dsh-mobile 0.6.7 → 0.6.9

package/lib/index.mjs

@@ -4,7 +4,7 @@ import { basename, dirname, extname, isAbsolute, join, relative, resolve, win32
 import { fileURLToPath, pathToFileURL } from "node:url";
 import z from "@deepseek-ai/schemastery";
 import { connect, createServer } from "node:net";
-import { chmod, copyFile, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, realpath, rename, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
+import { chmod, copyFile, link, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, realpath, rename, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
 import { performance as performance$1 } from "node:perf_hooks";
 import { execFile, spawn } from "node:child_process";
 import { createSocket } from "node:dgram";
@@ -144,10 +144,14 @@ var AccessController = class {
 	}
 	snapshot(devices) {
 		return Object.freeze({
-			version: 1,
+			version: 2,
 			devices: Object.freeze([...devices])
 		});
 	}
+	nativeIdentity(device) {
+		const nativeInstanceId = device.nativeInstanceId ?? this.options.legacyInstanceId ?? this.options.pairingInstanceId;
+		return nativeInstanceId === void 0 ? {} : { nativeInstanceId };
+	}
 	emitSessionEnded(session, reason) {
 		const authorization = Object.freeze({
 			sessionKey: session.key,
@@ -165,7 +169,7 @@ var AccessController = class {
 	pruneSessions(now) {
 		for (const [key, session] of this.sessions) if (session.expiresAt <= now) this.removeSession(key, "expired");
 	}
-	createSession(deviceId, now, deviceExpiresAt) {
+	createSession(device, now) {
 		this.pruneSessions(now);
 		if (this.sessions.size >= this.options.maxSessions) {
 			const oldest = [...this.sessions.values()].sort((left, right) => left.createdAt - right.createdAt)[0];
@@ -176,14 +180,15 @@ var AccessController = class {
 		const key = digestHex(sessionToken);
 		const record = Object.freeze({
 			key,
-			deviceId,
+			deviceId: device.id,
 			csrfDigest: digest$1(csrfToken),
 			createdAt: now,
-			expiresAt: Math.min(now + this.options.sessionTtlMs, deviceExpiresAt)
+			expiresAt: Math.min(now + this.options.sessionTtlMs, device.expiresAt)
 		});
 		this.sessions.set(key, record);
 		return Object.freeze({
-			deviceId,
+			...this.nativeIdentity(device),
+			deviceId: device.id,
 			sessionToken,
 			csrfToken,
 			sessionExpiresAt: record.expiresAt
@@ -228,12 +233,13 @@ var AccessController = class {
 				tokenDigest: digestHex(deviceToken),
 				createdAt: now,
 				expiresAt: now + this.options.deviceTtlMs,
-				lastSeenAt: now
+				lastSeenAt: now,
+				...this.options.pairingInstanceId === void 0 ? {} : { nativeInstanceId: this.options.pairingInstanceId }
 			});
 			const next = [...this.devices.filter((candidate) => candidate.revokedAt === void 0 && candidate.expiresAt > now), device];
 			await this.store.save(this.snapshot(next));
 			this.devices = next;
-			const session = this.createSession(device.id, now, device.expiresAt);
+			const session = this.createSession(device, now);
 			return Object.freeze({
 				...session,
 				deviceToken,
@@ -256,7 +262,7 @@ var AccessController = class {
 			next[index] = updated;
 			await this.store.save(this.snapshot(next));
 			this.devices = next;
-			return this.createSession(device.id, now, device.expiresAt);
+			return this.createSession(device, now);
 		});
 	}
 	/** Validate a persistent device credential without consuming a Session slot. */
@@ -275,6 +281,7 @@ var AccessController = class {
 			await this.store.save(this.snapshot(next));
 			this.devices = next;
 			return Object.freeze({
+				...this.nativeIdentity(device),
 				deviceId: device.id,
 				deviceExpiresAt: device.expiresAt
 			});
@@ -285,6 +292,7 @@ var AccessController = class {
 		this.requireInitialized();
 		const device = this.requireDevice(deviceToken, this.now());
 		return Object.freeze({
+			...this.nativeIdentity(device),
 			deviceId: device.id,
 			deviceExpiresAt: device.expiresAt
 		});
@@ -5289,6 +5297,8 @@ var MobileAccessGateway = class {
 		this.listenerTlsEnabled = config.tls.mode === "provided";
 		this.tlsEnabled = config.publicTls;
 		this.access = new AccessController(store, {
+			pairingInstanceId: config.instanceId,
+			...config.legacyInstanceId === void 0 ? {} : { legacyInstanceId: config.legacyInstanceId },
 			pairingTtlMs: config.pairingTtlMs,
 			deviceTtlMs: config.deviceTtlMs,
 			sessionTtlMs: config.sessionTtlMs,
@@ -5665,12 +5675,16 @@ var MobileAccessGateway = class {
 			sessionExpiresAt: result.sessionExpiresAt
 		}, this.tlsEnabled);
 	}
+	/** CA-backed entries retain their pin; public entries project the authenticated credential's identity. */
+	nativeResponseInstanceId(result) {
+		return this.config.pairingCaFile === void 0 ? result.nativeInstanceId ?? this.config.instanceId : this.config.instanceId;
+	}
 	async handleNativePair(request, response) {
 		const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
 		if (typeof body.token !== "string" || body.label !== void 0 && typeof body.label !== "string") throw new HttpError(400, "bad_request");
 		const result = await this.access.pair(request.socket.remoteAddress ?? "unknown", body.token, body.label);
 		sendJson(response, 201, {
-			instanceId: this.config.instanceId,
+			instanceId: this.nativeResponseInstanceId(result),
 			deviceId: result.deviceId,
 			deviceToken: result.deviceToken,
 			deviceExpiresAt: result.deviceExpiresAt,
@@ -5685,7 +5699,7 @@ var MobileAccessGateway = class {
 		if (typeof body.deviceToken !== "string") throw new HttpError(400, "bad_request");
 		const result = await this.access.renew(body.deviceToken);
 		sendJson(response, 200, {
-			instanceId: this.config.instanceId,
+			instanceId: this.nativeResponseInstanceId(result),
 			deviceId: result.deviceId,
 			sessionToken: result.sessionToken,
 			csrfToken: result.csrfToken,
@@ -5698,7 +5712,7 @@ var MobileAccessGateway = class {
 		if (typeof body.deviceToken !== "string") throw new HttpError(400, "bad_request");
 		const result = await this.access.probe(body.deviceToken);
 		sendJson(response, 200, {
-			instanceId: this.config.instanceId,
+			instanceId: this.nativeResponseInstanceId(result),
 			deviceId: result.deviceId,
 			deviceExpiresAt: result.deviceExpiresAt
 		}, this.tlsEnabled);
@@ -7367,6 +7381,7 @@ function parseDevice(value) {
 	if (typeof record.id !== "string" || !/^[a-f\d]{32}$/u.test(record.id)) throw new Error("device state contains an invalid id");
 	if (typeof record.label !== "string" || record.label.length < 1 || record.label.length > 64 || /[\u0000-\u001f\u007f]/u.test(record.label)) throw new Error("device state contains an invalid label");
 	if (typeof record.tokenDigest !== "string" || !/^[a-f\d]{64}$/u.test(record.tokenDigest)) throw new Error("device state contains an invalid credential digest");
+	if (record.nativeInstanceId !== void 0 && (typeof record.nativeInstanceId !== "string" || !/^[a-f\d]{64}$/u.test(record.nativeInstanceId))) throw new Error("device state contains an invalid native instance id");
 	assertInteger(record.createdAt, "createdAt");
 	assertInteger(record.expiresAt, "expiresAt");
 	assertInteger(record.lastSeenAt, "lastSeenAt");
@@ -7379,6 +7394,7 @@ function parseDevice(value) {
 		createdAt: record.createdAt,
 		expiresAt: record.expiresAt,
 		lastSeenAt: record.lastSeenAt,
+		...record.nativeInstanceId === void 0 ? {} : { nativeInstanceId: record.nativeInstanceId },
 		...record.revokedAt === void 0 ? {} : { revokedAt: record.revokedAt }
 	});
 }
@@ -7386,14 +7402,21 @@ function parseDevice(value) {
 function parseDeviceSnapshot(value, maximumDevices = 256) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("device state must be an object");
 	const snapshot = value;
-	if (snapshot.version !== 1 || !Array.isArray(snapshot.devices) || snapshot.devices.length > maximumDevices) throw new Error("device state has an unsupported version or device count");
+	if (snapshot.version !== 1 && snapshot.version !== 2 || !Array.isArray(snapshot.devices) || snapshot.devices.length > maximumDevices) throw new Error("device state has an unsupported version or device count");
 	const devices = snapshot.devices.map(parseDevice);
 	if (new Set(devices.map((device) => device.id)).size !== devices.length || new Set(devices.map((device) => device.tokenDigest)).size !== devices.length) throw new Error("device state contains duplicate device identities");
 	return Object.freeze({
-		version: 1,
+		version: snapshot.version,
 		devices: Object.freeze(devices)
 	});
 }
+function snapshotForSave(snapshot, maximumDevices) {
+	const validated = parseDeviceSnapshot(snapshot, maximumDevices);
+	return Object.freeze({
+		version: 2,
+		devices: validated.devices
+	});
+}
 /** Atomic JSON implementation with symlink refusal and owner-only file creation. */
 var JsonDeviceStore = class {
 	file;
@@ -7424,7 +7447,7 @@ var JsonDeviceStore = class {
 		return parseDeviceSnapshot(parsed, this.maximumDevices);
 	}
 	async save(snapshot) {
-		const validated = parseDeviceSnapshot(snapshot, this.maximumDevices);
+		const validated = snapshotForSave(snapshot, this.maximumDevices);
 		const directory = dirname(this.file);
 		await mkdir(directory, {
 			recursive: true,
@@ -7468,7 +7491,7 @@ var MemoryDeviceStore = class {
 		return structuredClone(this.snapshot);
 	}
 	async save(snapshot) {
-		this.snapshot = structuredClone(parseDeviceSnapshot(snapshot));
+		this.snapshot = structuredClone(snapshotForSave(snapshot));
 	}
 	/** Return a defensive copy for assertions or administrative export. */
 	inspect() {
@@ -10587,6 +10610,8 @@ var RemoteProviderCoordinator = class {
 	store;
 	selectedValue;
 	queue = Promise.resolve();
+	closing = false;
+	closeTask;
 	constructor(selected, controllers, store) {
 		this.controllers = controllers;
 		this.store = store;
@@ -10638,8 +10663,16 @@ var RemoteProviderCoordinator = class {
 			}
 		});
 	}
+	/** Stop admitting mutations and wait for accepted work before callers release provider resources. */
+	close() {
+		this.closing = true;
+		this.closeTask ??= this.queue;
+		return this.closeTask;
+	}
 	enqueue(operation) {
-		const task = this.queue.then(() => this.runAndEnforce(operation), () => this.runAndEnforce(operation));
+		if (this.closing) return Promise.reject(/* @__PURE__ */ new Error("remote_provider_closed"));
+		const run = () => this.closing ? Promise.reject(/* @__PURE__ */ new Error("remote_provider_closed")) : this.runAndEnforce(operation);
+		const task = this.queue.then(run, run);
 		this.queue = task.then(() => void 0, () => void 0);
 		return task;
 	}
@@ -13330,6 +13363,8 @@ const MOBILE_CUSTOMIZATION_GUIDE_BODY = `你在为用户定制 DSH Mobile 的手
 
 动手前先读已有的定制文件。若要调整 DSH 自带的输入框、侧栏或设置等现有界面，先确认当前 DSH 版本与手机页面模式（专用移动页面或 ?frontend=stock），只读核对运行页面的 DOM、属性和样式；本机有同版本前端源码时可参考相应组件，没有源码时可查看已安装的客户端产物，不必下载源码。优先使用扩展 API、插槽和稳定的 data-* 标记，不凭猜测依赖构建类名。只读查看不改变前述写入范围。
 
+旧 CSS 可能覆盖新版内置修复。先备份并在同一会话、方向和字号下对比有无该样式，不要无症状叠加旧补丁。CSS Modules 的后缀／子串匹配必须限定到已核对的区域祖先，例如 [data-dsh-mobile-header] [class*="_titleRow"]；不要裸匹配整页。display: none 会让其中的操作不可用，不得把隐藏功能描述成折叠。
+
 2. 电脑端能力 —— 手机需要读电脑文件、执行命令或访问硬件时，创建扩展：
    - 目录：$DSH_HOME/mobile-access/extensions/<id>/，id 用小写字母数字和连字符（如 media-remote）
    - extension.json：{"schemaVersion":1,"id":"<id>","name":"显示名","version":"0.1.0","description":"说明"}
@@ -15272,10 +15307,35 @@ async function removeCaddyTree(root, target) {
 }
 //#endregion
 //#region src/caddy-component.ts
-const CADDY_VERSION = "2.11.6";
+const CADDY_VERSION = "2.11.7";
 const CADDY_DNS_PLUGIN_VERSION = "v0.4.3";
-const CADDY_DOWNLOAD_PAGE = "https://caddyserver.com/download";
-const CADDY_COMPONENT_RELEASES = Object.freeze({});
+const CADDY_DOWNLOAD_PAGE = "https://github.com/saya-ch/dsh-mobile/releases/tag/caddy-component-2.11.7-tencentcloud-0.4.3-r1";
+const CADDY_COMPONENT_RELEASES = Object.freeze({
+	"linux-x64": Object.freeze({
+		version: CADDY_VERSION,
+		dnsPluginVersion: CADDY_DNS_PLUGIN_VERSION,
+		platform: "linux",
+		arch: "x64",
+		executableName: "caddy",
+		downloadUrl: "https://github.com/saya-ch/dsh-mobile/releases/download/caddy-component-2.11.7-tencentcloud-0.4.3-r1/caddy-2.11.7-tencentcloud-0.4.3-linux-x64",
+		downloadBytes: 81995704,
+		executableBytes: 81995704,
+		downloadSha256: "13652ef9ea3792ebff772a5b873ade63ed6de1c0a794bb3403a523639b8f57af",
+		executableSha256: "13652ef9ea3792ebff772a5b873ade63ed6de1c0a794bb3403a523639b8f57af"
+	}),
+	"win32-x64": Object.freeze({
+		version: CADDY_VERSION,
+		dnsPluginVersion: CADDY_DNS_PLUGIN_VERSION,
+		platform: "win32",
+		arch: "x64",
+		executableName: "caddy.exe",
+		downloadUrl: "https://github.com/saya-ch/dsh-mobile/releases/download/caddy-component-2.11.7-tencentcloud-0.4.3-r1/caddy-2.11.7-tencentcloud-0.4.3-win32-x64.exe",
+		downloadBytes: 82816e3,
+		executableBytes: 82816e3,
+		downloadSha256: "962f7937a06e1e737513d2d1d4ad75df54ba503d36fa2a458912bd38fbd0094a",
+		executableSha256: "962f7937a06e1e737513d2d1d4ad75df54ba503d36fa2a458912bd38fbd0094a"
+	})
+});
 Object.freeze({
 	version: CADDY_VERSION,
 	dnsPluginVersion: CADDY_DNS_PLUGIN_VERSION
@@ -15299,14 +15359,16 @@ function caddyInspectionEnvironment(environment = process.env) {
 	]) if (environment[name] !== void 0) result[name] = environment[name];
 	return result;
 }
-async function inspect(executable) {
+async function inspect(executable, assertOpen) {
 	const options = {
 		env: caddyInspectionEnvironment(),
 		timeout: 15e3,
 		maxBuffer: 262144
 	};
+	const version = (await execFileText(executable, ["version"], options)).stdout.trim();
+	assertOpen();
 	return {
-		version: (await execFileText(executable, ["version"], options)).stdout.trim(),
+		version,
 		modules: (await execFileText(executable, ["list-modules", "--versions"], options)).stdout
 	};
 }
@@ -15325,6 +15387,10 @@ var CaddyComponentManager = class {
 	installed = false;
 	errorCode;
 	queue = Promise.resolve();
+	closed = false;
+	closing;
+	download;
+	cleanupPaths = /* @__PURE__ */ new Set();
 	constructor(options) {
 		if (!isAbsolute(options.stateDirectory)) throw new Error("caddy state directory must be absolute");
 		this.stateDirectory = resolve(options.stateDirectory);
@@ -15334,7 +15400,7 @@ var CaddyComponentManager = class {
 		if (artifact !== void 0 && (artifact.platform !== platform || artifact.arch !== arch || !/^https:\/\//u.test(artifact.downloadUrl) || !/^[a-f0-9]{64}$/u.test(artifact.downloadSha256) || !/^[a-f0-9]{64}$/u.test(artifact.executableSha256) || artifact.downloadBytes < 1 || artifact.executableBytes < 1 || !/^[a-z0-9.-]+$/u.test(artifact.executableName))) throw new Error("caddy_artifact_invalid");
 		this.artifact = artifact;
 		this.componentRoot = join(this.stateDirectory, "components", "caddy");
-		this.componentStorage = join(this.componentRoot, artifact?.version ?? "2.11.6");
+		this.componentStorage = join(this.componentRoot, artifact?.version ?? "2.11.7");
 		this.executable = join(this.componentStorage, artifact?.executableName ?? (platform === "win32" ? "caddy.exe" : "caddy"));
 		this.logRoot = join(this.stateDirectory, "caddy", "logs");
 		this.stagingRoot = join(this.stateDirectory, "staging", "caddy");
@@ -15344,41 +15410,48 @@ var CaddyComponentManager = class {
 			expectedBytes: artifact?.downloadBytes ?? 0,
 			errorPrefix: "caddy"
 		}));
-		this.inspectExecutable = options.inspectExecutable ?? inspect;
+		this.inspectExecutable = options.inspectExecutable ?? ((executable) => inspect(executable, () => this.assertOpen()));
 		this.promote = options.promoteDirectory ?? ((source, destination) => renameCaddyPath(this.stateDirectory, source, destination));
 	}
 	/** Recheck a pinned executable before launching; no unverified local binary can run. */
-	async ensureExecutable() {
+	ensureExecutable() {
+		return this.enqueue(() => this.checkExecutable());
+	}
+	async checkExecutable() {
 		const artifact = this.artifact;
 		if (artifact === void 0) throw new Error("caddy_component_unavailable");
 		await assertCaddyParents(this.stateDirectory, this.executable);
+		this.assertOpen();
 		const entry = await lstat(this.executable);
 		if (!entry.isFile() || entry.isSymbolicLink() || entry.size !== artifact.executableBytes || await digest(this.executable) !== artifact.executableSha256) throw new Error("caddy_component_invalid");
 		await this.verifyMetadata(this.executable, artifact);
 	}
 	async initialize() {
-		this.installed = false;
-		this.errorCode = void 0;
-		if (this.artifact === void 0) {
-			this.errorCode = "caddy_component_unavailable";
-			return;
-		}
-		try {
-			await this.ensureExecutable();
-			this.installed = true;
-		} catch (error) {
-			if (error.code !== "ENOENT") this.errorCode = "caddy_component_invalid";
-		}
+		return this.enqueue(async () => {
+			this.installed = false;
+			this.errorCode = void 0;
+			if (this.artifact === void 0) {
+				this.errorCode = "caddy_component_unavailable";
+				return;
+			}
+			try {
+				await this.checkExecutable();
+				this.installed = true;
+			} catch (error) {
+				this.assertOpen();
+				if (error.code !== "ENOENT") this.errorCode = "caddy_component_invalid";
+			}
+		});
 	}
 	status() {
 		const artifact = this.artifact;
 		return Object.freeze({
 			supported: artifact !== void 0,
 			installed: this.installed,
-			version: artifact?.version ?? "2.11.6",
+			version: artifact?.version ?? "2.11.7",
 			downloadBytes: artifact?.downloadBytes ?? 0,
 			installedBytes: this.installed ? artifact?.executableBytes ?? 0 : 0,
-			sourceUrl: artifact?.downloadUrl ?? "https://caddyserver.com/download",
+			sourceUrl: artifact?.downloadUrl ?? "https://github.com/saya-ch/dsh-mobile/releases/tag/caddy-component-2.11.7-tencentcloud-0.4.3-r1",
 			downloadPage: CADDY_DOWNLOAD_PAGE,
 			storagePath: this.componentRoot,
 			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
@@ -15390,28 +15463,40 @@ var CaddyComponentManager = class {
 			const artifact = this.artifact;
 			if (artifact === void 0) throw new Error("caddy_component_unavailable");
 			await ensureCaddyDirectory(this.stateDirectory, this.stagingRoot);
+			this.assertOpen();
 			await ensureCaddyDirectory(this.stateDirectory, this.componentRoot);
+			this.assertOpen();
 			const staging = await mkdtemp(join(this.stagingRoot, "install-"));
 			const candidate = join(this.componentRoot, ".install-" + randomBytes(12).toString("hex"));
 			const backup = join(this.componentRoot, ".previous-" + randomBytes(12).toString("hex"));
 			let previous = false;
 			let promoted = false;
 			let failed = false;
+			let operationError;
 			try {
+				this.assertOpen();
 				const controller = new AbortController();
 				const timeout = setTimeout(() => {
 					controller.abort();
 				}, 6e5);
 				timeout.unref();
+				this.download = {
+					controller,
+					timeout
+				};
 				let bytes;
 				try {
 					bytes = await this.fetchArtifact(artifact.downloadUrl, controller.signal);
 				} finally {
 					clearTimeout(timeout);
+					this.download = void 0;
 				}
+				this.assertOpen();
+				controller.signal.throwIfAborted();
 				if (bytes.byteLength !== artifact.downloadBytes) throw new Error("caddy_download_size_mismatch");
 				if (createHash("sha256").update(bytes).digest("hex") !== artifact.downloadSha256) throw new Error("caddy_download_hash_mismatch");
 				await ensureCaddyDirectory(this.stateDirectory, candidate);
+				this.assertOpen();
 				const executable = join(candidate, artifact.executableName);
 				await writeFile(executable, bytes, {
 					flag: "wx",
@@ -15420,8 +15505,10 @@ var CaddyComponentManager = class {
 				await chmod(executable, 448);
 				if (bytes.byteLength !== artifact.executableBytes || await digest(executable) !== artifact.executableSha256) throw new Error("caddy_executable_hash_mismatch");
 				await this.verifyMetadata(executable, artifact);
+				this.assertOpen();
 				try {
 					const entry = await lstat(this.componentStorage);
+					this.assertOpen();
 					if (!entry.isDirectory() || entry.isSymbolicLink()) throw new Error("caddy_path_invalid");
 					await renameCaddyPath(this.stateDirectory, this.componentStorage, backup);
 					previous = true;
@@ -15429,6 +15516,7 @@ var CaddyComponentManager = class {
 					if (error.code !== "ENOENT") throw error;
 				}
 				try {
+					this.assertOpen();
 					await this.promote(candidate, this.componentStorage);
 					promoted = true;
 				} catch (error) {
@@ -15446,21 +15534,29 @@ var CaddyComponentManager = class {
 				this.errorCode = void 0;
 			} catch (error) {
 				failed = true;
+				operationError = error;
 				throw error;
 			} finally {
-				let cleanupError;
+				const cleanupErrors = [];
 				for (const path of [
 					staging,
 					candidate,
 					...previous && promoted ? [backup] : []
-				]) try {
-					await removeCaddyTree(this.stateDirectory, path);
-				} catch (error) {
-					cleanupError ??= error;
+				]) {
+					this.cleanupPaths.add(path);
+					try {
+						await removeCaddyTree(this.stateDirectory, path);
+						this.cleanupPaths.delete(path);
+					} catch (error) {
+						cleanupErrors.push(error);
+					}
+				}
+				if (cleanupErrors.length > 0) {
+					if (!failed && cleanupErrors.length === 1) throw cleanupErrors[0];
+					throw new AggregateError([...failed ? [operationError] : [], ...cleanupErrors], "caddy_component_cleanup_failed", failed ? { cause: operationError } : void 0);
 				}
-				if (!failed && cleanupError !== void 0) throw cleanupError;
 			}
-		});
+		}).then(() => this.status());
 	}
 	/** Remove optional component files; callers stop the controller and purge runtime configuration separately. */
 	purge() {
@@ -15469,18 +15565,57 @@ var CaddyComponentManager = class {
 			await removeCaddyTree(this.stateDirectory, this.stagingRoot);
 			this.installed = false;
 			this.errorCode = this.artifact === void 0 ? "caddy_component_unavailable" : void 0;
+		}).then(() => this.status());
+	}
+	/**
+	* Permanently stop admission and abort downloads, then await admitted work and cleanup.
+	* An already started promotion/purge settles normally; cancellation does not undo committed bytes.
+	* A downloader that ignores abort remains owned until its promise settles. Failed temporary cleanup
+	* is retried here; a failed close can be called again without reopening admission or deleting recovery backups.
+	*/
+	close() {
+		if (this.closing !== void 0) return this.closing;
+		this.closed = true;
+		if (this.download !== void 0) {
+			clearTimeout(this.download.timeout);
+			this.download.controller.abort(/* @__PURE__ */ new Error("caddy_component_closed"));
+		}
+		const task = this.queue.then(async () => {
+			const errors = [];
+			for (const path of this.cleanupPaths) try {
+				await removeCaddyTree(this.stateDirectory, path);
+				this.cleanupPaths.delete(path);
+			} catch (error) {
+				errors.push(error);
+			}
+			if (errors.length === 1) throw errors[0];
+			if (errors.length > 1) throw new AggregateError(errors, "caddy_component_cleanup_failed");
+		});
+		this.closing = task;
+		task.catch(() => {
+			if (this.closing === task) this.closing = void 0;
 		});
+		return task;
 	}
 	async verifyMetadata(executable, artifact) {
+		this.assertOpen();
 		const info = await this.inspectExecutable(executable);
+		this.assertOpen();
 		if (!info.version.startsWith("v" + artifact.version + " ")) throw new Error("caddy_executable_version_mismatch");
 		const nonstandard = info.modules.split(/\r?\n/u).filter((line) => line.startsWith("dns.providers."));
 		if (nonstandard.length !== 1 || nonstandard[0] !== "dns.providers.tencentcloud " + artifact.dnsPluginVersion || !info.modules.includes("Non-standard modules: 1")) throw new Error("caddy_executable_modules_mismatch");
 	}
+	assertOpen() {
+		if (this.closed) throw new Error("caddy_component_closed");
+	}
 	enqueue(operation) {
-		const task = this.queue.then(operation, operation);
+		if (this.closed) return Promise.reject(/* @__PURE__ */ new Error("caddy_component_closed"));
+		const task = this.queue.then(() => {
+			this.assertOpen();
+			return operation();
+		});
 		this.queue = task.then(() => void 0, () => void 0);
-		return task.then(() => this.status());
+		return task;
 	}
 };
 const MAX_CONFIG_BYTES = 16384;
@@ -15839,6 +15974,7 @@ var CaddyController = class {
 		} catch {}
 	}
 	async start() {
+		if (this.child !== void 0 || this.gatewayValue !== void 0) await this.stop();
 		const generation = ++this.generation;
 		const startup = new AbortController();
 		this.startupAbort = startup;
@@ -15888,12 +16024,19 @@ var CaddyController = class {
 				"--adapter",
 				"caddyfile"
 			], environment);
-			this.child = child;
+			const ownedChild = {
+				process: child,
+				closed: false
+			};
+			this.child = ownedChild;
+			child.once("close", () => {
+				ownedChild.closed = true;
+			});
 			child.stdout.resume();
 			child.stderr.resume();
 			child.stdin.end();
 			const failed = (code) => {
-				if (generation !== this.generation || this.child !== child) return;
+				if (generation !== this.generation || this.child !== ownedChild) return;
 				childFailure = code;
 				startup.abort();
 				if (this.latest.state === "ready") this.enqueue(async () => {
@@ -15968,20 +16111,49 @@ var CaddyController = class {
 		this.startupAbort?.abort();
 		await this.stopResources();
 	}
+	waitForChildClose(child) {
+		if (child.closed) return Promise.resolve();
+		return new Promise((resolve, reject) => {
+			const finish = (error) => {
+				clearTimeout(timer);
+				child.process.removeListener("close", closed);
+				if (error === void 0) resolve();
+				else reject(error);
+			};
+			const closed = () => {
+				finish();
+			};
+			const timer = setTimeout(() => {
+				finish(/* @__PURE__ */ new Error("caddy_process_close_timeout"));
+			}, 1500);
+			timer.unref();
+			child.process.once("close", closed);
+		});
+	}
 	async stopResources() {
 		const child = this.child;
 		const gateway = this.gatewayValue;
-		await settleRemoteResources([async () => {
-			if (child !== void 0) {
-				await (this.options.terminateProcess ?? terminateRemoteProcess)(child);
-				if (this.child === child) this.child = void 0;
-			}
-		}, async () => {
-			if (gateway !== void 0) {
-				await gateway.close();
-				if (this.gatewayValue === gateway) this.gatewayValue = void 0;
-			}
-		}], "caddy cleanup failed");
+		try {
+			await settleRemoteResources([async () => {
+				if (child !== void 0) {
+					await (this.options.terminateProcess ?? terminateRemoteProcess)(child.process);
+					await this.waitForChildClose(child);
+					if (this.child === child) this.child = void 0;
+				}
+			}, async () => {
+				if (gateway !== void 0) {
+					await gateway.close();
+					if (this.gatewayValue === gateway) this.gatewayValue = void 0;
+				}
+			}], "caddy cleanup failed");
+		} catch (error) {
+			this.publish({
+				enabled: this.enabled,
+				state: "error",
+				errorCode: "caddy_cleanup_failed"
+			});
+			throw error;
+		}
 	}
 };
 //#endregion
@@ -16691,23 +16863,75 @@ async function readInstallationId(file) {
 	await restrictPrivateFile(file);
 	return contents.slice(0, -1);
 }
-/** Keep one random plugin identity across setup changes, restarts, and FRP resets. */
+/** Keep one random plugin identity across setup changes, restarts, and FRP resets; creation requires hard-link support in the state directory. */
 async function loadOrCreateInstallationId(file) {
 	if (!isAbsolute(file)) throw new Error("installation ID path must be absolute");
 	const target = resolve(file);
-	await mkdir(dirname(target), {
-		recursive: true,
-		mode: 448
-	});
+	const directory = dirname(target);
+	await ensureManagedDirectory(directory, directory, "installation_id");
 	try {
-		await writeFile(target, `${randomBytes(32).toString("hex")}\n`, {
-			flag: "wx",
-			mode: 384
-		});
+		return await readInstallationId(target);
 	} catch (error) {
-		if (error.code !== "EEXIST") throw error;
+		if (error.code !== "ENOENT") throw error;
 	}
-	return readInstallationId(target);
+	const temporary = join(directory, `.${basename(target)}.${randomBytes(12).toString("hex")}.tmp`);
+	let created = false;
+	let failure;
+	try {
+		await assertManagedParents(directory, temporary, "installation_id");
+		const handle = await open(temporary, "wx", 384);
+		created = true;
+		let writeFailure;
+		try {
+			await handle.writeFile(`${randomBytes(32).toString("hex")}\n`, "utf8");
+		} catch (error) {
+			writeFailure = error;
+			throw error;
+		} finally {
+			try {
+				await handle.close();
+			} catch (closeError) {
+				if (writeFailure !== void 0) throw new AggregateError([writeFailure, closeError], "installation ID candidate write and close failed");
+				throw closeError;
+			}
+		}
+		await restrictPrivateFile(temporary);
+		await assertManagedParents(directory, target, "installation_id");
+		try {
+			await link(temporary, target);
+		} catch (error) {
+			if (error.code !== "EEXIST") throw new Error("installation ID publication failed; the state filesystem must support hard links", { cause: error });
+		}
+		return await readInstallationId(target);
+	} catch (error) {
+		failure = error;
+		throw error;
+	} finally {
+		if (created) try {
+			await assertManagedParents(directory, temporary, "installation_id");
+			await unlink(temporary);
+		} catch (cleanupError) {
+			if (failure !== void 0) throw new AggregateError([failure, cleanupError], "installation ID publication and temporary cleanup failed");
+			throw cleanupError;
+		}
+	}
+}
+//#endregion
+//#region src/gateway-identity.ts
+/**
+* Use the persisted installation identity for an unpinned, automatically identified entry.
+* @param config - Validated gateway configuration containing the legacy identity.
+* @param installationId - Confirmed random identity read from this installation's state.
+* @param explicitIdentity - Whether the operator supplied the gateway identity.
+* @returns Configuration retaining certificate/operator identities or the new and legacy public identities.
+*/
+function withInstallationIdentity(config, installationId, explicitIdentity) {
+	if (config.pairingCaFile !== void 0 || explicitIdentity) return config;
+	return Object.freeze({
+		...config,
+		instanceId: installationId,
+		legacyInstanceId: config.instanceId
+	});
 }
 //#endregion
 //#region src/lan-setup.ts
@@ -16955,7 +17179,7 @@ async function stableInstanceId(loaded, template) {
 	if (loaded.kind !== "managed") return loaded.config.instanceId ?? template.instanceId;
 	return new X509Certificate(await readFile(loaded.setup.tls.caCertFile)).fingerprint256.replaceAll(":", "").toLowerCase();
 }
-function remoteGatewayConfig(template, publicOrigin, stateFile, instanceId, listenPort = 0) {
+function remoteGatewayConfig(template, publicOrigin, stateFile, instanceId, listenPort = 0, legacyInstanceId) {
 	const origin = new URL(publicOrigin);
 	if (origin.protocol !== "https:" || origin.username !== "" || origin.password !== "" || origin.pathname !== "/" || origin.search !== "" || origin.hash !== "") throw new Error("remote public origin must be an HTTPS origin");
 	const publicAuthority = origin.port === "" ? `${origin.hostname}:443` : origin.host;
@@ -16968,6 +17192,7 @@ function remoteGatewayConfig(template, publicOrigin, stateFile, instanceId, list
 		allowedCidrs: Object.freeze([parseCidr("127.0.0.0/8")]),
 		stateFile,
 		instanceId,
+		...legacyInstanceId === void 0 ? {} : { legacyInstanceId },
 		tls: Object.freeze({ mode: "disabled" }),
 		publicTls: true,
 		discovery: false
@@ -17028,11 +17253,11 @@ async function readFrpIngressTrustAnchor(settings, stateFile, ownedRoot = dirnam
 	}
 }
 /** Reuse remote HTTPS policy while binding a separately validated private HTTP origin. */
-function originGatewayConfig(template, settings, stateFile, instanceId, listenPort = settings.listenPort) {
+function originGatewayConfig(template, settings, stateFile, instanceId, listenPort = settings.listenPort, legacyInstanceId) {
 	const validated = parseOriginSettings(settings);
 	if (listenPort !== 0) validateOriginListenPort(listenPort);
 	return Object.freeze({
-		...remoteGatewayConfig(template, validated.publicOrigin, stateFile, instanceId, listenPort),
+		...remoteGatewayConfig(template, validated.publicOrigin, stateFile, instanceId, listenPort, legacyInstanceId),
 		listenHost: validated.listenHost,
 		allowedCidrs: Object.freeze(validated.allowedCidrs.map(parseCidr))
 	});
@@ -17115,6 +17340,7 @@ async function apply(ctx, config) {
 	const frpComponent = new FrpComponentManager({ stateDirectory });
 	await frpComponent.initialize();
 	const frpIdentity = await loadOrCreateInstallationId(join(stateDirectory, "installation-id"));
+	const remoteInstanceId = loaded.kind === "managed" ? frpIdentity : loaded.config.instanceId ?? frpIdentity;
 	const frpConfig = new FrpConfigStore(join(remoteDirectory, "frp", "config"), frpProxyName(frpIdentity), stateDirectory);
 	await frpConfig.initialize();
 	const originConfig = new OriginConfigStore(join(remoteDirectory, "origin", "config"), stateDirectory);
@@ -17166,10 +17392,10 @@ async function apply(ctx, config) {
 	let trustedNetworksWrite = Promise.resolve();
 	let adminClosing = false;
 	const startGateway = async (candidateConfig) => {
-		const resolved = parseGatewayConfig({
+		const resolved = withInstallationIdentity(parseGatewayConfig({
 			...candidateConfig,
 			upstreamOrigin: template.upstreamOrigin.origin
-		});
+		}), frpIdentity, candidateConfig.instanceId !== void 0);
 		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, (source, code) => {
 			logger.warn("%s discovery degraded while DSH remains available: %s", source, code);
 		}, clientModulePreferences);
@@ -17227,7 +17453,7 @@ async function apply(ctx, config) {
 		}
 	}
 	const createRemoteGateway = async (publicOrigin, listenPort = 0) => {
-		const resolved = remoteGatewayConfig(template, publicOrigin, remoteDeviceFile, instanceId, listenPort);
+		const resolved = remoteGatewayConfig(template, publicOrigin, remoteDeviceFile, remoteInstanceId, listenPort, instanceId);
 		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences);
 		await candidate.start();
 		return candidate;
@@ -17254,7 +17480,7 @@ async function apply(ctx, config) {
 		return candidate;
 	};
 	const createOriginGateway = async (settings) => {
-		const resolved = originGatewayConfig(template, settings, remoteDeviceFile, instanceId);
+		const resolved = originGatewayConfig(template, settings, remoteDeviceFile, remoteInstanceId, settings.listenPort, instanceId);
 		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences);
 		try {
 			await candidate.start();
@@ -17273,7 +17499,7 @@ async function apply(ctx, config) {
 		store: createVolatileRemoteControlStore(),
 		component: caddyComponent,
 		config: caddyConfig,
-		instanceId,
+		instanceId: remoteInstanceId,
 		createGateway: (settings) => createRemoteGateway(settings.publicOrigin)
 	});
 	const originController = new ManagedOriginController({
@@ -17313,7 +17539,7 @@ async function apply(ctx, config) {
 			store: frpStore,
 			executable: frpComponent.executable,
 			config: frpConfig,
-			instanceId,
+			instanceId: remoteInstanceId,
 			createGateway: createFrpGateway,
 			/**
 			* Hand the start-up self-check the CA the app itself pins.
@@ -17943,6 +18169,11 @@ async function apply(ctx, config) {
 			adminClosing = true;
 			unregister();
 		};
+		const drainRemoteWork = async () => {
+			const draining = remoteProviders.close();
+			caddyController.cancelPendingStart();
+			await settleCleanupSteps([() => caddyComponent.close(), () => draining]);
+		};
 		const disposeMobileCommand = ctx.commands.register({
 			name: "mobile",
 			description: "定制手机界面或添加电脑能力",
@@ -18009,6 +18240,7 @@ async function apply(ctx, config) {
 			try {
 				await settleCleanupSteps([
 					stopAdmin,
+					drainRemoteWork,
 					() => trustedNetworksWrite,
 					disposeMobileCommand,
 					disposeTaskEvents,
@@ -18028,6 +18260,7 @@ async function apply(ctx, config) {
 		return async () => {
 			await settleCleanupSteps([
 				stopAdmin,
+				drainRemoteWork,
 				() => trustedNetworksWrite,
 				disposeMobileCommand,
 				disposeTaskEvents,