feat: add windows client installer

.codex/skills/design-harbor-device-ecosystem/SKILL.md

@@ -1,70 +0,0 @@
----
-name: design-harbor-device-ecosystem
-description: "Use when changing or reviewing Harbor companion-device discovery, pairing, trust, presence, routing handoff, or their API and persistence contracts. Not for traffic-only inventory or visual polish."
----
-
-# Design Harbor Device Ecosystem
-
-Keep discovery, trust, application presence, routing, and LAN observation separate. A device is not trusted because mDNS or the neighbor table reports it, and a paired device is not necessarily connected or routed through this Gateway.
-
-## Scope and non-goals
-
-- Apply this skill to Gateway integration with Harbor Connect on macOS and future clients, extensions, appliances, or companion services.
-- Keep one platform-neutral protocol core. Isolate native DNS-SD and private-key storage behind thin platform adapters, and state whether a new target is desktop, headless, mobile, or browser-bound before choosing an adapter.
-- Preserve the existing MAC-based inventory as an observational traffic and policy surface; do not turn it into ecosystem identity.
-- Do not introduce a generic event bus, mesh, cloud account, fleet controller, or WAN discovery without a concrete requirement.
-- Do not define a new visible pairing flow, badge, layout, wording, or management surface without the exact owner decision required by `workpack/DESIGN_OWNER_POLICY.md`.
-- Do not deploy, SSH, pair live devices, or operate a live Gateway unless the current user request explicitly authorizes that exact operation.
-
-## Workflow
-
-1. Start with the selected workpack task when one exists. Read `PRODUCT.md` and `workpack/PRODUCT_PRIORITIES.md` for product scope, `workpack/DATA_CONSISTENCY_MODEL.md` for persistence or projection changes, and `workpack/STATUS.md` for active roadmap/cutover work. Any visible UI decision requires `workpack/DESIGN_OWNER_POLICY.md`; reuse an exact owner decision already recorded for this scope.
-2. Read [device-ecosystem-contract.md](references/device-ecosystem-contract.md) before changing discovery, pairing, identity, presence, routing handoff, or the Gateway device projection.
-3. Trace the current producer -> transport -> persistence -> canonical snapshot -> UI path. Confirm the owning service and every caller before editing.
-4. Classify each proposed field and state as one of: discovery candidate, persisted trust relationship, authenticated presence lease, route state, network observation, or derived binding. Reject fields that mix categories.
-5. Reuse standard DNS-SD/mDNS for local discovery and the existing request/response control-plane shape for the first protocol slice. Do not treat the current plaintext HTTP transport as sufficient protection for invitations or credentials; require pinned end-to-end identity and confidentiality. Add push transport only when a concrete feature cannot work with bounded polling or heartbeats.
-6. Keep persisted relationship mutations schema-versioned, atomic, revision-safe, and reversible. Keep transient session loss from deleting paired identity.
-7. Join ecosystem membership to network inventory in the backend and expose one revisioned projection. Never join independent authoritative lists in React. Also use `design-vpn-client-ui` for any visible Connect UI work.
-8. For runtime, API, dependency, UI, or deployment changes, also use `manage-harbor-versions` and run its affected-component gate. Skill-only and documentation-only changes need no Harbor version bump.
-
-## Non-negotiable decisions
-
-- Advertise Gateway availability through a versioned DNS-SD service on the local link. Treat every advertisement and resolved address as an untrusted candidate until paired identity is cryptographically verified.
-- Put no subscription URL, pairing secret, device list, credential, or private identity material in mDNS/DNS-SD records, logs, fixtures, screenshots, or user-visible diagnostics.
-- Pair explicitly. Use a short-lived, single-use invitation; bind the stable Gateway identity and client installation identity; persist each side atomically only after confirmation; make cross-device finalization idempotent and recoverable; support revoke and credential rotation.
-- Use a high-entropy QR/manual invitation, or a vetted PAKE plus mutual confirmation for a short human code. Never send a low-entropy code as a bearer secret over unauthenticated HTTP.
-- Give every Harbor installation a stable cryptographic device identity. Keep it independent of IP, hostname, interface, and randomized MAC.
-- Define states precisely: `discovered` means advertised; `paired` means a persisted trust relationship; `connected` means a current authenticated lease; `routed` means this Gateway is the active route. Never collapse them into one `online` boolean.
-- Derive lease freshness from Gateway receipt time. Do not trust a client-supplied clock, IP address, or MAC address as authoritative.
-- Correlate a paired client with the existing neighbor inventory only as a derived, confidence-bearing binding. A missing or ambiguous binding must not erase membership or fabricate traffic attribution.
-- Allow a client to pair with multiple Gateways, but keep one explicit active routing target. A discovered or unpaired Gateway must never hijack route selection.
-- Preserve legacy subscription-based presence only as a bounded transition path. Never silently convert matching subscription URLs into permanent pairing records.
-- Keep capability advertisement versioned and additive. Ignore unknown capabilities; block incompatible protocol versions explicitly. Never authorize a mutation from self-declared capabilities alone.
-- Keep the Gateway backend as the source of truth for its paired-device registry and active leases. Preserve revision-safe frontend application and transport freshness separation.
-
-## Acceptance pass
-
-Verify the affected contracts below. Protocol, authentication, shared projection, or migration changes require coverage across the impacted lifecycle; a documentation-only correction uses consistency/link checks. Do not operate live devices without the exact authorization described above:
-
-- A supported client can discover more than one Gateway and survives address changes without changing Gateway identity.
-- Spoofed discovery cannot create trust, change the active route, or appear as a paired ecosystem member.
-- Pairing works without a subscription URL; invitations expire, are single-use, and reject replay.
-- The Gateway can distinguish an ordinary LAN neighbor, a paired but disconnected device, a connected Harbor client, and a client currently routed through it.
-- A paired Mac remains the same ecosystem device across DHCP, interface, or randomized-MAC changes; only its derived inventory binding changes.
-- Discovery loss does not unpair a device; heartbeat loss expires the lease; revocation rejects the next authenticated request immediately.
-- Multiple Gateways and multiple clients do not collide. Any aggregate network identity includes Gateway scope.
-- Persisted writes are atomic and migrated with rollback; delayed snapshots cannot overwrite newer state.
-- Legacy installs retain the documented transition behavior without exposing or copying subscription secrets.
-- Automated tests cover discovery deduplication, pairing expiry/replay, authentication, lease expiry, revocation, binding ambiguity, revision ordering, and migration.
-- Any visible UI outcome has a separately recorded owner decision and preserves loading, empty, stale, error, keyboard, reduced-motion, and responsive behavior.
-
-## Output contract
-
-Report:
-
-- current owner and traced data flow;
-- chosen source of truth for identity, trust, presence, route, and inventory binding;
-- protocol and persistence changes, including version negotiation;
-- migration, compatibility, rollback, and security boundaries;
-- exact automated checks and what remains unverified;
-- unresolved owner decisions, especially visible UI and short-code pairing treatment.

.codex/skills/design-harbor-device-ecosystem/agents/openai.yaml

@@ -1,4 +0,0 @@
-interface:
-  display_name: "Design Harbor Device Ecosystem"
-  short_description: "Design trusted Harbor device integration."
-  default_prompt: "Use $design-harbor-device-ecosystem to design Harbor Gateway discovery, pairing, and connected-device contracts."

.codex/skills/design-harbor-device-ecosystem/references/device-ecosystem-contract.md

@@ -1,159 +0,0 @@
-# Harbor device ecosystem contract
-
-Use this reference for Gateway advertisement, discovery, pairing, connected-device lists, or integration with future Harbor-capable subsystems.
-
-## Layer ownership
-
-| Layer | Source of truth | Identity | Lifetime | Meaning |
-|---|---|---|---|---|
-| Discovery | DNS-SD browser cache | advertised Gateway instance | ephemeral | a compatible service may be reachable |
-| Gateway trust | client pairing store | `gatewayId` plus pinned public identity | persisted | this is a Gateway the owner paired |
-| Peer registry | Gateway pairing store | stable client installation ID plus public identity | persisted | this client belongs to the Harbor ecosystem |
-| Presence | Gateway session owner | authenticated client ID plus lease | ephemeral | this paired client is currently connected to the control plane |
-| Route | Connect route owner | selected `gatewayId` plus applied route state | runtime/canonical | this client currently intends to use this Gateway |
-| Network inventory | existing device inventory | Gateway-scoped MAC-derived `dev_*` ID | observed/persisted | this network endpoint was seen and may own traffic or policy |
-| Binding | Gateway backend projection | ecosystem client ID -> network inventory ID | derived | current correlation, never trust identity |
-
-Do not reuse the current MAC-derived `dev_*` ID as an ecosystem ID. For a future fleet view, scope network inventory IDs by `gatewayId`.
-
-## Minimal discovery profile
-
-Advertise one TCP DNS-SD service such as `_harbor-gw._tcp.local.`. Use the service instance name as a short, user-friendly Gateway name; do not encode a MAC address or serial number in it.
-
-Use SRV/A/AAAA for endpoint resolution. Keep TXT metadata small and additive:
-
-- `txtvers=1` for the TXT schema;
-- `protovers=1` for the application protocol;
-- public `id=<gatewayId>` for candidate deduplication;
-- compact capability flags and whether a pairing window is open.
-
-Never advertise credentials, pairing invitations, subscription data, client names, client counts, or private network policy. Unknown TXT keys must be ignored. Resolve addresses immediately before connection and verify the paired identity after connecting.
-
-mDNS is link-local. For another VLAN or routed segment, use an explicitly configured address, QR/manual endpoint, or unicast DNS-SD. Do not invent a custom UDP broadcast or assume multicast crosses routers.
-
-In the current Gateway deployment, first inspect the Compose network boundary: the control service is bridge-networked while the dataplane owns host networking. Keep identity and trust in control, but publish the public DNS-SD descriptor through host Avahi or a narrow host-network publisher. Do not move the whole control plane to host networking merely to gain multicast. On macOS, prefer the native Bonjour/`dns-sd` surface through the existing host-side network monitor over a second custom discovery stack.
-
-Discovery answers only “where might a Gateway be?” It does not answer “do I trust it?”, “am I connected?”, or “is my traffic routed through it?”.
-
-## Identity and pairing
-
-Maintain a stable Gateway identity and a stable key pair in persisted, backup-aware storage. Maintain a stable installation identity and key pair per client; store the client private key in the platform credential store, including macOS Keychain.
-
-Do not reuse the current subscription `hwid` as public ecosystem identity: it is also sent to the subscription provider as `x-hwid`. Create a separate local identity so LAN and provider correlation remain independent.
-
-Model the minimum persisted relationship records:
-
-```text
-PairedGateway = gatewayId, displayName, pinnedPublicIdentity,
-                capabilities, pairedAt
-
-PairedDevice  = deviceId, displayName, deviceType, publicIdentity,
-                capabilities, pairedAt, revokedAt?
-```
-
-Treat display names, platform, version, and capabilities as metadata, not authentication or authorization.
-
-Use this pairing sequence:
-
-1. Let the Gateway open a bounded pairing window and create a short-lived, single-use invitation.
-2. Bind the invitation to the Gateway ID and public-identity fingerprint.
-3. Let the client create or load its installation key and submit its public identity and minimal metadata.
-4. Confirm the peer on a trusted surface before committing both records.
-5. Issue a per-device credential or register proof-of-possession for later authenticated requests.
-6. Consume the invitation atomically; reject expiry, replay, mismatch, or reuse.
-7. Support revoke and credential rotation without changing unrelated LAN inventory.
-
-Persist each local trust record atomically and make finalization idempotent so an interrupted client can resume or safely retry. Pairing spans two devices and is not a distributed transaction; never report it as cross-device atomicity.
-
-For the smallest safe first slice, encode the same grouped high-entropy invitation in QR and manual copy/paste form. If the owner requires a short numeric code, use a vetted password-authenticated key exchange such as SPAKE2 and mutual key confirmation, or require an independent confirmation that provides equivalent protection. Use platform or Node standard cryptography for identity and signatures; do not design custom cryptography or add a crypto dependency without need.
-
-Do not use the subscription URL as a pairing credential. Keep the existing subscription-HMAC presence only as an explicitly labelled legacy trust source during the transition window.
-
-## Authenticated presence and route state
-
-After pairing, let the client renew a bounded authenticated lease. Start with periodic requests using the existing control-plane API shape, but protect invitations and credentials with pinned end-to-end identity and confidentiality; the current plaintext HTTP transport alone is not sufficient. Do not add WebSocket, broker, or event-stream infrastructure until a concrete server-push feature requires it.
-
-The Gateway derives:
-
-```text
-paired      = persisted relationship exists and is not revoked
-connected   = paired and authenticated lease has not expired
-routed      = connected and current Connect route state selects this gatewayId
-inventory   = optional current network binding exists
-```
-
-Store or project `lastAuthenticatedAt` and `leaseExpiresAt`; derive status rather than persisting a mutable `online` boolean. Use Gateway receipt time for freshness. Let the client report `deviceType`, app/protocol version, capabilities, and selected route as authenticated metadata, but distinguish a reported route from dataplane-confirmed traffic.
-
-Discovery failure marks the candidate stale. It does not revoke pairing or immediately terminate a still-valid lease. Lease expiry marks the client disconnected without deleting its relationship. Revocation invalidates the credential immediately.
-
-## Joining a Mac to the Gateway device view
-
-When a paired Mac renews its lease:
-
-1. Authenticate its stable ecosystem identity.
-2. Derive the remote source address from the accepted connection; do not trust a claimed IP.
-3. Correlate that address with the current neighbor snapshot to obtain an optional MAC-derived inventory ID.
-4. Publish the relationship, presence, route, and binding together from the Gateway backend.
-
-Represent the binding with `networkDeviceId`, `confidence`, and `observedAt`. A randomized MAC, DHCP change, or interface switch updates or removes only this binding. The stable Mac relationship remains.
-
-If the source address is NATed, missing, duplicated, or maps to an ambiguous neighbor, keep the Mac paired/connected but leave traffic and policy attribution unavailable. Never attach another device's counters by hostname or client-provided MAC.
-
-Expose one revisioned Gateway projection to the UI. It may extend the current device snapshot or use a dedicated ecosystem snapshot, but the backend must perform the join. React must not fetch authoritative pairing, presence, and inventory lists independently and guess the relationship.
-
-## Multi-Gateway behavior
-
-- Let Connect persist several `PairedGateway` records keyed by stable Gateway ID.
-- Let discovery resolve zero or more current endpoints for each identity.
-- Keep one active route target and make selection or automatic policy explicit.
-- Require a paired identity match before automatic handoff. A new advertisement is never enough.
-- Preserve a verified active Gateway through transient discovery failure, but surface stale freshness.
-- Let one Gateway register many clients without assuming macOS; branch on negotiated capabilities, not hard-coded platform paths.
-- Do not add fleet federation. If it becomes real, aggregate with compound `{gatewayId, deviceId}` identities.
-
-## Canonical data and failure rules
-
-- Give the pairing registry its own `schemaVersion` and monotonic `revision`, or include it in an existing canonical aggregate with equivalent guarantees.
-- Reuse the existing atomic JSON-store pattern before considering a database or another persistence dependency.
-- Make pair, rename, revoke, and credential rotation atomic. Return the complete new snapshot after a mutation.
-- Keep active leases process-local unless restart continuity has a demonstrated need. Persist last-seen metadata at a bounded cadence if required; never write every heartbeat by default.
-- Apply incoming frontend snapshots only when their revision is not older than the current one. Keep transport stale/error state outside the domain snapshot.
-- Preserve last-good discovery and registry data on source errors; expose freshness and the error separately.
-- Treat public-key mismatch as an identity error requiring explicit repair or re-pairing, not an address update.
-- Treat an unsupported protocol version as an incompatible state, not a generic offline state.
-
-## Compatibility sequence
-
-1. Add the new identity, discovery, pairing, and presence contract without changing current route behavior.
-2. Prefer evolving the existing Gateway presence protocol to a version that signs challenges with ecosystem identity instead of creating a second overlapping presence subsystem.
-3. Keep the subscription-HMAC default-gateway proof as a labelled `legacy-default-route` source for one documented transition release.
-4. Publish the stable `gatewayId` in canonical route state; keep address, UI origin, and freshness as changeable observations.
-5. Prefer a paired Gateway when its verified identity matches the current route candidate. Preserve the approved sticky verified-Gateway behavior through transient discovery failure.
-6. Never auto-mint a pairing record from a matching subscription URL.
-7. When forgetting the active Gateway, demote route state atomically before deleting trust.
-8. Preserve existing `dev_*` inventory IDs, aliases, traffic totals, and policies; add only a derived ecosystem binding.
-9. Remove the legacy proof only after migration evidence and an explicit cutover task.
-
-## Automated evidence
-
-Cover at least:
-
-- zero, one, and multiple advertisements; deduplication and endpoint changes;
-- mDNS loss and recovery without unpairing;
-- no secrets in TXT metadata or logs;
-- invitation expiry, replay, mismatch, and atomic single-use consumption;
-- valid/invalid proof-of-possession, credential rotation, and revocation;
-- lease renewal and expiry using Gateway receipt time;
-- paired/connected/routed state separation;
-- DHCP, interface, and randomized-MAC changes;
-- missing and ambiguous inventory binding without false traffic attribution;
-- multiple Gateways with one active route;
-- revision ordering, migration, rollback, and legacy transition.
-
-## Standards basis
-
-- [RFC 6762: Multicast DNS](https://www.rfc-editor.org/rfc/rfc6762)
-- [RFC 6763: DNS-Based Service Discovery](https://www.rfc-editor.org/rfc/rfc6763)
-- [RFC 9382: SPAKE2](https://www.rfc-editor.org/rfc/rfc9382)
-
-These standards define discovery and an available PAKE building block. They do not make an mDNS advertisement trustworthy; preserve end-to-end identity verification.

.codex/skills/design-vpn-client-ui/SKILL.md

@@ -1,63 +0,0 @@
----
-name: design-vpn-client-ui
-description: "Use when changing or reviewing Harbor Connect and Gateway client UI. Apply the established visual and motion language; not for administrative Gateway UI unless explicitly requested."
----
-
-# Design VPN Client UI
-
-Preserve the repo's focused one-screen VPN client language: a centered primary action, quiet technical typography, mode-specific accents, and motion that makes live state and interaction legible without moving layout.
-
-## Workflow
-
-1. Inspect the affected client component, state owner, relevant styles, and nearest analogue. Read `PRODUCT.md` when product behavior or mode semantics change; expand context when shared invariants require it.
-2. Inspect supplied evidence and trace the real DOM and state change that causes the visual issue. Follow repository testing policy; do not launch manual or interactive visual testing unless the user explicitly requests it in the current prompt.
-3. Read [visual-language.md](references/visual-language.md) for layout, hierarchy, color, and typography work.
-4. Read [motion-and-interaction.md](references/motion-and-interaction.md) for animation, hover, refresh, input, copy, or state-transition work.
-5. Reuse existing React state, CSS variables, formatters, and API paths. Prefer a narrow CSS/markup change over a new abstraction or dependency.
-6. Keep geometry stable across every state. Reserve space before animating content.
-7. Implement `prefers-reduced-motion` alongside every new animation.
-8. Run focused automated checks for affected behavior and `npm run build` for client code changes; use the full `npm test` suite when shared behavior changes or narrower evidence is insufficient. Documentation-only work uses structural/link checks and `git diff --check`. Manual visual inspection requires an explicit request in the current prompt.
-
-## Communicating a proposed change
-
-For a local correction, report the result and focused evidence briefly. For a change spanning
-several owners or state lifecycles, use one compact table of affected modules plus the
-relevant states, accessibility, and motion decisions. Omit empty sections and unrelated modules.
-
-## Non-negotiable decisions
-
-- Keep the power action on the screen's central vertical axis. Place subscription content to its right without shifting that axis.
-- Keep the power hit target generous while rendering only the icon, never a large enclosing accent circle.
-- Drive every active accent from the current mode token: Connect is blue-green; Gateway is orange. Keep inactive power gray, including hover, and preserve semantic warning/error colors.
-- Never let labels, timers, feedback, icons, progress, or server rows shift neighboring content.
-- Animate state, opacity, blur, glow, color, filter, and transform. Do not animate layout properties.
-- Make live behavior visibly alive: running processes, changing values, mode changes, and interactive affordances should communicate through restrained motion instead of abrupt static replacement.
-- Give every actionable icon a semantic hover/focus response; rotate cyclic actions, move the physical part of object-like controls, and keep their hit targets fixed.
-- Let every visible cycle finish and return to its resting coordinates before stopping. Never cancel a hover animation, spinner, or list exit at an arbitrary frame.
-- Animate dynamic rows through complete enter and exit phases; keep a departing row mounted until its exit finishes, with immediate removal under reduced motion.
-- Animate only what changed. Keep unchanged digits, labels, icons, and surrounding geometry stable.
-- Keep tooltips outside transformed, rotating, glowing, or filtered controls. Show them quickly above the control as independent translucent cloud surfaces.
-- Prefer one clear value over unsupported detail. Hide subscription fields the provider does not supply.
-- Keep client UI compact and calm. Do not introduce dashboard cards, decorative chrome, or admin-console density.
-- Do not use a modal, popup, or blocking backdrop unless the user explicitly asks for one. Prefer inline disclosure or a non-modal layer that preserves the main screen.
-- When the owner explicitly chooses modal treatment for critical confirmations, reuse one accessible full-screen confirmation popup: blur and block the background, reveal from center, then stage text and actions.
-- Avoid borders, divider lines, and framed regions by default. Build hierarchy with spacing, typography, subtle surface changes, light, and depth; use a line only when it communicates an essential state.
-- In client-side editors, prefer flat text controls and accessible custom pickers over browser-native menus when the native surface breaks the visual language. Do not append another blank row until the current row is complete.
-
-## Acceptance pass
-
-Check the affected behaviors below using automated evidence where possible. Shared layout or motion changes require broader coverage; a local correction does not require exercising unrelated controls. Manual inspection remains limited to an explicit request in the current prompt:
-
-- Power on/off is unmistakable without reading the label.
-- Switching on/off preserves the exact positions of title, timer, and hint.
-- Switching Connect/Gateway crossfades status in a fixed slot, changes the full accent palette, and clearly de-emphasizes data irrelevant to the active route.
-- A timer tick animates only changed digits and reads as a soft flow, never a blink.
-- Hover motion completes its current cycle and settles before stopping; ambient affordance motion remains subtle and infrequent.
-- Tooltips remain upright, unfiltered, above adjacent content, and visually consistent across controls.
-- Refresh and copy feedback cannot change element width or alignment.
-- Server separators are compact and only slightly wider than their content.
-- Repeated polling does not replay decorative list animations.
-- Manual refresh has an obvious but non-jarring response.
-- Icon-only controls respond on hover and focus, active cyclic work spins, and durable states such as pinned remain legible at rest.
-- Keyboard focus remains visible even when the text caret is intentionally hidden.
-- Narrow screens return to a simple single-column layout.

.codex/skills/design-vpn-client-ui/agents/openai.yaml

@@ -1,4 +0,0 @@
-interface:
-  display_name: "Design VPN Client UI"
-  short_description: "Design the repo's calm animated VPN client UI."
-  default_prompt: "Use $design-vpn-client-ui to design or refine the VPN client interface in this repository."

.codex/skills/design-vpn-client-ui/references/motion-and-interaction.md

@@ -1,125 +0,0 @@
-# Motion and interaction
-
-## Motion character
-
-Aim for fluid, slightly viscous motion: noticeable, calm, and complete. Avoid bounce, elastic easing, abrupt unmounts, decorative page choreography, or tiny effects too weak to communicate feedback.
-
-Motion is functional feedback. If the system is running, refreshing, counting, switching route, or inviting interaction, show that activity with restrained movement. Do not animate every static decoration; animate the part that proves work, state, or affordance.
-
-Use exponential ease-out curves such as `cubic-bezier(0.16, 1, 0.3, 1)` for arrivals. Typical timing:
-
-- hover and press: 180-300 ms;
-- state color and glow: 600-900 ms;
-- content reveal: 600-850 ms;
-- numeric tween and progress: about 900 ms;
-- copy feedback: about 800 ms;
-- server cascade: 620-760 ms per row with 90-110 ms stagger.
-- tooltip arrival: about 90-140 ms with almost no delay;
-- ambient affordance hint: one small cycle roughly every 10 seconds.
-
-## Cycle completion
-
-- On pointer leave, do not snap an infinite hover animation or reverse it from the middle. Mark it for stopping, let the current iteration reach its original coordinates, then remove the animation.
-- If the user re-enters before the iteration ends, clear the stop request and continue the same behavior.
-- Separate state transforms from repeating motion when both affect one control. Animate a child for the cycle and its wrapper for durable state, or wait for `animationiteration` before clearing the animated class.
-- Keep reduced-motion behavior immediate and static; never wait for an iteration event that will not fire.
-
-## Power state
-
-- Transition gray to the current mode accent slowly when connecting and back to gray when disconnecting.
-- Animate icon color, localized light, and SVG shadow together.
-- Let the light expand and brighten on enable, then contract and fade on disable.
-- Keep the hit target and all surrounding geometry fixed.
-- Use a short press compression, followed by a slower release.
-
-## Changing text and numbers
-
-- Put alternate labels in fixed-size slots.
-- Reveal connection title, timer, and hint with overlapping fixed layers, opacity, and light blur, never vertical layout movement.
-- Crossfade `VPN включён`, `Gateway подключён`, and disconnected copy in the same reserved slot when route state changes.
-- Split changing numeric values into stable digits. On a tick such as `33 → 34`, keep the first `3` mounted and animate only `3 → 4` with a soft color/glow/blur flow; avoid low-opacity blinking or scaling the whole seconds value.
-- Persist user-selected timer presentation locally and restore it on the next visit.
-- Tween numeric traffic values from old to new with `requestAnimationFrame` or an equivalent stable counter.
-- Animate progress width concurrently and add a brief glow that fully fades.
-- Never translate changing numbers if the user asked for a fluid morph; use numerical interpolation, opacity, color, blur, and light.
-
-## Mode switch affordance
-
-- Treat the Connect/Gateway brand as one state control with a foreground label, a background label, and two independently colored direction arrows.
-- On hover, move both labels continuously: let the foreground drift slightly down while the background rises toward it. Move the right arrow right and the left arrow left, then return; keep amplitudes small.
-- When mode changes, swap the arrows' positions smoothly and bring the new label to the foreground without changing the brand's centered geometry.
-- When hover ends, finish the current cycle at rest before stopping. Outside hover, replay one smaller cycle about every 10 seconds to hint that the control is clickable.
-- Keep explanatory tooltip geometry tied to the mode-label-to-arrows span, not to the entire Harbor wordmark.
-
-## Refresh
-
-- Use a clean, symmetric SVG refresh icon aligned in the same flex row as its label.
-- Spin for at least one full cycle. If the request finishes mid-cycle, continue to the next cycle boundary before stopping.
-- Update data immediately when it arrives; finishing the icon cycle must not delay the data.
-- Manual refresh may replay meaningful data and server transitions.
-- Background polling should update quietly and must not repeatedly replay the server cascade.
-- On updated traffic, tween the number, advance the bar, and emit a visible but brief mode-accent flare.
-- Keep refresh tooltip outside the rotating button so it remains upright and unfiltered.
-
-## Icon controls
-
-- Give every actionable icon a small semantic response on hover and keyboard focus; leave decorative icons still.
-- Rotate cyclic actions such as refresh, ping, and traffic sorting on hover, then use the shared continuous spin while work is running.
-- Move the physical part of object-like controls: lift and tilt a pin, pencil, or trash lid instead of moving its fixed hit target.
-- Keep durable state on the icon wrapper and transient motion on the SVG child. A pinned icon stays lifted and tilted while its row moves to the pinned group.
-- Keep the hit target, tooltip, and surrounding layout fixed. Tooltips remain outside the transformed SVG.
-- Under reduced motion, preserve color, focus, and final state without animated travel or rotation.
-
-## Server cascade
-
-- On initial display, reveal rows from top to bottom with a small negative Y offset, opacity, and blur.
-- On manual refresh, animate an explicit exit phase first. Fade rows top to bottom, then remount and enter top to bottom.
-- Wait for the last exit delay and duration before starting entry.
-- Disable pointer interaction during exit.
-- Do not replay on ping updates or unrelated renders.
-
-## Dynamic editors
-
-- Reveal added rows with opacity, blur, and a small transform while keeping surrounding geometry predictable.
-- Keep interactive add latency constant regardless of collection length. Never multiply an added row's delay by its index; use bounded staggering only for a one-time group reveal.
-- Give removal its own exit state and keep the row mounted until `animationend`; then animate surviving rows into their new positions instead of letting layout snap. Under reduced motion, remove it immediately.
-- Do not let repeated add actions accumulate unfinished rows. Disable add while any current row lacks its required value and explain the disabled state in a reserved hint slot.
-- Track the editor's dirty draft against its open/save baseline. Guard Escape, outside click, navigation controls, Cancel, and page unload; use an inline discard confirmation for in-app exits.
-- Replace browser-native dropdowns when their platform chrome conflicts with the client surface. Use an accessible custom listbox with trigger, selected state, outside-click and Escape closing, arrow-key navigation, and restored trigger focus.
-- Let picker options appear as a short staggered cloud using opacity, blur, and transform. Avoid borders, shadows, raised cards, and layout-property animation.
-
-## Subscription input
-
-- Show the public domain while retaining the full URL internally.
-- Disable browser autocomplete suggestions and neutralize autofill backgrounds.
-- Hide the blinking caret when the paste-first interaction does not need it, while preserving keyboard input and focus outline.
-- When an existing subscription is being edited and the field is idle, use the mode-accent underline as a five-second timeout indicator: start bright, fade to quiet, then restore display mode.
-- Pause the timeout once the user enters content.
-- Close and clear unfinished input on outside click or Escape.
-- Animate the trash lid independently on hover. Use the shared critical confirmation popup instead of a browser-native confirm dialog.
-
-## Critical confirmation popup
-
-- Reserve the blocking popup for explicit destructive or data-loss confirmation. It must cover the viewport, make the background inert, and use `alertdialog` with `aria-modal`.
-- Fade and blur the backdrop first, resolve the popup from the center, then reveal its title, description, and actions in a short sequence.
-- Put initial focus on the safe action, trap Tab within the popup, let Escape and backdrop click choose the safe action, and restore the invoking focus on close.
-- Reuse the same component and motion vocabulary for every critical confirmation. Reduced motion presents the final state immediately.
-
-## First-run initialization
-
-- With no subscription, show only the centered subscription input. Hide power, proxy controls, usage, and servers.
-- After a valid subscription loads, keep the subscription and server list centered. Require an explicit server choice instead of silently selecting the first server.
-- On server choice, slide the subscription column to the right while revealing the power column on the viewport's central axis.
-- Preserve the chosen server on later visits, but return to first-run initialization after subscription deletion.
-- Deleting a subscription must stop the VPN, clear its cached/configured state, and return the UI to the centered input without leaving stale controls visible.
-
-## Copy feedback
-
-- Keep protocol buttons fixed-size and centered.
-- Copy the complete protocol URL while showing a shared address separately.
-- Overlay mode-accent `Copied` feedback in the same fixed box; do not append text or move the label.
-- Make feedback appear immediately, hold briefly, and fade fully before restoring the original label. Keep the whole cycle near 800 ms.
-
-## Reduced motion
-
-Under `prefers-reduced-motion: reduce`, remove transitions and keyframe animations while preserving final state, focus, color contrast, copy wording, and all functionality.

.codex/skills/design-vpn-client-ui/references/visual-language.md

@@ -1,64 +0,0 @@
-# Visual language
-
-## Scene and character
-
-Design for a macOS user glancing at a small VPN control surface in a quiet desktop environment. The UI should feel soft, precise, dependable, and slightly terminal-like, not like a network administration dashboard.
-
-## Composition
-
-- Make one primary action dominant: the VPN power icon.
-- Keep the power control centered on the viewport's vertical axis, not merely centered inside a left column.
-- Build the left flow vertically: power icon, stable connection copy, proxy address, copy actions.
-- Place subscription identity, usage, expiry, and servers in a compact column to the right.
-- Collapse to one centered column on narrow screens.
-- Avoid enclosing frames, borders, and divider lines. Use spacing, type, subtle surface changes, light, depth, and state color for hierarchy.
-- Do not introduce popups or modals without an explicit user request. Prefer inline disclosure or a non-modal side layer when supporting content must coexist with the main control surface.
-- Keep server rows vertical and narrow. Underlines should be only slightly wider than the server label and ping.
-
-## Geometry and alignment
-
-- Reserve identical height for mutually exclusive content such as timer versus connection hint.
-- Give copy buttons fixed width. Overlay temporary feedback instead of replacing text in normal flow.
-- Align icons and labels in the same flex row. Do not position an icon by guessed absolute offsets.
-- Give repeated row actions one fixed-width trailing slot aligned to the same edge. Reserve that slot when labels wrap or statuses change; never place the action at the end of intrinsic label text.
-- Preserve a generous invisible hit area around icon-only controls.
-- Center proxy address and protocol actions with the power column.
-- Treat one-pixel optical misalignment as a defect when controls sit beside uppercase labels.
-- Center the semantic brand or label independently from optional action icons. Place secondary icons beside it without letting their width move the centered content.
-- Layer mutually exclusive status text in one fixed slot and crossfade between layers. Never replace text in normal flow when its length can move the interface.
-
-## Typography
-
-- Prefer the existing JetBrains Mono / SF Mono stack for the client surface.
-- Use uppercase, tracked, muted micro-labels for metadata.
-- Use stronger weight and size for the subscription domain and connection state.
-- Use tabular numerals for timers and changing numeric data.
-- Avoid display fonts, oversized headings, and mixed type families.
-
-## Color and light
-
-- Preserve green-tinted dark and light neutrals through the existing OKLCH variables.
-- Treat mode color as a system-wide state, not a logo-only decoration: Connect uses its blue-green token and Gateway uses its orange token for power, glow, selected rows, progress, copy/refresh feedback, focus, and mode-relevant labels.
-- Inactive power stays neutral gray even on hover. Warning and destructive actions remain semantic red rather than inheriting the mode accent.
-- Prefer localized `drop-shadow`, `text-shadow`, or a soft radial light layer over filled accent containers.
-- Let glow support state recognition. Do not leave every element glowing continuously.
-- Give Connect and Gateway distinct favicons and brand marks using the same mode palette.
-- When Gateway carries traffic, fade, desaturate, and disable the local subscription/server block: it remains understandable context but must not look active or actionable.
-
-## Interactive surfaces
-
-- Use one fast translucent cloud treatment for explanatory tooltips. Place the cloud above its target with strong enough contrast to survive busy content beneath it.
-- Keep a tooltip as a sibling of the animated icon/button it describes. A tooltip must never rotate, glow, blur, scale, or move with the control.
-- Use the shared full-screen critical confirmation popup for destructive actions and unsaved-data exits. Keep the centered surface flat, with hierarchy from blur, spacing, type, and staged motion rather than borders or rounded cards.
-- Animate physical icon parts when their function suggests it, such as lifting a trash lid on hover, while keeping hit areas and nearby text fixed.
-- Keep advanced client editors flat inside their side layer: rows, notes, selectors, and actions should not become nested cards, bordered fields, or raised buttons. Use spacing, type, focus light, and state color for hierarchy.
-
-## Data presentation
-
-- Show subscription domain, not the credential-like full URL.
-- Show used traffic and total limit as the primary statistic.
-- Omit upload/download breakdown when provider support is absent or ambiguous.
-- Show expiry as both date and remaining days, with correct Russian forms.
-- If there is no total, say `без лимита` and omit the progress bar.
-- Hide unavailable rows instead of showing empty placeholders or zeros that imply real measurements.
-- Keep `not tested`, `running`, `success`, and `failed` as separate row states. A result from one row must not turn untouched sibling rows into failures.

.codex/skills/manage-harbor-versions/SKILL.md

@@ -1,26 +0,0 @@
----
-name: manage-harbor-versions
-description: Check and bump Harbor component versions for every runtime, UI, API, dependency, packaging, or deployment-config change in this repository. Use before completing implementation work, release preparation, or any change that can alter the shipped Mac client, Gateway client, or Gateway backend.
----
-
-# Manage Harbor Versions
-
-Treat `src/shared/versions.ts` as the only component-version source. Do not use the root package version as a release version.
-
-## Required workflow
-
-1. Inspect the complete diff and choose the comparison base, normally `HEAD` for working-tree changes or the target branch for a review.
-2. Run `npm run version:harbor -- affected <base>`.
-3. Classify the highest compatibility impact:
-   - `major`: changes an ecosystem contract or requires all cooperating components and clients to update;
-   - `minor`: changes one component and its tightly linked components while remaining compatible with other clients on the same major;
-   - `hotfix`: changes only the affected component without requiring linked components or other clients to update.
-4. Run one explicit bump command:
-   - `npm run version:harbor -- bump major`
-   - `npm run version:harbor -- bump minor <components...>`
-   - `npm run version:harbor -- bump hotfix <components...>`
-5. Run `npm run version:harbor -- check <base>` and the repository tests before completion.
-
-Valid component names are `mac`, `gateway-client`, and `gateway-backend`. A major bump always updates all three components. A minor bump for either Gateway component automatically updates both Gateway client and Gateway backend. A hotfix updates only the named component.
-
-Do not bump documentation- or test-only changes. If the version contract is new and the base has no `src/shared/versions.ts`, keep the initial versions and let the checker report that no baseline exists.

.codex/skills/manage-harbor-versions/agents/openai.yaml

@@ -1,4 +0,0 @@
-interface:
-  display_name: "Manage Harbor Versions"
-  short_description: "Check and bump Harbor component versions."
-  default_prompt: "Use $manage-harbor-versions to classify changes and update the required Harbor component versions."

.dockerignore

@@ -1,7 +1,6 @@
 node_modules
-dist
 .vpn-proxy
-.runtime
+_archive
 .git
 .gitea
 .github

.env.example

@@ -1,23 +1,17 @@
 PORT=3456
 APP_MODE=gateway
 CLIENT_UI_PORT=3456
-CLIENT_PROXY_PORT=8082
-HARBOR_GATEWAY_CONTROL_PORT=3456
+CLIENT_PROXY_PORT_START=8080
+CLIENT_PROXY_PORT_END=8090
 BASE_IMAGE=debian:bookworm-slim
-SINGBOX_VERSION=1.14.0-rc.5
+SINGBOX_VERSION=1.12.13
 INSTALL_RUNTIME_DEPS=true
 INSTALL_SINGBOX=true
 PROXY_PORT=8080
 PROXY_BIND_IP=0.0.0.0
-SING_BOX_API_PORT=19090
-SING_BOX_TRAFFIC_SOURCE=native
 TPROXY_PORT=7895
 TPROXY_MARK=1
 TPROXY_TABLE=100
 TPROXY_CHAIN=VPN_PROXY_TPROXY
-DIRECT_TRAFFIC_CHAIN=VPN_PROXY_DIRECT
-DIRECT_TRAFFIC_MARK=0x40000000
-GATEWAY_FORWARD_CHAIN=VPN_PROXY_FORWARD
-GATEWAY_NAT_CHAIN=VPN_PROXY_NAT
-GATEWAY_CLIENT_CIDRS=10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
+ROUTING_RU_DIRECT=true
 LOG_LEVEL=info

.gitea/workflows/gateway-build.yml

@@ -4,28 +4,18 @@ on:
   push:
     branches: [master]
   workflow_dispatch:
-    inputs:
-      hard_deploy:
-        description: Always rebuild and deploy both Gateway images
-        required: false
-        default: false
-        type: boolean
 
 env:
   DEPLOY_PATH: /opt/vpn-proxy
   BASE_IMAGE: vpn-proxy-runtime-base:bookworm-slim
-  NODE_BUILD_IMAGE: mirror.gcr.io/library/node:24.21.0-bookworm
   RUNTIME_BASE_SOURCE_IMAGE: mirror.gcr.io/library/debian:bookworm-slim
   APT_MIRROR: http://mirror.yandex.ru/debian
   APT_SECURITY_MIRROR: http://mirror.yandex.ru/debian-security
-  SINGBOX_VERSION: 1.14.0-rc.5
+  SINGBOX_VERSION: 1.12.13
 
 jobs:
   build-and-push:
     runs-on: ubuntu-22.04
-    outputs:
-      affected_components: ${{ steps['gateway-build'].outputs.affected_components }}
-      restart_scope: ${{ steps['gateway-build'].outputs.restart_scope }}
     steps:
       - name: Clone repository
         env:
@@ -34,104 +24,17 @@ jobs:
           set -euo pipefail
           SERVER_HOST=$(echo "${{ gitea.server_url }}" | sed 's|https\?://||')
           rm -rf repo
-          git clone "http://${{ gitea.actor }}:${GIT_TOKEN}@${SERVER_HOST}/${{ gitea.repository }}.git" repo
+          git clone --depth 2 "http://${{ gitea.actor }}:${GIT_TOKEN}@${SERVER_HOST}/${{ gitea.repository }}.git" repo
           cd repo
           git checkout ${{ gitea.sha }}
 
       - name: Build and push gateway image
-        id: gateway-build
-        env:
-          HARD_DEPLOY_INPUT: ${{ inputs.hard_deploy }}
         run: |
           set -euo pipefail
           cd repo
 
           REGISTRY_HOST=$(echo "${{ gitea.server_url }}" | sed 's|https\?://||')
           IMAGE="${REGISTRY_HOST}/${{ gitea.repository }}/gateway"
-          CONTROL_IMAGE="${IMAGE}-control"
-          DATAPLANE_IMAGE="${IMAGE}-dataplane"
-
-          EVENT_NAME="${{ gitea.event_name }}"
-          case "${EVENT_NAME}:${HARD_DEPLOY_INPUT}" in
-            workflow_dispatch:true) HARD_DEPLOY=true ;;
-            workflow_dispatch:false|workflow_dispatch:|push:false|push:) HARD_DEPLOY=false ;;
-            *) echo "Invalid hard deploy request: ${EVENT_NAME}:${HARD_DEPLOY_INPUT}" >&2; exit 1 ;;
-          esac
-          BEFORE_SHA="${{ gitea.event.before }}"
-          ZERO_SHA="0000000000000000000000000000000000000000"
-          if [ "$EVENT_NAME" = "push" ] \
-            && [ -n "$BEFORE_SHA" ] \
-            && [ "$BEFORE_SHA" != "$ZERO_SHA" ] \
-            && git cat-file -e "${BEFORE_SHA}^{commit}" 2>/dev/null; then
-            CHANGED_FILES="$(git diff --no-renames --name-only "$BEFORE_SHA" "${{ gitea.sha }}")"
-          elif [ "$EVENT_NAME" = "push" ]; then
-            CHANGED_FILES="package.json"
-          else
-            CHANGED_FILES="$(git diff-tree --no-renames --no-commit-id --name-only -r -m HEAD)"
-          fi
-          if command -v node >/dev/null 2>&1; then
-            RUNTIME_IMPACT="$(printf '%s\n' "$CHANGED_FILES" | node scripts/runtime-impact.mjs --stdin)"
-          else
-            if ! docker image inspect "${{ env.BASE_IMAGE }}" >/dev/null 2>&1 \
-              || ! docker run --rm "${{ env.BASE_IMAGE }}" sh -lc 'command -v node >/dev/null'; then
-              echo "Cannot classify runtime impact: Node and the existing runtime base are unavailable." >&2
-              exit 1
-            fi
-            RUNTIME_IMPACT="$(printf '%s\n' "$CHANGED_FILES" | docker run --rm -i \
-              -v "$PWD:/work" \
-              -w /work \
-              "${{ env.BASE_IMAGE }}" \
-              node scripts/runtime-impact.mjs --stdin)"
-          fi
-          AFFECTED_COMPONENTS="$(printf '%s\n' "$RUNTIME_IMPACT" | sed -n 's/^affected-components=//p')"
-          RESTART_SCOPE="$(printf '%s\n' "$RUNTIME_IMPACT" | sed -n 's/^restart-scope=//p')"
-          case "${AFFECTED_COMPONENTS}:${RESTART_SCOPE}" in
-            none:none|control:control|dataplane:both|control+dataplane:both) ;;
-            *) echo "Invalid runtime impact: ${RUNTIME_IMPACT}" >&2; exit 1 ;;
-          esac
-          DOCKER_BUILD_OPTIONS=()
-          if [ "$HARD_DEPLOY" = "true" ]; then
-            echo "Hard deploy requested: forcing no-cache rebuild and deploy of both Gateway images."
-            AFFECTED_COMPONENTS="control+dataplane"
-            RESTART_SCOPE="both"
-            DOCKER_BUILD_OPTIONS=(--no-cache)
-          fi
-          echo "Affected components: ${AFFECTED_COMPONENTS}"
-          echo "Restart scope: ${RESTART_SCOPE}"
-          echo "affected_components=${AFFECTED_COMPONENTS}" >> "$GITHUB_OUTPUT"
-          echo "restart_scope=${RESTART_SCOPE}" >> "$GITHUB_OUTPUT"
-          if command -v npm >/dev/null 2>&1 && node scripts/check-sqlite-runtime.mjs; then
-            npm ci --no-audit --no-fund
-            npm run typecheck
-            npm run check:boundaries
-            npm test
-            npm run build:production
-          else
-            if ! docker run --rm "${{ env.NODE_BUILD_IMAGE }}" sh -lc 'command -v npm >/dev/null && command -v git >/dev/null && test -x /bin/bash'; then
-              echo "Cannot validate change: the pinned Node 24.21.0 build toolchain is unavailable." >&2
-              exit 1
-            fi
-            echo "Host npm not found; validating inside ${{ env.NODE_BUILD_IMAGE }}"
-            docker run --rm \
-              --network host \
-              -v "$PWD:/work" \
-              -w /work \
-              "${{ env.NODE_BUILD_IMAGE }}" \
-              sh -lc '
-                npm ci --no-audit --no-fund
-                npm_status=$?
-                if [ "$npm_status" -ne 0 ] || [ ! -x node_modules/.bin/tsc ]; then
-                  echo "npm ci failed to install the validation toolchain." >&2
-                  tail -n 200 /root/.npm/_logs/*-debug-0.log >&2 || true
-                  exit 1
-                fi
-                npm run typecheck && npm run check:boundaries && npm test && npm run build:production
-              '
-          fi
-          if [ "$RESTART_SCOPE" = "none" ]; then
-            echo "Image build and push skipped: no Gateway runtime impact."
-            exit 0
-          fi
 
           echo "Build runner: $(hostname)"
           echo "Base image: ${{ env.BASE_IMAGE }}"
@@ -139,41 +42,42 @@ jobs:
           docker info 2>/dev/null | sed -n '/HTTP Proxy:/p;/HTTPS Proxy:/p;/Name:/p'
 
           if ! docker image inspect "${{ env.BASE_IMAGE }}" >/dev/null 2>&1 \
-            || ! docker run --rm "${{ env.BASE_IMAGE }}" sh -lc \
-              'command -v npm >/dev/null && sing-box version 2>&1 | grep -Fx "sing-box version ${{ env.SINGBOX_VERSION }}"'; then
-            echo "Runtime base image ${{ env.BASE_IMAGE }} is missing npm or sing-box ${{ env.SINGBOX_VERSION }}; building it now."
+            || ! docker run --rm "${{ env.BASE_IMAGE }}" sh -lc 'command -v npm >/dev/null'; then
+            echo "Runtime base image ${{ env.BASE_IMAGE }} is missing npm; building it now."
             BASE_IMAGE="${{ env.RUNTIME_BASE_SOURCE_IMAGE }}" \
             RUNTIME_BASE_IMAGE="${{ env.BASE_IMAGE }}" \
             APT_MIRROR="${{ env.APT_MIRROR }}" \
             APT_SECURITY_MIRROR="${{ env.APT_SECURITY_MIRROR }}" \
             SINGBOX_VERSION="${{ env.SINGBOX_VERSION }}" \
-            NODE_BUILD_IMAGE="${{ env.NODE_BUILD_IMAGE }}" \
             ./scripts/build-runtime-base.sh
           fi
 
+          if command -v npm >/dev/null 2>&1; then
+            npm ci --no-audit --no-fund
+            npm run build
+          else
+            echo "Host npm not found; building frontend inside ${{ env.BASE_IMAGE }}"
+            docker run --rm \
+              --network host \
+              -v "$PWD:/work" \
+              -w /work \
+              "${{ env.BASE_IMAGE }}" \
+              sh -lc 'npm ci --no-audit --no-fund && npm run build'
+          fi
+
           echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "$REGISTRY_HOST" -u "${{ gitea.actor }}" --password-stdin
           DOCKER_BUILDKIT=1 docker build \
-            "${DOCKER_BUILD_OPTIONS[@]}" \
             --network host \
             --pull=false \
-            --build-arg NODE_BUILD_IMAGE="${{ env.NODE_BUILD_IMAGE }}" \
             --build-arg BASE_IMAGE="${{ env.BASE_IMAGE }}" \
             --build-arg SINGBOX_VERSION="${{ env.SINGBOX_VERSION }}" \
             --build-arg INSTALL_RUNTIME_DEPS=false \
             --build-arg INSTALL_SINGBOX=false \
-            -t "${CONTROL_IMAGE}:latest" \
-            -t "${CONTROL_IMAGE}:${{ gitea.sha }}" \
-            -t "${DATAPLANE_IMAGE}:latest" \
-            -t "${DATAPLANE_IMAGE}:${{ gitea.sha }}" \
+            -t "${IMAGE}:latest" \
+            -t "${IMAGE}:${{ gitea.sha }}" \
             .
-          docker run --rm --entrypoint sing-box "${CONTROL_IMAGE}:${{ gitea.sha }}" version 2>&1 \
-            | grep -Fx "sing-box version ${{ env.SINGBOX_VERSION }}"
-          docker run --rm --entrypoint sing-box "${DATAPLANE_IMAGE}:${{ gitea.sha }}" version 2>&1 \
-            | grep -Fx "sing-box version ${{ env.SINGBOX_VERSION }}"
-          docker push "${CONTROL_IMAGE}:latest"
-          docker push "${CONTROL_IMAGE}:${{ gitea.sha }}"
-          docker push "${DATAPLANE_IMAGE}:latest"
-          docker push "${DATAPLANE_IMAGE}:${{ gitea.sha }}"
+          docker push "${IMAGE}:latest"
+          docker push "${IMAGE}:${{ gitea.sha }}"
 
   deploy:
     runs-on: lxc-111
@@ -197,34 +101,7 @@ jobs:
 
           REGISTRY_HOST=$(echo "${{ gitea.server_url }}" | sed 's|https\?://||')
           IMAGE="${REGISTRY_HOST}/${{ gitea.repository }}/gateway"
-          CONTROL_IMAGE="${IMAGE}-control:${{ gitea.sha }}"
-          DATAPLANE_IMAGE="${IMAGE}-dataplane:${{ gitea.sha }}"
-          AFFECTED_COMPONENTS="${{ needs['build-and-push'].outputs.affected_components }}"
-          RESTART_SCOPE="${{ needs['build-and-push'].outputs.restart_scope }}"
-          case "${AFFECTED_COMPONENTS}:${RESTART_SCOPE}" in
-            none:none|control:control|dataplane:both|control+dataplane:both) ;;
-            *) echo "Invalid runtime impact output: ${AFFECTED_COMPONENTS}:${RESTART_SCOPE}" >&2; exit 1 ;;
-          esac
-          if [ "$RESTART_SCOPE" = "none" ]; then
-            echo "Deploy skipped: no Gateway runtime impact."
-            exit 0
-          fi
-          UPDATE_DATAPLANE=false
-          if [ "$RESTART_SCOPE" = "both" ]; then
-            UPDATE_DATAPLANE=true
-          fi
 
           echo "Deploy runner: $(hostname)"
-          echo "Affected components: ${AFFECTED_COMPONENTS}"
-          echo "Restart scope: ${RESTART_SCOPE}"
-          echo "Update dataplane: ${UPDATE_DATAPLANE}"
           echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "$REGISTRY_HOST" -u "${{ gitea.actor }}" --password-stdin
-          DEPLOY_PATH="${{ env.DEPLOY_PATH }}" \
-            CONTROL_IMAGE="${CONTROL_IMAGE}" \
-            DATAPLANE_IMAGE="${DATAPLANE_IMAGE}" \
-            UPDATE_DATAPLANE="${UPDATE_DATAPLANE}" \
-            bash scripts/deploy-gateway.sh
-          VERSION_JSON="$(curl --noproxy '*' -fsS http://127.0.0.1:3456/api/version)"
-          printf '%s\n' "$VERSION_JSON"
-          printf '%s\n' "$VERSION_JSON" \
-            | grep -F "\"singBox\":\"${{ env.SINGBOX_VERSION }}\""
+          DEPLOY_PATH="${{ env.DEPLOY_PATH }}" GATEWAY_IMAGE="${IMAGE}:${{ gitea.sha }}" bash scripts/deploy-gateway.sh

.gitignore

@@ -1,20 +1,17 @@
+# Local archive with the previous implementation and runtime secrets
+_archive/
+
 # Runtime state
 .env
 *.env.local
 data/
 .vpn-proxy/
-.runtime/
+.superpowers/
 .worktrees/
 
-# Local roadmap and task workspace
-/workpack/
-/design-qa.md
-
 # Node/Vite
 node_modules/
 dist/
-.test-dist/
-.tmp-tests/
 coverage/
 npm-debug.log*
 yarn-debug.log*

.node-version

@@ -1 +0,0 @@
-24.21.0

AGENTS.md

@@ -1,9 +0,0 @@
-# Harbor task workflow
-
-Use the checked-in `workpack/` directory as the only roadmap source. Do not require or read the original archive.
-
-Follow `workpack/AGENTS.md` for every roadmap task, including status updates. Completed tasks must not be selected or implemented again unless the user explicitly asks to reopen one.
-
-Before implementing any feature, record or refresh its plan in the selected `workpack/tasks/TASK-*.md` file using the mandatory feature-plan contract from `workpack/AGENTS.md`. Write the whole plan in simple language understandable without knowledge of the codebase: explain technical terms on first use, and use file paths or code names only as supporting detail. The plan must explain the implementation sequence and affected system components. For user-visible work it must also specify layout and states, exact icons, animation/motion behavior, accessibility and reduced-motion behavior; otherwise it must explicitly state that UI, icons and motion are unaffected. A proposed visible design is not owner approval.
-
-For every runtime, UI, API, dependency or deployment-config change, use `.codex/skills/manage-harbor-versions/SKILL.md`. Before completion, classify the affected components, bump the required version level and run `npm run version:harbor -- check <base>`. Documentation- and test-only changes do not require a bump.

Dockerfile

@@ -1,33 +1,19 @@
-ARG NODE_BUILD_IMAGE=node:24.21.0-bookworm
 ARG BASE_IMAGE=debian:bookworm-slim
-
-FROM ${NODE_BUILD_IMAGE} AS build
-WORKDIR /src
-COPY scripts/check-sqlite-runtime.mjs ./scripts/check-sqlite-runtime.mjs
-RUN node scripts/check-sqlite-runtime.mjs
-COPY package.json package-lock.json ./
-RUN npm ci
-COPY index.html vite.config.ts tsconfig*.json ./
-COPY src/web ./src/web
-COPY src/server ./src/server
-COPY src/shared ./src/shared
-COPY monitoring/grafana/harbor-gateway.json ./monitoring/grafana/harbor-gateway.json
-RUN npm run build:production
-
 FROM ${BASE_IMAGE}
-COPY --from=build /usr/local /usr/local
-ARG SINGBOX_VERSION=1.14.0-rc.5
+ARG SINGBOX_VERSION=1.12.13
 ARG INSTALL_RUNTIME_DEPS=true
 ARG INSTALL_SINGBOX=true
+COPY dist /app/dist
 
 RUN if [ "${INSTALL_RUNTIME_DEPS}" = "true" ]; then \
         apt-get update \
-        && apt-get install -y --no-install-recommends ca-certificates curl iptables iproute2 ieee-data dumb-init \
+        && apt-get install -y --no-install-recommends ca-certificates curl iptables ipset iproute2 nodejs dumb-init \
         && rm -rf /var/lib/apt/lists/*; \
     else \
         command -v dumb-init >/dev/null \
         && command -v node >/dev/null \
-        && command -v iptables >/dev/null; \
+        && command -v iptables >/dev/null \
+        && command -v ipset >/dev/null; \
     fi
 
 RUN if [ "${INSTALL_SINGBOX}" = "true" ]; then \
@@ -38,7 +24,7 @@ RUN if [ "${INSTALL_SINGBOX}" = "true" ]; then \
         arm64) sb_arch="arm64" ;; \
         *) echo "Unsupported architecture: $arch" >&2; exit 1 ;; \
         esac; \
-        curl --retry 5 --retry-all-errors --retry-delay 2 -fsSL "https://github.com/SagerNet/sing-box/releases/download/v${SINGBOX_VERSION}/sing-box-${SINGBOX_VERSION}-linux-${sb_arch}.tar.gz" -o /tmp/sing-box.tgz; \
+        curl -fsSL "https://github.com/SagerNet/sing-box/releases/download/v${SINGBOX_VERSION}/sing-box-${SINGBOX_VERSION}-linux-${sb_arch}.tar.gz" -o /tmp/sing-box.tgz; \
         tar -xzf /tmp/sing-box.tgz -C /tmp; \
         mv "/tmp/sing-box-${SINGBOX_VERSION}-linux-${sb_arch}/sing-box" /usr/local/bin/sing-box; \
         chmod +x /usr/local/bin/sing-box; \
@@ -48,15 +34,8 @@ RUN if [ "${INSTALL_SINGBOX}" = "true" ]; then \
     fi
 
 WORKDIR /app
-COPY --from=build /src/dist /app/dist
-COPY --from=build /src/node_modules/@bufbuild/protobuf /app/node_modules/@bufbuild/protobuf
-COPY --from=build /src/node_modules/@connectrpc/connect /app/node_modules/@connectrpc/connect
-COPY --from=build /src/node_modules/@connectrpc/connect-node /app/node_modules/@connectrpc/connect-node
-COPY --from=build /src/node_modules/tldts /app/node_modules/tldts
-COPY --from=build /src/node_modules/tldts-core /app/node_modules/tldts-core
-COPY scripts/check-sqlite-runtime.mjs /app/scripts/check-sqlite-runtime.mjs
-RUN node /app/scripts/check-sqlite-runtime.mjs
 COPY package.json /app/package.json
+COPY src/server /app/src/server
 COPY entrypoint.sh /entrypoint.sh
 
 RUN chmod +x /entrypoint.sh \
@@ -65,11 +44,11 @@ RUN chmod +x /entrypoint.sh \
 ENV PORT=3456 \
     PROXY_PORT=8080 \
     PROXY_BIND_IP=0.0.0.0 \
-    SING_BOX_API_PORT=19090 \
     TPROXY_PORT=7895 \
+    DIRECT_BYPASS_CACHE=false \
+    RULE_SET_DOWNLOAD_DETOUR=vpn \
     DATA_DIR=/var/lib/vpn-proxy \
     SING_BOX_CONFIG=/etc/sing-box/config.json \
-    SING_BOX_CACHE=/var/lib/sing-box/cache.db \
-    SING_BOX_TRAFFIC_SOURCE=snapshot
+    SING_BOX_CACHE=/var/lib/sing-box/cache.db
 
 ENTRYPOINT ["dumb-init", "/entrypoint.sh"]

Dockerfile.client

@@ -1,25 +1,19 @@
-ARG NODE_BUILD_IMAGE=node:24.21.0-bookworm
+ARG NODE_BUILD_IMAGE=node:20-alpine
 ARG RUNTIME_IMAGE=debian:bookworm-slim
 
-FROM ${NODE_BUILD_IMAGE} AS build
+FROM ${NODE_BUILD_IMAGE} AS web-build
 WORKDIR /src
-COPY scripts/check-sqlite-runtime.mjs ./scripts/check-sqlite-runtime.mjs
-RUN node scripts/check-sqlite-runtime.mjs
 COPY package.json package-lock.json ./
 RUN npm ci
-COPY index.html vite.config.ts tsconfig*.json ./
+COPY index.html vite.config.js ./
 COPY src/web ./src/web
-COPY src/server ./src/server
-COPY src/shared ./src/shared
-COPY monitoring/grafana/harbor-gateway.json ./monitoring/grafana/harbor-gateway.json
-RUN npm run build:production
+RUN npm run build
 
 FROM ${RUNTIME_IMAGE}
-COPY --from=build /usr/local /usr/local
-ARG SINGBOX_VERSION=1.14.0-rc.5
+ARG SINGBOX_VERSION=1.12.13
 
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends ca-certificates curl dumb-init tar \
+    && apt-get install -y --no-install-recommends ca-certificates curl dumb-init nodejs tar \
     && rm -rf /var/lib/apt/lists/*
 
 RUN set -eux; \
@@ -29,22 +23,16 @@ RUN set -eux; \
       arm64) sb_arch="arm64" ;; \
       *) echo "Unsupported architecture: $arch" >&2; exit 1 ;; \
     esac; \
-    curl --retry 5 --retry-all-errors --retry-delay 2 -fsSL "https://github.com/SagerNet/sing-box/releases/download/v${SINGBOX_VERSION}/sing-box-${SINGBOX_VERSION}-linux-${sb_arch}.tar.gz" -o /tmp/sing-box.tgz; \
+    curl -fsSL "https://github.com/SagerNet/sing-box/releases/download/v${SINGBOX_VERSION}/sing-box-${SINGBOX_VERSION}-linux-${sb_arch}.tar.gz" -o /tmp/sing-box.tgz; \
     tar -xzf /tmp/sing-box.tgz -C /tmp; \
     mv "/tmp/sing-box-${SINGBOX_VERSION}-linux-${sb_arch}/sing-box" /usr/local/bin/sing-box; \
     chmod +x /usr/local/bin/sing-box; \
     rm -rf /tmp/sing-box*
 
 WORKDIR /app
-COPY --from=build /src/dist /app/dist
-COPY --from=build /src/node_modules/@bufbuild/protobuf /app/node_modules/@bufbuild/protobuf
-COPY --from=build /src/node_modules/@connectrpc/connect /app/node_modules/@connectrpc/connect
-COPY --from=build /src/node_modules/@connectrpc/connect-node /app/node_modules/@connectrpc/connect-node
-COPY --from=build /src/node_modules/tldts /app/node_modules/tldts
-COPY --from=build /src/node_modules/tldts-core /app/node_modules/tldts-core
-COPY scripts/check-sqlite-runtime.mjs /app/scripts/check-sqlite-runtime.mjs
-RUN node /app/scripts/check-sqlite-runtime.mjs
+COPY --from=web-build /src/dist /app/dist
 COPY package.json /app/package.json
+COPY src/server /app/src/server
 COPY entrypoint.client.sh /entrypoint.client.sh
 
 RUN chmod +x /entrypoint.client.sh \
@@ -52,16 +40,15 @@ RUN chmod +x /entrypoint.client.sh \
 
 ENV APP_MODE=client \
     PORT=3456 \
-    PROXY_PORT=8082 \
+    PROXY_PORT=8080 \
     PROXY_BIND_IP=0.0.0.0 \
     DATA_DIR=/var/lib/vpn-proxy \
     SING_BOX_CONFIG=/etc/sing-box/config.json \
     SING_BOX_CACHE=/var/lib/sing-box/cache.db \
     RULE_SET_DOWNLOAD_DETOUR=vpn \
     ROUTING_RU_DIRECT=true \
-    SING_BOX_TRAFFIC_SOURCE=native \
     LOG_LEVEL=info
 
-EXPOSE 3456 8082
+EXPOSE 3456 8080
 
 ENTRYPOINT ["dumb-init", "/entrypoint.client.sh"]

Dockerfile.runtime-base

@@ -1,11 +1,6 @@
 ARG BASE_IMAGE=mirror.gcr.io/library/debian:bookworm-slim
-ARG NODE_BUILD_IMAGE=node:24.21.0-bookworm
-FROM ${NODE_BUILD_IMAGE} AS node-runtime
 FROM ${BASE_IMAGE}
-COPY --from=node-runtime /usr/local /usr/local
-COPY scripts/check-sqlite-runtime.mjs /opt/harbor/check-sqlite-runtime.mjs
-RUN node /opt/harbor/check-sqlite-runtime.mjs
-ARG SINGBOX_VERSION=1.14.0-rc.5
+ARG SINGBOX_VERSION=1.12.13
 ARG APT_MIRROR=http://mirror.yandex.ru/debian
 ARG APT_SECURITY_MIRROR=http://mirror.yandex.ru/debian-security
 ARG HTTP_PROXY
@@ -37,7 +32,7 @@ RUN export http_proxy="${http_proxy:-${HTTP_PROXY:-}}" \
       -o Acquire::http::Timeout=20 \
       -o Acquire::https::Timeout=20 \
       -o Acquire::ForceIPv4=true \
-      install -y --no-install-recommends ca-certificates curl iptables ipset iproute2 ieee-data dumb-init \
+      install -y --no-install-recommends ca-certificates curl iptables ipset iproute2 nodejs npm dumb-init \
     && rm -rf /var/lib/apt/lists/*
 
 RUN set -eux; \
@@ -50,7 +45,7 @@ RUN set -eux; \
     arm64) sb_arch="arm64" ;; \
     *) echo "Unsupported architecture: $arch" >&2; exit 1 ;; \
     esac; \
-    curl --retry 5 --retry-all-errors --retry-delay 2 -fsSL "https://github.com/SagerNet/sing-box/releases/download/v${SINGBOX_VERSION}/sing-box-${SINGBOX_VERSION}-linux-${sb_arch}.tar.gz" -o /tmp/sing-box.tgz; \
+    curl -fsSL "https://github.com/SagerNet/sing-box/releases/download/v${SINGBOX_VERSION}/sing-box-${SINGBOX_VERSION}-linux-${sb_arch}.tar.gz" -o /tmp/sing-box.tgz; \
     tar -xzf /tmp/sing-box.tgz -C /tmp; \
     mv "/tmp/sing-box-${SINGBOX_VERSION}-linux-${sb_arch}/sing-box" /usr/local/bin/sing-box; \
     chmod +x /usr/local/bin/sing-box; \

PRODUCT.md

@@ -1,35 +0,0 @@
-# Product
-
-## Register
-
-product
-
-## Users
-
-People running either a local macOS proxy client or a small Linux VPN gateway. They open the client only to add a subscription, choose a server, turn the VPN on or off, and copy the connection address.
-
-## Product Purpose
-
-Provide one small, dependable control surface for the macOS client and the system gateway. Success means the connection state is obvious, while the gateway address and proxy URLs are ready to copy from the same screen.
-
-## Brand Personality
-
-Soft, calm, precise. Familiar to macOS users, with sharper geometry and a quiet monospace character.
-
-## Anti-references
-
-Not an admin dashboard, network console, settings maze, or enclosing card. Avoid sidebars, technical route diagrams, framed content areas, decorative effects, and routing-rule administration.
-
-## Design Principles
-
-- One screen, one primary action.
-- Use plain language and hide implementation details.
-- Make connection state unmistakable without relying on color alone.
-- Prefer native controls and predictable macOS behavior.
-- Show saved subscriptions as a domain, not as a credential-like URL.
-- Make servers directly selectable instead of hiding them in a dropdown.
-- Keep advanced and server-only features out of the client path.
-
-## Accessibility & Inclusion
-
-Support keyboard navigation, visible focus, sufficient contrast, system light and dark themes, and reduced motion preferences.

README.md

@@ -1,425 +1,483 @@
-# Harbor
+# VPN Proxy
 
-Harbor помогает пользоваться несколькими VPN-подписками дома и на Mac без ручной настройки `sing-box`.
+Локальный Docker-клиент для Mac и прозрачный VPN-шлюз на базе [sing-box](https://sing-box.sagernet.org/).
 
-Проект работает в двух режимах:
+## macOS: локальный Docker-клиент
 
-| Режим | Где работает | Для чего нужен |
-| --- | --- | --- |
-| **Harbor Gateway** | На отдельной Linux-машине | Проводит через VPN весь интернет-трафик домашних устройств или работает как общий HTTP/SOCKS5-прокси |
-| **Harbor Connect** | На macOS | Даёт приложениям на Mac локальный HTTP/SOCKS5-прокси |
-
-Основной экран Connect и Gateway всегда показывает фактически применённые подписку и сервер. Управление подписками открывается отдельной верхней кнопкой в правой панели; Home, «Устройства» и «Диагностика» Gateway доступны и без подписки.
-
-## Что понадобится
-
-- ссылка на подписку от VPN-провайдера, если Harbor должен направлять трафик через VPN;
-- Docker с командой `docker compose`;
-- для ручной установки Gateway — Git;
-- для Gateway — Linux-машина в одной локальной сети с устройствами;
-- для Connect — Mac с запущенным Docker Desktop.
-
-Harbor не является VPN-провайдером и не создаёт подписки самостоятельно.
-
-## Что выбрать
-
-Используйте **Harbor Connect**, если VPN нужен только приложениям на одном Mac.
-
-Используйте **Harbor Gateway**, если нужно подключить телевизор, телефон, игровую приставку или сразу несколько устройств. Устройства можно направить через Gateway целиком либо настроить в отдельных приложениях общий прокси.
-
-Оба режима можно использовать вместе. Дома Connect автоматически распознаёт настроенный Harbor Gateway и не запускает второй VPN-маршрут. В другой сети Connect возвращается к локальному VPN.
-
-## Установка Harbor Gateway
-
-### 1. Скачайте проект
+Самый простой режим: контейнер работает как обычный локальный HTTP/SOCKS proxy без TProxy, iptables, `network_mode: host` и прав `NET_ADMIN`.
 
 ```bash
-git clone https://git.dokops.ru/dokril/vpn-proxy.git
-cd vpn-proxy
+curl -fsSL https://git.dokops.ru/dokril/vpn-proxy/raw/branch/master/scripts/install-macos-client.sh | bash
 ```
 
-### 2. Создайте настройки
+После запуска по умолчанию:
+
+- UI: `http://127.0.0.1:3456`
+- HTTP/SOCKS proxy: `127.0.0.1:8080` по умолчанию; в UI можно выбрать порт из Docker-диапазона `8080–8090`
+
+Установщик интерактивно спросит proxy-порт. Если стандартный UI-порт `3456` занят другим контейнером, установщик попросит выбрать свободный UI-порт. Для неинтерактивного запуска можно задать порты заранее; тогда вопросы не появятся:
 
 ```bash
-cp .env.example .env
+curl -fsSL https://git.dokops.ru/dokril/vpn-proxy/raw/branch/master/scripts/install-macos-client.sh | VPN_PROXY_CLIENT_PORT=18080 bash
 ```
 
-Стандартные значения подходят для обычной домашней сети. При необходимости откройте `.env` в текстовом редакторе и измените порты.
-
-### 3. Запустите Gateway
+Если старый gateway/client уже занимает `3456` или выбранный proxy-порт, можно не трогать старый контейнер и поставить новый клиент на другие порты:
 
 ```bash
-docker compose -f docker-compose.gateway.yml up -d --build
+curl -fsSL https://git.dokops.ru/dokril/vpn-proxy/raw/branch/master/scripts/install-macos-client.sh | VPN_PROXY_CLIENT_UI_PORT=3457 VPN_PROXY_CLIENT_PORT=18080 bash
 ```
 
-Откройте в браузере:
+После запуска скрипт проверяет, что UI реально ответил на `/api/state`. Если контейнер сразу упал или порт занят, он покажет `docker compose ps` и последние логи вместо ложного сообщения о готовности.
 
-```text
-http://АДРЕС-GATEWAY:3456
-```
+В Mac UI есть **Домашний режим**. Когда он включён, приложения по-прежнему используют выбранный локальный proxy-порт, но весь proxy-трафик идёт напрямую без VPN.
 
-Например, если Linux-машина имеет адрес `192.168.1.20`, интерфейс будет доступен по адресу `http://192.168.1.20:3456`.
-
-### 4. При необходимости добавьте подписку
-
-1. Нажмите «Подписки» — верхнюю кнопку в правой панели Gateway.
-2. Нажмите «Добавить подписку», задайте понятное имя и вставьте ссылку VPN-провайдера.
-3. Выберите сервер внутри добавленной группы.
-4. При нескольких группах выберите нужную действием «Сделать активной».
-5. Включите VPN.
-
-После подключения Harbor покажет два варианта использования:
-
-- **Gateway** — укажите IP-адрес Linux-машины как основной шлюз устройства. Через VPN пойдёт весь его интернет-трафик;
-- **Gateway Proxy** — укажите адрес Linux-машины и порт `8080` в приложении. Поддерживаются HTTP и SOCKS5 на одном порту.
-
-Приватные и локальные адреса не отправляются в VPN, поэтому устройства сохраняют доступ к домашней сети. Общий прокси по умолчанию принимает подключения только из приватных сетей.
-
-### Резервный канал Gateway
-
-После добавления подписок откройте «Резерв» — вторую кнопку в правой панели. Выберите основной и резервный серверы (они могут быть из одной или разных подписок), сервисы для проверки и отдельный таймаут каждого сервиса. Там же настраиваются длительность сбоя и восстановления, порог активного трафика, период тишины и защита от частых переключений.
-
-При включении Harbor заранее проверяет dual-конфигурацию. Если VPN остановлен, она начнёт работать только после следующего обычного нажатия питания; сохранение само VPN не включает. Переключение меняет маршрут только для новых соединений — уже открытые соединения не закрываются. Если через VPN идёт активный трафик или его активность нельзя надёжно определить, Harbor ждёт и показывает скорость, число передающих соединений и безопасные подписи основных блокирующих потоков.
-
-Выключенный резерв полностью пассивен: Harbor не запускает проверки, таймер выбора и отдельный подсчёт активности. Если dual-конфигурация уже загружена, отключение не перезапускает VPN и не меняет текущий маршрут; обычный stop и следующий запуск вернут single-channel config. Последние важные события — включение VPN, обновления подписок, переключения и ошибки — доступны в последней кнопке «Журнал» и хранятся 30 дней без ссылок подписок и сырых диагностических ответов.
-
-### Устройства Gateway
-
-Откройте «Устройства» в правой панели Gateway — подписка для просмотра списка не требуется. Harbor раз в 15 секунд читает локальную таблицу соседей и показывает каждое устройство одной компактной строкой: заданное название, hostname или IP, последний контакт, выбранный график трафика и иконку применённого маршрута. По умолчанию график показывает приблизительный выход `VPN`/`Direct`; переключатель `Вход` возвращает накопленную разбивку `Gateway`/`Прокси`. Наведите курсор на имя или переведите на него фокус, чтобы открыть IP, MAC и доступный hostname; нажатие на значение копирует его. Hostname определяется через локальное обратное разрешение имён и может отсутствовать, если сеть его не публикует. Технические interface и manufacturer продолжают храниться для идентификации, но не занимают место в строке. Список разделён на «Закреплённые», «Остальные» и «Фоновые»: последняя группа сохраняется между перезапусками, показывает только identity/presence и кнопку возврата без графика, traffic и route controls. Название, закрепление, фоновое положение и накопленные totals сохраняются в volume Gateway, пока устройство остаётся в inventory.
-
-Левая панель списка ищет по имени, hostname, IP, MAC и тегам, фильтрует новые, закреплённые, фоновые или устройства без тегов и позволяет выбрать несколько тегов по правилу «хотя бы один». Каталог тегов общий для Gateway: в нём можно создать до 32 тегов и назначить устройству до 8. Назначения сохраняются в документе устройств внутри `harbor.sqlite`, но маршруты не меняют. После удаления устройства по 30-дневному retention его назначения удаляются, сам каталог остаётся; вернувшееся позже устройство появляется без тегов. Если Mac-клиент подключён к старой версии Gateway, список продолжает работать, а управление тегами скрывается до обновления Gateway.
-
-Красная кнопка `Сбросить данные` после отдельного подтверждения обнуляет вход и выход всех устройств и начинает считать их заново. Общий график скорости на Home и уже сохранённая история Prometheus/Grafana не очищаются: входной counter выглядит для Prometheus как стандартный reset, а для выхода Harbor сохраняет только baseline отображения и не изменяет raw dataplane counters.
-
-Устройство, впервые замеченное после обновления Gateway, по умолчанию идёт `Напрямую` и первые семь дней отмечается `NEW`; исчезновение метки маршрут не меняет. Уже известные при обновлении устройства сохраняют текущий VPN, даже если метка ещё видна по их `firstSeenAt`. VPN разрешается существующей последней иконкой маршрута. Если новый device пока распознан неоднозначно, Harbor сохраняет Direct-намерение, временно оставляет фактический VPN и применяет Direct после однозначного наблюдения.
-
-У однозначно распознанного устройства маршрут можно переключить последней иконкой между `VPN` и `Напрямую` независимо от закрепления; точное значение и следующее действие показаны в tooltip. `VPN` означает обработку через sing-box и правила Gateway: например, включённое локальное доменное правило всё равно может выбрать прямой выход внутри sing-box. `Напрямую` полностью обходит sing-box на уровне iptables. Traffic totals учитываются в обоих режимах. Если правило не удалось применить, Harbor сохраняет выбранный режим и отдельно показывает последний фактически применённый маршрут.
-
-Список приблизительный: имя и пользовательские настройки привязаны к MAC и сохраняются при обычной смене IP, но новый private/randomized MAC считается новым устройством — переносить имя по одному только DHCP-адресу небезопасно. Запись автоматически удаляется после 30 дней без подтверждённого контакта независимо от имени, закрепления или фонового положения; временная ошибка чтения сети этот срок не продвигает. Один MAC с несколькими IP помечается как неоднозначный, а устройство появляется только после сетевого контакта с Gateway. Интерфейс самого Gateway не выдаётся за Wi-Fi/Ethernet устройства. Внешние сервисы распознавания производителя не используются. `Прокси` учитывает подключения устройства к общему proxy-порту Harbor, а `Gateway` — остальной публичный трафик через Gateway; трафик, который вообще не дошёл до Harbor, увидеть нельзя. Локальные, приватные и multicast-пакеты в totals не входят. При аварийном restart dataplane возможна потеря последних примерно 30 секунд; история по часам пока не хранится.
-
-Home показывает фактически применённый VPN-сервер, накопленное `Учтено Harbor` и большой нижний график средней скорости Download/Upload за фактический интервал между снимками. `Учтено Harbor` — сумма `Gateway` и явного `Прокси` для всех наблюдавшихся устройств; это не лимит VPN-провайдера и не весь физический трафик Linux-машины. Накопленный total сохраняется при очистке старых устройств, а короткая история скорости после перезапуска начинает заполняться заново.
-
-## Установка Harbor Connect на macOS
-
-### 1. Запустите Docker Desktop
-
-Установщик проверит наличие Docker, Docker Compose, `curl` и `tar`. Если Docker Desktop не запущен, установка остановится с понятным сообщением.
-
-### 2. Запустите установщик
+Также Mac-клиент можно связать с серверным gateway. На gateway доступна ручка:
 
 ```bash
-curl -fsSL https://git.dokops.ru/dokril/vpn-proxy/raw/branch/master/install.sh | sh
+GET http://<gateway-ui-host>:3456/api/shared-proxy
 ```
 
-Установщик:
+Если gateway запущен и его mixed proxy работает, ручка вернёт `available: true` и SOCKS5 endpoint общего proxy. В Mac UI укажите адрес gateway UI, например `http://192.168.50.111:3456`. Клиент проверит ручку и переключит локальный `127.0.0.1:<proxy-port>` в режим upstream: весь proxy-трафик пойдёт через общий gateway, локальная VPN-подписка на Mac для этого режима не нужна.
 
-- сохранит рабочую копию в `~/.vpn-proxy-client`;
-- предложит порт для локального прокси;
-- соберёт и запустит контейнер Harbor Connect;
-- добавит пользовательский LaunchAgent для определения текущего Gateway.
-
-По умолчанию используются адреса:
-
-| Назначение | Адрес |
-| --- | --- |
-| Интерфейс Harbor Connect | `http://127.0.0.1:3456` |
-| HTTP-прокси | `127.0.0.1:8082` |
-| SOCKS5-прокси | `127.0.0.1:8082` |
-
-### 3. Добавьте подписку
-
-Откройте `http://127.0.0.1:3456`, добавьте подписку с понятным именем, выберите сервер внутри её группы и включите VPN. Остальные подписки можно добавить через правую панель «Подписки»; у каждой сохраняются собственные серверы, лимит и выбор.
-
-Сам по себе локальный прокси не перенаправляет приложения автоматически. Адрес `127.0.0.1:8082` нужно указать в настройках нужного приложения или в системных настройках macOS.
-
-Кнопка «Трафик» в правой панели показывает активные соединения, которые прошли через Harbor Connect. Данные о приложениях macOS недоступны, потому что sing-box работает внутри Docker.
-
-### Другие порты
-
-Передайте нужные значения при повторном запуске установщика:
+Ручной запуск из checkout:
 
 ```bash
-curl -fsSL https://git.dokops.ru/dokril/vpn-proxy/raw/branch/master/install.sh | \
-  VPN_PROXY_CLIENT_PORT=9080 \
-  VPN_PROXY_CLIENT_UI_PORT=3457 \
-  sh
+docker compose -f docker-compose.client.yml up -d --build
 ```
 
-Допустимы порты от `1024` до `65535`. Установщик не позволит выбрать занятый порт или один порт одновременно для интерфейса и прокси.
-
-## Правила маршрутизации
-
-После добавления подписки откройте «Правила маршрутизации» справа от основного экрана. При первом обновлении Harbor добавит включённое правило `*.ru → Напрямую`. Для каждого точного домена, suffix или фрагмента имени можно выбрать результат `VPN` либо `Напрямую`, выключить правило или удалить его. Правила проверяются сверху вниз, первое совпадение выбирает маршрут. Чтобы изменить порядок, возьмите строку за три точки слева и перетащите; с клавиатуры нажмите на этом хвате `Space` или `Enter`, переместите правило стрелками и повторно нажмите для размещения.
-
-Правила применяются только к трафику, который вошёл в VPN-маршрутизацию Harbor. Устройство Gateway в режиме «Напрямую» и Connect при активном Harbor Gateway обходят локальный список; «Напрямую» внутри правила — результат уже найденного совпадения. Для устройства Gateway с маршрутом `VPN` и при обычном локальном VPN список применяется.
-
-Полный URL можно вставить в поле точного домена, но Harbor сохранит только hostname. Путь и параметры HTTPS зашифрованы и недоступны sing-box на уровне маршрутизации. GeoSite, GeoIP и подключаемые списки пока не поддерживаются.
-
-При сохранении Harbor проверяет фактическое состояние sing-box. Работающий процесс применяет новую конфигурацию, только если она изменилась. Если sing-box остановлен, правила сохраняются с признаком «ждут запуска» и начнут работать при следующем запуске или restart; в Connect с активным Harbor Gateway они сохраняются как желаемые, но локально не применяются.
-
-## Системный прокси macOS
-
-Сначала посмотрите точное имя сетевого подключения:
-
-```bash
-networksetup -listallnetworkservices
-```
-
-Для подключения с именем `Wi-Fi` включите HTTP, HTTPS и SOCKS5-прокси:
-
-```bash
-networksetup -setwebproxy Wi-Fi 127.0.0.1 8082
-networksetup -setsecurewebproxy Wi-Fi 127.0.0.1 8082
-networksetup -setsocksfirewallproxy Wi-Fi 127.0.0.1 8082
-```
-
-Чтобы отключить их:
-
-```bash
-networksetup -setwebproxystate Wi-Fi off
-networksetup -setsecurewebproxystate Wi-Fi off
-networksetup -setsocksfirewallproxystate Wi-Fi off
-```
-
-Если сетевое подключение называется иначе, замените `Wi-Fi` его точным именем.
-
-## Автоматическое использование домашнего Gateway
-
-Harbor Connect раз в пять секунд узнаёт у macOS адрес текущего основного шлюза. Если по этому адресу работает Harbor Gateway с той же выбранной VPN-подпиской, Connect оставляет локальный прокси доступным для приложений, но не создаёт второй VPN-маршрут: трафик уже обрабатывает Gateway.
-
-Для этого:
-
-1. добавьте одну и ту же ссылку подписки в Gateway и Connect и выберите соответствующий профиль на обоих устройствах;
-2. убедитесь, что Mac может открыть интерфейс Gateway на порту `3456`;
-3. оставьте автоматический режим включённым в Harbor Connect.
-
-Ссылка должна содержать персональный секрет или token длиной не менее 16 символов — обычные ссылки подписок уже соответствуют этому условию. Ссылка между устройствами не передаётся: она используется локально для проверки, что Connect нашёл именно ваш Gateway. До отдельного pairing-flow Connect не получает от Gateway имя фактически применённых подписки и сервера, поэтому в режиме Gateway честно показывает `Gateway · сервер не определён`. При смене сети или после трёх неудачных проверок Connect возвращается к локальному VPN.
-
-## Повседневные команды
-
-Все команды Gateway выполняются из каталога проекта. Команды Connect — из `~/.vpn-proxy-client`.
-
-### Harbor Gateway
-
-| Действие | Команда |
-| --- | --- |
-| Запустить или обновить после изменения файлов | `docker compose -f docker-compose.gateway.yml up -d --build` |
-| Обновить только интерфейс и управление | `docker compose -f docker-compose.gateway.yml build vpn-proxy-control && docker compose -f docker-compose.gateway.yml up -d --no-deps vpn-proxy-control` |
-| Показать состояние | `docker compose -f docker-compose.gateway.yml ps` |
-| Смотреть журнал | `docker compose -f docker-compose.gateway.yml logs -f` |
-| Перезапустить только интерфейс и управление | `docker compose -f docker-compose.gateway.yml restart vpn-proxy-control` |
-| Перезапустить VPN dataplane | `docker compose -f docker-compose.gateway.yml restart vpn-proxy-dataplane` |
-| Остановить | `docker compose -f docker-compose.gateway.yml down` |
-| Удалить вместе с сохранёнными данными | `docker compose -f docker-compose.gateway.yml down -v` |
-
-### Harbor Connect
+Перезапуск и логи:
 
 ```bash
 cd ~/.vpn-proxy-client
+docker compose -f docker-compose.client.yml logs -f
+docker compose -f docker-compose.client.yml restart
 ```
 
-| Действие | Команда |
-| --- | --- |
-| Обновить и снова запустить | `./scripts/install-macos-client.sh` |
-| Показать состояние | `docker compose -f docker-compose.client.yml ps` |
-| Смотреть журнал | `docker compose -f docker-compose.client.yml logs -f` |
-| Перезапустить | `docker compose -f docker-compose.client.yml restart` |
-| Остановить | `docker compose -f docker-compose.client.yml down` |
-| Удалить вместе с сохранёнными данными | `docker compose -f docker-compose.client.yml down -v` |
+## Windows: app proxy client
 
-Команда с `-v` удаляет подписку, выбранный сервер и другие сохранённые данные. Для обычной остановки используйте `down` без `-v`.
+Windows mode restores the native workflow for Discord, Vesktop, games, and other apps that do not expose proxy settings.
 
-## Обновление
+Run PowerShell 7 as Administrator. While this branch is being tested, install from `codex-windows-client`:
 
-### Gateway
+```powershell
+irm https://git.dokops.ru/dokril/vpn-proxy/raw/branch/codex-windows-client/scripts/install-windows-client.ps1 | iex
+```
+
+Installer modes:
+
+- `Full install`: local native `sing-box.exe` on `127.0.0.1:1080` plus ProxiFyre/WinPacketFilter.
+- `ProxiFyre only`: ProxiFyre/WinPacketFilter only, pointed at an existing SOCKS5 proxy such as `127.0.0.1:8080` or `192.168.50.111:8080`.
+
+The installer keeps profile data under `C:\Tools\vpn-proxy-windows\data`, so rerunning it can replace app files without deleting saved profiles.
+
+Local UI:
+
+```text
+http://127.0.0.1:3456
+```
+
+Recovery commands:
+
+```powershell
+& "C:\Tools\vpn-proxy-windows\app\scripts\windows\manage.ps1" -OpenUi
+& "C:\Tools\vpn-proxy-windows\app\scripts\windows\manage.ps1" -Status
+& "C:\Tools\vpn-proxy-windows\app\scripts\windows\manage.ps1" -RestartServices
+```
+
+The UI manages profiles made of process names, folders, and explicit `.exe` files. It generates ProxiFyre config and restarts ProxiFyre only when the user applies changes.
+
+---
+
+# VPN Proxy Gateway
+
+Самохостируемый прозрачный VPN-шлюз на базе [sing-box](https://sing-box.sagernet.org/).  
+Разворачивается в Docker (LXC, VPS), перехватывает трафик всей локальной сети через iptables TProxy — без клиентов на устройствах.
+
+Веб-интерфейс на React даёт полное управление: подписки, выбор сервера, кастомные правила маршрутизации, просмотр трафика в реальном времени.
+
+---
+
+## Архитектура
+
+```
+Клиент (ПК/телефон)
+    │  TCP/UDP трафик
+    ▼
+[Роутер] → маршрут по умолчанию → LXC/VPS (gateway)
+    │
+    ▼
+iptables mangle PREROUTING → цепочка VPN_PROXY_TPROXY
+    │
+    ├─ ipset vpn_direct_bypass (dst IP) → RETURN  ← опциональный bypass-кэш
+    ├─ приватные CIDR (RFC1918, ...)    → RETURN
+    └─ TCP/UDP                          → TPROXY :7895
+                    │
+                    ▼
+              sing-box (tproxy inbound :7895)
+                    │
+            роутинг по правилам
+                    │
+         ┌──────────┼──────────┐
+         ▼          ▼          ▼
+      direct     VPN out    block
+```
+
+ПК-приложения, которым нужен VPN явно:
+
+```
+Windows app → ProxiFyre/Proxifier → gateway:8080 → sing-box mixed-in → global rules → default VPN
+```
+
+**Node.js API-сервер** (`src/server/index.js`) работает внутри того же контейнера:  
+управляет процессом sing-box, парсит его логи, экспортирует REST API и SSE-стримы для веб-интерфейса.
+
+---
+
+## Стек
+
+| Слой             | Технология                                                    |
+| ---------------- | ------------------------------------------------------------- |
+| Контейнер        | Docker, `network_mode: host`, `CAP_NET_ADMIN` + `CAP_NET_RAW` |
+| Перехват трафика | iptables TProxy + iproute2 policy routing                     |
+| Bypass-кэш       | опциональный ipset `hash:ip` с TTL                            |
+| VPN-ядро         | sing-box (VLESS/VLESS-Reality/VMess/Trojan/Hysteria2/SS)      |
+| API-сервер       | Node.js 18, plain `http` (без фреймворков)                    |
+| Веб-интерфейс    | React 18 + Vite 7, SPA                                        |
+
+---
+
+## Как работает прозрачное проксирование
+
+### 1. TProxy и policy routing
+
+При старте контейнера `entrypoint.sh` настраивает ядро:
 
 ```bash
-git pull --ff-only
-docker compose -f docker-compose.gateway.yml up -d --build
+# Policy routing: пакеты с меткой TPROXY_MARK уходят через loopback
+ip rule add fwmark 1 table 100
+ip route replace local 0.0.0.0/0 dev lo table 100
+
+# Цепочка iptables (порядок правил — критичен)
+iptables -t mangle -N VPN_PROXY_TPROXY
+  -m addrtype --dst-type LOCAL          → RETURN   # ответы самого sing-box
+  -m mark --mark 1                      → RETURN   # уже помеченные пакеты
+  -m set --match-set vpn_direct_bypass  → RETURN   # только если DIRECT_BYPASS_CACHE=true
+  -d 10.0.0.0/8, 192.168.0.0/16, ...   → RETURN   # приватные адреса
+  -p tcp                                → TPROXY :7895 mark 1
+  -p udp                                → TPROXY :7895 mark 1
+iptables -t mangle -A PREROUTING -j VPN_PROXY_TPROXY
 ```
 
-### Connect
+При остановке контейнера (`SIGTERM`) все правила iptables удаляются идемпотентно.  
+ipset-кэш намеренно **не** очищается — записи истекают по TTL.
 
-Повторно запустите однострочный установщик. Он обновит рабочую копию, снова спросит порт прокси и пересоберёт Connect:
+### 2. Маршрутизация внутри sing-box
+
+Каждый пакет проходит правила в порядке приоритета — **первое совпадение побеждает**:
+
+| Приоритет | Условие                                     | Действие                                 |
+| --------- | ------------------------------------------- | ---------------------------------------- |
+| 1         | `ip_is_private: true`                       | `direct` (защита LAN)                    |
+| 2         | Global custom rules                         | `direct` / VPN / `block` для всех inbound |
+| 3         | `rule_set: [geoip-ru, geosite-category-ru]` | `direct`                                  |
+| 4         | Device defaults для `tproxy-in`             | `direct` / VPN / `block`                 |
+| 5         | Proxy default для `mixed-in`                | по умолчанию VPN                         |
+| 6         | Transparent default для unknown devices     | по умолчанию VPN                         |
+| 7         | Всё остальное (`final`)                     | `direct`                                 |
+
+Конфиг генерируется динамически через `buildGatewayConfig()` из подписки + сохранённых правил. Перед применением выполняется `sing-box check`.
+
+### 3. Bypass Mode (весь трафик напрямую)
+
+Кнопка "Весь трафик напрямую" в дашборде. При активации `buildGatewayConfig()` вызывается с `{ bypassAll: true }` — в конфиге убираются все rule_set, `final: "direct"`. Удобно для диагностики или когда VPN не нужен.
+
+---
+
+## Direct Bypass Cache (ipset)
+
+Оптимизация выключена по умолчанию: `DIRECT_BYPASS_CACHE=false`. Причина — dst-IP cache обходит sing-box до проверки global rules, а значит может нарушить требования вида `AI → VPN` или `blocked → block`.
+
+Если явно включить `DIRECT_BYPASS_CACHE=true`, IP-адреса, которые sing-box уже отправил напрямую, кэшируются в ядре и больше не проходят через userspace.
+
+**Цепочка событий:**
+
+1. sing-box маршрутизирует соединение как `direct`, пишет в лог:  
+   `[TCP] 192.168.1.5:54321 --> 203.0.113.10:443 outbound/direct[direct]`
+
+2. Node.js парсит строку (regex `-->` + `outbound/`). Если `category === "direct"` и назначение — IPv4-адрес:
+
+   ```bash
+   ipset add vpn_direct_bypass 203.0.113.10 timeout 3600 -exist
+   ```
+
+3. Следующий пакет к `203.0.113.10` обрабатывается iptables **до** передачи в sing-box:
+
+   ```
+   -m set --match-set vpn_direct_bypass dst → RETURN
+   ```
+
+   Пакет уходит напрямую на уровне ядра — нулевые накладные расходы userspace sing-box.
+
+4. Запись истекает через TTL (по умолчанию 1 час).
+
+```
+DIRECT_BYPASS_CACHE=false             # безопасное значение по умолчанию
+DIRECT_BYPASS_SET=vpn_direct_bypass   # имя ipset
+DIRECT_BYPASS_TTL=3600                # TTL в секундах
+```
+
+## Профили устройств
+
+Управляются из UI на вкладке **Маршрутизация** и сохраняются в `devices.json`:
+
+```json
+{
+  "defaultTransparentMode": "vpn",
+  "proxyDefaultMode": "vpn",
+  "devices": [
+    {
+      "id": "gaming-pc",
+      "name": "Gaming PC",
+      "ip": "192.168.1.50",
+      "mac": "",
+      "mode": "direct",
+      "enabled": true
+    },
+    {
+      "id": "phone",
+      "name": "Phone",
+      "ip": "192.168.1.60",
+      "mode": "vpn",
+      "enabled": true
+    }
+  ]
+}
+```
+
+| Mode     | Что делает                                                        |
+| -------- | ----------------------------------------------------------------- |
+| `direct` | fallback устройства после global rules → `direct`                 |
+| `vpn`    | fallback устройства после global rules → выбранный VPN            |
+| `block`  | fallback устройства после global rules → `block`                  |
+| `rules`  | не задаёт fallback устройства; используется transparent default   |
+
+`mixed-in` не зависит от режима устройства: если приложение явно пошло на `gateway:8080`, сначала применяются global rules, затем `proxyDefaultMode` (по умолчанию VPN).
+
+---
+
+## Кастомные правила маршрутизации
+
+Управляются из вкладки **Маршрутизация**. Сохраняются в `custom-rules.json`.
+Правила применяются в порядке отображения в UI — **first match wins**. Custom rules являются global rules: они применяются для `tproxy-in`, `mixed-in`, ПК, телефона и unknown devices до любых fallback-режимов.
+
+| Поле             | Тип                          | Описание                                    |
+| ---------------- | ---------------------------- | ------------------------------------------- |
+| `name`           | string                       | Название правила                            |
+| `enabled`        | bool                         | Вкл/выкл                                    |
+| `outbound`       | `direct` \| `vpn` \| `block` | Куда отправить трафик                       |
+| `domains`        | string[]                     | Точные домены (`example.com`)               |
+| `domainSuffixes` | string[]                     | Суффикс домена (`.example.com` + поддомены) |
+| `domainKeywords` | string[]                     | Keyword в имени хоста                       |
+| `ipCidrs`        | string[]                     | IP-диапазоны CIDR                           |
+| `ports`          | string[]                     | Порты или диапазоны (`443`, `8000-9000`)    |
+| `networks`       | `tcp` \| `udp`               | Протокол                                    |
+| `ruleSets`       | string[]                     | Ссылки на remote rule-set                   |
+
+UI автоматически детектирует конфликты — когда правило полностью перекрывается предыдущим.
+
+### Remote Rule Sets
+
+В **Настройках** можно добавить произвольные rule-set:
+
+```json
+{ "tag": "gaming-servers", "url": "https://...", "format": "binary" }
+```
+
+sing-box скачивает их при старте, кэширует в `cache.db`. Ключ кэша — SHA-1 от URL.
+
+---
+
+## Подписки
+
+Поддерживаемые форматы:
+
+- **JSON-конфиг sing-box** — объект с полем `outbounds[]`
+- **Base64-список VLESS-ссылок** — декодируется, каждая ссылка парсится
+- **Прямые VLESS URI** (`vless://uuid@host:port?...#tag`)
+
+После загрузки пользователь выбирает сервер → генерируется конфиг → `sing-box check` → перезапуск.
+
+Подписка кэшируется в `subscription-cache.json` — при рестарте контейнера конфиг автоматически пересоздаётся из кэша без повторного скачивания.
+
+---
+
+## Просмотр трафика
+
+Вкладка **Трафик** в разделе Логи. Данные приходят через SSE (`/api/traffic/stream`).
+
+### Парсинг логов sing-box
+
+Node.js читает stderr sing-box и извлекает трафик двумя шагами:
+
+```
+[router] match[2][my-rule] => outbound/direct[direct]   ← имя правила
+[TCP] 192.168.1.5:PORT --> example.com:443 outbound/vpn[tag]   ← соединение
+```
+
+1. `[router]`-строка → имя правила сохраняется с TTL 500 мс
+2. Следующая строка с `-->` подхватывает имя в поле `matchedRule`
+3. Тип трафика: `direct` / `vpn` / `block` по outbound
+4. Direct + IPv4 → добавление в ipset bypass-кэш, только если `DIRECT_BYPASS_CACHE=true`
+
+### Группировка и сортировка
+
+`(category, host, port, matchedRule)` объединяются в группу с счётчиком:
+
+- **По частоте** — самые частые наверху (по умолчанию)
+- **По времени** — последние наверху
+
+---
+
+## Проверка маршрута
+
+Вкладка **Проверка** позволяет узнать, по какому правилу пойдёт трафик к хосту/IP/порту — без реального подключения. Node.js (`routeMatcher.js`) симулирует ту же логику, что и sing-box:
+
+1. private IP → direct
+2. global custom rules
+3. geoip-ru / geosite-category-ru → direct
+4. `tproxy-in` + device default
+5. `mixed-in` + proxy default
+6. final → direct
+
+---
+
+## Быстрый старт
 
 ```bash
-curl -fsSL https://git.dokops.ru/dokril/vpn-proxy/raw/branch/master/install.sh | sh
+# Сборка фронтенда
+npm install && npm run build
+
+# Запуск контейнера
+docker compose -f docker-compose.gateway.yml up -d
 ```
 
-Если раньше использовался нестандартный порт, укажите его снова через `VPN_PROXY_CLIENT_PORT`.
-
-### Версии
-
-Текущая версия всегда показана в правом нижнем углу интерфейса. Connect показывает строку `M` (Mac client). Gateway показывает `C` (Gateway client UI), `B` (текущий control-backend) и `D` (фактически развёрнутый dataplane). Поэтому после control-only deploy `B` обновится сразу, а `D` может намеренно остаться на прежней версии до следующего runtime-deploy. Наведите курсор или переведите клавиатурный фокус на цифру, чтобы увидеть смысл `major`, `minor` или `hotfix`; у `D` также указана фактическая версия `sing-box`.
-
-Компонентные версии меняются в `src/shared/versions.ts`. У всех компонентов должен совпадать `major`, у Gateway client и backend — `major.minor`; `hotfix` может отличаться. Runtime-значения доступны через `GET /api/version`.
-
-Для изменения версии используйте `npm run version:harbor -- affected HEAD`, затем `npm run version:harbor -- bump <major|minor|hotfix> [компонент]` и `npm run version:harbor -- check HEAD`. Правила выбора уровня закреплены в обязательном repo skill `manage-harbor-versions`.
-
-## Настройки `.env`
-
-Для большинства установок достаточно стандартных значений.
-
-| Переменная | По умолчанию | Назначение |
-| --- | --- | --- |
-| `PORT` | `3456` | Внутренний порт веб-интерфейса Gateway |
-| `CLIENT_UI_PORT` | `3456` | Порт интерфейса Connect на Mac |
-| `PROXY_PORT` | `8080` | Порт общего прокси Gateway |
-| `CLIENT_PROXY_PORT` | `8082` | Порт локального прокси Connect |
-| `HARBOR_GATEWAY_CONTROL_PORT` | `3456` | Порт, на котором Connect проверяет домашний Gateway |
-| `PROXY_BIND_IP` | `0.0.0.0` | Адрес, на котором Gateway принимает прокси-подключения |
-| `PROXY_ALLOWED_CIDRS` | приватные IPv4-сети | Сети, которым разрешён доступ к Gateway Proxy |
-| `GATEWAY_CLIENT_CIDRS` | приватные IPv4-сети | Сети, трафик которых Gateway может маршрутизировать |
-| `DIRECT_TRAFFIC_MARK` | `0x40000000` | Зарезервированный одиночный connmark-бит учёта Direct; измените при конфликте с host QoS/firewall, не пересекаясь с `TPROXY_MARK` |
-| `SING_BOX_TRAFFIC_SOURCE` | `native` | Источник Gateway traffic counters: `snapshot`, `shadow` или `native` |
-| `LOG_LEVEL` | `info` | Уровень подробности журнала |
-
-Остальные значения в `.env.example` относятся к сборке контейнера и внутренней маршрутизации. Меняйте их только при нестандартном развёртывании.
-
-После изменения `.env` пересоздайте контейнер командой `up -d` — обычного `restart` недостаточно.
-
-Production Gateway по умолчанию использует `native`: новый счётчик видит полный жизненный цикл соединений, включая короткие соединения и последние байты перед закрытием. `shadow` оставляет основным старый счётчик и запускает новый только для сравнения. `snapshot` полностью выключает инспектор и опрашивает активные соединения раз в 2 секунды. Режим меняется только при пересоздании обоих Gateway-контейнеров и не переключается автоматически при ошибке, чтобы одни байты не были посчитаны дважды.
-
-Rollback сохраняет volumes и возвращает прежний writer:
+Если Docker Hub отвечает таймаутом на `debian:bookworm-slim`, можно собрать через read-through mirror:
 
 ```bash
-SINGBOX_VERSION=1.13.18 \
-SING_BOX_TRAFFIC_SOURCE=snapshot \
-docker compose -f docker-compose.gateway.yml up -d --build
+BASE_IMAGE=mirror.gcr.io/library/debian:bookworm-slim \
+docker compose -f docker-compose.gateway.yml build
+
+docker compose -f docker-compose.gateway.yml up -d
 ```
 
-## Локальная история трафика
-
-Harbor полностью работает без Prometheus. В существующем drawer «Трафик» режимы `Сейчас / История` разделяют текущие соединения и локальные суммы. История поддерживает `24 часа / 7 дней / 30 дней / 90 дней`, поиск, маршрут и устройство на Gateway; строки раскрываются как сервис → домен → полное имя → IP. Например, `www.yandex.ru` и `mail.yandex.com` остаются разными именами внутри группы «Яндекс». IP без наблюдённого домена не выдаётся за распознанный сайт.
-
-`traffic.sqlite` хранит рабочие данные за 90 дней: завершённые минуты за последние 7 дней, далее часы. Текущая история отстаёт не более чем на минуту при исправном сборе; API сообщает фактически доступный период, детализацию и пропуски. История начинается с включения нового native-сбора. Данные по доменам относятся только к соединениям, наблюдаемым sing-box, и не восстанавливают ранее накопленные общие счётчики.
-
-Запись и запросы выполняются в отдельном рабочем потоке. Ошибка базы или переполнение ограниченной очереди отмечает историю как неполную, но не останавливает VPN или экспорт метрик. Для защиты от повторного учёта сохраняются позиции счётчиков: активные — пока нужны их исходные значения, закрытые — до 90 дней либо смены процесса sing-box. Размер зависит не только от доменов, но и от числа соединений; это не база фиксированного размера. Освобождённые страницы переиспользуются без обязательного немедленного уменьшения файла.
-
-## Prometheus и Grafana
-
-Prometheus необязателен. Он хранит только экспортируемые метрики по политике своего владельца, а не копию всей SQLite. Полную доменную/IP-детализацию внешнего архива этот релиз не обещает. Нет синхронизации баз, автоматического восполнения пропущенных scrape, восстановления SQLite из Prometheus или переключения интерфейса на него. Очистка локальной истории не удаляет внешнюю; отсутствие Prometheus не продлевает локальные 90 дней.
-
-Gateway публикует уже накопленные Harbor traffic counters по адресу `http://<gateway>:3456/metrics`. Scrape не запускает дополнительный netfilter read и не меняет сохранённое состояние. Harbor обновляет snapshot раз в 15 секунд, поэтому рекомендуемый начальный scrape interval и refresh dashboard — 30 секунд:
-
-```yaml
-scrape_configs:
-  - job_name: harbor_gateway
-    scrape_interval: 30s
-    scrape_timeout: 3s
-    metrics_path: /metrics
-    static_configs:
-      - targets: ["<gateway>:3456"]
-```
-
-`harbor_traffic_bytes_total` содержит общий накопленный объём по источникам Gateway/Proxy. `harbor_device_traffic_bytes_total` содержит upload/download по стабильному `device_id`; пользовательское название и текущий IP находятся в `harbor_device_info`. Gauge `harbor_device_applied_policy{device_id}` показывает последнюю применённую policy: `0` для Direct и `1` для VPN. История начинается с первого Prometheus scrape после обновления и не восстанавливается задним числом. `harbor_device_domain_traffic_bytes_total` добавляет наблюдённые домен, сервис, источник и направление для каждого устройства. `harbor_domain_traffic_attribution_events_total{outcome}` помогает отличить нераспознанный hostname, неизвестное устройство и неподдерживаемый inbound без динамических high-cardinality labels.
-
-Фактический выход экспортируется отдельно. `harbor_singbox_tracked_bytes_total{source,outbound,direction}` показывает наблюдённые sing-box байты с `outbound="vpn|direct|unknown"`; вариант с префиксом `harbor_device_...` добавляет `device_id`. `harbor_direct_ipv4_packet_bytes_total{direction}` считает IPv4-пакеты, которые Gateway направил напрямую вместо sing-box, включая policy Direct и работу при остановленном VPN runtime; вариант `harbor_device_...` содержит атрибутированную детализацию. `source="gateway|proxy"` по-прежнему означает место входа, а `outbound` — выбранный sing-box выход.
-
-Dashboard начинает со скорости скачивания и отправки в конце выбранного периода, общего трафика и фактического VPN / Direct за этот период. Под обзором полоса `Применённый режим` показывает applied policy устройства, а график `Фактический VPN / Direct` независимо показывает маршрут наблюдённых байтов. Поэтому компьютер с policy Direct, браузер которого использует Harbor Proxy, остаётся Direct на полосе режима, но его proxy-соединения учитываются в VPN. Единый фильтр `Устройства` управляет режимом, скоростью, общим трафиком, сервисами, доменами и технической детализацией. Таблица «Все устройства за период» намеренно остаётся общей и выбирает устройство в том же фильтре. Блок «Куда уходит трафик» показывает основные назначения и Top-15 доменов без пагинации. Свёрнутая техническая детализация показывает `source × outbound`, включая `proxy · vpn`, и раздельные Direct-пути через sing-box и Linux мимо sing-box. Автообновление настроено на 30 секунд; индикатор предупреждает после 60 секунд и считает данные устаревшими после 120 секунд.
-
-В `snapshot` и `shadow` domain и sing-box outbound counters снимаются с активных соединений раз в 2 секунды. В `native` dataplane получает полный lifecycle, включая короткие соединения и финальный хвост; существующая проекция экспортируемых domain/outbound counters хранится в памяти до перезапуска, а необязательный Prometheus независимо сохраняет полученные метрики. Полный поток также поступает в отдельную локальную `traffic.sqlite`; её очистка не сбрасывает эту проекцию. Перед routing sing-box до 1 секунды распознаёт HTTP Host, TLS SNI и QUIC Server Name. YouTube и OpenAI / ChatGPT объединяются по известным связанным доменам в label `service`, остальные значения сохраняют домен как имя сервиса. Если устройство и Harbor source известны, но hostname недоступен (например, ECH или IP-only), трафик попадает в `domain="_unknown",service="Не распознано"` и не теряется. Новые domain series сверх process limit складываются в `_other`.
-
-Состояние collector и сравнение `shadow` экспортируются отдельными bounded gauges `harbor_traffic_collector_*` и `harbor_traffic_shadow_*`. Они не содержат UUID, IP, домены или пользовательские имена и не заменяют canonical traffic counters.
-
-Direct IPv4 считает L3 packet bytes с IP-заголовками и retransmit, а sing-box tracker считает логические TCP/UDP bytes без tunnel overhead. Основные Grafana panels складывают их только как приблизительную пользовательскую оценку непересекающихся Direct-путей; техническая секция сохраняет значения раздельными. Эту сумму нельзя считать точным provider или wire total. Snapshot polling может пропустить короткие соединения и финальный хвост; native lifecycle закрывает этот разрыв только для трафика, вошедшего в sing-box. IPv6, трафик вне Gateway, назначения из `BYPASS_CIDRS` и quota провайдера не входят в route split.
-
-Готовый dashboard: [`monitoring/grafana/harbor-gateway.json`](monitoring/grafana/harbor-gateway.json). При импорте Grafana попросит выбрать Prometheus data source. Та же конфигурация и dashboard доступны для копирования в Gateway drawer «Как использовать» → «Prometheus и Grafana».
-
-## Если что-то не работает
-
-### Интерфейс не открывается
-
-Проверьте контейнер и журнал:
+Если сборку нужно выполнять на контейнере/хосте, который уже ходит через рабочий gateway, а запускать image на другом:
 
 ```bash
-docker compose -f docker-compose.gateway.yml ps
-docker compose -f docker-compose.gateway.yml logs --tail=100
+BUILD_HOST=107 DEPLOY_HOST=111 ./scripts/build-on-107-deploy-111.sh
 ```
 
-Для Connect замените имя файла на `docker-compose.client.yml` и выполняйте команду из `~/.vpn-proxy-client`.
+Скрипт собирает image на `BUILD_HOST`, переносит его на `DEPLOY_HOST` через `docker save | docker load` и запускает без `docker pull`. Если `107`/`111` не являются SSH-алиасами, укажите реальные адреса, например `BUILD_HOST=root@192.168.1.107 DEPLOY_HOST=root@192.168.1.111`.
 
-### Прокси не отвечает
-
-Убедитесь, что Harbor включён в интерфейсе, а приложение использует правильные адрес и порт. Для Connect это обычно `127.0.0.1:8082`; для Gateway — IP Linux-машины и порт `8080`.
-
-### Connect не распознаёт Gateway
-
-Проверьте три условия:
-
-- Gateway является текущим основным шлюзом Mac;
-- на обоих устройствах сохранена одна и та же подписка;
-- с Mac открывается `http://АДРЕС-GATEWAY:3456`.
-
-### Проверка конфигурации без запуска
+Чтобы не получать циклическую зависимость "собрать gateway можно только через уже работающий gateway", подготовьте runtime base на `107` один раз:
 
 ```bash
-docker compose -f docker-compose.gateway.yml config
-docker compose -f docker-compose.client.yml config
-docker compose -f docker-compose.client.local.yml config
+./scripts/build-runtime-base.sh
 ```
 
-Эти команды только проверяют и показывают итоговую конфигурацию Docker Compose.
+После этого CI и `build-on-107-deploy-111.sh` используют локальный `vpn-proxy-runtime-base:bookworm-slim`: основная сборка gateway больше не делает `apt-get`, не качает sing-box и не обращается к Docker Hub за base image.
 
-### Локальное тестирование Harbor Connect
+UI доступен на `http://<gateway-ip>:3456`.
 
-Тестовый Connect запускается рядом с установленным клиентом и использует отдельные контейнер, volumes и порты:
+На роутере указать шлюз по умолчанию (или нужные подсети) на IP контейнера.
 
-```bash
-docker compose -f docker-compose.client.local.yml up -d --build
+---
+
+## Переменные окружения
+
+| Переменная          | По умолчанию         | Описание                               |
+| ------------------- | -------------------- | -------------------------------------- |
+| `APP_MODE`          | `gateway`            | `gateway` или `client`; compose клиента задаёт `client` автоматически |
+| `CLIENT_UI_PORT`    | `3456`               | Host-порт UI для `docker-compose.client.yml` |
+| `VPN_PROXY_CLIENT_UI_PORT` | unset        | UI-порт для macOS installer; записывается в `CLIENT_UI_PORT` |
+| `VPN_PROXY_CLIENT_PORT` | unset           | Proxy-порт для macOS installer; записывает `CLIENT_PROXY_PORT_START/END` |
+| `CLIENT_PROXY_PORT_START` | `8080`         | Первый host/container proxy-порт для `docker-compose.client.yml` |
+| `CLIENT_PROXY_PORT_END` | `8090`           | Последний host/container proxy-порт для `docker-compose.client.yml` |
+| `SHARED_PROXY_HOST` | unset                | Явный host/IP, который gateway отдаёт в `/api/shared-proxy`; если не задан, берётся Host заголовок запроса |
+| `PORT`              | `3456`               | Порт веб-интерфейса                    |
+| `BASE_IMAGE`        | `debian:bookworm-slim` | Базовый Docker image для сборки; можно заменить на mirror |
+| `SINGBOX_VERSION`   | `1.12.13`            | Версия sing-box для Docker build       |
+| `INSTALL_RUNTIME_DEPS` | `true`            | Устанавливать runtime-пакеты в Docker build; `false` для подготовленного runtime base |
+| `INSTALL_SINGBOX`   | `true`               | Скачивать sing-box в Docker build; `false` для подготовленного runtime base |
+| `PROXY_PORT`        | `8080`               | HTTP/SOCKS mixed inbound               |
+| `TPROXY_PORT`       | `7895`               | TProxy inbound sing-box                |
+| `DATA_DIR`          | `/var/lib/vpn-proxy` | Директория данных (volume)             |
+| `ROUTING_RU_DIRECT` | `true`               | geoip-ru/geosite-ru → direct           |
+| `LOG_LEVEL`         | `info`               | Уровень логов sing-box                 |
+| `DIRECT_BYPASS_CACHE` | `false`            | Включить dst-IP bypass cache; по умолчанию выключен |
+| `DIRECT_BYPASS_SET` | `vpn_direct_bypass`  | Имя ipset bypass-кэша                  |
+| `DIRECT_BYPASS_TTL` | `3600`               | TTL записей (секунды)                  |
+| `RULE_SET_DOWNLOAD_DETOUR` | `vpn`          | Через какой outbound sing-box скачивает remote rule-set; `vpn` = выбранный сервер |
+| `PROXY_BIND_IP`     | `0.0.0.0`            | Bind для HTTP/SOCKS в LAN; можно сузить до IP gateway |
+| `PROXY_FIREWALL`    | `true`               | Закрыть `PROXY_PORT` не из allowed CIDR |
+| `PROXY_ALLOWED_CIDRS` | `10.0.0.0/8 172.16.0.0/12 192.168.0.0/16` | Кто может подключаться к mixed proxy |
+
+---
+
+## REST API
+
+| Метод     | Путь                   | Описание                             |
+| --------- | ---------------------- | ------------------------------------ |
+| `GET`     | `/api/state`           | Полное состояние системы             |
+| `GET`     | `/api/shared-proxy`    | Проверка и параметры общего gateway proxy |
+| `POST`    | `/api/subscription`    | Загрузить подписку по URL            |
+| `POST`    | `/api/apply`           | Применить сервер (`{ selectedTag }`) |
+| `GET`     | `/api/servers`         | Список серверов из кэша              |
+| `GET/PUT` | `/api/rules`           | Кастомные правила                    |
+| `GET/PUT` | `/api/devices`         | Профили устройств и default fallback |
+| `GET/PUT` | `/api/rule-sets`       | Кастомные remote rule-set            |
+| `POST`    | `/api/singbox/start`   | Запустить sing-box                   |
+| `POST`    | `/api/singbox/stop`    | Остановить sing-box                  |
+| `POST`    | `/api/singbox/restart` | Перезапустить sing-box               |
+| `POST`    | `/api/bypass`          | `{ enabled }` — bypass mode          |
+| `GET`     | `/api/direct-cache`    | Состояние ipset bypass-кэша          |
+| `DELETE`  | `/api/direct-cache`    | Сбросить bypass-кэш                  |
+| `POST`    | `/api/route/check`     | Симулировать маршрут                 |
+| `POST`    | `/api/servers/ping`    | TCP-пинг до хоста                    |
+| `GET`     | `/api/logs/stream`     | SSE системных логов                  |
+| `GET`     | `/api/traffic/stream`  | SSE трафика                          |
+
+---
+
+## Структура проекта
+
+```
+├── Dockerfile                  # debian + sing-box + ipset + node
+├── entrypoint.sh               # iptables/ipset setup → запуск node
+├── docker-compose.gateway.yml
+├── src/
+│   ├── server/
+│   │   ├── index.js            # HTTP-сервер, управление sing-box, SSE
+│   │   ├── singbox.js          # генерация конфига sing-box
+│   │   ├── subscription.js     # парсинг подписок (JSON/VLESS/base64)
+│   │   ├── routeMatcher.js     # симулятор маршрутизации
+│   │   ├── ping.js             # TCP-пинг и DNS-resolve
+│   │   └── config.js           # настройки из env
+│   └── web/
+│       ├── App.jsx             # корневой компонент, глобальный state
+│       ├── api.js              # обёртка fetch для API
+│       └── components/
+│           ├── OverviewPage.jsx    # дашборд, bypass-toggle
+│           ├── LogsPage.jsx        # трафик + системные логи
+│           ├── RoutingPage.jsx     # кастомные правила
+│           ├── ServersPage.jsx     # подписка и выбор сервера
+│           ├── SettingsPage.jsx    # rule-sets и настройки
+│           └── RouteChecker.jsx    # проверка маршрута
+└── docs/
+    └── roadmap.md
 ```
 
-Интерфейс доступен на `http://127.0.0.1:3457`, HTTP/SOCKS5-прокси — на `127.0.0.1:8083`. Остановить тестовый стек с сохранением его volumes можно командой:
+## Ограничения
 
-```bash
-docker compose -f docker-compose.client.local.yml down
-```
-
-Порты можно заменить через `LOCAL_CLIENT_UI_PORT` и `LOCAL_CLIENT_PROXY_PORT`.
-
-Для rollback canary на стабильный sing-box без инспектора используйте:
-
-```bash
-SINGBOX_VERSION=1.13.18 \
-SING_BOX_TRAFFIC_SOURCE=disabled \
-docker compose -f docker-compose.client.local.yml up -d --build
-```
-
-Не добавляйте `-v` к `down`, если хотите сохранить тестовые подписки и настройки.
-
-## Служебные команды
-
-Этот раздел нужен тем, кто собирает, проверяет или развёртывает сам проект. Для обычного использования он не требуется.
-
-### Команды npm
-
-Для сборки и backend закреплён Node **24.21.0** (`.node-version`); используется встроенная SQLite без ORM. `npm run check:runtime` проверяет точную Node-версию, движок SQLite не старше 3.51.3 и точность 64-битных счётчиков. Та же проверка выполняется в сборочных и конечных Docker-образах. При использовании fnm: `fnm use 24.21.0`.
-
-| Команда | Назначение |
-| --- | --- |
-| `npm ci` | Установить точные версии зависимостей из `package-lock.json` |
-| `npm test` | Запустить автоматические проверки |
-| `npm run build` | Собрать веб-интерфейс в `dist/` |
-| `npm run dev` | Запустить Vite для разработки интерфейса |
-| `npm start` | Запустить управляющий Node.js-сервис в подготовленном окружении |
-
-### Сборка и развёртывание
-
-| Команда | Назначение |
-| --- | --- |
-| `./scripts/build-runtime-base.sh` | Собрать базовый runtime-образ с Node.js, сетевыми утилитами и `sing-box` |
-| `./scripts/build-on-107-deploy-111.sh` | Собрать Gateway на хосте `107` и развернуть на хосте `111`; хосты меняются через `BUILD_HOST` и `DEPLOY_HOST` |
-| `GATEWAY_IMAGE=<образ> ./scripts/deploy-gateway.sh` | Развернуть уже собранный образ в `/opt/vpn-proxy` |
-| `./scripts/harbor-network-monitor.sh` | Один раз записать текущий Gateway macOS; обычно этот скрипт запускает установленный LaunchAgent |
-
-Отправка изменений в ветку `master` также запускает автоматическую сборку и развёртывание Gateway через Gitea Actions. Каждый деплой пересоздаёт `vpn-proxy-control`, поэтому строка `B` соответствует текущему коду API. Процесс `sing-box` и сетевые правила остаются в `vpn-proxy-dataplane`; он пересоздаётся только при изменении его runtime-зависимостей, а его фактическая версия показывается отдельно как `D`.
-
-## Хранение данных
-
-Подписка, выбранный сервер и состояние подключения хранятся в именованных Docker volumes. Поэтому обычные команды `restart`, `down`, обновление проекта и повторная сборка не удаляют настройки.
-
-На каждом Mac/Gateway свои `harbor.sqlite` (настройки, подписки, устройства, правила, накопленные счётчики и журнал) и `traffic.sqlite` (ограниченная история). Журнал сохраняет прежний предел 30 дней/10 000 событий; настройки не подчиняются retention истории. Секреты, hardware ID, генерируемый конфиг и кеш sing-box остаются файлами.
-
-Первый запуск транзакционно импортирует прежние JSON, сохраняя IDs, revisions и исходные значения счётчиков. После успеха SQLite становится единственным рабочим хранилищем; исходные JSON остаются неизменными резервными копиями, без параллельной записи. Повреждение или неизвестная версия останавливает миграцию без обнуления. Старый бинарник не читает новые данные: простой downgrade вернул бы устаревшие JSON. Правила backup и восстановления описаны в [state recovery](docs/recovery/state-recovery.md).
-
-Не публикуйте файл `.env`, ссылку подписки и содержимое Docker volumes. `.env` уже исключён из Git.
+- TProxy только IPv4. IPv6 — в roadmap.
+- DNS-перехват не включён; выдавайте клиентам DNS через DHCP роутера.
+- Gateway не видит имя процесса на клиентском ПК — правила для игр задаются через домены, CIDR и порты.

buf.gen.yaml

@@ -1,9 +0,0 @@
-version: v2
-clean: true
-inputs:
-  - directory: proto/sing-box/v1.14.0-rc.5
-plugins:
-  - local: protoc-gen-es
-    out: src/server/generated
-    opt:
-      - target=ts

context.md

@@ -1,209 +0,0 @@
-# Read-only аудит failover/failback
-
-## Короткий вывод
-
-Штатное переключение между `primary` и `reserve` меняет маршрут **только для новых соединений**. Уже установленные TCP/UDP-соединения не переносятся и не закрываются самим Harbor.
-
-Поэтому:
-
-- здоровая загрузка, игра или поток продолжаются через старый канал;
-- если старый канал действительно умер, существующая сессия может оборваться независимо от переключения;
-- после переключения новые соединения идут через новый канал;
-- бесшовной миграции уже открытого TCP/UDP-сеанса на другой внешний адрес нет.
-
-## 1. Точный механизм
-
-### Конфигурация
-
-Gateway собирает один dual-channel `sing-box` config:
-
-- `channel-primary`;
-- `channel-reserve`;
-- selector `channel-selector`;
-- стабильные `tproxy-in` и `mixed-in`;
-- отдельные diagnostic inbounds для проверки каждого канала.
-
-Пользовательский трафик направляется в selector, а selector настроен с:
-
-```text
-interrupt_exist_connections: false
-```
-
-См. `src/server/singbox.ts:204-247`.
-
-Роль меняется через localhost Clash API:
-
-- `PUT /proxies/channel-selector`;
-- затем Harbor читает selector обратно и подтверждает выбранную роль.
-
-См. `src/server/services/singboxSelectorService.ts:29-81`.
-
-Failover API доступен только в Gateway:
-
-- `PUT /api/failover`;
-- `POST /api/failover/pause`;
-- `POST /api/failover/switch`;
-- `POST /api/failover/check`.
-
-См. `src/server/http/routes/failoverRoute.ts:18-39`.
-
-Переключение selector не вызывает `sing-box` restart/apply/stop.
-
-### Автоматический failover
-
-`FailoverService`:
-
-1. Проверяет оба канала через отдельные diagnostic inbound и выбранные HTTPS-сервисы.
-2. Считает канал healthy только если все проверки успешны; неизвестный результат даёт `unknown`.
-3. При сбое primary ждёт `failureWindowMs`.
-4. Переключается на reserve только если reserve healthy.
-5. При включённом traffic guard ждёт свежий quiet-window.
-6. Перед самой сменой повторно проверяет здоровье и активность.
-7. Выполняет selector PUT, read-back и только после этого обновляет canonical applied state.
-
-См. `src/server/features/failover/failoverService.ts:225-245`, `:320-514`; state machine — `src/shared/failover.ts:278-354`.
-
-Дефолты:
-
-- проверка каждые 60 секунд;
-- сбой primary — 120 секунд;
-- восстановление primary — 15 минут;
-- quiet-window — 30 секунд;
-- активный трафик — выше 32 КБ/с;
-- минимум на reserve — 10 минут;
-- после 3 failover за 24 часа — карантин primary на 6 часов.
-
-См. `src/shared/failover.ts:137-148`.
-
-### Автоматический failback
-
-Отдельной реализации нет: это обратная ветка той же state machine.
-
-Из reserve Harbor возвращается на primary только после:
-
-- полного `recoveryWindowMs`;
-- `minimumReserveMs`;
-- окончания quarantine, если он действует;
-- quiet-window при включённом traffic guard;
-- подтверждения, что primary healthy.
-
-Причина переключения публикуется как `primary-recovered`. См. `src/shared/failover.ts:311-354`.
-
-## 2. Судьба существующих соединений
-
-| Событие | Уже открытый TCP/UDP flow | Новые соединения |
-|---|---|---|
-| Автоматический failover primary → reserve | Остаётся на прежнем outbound; Harbor его не закрывает и не мигрирует | Идут через reserve |
-| Автоматический failback reserve → primary | Остаётся на reserve | Идут через primary |
-| Ручной selector switch | Не закрывается, если старый outbound ещё работает | Сразу идёт через выбранную роль |
-| Pause | Ничего не меняет | Идут через текущую роль |
-| Disable failover | Selector и текущий маршрут не меняются; dual config временно остаётся загруженным | Идут через текущую роль |
-| Обычный stop/restart/config replacement | Процесс `sing-box` останавливается, поэтому TCP/UDP-сессии прерываются | После запуска — по новой конфигурации |
-| Реальная авария primary | Уже существующий flow может оборваться сам; Harbor не может перенести его на другой внешний IP | После selector switch новые flow идут через reserve |
-
-Проверка `interrupt_exist_connections: false` непосредственно подтверждена TCP- и UDP-fixture-тестом: существующие TCP socket и UDP association продолжают обмен после switch, а новые идут через reserve. См. `test/server/singbox-selector-capability.test.js:141-142`, `:237-356`.
-
-## 3. Отличия режимов
-
-### Ручное переключение
-
-`POST /api/failover/switch` вызывает selector напрямую:
-
-- traffic guard не проверяется;
-- состояние здоровья целевого канала backend не проверяет;
-- после успешного ручного переключения `failoverPolicy.paused` становится `true`;
-- автоматический failback не произойдёт, пока пользователь не возобновит автоматическое переключение.
-
-См. `src/server/features/failover/failoverService.ts:248-317`, `:614-631`.
-
-Это означает, что ручной switch может быть выполнен даже на канал, который сейчас не подтверждён healthy. Это важная оговорка.
-
-### Автоматический failover
-
-Автоматическое переключение:
-
-- ждёт failure window;
-- требует healthy reserve;
-- при включённом guard блокируется активным или неизвестным трафиком;
-- повторно валидирует условия непосредственно перед selector mutation;
-- не перезапускает `sing-box`.
-
-### Восстановление primary
-
-Восстановившийся primary не получает новые соединения сразу. Сначала выдерживаются recovery/hold/quarantine условия и quiet-window. Пока они не выполнены, новые подключения остаются на reserve.
-
-### Pause и Disable
-
-`pause` приостанавливает решения, но dual config и наблюдение остаются активными.
-
-`disable` останавливает scheduler, probes и failover activity collector, но не переключает selector и не перезапускает процесс. После обычного stop/следующего запуска собирается single-channel config.
-
-См. `README.md:78-84`, `docs/product/application-state.md:102-110`.
-
-## 4. Практические сценарии
-
-- **Загрузка файла:** при обычном автоматическом failover активная передача по умолчанию задерживает switch. Если primary всё же упал, текущая TCP-загрузка не переносится на reserve; она может завершиться ошибкой. Возобновление или новый HTTP-запрос после switch пойдёт через reserve.
-- **Игровая сессия:** существующий TCP-сеанс остаётся на старом канале. TCP-сессия оборвётся, если primary реально недоступен. UDP-flow также не мигрирует и может начать терять пакеты или истечь по timeout; новая сессия после switch пойдёт через reserve.
-- **Стрим:** активный поток обычно блокирует автоматический switch при включённом guard. Ручной switch может быть выполнен сразу, но существующий TCP/QUIC-поток остаётся на старом outbound. При аварии старого канала плеер должен переподключиться.
-- **WebSocket/долгий polling:** действующий flow не переносится; новые подключения после switch используют новую роль.
-- **Молчащее соединение:** наличие открытого socket само по себе не считается активностью. Guard смотрит на дельты переданных байтов.
-
-## 5. Условия и оговорки
-
-- Failover реализован только для **Gateway**, не для локального Connect или `gateway-direct`.
-- Активность собирается существующим `/connections` observer каждые 2 секунды, с bounded окном до 10 секунд. См. `src/server/index.ts:311-333`, `src/server/services/domainTrafficService.ts:323-416`, `:437-495`.
-- Короткое соединение, полностью завершившееся между двумя снимками, может не попасть в activity guard.
-- Неизвестная или устаревшая activity-информация блокирует автоматический switch; ручной switch остаётся доступен.
-- Отключение traffic guard разрешает автоматический switch без ожидания тишины, но `interrupt_exist_connections: false` всё равно защищает уже открытые connections от закрытия самим selector.
-- При изменении policy во время работающего single-channel VPN dual config становится `pending`; скрытого restart нет. См. `src/server/features/connection/connectionService.ts:140-201`, `:288-361`.
-- Явный stop/restart или обычная смена сервера вне активного failover уже является disruptive operation: `sing-box` получает SIGTERM и текущие сессии прекращаются. См. `src/server/singboxRuntime.ts:39-62`, `:65-122`.
-- Оба канала находятся в одном процессе `sing-box`; process-wide crash не защищён selector-механизмом.
-
-## 6. Основные файлы
-
-- `src/server/singbox.ts:204-247` — dual config, selector, inbound routing.
-- `src/server/services/singboxSelectorService.ts:29-81` — selector PUT/read-back.
-- `src/server/features/failover/failoverService.ts:225-245` — проверки каналов.
-- `src/server/features/failover/failoverService.ts:248-317` — selector switch, commit и rollback.
-- `src/server/features/failover/failoverService.ts:320-514` — автоматический раунд и traffic guard.
-- `src/server/features/failover/failoverService.ts:614-631` — ручное переключение.
-- `src/shared/failover.ts:137-148`, `:278-354` — дефолты и state machine.
-- `src/server/services/domainTrafficService.ts:129-160`, `:323-416`, `:437-495` — классификация и activity.
-- `src/server/features/connection/connectionService.ts:140-201`, `:243-361` — обычный apply/stop/restart.
-- `src/server/singboxRuntime.ts:39-122` — фактическая остановка и перезапуск процесса.
-- `README.md:78-84` — пользовательская документация.
-- `docs/product/application-state.md:102-110` — контракт состояния.
-- `workpack/tasks/TASK-021-auto-server-selection-failover.md:93-106`, `:187-204` — относящийся план и ограничения; задача не выбиралась и не изменялась.
-
-## 7. Тесты, подтверждающие выводы
-
-- `test/server/singbox-selector-capability.test.js:141-356`  
-  Интеграционная TCP/UDP-проверка: активный трафик задерживает failover, существующие TCP/UDP продолжают работать после switch, новые соединения идут через reserve, PID процесса не меняется. Тест opt-in и пропускается без `HARBOR_SINGBOX_IMAGE`.
-- `test/server/singbox-gateway-mode.test.js:69-110`  
-  Проверяет selector, `interrupt_exist_connections: false`, отдельные diagnostic routes и primary/reserve outbounds.
-- `test/server/failover-service.test.js:83-200`  
-  Failure window, traffic guard, both-unhealthy и failback recovery/hold/quarantine.
-- `test/server/failover-service.test.js:255-420`  
-  Disabled zero-work, отмена устаревших наблюдений и непосредственная revalidation активности.
-- `test/server/failover-service.test.js:423-520`  
-  Selector rollback, commit ordering и ручной switch с pause.
-- `test/server/domain-traffic.test.js:209-239`  
-  Activity считается по пользовательскому VPN traffic, diagnostic connection не блокирует switch.
-- `test/server/connection-service.test.js:265-310`, `:340-390`  
-  Restart dual config и rollback; pending edits для работающего single-channel.
-- `test/server/singbox-runtime.test.js:16-50`  
-  При изменении config runtime запускает новый процесс.
-- `test/server/failover-route.test.js:10-53`  
-  Gateway-only API и маршруты ручного switch/pause/check.
-- `test/web/failover-feature-contract.test.js:19-76`  
-  UI явно сообщает: новые подключения переключаются, открытые остаются на прежнем канале.
-
-## Review findings и residual risks
-
-- **medium — `src/server/features/failover/failoverService.ts:614-620`:** ручной switch не проверяет health целевого канала и не применяет traffic guard; он сразу меняет selector и ставит automation на pause.
-- **medium — `test/server/singbox-selector-capability.test.js:141-356`:** capability test opt-in и использует deterministic `direct` outbounds, а не реальный VLESS/Trojan outage.
-- **medium — `src/server/services/domainTrafficService.ts:414-416`, `:451-479`:** activity основана на polling и byte deltas; короткие или очень малые потоки могут не блокировать автоматическое решение.
-- **info — `src/server/singboxRuntime.ts:39-122`:** явный stop/restart отличается от selector switch и прерывает существующие соединения.
-- **info — архитектура одного процесса:** падение всего `sing-box` не компенсируется selector failover.
-
-Файлы не изменялись. Тесты и live Gateway в рамках read-only аудита не запускались.

docker-compose.client.local.yml

@@ -1,24 +0,0 @@
-name: harbor-connect-local
-
-services:
-  harbor-connect:
-    extends:
-      file: docker-compose.client.yml
-      service: harbor-connect
-    container_name: harbor-connect-local
-    environment:
-      PORT: ${LOCAL_CLIENT_UI_PORT:-3457}
-      PROXY_PORT: ${LOCAL_CLIENT_PROXY_PORT:-8083}
-    ports: !override
-      - "127.0.0.1:${LOCAL_CLIENT_UI_PORT:-3457}:${LOCAL_CLIENT_UI_PORT:-3457}"
-      - "127.0.0.1:${LOCAL_CLIENT_PROXY_PORT:-8083}:${LOCAL_CLIENT_PROXY_PORT:-8083}"
-    volumes: !override
-      - vpn-proxy-client-local-data:/var/lib/vpn-proxy
-      - sing-box-client-local-cache:/var/lib/sing-box
-      - ./.runtime:/run/harbor-host:ro
-    healthcheck:
-      test: ["CMD", "curl", "--noproxy", "*", "-fsS", "http://127.0.0.1:${LOCAL_CLIENT_UI_PORT:-3457}/api/state"]
-
-volumes:
-  vpn-proxy-client-local-data:
-  sing-box-client-local-cache:

docker-compose.client.yml

@@ -1,22 +1,23 @@
 services:
-  harbor-connect:
+  vpn-proxy-client:
     build:
       context: .
       dockerfile: Dockerfile.client
       args:
-        SINGBOX_VERSION: ${SINGBOX_VERSION:-1.14.0-rc.5}
-    container_name: harbor-connect
+        SINGBOX_VERSION: ${SINGBOX_VERSION:-1.12.13}
+    container_name: vpn-proxy-client
     environment:
       APP_MODE: client
       PORT: ${PORT:-3456}
-      PROXY_PORT: ${CLIENT_PROXY_PORT:-8082}
+      PROXY_PORT: ${CLIENT_PROXY_PORT_START:-8080}
+      CLIENT_PROXY_PORT_START: ${CLIENT_PROXY_PORT_START:-8080}
+      CLIENT_PROXY_PORT_END: ${CLIENT_PROXY_PORT_END:-8090}
       PROXY_BIND_IP: 0.0.0.0
       DATA_DIR: /var/lib/vpn-proxy
       SING_BOX_CONFIG: /etc/sing-box/config.json
       SING_BOX_CACHE: /var/lib/sing-box/cache.db
-      SING_BOX_TRAFFIC_SOURCE: ${SING_BOX_TRAFFIC_SOURCE:-native}
-      HARBOR_HOST_NETWORK_STATE: /run/harbor-host/network.json
-      HARBOR_GATEWAY_CONTROL_PORT: ${HARBOR_GATEWAY_CONTROL_PORT:-3456}
+      ROUTING_RU_DIRECT: ${ROUTING_RU_DIRECT:-true}
+      RULE_SET_DOWNLOAD_DETOUR: ${RULE_SET_DOWNLOAD_DETOUR:-vpn}
       LOG_LEVEL: ${LOG_LEVEL:-info}
       HTTP_PROXY: ""
       HTTPS_PROXY: ""
@@ -28,14 +29,13 @@ services:
       no_proxy: "localhost,127.0.0.1,host.docker.internal"
     ports:
       - "127.0.0.1:${CLIENT_UI_PORT:-3456}:${PORT:-3456}"
-      - "127.0.0.1:${CLIENT_PROXY_PORT:-8082}:${CLIENT_PROXY_PORT:-8082}"
+      - "127.0.0.1:${CLIENT_PROXY_PORT_START:-8080}-${CLIENT_PROXY_PORT_END:-8090}:${CLIENT_PROXY_PORT_START:-8080}-${CLIENT_PROXY_PORT_END:-8090}"
     volumes:
       - vpn-proxy-client-data:/var/lib/vpn-proxy
       - sing-box-client-cache:/var/lib/sing-box
-      - ./.runtime:/run/harbor-host:ro
     restart: unless-stopped
     healthcheck:
-      test: ["CMD", "curl", "--noproxy", "*", "-fsS", "http://127.0.0.1:${PORT:-3456}/api/state"]
+      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:${PORT:-3456}/api/state"]
       interval: 30s
       timeout: 5s
       retries: 3

docker-compose.gateway.yml

@@ -1,67 +1,26 @@
-x-gateway-image: &gateway-image
-  image: ${GATEWAY_IMAGE:-vpn-proxy-gateway:local}
-  build:
-    context: .
-    dockerfile: Dockerfile
-    args:
-      BASE_IMAGE: ${BASE_IMAGE:-debian:bookworm-slim}
-      SINGBOX_VERSION: ${SINGBOX_VERSION:-1.14.0-rc.5}
-      INSTALL_RUNTIME_DEPS: ${INSTALL_RUNTIME_DEPS:-true}
-      INSTALL_SINGBOX: ${INSTALL_SINGBOX:-true}
-
 services:
-  vpn-proxy-dataplane:
-    <<: *gateway-image
-    container_name: vpn-proxy-dataplane
+  vpn-proxy-gateway:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      args:
+        BASE_IMAGE: ${BASE_IMAGE:-debian:bookworm-slim}
+        SINGBOX_VERSION: ${SINGBOX_VERSION:-1.12.13}
+        INSTALL_RUNTIME_DEPS: ${INSTALL_RUNTIME_DEPS:-true}
+        INSTALL_SINGBOX: ${INSTALL_SINGBOX:-true}
+    container_name: vpn-proxy-gateway
     network_mode: host
     cap_add:
       - NET_ADMIN
       - NET_RAW
     env_file:
-      - path: .env
-        required: false
+      - .env
     environment:
-      APP_COMPONENT: dataplane
       DATA_DIR: /var/lib/vpn-proxy
-      SING_BOX_CONFIG: /var/lib/vpn-proxy/sing-box-config.json
       SING_BOX_CACHE: /var/lib/sing-box/cache.db
-      SING_BOX_TRAFFIC_SOURCE: ${SING_BOX_TRAFFIC_SOURCE:-native}
-      SING_BOX_API_SECRET: /var/lib/sing-box/api.secret
-      SING_BOX_RUNTIME_CONFIG: /var/lib/sing-box/runtime-config.json
-      DATAPLANE_SOCKET: /run/vpn-proxy/dataplane.sock
     volumes:
       - vpn-proxy-data:/var/lib/vpn-proxy
       - sing-box-cache:/var/lib/sing-box
-      - vpn-proxy-runtime:/run/vpn-proxy
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD", "curl", "--unix-socket", "/run/vpn-proxy/dataplane.sock", "-fsS", "http://localhost/status"]
-      interval: 5s
-      timeout: 3s
-      retries: 12
-      start_period: 5s
-
-  vpn-proxy-control:
-    <<: *gateway-image
-    container_name: vpn-proxy-gateway
-    env_file:
-      - path: .env
-        required: false
-    environment:
-      APP_COMPONENT: control
-      DATA_DIR: /var/lib/vpn-proxy
-      SING_BOX_CONFIG: /var/lib/vpn-proxy/sing-box-config.json
-      SING_BOX_CACHE: /var/lib/sing-box/cache.db
-      SING_BOX_TRAFFIC_SOURCE: ${SING_BOX_TRAFFIC_SOURCE:-native}
-      DATAPLANE_SOCKET: /run/vpn-proxy/dataplane.sock
-    ports:
-      - "${PORT:-3456}:${PORT:-3456}"
-    volumes:
-      - vpn-proxy-data:/var/lib/vpn-proxy
-      - vpn-proxy-runtime:/run/vpn-proxy
-    depends_on:
-      vpn-proxy-dataplane:
-        condition: service_healthy
     restart: unless-stopped
     healthcheck:
       test: ["CMD", "curl", "-fsS", "http://127.0.0.1:${PORT:-3456}/api/state"]
@@ -73,4 +32,3 @@ services:
 volumes:
   vpn-proxy-data:
   sing-box-cache:
-  vpn-proxy-runtime:

docker-compose.server.yml

@@ -0,0 +1,22 @@
+services:
+  vpn-proxy-gateway:
+    image: ${GATEWAY_IMAGE}
+    container_name: vpn-proxy-gateway
+    network_mode: host
+    cap_add:
+      - NET_ADMIN
+      - NET_RAW
+    env_file:
+      - .env
+    environment:
+      DATA_DIR: /var/lib/vpn-proxy
+      SING_BOX_CONFIG: /etc/sing-box/config.json
+      SING_BOX_CACHE: /var/lib/sing-box/cache.db
+    volumes:
+      - vpn-proxy-data:/var/lib/vpn-proxy
+      - sing-box-cache:/var/lib/sing-box
+    restart: unless-stopped
+
+volumes:
+  vpn-proxy-data:
+  sing-box-cache:

docs/design/responsive-layout.md

@@ -1,21 +0,0 @@
-# Harbor responsive layout
-
-The client page has three stable regions: the Harbor brand, the primary power control and the subscription/details form.
-
-## Desktop
-
-At widths above 920 px the main panel uses a symmetric three-column grid. Equal outer columns keep the power control on the exact horizontal center axis; the details form occupies the right column. The form has a viewport-relative maximum height and its own vertical scroll for unusually long content, so a large server list cannot move the power control away from the visual center.
-
-The no-subscription setup state collapses the panel to one column and centers the form. No `left` offset or translated absolute element participates in either layout.
-
-## Tablet and mobile
-
-At 920 px and below all main regions use one normal-flow grid column. The brand becomes an absolute header inside the page shell, while reserved top padding prevents it from overlapping the primary content. Errors become normal-flow rows instead of floating over nearby controls. Form width is capped by both the available space and a readable maximum.
-
-At 560 px and below spacing and drawer padding become more compact. Controls with a preferred fixed size, such as the duration switch, use `min(..., 100%)` so the primary flow remains available at 320 px.
-
-## Motion and overflow contract
-
-Layout properties are not animated. State feedback may animate opacity and blur, and the existing `prefers-reduced-motion` rules disable those transitions and animations. Drawers are capped at `100vw`; dialogs and inline content retain viewport-relative width limits.
-
-Automated source-contract tests protect the symmetric desktop grid, normal-flow narrow layout, viewport-safe control widths and reduced-motion fallback. Release acceptance still includes a rendered check at 390, 768 and 1440 px; TASK-017 will later make that browser matrix automatic in CI.

docs/product/application-state.md

@@ -1,130 +0,0 @@
-# Harbor application state v1
-
-`GET /api/state` is the canonical Harbor domain snapshot. Successful mutations return the same snapshot as `state`. The persisted owner is the `state` JSON document in `harbor.sqlite` (currently document schema v10). React keeps only drafts, disclosure, focus, animation and transport freshness.
-
-An abbreviated snapshot:
-
-```json
-{
-  "apiVersion": 1,
-  "revision": 42,
-  "mode": "client",
-  "profiles": [
-    {
-      "id": "profile_primary",
-      "label": "Личный",
-      "subscription": {
-        "status": "ready",
-        "host": "provider.example/…",
-        "fetchedAt": "2026-08-11T12:00:00.000Z",
-        "userInfo": {},
-        "lastRefreshAttemptAt": null,
-        "errorCode": null
-      },
-      "desiredServerId": "srv_amsterdam",
-      "servers": [
-        {
-          "id": "srv_amsterdam",
-          "label": "Amsterdam",
-          "host": "nl.example.net",
-          "port": 443,
-          "protocol": "vless"
-        }
-      ]
-    }
-  ],
-  "selection": {
-    "desiredProfileId": "profile_primary",
-    "desiredServerId": "srv_amsterdam",
-    "appliedProfileId": "profile_primary",
-    "appliedServerId": "srv_amsterdam",
-    "appliedServerSnapshot": {
-      "id": "srv_amsterdam",
-      "label": "Amsterdam",
-      "host": "nl.example.net",
-      "port": 443,
-      "protocol": "vless"
-    }
-  },
-  "operation": {
-    "kind": null,
-    "status": "idle",
-    "startedAt": null,
-    "error": null,
-    "profileId": null,
-    "serverId": null
-  }
-}
-```
-
-Every profile owns one private provider URL/config, public metadata, server list and desired server. The URL/config never enters the public snapshot. `subscription` and top-level `servers` remain a one-release projection of the desired profile for older clients; they are not a second owner.
-
-## Revision rules
-
-`revision` increases for every visible domain transition, including operation start, completion and failure. Commands carry `expectedRevision`; stale commands fail with `STATE_CONFLICT`. Duplicate profile labels are rejected by preflight without a provider request or revision change.
-
-The frontend accepts only newer snapshots. Equal revisions preserve object identity, and older polling responses cannot overwrite mutation results. After a failed mutation the browser immediately synchronizes the authoritative snapshot before allowing another command or retry.
-
-Browser boot/offline/stale state remains a transport envelope beside the domain snapshot. A transport failure retains the last accepted domain state.
-
-Failover health and traffic observations are transient: they do not write `state.json` or increase the domain `revision` every few seconds. Each control-process lifetime publishes a new `observationEpoch` and increasing `observationSequence`. At the same domain revision the browser accepts only a newer sequence from the active epoch; after accepting a new epoch it retires the old one so a late response cannot restore stale health.
-
-## Desired and applied identity
-
-`desiredProfileId` and each profile's `desiredServerId` record the next local choice. `appliedProfileId`, `appliedServerId` and `appliedServerSnapshot` describe the runtime that actually owns traffic. There is no third `activeProfileId`.
-
-While stopped, selecting or activating a profile only updates desired state. While running, changing the applied profile/server builds a candidate config, starts it, then publishes desired and applied identity in one final state commit. Until that commit the old applied pair remains authoritative. A failure restores the previous config, runtime and state.
-
-If refresh removes the applied server, the running process is not silently switched. The provider list and desired selection are cleared as needed, while `appliedServerSnapshot` retains the last applied label until explicit stop or a successful switch. Stop clears applied identity and keeps the desired pair.
-
-## Profile operations
-
-The canonical API is scoped by profile:
-
-- `POST /api/profiles` adds a profile after one explicit provider fetch;
-- `PATCH /api/profiles/:id` renames it locally;
-- `PUT /api/profiles/:id/server` selects one of its servers;
-- `POST /api/profiles/:id/activate` activates/switches it;
-- `POST /api/profiles/:id/refresh` refreshes only that provider;
-- `DELETE /api/profiles/:id` deletes it, with explicit `stop-and-delete` for a running applied profile;
-- `POST /api/profiles/:id/servers/ping` performs bounded transient health checks.
-
-Provider failure retains the last successful list and metadata, marks only the target profile stale and records the last successful timestamp. Refreshing, pinging or deleting an inactive profile does not mutate the applied config/runtime. Background refresh iterates profiles independently every 15 minutes.
-
-## Ordered routing rules
-
-`route.localRules` is the desired ordered list. Every rule has an explicit `outbound: "vpn" | "direct"`; the first enabled matcher wins and disabled rules retain their position without entering the generated config. `route.activeLocalRules` is the exact canonical list used to generate the running rules-enabled config, not a second desired owner.
-
-The route-rules mutation uses the whole-array `PUT /api/route-rules/v2` with `rulesContractVersion: 2` and `expectedRulesRevision`. Contract v2 requires an explicit outbound on every rule. The versioned path prevents a stale v2 tab from writing to a rolled-back v1 backend; the legacy path on a v2 backend rejects its payload without changing state, config or runtime. A client that receives a snapshot without capability version 2 can read legacy rules as direct but keeps the editor read-only.
-
-In Connect `gateway-direct`, local user rules are intentionally omitted and the snapshot reports no active or pending local rules. Gateway device policy `Напрямую` bypasses sing-box before these rules; policy `VPN` and an ordinary local/Gateway VPN pipeline evaluate them.
-
-## Gateway failover and activity journal
-
-`failoverPolicy` is the desired Gateway-only policy: master enable, primary/reserve profile and server, service checks with individual timeouts, health windows, active-traffic guard and flap protection. `failoverRuntimeState` stores switch history, hold and quarantine deadlines separately, so a runtime decision is not mistaken for a desired configuration change. `appliedFailoverPolicy` stores only the two loaded targets and safe configuration fingerprints.
-
-Enabling failover while VPN is stopped validates a temporary dual-channel candidate but does not start VPN. The dual config is loaded only by the next explicit power-on. Enabling it over a running single-channel config remains pending until a later stop and power-on. Disabling automation stops its timer, probes and activity collector immediately, but does not restart sing-box or change the selected route; the already loaded dual config is reported as `passive-loaded` until the ordinary stop lifecycle clears it.
-
-The dual config keeps one stable inbound and a sing-box selector with `interrupt_exist_connections: false`. A switch changes the outbound for new connections only. Before an automatic switch, the existing `/connections` observer measures VPN byte deltas over a bounded 10-second window. Active or unknown traffic blocks the switch; the public snapshot contains only aggregate speed, connection count and at most three safe device/service labels.
-
-Failover mutations use `PUT /api/failover`, `POST /api/failover/pause` and `POST /api/failover/switch`. Important user events are separate rows in the `harbor.sqlite` journal table and read through `GET /api/activity-journal`. The journal is not a second state owner, contains no provider URLs or raw diagnostics, uses stable ID cursors and retains at most 30 days and 10,000 entries.
-
-## Compatibility and migration
-
-Schema v5 migrates the legacy singleton and `subscription-cache.json` into one profile named `Основной`. Stable endpoint identity preserves unambiguous desired/applied selection, including transport variants whose normalized IDs differ from old labels. An explicitly stopped legacy state does not resurrect an old applied target.
-
-Schema v6 adds the routing-rule outbound. Rules read from schemas v0-v5 migrate to `outbound: "direct"` in their existing order and both desired/applied arrays are normalized together. A schema-v6 rule without a valid outbound is rejected rather than silently rewritten. Schema v7 adds canonical connectivity-diagnostics settings. Schema v8 adds a disabled failover policy, empty runtime history and no applied dual config, so upgrading does not start monitoring or change traffic.
-
-The initial SQLite migration imports settings, devices and journal in one transaction, including a legacy subscription cache when needed. Original JSON files remain unchanged as transition-time backups, with no parallel writes. Invalid input or a conflicting cache owner aborts migration without replacing state or starting stale configuration. Subsequent starts use only SQLite. Current document normalizers also preserve traffic-display settings and the device inventory's tag catalogue.
-
-The existing HTTP compatibility projection is unchanged. A pre-SQLite binary cannot read current persistence: restore a complete compatible backup or explicitly export current data before downgrading. Old JSON files do not contain post-migration changes. See [state recovery](../recovery/state-recovery.md).
-
-## Local traffic history
-
-`GET /api/traffic/history` reads only the local collector's `traffic.sqlite`, through a worker and, on a split Gateway, the existing control/dataplane socket. It accepts `range=24h|7d|30d|90d`, `level=service|domain|hostname|ip`, parent filters `service/domain/hostname`, `originId`, `route=all|vpn|direct|other`, `search`, `offset` and an optional `until` timestamp in milliseconds. Pages contain at most 100 groups. Bytes are decimal strings, preserving integers above JavaScript's safe-number range.
-
-The response reports the requested/effective period, first available observation, minute/hour boundary, current collector state, gap count and partial coverage. `query.until` is the effective end of a complete bucket; use it for matching drilldown and pagination. Current history can lag by one minute. Data older than 7 days is hourly; retention and rollup can change available granularity between requests.
-
-History starts with the new collector, not with previously accumulated device counters. Full observed hostnames and IPs remain distinct; service grouping is a local presentation classification, not proof of ownership of an IP. Unknown domains remain unknown. A history storage error reports unavailable/partial data without stopping VPN or exported metrics.
-
-Prometheus is optional, independent and contains only exported metrics—not a copy of this database. There is no synchronization, automatic UI fallback, scrape backfill or restoration from Prometheus. Local cleanup does not delete external history or change its retention.

docs/product/data-consistency-regressions.md

@@ -1,17 +0,0 @@
-# Data consistency regression suite
-
-`npm test` is the required fast regression gate. It uses generated fixtures, temporary directories, loopback HTTP servers and a fake sing-box executable; it does not require internet, root or an installed sing-box.
-
-The protected invariants are:
-
-| Invariant | Regression coverage |
-|---|---|
-| One backend canonical snapshot owns servers and desired/applied selection | `test/data-consistency-regression.test.js`, `test/server/state-contract.test.js` |
-| Revisions increase and an older response cannot replace newer state | `test/server/state-contract.test.js`, `test/web/harbor-state.test.js` |
-| Provider failure, parser failure and runtime failure do not partially commit subscription state | `test/server/state-contract.test.js` |
-| Atomic write failure preserves the last file and corrupt JSON preserves its original bytes | `test/server/state-store.test.js` |
-| Legacy state migrates with an explicit result for ambiguous selection | `test/server/state-store.test.js` |
-| Stable IDs survive reorder and duplicate labels for 1, 30 and 300 servers | `test/data-consistency-regression.test.js`, `test/server/subscription.test.js` |
-| Initial control outage does not invent domain state; repeated failures retain and mark the last snapshot stale | `test/web/harbor-state.test.js` |
-
-Fixtures are generated in test code to keep the suite small and deterministic. Packet-level networking, browser screenshots and accessibility automation are intentionally deferred to their dedicated roadmap tasks.

docs/product/error-contract.md

@@ -1,22 +0,0 @@
-# Harbor error contract v1
-
-Public API failures use one envelope:
-
-```json
-{
-  "success": false,
-  "error": {
-    "code": "PROVIDER_UNAVAILABLE",
-    "message": "Провайдер подписки временно недоступен.",
-    "retryable": true,
-    "correlationId": "6f1a63de-30f9-4dc5-b8ce-38d38c164fe3",
-    "details": "HTTP 503"
-  }
-}
-```
-
-`code`, Russian user copy, HTTP status and retry policy come from `src/shared/errors.ts`. The browser maps copy and retry behavior by `code`; it does not display server-provided `details`. Unknown failures use `UNKNOWN`, never expose the raw exception, and always receive a correlation reference. Server logs use the same reference and redact complete HTTP(S) URLs.
-
-Errors are local operation results, not canonical state replacements. A failed apply keeps the previous snapshot; in particular, server existence is validated before `desiredServerId` is persisted. Frontend errors are shown beside subscription or connection controls. Only retryable codes expose `Повторить`.
-
-This is a coordinated API change: old frontends do not understand the object-valued `error` field, so frontend and control plane must be deployed together. Persisted files and volumes are unchanged. Rollback is code-only and requires no data migration.

docs/product/frontend-operations.md

@@ -1,16 +0,0 @@
-# Frontend operation registry
-
-Harbor tracks active browser mutations by operation key instead of one global `busy` flag:
-
-- `connection`: start, stop and restart;
-- `serverApply`: apply a `(profileId, serverId)` pair;
-- `profileAdd`, `profileRename`, `profileSelect`, `profileActivate`, `profileRefresh`, `profileDelete`;
-- `gatewayAuto`: change the active route preference.
-
-Each entry is `{ status: "running", startedAt }`. A repeated operation key receives the same in-flight Promise, so a double click sends one request. A conflicting key resolves to `false` without starting its action. The symmetric conflict matrix lives in `src/web/state/operations.ts`.
-
-The registry only disables controls that can mutate the same domain state. Copy actions, instruction navigation and local tabs remain available during subscription refresh. Progress is announced with `role="status"`; the structured error from TASK-004 remains `role="alert"` after failure.
-
-Subscription URL validation is local and accepts only well-formed `http` and `https` URLs. It does not contact the provider; explicit profile add performs the single provider request and reports provider failures at that profile.
-
-The registry is local transport/UI state for immediate feedback. It does not replace backend `snapshot.operation`, which preserves the target across polling, reloads and other windows. A `diagnostics` key is intentionally deferred until diagnostics become a conflicting mutation.

docs/recovery/state-recovery.md

@@ -1,39 +0,0 @@
-# Harbor state recovery
-
-## Storage owners
-
-Harbor uses the existing data directory. `harbor.sqlite` is the only working owner of settings, profiles, subscriptions, device inventory and accumulated device counters. Settings and devices are versioned JSON documents inside SQLite (currently state schema 10 and inventory schema 3); the journal is a separate indexed table with the existing 30-day/10,000-event limit.
-
-`traffic.sqlite` is separate, replaceable working history: 90 days, completed minute buckets for the latest 7 days and hourly buckets before that. Removing history does not reset settings or exported counters. Prometheus is optional and independently retains only the metrics it scrapes; it cannot restore this database.
-
-Secrets, hardware identity, generated configuration and sing-box's own cache remain files.
-
-## Atomic writes and migration
-
-SQLite uses WAL, FULL synchronous commits and a five-second busy timeout. A document mutation runs its read and write in one transaction. Journal append/deduplication/pruning is transactional. Profile/server switching still prepares candidate configuration and runtime before publishing the canonical state.
-
-Before the first successful SQLite startup, Harbor imports `state.json`, `devices.json`, `activity-journal.json` and, when required by a pre-profile schema, `subscription-cache.json` in one transaction. Existing normalizers preserve revision, stable IDs, ordered rules and decimal-string counters. A null optional subscription cache is valid.
-
-The import marker commits with all imported records. An unsupported version, invalid input or conflicting cache owner aborts the entire import. Harbor does not erase settings, rename damaged originals, start stale configuration or silently return to first-run. Correct the reported original and retry only after making a backup.
-
-After a successful import, the original JSON files remain unchanged under their original names as transition-time backups. They are never read or written as current state again. Changing them does not change Harbor. A corrupt or unsupported SQLite database does not fall back to those stale JSON files.
-
-## Backup and recovery
-
-Stop both control and collector processes before offline recovery. On a Gateway this means the control and dataplane components; stop the Mac backend for Mac recovery.
-
-1. Preserve the whole data directory, including any `-wal` and `-shm` files, before changing anything.
-2. Restore a matching backup of `harbor.sqlite` and any necessary secret/config files. Do not mix a database with another backup's WAL.
-3. Start the same compatible release and inspect `GET /api/state` before applying a profile.
-
-For online backups use SQLite's backup API; copying only a live `.sqlite` file can omit committed WAL data. Offline copies after a clean stop are simpler.
-
-To discard only working traffic history, stop the collector and move its `traffic.sqlite` plus any associated `traffic.sqlite-wal` and `traffic.sqlite-shm` aside together. Leave `harbor.sqlite` untouched. A new collector database starts a new coverage period; there is no automatic Prometheus backfill. Do not unlink an open database.
-
-Deletion/retention makes pages reusable; it does not necessarily shrink the physical file immediately. Traffic retention and compaction run in the worker, outside connection processing.
-
-## Downgrade
-
-A pre-SQLite binary ignores `harbor.sqlite`. Merely starting it would revive old JSON settings and lose all changes since the cutover. Automatic downgrade is unsupported.
-
-Either restore a complete pre-upgrade backup deliberately, accepting the loss of subsequent changes, or first export current state into the exact schema required by the older binary. No automatic export/downgrade tool is provided. Preserve the SQLite backup in either case; do not overwrite current state with stale JSON as a recovery shortcut.

docs/roadmap.md

@@ -0,0 +1,105 @@
+# Roadmap: VPN Proxy rebuild
+
+## Целевая модель
+
+Проект должен стать multi-mode системой вокруг `sing-box`:
+
+| Режим | Назначение | Runtime | Статус |
+| --- | --- | --- | --- |
+| `gateway` | LXC/VPS как gateway для роутера и всей сети | Docker `network_mode: host` + TProxy | делаем первым |
+| `desktop-proxy` | Mac/Linux локальный HTTP/SOCKS proxy с fallback | Docker bridged ports | позже переносим из старой реализации |
+| `windows-gaming` | Windows для игр/Discord/Vesktop | native `sing-box.exe` + ProxiFyre | позже приводим в порядок |
+
+## Gateway mode
+
+Цель: контейнер, который становится прозрачным gateway для сети.
+
+Требования:
+
+- `sing-box` внутри контейнера.
+- `network_mode: host`.
+- `CAP_NET_ADMIN` и `CAP_NET_RAW`.
+- TProxy inbound на `7895`.
+- Mixed HTTP/SOCKS inbound на `8080`.
+- Web UI на `3456`.
+- Subscription URL вводится в UI, парсится, пользователь выбирает сервер.
+- Пользовательские routing lists управляются из UI.
+- Генерируется `/etc/sing-box/config.json`.
+- `sing-box check` перед применением.
+- Restart `sing-box` после применения.
+- Idempotent iptables setup.
+- Cleanup iptables/ip rule/ip route при остановке контейнера.
+
+Маршрутизация v1:
+
+- private IP ranges -> `direct`.
+- пользовательские списки -> `direct`, `vpn` или `block`.
+- `geoip-ru` -> `direct`.
+- `geosite-category-ru` -> `direct`.
+- все остальное -> выбранный VPN outbound.
+
+Порядок правил:
+
+1. safety private-direct, чтобы не ломать LAN.
+2. custom routing lists из UI.
+3. RU direct rules.
+4. default VPN outbound.
+
+Формат пользовательского списка:
+
+- `name`.
+- `enabled`.
+- `outbound`: `direct`, `vpn`, `block`.
+- `domains`: exact domains.
+- `domainSuffixes`: доменные suffix, удобно для игр/сервисов.
+- `domainKeywords`: keyword matching.
+- `ipCidrs`: CIDR ranges.
+- `ports`: TCP/UDP ports.
+- `networks`: `tcp`, `udp`.
+- UI должен автосохранять списки с debounce, чтобы polling state не затирал незавершенное редактирование.
+
+Важно: gateway не видит process name на клиентском ПК. Для сценария вроде "League of Legends всегда direct" нужны домены, CIDR и порты Riot, а не имя процесса.
+
+Отдельно решить позже:
+
+- DNS strategy: DHCP DNS, DNS redirect или local DNS inbound.
+- IPv6 TProxy.
+- nftables backend.
+- health checks и smoke diagnostics.
+- secret storage через Infisical/Vault/env.
+
+## Desktop proxy mode
+
+Цель: сохранить удобный Docker-сценарий для Mac/Linux без TProxy.
+
+Требования:
+
+- UI на `3456`.
+- Mixed inbound на `8080`.
+- Subscription parser.
+- Выбор сервера.
+- Fallback proxy через `urltest`.
+- Direct mode toggle.
+- Не требует `NET_ADMIN`.
+
+## Windows gaming mode
+
+Цель: сохранить сценарий для Discord/Vesktop/игр.
+
+Требования:
+
+- Native `sing-box.exe`.
+- Scheduled task или Windows service.
+- ProxiFyre + WinPacketFilter для приложений, которые не умеют proxy.
+- Управление из PowerShell helper.
+- Позже можно сделать Electron/Tauri UI поверх privileged helper.
+
+## Рабочий порядок
+
+1. Сделать новый gateway root.
+2. Реализовать Docker image + entrypoint TProxy lifecycle.
+3. Реализовать маленький control-server.
+4. Реализовать Vite + React UI для subscription -> server select -> apply.
+5. Добавить gateway docs/install script.
+6. Потом переносить desktop-proxy.
+7. Потом приводить Windows mode к новой архитектуре.

docs/superpowers/plans/2026-05-19-macos-client.md

@@ -0,0 +1,74 @@
+# macOS Docker Client Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Build a macOS Docker client mode that exposes a local HTTP/SOCKS proxy on `127.0.0.1:8080` with a friendlier UI and a curl installer.
+
+**Architecture:** Reuse the current Node API, React UI, subscription parser, sing-box process manager, and routing rule generator. Add `APP_MODE=client` so the same backend emits a proxy-only sing-box config without TProxy, and use a dedicated Dockerfile/compose path for Mac installation.
+
+**Tech Stack:** Node.js ESM, React/Vite, sing-box, Docker Compose, POSIX shell, `node:test`.
+
+---
+
+### Task 1: Client Mode Config Contract
+
+**Files:**
+- Create: `test/server/singbox-client-mode.test.js`
+- Modify: `package.json`
+- Modify: `src/server/config.js`
+- Modify: `src/server/singbox.js`
+- Modify: `src/server/index.js`
+
+- [ ] Add `node:test` coverage that proves `APP_MODE=client` config has `mixed-in`, no `tproxy-in`, no transparent fallback, and a VPN proxy fallback.
+- [ ] Add `npm test` script.
+- [ ] Add `settings.appMode`.
+- [ ] Make `buildGatewayConfig()` conditionally emit client-only inbounds and route rules.
+- [ ] Expose `mode` and hide irrelevant tproxy fields in public state.
+
+### Task 2: macOS Client Docker Runtime
+
+**Files:**
+- Create: `entrypoint.client.sh`
+- Create: `Dockerfile.client`
+- Create: `docker-compose.client.yml`
+
+- [ ] Add an entrypoint that starts only the Node control server.
+- [ ] Add a Dockerfile that builds the Vite frontend inside Docker and installs only client runtime dependencies plus sing-box.
+- [ ] Add compose with loopback-only port publishing for UI and proxy.
+
+### Task 3: User-Friendly Client UI
+
+**Files:**
+- Create: `src/web/components/ClientOverviewPage.jsx`
+- Modify: `src/web/App.jsx`
+- Modify: `src/web/components/Sidebar.jsx`
+- Modify: `src/web/components/Topbar.jsx`
+- Modify: `src/web/components/StatusPane.jsx`
+- Modify: `src/web/components/RouteChecker.jsx`
+- Modify: `src/web/styles.css`
+
+- [ ] Add a client overview with status, active server, copyable proxy URLs, and macOS setup commands.
+- [ ] Hide gateway-only navigation and side status pane in client mode.
+- [ ] Rename topbar brand to match current mode.
+- [ ] Keep servers, logs, and settings reachable in client mode.
+
+### Task 4: curl Installer and Docs
+
+**Files:**
+- Create: `scripts/install-macos-client.sh`
+- Modify: `README.md`
+- Modify: `.env.example`
+
+- [ ] Add curl-friendly installer with Docker/Git checks and update-or-clone behavior.
+- [ ] Document one-line install command and manual compose command.
+- [ ] Add client mode environment examples.
+
+### Task 5: Verification
+
+**Commands:**
+- `npm test`
+- `npm run build`
+- `docker compose -f docker-compose.client.yml config`
+
+- [ ] Run all commands and fix any failures.
+- [ ] Inspect the diff to confirm existing CI/runtime-base edits remain untouched.

docs/superpowers/specs/2026-05-19-macos-client-design.md

@@ -0,0 +1,48 @@
+# macOS Docker Client Design
+
+## Goal
+
+Add a simple macOS-friendly Docker client that behaves like the previous local proxy product: the user runs one container, opens a web UI, loads a subscription, chooses a server, and points macOS apps at `127.0.0.1:8080`.
+
+## Product Shape
+
+The client is not a transparent gateway. It must not require router changes, host networking, `NET_ADMIN`, iptables, ipset, or TProxy. The first-screen UI should explain the current proxy state, active server, and exact local proxy addresses. Gateway-only controls remain available only when the app runs in gateway mode.
+
+## Runtime Architecture
+
+`APP_MODE=client` switches the config generator to proxy-only sing-box config:
+
+- one `mixed` inbound on `PROXY_PORT`;
+- no `tproxy` inbound;
+- custom routing rules still apply before fallback;
+- `proxyDefaultMode` controls the mixed proxy fallback and defaults to VPN;
+- generated configs still pass `sing-box check` before restart.
+
+The client Docker image builds the React frontend inside Docker so macOS installation does not require local Node.js. Docker publishes only loopback ports:
+
+- `127.0.0.1:3456` for the UI;
+- `127.0.0.1:8080` for HTTP/SOCKS proxy.
+
+## Installer
+
+The macOS installer is a curl-friendly shell script. It checks macOS, Docker, Docker Compose, and Git, clones or updates the repository under `~/.vpn-proxy-client`, then runs the client compose file with `--build`. It prints the UI URL, proxy URLs, and optional `networksetup` commands, but does not change system proxy settings automatically.
+
+## UI
+
+Client mode gets a user-facing overview based on the old workflow:
+
+- status: ready, stopped, not configured, applying, error;
+- active server and traffic quota;
+- copyable HTTP and SOCKS5 proxy URLs;
+- short macOS setup commands;
+- primary actions: load subscription, choose server, restart, stop.
+
+Gateway terminology such as TProxy, devices, router, transparent fallback, and direct bypass cache is hidden in client mode.
+
+## Verification
+
+Use `node:test` for server config behavior, then run:
+
+- `npm test`;
+- `npm run build`;
+- `docker compose -f docker-compose.client.yml config`.

docs/superpowers/specs/2026-05-21-windows-client-design.md

@@ -0,0 +1,229 @@
+# Windows Client Design
+
+## Goal
+
+Restore the old Windows workflow in a cleaner product shape: a one-command PowerShell installer can install either a full local `sing-box` + ProxiFyre setup or ProxiFyre-only routing to an existing proxy, then expose a small local web UI for profiles, folders, executable files, status, and logs.
+
+## Product Shape
+
+The Windows mode is script-first and UI-assisted. The installer remains the durable entrypoint because Windows driver/service setup needs administrator rights and must stay easy to debug from PowerShell. The web UI is a local control surface on top of the same scripts, not a separate desktop app in the first version.
+
+The installer supports two paths:
+
+- **Full install:** install native `sing-box.exe`, configure a local SOCKS/HTTP proxy on `127.0.0.1:1080`, install WinPacketFilter and ProxiFyre, then route selected Windows apps through the local proxy.
+- **ProxiFyre only:** install WinPacketFilter and ProxiFyre, then point selected Windows apps to an existing proxy target such as `127.0.0.1:8080`, `192.168.50.111:8080`, or another reachable SOCKS5 endpoint.
+
+The default UI direction is the approved cleaner mockup: one route status, profiles as the main object, selected profile details on the right, and a short recent activity/log section below. The first screen should answer: what is the active proxy target, whether services are running, and which profiles are currently enabled.
+
+## User Flows
+
+### Install
+
+The user opens PowerShell 7 as Administrator and runs:
+
+```powershell
+irm https://git.dokops.ru/dokril/vpn-proxy/raw/branch/master/scripts/install-windows-client.ps1 | iex
+```
+
+The installer checks administrator rights, PowerShell version, architecture, internet access, and required paths. It installs under `C:\Tools\vpn-proxy-windows` and keeps third-party runtime files in focused subdirectories:
+
+- `C:\Tools\vpn-proxy-windows\app` for this project checkout or archive.
+- `C:\Tools\vpn-proxy-windows\runtime\node` for portable Node.js when no suitable Node is installed.
+- `C:\Tools\vpn-proxy-windows\runtime\sing-box` for `sing-box.exe`, config, and logs.
+- `C:\Tools\ProxiFyre` for ProxiFyre, matching the legacy script path.
+
+If the user chooses Full install, the installer asks for a subscription or VLESS link, parses it through the existing subscription logic where possible, lets the user select a server, writes the native `sing-box` config, installs a scheduled task for `sing-box`, and starts it.
+
+If the user chooses ProxiFyre only, the installer asks for a SOCKS5 proxy target and verifies TCP connectivity before writing ProxiFyre config.
+
+After setup, the installer starts the local control UI on `http://127.0.0.1:3456` and prints recovery commands:
+
+```powershell
+& "C:\Tools\vpn-proxy-windows\manage.ps1"
+& "C:\Tools\vpn-proxy-windows\manage.ps1" -OpenUi
+& "C:\Tools\vpn-proxy-windows\manage.ps1" -Status
+```
+
+### Profile Management
+
+Profiles are the central unit. A profile contains a name, enabled flag, proxy target, protocol list, and app items. Supported item types:
+
+- `process`: process name such as `Discord`, `Update`, or `Vesktop`.
+- `folder`: folder path; the system scans `.exe` files and converts them to routable entries.
+- `exe`: explicit executable file path; the system resolves it to the executable name for ProxiFyre and keeps the full path for display and diagnostics.
+
+Folder and exe entries are intentionally stored as user-facing source items, while the generated ProxiFyre config is derived. This keeps the UI understandable and makes future ProxiFyre/Proxifier adapter changes possible without changing the profile model.
+
+When a profile changes, the UI marks it as pending. The user applies changes once. Apply regenerates ProxiFyre `app-config.json`, restarts the ProxiFyre service, then writes an activity entry showing what changed.
+
+### Runtime Operations
+
+The UI exposes these actions:
+
+- start, stop, restart `sing-box` when local mode is installed;
+- start, stop, restart ProxiFyre;
+- switch a profile between `local-singbox` and an external proxy target;
+- add process, folder, or exe entries;
+- scan folder entries again;
+- copy diagnostics for support/debugging;
+- open logs.
+
+The UI does not auto-change global Windows proxy settings. Routing happens only through ProxiFyre profiles.
+
+## Architecture
+
+The active project already has a plain Node API server, React/Vite UI, subscription parser, `sing-box` config generator, logs, traffic parsing, and client/gateway modes. Windows mode should reuse those pieces and add a Windows helper boundary.
+
+### App Mode
+
+Add `APP_MODE=windows`. In Windows mode:
+
+- the HTTP server binds to `127.0.0.1`;
+- the UI uses Windows labels and hides gateway-only TProxy/device controls;
+- config generation is proxy-only like client mode, but it targets native `sing-box.exe` rather than Docker;
+- service and driver actions go through the PowerShell helper, not direct Node assumptions.
+
+### Windows Helper Boundary
+
+Create a PowerShell helper module that owns privileged Windows operations:
+
+- install/update `sing-box.exe`;
+- install/start/stop scheduled tasks;
+- install/update WinPacketFilter;
+- install/update ProxiFyre;
+- write ProxiFyre config;
+- query service/task status;
+- read recent log files;
+- test proxy connectivity;
+- manage firewall rules for local proxy ports.
+
+The Node server calls the helper with explicit command names and JSON input/output. The helper returns structured JSON for every operation:
+
+```json
+{
+  "success": true,
+  "action": "proxies.apply",
+  "changed": true,
+  "message": "ProxiFyre config applied and service restarted"
+}
+```
+
+Errors use the same shape with `success: false`, `error`, and optional `details`. The UI never parses raw PowerShell text.
+
+### Data Files
+
+Windows mode stores state under `C:\Tools\vpn-proxy-windows\data`:
+
+- `windows-profiles.json` for profile source data.
+- `proxy-targets.json` for `local-singbox` and external proxy targets.
+- `windows-state.json` for last applied profile revision and UI status.
+- `subscription-cache.json` and `state.json` stay compatible with existing subscription/server selection logic.
+
+Profile shape:
+
+```json
+{
+  "id": "discord-vesktop",
+  "name": "Discord + Vesktop",
+  "enabled": true,
+  "proxyTargetId": "local-singbox",
+  "protocols": ["TCP", "UDP"],
+  "items": [
+    { "type": "process", "value": "Discord" },
+    { "type": "process", "value": "Update" },
+    {
+      "type": "folder",
+      "value": "%LOCALAPPDATA%\\vesktop",
+      "recursive": true
+    },
+    {
+      "type": "exe",
+      "value": "C:\\Games\\SomeGame\\game.exe"
+    }
+  ]
+}
+```
+
+Generated ProxiFyre config is not edited directly. It is derived from enabled profiles and proxy targets, then written to `C:\Tools\ProxiFyre\app-config.json`.
+
+### API Surface
+
+Add Windows-specific endpoints:
+
+- `GET /api/windows/status`: returns install mode, `sing-box` status, ProxiFyre status, active target, pending changes, and recent activity.
+- `GET /api/windows/profiles`: returns profile source data with resolved executable counts.
+- `PUT /api/windows/profiles`: saves profiles without applying.
+- `POST /api/windows/profiles/apply`: generates ProxiFyre config and restarts service.
+- `POST /api/windows/profiles/scan`: resolves folder and exe entries for preview.
+- `GET /api/windows/targets`: returns `local-singbox` and external proxy targets.
+- `PUT /api/windows/targets`: saves external proxy targets after validation.
+- `POST /api/windows/service`: start, stop, or restart `sing-box`, ProxiFyre, or the UI service.
+- `GET /api/windows/logs`: returns recent helper, `sing-box`, and ProxiFyre logs.
+
+Existing generic endpoints for subscription fetch, server selection, apply, logs, and config validation should be reused where the behavior matches Windows mode.
+
+## UI Design
+
+The approved direction is a restrained operational UI:
+
+- top bar: product name, restart/stop/add profile actions;
+- left nav: Overview, Profiles, Targets, Logs, Settings;
+- main status panel: one sentence describing the active route, plus a compact route line such as `Selected apps -> ProxiFyre -> sing-box -> VPN`;
+- main workspace: profile list on the left, selected profile details on the right;
+- profile details: target selector, add process/folder/exe input, resolved items list, save/apply controls;
+- activity panel: recent traffic/service events, not a full noisy log dump.
+
+Avoid duplicate status blocks. Avoid showing raw implementation concepts like WinPacketFilter unless the user is in diagnostics/settings. The primary terms should be `Profile`, `Proxy target`, `Local sing-box`, `Existing proxy`, `App/folder/exe`, and `Apply changes`.
+
+## Safety And Constraints
+
+The UI binds only to `127.0.0.1`. Windows actions that require elevation stay in the installer/helper path. The installer must not delete existing `C:\Tools\vpn-proxy` legacy folders without confirmation.
+
+Folder and exe routing needs a clear diagnostic note: ProxiFyre routing ultimately depends on what the installed ProxiFyre version accepts. The first implementation should resolve folders and exe paths to executable names for compatibility, while preserving full paths in profile data and diagnostics. If direct path matching is verified in ProxiFyre, the adapter can emit full paths without changing the UI model.
+
+The installer should be idempotent:
+
+- re-running it updates project files;
+- existing subscriptions and profiles are preserved unless the user chooses reset;
+- existing ProxiFyre config is backed up before overwrite;
+- failed applies leave the previous generated config available for rollback.
+
+## Testing And Verification
+
+Use focused tests for pure logic:
+
+- profile normalization;
+- folder/exe item resolution;
+- ProxiFyre config generation;
+- proxy target validation;
+- Windows helper JSON command contract;
+- `APP_MODE=windows` public state and config generation.
+
+Use manual Windows verification for privileged operations:
+
+- fresh Full install;
+- fresh ProxiFyre-only install;
+- re-run installer over existing install;
+- add process profile;
+- add folder profile;
+- add explicit exe profile;
+- switch a profile from local sing-box to external proxy;
+- restart ProxiFyre and verify service status;
+- copy diagnostics after a failed proxy target check.
+
+Local non-Windows development should still run `npm test` and `npm run build`. Windows-only helper commands should have dry-run or mockable modes so logic can be tested without installing drivers on the development machine.
+
+## Non-Goals For First Version
+
+- No Electron or Tauri wrapper.
+- No global Windows system proxy changes.
+- No transparent routing without ProxiFyre.
+- No remote multi-device management.
+- No automatic uninstall of unrelated WinPacketFilter users.
+- No Proxifier support until ProxiFyre behavior is stable.
+
+## Implementation Defaults
+
+- The UI server runs when opened by `manage.ps1 -OpenUi` in the first version. An at-logon scheduled UI task can be added later after the helper and UI are stable.
+- Full install uses portable Node/npm when the machine has no suitable Node.js. The installer builds the React UI locally for MVP; a prebuilt release artifact can replace that later without changing user-facing behavior.
+- ProxiFyre generation emits process names in the first version for compatibility. Full folder and exe paths remain in profile data and diagnostics; the adapter can start emitting full paths later if ProxiFyre path matching is verified.

entrypoint.client.sh

@@ -2,7 +2,7 @@
 set -euo pipefail
 
 PORT="${PORT:-3456}"
-PROXY_PORT="${PROXY_PORT:-8082}"
+PROXY_PORT="${PROXY_PORT:-8080}"
 DATA_DIR="${DATA_DIR:-/var/lib/vpn-proxy}"
 SING_BOX_CONFIG="${SING_BOX_CONFIG:-/etc/sing-box/config.json}"
 SING_BOX_CACHE="${SING_BOX_CACHE:-/var/lib/sing-box/cache.db}"
@@ -18,4 +18,4 @@ export PORT PROXY_PORT DATA_DIR SING_BOX_CONFIG SING_BOX_CACHE
 export PROXY_BIND_IP="${PROXY_BIND_IP:-0.0.0.0}"
 
 log "starting VPN proxy client UI on :${PORT}, local proxy on :${PROXY_PORT}"
-exec node /app/dist/server/main.js
+exec node /app/src/server/index.js

entrypoint.sh

@@ -1,92 +1,31 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-APP_COMPONENT="${APP_COMPONENT:-combined}"
 TPROXY_PORT="${TPROXY_PORT:-7895}"
 TPROXY_MARK="${TPROXY_MARK:-1}"
 TPROXY_TABLE="${TPROXY_TABLE:-100}"
 TPROXY_CHAIN="${TPROXY_CHAIN:-VPN_PROXY_TPROXY}"
-DEVICE_POLICY_CHAIN="${DEVICE_POLICY_CHAIN:-VPN_PROXY_DEVICE_POLICY}"
-GATEWAY_FORWARD_CHAIN="${GATEWAY_FORWARD_CHAIN:-VPN_PROXY_FORWARD}"
-GATEWAY_NAT_CHAIN="${GATEWAY_NAT_CHAIN:-VPN_PROXY_NAT}"
-TRAFFIC_UPLOAD_CHAIN="${TRAFFIC_UPLOAD_CHAIN:-VPN_PROXY_TRAFFIC_UP}"
-TRAFFIC_DOWNLOAD_CHAIN="${TRAFFIC_DOWNLOAD_CHAIN:-VPN_PROXY_TRAFFIC_DOWN}"
-DIRECT_TRAFFIC_CHAIN="${DIRECT_TRAFFIC_CHAIN:-VPN_PROXY_DIRECT}"
-DIRECT_TRAFFIC_MARK="${DIRECT_TRAFFIC_MARK:-0x40000000}"
-GATEWAY_CLIENT_CIDRS="${GATEWAY_CLIENT_CIDRS:-10.0.0.0/8 172.16.0.0/12 192.168.0.0/16}"
 PROXY_PORT="${PROXY_PORT:-8080}"
 PROXY_BIND_IP="${PROXY_BIND_IP:-0.0.0.0}"
 PROXY_INPUT_CHAIN="${PROXY_INPUT_CHAIN:-VPN_PROXY_INPUT}"
 PROXY_FIREWALL="${PROXY_FIREWALL:-true}"
 PROXY_ALLOWED_CIDRS="${PROXY_ALLOWED_CIDRS:-10.0.0.0/8 172.16.0.0/12 192.168.0.0/16}"
 BYPASS_CIDRS="${BYPASS_CIDRS:-0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16 224.0.0.0/4 240.0.0.0/4}"
-export TPROXY_PORT TPROXY_MARK DEVICE_POLICY_CHAIN TRAFFIC_UPLOAD_CHAIN TRAFFIC_DOWNLOAD_CHAIN DIRECT_TRAFFIC_CHAIN DIRECT_TRAFFIC_MARK GATEWAY_CLIENT_CIDRS BYPASS_CIDRS
-DEVICE_TRAFFIC_CONFIG_VALID=false
-export DEVICE_TRAFFIC_ACCOUNTING_ENABLED=false
+# Имя ipset для IP-адресов, которые sing-box отправил напрямую (direct bypass cache)
+DIRECT_BYPASS_SET="${DIRECT_BYPASS_SET:-vpn_direct_bypass}"
+# TTL записи в ipset (секунды). По умолчанию 1 час.
+DIRECT_BYPASS_TTL="${DIRECT_BYPASS_TTL:-3600}"
+# Direct bypass cache выключен по умолчанию, потому что он обходит global rules.
+DIRECT_BYPASS_CACHE="${DIRECT_BYPASS_CACHE:-false}"
 
 log() {
   printf '[gateway-entrypoint] %s\n' "$*"
 }
 
-if [[ "$APP_COMPONENT" == "control" ]]; then
-  exec node /app/dist/server/main.js
-fi
-
-validate_device_traffic_config() {
-  if [[ -z "$DIRECT_TRAFFIC_CHAIN" || ${#DIRECT_TRAFFIC_CHAIN} -gt 24
-    || "$DIRECT_TRAFFIC_CHAIN" =~ [^a-zA-Z0-9_] ]]; then
-    log "device traffic counters unavailable: invalid DIRECT_TRAFFIC_CHAIN"
-    return 1
-  fi
-  local direct_names=("$DIRECT_TRAFFIC_CHAIN" "${DIRECT_TRAFFIC_CHAIN}_A" "${DIRECT_TRAFFIC_CHAIN}_B")
-  local reserved_names=(
-    PREROUTING INPUT FORWARD OUTPUT POSTROUTING
-    "$TPROXY_CHAIN"
-    "$DEVICE_POLICY_CHAIN" "${DEVICE_POLICY_CHAIN}_A" "${DEVICE_POLICY_CHAIN}_B"
-    "$TRAFFIC_DOWNLOAD_CHAIN" "${TRAFFIC_DOWNLOAD_CHAIN}_A" "${TRAFFIC_DOWNLOAD_CHAIN}_B"
-    "${TRAFFIC_DOWNLOAD_CHAIN}_A_P" "${TRAFFIC_DOWNLOAD_CHAIN}_B_P"
-  )
-  for direct_name in "${direct_names[@]}"; do
-    for reserved_name in "${reserved_names[@]}"; do
-      if [[ "$direct_name" == "$reserved_name" ]]; then
-        log "device traffic counters unavailable: DIRECT_TRAFFIC_CHAIN conflicts with ${reserved_name}"
-        return 1
-      fi
-    done
-  done
-  if ! [[ "$DIRECT_TRAFFIC_MARK" =~ ^(0[xX][0-9a-fA-F]{1,8}|[0-9]{1,10})$
-    && "$TPROXY_MARK" =~ ^(0[xX][0-9a-fA-F]{1,8}|[0-9]{1,10})$ ]]; then
-    log "device traffic counters unavailable: invalid traffic mark"
-    return 1
-  fi
-  local direct_mark_value tproxy_mark_value
-  if [[ "$DIRECT_TRAFFIC_MARK" =~ ^0[xX] ]]; then
-    direct_mark_value=$((16#${DIRECT_TRAFFIC_MARK:2}))
-  else
-    direct_mark_value=$((10#$DIRECT_TRAFFIC_MARK))
-  fi
-  if [[ "$TPROXY_MARK" =~ ^0[xX] ]]; then
-    tproxy_mark_value=$((16#${TPROXY_MARK:2}))
-  else
-    tproxy_mark_value=$((10#$TPROXY_MARK))
-  fi
-  if (( direct_mark_value == 0 || direct_mark_value > 0xffffffff
-    || (direct_mark_value & (direct_mark_value - 1)) != 0
-    || (direct_mark_value & tproxy_mark_value) != 0 )); then
-    log "device traffic counters unavailable: DIRECT_TRAFFIC_MARK must be one bit outside TPROXY_MARK"
-    return 1
-  fi
-  DEVICE_TRAFFIC_CONFIG_VALID=true
-}
-
 ipt() {
   iptables -w "$@"
 }
 
-ipt_traffic() {
-  iptables -w 1 "$@"
-}
-
 cleanup_proxy_firewall() {
   ipt -D INPUT -p tcp --dport "$PROXY_PORT" -j "$PROXY_INPUT_CHAIN" 2>/dev/null || true
   ipt -D INPUT -p udp --dport "$PROXY_PORT" -j "$PROXY_INPUT_CHAIN" 2>/dev/null || true
@@ -95,97 +34,26 @@ cleanup_proxy_firewall() {
 }
 
 cleanup_tproxy() {
+  log "cleanup tproxy rules"
   ipt -t mangle -D PREROUTING -j "$TPROXY_CHAIN" 2>/dev/null || true
   ipt -t mangle -F "$TPROXY_CHAIN" 2>/dev/null || true
   ipt -t mangle -X "$TPROXY_CHAIN" 2>/dev/null || true
   ip rule del fwmark "$TPROXY_MARK" table "$TPROXY_TABLE" 2>/dev/null || true
   ip route flush table "$TPROXY_TABLE" 2>/dev/null || true
+  # ipset не чистим при завершении — TTL сам истечёт
 }
 
-cleanup_device_policy() {
-  ipt -t mangle -F "$DEVICE_POLICY_CHAIN" 2>/dev/null || true
-  for slot in A B; do
-    ipt -t mangle -F "${DEVICE_POLICY_CHAIN}_${slot}" 2>/dev/null || true
-    ipt -t mangle -X "${DEVICE_POLICY_CHAIN}_${slot}" 2>/dev/null || true
-  done
-  ipt -t mangle -X "$DEVICE_POLICY_CHAIN" 2>/dev/null || true
-}
-
-setup_device_policy() {
-  cleanup_device_policy
-  ipt -t mangle -N "$DEVICE_POLICY_CHAIN" || return 1
-  ipt -t mangle -N "${DEVICE_POLICY_CHAIN}_A" || return 1
-  ipt -t mangle -N "${DEVICE_POLICY_CHAIN}_B" || return 1
-  ipt -t mangle -A "${DEVICE_POLICY_CHAIN}_A" -p tcp -j TPROXY --on-port "$TPROXY_PORT" --tproxy-mark "$TPROXY_MARK/$TPROXY_MARK" || return 1
-  ipt -t mangle -A "${DEVICE_POLICY_CHAIN}_A" -p udp -j TPROXY --on-port "$TPROXY_PORT" --tproxy-mark "$TPROXY_MARK/$TPROXY_MARK" || return 1
-  ipt -t mangle -A "$DEVICE_POLICY_CHAIN" -j "${DEVICE_POLICY_CHAIN}_A" || return 1
-}
-
-cleanup_gateway_forwarding() {
-  ipt -D FORWARD -j "$GATEWAY_FORWARD_CHAIN" 2>/dev/null || true
-  ipt -t nat -D POSTROUTING -j "$GATEWAY_NAT_CHAIN" 2>/dev/null || true
-  ipt -F "$GATEWAY_FORWARD_CHAIN" 2>/dev/null || true
-  ipt -X "$GATEWAY_FORWARD_CHAIN" 2>/dev/null || true
-  ipt -t nat -F "$GATEWAY_NAT_CHAIN" 2>/dev/null || true
-  ipt -t nat -X "$GATEWAY_NAT_CHAIN" 2>/dev/null || true
-}
-
-cleanup_device_traffic() {
-  [[ "$DEVICE_TRAFFIC_CONFIG_VALID" == "true" ]] || return 0
-  ipt_traffic -t mangle -D "$TPROXY_CHAIN" -j CONNMARK --set-xmark "0x0/$DIRECT_TRAFFIC_MARK" 2>/dev/null || true
-  ipt_traffic -t raw -D PREROUTING -j "$TRAFFIC_UPLOAD_CHAIN" 2>/dev/null || true
-  ipt_traffic -t mangle -D PREROUTING -j "$DIRECT_TRAFFIC_CHAIN" 2>/dev/null || true
-  ipt_traffic -t mangle -D POSTROUTING -j "$TRAFFIC_DOWNLOAD_CHAIN" 2>/dev/null || true
-  ipt_traffic -t raw -F "$TRAFFIC_UPLOAD_CHAIN" 2>/dev/null || true
-  ipt_traffic -t mangle -F "$DIRECT_TRAFFIC_CHAIN" 2>/dev/null || true
-  ipt_traffic -t mangle -F "$TRAFFIC_DOWNLOAD_CHAIN" 2>/dev/null || true
-  for slot in A B; do
-    ipt_traffic -t raw -F "${TRAFFIC_UPLOAD_CHAIN}_${slot}" 2>/dev/null || true
-    ipt_traffic -t raw -F "${TRAFFIC_UPLOAD_CHAIN}_${slot}_P" 2>/dev/null || true
-    ipt_traffic -t raw -X "${TRAFFIC_UPLOAD_CHAIN}_${slot}_P" 2>/dev/null || true
-    ipt_traffic -t raw -X "${TRAFFIC_UPLOAD_CHAIN}_${slot}" 2>/dev/null || true
-    ipt_traffic -t mangle -F "${DIRECT_TRAFFIC_CHAIN}_${slot}" 2>/dev/null || true
-    ipt_traffic -t mangle -X "${DIRECT_TRAFFIC_CHAIN}_${slot}" 2>/dev/null || true
-    ipt_traffic -t mangle -F "${TRAFFIC_DOWNLOAD_CHAIN}_${slot}" 2>/dev/null || true
-    ipt_traffic -t mangle -F "${TRAFFIC_DOWNLOAD_CHAIN}_${slot}_P" 2>/dev/null || true
-    ipt_traffic -t mangle -X "${TRAFFIC_DOWNLOAD_CHAIN}_${slot}_P" 2>/dev/null || true
-    ipt_traffic -t mangle -X "${TRAFFIC_DOWNLOAD_CHAIN}_${slot}" 2>/dev/null || true
-  done
-  ipt_traffic -t raw -X "$TRAFFIC_UPLOAD_CHAIN" 2>/dev/null || true
-  ipt_traffic -t mangle -X "$DIRECT_TRAFFIC_CHAIN" 2>/dev/null || true
-  ipt_traffic -t mangle -X "$TRAFFIC_DOWNLOAD_CHAIN" 2>/dev/null || true
-}
-
-setup_device_traffic() {
-  log "setup device traffic counters"
-  cleanup_device_traffic
-  ipt_traffic -t raw -N "$TRAFFIC_UPLOAD_CHAIN" || return 1
-  ipt_traffic -t mangle -N "$DIRECT_TRAFFIC_CHAIN" || return 1
-  ipt_traffic -t mangle -N "$TRAFFIC_DOWNLOAD_CHAIN" || return 1
-  for slot in A B; do
-    ipt_traffic -t raw -N "${TRAFFIC_UPLOAD_CHAIN}_${slot}" || return 1
-    ipt_traffic -t raw -N "${TRAFFIC_UPLOAD_CHAIN}_${slot}_P" || return 1
-    ipt_traffic -t mangle -N "${DIRECT_TRAFFIC_CHAIN}_${slot}" || return 1
-    ipt_traffic -t mangle -N "${TRAFFIC_DOWNLOAD_CHAIN}_${slot}" || return 1
-    ipt_traffic -t mangle -N "${TRAFFIC_DOWNLOAD_CHAIN}_${slot}_P" || return 1
-  done
-  ipt_traffic -t raw -I PREROUTING 1 -j "$TRAFFIC_UPLOAD_CHAIN" || return 1
-  # sing-box inserts TPROXY at position 1 later; this jump then sees only packets not intercepted by it.
-  ipt_traffic -t mangle -I PREROUTING 1 -j "$DIRECT_TRAFFIC_CHAIN" || return 1
-  ipt_traffic -t mangle -I POSTROUTING 1 -j "$TRAFFIC_DOWNLOAD_CHAIN" || return 1
-  local policy_rule=4
-  for _cidr in $BYPASS_CIDRS; do
-    policy_rule=$((policy_rule + 1))
-  done
-  ipt_traffic -t mangle -I "$TPROXY_CHAIN" "$policy_rule" -j CONNMARK --set-xmark "0x0/$DIRECT_TRAFFIC_MARK" || return 1
-}
-
-enable_ip_forwarding() {
-  if [[ -w /proc/sys/net/ipv4/ip_forward ]]; then
-    printf '1' > /proc/sys/net/ipv4/ip_forward || true
-  elif command -v sysctl >/dev/null 2>&1; then
-    sysctl -w net.ipv4.ip_forward=1 >/dev/null 2>&1 || true
+setup_direct_bypass_set() {
+  if [[ "$DIRECT_BYPASS_CACHE" != "true" ]]; then
+    export DIRECT_BYPASS_CACHE
+    return
   fi
+
+  log "setup ipset ${DIRECT_BYPASS_SET} (timeout=${DIRECT_BYPASS_TTL}s)"
+  # Создаём с timeout; если уже существует — не трогаем (сохраняем накопленные записи)
+  ipset create "$DIRECT_BYPASS_SET" hash:ip timeout "$DIRECT_BYPASS_TTL" 2>/dev/null || true
+  # Экспортируем имя для использования в Node.js через env
+  export DIRECT_BYPASS_SET DIRECT_BYPASS_TTL DIRECT_BYPASS_CACHE
 }
 
 setup_proxy_firewall() {
@@ -193,7 +61,9 @@ setup_proxy_firewall() {
     return
   fi
 
+  log "setup proxy firewall for :${PROXY_PORT} (${PROXY_ALLOWED_CIDRS})"
   cleanup_proxy_firewall
+
   ipt -N "$PROXY_INPUT_CHAIN"
   for cidr in $PROXY_ALLOWED_CIDRS; do
     ipt -A "$PROXY_INPUT_CHAIN" -s "$cidr" -j RETURN
@@ -203,81 +73,52 @@ setup_proxy_firewall() {
   ipt -I INPUT -p udp --dport "$PROXY_PORT" -j "$PROXY_INPUT_CHAIN"
 }
 
-setup_gateway_forwarding() {
-  log "setup direct gateway forwarding"
-  cleanup_gateway_forwarding
-  enable_ip_forwarding
-
-  ipt -N "$GATEWAY_FORWARD_CHAIN"
-  ipt -t nat -N "$GATEWAY_NAT_CHAIN"
-  for cidr in $GATEWAY_CLIENT_CIDRS; do
-    ipt -A "$GATEWAY_FORWARD_CHAIN" -s "$cidr" -j ACCEPT
-    ipt -A "$GATEWAY_FORWARD_CHAIN" -d "$cidr" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-    ipt -t nat -A "$GATEWAY_NAT_CHAIN" -s "$cidr" -m addrtype ! --dst-type LOCAL -j MASQUERADE
-  done
-  ipt -I FORWARD 1 -j "$GATEWAY_FORWARD_CHAIN"
-  ipt -t nat -I POSTROUTING 1 -j "$GATEWAY_NAT_CHAIN"
-}
-
 setup_tproxy() {
-  log "setup tproxy on port ${TPROXY_PORT}"
+  log "setup tproxy on port ${TPROXY_PORT}, mark ${TPROXY_MARK}, table ${TPROXY_TABLE}"
   cleanup_tproxy
-  if ! setup_device_policy; then
-    log "device policy unavailable; using global VPN fallback"
-    cleanup_device_policy
-  fi
-  enable_ip_forwarding
 
   ip rule add fwmark "$TPROXY_MARK" table "$TPROXY_TABLE" 2>/dev/null || true
   ip route replace local 0.0.0.0/0 dev lo table "$TPROXY_TABLE"
+
   ipt -t mangle -N "$TPROXY_CHAIN"
+  # Пропускаем пакеты, адресованные самому хосту (ответы на исходящие соединения sing-box)
   ipt -t mangle -A "$TPROXY_CHAIN" -m addrtype --dst-type LOCAL -j RETURN
   ipt -t mangle -A "$TPROXY_CHAIN" -m mark --mark "$TPROXY_MARK" -j RETURN
-  ipt -t mangle -A "$TPROXY_CHAIN" -i 'br-+' -j RETURN
 
-  # Private/local destinations stay reachable; every intercepted public packet goes to VPN.
+  if [[ "$DIRECT_BYPASS_CACHE" == "true" ]]; then
+    # Direct bypass cache: IP-адреса из ipset идут напрямую, минуя sing-box.
+    # Включайте только если готовы к тому, что global rules для этих dst IP не будут проверяться.
+    ipt -t mangle -A "$TPROXY_CHAIN" -m set --match-set "$DIRECT_BYPASS_SET" dst -j RETURN
+  fi
+
   for cidr in $BYPASS_CIDRS; do
     ipt -t mangle -A "$TPROXY_CHAIN" -d "$cidr" -j RETURN
   done
-  if ipt -t mangle -L "$DEVICE_POLICY_CHAIN" -n >/dev/null 2>&1; then
-    ipt -t mangle -A "$TPROXY_CHAIN" -j "$DEVICE_POLICY_CHAIN"
-  else
-    ipt -t mangle -A "$TPROXY_CHAIN" -p tcp -j TPROXY --on-port "$TPROXY_PORT" --tproxy-mark "$TPROXY_MARK/$TPROXY_MARK"
-    ipt -t mangle -A "$TPROXY_CHAIN" -p udp -j TPROXY --on-port "$TPROXY_PORT" --tproxy-mark "$TPROXY_MARK/$TPROXY_MARK"
-  fi
+
+  ipt -t mangle -A "$TPROXY_CHAIN" -p tcp -j TPROXY --on-port "$TPROXY_PORT" --tproxy-mark "$TPROXY_MARK/$TPROXY_MARK"
+  ipt -t mangle -A "$TPROXY_CHAIN" -p udp -j TPROXY --on-port "$TPROXY_PORT" --tproxy-mark "$TPROXY_MARK/$TPROXY_MARK"
+  ipt -t mangle -A PREROUTING -j "$TPROXY_CHAIN"
 }
 
-setup_gateway_forwarding
+setup_direct_bypass_set
 setup_tproxy
-if validate_device_traffic_config; then
-  if ! setup_device_traffic; then
-    log "device traffic counters unavailable; VPN routing remains active"
-    cleanup_device_traffic
-  else
-    export DEVICE_TRAFFIC_ACCOUNTING_ENABLED=true
-  fi
-fi
 setup_proxy_firewall
 
-node /app/dist/server/main.js &
+node /app/src/server/index.js &
 APP_PID=$!
 
 shutdown() {
+  log "shutdown requested"
   kill "$APP_PID" 2>/dev/null || true
   wait "$APP_PID" 2>/dev/null || true
   cleanup_proxy_firewall
-  cleanup_device_traffic
   cleanup_tproxy
-  cleanup_device_policy
-  cleanup_gateway_forwarding
 }
 
 trap 'shutdown; exit 0' SIGTERM SIGINT
+
 wait "$APP_PID"
 STATUS=$?
 cleanup_proxy_firewall
-cleanup_device_traffic
 cleanup_tproxy
-cleanup_device_policy
-cleanup_gateway_forwarding
 exit "$STATUS"

index.html

@@ -3,11 +3,10 @@
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <link id="harbor-favicon" rel="icon" href="/harbor-connect.svg?v=2" type="image/svg+xml" sizes="any" />
-    <title>Harbor</title>
+    <title>VPN Proxy Gateway</title>
   </head>
   <body>
     <div id="root"></div>
-    <script type="module" src="/src/web/main.tsx"></script>
+    <script type="module" src="/src/web/App.jsx"></script>
   </body>
 </html>

install.sh

@@ -1,27 +0,0 @@
-#!/bin/sh
-set -eu
-
-need() {
-  command -v "$1" >/dev/null 2>&1 || {
-    printf '[harbor-connect] error: %s is required\n' "$1" >&2
-    exit 1
-  }
-}
-
-need curl
-need tar
-[ -x /bin/bash ] || { printf '[harbor-connect] error: /bin/bash is required\n' >&2; exit 1; }
-
-branch="${VPN_PROXY_BRANCH:-master}"
-archive_url="${VPN_PROXY_ARCHIVE_URL:-https://git.dokops.ru/dokril/vpn-proxy/archive/${branch}.tar.gz}"
-tmp="$(mktemp -d "${TMPDIR:-/tmp}/harbor-connect.XXXXXX")"
-trap 'rm -rf "$tmp"' 0 1 2 3 15
-
-mkdir -p "$tmp/source"
-curl -fsSL "$archive_url" | tar -xzf - -C "$tmp/source" --strip-components=1
-[ -f "$tmp/source/scripts/install-macos-client.sh" ] || {
-  printf '[harbor-connect] error: installer is missing from archive\n' >&2
-  exit 1
-}
-
-VPN_PROXY_SOURCE_DIR="$tmp/source" /bin/bash "$tmp/source/scripts/install-macos-client.sh"

package-lock.json

@@ -8,30 +8,15 @@
       "name": "vpn-proxy-gateway",
       "version": "0.1.0",
       "dependencies": {
-        "@bufbuild/protobuf": "2.6.0",
-        "@connectrpc/connect": "2.0.3",
-        "@connectrpc/connect-node": "2.0.3",
+        "@dnd-kit/core": "^6.3.1",
+        "@dnd-kit/sortable": "^10.0.0",
+        "@dnd-kit/utilities": "^3.2.2",
         "@vitejs/plugin-react": "^5.0.0",
         "react": "^19.0.0",
         "react-dom": "^19.0.0",
-        "tldts": "7.4.12",
         "vite": "^7.0.0"
       },
-      "devDependencies": {
-        "@babel/parser": "7.29.3",
-        "@bufbuild/buf": "1.47.2",
-        "@bufbuild/protoc-gen-es": "2.6.0",
-        "@csstools/selector-specificity": "6.0.0",
-        "@types/node": "24.13.4",
-        "@types/react": "^19.2.18",
-        "@types/react-dom": "^19.2.4",
-        "postcss": "8.5.14",
-        "postcss-selector-parser": "7.1.4",
-        "typescript": "7.0.2"
-      },
-      "engines": {
-        "node": "24.21.x"
-      }
+      "devDependencies": {}
     },
     "node_modules/@babel/code-frame": {
       "version": "7.29.0",
@@ -296,250 +281,57 @@
         "node": ">=6.9.0"
       }
     },
-    "node_modules/@bufbuild/buf": {
-      "version": "1.47.2",
-      "resolved": "https://registry.npmjs.org/@bufbuild/buf/-/buf-1.47.2.tgz",
-      "integrity": "sha512-glY5kCAoO4+a7HvDb+BLOdoHSdCk4mdXdkp53H8JFz7maOnkxCiHHXgRX+taFyEu25N8ybn7NjZFrZSdRwq2sA==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "buf": "bin/buf",
-        "protoc-gen-buf-breaking": "bin/protoc-gen-buf-breaking",
-        "protoc-gen-buf-lint": "bin/protoc-gen-buf-lint"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "optionalDependencies": {
-        "@bufbuild/buf-darwin-arm64": "1.47.2",
-        "@bufbuild/buf-darwin-x64": "1.47.2",
-        "@bufbuild/buf-linux-aarch64": "1.47.2",
-        "@bufbuild/buf-linux-armv7": "1.47.2",
-        "@bufbuild/buf-linux-x64": "1.47.2",
-        "@bufbuild/buf-win32-arm64": "1.47.2",
-        "@bufbuild/buf-win32-x64": "1.47.2"
-      }
-    },
-    "node_modules/@bufbuild/buf-darwin-arm64": {
-      "version": "1.47.2",
-      "resolved": "https://registry.npmjs.org/@bufbuild/buf-darwin-arm64/-/buf-darwin-arm64-1.47.2.tgz",
-      "integrity": "sha512-74WerFn06y+azgVfsnzhfbI5wla/OLPDnIvaNJBWHaqya/3bfascJkDylW2GVNHmwG1K/cscpmcc/RJPaO7ntQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@bufbuild/buf-darwin-x64": {
-      "version": "1.47.2",
-      "resolved": "https://registry.npmjs.org/@bufbuild/buf-darwin-x64/-/buf-darwin-x64-1.47.2.tgz",
-      "integrity": "sha512-adAiOacOQe8Ym/YXPCEiq9mrPeKRmDtF2TgqPWTcDy6mF7TqR7hMJINkEEuMd1EeACmXnzMOnXlm9ICtvdYgPg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@bufbuild/buf-linux-aarch64": {
-      "version": "1.47.2",
-      "resolved": "https://registry.npmjs.org/@bufbuild/buf-linux-aarch64/-/buf-linux-aarch64-1.47.2.tgz",
-      "integrity": "sha512-52vY+Owffr5diw2PyfQJqH+Fld6zW6NhNZak4zojvc2MjZKubWM0TfNyM9jXz2YrwyB+cyxkabE60nBI80m37w==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@bufbuild/buf-linux-armv7": {
-      "version": "1.47.2",
-      "resolved": "https://registry.npmjs.org/@bufbuild/buf-linux-armv7/-/buf-linux-armv7-1.47.2.tgz",
-      "integrity": "sha512-g9KtpObDeHZ/VG/0b5ZCieOao7L/WYZ0fPqFSs4N07D3APgEDhJG6vLyUcDgJMDgyLcgkNjNz0+XdYQb/tXyQw==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@bufbuild/buf-linux-x64": {
-      "version": "1.47.2",
-      "resolved": "https://registry.npmjs.org/@bufbuild/buf-linux-x64/-/buf-linux-x64-1.47.2.tgz",
-      "integrity": "sha512-MODCK2BzD1Mgoyr+5Sp8xA8qMNdytj8hYheyhA5NnCGTkQf8sfqAjpBSAAmKk6Zar8HOlVXML6tzE/ioDFFGwQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@bufbuild/buf-win32-arm64": {
-      "version": "1.47.2",
-      "resolved": "https://registry.npmjs.org/@bufbuild/buf-win32-arm64/-/buf-win32-arm64-1.47.2.tgz",
-      "integrity": "sha512-563YKYWJl3LrCY3G3+zuhb8HwOs6DzWslwGPFkKV2hwHyWyvd1DR1JjiLvw9zX64IKNctQ0HempSqc3kcboaqQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@bufbuild/buf-win32-x64": {
-      "version": "1.47.2",
-      "resolved": "https://registry.npmjs.org/@bufbuild/buf-win32-x64/-/buf-win32-x64-1.47.2.tgz",
-      "integrity": "sha512-Sqcdv7La2xBDh3bTdEYb2f4UTMMqCcYe/D0RELhvQ5wDn6I35V3/2YT1OF5fRuf0BZLCo0OdO37S9L47uHSz2g==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@bufbuild/protobuf": {
-      "version": "2.6.0",
-      "resolved": "https://registry.npmjs.org/@bufbuild/protobuf/-/protobuf-2.6.0.tgz",
-      "integrity": "sha512-6cuonJVNOIL7lTj5zgo/Rc2bKAo4/GvN+rKCrUj7GdEHRzCk8zKOfFwUsL9nAVk5rSIsRmlgcpLzTRysopEeeg==",
-      "license": "(Apache-2.0 AND BSD-3-Clause)"
-    },
-    "node_modules/@bufbuild/protoc-gen-es": {
-      "version": "2.6.0",
-      "resolved": "https://registry.npmjs.org/@bufbuild/protoc-gen-es/-/protoc-gen-es-2.6.0.tgz",
-      "integrity": "sha512-sKvgGndyw1stawiDKMLZyilj1BzMuUTlvyrBiDnzxGIjCMK4hoE0DsVBiqCuTFqENnLmEGdy+huOZ5KgQAGlFA==",
-      "dev": true,
-      "license": "Apache-2.0",
+    "node_modules/@dnd-kit/accessibility": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/@dnd-kit/accessibility/-/accessibility-3.1.1.tgz",
+      "integrity": "sha512-2P+YgaXF+gRsIihwwY1gCsQSYnu9Zyj2py8kY5fFvUM1qm2WA2u639R6YNVfU4GWr+ZM5mqEsfHZZLoRONbemw==",
+      "license": "MIT",
       "dependencies": {
-        "@bufbuild/protobuf": "^2.6.0",
-        "@bufbuild/protoplugin": "2.6.0"
-      },
-      "bin": {
-        "protoc-gen-es": "bin/protoc-gen-es"
-      },
-      "engines": {
-        "node": ">=14"
+        "tslib": "^2.0.0"
       },
       "peerDependencies": {
-        "@bufbuild/protobuf": "2.6.0"
-      },
-      "peerDependenciesMeta": {
-        "@bufbuild/protobuf": {
-          "optional": true
-        }
+        "react": ">=16.8.0"
       }
     },
-    "node_modules/@bufbuild/protoplugin": {
-      "version": "2.6.0",
-      "resolved": "https://registry.npmjs.org/@bufbuild/protoplugin/-/protoplugin-2.6.0.tgz",
-      "integrity": "sha512-mfAwI+4GqUtbw/ddfyolEHaAL86ozRIVlOg2A+SVRbjx1CjsMc1YJO+hBSkt/pqfpR+PmWBbZLstHbXP8KGtMQ==",
-      "dev": true,
-      "license": "Apache-2.0",
+    "node_modules/@dnd-kit/core": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/@dnd-kit/core/-/core-6.3.1.tgz",
+      "integrity": "sha512-xkGBRQQab4RLwgXxoqETICr6S5JlogafbhNsidmrkVv2YRs5MLwpjoF2qpiGjQt8S9AoxtIV603s0GIUpY5eYQ==",
+      "license": "MIT",
       "dependencies": {
-        "@bufbuild/protobuf": "2.6.0",
-        "@typescript/vfs": "^1.5.2",
-        "typescript": "5.4.5"
-      }
-    },
-    "node_modules/@bufbuild/protoplugin/node_modules/typescript": {
-      "version": "5.4.5",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.4.5.tgz",
-      "integrity": "sha512-vcI4UpRgg81oIRUFwR0WSIHKt11nJ7SAVlYNIu+QpqeyXP+gpQJy/Z4+F0aGxSE4MqwjyXvW/TzgkLAx2AGHwQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=14.17"
-      }
-    },
-    "node_modules/@connectrpc/connect": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/@connectrpc/connect/-/connect-2.0.3.tgz",
-      "integrity": "sha512-jAbVMHVtDCydGt2P20VpmLjbLtERqSV0RMSyQF3k2zhK8pzQ2QaCAcyVhufClqrOAFZUKL5BqVYtttaxvhmRgg==",
-      "license": "Apache-2.0",
-      "peerDependencies": {
-        "@bufbuild/protobuf": "^2.2.0"
-      }
-    },
-    "node_modules/@connectrpc/connect-node": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/@connectrpc/connect-node/-/connect-node-2.0.3.tgz",
-      "integrity": "sha512-GZ8WXBCeoZY31wzmnrrV4IA0nvYzEwqt9yHg304b7y/ovKh0IEbBuSWbee/hJu2Tt7PD0C8D4WUwheECCeLpQA==",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=18.14.1"
+        "@dnd-kit/accessibility": "^3.1.1",
+        "@dnd-kit/utilities": "^3.2.2",
+        "tslib": "^2.0.0"
       },
       "peerDependencies": {
-        "@bufbuild/protobuf": "^2.2.0",
-        "@connectrpc/connect": "2.0.3"
+        "react": ">=16.8.0",
+        "react-dom": ">=16.8.0"
       }
     },
-    "node_modules/@csstools/selector-specificity": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/@csstools/selector-specificity/-/selector-specificity-6.0.0.tgz",
-      "integrity": "sha512-4sSgl78OtOXEX/2d++8A83zHNTgwCJMaR24FvsYL7Uf/VS8HZk9PTwR51elTbGqMuwH3szLvvOXEaVnqn0Z3zA==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT-0",
-      "engines": {
-        "node": ">=20.19.0"
+    "node_modules/@dnd-kit/sortable": {
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/@dnd-kit/sortable/-/sortable-10.0.0.tgz",
+      "integrity": "sha512-+xqhmIIzvAYMGfBYYnbKuNicfSsk4RksY2XdmJhT+HAC01nix6fHCztU68jooFiMUB01Ky3F0FyOvhG/BZrWkg==",
+      "license": "MIT",
+      "dependencies": {
+        "@dnd-kit/utilities": "^3.2.2",
+        "tslib": "^2.0.0"
       },
       "peerDependencies": {
-        "postcss-selector-parser": "^7.1.1"
+        "@dnd-kit/core": "^6.3.0",
+        "react": ">=16.8.0"
+      }
+    },
+    "node_modules/@dnd-kit/utilities": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/@dnd-kit/utilities/-/utilities-3.2.2.tgz",
+      "integrity": "sha512-+MKAJEOfaBe5SmV6t34p80MMKhjvUz0vRrvVJbPT0WElzaOJ/1xs+D+KDv+tD/NE5ujfrChEcshd4fLn0wpiqg==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "peerDependencies": {
+        "react": ">=16.8.0"
       }
     },
     "node_modules/@esbuild/aix-ppc64": {
@@ -1381,389 +1173,6 @@
       "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
       "license": "MIT"
     },
-    "node_modules/@types/node": {
-      "version": "24.13.4",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.4.tgz",
-      "integrity": "sha512-YJ7EqCstVTzIr0fMr7qul/977en+pQHrfmuKIo6Zr9i75Be21dr3MovcfvGtyvi2HAUrRerWps5sMO9I7WaxDw==",
-      "devOptional": true,
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~7.18.0"
-      }
-    },
-    "node_modules/@types/react": {
-      "version": "19.2.18",
-      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.18.tgz",
-      "integrity": "sha512-AnzbBERsrLKtk2XSfTbYRLjQPdy116Sty4q+T+Bp3IC4l6jNBvreVPAHmpq9qhXQM7CXZPjLVmGMw9sy+hxQ3w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "csstype": "^3.2.2"
-      }
-    },
-    "node_modules/@types/react-dom": {
-      "version": "19.2.4",
-      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.2.4.tgz",
-      "integrity": "sha512-Bsc+QHgp+P/F02XDzNCY9jnZNCUuLki36KT7VKrTXXLdHf+vHMNZnW1rVu5DNW/rCK+fya3DATySbLM4yhtKUw==",
-      "dev": true,
-      "license": "MIT",
-      "peerDependencies": {
-        "@types/react": "^19.2.0"
-      }
-    },
-    "node_modules/@typescript/typescript-aix-ppc64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz",
-      "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-darwin-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz",
-      "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-darwin-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz",
-      "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-freebsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-freebsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz",
-      "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-arm": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz",
-      "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz",
-      "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-loong64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz",
-      "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==",
-      "cpu": [
-        "loong64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-mips64el": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz",
-      "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==",
-      "cpu": [
-        "mips64el"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-ppc64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz",
-      "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-riscv64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz",
-      "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-s390x": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz",
-      "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz",
-      "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-netbsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-netbsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz",
-      "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-openbsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-openbsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz",
-      "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-sunos-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz",
-      "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-win32-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-arm64/-/typescript-win32-arm64-7.0.2.tgz",
-      "integrity": "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-win32-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-x64/-/typescript-win32-x64-7.0.2.tgz",
-      "integrity": "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/vfs": {
-      "version": "1.6.4",
-      "resolved": "https://registry.npmjs.org/@typescript/vfs/-/vfs-1.6.4.tgz",
-      "integrity": "sha512-PJFXFS4ZJKiJ9Qiuix6Dz/OwEIqHD7Dme1UwZhTK11vR+5dqW2ACbdndWQexBzCx+CPuMe5WBYQWCsFyGlQLlQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.4.3"
-      },
-      "peerDependencies": {
-        "typescript": "*"
-      }
-    },
     "node_modules/@vitejs/plugin-react": {
       "version": "5.2.0",
       "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-5.2.0.tgz",
@@ -1855,26 +1264,6 @@
       "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
       "license": "MIT"
     },
-    "node_modules/cssesc": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/cssesc/-/cssesc-3.0.0.tgz",
-      "integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==",
-      "dev": true,
-      "license": "MIT",
-      "bin": {
-        "cssesc": "bin/cssesc"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/csstype": {
-      "version": "3.2.3",
-      "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
-      "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/debug": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
@@ -2103,20 +1492,6 @@
         "node": "^10 || ^12 || >=14"
       }
     },
-    "node_modules/postcss-selector-parser": {
-      "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.4.tgz",
-      "integrity": "sha512-HeP7D2wyhkR+XaK6v4W8oRF62Dsz4flyuczALJp61GckGm42u1saSSJ/0auvcBqxs3jMRFEcPK34At/0JBKdOg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "cssesc": "^3.0.0",
-        "util-deprecate": "^1.0.2"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/react": {
       "version": "19.2.6",
       "resolved": "https://registry.npmjs.org/react/-/react-19.2.6.tgz",
@@ -2231,65 +1606,11 @@
         "url": "https://github.com/sponsors/SuperchupuDev"
       }
     },
-    "node_modules/tldts": {
-      "version": "7.4.12",
-      "resolved": "https://registry.npmjs.org/tldts/-/tldts-7.4.12.tgz",
-      "integrity": "sha512-WylhSDKVeYnWXL3a+vKTaOxjnOeEGw938hImY8zoRWJjRRK/Jp1K+IihBzIONpUmW4e3WmXT6q5FW6vlESVZCA==",
-      "license": "MIT",
-      "dependencies": {
-        "tldts-core": "^7.4.12"
-      },
-      "bin": {
-        "tldts": "bin/cli.js"
-      }
-    },
-    "node_modules/tldts-core": {
-      "version": "7.4.12",
-      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.12.tgz",
-      "integrity": "sha512-nYNzS2WRf4QJmjzFFgAxLOBjyBxAGRbCy9PVBPaglcYyYajh40VBn+v5Ngr96ZMc7oM0+aCJdtQnNejvdBnXMQ==",
-      "license": "MIT"
-    },
-    "node_modules/typescript": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-7.0.2.tgz",
-      "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc"
-      },
-      "engines": {
-        "node": ">=16.20.0"
-      },
-      "optionalDependencies": {
-        "@typescript/typescript-aix-ppc64": "7.0.2",
-        "@typescript/typescript-darwin-arm64": "7.0.2",
-        "@typescript/typescript-darwin-x64": "7.0.2",
-        "@typescript/typescript-freebsd-arm64": "7.0.2",
-        "@typescript/typescript-freebsd-x64": "7.0.2",
-        "@typescript/typescript-linux-arm": "7.0.2",
-        "@typescript/typescript-linux-arm64": "7.0.2",
-        "@typescript/typescript-linux-loong64": "7.0.2",
-        "@typescript/typescript-linux-mips64el": "7.0.2",
-        "@typescript/typescript-linux-ppc64": "7.0.2",
-        "@typescript/typescript-linux-riscv64": "7.0.2",
-        "@typescript/typescript-linux-s390x": "7.0.2",
-        "@typescript/typescript-linux-x64": "7.0.2",
-        "@typescript/typescript-netbsd-arm64": "7.0.2",
-        "@typescript/typescript-netbsd-x64": "7.0.2",
-        "@typescript/typescript-openbsd-arm64": "7.0.2",
-        "@typescript/typescript-openbsd-x64": "7.0.2",
-        "@typescript/typescript-sunos-x64": "7.0.2",
-        "@typescript/typescript-win32-arm64": "7.0.2",
-        "@typescript/typescript-win32-x64": "7.0.2"
-      }
-    },
-    "node_modules/undici-types": {
-      "version": "7.18.2",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
-      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
-      "devOptional": true,
-      "license": "MIT"
+    "node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
     },
     "node_modules/update-browserslist-db": {
       "version": "1.2.3",
@@ -2321,13 +1642,6 @@
         "browserslist": ">= 4.21.0"
       }
     },
-    "node_modules/util-deprecate": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
-      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/vite": {
       "version": "7.3.3",
       "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.3.tgz",

package.json

@@ -2,47 +2,21 @@
   "name": "vpn-proxy-gateway",
   "version": "0.1.0",
   "private": true,
-  "engines": {
-    "node": "24.21.x"
-  },
   "type": "module",
   "description": "Gateway-first VPN proxy control panel for sing-box TProxy deployments.",
   "scripts": {
-    "check:runtime": "node scripts/check-sqlite-runtime.mjs",
-    "pretest": "npm run check:runtime",
     "dev": "vite --host 0.0.0.0",
-    "generate:singbox-api": "XDG_CACHE_HOME=${TMPDIR:-/tmp}/harbor-buf-cache buf generate --template buf.gen.yaml",
     "build": "vite build",
-    "build:production": "npm run build && npm run build:server",
-    "build:server": "tsc -p tsconfig.server.json",
-    "build:test": "npm run build:production && node scripts/clean-test-dist.mjs && tsc -p tsconfig.test.json",
-    "check:boundaries": "node scripts/check-import-boundaries.mjs",
-    "prestart": "npm run build:production",
-    "test": "npm run build:test && node --test",
-    "typecheck": "tsc -p tsconfig.web.json && tsc -p tsconfig.server.json --noEmit",
-    "version:harbor": "node scripts/harbor-version.mjs",
-    "start": "node dist/server/main.js"
+    "test": "node --test",
+    "start": "node src/server/index.js"
   },
   "dependencies": {
-    "@bufbuild/protobuf": "2.6.0",
-    "@connectrpc/connect": "2.0.3",
-    "@connectrpc/connect-node": "2.0.3",
+    "@dnd-kit/core": "^6.3.1",
+    "@dnd-kit/sortable": "^10.0.0",
+    "@dnd-kit/utilities": "^3.2.2",
     "@vitejs/plugin-react": "^5.0.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
-    "tldts": "7.4.12",
     "vite": "^7.0.0"
-  },
-  "devDependencies": {
-    "@babel/parser": "7.29.3",
-    "@bufbuild/buf": "1.47.2",
-    "@bufbuild/protoc-gen-es": "2.6.0",
-    "@csstools/selector-specificity": "6.0.0",
-    "@types/node": "24.13.4",
-    "@types/react": "^19.2.18",
-    "@types/react-dom": "^19.2.4",
-    "postcss": "8.5.14",
-    "postcss-selector-parser": "7.1.4",
-    "typescript": "7.0.2"
   }
 }

proto/sing-box/v1.14.0-rc.5/daemon/started_service.proto

@@ -1,808 +0,0 @@
-syntax = "proto3";
-
-package daemon;
-option go_package = "github.com/sagernet/sing-box/daemon";
-
-import "google/protobuf/empty.proto";
-
-service StartedService {
-  rpc GetVersion(google.protobuf.Empty) returns(Version) {}
-  rpc SubscribeServiceStatus(google.protobuf.Empty) returns(stream ServiceStatus) {}
-  rpc SubscribeLog(google.protobuf.Empty) returns(stream Log) {}
-  rpc GetDefaultLogLevel(google.protobuf.Empty) returns(DefaultLogLevel) {}
-  rpc ClearLogs(google.protobuf.Empty) returns(google.protobuf.Empty) {}
-  rpc SubscribeStatus(SubscribeStatusRequest) returns(stream Status) {}
-  rpc SubscribeGroups(google.protobuf.Empty) returns(stream Groups) {}
-
-  rpc GetClashModeStatus(google.protobuf.Empty) returns(ClashModeStatus) {}
-  rpc SubscribeClashMode(google.protobuf.Empty) returns(stream ClashMode) {}
-  rpc SetClashMode(ClashMode) returns(google.protobuf.Empty) {}
-
-  rpc URLTest(URLTestRequest) returns(google.protobuf.Empty) {}
-  rpc SelectOutbound(SelectOutboundRequest) returns (google.protobuf.Empty) {}
-  rpc SetGroupExpand(SetGroupExpandRequest) returns (google.protobuf.Empty) {}
-
-  rpc SubscribeConnections(SubscribeConnectionsRequest) returns(stream ConnectionEvents) {}
-  rpc CloseConnection(CloseConnectionRequest) returns(google.protobuf.Empty) {}
-  rpc CloseAllConnections(google.protobuf.Empty) returns(google.protobuf.Empty) {}
-  rpc GetDeprecatedWarnings(google.protobuf.Empty) returns(DeprecatedWarnings) {}
-  rpc GetStartedAt(google.protobuf.Empty) returns(StartedAt) {}
-
-  rpc SubscribeOutbounds(google.protobuf.Empty) returns (stream OutboundList) {}
-  rpc StartNetworkQualityTest(NetworkQualityTestRequest) returns (stream NetworkQualityTestProgress) {}
-  rpc StartSTUNTest(STUNTestRequest) returns (stream STUNTestProgress) {}
-  rpc SubscribeTailscaleStatus(google.protobuf.Empty) returns (stream TailscaleStatusUpdate) {}
-  rpc StartTailscalePing(TailscalePingRequest) returns (stream TailscalePingResponse) {}
-  rpc SetTailscaleExitNode(SetTailscaleExitNodeRequest) returns (google.protobuf.Empty) {}
-  rpc TailscaleLogout(TailscaleLogoutRequest) returns (google.protobuf.Empty) {}
-  rpc GetTailscaleCertificate(TailscaleCertificateRequest) returns (TailscaleCertificate) {}
-  rpc StartTailscaleSSHSession(stream TailscaleSSHClientMessage) returns (stream TailscaleSSHServerMessage) {}
-  rpc SubscribeTaildropInbox(SubscribeTaildropInboxRequest) returns (stream TaildropInbox) {}
-  rpc MarkTaildropInboxRead(MarkTaildropInboxReadRequest) returns (google.protobuf.Empty) {}
-  rpc SendTaildropFiles(stream TaildropSendClientMessage) returns (stream TaildropSendServerMessage) {}
-  rpc DownloadTaildropFile(DownloadTaildropFileRequest) returns (stream DownloadTaildropFileChunk) {}
-  rpc DeleteTaildropFile(DeleteTaildropFileRequest) returns (google.protobuf.Empty) {}
-  rpc CancelTaildropReceiving(CancelTaildropReceivingRequest) returns (google.protobuf.Empty) {}
-  rpc ProvideUSBDevices(stream USBProviderMessage) returns (stream USBServerMessage) {}
-  rpc SubscribeUSBIPServerStatus(google.protobuf.Empty) returns (stream USBIPServerStatusUpdate) {}
-  rpc SubscribeOpenConnectStatus(google.protobuf.Empty) returns (stream OpenConnectStatusUpdate) {}
-  rpc SubmitOpenConnectAuthResponse(OpenConnectAuthResponseSubmission) returns (google.protobuf.Empty) {}
-  rpc CancelOpenConnectAuthChallenge(OpenConnectAuthChallengeCancel) returns (google.protobuf.Empty) {}
-  rpc SubscribeOpenVPNStatus(google.protobuf.Empty) returns (stream OpenVPNStatusUpdate) {}
-  rpc SubmitOpenVPNChallengeResponse(OpenVPNChallengeSubmission) returns (google.protobuf.Empty) {}
-  rpc CancelOpenVPNChallenge(OpenVPNChallengeCancel) returns (google.protobuf.Empty) {}
-  rpc SubscribeNotifications(google.protobuf.Empty) returns (stream NotificationEvent) {}
-}
-
-message Version {
-  string version = 1;
-  int32 apiVersion = 2;
-}
-
-message ServiceStatus {
-  enum Type {
-    IDLE = 0;
-    STARTING = 1;
-    STARTED = 2;
-    STOPPING = 3;
-    FATAL = 4;
-  }
-  Type status = 1;
-  string errorMessage = 2;
-}
-
-message SubscribeStatusRequest {
-  int64 interval = 1;
-}
-
-enum LogLevel {
-  PANIC = 0;
-  FATAL = 1;
-  ERROR = 2;
-  WARN = 3;
-  INFO = 4;
-  DEBUG = 5;
-  TRACE = 6;
-}
-
-message Log {
-  repeated Message messages = 1;
-  bool reset = 2;
-  message Message {
-    LogLevel level = 1;
-    string message = 2;
-  }
-}
-
-message DefaultLogLevel {
-  LogLevel level = 1;
-}
-
-message Status {
-  uint64 memory = 1;
-  int32 goroutines = 2;
-  int32 connectionsIn = 3;
-  int32 connectionsOut = 4;
-  bool trafficAvailable = 5;
-  int64 uplink = 6;
-  int64 downlink = 7;
-  int64 uplinkTotal = 8;
-  int64 downlinkTotal = 9;
-}
-
-message Groups {
-  repeated Group group = 1;
-}
-
-message Group {
-  string tag = 1;
-  string type = 2;
-  bool selectable = 3;
-  string selected = 4;
-  bool isExpand = 5;
-  repeated GroupItem items = 6;
-}
-
-message GroupItem {
-  string tag = 1;
-  string type = 2;
-  int64 urlTestTime = 3;
-  int32 urlTestDelay = 4;
-}
-
-message URLTestRequest {
-  string outboundTag = 1;
-}
-
-message SelectOutboundRequest {
-  string groupTag = 1;
-  string outboundTag = 2;
-}
-
-message SetGroupExpandRequest {
-  string groupTag = 1;
-  bool isExpand = 2;
-}
-
-message ClashMode {
-  string mode = 3;
-}
-
-message ClashModeStatus {
-  repeated string modeList = 1;
-  string currentMode = 2;
-}
-
-message SubscribeConnectionsRequest {
-  int64 interval = 1;
-}
-
-enum ConnectionEventType {
-  CONNECTION_EVENT_NEW = 0;
-  CONNECTION_EVENT_UPDATE = 1;
-  CONNECTION_EVENT_CLOSED = 2;
-}
-
-message ConnectionEvent {
-  ConnectionEventType type = 1;
-  string id = 2;
-  Connection connection = 3;
-  int64 uplinkDelta = 4;
-  int64 downlinkDelta = 5;
-  int64 closedAt = 6;
-}
-
-message ConnectionEvents {
-  repeated ConnectionEvent events = 1;
-  bool reset = 2;
-}
-
-message Connection {
-  string id = 1;
-  string inbound = 2;
-  string inboundType = 3;
-  int32 ipVersion = 4;
-  string network = 5;
-  string source = 6;
-  string destination = 7;
-  string domain = 8;
-  string protocol = 9;
-  string user = 10;
-  string fromOutbound = 11;
-  int64 createdAt = 12;
-  int64 closedAt = 13;
-  int64 uplink = 14;
-  int64 downlink = 15;
-  int64 uplinkTotal = 16;
-  int64 downlinkTotal = 17;
-  string rule = 18;
-  string outbound = 19;
-  string outboundType = 20;
-  repeated string chainList = 21;
-  ProcessInfo processInfo = 22;
-}
-
-message ProcessInfo {
-  uint32 processId = 1;
-  int32 userId = 2;
-  string userName = 3;
-  string processPath = 4;
-  repeated string packageNames = 5;
-}
-
-message CloseConnectionRequest {
-  string id = 1;
-}
-
-message DeprecatedWarnings {
-  repeated DeprecatedWarning warnings = 1;
-}
-
-message DeprecatedWarning {
-  string message = 1;
-  bool impending = 2;
-  string migrationLink = 3;
-  string description = 4;
-  string deprecatedVersion = 5;
-  string scheduledVersion = 6;
-}
-
-message StartedAt {
-  int64 startedAt = 1;
-}
-
-message OutboundList {
-  repeated GroupItem outbounds = 1;
-}
-
-message NetworkQualityTestRequest {
-  string configURL = 1;
-  string outboundTag = 2;
-  bool serial = 3;
-  int32 maxRuntimeSeconds = 4;
-  bool http3 = 5;
-}
-
-message NetworkQualityTestProgress {
-  int32 phase = 1;
-  int64 downloadCapacity = 2;
-  int64 uploadCapacity = 3;
-  int32 downloadRPM = 4;
-  int32 uploadRPM = 5;
-  int32 idleLatencyMs = 6;
-  int64 elapsedMs = 7;
-  bool isFinal = 8;
-  string error = 9;
-  int32 downloadCapacityAccuracy = 10;
-  int32 uploadCapacityAccuracy = 11;
-  int32 downloadRPMAccuracy = 12;
-  int32 uploadRPMAccuracy = 13;
-}
-
-message STUNTestRequest {
-  string server = 1;
-  string outboundTag = 2;
-}
-
-message STUNTestProgress {
-  int32 phase = 1;
-  string externalAddr = 2;
-  int32 latencyMs = 3;
-  int32 natMapping = 4;
-  int32 natFiltering = 5;
-  bool isFinal = 6;
-  string error = 7;
-  bool natTypeSupported = 8;
-}
-
-message TailscaleStatusUpdate {
-  repeated TailscaleEndpointStatus endpoints = 1;
-}
-
-message TailscaleEndpointStatus {
-  string endpointTag = 1;
-  string backendState = 2;
-  string stateText = 3;
-  string authURL = 4;
-  string networkName = 5;
-  string magicDNSSuffix = 6;
-  TailscalePeer self = 7;
-  repeated TailscaleUserGroup userGroups = 8;
-  TailscalePeer exitNode = 9;
-  bool keyAuth = 10;
-  bool canShareFiles = 11;
-  int32 waitingFileCount = 12;
-  int32 receivingFileCount = 13;
-  int32 unreadFileCount = 14;
-  repeated string certDomains = 15;
-}
-
-message TailscaleUserGroup {
-  int64 userID = 1;
-  string loginName = 2;
-  string displayName = 3;
-  string profilePicURL = 4;
-  repeated TailscalePeer peers = 5;
-}
-
-message TailscalePeer {
-  string hostName = 1;
-  string dnsName = 2;
-  string os = 3;
-  repeated string tailscaleIPs = 4;
-  bool online = 5;
-  bool exitNode = 6;
-  bool exitNodeOption = 7;
-  bool active = 8;
-  int64 rxBytes = 9;
-  int64 txBytes = 10;
-  int64 keyExpiry = 11;
-  string stableID = 12;
-  bool expired = 13;
-  repeated string sshHostKeys = 14;
-  bool shareeNode = 15;
-  int64 lastSeen = 16;
-  bool canReceiveFiles = 17;
-}
-
-message TailscalePingRequest {
-  string endpointTag = 1;
-  string peerIP = 2;
-}
-
-message TailscalePingResponse {
-  double latencyMs = 1;
-  bool isDirect = 2;
-  string endpoint = 3;
-  int32 derpRegionID = 4;
-  string derpRegionCode = 5;
-  string error = 6;
-  string peerRelay = 7;
-}
-
-message SetTailscaleExitNodeRequest {
-  string endpointTag = 1;
-  string stableID = 2;
-}
-
-message TailscaleLogoutRequest {
-  string endpointTag = 1;
-}
-
-message TailscaleCertificateRequest {
-  string endpointTag = 1;
-  string domain = 2;
-  int64 minValiditySeconds = 3;
-}
-
-message TailscaleCertificate {
-  bytes certificatePEM = 1;
-  bytes privateKeyPEM = 2;
-}
-
-message TailscaleSSHClientMessage {
-  oneof message {
-    TailscaleSSHStart start = 1;
-    TailscaleSSHInput input = 2;
-    TailscaleSSHResize resize = 3;
-  }
-}
-
-message TailscaleSSHStart {
-  string endpointTag = 1;
-  string peerAddress = 2;
-  string username = 3;
-  string terminalType = 4;
-  int32 columns = 5;
-  int32 rows = 6;
-  int32 widthPixels = 7;
-  int32 heightPixels = 8;
-  repeated string hostKeys = 9;
-  bool forward_agent = 10;
-}
-
-message TailscaleSSHInput {
-  bytes data = 1;
-}
-
-message TailscaleSSHResize {
-  int32 columns = 1;
-  int32 rows = 2;
-  int32 widthPixels = 3;
-  int32 heightPixels = 4;
-}
-
-message TailscaleSSHServerMessage {
-  oneof message {
-    TailscaleSSHAuthBanner authBanner = 1;
-    TailscaleSSHReady ready = 2;
-    TailscaleSSHOutput output = 3;
-    TailscaleSSHExit exit = 4;
-    TailscaleSSHError error = 5;
-  }
-}
-
-message TailscaleSSHAuthBanner {
-  string message = 1;
-}
-
-message TailscaleSSHReady {
-}
-
-message TailscaleSSHOutput {
-  bytes data = 1;
-}
-
-message TailscaleSSHExit {
-  int32 exitCode = 1;
-  string signal = 2;
-  string errorMessage = 3;
-}
-
-message TailscaleSSHError {
-  string message = 1;
-}
-
-message SubscribeTaildropInboxRequest {
-  string endpointTag = 1;
-}
-
-message MarkTaildropInboxReadRequest {
-  string endpointTag = 1;
-}
-
-message TaildropInbox {
-  string endpointTag = 1;
-  repeated TaildropFile files = 2;
-  repeated TaildropReceivingFile receiving = 3;
-}
-
-message TaildropFile {
-  string name = 1;
-  int64 size = 2;
-  string senderName = 3;
-  int64 modifiedAt = 4;
-}
-
-message TaildropReceivingFile {
-  string name = 1;
-  int64 size = 2;
-  int64 receivedBytes = 3;
-  string senderID = 4;
-  string senderName = 5;
-}
-
-message TaildropSendClientMessage {
-  oneof message {
-    TaildropSendStart start = 1;
-    TaildropFileChunk chunk = 2;
-    TaildropFileDone fileDone = 3;
-  }
-}
-
-message TaildropSendStart {
-  string endpointTag = 1;
-  string peerStableID = 2;
-  repeated TaildropOutgoingFile files = 3;
-}
-
-message TaildropOutgoingFile {
-  string name = 1;
-  int64 size = 2;
-}
-
-message TaildropFileChunk {
-  bytes data = 1;
-}
-
-message TaildropFileDone {}
-
-message TaildropSendServerMessage {
-  oneof message {
-    TaildropSendProgress progress = 1;
-    int64 receivedBytes = 2;
-  }
-}
-
-message TaildropSendProgress {
-  int32 fileIndex = 1;
-  int64 sentBytes = 2;
-  bool fileCompleted = 3;
-}
-
-message DownloadTaildropFileRequest {
-  string endpointTag = 1;
-  string name = 2;
-}
-
-message DownloadTaildropFileChunk {
-  int64 size = 1;
-  bytes data = 2;
-}
-
-message DeleteTaildropFileRequest {
-  string endpointTag = 1;
-  string name = 2;
-}
-
-message CancelTaildropReceivingRequest {
-  string endpointTag = 1;
-  string senderID = 2;
-  string name = 3;
-}
-
-message USBProviderMessage {
-  oneof message {
-    USBDeviceAttach attach = 1;
-    USBDeviceDetach detach = 2;
-    USBURBResponse urbResponse = 3;
-  }
-}
-
-message USBServerMessage {
-  oneof message {
-    USBDeviceReady ready = 1;
-    USBURBRequest urbRequest = 2;
-    USBEndpointAbort abort = 3;
-    USBError error = 4;
-  }
-}
-
-message USBDeviceDescriptor {
-  string deviceId = 1;
-  uint32 busNum = 2;
-  uint32 devNum = 3;
-  uint32 speed = 4;
-  uint32 vendorId = 5;
-  uint32 productId = 6;
-  uint32 bcdDevice = 7;
-  uint32 deviceClass = 8;
-  uint32 deviceSubClass = 9;
-  uint32 deviceProtocol = 10;
-  uint32 configurationValue = 11;
-  uint32 numConfigurations = 12;
-  repeated USBInterface interfaces = 13;
-  string serial = 14;
-  string product = 15;
-}
-
-message USBDeviceAttach {
-  string serverTag = 1;
-  USBDeviceDescriptor descriptor = 2;
-}
-
-message USBInterface {
-  uint32 interfaceClass = 1;
-  uint32 interfaceSubClass = 2;
-  uint32 interfaceProtocol = 3;
-}
-
-message USBDeviceDetach {
-  string deviceId = 1;
-}
-
-message USBDeviceReady {
-  string deviceId = 1;
-  string busId = 2;
-}
-
-message USBURBRequest {
-  string deviceId = 1;
-  uint64 seq = 2;
-  uint32 endpoint = 3;
-  bool directionIn = 4;
-  uint32 transferFlags = 5;
-  bytes setup = 6;
-  uint32 transferBufferLength = 7;
-  bytes outData = 8;
-  int32 numberOfPackets = 9;
-  int32 startFrame = 10;
-  int32 interval = 11;
-  repeated USBIsoPacket isoPackets = 12;
-}
-
-message USBURBResponse {
-  string deviceId = 1;
-  uint64 seq = 2;
-  int32 status = 3;
-  int32 actualLength = 4;
-  bytes inData = 5;
-  repeated USBIsoPacket isoPackets = 6;
-}
-
-message USBIsoPacket {
-  int32 offset = 1;
-  int32 length = 2;
-  int32 actualLength = 3;
-  int32 status = 4;
-}
-
-message USBEndpointAbort {
-  string deviceId = 1;
-  uint32 endpoint = 2;
-}
-
-message USBError {
-  string deviceId = 1;
-  string message = 2;
-}
-
-message USBIPServerStatusUpdate {
-  repeated USBIPServerStatus servers = 1;
-}
-
-message USBIPServerStatus {
-  string serverTag = 1;
-  repeated USBSharedDevice devices = 2;
-}
-
-message USBSharedDevice {
-  USBDeviceDescriptor descriptor = 1;
-  string busId = 2;
-  string stableId = 3;
-  USBBackend backend = 4;
-  USBDeviceState state = 5;
-}
-
-enum USBDeviceState {
-  USB_DEVICE_STATE_IDLE = 0;
-  USB_DEVICE_STATE_ATTACHED = 1;
-  USB_DEVICE_STATE_UNAVAILABLE = 2;
-}
-
-enum USBBackend {
-  USB_BACKEND_UNSPECIFIED = 0;
-  USB_BACKEND_LINUX_SYSFS = 1;
-  USB_BACKEND_DYNAMIC = 2;
-  USB_BACKEND_DARWIN_IOKIT = 3;
-  USB_BACKEND_WINDOWS_VBOXUSB = 4;
-}
-
-message OpenConnectStatusUpdate {
-  repeated OpenConnectEndpointStatus endpoints = 1;
-}
-
-message OpenConnectEndpointStatus {
-  string endpointTag = 1;
-  string state = 2;
-  string stateText = 3;
-  OpenConnectAuthChallenge authChallenge = 4;
-  string error = 5;
-  OpenConnectTunnelInfo tunnelInfo = 6;
-}
-
-message OpenConnectTunnelInfo {
-  string server = 1;
-  string flavor = 2;
-  string transport = 3;
-  repeated string ipv4 = 4;
-  repeated string ipv6 = 5;
-  repeated string dns = 6;
-  uint32 mtu = 7;
-  int64 connectedSince = 8;
-}
-
-message OpenConnectAuthChallenge {
-  string id = 1;
-  string banner = 2;
-  string message = 3;
-  string error = 4;
-  oneof challenge {
-    OpenConnectAuthForm form = 5;
-    OpenConnectBrowserRequest browser = 6;
-  }
-}
-
-message OpenConnectAuthForm {
-  repeated OpenConnectAuthFormField fields = 1;
-}
-
-message OpenConnectAuthFormField {
-  string submissionKey = 1;
-  string name = 2;
-  string label = 3;
-  string kind = 4;
-  string value = 5;
-  repeated OpenConnectAuthFormChoice options = 6;
-}
-
-message OpenConnectAuthFormChoice {
-  string value = 1;
-  string label = 2;
-}
-
-message OpenConnectBrowserRequest {
-  string url = 1;
-  string finalURL = 2;
-  repeated string cookieNames = 3;
-  repeated string headerNames = 4;
-  repeated string callbackURLPrefixes = 5;
-  repeated string earlyCookieNames = 6;
-  string cacheID = 7;
-}
-
-message OpenConnectBrowserCookie {
-  string name = 1;
-  string value = 2;
-}
-
-message OpenConnectBrowserHeader {
-  string name = 1;
-  repeated string values = 2;
-}
-
-message OpenConnectAuthFormResponse {
-  map<string, string> values = 1;
-}
-
-message OpenConnectBrowserResult {
-  string finalURL = 1;
-  repeated OpenConnectBrowserCookie cookies = 2;
-  repeated OpenConnectBrowserHeader headers = 3;
-}
-
-message OpenConnectAuthResponseSubmission {
-  string endpointTag = 1;
-  string challengeID = 2;
-  oneof response {
-    OpenConnectAuthFormResponse form = 3;
-    OpenConnectBrowserResult browser = 4;
-  }
-}
-
-message OpenConnectAuthChallengeCancel {
-  string endpointTag = 1;
-  string challengeID = 2;
-}
-
-message OpenVPNStatusUpdate {
-  repeated OpenVPNEndpointStatus endpoints = 1;
-}
-
-message OpenVPNEndpointStatus {
-  string endpointTag = 1;
-  string state = 2;
-  string stateText = 3;
-  OpenVPNChallenge challenge = 4;
-  string error = 5;
-  OpenVPNTunnelInfo tunnelInfo = 6;
-}
-
-message OpenVPNTunnelInfo {
-  string server = 1;
-  reserved 2;
-  string network = 3;
-  repeated string ipv4 = 4;
-  repeated string ipv6 = 5;
-  repeated string dns = 6;
-  uint32 mtu = 7;
-  int64 connectedSince = 8;
-  string cipher = 9;
-}
-
-message OpenVPNChallenge {
-  string id = 1;
-  string kind = 2;
-  string username = 3;
-  string message = 4;
-  string url = 5;
-  string secretMessage = 6;
-  bool echo = 7;
-  string previousError = 8;
-  int64 deadline = 9;
-}
-
-message OpenVPNChallengeSubmission {
-  string endpointTag = 1;
-  string challengeID = 2;
-  string username = 3;
-  string password = 4;
-  string secret = 5;
-}
-
-message OpenVPNChallengeCancel {
-  string endpointTag = 1;
-  string challengeID = 2;
-}
-
-message NotificationEvent {
-  oneof event {
-    Notification send = 1;
-    NotificationCancel cancel = 2;
-  }
-}
-
-message Notification {
-  string identifier = 1;
-  string typeName = 2;
-  int32 typeID = 3;
-  string title = 4;
-  string subtitle = 5;
-  string body = 6;
-  string openURL = 7;
-}
-
-message NotificationCancel {
-  string identifier = 1;
-  int32 typeID = 2;
-}

public/harbor-connect.svg

@@ -1,8 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
-  <rect width="32" height="32" rx="9" fill="#101812"/>
-  <circle cx="16" cy="16" r="11" fill="#56c9bd" opacity=".09"/>
-  <g fill="none" stroke="#62d6c9" stroke-width="2.6" stroke-linecap="round">
-    <path d="M16 6.5v9"/>
-    <path d="M10.1 10.3a8 8 0 1 0 11.8 0"/>
-  </g>
-</svg>

public/harbor-gateway.svg

@@ -1,8 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
-  <rect width="32" height="32" rx="9" fill="#18150f"/>
-  <circle cx="16" cy="7" r="2.5" fill="none" stroke="#efad58" stroke-width="2.3"/>
-  <g fill="none" stroke="#efad58" stroke-width="2.3" stroke-linecap="round" stroke-linejoin="round">
-    <path d="M16 9.5V25M10.5 14h11"/>
-    <path d="M16 27c-5 0-8-2.8-9.5-6.5M16 27c5 0 8-2.8 9.5-6.5"/>
-  </g>
-</svg>

scripts/build-on-107-deploy-111.sh

@@ -10,9 +10,8 @@ GIT_REF="$(git rev-parse --short HEAD 2>/dev/null || echo manual)"
 IMAGE_TAG="${IMAGE_TAG:-${GIT_REF}-$(date +%Y%m%d%H%M%S)}"
 GATEWAY_IMAGE="${GATEWAY_IMAGE:-${IMAGE_NAME}:${IMAGE_TAG}}"
 BASE_IMAGE="${BASE_IMAGE:-vpn-proxy-runtime-base:bookworm-slim}"
-NODE_BUILD_IMAGE="${NODE_BUILD_IMAGE:-node:24.21.0-bookworm}"
 RUNTIME_BASE_SOURCE_IMAGE="${RUNTIME_BASE_SOURCE_IMAGE:-mirror.gcr.io/library/debian:bookworm-slim}"
-SINGBOX_VERSION="${SINGBOX_VERSION:-1.14.0-rc.5}"
+SINGBOX_VERSION="${SINGBOX_VERSION:-1.12.13}"
 DOCKER_BUILD_PULL="${DOCKER_BUILD_PULL:-false}"
 INSTALL_RUNTIME_DEPS="${INSTALL_RUNTIME_DEPS:-false}"
 INSTALL_SINGBOX="${INSTALL_SINGBOX:-false}"
@@ -63,7 +62,7 @@ else
 fi
 
 echo "Building image on ${BUILD_HOST}"
-BUILD_COMMAND="set -e; echo 'Docker context:' \$(docker context show 2>/dev/null || true); docker info 2>/dev/null | sed -n '/HTTP Proxy:/p;/HTTPS Proxy:/p;/Name:/p'; cd '${BUILD_PATH}'; if ! docker image inspect '${BASE_IMAGE}' >/dev/null 2>&1 || ! docker run --rm '${BASE_IMAGE}' sh -lc \"command -v npm >/dev/null && sing-box version 2>&1 | grep -Fx 'sing-box version ${SINGBOX_VERSION}'\"; then if [ '${AUTO_BUILD_RUNTIME_BASE}' = 'true' ]; then echo 'Runtime base image ${BASE_IMAGE} is missing or does not contain sing-box ${SINGBOX_VERSION}; building it now.'; BASE_IMAGE='${RUNTIME_BASE_SOURCE_IMAGE}' RUNTIME_BASE_IMAGE='${BASE_IMAGE}' SINGBOX_VERSION='${SINGBOX_VERSION}' ./scripts/build-runtime-base.sh; else echo 'Runtime base image ${BASE_IMAGE} is missing or does not contain sing-box ${SINGBOX_VERSION} on ${BUILD_HOST}.'; echo 'Seed it once with: ./scripts/build-runtime-base.sh'; exit 1; fi; fi; docker run --rm '${BASE_IMAGE}' sh -lc \"command -v npm >/dev/null && sing-box version 2>&1 | grep -Fx 'sing-box version ${SINGBOX_VERSION}'\"; node scripts/check-sqlite-runtime.mjs && npm ci && npm run build:production && docker build --pull='${DOCKER_BUILD_PULL}' --build-arg NODE_BUILD_IMAGE='${NODE_BUILD_IMAGE}' --build-arg BASE_IMAGE='${BASE_IMAGE}' --build-arg SINGBOX_VERSION='${SINGBOX_VERSION}' --build-arg INSTALL_RUNTIME_DEPS='${INSTALL_RUNTIME_DEPS}' --build-arg INSTALL_SINGBOX='${INSTALL_SINGBOX}' -t '${GATEWAY_IMAGE}' . && docker run --rm --entrypoint sing-box '${GATEWAY_IMAGE}' version 2>&1 | grep -Fx 'sing-box version ${SINGBOX_VERSION}'"
+BUILD_COMMAND="set -e; echo 'Docker context:' \$(docker context show 2>/dev/null || true); docker info 2>/dev/null | sed -n '/HTTP Proxy:/p;/HTTPS Proxy:/p;/Name:/p'; cd '${BUILD_PATH}'; if ! docker image inspect '${BASE_IMAGE}' >/dev/null 2>&1; then if [ '${AUTO_BUILD_RUNTIME_BASE}' = 'true' ]; then echo 'Runtime base image ${BASE_IMAGE} is missing on ${BUILD_HOST}; building it now.'; BASE_IMAGE='${RUNTIME_BASE_SOURCE_IMAGE}' RUNTIME_BASE_IMAGE='${BASE_IMAGE}' SINGBOX_VERSION='${SINGBOX_VERSION}' ./scripts/build-runtime-base.sh; else echo 'Runtime base image ${BASE_IMAGE} is missing on ${BUILD_HOST}.'; echo 'Seed it once with: ./scripts/build-runtime-base.sh'; exit 1; fi; fi; npm ci && npm run build && docker build --pull='${DOCKER_BUILD_PULL}' --build-arg BASE_IMAGE='${BASE_IMAGE}' --build-arg SINGBOX_VERSION='${SINGBOX_VERSION}' --build-arg INSTALL_RUNTIME_DEPS='${INSTALL_RUNTIME_DEPS}' --build-arg INSTALL_SINGBOX='${INSTALL_SINGBOX}' -t '${GATEWAY_IMAGE}' ."
 if [ "${BUILD_HOST}" = "local" ]; then
   bash -lc "${BUILD_COMMAND}"
 else
@@ -105,9 +104,9 @@ echo "Starting gateway on ${DEPLOY_HOST}"
 if [ "${DEPLOY_HOST}" = "local" ]; then
   cd "${DEPLOY_PATH}"
   chmod +x ./deploy-gateway.sh
-  DEPLOY_PATH="${DEPLOY_PATH}" GATEWAY_IMAGE="${GATEWAY_IMAGE}" UPDATE_DATAPLANE=true PULL_IMAGE=false ./deploy-gateway.sh
+  DEPLOY_PATH="${DEPLOY_PATH}" GATEWAY_IMAGE="${GATEWAY_IMAGE}" PULL_IMAGE=false ./deploy-gateway.sh
 else
   ensure_known_host "${DEPLOY_HOST}"
   ssh_cmd "${DEPLOY_HOST}" \
-    "cd '${DEPLOY_PATH}' && chmod +x ./deploy-gateway.sh && DEPLOY_PATH='${DEPLOY_PATH}' GATEWAY_IMAGE='${GATEWAY_IMAGE}' UPDATE_DATAPLANE=true PULL_IMAGE=false ./deploy-gateway.sh"
+    "cd '${DEPLOY_PATH}' && chmod +x ./deploy-gateway.sh && DEPLOY_PATH='${DEPLOY_PATH}' GATEWAY_IMAGE='${GATEWAY_IMAGE}' PULL_IMAGE=false ./deploy-gateway.sh"
 fi

scripts/build-runtime-base.sh

@@ -2,9 +2,8 @@
 set -euo pipefail
 
 BASE_IMAGE="${BASE_IMAGE:-mirror.gcr.io/library/debian:bookworm-slim}"
-NODE_BUILD_IMAGE="${NODE_BUILD_IMAGE:-node:24.21.0-bookworm}"
 RUNTIME_BASE_IMAGE="${RUNTIME_BASE_IMAGE:-vpn-proxy-runtime-base:bookworm-slim}"
-SINGBOX_VERSION="${SINGBOX_VERSION:-1.14.0-rc.5}"
+SINGBOX_VERSION="${SINGBOX_VERSION:-1.12.13}"
 APT_MIRROR="${APT_MIRROR:-http://mirror.yandex.ru/debian}"
 APT_SECURITY_MIRROR="${APT_SECURITY_MIRROR:-http://mirror.yandex.ru/debian-security}"
 HTTP_PROXY="${HTTP_PROXY:-$(docker info 2>/dev/null | awk -F': ' '/HTTP Proxy:/ {print $2; exit}')}"
@@ -19,7 +18,6 @@ if [ -n "${HTTP_PROXY}" ]; then echo "HTTP proxy: ${HTTP_PROXY}"; fi
 if [ -n "${HTTPS_PROXY}" ]; then echo "HTTPS proxy: ${HTTPS_PROXY}"; fi
 
 docker build \
-  --build-arg NODE_BUILD_IMAGE="${NODE_BUILD_IMAGE}" \
   --build-arg BASE_IMAGE="${BASE_IMAGE}" \
   --build-arg SINGBOX_VERSION="${SINGBOX_VERSION}" \
   --build-arg APT_MIRROR="${APT_MIRROR}" \

scripts/check-import-boundaries.mjs

@@ -1,151 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { SyntaxKind } from 'typescript/unstable/ast';
-import { createScanner } from 'typescript/unstable/ast/scanner';
-
-const SOURCE_FILE = /\.[cm]?[jt]sx?$/;
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-
-function normalized(value) {
-  return value.replaceAll(path.sep, '/').replace(/^\.\//, '');
-}
-
-function relativeTarget(importer, specifier) {
-  if (!specifier.startsWith('.')) return null;
-  return normalized(path.posix.normalize(path.posix.join(path.posix.dirname(importer), specifier)));
-}
-
-function featurePath(file) {
-  const match = /^src\/(server|web)\/features\/([^/]+)(?:\/(.*))?$/.exec(file);
-  return match ? { layer: match[1], name: match[2], privatePath: match[3] || '' } : null;
-}
-
-export function importBoundaryViolation(importerValue, specifier) {
-  const importer = normalized(importerValue);
-  const target = relativeTarget(importer, specifier);
-  if (!target) return null;
-
-  if (importer.startsWith('src/shared/') && /^src\/(server|web)\//.test(target)) {
-    return 'shared cannot import server or web';
-  }
-  if (importer.startsWith('src/server/') && target.startsWith('src/web/')) {
-    return 'server cannot import web';
-  }
-  if (importer.startsWith('src/web/') && target.startsWith('src/server/')) {
-    return 'web cannot import server';
-  }
-  if (importer.startsWith('src/server/http/') && target.startsWith('src/server/infrastructure/')) {
-    return 'server/http cannot import infrastructure directly';
-  }
-  if (importer.startsWith('src/server/features/') && target.startsWith('src/server/http/')) {
-    return 'server/features cannot import http';
-  }
-  if (importer.startsWith('src/web/ui/')
-    && /^src\/web\/(?:features(?:\/|$)|api(?:\/|\.[cm]?[jt]sx?$|$))/.test(target)) {
-    return 'web/ui cannot import api or features';
-  }
-
-  const fromFeature = featurePath(importer);
-  const toFeature = featurePath(target);
-  if (fromFeature && toFeature
-    && fromFeature.layer === toFeature.layer
-    && fromFeature.name !== toFeature.name
-    && toFeature.privatePath
-    && !/^index(?:\.[cm]?[jt]sx?)?$/.test(toFeature.privatePath)) {
-    return 'cross-feature imports must use the feature index';
-  }
-  return null;
-}
-
-function filesUnder(directory) {
-  return fs.readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
-    const absolute = path.join(directory, entry.name);
-    return entry.isDirectory() ? filesUnder(absolute) : [absolute];
-  });
-}
-
-function importedSpecifiers(source) {
-  const specifiers = [];
-  const scanner = createScanner(true, undefined, source);
-  const tokens = [];
-  for (let token = scanner.scan(); token !== SyntaxKind.EndOfFile; token = scanner.scan()) {
-    if (token === SyntaxKind.SlashToken) token = scanner.reScanSlashToken();
-    tokens.push({ kind: token, text: scanner.getTokenText(), value: scanner.getTokenValue() });
-  }
-
-  for (let index = 0; index < tokens.length; index += 1) {
-    const token = tokens[index];
-    const previous = tokens[index - 1];
-    const next = tokens[index + 1];
-    const isProperty = previous?.kind === SyntaxKind.DotToken
-      || previous?.kind === SyntaxKind.QuestionDotToken;
-
-    if (token.text === 'import' && !isProperty) {
-      if (next?.kind === SyntaxKind.StringLiteral) {
-        specifiers.push(next.value);
-      } else if (next?.kind === SyntaxKind.OpenParenToken) {
-        const argument = tokens[index + 2];
-        if (argument?.kind === SyntaxKind.StringLiteral) specifiers.push(argument.value);
-      } else if (next?.kind === SyntaxKind.OpenBraceToken
-        || next?.kind === SyntaxKind.AsteriskToken
-        || next?.kind === SyntaxKind.Identifier
-        || next?.text === 'type') {
-        for (let cursor = index + 1; cursor < tokens.length; cursor += 1) {
-          if (tokens[cursor].kind === SyntaxKind.SemicolonToken) break;
-          if (tokens[cursor].text === 'from'
-            && tokens[cursor + 1]?.kind === SyntaxKind.StringLiteral) {
-            specifiers.push(tokens[cursor + 1].value);
-            break;
-          }
-        }
-      }
-    } else if (token.text === 'export' && !isProperty) {
-      if (next?.kind !== SyntaxKind.OpenBraceToken
-        && next?.kind !== SyntaxKind.AsteriskToken
-        && next?.text !== 'type') continue;
-      for (let cursor = index + 1; cursor < tokens.length; cursor += 1) {
-        if (tokens[cursor].kind === SyntaxKind.SemicolonToken) break;
-        if (tokens[cursor].text === 'from'
-          && tokens[cursor + 1]?.kind === SyntaxKind.StringLiteral) {
-          specifiers.push(tokens[cursor + 1].value);
-          break;
-        }
-      }
-    } else if (token.text === 'require' && !isProperty) {
-      if (next?.kind === SyntaxKind.OpenParenToken
-        && tokens[index + 2]?.kind === SyntaxKind.StringLiteral) {
-        specifiers.push(tokens[index + 2].value);
-      }
-    }
-  }
-  return specifiers;
-}
-
-export function checkImportBoundaries(repositoryRoot = root) {
-  const sourceRoot = path.join(repositoryRoot, 'src');
-  const files = filesUnder(sourceRoot).filter((file) => SOURCE_FILE.test(file));
-  const violations = [];
-  for (const file of files) {
-    const importer = normalized(path.relative(repositoryRoot, file));
-    const source = fs.readFileSync(file, 'utf8');
-    for (const specifier of importedSpecifiers(source)) {
-      const rule = importBoundaryViolation(importer, specifier);
-      if (rule) violations.push({ importer, specifier, rule });
-    }
-  }
-  return { filesChecked: files.length, violations };
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  const result = checkImportBoundaries();
-  if (result.violations.length) {
-    for (const violation of result.violations) {
-      console.error(`${violation.importer}: ${violation.rule} (${violation.specifier})`);
-    }
-    process.exitCode = 1;
-  } else {
-    console.log(`Import boundaries: ${result.filesChecked} files checked.`);
-  }
-}

scripts/check-sqlite-runtime.mjs

@@ -1,19 +0,0 @@
-import assert from 'node:assert/strict';
-import { DatabaseSync } from 'node:sqlite';
-
-assert.equal(process.versions.node, '24.21.0', 'Harbor requires the pinned Node 24.21.0 runtime');
-const db = new DatabaseSync(':memory:');
-try {
-  const version = db.prepare('SELECT sqlite_version() AS version').get().version;
-  const [major, minor, patch] = version.split('.').map(Number);
-  assert.ok(major > 3 || (major === 3 && (minor > 51 || (minor === 51 && patch >= 3))),
-    'Harbor requires SQLite >= 3.51.3 with the WAL-reset fix');
-  db.exec('CREATE TABLE probe (bytes INTEGER NOT NULL) STRICT');
-  db.prepare('INSERT INTO probe VALUES (?)').run(9007199254740993n);
-  const statement = db.prepare('SELECT bytes FROM probe');
-  statement.setReadBigInts(true);
-  assert.equal(statement.get().bytes, 9007199254740993n);
-  console.log(`Harbor runtime: Node ${process.versions.node}, SQLite ${version}, ${process.platform}/${process.arch}`);
-} finally {
-  db.close();
-}

scripts/clean-test-dist.mjs

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import path from 'node:path';
-
-fs.rmSync(path.resolve('.test-dist'), { recursive: true, force: true });

scripts/deploy-gateway.sh

@@ -2,29 +2,17 @@
 set -euo pipefail
 
 DEPLOY_PATH="${DEPLOY_PATH:-/opt/vpn-proxy}"
-CONTROL_IMAGE="${CONTROL_IMAGE:-${GATEWAY_IMAGE:-}}"
-DATAPLANE_IMAGE="${DATAPLANE_IMAGE:-${GATEWAY_IMAGE:-}}"
-CONTROL_IMAGE="${CONTROL_IMAGE:?CONTROL_IMAGE or GATEWAY_IMAGE is required}"
-DATAPLANE_IMAGE="${DATAPLANE_IMAGE:?DATAPLANE_IMAGE or GATEWAY_IMAGE is required}"
-UPDATE_DATAPLANE="${UPDATE_DATAPLANE:-false}"
+GATEWAY_IMAGE="${GATEWAY_IMAGE:?GATEWAY_IMAGE is required}"
 PULL_IMAGE="${PULL_IMAGE:-true}"
 
 echo "Preparing deploy directory: ${DEPLOY_PATH}"
 mkdir -p "${DEPLOY_PATH}"
 
-EXISTING_DATAPLANE_IMAGE="$(docker inspect --format '{{.Config.Image}}' vpn-proxy-dataplane 2>/dev/null || true)"
-FIRST_SPLIT_DEPLOY=false
-if [ -z "${EXISTING_DATAPLANE_IMAGE}" ]; then
-  FIRST_SPLIT_DEPLOY=true
-elif [ "${UPDATE_DATAPLANE}" != "true" ]; then
-  DATAPLANE_IMAGE="${EXISTING_DATAPLANE_IMAGE}"
-fi
-
 cat > "${DEPLOY_PATH}/docker-compose.server.yml" <<EOF
 services:
-  vpn-proxy-dataplane:
-    image: ${DATAPLANE_IMAGE}
-    container_name: vpn-proxy-dataplane
+  vpn-proxy-gateway:
+    image: ${GATEWAY_IMAGE}
+    container_name: vpn-proxy-gateway
     network_mode: host
     cap_add:
       - NET_ADMIN
@@ -32,44 +20,11 @@ services:
     env_file:
       - .env
     environment:
-      APP_COMPONENT: dataplane
       DATA_DIR: /var/lib/vpn-proxy
-      SING_BOX_CONFIG: /var/lib/vpn-proxy/sing-box-config.json
       SING_BOX_CACHE: /var/lib/sing-box/cache.db
-      SING_BOX_TRAFFIC_SOURCE: \${SING_BOX_TRAFFIC_SOURCE:-native}
-      DATAPLANE_SOCKET: /run/vpn-proxy/dataplane.sock
     volumes:
       - vpn-proxy-data:/var/lib/vpn-proxy
       - sing-box-cache:/var/lib/sing-box
-      - vpn-proxy-runtime:/run/vpn-proxy
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD", "curl", "--unix-socket", "/run/vpn-proxy/dataplane.sock", "-fsS", "http://localhost/status"]
-      interval: 5s
-      timeout: 3s
-      retries: 12
-      start_period: 5s
-
-  vpn-proxy-control:
-    image: ${CONTROL_IMAGE}
-    container_name: vpn-proxy-gateway
-    env_file:
-      - .env
-    environment:
-      APP_COMPONENT: control
-      DATA_DIR: /var/lib/vpn-proxy
-      SING_BOX_CONFIG: /var/lib/vpn-proxy/sing-box-config.json
-      SING_BOX_CACHE: /var/lib/sing-box/cache.db
-      SING_BOX_TRAFFIC_SOURCE: \${SING_BOX_TRAFFIC_SOURCE:-native}
-      DATAPLANE_SOCKET: /run/vpn-proxy/dataplane.sock
-    ports:
-      - "\${PORT:-3456}:\${PORT:-3456}"
-    volumes:
-      - vpn-proxy-data:/var/lib/vpn-proxy
-      - vpn-proxy-runtime:/run/vpn-proxy
-    depends_on:
-      vpn-proxy-dataplane:
-        condition: service_healthy
     restart: unless-stopped
     healthcheck:
       test: ["CMD", "curl", "-fsS", "http://127.0.0.1:\${PORT:-3456}/api/state"]
@@ -81,7 +36,6 @@ services:
 volumes:
   vpn-proxy-data:
   sing-box-cache:
-  vpn-proxy-runtime:
 EOF
 
 if [ ! -f "${DEPLOY_PATH}/.env" ]; then
@@ -93,9 +47,7 @@ TPROXY_PORT=7895
 TPROXY_MARK=1
 TPROXY_TABLE=100
 TPROXY_CHAIN=VPN_PROXY_TPROXY
-GATEWAY_FORWARD_CHAIN=VPN_PROXY_FORWARD
-GATEWAY_NAT_CHAIN=VPN_PROXY_NAT
-GATEWAY_CLIENT_CIDRS=10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
+ROUTING_RU_DIRECT=true
 LOG_LEVEL=info
 EOF
   echo "Created default .env. Edit ${DEPLOY_PATH}/.env if this server needs different ports."
@@ -105,29 +57,15 @@ fi
 
 cd "${DEPLOY_PATH}"
 
-echo "Control image: ${CONTROL_IMAGE}"
-echo "Dataplane image: ${DATAPLANE_IMAGE}"
+echo "Pulling image: ${GATEWAY_IMAGE}"
 if [ "${PULL_IMAGE}" = "true" ]; then
-  docker compose -f docker-compose.server.yml pull vpn-proxy-control
-  if [ "${FIRST_SPLIT_DEPLOY}" = "true" ] || [ "${UPDATE_DATAPLANE}" = "true" ]; then
-    docker compose -f docker-compose.server.yml pull vpn-proxy-dataplane
-  fi
+  docker compose -f docker-compose.server.yml pull
 else
-  echo "Skipping image pull"
+  echo "Skipping image pull; using local image ${GATEWAY_IMAGE}"
 fi
 
-if [ "${FIRST_SPLIT_DEPLOY}" = "true" ]; then
-  echo "Migrating the legacy combined gateway to split services..."
-  docker stop vpn-proxy-gateway 2>/dev/null || true
-  docker rm vpn-proxy-gateway 2>/dev/null || true
-  docker compose -f docker-compose.server.yml up -d --wait --wait-timeout 90
-elif [ "${UPDATE_DATAPLANE}" = "true" ]; then
-  echo "Updating control and dataplane..."
-  docker compose -f docker-compose.server.yml up -d --wait --wait-timeout 90
-else
-  echo "Updating control; keeping dataplane running..."
-  docker compose -f docker-compose.server.yml up -d --no-deps --wait --wait-timeout 90 vpn-proxy-control
-fi
+echo "Starting gateway..."
+docker compose -f docker-compose.server.yml up -d
 
-echo "Current containers:"
-docker ps --filter "name=vpn-proxy-gateway" --filter "name=vpn-proxy-dataplane"
+echo "Current container:"
+docker ps --filter "name=vpn-proxy-gateway"

scripts/harbor-network-monitor.sh

@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-export LC_ALL=C
-
-RUNTIME_DIR="${HARBOR_RUNTIME_DIR:-$HOME/.vpn-proxy-client/.runtime}"
-STATE_FILE="$RUNTIME_DIR/network.json"
-ROUTE_BIN="${HARBOR_ROUTE_BIN:-/sbin/route}"
-ARP_BIN="${HARBOR_ARP_BIN:-/usr/sbin/arp}"
-NETSTAT_BIN="${HARBOR_NETSTAT_BIN:-/usr/sbin/netstat}"
-
-route_info="$($ROUTE_BIN -n get default 2>/dev/null || true)"
-gateway="$(awk '/^[[:space:]]*gateway:/{print $2; exit}' <<<"$route_info")"
-network_interface="$(awk '/^[[:space:]]*interface:/{print $2; exit}' <<<"$route_info")"
-
-if [[ -z "$gateway" || -z "$network_interface" ]]; then
-  read -r gateway network_interface < <(
-    "$NETSTAT_BIN" -rn -f inet 2>/dev/null \
-      | awk '$1 == "default" && $2 ~ /^[0-9]+\./ { print $2, $4; exit }'
-  ) || true
-fi
-
-if [[ ! "$gateway" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
-  gateway=""
-  network_interface=""
-fi
-if [[ ! "$network_interface" =~ ^[a-zA-Z0-9._-]{1,32}$ ]]; then
-  network_interface=""
-fi
-
-mac=""
-if [[ -n "$gateway" ]]; then
-  mac="$($ARP_BIN -n "$gateway" 2>/dev/null | awk '/ at /{print $4; exit}' || true)"
-  if [[ ! "$mac" =~ ^[a-fA-F0-9]{2}(:[a-fA-F0-9]{2}){5}$ ]]; then
-    mac=""
-  else
-    mac="$(printf '%s' "$mac" | tr '[:upper:]' '[:lower:]')"
-  fi
-fi
-
-mkdir -p "$RUNTIME_DIR"
-tmp="$(mktemp "${STATE_FILE}.XXXXXX")"
-trap 'rm -f "$tmp"' EXIT
-printf '{"gateway":"%s","interface":"%s","mac":"%s","observedAt":"%s"}\n' \
-  "$gateway" "$network_interface" "$mac" "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" > "$tmp"
-mv "$tmp" "$STATE_FILE"

scripts/harbor-version.mjs

@@ -1,205 +0,0 @@
-#!/usr/bin/env node
-import { execFileSync } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-
-const COMPONENTS = ['macClient', 'gatewayClient', 'gatewayBackend'];
-const VERSION_FILE = 'src/shared/versions.ts';
-const LEGACY_VERSION_FILE = 'src/shared/versions.js';
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const aliases = {
-  mac: 'macClient',
-  'mac-client': 'macClient',
-  client: 'gatewayClient',
-  'gateway-client': 'gatewayClient',
-  backend: 'gatewayBackend',
-  'gateway-backend': 'gatewayBackend',
-};
-
-export function parseVersion(value) {
-  const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(String(value || ''));
-  return match ? {
-    major: Number(match[1]),
-    minor: Number(match[2]),
-    hotfix: Number(match[3]),
-  } : null;
-}
-
-export function versionCompatibility(versions) {
-  const mac = parseVersion(versions?.macClient);
-  const client = parseVersion(versions?.gatewayClient);
-  const backend = parseVersion(versions?.gatewayBackend);
-  const major = Boolean(mac && client && backend
-    && mac.major === client.major
-    && client.major === backend.major);
-  const gateway = Boolean(client && backend
-    && client.major === backend.major
-    && client.minor === backend.minor);
-  return { compatible: major && gateway, major, gateway };
-}
-
-export function versionsFromSource(source) {
-  return Object.fromEntries(COMPONENTS.map((component) => {
-    const match = new RegExp(`${component}:\\s*'(\\d+\\.\\d+\\.\\d+)'`).exec(source);
-    if (!match) throw new Error(`Не найдена версия ${component}`);
-    return [component, match[1]];
-  }));
-}
-
-export function affectedComponents(files) {
-  const affected = new Set();
-  const add = (...components) => components.forEach((component) => affected.add(component));
-  for (const file of files) {
-    if (file === VERSION_FILE) continue;
-    if (/^(?:\.dockerignore$|\.node-version$|scripts\/check-sqlite-runtime\.mjs$|package(?:-lock)?\.json$|tsconfig\.base\.json$|src\/shared\/)/.test(file)) add(...COMPONENTS);
-    else if (/^(src\/web\/|public\/|monitoring\/grafana\/|index\.html$|tsconfig\.web\.json$|vite\.config\.[cm]?[jt]s$)/.test(file)) {
-      add('macClient', 'gatewayClient');
-    } else if (/^(src\/server\/|tsconfig\.server\.json$)/.test(file)) add('macClient', 'gatewayBackend');
-    else if (/^(install\.sh|Dockerfile\.client|docker-compose\.client(\.local)?\.yml|entrypoint\.client\.sh|scripts\/(install-macos-client|harbor-network-monitor)\.sh)$/.test(file)) {
-      add('macClient');
-    } else if (/^(Dockerfile|Dockerfile\.runtime-base|docker-compose\.gateway\.yml|entrypoint\.sh|scripts\/(deploy-gateway|build-runtime-base|build-on-107-deploy-111)\.sh)$/.test(file)) {
-      add('gatewayBackend');
-    } else if (/^(\.gitea\/workflows\/gateway-build\.yml|scripts\/runtime-impact\.mjs)$/.test(file)) {
-      add('gatewayBackend');
-    }
-  }
-  return COMPONENTS.filter((component) => affected.has(component));
-}
-
-function formatVersion({ major, minor, hotfix }) {
-  return `${major}.${minor}.${hotfix}`;
-}
-
-export function bumpVersions(versions, level, requested = []) {
-  const current = Object.fromEntries(COMPONENTS.map((component) => {
-    const parsed = parseVersion(versions[component]);
-    if (!parsed) throw new Error(`Некорректная версия ${component}: ${versions[component]}`);
-    return [component, parsed];
-  }));
-  if (level === 'major') {
-    const major = Math.max(...COMPONENTS.map((component) => current[component].major)) + 1;
-    return Object.fromEntries(COMPONENTS.map((component) => [component, `${major}.0.0`]));
-  }
-
-  const targets = new Set(requested.map((target) => aliases[target] || target));
-  if (!targets.size) throw new Error(`${level} требует хотя бы один компонент`);
-  for (const target of targets) {
-    if (!COMPONENTS.includes(target)) throw new Error(`Неизвестный компонент: ${target}`);
-  }
-  if (level === 'minor' && (targets.has('gatewayClient') || targets.has('gatewayBackend'))) {
-    targets.add('gatewayClient');
-    targets.add('gatewayBackend');
-  }
-  if (!['minor', 'hotfix'].includes(level)) throw new Error(`Неизвестный уровень: ${level}`);
-
-  const next = { ...versions };
-  if (level === 'minor' && targets.has('gatewayClient')) {
-    const minor = Math.max(current.gatewayClient.minor, current.gatewayBackend.minor) + 1;
-    next.gatewayClient = `${current.gatewayClient.major}.${minor}.0`;
-    next.gatewayBackend = `${current.gatewayBackend.major}.${minor}.0`;
-    targets.delete('gatewayClient');
-    targets.delete('gatewayBackend');
-  }
-  for (const target of targets) {
-    const value = current[target];
-    next[target] = level === 'minor'
-      ? `${value.major}.${value.minor + 1}.0`
-      : formatVersion({ ...value, hotfix: value.hotfix + 1 });
-  }
-  return next;
-}
-
-function git(args) {
-  return execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
-}
-
-function changedFiles(base) {
-  const tracked = git(['diff', '--no-renames', '--name-only', base, '--']).split('\n');
-  const untracked = git(['ls-files', '--others', '--exclude-standard']).split('\n');
-  return [...new Set([...tracked, ...untracked].filter(Boolean))];
-}
-
-function baselineVersions(base) {
-  try {
-    return versionsFromSource(git(['show', `${base}:${VERSION_FILE}`]));
-  } catch {
-    try {
-      return versionsFromSource(git(['show', `${base}:${LEGACY_VERSION_FILE}`]));
-    } catch {
-      return null;
-    }
-  }
-}
-
-function compareVersions(before, after) {
-  const left = parseVersion(before);
-  const right = parseVersion(after);
-  if (!left || !right) return -1;
-  for (const key of ['major', 'minor', 'hotfix']) {
-    if (right[key] !== left[key]) return right[key] > left[key] ? 1 : -1;
-  }
-  return 0;
-}
-
-function validateCompatibility(versions) {
-  const compatibility = versionCompatibility(versions);
-  if (!compatibility.major) throw new Error('У всех компонентов должен совпадать major');
-  if (!compatibility.gateway) throw new Error('Gateway client и backend должны совпадать по major.minor');
-}
-
-function writeVersions(versions) {
-  const file = path.join(root, VERSION_FILE);
-  let source = fs.readFileSync(file, 'utf8');
-  for (const component of COMPONENTS) {
-    source = source.replace(
-      new RegExp(`(${component}:\\s*')\\d+\\.\\d+\\.\\d+(')`),
-      `$1${versions[component]}$2`,
-    );
-  }
-  fs.writeFileSync(file, source);
-}
-
-function printVersions(versions) {
-  for (const component of COMPONENTS) console.log(`${component}: ${versions[component]}`);
-}
-
-function main([command = 'check', ...args]) {
-  const source = fs.readFileSync(path.join(root, VERSION_FILE), 'utf8');
-  const current = versionsFromSource(source);
-  validateCompatibility(current);
-
-  if (command === 'bump') {
-    const next = bumpVersions(current, args[0], args.slice(1));
-    validateCompatibility(next);
-    writeVersions(next);
-    printVersions(next);
-    return;
-  }
-
-  const base = args[0] || 'HEAD';
-  const affected = affectedComponents(changedFiles(base));
-  if (command === 'affected') {
-    console.log(affected.length ? affected.join('\n') : 'Нет изменений, требующих bump.');
-    return;
-  }
-  if (command !== 'check') throw new Error(`Неизвестная команда: ${command}`);
-
-  const baseline = baselineVersions(base);
-  if (!baseline) {
-    console.log('Version contract создаётся впервые; baseline для bump отсутствует.');
-    return;
-  }
-  const missing = affected.filter((component) => compareVersions(baseline[component], current[component]) <= 0);
-  if (missing.length) throw new Error(`Не повышена версия: ${missing.join(', ')}`);
-  console.log(affected.length ? `Version check: ${affected.join(', ')}` : 'Version check: bump не требуется.');
-}
-
-if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
-  try {
-    main(process.argv.slice(2));
-  } catch (error) {
-    console.error(`[harbor-version] ${error.message}`);
-    process.exitCode = 1;
-  }
-}

scripts/install-macos-client.sh

@@ -2,25 +2,20 @@
 set -euo pipefail
 
 INSTALL_DIR="${VPN_PROXY_INSTALL_DIR:-$HOME/.vpn-proxy-client}"
+REPO_URL="${VPN_PROXY_REPO_URL:-https://git.dokops.ru/dokril/vpn-proxy.git}"
 BRANCH="${VPN_PROXY_BRANCH:-master}"
-ARCHIVE_URL="${VPN_PROXY_ARCHIVE_URL:-https://git.dokops.ru/dokril/vpn-proxy/archive/${BRANCH}.tar.gz}"
-SOURCE_DIR="${VPN_PROXY_SOURCE_DIR:-}"
 COMPOSE_FILE="docker-compose.client.yml"
-DEFAULT_PROXY_PORT="8082"
+DEFAULT_PROXY_PORT="8080"
 REQUESTED_PROXY_PORT="${VPN_PROXY_CLIENT_PORT:-}"
 REQUESTED_UI_PORT="${VPN_PROXY_CLIENT_UI_PORT:-${CLIENT_UI_PORT:-}}"
-TARGET_SINGBOX_VERSION="${SINGBOX_VERSION:-1.14.0-rc.5}"
-TARGET_TRAFFIC_SOURCE="${SING_BOX_TRAFFIC_SOURCE:-native}"
-CLIENT_CONTAINER_NAME="harbor-connect"
-LEGACY_CLIENT_CONTAINER_NAME="vpn-proxy-client"
-NETWORK_MONITOR_LABEL="com.dokril.harbor-connect.network"
+CLIENT_CONTAINER_NAME="vpn-proxy-client"
 
 log() {
-  printf '[harbor-connect] %s\n' "$*"
+  printf '[vpn-proxy-client] %s\n' "$*"
 }
 
 die() {
-  printf '[harbor-connect] error: %s\n' "$*" >&2
+  printf '[vpn-proxy-client] error: %s\n' "$*" >&2
   exit 1
 }
 
@@ -64,6 +59,15 @@ ask_proxy_port() {
   printf '%s\n' "$DEFAULT_PROXY_PORT"
 }
 
+port_range_end() {
+  local start="$1"
+  local end="$((start + 10))"
+  if [ "$end" -gt 65535 ]; then
+    end=65535
+  fi
+  printf '%s\n' "$end"
+}
+
 published_port_conflicts() {
   local port="$1"
   local line
@@ -71,14 +75,25 @@ published_port_conflicts() {
   while IFS= read -r line; do
     [ -n "$line" ] || continue
     case "$line" in
-      "${CLIENT_CONTAINER_NAME}"$'\t'*|"${LEGACY_CLIENT_CONTAINER_NAME}"$'\t'*) ;;
+      "${CLIENT_CONTAINER_NAME}"$'\t'*) ;;
       *) printf '%s\n' "$line" ;;
     esac
   done < <(docker ps --filter "publish=${port}" --format '{{.Names}}	{{.Ports}}')
 }
 
 proxy_port_conflicts() {
-  published_port_conflicts "$1"
+  local start="$1"
+  local end
+  local port
+  local conflicts
+
+  end="$(port_range_end "$start")"
+  for port in $(seq "$start" "$end"); do
+    conflicts="$(published_port_conflicts "$port")"
+    if [ -n "$conflicts" ]; then
+      printf 'port %s: %s\n' "$port" "$conflicts"
+    fi
+  done
 }
 
 assert_proxy_port_available() {
@@ -90,8 +105,8 @@ assert_proxy_port_available() {
     return 0
   fi
 
-  printf '[harbor-connect] proxy port %s is already used:\n%s\n' \
-    "$port" "$conflicts" >&2
+  printf '[vpn-proxy-client] proxy port range %s-%s is already used:\n%s\n' \
+    "$port" "$(port_range_end "$port")" "$conflicts" >&2
   die "choose another proxy port with VPN_PROXY_CLIENT_PORT=<port> or stop the conflicting container"
 }
 
@@ -105,7 +120,7 @@ assert_single_port_available() {
     return 0
   fi
 
-  printf '[harbor-connect] %s port %s is already used:\n%s\n' \
+  printf '[vpn-proxy-client] %s port %s is already used:\n%s\n' \
     "$label" "$port" "$conflicts" >&2
   die "choose another ${label} port or stop the conflicting container"
 }
@@ -155,8 +170,8 @@ choose_ui_port() {
 }
 
 assert_ui_outside_proxy_range() {
-  if [ "$UI_PORT" = "$PROXY_PORT" ]; then
-    die "UI port ${UI_PORT} overlaps proxy port"
+  if [ "$UI_PORT" -ge "$PROXY_PORT" ] && [ "$UI_PORT" -le "$PROXY_PORT_END" ]; then
+    die "UI port ${UI_PORT} overlaps proxy port range ${PROXY_PORT}-${PROXY_PORT_END}"
   fi
 }
 
@@ -166,68 +181,20 @@ wait_for_client_ui() {
   local attempt
 
   for attempt in $(seq 1 30); do
-    if curl --noproxy "*" -fsS "$ui_url" >/dev/null 2>&1; then
+    if curl -fsS "$ui_url" >/dev/null 2>&1; then
       return 0
     fi
     sleep 1
   done
 
-  printf '\n[harbor-connect] client did not become ready at %s\n' "$ui_url" >&2
-  printf '[harbor-connect] docker compose status:\n' >&2
+  printf '\n[vpn-proxy-client] client did not become ready at %s\n' "$ui_url" >&2
+  printf '[vpn-proxy-client] docker compose status:\n' >&2
   docker compose -f "$COMPOSE_FILE" ps >&2 || true
-  printf '\n[harbor-connect] recent service logs:\n' >&2
-  docker compose -f "$COMPOSE_FILE" logs --tail=120 harbor-connect >&2 || true
+  printf '\n[vpn-proxy-client] recent service logs:\n' >&2
+  docker compose -f "$COMPOSE_FILE" logs --tail=120 vpn-proxy-client >&2 || true
   die "client UI is not ready; see Docker status and logs above"
 }
 
-xml_escape() {
-  sed -e 's/&/\&amp;/g' -e 's/</\&lt;/g' -e 's/>/\&gt;/g' -e 's/"/\&quot;/g'
-}
-
-install_network_monitor() {
-  local launch_agents_dir="$HOME/Library/LaunchAgents"
-  local plist_path="$launch_agents_dir/${NETWORK_MONITOR_LABEL}.plist"
-  local escaped_script_path
-  local escaped_runtime_dir
-  local user_domain="gui/$(id -u)"
-
-  escaped_script_path="$(printf '%s' "$INSTALL_DIR/scripts/harbor-network-monitor.sh" | xml_escape)"
-  escaped_runtime_dir="$(printf '%s' "$INSTALL_DIR/.runtime" | xml_escape)"
-  mkdir -p "$INSTALL_DIR/.runtime" "$launch_agents_dir"
-
-  cat > "$plist_path" <<EOF
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>${NETWORK_MONITOR_LABEL}</string>
-  <key>ProgramArguments</key>
-  <array>
-    <string>/bin/bash</string>
-    <string>${escaped_script_path}</string>
-  </array>
-  <key>EnvironmentVariables</key>
-  <dict>
-    <key>HARBOR_RUNTIME_DIR</key>
-    <string>${escaped_runtime_dir}</string>
-  </dict>
-  <key>RunAtLoad</key>
-  <true/>
-  <key>StartInterval</key>
-  <integer>5</integer>
-  <key>ProcessType</key>
-  <string>Background</string>
-</dict>
-</plist>
-EOF
-
-  /bin/bash "$INSTALL_DIR/scripts/harbor-network-monitor.sh"
-  launchctl bootout "$user_domain" "$plist_path" >/dev/null 2>&1 || true
-  launchctl bootstrap "$user_domain" "$plist_path"
-  log "automatic Gateway detection enabled"
-}
-
 set_env_value() {
   local key="$1"
   local value="$2"
@@ -257,59 +224,26 @@ get_env_value() {
   ' .env
 }
 
-copy_source() {
-  local source_dir="$1"
-  [ -f "$source_dir/docker-compose.client.yml" ] || die "invalid Harbor source archive"
-  log "installing files to $INSTALL_DIR"
-  mkdir -p "$INSTALL_DIR"
-  rsync -a --delete \
-    --exclude='.env' \
-    --exclude='.runtime' \
-    --exclude='.git' \
-    "$source_dir/" "$INSTALL_DIR/"
-}
-
-download_source() {
-  local tmp_dir
-  tmp_dir="$(mktemp -d)"
-  mkdir -p "$tmp_dir/source"
-  log "downloading $ARCHIVE_URL"
-  if ! curl -fsSL "$ARCHIVE_URL" | tar -xzf - -C "$tmp_dir/source" --strip-components=1; then
-    rm -rf "$tmp_dir"
-    die "failed to download Harbor source"
-  fi
-  copy_source "$tmp_dir/source"
-  rm -rf "$tmp_dir"
-}
-
 if [[ "$(uname -s)" != "Darwin" ]]; then
   die "this installer is intended for macOS"
 fi
 
+need git
 need docker
 need curl
-need rsync
-need tar
-
-case "$TARGET_TRAFFIC_SOURCE" in
-  native|disabled) ;;
-  *) die "SING_BOX_TRAFFIC_SOURCE must be native or disabled" ;;
-esac
 
 docker compose version >/dev/null 2>&1 || die "Docker Compose plugin is required"
 docker info >/dev/null 2>&1 || die "Docker Desktop is not running"
 
-if [[ -n "$SOURCE_DIR" ]]; then
-  copy_source "$SOURCE_DIR"
-elif [[ -d "$INSTALL_DIR/.git" ]]; then
-  need git
+if [[ -d "$INSTALL_DIR/.git" ]]; then
   log "updating $INSTALL_DIR"
   git -C "$INSTALL_DIR" fetch origin "$BRANCH"
   git -C "$INSTALL_DIR" checkout "$BRANCH"
   git -C "$INSTALL_DIR" pull --ff-only origin "$BRANCH"
 else
+  log "cloning $REPO_URL#$BRANCH to $INSTALL_DIR"
   mkdir -p "$(dirname "$INSTALL_DIR")"
-  download_source
+  git clone --branch "$BRANCH" "$REPO_URL" "$INSTALL_DIR"
 fi
 
 cd "$INSTALL_DIR"
@@ -320,37 +254,36 @@ fi
 
 PROXY_PORT="$(ask_proxy_port)"
 assert_proxy_port_available "$PROXY_PORT"
+PROXY_PORT_END="$(port_range_end "$PROXY_PORT")"
 UI_PORT="${REQUESTED_UI_PORT:-$(get_env_value CLIENT_UI_PORT)}"
 UI_PORT="${UI_PORT:-3456}"
 UI_PORT="$(choose_ui_port "$UI_PORT")"
 assert_ui_outside_proxy_range
 
 set_env_value APP_MODE client
-set_env_value SINGBOX_VERSION "$TARGET_SINGBOX_VERSION"
-set_env_value SING_BOX_TRAFFIC_SOURCE "$TARGET_TRAFFIC_SOURCE"
 set_env_value CLIENT_UI_PORT "$UI_PORT"
 set_env_value CLIENT_PROXY_PORT "$PROXY_PORT"
+set_env_value CLIENT_PROXY_PORT_START "$PROXY_PORT"
+set_env_value CLIENT_PROXY_PORT_END "$PROXY_PORT_END"
 set_env_value PROXY_PORT "$PROXY_PORT"
 
 log "UI port: http://127.0.0.1:${UI_PORT}"
-log "proxy port: 127.0.0.1:${PROXY_PORT}"
-
-install_network_monitor
+log "proxy port: 127.0.0.1:${PROXY_PORT} (reserved range ${PROXY_PORT}-${PROXY_PORT_END})"
 
 log "building and starting Docker client"
-docker compose -f "$COMPOSE_FILE" up -d --build --remove-orphans
+docker compose -f "$COMPOSE_FILE" up -d --build
 wait_for_client_ui
 
 cat <<EOF
 
-Harbor Connect is running.
+VPN Proxy Client is running.
 
 UI:
   http://127.0.0.1:${UI_PORT}
 
 Proxy:
   HTTP/SOCKS5 127.0.0.1:${PROXY_PORT}
-  This is the only Docker-published proxy port. Re-run the installer with VPN_PROXY_CLIENT_PORT=<port> to change it.
+  UI can switch proxy port within the Docker-published ${PROXY_PORT}-${PROXY_PORT_END} range.
 
 Useful commands:
   cd ~/.vpn-proxy-client

scripts/install-windows-client.ps1

@@ -0,0 +1,296 @@
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
+
+$InstallRoot = $env:VPN_PROXY_WINDOWS_ROOT
+if ([string]::IsNullOrWhiteSpace($InstallRoot)) { $InstallRoot = "C:\Tools\vpn-proxy-windows" }
+
+$RepoBranch = $env:VPN_PROXY_WINDOWS_BRANCH
+if ([string]::IsNullOrWhiteSpace($RepoBranch)) { $RepoBranch = "codex-windows-client" }
+
+$AppDir = Join-Path $InstallRoot "app"
+$DataDir = Join-Path $InstallRoot "data"
+$RuntimeDir = Join-Path $InstallRoot "runtime"
+$NodeDir = Join-Path $RuntimeDir "node"
+$SingBoxDir = Join-Path $RuntimeDir "sing-box"
+$ProxiFyreRoot = $env:PROXIFYRE_ROOT
+if ([string]::IsNullOrWhiteSpace($ProxiFyreRoot)) { $ProxiFyreRoot = "C:\Tools\ProxiFyre" }
+
+$RepoZipUrl = "https://git.dokops.ru/dokril/vpn-proxy/archive/$RepoBranch.zip"
+$SingBoxVersion = "1.12.13"
+$SingBoxUrl = "https://github.com/SagerNet/sing-box/releases/download/v$SingBoxVersion/sing-box-$SingBoxVersion-windows-amd64.zip"
+$Headers = @{ "User-Agent" = "vpn-proxy-windows-installer" }
+
+function Assert-Admin {
+  $principal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
+  if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+    throw "Run PowerShell 7 as Administrator"
+  }
+}
+
+function Assert-PowerShell7 {
+  if ($PSVersionTable.PSVersion.Major -lt 7) {
+    throw "PowerShell 7 is required"
+  }
+}
+
+function Get-Arch {
+  if ($env:PROCESSOR_ARCHITECTURE -eq "ARM64") { return "arm64" }
+  if ($env:PROCESSOR_ARCHITECTURE -eq "AMD64") { return "x64" }
+  return "x86"
+}
+
+function Download-File {
+  param([string]$Url, [string]$Destination)
+  Write-Host "Downloading $Url"
+  Invoke-WebRequest -Uri $Url -OutFile $Destination -UseBasicParsing -Headers $Headers
+  Unblock-File -Path $Destination -ErrorAction SilentlyContinue
+}
+
+function Invoke-CheckedProcess {
+  param(
+    [string]$FilePath,
+    [string[]]$ArgumentList,
+    [int[]]$AllowedExitCodes = @(0)
+  )
+
+  $process = Start-Process -FilePath $FilePath -ArgumentList $ArgumentList -Wait -PassThru
+  if ($AllowedExitCodes -notcontains $process.ExitCode) {
+    throw "$FilePath failed with exit code $($process.ExitCode)"
+  }
+  return $process.ExitCode
+}
+
+function Get-GitHubReleaseAsset {
+  param(
+    [string]$Repo,
+    [scriptblock]$AssetFilter
+  )
+
+  $release = Invoke-RestMethod -Uri "https://api.github.com/repos/$Repo/releases/latest" -Headers $Headers
+  $asset = @($release.assets | Where-Object $AssetFilter | Select-Object -First 1)
+  if (-not $asset) {
+    throw "No matching release asset found for $Repo"
+  }
+  return $asset[0]
+}
+
+function Install-AppFiles {
+  New-Item -ItemType Directory -Force -Path $InstallRoot, $DataDir, $RuntimeDir | Out-Null
+  $zip = Join-Path $env:TEMP "vpn-proxy-windows.zip"
+  $extract = Join-Path $env:TEMP "vpn-proxy-windows-extract"
+  Remove-Item $zip -Force -ErrorAction SilentlyContinue
+  Remove-Item $extract -Recurse -Force -ErrorAction SilentlyContinue
+
+  Download-File -Url $RepoZipUrl -Destination $zip
+  Expand-Archive -Path $zip -DestinationPath $extract -Force
+  $source = Get-ChildItem $extract -Directory | Select-Object -First 1
+  if (-not $source) { throw "Downloaded archive layout is not recognized" }
+
+  if (Test-Path $AppDir) {
+    $backup = "$AppDir.backup"
+    Remove-Item $backup -Recurse -Force -ErrorAction SilentlyContinue
+    Move-Item $AppDir $backup
+  }
+
+  Move-Item $source.FullName $AppDir
+  Remove-Item $zip -Force -ErrorAction SilentlyContinue
+  Remove-Item $extract -Recurse -Force -ErrorAction SilentlyContinue
+}
+
+function Install-NodeRuntime {
+  $existing = Get-Command node -ErrorAction SilentlyContinue
+  if ($existing) { return $existing.Source }
+
+  New-Item -ItemType Directory -Force -Path $RuntimeDir | Out-Null
+  $arch = Get-Arch
+  $index = Invoke-RestMethod -Uri "https://nodejs.org/dist/index.json" -Headers $Headers
+  $release = @($index | Where-Object { $_.lts -ne $false } | Select-Object -First 1)[0]
+  if (-not $release) { throw "Cannot resolve latest Node.js LTS release" }
+
+  $version = [string]$release.version
+  $assetName = "node-$version-win-$arch.zip"
+  $zip = Join-Path $env:TEMP $assetName
+  $extract = Join-Path $env:TEMP "node-windows-extract"
+  Remove-Item $zip -Force -ErrorAction SilentlyContinue
+  Remove-Item $extract -Recurse -Force -ErrorAction SilentlyContinue
+  Remove-Item $NodeDir -Recurse -Force -ErrorAction SilentlyContinue
+
+  Download-File -Url "https://nodejs.org/dist/$version/$assetName" -Destination $zip
+  Expand-Archive -Path $zip -DestinationPath $extract -Force
+  $nodeSource = Get-ChildItem $extract -Directory | Select-Object -First 1
+  if (-not $nodeSource) { throw "Downloaded Node.js archive layout is not recognized" }
+  Move-Item $nodeSource.FullName $NodeDir
+  Remove-Item $zip -Force -ErrorAction SilentlyContinue
+  Remove-Item $extract -Recurse -Force -ErrorAction SilentlyContinue
+  return (Join-Path $NodeDir "node.exe")
+}
+
+function Get-NpmCommand {
+  param([string]$NodeCommand)
+
+  $portableNpm = Join-Path (Split-Path -Parent $NodeCommand) "npm.cmd"
+  if (Test-Path $portableNpm) { return $portableNpm }
+  $existing = Get-Command npm -ErrorAction SilentlyContinue
+  if ($existing) { return $existing.Source }
+  throw "npm was not found"
+}
+
+function Install-VisualCRedistributable {
+  $arch = Get-Arch
+  $vcArch = if ($arch -eq "arm64") { "arm64" } elseif ($arch -eq "x86") { "x86" } else { "x64" }
+  $exe = Join-Path $env:TEMP "vc_redist.$vcArch.exe"
+  Download-File -Url "https://aka.ms/vs/17/release/vc_redist.$vcArch.exe" -Destination $exe
+  $code = Invoke-CheckedProcess -FilePath $exe -ArgumentList @("/install", "/quiet", "/norestart") -AllowedExitCodes @(0, 3010)
+  if ($code -eq 3010) {
+    Write-Warning "Visual C++ Redistributable requested a reboot"
+  }
+}
+
+function Install-WinPacketFilter {
+  $service = Get-Service -Name "ndisrd" -ErrorAction SilentlyContinue
+  if ($service -and $service.Status -eq "Running") {
+    Write-Host "WinPacketFilter driver is already running"
+    return
+  }
+
+  $arch = Get-Arch
+  $assetToken = if ($arch -eq "arm64") { "ARM64" } elseif ($arch -eq "x86") { "x86" } else { "x64" }
+  $asset = Get-GitHubReleaseAsset -Repo "wiresock/ndisapi" -AssetFilter {
+    param($item)
+    $item.name -match "\.msi$" -and $item.name -match $assetToken
+  }
+
+  $msi = Join-Path $env:TEMP $asset.name
+  Download-File -Url $asset.browser_download_url -Destination $msi
+  $code = Invoke-CheckedProcess -FilePath "msiexec.exe" -ArgumentList @("/i", "`"$msi`"", "/qn", "/norestart") -AllowedExitCodes @(0, 3010)
+  if ($code -eq 3010) {
+    Write-Warning "WinPacketFilter requested a reboot before first use"
+  }
+}
+
+function Install-ProxiFyre {
+  New-Item -ItemType Directory -Force -Path $ProxiFyreRoot | Out-Null
+  if (Test-Path (Join-Path $ProxiFyreRoot "ProxiFyre.exe")) {
+    Write-Host "ProxiFyre is already installed at $ProxiFyreRoot"
+    return
+  }
+
+  $asset = Get-GitHubReleaseAsset -Repo "wiresock/proxifyre" -AssetFilter {
+    param($item)
+    $item.name -match "\.zip$" -and $item.name -notmatch "source"
+  }
+
+  $zip = Join-Path $env:TEMP $asset.name
+  $extract = Join-Path $env:TEMP "proxifyre-extract"
+  Remove-Item $zip -Force -ErrorAction SilentlyContinue
+  Remove-Item $extract -Recurse -Force -ErrorAction SilentlyContinue
+
+  Download-File -Url $asset.browser_download_url -Destination $zip
+  Expand-Archive -Path $zip -DestinationPath $extract -Force
+  $exe = Get-ChildItem $extract -Recurse -Filter "ProxiFyre.exe" | Select-Object -First 1
+  if (-not $exe) { throw "ProxiFyre.exe was not found in release archive" }
+
+  Copy-Item (Join-Path (Split-Path -Parent $exe.FullName) "*") $ProxiFyreRoot -Recurse -Force
+  Remove-Item $zip -Force -ErrorAction SilentlyContinue
+  Remove-Item $extract -Recurse -Force -ErrorAction SilentlyContinue
+}
+
+function Install-SingBox {
+  New-Item -ItemType Directory -Force -Path $SingBoxDir | Out-Null
+  if (Test-Path (Join-Path $SingBoxDir "sing-box.exe")) { return }
+
+  $zip = Join-Path $env:TEMP "sing-box-windows.zip"
+  $extract = Join-Path $env:TEMP "sing-box-windows-extract"
+  Remove-Item $zip -Force -ErrorAction SilentlyContinue
+  Remove-Item $extract -Recurse -Force -ErrorAction SilentlyContinue
+  Download-File -Url $SingBoxUrl -Destination $zip
+  Expand-Archive -Path $zip -DestinationPath $extract -Force
+  $exe = Get-ChildItem $extract -Recurse -Filter "sing-box.exe" | Select-Object -First 1
+  if (-not $exe) { throw "sing-box.exe was not found in archive" }
+  Copy-Item $exe.FullName (Join-Path $SingBoxDir "sing-box.exe") -Force
+}
+
+function Select-InstallMode {
+  Write-Host ""
+  Write-Host "Choose install mode:"
+  Write-Host "  [1] Full install: local sing-box + ProxiFyre"
+  Write-Host "  [2] ProxiFyre only: use existing proxy target"
+  $choice = Read-Host "Mode [1]"
+  if ($choice -eq "2") { return "proxifyre-only" }
+  return "full"
+}
+
+function Test-TcpEndpoint {
+  param([string]$HostName, [int]$Port)
+
+  $client = [System.Net.Sockets.TcpClient]::new()
+  try {
+    $task = $client.ConnectAsync($HostName, $Port)
+    if (-not $task.Wait(2000)) { return $false }
+    return $client.Connected
+  } finally {
+    $client.Dispose()
+  }
+}
+
+function Write-InitialTargets {
+  param([string]$Mode)
+
+  $targetsPath = Join-Path $DataDir "proxy-targets.json"
+  if (Test-Path $targetsPath) { return }
+
+  if ($Mode -eq "proxifyre-only") {
+    $target = Read-Host "Existing SOCKS5 proxy target host:port"
+    if ($target -notmatch "^([^:]+):(\d+)$") { throw "Expected host:port" }
+    $hostName = $matches[1]
+    $port = [int]$matches[2]
+    if (-not (Test-TcpEndpoint -HostName $hostName -Port $port)) {
+      Write-Warning "Proxy target $target did not accept a TCP connection during install"
+    }
+    @(@{ id = "existing-proxy"; name = "Existing proxy"; protocol = "socks5"; host = $hostName; port = $port }) |
+      ConvertTo-Json -Depth 5 |
+      Set-Content $targetsPath -Encoding UTF8
+  }
+}
+
+function Install-NodeDependencies {
+  $node = Install-NodeRuntime
+  $npm = Get-NpmCommand -NodeCommand $node
+  $env:PATH = "$(Split-Path -Parent $node);$env:PATH"
+  Push-Location $AppDir
+  try {
+    & $npm install
+    if ($LASTEXITCODE -ne 0) { throw "npm install failed" }
+    & $npm run build
+    if ($LASTEXITCODE -ne 0) { throw "npm run build failed" }
+  } finally {
+    Pop-Location
+  }
+}
+
+function Start-Ui {
+  $manage = Join-Path $AppDir "scripts\windows\manage.ps1"
+  Start-Process pwsh -ArgumentList "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", "`"$manage`"", "-OpenUi"
+}
+
+Assert-Admin
+Assert-PowerShell7
+$mode = Select-InstallMode
+Install-AppFiles
+Install-NodeDependencies
+Install-VisualCRedistributable
+Install-WinPacketFilter
+Install-ProxiFyre
+if ($mode -eq "full") { Install-SingBox }
+Write-InitialTargets -Mode $mode
+Set-Content -Path (Join-Path $DataDir "windows-state.json") -Encoding UTF8 -Value (@{ installMode = $mode } | ConvertTo-Json)
+Start-Ui
+
+Write-Host ""
+Write-Host "VPN Proxy Windows is installed."
+Write-Host "UI: http://127.0.0.1:3456"
+Write-Host "Recovery:"
+Write-Host "& `"$AppDir\scripts\windows\manage.ps1`" -OpenUi"
+Write-Host "& `"$AppDir\scripts\windows\manage.ps1`" -Status"
+Write-Host "& `"$AppDir\scripts\windows\manage.ps1`" -RestartServices"

scripts/runtime-impact.mjs

@@ -1,112 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const CODE_EXTENSION = String.raw`\.[cm]?[jt]sx?$`;
-const noRuntimeImpact = [
-  /^\.codex\//,
-  /^\.tmp-tests\//,
-  /^docs\//,
-  /^test\//,
-  /^workpack\//,
-  /^(?:AGENTS|PRODUCT|README)\.md$/,
-  /^context\.md$/,
-  /^\.env\.example$/,
-  /^\.gitignore$/,
-  /^Dockerfile\.client$/,
-  /^docker-compose\.client(?:\.local)?\.yml$/,
-  /^entrypoint\.client\.sh$/,
-  /^install\.sh$/,
-  /^scripts\/(?:check-import-boundaries\.mjs|clean-test-dist\.mjs|harbor-network-monitor\.sh|harbor-version\.mjs|install-macos-client\.sh)$/,
-  /^tools\/test-singbox-(?:client-rc|gateway-native-traffic|native-traffic)\.sh$/,
-];
-const foundation = [
-  /^\.node-version$/,
-  /^scripts\/check-sqlite-runtime\.mjs$/,
-  /^\.dockerignore$/,
-  /^\.gitea\/workflows\//,
-  /^Dockerfile(?:\.runtime-base)?$/,
-  /^docker-compose\.gateway\.yml$/,
-  /^entrypoint\.sh$/,
-  /^package(?:-lock)?\.json$/,
-  /^scripts\/(?:build-on-107-deploy-111|build-runtime-base|deploy-gateway)\.sh$/,
-  /^scripts\/runtime-impact\.mjs$/,
-  /^tsconfig(?:\.[^.]+)?\.json$/,
-];
-const controlAndDataplane = [
-  /^src\/server\/services\/(?:sqlite|trafficHistoryStore|trafficHistoryService|trafficHistoryWorker)\.ts$/,
-  /^src\/shared\/trafficHistory\.ts$/,
-  /^buf\.gen\.yaml$/,
-  /^proto\//,
-  new RegExp(`^src/server/main${CODE_EXTENSION}`),
-  new RegExp(`^src/server/(?:config|gatewayNativeRuntime|gatewayRouting|singbox|singboxRuntime|version)${CODE_EXTENSION}`),
-  /^src\/server\/generated\//,
-  new RegExp(`^src/server/adapters/neighbors${CODE_EXTENSION}`),
-  new RegExp(`^src/server/services/(?:connectivityDiagnosticsService|deviceInventoryService|devicePolicyService|liveTrafficService|singboxSelectorService)${CODE_EXTENSION}`),
-  new RegExp(`^src/shared/(?:connectivityDiagnostics|errors|liveTraffic)${CODE_EXTENSION}`),
-  /^src\/server\/infrastructure\/dataplane\//,
-];
-const dataplane = [
-  new RegExp(`^src/server/dataplane${CODE_EXTENSION}`),
-  new RegExp(`^src/server/services/(?:deviceTrafficService|domainTrafficService)${CODE_EXTENSION}`),
-];
-const control = [
-  /^index\.html$/,
-  /^monitoring\//,
-  /^public\//,
-  /^src\/server\//,
-  /^src\/shared\//,
-  /^src\/web\//,
-  /^vite\.config\.[cm]?[jt]s$/,
-];
-
-function matchesAny(file, patterns) {
-  return patterns.some((pattern) => pattern.test(file));
-}
-
-function normalizeFile(file) {
-  return file.trim().replaceAll('\\', '/').replace(/^\.\//, '');
-}
-
-export function classifyRuntimeImpact(files) {
-  const affected = new Set();
-  for (const value of files) {
-    const file = normalizeFile(value);
-    if (!file || matchesAny(file, noRuntimeImpact)) continue;
-    if (matchesAny(file, foundation) || matchesAny(file, controlAndDataplane)) {
-      affected.add('control');
-      affected.add('dataplane');
-    } else if (matchesAny(file, dataplane)) {
-      affected.add('dataplane');
-    } else if (matchesAny(file, control)) {
-      affected.add('control');
-    } else {
-      throw new Error(`Unclassified path: ${file}`);
-    }
-  }
-
-  const affectedComponents = ['control', 'dataplane'].filter((component) => affected.has(component));
-  const restartScope = affected.has('dataplane') ? 'both' : affected.has('control') ? 'control' : 'none';
-  return { affectedComponents, restartScope };
-}
-
-function formatImpact(impact) {
-  return [
-    `affected-components=${impact.affectedComponents.join('+') || 'none'}`,
-    `restart-scope=${impact.restartScope}`,
-  ].join('\n');
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  try {
-    const args = process.argv.slice(2);
-    const files = args.includes('--stdin')
-      ? fs.readFileSync(0, 'utf8').split(/\r?\n/)
-      : args;
-    console.log(formatImpact(classifyRuntimeImpact(files)));
-  } catch (error) {
-    console.error(`[runtime-impact] ${error.message}`);
-    process.exitCode = 1;
-  }
-}

scripts/windows/VpnProxy.Windows.psm1

@@ -0,0 +1,154 @@
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+$script:InstallRoot = $env:VPN_PROXY_WINDOWS_ROOT
+if ([string]::IsNullOrWhiteSpace($script:InstallRoot)) {
+  $script:InstallRoot = "C:\Tools\vpn-proxy-windows"
+}
+
+$script:ProxiFyreRoot = $env:PROXIFYRE_ROOT
+if ([string]::IsNullOrWhiteSpace($script:ProxiFyreRoot)) {
+  $script:ProxiFyreRoot = "C:\Tools\ProxiFyre"
+}
+
+function New-VpnProxyResult {
+  param(
+    [string]$Action,
+    [bool]$Success,
+    [object]$Result = $null,
+    [string]$Message = "",
+    [string]$ErrorMessage = ""
+  )
+
+  $value = [ordered]@{
+    success = $Success
+    action = $Action
+  }
+  if ($null -ne $Result) { $value.result = $Result }
+  if ($Message) { $value.message = $Message }
+  if ($ErrorMessage) { $value.error = $ErrorMessage }
+  return $value
+}
+
+function Get-VpnProxyStatus {
+  $task = Get-ScheduledTask -TaskName "SingBoxProxy" -ErrorAction SilentlyContinue
+  $singboxProcess = Get-Process -Name "sing-box" -ErrorAction SilentlyContinue
+  $proxifyre = Get-Service -Name "ProxiFyreService" -ErrorAction SilentlyContinue
+
+  return [ordered]@{
+    singbox = if ($singboxProcess) { "Running" } elseif ($task) { [string]$task.State } else { "NotInstalled" }
+    proxifyre = if ($proxifyre) { [string]$proxifyre.Status } else { "NotInstalled" }
+    installRoot = $script:InstallRoot
+    proxifyreRoot = $script:ProxiFyreRoot
+  }
+}
+
+function Write-ProxiFyreConfig {
+  param(
+    [Parameter(Mandatory=$true)][string]$ConfigPath,
+    [Parameter(Mandatory=$true)][object]$Config
+  )
+
+  $dir = Split-Path -Parent $ConfigPath
+  New-Item -ItemType Directory -Force -Path $dir | Out-Null
+  if (Test-Path $ConfigPath) {
+    Copy-Item $ConfigPath "$ConfigPath.bak" -Force
+  }
+  $Config | ConvertTo-Json -Depth 20 | Set-Content -Path $ConfigPath -Encoding UTF8
+}
+
+function Restart-ProxiFyre {
+  $exe = Join-Path $script:ProxiFyreRoot "ProxiFyre.exe"
+  if (-not (Test-Path $exe)) {
+    throw "ProxiFyre.exe not found at $exe"
+  }
+
+  & $exe stop 2>$null | Out-Null
+  & $exe install 2>$null | Out-Null
+  & $exe start 2>$null | Out-Null
+}
+
+function Invoke-ProxiFyreApply {
+  param([object]$Payload)
+
+  Write-ProxiFyreConfig -ConfigPath $Payload.configPath -Config $Payload.config
+  Restart-ProxiFyre
+  return New-VpnProxyResult -Action "proxifyre.apply" -Success $true -Message "ProxiFyre config applied and service restarted"
+}
+
+function Invoke-ServiceControl {
+  param([object]$Payload)
+
+  $service = [string]$Payload.service
+  $action = [string]$Payload.action
+
+  if ($service -eq "proxifyre") {
+    if ($action -eq "restart") { Restart-ProxiFyre }
+    elseif ($action -eq "start") { Start-Service -Name "ProxiFyreService" }
+    elseif ($action -eq "stop") { Stop-Service -Name "ProxiFyreService" -Force }
+    else { throw "Unknown ProxiFyre action: $action" }
+  } elseif ($service -eq "sing-box") {
+    if ($action -eq "restart") {
+      Stop-ScheduledTask -TaskName "SingBoxProxy" -ErrorAction SilentlyContinue
+      Start-ScheduledTask -TaskName "SingBoxProxy"
+    } elseif ($action -eq "start") {
+      Start-ScheduledTask -TaskName "SingBoxProxy"
+    } elseif ($action -eq "stop") {
+      Stop-ScheduledTask -TaskName "SingBoxProxy"
+    } else {
+      throw "Unknown sing-box action: $action"
+    }
+  } elseif ($service -eq "ui") {
+    return New-VpnProxyResult -Action "service.control" -Success $true -Message "UI is controlled by manage.ps1 -OpenUi"
+  } else {
+    throw "Unknown service: $service"
+  }
+
+  return New-VpnProxyResult -Action "service.control" -Success $true -Message "$service $action complete"
+}
+
+function Get-VpnProxyLogs {
+  $paths = @(
+    (Join-Path $script:InstallRoot "runtime\sing-box\singbox.log"),
+    (Join-Path $script:ProxiFyreRoot "ProxiFyre.log")
+  )
+  $logs = @()
+
+  foreach ($path in $paths) {
+    if (Test-Path $path) {
+      $logs += [ordered]@{
+        path = $path
+        lines = @(Get-Content $path -Tail 120 -ErrorAction SilentlyContinue)
+      }
+    }
+  }
+
+  return $logs
+}
+
+function Invoke-VpnProxyAction {
+  param(
+    [Parameter(Mandatory=$true)][string]$Action,
+    [object]$Payload = @{}
+  )
+
+  switch ($Action) {
+    "status.get" {
+      return New-VpnProxyResult -Action $Action -Success $true -Result (Get-VpnProxyStatus)
+    }
+    "proxifyre.apply" {
+      return Invoke-ProxiFyreApply -Payload $Payload
+    }
+    "service.control" {
+      return Invoke-ServiceControl -Payload $Payload
+    }
+    "logs.get" {
+      return New-VpnProxyResult -Action $Action -Success $true -Result (Get-VpnProxyLogs)
+    }
+    default {
+      throw "Unknown action: $Action"
+    }
+  }
+}
+
+Export-ModuleMember -Function Invoke-VpnProxyAction, Get-VpnProxyStatus

scripts/windows/helper.ps1

@@ -0,0 +1,26 @@
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+Import-Module (Join-Path $ScriptDir "VpnProxy.Windows.psm1") -Force
+
+try {
+  $raw = [Console]::In.ReadToEnd()
+  if ([string]::IsNullOrWhiteSpace($raw)) {
+    throw "Missing JSON input"
+  }
+
+  $request = $raw | ConvertFrom-Json
+  $payload = if ($request.PSObject.Properties.Name -contains "payload") { $request.payload } else { @{} }
+  $result = Invoke-VpnProxyAction -Action ([string]$request.action) -Payload $payload
+  $result | ConvertTo-Json -Depth 30 -Compress
+  exit 0
+} catch {
+  $errorResult = [ordered]@{
+    success = $false
+    action = "error"
+    error = $_.Exception.Message
+  }
+  $errorResult | ConvertTo-Json -Depth 10 -Compress
+  exit 1
+}

scripts/windows/manage.ps1

@@ -0,0 +1,65 @@
+param(
+  [switch]$OpenUi,
+  [switch]$Status,
+  [switch]$RestartServices
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$AppDir = Split-Path -Parent (Split-Path -Parent $ScriptDir)
+if (-not (Test-Path (Join-Path $AppDir "package.json"))) {
+  throw "Cannot locate app root from $ScriptDir"
+}
+
+$Root = $env:VPN_PROXY_WINDOWS_ROOT
+if ([string]::IsNullOrWhiteSpace($Root)) {
+  if ((Split-Path -Leaf $AppDir) -eq "app") {
+    $Root = Split-Path -Parent $AppDir
+  } else {
+    $Root = $AppDir
+  }
+}
+
+$env:VPN_PROXY_WINDOWS_ROOT = $Root
+$env:APP_MODE = "windows"
+$env:DATA_DIR = Join-Path $Root "data"
+$env:DIST_DIR = Join-Path $AppDir "dist"
+$env:PROXY_PORT = "1080"
+$env:PROXY_BIND_IP = "127.0.0.1"
+$env:SING_BOX_CONFIG = Join-Path $Root "runtime\sing-box\config.json"
+$env:SING_BOX_CACHE = Join-Path $Root "runtime\sing-box\cache.db"
+$env:WINDOWS_HELPER = Join-Path $AppDir "scripts\windows\helper.ps1"
+$env:PATH = "$(Join-Path $Root "runtime\sing-box");$env:PATH"
+
+function Get-NodeCommand {
+  $portable = Join-Path $Root "runtime\node\node.exe"
+  if (Test-Path $portable) { return $portable }
+  return "node"
+}
+
+if ($Status) {
+  $inputJson = @{ action = "status.get"; payload = @{} } | ConvertTo-Json -Compress
+  $inputJson | & $env:WINDOWS_HELPER
+  exit $LASTEXITCODE
+}
+
+if ($RestartServices) {
+  $helper = $env:WINDOWS_HELPER
+  (@{ action = "service.control"; payload = @{ service = "proxifyre"; action = "restart" } } | ConvertTo-Json -Compress) | & $helper
+  (@{ action = "service.control"; payload = @{ service = "sing-box"; action = "restart" } } | ConvertTo-Json -Compress) | & $helper
+  exit 0
+}
+
+if ($OpenUi) {
+  $node = Get-NodeCommand
+  Start-Process "http://127.0.0.1:3456"
+  & $node (Join-Path $AppDir "src\server\index.js")
+  exit $LASTEXITCODE
+}
+
+Write-Host "VPN Proxy Windows"
+Write-Host "  -OpenUi          Start local UI"
+Write-Host "  -Status          Print JSON status"
+Write-Host "  -RestartServices Restart ProxiFyre and sing-box"

src/server/adapters/neighbors.ts

@@ -1,83 +0,0 @@
-import { spawnSync } from 'node:child_process';
-
-const ACTIVE_STATES = new Set(['REACHABLE', 'DELAY', 'PROBE', 'PERMANENT', 'NOARP']);
-const IGNORED_STATES = new Set(['FAILED', 'INCOMPLETE']);
-const MAC_PATTERN = /^[0-9a-f]{2}(?::[0-9a-f]{2}){5}$/i;
-const INTERFACE_PATTERN = /^[a-z0-9_.:-]{1,15}$/i;
-
-interface NeighborEntry extends Record<string, unknown> {
-  state?: unknown;
-  lladdr?: unknown;
-  dev?: unknown;
-  dst?: unknown;
-}
-
-export interface NeighborObservation {
-  ip: string;
-  mac: string;
-  interface: string;
-  active: boolean;
-  observedAt: string;
-  source: 'neighbor';
-}
-
-function neighborEntry(value: unknown): NeighborEntry {
-  return value && typeof value === 'object' && !Array.isArray(value)
-    ? value as NeighborEntry
-    : {};
-}
-
-export function isDeviceInterface(value: unknown) {
-  const name = String(value || '');
-  return INTERFACE_PATTERN.test(name)
-    && name !== 'docker0' && !name.startsWith('br-') && !name.startsWith('veth');
-}
-
-export function parseNeighborSnapshot(value: unknown, observedAt = new Date().toISOString()): NeighborObservation[] {
-  if (!Array.isArray(value)) return [];
-  return value.flatMap((value) => {
-    const entry = neighborEntry(value);
-    const states = (Array.isArray(entry.state) ? entry.state : [entry.state])
-      .filter(Boolean)
-      .map((state: unknown) => String(state).toUpperCase());
-    const mac = String(entry.lladdr || '').toLowerCase();
-    const deviceInterface = String(entry.dev || '');
-    if (!entry.dst || !isDeviceInterface(deviceInterface) || !MAC_PATTERN.test(mac)
-      || states.some((state) => IGNORED_STATES.has(state))) {
-      return [];
-    }
-    return [{
-      ip: String(entry.dst),
-      mac,
-      interface: deviceInterface,
-      active: states.some((state) => ACTIVE_STATES.has(state)),
-      observedAt,
-      source: 'neighbor',
-    }];
-  });
-}
-
-export function readNeighborSnapshot(run: typeof spawnSync = spawnSync, now = () => new Date()) {
-  const observedAt = now().toISOString();
-  const result = run('ip', ['-j', 'neigh', 'show'], {
-    encoding: 'utf8',
-    timeout: 1500,
-  });
-  if (result.error || result.status !== 0) {
-    return {
-      observedAt,
-      observations: [],
-      error: result.error?.message || String(result.stderr || 'ip neigh завершился с ошибкой').trim(),
-    };
-  }
-  try {
-    return {
-      observedAt,
-      observations: parseNeighborSnapshot(JSON.parse(result.stdout || '[]'), observedAt),
-      error: null,
-    };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return { observedAt, observations: [], error: `ip neigh вернул невалидный JSON: ${message}` };
-  }
-}

src/server/clientSettings.js

@@ -0,0 +1,101 @@
+import fs from "node:fs";
+import path from "node:path";
+import { settings } from "./config.js";
+
+const DEFAULT_CLIENT_SETTINGS = {
+  homeBypassEnabled: false,
+  sharedProxyEnabled: false,
+  sharedProxyControlUrl: "",
+  sharedProxy: null,
+};
+
+function normalizeProxyPort(value, fallback = settings.proxyPort) {
+  const parsed = Number.parseInt(value, 10);
+  const min = Number.isInteger(settings.clientProxyPortStart)
+    ? settings.clientProxyPortStart
+    : settings.proxyPort;
+  const max = Number.isInteger(settings.clientProxyPortEnd)
+    ? settings.clientProxyPortEnd
+    : min;
+  const fallbackPort =
+    Number.isInteger(fallback) && fallback >= min && fallback <= max
+      ? fallback
+      : min;
+  if (!Number.isInteger(parsed) || parsed < min || parsed > max) {
+    return fallbackPort;
+  }
+  return parsed;
+}
+
+function readJson(filePath, fallback) {
+  try {
+    if (!fs.existsSync(filePath)) return fallback;
+    return JSON.parse(fs.readFileSync(filePath, "utf8"));
+  } catch {
+    return fallback;
+  }
+}
+
+function writeJson(filePath, value) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify(value, null, 2), "utf8");
+}
+
+function normalizeUrl(value) {
+  const raw = String(value || "").trim();
+  if (!raw) return "";
+  try {
+    const url = new URL(raw);
+    if (!["http:", "https:"].includes(url.protocol)) return "";
+    url.hash = "";
+    url.search = "";
+    return url.toString().replace(/\/$/, "");
+  } catch {
+    return "";
+  }
+}
+
+function normalizeSharedProxy(value) {
+  if (!value || typeof value !== "object") return null;
+  const host = String(value.host || "").trim();
+  const port = Number.parseInt(value.port, 10);
+  const protocol = value.protocol === "http" ? "http" : "socks5";
+  if (!host || !Number.isInteger(port) || port <= 0 || port > 65535) {
+    return null;
+  }
+  return {
+    host,
+    port,
+    protocol,
+    checkedAt: value.checkedAt || null,
+  };
+}
+
+export function normalizeClientSettings(input = {}) {
+  const sharedProxy = normalizeSharedProxy(input.sharedProxy);
+  const sharedProxyEnabled = Boolean(input.sharedProxyEnabled && sharedProxy);
+  return {
+    homeBypassEnabled: Boolean(input.homeBypassEnabled),
+    proxyPort: normalizeProxyPort(input.proxyPort),
+    sharedProxyEnabled,
+    sharedProxyControlUrl: normalizeUrl(input.sharedProxyControlUrl),
+    sharedProxy,
+  };
+}
+
+export function readClientSettings() {
+  return normalizeClientSettings({
+    ...DEFAULT_CLIENT_SETTINGS,
+    proxyPort: settings.proxyPort,
+    ...readJson(settings.clientSettingsPath, {}),
+  });
+}
+
+export function writeClientSettings(input) {
+  const normalized = normalizeClientSettings({
+    ...readClientSettings(),
+    ...(input && typeof input === "object" ? input : {}),
+  });
+  writeJson(settings.clientSettingsPath, normalized);
+  return normalized;
+}

src/server/config.js

@@ -0,0 +1,49 @@
+import path from "node:path";
+
+const dataDir = process.env.DATA_DIR || path.resolve(".vpn-proxy");
+const rawAppMode = String(process.env.APP_MODE || "gateway").toLowerCase();
+const appMode = ["gateway", "client", "windows"].includes(rawAppMode)
+  ? rawAppMode
+  : "gateway";
+
+export const settings = {
+  appMode,
+  port: Number(process.env.PORT || 3456),
+  proxyPort: Number(process.env.PROXY_PORT || 8080),
+  clientProxyPortStart: Number(process.env.CLIENT_PROXY_PORT_START || 8080),
+  clientProxyPortEnd: Number(process.env.CLIENT_PROXY_PORT_END || 8090),
+  tproxyPort: Number(process.env.TPROXY_PORT || 7895),
+  bindIp: process.env.PROXY_BIND_IP || "0.0.0.0",
+  dataDir,
+  distDir: process.env.DIST_DIR || "/app/dist",
+  configPath:
+    process.env.SING_BOX_CONFIG || path.join(dataDir, "sing-box-config.json"),
+  cachePath: process.env.SING_BOX_CACHE || "/var/lib/sing-box/cache.db",
+  statePath: path.join(dataDir, "state.json"),
+  customRulesPath: path.join(dataDir, "custom-rules.json"),
+  customRuleSetsPath: path.join(dataDir, "custom-rule-sets.json"),
+  clientSettingsPath: path.join(dataDir, "client-settings.json"),
+  devicesPath: path.join(dataDir, "devices.json"),
+  deviceRulesPath: path.join(dataDir, "device-rules.json"),
+  subscriptionCachePath: path.join(dataDir, "subscription-cache.json"),
+  windowsProfilesPath: path.join(dataDir, "windows-profiles.json"),
+  windowsTargetsPath: path.join(dataDir, "proxy-targets.json"),
+  windowsStatePath: path.join(dataDir, "windows-state.json"),
+  windowsActivityPath: path.join(dataDir, "windows-activity.json"),
+  windowsHelperPath:
+    process.env.WINDOWS_HELPER || path.resolve("scripts/windows/helper.ps1"),
+  proxifyreConfigPath:
+    process.env.PROXIFYRE_CONFIG ||
+    "C:\\Tools\\ProxiFyre\\app-config.json",
+  sharedProxyHost: process.env.SHARED_PROXY_HOST || "",
+  hwidPath: path.join(dataDir, "hwid"),
+  routingRuDirect: String(process.env.ROUTING_RU_DIRECT || "true") !== "false",
+  ruleSetDownloadDetour: process.env.RULE_SET_DOWNLOAD_DETOUR || "vpn",
+  logLevel: process.env.LOG_LEVEL || "info",
+  appName:
+    appMode === "windows"
+      ? "VPN Proxy Windows"
+      : appMode === "client"
+        ? "VPN Proxy Client"
+        : "VPN Proxy Gateway",
+};

src/server/config.ts

@@ -1,77 +0,0 @@
-import path from "node:path";
-
-const appMode = process.env.APP_MODE === "client" ? "client" : "gateway";
-const appComponent = process.env.APP_COMPONENT || "";
-const dataDir = process.env.DATA_DIR || path.resolve(".vpn-proxy");
-const parsePort = (value: string | undefined, fallback: number) => {
-  const parsed = Number.parseInt(value || '', 10);
-  return Number.isInteger(parsed) ? parsed : fallback;
-};
-const proxyPort = parsePort(
-  process.env.PROXY_PORT,
-  appMode === "client" ? 8082 : 8080,
-);
-const trafficSource = process.env.SING_BOX_TRAFFIC_SOURCE
-  || (appMode === "client" ? "native" : "snapshot");
-if (appMode === "client" && trafficSource !== "native" && trafficSource !== "disabled") {
-  throw new Error("SING_BOX_TRAFFIC_SOURCE must be native or disabled in client mode");
-}
-if (appMode === "gateway" && !["snapshot", "shadow", "native"].includes(trafficSource)) {
-  throw new Error("SING_BOX_TRAFFIC_SOURCE must be snapshot, shadow or native in gateway mode");
-}
-if (appMode === "gateway" && trafficSource !== "snapshot"
-  && ((appComponent !== "control" && appComponent !== "dataplane")
-    || !process.env.DATAPLANE_SOCKET?.trim())) {
-  throw new Error("Gateway shadow and native traffic modes require split control/dataplane topology");
-}
-
-export const settings = {
-  appMode,
-  appComponent,
-  port: parsePort(process.env.PORT, 3456),
-  proxyPort,
-  diagnosticsProxyPort: parsePort(process.env.DIAGNOSTICS_PROXY_PORT, 18080),
-  failoverPrimaryProxyPort: parsePort(process.env.FAILOVER_PRIMARY_PROXY_PORT, 18081),
-  failoverReserveProxyPort: parsePort(process.env.FAILOVER_RESERVE_PROXY_PORT, 18082),
-  singboxApiPort: parsePort(process.env.SING_BOX_API_PORT, 19090),
-  singboxNativeApiPort: 19091,
-  singboxTrafficSource: trafficSource as "native" | "disabled" | "snapshot" | "shadow",
-  tproxyPort: parsePort(process.env.TPROXY_PORT, 7895),
-  tproxyMark: process.env.TPROXY_MARK || "1",
-  tproxyChain: process.env.TPROXY_CHAIN || "VPN_PROXY_TPROXY",
-  devicePolicyChain: process.env.DEVICE_POLICY_CHAIN || "VPN_PROXY_DEVICE_POLICY",
-  trafficUploadChain: process.env.TRAFFIC_UPLOAD_CHAIN || "VPN_PROXY_TRAFFIC_UP",
-  trafficDownloadChain: process.env.TRAFFIC_DOWNLOAD_CHAIN || "VPN_PROXY_TRAFFIC_DOWN",
-  deviceTrafficAccountingEnabled: process.env.DEVICE_TRAFFIC_ACCOUNTING_ENABLED !== "false",
-  directTrafficChain: process.env.DIRECT_TRAFFIC_CHAIN || "VPN_PROXY_DIRECT",
-  directTrafficMark: process.env.DIRECT_TRAFFIC_MARK || "0x40000000",
-  gatewayClientCidrs: (process.env.GATEWAY_CLIENT_CIDRS
-    || "10.0.0.0/8 172.16.0.0/12 192.168.0.0/16")
-    .trim().split(/\s+/).filter(Boolean),
-  bypassCidrs: (process.env.BYPASS_CIDRS
-    || "0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16 224.0.0.0/4 240.0.0.0/4")
-    .trim().split(/\s+/).filter(Boolean),
-  dataplaneSocket: process.env.DATAPLANE_SOCKET || "/run/vpn-proxy/dataplane.sock",
-  bindIp: process.env.PROXY_BIND_IP || "0.0.0.0",
-  dataDir,
-  distDir: process.env.DIST_DIR || "/app/dist",
-  configPath:
-    process.env.SING_BOX_CONFIG || path.join(dataDir, "sing-box-config.json"),
-  cachePath: process.env.SING_BOX_CACHE || "/var/lib/sing-box/cache.db",
-  gatewayNativeApiSecretPath:
-    process.env.SING_BOX_API_SECRET || "/var/lib/sing-box/api.secret",
-  gatewayRuntimeConfigPath:
-    process.env.SING_BOX_RUNTIME_CONFIG || "/var/lib/sing-box/runtime-config.json",
-  statePath: path.join(dataDir, "state.json"),
-  deviceStatePath: path.join(dataDir, "devices.json"),
-  activityJournalPath: path.join(dataDir, "activity-journal.json"),
-  subscriptionCachePath: path.join(dataDir, "subscription-cache.json"),
-  sharedProxyHost: process.env.SHARED_PROXY_HOST || "",
-  hostNetworkStatePath:
-    process.env.HARBOR_HOST_NETWORK_STATE || "/run/harbor-host/network.json",
-  gatewayPresencePort: parsePort(process.env.HARBOR_GATEWAY_CONTROL_PORT, 3456),
-  subscriptionTimeoutMs: parsePort(process.env.SUBSCRIPTION_TIMEOUT_MS, 15_000),
-  hwidPath: path.join(dataDir, "hwid"),
-  logLevel: process.env.LOG_LEVEL || "info",
-  appName: "VPN Proxy Gateway",
-};

src/server/dataplane.ts

@@ -1,442 +0,0 @@
-import fs from 'node:fs';
-import http from 'node:http';
-import net from 'node:net';
-import path from 'node:path';
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { LiveTrafficConnection, LiveTrafficSnapshot } from '../shared/liveTraffic.js';
-import { settings } from './config.js';
-import { createSingboxRuntime } from './singboxRuntime.js';
-import { buildVersionInfo } from './version.js';
-import { readNeighborSnapshot } from './adapters/neighbors.js';
-import { createDeviceTrafficService } from './services/deviceTrafficService.js';
-import { createDevicePolicyService } from './services/devicePolicyService.js';
-import { createConnectivityDiagnosticsService } from './services/connectivityDiagnosticsService.js';
-import { createDnsDiagnosticsService } from './services/dnsDiagnosticsService.js';
-import {
-  createDomainTrafficService,
-  readSingboxConnections,
-} from './services/domainTrafficService.js';
-import { deviceId } from './services/deviceInventoryService.js';
-import {
-  createLiveTrafficService,
-} from './services/liveTrafficService.js';
-import { createSingboxSelectorService } from './services/singboxSelectorService.js';
-import { createTrafficHistoryService } from './services/trafficHistoryService.js';
-import { parseTrafficHistoryQuery } from '../shared/trafficHistory.js';
-
-const socketPath = settings.dataplaneSocket;
-const trafficMode = settings.singboxTrafficSource as 'snapshot' | 'shadow' | 'native';
-const nativeTrafficEnabled = trafficMode === 'shadow' || trafficMode === 'native';
-const runtime = createSingboxRuntime({
-  configPath: settings.configPath,
-  gateway: true,
-  tproxyChain: settings.tproxyChain,
-  gatewayRuntimeConfigPath: settings.gatewayRuntimeConfigPath,
-  ...(nativeTrafficEnabled ? {
-    nativeApi: {
-      apiPort: settings.singboxNativeApiPort,
-      secretPath: settings.gatewayNativeApiSecretPath,
-      runtimeConfigPath: settings.gatewayRuntimeConfigPath,
-    },
-  } : {}),
-});
-const versionInfo = buildVersionInfo('gateway');
-const traffic = createDeviceTrafficService({
-  observe: () => readNeighborSnapshot(),
-  uploadChain: settings.trafficUploadChain,
-  downloadChain: settings.trafficDownloadChain,
-  directChain: settings.directTrafficChain,
-  directMark: settings.directTrafficMark,
-  tproxyMark: settings.tproxyMark,
-  gatewayClientCidrs: settings.gatewayClientCidrs,
-  bypassCidrs: settings.bypassCidrs,
-  proxyPort: settings.proxyPort,
-});
-const devicePolicy = createDevicePolicyService({
-  chain: settings.devicePolicyChain,
-  tproxyPort: settings.tproxyPort,
-  tproxyMark: settings.tproxyMark,
-});
-const connectivityDiagnostics = createConnectivityDiagnosticsService({
-  proxyPort: settings.diagnosticsProxyPort,
-});
-const dnsDiagnostics = createDnsDiagnosticsService({
-  proxyPort: settings.diagnosticsProxyPort,
-});
-const failoverDiagnostics = {
-  primary: createConnectivityDiagnosticsService({ proxyPort: settings.failoverPrimaryProxyPort }),
-  reserve: createConnectivityDiagnosticsService({ proxyPort: settings.failoverReserveProxyPort }),
-};
-const selector = createSingboxSelectorService({ port: settings.singboxApiPort });
-const snapshotDomainTraffic = createDomainTrafficService({
-  observe: () => readSingboxConnections(settings.singboxApiPort),
-  devices: () => traffic.snapshot().devices,
-});
-const nativeDomainTraffic = createDomainTrafficService({
-  observe: () => ({ connections: [] }),
-  devices: () => traffic.snapshot().devices,
-});
-const domainTraffic = trafficMode === 'native' ? nativeDomainTraffic : snapshotDomainTraffic;
-let originsByIp = new Map<string, LiveTrafficConnection['origin'] | null>();
-let liveTraffic = createLiveTrafficService({
-  port: settings.singboxNativeApiPort,
-  enabled: false,
-  gateway: true,
-  isRuntimeRunning: () => false,
-  resolveOrigin,
-});
-const trafficHistory = createTrafficHistoryService({
-  filePath: path.join(settings.dataDir, 'traffic.sqlite'),
-  source: () => liveTrafficSnapshot().source.state,
-});
-let ready = false;
-let trafficTimer: NodeJS.Timeout | null = null;
-let domainTrafficTimer: NodeJS.Timeout | null = null;
-const MAX_POLICY_BODY_BYTES = 256 * 1024;
-
-function record(value: unknown): Record<string, unknown> {
-  return value && typeof value === 'object' && !Array.isArray(value)
-    ? value as Record<string, unknown>
-    : {};
-}
-
-function errorMessage(error: unknown) {
-  return error instanceof Error ? error.message : String(error);
-}
-
-function updateOrigins(devices: unknown) {
-  const next = new Map<string, LiveTrafficConnection['origin'] | null>();
-  for (const value of Array.isArray(devices) ? devices : []) {
-    const device = record(value);
-    const ip = String(device.ip || '');
-    const mac = String(device.mac || '').toLowerCase();
-    if (!net.isIPv4(ip) || !/^[0-9a-f]{2}(?::[0-9a-f]{2}){5}$/.test(mac)) continue;
-    const origin: LiveTrafficConnection['origin'] = {
-      kind: 'device',
-      id: deviceId(mac),
-      label: ip,
-      provenance: 'source-ip',
-    };
-    next.set(ip, next.has(ip) ? null : origin);
-  }
-  originsByIp = next;
-}
-
-function resolveOrigin(sourceIp: string): LiveTrafficConnection['origin'] {
-  return originsByIp.get(sourceIp) || {
-    kind: 'unknown',
-    id: null,
-    label: 'Неизвестное устройство',
-    provenance: 'unknown',
-  };
-}
-
-async function refreshDeviceTraffic() {
-  try {
-    return await traffic.refresh();
-  } finally {
-    refreshOrigins();
-  }
-}
-
-function refreshOrigins() {
-  updateOrigins(readNeighborSnapshot().observations);
-}
-
-function decimal(value: unknown) {
-  return typeof value === 'string' && /^\d+$/.test(value) ? BigInt(value) : 0n;
-}
-
-function trackedTotals(snapshot: unknown) {
-  let upload = 0n;
-  let download = 0n;
-  for (const value of Array.isArray(record(snapshot).tracked) ? record(snapshot).tracked as unknown[] : []) {
-    const entry = record(value);
-    upload += decimal(entry.uploadBytes);
-    download += decimal(entry.downloadBytes);
-  }
-  return { upload, download };
-}
-
-function mismatchCount(left: unknown, right: unknown, fields: string[]) {
-  const entries = (value: unknown) => {
-    const values = Array.isArray(value) ? value : [];
-    return new Map(values.map((item) => {
-      const entry = record(item);
-      const key = fields.map((field) => String(entry[field] || '')).join('\0');
-      return [key, `${entry.uploadBytes || '0'}\0${entry.downloadBytes || '0'}`];
-    }));
-  };
-  const leftEntries = entries(left);
-  const rightEntries = entries(right);
-  const keys = new Set([...leftEntries.keys(), ...rightEntries.keys()]);
-  let mismatches = 0;
-  for (const key of keys) if (leftEntries.get(key) !== rightEntries.get(key)) mismatches += 1;
-  return mismatches;
-}
-
-function liveTrafficSnapshot(): LiveTrafficSnapshot {
-  const snapshot = liveTraffic.snapshot();
-  return nativeTrafficEnabled && runtime.nativeApiWarning ? {
-    ...snapshot,
-    source: {
-      ...snapshot.source,
-      state: 'incompatible',
-      error: runtime.nativeApiWarning,
-    },
-  } : snapshot;
-}
-
-function trafficCollectorSource() {
-  const canonical = domainTraffic.snapshot();
-  const canonicalSource = record(canonical.source);
-  const nativeLive = nativeTrafficEnabled ? liveTrafficSnapshot() : null;
-  const nativeProjection = nativeDomainTraffic.snapshot();
-  const legacyProjection = snapshotDomainTraffic.snapshot();
-  let shadow = null;
-  if (trafficMode === 'shadow') {
-    const nativeTotals = trackedTotals(nativeProjection);
-    const legacyTotals = trackedTotals(legacyProjection);
-    shadow = {
-      activeDifference: Number(record(nativeProjection.source).activeConnections || 0)
-        - Number(record(legacyProjection.source).activeConnections || 0),
-      uploadDifferenceBytes: (nativeTotals.upload - legacyTotals.upload).toString(),
-      downloadDifferenceBytes: (nativeTotals.download - legacyTotals.download).toString(),
-      routeMismatches: mismatchCount(nativeProjection.tracked, legacyProjection.tracked, ['source', 'outbound']),
-      deviceMismatches: mismatchCount(nativeProjection.routes, legacyProjection.routes, ['deviceId', 'source', 'outbound']),
-    };
-  }
-  return {
-    error: runtime.nativeApiWarning
-      || (trafficMode === 'native' ? nativeLive?.source.error : canonicalSource.error)
-      || null,
-    mode: trafficMode,
-    writer: trafficMode === 'native' ? 'native' as const : 'snapshot' as const,
-    activeConnections: Number(canonicalSource.activeConnections || 0),
-    native: nativeLive ? {
-      state: nativeLive.source.state,
-      epoch: nativeLive.epoch,
-      sequence: nativeLive.sequence,
-      observedAt: nativeLive.observedAt,
-      active: nativeLive.summary.active,
-      unattributedUploadBytes: nativeLive.source.unattributedUploadBytes,
-      unattributedDownloadBytes: nativeLive.source.unattributedDownloadBytes,
-    } : null,
-    shadow,
-  };
-}
-
-function domainTrafficSnapshot() {
-  const snapshot = domainTraffic.snapshot();
-  return { ...snapshot, source: trafficCollectorSource() };
-}
-
-function readJson(req: IncomingMessage): Promise<unknown> {
-  return new Promise((resolve, reject) => {
-    const chunks: Buffer[] = [];
-    let size = 0;
-    let tooLarge = false;
-    req.on('data', (chunk: Buffer | string) => {
-      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-      size += buffer.length;
-      if (!tooLarge && size > MAX_POLICY_BODY_BYTES) {
-        tooLarge = true;
-        reject(new Error('Device policy request слишком большой'));
-        return;
-      }
-      if (!tooLarge) chunks.push(buffer);
-    });
-    req.on('end', () => {
-      if (tooLarge) return;
-      try {
-        resolve(JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}'));
-      } catch {
-        reject(new Error('Device policy request содержит невалидный JSON'));
-      }
-    });
-    req.on('error', reject);
-  });
-}
-
-function sendJson(res: ServerResponse, statusCode: number, payload: unknown) {
-  res.writeHead(statusCode, { 'content-type': 'application/json; charset=utf-8' });
-  res.end(JSON.stringify(payload));
-}
-
-const server = http.createServer(async (req: IncomingMessage, res: ServerResponse) => {
-  try {
-    if (req.method === 'GET' && req.url === '/status') {
-      return sendJson(res, ready ? 200 : 503, {
-        ...await runtime.refresh(),
-        gatewayBackendVersion: versionInfo.components.gatewayBackend,
-        singBoxVersion: versionInfo.runtime.singBox,
-        devicePolicy: devicePolicy.snapshot(),
-        trafficCollector: trafficCollectorSource(),
-        ready,
-      });
-    }
-    if (req.method === 'GET' && req.url === '/devices') {
-      return sendJson(res, 200, readNeighborSnapshot());
-    }
-    if (req.method === 'GET' && req.url === '/device-traffic') {
-      return sendJson(res, 200, traffic.snapshot());
-    }
-    if (req.method === 'GET' && req.url === '/domain-traffic') {
-      return sendJson(res, 200, domainTrafficSnapshot());
-    }
-    if (req.method === 'GET' && req.url === '/traffic/live') {
-      return sendJson(res, 200, liveTrafficSnapshot());
-    }
-    const url = new URL(req.url || '/', 'http://localhost');
-    if (req.method === 'GET' && url.pathname === '/traffic/history') {
-      return sendJson(res, 200, await trafficHistory.query(parseTrafficHistoryQuery(url.searchParams)));
-    }
-    if (req.method === 'GET' && req.url === '/device-policy') {
-      return sendJson(res, 200, devicePolicy.snapshot());
-    }
-    if (req.method === 'PUT' && req.url === '/device-policy') {
-      const body = record(await readJson(req));
-      return sendJson(res, 200, await devicePolicy.apply(body.devices));
-    }
-    if (req.method === 'POST' && req.url === '/diagnostics/connectivity') {
-      const { services = [], target = null } = record(await readJson(req));
-      return sendJson(res, 200, await connectivityDiagnostics.run({
-        vpnAvailable: runtime.running,
-        services,
-        target,
-      }));
-    }
-    if (req.method === 'POST' && req.url === '/diagnostics/dns/catalog') {
-      const { customResolvers = [], customDomains = [] } = record(await readJson(req));
-      return sendJson(res, 200, await dnsDiagnostics.catalog(
-        Array.isArray(customResolvers) ? customResolvers : [],
-        Array.isArray(customDomains) ? customDomains : [],
-      ));
-    }
-    if (req.method === 'POST' && req.url === '/diagnostics/dns') {
-      const {
-        customResolvers = [], customDomains = [], domainId, resolverId = null,
-      } = record(await readJson(req));
-      return sendJson(res, 200, await dnsDiagnostics.run({
-        vpnAvailable: runtime.running,
-        customResolvers: Array.isArray(customResolvers) ? customResolvers : [],
-        customDomains: Array.isArray(customDomains) ? customDomains : [],
-        domainId,
-        resolverId,
-      }));
-    }
-    if (req.method === 'POST' && req.url === '/failover/probe') {
-      const { role, services = [], target = null, timeoutMs = 6_000 } = record(await readJson(req));
-      if (role !== 'primary' && role !== 'reserve') throw new Error('Неизвестная failover role');
-      return sendJson(res, 200, await failoverDiagnostics[role].runVpn({ services, target, timeoutMs: Number(timeoutMs) }));
-    }
-    if (req.method === 'GET' && req.url === '/failover/selector') {
-      return sendJson(res, 200, await selector.read());
-    }
-    if (req.method === 'PUT' && req.url === '/failover/selector') {
-      const { role } = record(await readJson(req));
-      if (role !== 'primary' && role !== 'reserve') throw new Error('Неизвестная failover role');
-      return sendJson(res, 200, await selector.select(role));
-    }
-    if (req.method === 'PUT' && req.url === '/failover/activity') {
-      const { enabled } = record(await readJson(req));
-      if (enabled === true) domainTraffic.enableActivity();
-      else domainTraffic.disableActivity();
-      return sendJson(res, 200, { enabled: enabled === true });
-    }
-    if (req.method === 'POST' && req.url === '/failover/activity/read') {
-      const { thresholdBytesPerSecond = 0 } = record(await readJson(req));
-      const sourceLive = trafficMode !== 'native' || liveTrafficSnapshot().source.state === 'live';
-      return sendJson(res, 200, {
-        activity: sourceLive ? domainTraffic.activitySnapshot(thresholdBytesPerSecond) : null,
-      });
-    }
-    if (req.method === 'POST' && req.url === '/config/check') {
-      const { config } = record(await readJson(req));
-      return sendJson(res, 200, runtime.checkConfig(config));
-    }
-    if (req.method === 'POST' && req.url === '/apply') {
-      return sendJson(res, 200, await runtime.apply());
-    }
-    if (req.method === 'POST' && req.url === '/restart') {
-      return sendJson(res, 200, await runtime.restart());
-    }
-    if (req.method === 'POST' && req.url === '/stop') {
-      return sendJson(res, 200, await runtime.stop());
-    }
-    return sendJson(res, 404, { error: 'Не найдено' });
-  } catch (error) {
-    return sendJson(res, 500, { error: errorMessage(error) });
-  }
-});
-
-fs.mkdirSync(path.dirname(socketPath), { recursive: true });
-fs.rmSync(socketPath, { force: true });
-server.listen(socketPath, async () => {
-  fs.chmodSync(socketPath, 0o660);
-  try {
-    await runtime.apply();
-  } catch (error) {
-    console.warn(`[dataplane] sing-box не запущен: ${errorMessage(error)}`);
-  } finally {
-    refreshOrigins();
-    liveTraffic = createLiveTrafficService({
-      port: settings.singboxNativeApiPort,
-      enabled: nativeTrafficEnabled,
-      gateway: true,
-      isRuntimeRunning: () => runtime.running && !runtime.nativeApiWarning,
-      resolveOrigin,
-      authorization: () => runtime.nativeApiSecret,
-      onProjection: (batch) => {
-        trafficHistory.enqueue(batch);
-        nativeDomainTraffic.ingestNative(batch);
-      },
-    });
-    liveTraffic.start();
-    ready = true;
-    if (settings.deviceTrafficAccountingEnabled) {
-      setImmediate(() => {
-        refreshDeviceTraffic()
-          .catch((error: unknown) => console.warn(`[dataplane] traffic counters не запущены: ${errorMessage(error)}`));
-      });
-      trafficTimer = setInterval(() => {
-        refreshDeviceTraffic().catch((error: unknown) => console.warn(`[dataplane] traffic counters не обновлены: ${errorMessage(error)}`));
-      }, 15_000);
-      trafficTimer.unref();
-    } else {
-      trafficTimer = setInterval(refreshOrigins, 15_000);
-      trafficTimer.unref();
-    }
-    if (trafficMode !== 'native') {
-      setImmediate(() => {
-        snapshotDomainTraffic.refresh()
-          .catch((error: unknown) => console.warn(`[dataplane] domain traffic не запущен: ${errorMessage(error)}`));
-      });
-      domainTrafficTimer = setInterval(() => {
-        snapshotDomainTraffic.refresh()
-          .catch((error: unknown) => console.warn(`[dataplane] domain traffic не обновлён: ${errorMessage(error)}`));
-      }, 2_000);
-      domainTrafficTimer.unref();
-    }
-    console.log(`[dataplane] control socket: ${socketPath}`);
-  }
-});
-
-let shuttingDown = false;
-async function shutdown() {
-  if (shuttingDown) return;
-  shuttingDown = true;
-  ready = false;
-  if (trafficTimer) clearInterval(trafficTimer);
-  if (domainTrafficTimer) clearInterval(domainTrafficTimer);
-  await liveTraffic.stop();
-  await trafficHistory.close();
-  await runtime.shutdown();
-  server.close(() => {
-    fs.rmSync(socketPath, { force: true });
-    process.exit(0);
-  });
-}
-
-process.on('SIGTERM', shutdown);
-process.on('SIGINT', shutdown);

src/server/dataplaneClient.ts

@@ -1,120 +0,0 @@
-import http from 'node:http';
-import { HarborError } from '../shared/errors.js';
-import { historyQueryParams, type TrafficHistoryQuery } from '../shared/trafficHistory.js';
-
-type SendDataplaneRequest = (
-  socketPath: string,
-  pathname: string,
-  method?: string,
-  body?: unknown,
-  timeoutMs?: number,
-) => Promise<unknown>;
-
-function record(value: unknown): Record<string, unknown> {
-  return value && typeof value === 'object' ? value as Record<string, unknown> : {};
-}
-
-function request(
-  socketPath: string,
-  pathname: string,
-  method = 'GET',
-  body: unknown = null,
-  timeoutMs = 6000,
-): Promise<unknown> {
-  return new Promise((resolve, reject) => {
-    const encoded = body == null ? null : JSON.stringify(body);
-    const req = http.request({
-      socketPath,
-      path: pathname,
-      method,
-      headers: encoded ? {
-        'content-type': 'application/json',
-        'content-length': Buffer.byteLength(encoded),
-      } : {},
-    }, (res) => {
-      const chunks: Buffer[] = [];
-      res.on('data', (chunk: Buffer) => chunks.push(chunk));
-      res.on('end', () => {
-        let body: unknown = {};
-        try {
-          body = JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');
-        } catch {
-          return reject(new Error('Dataplane вернул невалидный JSON'));
-        }
-        if ((res.statusCode || 500) >= 400) {
-          return reject(new Error(String(record(body).error || `Dataplane HTTP ${res.statusCode}`)));
-        }
-        resolve(body);
-      });
-    });
-    req.on('error', reject);
-    req.setTimeout(timeoutMs, () => req.destroy(new Error(`Dataplane не ответил за ${Math.ceil(timeoutMs / 1000)} секунд`)));
-    req.end(encoded);
-  });
-}
-
-export function createDataplaneClient(socketPath: string, send: SendDataplaneRequest = request) {
-  let current: Record<string, unknown> = { running: false, startedAt: null };
-  const update = async (pathname: string, method: string) => {
-    try {
-      current = record(await send(socketPath, pathname, method));
-      return current;
-    } catch (cause) {
-      if (pathname === '/apply' || pathname === '/restart') {
-        throw new HarborError('PROCESS_START_FAILED', { cause });
-      }
-      throw cause;
-    }
-  };
-
-  return {
-    get running() { return Boolean(current.running); },
-    get startedAt() { return current.startedAt || null; },
-    refresh: () => update('/status', 'GET'),
-    observeDevices: () => send(socketPath, '/devices', 'GET'),
-    observeTraffic: () => send(socketPath, '/device-traffic', 'GET'),
-    observeDomainTraffic: () => send(socketPath, '/domain-traffic', 'GET'),
-    observeLiveTraffic: () => send(socketPath, '/traffic/live', 'GET'),
-    observeTrafficHistory: (query: TrafficHistoryQuery) => send(socketPath, `/traffic/history?${historyQueryParams(query)}`, 'GET', null, 12_000),
-    observeDevicePolicy: () => send(socketPath, '/device-policy', 'GET'),
-    applyDevicePolicies: (devices: unknown) => send(socketPath, '/device-policy', 'PUT', { devices }),
-    runConnectivityDiagnostics: async (services: unknown = [], target: unknown = null) => {
-      try {
-        return await send(socketPath, '/diagnostics/connectivity', 'POST', { services, target }, 25_000);
-      } catch (cause) {
-        throw new HarborError('DIAGNOSTICS_FAILED', { cause });
-      }
-    },
-    getDnsDiagnosticsCatalog: (customResolvers: unknown = [], customDomains: unknown = []) => (
-      send(socketPath, '/diagnostics/dns/catalog', 'POST', { customResolvers, customDomains })
-    ),
-    runDnsDiagnostics: async (
-      customResolvers: unknown = [],
-      customDomains: unknown = [],
-      domainId: unknown,
-      resolverId: unknown = null,
-    ) => {
-      try {
-        return await send(socketPath, '/diagnostics/dns', 'POST', {
-          customResolvers, customDomains, domainId, resolverId,
-        }, 40_000);
-      } catch (cause) {
-        throw new HarborError('DIAGNOSTICS_FAILED', { cause });
-      }
-    },
-    checkConfig: (config: unknown) => send(socketPath, '/config/check', 'POST', { config }, 15_000),
-    runFailoverProbe: (role: 'primary' | 'reserve', services: unknown, target: unknown, timeoutMs: number) => (
-      send(socketPath, '/failover/probe', 'POST', { role, services, target, timeoutMs }, timeoutMs + 10_000)
-    ),
-    readFailoverSelector: () => send(socketPath, '/failover/selector', 'GET'),
-    selectFailoverRole: (role: 'primary' | 'reserve') => send(socketPath, '/failover/selector', 'PUT', { role }),
-    setFailoverActivityEnabled: (enabled: boolean) => send(socketPath, '/failover/activity', 'PUT', { enabled }),
-    readFailoverActivity: (thresholdBytesPerSecond: number) => (
-      send(socketPath, '/failover/activity/read', 'POST', { thresholdBytesPerSecond })
-    ),
-    apply: () => update('/apply', 'POST'),
-    restart: () => update('/restart', 'POST'),
-    stop: () => update('/stop', 'POST'),
-    shutdown: async () => current,
-  };
-}

src/server/devices.js

@@ -0,0 +1,153 @@
+import fs from "node:fs";
+import path from "node:path";
+import { settings } from "./config.js";
+
+export const DEVICE_MODES = new Set(["direct", "vpn", "rules", "block"]);
+export const DEFAULT_DEVICE_MODES = new Set(["direct", "vpn", "block"]);
+export const DEFAULT_DEVICE_MODE = "vpn";
+export const DEFAULT_PROXY_MODE = "vpn";
+export const TPROXY_INBOUND = "tproxy-in";
+export const MIXED_INBOUND = "mixed-in";
+
+const IPISH_RE = /^[\.\d:/]+$/;
+
+function readJson(filePath, fallback) {
+  try {
+    if (!fs.existsSync(filePath)) return fallback;
+    return JSON.parse(fs.readFileSync(filePath, "utf8"));
+  } catch {
+    return fallback;
+  }
+}
+
+function writeJson(filePath, value) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify(value, null, 2), "utf8");
+}
+
+function normalizeDeviceMode(mode, fallback = "rules") {
+  const value = String(mode || "").trim().toLowerCase();
+  if (value === "bypass") return "direct";
+  return DEVICE_MODES.has(value) ? value : fallback;
+}
+
+function normalizeDefaultMode(mode) {
+  const value = String(mode || "").trim().toLowerCase();
+  return DEFAULT_DEVICE_MODES.has(value) ? value : DEFAULT_DEVICE_MODE;
+}
+
+function normalizeProxyMode(mode) {
+  const value = String(mode || "").trim().toLowerCase();
+  return DEFAULT_DEVICE_MODES.has(value) ? value : DEFAULT_PROXY_MODE;
+}
+
+function normalizeIp(ip) {
+  const value = String(ip || "").trim();
+  return value && IPISH_RE.test(value) ? value : "";
+}
+
+function normalizeMac(mac) {
+  return String(mac || "").trim();
+}
+
+function fromLegacyDeviceRules(input) {
+  const rules = Array.isArray(input) ? input : [];
+  const devices = [];
+
+  for (const rule of rules) {
+    const sourceIps = Array.isArray(rule?.sourceIps) ? rule.sourceIps : [];
+    const mode = normalizeDeviceMode(rule?.outbound, "direct");
+    sourceIps.forEach((sourceIp, ipIndex) => {
+      const ip = normalizeIp(sourceIp);
+      if (!ip) return;
+      devices.push({
+        id: String(rule.id || `dev-${devices.length}`) + `-${ipIndex}`,
+        name: String(rule.name || `Устройство ${devices.length + 1}`).trim(),
+        enabled: rule.enabled !== false,
+        ip,
+        mac: "",
+        mode,
+        lastSeen: null,
+      });
+    });
+  }
+
+  return {
+    defaultTransparentMode: DEFAULT_DEVICE_MODE,
+    proxyDefaultMode: DEFAULT_PROXY_MODE,
+    devices,
+  };
+}
+
+export function normalizeDeviceProfiles(input) {
+  const raw =
+    input && typeof input === "object" && !Array.isArray(input)
+      ? input
+      : { devices: input };
+  const rawDevices = Array.isArray(raw.devices) ? raw.devices : [];
+
+  return {
+    defaultTransparentMode: normalizeDefaultMode(
+      raw.defaultTransparentMode || raw.defaultMode,
+    ),
+    proxyDefaultMode: normalizeProxyMode(raw.proxyDefaultMode),
+    devices: rawDevices.map((device, index) => ({
+      id: String(device.id || `dev-${Date.now()}-${index}`),
+      name: String(device.name || `Устройство ${index + 1}`).trim(),
+      enabled: device.enabled !== false,
+      ip: normalizeIp(device.ip || device.sourceIp),
+      mac: normalizeMac(device.mac),
+      mode: normalizeDeviceMode(device.mode || device.outbound, "rules"),
+      lastSeen: device.lastSeen || null,
+    })),
+  };
+}
+
+export function readDeviceProfiles() {
+  if (fs.existsSync(settings.devicesPath)) {
+    return normalizeDeviceProfiles(readJson(settings.devicesPath, null));
+  }
+
+  if (fs.existsSync(settings.deviceRulesPath)) {
+    return normalizeDeviceProfiles(
+      fromLegacyDeviceRules(readJson(settings.deviceRulesPath, [])),
+    );
+  }
+
+  return {
+    defaultTransparentMode: DEFAULT_DEVICE_MODE,
+    proxyDefaultMode: DEFAULT_PROXY_MODE,
+    devices: [],
+  };
+}
+
+export function writeDeviceProfiles(value) {
+  const normalized = normalizeDeviceProfiles(value);
+  writeJson(settings.devicesPath, normalized);
+  return normalized;
+}
+
+export function normalizeCidr(ip) {
+  const value = normalizeIp(ip);
+  if (!value) return "";
+  return value.includes("/") ? value : `${value}/32`;
+}
+
+export function deviceCidrs(devices, modes) {
+  const allowedModes = new Set(Array.isArray(modes) ? modes : [modes]);
+  return (Array.isArray(devices) ? devices : [])
+    .filter((device) => device.enabled !== false && allowedModes.has(device.mode))
+    .map((device) => normalizeCidr(device.ip))
+    .filter(Boolean);
+}
+
+export function legacyDeviceRulesFromProfiles(profiles) {
+  const { devices } = normalizeDeviceProfiles(profiles);
+  return devices.map((device) => ({
+    id: device.id,
+    name: device.name,
+    enabled: device.enabled,
+    sourceIps: device.ip ? [device.ip] : [],
+    outbound: device.mode === "rules" ? "direct" : device.mode,
+  }));
+}

src/server/features/connection/connectionService.ts

@@ -1,376 +0,0 @@
-import {
-  profileById,
-  type StoredProfile,
-  type StoredState,
-} from '../../../shared/contracts/state.js';
-import { HarborError } from '../../../shared/errors.js';
-import { finishRollback, type RollbackStep } from '../../services/rollback.js';
-import type { AppliedFailoverPolicy } from '../../../shared/failover.js';
-import type { ActivityJournalEventInput } from '../../../shared/activityJournal.js';
-
-interface ConnectionServiceDependencies {
-  state: {
-    read(): StoredState;
-    update(mutator: (state: StoredState) => Record<string, unknown>): StoredState;
-  };
-  config: {
-    build(subscriptionConfig: unknown, selectedServerId: string, routeRules: StoredState['routeRules']): unknown;
-    read(): string | null;
-    write(value: unknown): void;
-    restore(value: string): void;
-    remove(): void;
-  };
-  runtime: {
-    isRunning(): Promise<boolean>;
-    start(): Promise<unknown>;
-    stop(): Promise<unknown>;
-    stopCommand(): Promise<RuntimeCommandResult>;
-    restartCommand(): Promise<RuntimeCommandResult>;
-  };
-  route?: { isGatewayDirect(): boolean };
-  failover?: {
-    build(state: StoredState, source?: 'desired' | 'applied'): {
-      config: unknown;
-      applied: AppliedFailoverPolicy;
-      primaryProfile: StoredProfile;
-      primaryServer: StoredProfile['servers'][number];
-    };
-    prepareActivation(role: 'primary' | 'reserve'): Promise<unknown>;
-    restoreAppliedActivation(state: StoredState): Promise<unknown>;
-    reconcile(): Promise<unknown>;
-  };
-  onEvent?: (event: ActivityJournalEventInput) => void;
-  serialize<T>(operation: () => Promise<T>): Promise<T>;
-  now(): Date;
-}
-
-export type RuntimeCommandResult =
-  | { ok: true; mutationStarted: true }
-  | { ok: false; mutationStarted: boolean; error: unknown };
-
-export async function captureRuntimeCommand(
-  command: () => Promise<unknown>,
-  { preMutationErrorCodes = [] }: { preMutationErrorCodes?: readonly string[] } = {},
-): Promise<RuntimeCommandResult> {
-  try {
-    await command();
-    return { ok: true, mutationStarted: true };
-  } catch (error) {
-    const code = error && typeof error === 'object' && 'code' in error ? String(error.code) : '';
-    return { ok: false, mutationStarted: !preMutationErrorCodes.includes(code), error };
-  }
-}
-
-function requireExpectedRevision(state: StoredState, expectedRevision: unknown) {
-  if (expectedRevision === undefined) return;
-  if (!Number.isSafeInteger(expectedRevision) || Number(expectedRevision) !== state.revision) {
-    throw new HarborError('STATE_CONFLICT');
-  }
-}
-
-function resolveProfile(state: StoredState, profileId: unknown): StoredProfile {
-  const requested = String(profileId || '').trim();
-  const profile = profileById(state, requested)
-    || (!requested && state.profiles.length === 1 ? state.profiles[0] : null);
-  if (!profile) throw new HarborError('PROFILE_NOT_FOUND');
-  return profile;
-}
-
-function withDesiredServer(state: StoredState, profile: StoredProfile, serverId: string) {
-  const nextProfile = { ...profile, desiredServerId: serverId };
-  return {
-    ...state,
-    profiles: state.profiles.map((candidate) => candidate.id === profile.id ? nextProfile : candidate),
-    desiredProfileId: profile.id,
-  };
-}
-
-export function createConnectionService(dependencies: ConnectionServiceDependencies) {
-  const prepareFailoverActivation = async (role: 'primary' | 'reserve') => {
-    try {
-      await dependencies.failover?.prepareActivation(role);
-    } catch (cause) {
-      throw new HarborError('PROCESS_START_FAILED', { cause });
-    }
-  };
-  const activationTarget = (
-    state: StoredState,
-    applied: AppliedFailoverPolicy,
-    role: 'primary' | 'reserve',
-  ) => {
-    const target = applied[role];
-    const profile = profileById(state, target.profileId);
-    const server = profile?.servers.find(({ id }) => id === target.serverId);
-    if (!profile || !server) throw new HarborError('SERVER_NOT_FOUND');
-    return { profile, server };
-  };
-  const finishConnectionRollback = async (error: unknown, steps: RollbackStep[], message: string) => {
-    try {
-      await finishRollback(error, steps, message);
-    } catch (cause) {
-      const code = cause && typeof cause === 'object' && 'code' in cause
-        && /^[A-Z0-9_]{1,50}$/.test(String(cause.code)) ? String(cause.code) : 'UNKNOWN';
-      dependencies.onEvent?.({
-        type: 'connection.failed',
-        severity: 'error',
-        source: 'connection',
-        dedupeKey: `connection.failed:${dependencies.state.read().revision}:${code}`,
-        data: { errorCode: code },
-      });
-      throw cause;
-    }
-  };
-  const applyWithinQueue = async (
-    previousState: StoredState,
-    profile: StoredProfile,
-    serverIdValue: unknown,
-    selectedTagValue: unknown,
-  ) => {
-    const requestedId = String(serverIdValue || '').trim();
-    const requestedTag = String(selectedTagValue || '').trim();
-    const resolvedId = requestedId || (() => {
-      const matches = profile.servers.filter((server) => server.label === requestedTag);
-      return matches.length === 1 ? matches[0].id : '';
-    })();
-    const selectedServer = profile.servers.find((server) => server.id === resolvedId);
-    if (!selectedServer) throw new HarborError('SERVER_NOT_FOUND');
-    if (!profile.subscriptionConfig) throw new HarborError('CONFIG_INVALID');
-
-    const wasRunning = await dependencies.runtime.isRunning();
-    if (wasRunning && previousState.failoverPolicy?.enabled) {
-      dependencies.state.update((state) => withDesiredServer(state, profile, selectedServer.id));
-      return { profileId: profile.id, serverId: selectedServer.id, selectedTag: selectedServer.label };
-    }
-
-    if (dependencies.route?.isGatewayDirect()) {
-      dependencies.state.update((state) => withDesiredServer(state, profile, selectedServer.id));
-      return { profileId: profile.id, serverId: selectedServer.id, selectedTag: selectedServer.label };
-    }
-
-    const failoverCandidate = previousState.failoverPolicy?.enabled
-      ? dependencies.failover?.build(previousState, wasRunning ? 'applied' : 'desired')
-      : null;
-    const nextConfig = failoverCandidate?.config || dependencies.config.build(
-      profile.subscriptionConfig,
-      selectedServer.id,
-      previousState.routeRules,
-    );
-    const previousConfig = dependencies.config.read();
-    let configMutationStarted = false;
-    let runtimeMutationStarted = false;
-    let stateCommitStarted = false;
-
-    try {
-      configMutationStarted = true;
-      dependencies.config.write(nextConfig);
-      runtimeMutationStarted = true;
-      await dependencies.runtime.start();
-      if (failoverCandidate) await prepareFailoverActivation('primary');
-      stateCommitStarted = true;
-      dependencies.state.update((state) => ({
-        ...withDesiredServer(state, profile, selectedServer.id),
-        connectionDesired: 'running',
-        appliedProfileId: failoverCandidate?.primaryProfile.id || profile.id,
-        appliedServerId: failoverCandidate?.primaryServer.id || selectedServer.id,
-        appliedServerSnapshot: failoverCandidate?.primaryServer || selectedServer,
-        appliedFailoverPolicy: failoverCandidate?.applied || null,
-        appliedAt: dependencies.now().toISOString(),
-        appliedRouteRules: state.routeRules,
-      }));
-    } catch (error) {
-      await finishConnectionRollback(error, [
-        ...(stateCommitStarted ? [{ run: () => dependencies.state.update(() => previousState) }] : []),
-        ...(configMutationStarted ? [{
-          run: () => previousConfig === null
-            ? dependencies.config.remove()
-            : dependencies.config.restore(previousConfig),
-        }] : []),
-        ...(runtimeMutationStarted ? [{
-          run: async () => {
-            if (!wasRunning) return dependencies.runtime.stop();
-            await dependencies.runtime.start();
-            await dependencies.failover?.restoreAppliedActivation(previousState);
-          },
-          runtime: true,
-        }] : []),
-      ], 'Connection rollback failed');
-    }
-
-    await dependencies.failover?.reconcile();
-    dependencies.onEvent?.({
-      type: 'connection.started',
-      severity: 'info',
-      source: 'connection',
-      dedupeKey: `connection.started:${dependencies.state.read().revision}`,
-      data: {
-        profileLabel: failoverCandidate?.primaryProfile.label || profile.label,
-        serverLabel: failoverCandidate?.primaryServer.label || selectedServer.label,
-      },
-    });
-
-    return { profileId: profile.id, serverId: selectedServer.id, selectedTag: selectedServer.label };
-  };
-
-  const apply = (
-    profileId: unknown,
-    serverId: unknown,
-    selectedTag: unknown = '',
-    expectedRevision?: unknown,
-  ) => dependencies.serialize(async () => {
-    const state = dependencies.state.read();
-    requireExpectedRevision(state, expectedRevision);
-    return applyWithinQueue(state, resolveProfile(state, profileId), serverId, selectedTag);
-  });
-
-  const activate = (profileId: unknown, expectedRevision?: unknown) => (
-    dependencies.serialize(async () => {
-      const state = dependencies.state.read();
-      requireExpectedRevision(state, expectedRevision);
-      const profile = resolveProfile(state, profileId);
-      const selectedServer = profile.servers.find((server) => server.id === profile.desiredServerId);
-      if (!selectedServer) throw new HarborError('SERVER_NOT_FOUND');
-      const running = await dependencies.runtime.isRunning();
-      if (!running || dependencies.route?.isGatewayDirect()) {
-        if (state.desiredProfileId !== profile.id) {
-          dependencies.state.update((current) => ({ ...current, desiredProfileId: profile.id }));
-        }
-        return { profileId: profile.id, serverId: selectedServer.id, selectedTag: selectedServer.label };
-      }
-      return applyWithinQueue(state, profile, selectedServer.id, '');
-    })
-  );
-
-  const stop = () => dependencies.serialize(async () => {
-    const previousState = dependencies.state.read();
-    let wasRunning: boolean | null = null;
-    try {
-      wasRunning = await dependencies.runtime.isRunning();
-    } catch {}
-    let runtimeMutationStarted = false;
-    let stateCommitStarted = false;
-
-    try {
-      const command = await dependencies.runtime.stopCommand();
-      runtimeMutationStarted = command.mutationStarted;
-      if (!command.ok) throw command.error;
-      stateCommitStarted = true;
-      dependencies.state.update((state) => ({
-        ...state,
-        connectionDesired: 'stopped',
-        appliedProfileId: '',
-        appliedServerId: '',
-        appliedServerSnapshot: null,
-        appliedFailoverPolicy: null,
-      }));
-    } catch (error) {
-      await finishConnectionRollback(error, [
-        ...(runtimeMutationStarted && wasRunning !== null ? [{
-          run: async () => {
-            if (!wasRunning) return dependencies.runtime.stop();
-            await dependencies.runtime.start();
-            await dependencies.failover?.restoreAppliedActivation(previousState);
-          },
-          runtime: true,
-        }] : []),
-        ...(stateCommitStarted ? [{ run: () => dependencies.state.update(() => previousState) }] : []),
-      ], 'Connection rollback failed');
-    }
-    await dependencies.failover?.reconcile();
-    dependencies.onEvent?.({
-      type: 'connection.stopped',
-      severity: 'info',
-      source: 'connection',
-      dedupeKey: `connection.stopped:${dependencies.state.read().revision}`,
-      data: {},
-    });
-  });
-
-  const restart = () => dependencies.serialize(async () => {
-    const previousState = dependencies.state.read();
-    const wasRunning = await dependencies.runtime.isRunning();
-    const targetProfileId = wasRunning
-      ? previousState.appliedProfileId
-      : previousState.desiredProfileId;
-    const targetServerId = wasRunning
-      ? previousState.appliedServerId
-      : resolveProfile(previousState, targetProfileId).desiredServerId;
-    const profile = resolveProfile(previousState, targetProfileId);
-    const server = profile.servers.find((candidate) => candidate.id === targetServerId)
-      || (previousState.appliedServerSnapshot?.id === targetServerId
-        ? previousState.appliedServerSnapshot
-        : null);
-    if (!server || !profile.subscriptionConfig) throw new HarborError('CONFIG_INVALID');
-    const failoverCandidate = previousState.failoverPolicy?.enabled
-      ? dependencies.failover?.build(previousState, wasRunning ? 'applied' : 'desired')
-      : null;
-    const activationRole = failoverCandidate && wasRunning
-      && previousState.appliedProfileId === failoverCandidate.applied.reserve.profileId
-      && previousState.appliedServerId === failoverCandidate.applied.reserve.serverId
-      ? 'reserve' as const
-      : 'primary' as const;
-    const failoverTarget = failoverCandidate
-      ? activationTarget(previousState, failoverCandidate.applied, activationRole)
-      : null;
-    const candidateConfig = failoverCandidate?.config || dependencies.config.build(
-      profile.subscriptionConfig,
-      server.id,
-      previousState.routeRules,
-    );
-    const previousConfig = dependencies.config.read();
-    let configMutationStarted = false;
-    let runtimeMutationStarted = false;
-    let stateCommitStarted = false;
-
-    try {
-      configMutationStarted = true;
-      dependencies.config.write(candidateConfig);
-      const command = await dependencies.runtime.restartCommand();
-      runtimeMutationStarted = command.mutationStarted;
-      if (!command.ok) throw command.error;
-      if (failoverCandidate) await prepareFailoverActivation(activationRole);
-      stateCommitStarted = true;
-      dependencies.state.update((state) => ({
-        ...state,
-        desiredProfileId: wasRunning ? state.desiredProfileId : profile.id,
-        appliedProfileId: failoverTarget?.profile.id || profile.id,
-        appliedServerId: failoverTarget?.server.id || server.id,
-        appliedServerSnapshot: failoverTarget?.server || server,
-        appliedFailoverPolicy: failoverCandidate?.applied || null,
-        connectionDesired: 'running',
-        appliedRouteRules: dependencies.route?.isGatewayDirect() ? [] : state.routeRules,
-      }));
-    } catch (error) {
-      await finishConnectionRollback(error, [
-        ...(configMutationStarted ? [{
-          run: () => previousConfig === null
-            ? dependencies.config.remove()
-            : dependencies.config.restore(previousConfig),
-        }] : []),
-        ...(runtimeMutationStarted ? [{
-          run: async () => {
-            if (!wasRunning) return dependencies.runtime.stop();
-            await dependencies.runtime.start();
-            await dependencies.failover?.restoreAppliedActivation(previousState);
-          },
-          runtime: true,
-        }] : []),
-        ...(stateCommitStarted ? [{ run: () => dependencies.state.update(() => previousState) }] : []),
-      ], 'Connection rollback failed');
-    }
-    await dependencies.failover?.reconcile();
-    dependencies.onEvent?.({
-      type: 'connection.started',
-      severity: 'info',
-      source: 'connection',
-      dedupeKey: `connection.started:${dependencies.state.read().revision}`,
-      data: {
-        profileLabel: failoverTarget?.profile.label || profile.label,
-        serverLabel: failoverTarget?.server.label || server.label,
-      },
-    });
-  });
-
-  return { apply, activate, stop, restart };
-}
-
-export type ConnectionService = ReturnType<typeof createConnectionService>;

src/server/features/connection/index.ts

@@ -1,6 +0,0 @@
-export {
-  captureRuntimeCommand,
-  createConnectionService,
-  type RuntimeCommandResult,
-  type ConnectionService,
-} from './connectionService.js';

src/server/features/diagnostics/connectivityDiagnosticsUseCase.ts

@@ -1,116 +0,0 @@
-import { isDeepStrictEqual } from 'node:util';
-
-import {
-  normalizeDiagnosticSettings,
-  type DiagnosticSettings,
-} from '../../../shared/connectivityDiagnostics.js';
-import type { HarborServer, StoredProfile, StoredState } from '../../../shared/contracts/state.js';
-import { HarborError } from '../../../shared/errors.js';
-
-interface DiagnosticState {
-  desiredProfileId?: unknown;
-  appliedProfileId?: unknown;
-  appliedServerId?: unknown;
-  appliedServerSnapshot?: HarborServer | null;
-  profiles?: StoredProfile[];
-  revision?: number;
-  diagnostics?: DiagnosticSettings;
-}
-
-interface DiagnosticsResult extends Record<string, unknown> {
-  vpn?: Record<string, unknown>;
-}
-
-interface ConnectivityDiagnosticsDependencies {
-  state: {
-    read(): DiagnosticState;
-    update(mutator: (state: StoredState) => Record<string, unknown>): StoredState;
-  };
-  runDiagnostics(services: unknown, target: unknown): Promise<unknown>;
-  dnsCatalog(customResolvers: unknown, customDomains: unknown): Promise<unknown>;
-  runDnsDiagnostics(
-    customResolvers: unknown,
-    customDomains: unknown,
-    domainId: unknown,
-    resolverId: unknown,
-  ): Promise<unknown>;
-}
-
-function diagnosticsResult(value: unknown): DiagnosticsResult {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
-    throw new TypeError('Diagnostics adapter returned an invalid result');
-  }
-  return value as DiagnosticsResult;
-}
-
-function selectedServer(state: DiagnosticState) {
-  const profiles = Array.isArray(state.profiles) ? state.profiles : [];
-  const appliedProfile = profiles.find((profile) => profile.id === state.appliedProfileId);
-  const applied = appliedProfile?.servers.find((server) => server.id === state.appliedServerId)
-    || (state.appliedServerSnapshot?.id === state.appliedServerId
-      ? state.appliedServerSnapshot
-      : null);
-  if (state.appliedServerId) return applied;
-  const desiredProfile = profiles.find((profile) => profile.id === state.desiredProfileId);
-  return desiredProfile?.servers.find((server) => server.id === desiredProfile.desiredServerId) || null;
-}
-
-export function createConnectivityDiagnosticsUseCase(
-  dependencies: ConnectivityDiagnosticsDependencies,
-) {
-  return {
-    async run(target: unknown) {
-      const state = dependencies.state.read();
-      const selected = selectedServer(state);
-      const server = selected ? { id: selected.id, label: selected.label } : null;
-      const services = normalizeDiagnosticSettings(state.diagnostics).customServices;
-      const result = diagnosticsResult(await dependencies.runDiagnostics(services, target));
-      return {
-        ...result,
-        vpn: {
-          ...result.vpn,
-          server,
-        },
-      };
-    },
-    async dnsCatalog() {
-      const settings = normalizeDiagnosticSettings(dependencies.state.read().diagnostics);
-      return dependencies.dnsCatalog(settings.customDnsResolvers, settings.customDnsDomains);
-    },
-    async runDns(domainId: unknown, resolverId: unknown) {
-      const settings = normalizeDiagnosticSettings(dependencies.state.read().diagnostics);
-      return dependencies.runDnsDiagnostics(
-        settings.customDnsResolvers,
-        settings.customDnsDomains,
-        domainId,
-        resolverId,
-      );
-    },
-    updateSettings(settings: unknown, expectedRevision: unknown) {
-      if (!Number.isSafeInteger(expectedRevision) || Number(expectedRevision) < 0) {
-        throw new HarborError('REQUEST_INVALID');
-      }
-      const current = dependencies.state.read();
-      if (current.revision !== expectedRevision) throw new HarborError('STATE_CONFLICT');
-      let diagnostics: DiagnosticSettings;
-      try {
-        const requested = settings && typeof settings === 'object' && !Array.isArray(settings)
-          ? settings as Record<string, unknown>
-          : {};
-        diagnostics = normalizeDiagnosticSettings({
-          ...normalizeDiagnosticSettings(current.diagnostics),
-          ...requested,
-          configured: true,
-        }, { strict: true });
-      } catch (cause) {
-        throw new HarborError('REQUEST_INVALID', { cause });
-      }
-      if (isDeepStrictEqual(current.diagnostics, diagnostics)) return;
-      dependencies.state.update((state) => ({ ...state, diagnostics }));
-    },
-  };
-}
-
-export type ConnectivityDiagnosticsUseCase = ReturnType<
-  typeof createConnectivityDiagnosticsUseCase
->;

src/server/features/diagnostics/index.ts

@@ -1,4 +0,0 @@
-export {
-  createConnectivityDiagnosticsUseCase,
-  type ConnectivityDiagnosticsUseCase,
-} from './connectivityDiagnosticsUseCase.js';

src/server/features/failover/failoverService.ts

@@ -1,728 +0,0 @@
-import crypto from 'node:crypto';
-import {
-  createIdleFailoverSnapshot,
-  isFailoverConfigured,
-  nextFailoverDecision,
-  normalizeFailoverPolicy,
-  type AppliedFailoverPolicy,
-  type FailoverDecisionMemory,
-  type FailoverHealth,
-  type FailoverPolicy,
-  type FailoverRole,
-  type FailoverSnapshot,
-} from '../../../shared/failover.js';
-import type { HarborServer, StoredState } from '../../../shared/contracts/state.js';
-import type { ActivityJournalEventInput } from '../../../shared/activityJournal.js';
-import { HarborError } from '../../../shared/errors.js';
-
-interface Candidate {
-  config: unknown;
-  applied: AppliedFailoverPolicy;
-}
-
-interface FailoverServiceDependencies {
-  state: {
-    read(): StoredState;
-    update(mutator: (state: StoredState) => Record<string, unknown>): StoredState;
-  };
-  runtime: { isRunning(): Promise<boolean> };
-  dataplane: {
-    checkConfig(config: unknown): Promise<unknown>;
-    runFailoverProbe(role: FailoverRole, services: unknown, target: string, timeoutMs: number): Promise<unknown>;
-    readFailoverSelector(): Promise<unknown>;
-    selectFailoverRole(role: FailoverRole): Promise<unknown>;
-    setFailoverActivityEnabled(enabled: boolean): Promise<unknown>;
-    readFailoverActivity(thresholdBytesPerSecond: number): Promise<unknown>;
-  };
-  buildCandidate(state: StoredState): Candidate;
-  serialize<T>(operation: () => Promise<T>): Promise<T>;
-  scheduler?: {
-    setTimeout(callback: () => void, intervalMs: number): NodeJS.Timeout;
-    clearTimeout(timer: NodeJS.Timeout): void;
-  };
-  now?: () => Date;
-  onWarning?: (error: unknown) => void;
-  onSwitch?: (from: FailoverRole, to: FailoverRole, reason: string) => void;
-  onEvent?: (event: ActivityJournalEventInput) => void;
-}
-
-const record = (value: unknown): Record<string, unknown> => (
-  value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}
-);
-
-function targetServer(state: StoredState, role: FailoverRole): HarborServer | null {
-  const target = state.appliedFailoverPolicy?.[role] || state.failoverPolicy[role];
-  return state.profiles.find(({ id }) => id === target.profileId)
-    ?.servers.find(({ id }) => id === target.serverId) || null;
-}
-
-function currentRole(state: StoredState): FailoverRole | null {
-  const applied = state.appliedFailoverPolicy;
-  if (!applied) return null;
-  for (const role of ['primary', 'reserve'] as const) {
-    if (
-      state.appliedProfileId === applied[role].profileId
-      && state.appliedServerId === applied[role].serverId
-    ) return role;
-  }
-  return null;
-}
-
-function probeHealth(value: unknown): boolean {
-  const vpn = record(record(value).vpn);
-  const sites = Array.isArray(vpn.sites) ? vpn.sites.map(record) : [];
-  return sites.length === 1 && sites[0].status === 'available';
-}
-
-function safeErrorCode(error: unknown) {
-  const code = error && typeof error === 'object' && 'code' in error ? String(error.code) : '';
-  return /^[A-Z0-9_]{1,50}$/.test(code) ? code : 'UNKNOWN';
-}
-
-export function createFailoverService(dependencies: FailoverServiceDependencies) {
-  const scheduler = dependencies.scheduler || {
-    setTimeout: (callback: () => void, intervalMs: number) => setTimeout(callback, intervalMs),
-    clearTimeout: (timer: NodeJS.Timeout) => clearTimeout(timer),
-  };
-  const now = dependencies.now || (() => new Date());
-  const epoch = crypto.randomUUID();
-  let sequence = 0;
-  let generation = 0;
-  let timer: NodeJS.Timeout | null = null;
-  let collectorEnabled: boolean | null = null;
-  let roundPromise: Promise<void> | null = null;
-  let roundGeneration: number | null = null;
-  let decisionMemory: FailoverDecisionMemory | undefined;
-  const healthMemory: Record<FailoverRole, 'healthy' | 'unhealthy' | undefined> = {
-    primary: undefined,
-    reserve: undefined,
-  };
-  function clearHealthMemory() {
-    healthMemory.primary = undefined;
-    healthMemory.reserve = undefined;
-  }
-  function recordHealthTransition(
-    role: FailoverRole,
-    health: FailoverHealth,
-    capturedGeneration?: number,
-  ) {
-    if (capturedGeneration !== undefined && capturedGeneration !== generation) return;
-    if (health !== 'healthy' && health !== 'unhealthy') return;
-    const previous = healthMemory[role];
-    healthMemory[role] = health;
-    if (previous === health) return;
-    if (previous === undefined && health === 'healthy') return;
-    const type = health === 'unhealthy'
-      ? role === 'primary' ? 'failover.primary_unavailable' : 'failover.reserve_unavailable'
-      : role === 'primary' ? 'failover.primary_recovered' : 'failover.reserve_recovered';
-    dependencies.onEvent?.({
-      type,
-      severity: health === 'unhealthy' ? 'warning' : 'info',
-      source: 'failover',
-      dedupeKey: null,
-      data: {
-        role,
-        reason: health === 'unhealthy' ? 'probe-failed' : 'probe-recovered',
-      },
-    });
-  }
-
-  let snapshot = createIdleFailoverSnapshot(dependencies.state.read().failoverPolicy, epoch, sequence);
-
-  function appliedMatchesDesired(state: StoredState) {
-    if (!state.appliedFailoverPolicy) return false;
-    try {
-      return JSON.stringify(dependencies.buildCandidate(state).applied)
-        === JSON.stringify(state.appliedFailoverPolicy);
-    } catch {
-      return false;
-    }
-  }
-
-  function publish(next: FailoverSnapshot) {
-    sequence += 1;
-    snapshot = { ...next, observationEpoch: epoch, observationSequence: sequence };
-  }
-
-  function clearTimer() {
-    if (timer) scheduler.clearTimeout(timer);
-    timer = null;
-  }
-
-  function schedule(delay: number) {
-    clearTimer();
-    timer = scheduler.setTimeout(() => {
-      timer = null;
-      void runRound().catch(dependencies.onWarning);
-    }, delay);
-    timer.unref?.();
-  }
-
-  async function disableCollector() {
-    if (collectorEnabled === false) return;
-    await dependencies.dataplane.setFailoverActivityEnabled(false);
-    collectorEnabled = false;
-  }
-
-  async function deactivate(policy: FailoverPolicy, passiveRole: FailoverRole | null = null) {
-    generation += 1;
-    clearTimer();
-    decisionMemory = undefined;
-    clearHealthMemory();
-    await disableCollector();
-    const idle = createIdleFailoverSnapshot(policy, epoch, sequence);
-    if (passiveRole) {
-      idle.activation = 'passive-loaded';
-      idle.currentRole = passiveRole;
-      idle.reason = 'disabled';
-    }
-    publish(idle);
-  }
-
-  function activeSnapshot(state: StoredState, status: FailoverSnapshot['status'] = 'observing'): FailoverSnapshot {
-    const role = state.failoverRuntimeState.reasonCode === 'selector-unknown' ? null : currentRole(state);
-    const channel = (target: typeof state.failoverPolicy.primary) => ({
-      target,
-      health: 'unknown' as FailoverHealth,
-      failingServiceIds: [],
-      checkedAt: null,
-      stateSince: null,
-    });
-    return {
-      observationEpoch: epoch,
-      observationSequence: sequence,
-      configured: isFailoverConfigured(state.failoverPolicy),
-      enabled: state.failoverPolicy.enabled,
-      paused: state.failoverPolicy.paused,
-      activation: appliedMatchesDesired(state) ? 'active' : 'pending',
-      currentRole: role || 'other',
-      status,
-      primary: channel(state.appliedFailoverPolicy?.primary || state.failoverPolicy.primary),
-      reserve: channel(state.appliedFailoverPolicy?.reserve || state.failoverPolicy.reserve),
-      nextDecisionAt: null,
-      reason: null,
-      trafficActivity: null,
-      policy: state.failoverPolicy,
-    };
-  }
-
-  async function reconcile() {
-    let state = dependencies.state.read();
-    const policy = state.failoverPolicy;
-    if (!policy.enabled) {
-      const role = currentRole(state);
-      const passiveRole = role && await dependencies.runtime.isRunning() ? role : null;
-      return deactivate(policy, passiveRole);
-    }
-    const running = await dependencies.runtime.isRunning();
-    if (!running || !state.appliedFailoverPolicy || !currentRole(state)) {
-      generation += 1;
-      clearHealthMemory();
-      clearTimer();
-      await disableCollector();
-      const pending = activeSnapshot(state, 'idle');
-      pending.activation = running ? 'pending' : 'inactive';
-      pending.reason = running ? 'pending-activation' : 'vpn-stopped';
-      publish(pending);
-      return;
-    }
-    const role = currentRole(state)!;
-    const selected = record(await dependencies.dataplane.readFailoverSelector());
-    if (selected.role !== role) await dependencies.dataplane.selectFailoverRole(role);
-    if (state.failoverRuntimeState.reasonCode === 'selector-unknown') {
-      state = dependencies.state.update((current) => ({
-        ...current,
-        failoverRuntimeState: { ...current.failoverRuntimeState, reasonCode: null },
-      }));
-    }
-    if (collectorEnabled !== true) {
-      await dependencies.dataplane.setFailoverActivityEnabled(true);
-      collectorEnabled = true;
-    }
-    generation += 1;
-    const active = activeSnapshot(state);
-    if (active.activation === 'pending') active.reason = 'pending-activation';
-    publish(active);
-    schedule(0);
-  }
-
-  async function reconcileAfterCommit() {
-    try {
-      await reconcile();
-    } catch (error) {
-      dependencies.onWarning?.(error);
-      const failed = activeSnapshot(dependencies.state.read(), 'error');
-      failed.reason = 'reconcile-failed';
-      publish(failed);
-    }
-  }
-
-  async function assessRole(role: FailoverRole, policy: FailoverPolicy) {
-    const custom = dependencies.state.read().diagnostics.customServices;
-    const results = await Promise.all(policy.checks.map(async (check) => {
-      try {
-        return {
-          id: check.serviceId,
-          ok: probeHealth(await dependencies.dataplane.runFailoverProbe(
-            role,
-            custom,
-            `site:${check.serviceId}`,
-            check.timeoutMs,
-          )),
-        };
-      } catch {
-        return { id: check.serviceId, ok: null };
-      }
-    }));
-    return {
-      health: results.some(({ ok }) => ok === null)
-        ? 'unknown' as const
-        : results.every(({ ok }) => ok) ? 'healthy' as const : 'unhealthy' as const,
-      failingServiceIds: results.filter(({ ok }) => ok === false).map(({ id }) => id),
-    };
-  }
-
-  async function switchWithinQueue(role: FailoverRole, reason: string) {
-      const before = dependencies.state.read();
-      const from = currentRole(before);
-      if (!from || from === role) return;
-      try {
-        await dependencies.dataplane.selectFailoverRole(role);
-        const server = targetServer(before, role);
-        if (!server) throw new HarborError('SERVER_NOT_FOUND');
-        const target = before.appliedFailoverPolicy![role];
-        const switchedAt = now().toISOString();
-        const cutoff = now().getTime() - before.failoverPolicy.flapProtection.windowMs;
-        const history = role === 'reserve'
-          ? [...before.failoverRuntimeState.failoverHistory.filter((value) => Date.parse(value) >= cutoff), switchedAt]
-          : before.failoverRuntimeState.failoverHistory.filter((value) => Date.parse(value) >= cutoff);
-        const quarantine = history.length >= before.failoverPolicy.flapProtection.count
-          ? new Date(now().getTime() + before.failoverPolicy.flapProtection.quarantineMs).toISOString()
-          : before.failoverRuntimeState.primaryQuarantineUntil;
-        dependencies.state.update((state) => ({
-          ...state,
-          appliedProfileId: target.profileId,
-          appliedServerId: target.serverId,
-          appliedServerSnapshot: server,
-          failoverPolicy: reason === 'manual'
-            ? state.failoverPolicy
-            : role === 'primary' ? { ...state.failoverPolicy, paused: false } : state.failoverPolicy,
-          failoverRuntimeState: {
-            ...state.failoverRuntimeState,
-            lastSwitchAt: switchedAt,
-            holdUntil: role === 'reserve'
-              ? new Date(now().getTime() + state.failoverPolicy.minimumReserveMs).toISOString()
-              : null,
-            primaryQuarantineUntil: quarantine,
-            failoverHistory: history,
-            reasonCode: reason,
-          },
-        }));
-      } catch (error) {
-        try {
-          await dependencies.dataplane.selectFailoverRole(from);
-        } catch (rollback) {
-          generation += 1;
-          clearTimer();
-          decisionMemory = undefined;
-          dependencies.state.update((state) => ({
-            ...state,
-            failoverPolicy: { ...state.failoverPolicy, paused: true },
-            failoverRuntimeState: { ...state.failoverRuntimeState, reasonCode: 'selector-unknown' },
-          }));
-          const failed = activeSnapshot(dependencies.state.read(), 'error');
-          failed.reason = 'selector-unknown';
-          publish(failed);
-          throw new AggregateError([error, rollback], 'Failover selector rollback failed');
-        }
-        throw error;
-      }
-      dependencies.onSwitch?.(from, role, reason);
-      dependencies.onEvent?.({
-        type: 'failover.switched',
-        severity: 'info',
-        source: 'failover',
-        dedupeKey: `failover.switched:${dependencies.state.read().revision}`,
-        data: {
-          fromRole: from,
-          toRole: role,
-          primaryLabel: targetServer(dependencies.state.read(), 'primary')?.label || 'Primary',
-          reserveLabel: targetServer(dependencies.state.read(), 'reserve')?.label || 'Reserve',
-          reason,
-          manual: reason === 'manual',
-        },
-      });
-  }
-
-  async function performRound(capturedGeneration: number) {
-    const prepared = await dependencies.serialize(async () => {
-      const state = dependencies.state.read();
-      const role = currentRole(state);
-      if (
-        capturedGeneration !== generation
-        || !state.failoverPolicy.enabled
-        || !state.appliedFailoverPolicy
-        || !role
-      ) return null;
-      const selected = record(await dependencies.dataplane.readFailoverSelector());
-      if (selected.role !== role) await dependencies.dataplane.selectFailoverRole(role);
-      await dependencies.dataplane.setFailoverActivityEnabled(true);
-      collectorEnabled = true;
-      const latest = dependencies.state.read();
-      return capturedGeneration === generation
-        && latest.failoverPolicy.enabled
-        && currentRole(latest) === role
-        ? { state: latest, policy: latest.failoverPolicy, role }
-        : null;
-    });
-    if (!prepared) return;
-    const { state, policy, role } = prepared;
-    const checkedAt = now().toISOString();
-    const previousSnapshot = snapshot;
-    publish({ ...snapshot, reason: 'checking-channels' });
-    let primary;
-    let reserve;
-    try {
-      [primary, reserve] = await Promise.all([
-        assessRole('primary', policy),
-        assessRole('reserve', policy),
-      ]);
-    } catch {
-      primary = { health: 'unknown' as const, failingServiceIds: [] };
-      reserve = { health: 'unknown' as const, failingServiceIds: [] };
-    }
-    if (capturedGeneration !== generation || !dependencies.state.read().failoverPolicy.enabled) return;
-    recordHealthTransition('primary', primary.health, capturedGeneration);
-    recordHealthTransition('reserve', reserve.health, capturedGeneration);
-    const activityResponse = record(await dependencies.dataplane.readFailoverActivity(
-      policy.trafficGuard.thresholdBytesPerSecond,
-    ));
-    if (capturedGeneration !== generation || !dependencies.state.read().failoverPolicy.enabled) return;
-    const activity = record(activityResponse.activity);
-    const observedAt = typeof activity.observedAt === 'string' ? Date.parse(activity.observedAt) : NaN;
-    const activityState = Number.isFinite(observedAt) && now().getTime() - observedAt <= 4_000
-      && (activity.state === 'active' || activity.state === 'quiet')
-      ? activity.state
-      : 'unknown';
-    const decision = nextFailoverDecision({
-      now: now().getTime(),
-      policy,
-      currentRole: role,
-      primaryHealth: primary.health,
-      reserveHealth: reserve.health,
-      activity: activityState,
-      holdUntil: Date.parse(state.failoverRuntimeState.holdUntil || '') || null,
-      primaryQuarantineUntil: Date.parse(state.failoverRuntimeState.primaryQuarantineUntil || '') || null,
-      memory: decisionMemory,
-    });
-    decisionMemory = decision.memory;
-    const next = activeSnapshot(state, decision.status);
-    next.currentRole = role;
-    next.primary = {
-      ...next.primary,
-      ...primary,
-      checkedAt,
-      stateSince: previousSnapshot.primary.health === primary.health
-        ? previousSnapshot.primary.stateSince || checkedAt
-        : checkedAt,
-    };
-    next.reserve = {
-      ...next.reserve,
-      ...reserve,
-      checkedAt,
-      stateSince: previousSnapshot.reserve.health === reserve.health
-        ? previousSnapshot.reserve.stateSince || checkedAt
-        : checkedAt,
-    };
-    next.reason = decision.reason;
-    next.nextDecisionAt = decision.nextDecisionAt ? new Date(decision.nextDecisionAt).toISOString() : null;
-    next.trafficActivity = activityState === 'unknown' ? {
-      state: 'unknown',
-      observedAt: Number.isFinite(observedAt) ? new Date(observedAt).toISOString() : checkedAt,
-      windowMs: 10_000,
-      thresholdBytesPerSecond: policy.trafficGuard.thresholdBytesPerSecond,
-      totalBytesPerSecond: 0,
-      transmittingConnections: 0,
-      quietSince: null,
-      switchTarget: decision.switchTo,
-      blockers: [],
-    } : {
-      state: activityState,
-      observedAt: String(activity.observedAt),
-      windowMs: Number(activity.windowMs) || 10_000,
-      thresholdBytesPerSecond: policy.trafficGuard.thresholdBytesPerSecond,
-      totalBytesPerSecond: Number(activity.totalBytesPerSecond) || 0,
-      transmittingConnections: Number(activity.transmittingConnections) || 0,
-      quietSince: typeof activity.quietSince === 'string' ? activity.quietSince : null,
-      switchTarget: decision.switchTo,
-      blockers: (Array.isArray(activity.blockers) ? activity.blockers : []).slice(0, 3) as FailoverSnapshot['trafficActivity'] extends infer T ? T extends { blockers: infer B } ? B : never : never,
-    };
-    publish(next);
-    if (decision.status === 'waiting-for-idle' && previousSnapshot.status !== 'waiting-for-idle') {
-      dependencies.onEvent?.({
-        type: 'failover.waiting_for_idle',
-        severity: 'info',
-        source: 'failover',
-        dedupeKey: `failover.waiting_for_idle:${state.revision}:${role}:${decision.reason}`,
-        data: { fromRole: role, toRole: decision.switchTo || (role === 'primary' ? 'reserve' : 'primary'), reason: decision.reason },
-      });
-    }
-    if (decision.reason === 'both-unhealthy' && previousSnapshot.reason !== 'both-unhealthy') {
-      dependencies.onEvent?.({
-        type: 'failover.both_unhealthy',
-        severity: 'warning',
-        source: 'failover',
-        dedupeKey: `failover.both_unhealthy:${state.revision}`,
-        data: { reason: decision.reason },
-      });
-    }
-    if (decision.switchTo) {
-      try {
-        const switched = await dependencies.serialize(async () => {
-          const current = dependencies.state.read();
-          if (
-            capturedGeneration !== generation
-            || !current.failoverPolicy.enabled
-            || current.failoverPolicy.paused
-            || currentRole(current) !== role
-            || !current.appliedFailoverPolicy
-          ) return false;
-          let freshPrimary;
-          let freshReserve;
-          try {
-            [freshPrimary, freshReserve] = await Promise.all([
-              assessRole('primary', current.failoverPolicy),
-              assessRole('reserve', current.failoverPolicy),
-            ]);
-          } catch {
-            return false;
-          }
-          const healthStillAllowsSwitch = decision.switchTo === 'reserve'
-            ? freshPrimary.health === 'unhealthy' && freshReserve.health === 'healthy'
-            : freshPrimary.health === 'healthy';
-          if (!healthStillAllowsSwitch || capturedGeneration !== generation) return false;
-          if (current.failoverPolicy.trafficGuard.enabled) {
-            const freshResponse = record(await dependencies.dataplane.readFailoverActivity(
-              current.failoverPolicy.trafficGuard.thresholdBytesPerSecond,
-            ));
-            const freshActivity = record(freshResponse.activity);
-            const freshObservedAt = typeof freshActivity.observedAt === 'string'
-              ? Date.parse(freshActivity.observedAt)
-              : NaN;
-            const freshQuietSince = typeof freshActivity.quietSince === 'string'
-              ? Date.parse(freshActivity.quietSince)
-              : NaN;
-            if (
-              capturedGeneration !== generation
-              || freshActivity.state !== 'quiet'
-              || !Number.isFinite(freshObservedAt)
-              || now().getTime() - freshObservedAt > 4_000
-              || !Number.isFinite(freshQuietSince)
-              || now().getTime() - freshQuietSince < current.failoverPolicy.trafficGuard.quietWindowMs
-            ) return false;
-          }
-          await switchWithinQueue(decision.switchTo!, decision.reason);
-          return true;
-        });
-        if (!switched) {
-          const cancelled = activeSnapshot(dependencies.state.read(), 'observing');
-          cancelled.reason = 'revalidation-required';
-          publish(cancelled);
-          decisionMemory = undefined;
-          return;
-        }
-      } catch (error) {
-        const failed = activeSnapshot(dependencies.state.read(), 'error');
-        failed.reason = dependencies.state.read().failoverRuntimeState.reasonCode === 'selector-unknown'
-          ? 'selector-unknown'
-          : 'switch-failed';
-        publish(failed);
-        dependencies.onEvent?.({
-          type: 'failover.switch_failed',
-          severity: 'error',
-          source: 'failover',
-          dedupeKey: `failover.switch_failed:${state.revision}:${role}:${decision.switchTo}`,
-          data: { fromRole: role, toRole: decision.switchTo, reason: decision.reason, errorCode: safeErrorCode(error) },
-        });
-        throw error;
-      }
-      if (capturedGeneration !== generation) return;
-      publish(activeSnapshot(dependencies.state.read(), decision.switchTo === 'reserve' ? 'reserve' : 'primary'));
-      decisionMemory = undefined;
-    }
-  }
-
-  async function runRound(): Promise<void> {
-    if (roundPromise) {
-      const pending = roundPromise;
-      if (roundGeneration === generation) return pending;
-      try {
-        await pending;
-      } catch {
-        // The original caller owns the stale round error; continue with current-generation work.
-      }
-      if (roundPromise && roundPromise !== pending) return roundPromise;
-      return runRound();
-    }
-    const capturedGeneration = generation;
-    let trackedPromise: Promise<void>;
-    trackedPromise = performRound(capturedGeneration).finally(() => {
-      if (roundPromise === trackedPromise) {
-        roundPromise = null;
-        roundGeneration = null;
-      }
-      if (capturedGeneration === generation && snapshot.reason === 'checking-channels') {
-        const failed = activeSnapshot(dependencies.state.read(), 'error');
-        failed.reason = 'health-unknown';
-        publish(failed);
-      }
-      const policy = dependencies.state.read().failoverPolicy;
-      if (capturedGeneration === generation && policy.enabled && dependencies.state.read().appliedFailoverPolicy) {
-        const decisionAt = snapshot.nextDecisionAt ? Date.parse(snapshot.nextDecisionAt) : NaN;
-        const decisionDelay = Number.isFinite(decisionAt)
-          ? Math.max(250, decisionAt - now().getTime())
-          : policy.intervalMs;
-        schedule(Math.min(policy.intervalMs, decisionDelay));
-      }
-    });
-    roundPromise = trackedPromise;
-    roundGeneration = capturedGeneration;
-    return trackedPromise;
-  }
-
-  function save(value: unknown) {
-    return dependencies.serialize(async () => {
-    let policy: FailoverPolicy;
-    try {
-      policy = normalizeFailoverPolicy(value, { strict: true });
-    } catch (cause) {
-      throw new HarborError('REQUEST_INVALID', { cause });
-    }
-    if (policy.enabled && !isFailoverConfigured(policy)) throw new HarborError('REQUEST_INVALID');
-    const before = dependencies.state.read();
-    const candidateState = { ...before, failoverPolicy: policy };
-    if (policy.enabled) {
-      const candidate = dependencies.buildCandidate(candidateState);
-      await dependencies.dataplane.checkConfig(candidate.config);
-    }
-    dependencies.state.update((state) => {
-      const role = before.failoverPolicy.enabled && !policy.enabled ? currentRole(state) : null;
-      const target = role ? state.appliedFailoverPolicy?.[role] : null;
-      return {
-        ...state,
-        failoverPolicy: policy,
-        ...(target ? {
-          desiredProfileId: target.profileId,
-          profiles: state.profiles.map((profile) => profile.id === target.profileId
-            ? { ...profile, desiredServerId: target.serverId }
-            : profile),
-        } : {}),
-      };
-    });
-    decisionMemory = undefined;
-    if (before.failoverPolicy.enabled !== policy.enabled) clearHealthMemory();
-    if (before.failoverPolicy.enabled !== policy.enabled) {
-      dependencies.onEvent?.({
-        type: policy.enabled ? 'failover.enabled' : 'failover.disabled',
-        severity: 'info',
-        source: 'failover',
-        dedupeKey: `failover.${policy.enabled ? 'enabled' : 'disabled'}:${dependencies.state.read().revision}`,
-        data: {},
-      });
-    }
-    await reconcileAfterCommit();
-    });
-  }
-
-  function pause(paused: boolean) {
-    return dependencies.serialize(async () => {
-    const before = dependencies.state.read();
-    if (!paused && (
-      !before.appliedFailoverPolicy
-      || !targetServer(before, 'primary')
-      || !targetServer(before, 'reserve')
-    )) throw new HarborError('REQUEST_INVALID');
-    dependencies.state.update((state) => ({
-      ...state,
-      failoverPolicy: { ...state.failoverPolicy, paused },
-    }));
-    decisionMemory = undefined;
-    dependencies.onEvent?.({
-      type: paused ? 'failover.paused' : 'failover.resumed',
-      severity: 'info',
-      source: 'failover',
-      dedupeKey: `failover.${paused ? 'paused' : 'resumed'}:${dependencies.state.read().revision}`,
-      data: {},
-    });
-    await reconcileAfterCommit();
-    });
-  }
-
-  async function manualSwitch(role: FailoverRole) {
-    await dependencies.serialize(async () => {
-      const state = dependencies.state.read();
-      if (!state.failoverPolicy.enabled || !state.appliedFailoverPolicy || !currentRole(state)) {
-        throw new HarborError('REQUEST_INVALID');
-      }
-      await switchWithinQueue(role, 'manual');
-    });
-    await reconcileAfterCommit();
-  }
-
-  const prepareActivation = (role: FailoverRole) => dependencies.dataplane.selectFailoverRole(role);
-
-  async function restoreAppliedActivation(state: StoredState) {
-    if (!state.appliedFailoverPolicy) return;
-    const role = currentRole(state);
-    if (!role) throw new HarborError('CONFIG_INVALID');
-    await prepareActivation(role);
-  }
-
-  function checkNow() {
-    return dependencies.serialize(async () => {
-      const state = dependencies.state.read();
-      if (!state.failoverPolicy.enabled || !state.appliedFailoverPolicy || !currentRole(state)) {
-        throw new HarborError('REQUEST_INVALID');
-      }
-      const capturedGeneration = ++generation;
-      clearTimer();
-      const checkedAt = now().toISOString();
-      publish({ ...snapshot, reason: 'checking-channels' });
-      let primary;
-      let reserve;
-      try {
-        [primary, reserve] = await Promise.all([
-          assessRole('primary', state.failoverPolicy),
-          assessRole('reserve', state.failoverPolicy),
-        ]);
-      } catch {
-        primary = { health: 'unknown' as const, failingServiceIds: [] };
-        reserve = { health: 'unknown' as const, failingServiceIds: [] };
-      }
-      if (capturedGeneration !== generation || !dependencies.state.read().failoverPolicy.enabled) return;
-      recordHealthTransition('primary', primary.health, capturedGeneration);
-      recordHealthTransition('reserve', reserve.health, capturedGeneration);
-      const next = activeSnapshot(dependencies.state.read(), 'observing');
-      next.primary = { ...next.primary, ...primary, checkedAt, stateSince: checkedAt };
-      next.reserve = { ...next.reserve, ...reserve, checkedAt, stateSince: checkedAt };
-      next.reason = 'manual-check';
-      publish(next);
-      schedule(state.failoverPolicy.intervalMs);
-    });
-  }
-
-  return {
-    snapshot: () => snapshot,
-    save,
-    pause,
-    manualSwitch,
-    checkNow,
-    prepareActivation,
-    restoreAppliedActivation,
-    reconcile,
-    runRound,
-    shutdown: () => deactivate(dependencies.state.read().failoverPolicy),
-  };
-}
-
-export type FailoverService = ReturnType<typeof createFailoverService>;

src/server/features/routing/gatewayAutoService.ts

@@ -1,362 +0,0 @@
-import { isDeepStrictEqual } from 'node:util';
-
-import {
-  appliedProfile,
-  desiredProfile,
-  type GatewayAutoState,
-  type StoredState,
-} from '../../../shared/contracts/state.js';
-import { HarborError } from '../../../shared/errors.js';
-import type { RuntimeCommandResult } from '../connection/index.js';
-import { finishRollback } from '../../services/rollback.js';
-
-interface HostNetworkState {
-  gateway: string;
-  interface: string;
-  mac: string;
-  observedAt?: number;
-}
-
-interface VerifiedGateway {
-  gatewayId: string;
-  uiOrigin?: string;
-  verifiedAt?: string;
-}
-
-type TimerHandle = NodeJS.Timeout;
-
-interface GatewayAutoServiceDependencies {
-  appMode: string;
-  state: {
-    read(): StoredState;
-    update(mutator: (state: StoredState) => Record<string, unknown>): StoredState;
-  };
-  subscription: { readConfig(profileId: string): unknown | null };
-  config: {
-    build(
-      subscriptionConfig: unknown,
-      selectedServerId: string,
-      routeRules: StoredState['routeRules'],
-      gatewayAuto: GatewayAutoState,
-    ): unknown;
-    read(): string | null;
-    write(value: unknown): void;
-    restore(value: string): void;
-    remove(): void;
-  };
-  runtime: {
-    isRunning(): boolean;
-    applyCommand(): Promise<RuntimeCommandResult>;
-    restoreRunning(): Promise<unknown>;
-    stopCommand(): Promise<RuntimeCommandResult>;
-  };
-  discovery: {
-    readHostNetwork(): HostNetworkState | null;
-    probeGateway(input: {
-      gateway: string;
-      subscriptionUrl: string;
-    }): Promise<VerifiedGateway>;
-  };
-  transition: {
-    createInitial(): GatewayAutoState;
-    applyPreference(state: GatewayAutoState, enabled: boolean): GatewayAutoState;
-    next(
-      current: GatewayAutoState,
-      input: {
-        network: HostNetworkState | null;
-        verifiedGateway?: VerifiedGateway | null;
-        error?: string;
-      },
-    ): GatewayAutoState;
-    sameRoute(
-      previous: GatewayAutoState['gateway'] | HostNetworkState | null | undefined,
-      current: HostNetworkState | null | undefined,
-    ): boolean;
-  };
-  serialize<T>(operation: () => Promise<T>): Promise<T>;
-  scheduler: {
-    setInterval(callback: () => void, intervalMs: number): TimerHandle;
-    clearInterval(timer: TimerHandle): void;
-  };
-  onRouteChange(state: GatewayAutoState): void;
-  onDiscoveryWarning(reason: string): void;
-  onTimerError(error: unknown): void;
-}
-
-interface CommitOptions {
-  reconfigure?: boolean;
-  persistEnabled?: boolean;
-}
-
-interface RefreshOptions {
-  reconfigure?: boolean;
-}
-
-function errorMessage(error: unknown) {
-  return error && typeof error === 'object' && 'message' in error && error.message
-    ? String(error.message)
-    : 'Gateway presence check failed';
-}
-
-export function createGatewayAutoService(dependencies: GatewayAutoServiceDependencies) {
-  let current = dependencies.transition.createInitial();
-  let refreshPromise: Promise<GatewayAutoState> | null = null;
-  let discoveryTimer: TimerHandle | null = null;
-
-  const restoreConfig = (previous: string | null) => {
-    if (previous === null) dependencies.config.remove();
-    else dependencies.config.restore(previous);
-  };
-
-  const commitCandidate = async (
-    candidate: GatewayAutoState,
-    { reconfigure = true, persistEnabled }: CommitOptions = {},
-  ) => {
-    const previousGatewayAuto = current;
-    const stateChanged = !isDeepStrictEqual(previousGatewayAuto, candidate);
-    const modeChanged = previousGatewayAuto.mode !== candidate.mode;
-    const leavesGatewayDirect = previousGatewayAuto.mode === 'gateway-direct'
-      && candidate.mode !== 'gateway-direct';
-    if (!stateChanged && persistEnabled === undefined) return current;
-
-    const previousState = dependencies.state.read();
-    const wasRunning = modeChanged ? dependencies.runtime.isRunning() : false;
-    const targetProfile = wasRunning
-      ? appliedProfile(previousState)
-      : desiredProfile(previousState);
-    const targetServerId = wasRunning
-      ? previousState.appliedServerId
-      : targetProfile?.desiredServerId || '';
-    const subscriptionConfig = modeChanged && targetProfile
-      ? dependencies.subscription.readConfig(targetProfile.id)
-      : null;
-    const stopUnavailableTarget = async (cause: unknown) => {
-      let runtimeMutationStarted = false;
-      let gatewayAutoPublished = false;
-      let stateCommitStarted = false;
-      try {
-        const command = await dependencies.runtime.stopCommand();
-        runtimeMutationStarted = command.mutationStarted;
-        if (!command.ok) throw command.error;
-        current = candidate;
-        gatewayAutoPublished = true;
-        stateCommitStarted = true;
-        dependencies.state.update((state) => ({
-          ...state,
-          connectionDesired: 'stopped',
-          appliedProfileId: '',
-          appliedServerId: '',
-          appliedServerSnapshot: null,
-          ...(persistEnabled === undefined ? {} : { gatewayAutoEnabled: persistEnabled }),
-        }));
-      } catch (error) {
-        await finishRollback(error, [
-          ...(gatewayAutoPublished ? [{ run: () => { current = previousGatewayAuto; } }] : []),
-          ...(runtimeMutationStarted ? [{
-            run: () => dependencies.runtime.restoreRunning(),
-            runtime: true,
-          }] : []),
-          ...(stateCommitStarted ? [{ run: () => dependencies.state.update(() => previousState) }] : []),
-        ], 'Gateway auto safe-stop rollback failed');
-      }
-      dependencies.onDiscoveryWarning(errorMessage(cause));
-      if (modeChanged) dependencies.onRouteChange(candidate);
-      throw cause;
-    };
-    if (modeChanged && wasRunning && (!targetProfile || !targetServerId || !subscriptionConfig)) {
-      if (leavesGatewayDirect) return stopUnavailableTarget(new HarborError('CONFIG_INVALID'));
-      throw new HarborError('CONFIG_INVALID');
-    }
-    let candidateConfig: unknown | null = null;
-    if (modeChanged && targetServerId && subscriptionConfig) {
-      try {
-        candidateConfig = dependencies.config.build(
-          subscriptionConfig,
-          targetServerId,
-          previousState.routeRules,
-          candidate,
-        );
-      } catch (error) {
-        const code = error && typeof error === 'object' && 'code' in error ? String(error.code) : '';
-        if (wasRunning && leavesGatewayDirect && ['CONFIG_INVALID', 'SERVER_NOT_FOUND'].includes(code)) {
-          return stopUnavailableTarget(error);
-        }
-        throw error;
-      }
-    }
-    const previousConfig = candidateConfig === null ? null : dependencies.config.read();
-    let configMutationStarted = false;
-    let runtimeMutationStarted = false;
-    let gatewayAutoPublished = false;
-    let stateCommitStarted = false;
-
-    try {
-      if (candidateConfig !== null) {
-        configMutationStarted = true;
-        dependencies.config.write(candidateConfig);
-        if (reconfigure && wasRunning) {
-          const command = await dependencies.runtime.applyCommand();
-          runtimeMutationStarted = command.mutationStarted;
-          if (!command.ok) throw command.error;
-        }
-      }
-
-      if (stateChanged) {
-        current = candidate;
-        gatewayAutoPublished = true;
-        stateCommitStarted = true;
-        dependencies.state.update((state) => ({
-          ...state,
-          ...(modeChanged && wasRunning && reconfigure ? {
-            appliedRouteRules: candidate.mode === 'gateway-direct' ? [] : state.routeRules,
-          } : {}),
-        }));
-      }
-      if (persistEnabled !== undefined) {
-        stateCommitStarted = true;
-        dependencies.state.update((state) => ({
-          ...state,
-          gatewayAutoEnabled: persistEnabled,
-        }));
-      }
-    } catch (error) {
-      await finishRollback(error, [
-        ...(gatewayAutoPublished ? [{ run: () => { current = previousGatewayAuto; } }] : []),
-        ...(configMutationStarted ? [{ run: () => restoreConfig(previousConfig) }] : []),
-        ...(wasRunning && runtimeMutationStarted ? [{
-          run: () => dependencies.runtime.restoreRunning(),
-          runtime: true,
-        }] : []),
-        ...(stateCommitStarted ? [{ run: () => dependencies.state.update(() => previousState) }] : []),
-      ], 'Gateway auto rollback failed');
-    }
-
-    if (modeChanged) dependencies.onRouteChange(candidate);
-    return current;
-  };
-
-  const runRefresh = async ({ reconfigure = true }: RefreshOptions) => {
-    const state = dependencies.state.read();
-    const profile = desiredProfile(state);
-    const subscriptionUrl = profile?.subscriptionUrl || '';
-    const network = subscriptionUrl
-      ? dependencies.discovery.readHostNetwork()
-      : null;
-
-    if (!network) {
-      const discoveryError = 'macOS default gateway недоступен или устарел';
-      const discoveredState = dependencies.transition.next(current, {
-        network: null,
-        error: discoveryError,
-      });
-      const candidate = dependencies.transition.applyPreference(
-        subscriptionUrl
-          ? { ...discoveredState, lastError: discoveryError }
-          : discoveredState,
-        state.gatewayAutoEnabled !== false,
-      );
-      return commitCandidate(candidate, { reconfigure });
-    }
-
-    if (
-      current.mode === 'gateway-direct' &&
-      !dependencies.transition.sameRoute(current.gateway, network)
-    ) {
-      await commitCandidate(
-        dependencies.transition.next(current, { network }),
-        { reconfigure },
-      );
-    }
-
-    let verifiedGateway: VerifiedGateway;
-    try {
-      verifiedGateway = await dependencies.discovery.probeGateway({
-        gateway: network.gateway,
-        subscriptionUrl,
-      });
-    } catch (error) {
-      const reason = errorMessage(error);
-      const latestState = dependencies.state.read();
-      const latestSubscriptionUrl = desiredProfile(latestState)?.subscriptionUrl || '';
-      const latestNetwork = latestSubscriptionUrl
-        ? dependencies.discovery.readHostNetwork()
-        : null;
-      if (
-        latestSubscriptionUrl !== subscriptionUrl ||
-        !dependencies.transition.sameRoute(network, latestNetwork)
-      ) {
-        return commitCandidate(dependencies.transition.createInitial(), { reconfigure });
-      }
-      if (current.lastError !== reason) dependencies.onDiscoveryWarning(reason);
-      return commitCandidate(
-        dependencies.transition.applyPreference(
-          dependencies.transition.next(current, {
-            network: latestNetwork,
-            error: reason,
-          }),
-          latestState.gatewayAutoEnabled !== false,
-        ),
-        { reconfigure },
-      );
-    }
-
-    const latestState = dependencies.state.read();
-    const latestSubscriptionUrl = desiredProfile(latestState)?.subscriptionUrl || '';
-    const latestNetwork = latestSubscriptionUrl
-      ? dependencies.discovery.readHostNetwork()
-      : null;
-    if (
-      latestSubscriptionUrl !== subscriptionUrl ||
-      !dependencies.transition.sameRoute(network, latestNetwork)
-    ) {
-      return commitCandidate(dependencies.transition.createInitial(), { reconfigure });
-    }
-    return commitCandidate(
-      dependencies.transition.applyPreference(
-        dependencies.transition.next(current, { network: latestNetwork, verifiedGateway }),
-        latestState.gatewayAutoEnabled !== false,
-      ),
-      { reconfigure },
-    );
-  };
-
-  const refresh = (options: RefreshOptions = {}) => {
-    if (dependencies.appMode !== 'client') return Promise.resolve(current);
-    if (refreshPromise) return refreshPromise;
-    refreshPromise = dependencies.serialize(() => runRefresh(options)).finally(() => {
-      refreshPromise = null;
-    });
-    return refreshPromise;
-  };
-
-  const setEnabled = (enabled: boolean) => dependencies.serialize(() => commitCandidate(
-    dependencies.transition.applyPreference(current, enabled),
-    { persistEnabled: enabled },
-  ));
-
-  const startDiscovery = (intervalMs: number) => {
-    if (discoveryTimer) return;
-    discoveryTimer = dependencies.scheduler.setInterval(() => {
-      void refresh().catch(dependencies.onTimerError);
-    }, intervalMs);
-    discoveryTimer.unref();
-  };
-
-  const stopDiscovery = () => {
-    if (!discoveryTimer) return;
-    dependencies.scheduler.clearInterval(discoveryTimer);
-    discoveryTimer = null;
-  };
-
-  return {
-    read: () => current,
-    set: (value: GatewayAutoState) => { current = value; },
-    createInitial: dependencies.transition.createInitial,
-    setEnabled,
-    refresh,
-    startDiscovery,
-    stopDiscovery,
-  };
-}
-
-export type GatewayAutoService = ReturnType<typeof createGatewayAutoService>;

src/server/features/routing/index.ts

@@ -1,8 +0,0 @@
-export {
-  createRouteRulesService,
-  type RouteRulesService,
-} from './routeRulesService.js';
-export {
-  createGatewayAutoService,
-  type GatewayAutoService,
-} from './gatewayAutoService.js';

src/server/features/routing/routeRulesService.ts

@@ -1,150 +0,0 @@
-import { isDeepStrictEqual } from 'node:util';
-
-import {
-  appliedProfile,
-  desiredProfile,
-  type RouteRule,
-  type StoredState,
-} from '../../../shared/contracts/state.js';
-import { HarborError } from '../../../shared/errors.js';
-import {
-  normalizeRouteRules,
-  ROUTE_RULES_CONTRACT_VERSION,
-} from '../../../shared/routingRules.js';
-import type { RuntimeCommandResult } from '../connection/index.js';
-import { finishRollback } from '../../services/rollback.js';
-
-interface RouteRulesDependencies {
-  state: {
-    read(): StoredState;
-    update(mutator: (state: StoredState) => Record<string, unknown>): StoredState;
-  };
-  subscription: { readConfig(profileId: string): unknown | null };
-  config: {
-    build(subscriptionConfig: unknown, selectedServerId: string, routeRules: RouteRule[]): unknown;
-    read(): string | null;
-    write(value: unknown): void;
-    restore(value: string): void;
-    remove(): void;
-  };
-  runtime: {
-    isRunning(): Promise<boolean>;
-    applyCommand(): Promise<RuntimeCommandResult>;
-    restoreRunning(): Promise<unknown>;
-  };
-  route?: { isGatewayDirect(): boolean };
-  serialize<T>(operation: () => Promise<T>): Promise<T>;
-  runOperation<T>(operation: () => Promise<T>): Promise<T>;
-  afterApply?: () => Promise<unknown>;
-  restoreAppliedActivation?: (state: StoredState) => Promise<unknown>;
-}
-
-export function createRouteRulesService(dependencies: RouteRulesDependencies) {
-  const applyRules = async (previousState: StoredState, routeRules: RouteRule[]) => {
-    const wasRunning = await dependencies.runtime.isRunning();
-    const bypassed = dependencies.route?.isGatewayDirect() === true;
-    const targetProfile = wasRunning
-      ? appliedProfile(previousState)
-      : desiredProfile(previousState);
-    const targetServerId = wasRunning
-      ? previousState.appliedServerId
-      : targetProfile?.desiredServerId || '';
-    const subscriptionConfig = targetProfile
-      ? dependencies.subscription.readConfig(targetProfile.id)
-      : null;
-    if (bypassed || !targetServerId || !subscriptionConfig) {
-      let stateCommitStarted = false;
-      try {
-        stateCommitStarted = true;
-        dependencies.state.update((state) => ({
-          ...state,
-          routeRules,
-          ...(bypassed ? { appliedRouteRules: [] } : {}),
-          routeRulesRevision: state.routeRulesRevision + 1,
-        }));
-      } catch (error) {
-        await finishRollback(error, [
-          ...(stateCommitStarted ? [{ run: () => dependencies.state.update(() => previousState) }] : []),
-        ], 'Route rules rollback failed');
-      }
-      return;
-    }
-
-    const candidateConfig = dependencies.config.build(
-      subscriptionConfig,
-      targetServerId,
-      routeRules,
-    );
-    const previousConfig = dependencies.config.read();
-    const configChanged = previousConfig !== JSON.stringify(candidateConfig, null, 2);
-    let configMutationStarted = false;
-    let runtimeMutationStarted = false;
-    let stateCommitStarted = false;
-
-    try {
-      if (configChanged) {
-        configMutationStarted = true;
-        dependencies.config.write(candidateConfig);
-      }
-      if (wasRunning && configChanged) {
-        const command = await dependencies.runtime.applyCommand();
-        runtimeMutationStarted = command.mutationStarted;
-        if (!command.ok) throw command.error;
-      }
-      stateCommitStarted = true;
-      dependencies.state.update((state) => ({
-        ...state,
-        routeRules,
-        ...(wasRunning ? { appliedRouteRules: routeRules } : {}),
-        routeRulesRevision: state.routeRulesRevision + 1,
-      }));
-      await dependencies.afterApply?.();
-    } catch (error) {
-      await finishRollback(error, [
-        ...(configMutationStarted ? [{
-          run: () => previousConfig === null
-            ? dependencies.config.remove()
-            : dependencies.config.restore(previousConfig),
-        }] : []),
-        ...(wasRunning && runtimeMutationStarted ? [{
-          run: async () => {
-            await dependencies.runtime.restoreRunning();
-            await dependencies.restoreAppliedActivation?.(previousState);
-          },
-          runtime: true,
-        }] : []),
-        ...(stateCommitStarted ? [{ run: () => dependencies.state.update(() => previousState) }] : []),
-      ], 'Route rules rollback failed');
-    }
-  };
-
-  const update = (
-    rules: unknown,
-    expectedRulesRevision: unknown,
-    rulesContractVersion: unknown,
-  ) => {
-    if (rulesContractVersion !== ROUTE_RULES_CONTRACT_VERSION) {
-      throw new HarborError('REQUEST_INVALID');
-    }
-    let routeRules: RouteRule[];
-    try {
-      routeRules = normalizeRouteRules(rules, { strict: true }) as RouteRule[];
-    } catch (cause) {
-      throw new HarborError('REQUEST_INVALID', { cause });
-    }
-    if (!Number.isSafeInteger(expectedRulesRevision) || Number(expectedRulesRevision) < 0) {
-      throw new HarborError('REQUEST_INVALID');
-    }
-
-    return dependencies.serialize(async () => {
-      const current = dependencies.state.read();
-      if (current.routeRulesRevision !== expectedRulesRevision) throw new HarborError('STATE_CONFLICT');
-      if (isDeepStrictEqual(current.routeRules, routeRules)) return;
-      await dependencies.runOperation(() => applyRules(current, routeRules));
-    });
-  };
-
-  return { update };
-}
-
-export type RouteRulesService = ReturnType<typeof createRouteRulesService>;

src/server/features/servers/index.ts

@@ -1,7 +0,0 @@
-export {
-  checkServerHealth,
-  createServerHealthService,
-  SERVER_HEALTH_CONCURRENCY,
-  SERVER_HEALTH_MAX_COUNT,
-  type ServerHealthService,
-} from './serverHealth.js';

src/server/features/servers/serverHealth.ts

@@ -1,63 +0,0 @@
-import type { HarborServer, StoredProfile } from '../../../shared/contracts/state.js';
-import { HarborError } from '../../../shared/errors.js';
-
-export const SERVER_HEALTH_MAX_COUNT = 30;
-export const SERVER_HEALTH_CONCURRENCY = 4;
-
-type HealthServer = Pick<HarborServer, 'id' | 'label' | 'host' | 'port'>;
-type Ping = (host: string, port: number) => Promise<Record<string, unknown>>;
-
-export async function checkServerHealth(
-  servers: HealthServer[],
-  ping: Ping,
-  {
-    maxCount = SERVER_HEALTH_MAX_COUNT,
-    concurrency = SERVER_HEALTH_CONCURRENCY,
-  } = {},
-) {
-  const queue = servers.slice(0, maxCount);
-  const results: Array<Record<string, unknown>> = new Array(queue.length);
-  let nextIndex = 0;
-
-  async function worker() {
-    while (nextIndex < queue.length) {
-      const index = nextIndex++;
-      const server = queue[index];
-      results[index] = {
-        id: server.id,
-        tag: server.label,
-        ...await ping(server.host, server.port),
-        checkedAt: new Date().toISOString(),
-      };
-    }
-  }
-
-  await Promise.all(Array.from({ length: Math.min(concurrency, queue.length) }, worker));
-  return results;
-}
-
-interface ServerHealthDependencies {
-  readProfiles(): StoredProfile[];
-  readDesiredProfileId(): string;
-  ping: Ping;
-}
-
-export function createServerHealthService(dependencies: ServerHealthDependencies) {
-  return {
-    check(profileIdValue: unknown, serverIds: unknown) {
-      const requestedProfileId = String(profileIdValue || '').trim();
-      const profileId = requestedProfileId || dependencies.readDesiredProfileId();
-      const profile = dependencies.readProfiles().find((candidate) => candidate.id === profileId);
-      if (!profile) throw new HarborError('PROFILE_NOT_FOUND');
-      const requestedIds = new Set(Array.isArray(serverIds) ? serverIds.map(String) : []);
-      return checkServerHealth(
-        requestedIds.size
-          ? profile.servers.filter((server) => requestedIds.has(server.id))
-          : profile.servers,
-        dependencies.ping,
-      );
-    },
-  };
-}
-
-export type ServerHealthService = ReturnType<typeof createServerHealthService>;

src/server/features/state/stateService.ts

@@ -1,63 +0,0 @@
-import {
-  createStateSnapshot,
-  normalizeStoredState,
-  type GatewayAutoState,
-  type OperationState,
-  type StateSnapshot,
-  type StoredState,
-} from '../../../shared/contracts/state.js';
-import type { FailoverSnapshot } from '../../../shared/failover.js';
-
-interface RuntimeState {
-  running?: boolean;
-  startedAt?: string | null;
-}
-
-export interface StateReadResult {
-  snapshot: StateSnapshot;
-  storedState: StoredState;
-  gatewayAuto: GatewayAutoState;
-  configExists: boolean;
-}
-
-interface StateServiceDependencies {
-  appMode: string;
-  readStoredState: () => unknown;
-  refreshRuntime: () => Promise<RuntimeState>;
-  getGatewayAutoState: () => GatewayAutoState;
-  getOperationState: () => OperationState;
-  configExists: () => boolean;
-  getFailoverSnapshot?: () => FailoverSnapshot;
-}
-
-function subscriptionHost(value: unknown) {
-  try {
-    return `${new URL(String(value)).host}/…`;
-  } catch {
-    return '';
-  }
-}
-
-export function createStateService(dependencies: StateServiceDependencies) {
-  return {
-    async read(): Promise<StateReadResult> {
-      const runtime = await dependencies.refreshRuntime();
-      const storedState = normalizeStoredState(dependencies.readStoredState());
-      const gatewayAuto = dependencies.getGatewayAutoState();
-      const configExists = dependencies.configExists();
-      const snapshot = createStateSnapshot({
-        storedState,
-        runtime,
-        gatewayAuto,
-        appMode: dependencies.appMode,
-        configExists,
-        subscriptionHost: subscriptionHost(storedState.subscriptionUrl),
-        operation: dependencies.getOperationState(),
-        failoverSnapshot: dependencies.getFailoverSnapshot?.(),
-      });
-      return { snapshot, storedState, gatewayAuto, configExists };
-    },
-  };
-}
-
-export type StateService = ReturnType<typeof createStateService>;

src/server/features/subscription/index.ts

@@ -1,8 +0,0 @@
-export {
-  createValidateSubscription,
-  type ValidateSubscription,
-} from './validateSubscription.js';
-export {
-  createSubscriptionService,
-  type SubscriptionService,
-} from './subscriptionService.js';

src/server/features/subscription/subscriptionService.ts

@@ -1,605 +0,0 @@
-import crypto from 'node:crypto';
-
-import {
-  profileById,
-  type GatewayAutoState,
-  type HarborServer,
-  type StoredProfile,
-  type StoredState,
-} from '../../../shared/contracts/state.js';
-import { HarborError } from '../../../shared/errors.js';
-import type { ActivityJournalEventInput } from '../../../shared/activityJournal.js';
-import { finishRollback } from '../../services/rollback.js';
-
-interface ParsedSubscription {
-  config: unknown;
-  servers: HarborServer[];
-  userInfo: Record<string, unknown>;
-  fetchedAt: string;
-}
-
-type TimerHandle = NodeJS.Timeout;
-
-interface SubscriptionServiceDependencies {
-  provider: {
-    fetchSubscription(url: string): Promise<ParsedSubscription>;
-    selectRefreshedServer(
-      currentServerId: string,
-      currentServers: HarborServer[],
-      nextServers: HarborServer[],
-    ): string;
-  };
-  state: {
-    read(): StoredState;
-    update(mutator: (state: StoredState) => Record<string, unknown>): StoredState;
-  };
-  config: {
-    build(subscriptionConfig: unknown, selectedServerId: string, routeRules: StoredState['routeRules']): unknown;
-    read(): string | null;
-    write(value: unknown): void;
-    restore(value: string): void;
-    remove(): void;
-  };
-  runtime: {
-    isRunning(): Promise<boolean>;
-    stop(): Promise<unknown>;
-    start(): Promise<unknown>;
-  };
-  gatewayAuto: {
-    read(): GatewayAutoState;
-    set(value: GatewayAutoState): void;
-    createInitial(): GatewayAutoState;
-  };
-  serialize<T>(operation: () => Promise<T>): Promise<T>;
-  scheduler: {
-    setInterval(callback: () => void, intervalMs: number): TimerHandle;
-    clearInterval(handle: TimerHandle): void;
-  };
-  onRefreshError(error: unknown): void;
-  onEvent?: (event: ActivityJournalEventInput) => void;
-  failover?: {
-    reconcile(): Promise<unknown>;
-    restoreAppliedActivation(state: StoredState): Promise<unknown>;
-  };
-  now?: () => Date;
-}
-
-export interface ProfileMutationResult extends Record<string, unknown> {
-  success: true;
-  profileId: string;
-  label: string;
-}
-
-const safeErrorCode = (error: unknown) => (
-  error && typeof error === 'object' && 'code' in error
-    ? String(error.code)
-    : 'UNKNOWN'
-);
-
-const cleanLabel = (value: unknown) => String(value || '').trim();
-const foldedLabel = (value: unknown) => cleanLabel(value).toLocaleLowerCase('ru');
-
-function requireLabel(value: unknown) {
-  const label = cleanLabel(value);
-  if (!label || label.length > 64) throw new HarborError('REQUEST_INVALID');
-  return label;
-}
-
-function requireExpectedRevision(state: StoredState, expectedRevision: unknown) {
-  if (expectedRevision === undefined) return;
-  if (!Number.isSafeInteger(expectedRevision) || Number(expectedRevision) !== state.revision) {
-    throw new HarborError('STATE_CONFLICT');
-  }
-}
-
-function requireProfile(state: StoredState, profileId: unknown) {
-  const profile = profileById(state, profileId);
-  if (!profile) throw new HarborError('PROFILE_NOT_FOUND');
-  return profile;
-}
-
-function assertUniqueLabel(state: StoredState, label: string, exceptProfileId = '') {
-  if (state.profiles.some((profile) => (
-    profile.id !== exceptProfileId && foldedLabel(profile.label) === foldedLabel(label)
-  ))) throw new HarborError('PROFILE_NAME_CONFLICT');
-}
-
-function replaceProfile(state: StoredState, nextProfile: StoredProfile) {
-  return state.profiles.map((profile) => profile.id === nextProfile.id ? nextProfile : profile);
-}
-
-function mutationResult(profile: Pick<StoredProfile, 'id' | 'label'>): ProfileMutationResult {
-  return { success: true, profileId: profile.id, label: profile.label };
-}
-
-function publicHost(url: string) {
-  try { return new URL(url).hostname; } catch { return ''; }
-}
-
-export function createSubscriptionService(dependencies: SubscriptionServiceDependencies) {
-  const refreshPromises = new Map<string, Promise<ProfileMutationResult>>();
-  let refreshTimer: TimerHandle | null = null;
-  const now = dependencies.now || (() => new Date());
-
-  const restoreConfig = (previous: string | null) => {
-    if (previous === null) dependencies.config.remove();
-    else dependencies.config.restore(previous);
-  };
-
-  const preflightAddProfile = (labelValue: unknown, expectedRevision?: unknown) => {
-    const state = dependencies.state.read();
-    requireExpectedRevision(state, expectedRevision);
-    assertUniqueLabel(state, requireLabel(labelValue));
-  };
-
-  const preflightRenameProfile = (
-    profileId: unknown,
-    labelValue: unknown,
-    expectedRevision?: unknown,
-  ) => {
-    const state = dependencies.state.read();
-    requireExpectedRevision(state, expectedRevision);
-    const profile = requireProfile(state, profileId);
-    assertUniqueLabel(state, requireLabel(labelValue), profile.id);
-  };
-
-  const addProfile = async (
-    labelValue: unknown,
-    subscriptionUrlValue: unknown,
-    expectedRevision?: unknown,
-  ) => {
-    const label = requireLabel(labelValue);
-    const subscriptionUrl = String(subscriptionUrlValue || '').trim();
-    const preflight = dependencies.state.read();
-    requireExpectedRevision(preflight, expectedRevision);
-    assertUniqueLabel(preflight, label);
-    const parsed = await dependencies.provider.fetchSubscription(subscriptionUrl);
-
-    // Admission CAS already passed; background freshness may advance the global revision during provider I/O.
-    return dependencies.serialize(async () => {
-      const state = dependencies.state.read();
-      assertUniqueLabel(state, label);
-      const profile: StoredProfile = {
-        id: `profile_${crypto.randomUUID()}`,
-        label,
-        subscriptionUrl,
-        subscriptionConfig: parsed.config,
-        servers: parsed.servers,
-        userInfo: parsed.userInfo,
-        fetchedAt: parsed.fetchedAt,
-        desiredServerId: '',
-        lastRefreshAttemptAt: parsed.fetchedAt,
-        lastRefreshErrorCode: null,
-      };
-      dependencies.state.update((current) => ({
-        ...current,
-        profiles: [...current.profiles, profile],
-        desiredProfileId: current.profiles.length ? current.desiredProfileId : profile.id,
-      }));
-      dependencies.onEvent?.({
-        type: 'subscription.added',
-        severity: 'info',
-        source: 'subscription',
-        dedupeKey: `subscription.added:${dependencies.state.read().revision}`,
-        data: { profileId: profile.id, profileLabel: profile.label, host: publicHost(profile.subscriptionUrl), serverCount: profile.servers.length },
-      });
-      return mutationResult(profile);
-    });
-  };
-
-  const renameProfile = (profileId: unknown, labelValue: unknown, expectedRevision?: unknown) => (
-    dependencies.serialize(async () => {
-      const state = dependencies.state.read();
-      requireExpectedRevision(state, expectedRevision);
-      const profile = requireProfile(state, profileId);
-      const label = requireLabel(labelValue);
-      if (profile.label === label) return mutationResult(profile);
-      assertUniqueLabel(state, label, profile.id);
-      const renamed = { ...profile, label };
-      dependencies.state.update((current) => ({
-        ...current,
-        profiles: replaceProfile(current, renamed),
-      }));
-      return mutationResult(renamed);
-    })
-  );
-
-  const selectProfileServer = (
-    profileId: unknown,
-    serverIdValue: unknown,
-    expectedRevision?: unknown,
-  ) => dependencies.serialize(async () => {
-    const state = dependencies.state.read();
-    requireExpectedRevision(state, expectedRevision);
-    const profile = requireProfile(state, profileId);
-    const serverId = String(serverIdValue || '').trim();
-    if (!profile.servers.some((server) => server.id === serverId)) {
-      throw new HarborError('SERVER_NOT_FOUND');
-    }
-    if (profile.desiredServerId === serverId && state.desiredProfileId === profile.id) {
-      return mutationResult(profile);
-    }
-    const selected = profile.desiredServerId === serverId
-      ? profile
-      : { ...profile, desiredServerId: serverId };
-    dependencies.state.update((current) => ({
-      ...current,
-      profiles: replaceProfile(current, selected),
-      desiredProfileId: profile.id,
-    }));
-    return mutationResult(selected);
-  });
-
-  const recordRefreshError = async (
-    profileId: string,
-    subscriptionUrl: string,
-    error: unknown,
-    origin: 'manual' | 'scheduled',
-  ) => dependencies.serialize(async () => {
-    const state = dependencies.state.read();
-    const profile = requireProfile(state, profileId);
-    if (profile.subscriptionUrl !== subscriptionUrl) throw new HarborError('STATE_CONFLICT');
-    const failed = {
-      ...profile,
-      lastRefreshAttemptAt: now().toISOString(),
-      lastRefreshErrorCode: safeErrorCode(error),
-    };
-    dependencies.state.update((current) => ({
-      ...current,
-      profiles: replaceProfile(current, failed),
-    }));
-    dependencies.onEvent?.({
-      type: 'subscription.refresh_failed',
-      severity: 'warning',
-      source: 'subscription',
-      dedupeKey: origin === 'scheduled'
-        ? `subscription.refresh_failed:${failed.id}:${failed.fetchedAt || 'never'}:${failed.lastRefreshErrorCode}`
-        : `subscription.refresh_failed:${dependencies.state.read().revision}`,
-      data: {
-        profileId: failed.id,
-        profileLabel: failed.label,
-        host: publicHost(failed.subscriptionUrl),
-        errorCode: failed.lastRefreshErrorCode || 'UNKNOWN',
-      },
-    });
-  });
-
-  const commitRefresh = (
-    profileId: string,
-    subscriptionUrl: string,
-    parsed: ParsedSubscription,
-    origin: 'manual' | 'scheduled',
-  ) => dependencies.serialize(async () => {
-    // Re-read the profile after provider I/O and guard its owner instead of rejecting background-only revisions.
-    const previousState = dependencies.state.read();
-    const previousProfile = requireProfile(previousState, profileId);
-    if (previousProfile.subscriptionUrl !== subscriptionUrl) throw new HarborError('STATE_CONFLICT');
-
-    const desiredServerId = dependencies.provider.selectRefreshedServer(
-      previousProfile.desiredServerId,
-      previousProfile.servers,
-      parsed.servers,
-    );
-    const refreshedProfile: StoredProfile = {
-      ...previousProfile,
-      subscriptionConfig: parsed.config,
-      servers: parsed.servers,
-      userInfo: parsed.userInfo,
-      fetchedAt: parsed.fetchedAt,
-      desiredServerId,
-      lastRefreshAttemptAt: parsed.fetchedAt,
-      lastRefreshErrorCode: null,
-    };
-    const contentChanged = JSON.stringify({
-      subscriptionConfig: previousProfile.subscriptionConfig,
-      servers: previousProfile.servers,
-      userInfo: previousProfile.userInfo,
-    }) !== JSON.stringify({
-      subscriptionConfig: refreshedProfile.subscriptionConfig,
-      servers: refreshedProfile.servers,
-      userInfo: refreshedProfile.userInfo,
-    });
-    const appendRefreshEvent = () => {
-      if (origin === 'scheduled' && !contentChanged && !previousProfile.lastRefreshErrorCode) return;
-      dependencies.onEvent?.({
-        type: 'subscription.refreshed',
-        severity: 'info',
-        source: 'subscription',
-        dedupeKey: `subscription.refreshed:${dependencies.state.read().revision}`,
-        data: {
-          profileId: refreshedProfile.id,
-          profileLabel: refreshedProfile.label,
-          host: publicHost(refreshedProfile.subscriptionUrl),
-          serverCount: refreshedProfile.servers.length,
-          added: refreshedProfile.servers.filter(({ id }) => !previousProfile.servers.some((server) => server.id === id)).length,
-          removed: previousProfile.servers.filter(({ id }) => !refreshedProfile.servers.some((server) => server.id === id)).length,
-        },
-      });
-    };
-    const loadedTargets = previousState.appliedFailoverPolicy
-      ? [previousState.appliedFailoverPolicy.primary, previousState.appliedFailoverPolicy.reserve]
-      : [];
-    const missingLoadedTarget = loadedTargets.some((target) => (
-      target.profileId === profileId
-      && !refreshedProfile.servers.some(({ id }) => id === target.serverId)
-    ));
-    const pauseFailover = previousState.failoverPolicy?.enabled
-      && !previousState.failoverPolicy.paused
-      && missingLoadedTarget;
-    const running = await dependencies.runtime.isRunning();
-    const refreshesApplied = running
-      && previousState.appliedProfileId === profileId
-      && !previousState.appliedFailoverPolicy;
-    const nextAppliedServerId = refreshesApplied
-      ? dependencies.provider.selectRefreshedServer(
-          previousState.appliedServerId,
-          previousProfile.servers,
-          parsed.servers,
-        )
-      : '';
-
-    if (!refreshesApplied || !nextAppliedServerId) {
-      dependencies.state.update((current) => ({
-        ...current,
-        profiles: replaceProfile(current, refreshedProfile),
-        ...(pauseFailover ? { failoverPolicy: { ...current.failoverPolicy, paused: true } } : {}),
-      }));
-      if (pauseFailover) dependencies.onEvent?.({
-        type: 'failover.paused',
-        severity: 'warning',
-        source: 'failover',
-        dedupeKey: `failover.paused:missing-target:${profileId}:${dependencies.state.read().revision}`,
-        data: {},
-      });
-      await dependencies.failover?.reconcile();
-      appendRefreshEvent();
-      return mutationResult(refreshedProfile);
-    }
-
-    const nextAppliedServer = parsed.servers.find((server) => server.id === nextAppliedServerId)!;
-    const candidateConfig = dependencies.config.build(
-      parsed.config,
-      nextAppliedServerId,
-      previousState.routeRules,
-    );
-    const previousConfig = dependencies.config.read();
-    let configMutationStarted = false;
-    let runtimeMutationStarted = false;
-    let stateCommitStarted = false;
-
-    try {
-      configMutationStarted = true;
-      dependencies.config.write(candidateConfig);
-      runtimeMutationStarted = true;
-      await dependencies.runtime.start();
-      stateCommitStarted = true;
-      dependencies.state.update((current) => ({
-        ...current,
-        profiles: replaceProfile(current, refreshedProfile),
-        appliedServerId: nextAppliedServerId,
-        appliedServerSnapshot: nextAppliedServer,
-        appliedRouteRules: dependencies.gatewayAuto.read().mode === 'gateway-direct'
-          ? []
-          : current.routeRules,
-      }));
-    } catch (error) {
-      await finishRollback(error, [
-        ...(stateCommitStarted ? [{ run: () => dependencies.state.update(() => previousState) }] : []),
-        ...(configMutationStarted ? [{ run: () => restoreConfig(previousConfig) }] : []),
-        ...(runtimeMutationStarted ? [{
-          run: async () => {
-            await dependencies.runtime.start();
-            await dependencies.failover?.restoreAppliedActivation(previousState);
-          },
-          runtime: true,
-        }] : []),
-      ], 'Subscription refresh rollback failed');
-    }
-    await dependencies.failover?.reconcile();
-    appendRefreshEvent();
-    return mutationResult(refreshedProfile);
-  });
-
-  const refreshProfile = (
-    profileIdValue: unknown,
-    expectedRevision?: unknown,
-    origin: 'manual' | 'scheduled' = 'manual',
-  ) => {
-    const profileId = String(profileIdValue || '').trim();
-    const existing = refreshPromises.get(profileId);
-    if (existing) return existing;
-    const initialState = dependencies.state.read();
-    requireExpectedRevision(initialState, expectedRevision);
-    const initialProfile = requireProfile(initialState, profileId);
-    const operation = (async () => {
-      let parsed: ParsedSubscription;
-      try {
-        parsed = await dependencies.provider.fetchSubscription(initialProfile.subscriptionUrl);
-      } catch (error) {
-        if (safeErrorCode(error) !== 'STATE_CONFLICT') {
-          await recordRefreshError(
-            profileId,
-            initialProfile.subscriptionUrl,
-            error,
-            origin,
-          );
-        }
-        throw error;
-      }
-      return commitRefresh(
-        profileId,
-        initialProfile.subscriptionUrl,
-        parsed,
-        origin,
-      );
-    })().finally(() => refreshPromises.delete(profileId));
-    refreshPromises.set(profileId, operation);
-    return operation;
-  };
-
-  const deleteProfile = (
-    profileIdValue: unknown,
-    modeValue: unknown = 'delete',
-    expectedRevision?: unknown,
-  ) => dependencies.serialize(async () => {
-    const previousState = dependencies.state.read();
-    requireExpectedRevision(previousState, expectedRevision);
-    const profile = requireProfile(previousState, profileIdValue);
-    const mode = String(modeValue || 'delete');
-    if (!['delete', 'stop-and-delete'].includes(mode)) throw new HarborError('REQUEST_INVALID');
-    const running = await dependencies.runtime.isRunning();
-    const failoverReferencesProfile = Boolean(previousState.appliedFailoverPolicy && (
-      previousState.appliedFailoverPolicy.primary.profileId === profile.id
-      || previousState.appliedFailoverPolicy.reserve.profileId === profile.id
-    ));
-    const desiredFailoverReferencesProfile = previousState.failoverPolicy?.primary.profileId === profile.id
-      || previousState.failoverPolicy?.reserve.profileId === profile.id;
-    const applied = running && (previousState.appliedProfileId === profile.id || failoverReferencesProfile);
-    if (applied && mode !== 'stop-and-delete') throw new HarborError('PROFILE_IN_USE');
-
-    const previousConfig = dependencies.config.read();
-    const previousGatewayAuto = dependencies.gatewayAuto.read();
-    const removesAppliedTarget = previousState.appliedProfileId === profile.id || failoverReferencesProfile;
-    let runtimeMutationStarted = false;
-    let configMutationStarted = false;
-    let gatewayMutationStarted = false;
-    let stateCommitStarted = false;
-
-    try {
-      if (applied) {
-        runtimeMutationStarted = true;
-        await dependencies.runtime.stop();
-      }
-      if (removesAppliedTarget) {
-        configMutationStarted = true;
-        dependencies.config.remove();
-      }
-      if (
-        previousState.desiredProfileId === profile.id
-        && !(running && previousState.appliedProfileId !== profile.id)
-      ) {
-        gatewayMutationStarted = true;
-        dependencies.gatewayAuto.set(dependencies.gatewayAuto.createInitial());
-      }
-      stateCommitStarted = true;
-      dependencies.state.update((current) => ({
-        ...current,
-        profiles: current.profiles.filter((candidate) => candidate.id !== profile.id),
-        desiredProfileId: current.desiredProfileId === profile.id ? '' : current.desiredProfileId,
-        appliedProfileId: current.appliedProfileId === profile.id ? '' : current.appliedProfileId,
-        appliedServerId: current.appliedProfileId === profile.id ? '' : current.appliedServerId,
-        appliedServerSnapshot: current.appliedProfileId === profile.id
-          ? null
-          : current.appliedServerSnapshot,
-        ...(removesAppliedTarget ? {
-          connectionDesired: 'stopped',
-          appliedProfileId: '',
-          appliedServerId: '',
-          appliedServerSnapshot: null,
-          appliedFailoverPolicy: null,
-        } : {}),
-        ...(failoverReferencesProfile || desiredFailoverReferencesProfile ? {
-          failoverPolicy: {
-            ...current.failoverPolicy,
-            enabled: false,
-            paused: false,
-            primary: current.failoverPolicy.primary.profileId === profile.id
-              ? { profileId: '', serverId: '' }
-              : current.failoverPolicy.primary,
-            reserve: current.failoverPolicy.reserve.profileId === profile.id
-              ? { profileId: '', serverId: '' }
-              : current.failoverPolicy.reserve,
-          },
-        } : {}),
-      }));
-    } catch (error) {
-      await finishRollback(error, [
-        ...(stateCommitStarted ? [{ run: () => dependencies.state.update(() => previousState) }] : []),
-        ...(gatewayMutationStarted ? [{ run: () => dependencies.gatewayAuto.set(previousGatewayAuto) }] : []),
-        ...(configMutationStarted ? [{ run: () => restoreConfig(previousConfig) }] : []),
-        ...(runtimeMutationStarted ? [{
-          run: async () => {
-            await dependencies.runtime.start();
-            await dependencies.failover?.restoreAppliedActivation(previousState);
-          },
-          runtime: true,
-        }] : []),
-      ], 'Subscription delete rollback failed');
-    }
-    await dependencies.failover?.reconcile();
-    dependencies.onEvent?.({
-      type: 'subscription.deleted',
-      severity: 'info',
-      source: 'subscription',
-      dedupeKey: `subscription.deleted:${dependencies.state.read().revision}`,
-      data: { profileId: profile.id, profileLabel: profile.label },
-    });
-    return mutationResult(profile);
-  });
-
-  // One-release compatibility for the old single-subscription client.
-  const importSubscription = (subscriptionUrl: string, expectedRevision?: unknown) => {
-    const state = dependencies.state.read();
-    if (state.profiles.length) throw new HarborError('STATE_CONFLICT');
-    return addProfile('Основной', subscriptionUrl, expectedRevision);
-  };
-
-  const refreshSavedSubscription = (expectedRevision?: unknown) => {
-    const state = dependencies.state.read();
-    if (state.profiles.length !== 1) throw new HarborError('STATE_CONFLICT');
-    return refreshProfile(state.profiles[0].id, expectedRevision);
-  };
-
-  const resetSavedSubscription = ({
-    stopRuntime = true,
-    expectedRevision,
-  }: { stopRuntime?: boolean; expectedRevision?: unknown } = {}) => {
-    const state = dependencies.state.read();
-    if (!state.profiles.length) return Promise.resolve(false);
-    if (state.profiles.length !== 1) throw new HarborError('STATE_CONFLICT');
-    return deleteProfile(
-      state.profiles[0].id,
-      stopRuntime ? 'stop-and-delete' : 'delete',
-      expectedRevision,
-    ).then(() => true);
-  };
-
-  const startAutoRefresh = (intervalMs: number) => {
-    if (refreshTimer) return;
-    refreshTimer = dependencies.scheduler.setInterval(() => {
-      void (async () => {
-        for (const { id } of dependencies.state.read().profiles) {
-          try {
-            await refreshProfile(id, undefined, 'scheduled');
-          } catch (error) {
-            dependencies.onRefreshError(error);
-          }
-        }
-      })();
-    }, intervalMs);
-    refreshTimer.unref();
-  };
-
-  const stopAutoRefresh = () => {
-    if (!refreshTimer) return;
-    dependencies.scheduler.clearInterval(refreshTimer);
-    refreshTimer = null;
-  };
-
-  return {
-    preflightAddProfile,
-    preflightRenameProfile,
-    addProfile,
-    renameProfile,
-    selectProfileServer,
-    refreshProfile,
-    deleteProfile,
-    importSubscription,
-    refreshSavedSubscription,
-    resetSavedSubscription,
-    startAutoRefresh,
-    stopAutoRefresh,
-  };
-}
-
-export type SubscriptionService = ReturnType<typeof createSubscriptionService>;

src/server/features/subscription/validateSubscription.ts

@@ -1,14 +0,0 @@
-interface SubscriptionResult {
-  servers: unknown[];
-}
-
-type FetchSubscription = (url: string) => Promise<SubscriptionResult>;
-
-export function createValidateSubscription(fetchSubscription: FetchSubscription) {
-  return async (url: unknown) => {
-    const parsed = await fetchSubscription(String(url).trim());
-    return { servers: parsed.servers.length };
-  };
-}
-
-export type ValidateSubscription = ReturnType<typeof createValidateSubscription>;

src/server/gatewayNativeRuntime.ts

@@ -1,163 +0,0 @@
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-
-interface MaterializeOptions {
-  apiPort: number;
-  secretPath: string;
-  runtimeConfigPath: string;
-}
-
-function record(value: unknown): Record<string, unknown> {
-  return value && typeof value === 'object' && !Array.isArray(value)
-    ? value as Record<string, unknown>
-    : {};
-}
-
-function message(error: unknown) {
-  return error instanceof Error ? error.message : String(error);
-}
-
-function privateWrite(filePath: string, value: unknown) {
-  fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
-  const temporaryPath = `${filePath}.${process.pid}.${crypto.randomBytes(8).toString('hex')}.tmp`;
-  let descriptor: number | null = null;
-  try {
-    descriptor = fs.openSync(
-      temporaryPath,
-      fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW,
-      0o600,
-    );
-    fs.writeFileSync(descriptor, JSON.stringify(value));
-    fs.fchmodSync(descriptor, 0o600);
-    fs.fsyncSync(descriptor);
-    fs.closeSync(descriptor);
-    descriptor = null;
-    fs.renameSync(temporaryPath, filePath);
-    fs.chmodSync(filePath, 0o600);
-    const status = fs.lstatSync(filePath);
-    if (!status.isFile() || status.isSymbolicLink() || (status.mode & 0o777) !== 0o600) {
-      throw new Error('private runtime config is not a regular 0600 file');
-    }
-  } finally {
-    if (descriptor !== null) fs.closeSync(descriptor);
-    fs.rmSync(temporaryPath, { force: true });
-  }
-}
-
-function openSecret(secretPath: string) {
-  const readFlags = fs.constants.O_RDWR | fs.constants.O_NOFOLLOW;
-  try {
-    return { descriptor: fs.openSync(secretPath, readFlags), created: false };
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
-  }
-
-  try {
-    return {
-      descriptor: fs.openSync(
-        secretPath,
-        readFlags | fs.constants.O_CREAT | fs.constants.O_EXCL,
-        0o600,
-      ),
-      created: true,
-    };
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
-    return { descriptor: fs.openSync(secretPath, readFlags), created: false };
-  }
-}
-
-export function ensureGatewayNativeApiSecret(secretPath: string) {
-  fs.mkdirSync(path.dirname(secretPath), { recursive: true, mode: 0o700 });
-  const { descriptor, created } = openSecret(secretPath);
-  try {
-    const secret = created
-      ? crypto.randomBytes(32).toString('hex')
-      : fs.readFileSync(descriptor, 'utf8');
-    if (created) {
-      fs.writeFileSync(descriptor, secret);
-      fs.fsyncSync(descriptor);
-    }
-    if (!/^[0-9a-f]{64}$/.test(secret)) {
-      throw new Error('native API secret must contain exactly 64 lowercase hex characters');
-    }
-    fs.fchmodSync(descriptor, 0o600);
-    const opened = fs.fstatSync(descriptor);
-    const linked = fs.lstatSync(secretPath);
-    if (!opened.isFile() || linked.isSymbolicLink() || !linked.isFile()
-      || opened.dev !== linked.dev || opened.ino !== linked.ino
-      || (opened.mode & 0o777) !== 0o600 || (linked.mode & 0o777) !== 0o600) {
-      throw new Error('native API secret is not a regular 0600 file');
-    }
-    return secret;
-  } finally {
-    fs.closeSync(descriptor);
-  }
-}
-
-function withoutApiServices(config: unknown) {
-  const safe = structuredClone(record(config));
-  const services = Array.isArray(safe.services)
-    ? safe.services.filter((service) => record(service).type !== 'api')
-    : [];
-  if (services.length) safe.services = services;
-  else delete safe.services;
-  return safe;
-}
-
-export function materializeGatewaySnapshotConfig(config: unknown, runtimeConfigPath: string) {
-  privateWrite(runtimeConfigPath, withoutApiServices(config));
-  return { configPath: runtimeConfigPath, secret: null, warning: null };
-}
-
-function withAuthenticatedApi(config: unknown, secret: string) {
-  const materialized = structuredClone(record(config));
-  const services = Array.isArray(materialized.services) ? materialized.services : [];
-  materialized.services = services.map((service) => (
-    record(service).type === 'api'
-      ? { ...record(service), secret }
-      : service
-  ));
-  return materialized;
-}
-
-function validateApiService(config: unknown, apiPort: number) {
-  const configuredServices = record(config).services;
-  const services = Array.isArray(configuredServices) ? configuredServices : [];
-  const apiServices = services.map(record).filter(({ type }) => type === 'api');
-  if (apiServices.length !== 1) throw new Error('expected exactly one native API service');
-  const [service] = apiServices;
-  if (service.listen !== '127.0.0.1' || service.listen_port !== apiPort
-    || service.dashboard !== false || Object.hasOwn(service, 'secret')) {
-    throw new Error(`native API service must be unauthenticated base config on 127.0.0.1:${apiPort}`);
-  }
-}
-
-export function materializeGatewayNativeConfig(
-  config: unknown,
-  { apiPort, secretPath, runtimeConfigPath }: MaterializeOptions,
-) {
-  let warning: string | null = null;
-  try {
-    validateApiService(config, apiPort);
-    const secret = ensureGatewayNativeApiSecret(secretPath);
-    privateWrite(runtimeConfigPath, withAuthenticatedApi(config, secret));
-    return { configPath: runtimeConfigPath, secret, warning };
-  } catch (error) {
-    warning = `Native traffic API disabled: ${message(error)}`;
-  }
-
-  const safeConfig = withoutApiServices(config);
-  try {
-    privateWrite(runtimeConfigPath, safeConfig);
-    return { configPath: runtimeConfigPath, secret: null, warning };
-  } catch (error) {
-    warning = `${warning}; private runtime config unavailable: ${message(error)}`;
-    const suffix = crypto.createHash('sha256').update(runtimeConfigPath).digest('hex').slice(0, 12);
-    const fallbackPath = path.join(os.tmpdir(), `harbor-singbox-runtime-${process.pid}-${suffix}.json`);
-    privateWrite(fallbackPath, safeConfig);
-    return { configPath: fallbackPath, secret: null, warning };
-  }
-}

src/server/gatewayPresence.ts

@@ -1,278 +0,0 @@
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import { HarborError } from '../shared/errors.js';
-
-const NONCE_RE = /^[a-f0-9]{32}$/;
-const PROOF_RE = /^[a-f0-9]{64}$/;
-const INTERFACE_RE = /^[a-zA-Z0-9._-]{1,32}$/;
-const MAC_RE = /^[a-f0-9]{2}(?::[a-f0-9]{2}){5}$/i;
-const SECRET_QUERY_KEYS = new Set(['access_token', 'auth', 'key', 'secret', 'token', 'uuid']);
-
-interface GatewayRoute {
-  gateway: string;
-  interface: string;
-  mac: string;
-  observedAt?: number;
-}
-
-interface VerifiedGateway {
-  gatewayId: string;
-  uiOrigin?: string;
-  verifiedAt?: string;
-}
-
-export interface GatewayAutoRuntimeState {
-  mode: 'local-vpn' | 'gateway-direct';
-  failures: number;
-  gateway: GatewayRoute | null;
-  gatewayId: string;
-  uiOrigin: string;
-  lastVerifiedAt: string | null;
-  lastError: string;
-}
-
-function record(value: unknown): Record<string, unknown> {
-  return value && typeof value === 'object' && !Array.isArray(value)
-    ? value as Record<string, unknown>
-    : {};
-}
-
-function isIpv4(value: unknown) {
-  const parts = String(value || '').split('.');
-  return parts.length === 4 && parts.every((part) => (
-    /^\d{1,3}$/.test(part) && Number(part) >= 0 && Number(part) <= 255
-  ));
-}
-
-function subscriptionSecret(subscriptionUrl: unknown) {
-  try {
-    const url = new URL(String(subscriptionUrl || '').trim());
-    const pathSegments = url.pathname.split('/').filter(Boolean);
-    const candidates = [
-      url.username,
-      url.password,
-      ...[...url.searchParams.entries()]
-        .filter(([key]) => SECRET_QUERY_KEYS.has(key.toLowerCase()))
-        .map(([, value]) => value),
-      pathSegments.at(-1),
-    ]
-      .map((value) => String(value || '').trim())
-      .filter((value) => value.length >= 16);
-    if (!candidates.length) return '';
-
-    url.hash = '';
-    url.searchParams.sort();
-    return url.toString();
-  } catch {
-    return '';
-  }
-}
-
-function presenceProof(subscriptionUrl: unknown, nonce: unknown, gatewayId: unknown) {
-  const credentialUrl = subscriptionSecret(subscriptionUrl);
-  if (!credentialUrl) return '';
-  const key = crypto.createHash('sha256')
-    .update(`harbor-gateway-presence-key\n${credentialUrl}`)
-    .digest();
-  return crypto.createHmac('sha256', key)
-    .update(`v1\n${nonce}\n${gatewayId}`)
-    .digest('hex');
-}
-
-export function buildGatewayPresence({ appMode, subscriptionUrl, gatewayId, nonce }: {
-  appMode: unknown;
-  subscriptionUrl: unknown;
-  gatewayId: unknown;
-  nonce: unknown;
-}) {
-  if (!NONCE_RE.test(String(nonce || ''))) {
-    throw new HarborError('REQUEST_INVALID');
-  }
-
-  const subscription = String(subscriptionUrl || '').trim();
-  const id = String(gatewayId || '').trim();
-  if (appMode !== 'gateway' || !subscriptionSecret(subscription) || !id) {
-    return {
-      success: true,
-      available: false,
-      product: 'harbor',
-      role: appMode,
-      protocolVersion: 1,
-    };
-  }
-
-  return {
-    success: true,
-    available: true,
-    product: 'harbor',
-    role: 'gateway',
-    protocolVersion: 1,
-    gatewayId: id,
-    transparentRouting: true,
-    proof: presenceProof(subscription, nonce, id),
-  };
-}
-
-export function verifyGatewayPresence(
-  value: unknown,
-  { subscriptionUrl, nonce }: { subscriptionUrl: unknown; nonce: unknown },
-) {
-  const payload = record(value);
-  if (
-    payload?.available !== true ||
-    payload?.product !== 'harbor' ||
-    payload?.role !== 'gateway' ||
-    payload?.protocolVersion !== 1 ||
-    payload?.transparentRouting !== true ||
-    !payload.gatewayId ||
-    !NONCE_RE.test(String(nonce || '')) ||
-    !PROOF_RE.test(String(payload.proof || ''))
-  ) return false;
-
-  const actual = Buffer.from(String(payload.proof), 'hex');
-  const expectedProof = presenceProof(subscriptionUrl, nonce, String(payload.gatewayId));
-  if (!expectedProof) return false;
-  const expected = Buffer.from(expectedProof, 'hex');
-  return crypto.timingSafeEqual(actual, expected);
-}
-
-export async function probeGatewayPresence({
-  gateway,
-  subscriptionUrl,
-  port = 3456,
-  fetchImpl = fetch,
-  timeoutMs = 1000,
-  nonce = crypto.randomBytes(16).toString('hex'),
-}: {
-  gateway: string;
-  subscriptionUrl: unknown;
-  port?: number;
-  fetchImpl?: typeof fetch;
-  timeoutMs?: number;
-  nonce?: string;
-}): Promise<VerifiedGateway> {
-  if (!isIpv4(gateway)) throw new Error('Некорректный адрес default gateway');
-
-  const presenceUrl = `http://${gateway}:${port}/api/gateway-presence?nonce=${nonce}`;
-  const response = await fetchImpl(
-    presenceUrl,
-    { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(timeoutMs) },
-  );
-  const payload = record(await response.json().catch(() => ({})));
-  if (!response.ok || !verifyGatewayPresence(payload, { subscriptionUrl, nonce })) {
-    throw new Error('Текущий default gateway не является доверенным Harbor Gateway');
-  }
-
-  return {
-    gatewayId: String(payload.gatewayId),
-    uiOrigin: new URL(presenceUrl).origin,
-    verifiedAt: new Date().toISOString(),
-  };
-}
-
-export function normalizeHostNetworkState(value: unknown, {
-  now = Date.now(),
-  maxAgeMs = 15_000,
-}: { now?: number; maxAgeMs?: number } = {}): GatewayRoute | null {
-  const candidate = record(value);
-  const gateway = String(candidate.gateway || '').trim();
-  const networkInterface = String(candidate.interface || '').trim();
-  const mac = String(candidate.mac || '').trim().toLowerCase();
-  const observedAt = Date.parse(String(candidate.observedAt || ''));
-
-  // ponytail: IPv4-only matches the current Gateway; add IPv6 when its TProxy path supports it.
-  if (
-    !isIpv4(gateway) ||
-    !INTERFACE_RE.test(networkInterface) ||
-    !MAC_RE.test(mac) ||
-    !Number.isFinite(observedAt) ||
-    observedAt > now + 5_000 ||
-    now - observedAt > maxAgeMs
-  ) return null;
-
-  return { gateway, interface: networkInterface, mac, observedAt };
-}
-
-export function readHostNetworkState(filePath: string, options?: { now?: number; maxAgeMs?: number }) {
-  try {
-    return normalizeHostNetworkState(
-      JSON.parse(fs.readFileSync(filePath, 'utf8')),
-      options,
-    );
-  } catch {
-    return null;
-  }
-}
-
-export function sameGatewayRoute(previous: GatewayRoute | null, current: GatewayRoute | null) {
-  return Boolean(
-    previous &&
-    current &&
-    previous.gateway === current.gateway &&
-    previous.interface === current.interface &&
-    previous.mac === current.mac,
-  );
-}
-
-export function createGatewayAutoState(): GatewayAutoRuntimeState {
-  return {
-    mode: 'local-vpn',
-    failures: 0,
-    gateway: null,
-    gatewayId: '',
-    uiOrigin: '',
-    lastVerifiedAt: null,
-    lastError: '',
-  };
-}
-
-export function applyGatewayPreference(state: GatewayAutoRuntimeState, enabled: boolean): GatewayAutoRuntimeState {
-  return {
-    ...state,
-    mode: enabled && state.gatewayId ? 'gateway-direct' : 'local-vpn',
-  };
-}
-
-export function nextGatewayAutoState(current: GatewayAutoRuntimeState, {
-  network,
-  verifiedGateway = null,
-  error = 'Gateway presence check failed',
-}: {
-  network: GatewayRoute | null;
-  verifiedGateway?: VerifiedGateway | null;
-  error?: unknown;
-}): GatewayAutoRuntimeState {
-  if (!network) {
-    if (!current.gatewayId) return createGatewayAutoState();
-    return {
-      ...current,
-      failures: current.failures + 1,
-      lastError: String(error || 'Gateway presence check failed'),
-    };
-  }
-
-  const routeChanged = !sameGatewayRoute(current.gateway, network);
-  const base = routeChanged
-    ? { ...createGatewayAutoState(), gateway: network }
-    : { ...current, gateway: network };
-
-  if (verifiedGateway?.gatewayId) {
-    return {
-      ...base,
-      mode: 'gateway-direct',
-      failures: 0,
-      gatewayId: verifiedGateway.gatewayId,
-      uiOrigin: verifiedGateway.uiOrigin || '',
-      lastVerifiedAt: verifiedGateway.verifiedAt || new Date().toISOString(),
-      lastError: '',
-    };
-  }
-
-  const failures = base.failures + 1;
-  return {
-    ...base,
-    mode: base.gatewayId ? 'gateway-direct' : 'local-vpn',
-    failures,
-    lastError: String(error || 'Gateway presence check failed'),
-  };
-}

src/server/gatewayRouting.ts

@@ -1,33 +0,0 @@
-import { spawnSync } from 'node:child_process';
-
-const options = { encoding: 'utf8' as const };
-const CHAIN_PATTERN = /^[a-z0-9_-]{1,28}$/i;
-
-export function setGatewayInterception(enabled: boolean, chain: string, run: typeof spawnSync = spawnSync) {
-  if (!CHAIN_PATTERN.test(chain)) throw new Error('Некорректная TProxy chain');
-  const rule = ['-w', '-t', 'mangle', 'PREROUTING', '-j', chain];
-  const exists = run('iptables', [...rule.slice(0, 3), '-C', ...rule.slice(3)], options).status === 0;
-
-  if (!enabled) {
-    if (exists) run('iptables', [...rule.slice(0, 3), '-D', ...rule.slice(3)], options);
-    return;
-  }
-  if (exists) {
-    const input = `*mangle\n-D PREROUTING -j ${chain}\n-I PREROUTING 1 -j ${chain}\nCOMMIT\n`;
-    const result = run('iptables-restore', ['-w', '--noflush'], { ...options, input });
-    if (result.status !== 0) {
-      // The transaction keeps the already-working jump intact; leave routing up.
-      return;
-    }
-    return;
-  }
-
-  const result = run(
-    'iptables',
-    [...rule.slice(0, 3), '-I', 'PREROUTING', '1', '-j', chain],
-    options,
-  );
-  if (result.status !== 0) {
-    throw new Error((result.stderr || 'Не удалось включить Gateway VPN').trim());
-  }
-}

src/server/http/response.ts

@@ -1,37 +0,0 @@
-import crypto from 'node:crypto';
-import type { ServerResponse } from 'node:http';
-
-import { normalizeHarborError } from '../../shared/errors.js';
-
-export function sendJson(res: ServerResponse, statusCode: number, payload: unknown) {
-  res.writeHead(statusCode, { 'content-type': 'application/json; charset=utf-8' });
-  res.end(JSON.stringify(payload));
-}
-
-function redactLogDetails(value: unknown) {
-  return String(value || '').replace(/https?:\/\/\S+/gi, '[redacted-url]');
-}
-
-export function sendError(res: ServerResponse, error: unknown) {
-  const harborError = normalizeHarborError(error);
-  const correlationId = crypto.randomUUID();
-  const technical = harborError.cause instanceof Error
-    ? harborError.cause.message
-    : harborError.details || error;
-  const technicalMessage = technical instanceof Error
-    ? technical.message
-    : technical;
-  console.error(
-    `[control] request failed [${correlationId}] ${harborError.code}: ${redactLogDetails(technicalMessage)}`,
-  );
-  return sendJson(res, harborError.status, {
-    success: false,
-    error: {
-      code: harborError.code,
-      message: harborError.message,
-      retryable: harborError.retryable,
-      correlationId,
-      ...(harborError.details ? { details: harborError.details } : {}),
-    },
-  });
-}

src/server/http/routes/activityJournalRoute.ts

@@ -1,17 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { ActivityJournalService } from '../../services/activityJournalService.js';
-import { sendJson } from '../response.js';
-
-export function createActivityJournalRoute({ journal }: { journal: ActivityJournalService }) {
-  return {
-    async handle(req: IncomingMessage, res: ServerResponse) {
-      const url = new URL(req.url || '/', 'http://localhost');
-      if (url.pathname !== '/api/activity-journal' || req.method !== 'GET') return false;
-      sendJson(res, 200, journal.page(
-        Number(url.searchParams.get('limit')) || 50,
-        url.searchParams.get('cursor'),
-      ));
-      return true;
-    },
-  };
-}

src/server/http/routes/connectionRuntimeRoute.ts

@@ -1,27 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-
-import type { ConnectionService } from '../../features/connection/index.js';
-
-interface ConnectionRuntimeRouteDependencies {
-  connection: Pick<ConnectionService, 'stop' | 'restart'>;
-  withOperation<T>(kind: string, operation: () => Promise<T>): Promise<T>;
-  sendState(res: ServerResponse, extra: { singboxRunning: boolean }): Promise<void>;
-}
-
-export function createConnectionRuntimeRoute(dependencies: ConnectionRuntimeRouteDependencies) {
-  return {
-    async handle(req: IncomingMessage, res: ServerResponse) {
-      if (req.method === 'POST' && req.url === '/api/singbox/stop') {
-        await dependencies.withOperation('stop', () => dependencies.connection.stop());
-        await dependencies.sendState(res, { singboxRunning: false });
-        return true;
-      }
-      if (req.method === 'POST' && req.url === '/api/singbox/restart') {
-        await dependencies.withOperation('start', () => dependencies.connection.restart());
-        await dependencies.sendState(res, { singboxRunning: true });
-        return true;
-      }
-      return false;
-    },
-  };
-}

src/server/http/routes/connectivityDiagnosticsRoute.ts

@@ -1,41 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-
-import type { ConnectivityDiagnosticsUseCase } from '../../features/diagnostics/index.js';
-import { sendJson } from '../response.js';
-
-interface ConnectivityDiagnosticsRouteDependencies {
-  diagnostics: Pick<ConnectivityDiagnosticsUseCase, 'run' | 'dnsCatalog' | 'runDns' | 'updateSettings'>;
-  readBody(req: IncomingMessage): Promise<Record<string, unknown>>;
-  sendState(res: ServerResponse): Promise<void>;
-}
-
-export function createConnectivityDiagnosticsRoute(
-  dependencies: ConnectivityDiagnosticsRouteDependencies,
-) {
-  return {
-    async handle(req: IncomingMessage, res: ServerResponse) {
-      if (req.url === '/api/diagnostics/dns' && req.method === 'GET') {
-        sendJson(res, 200, await dependencies.diagnostics.dnsCatalog());
-        return true;
-      }
-      if (req.url === '/api/diagnostics/dns' && req.method === 'POST') {
-        const { domainId, resolverId = null } = await dependencies.readBody(req);
-        sendJson(res, 200, await dependencies.diagnostics.runDns(domainId, resolverId));
-        return true;
-      }
-      if (req.url === '/api/diagnostics/connectivity' && req.method === 'POST') {
-        const { target = null } = await dependencies.readBody(req);
-        const result = await dependencies.diagnostics.run(target);
-        sendJson(res, 200, result);
-        return true;
-      }
-      if (req.url === '/api/diagnostics/settings' && req.method === 'PUT') {
-        const { settings, expectedRevision } = await dependencies.readBody(req);
-        dependencies.diagnostics.updateSettings(settings, expectedRevision);
-        await dependencies.sendState(res);
-        return true;
-      }
-      return false;
-    },
-  };
-}

src/server/http/routes/deviceInventoryRoute.ts

@@ -1,120 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-
-import { HarborError } from '../../../shared/errors.js';
-import { sendJson } from '../response.js';
-
-interface DeviceInventoryPort {
-  snapshot(): unknown;
-  refresh(): Promise<unknown>;
-  update(deviceId: string, patch: Record<string, unknown>, expectedRevision: unknown): unknown;
-  createTag(name: unknown, expectedRevision: unknown): unknown;
-  renameTag(tagId: string, name: unknown, expectedRevision: unknown): unknown;
-  deleteTag(tagId: string, expectedRevision: unknown): unknown;
-  resetTraffic(expectedRevision: unknown): Promise<unknown>;
-  setPolicy(deviceId: string, mode: unknown, expectedRevision: unknown): Promise<unknown>;
-}
-
-interface DeviceInventoryRouteDependencies {
-  deviceInventory: DeviceInventoryPort | null;
-  readBody(req: IncomingMessage): Promise<Record<string, unknown>>;
-}
-
-const DEVICE_PATH = /^\/api\/devices\/(dev_[a-f0-9]{16})$/;
-const DEVICE_POLICY_PATH = /^\/api\/devices\/(dev_[a-f0-9]{16})\/policy$/;
-const DEVICE_TAG_PATH = /^\/api\/device-tags\/(tag_[a-f0-9]{16})$/;
-
-export function createDeviceInventoryRoute(dependencies: DeviceInventoryRouteDependencies) {
-  return {
-    async handle(req: IncomingMessage, res: ServerResponse) {
-      const pathname = new URL(req.url || '/', 'http://localhost').pathname;
-
-      if (pathname === '/api/devices') {
-        if (!dependencies.deviceInventory || req.method !== 'GET') {
-          throw new HarborError('ENDPOINT_NOT_FOUND');
-        }
-        sendJson(res, 200, dependencies.deviceInventory.snapshot());
-        return true;
-      }
-
-      if (pathname === '/api/devices/refresh') {
-        if (!dependencies.deviceInventory || req.method !== 'POST') {
-          throw new HarborError('ENDPOINT_NOT_FOUND');
-        }
-        sendJson(res, 200, await dependencies.deviceInventory.refresh());
-        return true;
-      }
-
-      if (pathname === '/api/devices/traffic') {
-        if (!dependencies.deviceInventory || req.method !== 'DELETE') {
-          throw new HarborError('ENDPOINT_NOT_FOUND');
-        }
-        const body = await dependencies.readBody(req);
-        sendJson(res, 200, await dependencies.deviceInventory.resetTraffic(body.expectedRevision));
-        return true;
-      }
-
-      if (pathname === '/api/device-tags') {
-        if (!dependencies.deviceInventory || req.method !== 'POST') {
-          throw new HarborError('ENDPOINT_NOT_FOUND');
-        }
-        const body = await dependencies.readBody(req);
-        sendJson(
-          res,
-          200,
-          dependencies.deviceInventory.createTag(body.name, body.expectedRevision),
-        );
-        return true;
-      }
-
-      const tagMatch = pathname.match(DEVICE_TAG_PATH);
-      if (tagMatch) {
-        if (!dependencies.deviceInventory || !['PUT', 'DELETE'].includes(req.method || '')) {
-          throw new HarborError('ENDPOINT_NOT_FOUND');
-        }
-        const body = await dependencies.readBody(req);
-        sendJson(
-          res,
-          200,
-          req.method === 'PUT'
-            ? dependencies.deviceInventory.renameTag(tagMatch[1], body.name, body.expectedRevision)
-            : dependencies.deviceInventory.deleteTag(tagMatch[1], body.expectedRevision),
-        );
-        return true;
-      }
-
-      const deviceMatch = pathname.match(DEVICE_PATH);
-      if (deviceMatch) {
-        if (!dependencies.deviceInventory || req.method !== 'PUT') {
-          throw new HarborError('ENDPOINT_NOT_FOUND');
-        }
-        const { expectedRevision, ...patch } = await dependencies.readBody(req);
-        sendJson(
-          res,
-          200,
-          dependencies.deviceInventory.update(deviceMatch[1], patch, expectedRevision),
-        );
-        return true;
-      }
-
-      const policyMatch = pathname.match(DEVICE_POLICY_PATH);
-      if (policyMatch) {
-        if (!dependencies.deviceInventory || req.method !== 'PUT') {
-          throw new HarborError('ENDPOINT_NOT_FOUND');
-        }
-        const body = await dependencies.readBody(req);
-        sendJson(
-          res,
-          200,
-          await dependencies.deviceInventory.setPolicy(
-            policyMatch[1],
-            body.mode,
-            body.expectedRevision,
-          ),
-        );
-        return true;
-      }
-
-      return false;
-    },
-  };
-}

src/server/http/routes/failoverRoute.ts

@@ -1,49 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { FailoverService } from '../../features/failover/failoverService.js';
-import { HarborError } from '../../../shared/errors.js';
-
-interface FailoverRouteDependencies {
-  appMode: string;
-  failover: Pick<FailoverService, 'save' | 'pause' | 'manualSwitch' | 'checkNow'>;
-  readBody(req: IncomingMessage): Promise<Record<string, unknown>>;
-  withOperation<T>(kind: string, operation: () => Promise<T>, options?: { expectedRevision?: unknown }): Promise<T>;
-  sendState(res: ServerResponse): Promise<void>;
-}
-
-export function createFailoverRoute(dependencies: FailoverRouteDependencies) {
-  return {
-    async handle(req: IncomingMessage, res: ServerResponse) {
-      const pathname = new URL(req.url || '/', 'http://localhost').pathname;
-      if (!pathname.startsWith('/api/failover')) return false;
-      if (dependencies.appMode !== 'gateway') throw new HarborError('ENDPOINT_NOT_FOUND');
-      const body = await dependencies.readBody(req);
-      if (pathname === '/api/failover' && req.method === 'PUT') {
-        await dependencies.withOperation(
-          'failover-save',
-          () => dependencies.failover.save(body.policy),
-          { expectedRevision: body.expectedRevision },
-        );
-      } else if (pathname === '/api/failover/pause' && req.method === 'POST') {
-        if (typeof body.paused !== 'boolean') throw new HarborError('REQUEST_INVALID');
-        await dependencies.withOperation(
-          body.paused ? 'failover-pause' : 'failover-resume',
-          () => dependencies.failover.pause(body.paused as boolean),
-          { expectedRevision: body.expectedRevision },
-        );
-      } else if (pathname === '/api/failover/switch' && req.method === 'POST') {
-        if (body.role !== 'primary' && body.role !== 'reserve') throw new HarborError('REQUEST_INVALID');
-        await dependencies.withOperation(
-          'failover-switch',
-          () => dependencies.failover.manualSwitch(body.role as 'primary' | 'reserve'),
-          { expectedRevision: body.expectedRevision },
-        );
-      } else if (pathname === '/api/failover/check' && req.method === 'POST') {
-        await dependencies.failover.checkNow();
-      } else {
-        throw new HarborError('ENDPOINT_NOT_FOUND');
-      }
-      await dependencies.sendState(res);
-      return true;
-    },
-  };
-}

src/server/http/routes/gatewayAutoRoute.ts

@@ -1,32 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-
-import type { GatewayAutoService } from '../../features/routing/index.js';
-import { HarborError } from '../../../shared/errors.js';
-import { sendJson } from '../response.js';
-
-interface GatewayAutoRouteDependencies {
-  appMode: string;
-  gatewayAuto: Pick<GatewayAutoService, 'setEnabled'>;
-  readBody(req: IncomingMessage): Promise<Record<string, unknown>>;
-  withOperation<T>(kind: string, operation: () => Promise<T>): Promise<T>;
-  readStatePayload(): Promise<Record<string, unknown> & { gatewayAuto?: unknown }>;
-}
-
-export function createGatewayAutoRoute(dependencies: GatewayAutoRouteDependencies) {
-  return {
-    async handle(req: IncomingMessage, res: ServerResponse) {
-      if (req.method !== 'POST' || req.url !== '/api/gateway-auto') return false;
-      if (dependencies.appMode !== 'client') throw new HarborError('REQUEST_INVALID');
-      const { enabled } = await dependencies.readBody(req);
-      if (typeof enabled !== 'boolean') throw new HarborError('REQUEST_INVALID');
-
-      await dependencies.withOperation(
-        'gateway-auto',
-        () => dependencies.gatewayAuto.setEnabled(enabled),
-      );
-      const state = await dependencies.readStatePayload();
-      sendJson(res, 200, { success: true, gatewayAuto: state.gatewayAuto, state });
-      return true;
-    },
-  };
-}

src/server/http/routes/gatewayPresenceRoute.ts

@@ -1,33 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-
-import { buildGatewayPresence } from '../../gatewayPresence.js';
-import { sendJson } from '../response.js';
-
-interface GatewayPresenceState {
-  subscriptionUrl?: unknown;
-}
-
-interface GatewayPresenceRouteDependencies {
-  appMode: string;
-  readState(): GatewayPresenceState;
-  getHwid(): unknown;
-}
-
-export function createGatewayPresenceRoute(dependencies: GatewayPresenceRouteDependencies) {
-  return {
-    async handle(req: IncomingMessage, res: ServerResponse) {
-      const requestUrl = new URL(req.url || '/', 'http://localhost');
-      if (req.method !== 'GET' || requestUrl.pathname !== '/api/gateway-presence') return false;
-
-      const state = dependencies.readState();
-      const gatewayId = dependencies.getHwid();
-      sendJson(res, 200, buildGatewayPresence({
-        appMode: dependencies.appMode,
-        subscriptionUrl: state.subscriptionUrl,
-        gatewayId,
-        nonce: requestUrl.searchParams.get('nonce'),
-      }));
-      return true;
-    },
-  };
-}

src/server/http/routes/liveTrafficRoute.ts

@@ -1,115 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { isDeepStrictEqual } from 'node:util';
-
-import {
-  assertLiveTrafficSnapshot,
-  type LiveTrafficSnapshot,
-} from '../../../shared/liveTraffic.js';
-import type { StoredState } from '../../../shared/contracts/state.js';
-import { HarborError } from '../../../shared/errors.js';
-import {
-  normalizeTrafficSettings,
-  type TrafficSettings,
-} from '../../../shared/trafficSettings.js';
-import { sendJson } from '../response.js';
-
-interface LiveTrafficReader {
-  snapshot(): unknown | Promise<unknown>;
-}
-
-interface DeviceInventoryReader {
-  snapshot(): unknown;
-}
-
-interface TrafficSettingsState {
-  read(): { revision?: unknown; traffic?: TrafficSettings };
-  update(mutator: (state: StoredState) => Record<string, unknown>): unknown;
-}
-
-function record(value: unknown): Record<string, unknown> {
-  return value && typeof value === 'object' && !Array.isArray(value)
-    ? value as Record<string, unknown>
-    : {};
-}
-
-export function enrichLiveTrafficDeviceLabels(
-  snapshot: LiveTrafficSnapshot,
-  inventory: unknown,
-): LiveTrafficSnapshot {
-  const devices = Array.isArray(record(inventory).devices)
-    ? (record(inventory).devices as unknown[]).map(record)
-    : [];
-  const labels = new Map(devices.flatMap((device) => {
-    const id = String(device.id || '');
-    if (!/^dev_[a-f0-9]{16}$/.test(id)) return [];
-    const label = [device.alias, device.hostname, device.ip]
-      .find((value) => typeof value === 'string' && value.trim());
-    return label ? [[id, String(label).trim()] as const] : [];
-  }));
-  if (!labels.size) return snapshot;
-  return {
-    ...snapshot,
-    connections: snapshot.connections.map((connection) => {
-      const label = connection.origin.kind === 'device' && connection.origin.id
-        ? labels.get(connection.origin.id)
-        : null;
-      return label ? {
-        ...connection,
-        origin: { ...connection.origin, label },
-      } : connection;
-    }),
-  };
-}
-
-export function createLiveTrafficRoute({
-  traffic,
-  deviceInventory = null,
-  settingsState = null,
-  readBody = null,
-  sendState = null,
-}: {
-  traffic: LiveTrafficReader | null;
-  deviceInventory?: DeviceInventoryReader | null;
-  settingsState?: TrafficSettingsState | null;
-  readBody?: ((req: IncomingMessage) => Promise<Record<string, unknown>>) | null;
-  sendState?: ((res: ServerResponse) => Promise<void>) | null;
-}) {
-  return {
-    async handle(req: IncomingMessage, res: ServerResponse) {
-      const pathname = new URL(req.url || '/', 'http://localhost').pathname;
-      if (pathname === '/api/traffic/live') {
-        if (req.method !== 'GET' || !traffic) throw new HarborError('ENDPOINT_NOT_FOUND');
-        const snapshot = assertLiveTrafficSnapshot(await traffic.snapshot());
-        const enriched = deviceInventory
-          ? enrichLiveTrafficDeviceLabels(snapshot, deviceInventory.snapshot())
-          : snapshot;
-        sendJson(res, 200, enriched);
-        return true;
-      }
-      if (pathname === '/api/traffic/settings') {
-        if (req.method !== 'PUT' || !settingsState || !readBody || !sendState) {
-          throw new HarborError('ENDPOINT_NOT_FOUND');
-        }
-        const body = await readBody(req);
-        const expectedRevision = body.expectedRevision;
-        if (!Number.isSafeInteger(expectedRevision) || Number(expectedRevision) < 0) {
-          throw new HarborError('REQUEST_INVALID');
-        }
-        let settings: TrafficSettings;
-        try {
-          settings = normalizeTrafficSettings(body.settings, { strict: true });
-        } catch (cause) {
-          throw new HarborError('REQUEST_INVALID', { cause });
-        }
-        const current = settingsState.read();
-        if (current.revision !== expectedRevision) throw new HarborError('STATE_CONFLICT');
-        if (!isDeepStrictEqual(current.traffic, settings)) {
-          settingsState.update((state) => ({ ...state, traffic: settings }));
-        }
-        await sendState(res);
-        return true;
-      }
-      return false;
-    },
-  };
-}

src/server/http/routes/prometheusMetricsRoute.ts

@@ -1,26 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-
-import { HarborError } from '../../../shared/errors.js';
-import { sendPrometheusMetrics } from '../../prometheusMetrics.js';
-
-interface MetricsSnapshotPort {
-  metricsSnapshot(): unknown;
-}
-
-interface PrometheusMetricsRouteDependencies {
-  deviceInventory: MetricsSnapshotPort | null;
-}
-
-export function createPrometheusMetricsRoute(dependencies: PrometheusMetricsRouteDependencies) {
-  return {
-    async handle(req: IncomingMessage, res: ServerResponse) {
-      const pathname = new URL(req.url || '/', 'http://localhost').pathname;
-      if (pathname !== '/metrics') return false;
-      if (!dependencies.deviceInventory || req.method !== 'GET') {
-        throw new HarborError('ENDPOINT_NOT_FOUND');
-      }
-      sendPrometheusMetrics(res, dependencies.deviceInventory.metricsSnapshot());
-      return true;
-    },
-  };
-}

src/server/http/routes/routeRulesRoute.ts

@@ -1,21 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-
-import type { RouteRulesService } from '../../features/routing/index.js';
-
-interface RouteRulesRouteDependencies {
-  routeRules: RouteRulesService;
-  readBody(req: IncomingMessage): Promise<Record<string, unknown>>;
-  sendState(res: ServerResponse): Promise<void>;
-}
-
-export function createRouteRulesRoute(dependencies: RouteRulesRouteDependencies) {
-  return {
-    async handle(req: IncomingMessage, res: ServerResponse) {
-      if (req.method !== 'PUT' || !['/api/route-rules', '/api/route-rules/v2'].includes(req.url || '')) return false;
-      const { rules, expectedRulesRevision, rulesContractVersion } = await dependencies.readBody(req);
-      await dependencies.routeRules.update(rules, expectedRulesRevision, rulesContractVersion);
-      await dependencies.sendState(res);
-      return true;
-    },
-  };
-}

src/server/http/routes/serverApplyRoute.ts

@@ -1,40 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-
-import type { ConnectionService } from '../../features/connection/index.js';
-
-interface ServerApplyRouteDependencies {
-  connection: Pick<ConnectionService, 'apply'>;
-  readBody(req: IncomingMessage): Promise<Record<string, unknown>>;
-  withOperation<T>(
-    kind: string,
-    operation: (operationRevision: number) => Promise<T>,
-    options?: { expectedRevision?: unknown; profileId?: unknown; serverId?: unknown },
-  ): Promise<T>;
-  sendState(res: ServerResponse, extra: { profileId: string; serverId: string; selectedTag: string }): Promise<void>;
-}
-
-export function createServerApplyRoute(dependencies: ServerApplyRouteDependencies) {
-  return {
-    async handle(req: IncomingMessage, res: ServerResponse) {
-      if (req.method !== 'POST' || req.url !== '/api/apply') return false;
-      const {
-        profileId = '',
-        serverId = '',
-        selectedTag = '',
-        expectedRevision,
-      } = await dependencies.readBody(req);
-      const result = await dependencies.withOperation(
-        'apply-server',
-        (operationRevision) => dependencies.connection.apply(
-          profileId,
-          serverId,
-          selectedTag,
-          operationRevision,
-        ),
-        { expectedRevision, profileId, serverId },
-      );
-      await dependencies.sendState(res, result);
-      return true;
-    },
-  };
-}

src/server/http/routes/serverHealthRoute.ts

@@ -1,27 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-
-import type { ServerHealthService } from '../../features/servers/index.js';
-
-interface ServerHealthRouteDependencies {
-  serverHealth: ServerHealthService;
-  readBody(req: IncomingMessage): Promise<Record<string, unknown>>;
-  sendState(res: ServerResponse, extra: {
-    profileId: string;
-    results: Array<Record<string, unknown>>;
-  }): Promise<void>;
-}
-
-export function createServerHealthRoute(dependencies: ServerHealthRouteDependencies) {
-  return {
-    async handle(req: IncomingMessage, res: ServerResponse) {
-      const pathname = new URL(req.url || '/', 'http://localhost').pathname;
-      const profileMatch = pathname.match(/^\/api\/profiles\/([^/]+)\/servers\/ping$/);
-      if (req.method !== 'POST' || (!profileMatch && pathname !== '/api/servers/ping-all')) return false;
-      const { serverIds = [] } = await dependencies.readBody(req);
-      const profileId = profileMatch ? decodeURIComponent(profileMatch[1]) : '';
-      const results = await dependencies.serverHealth.check(profileId, serverIds);
-      await dependencies.sendState(res, { profileId, results });
-      return true;
-    },
-  };
-}

src/server/http/routes/sharedProxyRoute.ts

@@ -1,29 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-
-import { buildSharedProxyInfo } from '../../sharedProxy.js';
-import { sendJson } from '../response.js';
-
-interface SharedProxyRouteDependencies {
-  appMode: string;
-  proxyPort: unknown;
-  sharedProxyHost: unknown;
-  refreshRuntime(): Promise<{ running?: unknown }>;
-}
-
-export function createSharedProxyRoute(dependencies: SharedProxyRouteDependencies) {
-  return {
-    async handle(req: IncomingMessage, res: ServerResponse) {
-      if (req.method !== 'GET' || req.url !== '/api/shared-proxy') return false;
-
-      const runtime = await dependencies.refreshRuntime();
-      sendJson(res, 200, buildSharedProxyInfo({
-        appMode: dependencies.appMode,
-        proxyPort: dependencies.proxyPort,
-        running: runtime.running,
-        hostHeader: req.headers.host,
-        sharedProxyHost: dependencies.sharedProxyHost,
-      }));
-      return true;
-    },
-  };
-}