dsh-mobile 0.6.3 → 0.6.4

package/lib/index.mjs

@@ -5,6 +5,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import z from "@deepseek-ai/schemastery";
 import { connect, createServer } from "node:net";
 import { chmod, copyFile, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, realpath, rename, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
+import { performance as performance$1 } from "node:perf_hooks";
 import { execFile, spawn } from "node:child_process";
 import { createSocket } from "node:dgram";
 import { homedir, hostname, networkInterfaces, tmpdir } from "node:os";
@@ -1151,24 +1152,75 @@ function execFileText(file, args, options = {}) {
 //#endregion
 //#region src/private-file.ts
 let userSidTask;
+function commandFailureDetails(error) {
+	if (error === null || typeof error !== "object") return {};
+	let descriptors;
+	try {
+		descriptors = Object.getOwnPropertyDescriptors(error);
+	} catch (_error) {
+		return {};
+	}
+	const code = descriptors.code?.value;
+	const signal = descriptors.signal?.value;
+	const killed = descriptors.killed?.value;
+	return {
+		...code === null || typeof code === "number" && Number.isSafeInteger(code) || typeof code === "string" && /^[A-Z][A-Z0-9_]{0,63}$/u.test(code) ? { code } : {},
+		...signal === null || typeof signal === "string" && /^SIG[A-Z0-9]{1,16}$/u.test(signal) ? { signal } : {},
+		...typeof killed === "boolean" ? { killed } : {}
+	};
+}
+/** Phase and full await duration, including subprocess creation, without arguments, output or private paths. */
+var PrivateFilePermissionError = class extends Error {
+	stage;
+	elapsedMs;
+	code;
+	signal;
+	killed;
+	constructor(stage, elapsedMs, error) {
+		const details = commandFailureDetails(error);
+		const fields = [
+			...details.code === void 0 ? [] : [`code=${String(details.code)}`],
+			...details.signal === void 0 ? [] : [`signal=${String(details.signal)}`],
+			...details.killed === void 0 ? [] : [`killed=${String(details.killed)}`]
+		];
+		const summary = `Windows private-file ${stage} failed after ${String(elapsedMs)} ms${fields.length === 0 ? "" : ` (${fields.join(", ")})`}`;
+		const cause = Object.assign(/* @__PURE__ */ new Error("Windows permission operation failed"), details);
+		super(summary, { cause });
+		this.stage = stage;
+		this.elapsedMs = elapsedMs;
+		this.name = "PrivateFilePermissionError";
+		this.code = details.code;
+		this.signal = details.signal;
+		this.killed = details.killed;
+	}
+};
+async function permissionOperation(stage, operation) {
+	const started = performance$1.now();
+	try {
+		return await operation();
+	} catch (error) {
+		throw new PrivateFilePermissionError(stage, Math.max(0, Math.round(performance$1.now() - started)), error);
+	}
+}
 function windowsSystemTool(name) {
 	const systemRoot = process.env.SystemRoot ?? process.env.WINDIR;
-	if (systemRoot === void 0 || !win32.isAbsolute(systemRoot)) throw new Error("Windows system root is unavailable");
+	if (systemRoot === void 0 || !win32.isAbsolute(systemRoot)) throw Object.assign(/* @__PURE__ */ new Error("Windows system root is unavailable"), { code: "WINDOWS_SYSTEM_ROOT_UNAVAILABLE" });
 	return win32.join(systemRoot, "System32", name);
 }
 async function currentWindowsUserSid() {
-	userSidTask ??= execFileText(windowsSystemTool("whoami.exe"), [
-		"/user",
-		"/fo",
-		"csv",
-		"/nh"
-	], {
-		encoding: "utf8",
-		windowsHide: true,
-		timeout: 1e4
-	}).then(({ stdout }) => {
+	userSidTask ??= permissionOperation("sid-query", async () => {
+		const { stdout } = await execFileText(windowsSystemTool("whoami.exe"), [
+			"/user",
+			"/fo",
+			"csv",
+			"/nh"
+		], {
+			encoding: "utf8",
+			windowsHide: true,
+			timeout: 1e4
+		});
 		const match = /,"(S-\d(?:-\d+)+)"\s*$/u.exec(stdout.trim());
-		if (match?.[1] === void 0) throw new Error("unable to resolve the current Windows user SID");
+		if (match?.[1] === void 0) throw Object.assign(/* @__PURE__ */ new Error("unable to resolve the current Windows user SID"), { code: "WINDOWS_USER_SID_INVALID" });
 		return match[1];
 	}).catch((error) => {
 		userSidTask = void 0;
@@ -1176,12 +1228,12 @@ async function currentWindowsUserSid() {
 	});
 	return userSidTask;
 }
-/** Restrict a sensitive regular file to the current user and Windows administrators. */
+/** Restrict a sensitive regular file to the current user and Windows administrators; reject Windows permission failures with redacted phase and duration. */
 async function restrictPrivateFile(file, mode = 384) {
 	await chmod(file, mode);
 	if (process.platform !== "win32") return;
 	const userSid = await currentWindowsUserSid();
-	await execFileText(windowsSystemTool("icacls.exe"), [
+	await permissionOperation("acl-apply", () => execFileText(windowsSystemTool("icacls.exe"), [
 		file,
 		"/inheritance:r",
 		"/grant:r",
@@ -1196,7 +1248,7 @@ async function restrictPrivateFile(file, mode = 384) {
 		encoding: "utf8",
 		windowsHide: true,
 		timeout: 1e4
-	});
+	}));
 }
 //#endregion
 //#region src/client-module-preferences.ts
@@ -1457,24 +1509,23 @@ var JsonMobileAccessControlStore = class {
 		this.file = file;
 		this.initiallyEnabled = initiallyEnabled;
 	}
-	/** Avoid writing an absent already-disabled state without changing recovery of existing files. */
+	/** Disable an existing preference, returning the state only after private-file preparation completes. */
 	async disableIfPresent() {
+		const disabled = Object.freeze({
+			version: 1,
+			enabled: false
+		});
 		try {
 			await lstat(this.file);
 		} catch (error) {
 			if (error.code === "ENOENT") {
-				if (this.initiallyEnabled) await this.save({
-					version: 1,
-					enabled: false
-				});
-				return;
+				if (this.initiallyEnabled) await this.save(disabled);
+				return disabled;
 			}
 			throw error;
 		}
-		await this.save({
-			version: 1,
-			enabled: false
-		});
+		await this.save(disabled);
+		return disabled;
 	}
 	async load() {
 		let stat;
@@ -1517,8 +1568,8 @@ var JsonMobileAccessControlStore = class {
 				flag: "wx",
 				mode: 384
 			});
+			await restrictPrivateFile(temporary);
 			await rename(temporary, this.file);
-			await restrictPrivateFile(this.file);
 		} catch (error) {
 			try {
 				await rm(temporary, { force: true });
@@ -1960,6 +2011,44 @@ function ensureMobileCompatibility(html) {
 	return `${html.slice(0, first.index)}${script}${html.slice(first.index)}`;
 }
 //#endregion
+//#region src/http-cache.ts
+/** Entity-tag handling for authenticated GET and HEAD cache validation. */
+const ENTITY_TAG = /^[\t ]*(?:W\/)?("[\x21\x23-\x7e\x80-\xff]*")[\t ]*$/u;
+const ENTITY_TAG_LIST_ITEM = /(?:W\/)?"[\x21\x23-\x7e\x80-\xff]*"/gu;
+/**
+* Compare a GET or HEAD If-None-Match field with an existing representation.
+* Invalid fields do not match; empty list elements are ignored per HTTP list syntax.
+* @param field - The received conditional request field.
+* @param etag - The selected representation's valid entity tag.
+* @returns Whether the representation is unchanged under weak comparison.
+*/
+function matchesIfNoneMatch(field, etag) {
+	if (field === void 0) return false;
+	const current = ENTITY_TAG.exec(etag)?.[1];
+	if (current === void 0) return false;
+	if (/^[\t ]*\*[\t ]*$/u.test(field)) return true;
+	let cursor = 0;
+	let count = 0;
+	let matches = false;
+	for (const item of field.matchAll(ENTITY_TAG_LIST_ITEM)) {
+		const gap = field.slice(cursor, item.index);
+		if (!(count === 0 ? /^[\t ,]*$/u : /^[\t ]*,[\t ,]*$/u).test(gap)) return false;
+		if ((item[0].startsWith("W/") ? item[0].slice(2) : item[0]) === current) matches = true;
+		cursor = item.index + item[0].length;
+		count++;
+	}
+	return count > 0 && /^[\t ,]*$/u.test(field.slice(cursor)) && matches;
+}
+/**
+* Keep an upstream validator usable after lossless content encoding changes.
+* @param etag - An upstream entity tag, if supplied.
+* @returns A weak quoted entity tag, or undefined for an absent or invalid tag.
+*/
+function weakenEntityTag(etag) {
+	const opaque = etag === void 0 ? void 0 : ENTITY_TAG.exec(etag)?.[1];
+	return opaque === void 0 ? void 0 : `W/${opaque}`;
+}
+//#endregion
 //#region src/browser-auth-cookies.ts
 const HOST_SESSION_COOKIE = "__Host-dsh_ma_session";
 const HOST_CSRF_COOKIE = "__Host-dsh_ma_csrf";
@@ -2993,15 +3082,15 @@ const HOST_ACTIVATION_TIMEOUT_MS = 5e3;
 const RETIRED_GENERATION_TTL_MS = 6e5;
 /** Extension teardown is advisory and must never stop watcher progress. */
 const HOST_TEARDOWN_TIMEOUT_MS = 2e3;
-async function withActivationTimeout(promise, id, signal) {
+async function withActivationTimeout(promise, id, signal, timeoutMs) {
 	let timer;
 	let onAbort;
 	try {
 		return await Promise.race([
 			promise,
-			new Promise((_, reject) => {
-				timer = setTimeout(() => reject(new MobileExtensionError("host_load_timeout", `extension ${id} activation timed out`, 500)), HOST_ACTIVATION_TIMEOUT_MS);
-			}),
+			...timeoutMs === void 0 ? [] : [new Promise((_, reject) => {
+				timer = setTimeout(() => reject(new MobileExtensionError("host_load_timeout", `extension ${id} activation timed out`, 500)), timeoutMs);
+			})],
 			new Promise((_, reject) => {
 				const abort = () => {
 					reject(new MobileExtensionError("host_activation_closed", `extension ${id} activation is closed`, 409));
@@ -3554,7 +3643,7 @@ var MobileAccessService = class extends Service {
 		if (extension === void 0) throw new MobileExtensionError("extension_not_found", "extension not found", 404);
 		const route = ("host" in extension ? extension.host : extension).routes?.find((candidate) => {
 			if (candidate.method !== method) return false;
-			return (candidate.kind ?? "exact") === "exact" ? candidate.path === pathname : pathname === candidate.path || pathname.startsWith(`${candidate.path}/`);
+			return (candidate.kind ?? "exact") === "exact" ? candidate.path === pathname : candidate.path === "/" || pathname === candidate.path || pathname.startsWith(`${candidate.path}/`);
 		});
 		if (route === void 0) throw new MobileExtensionError("route_not_found", "route not found", 404);
 		if ("host" in extension) extension.controller.signal.throwIfAborted();
@@ -3963,7 +4052,7 @@ async function loadLocalExtension(directory, context, known, parentSignal, execu
 		let host;
 		if (worker !== void 0) {
 			try {
-				await withActivationTimeout(worker.activate(), manifest.id, controller.signal);
+				await withActivationTimeout(worker.activate(), manifest.id, controller.signal, void 0);
 			} catch (error) {
 				await worker.terminate("activation-failed");
 				throw error;
@@ -4007,7 +4096,7 @@ async function loadLocalExtension(directory, context, known, parentSignal, execu
 				}
 				await Promise.all(pendingEffects);
 			};
-			await withActivationTimeout(activate(), manifest.id, controller.signal);
+			await withActivationTimeout(activate(), manifest.id, controller.signal, HOST_ACTIVATION_TIMEOUT_MS);
 			host = validateDefinition({
 				...manifest,
 				actions,
@@ -4070,8 +4159,14 @@ const COPY = {
 		deviceName: "Device name",
 		pair: "Pair",
 		pairing: "Pairing…",
-		pairFailed: "Pairing failed",
-		unavailable: "The computer is unavailable.",
+		pairingCodeHint: "Use the 43-character pairing code shown on the computer. Keys starting with dsh1. or dsh2. are for the Android app.",
+		invalidPairingCode: "Enter the 43-character pairing code from the current pairing window on the computer.",
+		appKeyNotCode: "This is an Android app key. Use it in the app, or copy the browser pairing code from the computer.",
+		pairFailed: "Pairing failed. Check the code or generate a new one on the computer.",
+		pairingExpired: "The pairing code is invalid or has expired. Generate a new code on the computer and try again.",
+		pairingLimited: "Too many pairing attempts. Wait a moment and try again.",
+		deviceLimit: "The paired-device limit has been reached. Remove an unused device and generate a new pairing code on the computer.",
+		unavailable: "The computer is unavailable. Check the connection and try again.",
 		reconnectTitle: "Reconnect DSH mobile access",
 		reconnectHeading: "Reconnect this device",
 		restoring: "Restoring the secure Session…",
@@ -4086,8 +4181,14 @@ const COPY = {
 		deviceName: "设备名称",
 		pair: "配对",
 		pairing: "正在配对…",
-		pairFailed: "配对失败",
-		unavailable: "电脑当前不可用。",
+		pairingCodeHint: "请输入电脑端显示的 43 位配对码。以 dsh1. 或 dsh2. 开头的密钥用于 Android App。",
+		invalidPairingCode: "请输入电脑端当前配对窗口中的 43 位配对码。",
+		appKeyNotCode: "这是 Android App 密钥。请在 App 中使用，或回到电脑端复制浏览器配对码。",
+		pairFailed: "配对失败，请检查输入或在电脑端重新生成配对码。",
+		pairingExpired: "配对码无效或已过期，请在电脑端重新生成后重试。",
+		pairingLimited: "配对尝试过于频繁，请稍后再试。",
+		deviceLimit: "已达到配对设备上限，请在电脑端移除不需要的设备后重新生成配对码。",
+		unavailable: "电脑当前不可用，请检查连接后重试。",
 		reconnectTitle: "重新连接 DSH 移动访问",
 		reconnectHeading: "重新连接此设备",
 		restoring: "正在恢复安全会话…",
@@ -4102,8 +4203,14 @@ const COPY = {
 		deviceName: "Nome dispositivo",
 		pair: "Abbina",
 		pairing: "Abbinamento…",
-		pairFailed: "Abbinamento non riuscito",
-		unavailable: "Il computer non è disponibile.",
+		pairingCodeHint: "Usa il codice di abbinamento di 43 caratteri mostrato sul computer. Le chiavi che iniziano con dsh1. o dsh2. sono per l’app Android.",
+		invalidPairingCode: "Inserisci il codice di 43 caratteri dalla finestra di abbinamento attuale sul computer.",
+		appKeyNotCode: "Questa è una chiave per l’app Android. Usala nell’app oppure copia il codice di abbinamento per il browser dal computer.",
+		pairFailed: "Abbinamento non riuscito. Controlla il codice o generane uno nuovo sul computer.",
+		pairingExpired: "Il codice non è valido o è scaduto. Genera un nuovo codice sul computer e riprova.",
+		pairingLimited: "Troppi tentativi di abbinamento. Attendi un momento e riprova.",
+		deviceLimit: "È stato raggiunto il limite di dispositivi abbinati. Rimuovi un dispositivo inutilizzato e genera un nuovo codice sul computer.",
+		unavailable: "Il computer non è disponibile. Controlla la connessione e riprova.",
 		reconnectTitle: "Riconnetti accesso mobile DSH",
 		reconnectHeading: "Riconnetti questo dispositivo",
 		restoring: "Ripristino della sessione sicura…",
@@ -4142,7 +4249,8 @@ function renderPairPage(locale) {
 <main>
   <h1>${copy.pairHeading}</h1>
   <form id="pair-form">
-    <label>${copy.pairingCode} <input id="pair-token" autocomplete="one-time-code" required></label>
+    <label>${copy.pairingCode} <input id="pair-token" autocomplete="one-time-code" autocapitalize="off" spellcheck="false" aria-describedby="pair-token-hint pair-status" required></label>
+    <p id="pair-token-hint">${copy.pairingCodeHint}</p>
     <label>${copy.deviceName} <input id="device-label" maxlength="64" autocomplete="off"></label>
     <button type="submit">${copy.pair}</button>
     <output id="pair-status" aria-live="polite"></output>
@@ -4160,27 +4268,54 @@ function renderPairScript(locale) {
   const token = document.getElementById('pair-token')
   const label = document.getElementById('device-label')
   const status = document.getElementById('pair-status')
+  const submit = form.querySelector('button[type="submit"]')
+  let submitting = false
   const fragment = new URLSearchParams(location.hash.slice(1))
   const supplied = fragment.get('token')
   history.replaceState(null, '', location.pathname)
   if (supplied) token.value = supplied
+  token.addEventListener('input', () => {
+    token.removeAttribute('aria-invalid')
+    if (!submitting) status.value = ''
+  })
   form.addEventListener('submit', async (event) => {
     event.preventDefault()
+    if (submitting) return
+    const code = token.value.trim()
+    token.removeAttribute('aria-invalid')
+    if (/^dsh[12]\\./u.test(code) || !/^[A-Za-z0-9_-]{43}$/u.test(code)) {
+      status.value = /^dsh[12]\\./u.test(code)
+        ? ${JSON.stringify(copy.appKeyNotCode)} : ${JSON.stringify(copy.invalidPairingCode)}
+      token.setAttribute('aria-invalid', 'true')
+      token.focus()
+      return
+    }
+    submitting = true
+    submit.disabled = true
     status.value = ${JSON.stringify(copy.pairing)}
     try {
       const response = await fetch('/mobile-access/auth/pair', {
         method: 'POST',
         credentials: 'same-origin',
         headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ token: token.value, label: label.value || undefined }),
+        body: JSON.stringify({ token: code, label: label.value || undefined }),
       })
       if (!response.ok) {
-        status.value = ${JSON.stringify(copy.pairFailed)}
+        if (token.value.trim() !== code) { status.value = ''; return }
+        status.value = response.status === 401 ? ${JSON.stringify(copy.pairingExpired)}
+          : response.status === 429 ? ${JSON.stringify(copy.pairingLimited)}
+          : response.status === 409 ? ${JSON.stringify(copy.deviceLimit)}
+          : response.status >= 500 ? ${JSON.stringify(copy.unavailable)}
+          : ${JSON.stringify(copy.pairFailed)}
+        if (response.status === 401) token.setAttribute('aria-invalid', 'true')
         return
       }
       location.replace('/')
     } catch {
-      status.value = ${JSON.stringify(copy.unavailable)}
+      status.value = token.value.trim() === code ? ${JSON.stringify(copy.unavailable)} : ''
+    } finally {
+      submitting = false
+      submit.disabled = false
     }
   })
 })()
@@ -4793,6 +4928,7 @@ function sanitizeRequestHeaders(request, upstream) {
 		"if-match",
 		"if-modified-since",
 		"if-none-match",
+		"if-range",
 		"if-unmodified-since",
 		"range",
 		"user-agent"
@@ -4872,13 +5008,13 @@ function isCompressibleContentType(value) {
 	const mediaType = contentType.split(";", 1)[0]?.trim().toLowerCase() ?? "";
 	return mediaType.startsWith("text/") || /^(?:application\/(?:javascript|json|xml|x-javascript)|image\/svg\+xml)$/u.test(mediaType);
 }
-function shouldCompressResponse(request, response) {
+function canCompressResponse(request, response) {
 	const pathname = request.url?.split("?", 1)[0] ?? "";
-	return request.method === "GET" && (pathname.startsWith("/plugins/") || pathname.startsWith("/assets/")) && response.statusCode === 200 && request.headers.range === void 0 && response.headers["content-range"] === void 0 && response.headers["content-encoding"] === void 0 && acceptsGzip(request.headers["accept-encoding"]) && isCompressibleContentType(response.headers["content-type"]);
+	return (request.method === "GET" || request.method === "HEAD") && (pathname.startsWith("/plugins/") || pathname.startsWith("/assets/")) && response.statusCode === 200 && request.headers.range === void 0 && response.headers["content-range"] === void 0 && response.headers["content-encoding"] === void 0 && isCompressibleContentType(response.headers["content-type"]);
 }
 function revisionedStaticCacheControl(request, statusCode) {
 	if (request.method !== "GET" && request.method !== "HEAD") return void 0;
-	if (statusCode !== 200) return void 0;
+	if (statusCode !== 200 && statusCode !== 304) return void 0;
 	let target;
 	try {
 		target = new URL(request.url ?? "/", "https://dsh-mobile.invalid");
@@ -5689,7 +5825,7 @@ var MobileAccessGateway = class {
 		const clientModules = target.decodedPathname === `${AUTH_PREFIX}/client-modules`;
 		const requestedExtension = extensionTarget(target.decodedPathname);
 		const requestedMobileBootBatch = mobileBootBatchKey(target.decodedPathname);
-		const customAsset = request.method === "GET" ? target.decodedPathname === `/mobile-access/custom.css` ? {
+		const customAsset = request.method === "GET" || request.method === "HEAD" ? target.decodedPathname === `/mobile-access/custom.css` ? {
 			file: this.config.customCssFile,
 			contentType: "text/css; charset=utf-8",
 			fallback: CUSTOM_STYLE_FALLBACK
@@ -5798,23 +5934,23 @@ var MobileAccessGateway = class {
 					body = Buffer.from(customAsset.fallback);
 				}
 				if (body.byteLength > 262144) throw new HttpError(413, "payload_too_large");
-				const etag = createHash("sha256").update(body).digest("hex");
-				const ifNoneMatch = headerValue(request.headers, "if-none-match");
-				if (ifNoneMatch !== void 0 && ifNoneMatch === etag) {
+				const etag = `"${createHash("sha256").update(body).digest("hex")}"`;
+				const responseHeaders = { ETag: etag };
+				if (mtime !== void 0) responseHeaders["Last-Modified"] = mtime.toUTCString();
+				if (matchesIfNoneMatch(headerValue(request.headers, "if-none-match"), etag)) {
 					setSecurityHeaders(response, this.tlsEnabled);
-					response.writeHead(304);
+					response.writeHead(304, responseHeaders);
 					response.end();
 					return;
 				}
 				setSecurityHeaders(response, this.tlsEnabled);
-				const responseHeaders = {
+				response.writeHead(200, {
+					...responseHeaders,
 					"Content-Type": customAsset.contentType,
-					"Content-Length": body.byteLength,
-					"ETag": etag
-				};
-				if (mtime !== void 0) responseHeaders["Last-Modified"] = mtime.toUTCString();
-				response.writeHead(200, responseHeaders);
-				response.end(body);
+					"Content-Length": body.byteLength
+				});
+				if (request.method === "HEAD") response.end();
+				else response.end(body);
 				return;
 			} finally {
 				operation.release();
@@ -5890,10 +6026,10 @@ var MobileAccessGateway = class {
 						styleRevision
 					}
 				}));
-				const etag = createHash("sha256").update(body).update(extensions.contentDigest()).digest("hex");
-				if (headerValue(request.headers, "if-none-match") === etag) {
+				const etag = `"${createHash("sha256").update(body).update(extensions.contentDigest()).digest("hex")}"`;
+				if (matchesIfNoneMatch(headerValue(request.headers, "if-none-match"), etag)) {
 					setSecurityHeaders(response, this.tlsEnabled);
-					response.writeHead(304);
+					response.writeHead(304, { ETag: etag });
 					response.end();
 					return;
 				}
@@ -5916,9 +6052,10 @@ var MobileAccessGateway = class {
 			const operation = this.allocateRequest(authorization, response, {});
 			try {
 				const file = targetInfo.kind === "script" ? await extensions.readClientFile(targetInfo.id, "script", operation.signal, generation) : targetInfo.kind === "style" ? await extensions.readClientFile(targetInfo.id, "style", operation.signal, generation) : await extensions.readAsset(targetInfo.id, targetInfo.path ?? "", operation.signal, generation);
-				if (headerValue(request.headers, "if-none-match") === file.digest) {
+				const etag = `"${file.digest}"`;
+				if (matchesIfNoneMatch(headerValue(request.headers, "if-none-match"), etag)) {
 					setSecurityHeaders(response, this.tlsEnabled);
-					response.writeHead(304);
+					response.writeHead(304, { ETag: etag });
 					response.end();
 					return;
 				}
@@ -5927,7 +6064,7 @@ var MobileAccessGateway = class {
 				response.writeHead(200, {
 					"Content-Type": contentType,
 					"Content-Length": file.body.byteLength,
-					ETag: file.digest
+					ETag: etag
 				});
 				if (request.method === "HEAD") response.end();
 				else response.end(file.body);
@@ -6034,36 +6171,41 @@ var MobileAccessGateway = class {
 		}
 	}
 	async sendExtensionResponse(response, result, head) {
-		const status = result.status ?? 200;
-		if (!Number.isSafeInteger(status) || status < 200 || status > 599) throw new MobileExtensionError("invalid_route_response", "extension returned an invalid HTTP status", 500);
-		const contentType = result.contentType ?? "application/octet-stream";
-		if (contentType.length > 1024 || !/^[\x20-\x7e]+$/u.test(contentType) || !/^[\w!#$&+.^-]+\/[\w!#$&+.^-]+(?:;[\x20-\x7e]*)?$/u.test(contentType)) throw new MobileExtensionError("invalid_route_response", "extension returned an invalid content type", 500);
-		const safeHeaders = {};
-		for (const [name, value] of Object.entries(result.headers ?? {})) {
-			if (!/^(?:content-disposition|cache-control|etag)$/iu.test(name) || /[\r\n]/u.test(value)) continue;
-			safeHeaders[name] = value;
-		}
-		setSecurityHeaders(response, this.tlsEnabled);
-		if (typeof result.body === "string" || result.body instanceof Uint8Array) {
-			const body = typeof result.body === "string" ? Buffer.from(result.body) : Buffer.from(result.body);
-			if (body.byteLength > 4194304) throw new MobileExtensionError("extension_result_too_large", "extension response is too large", 500);
+		try {
+			const status = result.status ?? 200;
+			if (!Number.isSafeInteger(status) || status < 200 || status > 599) throw new MobileExtensionError("invalid_route_response", "extension returned an invalid HTTP status", 500);
+			const contentType = result.contentType ?? "application/octet-stream";
+			if (contentType.length > 1024 || !/^[\x20-\x7e]+$/u.test(contentType) || !/^[\w!#$&+.^-]+\/[\w!#$&+.^-]+(?:;[\x20-\x7e]*)?$/u.test(contentType)) throw new MobileExtensionError("invalid_route_response", "extension returned an invalid content type", 500);
+			const safeHeaders = {};
+			for (const [name, value] of Object.entries(result.headers ?? {})) {
+				if (!/^(?:content-disposition|cache-control|etag)$/iu.test(name) || /[\r\n]/u.test(value)) continue;
+				safeHeaders[name] = value;
+			}
+			setSecurityHeaders(response, this.tlsEnabled);
+			if (typeof result.body === "string" || result.body instanceof Uint8Array) {
+				const body = typeof result.body === "string" ? Buffer.from(result.body) : Buffer.from(result.body);
+				if (body.byteLength > 4194304) throw new MobileExtensionError("extension_result_too_large", "extension response is too large", 500);
+				response.writeHead(status, {
+					...safeHeaders,
+					"Content-Type": contentType,
+					"Content-Length": body.byteLength
+				});
+				if (head) response.end();
+				else response.end(body);
+				return;
+			}
 			response.writeHead(status, {
 				...safeHeaders,
-				"Content-Type": contentType,
-				"Content-Length": body.byteLength
+				"Content-Type": contentType
 			});
-			if (head) response.end();
-			else response.end(body);
-			return;
-		}
-		response.writeHead(status, {
-			...safeHeaders,
-			"Content-Type": contentType
-		});
-		if (head) {
-			result.body.destroy();
-			response.end();
-			return;
+			if (head) {
+				result.body.destroy();
+				response.end();
+				return;
+			}
+		} catch (error) {
+			disposeLateExtensionResponse(result);
+			throw error;
 		}
 		await pipeline(result.body, new ByteLimitTransform(4194304), response);
 	}
@@ -6479,7 +6621,7 @@ var MobileAccessGateway = class {
 			const assembled = stored.body;
 			if (assembled === void 0) throw new HttpError(502, "upstream_unavailable");
 			const body = compressed ? stored.gzipBody ??= await gzipBuffer(assembled) : assembled;
-			const etag = compressed ? `${stored.etag}-gzip` : stored.etag;
+			const etag = `"${compressed ? `${stored.etag}-gzip` : stored.etag}"`;
 			const headers = {
 				"Content-Type": "text/javascript; charset=utf-8",
 				"Content-Length": body.byteLength,
@@ -6488,7 +6630,7 @@ var MobileAccessGateway = class {
 			};
 			if (compressed) headers["Content-Encoding"] = "gzip";
 			addVaryAcceptEncoding(headers);
-			if (headerValue(request.headers, "if-none-match") === etag) {
+			if (matchesIfNoneMatch(headerValue(request.headers, "if-none-match"), etag)) {
 				setSecurityHeaders(response, this.tlsEnabled);
 				response.writeHead(304, {
 					ETag: etag,
@@ -6735,16 +6877,28 @@ var MobileAccessGateway = class {
 			const statusCode = proxied.statusCode ?? 502;
 			const cacheControl = revisionedStaticCacheControl(request$2, statusCode);
 			if (cacheControl !== void 0) headers["cache-control"] = cacheControl;
-			const compressed = shouldCompressResponse(request$2, proxied);
+			const compressible = canCompressResponse(request$2, proxied);
+			const compressed = compressible && acceptsGzip(request$2.headers["accept-encoding"]);
+			if (compressible) addVaryAcceptEncoding(headers);
 			if (compressed) {
 				delete headers["accept-ranges"];
 				delete headers["content-length"];
-				delete headers.etag;
+				const etag = weakenEntityTag(proxied.headers.etag);
+				if (etag === void 0) delete headers.etag;
+				else headers.etag = etag;
 				headers["content-encoding"] = "gzip";
+			} else if (statusCode === 304 && (request$2.method === "GET" || request$2.method === "HEAD") && request$2.headers.range === void 0 && (request$2.url?.split("?", 1)[0]?.startsWith("/plugins/") === true || request$2.url?.split("?", 1)[0]?.startsWith("/assets/") === true)) {
+				if (proxied.headers["content-encoding"] === void 0 && acceptsGzip(request$2.headers["accept-encoding"])) {
+					delete headers["content-length"];
+					delete headers["accept-ranges"];
+					const etag = weakenEntityTag(proxied.headers.etag);
+					if (etag === void 0) delete headers.etag;
+					else headers.etag = etag;
+				}
 				addVaryAcceptEncoding(headers);
 			}
 			response.writeHead(statusCode, headers);
-			await Promise.all([bodyDone, compressed ? pipeline(proxied, createGzip(), response) : pipeline(proxied, response)]);
+			await Promise.all([bodyDone, compressed && request$2.method !== "HEAD" ? pipeline(proxied, createGzip(), response) : pipeline(proxied, response)]);
 		} catch (error) {
 			holder.request?.destroy();
 			await bodyDone?.catch(() => void 0);
@@ -7475,6 +7629,118 @@ async function replaceManagedDirectory(root, target, candidate, prefix, operatio
 	}
 }
 //#endregion
+//#region src/component-download.ts
+/**
+* Hosts a pinned GitHub release download may redirect to.
+*
+* `github.com/<owner>/<repo>/releases/download/<tag>/<asset>` does not serve the bytes itself: it
+* answers 302 with a signed URL on a release-asset host. A fetch configured with
+* `redirect: 'error'` fails that hop as `TypeError: fetch failed` (cause: `unexpected redirect`)
+* before a single byte is transferred, which is exactly how the cloudflared component could never
+* install. Following one validated hop keeps the origin restriction while allowing the shape
+* every GitHub release download uses.
+*/
+const RELEASE_ASSET_HOSTS = Object.freeze(["release-assets.githubusercontent.com", "objects.githubusercontent.com"]);
+/** Release an unused body without replacing a download or validation failure. */
+async function discardBody(body) {
+	if (body === null) return;
+	try {
+		await body.cancel();
+	} catch (_error) {}
+}
+/** Follow one redirect hop after checking its scheme and host. A second hop is refused. */
+async function followValidatedRedirect(response, request) {
+	let target;
+	try {
+		const location = response.headers.get("location");
+		if (location === null) throw new Error(`${request.errorPrefix}_download_redirect_missing`);
+		try {
+			target = new URL(location, request.url);
+		} catch {
+			throw new Error(`${request.errorPrefix}_download_redirect_invalid`);
+		}
+		const hosts = request.redirectHosts ?? RELEASE_ASSET_HOSTS;
+		if (target.protocol !== "https:" || !hosts.includes(target.hostname)) throw new Error(`${request.errorPrefix}_download_redirect_rejected`);
+	} finally {
+		await discardBody(response.body);
+	}
+	return fetch(target, {
+		redirect: "error",
+		signal: request.signal
+	});
+}
+/** Attempts per install. A 55 MB transfer through a TUN proxy can reset mid-stream: the first
+* real run in the development environment failed after 1.5 MB and succeeded on the next attempt,
+* which is exactly the confusing "nothing happened" the user saw. */
+const DOWNLOAD_ATTEMPTS = 2;
+const RETRY_DELAY_MS = 750;
+/** Whether a failure is a transport problem worth a second attempt rather than a verdict. */
+function isRetryable(error) {
+	if (error instanceof TypeError) return true;
+	if (error instanceof Error && /_download_http_5\d\d$/u.test(error.message)) return true;
+	return false;
+}
+function delay(ms) {
+	return new Promise((resolve) => {
+		setTimeout(resolve, ms);
+	});
+}
+async function attemptDownload(request) {
+	const first = await fetch(request.url, {
+		redirect: "manual",
+		signal: request.signal
+	});
+	const response = first.status >= 300 && first.status < 400 ? await followValidatedRedirect(first, request) : first;
+	let reader;
+	let ended = false;
+	try {
+		if (!response.ok) throw new Error(`${request.errorPrefix}_download_http_${String(response.status)}`);
+		const contentLength = response.headers.get("content-length");
+		if (contentLength !== null && (!/^\d+$/u.test(contentLength) || Number(contentLength) !== request.expectedBytes)) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
+		if (response.body === null) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
+		const bytes = new Uint8Array(request.expectedBytes);
+		reader = response.body.getReader();
+		let received = 0;
+		while (true) {
+			const chunk = await reader.read();
+			if (chunk.done) {
+				ended = true;
+				break;
+			}
+			if (chunk.value.byteLength > bytes.byteLength - received) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
+			bytes.set(chunk.value, received);
+			received += chunk.value.byteLength;
+		}
+		if (received !== request.expectedBytes) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
+		return bytes;
+	} finally {
+		if (reader === void 0) await discardBody(response.body);
+		else try {
+			if (!ended) await discardBody(reader);
+		} finally {
+			reader.releaseLock();
+		}
+	}
+}
+/**
+* Download a pinned artifact, following at most one validated redirect, and check its exact length.
+* A transport failure is retried once; a length or redirect verdict is not. The caller still
+* verifies the SHA-256 before publishing anything.
+* @param request - the pinned URL, its exact byte length and the caller's error prefix.
+* @returns the artifact bytes.
+*/
+async function downloadPinnedArtifact(request) {
+	let lastError;
+	for (let attempt = 1; attempt <= DOWNLOAD_ATTEMPTS; attempt += 1) try {
+		return await attemptDownload(request);
+	} catch (error) {
+		lastError = error;
+		if (attempt === DOWNLOAD_ATTEMPTS || !isRetryable(error)) throw error;
+		await delay(RETRY_DELAY_MS);
+	}
+	throw lastError;
+}
+//#endregion
 //#region src/frp-component.ts
 const FRP_VERSION$1 = "0.70.1";
 const MAX_ARCHIVE_ENTRIES$1 = 128;
@@ -7605,39 +7871,12 @@ async function defaultExtractArtifact$2(archive, destination, executableName) {
 	await copyFile(extracted, join(destination, executableName));
 }
 async function defaultFetchArtifact$2(artifact, signal) {
-	const response = await fetch(artifact.downloadUrl, {
-		redirect: "follow",
+	return downloadPinnedArtifact({
+		url: artifact.downloadUrl,
+		expectedBytes: artifact.downloadBytes,
+		errorPrefix: "frp",
 		signal
 	});
-	if (!response.ok) throw new Error(`frp_download_http_${String(response.status)}`);
-	const finalUrl = new URL(response.url);
-	const officialHost = finalUrl.hostname === "github.com" || finalUrl.hostname.endsWith(".githubusercontent.com");
-	if (finalUrl.protocol !== "https:" || !officialHost) throw new Error("frp_download_origin_invalid");
-	const lengthHeader = response.headers.get("content-length");
-	const declaredLength = lengthHeader === null ? void 0 : Number(lengthHeader);
-	if (declaredLength !== void 0 && (!Number.isFinite(declaredLength) || declaredLength !== artifact.downloadBytes)) throw new Error("frp_download_size_mismatch");
-	if (response.body === null) throw new Error("frp_download_empty");
-	const chunks = [];
-	let received = 0;
-	const reader = response.body.getReader();
-	while (true) {
-		const result = await reader.read();
-		if (result.done) break;
-		received += result.value.byteLength;
-		if (received > artifact.downloadBytes) {
-			await reader.cancel();
-			throw new Error("frp_download_size_mismatch");
-		}
-		chunks.push(result.value);
-	}
-	if (received !== artifact.downloadBytes) throw new Error("frp_download_size_mismatch");
-	const bytes = new Uint8Array(received);
-	let offset = 0;
-	for (const chunk of chunks) {
-		bytes.set(chunk, offset);
-		offset += chunk.byteLength;
-	}
-	return bytes;
 }
 async function defaultInspectExecutable(executable) {
 	return (await runCapture$1(executable, ["--version"])).trim();
@@ -8984,7 +9223,7 @@ async function readManagedCa(setup) {
 	const [certPem, keyPem] = await Promise.all([readFile(setup.caCertFile, "utf8"), readFile(setup.caKeyFile, "utf8")]);
 	return assertMatchingCa(certPem, keyPem);
 }
-async function atomicWrite(file, contents) {
+async function stagePrivateFile(file, contents) {
 	const directory = dirname(file);
 	await mkdir(directory, {
 		recursive: true,
@@ -8992,17 +9231,85 @@ async function atomicWrite(file, contents) {
 	});
 	const temporary = join(directory, `.${basename(file)}.${randomBytes(12).toString("hex")}.tmp`);
 	try {
-		await writeFile(temporary, contents, {
+		await writeFile(temporary, "", {
 			mode: 384,
 			flag: "wx"
 		});
 		await restrictPrivateFile(temporary);
+		await writeFile(temporary, contents);
+		return temporary;
+	} catch (error) {
+		await rm(temporary, { force: true });
+		throw error;
+	}
+}
+async function atomicWrite(file, contents) {
+	const temporary = await stagePrivateFile(file, contents);
+	try {
 		await rename(temporary, file);
 		await restrictPrivateFile(file);
 	} finally {
 		await rm(temporary, { force: true });
 	}
 }
+const certificatePublications = /* @__PURE__ */ new Map();
+/** Stage both files before promotion and retain a private rollback copy until the pair is installed. */
+async function installServerCertificatePair(output, cert, key) {
+	const identity = `${output.certFile}\0${output.keyFile}`;
+	const publication = (certificatePublications.get(identity) ?? Promise.resolve()).catch(() => void 0).then(async () => {
+		const files = [output.certFile, output.keyFile];
+		const contents = [cert, key];
+		const staged = [];
+		const backups = [];
+		let promoted = 0;
+		let restored = true;
+		const failures = [];
+		try {
+			for (let index = 0; index < files.length; index += 1) {
+				const file = files[index];
+				staged.push(await stagePrivateFile(file, contents[index]));
+				let old;
+				try {
+					const metadata = await lstat(file);
+					if (!metadata.isFile() || metadata.isSymbolicLink()) throw new Error("managed TLS output is not a regular file");
+					old = await readFile(file);
+				} catch (error) {
+					if (error.code !== "ENOENT") throw error;
+				}
+				backups.push(old === void 0 ? void 0 : await stagePrivateFile(file, old));
+			}
+			for (let index = 0; index < files.length; index += 1) {
+				await rename(staged[index], files[index]);
+				promoted += 1;
+			}
+		} catch (error) {
+			failures.push(error);
+			for (let index = promoted - 1; index >= 0; index -= 1) try {
+				const backup = backups[index];
+				if (backup === void 0) await rm(files[index], { force: true });
+				else await rename(backup, files[index]);
+			} catch (restoreError) {
+				restored = false;
+				failures.push(restoreError);
+			}
+		} finally {
+			const cleanup = await Promise.allSettled(staged.map((file) => rm(file, { force: true })));
+			for (const result of cleanup) if (result.status === "rejected") failures.push(result.reason);
+			if (restored) {
+				const backupCleanup = await Promise.allSettled(backups.filter((file) => file !== void 0).map((file) => rm(file, { force: true })));
+				for (const result of backupCleanup) if (result.status === "rejected") failures.push(result.reason);
+			}
+		}
+		if (failures.length > 1) throw new AggregateError(failures, "managed TLS certificate replacement, rollback or cleanup failed");
+		if (failures.length === 1) throw failures[0];
+	});
+	certificatePublications.set(identity, publication);
+	try {
+		await publication;
+	} finally {
+		if (certificatePublications.get(identity) === publication) certificatePublications.delete(identity);
+	}
+}
 /** Create a long-lived CA or migrate the legacy self-signed server certificate as that CA. */
 async function ensureManagedCa(setup, legacy) {
 	let certPem;
@@ -9117,7 +9424,7 @@ async function issueServerCertificate(authority, target, output, lifetimeDays =
 			}
 		]
 	});
-	await Promise.all([atomicWrite(output.certFile, server.cert), atomicWrite(output.keyFile, server.private)]);
+	await installServerCertificatePair(output, server.cert, server.private);
 }
 /** Sign and atomically install a server leaf for the interface's current address. */
 async function refreshManagedServerCertificate(setup, address) {
@@ -9254,12 +9561,12 @@ async function ensureFrpIngressCertificate(settings, stateFile, now = Date.now()
 	if (previousFingerprint === void 0) await writeIngressIdentity(paths.statusFile, caFingerprint, ownedRoot);
 	const publicHost = new URL(settings.publicOrigin).hostname;
 	let leaf;
+	let matchingKey = false;
 	try {
 		leaf = new X509Certificate(await readFile(paths.certFile));
-	} catch {
-		leaf = void 0;
-	}
-	if (!(leaf !== void 0 && Date.parse(leaf.validTo) > now + 864e5 && coversPublicIp(leaf, publicHost) && leaf.verify(ca.publicKey))) {
+		if (leafKeyExists) matchingKey = leaf.checkPrivateKey(createPrivateKey(await readFile(paths.keyFile)));
+	} catch (_error) {}
+	if (!(leaf !== void 0 && matchingKey && Date.parse(leaf.validFrom) <= now && Date.parse(leaf.validTo) > now + 864e5 && coversPublicIp(leaf, publicHost) && leaf.verify(ca.publicKey))) {
 		await assertManagedParents(ownedRoot, paths.certFile, "frp_ingress");
 		await issueServerCertificate({
 			caCertFile: paths.caCertFile,
@@ -9385,6 +9692,18 @@ function aggregateErrors(errors, message) {
 	if (errors.length === 1 && errors[0] instanceof Error) return errors[0];
 	return new AggregateError(errors, message);
 }
+/**
+* Prepare each inactive provider's disabled state and settle every write before reporting a failure.
+* @param selected - Provider whose startup must still read its durable preference.
+* @param stores - The same stores supplied to the corresponding provider controllers.
+* @returns Fresh disabled states for this initialization only; no permission-success cache is retained.
+*/
+async function prepareDisabledRemoteProviders(selected, stores) {
+	const results = await Promise.allSettled(REMOTE_PROVIDERS.filter((provider) => provider !== selected).map(async (provider) => [provider, await stores[provider].disableIfPresent()]));
+	const failure = aggregateErrors(results.filter((result) => result.status === "rejected").map((result) => result.reason), "remote provider control preparation failed");
+	if (failure !== void 0) throw failure;
+	return new Map(results.flatMap((result) => result.status === "fulfilled" ? [result.value] : []));
+}
 /** Settle independent remote cleanup work before reporting any collected failure. */
 async function settleRemoteResources(steps, message = "remote resource cleanup failed") {
 	const failure = aggregateErrors((await Promise.allSettled(steps.map(async (step) => step()))).filter((result) => result.status === "rejected").map((result) => result.reason), message);
@@ -9837,8 +10156,8 @@ var FrpController = class {
 		if (options.ingressCertificateCheckMs !== void 0 && (!Number.isSafeInteger(options.ingressCertificateCheckMs) || options.ingressCertificateCheckMs < 1 || options.ingressCertificateCheckMs > 2147483647)) throw new Error("frp_ingress_check_interval_invalid");
 	}
 	/** Restore the remembered FRP switch without changing LAN or other providers. */
-	async initialize() {
-		const state = await this.options.store.load();
+	async initialize(initialState) {
+		const state = initialState ?? await this.options.store.load();
 		this.enabled = state.enabled;
 		this.initialized = true;
 		if (this.enabled) await this.start();
@@ -9860,12 +10179,12 @@ var FrpController = class {
 		if (!this.initialized || this.disposed) throw new Error("FRP controller is unavailable");
 		await this.enqueue(async () => {
 			if (this.enabled === enabled && (enabled === false || this.child !== void 0)) return;
-			if (!enabled) await this.stop();
-			this.enabled = enabled;
 			await this.options.store.save({
 				version: 1,
 				enabled
 			});
+			this.enabled = enabled;
+			if (!enabled) await this.stop();
 			if (enabled) await this.start();
 			else this.publish({
 				enabled: false,
@@ -9879,11 +10198,11 @@ var FrpController = class {
 		if (!this.initialized || this.disposed) throw new Error("FRP controller is unavailable");
 		await this.enqueue(async () => {
 			if (!this.enabled) {
-				this.enabled = true;
 				await this.options.store.save({
 					version: 1,
 					enabled: true
 				});
+				this.enabled = true;
 			}
 			await this.stop();
 			await this.start();
@@ -9894,12 +10213,12 @@ var FrpController = class {
 	async reset() {
 		if (!this.initialized || this.disposed) throw new Error("FRP controller is unavailable");
 		await this.enqueue(async () => {
-			await this.stop();
-			this.enabled = false;
 			await this.options.store.save({
 				version: 1,
 				enabled: false
 			});
+			this.enabled = false;
+			await this.stop();
 			this.publish({
 				enabled: false,
 				state: "off"
@@ -10509,96 +10828,6 @@ var OriginController = class {
 	}
 };
 //#endregion
-//#region src/component-download.ts
-/**
-* Hosts a pinned GitHub release download may redirect to.
-*
-* `github.com/<owner>/<repo>/releases/download/<tag>/<asset>` does not serve the bytes itself: it
-* answers 302 with a signed URL on a release-asset host. A fetch configured with
-* `redirect: 'error'` fails that hop as `TypeError: fetch failed` (cause: `unexpected redirect`)
-* before a single byte is transferred, which is exactly how the cloudflared component could never
-* install. Following one validated hop keeps the origin restriction while allowing the shape
-* every GitHub release download uses.
-*/
-const RELEASE_ASSET_HOSTS = Object.freeze(["release-assets.githubusercontent.com", "objects.githubusercontent.com"]);
-/** Follow one redirect hop after checking its scheme and host. A second hop is refused. */
-async function followValidatedRedirect(response, request) {
-	const location = response.headers.get("location");
-	if (location === null) throw new Error(`${request.errorPrefix}_download_redirect_missing`);
-	let target;
-	try {
-		target = new URL(location, request.url);
-	} catch {
-		throw new Error(`${request.errorPrefix}_download_redirect_invalid`);
-	}
-	const hosts = request.redirectHosts ?? RELEASE_ASSET_HOSTS;
-	if (target.protocol !== "https:" || !hosts.includes(target.hostname)) throw new Error(`${request.errorPrefix}_download_redirect_rejected`);
-	return fetch(target, {
-		redirect: "error",
-		signal: request.signal
-	});
-}
-/** Attempts per install. A 55 MB transfer through a TUN proxy can reset mid-stream: the first
-* real run in the development environment failed after 1.5 MB and succeeded on the next attempt,
-* which is exactly the confusing "nothing happened" the user saw. */
-const DOWNLOAD_ATTEMPTS = 2;
-const RETRY_DELAY_MS = 750;
-/** Whether a failure is a transport problem worth a second attempt rather than a verdict. */
-function isRetryable(error) {
-	if (error instanceof TypeError) return true;
-	if (error instanceof Error && /_download_http_5\d\d$/u.test(error.message)) return true;
-	return false;
-}
-function delay(ms) {
-	return new Promise((resolve) => {
-		setTimeout(resolve, ms);
-	});
-}
-async function attemptDownload(request) {
-	const first = await fetch(request.url, {
-		redirect: "manual",
-		signal: request.signal
-	});
-	const response = first.status >= 300 && first.status < 400 ? await followValidatedRedirect(first, request) : first;
-	if (!response.ok) throw new Error(`${request.errorPrefix}_download_http_${String(response.status)}`);
-	const contentLength = response.headers.get("content-length");
-	if (contentLength !== null && (!/^\d+$/u.test(contentLength) || Number(contentLength) !== request.expectedBytes)) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
-	if (response.body === null) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
-	const bytes = new Uint8Array(request.expectedBytes);
-	const reader = response.body.getReader();
-	let received = 0;
-	while (true) {
-		const chunk = await reader.read();
-		if (chunk.done) break;
-		if (chunk.value.byteLength > bytes.byteLength - received) {
-			await reader.cancel();
-			throw new Error(`${request.errorPrefix}_download_size_mismatch`);
-		}
-		bytes.set(chunk.value, received);
-		received += chunk.value.byteLength;
-	}
-	if (received !== request.expectedBytes) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
-	return bytes;
-}
-/**
-* Download a pinned artifact, following at most one validated redirect, and check its exact length.
-* A transport failure is retried once; a length or redirect verdict is not. The caller still
-* verifies the SHA-256 before publishing anything.
-* @param request - the pinned URL, its exact byte length and the caller's error prefix.
-* @returns the artifact bytes.
-*/
-async function downloadPinnedArtifact(request) {
-	let lastError;
-	for (let attempt = 1; attempt <= DOWNLOAD_ATTEMPTS; attempt += 1) try {
-		return await attemptDownload(request);
-	} catch (error) {
-		lastError = error;
-		if (attempt === DOWNLOAD_ATTEMPTS || !isRetryable(error)) throw error;
-		await delay(RETRY_DELAY_MS);
-	}
-	throw lastError;
-}
-//#endregion
 //#region src/cloudflared-component.ts
 /** Upper bound for `tar -t` output; a pinned release listing is a few lines. */
 const MAX_ARCHIVE_LIST_BYTES = 1048576;
@@ -11091,8 +11320,8 @@ var CloudflaredController = class {
 		if (!isAbsolute(options.executable)) throw new Error("cloudflared executable path must be absolute");
 	}
 	/** Restore the remembered cloudflared switch independently from LAN and other providers. */
-	async initialize() {
-		const state = await this.options.store.load();
+	async initialize(initialState) {
+		const state = initialState ?? await this.options.store.load();
 		this.enabled = state.enabled;
 		this.initialized = true;
 		if (this.enabled) await this.start();
@@ -11114,12 +11343,12 @@ var CloudflaredController = class {
 		if (!this.initialized || this.disposed) throw new Error("cloudflared controller is unavailable");
 		await this.enqueue(async () => {
 			if (this.enabled === enabled && (enabled === false || this.child !== void 0)) return;
-			if (!enabled) await this.stop();
-			this.enabled = enabled;
 			await this.options.store.save({
 				version: 1,
 				enabled
 			});
+			this.enabled = enabled;
+			if (!enabled) await this.stop();
 			if (enabled) await this.start();
 			else this.publish({
 				enabled: false,
@@ -11133,11 +11362,11 @@ var CloudflaredController = class {
 		if (!this.initialized || this.disposed) throw new Error("cloudflared controller is unavailable");
 		await this.enqueue(async () => {
 			if (!this.enabled) {
-				this.enabled = true;
 				await this.options.store.save({
 					version: 1,
 					enabled: true
 				});
+				this.enabled = true;
 			}
 			await this.stop();
 			await this.start();
@@ -11148,12 +11377,12 @@ var CloudflaredController = class {
 	async reset() {
 		if (!this.initialized || this.disposed) throw new Error("cloudflared controller is unavailable");
 		await this.enqueue(async () => {
-			await this.stop();
-			this.enabled = false;
 			await this.options.store.save({
 				version: 1,
 				enabled: false
 			});
+			this.enabled = false;
+			await this.stop();
 			this.publish({
 				enabled: false,
 				state: "off"
@@ -12695,17 +12924,6 @@ else
     printf '%s\n' "$caddy_import" > /etc/caddy/Caddyfile
     chmod 0644 /etc/caddy/Caddyfile
     caddyfile_ready=true
-  elif grep -q '^# Managed by DSH Mobile$' /etc/caddy/Caddyfile; then
-    # Legacy whole-file layout: the entire file is ours by construction.
-    printf '%s\n' "$caddy_import" > /etc/caddy/Caddyfile
-    chmod 0644 /etc/caddy/Caddyfile
-    caddyfile_ready=true
-  elif grep -q '^:80[[:space:]]*{' /etc/caddy/Caddyfile \
-    && grep -q 'root [*] /usr/share/caddy' /etc/caddy/Caddyfile \
-    && grep -q '^[[:space:]]*file_server[[:space:]]*$' /etc/caddy/Caddyfile; then
-    printf '%s\n' "$caddy_import" > /etc/caddy/Caddyfile
-    chmod 0644 /etc/caddy/Caddyfile
-    caddyfile_ready=true
   fi
 fi
 if [ "$caddyfile_ready" != true ]; then
@@ -13126,13 +13344,8 @@ if grep -Eq '^[[:space:]]*import[[:space:]]+/etc/caddy/dsh-mobile-dsh\.caddy([[:
   fi
   check caddy ok "已移除 DSH Mobile 站点引入；其余 Caddy 配置保持原样。"
 elif [ -f /etc/caddy/Caddyfile ] && grep -q '^# Managed by DSH Mobile$' /etc/caddy/Caddyfile; then
-  # Legacy whole-file layout (pre-snippet releases): the entire file is ours.
-  printf '# DSH Mobile removed its site. Restore your own Caddyfile or reinstall the Caddy defaults.\\n' > /etc/caddy/Caddyfile
-  chmod 0644 /etc/caddy/Caddyfile
-  if command -v caddy >/dev/null 2>&1; then
-    caddy validate --config /etc/caddy/Caddyfile && systemctl reload caddy.service || systemctl restart caddy.service || true
-  fi
-  check caddy ok "已清空旧版 DSH Mobile 管理的 Caddy 站点；请按需恢复自己的配置。"
+  # A legacy marker does not establish ownership of subsequently added sites.
+  check caddy warning "已保留旧版 Caddyfile；请手动移除 DSH Mobile 站点，不要删除其他站点。"
 else
   check caddy ok "Caddyfile 非 DSH Mobile 管理，保持原样。"
 fi
@@ -13339,6 +13552,7 @@ var FunnelController = class {
 		state: "off"
 	});
 	queue = Promise.resolve();
+	closeTask;
 	startTimer;
 	ownedRoot;
 	constructor(options) {
@@ -13348,7 +13562,7 @@ var FunnelController = class {
 		if (!isAbsolute(this.ownedRoot) || resolve(this.ownedRoot) === resolve(options.stateDirectory)) throw new Error("Funnel state must be a child of its owned root");
 	}
 	/** Restore the remote switch without coupling it to LAN availability. */
-	async initialize() {
+	async initialize(initialState) {
 		try {
 			await this.assertStateParents();
 		} catch (_error) {
@@ -13361,7 +13575,7 @@ var FunnelController = class {
 			});
 			return;
 		}
-		const state = await this.options.store.load();
+		const state = initialState ?? await this.options.store.load();
 		this.enabled = state.enabled;
 		this.initialized = true;
 		if (this.enabled) await this.start();
@@ -13382,29 +13596,67 @@ var FunnelController = class {
 	async setEnabled(enabled) {
 		if (!this.initialized || this.disposed) throw new Error("Funnel controller is unavailable");
 		await this.enqueue(async () => {
-			if (this.enabled === enabled && (enabled === false || this.child !== void 0)) return;
-			if (!enabled) await this.stop();
+			const ownsResources = this.child !== void 0 || this.gatewayValue !== void 0;
+			if (this.enabled === enabled && (enabled ? this.child !== void 0 : !ownsResources && this.latest.state === "off")) return;
+			if (!enabled) {
+				try {
+					await this.assertStateParents();
+				} catch (error) {
+					try {
+						await this.stop();
+					} catch (cleanupError) {
+						this.publish({
+							enabled: this.enabled,
+							state: "error",
+							errorCode: "funnel_cleanup_failed"
+						});
+						throw new AggregateError([error, cleanupError], "Funnel state validation and cleanup failed");
+					}
+					this.publish({
+						enabled: this.enabled,
+						state: "unavailable",
+						errorCode: "funnel_state_invalid"
+					});
+					throw error;
+				}
+				await this.options.store.save({
+					version: 1,
+					enabled: false
+				});
+				this.enabled = false;
+				try {
+					await this.stop();
+				} catch (error) {
+					this.publish({
+						enabled: false,
+						state: "error",
+						errorCode: "funnel_cleanup_failed"
+					});
+					throw error;
+				}
+				this.publish({
+					enabled: false,
+					state: "off"
+				});
+				return;
+			}
 			try {
 				await this.assertStateParents();
 			} catch (error) {
-				this.enabled = false;
 				this.publish({
-					enabled: false,
+					enabled: this.enabled,
 					state: "unavailable",
 					errorCode: "funnel_state_invalid"
 				});
 				throw error;
 			}
-			this.enabled = enabled;
 			await this.options.store.save({
 				version: 1,
-				enabled
-			});
-			if (enabled) await this.start();
-			else this.publish({
-				enabled: false,
-				state: "off"
+				enabled: true
 			});
+			this.enabled = true;
+			if (ownsResources) await this.stop();
+			await this.start();
 		});
 		return this.status();
 	}
@@ -13412,7 +13664,6 @@ var FunnelController = class {
 	async reconnect() {
 		if (!this.initialized || this.disposed) throw new Error("Funnel controller is unavailable");
 		await this.enqueue(async () => {
-			await this.stop();
 			try {
 				await this.assertStateParents();
 			} catch (error) {
@@ -13424,12 +13675,13 @@ var FunnelController = class {
 				throw error;
 			}
 			if (!this.enabled) {
-				this.enabled = true;
 				await this.options.store.save({
 					version: 1,
 					enabled: true
 				});
+				this.enabled = true;
 			}
+			await this.stop();
 			await this.start();
 		});
 		return this.status();
@@ -13438,8 +13690,26 @@ var FunnelController = class {
 	async reset() {
 		if (!this.initialized || this.disposed) throw new Error("Funnel controller is unavailable");
 		await this.enqueue(async () => {
-			await this.stop();
+			try {
+				await assertManagedParents(this.ownedRoot, this.options.stateDirectory, "funnel");
+				const selected = await lstat(this.options.stateDirectory).catch((error) => {
+					if (error.code !== "ENOENT") throw error;
+				});
+				if (selected !== void 0 && (selected.isSymbolicLink() || !selected.isDirectory())) await removeManagedTree(this.ownedRoot, this.options.stateDirectory, "funnel");
+			} catch (error) {
+				this.publish({
+					enabled: this.enabled,
+					state: "off",
+					errorCode: "funnel_state_invalid"
+				});
+				throw error;
+			}
+			await this.options.store.save({
+				version: 1,
+				enabled: false
+			});
 			this.enabled = false;
+			await this.stop();
 			try {
 				await removeManagedTree(this.ownedRoot, this.options.stateDirectory, "funnel");
 				await this.assertStateParents();
@@ -13463,10 +13733,15 @@ var FunnelController = class {
 		return this.status();
 	}
 	/** Stop all remote resources without modifying the remembered switch. */
-	async close() {
-		if (this.disposed) return;
+	close() {
+		if (this.closeTask !== void 0) return this.closeTask;
 		this.disposed = true;
-		await this.enqueue(() => this.stop());
+		const task = this.enqueue(() => this.stop());
+		this.closeTask = task.catch((error) => {
+			this.closeTask = void 0;
+			throw error;
+		});
+		return this.closeTask;
 	}
 	enqueue(operation) {
 		const task = this.queue.then(operation, operation);
@@ -13656,13 +13931,17 @@ var FunnelController = class {
 	async stopProcessAndGateway() {
 		this.clearStartTimer();
 		const child = this.child;
-		this.child = void 0;
 		const gateway = this.gatewayValue;
-		this.gatewayValue = void 0;
 		await settleRemoteResources([async () => {
 			child?.stdin.end();
 			if (child !== void 0 && child.exitCode === null) await terminateRemoteProcess(child);
-		}, () => gateway?.close()], "Funnel resource cleanup failed");
+			if (this.child === child) this.child = void 0;
+		}, async () => {
+			if (gateway !== void 0) {
+				await gateway.close();
+				if (this.gatewayValue === gateway) this.gatewayValue = void 0;
+			}
+		}], "Funnel resource cleanup failed");
 	}
 	clearStartTimer() {
 		if (this.startTimer === void 0) return;
@@ -13788,8 +14067,8 @@ var CpolarController = class {
 		if (options.region !== void 0 && !/^[a-z][a-z0-9_]{0,31}$/u.test(options.region)) throw new Error("cpolar region is invalid");
 	}
 	/** Restore the remembered cpolar switch independently from LAN and Funnel state. */
-	async initialize() {
-		const state = await this.options.store.load();
+	async initialize(initialState) {
+		const state = initialState ?? await this.options.store.load();
 		this.enabled = state.enabled;
 		this.initialized = true;
 		if (this.enabled) await this.start();
@@ -13811,12 +14090,12 @@ var CpolarController = class {
 		if (!this.initialized || this.disposed) throw new Error("cpolar controller is unavailable");
 		await this.enqueue(async () => {
 			if (this.enabled === enabled && (enabled === false || this.child !== void 0)) return;
-			if (!enabled) await this.stop();
-			this.enabled = enabled;
 			await this.options.store.save({
 				version: 1,
 				enabled
 			});
+			this.enabled = enabled;
+			if (!enabled) await this.stop();
 			if (enabled) await this.start();
 			else this.publish({
 				enabled: false,
@@ -13830,11 +14109,11 @@ var CpolarController = class {
 		if (!this.initialized || this.disposed) throw new Error("cpolar controller is unavailable");
 		await this.enqueue(async () => {
 			if (!this.enabled) {
-				this.enabled = true;
 				await this.options.store.save({
 					version: 1,
 					enabled: true
 				});
+				this.enabled = true;
 			}
 			await this.stop();
 			await this.start();
@@ -13845,12 +14124,12 @@ var CpolarController = class {
 	async reset() {
 		if (!this.initialized || this.disposed) throw new Error("cpolar controller is unavailable");
 		await this.enqueue(async () => {
-			await this.stop();
-			this.enabled = false;
 			await this.options.store.save({
 				version: 1,
 				enabled: false
 			});
+			this.enabled = false;
+			await this.stop();
 			this.publish({
 				enabled: false,
 				state: "off"
@@ -15292,12 +15571,12 @@ var ManagedOriginController = class {
 	gateway() {
 		return this.enabled ? this.controller().gateway() : void 0;
 	}
-	initialize() {
+	initialize(initialState) {
 		return this.enqueue(async () => {
 			if (this.initialized) return;
 			if (this.disposed) throw new Error("origin_controller_unavailable");
 			this.selected = (await this.options.modeStore.load()).mode;
-			this.enabled = (await this.options.store.load()).enabled;
+			this.enabled = (initialState ?? await this.options.store.load()).enabled;
 			await this.options.external.initialize();
 			await this.options.managed.initialize();
 			await this.options.external.setEnabled(false);
@@ -15336,11 +15615,11 @@ var ManagedOriginController = class {
 		if (!enabled) this.options.managed.cancelPendingStart?.();
 		return this.enqueue(async () => {
 			this.assertAvailable();
-			if (!enabled) await this.stopBoth();
 			await this.options.store.save({
 				version: 1,
 				enabled
 			});
+			if (!enabled) await this.stopBoth();
 			this.enabled = enabled;
 			if (enabled && !this.disposed) try {
 				await this.controller().setEnabled(true);
@@ -15354,11 +15633,11 @@ var ManagedOriginController = class {
 		this.options.managed.cancelPendingStart?.();
 		return this.enqueue(async () => {
 			this.assertAvailable();
-			await this.stopBoth();
 			await this.options.store.save({
 				version: 1,
 				enabled: true
 			});
+			await this.stopBoth();
 			this.enabled = true;
 			if (!this.disposed) try {
 				await this.controller().reconnect();
@@ -17229,8 +17508,9 @@ async function apply(ctx, config) {
 				frp: frpStore,
 				origin: originStore
 			};
-			await Promise.all(Object.keys(stores).filter((provider) => provider !== remoteProviders.selected).map((provider) => stores[provider].disableIfPresent()));
-			for (const provider of REMOTE_PROVIDERS) await remoteControllers[provider].initialize();
+			const prepared = await prepareDisabledRemoteProviders(remoteProviders.selected, stores);
+			for (const provider of REMOTE_PROVIDERS) if (provider === remoteProviders.selected) await remoteControllers[provider].initialize();
+			else await remoteControllers[provider].initialize(prepared.get(provider));
 			const lanDiscovery = lanGateway?.discoveryStatus();
 			if (lanDiscovery !== void 0 && !lanDiscovery.broadcast) logger.warn("broadcast discovery is unavailable (%s); mDNS is still published, so pair manually or free the UDP port", lanDiscovery.errorCode ?? "unknown_cause");
 			if (lanDiscovery?.mobileAssetsErrorCode !== void 0) logger.warn("a bundled mobile asset is missing (%s); the phone frontend will serve without it", lanDiscovery.mobileAssetsErrorCode);