dsh-mobile 0.6.2 → 0.6.3

package/lib/index.mjs

@@ -1,28 +1,29 @@
 import { createRequire } from "node:module";
-import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomBytes, timingSafeEqual } from "node:crypto";
+import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, win32 } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import z from "@deepseek-ai/schemastery";
 import { connect, createServer } from "node:net";
-import { chmod, copyFile, lstat, mkdir, mkdtemp, opendir, readFile, readdir, realpath, rename, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
+import { chmod, copyFile, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, realpath, rename, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
 import { execFile, spawn } from "node:child_process";
 import { createSocket } from "node:dgram";
 import { homedir, hostname, networkInterfaces, tmpdir } from "node:os";
 import { createServer as createServer$1, request } from "node:http";
 import { createServer as createServer$2, request as request$1 } from "node:https";
 import { Readable, Transform, finished } from "node:stream";
-import { pipeline } from "node:stream/promises";
+import { finished as finished$1, pipeline } from "node:stream/promises";
 import { promisify } from "node:util";
 import { createGzip, gzip } from "node:zlib";
 import Bonjour from "bonjour-service";
 import * as QRCode from "qrcode";
 import WebSocket, { WebSocketServer } from "ws";
 import { Logger, Service } from "@deepseek-ai/cordis";
+import { Worker } from "node:worker_threads";
 import { connect as connect$1 } from "node:tls";
 import { generate } from "selfsigned";
 import { boundContextSummary, createUserMessage } from "@deepseek-ai/dsh-llm/message";
 import { lookup } from "node:dns/promises";
-import { createWriteStream } from "node:fs";
+import { constants } from "node:fs";
 //#region src/access.ts
 /** Stable error categories converted to deliberately terse HTTP responses. */
 var AccessError = class extends Error {
@@ -860,9 +861,69 @@ var WebSocketPathStore = class {
 	}
 };
 //#endregion
+//#region src/extension-worker-config.ts
+function integer$1(value, name, fallback, minimum, maximum) {
+	const resolved = value ?? fallback;
+	if (typeof resolved !== "number" || !Number.isSafeInteger(resolved) || resolved < minimum || resolved > maximum) throw new Error(`hostExecution.${name} must be an integer from ${minimum} through ${maximum}`);
+	return resolved;
+}
+/** Resolve configuration once; reject malformed modes, ids and incoherent stream windows. */
+function resolveHostExecution(raw) {
+	if (raw !== void 0 && (raw === null || typeof raw !== "object" || Array.isArray(raw))) throw new Error("hostExecution must be an object");
+	const value = raw ?? {};
+	const mode = value.mode ?? "in-process";
+	if (mode !== "worker" && mode !== "in-process") throw new Error("hostExecution.mode is invalid");
+	if (value.extensions !== void 0 && (!Array.isArray(value.extensions) || value.extensions.some((id) => typeof id !== "string" || !/^[a-z][a-z0-9-]{0,63}$/u.test(id)) || new Set(value.extensions).size !== value.extensions.length)) throw new Error("hostExecution.extensions must contain unique local extension ids");
+	const streamWindowBytes = integer$1(value.streamWindowBytes, "streamWindowBytes", 262144, 1024, 4194304);
+	const streamChunkBytes = integer$1(value.streamChunkBytes, "streamChunkBytes", 65536, 1024, streamWindowBytes);
+	const streamAggregateBytes = integer$1(value.streamAggregateBytes, "streamAggregateBytes", 1048576, streamWindowBytes, 33554432);
+	return Object.freeze({
+		mode,
+		extensions: value.extensions === void 0 ? void 0 : Object.freeze([...value.extensions]),
+		maxWorkers: integer$1(value.maxWorkers, "maxWorkers", 8, 1, 128),
+		maxRegistrations: integer$1(value.maxRegistrations, "maxRegistrations", 256, 1, 4096),
+		maxOldGenerationSizeMb: integer$1(value.maxOldGenerationSizeMb, "maxOldGenerationSizeMb", 128, 16, 4096),
+		maxYoungGenerationSizeMb: integer$1(value.maxYoungGenerationSizeMb, "maxYoungGenerationSizeMb", 16, 1, 512),
+		stackSizeMb: integer$1(value.stackSizeMb, "stackSizeMb", 4, 1, 64),
+		activationTimeoutMs: integer$1(value.activationTimeoutMs, "activationTimeoutMs", 5e3, 1, 3e5),
+		operationTimeoutMs: integer$1(value.operationTimeoutMs, "operationTimeoutMs", 3e4, 1, 3e5),
+		cancelGraceMs: integer$1(value.cancelGraceMs, "cancelGraceMs", 250, 1, 3e4),
+		streamCancelGraceMs: integer$1(value.streamCancelGraceMs, "streamCancelGraceMs", 1e3, 1, 3e4),
+		disposeGraceMs: integer$1(value.disposeGraceMs, "disposeGraceMs", 2e3, 1, 3e4),
+		resultMaxBytes: integer$1(value.resultMaxBytes, "resultMaxBytes", 4194304, 1024, 4194304),
+		streamWindowBytes,
+		streamChunkBytes,
+		streamAggregateBytes,
+		logWindowMs: integer$1(value.logWindowMs, "logWindowMs", 1e3, 1, 6e4),
+		logMessagesPerWindow: integer$1(value.logMessagesPerWindow, "logMessagesPerWindow", 64, 1, 1024),
+		logMessageBytes: integer$1(value.logMessageBytes, "logMessageBytes", 4096, 128, 65536)
+	});
+}
+//#endregion
 //#region src/config.ts
 /** Loader-facing defaults; {@link parseGatewayConfig} enforces cross-field security rules. */
 const Config = z.object({
+	hostExecution: z.object({
+		mode: z.union([z.const("in-process"), z.const("worker")]),
+		extensions: z.union([z.const(void 0), z.array(String)]),
+		maxWorkers: z.natural(),
+		maxRegistrations: z.natural(),
+		maxOldGenerationSizeMb: z.natural(),
+		maxYoungGenerationSizeMb: z.natural(),
+		stackSizeMb: z.natural(),
+		activationTimeoutMs: z.natural(),
+		operationTimeoutMs: z.natural(),
+		cancelGraceMs: z.natural(),
+		streamCancelGraceMs: z.natural(),
+		disposeGraceMs: z.natural(),
+		resultMaxBytes: z.natural(),
+		streamWindowBytes: z.natural(),
+		streamChunkBytes: z.natural(),
+		streamAggregateBytes: z.natural(),
+		logWindowMs: z.natural(),
+		logMessagesPerWindow: z.natural(),
+		logMessageBytes: z.natural()
+	}),
 	setupFile: z.string().hidden(),
 	publicOrigin: z.string(),
 	listenHost: z.string(),
@@ -977,7 +1038,9 @@ function parsePublicOrigin$1(value) {
 	});
 }
 function parseTls(value, listenHost) {
+	if (value !== void 0 && (value === null || typeof value !== "object" || Array.isArray(value))) throw new Error("tls must be an object");
 	const mode = value?.mode ?? "provided";
+	if (value?.mode === null || mode !== "provided" && mode !== "disabled") throw new Error("tls.mode must be provided or disabled");
 	if (mode === "disabled") {
 		if (!isLoopbackAddress(listenHost)) throw new Error("TLS may be disabled only on an IP loopback listener");
 		return Object.freeze({ mode });
@@ -1024,6 +1087,7 @@ function parseGatewayConfig(raw) {
 	if (sessionTtlMs > deviceTtlMs) throw new Error("sessionTtlMs must not exceed deviceTtlMs");
 	return Object.freeze({
 		listenHost,
+		hostExecution: resolveHostExecution(value.hostExecution),
 		listenPort,
 		upstreamOrigin,
 		authorities: Object.freeze(authorities),
@@ -2258,6 +2322,660 @@ async function readComputerImage(path, signal) {
 	}
 }
 //#endregion
+//#region src/extension-worker.ts
+/** Supervise opt-in local hosts without executing extension code on the DSH thread. */
+/** JSON bytes serialized and size-checked inside the worker. */
+var PreparedJsonResult = class {
+	bytes;
+	constructor(bytes) {
+		this.bytes = bytes;
+	}
+};
+/** Identify worker results without invoking an extension serializer in the gateway. */
+function isPreparedJson(value) {
+	return value instanceof PreparedJsonResult;
+}
+/** Resolve the installed standalone entry adjacent to the plugin bundle. */
+function defaultExtensionWorkerModule() {
+	return new URL("./extension-worker-runtime.mjs", import.meta.url);
+}
+/** Every thread counts until actual exit, including activation, retirement and termination. */
+var ExtensionWorkerBudget = class {
+	maximum;
+	count = 0;
+	constructor(maximum) {
+		this.maximum = maximum;
+	}
+	get current() {
+		return this.count;
+	}
+	reserve() {
+		if (this.count >= this.maximum) throw new MobileExtensionError("extension_worker_limit", "local extension worker limit reached", 503);
+		this.count += 1;
+		let released = false;
+		return () => {
+			if (!released) {
+				released = true;
+				this.count -= 1;
+			}
+		};
+	}
+};
+/** Diagnostic count; production admission uses an instance-owned budget. */
+const activeWorkerCount = { current: 0 };
+const LIFECYCLE_ID = "lifecycle";
+/** Node accepts quoted NODE_OPTIONS words; inspect option names without exposing their values. */
+function nodeOptionWords(value) {
+	const words = [];
+	let word = "";
+	let quoted = false;
+	let escaped = false;
+	for (const character of value) {
+		if (escaped) {
+			word += character;
+			escaped = false;
+			continue;
+		}
+		if (character === "\\") {
+			escaped = true;
+			continue;
+		}
+		if (character === "\"") {
+			quoted = !quoted;
+			continue;
+		}
+		if (/\s/u.test(character) && !quoted) {
+			if (word !== "") {
+				words.push(word);
+				word = "";
+			}
+			continue;
+		}
+		word += character;
+	}
+	if (word !== "") words.push(word);
+	return words;
+}
+/** Known parent V8 heap flags take precedence over Worker resourceLimits. */
+function parentWorkerHeapOverrides(argv, nodeOptions) {
+	const heapFlags = /* @__PURE__ */ new Set([
+		"--max-old-space-size",
+		"--max-semi-space-size",
+		"--max-heap-size",
+		"--max-old-space-size-percentage"
+	]);
+	const found = /* @__PURE__ */ new Set();
+	for (const argument of [...argv, ...nodeOptionWords(nodeOptions ?? "")]) {
+		const name = argument.split("=", 1)[0].replaceAll("_", "-");
+		if (heapFlags.has(name)) found.add(name);
+	}
+	return Object.freeze([...found]);
+}
+const initialNodeOptions = process.env.NODE_OPTIONS;
+var ExtensionWorkerHost = class {
+	options;
+	limits;
+	worker;
+	pending = /* @__PURE__ */ new Map();
+	routePending = /* @__PURE__ */ new Map();
+	streams = /* @__PURE__ */ new Map();
+	detachedRoutes = /* @__PURE__ */ new Set();
+	executionGrace = /* @__PURE__ */ new Map();
+	exited;
+	unavailableController = new AbortController();
+	termination;
+	activation;
+	dead = false;
+	disposed = false;
+	maxBufferedBytes = 0;
+	cancelledStreams = 0;
+	logWindowStart = Date.now();
+	logCount = 0;
+	stdioBytes = 0;
+	stdioResume;
+	constructor(options) {
+		this.options = options;
+		this.limits = resolveHostExecution(options.limits);
+		const overrides = new Set(parentWorkerHeapOverrides(process.execArgv, initialNodeOptions));
+		for (const flag of parentWorkerHeapOverrides([], process.env.NODE_OPTIONS)) overrides.add(flag);
+		if (overrides.size > 0) throw new MobileExtensionError("extension_worker_heap_override", `worker heap limits require launching DSH without ${[...overrides].join(", ")}`, 503);
+		const release = options.budget?.reserve() ?? (() => void 0);
+		try {
+			this.worker = new Worker(options.workerModule, {
+				workerData: { limits: this.limits },
+				stdout: true,
+				stderr: true,
+				resourceLimits: {
+					maxOldGenerationSizeMb: this.limits.maxOldGenerationSizeMb,
+					maxYoungGenerationSizeMb: this.limits.maxYoungGenerationSizeMb,
+					stackSizeMb: this.limits.stackSizeMb
+				}
+			});
+		} catch (error) {
+			release();
+			throw error;
+		}
+		const drainConsole = (chunk) => {
+			this.stdioBytes += chunk.byteLength;
+			if (this.stdioBytes < this.limits.logMessageBytes * this.limits.logMessagesPerWindow || this.stdioResume !== void 0) return;
+			this.worker.stdout?.pause();
+			this.worker.stderr?.pause();
+			this.stdioResume = setTimeout(() => {
+				this.stdioResume = void 0;
+				this.stdioBytes = 0;
+				if (!this.dead) {
+					this.worker.stdout?.resume();
+					this.worker.stderr?.resume();
+				}
+			}, this.limits.logWindowMs);
+			this.stdioResume.unref();
+		};
+		this.worker.stdout?.on("data", drainConsole);
+		this.worker.stderr?.on("data", drainConsole);
+		this.worker.unref();
+		activeWorkerCount.current += 1;
+		this.exited = new Promise((resolve) => {
+			this.worker.once("exit", () => {
+				this.dead = true;
+				if (this.stdioResume !== void 0) clearTimeout(this.stdioResume);
+				this.markUnavailable();
+				release();
+				activeWorkerCount.current -= 1;
+				for (const timer of this.executionGrace.values()) clearTimeout(timer);
+				this.executionGrace.clear();
+				const error = this.unavailable();
+				for (const entry of this.pending.values()) {
+					entry.cleanup();
+					entry.reject(error);
+				}
+				for (const entry of this.routePending.values()) {
+					entry.cleanup();
+					entry.reject(error);
+				}
+				this.pending.clear();
+				this.routePending.clear();
+				this.detachedRoutes.clear();
+				for (const live of this.streams.values()) {
+					if (live.cancelTimer !== void 0) clearTimeout(live.cancelTimer);
+					live.bridge.destroy(error);
+				}
+				this.streams.clear();
+				resolve();
+			});
+		});
+		this.worker.on("message", (raw) => {
+			try {
+				this.handleMessage(raw);
+			} catch (error) {
+				this.terminate("invalid-worker-message");
+			}
+		});
+		this.worker.on("error", () => {
+			this.terminate("worker-error");
+		});
+	}
+	/** A stopped generation never silently respawns. */
+	available() {
+		return !this.dead && this.termination === void 0 && !this.disposed && !this.unavailableController.signal.aborted;
+	}
+	/** Activate once and receive executable-free registration metadata. */
+	async activate() {
+		let timer;
+		try {
+			const reply = new Promise((resolve, reject) => {
+				this.pending.set(LIFECYCLE_ID, {
+					resolve,
+					reject,
+					cleanup: () => void 0
+				});
+				this.post({
+					kind: "activate",
+					id: LIFECYCLE_ID,
+					hostFile: this.options.hostFile,
+					generation: this.options.generation,
+					manifest: this.options.manifest
+				});
+			});
+			await Promise.race([reply, new Promise((_, reject) => {
+				timer = setTimeout(() => reject(new MobileExtensionError("host_load_timeout", "extension worker activation timed out", 500)), this.options.activationTimeoutMs ?? this.limits.activationTimeoutMs);
+			})]);
+			if (this.activation === void 0) throw new MobileExtensionError("host_activation_failed", "extension worker activation failed", 500);
+			return this.activation;
+		} catch (error) {
+			await this.terminate("activation-failed");
+			throw error;
+		} finally {
+			if (timer !== void 0) clearTimeout(timer);
+		}
+	}
+	actionMetadata() {
+		return this.activation?.actions ?? [];
+	}
+	routeMetadata() {
+		return this.activation?.routes ?? [];
+	}
+	/** Underlying action: settles only when execution completes or the thread exits. */
+	invokeExecution(action, input, caller) {
+		if (!this.available()) return Promise.reject(this.unavailable());
+		if (caller.signal.aborted) return Promise.reject(caller.signal.reason);
+		const id = randomUUID();
+		return new Promise((resolve, reject) => {
+			const onAbort = () => {
+				this.post({
+					kind: "cancel",
+					id
+				});
+				this.armExecutionGrace(id);
+			};
+			caller.signal.addEventListener("abort", onAbort, { once: true });
+			this.pending.set(id, {
+				resolve,
+				reject,
+				cleanup: () => {
+					caller.signal.removeEventListener("abort", onAbort);
+					this.settleExecutionGrace(id);
+				}
+			});
+			try {
+				this.post({
+					kind: "invoke",
+					id,
+					action,
+					deviceId: caller.deviceId,
+					input
+				});
+			} catch (error) {
+				this.pending.get(id)?.cleanup();
+				this.pending.delete(id);
+				reject(error instanceof Error ? error : new Error(String(error)));
+			}
+		});
+	}
+	/** Direct caller budget; service dispatch observes invokeExecution separately. */
+	invoke(action, input, caller) {
+		return this.callerBudget((signal) => this.invokeExecution(action, input, {
+			...caller,
+			signal
+		}), caller.signal, this.actionMetadata().find((entry) => entry.name === action)?.timeoutMs ?? this.limits.operationTimeoutMs, "extension_action_timeout");
+	}
+	/** Underlying route: late streams are cancelled and observed to confirmed end. */
+	handleRouteExecution(routeIndex, request) {
+		if (!this.available()) return Promise.reject(this.unavailable());
+		if (request.signal.aborted) return Promise.reject(request.signal.reason);
+		const id = randomUUID();
+		return new Promise((resolve, reject) => {
+			const onAbort = () => {
+				this.post({
+					kind: "cancel",
+					id
+				});
+				if (this.routePending.has(id)) {
+					this.detachedRoutes.add(id);
+					this.armExecutionGrace(id);
+				}
+				this.cancelStream(id);
+			};
+			request.signal.addEventListener("abort", onAbort, { once: true });
+			this.routePending.set(id, {
+				resolve,
+				reject,
+				cleanup: () => {
+					request.signal.removeEventListener("abort", onAbort);
+					this.settleExecutionGrace(id);
+				}
+			});
+			try {
+				this.post({
+					kind: "route",
+					id,
+					routeIndex,
+					method: request.method,
+					path: request.pathname,
+					query: [...request.query.entries()],
+					headers: request.headers,
+					body: new Uint8Array(request.body),
+					deviceId: request.deviceId
+				});
+			} catch (error) {
+				this.routePending.get(id)?.cleanup();
+				this.routePending.delete(id);
+				reject(error instanceof Error ? error : new Error(String(error)));
+			}
+		});
+	}
+	/** Handler budget ends at stream-start; stream lifetime remains cancellation-bound. */
+	handleRoute(routeIndex, request) {
+		return this.callerBudget((signal) => this.handleRouteExecution(routeIndex, {
+			...request,
+			signal
+		}), request.signal, this.routeMetadata()[routeIndex]?.timeoutMs ?? this.limits.operationTimeoutMs, "extension_route_timeout", true);
+	}
+	async callerBudget(start, external, timeoutMs, code, holdForStream = false) {
+		const controller = new AbortController();
+		let timer;
+		let detach;
+		const onAbort = () => {
+			controller.abort(external.reason);
+			detach?.(external.reason ?? new MobileExtensionError("extension_cancelled", "caller cancelled", 409));
+		};
+		const onUnavailable = () => {
+			detach?.(this.unavailableController.signal.reason);
+		};
+		if (external.aborted) throw external.reason;
+		if (!this.available()) throw this.unavailable();
+		external.addEventListener("abort", onAbort, { once: true });
+		this.unavailableController.signal.addEventListener("abort", onUnavailable, { once: true });
+		const release = () => {
+			external.removeEventListener("abort", onAbort);
+			this.unavailableController.signal.removeEventListener("abort", onUnavailable);
+			if (timer !== void 0) clearTimeout(timer);
+		};
+		let retained = false;
+		try {
+			const result = await Promise.race([start(controller.signal), new Promise((_, reject) => {
+				detach = reject;
+				timer = setTimeout(() => {
+					const error = new MobileExtensionError(code, "extension operation timed out", 500);
+					controller.abort(error);
+					reject(error);
+				}, timeoutMs);
+			})]);
+			if (holdForStream && result !== null && typeof result === "object" && "body" in result && result.body instanceof Readable) {
+				retained = true;
+				result.body.once("close", release);
+				result.body.once("end", release);
+			}
+			return result;
+		} finally {
+			if (timer !== void 0) clearTimeout(timer);
+			if (!retained) release();
+		}
+	}
+	streamStats() {
+		return {
+			activeStreams: [...this.streams.values()].filter((live) => !live.ended).length,
+			maxBufferedBytes: this.maxBufferedBytes,
+			cancelledStreams: this.cancelledStreams,
+			bufferedBytes: this.totalUnacked()
+		};
+	}
+	/** Graceful effects cleanup followed by termination; completion requires actual exit. */
+	async dispose() {
+		if (!this.available()) {
+			await this.terminate("dispose-unavailable");
+			return;
+		}
+		this.disposed = true;
+		let timer;
+		try {
+			const reply = new Promise((resolve, reject) => {
+				this.pending.set(LIFECYCLE_ID, {
+					resolve,
+					reject,
+					cleanup: () => void 0
+				});
+				this.post({
+					kind: "dispose",
+					id: LIFECYCLE_ID
+				});
+			});
+			await Promise.race([reply, new Promise((resolve) => {
+				timer = setTimeout(resolve, this.limits.disposeGraceMs);
+			})]);
+		} finally {
+			if (timer !== void 0) clearTimeout(timer);
+			await this.terminate("disposed");
+		}
+	}
+	whenExited() {
+		return this.exited;
+	}
+	/** Stop admission now, retain execution/budget ownership until confirmed thread exit. */
+	terminate(reason) {
+		this.markUnavailable();
+		this.termination ??= (async () => {
+			if (!this.dead) await this.worker.terminate();
+			await this.exited;
+		})();
+		this.termination.catch(() => void 0);
+		return this.termination;
+	}
+	unavailable() {
+		return new MobileExtensionError("extension_host_unavailable", `extension ${this.options.manifest.id} worker is unavailable; explicit recovery is required`, 503);
+	}
+	markUnavailable() {
+		if (this.unavailableController.signal.aborted) return;
+		const error = this.unavailable();
+		this.unavailableController.abort(error);
+		try {
+			this.options.onUnavailable?.(error);
+		} catch (cause) {}
+	}
+	armExecutionGrace(id) {
+		if (this.executionGrace.has(id) || !this.available()) return;
+		const timer = setTimeout(() => {
+			this.executionGrace.delete(id);
+			if (this.pending.has(id) || this.routePending.has(id)) this.terminate("cancel-unresponsive");
+		}, this.limits.cancelGraceMs);
+		timer.unref();
+		this.executionGrace.set(id, timer);
+	}
+	settleExecutionGrace(id) {
+		const timer = this.executionGrace.get(id);
+		if (timer !== void 0) clearTimeout(timer);
+		this.executionGrace.delete(id);
+	}
+	post(message) {
+		if (!this.dead && this.termination === void 0) this.worker.postMessage(message);
+	}
+	handleMessage(raw) {
+		if (this.dead || raw === null || typeof raw !== "object") return;
+		const message = raw;
+		if (message.kind === "log") {
+			if (message.level !== "debug" && message.level !== "info" && message.level !== "warn" && message.level !== "error") return;
+			if (!Array.isArray(message.args) || message.args.some((arg) => typeof arg !== "string")) return;
+			if (Date.now() - this.logWindowStart >= this.limits.logWindowMs) {
+				this.logWindowStart = Date.now();
+				this.logCount = 0;
+			}
+			if (++this.logCount > this.limits.logMessagesPerWindow || Buffer.byteLength(message.args.join("")) > this.limits.logMessageBytes) return;
+			try {
+				this.options.logger[message.level](...message.args);
+			} catch (error) {}
+			return;
+		}
+		if (typeof message.runtimeId !== "string") return;
+		if (this.activation !== void 0 && message.runtimeId !== this.activation.runtimeId) return;
+		if (message.kind === "activated") {
+			if (this.activation !== void 0 || !Array.isArray(message.actions) || !Array.isArray(message.routes)) throw new Error("invalid activation metadata");
+			const actions = message.actions;
+			const routes = message.routes;
+			if (actions.length + routes.length > this.limits.maxRegistrations) throw new Error("worker registration limit exceeded");
+			for (const action of actions) if (typeof action?.name !== "string" || !/^[a-z][a-z0-9-]{0,63}$/u.test(action.name)) throw new Error("invalid action metadata");
+			for (const route of routes) if (typeof route?.method !== "string" || typeof route.path !== "string") throw new Error("invalid route metadata");
+			this.activation = Object.freeze({
+				runtimeId: message.runtimeId,
+				actions: Object.freeze(actions),
+				routes: Object.freeze(routes)
+			});
+			const pending = this.pending.get(LIFECYCLE_ID);
+			this.pending.delete(LIFECYCLE_ID);
+			pending?.cleanup();
+			pending?.resolve(new PreparedJsonResult(Buffer.alloc(0)));
+			return;
+		}
+		if (typeof message.id !== "string") return;
+		const id = message.id;
+		if (message.kind === "result" || message.kind === "error") {
+			const pending = this.pending.get(id);
+			this.pending.delete(id);
+			pending?.cleanup();
+			if (message.kind === "result") {
+				if (!(message.bytes instanceof Uint8Array) || message.bytes.byteLength > this.limits.resultMaxBytes) {
+					pending?.reject(new MobileExtensionError("extension_failed", "invalid worker result", 500));
+					return;
+				}
+				pending?.resolve(new PreparedJsonResult(Buffer.from(message.bytes)));
+			} else {
+				const error = new MobileExtensionError(typeof message.code === "string" ? message.code.slice(0, 64) : "extension_failed", typeof message.message === "string" ? message.message.slice(0, 500) : "extension failed", typeof message.status === "number" && Number.isInteger(message.status) && message.status >= 400 && message.status <= 599 ? message.status : 500);
+				pending?.reject(error);
+				const route = this.routePending.get(id);
+				this.routePending.delete(id);
+				this.detachedRoutes.delete(id);
+				route?.cleanup();
+				route?.reject(error);
+			}
+			return;
+		}
+		if (message.kind === "route-response" || message.kind === "stream-start") {
+			const route = this.routePending.get(id);
+			if (route === void 0) {
+				if (message.kind === "stream-start") this.post({
+					kind: "stream-cancel",
+					id
+				});
+				return;
+			}
+			if (message.kind === "stream-start" && this.detachedRoutes.has(id)) {
+				this.cancelledStreams += 1;
+				this.post({
+					kind: "stream-cancel",
+					id
+				});
+				return;
+			}
+			const response = responseMetadata(message);
+			this.routePending.delete(id);
+			this.detachedRoutes.delete(id);
+			if (message.kind === "route-response") {
+				route.cleanup();
+				if (!(message.bytes instanceof Uint8Array) || message.bytes.byteLength > this.limits.resultMaxBytes) {
+					route.reject(new MobileExtensionError("invalid_route_response", "invalid worker route response", 500));
+					return;
+				}
+				route.resolve({
+					...response,
+					body: Buffer.from(message.bytes)
+				});
+			} else {
+				this.settleExecutionGrace(id);
+				const live = this.openStream(id, route.cleanup);
+				route.resolve({
+					...response,
+					body: live.bridge
+				});
+			}
+			return;
+		}
+		if (message.kind === "stream-chunk") {
+			const live = this.streams.get(id);
+			if (live === void 0 || live.ended || live.bridge.destroyed) return;
+			if (!(message.bytes instanceof Uint8Array) || message.bytes.byteLength > this.limits.streamChunkBytes || live.unacked + message.bytes.byteLength > this.limits.streamWindowBytes || this.totalUnacked() + message.bytes.byteLength > this.limits.streamAggregateBytes) throw new Error("worker exceeded stream credit");
+			live.unacked += message.bytes.byteLength;
+			this.maxBufferedBytes = Math.max(this.maxBufferedBytes, this.totalUnacked());
+			live.bridge.push(Buffer.from(message.bytes));
+			return;
+		}
+		if (message.kind === "stream-end" || message.kind === "stream-error") {
+			this.settleExecutionGrace(id);
+			const detached = this.routePending.get(id);
+			if (this.detachedRoutes.delete(id)) {
+				this.routePending.delete(id);
+				detached?.cleanup();
+				detached?.reject(new MobileExtensionError("extension_cancelled", "caller detached", 409));
+			}
+			const live = this.streams.get(id);
+			if (live === void 0) return;
+			live.ended = true;
+			if (live.cancelTimer !== void 0) clearTimeout(live.cancelTimer);
+			if (message.kind === "stream-error") live.bridge.destroy(new Error(typeof message.message === "string" ? message.message.slice(0, 500) : "worker stream failed"));
+			else if (live.bridge.destroyed) this.streams.delete(id);
+			else live.bridge.push(null);
+		}
+	}
+	totalUnacked() {
+		let total = 0;
+		for (const live of this.streams.values()) total += live.unacked;
+		return total;
+	}
+	openStream(id, cleanup) {
+		const live = {
+			bridge: new WorkerStreamBridge((bytes) => {
+				live.unacked -= bytes;
+				this.post({
+					kind: "stream-ack",
+					id,
+					bytes
+				});
+			}),
+			unacked: 0,
+			ended: false
+		};
+		live.bridge.on("error", () => void 0);
+		const settle = () => {
+			cleanup();
+			if (live.ended) {
+				if (live.unacked > 0) this.post({
+					kind: "stream-cancel",
+					id
+				});
+				this.streams.delete(id);
+			} else this.cancelStream(id);
+		};
+		live.bridge.once("end", settle);
+		live.bridge.once("close", settle);
+		this.streams.set(id, live);
+		return live;
+	}
+	cancelStream(id) {
+		const live = this.streams.get(id);
+		if (live === void 0 || live.ended || live.cancelTimer !== void 0) return;
+		this.cancelledStreams += 1;
+		this.post({
+			kind: "stream-cancel",
+			id
+		});
+		live.cancelTimer = setTimeout(() => {
+			if (!live.ended) this.terminate("stream-cancel-unresponsive");
+		}, this.limits.streamCancelGraceMs);
+		live.cancelTimer.unref();
+		live.bridge.destroy();
+	}
+};
+function responseMetadata(message) {
+	const headers = {};
+	let bytes = typeof message.contentType === "string" ? Buffer.byteLength(message.contentType) : 0;
+	if (message.headers !== void 0) {
+		if (message.headers === null || typeof message.headers !== "object" || Array.isArray(message.headers)) throw new Error("invalid response headers");
+		const entries = Object.entries(message.headers);
+		if (entries.length > 3) throw new Error("invalid response header count");
+		for (const [key, value] of entries) {
+			if (typeof value !== "string" || !/^(?:content-disposition|cache-control|etag)$/iu.test(key)) throw new Error("invalid response header");
+			bytes += Buffer.byteLength(key) + Buffer.byteLength(value);
+			if (bytes > 16384) throw new Error("invalid response header bytes");
+			headers[key] = value;
+		}
+	}
+	return {
+		...typeof message.status === "number" ? { status: message.status } : {},
+		...typeof message.contentType === "string" ? { contentType: message.contentType } : {},
+		...message.headers === void 0 ? {} : { headers }
+	};
+}
+/** Credit belongs to bytes actually removed by the consumer, including reads after source EOF. */
+var WorkerStreamBridge = class extends Readable {
+	consume;
+	constructor(consume) {
+		super({ highWaterMark: 16384 });
+		this.consume = consume;
+	}
+	_read() {}
+	emit(event, ...args) {
+		if (event === "data" && Buffer.isBuffer(args[0])) this.consume(args[0].byteLength);
+		return super.emit(event, ...args);
+	}
+};
+//#endregion
 //#region src/extensions.ts
 /** Maximum sizes enforced at the local-extension filesystem boundary. */
 const EXTENSION_LIMITS = Object.freeze({
@@ -2599,6 +3317,11 @@ var MobileAccessService = class extends Service {
 	localRefreshAbort;
 	localLifecycle = 0;
 	localClosed = true;
+	localExecution;
+	localExecutionKey;
+	workerBudget;
+	disposal = /* @__PURE__ */ new Set();
+	recoveries = /* @__PURE__ */ new Map();
 	constructor(ctx) {
 		super(ctx, "mobileAccess");
 	}
@@ -2660,10 +3383,65 @@ var MobileAccessService = class extends Service {
 	}
 	/** Return loaded and failed local extension counts without exposing host errors. */
 	status() {
+		const unavailable = [...this.local.values()].filter((entry) => entry.worker !== void 0 && !entry.worker.available()).length;
 		return Object.freeze({
-			loaded: this.registered.size + this.local.size,
-			failed: this.failures.size
+			loaded: this.registered.size + this.local.size - unavailable,
+			failed: this.failures.size + unavailable
+		});
+	}
+	/** Local Host status does not reveal filesystem paths, credentials or extension errors. */
+	hostStatus() {
+		const limits = resolveHostExecution(this.localExecution?.hostExecution);
+		return {
+			hosts: [...this.local.values()].map((entry) => ({
+				id: entry.manifest.id,
+				name: entry.manifest.name,
+				mode: entry.worker === void 0 ? "in-process" : "worker",
+				state: entry.worker === void 0 || entry.worker.available() ? "ready" : "unavailable",
+				generation: entry.digest
+			})),
+			limits: {
+				maxWorkers: limits.maxWorkers,
+				workers: this.workerBudget?.current ?? 0
+			}
+		};
+	}
+	/** Explicitly replace one unavailable worker without replaying requests or changing its files. */
+	recoverExtension(id) {
+		assertExtensionId(id);
+		const existing = this.recoveries.get(id);
+		if (existing !== void 0) return existing;
+		const recovering = (async () => {
+			if (this.localRefreshing !== void 0) await this.localRefreshing;
+			const previous = this.local.get(id);
+			if (this.localClosed || previous?.worker === void 0 || this.localContext === void 0) throw new MobileExtensionError("extension_recovery_unavailable", "local worker recovery is unavailable", 409);
+			if (previous.worker.available()) throw new MobileExtensionError("extension_host_running", "extension worker is already running", 409);
+			await previous.worker.terminate("explicit-recovery");
+			const lifecycle = this.localLifecycle;
+			const fingerprint = await extensionFingerprint(previous.directory);
+			const fresh = await loadLocalExtension(previous.directory, this.localContext, fingerprint, void 0, this.localExecution);
+			try {
+				const confirmed = await extensionFingerprint(previous.directory);
+				if (this.localClosed || this.localLifecycle !== lifecycle || this.local.get(id) !== previous || confirmed.digest !== fingerprint.digest) throw new MobileExtensionError("extension_changed_during_activation", "extension changed during recovery", 409);
+			} catch (error) {
+				await abortAndDisposeLocal([fresh]);
+				throw error;
+			}
+			this.local.set(id, fresh);
+			this.failures.delete(id);
+			this.queueDisposal([previous]);
+			this.updateContentHash();
+		})().finally(() => {
+			if (this.recoveries.get(id) === recovering) this.recoveries.delete(id);
+		});
+		this.recoveries.set(id, recovering);
+		return recovering;
+	}
+	queueDisposal(entries) {
+		const pending = abortAndDisposeLocal(entries).finally(() => {
+			this.disposal.delete(pending);
 		});
+		this.disposal.add(pending);
 	}
 	/** Locate one active extension. */
 	extension(id, generation) {
@@ -2753,7 +3531,7 @@ var MobileAccessService = class extends Service {
 				});
 			}, {
 				external: external?.signal ?? context.signal,
-				timeoutMs: action.timeoutMs ?? 3e4,
+				timeoutMs: action.timeoutMs ?? ("host" in extension && extension.worker !== void 0 ? resolveHostExecution(this.localExecution?.hostExecution).operationTimeoutMs : 3e4),
 				timeoutError: () => new MobileExtensionError("extension_action_timeout", `extension ${id} action ${actionName} timed out`, 500),
 				onDetach: () => {
 					this.abandoned.set(id, (this.abandoned.get(id) ?? 0) + 1);
@@ -2791,7 +3569,7 @@ var MobileAccessService = class extends Service {
 				signal
 			}), {
 				external: external?.signal ?? request.signal,
-				timeoutMs: route.timeoutMs ?? 3e4,
+				timeoutMs: route.timeoutMs ?? ("host" in extension && extension.worker !== void 0 ? resolveHostExecution(this.localExecution?.hostExecution).operationTimeoutMs : 3e4),
 				timeoutError: () => new MobileExtensionError("extension_route_timeout", `extension ${id} route ${method} ${pathname} timed out`, 500),
 				onDetach: () => {
 					this.abandoned.set(id, (this.abandoned.get(id) ?? 0) + 1);
@@ -2823,13 +3601,24 @@ var MobileAccessService = class extends Service {
 		}
 	}
 	/** Start the local directory watcher; an absent directory is intentionally inert. */
-	async startLocal(root, context) {
+	async startLocal(root, context, options) {
 		const targetRoot = resolve(root);
-		if (this.localRoot !== void 0 && resolve(this.localRoot) !== targetRoot) await this.stopLocal();
+		const limits = resolveHostExecution(options?.hostExecution);
+		const executionKey = JSON.stringify({
+			limits,
+			module: options?.hostExecution?.workerModule
+		});
+		if (this.localRoot !== void 0 && (resolve(this.localRoot) !== targetRoot || this.localExecutionKey !== executionKey)) await this.stopLocal();
 		if (this.localTimer !== void 0) clearInterval(this.localTimer);
 		const lifecycle = ++this.localLifecycle;
+		this.workerBudget ??= new ExtensionWorkerBudget(limits.maxWorkers);
 		this.localRoot = targetRoot;
 		this.localContext = context;
+		this.localExecution = {
+			...options,
+			workerBudget: this.workerBudget
+		};
+		this.localExecutionKey = executionKey;
 		this.localClosed = false;
 		await mkdir(this.localRoot, { recursive: true });
 		if (this.localClosed || this.localLifecycle !== lifecycle || this.localRoot !== targetRoot || this.localContext !== context) return;
@@ -2863,6 +3652,8 @@ var MobileAccessService = class extends Service {
 		this.failures.clear();
 		this.updateContentHash();
 		await abortAndDisposeLocal(late);
+		await Promise.allSettled([...this.disposal, ...this.recoveries.values()]);
+		this.workerBudget = void 0;
 		if (this.localTimer !== void 0) clearInterval(this.localTimer);
 		this.localTimer = void 0;
 	}
@@ -2906,7 +3697,7 @@ var MobileAccessService = class extends Service {
 				const previous = current?.digest === fingerprint.digest ? current : retired?.digest === fingerprint.digest ? retired : void 0;
 				if (previous?.digest === fingerprint.digest) staged.push(previous);
 				else {
-					const fresh = await loadLocalExtension(directory, this.localContext, fingerprint, signal);
+					const fresh = await loadLocalExtension(directory, this.localContext, fingerprint, signal, this.localExecution);
 					try {
 						signal.throwIfAborted();
 						if ((await extensionFingerprint(directory)).digest !== fingerprint.digest) throw new MobileExtensionError("extension_changed_during_activation", `extension ${fingerprint.manifest.id} changed during activation`, 409);
@@ -2957,13 +3748,15 @@ var MobileAccessService = class extends Service {
 			for (const name of names) this.failures.delete(name);
 			for (const failure of this.failures.keys()) if (failure !== "local" && !names.includes(failure)) this.failures.delete(failure);
 			this.failures.delete("local");
-			if (removed.length > 0) abortAndDisposeLocal(removed);
+			if (removed.length > 0) this.queueDisposal(removed);
 			this.updateContentHash();
 		} catch (error) {
 			await abortAndDisposeLocal(stagedFresh);
 			if (this.localClosed || signal.aborted) return;
 			const message = error instanceof Error ? error.message : String(error);
+			const changedFailure = this.failures.get(failingName) !== message;
 			this.failures.set(failingName, message);
+			if (changedFailure && error instanceof MobileExtensionError && error.code === "extension_worker_heap_override") this.ctx.logger.warn("local extension worker refused: %s", error.message);
 			if (!(error instanceof MobileExtensionError)) this.ctx.logger.warn(error instanceof Error ? error : new Error(String(error)));
 		}
 	}
@@ -2973,12 +3766,12 @@ var MobileAccessService = class extends Service {
 		if (previous !== void 0) {
 			clearTimeout(previous.timer);
 			this.retired.delete(active.manifest.id);
-			abortAndDisposeLocal([previous.active]);
+			this.queueDisposal([previous.active]);
 		}
 		const timer = setTimeout(() => {
 			if (this.retired.get(active.manifest.id)?.active !== active) return;
 			this.retired.delete(active.manifest.id);
-			abortAndDisposeLocal([active]);
+			this.queueDisposal([active]);
 		}, RETIRED_GENERATION_TTL_MS);
 		timer.unref();
 		this.retired.set(active.manifest.id, {
@@ -3100,8 +3893,9 @@ async function abortAndDisposeLocal(entries) {
 		pending.push(...invokeCleanups(entry.cleanups));
 	}
 	await settleBounded(pending, HOST_TEARDOWN_TIMEOUT_MS);
+	await Promise.all(entries.flatMap((entry) => entry.worker === void 0 ? [] : [entry.worker.dispose()]));
 }
-async function loadLocalExtension(directory, context, known, parentSignal) {
+async function loadLocalExtension(directory, context, known, parentSignal, execution) {
 	const root = await realExtensionRoot(directory);
 	const manifestFile = await regularFile$3(join(root, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
 	const manifest = known?.manifest ?? parseExtensionManifest(JSON.parse(await readFile(manifestFile.path, "utf8")));
@@ -3153,28 +3947,73 @@ async function loadLocalExtension(directory, context, known, parentSignal) {
 		}
 	};
 	try {
-		const activate = async () => {
-			controller.signal.throwIfAborted();
-			if (hostFile !== void 0) {
-				const digest = createHash("sha256").update(await readFile(hostFile)).digest("hex");
+		const limits = resolveHostExecution(execution?.hostExecution);
+		const worker = limits.mode === "worker" && (limits.extensions === void 0 || limits.extensions.includes(manifest.id)) && hostFile !== void 0 ? new ExtensionWorkerHost({
+			workerModule: execution?.hostExecution?.workerModule ?? defaultExtensionWorkerModule(),
+			hostFile,
+			manifest,
+			generation: known?.digest ?? createHash("sha256").update(manifest.id).digest("hex"),
+			logger: workerLoggerAdapter(context),
+			limits,
+			...execution?.workerBudget === void 0 ? {} : { budget: execution.workerBudget },
+			onUnavailable: (error) => {
+				controller.abort(error);
+			}
+		}) : void 0;
+		let host;
+		if (worker !== void 0) {
+			try {
+				await withActivationTimeout(worker.activate(), manifest.id, controller.signal);
+			} catch (error) {
+				await worker.terminate("activation-failed");
+				throw error;
+			}
+			const proxyActions = {};
+			for (const metadata of worker.actionMetadata()) proxyActions[metadata.name] = {
+				...metadata.timeoutMs === void 0 ? {} : { timeoutMs: metadata.timeoutMs },
+				run: (actionContext, input) => worker.invokeExecution(metadata.name, input, actionContext)
+			};
+			const proxyRoutes = worker.routeMetadata().map((metadata, index) => ({
+				method: metadata.method,
+				path: metadata.path,
+				...metadata.kind === void 0 ? {} : { kind: metadata.kind },
+				...metadata.timeoutMs === void 0 ? {} : { timeoutMs: metadata.timeoutMs },
+				handle: (request) => worker.handleRouteExecution(index, request)
+			}));
+			try {
+				host = validateDefinition({
+					...manifest,
+					...Object.keys(proxyActions).length === 0 ? {} : { actions: proxyActions },
+					...proxyRoutes.length === 0 ? {} : { routes: proxyRoutes }
+				});
+			} catch (error) {
+				await worker.terminate("definition-invalid");
+				throw error;
+			}
+		} else {
+			const activate = async () => {
 				controller.signal.throwIfAborted();
-				let imported;
-				try {
-					imported = await import(`${pathToFileURL(hostFile).href}?dsh_generation=${digest}`);
-				} catch {
-					throw new MobileExtensionError("host_load_failed", `could not load ${manifest.id}/host.mjs`, 500);
+				if (hostFile !== void 0) {
+					const digest = createHash("sha256").update(await readFile(hostFile)).digest("hex");
+					controller.signal.throwIfAborted();
+					let imported;
+					try {
+						imported = await import(`${pathToFileURL(hostFile).href}?dsh_generation=${digest}`);
+					} catch {
+						throw new MobileExtensionError("host_load_failed", `could not load ${manifest.id}/host.mjs`, 500);
+					}
+					controller.signal.throwIfAborted();
+					if (imported.default !== void 0) await imported.default(api);
 				}
-				controller.signal.throwIfAborted();
-				if (imported.default !== void 0) await imported.default(api);
-			}
-			await Promise.all(pendingEffects);
-		};
-		await withActivationTimeout(activate(), manifest.id, controller.signal);
-		const host = validateDefinition({
-			...manifest,
-			actions,
-			routes
-		});
+				await Promise.all(pendingEffects);
+			};
+			await withActivationTimeout(activate(), manifest.id, controller.signal);
+			host = validateDefinition({
+				...manifest,
+				actions,
+				routes
+			});
+		}
 		activationOpen = false;
 		const digest = known?.digest ?? createHash("sha256").update(manifest.id).digest("hex");
 		return Object.freeze({
@@ -3186,7 +4025,8 @@ async function loadLocalExtension(directory, context, known, parentSignal) {
 			host,
 			controller,
 			cleanups: Object.freeze(cleanups),
-			digest
+			digest,
+			...worker === void 0 ? {} : { worker }
 		});
 	} catch (error) {
 		activationOpen = false;
@@ -3198,6 +4038,23 @@ async function loadLocalExtension(directory, context, known, parentSignal) {
 		parentSignal?.removeEventListener("abort", onParentAbort);
 	}
 }
+/** Forward the worker's logger-only context adapter into the plugin logger. */
+function workerLoggerAdapter(context) {
+	return {
+		debug: (...args) => {
+			context.logger.debug(...args);
+		},
+		info: (...args) => {
+			context.logger.info(...args);
+		},
+		warn: (...args) => {
+			context.logger.warn(...args);
+		},
+		error: (...args) => {
+			context.logger.error(...args);
+		}
+	};
+}
 /** Construct the service in a Cordis plugin without importing DSH internals. */
 function createMobileAccessService(ctx) {
 	return new MobileAccessService(ctx);
@@ -4992,7 +5849,8 @@ var MobileAccessGateway = class {
 		}
 		const stockFrontend = new URL(target.raw, this.address().origin).searchParams.get("frontend") === "stock";
 		const acceptsHtml = request.headers.accept?.split(",").some((value) => value.trim().split(";", 1)[0] === "text/html") ?? false;
-		if (request.method === "GET" && acceptsHtml && !stockFrontend) {
+		const frontendDocument = target.decodedPathname === "/" || target.decodedPathname === "/index.html";
+		if (request.method === "GET" && frontendDocument && acceptsHtml && !stockFrontend) {
 			await this.proxyMobileIndex(request, response, authorization);
 			return;
 		}
@@ -5101,14 +5959,27 @@ var MobileAccessGateway = class {
 					signal: abort.signal,
 					deviceId: authorization.deviceId
 				}, generation);
-				let serialized;
-				try {
-					serialized = Buffer.from(JSON.stringify(result));
-				} catch {
-					throw new MobileExtensionError("extension_failed", "extension action failed", 500);
+				if (isPreparedJson(result)) {
+					if (result.bytes.byteLength > 4194304) throw new MobileExtensionError("extension_result_too_large", "extension result is too large", 500);
+					if (!response.headersSent && !response.destroyed) {
+						const body = Buffer.concat([result.bytes, Buffer.from("\n")]);
+						setSecurityHeaders(response, this.tlsEnabled);
+						response.writeHead(200, {
+							"Content-Type": "application/json; charset=utf-8",
+							"Content-Length": body.byteLength
+						});
+						response.end(body);
+					}
+				} else {
+					let serialized;
+					try {
+						serialized = Buffer.from(JSON.stringify(result));
+					} catch {
+						throw new MobileExtensionError("extension_failed", "extension action failed", 500);
+					}
+					if (serialized.byteLength > 4194304) throw new MobileExtensionError("extension_result_too_large", "extension result is too large", 500);
+					sendJson(response, 200, result, this.tlsEnabled);
 				}
-				if (serialized.byteLength > 4194304) throw new MobileExtensionError("extension_result_too_large", "extension result is too large", 500);
-				sendJson(response, 200, result, this.tlsEnabled);
 			} finally {
 				generationSignal?.removeEventListener("abort", onGenerationAbort);
 				abort.abort();
@@ -5371,7 +6242,7 @@ var MobileAccessGateway = class {
 					hostname: stripIpv6Brackets(this.config.upstreamOrigin.hostname),
 					port: Number(this.config.upstreamOrigin.port),
 					method: "GET",
-					path: "/",
+					path: incoming?.url ?? "/",
 					headers,
 					agent: false
 				});
@@ -6436,12 +7307,180 @@ var MemoryDeviceStore = class {
 	}
 };
 //#endregion
-//#region src/frp-component.ts
-const FRP_VERSION$1 = "0.70.1";
-const MAX_ARCHIVE_ENTRIES$1 = 128;
-const MAX_ARCHIVE_LIST_BYTES$1 = 262144;
-/** Pinned official FRP release metadata for supported desktop targets. */
-const FRP_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
+//#region src/managed-files.ts
+/** Refuse link-shaped ancestors inside an owned state root before accessing a child. */
+async function assertManagedParents(root, target, prefix) {
+	const parent = resolve(root);
+	const candidate = resolve(target);
+	const offset = relative(parent, candidate);
+	if (!isAbsolute(root) || offset !== "" && (offset.startsWith("..") || isAbsolute(offset))) throw new Error(`${prefix}_path_invalid`);
+	const paths = [parent];
+	let cursor = parent;
+	if (offset !== "") for (const segment of relative(parent, dirname(candidate)).split(/[\\/]/u).filter(Boolean)) {
+		cursor = join(cursor, segment);
+		paths.push(cursor);
+	}
+	for (const path of paths) {
+		let entry;
+		try {
+			entry = await lstat(path);
+		} catch (error) {
+			if (error.code === "ENOENT") continue;
+			throw error;
+		}
+		if (!entry.isDirectory() || entry.isSymbolicLink()) throw new Error(`${prefix}_path_invalid`);
+	}
+}
+/** Retry Windows handle contention while checking ownership before every mutation. */
+async function mutateManagedPath(validate, mutate) {
+	let original;
+	for (let attempt = 0;; attempt++) {
+		await validate();
+		try {
+			await mutate();
+			return;
+		} catch (error) {
+			const code = error.code;
+			if (process.platform !== "win32" || code !== "EPERM" && code !== "EBUSY") throw error;
+			if (attempt === 0) original = error;
+			if (attempt === 7) throw original;
+			await new Promise((resolve) => setTimeout(resolve, Math.min(50 * 2 ** attempt, 400)));
+		}
+	}
+}
+/** Move only owned paths, retaining parent checks on every Windows retry. */
+async function renameManagedPath(root, source, destination, prefix) {
+	if (resolve(source) === resolve(root) || resolve(destination) === resolve(root)) throw new Error(`${prefix}_path_invalid`);
+	await mutateManagedPath(async () => {
+		await assertManagedParents(root, source, prefix);
+		await assertManagedParents(root, destination, prefix);
+	}, () => rename(source, destination));
+}
+/** Create a real owned directory; secure new directories without changing existing child ACLs. */
+async function ensureManagedDirectory(root, directory, prefix) {
+	await assertManagedParents(root, directory, prefix);
+	const created = await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const entry = await lstat(directory);
+	if (!entry.isDirectory() || entry.isSymbolicLink()) throw new Error(`${prefix}_path_invalid`);
+	if (created !== void 0) await restrictPrivateFile(directory, 448);
+}
+/** Delete an owned child tree; remove links themselves and never delete the root. */
+async function removeManagedTree(root, target, prefix) {
+	if (resolve(target) === resolve(root)) throw new Error(`${prefix}_path_invalid`);
+	await assertManagedParents(root, target, prefix);
+	let entry;
+	try {
+		entry = await lstat(target);
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		throw error;
+	}
+	if (entry.isSymbolicLink() || !entry.isDirectory()) {
+		await mutateManagedPath(() => assertManagedParents(root, target, prefix), () => unlink(target));
+		return;
+	}
+	for (const name of await readdir(target)) await removeManagedTree(root, join(target, name), prefix);
+	await mutateManagedPath(() => assertManagedParents(root, target, prefix), () => rmdir(target));
+}
+/** Validate every selected child, then await all deletion work even when one fails. */
+async function removeManagedPaths(root, paths, prefix) {
+	for (const path of paths) {
+		if (resolve(path) === resolve(root)) throw new Error(`${prefix}_path_invalid`);
+		await assertManagedParents(root, path, prefix);
+	}
+	const errors = (await Promise.allSettled(paths.map((path) => removeManagedTree(root, path, prefix)))).filter((result) => result.status === "rejected").map((result) => result.reason);
+	if (errors.length === 1) throw errors[0];
+	if (errors.length > 1) throw new AggregateError(errors, `${prefix}_cleanup_failed`);
+}
+/** Atomically replace one sensitive file beneath real owned directories. */
+async function writeManagedPrivateFile(root, file, body, prefix) {
+	await ensureManagedDirectory(root, dirname(file), prefix);
+	try {
+		const entry = await lstat(file);
+		if (!entry.isFile() || entry.isSymbolicLink()) throw new Error(`${prefix}_config_target_invalid`);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+	const temporary = join(dirname(file), "." + basename(file) + "." + randomBytes(12).toString("hex") + ".tmp");
+	let failed = false;
+	try {
+		await writeFile(temporary, body, {
+			encoding: "utf8",
+			flag: "wx",
+			mode: 384
+		});
+		await restrictPrivateFile(temporary);
+		await renameManagedPath(root, temporary, file, prefix);
+	} catch (error) {
+		failed = true;
+		throw error;
+	} finally {
+		try {
+			await removeManagedTree(root, temporary, prefix);
+		} catch (error) {
+			if (!failed) throw error;
+		}
+	}
+}
+/** Promote a verified directory, restoring the previous version if promotion fails. */
+async function replaceManagedDirectory(root, target, candidate, prefix, operations = {}) {
+	if (resolve(target) === resolve(root) || resolve(candidate) === resolve(root)) throw new Error(`${prefix}_path_invalid`);
+	const move = async (source, destination) => {
+		await assertManagedParents(root, source, prefix);
+		await assertManagedParents(root, destination, prefix);
+		if (operations.move === void 0) await renameManagedPath(root, source, destination, prefix);
+		else await operations.move(source, destination);
+	};
+	const remove = operations.remove ?? ((path) => removeManagedTree(root, path, prefix));
+	const backup = join(dirname(target), `.${basename(target)}.previous-${randomBytes(12).toString("hex")}`);
+	let previous = false;
+	let promoted = false;
+	try {
+		await assertManagedParents(root, join(candidate, "publication-check"), prefix);
+		await assertManagedParents(root, target, prefix);
+		try {
+			const entry = await lstat(target);
+			if (!entry.isDirectory() || entry.isSymbolicLink()) throw new Error(`${prefix}_path_invalid`);
+			await move(target, backup);
+			previous = true;
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		try {
+			await move(candidate, target);
+			promoted = true;
+		} catch (error) {
+			if (previous) try {
+				await move(backup, target);
+				previous = false;
+			} catch (restoreError) {
+				throw new AggregateError([error, restoreError], `${prefix}_component_replace_failed`);
+			}
+			throw error;
+		}
+	} finally {
+		try {
+			await remove(candidate);
+		} catch (_error) {
+			process.emitWarning(`${prefix} candidate cleanup failed`, { code: "DSH_MOBILE_COMPONENT_CLEANUP_FAILED" });
+		}
+		if (promoted && previous) try {
+			await remove(backup);
+		} catch (_error) {
+			process.emitWarning(`${prefix} previous component cleanup failed`, { code: "DSH_MOBILE_COMPONENT_CLEANUP_FAILED" });
+		}
+	}
+}
+//#endregion
+//#region src/frp-component.ts
+const FRP_VERSION$1 = "0.70.1";
+const MAX_ARCHIVE_ENTRIES$1 = 128;
+const MAX_ARCHIVE_LIST_BYTES$1 = 262144;
+/** Pinned official FRP release metadata for supported desktop targets. */
+const FRP_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 	{
 		platform: "win32",
 		arch: "x64",
@@ -6510,37 +7549,6 @@ async function regularFile$2(file) {
 		throw error;
 	}
 }
-async function replaceDirectory(target, candidate) {
-	const backup = `${target}.previous-${randomBytes(12).toString("hex")}`;
-	let previous = false;
-	try {
-		try {
-			await rename(target, backup);
-			previous = true;
-		} catch (error) {
-			if (error.code !== "ENOENT") throw error;
-		}
-		try {
-			await rename(candidate, target);
-		} catch (error) {
-			if (previous) try {
-				await rename(backup, target);
-			} catch (restoreError) {
-				throw new AggregateError([error, restoreError], "frp_component_replace_failed");
-			}
-			throw error;
-		}
-		if (previous) await rm(backup, {
-			recursive: true,
-			force: true
-		});
-	} finally {
-		await rm(candidate, {
-			recursive: true,
-			force: true
-		});
-	}
-}
 function sha256$2(bytes) {
 	return createHash("sha256").update(bytes).digest("hex");
 }
@@ -6641,6 +7649,7 @@ var FrpComponentManager = class {
 	componentStorage;
 	logRoot;
 	stagingRoot;
+	stateDirectory;
 	artifact;
 	fetchArtifact;
 	extractArtifact;
@@ -6650,8 +7659,9 @@ var FrpComponentManager = class {
 	errorCode;
 	queue = Promise.resolve();
 	constructor(options) {
+		if (!isAbsolute(options.stateDirectory)) throw new Error("frp state directory must be absolute");
 		const stateDirectory = resolve(options.stateDirectory);
-		if (!isAbsolute(stateDirectory)) throw new Error("frp state directory must be absolute");
+		this.stateDirectory = stateDirectory;
 		const platform = options.platform ?? process.platform;
 		const arch = options.arch ?? process.arch;
 		this.artifact = FRP_COMPONENT_RELEASES[`${platform}-${arch}`];
@@ -6672,13 +7682,19 @@ var FrpComponentManager = class {
 	}
 	/** Inspect the managed executable without relying on global FRP installations. */
 	async initialize() {
-		this.installed = await regularFile$2(this.executable);
-		this.installedBytes = this.installed ? (await stat(this.executable)).size : 0;
-		if (this.installed) try {
-			if (await this.inspectExecutable(this.executable) !== FRP_VERSION$1) throw new Error("frp_component_version_mismatch");
-			this.errorCode = void 0;
-		} catch {
+		this.installed = false;
+		this.installedBytes = 0;
+		this.errorCode = void 0;
+		try {
+			await assertManagedParents(this.stateDirectory, this.executable, "frp");
+			this.installed = await regularFile$2(this.executable);
+			this.installedBytes = this.installed ? (await stat(this.executable)).size : 0;
+			if (this.installed) {
+				if (await this.inspectExecutable(this.executable) !== FRP_VERSION$1) throw new Error("frp_component_version_mismatch");
+			}
+		} catch (_error) {
 			this.installed = false;
+			this.installedBytes = 0;
 			this.errorCode = "frp_component_invalid";
 		}
 	}
@@ -6701,10 +7717,8 @@ var FrpComponentManager = class {
 		return this.enqueue(async () => {
 			const artifact = this.artifact;
 			if (artifact === void 0) throw new Error("frp_component_unsupported");
-			await mkdir(this.stagingRoot, {
-				recursive: true,
-				mode: 448
-			});
+			await assertManagedParents(this.stateDirectory, this.executable, "frp");
+			await ensureManagedDirectory(this.stateDirectory, this.stagingRoot, "frp");
 			const staging = await mkdtemp(join(this.stagingRoot, "install-"));
 			try {
 				const controller = new AbortController();
@@ -6731,42 +7745,36 @@ var FrpComponentManager = class {
 				await chmod(extracted, 448);
 				if (await this.inspectExecutable(extracted) !== FRP_VERSION$1) throw new Error("frp_component_version_mismatch");
 				const candidate = join(this.componentRoot, `.install-${randomBytes(12).toString("hex")}`);
-				await mkdir(candidate, {
-					recursive: true,
-					mode: 448
-				});
-				const candidateExecutable = join(candidate, artifact.executableName);
-				await copyFile(extracted, candidateExecutable);
-				await chmod(candidateExecutable, 448);
-				await replaceDirectory(this.componentStorage, candidate);
+				await ensureManagedDirectory(this.stateDirectory, candidate, "frp");
+				try {
+					const candidateExecutable = join(candidate, artifact.executableName);
+					await copyFile(extracted, candidateExecutable);
+					await chmod(candidateExecutable, 448);
+					await replaceManagedDirectory(this.stateDirectory, this.componentStorage, candidate, "frp");
+				} catch (error) {
+					try {
+						await removeManagedTree(this.stateDirectory, candidate, "frp");
+					} catch (_cleanupError) {
+						process.emitWarning("FRP candidate cleanup failed", { code: "DSH_MOBILE_COMPONENT_CLEANUP_FAILED" });
+					}
+					throw error;
+				}
 				this.installed = true;
 				this.installedBytes = (await stat(this.executable)).size;
 				this.errorCode = void 0;
 			} finally {
-				await rm(staging, {
-					recursive: true,
-					force: true
-				});
+				await removeManagedTree(this.stateDirectory, staging, "frp");
 			}
 		});
 	}
 	/** Remove all FRP executable, staging, and log files owned by DSH Mobile. */
 	purge() {
 		return this.enqueue(async () => {
-			await Promise.all([
-				rm(this.componentRoot, {
-					recursive: true,
-					force: true
-				}),
-				rm(this.logRoot, {
-					recursive: true,
-					force: true
-				}),
-				rm(this.stagingRoot, {
-					recursive: true,
-					force: true
-				})
-			]);
+			await removeManagedPaths(this.stateDirectory, [
+				this.componentRoot,
+				this.logRoot,
+				this.stagingRoot
+			], "frp");
 			this.installed = false;
 			this.installedBytes = 0;
 			this.errorCode = void 0;
@@ -7188,34 +8196,9 @@ function createFrpServerTemplate(settings) {
 		entryTls: resolveFrpEntryTls(settings)
 	});
 }
-async function atomicPrivateWrite$2(file, body) {
-	const directory = dirname(file);
-	await mkdir(directory, {
-		recursive: true,
-		mode: 448
-	});
-	try {
-		const current = await lstat(file);
-		if (!current.isFile() || current.isSymbolicLink()) throw new Error("frp_config_target_invalid");
-	} catch (error) {
-		if (error.code !== "ENOENT") throw error;
-	}
-	const temporary = join(directory, `.${basename(file)}.${randomBytes(12).toString("hex")}.tmp`);
-	try {
-		await writeFile(temporary, body, {
-			encoding: "utf8",
-			flag: "wx",
-			mode: 384
-		});
-		await rename(temporary, file);
-		await restrictPrivateFile(file);
-	} catch (error) {
-		await rm(temporary, { force: true });
-		throw error;
-	}
-}
 /** Owns private FRP settings and generation-specific frpc configuration. */
 var FrpConfigStore = class {
+	ownedRoot;
 	stateRoot;
 	settingsFile;
 	runtimeConfigFile;
@@ -7229,7 +8212,8 @@ var FrpConfigStore = class {
 	proxyName;
 	settingsValue;
 	errorCode;
-	constructor(stateDirectory, proxyName = FRP_DEFAULT_PROXY_NAME) {
+	constructor(stateDirectory, proxyName = FRP_DEFAULT_PROXY_NAME, ownedRoot = stateDirectory) {
+		this.ownedRoot = ownedRoot;
 		if (!isAbsolute(stateDirectory)) throw new Error("frp config state directory must be absolute");
 		this.stateRoot = resolve(stateDirectory);
 		this.settingsFile = join(this.stateRoot, "settings.json");
@@ -7238,6 +8222,14 @@ var FrpConfigStore = class {
 	}
 	/** Load private settings while rejecting links, oversized files, and unknown fields. */
 	async initialize() {
+		this.settingsValue = void 0;
+		this.errorCode = void 0;
+		try {
+			await assertManagedParents(this.ownedRoot, this.settingsFile, "frp");
+		} catch (_error) {
+			this.errorCode = "frp_config_invalid";
+			return;
+		}
 		let entry;
 		try {
 			entry = await lstat(this.settingsFile);
@@ -7292,8 +8284,8 @@ var FrpConfigStore = class {
 	/** Atomically replace private FRP settings. */
 	async configure(value) {
 		const settings = parseFrpSettings(value);
-		await atomicPrivateWrite$2(this.settingsFile, `${JSON.stringify(settings)}\n`);
-		await rm(this.runtimeConfigFile, { force: true });
+		await writeManagedPrivateFile(this.ownedRoot, this.settingsFile, `${JSON.stringify(settings)}\n`, "frp");
+		await removeManagedTree(this.ownedRoot, this.runtimeConfigFile, "frp");
 		this.settingsValue = settings;
 		this.errorCode = void 0;
 		return this.status();
@@ -7302,15 +8294,12 @@ var FrpConfigStore = class {
 	async writeRuntimeConfig(localPort) {
 		const settings = this.settingsValue;
 		if (settings === void 0) throw new Error("frp_config_missing");
-		await atomicPrivateWrite$2(this.runtimeConfigFile, createFrpcToml(settings, localPort, this.proxyName));
+		await writeManagedPrivateFile(this.ownedRoot, this.runtimeConfigFile, createFrpcToml(settings, localPort, this.proxyName), "frp");
 		return this.runtimeConfigFile;
 	}
 	/** Remove only configuration files owned by the FRP provider. */
 	async purge() {
-		await rm(this.stateRoot, {
-			recursive: true,
-			force: true
-		});
+		await removeManagedPaths(this.ownedRoot, [this.settingsFile, this.runtimeConfigFile], "frp");
 		this.settingsValue = void 0;
 		this.errorCode = void 0;
 		return this.status();
@@ -8197,25 +9186,11 @@ async function readIngressIdentity(file) {
 		throw new Error("frp_ingress_ca_invalid", { cause: error });
 	}
 }
-async function writeIngressIdentity(file, fingerprint) {
-	const temporary = join(dirname(file), `.${basename(file)}.${randomBytes(12).toString("hex")}.tmp`);
-	try {
-		await writeFile(temporary, `${JSON.stringify({
-			version: 1,
-			caFingerprint: fingerprint
-		})}\n`, {
-			flag: "wx",
-			mode: 384
-		});
-		await rename(temporary, file);
-		await restrictPrivateFile(file);
-	} finally {
-		try {
-			await unlink(temporary);
-		} catch (error) {
-			if (error.code !== "ENOENT") throw error;
-		}
-	}
+async function writeIngressIdentity(file, fingerprint, ownedRoot) {
+	await writeManagedPrivateFile(ownedRoot, file, `${JSON.stringify({
+		version: 1,
+		caFingerprint: fingerprint
+	})}\n`, "frp_ingress");
 }
 function coversPublicIp(certificate, address) {
 	return (certificate.subjectAltName ?? "").split(",").some((entry) => entry.trim() === `IP Address:${address}`);
@@ -8227,9 +9202,11 @@ function coversPublicIp(certificate, address) {
 * replaced silently. The leaf is re-signed when expiring or no longer valid for
 * the public IPv4, and the running gateway reloads it after a renewal check.
 */
-async function ensureFrpIngressCertificate(settings, stateFile, now = Date.now(), expectedCaFingerprint) {
+async function ensureFrpIngressCertificate(settings, stateFile, now = Date.now(), expectedCaFingerprint, ownedRoot = dirname(stateFile)) {
 	if (resolveFrpMode(settings) !== "attach" || !isFrpSelfSignedIngress(settings)) throw new Error("frp_entry_tls_invalid");
 	const paths = frpIngressPaths(stateFile);
+	await assertManagedParents(ownedRoot, paths.statusFile, "frp_ingress");
+	await assertManagedParents(ownedRoot, paths.caCertFile, "frp_ingress");
 	try {
 		const directory = await lstat(paths.directory);
 		if (!directory.isDirectory() || directory.isSymbolicLink()) throw new Error("frp_ingress_directory_invalid");
@@ -8246,10 +9223,7 @@ async function ensureFrpIngressCertificate(settings, stateFile, now = Date.now()
 	if (caCertExists !== caKeyExists || !caCertExists && (previousFingerprint !== void 0 || leafCertExists || leafKeyExists)) throw new Error("frp_ingress_ca_invalid");
 	if (caCertExists && (await readCertificateRenewal(paths.caCertFile, now)).state === "expired") throw new Error("frp_ingress_ca_expired");
 	if (previousFingerprint === void 0) {
-		await mkdir(dirname(paths.statusFile), {
-			recursive: true,
-			mode: 448
-		});
+		await ensureManagedDirectory(ownedRoot, dirname(paths.statusFile), "frp_ingress");
 		try {
 			await writeFile(paths.statusFile, "{\"version\":1,\"pending\":true}\n", {
 				flag: "wx",
@@ -8269,6 +9243,7 @@ async function ensureFrpIngressCertificate(settings, stateFile, now = Date.now()
 	};
 	let ca;
 	try {
+		await assertManagedParents(ownedRoot, paths.caCertFile, "frp_ingress");
 		ca = expectedCaFingerprint === void 0 ? await ensureManagedCa(caFiles) : await readManagedCa(caFiles);
 	} catch (error) {
 		throw new Error("frp_ingress_ca_invalid", { cause: error });
@@ -8276,7 +9251,7 @@ async function ensureFrpIngressCertificate(settings, stateFile, now = Date.now()
 	const caFingerprint = ca.fingerprint256.replaceAll(":", "").toLowerCase();
 	if (previousFingerprint !== void 0 && caFingerprint !== previousFingerprint) throw new Error("frp_ingress_ca_changed");
 	if (expectedCaFingerprint !== void 0 && caFingerprint !== expectedCaFingerprint) throw new Error("frp_ingress_ca_changed");
-	if (previousFingerprint === void 0) await writeIngressIdentity(paths.statusFile, caFingerprint);
+	if (previousFingerprint === void 0) await writeIngressIdentity(paths.statusFile, caFingerprint, ownedRoot);
 	const publicHost = new URL(settings.publicOrigin).hostname;
 	let leaf;
 	try {
@@ -8285,6 +9260,7 @@ async function ensureFrpIngressCertificate(settings, stateFile, now = Date.now()
 		leaf = void 0;
 	}
 	if (!(leaf !== void 0 && Date.parse(leaf.validTo) > now + 864e5 && coversPublicIp(leaf, publicHost) && leaf.verify(ca.publicKey))) {
+		await assertManagedParents(ownedRoot, paths.certFile, "frp_ingress");
 		await issueServerCertificate({
 			caCertFile: paths.caCertFile,
 			caKeyFile: paths.caKeyFile
@@ -8314,7 +9290,7 @@ async function ensureFrpIngressCertificate(settings, stateFile, now = Date.now()
 * No secret ever leaves this function: the CA is reported by fingerprint only,
 * and the token is never read.
 */
-async function frpIngressSelfCheck(settings, stateFile) {
+async function frpIngressSelfCheck(settings, stateFile, ownedRoot = dirname(stateFile)) {
 	const paths = frpIngressPaths(stateFile);
 	const base = {
 		mode: resolveFrpMode(settings),
@@ -8331,6 +9307,8 @@ async function frpIngressSelfCheck(settings, stateFile) {
 		}
 	};
 	if (!isFrpSelfSignedIngress(settings)) return Object.freeze(base);
+	await assertManagedParents(ownedRoot, paths.caCertFile, "frp_ingress");
+	await assertManagedParents(ownedRoot, paths.certFile, "frp_ingress");
 	let caFingerprint;
 	try {
 		caFingerprint = new X509Certificate(await readFile(paths.caCertFile)).fingerprint256.replaceAll(":", "").toLowerCase();
@@ -8345,8 +9323,10 @@ async function frpIngressSelfCheck(settings, stateFile) {
 	});
 }
 /** Remove only the five files owned by the local self-signed FRP entry. */
-async function purgeFrpIngressCertificates(stateFile) {
+async function purgeFrpIngressCertificates(stateFile, ownedRoot = dirname(stateFile)) {
 	const paths = frpIngressPaths(stateFile);
+	await assertManagedParents(ownedRoot, paths.statusFile, "frp_ingress");
+	await assertManagedParents(ownedRoot, paths.directory, "frp_ingress");
 	try {
 		const marker = await lstat(paths.statusFile);
 		if (!marker.isFile() && !marker.isSymbolicLink()) throw new Error("frp_ingress_file_invalid");
@@ -8372,6 +9352,7 @@ async function purgeFrpIngressCertificates(stateFile) {
 		paths.certFile,
 		paths.keyFile
 	]) {
+		await assertManagedParents(ownedRoot, file, "frp_ingress");
 		let entry;
 		try {
 			entry = await lstat(file);
@@ -8383,6 +9364,7 @@ async function purgeFrpIngressCertificates(stateFile) {
 		await unlink(file);
 	}
 	try {
+		await assertManagedParents(ownedRoot, paths.directory, "frp_ingress");
 		await rmdir(paths.directory);
 	} catch (error) {
 		if (error.code === "ENOENT") return;
@@ -9303,39 +10285,15 @@ function parseOriginSettings(value) {
 		allowedCidrs: validateOriginAllowedCidrs(record.allowedCidrs, listenHost)
 	});
 }
-async function atomicPrivateWrite$1(file, body) {
-	const directory = dirname(file);
-	await mkdir(directory, {
-		recursive: true,
-		mode: 448
-	});
-	try {
-		const current = await lstat(file);
-		if (!current.isFile() || current.isSymbolicLink()) throw new Error("origin_config_target_invalid");
-	} catch (error) {
-		if (error.code !== "ENOENT") throw error;
-	}
-	const temporary = join(directory, "." + basename(file) + "." + randomBytes(12).toString("hex") + ".tmp");
-	try {
-		await writeFile(temporary, body, {
-			encoding: "utf8",
-			flag: "wx",
-			mode: 384
-		});
-		await rename(temporary, file);
-		await restrictPrivateFile(file);
-	} catch (error) {
-		await rm(temporary, { force: true });
-		throw error;
-	}
-}
 /** Owns only origin settings; shared paired-device storage is never removed. */
 var OriginConfigStore = class {
+	ownedRoot;
 	stateRoot;
 	settingsFile;
 	settingsValue;
 	errorCode;
-	constructor(stateDirectory) {
+	constructor(stateDirectory, ownedRoot = stateDirectory) {
+		this.ownedRoot = ownedRoot;
 		if (!isAbsolute(stateDirectory)) throw new Error("origin config state directory must be absolute");
 		this.stateRoot = resolve(stateDirectory);
 		this.settingsFile = join(this.stateRoot, "settings.json");
@@ -9343,6 +10301,12 @@ var OriginConfigStore = class {
 	async initialize() {
 		this.settingsValue = void 0;
 		this.errorCode = void 0;
+		try {
+			await assertManagedParents(this.ownedRoot, this.settingsFile, "origin");
+		} catch (_error) {
+			this.errorCode = "origin_config_invalid";
+			return;
+		}
 		let entry;
 		try {
 			entry = await lstat(this.settingsFile);
@@ -9381,13 +10345,13 @@ var OriginConfigStore = class {
 	}
 	async configure(value) {
 		const settings = parseOriginSettings(value);
-		await atomicPrivateWrite$1(this.settingsFile, JSON.stringify(settings) + "\n");
+		await writeManagedPrivateFile(this.ownedRoot, this.settingsFile, JSON.stringify(settings) + "\n", "origin");
 		this.settingsValue = settings;
 		this.errorCode = void 0;
 		return this.status();
 	}
 	async purge() {
-		await rm(this.settingsFile, { force: true });
+		await removeManagedTree(this.ownedRoot, this.settingsFile, "origin");
 		this.settingsValue = void 0;
 		this.errorCode = void 0;
 		return this.status();
@@ -9805,6 +10769,7 @@ var CloudflaredComponentManager = class {
 	stateRoot;
 	logRoot;
 	stagingRoot;
+	stateDirectory;
 	platform;
 	arch;
 	release;
@@ -9814,8 +10779,9 @@ var CloudflaredComponentManager = class {
 	errorCode;
 	queue = Promise.resolve();
 	constructor(options) {
+		if (!isAbsolute(options.stateDirectory)) throw new Error("cloudflared state directory must be absolute");
 		const stateDirectory = resolve(options.stateDirectory);
-		if (!isAbsolute(stateDirectory)) throw new Error("cloudflared state directory must be absolute");
+		this.stateDirectory = stateDirectory;
 		this.platform = options.platform ?? process.platform;
 		this.arch = options.arch ?? process.arch;
 		this.release = lookupRelease(this.platform, this.arch);
@@ -9839,9 +10805,16 @@ var CloudflaredComponentManager = class {
 	/** Inspect the managed binary without using any global cloudflared state. */
 	async initialize() {
 		const release = this.release;
+		this.installed = false;
 		this.errorCode = void 0;
-		this.installed = release !== void 0 && await regularFile$1(this.executable, release.executableBytes);
-		if (this.installed && release !== void 0 && await sha256$1(this.executable) !== release.executableSha256) {
+		try {
+			await assertManagedParents(this.stateDirectory, this.executable, "cloudflared");
+			this.installed = release !== void 0 && await regularFile$1(this.executable, release.executableBytes);
+			if (this.installed && release !== void 0 && await sha256$1(this.executable) !== release.executableSha256) {
+				this.installed = false;
+				this.errorCode = "cloudflared_component_invalid";
+			}
+		} catch (_error) {
 			this.installed = false;
 			this.errorCode = "cloudflared_component_invalid";
 		}
@@ -9867,10 +10840,8 @@ var CloudflaredComponentManager = class {
 		return this.enqueue(async () => {
 			const release = this.release;
 			if (release === void 0) throw new Error("cloudflared_component_unsupported");
-			await mkdir(this.stagingRoot, {
-				recursive: true,
-				mode: 448
-			});
+			await assertManagedParents(this.stateDirectory, this.executable, "cloudflared");
+			await ensureManagedDirectory(this.stateDirectory, this.stagingRoot, "cloudflared");
 			const staging = await mkdtemp(join(this.stagingRoot, "install-"));
 			try {
 				const controller = new AbortController();
@@ -9906,48 +10877,43 @@ var CloudflaredComponentManager = class {
 				await chmod(staged, 448);
 				if (!await regularFile$1(staged, release.executableBytes) || await sha256$1(staged) !== release.executableSha256) throw new Error("cloudflared_executable_hash_mismatch");
 				const candidate = join(this.componentRoot, `.install-${randomBytes(12).toString("hex")}`);
-				await mkdir(candidate, {
-					recursive: true,
-					mode: 448
-				});
-				await copyFile(staged, join(candidate, release.executableName));
-				await chmod(join(candidate, release.executableName), 448);
-				await rm(this.componentStorage, {
-					recursive: true,
-					force: true
-				});
-				await rename(candidate, this.componentStorage);
+				await ensureManagedDirectory(this.stateDirectory, candidate, "cloudflared");
+				try {
+					await copyFile(staged, join(candidate, release.executableName));
+					await chmod(join(candidate, release.executableName), 448);
+					await replaceManagedDirectory(this.stateDirectory, this.componentStorage, candidate, "cloudflared");
+				} catch (error) {
+					try {
+						await removeManagedTree(this.stateDirectory, candidate, "cloudflared");
+					} catch (_cleanupError) {
+						process.emitWarning("cloudflared candidate cleanup failed", { code: "DSH_MOBILE_COMPONENT_CLEANUP_FAILED" });
+					}
+					throw error;
+				}
 				this.installed = true;
 				this.errorCode = void 0;
+			} catch (error) {
+				try {
+					await assertManagedParents(this.stateDirectory, this.executable, "cloudflared");
+					this.installed = await regularFile$1(this.executable, release.executableBytes) && await sha256$1(this.executable) === release.executableSha256;
+				} catch (_inspectionError) {
+					this.installed = false;
+				}
+				throw error;
 			} finally {
-				await rm(staging, {
-					recursive: true,
-					force: true
-				});
+				await removeManagedTree(this.stateDirectory, staging, "cloudflared");
 			}
 		});
 	}
 	/** Remove every cloudflared file owned by DSH Mobile without touching global state. */
 	purge() {
 		return this.enqueue(async () => {
-			await Promise.all([
-				rm(this.componentRoot, {
-					recursive: true,
-					force: true
-				}),
-				rm(this.stateRoot, {
-					recursive: true,
-					force: true
-				}),
-				rm(this.logRoot, {
-					recursive: true,
-					force: true
-				}),
-				rm(this.stagingRoot, {
-					recursive: true,
-					force: true
-				})
-			]);
+			await removeManagedPaths(this.stateDirectory, [
+				this.componentRoot,
+				this.stateRoot,
+				this.logRoot,
+				this.stagingRoot
+			], "cloudflared");
 			this.installed = false;
 			this.errorCode = void 0;
 		});
@@ -10589,34 +11555,9 @@ function mergeSavedCloudflaredTunnelSettings(partial, saved) {
 		port
 	});
 }
-async function atomicPrivateWrite(file, body) {
-	const directory = dirname(file);
-	await mkdir(directory, {
-		recursive: true,
-		mode: 448
-	});
-	try {
-		const current = await lstat(file);
-		if (!current.isFile() || current.isSymbolicLink()) throw new Error("cloudflared_tunnel_target_invalid");
-	} catch (error) {
-		if (error.code !== "ENOENT") throw error;
-	}
-	const temporary = join(directory, `.${basename(file)}.${randomBytes(12).toString("hex")}.tmp`);
-	try {
-		await writeFile(temporary, body, {
-			encoding: "utf8",
-			flag: "wx",
-			mode: 384
-		});
-		await rename(temporary, file);
-		await restrictPrivateFile(file);
-	} catch (error) {
-		await rm(temporary, { force: true });
-		throw error;
-	}
-}
 /** Owns the private cloudflared tunnel configuration for one DSH installation. */
 var CloudflaredTunnelStore = class {
+	ownedRoot;
 	stateRoot;
 	settingsFile;
 	settingsValue = Object.freeze({
@@ -10624,13 +11565,25 @@ var CloudflaredTunnelStore = class {
 		mode: "quick"
 	});
 	errorCode;
-	constructor(stateDirectory) {
+	constructor(stateDirectory, ownedRoot = stateDirectory) {
+		this.ownedRoot = ownedRoot;
 		if (!isAbsolute(stateDirectory)) throw new Error("cloudflared tunnel state directory must be absolute");
 		this.stateRoot = resolve(stateDirectory);
 		this.settingsFile = join(this.stateRoot, "tunnel.json");
 	}
 	/** Load private settings while rejecting links, oversized files and unknown fields. */
 	async initialize() {
+		this.settingsValue = Object.freeze({
+			version: 1,
+			mode: "quick"
+		});
+		this.errorCode = void 0;
+		try {
+			await assertManagedParents(this.ownedRoot, this.settingsFile, "cloudflared");
+		} catch (_error) {
+			this.errorCode = "cloudflared_tunnel_config_invalid";
+			return;
+		}
 		let entry;
 		try {
 			entry = await lstat(this.settingsFile);
@@ -10675,15 +11628,20 @@ var CloudflaredTunnelStore = class {
 	/** Atomically replace the tunnel configuration. */
 	async configure(value) {
 		const settings = parseCloudflaredTunnelSettings(value);
-		if (settings.mode === "quick") await rm(this.settingsFile, { force: true });
-		else await atomicPrivateWrite(this.settingsFile, `${JSON.stringify(settings)}\n`);
+		if (settings.mode === "quick") await removeManagedTree(this.ownedRoot, this.settingsFile, "cloudflared");
+		else try {
+			await writeManagedPrivateFile(this.ownedRoot, this.settingsFile, `${JSON.stringify(settings)}\n`, "cloudflared");
+		} catch (error) {
+			if (error instanceof Error && error.message === "cloudflared_config_target_invalid") throw new Error("cloudflared_tunnel_target_invalid", { cause: error });
+			throw error;
+		}
 		this.settingsValue = settings;
 		this.errorCode = void 0;
 		return this.status();
 	}
 	/** Forget a named tunnel and its connector token. */
 	async purge() {
-		await rm(this.settingsFile, { force: true });
+		await removeManagedTree(this.ownedRoot, this.settingsFile, "cloudflared");
 		this.settingsValue = Object.freeze({
 			version: 1,
 			mode: "quick"
@@ -11242,7 +12200,7 @@ async function collectConnectionDiagnostics(snapshot, probes = {}) {
 function buildMobileGuide(state) {
 	const styleLine = state.hasCustomCss ? "存在（当前生效的自定义样式）" : "不存在（使用内置默认样式）";
 	const scriptLine = state.hasCustomJs ? "存在（当前生效的自定义脚本）" : "不存在（无自定义脚本）";
-	const extensionLines = state.extensions.length === 0 ? "（无）" : state.extensions.map((entry) => `- ${entry.id}（${entry.name} v${entry.version}）`).join("\n");
+	const extensionLines = state.extensions.length === 0 ? "（无）" : state.extensions.map((entry) => `- ${entry.id}（${entry.name} v${entry.version}）${entry.executionMode === void 0 ? "" : ` · ${entry.executionMode}${entry.executionState === "unavailable" ? " · 当前不可用，需要显式重启扩展" : ""}`}`).join("\n");
 	const failureLine = state.failedExtensionCount > 0 ? `注意：${state.failedExtensionCount} 个扩展的电脑端 host 激活失败，如改动相关扩展请先检查其 host.mjs 与 extension.json。` : "";
 	return `${`## 手机端当前状态（改动前必读，避免覆盖已有定制）
 
@@ -11276,16 +12234,18 @@ const MOBILE_CUSTOMIZATION_GUIDE_BODY = `你在为用户定制 DSH Mobile 的手
    - 目录：$DSH_HOME/mobile-access/extensions/<id>/，id 用小写字母数字和连字符（如 media-remote）
    - extension.json：{"schemaVersion":1,"id":"<id>","name":"显示名","version":"0.1.0","description":"说明"}
    - host.mjs：电脑端 Node.js 代码（可信本地代码，可读写文件、执行命令）。导出默认函数 (api) => { ... }，用 api.action('名称', { input, run }) 注册动作、api.route({ method, path, handle }) 注册路由、api.effect(fn) 注册清理。input 可以直接使用 api.schema.object(...) 等 Schemastery schema，也可以传入带 parse(value) 的适配器；两种形式都会在动作执行前校验并规范化输入。
+   - 执行方式见上方实际状态。默认 in-process；插件配置可按扩展选择 worker。Worker 中 api.context 只有 logger，不能调用 Cordis 服务；api.manifest、schema、action、route、effect 仍可用。不要把需要 Cordis 的扩展偷偷改成 Worker，也不要在 extension.json 中添加执行模式字段。
    - 动作与路由的执行有时间预算：默认 30 秒（输入校验也计入），可用 api.action('名称', { input, run, timeoutMs }) 或 api.route({ ..., timeoutMs }) 按操作覆盖（1–300000 的整数毫秒）。超时或调用方取消后，调用方收到 500 extension_action_timeout / extension_route_timeout（或取消原因）；这只表示调用方不再等待，底层代码可能仍在运行并已产生副作用，请在 run / handle 中响应 signal 实现协作式取消。路由的预算到 handle() 返回响应为止，不影响已返回流的存活。若某扩展存在调用方已离开（超时或取消）但仍未结束的操作，后续对该扩展的新调用会收到 503 extension_busy，直到该操作真正结束。
    - mobile.js：手机端脚本，用 window.dshMobile.define({ apiVersion:1, id:'<id>', activate(api) { ... } })，activate 返回清理函数
    - mobile.css：手机端样式（可选）
    - assets/：手机端静态资源（可选）
    - mobile.js 里用 api.host.invoke('动作名', 输入) 调 host.mjs 的 action（请求会按 application/json 发送），api.host.fetch('/路由路径') 调 route，api.host.assetUrl('相对路径') 生成与当前版本绑定的资源地址
-   - 也可以先用命令生成模板：dsh plugin --profile web exec dsh-mobile extension create <id> --name "<名称>"，再在模板上改
+   - DSH Web 可先用命令生成模板：dsh plugin --profile web exec dsh-mobile extension create <id> --name "<名称>"，再在模板上改；Desktop 请在上方实际定制目录创建文件，不要误改 Web profile
 
 安全约束：
 - host.mjs 拥有电脑用户的完整权限，绝不能放入不可信代码，也不要让手机端无条件执行任意命令
-- host.mjs 的同步阻塞（如 while (true) {} 或长时间同步循环）会卡死整个电脑端网关进程，超时与取消机制都无法打断；绝不编写同步阻塞代码
+- in-process 的同步阻塞会卡住网关事件循环，超时不能打断；Worker 可约束 JavaScript 阻塞，但不是安全沙箱，不约束全部原生内存，也不回滚副作用。两种模式都应响应 signal，避免编写不可取消的同步循环
+- Worker 终止后其他未完成调用会失败，已开始的操作不会自动重试。相同内容的停止实例需要操作者在电脑端“移动访问 → 扩展需要重启”中确认恢复；不要通过无意义改文件或自动重放原动作实现恢复
 - 所有改动只限 $DSH_HOME/mobile-access/，不要动 DeepSeek Harness 源码
 
 完成前请自检：
@@ -11313,10 +12273,16 @@ const LINUX_ARTIFACTS = Object.freeze({
 var VpsSshError = class extends Error {
 	stdout;
 	stderr;
+	timedOut;
+	exitCode;
+	signal;
 	constructor(message, stdout, stderr, options) {
 		super(message, options);
 		this.stdout = stdout;
 		this.stderr = stderr;
+		this.timedOut = options?.timedOut ?? false;
+		this.exitCode = options?.exitCode;
+		this.signal = options?.signal;
 	}
 };
 function shellQuote(value) {
@@ -11427,7 +12393,7 @@ function sshSessionOptions(knownHostsFile) {
 		`-o UserKnownHostsFile=${knownHostsFile}`
 	];
 }
-/** Lenient scan probe: garbage fails the whole fetch, comment-only output falls back. */
+/** Recognize usable public-key scan output without authenticating to the server. */
 function tryParseKeyscanOutput(output) {
 	try {
 		return parseKeyscanOutput(output);
@@ -11466,58 +12432,20 @@ async function defaultRunKeyscan(input, serverAddress) {
 	}
 	return first?.stdout ?? "";
 }
-/**
-* Read the server's public host keys over an authenticated connection with a
-* throwaway known_hosts file. Fallback for keyscan binaries that cannot
-* negotiate with modern servers; output feeds the same confirm-and-pin pipeline.
-*/
-async function defaultRunSshFetch(input, serverAddress) {
-	const ssh = process.platform === "win32" ? "ssh.exe" : "ssh";
-	const sshUser = validSshUser(input.sshUser);
-	const sshPort = validSshPort(input.sshPort);
-	const sshKeyPath = validSshKeyPath(input.sshKeyPath);
-	const { stdout } = await runProcess(ssh, [
-		"-o",
-		"BatchMode=yes",
-		"-o",
-		"ConnectTimeout=15",
-		"-o",
-		"StrictHostKeyChecking=no",
-		`-o UserKnownHostsFile=${process.platform === "win32" ? "NUL" : "/dev/null"}`,
-		...sshKeyPath === void 0 ? [] : ["-i", sshKeyPath],
-		"-p",
-		String(sshPort),
-		`${sshUser}@${serverAddress}`,
-		"cat /etc/ssh/ssh_host_*_key.pub"
-	], void 0, 3e4).catch((error) => {
-		throw new VpsSshError("vps_host_key_unavailable", "", error instanceof Error ? error.message : String(error));
-	});
-	const lines = [];
-	for (const line of stdout.split(/\r?\n/u)) {
-		const match = /^(ssh-rsa|ecdsa-sha2-nistp\d+|ssh-ed25519)\s+([A-Za-z0-9+/]+={0,2})(\s|$)/u.exec(line.trim());
-		if (match?.[1] !== void 0 && match[2] !== void 0) lines.push(`${serverAddress} ${match[1]} ${match[2]}`);
-	}
-	return lines.length === 0 ? stdout : `${lines.join("\n")}\n`;
-}
-/**
-* Scan host keys with keyscan first, then fall back to an authenticated read
-* when the local keyscan binary cannot negotiate with the server. Both paths
-* feed the same confirm-and-pin pipeline, so a fallback never weakens the
-* user-confirmation gate.
-*/
+/** Obtain public host keys without using a private key, agent or unverified authenticated connection. */
 async function scanHostKeys(input, serverAddress, options) {
-	const scanned = await (options.runKeyscan ?? defaultRunKeyscan)({
-		sshUser: input.sshUser,
-		sshPort: input.sshPort
-	}, serverAddress).catch(() => "");
-	if (tryParseKeyscanOutput(scanned)?.length) return scanned;
-	options.log?.("host-keys-keyscan-empty", { serverAddress });
-	const fetched = await (options.runSshFetch ?? defaultRunSshFetch)(input, serverAddress);
-	if (tryParseKeyscanOutput(fetched)?.length) {
-		options.log?.("host-keys-ssh-fallback", { serverAddress });
-		return fetched;
-	}
-	throw new Error("vps_host_key_unavailable");
+	const runKeyscan = options.runKeyscan ?? defaultRunKeyscan;
+	let scanned;
+	try {
+		scanned = await runKeyscan({
+			sshUser: input.sshUser,
+			sshPort: input.sshPort
+		}, serverAddress);
+	} catch (error) {
+		throw new Error("vps_host_key_unavailable", { cause: error });
+	}
+	if (parseKeyscanOutput(scanned).length === 0) throw new Error("vps_host_key_unavailable");
+	return scanned;
 }
 /**
 * Fetch the server's current host keys and return them with OpenSSH-style
@@ -11880,7 +12808,8 @@ check caddy ok "Caddy 已加载 ${publicHost}。"
 echo DSH_MOBILE_DEPLOYMENT_OK
 `;
 }
-async function runProcess(command, args, stdin, timeoutMs = SSH_TIMEOUT_MS) {
+/** Run one owned SSH/transfer utility; reject only after its process and stdio have closed. */
+async function runVpsProcess(command, args, stdin, timeoutMs = SSH_TIMEOUT_MS) {
 	return new Promise((resolveRun, rejectRun) => {
 		const child = spawn(command, args, {
 			windowsHide: true,
@@ -11893,9 +12822,23 @@ async function runProcess(command, args, stdin, timeoutMs = SSH_TIMEOUT_MS) {
 		let stdout = "";
 		let stderr = "";
 		const append = (current, chunk) => `${current}${chunk.toString("utf8")}`.slice(-98304);
-		const timer = setTimeout(() => {
+		let timedOut = false;
+		let failure;
+		let failureCode = "vps_ssh_unavailable";
+		let forceTimer;
+		const terminate = () => {
 			child.kill();
-			rejectRun(new VpsSshError("vps_ssh_timeout", stdout, stderr));
+			forceTimer ??= setTimeout(() => {
+				if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+				child.stdin.destroy();
+				child.stdout.destroy();
+				child.stderr.destroy();
+			}, 1e3);
+			forceTimer.unref();
+		};
+		const timer = setTimeout(() => {
+			timedOut = true;
+			terminate();
 		}, timeoutMs);
 		timer.unref();
 		child.stdout.on("data", (chunk) => {
@@ -11905,12 +12848,32 @@ async function runProcess(command, args, stdin, timeoutMs = SSH_TIMEOUT_MS) {
 			stderr = append(stderr, Buffer.from(chunk));
 		});
 		child.once("error", (error) => {
-			clearTimeout(timer);
-			rejectRun(new VpsSshError("vps_ssh_unavailable", stdout, stderr, { cause: error }));
+			failure = error;
 		});
-		child.once("close", (code) => {
+		child.stdin.on("error", (error) => {
+			failure = error;
+			failureCode = "vps_ssh_input_failed";
+			terminate();
+		});
+		const failedOutput = (error) => {
+			failure = error;
+			failureCode = "vps_ssh_transport_failed";
+			terminate();
+		};
+		child.stdout.on("error", failedOutput);
+		child.stderr.on("error", failedOutput);
+		child.once("close", (code, signal) => {
 			clearTimeout(timer);
-			if (code !== 0) rejectRun(new VpsSshError(stderr.includes("Permission denied") ? "vps_ssh_auth_failed" : "vps_deploy_failed", stdout, stderr));
+			if (forceTimer !== void 0) clearTimeout(forceTimer);
+			const facts = {
+				timedOut,
+				exitCode: code,
+				signal,
+				...failure === void 0 ? {} : { cause: failure }
+			};
+			if (timedOut) rejectRun(new VpsSshError("vps_ssh_timeout", stdout, stderr, facts));
+			else if (failure !== void 0) rejectRun(new VpsSshError(child.pid === void 0 ? "vps_ssh_unavailable" : failureCode, stdout, stderr, facts));
+			else if (code !== 0) rejectRun(new VpsSshError(stderr.includes("Permission denied") ? "vps_ssh_auth_failed" : "vps_deploy_failed", stdout, stderr, facts));
 			else resolveRun({
 				stdout,
 				stderr
@@ -11919,8 +12882,10 @@ async function runProcess(command, args, stdin, timeoutMs = SSH_TIMEOUT_MS) {
 		child.stdin.end(stdin, "utf8");
 	});
 }
+const runProcess = runVpsProcess;
 async function downloadArtifact(artifact, file) {
-	await runProcess(process.platform === "win32" ? "curl.exe" : "curl", [
+	const curl = process.platform === "win32" ? "curl.exe" : "curl";
+	await runProcess(curl, [
 		...process.platform === "win32" ? ["--ipv4"] : [],
 		"--fail",
 		"--location",
@@ -12375,12 +13340,27 @@ var FunnelController = class {
 	});
 	queue = Promise.resolve();
 	startTimer;
+	ownedRoot;
 	constructor(options) {
 		this.options = options;
 		if (!isAbsolute(options.executable) || !isAbsolute(options.stateDirectory)) throw new Error("Funnel paths must be absolute");
+		this.ownedRoot = options.ownedRoot ?? dirname(resolve(options.stateDirectory));
+		if (!isAbsolute(this.ownedRoot) || resolve(this.ownedRoot) === resolve(options.stateDirectory)) throw new Error("Funnel state must be a child of its owned root");
 	}
 	/** Restore the remote switch without coupling it to LAN availability. */
 	async initialize() {
+		try {
+			await this.assertStateParents();
+		} catch (_error) {
+			this.enabled = false;
+			this.initialized = true;
+			this.publish({
+				enabled: false,
+				state: "unavailable",
+				errorCode: "funnel_state_invalid"
+			});
+			return;
+		}
 		const state = await this.options.store.load();
 		this.enabled = state.enabled;
 		this.initialized = true;
@@ -12404,6 +13384,17 @@ var FunnelController = class {
 		await this.enqueue(async () => {
 			if (this.enabled === enabled && (enabled === false || this.child !== void 0)) return;
 			if (!enabled) await this.stop();
+			try {
+				await this.assertStateParents();
+			} catch (error) {
+				this.enabled = false;
+				this.publish({
+					enabled: false,
+					state: "unavailable",
+					errorCode: "funnel_state_invalid"
+				});
+				throw error;
+			}
 			this.enabled = enabled;
 			await this.options.store.save({
 				version: 1,
@@ -12421,6 +13412,17 @@ var FunnelController = class {
 	async reconnect() {
 		if (!this.initialized || this.disposed) throw new Error("Funnel controller is unavailable");
 		await this.enqueue(async () => {
+			await this.stop();
+			try {
+				await this.assertStateParents();
+			} catch (error) {
+				this.publish({
+					enabled: this.enabled,
+					state: "unavailable",
+					errorCode: "funnel_state_invalid"
+				});
+				throw error;
+			}
 			if (!this.enabled) {
 				this.enabled = true;
 				await this.options.store.save({
@@ -12428,7 +13430,6 @@ var FunnelController = class {
 					enabled: true
 				});
 			}
-			await this.stop();
 			await this.start();
 		});
 		return this.status();
@@ -12439,14 +13440,21 @@ var FunnelController = class {
 		await this.enqueue(async () => {
 			await this.stop();
 			this.enabled = false;
-			await this.options.store.save({
-				version: 1,
-				enabled: false
-			});
-			await rm(resolve(this.options.stateDirectory), {
-				recursive: true,
-				force: true
-			});
+			try {
+				await removeManagedTree(this.ownedRoot, this.options.stateDirectory, "funnel");
+				await this.assertStateParents();
+				await this.options.store.save({
+					version: 1,
+					enabled: false
+				});
+			} catch (error) {
+				this.publish({
+					enabled: false,
+					state: "off",
+					errorCode: "funnel_state_invalid"
+				});
+				throw error;
+			}
 			this.publish({
 				enabled: false,
 				state: "off"
@@ -12471,6 +13479,15 @@ var FunnelController = class {
 			this.options.onStatus?.(this.status());
 		} catch {}
 	}
+	async assertStateParents() {
+		await assertManagedParents(this.ownedRoot, this.options.stateDirectory, "funnel");
+		try {
+			const entry = await lstat(this.options.stateDirectory);
+			if (!entry.isDirectory() || entry.isSymbolicLink()) throw new Error("funnel_path_invalid");
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+	}
 	async start() {
 		const generation = ++this.generation;
 		let entry;
@@ -12492,6 +13509,17 @@ var FunnelController = class {
 			});
 			return;
 		}
+		try {
+			await this.assertStateParents();
+			await ensureManagedDirectory(this.ownedRoot, this.options.stateDirectory, "funnel");
+		} catch (_error) {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "funnel_state_invalid"
+			});
+			return;
+		}
 		this.buffer = "";
 		this.publish({
 			enabled: true,
@@ -13147,20 +14175,19 @@ async function pathExists(path) {
 /** Replace only this version's verified binary, retaining the previous directory until promotion succeeds. */
 async function publishVerifiedCpolarExecutable(extracted, componentRoot, componentStorage, executableName, operations = {}) {
 	if (dirname(componentStorage) !== componentRoot || !inside(componentRoot, componentStorage) || basename(executableName) !== executableName || executableName === "." || executableName === "..") throw new Error("cpolar component storage escaped its private root");
-	const move = operations.move ?? rename;
-	const remove = operations.remove ?? ((path) => rm(path, {
-		recursive: true,
-		force: true
-	}));
+	const move = async (from, to) => {
+		await assertManagedParents(componentRoot, from, "cpolar");
+		await assertManagedParents(componentRoot, to, "cpolar");
+		if (operations.move === void 0) await renameManagedPath(componentRoot, from, to, "cpolar");
+		else await operations.move(from, to);
+	};
+	const remove = operations.remove ?? ((path) => removeManagedTree(componentRoot, path, "cpolar"));
 	const candidate = join(componentRoot, `.install-${randomBytes(12).toString("hex")}`);
 	const backup = join(componentRoot, `.previous-${randomBytes(12).toString("hex")}`);
 	let backupContainsPrevious = false;
 	let replacementInstalled = false;
 	try {
-		await mkdir(candidate, {
-			recursive: true,
-			mode: 448
-		});
+		await ensureManagedDirectory(componentRoot, candidate, "cpolar");
 		await copyFile(extracted, join(candidate, executableName));
 		await chmod(join(candidate, executableName), 448);
 		if (await pathExists(componentStorage)) {
@@ -13194,10 +14221,7 @@ async function publishVerifiedCpolarExecutable(extracted, componentRoot, compone
 	}
 }
 /** Remove only this install's staging directory without replacing a preceding failure. */
-async function cleanupCpolarInstallStaging(staging, installFailed, remove = (path) => rm(path, {
-	recursive: true,
-	force: true
-})) {
+async function cleanupCpolarInstallStaging(staging, installFailed, remove = (path) => removeManagedTree(dirname(path), path, "cpolar")) {
 	try {
 		await remove(staging);
 	} catch (error) {
@@ -13291,6 +14315,7 @@ var CpolarComponentManager = class {
 	stateRoot;
 	logRoot;
 	stagingRoot;
+	stateDirectory;
 	platform;
 	arch;
 	release;
@@ -13301,8 +14326,9 @@ var CpolarComponentManager = class {
 	errorCode;
 	queue = Promise.resolve();
 	constructor(options) {
+		if (!isAbsolute(options.stateDirectory)) throw new Error("cpolar state directory must be absolute");
 		const stateDirectory = resolve(options.stateDirectory);
-		if (!isAbsolute(stateDirectory)) throw new Error("cpolar state directory must be absolute");
+		this.stateDirectory = stateDirectory;
 		this.platform = options.platform ?? process.platform;
 		this.arch = options.arch ?? process.arch;
 		this.release = CPOLAR_COMPONENT_RELEASES[`${this.platform}-${this.arch}`];
@@ -13330,13 +14356,24 @@ var CpolarComponentManager = class {
 	/** Inspect the managed binary and configuration without using global cpolar state. */
 	async initialize() {
 		const release = this.release;
-		this.installed = release !== void 0 && await regularFile(this.executable, release.executableBytes);
-		if (this.installed && release !== void 0 && await sha256(this.executable) !== release.executableSha256) {
+		this.installed = false;
+		this.configured = false;
+		this.errorCode = void 0;
+		try {
+			await assertManagedParents(this.stateDirectory, this.executable, "cpolar");
+			await assertManagedParents(this.stateDirectory, this.configFile, "cpolar");
+			this.installed = release !== void 0 && await regularFile(this.executable, release.executableBytes);
+			if (this.installed && release !== void 0 && await sha256(this.executable) !== release.executableSha256) {
+				this.installed = false;
+				this.errorCode = "cpolar_component_invalid";
+			}
+			this.configured = await regularFile(this.configFile);
+			if (this.configured) await restrictPrivateFile(this.configFile);
+		} catch (_error) {
 			this.installed = false;
+			this.configured = false;
 			this.errorCode = "cpolar_component_invalid";
 		}
-		this.configured = await regularFile(this.configFile);
-		if (this.configured) await restrictPrivateFile(this.configFile);
 	}
 	/** Return a safe status that never includes the account token. */
 	status() {
@@ -13362,11 +14399,9 @@ var CpolarComponentManager = class {
 		return this.enqueue(async () => {
 			const release = this.release;
 			if (release === void 0) throw new Error("cpolar_component_unsupported");
+			await assertManagedParents(this.stateDirectory, this.executable, "cpolar");
 			const staging = await installStep("cpolar_storage_failed", async () => {
-				await mkdir(this.stagingRoot, {
-					recursive: true,
-					mode: 448
-				});
+				await ensureManagedDirectory(this.stateDirectory, this.stagingRoot, "cpolar");
 				return mkdtemp(join(this.stagingRoot, "install-"));
 			});
 			let installFailed = false;
@@ -13394,19 +14429,24 @@ var CpolarComponentManager = class {
 				await installStep("cpolar_extract_failed", () => this.extractArtifact(archive, staging));
 				const extracted = join(staging, release.executableName);
 				if (!await installStep("cpolar_extract_failed", async () => await regularFile(extracted, release.executableBytes) && await sha256(extracted) === release.executableSha256)) throw new Error("cpolar_executable_hash_mismatch");
-				await installStep("cpolar_storage_failed", () => publishVerifiedCpolarExecutable(extracted, this.componentRoot, this.componentStorage, release.executableName));
+				await installStep("cpolar_storage_failed", async () => {
+					await ensureManagedDirectory(this.stateDirectory, this.componentRoot, "cpolar");
+					await assertManagedParents(this.stateDirectory, this.executable, "cpolar");
+					await publishVerifiedCpolarExecutable(extracted, this.componentRoot, this.componentStorage, release.executableName);
+				});
 				this.installed = true;
 				this.errorCode = void 0;
 			} catch (error) {
 				installFailed = true;
 				try {
+					await assertManagedParents(this.stateDirectory, this.executable, "cpolar");
 					this.installed = await regularFile(this.executable, release.executableBytes) && await sha256(this.executable) === release.executableSha256;
 				} catch (_inspectionError) {
 					this.installed = false;
 				}
 				throw error;
 			} finally {
-				await cleanupCpolarInstallStaging(staging, installFailed);
+				await cleanupCpolarInstallStaging(staging, installFailed, (path) => removeManagedTree(this.stateDirectory, path, "cpolar"));
 			}
 		});
 	}
@@ -13414,24 +14454,8 @@ var CpolarComponentManager = class {
 	configure(authtoken) {
 		return this.enqueue(async () => {
 			const token = validateCpolarAuthtoken(authtoken);
-			await mkdir(this.stateRoot, {
-				recursive: true,
-				mode: 448
-			});
-			const temporary = join(this.stateRoot, `.cpolar.${randomBytes(12).toString("hex")}.tmp`);
 			const body = `authtoken: ${JSON.stringify(token)}\nconsole_ui: false\nupdate: false\ninspect_db_size: -1\n`;
-			try {
-				await writeFile(temporary, body, {
-					encoding: "utf8",
-					flag: "wx",
-					mode: 384
-				});
-				await rename(temporary, this.configFile);
-				await restrictPrivateFile(this.configFile);
-			} catch (error) {
-				await rm(temporary, { force: true });
-				throw error;
-			}
+			await writeManagedPrivateFile(this.stateDirectory, this.configFile, body, "cpolar");
 			this.configured = true;
 			this.errorCode = void 0;
 		});
@@ -13439,24 +14463,12 @@ var CpolarComponentManager = class {
 	/** Remove every cpolar file owned by DSH Mobile without touching global state. */
 	purge() {
 		return this.enqueue(async () => {
-			await Promise.all([
-				rm(this.componentRoot, {
-					recursive: true,
-					force: true
-				}),
-				rm(this.stateRoot, {
-					recursive: true,
-					force: true
-				}),
-				rm(this.logRoot, {
-					recursive: true,
-					force: true
-				}),
-				rm(this.stagingRoot, {
-					recursive: true,
-					force: true
-				})
-			]);
+			await removeManagedPaths(this.stateDirectory, [
+				this.componentRoot,
+				this.stateRoot,
+				this.logRoot,
+				this.stagingRoot
+			], "cpolar");
 			this.installed = false;
 			this.configured = false;
 			this.errorCode = void 0;
@@ -13470,82 +14482,25 @@ var CpolarComponentManager = class {
 };
 //#endregion
 //#region src/caddy-files.ts
-/** Refuse link-shaped ancestors within the owned state root before filesystem operations. */
+/** Refuse link-shaped ancestors within Caddy's owned state root. */
 async function assertCaddyParents(root, target) {
-	const parent = resolve(root);
-	const candidate = resolve(target);
-	const offset = relative(parent, candidate);
-	if (!isAbsolute(root) || offset !== "" && (offset.startsWith("..") || isAbsolute(offset))) throw new Error("caddy_path_invalid");
-	const paths = [parent];
-	let cursor = parent;
-	for (const segment of relative(parent, dirname(candidate)).split(/[\\/]/u).filter(Boolean)) {
-		cursor = join(cursor, segment);
-		paths.push(cursor);
-	}
-	for (const path of paths) {
-		let entry;
-		try {
-			entry = await lstat(path);
-		} catch (error) {
-			if (error.code === "ENOENT") continue;
-			throw error;
-		}
-		if (!entry.isDirectory() || entry.isSymbolicLink()) throw new Error("caddy_path_invalid");
-	}
+	await assertManagedParents(root, target, "caddy");
 }
-/** Create a private real directory, never traversing a link owned by the component. */
+/** Move a Caddy-owned path, preserving bounded Windows retries and ownership checks. */
+async function renameCaddyPath(root, source, destination) {
+	await renameManagedPath(root, source, destination, "caddy");
+}
+/** Create a real Caddy directory, securing fresh directories and preserving existing ACLs. */
 async function ensureCaddyDirectory(root, directory) {
-	await assertCaddyParents(root, directory);
-	await mkdir(directory, {
-		recursive: true,
-		mode: 448
-	});
-	const entry = await lstat(directory);
-	if (!entry.isDirectory() || entry.isSymbolicLink()) throw new Error("caddy_path_invalid");
-	await restrictPrivateFile(directory, 448);
+	await ensureManagedDirectory(root, directory, "caddy");
 }
-/** Atomically replace one private configuration file under a real owned directory. */
+/** Atomically replace one private Caddy configuration file. */
 async function writeCaddyPrivateFile(root, file, body) {
-	await ensureCaddyDirectory(root, dirname(file));
-	try {
-		const entry = await lstat(file);
-		if (!entry.isFile() || entry.isSymbolicLink()) throw new Error("caddy_config_target_invalid");
-	} catch (error) {
-		if (error.code !== "ENOENT") throw error;
-	}
-	const temporary = join(dirname(file), "." + basename(file) + "." + randomBytes(12).toString("hex") + ".tmp");
-	try {
-		await writeFile(temporary, body, {
-			encoding: "utf8",
-			flag: "wx",
-			mode: 384
-		});
-		await restrictPrivateFile(temporary);
-		await rename(temporary, file);
-	} finally {
-		await rm(temporary, { force: true });
-	}
+	await writeManagedPrivateFile(root, file, body, "caddy");
 }
-/** Delete only owned entries; junctions and symlinks are unlinked, never descended into. */
+/** Delete only Caddy-owned children; unlink junctions and symlinks themselves. */
 async function removeCaddyTree(root, target) {
-	await assertCaddyParents(root, target);
-	let entry;
-	try {
-		entry = await lstat(target);
-	} catch (error) {
-		if (error.code === "ENOENT") return;
-		throw error;
-	}
-	if (entry.isSymbolicLink()) {
-		await unlink(target);
-		return;
-	}
-	if (!entry.isDirectory()) {
-		await unlink(target);
-		return;
-	}
-	for (const name of await readdir(target)) await removeCaddyTree(root, join(target, name));
-	await rmdir(target);
+	await removeManagedTree(root, target, "caddy");
 }
 //#endregion
 //#region src/caddy-component.ts
@@ -13622,7 +14577,7 @@ var CaddyComponentManager = class {
 			errorPrefix: "caddy"
 		}));
 		this.inspectExecutable = options.inspectExecutable ?? inspect;
-		this.promote = options.promoteDirectory ?? rename;
+		this.promote = options.promoteDirectory ?? ((source, destination) => renameCaddyPath(this.stateDirectory, source, destination));
 	}
 	/** Recheck a pinned executable before launching; no unverified local binary can run. */
 	async ensureExecutable() {
@@ -13673,6 +14628,7 @@ var CaddyComponentManager = class {
 			const backup = join(this.componentRoot, ".previous-" + randomBytes(12).toString("hex"));
 			let previous = false;
 			let promoted = false;
+			let failed = false;
 			try {
 				const controller = new AbortController();
 				const timeout = setTimeout(() => {
@@ -13699,7 +14655,7 @@ var CaddyComponentManager = class {
 				try {
 					const entry = await lstat(this.componentStorage);
 					if (!entry.isDirectory() || entry.isSymbolicLink()) throw new Error("caddy_path_invalid");
-					await rename(this.componentStorage, backup);
+					await renameCaddyPath(this.stateDirectory, this.componentStorage, backup);
 					previous = true;
 				} catch (error) {
 					if (error.code !== "ENOENT") throw error;
@@ -13708,18 +14664,33 @@ var CaddyComponentManager = class {
 					await this.promote(candidate, this.componentStorage);
 					promoted = true;
 				} catch (error) {
-					if (previous) {
-						await rename(backup, this.componentStorage);
+					if (previous) try {
+						await renameCaddyPath(this.stateDirectory, backup, this.componentStorage);
 						previous = false;
+					} catch (rollbackError) {
+						this.installed = false;
+						this.errorCode = "caddy_component_invalid";
+						throw new AggregateError([error, rollbackError], "caddy_component_rollback_failed", { cause: error });
 					}
 					throw error;
 				}
 				this.installed = true;
 				this.errorCode = void 0;
+			} catch (error) {
+				failed = true;
+				throw error;
 			} finally {
-				await removeCaddyTree(this.stateDirectory, staging);
-				await removeCaddyTree(this.stateDirectory, candidate);
-				if (previous && promoted) await removeCaddyTree(this.stateDirectory, backup);
+				let cleanupError;
+				for (const path of [
+					staging,
+					candidate,
+					...previous && promoted ? [backup] : []
+				]) try {
+					await removeCaddyTree(this.stateDirectory, path);
+				} catch (error) {
+					cleanupError ??= error;
+				}
+				if (!failed && cleanupError !== void 0) throw cleanupError;
 			}
 		});
 	}
@@ -14832,24 +15803,69 @@ var PluginReleaseManager = class {
 //#endregion
 //#region src/file-logger.ts
 const MAX_LOG_BYTES = 5242880;
-/** Install a plugin-scoped Cordis exporter backed by a private UTF-8 log file. */
-async function installMobileFileLogger(ctx, stateDirectory) {
+const MAX_QUEUED_BYTES = 262144;
+const PATH_PREFIX = "mobile_log";
+async function regularLogFile(file) {
+	try {
+		const entry = await lstat(file);
+		if (!entry.isFile() || entry.isSymbolicLink()) throw new Error("mobile_log_target_invalid");
+		return entry;
+	} catch (error) {
+		if (error.code === "ENOENT") return void 0;
+		throw error;
+	}
+}
+/** Open a private append-only file before registering a safely disposable Cordis exporter. */
+async function installMobileFileLogger(ctx, stateDirectory, options = {}) {
 	const directory = join(stateDirectory, "logs");
 	const file = join(directory, "dsh-mobile.log");
 	const previous = `${file}.1`;
-	await mkdir(directory, {
-		recursive: true,
-		mode: 448
-	});
-	const entry = await lstat(file).catch(() => void 0);
-	if (entry !== void 0 && entry.isFile() && !entry.isSymbolicLink() && entry.size >= MAX_LOG_BYTES) {
-		await rm(previous, { force: true });
-		await rename(file, previous);
+	await ensureManagedDirectory(stateDirectory, directory, PATH_PREFIX);
+	const entry = await regularLogFile(file);
+	if (entry !== void 0 && entry.size >= MAX_LOG_BYTES) {
+		await regularLogFile(previous);
+		await removeManagedTree(stateDirectory, previous, PATH_PREFIX);
+		await renameManagedPath(stateDirectory, file, previous, PATH_PREFIX);
+		await regularLogFile(previous);
+		await restrictPrivateFile(previous);
+	}
+	await assertManagedParents(stateDirectory, file, PATH_PREFIX);
+	await regularLogFile(file);
+	const handle = await open(file, constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | (constants.O_NOFOLLOW ?? 0), 384);
+	let stream;
+	try {
+		const opened = await handle.stat();
+		const actual = await regularLogFile(file);
+		if (!opened.isFile() || actual === void 0 || actual.dev !== opened.dev || actual.ino !== opened.ino) throw new Error("mobile_log_target_invalid");
+		await assertManagedParents(stateDirectory, file, PATH_PREFIX);
+		await handle.chmod(384);
+		await restrictPrivateFile(file);
+		stream = options.createStream?.(handle) ?? handle.createWriteStream({
+			encoding: "utf8",
+			autoClose: true
+		});
+	} catch (error) {
+		await handle.close();
+		throw error;
 	}
-	const stream = createWriteStream(file, {
-		flags: "a",
-		encoding: "utf8",
-		mode: 384
+	let stopped = false;
+	let removeExporter;
+	const stopLogging = (error) => {
+		if (stopped) return;
+		stopped = true;
+		try {
+			Promise.resolve(removeExporter?.()).catch(() => void 0);
+		} catch (disposeError) {}
+		stream.destroy();
+		const candidate = error;
+		const code = candidate !== null && typeof candidate === "object" && typeof candidate.code === "string" ? candidate.code : "write_failed";
+		try {
+			ctx.logger("dsh-mobile").warn("file logging disabled (%s); other logging remains available", code);
+		} catch (loggerError) {}
+	};
+	stream.on("error", stopLogging);
+	const closed = finished$1(stream, { cleanup: true }).catch((error) => {
+		stopLogging(error);
 	});
 	const exporter = {
 		colors: false,
@@ -14859,20 +15875,40 @@ async function installMobileFileLogger(ctx, stateDirectory) {
 			"dsh-mobile": 3
 		},
 		export(message) {
-			if (message.name !== "dsh-mobile") return;
-			const record = {
-				timestamp: new Date(message.ts).toISOString(),
-				level: message.type,
-				logger: message.name,
-				message: Logger.format(exporter, message)
-			};
-			stream.write(`${JSON.stringify(record)}\n`);
+			if (stopped || message.name !== "dsh-mobile") return;
+			try {
+				const record = {
+					timestamp: new Date(message.ts).toISOString(),
+					level: message.type,
+					logger: message.name,
+					message: Logger.format(exporter, message)
+				};
+				const line = `${JSON.stringify(record)}\n`;
+				if (stream.writableLength + Buffer.byteLength(line) > MAX_QUEUED_BYTES) {
+					stopLogging(Object.assign(/* @__PURE__ */ new Error("file log queue exhausted"), { code: "backpressure" }));
+					return;
+				}
+				stream.write(line);
+			} catch (error) {
+				stopLogging(error);
+			}
 		}
 	};
-	ctx.logger.exporter(exporter);
-	ctx.effect(() => () => {
-		stream.end();
-	}, "dsh-mobile file logger");
+	try {
+		removeExporter = ctx.logger.exporter(exporter);
+		ctx.effect(() => async () => {
+			stopped = true;
+			await removeExporter?.();
+			stream.end();
+			await closed;
+		}, "dsh-mobile file logger");
+	} catch (error) {
+		stopped = true;
+		stream.destroy();
+		await closed;
+		await removeExporter?.();
+		throw error;
+	}
 	return file;
 }
 //#endregion
@@ -15034,6 +16070,7 @@ function installedDshVersion() {
 }
 function mapAdminError(error) {
 	if (error instanceof HttpError) return error;
+	if (error instanceof MobileExtensionError) return new HttpError(error.status, error.code);
 	const code = error.code;
 	if (error instanceof Error && error.message.includes("spawn UNKNOWN")) return new HttpError(409, "frp_component_launch_failed");
 	if (code === "EADDRNOTAVAIL") return new HttpError(409, "network_address_changed");
@@ -15210,10 +16247,14 @@ function frpIngressGatewayConfig(template, settings, stateFile, ingress, listenP
 * An unreadable self-signed CA fails explicitly: falling back to the system
 * trust store would hide a broken pairing identity behind a start timeout.
 */
-async function readFrpIngressTrustAnchor(settings, stateFile) {
+async function readFrpIngressTrustAnchor(settings, stateFile, ownedRoot = dirname(stateFile)) {
 	if (!isFrpSelfSignedIngress(settings)) return void 0;
 	try {
-		return await readFile(frpIngressPaths(stateFile).caCertFile, "utf8");
+		const file = frpIngressPaths(stateFile).caCertFile;
+		await assertManagedParents(ownedRoot, file, "frp_ingress");
+		const entry = await lstat(file);
+		if (!entry.isFile() || entry.isSymbolicLink()) throw new Error("frp_ingress_file_invalid");
+		return await readFile(file, "utf8");
 	} catch (error) {
 		throw new Error("frp_ingress_ca_invalid", { cause: error });
 	}
@@ -15306,15 +16347,15 @@ async function apply(ctx, config) {
 	const frpComponent = new FrpComponentManager({ stateDirectory });
 	await frpComponent.initialize();
 	const frpIdentity = await loadOrCreateInstallationId(join(stateDirectory, "installation-id"));
-	const frpConfig = new FrpConfigStore(join(remoteDirectory, "frp", "config"), frpProxyName(frpIdentity));
+	const frpConfig = new FrpConfigStore(join(remoteDirectory, "frp", "config"), frpProxyName(frpIdentity), stateDirectory);
 	await frpConfig.initialize();
-	const originConfig = new OriginConfigStore(join(remoteDirectory, "origin", "config"));
+	const originConfig = new OriginConfigStore(join(remoteDirectory, "origin", "config"), stateDirectory);
 	await originConfig.initialize();
 	const caddyComponent = new CaddyComponentManager({ stateDirectory });
 	await caddyComponent.initialize();
 	const caddyConfig = new CaddyConfigStore(stateDirectory);
 	await caddyConfig.initialize();
-	const cloudflaredTunnel = new CloudflaredTunnelStore(join(remoteDirectory, "cloudflared"));
+	const cloudflaredTunnel = new CloudflaredTunnelStore(join(remoteDirectory, "cloudflared"), stateDirectory);
 	await cloudflaredTunnel.initialize();
 	const unregisterBuiltin = mobileAccess.registerExtension({
 		schemaVersion: 1,
@@ -15433,7 +16474,7 @@ async function apply(ctx, config) {
 	*/
 	const createFrpGateway = async (publicOrigin, settings) => {
 		if (!isFrpSelfSignedIngress(settings)) return createRemoteGateway(publicOrigin);
-		const ingress = await ensureFrpIngressCertificate(settings, remoteDeviceFile);
+		const ingress = await ensureFrpIngressCertificate(settings, remoteDeviceFile, Date.now(), void 0, stateDirectory);
 		const resolved = frpIngressGatewayConfig(template, settings, remoteDeviceFile, ingress);
 		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences);
 		try {
@@ -15482,6 +16523,7 @@ async function apply(ctx, config) {
 			store: tailscaleStore,
 			executable: funnelExecutable(import.meta.url),
 			stateDirectory: join(remoteDirectory, "tailscale"),
+			ownedRoot: stateDirectory,
 			hostname: `dsh-${instanceId.slice(0, 12)}`,
 			createGateway: createRemoteGateway
 		}),
@@ -15509,9 +16551,9 @@ async function apply(ctx, config) {
 			* Only this module knows where the ingress material lives, so the anchor is
 			* read here from the ingress directory instead of being guessed downstream.
 			*/
-			resolveDiscoveryTrustAnchor: (settings) => readFrpIngressTrustAnchor(settings, remoteDeviceFile),
+			resolveDiscoveryTrustAnchor: (settings) => readFrpIngressTrustAnchor(settings, remoteDeviceFile, stateDirectory),
 			maintainIngressCertificate: async (settings, gateway) => {
-				await ensureFrpIngressCertificate(settings, remoteDeviceFile, Date.now(), gateway.config.instanceId);
+				await ensureFrpIngressCertificate(settings, remoteDeviceFile, Date.now(), gateway.config.instanceId, stateDirectory);
 				await gateway.refreshProvidedTls();
 			}
 		}),
@@ -15590,7 +16632,7 @@ async function apply(ctx, config) {
 		const frpGateway = remoteControllers.frp.gateway();
 		const pinnedFrpProbe = frpSettings !== void 0 && isFrpSelfSignedIngress(frpSettings) && frpGateway !== void 0 && frpOrigin !== void 0 ? async () => {
 			try {
-				const trustAnchorPem = await readFrpIngressTrustAnchor(frpSettings, remoteDeviceFile);
+				const trustAnchorPem = await readFrpIngressTrustAnchor(frpSettings, remoteDeviceFile, stateDirectory);
 				if (trustAnchorPem === void 0) return { state: "unreachable" };
 				const started = performance.now();
 				return await defaultProbeDiscovery({
@@ -15713,6 +16755,17 @@ async function apply(ctx, config) {
 					sendJson(response, 200, await releaseManager.status(), false);
 					return;
 				}
+				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/extensions/hosts`) {
+					sendJson(response, 200, mobileAccess.hostStatus(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/extensions/recover`) {
+					const body = await readJsonObject(request, 4096);
+					if (typeof body.id !== "string" || body.confirm !== true) throw new HttpError(400, "bad_request");
+					await mobileAccess.recoverExtension(body.id);
+					sendJson(response, 200, mobileAccess.hostStatus(), false);
+					return;
+				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/release/update`) {
 					await readJsonObject(request, 4096);
 					sendJson(response, 200, await releaseManager.update(), false);
@@ -15946,7 +16999,7 @@ async function apply(ctx, config) {
 				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/remote/frp/self-check`) {
 					const settings = frpConfig.settings();
 					if (settings === void 0) throw new HttpError(409, "frp_config_missing");
-					const check = await frpIngressSelfCheck(settings, remoteDeviceFile);
+					const check = await frpIngressSelfCheck(settings, remoteDeviceFile, stateDirectory);
 					const entry = resolveFrpEntryProbe(settings);
 					const [frpsReachable, entryReachable] = await Promise.all([probeTcpReachable(settings.serverAddress, settings.serverPort), probeTcpReachable(entry.host, entry.port)]);
 					sendJson(response, 200, {
@@ -16061,10 +17114,10 @@ async function apply(ctx, config) {
 					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
 					await remoteProviders.mutate(async () => {
 						await remoteControllers.frp.setEnabled(false);
-						await Promise.all([
-							frpComponent.purge(),
-							frpConfig.purge(),
-							purgeFrpIngressCertificates(remoteDeviceFile)
+						await settleCleanupSteps([
+							() => frpComponent.purge().then(() => void 0),
+							() => frpConfig.purge().then(() => void 0),
+							() => purgeFrpIngressCertificates(remoteDeviceFile, stateDirectory)
 						]);
 					});
 					sendJson(response, 200, remotePayload(), false);
@@ -16130,15 +17183,23 @@ async function apply(ctx, config) {
 					kind: "error",
 					text: "请带上需求，例如：/mobile 把手机端改成深色主题"
 				};
+				const hostStates = new Map(mobileAccess.hostStatus().hosts.map((host) => [host.id, host]));
 				const guide = buildMobileGuide({
 					directory: stateDirectory,
 					hasCustomCss: await existsRegularFile(template.customCssFile),
 					hasCustomJs: await existsRegularFile(template.customScriptFile),
-					extensions: mobileAccess.manifest().map((entry) => ({
-						id: entry.id,
-						name: entry.name,
-						version: entry.version
-					})),
+					extensions: mobileAccess.manifest().map((entry) => {
+						const host = hostStates.get(entry.id);
+						return {
+							id: entry.id,
+							name: entry.name,
+							version: entry.version,
+							...host === void 0 ? {} : {
+								executionMode: host.mode,
+								executionState: host.state
+							}
+						};
+					}),
 					failedExtensionCount: mobileAccess.status().failed
 				});
 				agent.steer(createUserMessage({
@@ -16159,7 +17220,7 @@ async function apply(ctx, config) {
 			}
 		});
 		try {
-			await mobileAccess.startLocal(template.extensionsDir, ctx);
+			await mobileAccess.startLocal(template.extensionsDir, ctx, { hostExecution: template.hostExecution });
 			await lanController.initialize();
 			const stores = {
 				tailscale: tailscaleStore,
@@ -16211,6 +17272,6 @@ async function apply(ctx, config) {
 	}, "dsh-mobile: independent LAN and selectable remote providers with /mobile command");
 }
 //#endregion
-export { AUTH_PREFIX, AccessController, AccessError, BlockedUpgradePathLog, BoundedRateLimiter, CERT_EXPIRING_DAYS, CLOUDFLARED_COMPONENT_RELEASE, CLOUDFLARED_COMPONENT_RELEASES, CSRF_COOKIE, CSRF_HEADER, ClientModuleConflictError, ClientModulePreferenceStore, CloudflaredComponentManager, CloudflaredController, CloudflaredTunnelStore, Config, DEFAULT_ORIGIN_LISTEN_PORT, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_ATTACH_DISCOVERY_PATH, FRP_ATTACH_LOCAL_DECLARATION, FRP_ATTACH_SELF_SIGNED_DECLARATION, FRP_ATTACH_VPS_DECLARATION, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FRP_DEFAULT_PROXY_NAME, FRP_DEFAULT_PUBLIC_PORT, FRP_RESERVED_PORTS, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, OriginConfigStore, OriginController, REMOTE_PROVIDERS, RequestTrustPolicy, SESSION_COOKIE, TASK_EVENT_DEBOUNCE_MS, TaskEventHub, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpAttachPlan, createFrpAttachTemplate, createFrpAttachTemplateParts, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, ensureFrpIngressCertificate, evaluateCertificateLifetime, frpAttachVpsParts, frpIngressPaths, frpIngressSelfCheck, frpProxyName, inject, isCloudflaredRegistration, isFrpSelfSignedIngress, isGloballyRoutableIpv4, isLoopbackAddress, issueServerCertificate, mergeSavedCloudflaredTunnelSettings, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, originGatewayConfig, parseAuthority, parseCidr, parseCloudflaredOrigin, parseCloudflaredTunnelSettings, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseOriginSettings, parseRemoteProviderState, probeOriginCertificate, readCertificateRenewal, resolveAuthority, resolveFrpEntryTls, resolveFrpMode, resolveFrpPublicPort, resolveFrpVhostHttpPort, rewriteMobileIndex, validateAttachSettings, validateCloudflaredTunnelHostname, validateCloudflaredTunnelPort, validateCloudflaredTunnelToken, validateFrpEntryTls, validateFrpMode, validateFrpProxyName, validateFrpPublicOrigin, validateFrpPublicPort, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateFrpVhostHttpPort, validateOriginAllowedCidrs, validateOriginListenHost, validateOriginListenPort, validateOriginPublicOrigin, validateWebSocketPath, watchTaskCompletions };
+export { AUTH_PREFIX, AccessController, AccessError, BlockedUpgradePathLog, BoundedRateLimiter, CERT_EXPIRING_DAYS, CLOUDFLARED_COMPONENT_RELEASE, CLOUDFLARED_COMPONENT_RELEASES, CSRF_COOKIE, CSRF_HEADER, ClientModuleConflictError, ClientModulePreferenceStore, CloudflaredComponentManager, CloudflaredController, CloudflaredTunnelStore, Config, DEFAULT_ORIGIN_LISTEN_PORT, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_ATTACH_DISCOVERY_PATH, FRP_ATTACH_LOCAL_DECLARATION, FRP_ATTACH_SELF_SIGNED_DECLARATION, FRP_ATTACH_VPS_DECLARATION, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FRP_DEFAULT_PROXY_NAME, FRP_DEFAULT_PUBLIC_PORT, FRP_RESERVED_PORTS, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, OriginConfigStore, OriginController, REMOTE_PROVIDERS, RequestTrustPolicy, SESSION_COOKIE, TASK_EVENT_DEBOUNCE_MS, TaskEventHub, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpAttachPlan, createFrpAttachTemplate, createFrpAttachTemplateParts, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, ensureFrpIngressCertificate, evaluateCertificateLifetime, frpAttachVpsParts, frpIngressPaths, frpIngressSelfCheck, frpProxyName, inject, isCloudflaredRegistration, isFrpSelfSignedIngress, isGloballyRoutableIpv4, isLoopbackAddress, issueServerCertificate, mergeSavedCloudflaredTunnelSettings, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, originGatewayConfig, parseAuthority, parseCidr, parseCloudflaredOrigin, parseCloudflaredTunnelSettings, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseOriginSettings, parseRemoteProviderState, probeOriginCertificate, readCertificateRenewal, resolveAuthority, resolveFrpEntryTls, resolveFrpMode, resolveFrpPublicPort, resolveFrpVhostHttpPort, resolveHostExecution, rewriteMobileIndex, validateAttachSettings, validateCloudflaredTunnelHostname, validateCloudflaredTunnelPort, validateCloudflaredTunnelToken, validateFrpEntryTls, validateFrpMode, validateFrpProxyName, validateFrpPublicOrigin, validateFrpPublicPort, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateFrpVhostHttpPort, validateOriginAllowedCidrs, validateOriginListenHost, validateOriginListenPort, validateOriginPublicOrigin, validateWebSocketPath, watchTaskCompletions };
 
 //# sourceMappingURL=index.mjs.map