vanspod 0.0.0-stage → 0.1.2

package/dist/storageErrors.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StorageError = void 0;
+class StorageError extends Error {
+    code;
+    constructor(code) {
+        super(code === "invalid" ? "課堂連線資料格式不正確。請重新連線。" :
+            code === "legacy" ? "課堂連線需要安全遷移。" :
+                code === "migration-failed" ? "舊課堂連線無法安全遷移，已移除舊憑證。請重新連線。" :
+                    code === "legacy-cleanup-failed" ? "無法移除舊課堂憑證。請手動刪除 VansPod 的 connection.json，再重新連線。" :
+                        code === "clear-failed" ? "無法清除已保存的課堂連線。" :
+                            code === "unreadable" ? "課堂連線無法解密。請重新連線。" : "安全儲存暫時無法使用。");
+        this.code = code;
+        this.name = "StorageError";
+    }
+}
+exports.StorageError = StorageError;

package/dist/storageLocation.js

@@ -0,0 +1,58 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.relocateConnectionStorage = relocateConnectionStorage;
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const storageErrors_1 = require("./storageErrors");
+/** Move the existing envelope unchanged; the secure adapter handles decryption and plaintext migration. */
+function relocateConnectionStorage(storage, target, legacy) {
+    let initialized;
+    async function removeLegacy() {
+        try {
+            await promises_1.default.unlink(legacy);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw new storageErrors_1.StorageError("clear-failed");
+        }
+    }
+    async function relocate() {
+        try {
+            await promises_1.default.access(legacy);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return;
+            throw new storageErrors_1.StorageError("unavailable");
+        }
+        try {
+            await promises_1.default.mkdir(node_path_1.default.dirname(target), { recursive: true });
+            // Never overwrite a newer connection. Exclusive copying also supports different drives.
+            await promises_1.default.copyFile(legacy, target, node_fs_1.constants.COPYFILE_EXCL);
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw new storageErrors_1.StorageError("unavailable");
+        }
+        await removeLegacy();
+    }
+    function initialize() {
+        if (!initialized)
+            initialized = relocate();
+        return initialized;
+    }
+    return {
+        async getConnection() { await initialize(); return storage.getConnection(); },
+        async setConnection(connection, options) { await initialize(); return storage.setConnection(connection, options); },
+        async clearConnection() {
+            await initialize().catch(() => { });
+            await removeLegacy();
+            await storage.clearConnection();
+            initialized = Promise.resolve();
+        },
+    };
+}

package/dist/version.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VERSION = void 0;
+exports.VERSION = "0.1.2";

package/dist/vsCodeRouteSettings.js

@@ -0,0 +1,208 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createVsCodeRouteSettings = createVsCodeRouteSettings;
+const node_util_1 = require("node:util");
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_path_1 = __importDefault(require("node:path"));
+function isJournal(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const item = value;
+    return item.version === 1 && item.route === "vsCodeChat" && !!item.intended && typeof item.intended === "object" &&
+        !!item.owned && item.owned.name === "VCRouter" && item.owned.vendor === "customendpoint";
+}
+function asProviderArray(value) {
+    if (!Array.isArray(value) || value.some(item => !item || typeof item !== "object" || Array.isArray(item))) {
+        throw new Error("VS Code Chat 模型設定格式無效。");
+    }
+    return value;
+}
+async function readProviders(filename) {
+    let raw;
+    try {
+        raw = await promises_1.default.readFile(filename, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+    try {
+        return asProviderArray(JSON.parse(raw));
+    }
+    catch (error) {
+        if (error instanceof SyntaxError)
+            throw new Error("VS Code Chat 模型設定不是合法 JSON。");
+        throw error;
+    }
+}
+async function atomicJson(filename, value) {
+    await promises_1.default.mkdir(node_path_1.default.dirname(filename), { recursive: true });
+    const temporary = `${filename}.tmp`;
+    try {
+        await promises_1.default.writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+        await promises_1.default.rename(temporary, filename);
+    }
+    finally {
+        await promises_1.default.rm(temporary, { force: true });
+    }
+}
+async function readJournal(filename) {
+    let raw;
+    try {
+        raw = await promises_1.default.readFile(filename, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error("VS Code Chat 設定 journal 已損毀。");
+    }
+    if (!isJournal(parsed))
+        throw new Error("VS Code Chat 設定 journal 已損毀。");
+    return parsed;
+}
+function namedIndexes(providers) {
+    const result = [];
+    providers.forEach((provider, index) => {
+        if (provider.name === "VCRouter")
+            result.push(index);
+    });
+    return result;
+}
+function containsOldExtensionSecret(provider) {
+    return JSON.stringify(provider).includes("${input:chat.lm.secret.");
+}
+function classroomTemplate(providers) {
+    const found = providers.find(provider => provider.name === "VCRouter" && provider.vendor === "customendpoint");
+    if (!found)
+        throw new Error("Router 沒有提供 VS Code Chat 模型設定。");
+    return found;
+}
+const CREDENTIAL_KEYS = new Set([
+    "apikey",
+    "xapikey",
+    "authorization",
+    "proxyauthorization",
+    "token",
+    "accesstoken",
+    "credential",
+    "credentials",
+    "password",
+    "secret",
+    "secretref",
+]);
+function withoutCredentials(value) {
+    if (typeof value === "string" && value.includes("${input:chat.lm.secret."))
+        return undefined;
+    if (Array.isArray(value)) {
+        return value.map(withoutCredentials).filter(item => item !== undefined);
+    }
+    if (!value || typeof value !== "object")
+        return value;
+    const clean = {};
+    for (const [key, item] of Object.entries(value)) {
+        const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
+        if (CREDENTIAL_KEYS.has(normalized))
+            continue;
+        const sanitized = withoutCredentials(item);
+        if (sanitized !== undefined)
+            clean[key] = sanitized;
+    }
+    return clean;
+}
+function intendedProvider(template, adapter, origin) {
+    const provider = withoutCredentials(structuredClone(template));
+    provider.name = "VCRouter";
+    provider.vendor = "customendpoint";
+    provider.apiType = adapter;
+    provider.models = (Array.isArray(provider.models) ? provider.models : []).map(value => {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return value;
+        const model = structuredClone(value);
+        model.url = `${origin.replace(/\/$/, "")}/v1`;
+        model.apiType = adapter;
+        return model;
+    });
+    return provider;
+}
+function createVsCodeRouteSettings(options) {
+    const restore = async () => {
+        const journal = await readJournal(options.journalFile);
+        if (!journal)
+            return { changed: false };
+        const current = await readProviders(options.settingsFile);
+        const indexes = namedIndexes(current);
+        if (indexes.length !== 1 || !(0, node_util_1.isDeepStrictEqual)(current[indexes[0]], journal.intended)) {
+            throw new Error("VS Code 的 VCRouter provider 已被其他程式修改，VansPod 不會覆寫。");
+        }
+        const next = current.filter((_provider, index) => index !== indexes[0]);
+        await atomicJson(options.settingsFile, next);
+        await promises_1.default.rm(options.journalFile, { force: true });
+        return { changed: true };
+    };
+    return {
+        async publish({ providers, adapter, origin }) {
+            const current = await readProviders(options.settingsFile);
+            const intended = intendedProvider(classroomTemplate(providers), adapter, origin);
+            const journal = await readJournal(options.journalFile);
+            let original = null;
+            let next;
+            if (journal) {
+                const indexes = namedIndexes(current);
+                if (indexes.length !== 1 || !(0, node_util_1.isDeepStrictEqual)(current[indexes[0]], journal.intended)) {
+                    throw new Error("VS Code 的 VCRouter provider 已被其他程式修改，VansPod 不會覆寫。");
+                }
+                original = journal.original;
+                next = current.map((provider, index) => index === indexes[0] ? intended : provider);
+            }
+            else {
+                const existing = namedIndexes(current).map(index => current[index]);
+                if (existing.some(containsOldExtensionSecret)) {
+                    throw new Error("偵測到舊擴充的 VCRouter provider。請先在舊擴充清除舊擴充的 Classroom Connection，再回到 VansPod 重新載入。");
+                }
+                if (existing.length > 0) {
+                    throw new Error("既有 VCRouter provider 的 ownership 無法確認，VansPod 不會覆寫。");
+                }
+                next = [...current, intended];
+            }
+            if ((0, node_util_1.isDeepStrictEqual)(next, current))
+                return { changed: false };
+            const nextJournal = {
+                version: 1,
+                route: "vsCodeChat",
+                original,
+                intended,
+                owned: { name: "VCRouter", vendor: "customendpoint" },
+            };
+            await atomicJson(options.journalFile, nextJournal);
+            await atomicJson(options.settingsFile, next);
+            return { changed: true };
+        },
+        restore,
+        async initializeNative() {
+            if (await readJournal(options.journalFile))
+                return restore();
+            const current = await readProviders(options.settingsFile);
+            const origins = new Set((options.legacyOrigins ?? ["http://127.0.0.1:47821"]).map(origin => origin.replace(/\/$/, "")));
+            const next = current.filter(provider => {
+                const keys = Object.keys(provider).sort();
+                return !(keys.length === 2 && keys[0] === "name" && keys[1] === "url" && provider.name === "VCRouter" &&
+                    typeof provider.url === "string" && origins.has(provider.url.replace(/\/$/, "")));
+            });
+            if ((0, node_util_1.isDeepStrictEqual)(next, current))
+                return { changed: false };
+            await atomicJson(options.settingsFile, next);
+            return { changed: true };
+        },
+    };
+}

package/dist/webSearch.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NO_SHELL = exports.MAX_QUERY_LENGTH = void 0;
+exports.explainSearchFailure = explainSearchFailure;
+exports.webSearch = webSearch;
+const types_1 = require("./adapters/types");
+exports.MAX_QUERY_LENGTH = 1000;
+// Every explanation below is read verbatim by the model, hence the English half. None
+// of them may hint at another route to the information: an earlier refusal did, and the
+// model crawled sites from the shell for minutes (ADR-0007). What is ruled out is
+// searching by other means; reading one known URL is not Web Search, and only the reply
+// to Codex's own open, click or find says so (codexWebSearch.ts).
+exports.NO_SHELL = "Do not use shell commands (curl, wget, scripts) to search the web or crawl sites for this information.";
+const ROUTER_REFUSALS = {
+    web_search_disabled: `這堂課沒有開放網路搜尋。Web search is not enabled for this class session. This is a class setting, not a malfunction, and no search was performed. Do not retry this tool. ${exports.NO_SHELL} Tell the user directly that web search is not enabled for this class session.`,
+    web_search_rate_limited: `搜尋太頻繁，請稍後再試。Web search is temporarily rate limited: there were too many searches in the last minute, so no search was performed. Do not retry this tool now. ${exports.NO_SHELL} Tell the user to wait about a minute and then ask again.`,
+    web_search_unavailable: `網路搜尋服務目前無法使用。The classroom web search service is not available right now. This is a service problem, not a class setting, and no search was performed. Do not retry this tool. ${exports.NO_SHELL} Tell the user that web search is currently out of service and that they can report it to their teacher.`,
+};
+const SEARCH_FAILED = `搜尋失敗，沒有取得結果。The web search failed: the search service returned an error, so there are no results. This is not a class setting. You may retry this tool once; if it fails again, tell the user that the search failed and that they can try again later. ${exports.NO_SHELL}`;
+/** What the model is told when a search failed with this Router error code. */
+function explainSearchFailure(errorCode) {
+    return ROUTER_REFUSALS[errorCode] ?? SEARCH_FAILED;
+}
+function textOf(value) { return typeof value === "string" ? value : ""; }
+// Router relays its search provider's HTTP status (a provider 429 arrives as 429 with
+// code null), so the error code alone tells a refusal from an upstream failure.
+async function routerErrorCode(response) {
+    try {
+        return textOf((0, types_1.object)(await response.json(), "search error").error?.code);
+    }
+    catch {
+        return "";
+    }
+}
+// Only the query strings and the Classroom API Key leave. An unreachable Router or a
+// reply that is not a result list is a failure like any other; an abort is the caller's.
+async function webSearch(queries, routerBaseUrl, classroomApiKey, signal) {
+    try {
+        const response = await fetch(`${routerBaseUrl.replace(/\/+$/, "")}/v1/search`, {
+            method: "POST", signal,
+            headers: { "Content-Type": "application/json", Authorization: `Bearer ${classroomApiKey}` },
+            body: JSON.stringify({ queries }),
+        });
+        if (!response.ok)
+            return { errorCode: await routerErrorCode(response) };
+        return { results: (0, types_1.list)((0, types_1.object)(await response.json(), "search response").results, "results").map(item => {
+                const result = (0, types_1.object)(item, "search result");
+                return { query: textOf(result.query), title: textOf(result.title), url: textOf(result.url), text: textOf(result.text) };
+            }) };
+    }
+    catch (error) {
+        if (signal?.aborted)
+            throw error;
+        return { errorCode: "" };
+    }
+}

package/dist/windowsSecureStorage.js

@@ -0,0 +1,163 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.protectedFiles = exports.StorageError = void 0;
+exports.createWindowsDataProtector = createWindowsDataProtector;
+exports.createWindowsSecureStorage = createWindowsSecureStorage;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_path_1 = __importDefault(require("node:path"));
+const storageErrors_1 = require("./storageErrors");
+var storageErrors_2 = require("./storageErrors");
+Object.defineProperty(exports, "StorageError", { enumerable: true, get: function () { return storageErrors_2.StorageError; } });
+function createWindowsDataProtector(options = {}) {
+    const launch = options.launch ?? node_child_process_1.spawn;
+    const maxBytes = options.maxBytes ?? 2_097_152;
+    const timeoutMs = options.timeoutMs ?? 15_000;
+    const executable = node_path_1.default.win32.join(process.env.SystemRoot || "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+    function run(operation, input) {
+        if (Buffer.byteLength(input, "utf8") > maxBytes)
+            return Promise.reject(new storageErrors_1.StorageError("unavailable"));
+        const transform = operation === "Protect"
+            ? "$bytes = [Text.Encoding]::UTF8.GetBytes($payload); $out = [Security.Cryptography.ProtectedData]::Protect($bytes, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser); [Console]::Out.Write([Convert]::ToBase64String($out))"
+            : "$bytes = [Convert]::FromBase64String($payload); $out = [Security.Cryptography.ProtectedData]::Unprotect($bytes, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser); [Console]::Out.Write([Text.Encoding]::UTF8.GetString($out))";
+        const command = "$ErrorActionPreference = 'Stop'; [Console]::InputEncoding = New-Object Text.UTF8Encoding($false); [Console]::OutputEncoding = New-Object Text.UTF8Encoding($false); try { Add-Type -AssemblyName System.Security; $payload = [Console]::In.ReadToEnd(); " + transform + " } catch { exit 1 }";
+        return new Promise((resolve, reject) => {
+            let child;
+            try {
+                child = launch(executable, ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", command], { windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
+            }
+            catch {
+                reject(new storageErrors_1.StorageError("unavailable"));
+                return;
+            }
+            let finished = false;
+            let bytes = 0;
+            const output = [];
+            const finish = (failed) => {
+                if (finished)
+                    return;
+                finished = true;
+                clearTimeout(timer);
+                if (failed) {
+                    child.kill();
+                    reject(new storageErrors_1.StorageError("unavailable"));
+                }
+                else
+                    resolve(Buffer.concat(output).toString("utf8"));
+            };
+            const timer = setTimeout(() => finish(true), timeoutMs);
+            child.on("error", () => finish(true));
+            child.stdin?.on("error", () => finish(true));
+            child.stdout?.on("data", (chunk) => {
+                bytes += chunk.length;
+                if (bytes > maxBytes) {
+                    finish(true);
+                    return;
+                }
+                output.push(chunk);
+            });
+            child.stderr?.on("data", (chunk) => {
+                // Never forward raw PowerShell diagnostics; they may contain sensitive input.
+                bytes += chunk.length;
+                if (bytes > maxBytes)
+                    finish(true);
+            });
+            child.on("close", code => finish(code !== 0));
+            child.stdin?.end(input, "utf8");
+        });
+    }
+    return { protect: value => run("Protect", value), unprotect: value => run("Unprotect", value) };
+}
+exports.protectedFiles = {
+    read: file => promises_1.default.readFile(file, "utf8"),
+    async write(file, contents) {
+        const handle = await promises_1.default.open(file, "wx", 0o600);
+        try {
+            await handle.writeFile(contents, "utf8");
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+    },
+    replace: (source, target) => promises_1.default.rename(source, target),
+    remove: file => promises_1.default.unlink(file),
+    async mkdir(directory) { await promises_1.default.mkdir(directory, { recursive: true }); },
+};
+function absent(error) { return error?.code === "ENOENT"; }
+function createWindowsSecureStorage(filePath, options = {}) {
+    const protector = options.protector ?? createWindowsDataProtector();
+    const files = options.files ?? exports.protectedFiles;
+    const fileFor = (key) => key === "classroom-connection" ? filePath :
+        node_path_1.default.join(node_path_1.default.dirname(filePath), `secure-${(0, node_crypto_1.createHash)("sha256").update(key).digest("hex")}.json`);
+    return {
+        async get(key) {
+            let raw;
+            try {
+                raw = await files.read(fileFor(key));
+            }
+            catch (error) {
+                if (absent(error))
+                    return undefined;
+                throw new storageErrors_1.StorageError("unavailable");
+            }
+            let value;
+            try {
+                value = JSON.parse(raw);
+            }
+            catch {
+                throw new storageErrors_1.StorageError("unreadable");
+            }
+            if (!value || typeof value !== "object")
+                throw new storageErrors_1.StorageError("unreadable");
+            const envelope = value;
+            if (typeof envelope.apiKey === "string" && envelope.apiKey && envelope.secureStorage === undefined)
+                throw new storageErrors_1.StorageError("legacy");
+            if (envelope.secureStorage !== 1 || envelope.scheme !== "dpapi-current-user" ||
+                typeof envelope.ciphertext !== "string" || !/^[A-Za-z0-9+/]+={0,2}$/.test(envelope.ciphertext))
+                throw new storageErrors_1.StorageError("unreadable");
+            try {
+                return await protector.unprotect(envelope.ciphertext);
+            }
+            catch {
+                throw new storageErrors_1.StorageError("unreadable");
+            }
+        },
+        async set(key, value) {
+            const target = fileFor(key);
+            const temporary = `${target}.${(0, node_crypto_1.randomUUID)()}.tmp`;
+            try {
+                const ciphertext = await protector.protect(value);
+                if (!/^[A-Za-z0-9+/]+={0,2}$/.test(ciphertext) || await protector.unprotect(ciphertext) !== value)
+                    throw new storageErrors_1.StorageError("unavailable");
+                const envelope = JSON.stringify({ secureStorage: 1, scheme: "dpapi-current-user", ciphertext });
+                await files.mkdir(node_path_1.default.dirname(target));
+                await files.write(temporary, envelope);
+                await files.replace(temporary, target);
+                return { persistence: "persistent" };
+            }
+            catch {
+                throw new storageErrors_1.StorageError("unavailable");
+            }
+            finally {
+                try {
+                    await files.remove(temporary);
+                }
+                catch { /* Only encrypted abandoned data is possible. */ }
+            }
+        },
+        async delete(key) {
+            try {
+                await files.remove(fileFor(key));
+            }
+            catch (error) {
+                if (!absent(error))
+                    throw new storageErrors_1.StorageError("clear-failed");
+            }
+        },
+    };
+}

package/package.json

@@ -1,6 +1,29 @@
 {
   "name": "vanspod",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.2",
+  "bin": { "vanspod": "bin/vanspod.cjs" },
+  "engines": { "node": ">=24" },
+  "os": ["win32"],
+  "files": ["bin/", "dist/**/*.js", "!dist/test/**", "!dist/sea-*.js", "media/brand-logo.png", "media/brand-icon.ico", "media/fadou-superhero.png", "media/fadou-superhero-blink.png", "scripts/tray.ps1", "scripts/uninstall.ps1", "README.md"],
+  "publishConfig": { "access": "public" },
+  "description": "本機 VansPod。學生用系統瀏覽器兌換課堂連線。",
+  "scripts": {
+    "test": "tsc -p . && node --test dist/test/*.test.js",
+    "typecheck": "tsc -p . --noEmit",
+    "build": "tsc -p .",
+    "start": "tsc -p . && node dist/entry.js",
+    "prepack": "npm run build",
+    "postinstall": "node bin/register.cjs",
+    "dist": "node scripts/dist.mjs",
+    "test:windows-exe": "npm run dist && node scripts/test-windows-exe.mjs",
+    "test:lifecycle": "tsc -p . && node --test dist/test/launcher.test.js",
+    "test:distribution": "npm run dist && node scripts/test-distribution.mjs"
+  },
+  "devDependencies": {
+    "@types/node": "^24.5.2",
+    "typescript": "^5.9.2"
+  },
+  "dependencies": {
+    "yaml": "^2.9.1"
+  }
+}

package/scripts/tray.ps1

@@ -0,0 +1,40 @@
+param(
+  [Parameter(Mandatory = $true)]
+  [string]$Url,
+  [Parameter(Mandatory = $true)][string]$IconPath,
+  [Parameter(Mandatory = $true)][string]$StateFile
+)
+
+Add-Type -AssemblyName System.Windows.Forms
+Add-Type -AssemblyName System.Drawing
+
+$script:OpenUrl = $Url
+$openPage = { Start-Process $script:OpenUrl }.GetNewClosure()
+
+$notify = New-Object System.Windows.Forms.NotifyIcon
+$notify.Icon = New-Object System.Drawing.Icon($IconPath)
+$notify.Text = "VansPod"
+$notify.Visible = $true
+$notify.add_Click($openPage)
+
+$menu = New-Object System.Windows.Forms.ContextMenuStrip
+$open = $menu.Items.Add("開啟 VansPod")
+$open.add_Click($openPage)
+$stop = $menu.Items.Add("結束 VansPod")
+$stop.add_Click({
+  try {
+    $state = Get-Content -LiteralPath $StateFile -Raw -Encoding UTF8 | ConvertFrom-Json
+    $headers = @{Authorization = 'Bearer ' + $state.token}
+    $result = Invoke-RestMethod -Uri ($state.origin + '/_vanspod/stop') -Method Post -Headers $headers -ContentType 'application/json' -Body '{}' -TimeoutSec 20
+    if ($result.confirmation) {
+      $answer = [System.Windows.Forms.MessageBox]::Show($result.message, 'VansPod', [System.Windows.Forms.MessageBoxButtons]::YesNo)
+      if ($answer -eq [System.Windows.Forms.DialogResult]::Yes) { $result = Invoke-RestMethod -Uri ($state.origin + '/_vanspod/stop') -Method Post -Headers $headers -ContentType 'application/json' -Body '{"confirmed":true}' -TimeoutSec 20 }
+    }
+    if (-not $result.ok -and -not $result.confirmation) { [System.Windows.Forms.MessageBox]::Show($result.message, 'VansPod') | Out-Null }
+  } catch { [System.Windows.Forms.MessageBox]::Show('無法結束 VansPod，請開啟畫面後重試。', 'VansPod') | Out-Null }
+})
+$notify.ContextMenuStrip = $menu
+
+try { [System.Windows.Forms.Application]::Run() }
+finally { $notify.Visible = $false; $notify.Icon.Dispose(); $notify.Dispose(); $menu.Dispose() }
+