Initial plan

.circleci/config.yml

@@ -7,15 +7,14 @@ jobs:
     steps:
     - checkout
     - run:
-        name: Test and build web assets
+        name: Build web assets (frps)
-        command: make web-ci
+        command: make install build
+        working_directory: web/frps
     - run:
-        name: Check Go formatting and build binaries
+        name: Build web assets (frpc)
-        command: |
+        command: make install build
-          set -e
+        working_directory: web/frpc
-          make env fmt
+    - run: make
-          git diff --exit-code
-          make build
     - run: make alltest
 
 workflows:

.gitattributes

@@ -1 +0,0 @@
-* text=auto eol=lf

.github/FUNDING.yml

@@ -0,0 +1,4 @@
+# These are supported funding model platforms
+
+github: [fatedier]
+custom: ["https://afdian.com/a/fatedier"]

.github/pull_request_template.md

@@ -0,0 +1,3 @@
+### WHY
+
+<!-- author to complete -->

.github/workflows/build-all.yaml

@@ -1,194 +0,0 @@
-name: Build FRP Binaries
-
-on:
-  push:
-    branches:
-      - '**'
-  workflow_dispatch:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    name: Build FRP ${{ matrix.goos }}-${{ matrix.goarch }}
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        goos: [linux, windows, darwin, freebsd, openbsd, android]
-        goarch: [amd64, 386, arm, arm64]
-        include:
-          - goos: linux
-            goarch: loong64
-        exclude:
-          - goos: darwin
-            goarch: arm
-          - goos: darwin
-            goarch: 386
-          - goos: freebsd
-            goarch: arm
-          - goos: openbsd
-            goarch: arm
-          - goos: android
-            goarch: amd64
-          - goos: android
-            goarch: 386
-          # 排除 Android ARM 32位,在单独的 job 中处理
-          - goos: android
-            goarch: arm
-
-    steps:
-      - name: Checkout source
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.22'
-
-      - name: Install dependencies
-        run: |
-          sudo apt-get update -y
-          sudo apt-get install -y zip tar make gcc g++ upx
-
-      - name: Build FRP for ${{ matrix.goos }}-${{ matrix.goarch }}
-        run: |
-          mkdir -p release/packages
-
-          echo "Building for ${{ matrix.goos }}-${{ matrix.goarch }}"
-
-          # 构建版本号
-          make
-          version=$(./bin/frps --version)
-          echo "Detected version: $version"
-
-          export GOOS=${{ matrix.goos }}
-          export GOARCH=${{ matrix.goarch }}
-          export CGO_ENABLED=0
-
-          # 构建可执行文件
-          make frpc frps
-
-          if [ "${{ matrix.goos }}" = "windows" ]; then
-            if [ -f "./bin/frpc" ]; then mv ./bin/frpc ./bin/frpc.exe; fi
-            if [ -f "./bin/frps" ]; then mv ./bin/frps ./bin/frps.exe; fi
-          fi
-
-          out_dir="release/packages/frp_${version}_${{ matrix.goos }}_${{ matrix.goarch }}"
-          mkdir -p "$out_dir"
-
-          if [ "${{ matrix.goos }}" = "windows" ]; then
-            mv ./bin/frpc.exe "$out_dir/frpc.exe"
-            mv ./bin/frps.exe "$out_dir/frps.exe"
-          else
-            mv ./bin/frpc "$out_dir/frpc"
-            mv ./bin/frps "$out_dir/frps"
-          fi
-
-          cp LICENSE "$out_dir"
-          cp -f conf/frpc.toml "$out_dir"
-          cp -f conf/frps.toml "$out_dir"
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: LoliaFrp_${{ matrix.goos }}_${{ matrix.goarch }}
-          path: |
-            release/packages/frp_*
-          retention-days: 7
-
-  build-android-arm:
-    name: Build FRP android-arm
-    runs-on: ubuntu-latest
-    
-    steps:
-      - name: Checkout source
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.22'
-
-      - name: Install dependencies and Android NDK
-        run: |
-          sudo apt-get update -y
-          sudo apt-get install -y zip tar make gcc g++ upx wget unzip
-          
-          # 下载并安装 Android NDK
-          echo "Downloading Android NDK..."
-          wget -q https://dl.google.com/android/repository/android-ndk-r26c-linux.zip
-          echo "Extracting Android NDK..."
-          unzip -q android-ndk-r26c-linux.zip
-          echo "NDK installed at: $PWD/android-ndk-r26c"
-
-      - name: Build FRP for android-arm
-        run: |
-          mkdir -p release/packages
-          mkdir -p bin
-          
-          echo "Building for android-arm with CGO"
-          
-          # 首先构建一次获取版本号
-          CGO_ENABLED=0 make
-          version=$(./bin/frps --version)
-          echo "Detected version: $version"
-          
-          # 清理之前的构建
-          rm -rf ./bin/*
-          
-          # 设置 Android ARM 交叉编译环境
-          export GOOS=android
-          export GOARCH=arm
-          export GOARM=7
-          export CGO_ENABLED=1
-          export CC=$PWD/android-ndk-r26c/toolchains/llvm/prebuilt/linux-x86_64/bin/armv7a-linux-androideabi21-clang
-          export CXX=$PWD/android-ndk-r26c/toolchains/llvm/prebuilt/linux-x86_64/bin/armv7a-linux-androideabi21-clang++
-          
-          echo "Environment:"
-          echo "GOOS=$GOOS"
-          echo "GOARCH=$GOARCH"
-          echo "GOARM=$GOARM"
-          echo "CGO_ENABLED=$CGO_ENABLED"
-          echo "CC=$CC"
-          
-          # 直接使用 go build 命令，不通过 Makefile，防止 CGO_ENABLED 被覆盖
-          # -checklinkname=0: 关闭 Go 1.23+ 的 linkname 检查，规避 wlynxg/anet
-          # 在 android 下通过 //go:linkname 引用 net.zoneCache 导致的链接失败
-          echo "Building frps..."
-          go build -trimpath -ldflags "-s -w -checklinkname=0" -tags frps -o bin/frps ./cmd/frps
-
-          echo "Building frpc..."
-          go build -trimpath -ldflags "-s -w -checklinkname=0" -tags frpc -o bin/frpc ./cmd/frpc
-          
-          # 验证文件已生成
-          ls -lh ./bin/
-          file ./bin/frpc
-          file ./bin/frps
-          
-          out_dir="release/packages/frp_${version}_android_arm"
-          mkdir -p "$out_dir"
-          
-          mv ./bin/frpc "$out_dir/frpc"
-          mv ./bin/frps "$out_dir/frps"
-          
-          cp LICENSE "$out_dir"
-          cp -f conf/frpc.toml "$out_dir"
-          cp -f conf/frps.toml "$out_dir"
-          
-          echo "Build completed for android-arm"
-          ls -lh "$out_dir"
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: LoliaFrp_android_arm
-          path: |
-            release/packages/frp_*
-          retention-days: 7

.github/workflows/build-and-push-image.yml

@@ -0,0 +1,83 @@
+name: Build Image and Publish to Dockerhub & GPR
+
+on:
+  release:
+    types: [ published ]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Image tag'
+        required: true
+        default: 'test'
+permissions:
+  contents: read
+
+jobs:
+  image:
+    name: Build Image from Dockerfile and binaries
+    runs-on: ubuntu-latest
+    steps:
+      # environment
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: '0'
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # get image tag name
+      - name: Get Image Tag Name
+        run: |
+          if [ x${{ github.event.inputs.tag }} == x"" ]; then
+            echo "TAG_NAME=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
+          else
+            echo "TAG_NAME=${{ github.event.inputs.tag }}" >> $GITHUB_ENV
+          fi
+      - name: Login to DockerHub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+      - name: Login to the GPR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GPR_TOKEN }}
+
+      # prepare image tags
+      - name: Prepare Image Tags
+        run: |
+          echo "DOCKERFILE_FRPC_PATH=dockerfiles/Dockerfile-for-frpc" >> $GITHUB_ENV
+          echo "DOCKERFILE_FRPS_PATH=dockerfiles/Dockerfile-for-frps" >> $GITHUB_ENV
+          echo "TAG_FRPC=fatedier/frpc:${{ env.TAG_NAME }}" >> $GITHUB_ENV
+          echo "TAG_FRPS=fatedier/frps:${{ env.TAG_NAME }}" >> $GITHUB_ENV
+          echo "TAG_FRPC_GPR=ghcr.io/fatedier/frpc:${{ env.TAG_NAME }}" >> $GITHUB_ENV
+          echo "TAG_FRPS_GPR=ghcr.io/fatedier/frps:${{ env.TAG_NAME }}" >> $GITHUB_ENV
+
+      - name: Build and push frpc
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./dockerfiles/Dockerfile-for-frpc
+          platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
+          push: true
+          tags: |
+            ${{ env.TAG_FRPC }}
+            ${{ env.TAG_FRPC_GPR }}
+
+      - name: Build and push frps
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./dockerfiles/Dockerfile-for-frps
+          platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
+          push: true
+          tags: |
+            ${{ env.TAG_FRPS }}
+            ${{ env.TAG_FRPS_GPR }}

.github/workflows/docker-build.yml

@@ -1,82 +0,0 @@
-name: Docker Build and Push
-
-on:
-  push:
-    branches:
-      - main
-      - dev
-    tags:
-      - 'v*'
-  pull_request:
-    branches:
-      - main
-      - dev
-  workflow_dispatch:
-
-env:
-  REGISTRY: ghcr.io
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-
-    strategy:
-      matrix:
-        include:
-          - name: frps
-            dockerfile: dockerfiles/Dockerfile-for-frps
-            image_name: ghcr.io/${{ github.repository_owner }}/loliacli-frps
-          - name: frpc
-            dockerfile: dockerfiles/Dockerfile-for-frpc
-            image_name: ghcr.io/${{ github.repository_owner }}/loliacli-frpc
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ matrix.image_name }}
-          tags: |
-            type=ref,event=branch
-            type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-            type=raw,value=latest,enable={{is_default_branch}}
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ${{ matrix.dockerfile }}
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
-
-      - name: Generate image digest
-        if: github.event_name != 'pull_request'
-        run: |
-          echo "Image pushed to: ${{ matrix.image_name }}"
-          echo "Tags: ${{ steps.meta.outputs.tags }}"

.github/workflows/golangci-lint.yml

@@ -14,18 +14,22 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v4
-    - uses: actions/setup-go@v6
+    - uses: actions/setup-go@v5
       with:
         go-version: '1.25'
         cache: false
-    - uses: actions/setup-node@v6
+    - uses: actions/setup-node@v4
       with:
         node-version: '22'
-    - name: Test and build web assets
+    - name: Build web assets (frps)
-      run: make web-ci
+      run: make build
+      working-directory: web/frps
+    - name: Build web assets (frpc)
+      run: make build
+      working-directory: web/frpc
     - name: golangci-lint
       uses: golangci/golangci-lint-action@v9
       with:
         # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
-        version: v2.11
+        version: v2.10

.github/workflows/goreleaser.yml

@@ -8,15 +8,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: '1.25'
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v4
         with:
           node-version: '22'
       - name: Build web assets (frps)
@@ -30,7 +30,7 @@ jobs:
           ./package.sh
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@v6
         with:
           version: latest
           args: release --clean --release-notes=./Release.md

.github/workflows/release.yaml

@@ -1,129 +0,0 @@
-name: Release FRP Binaries
-
-on:
-  push:
-    tags:
-      - "v*"
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "Tag to release (e.g., v1.0.0)"
-        required: true
-        type: string
-
-permissions:
-  contents: write
-
-jobs:
-  # 调用 build-all workflow
-  build:
-    uses: ./.github/workflows/build-all.yaml
-    permissions:
-      contents: read
-
-  # 创建 release
-  release:
-    name: Create Release
-    needs: build
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout source
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Get tag name
-        id: tag
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            echo "tag=${{ github.event.inputs.tag }}" >> $GITHUB_OUTPUT
-          else
-            echo "tag=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Download all artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: artifacts
-
-      - name: Display artifact structure
-        run: |
-          echo "Artifact structure:"
-          ls -R artifacts/
-
-      - name: Organize release files
-        run: |
-          mkdir -p release_files
-
-          # 查找并复制所有压缩包
-          find artifacts -type f \( -name "*.zip" -o -name "*.tar.gz" \) -exec cp {} release_files/ \;
-
-          # 如果没有压缩包，尝试查找二进制文件并打包
-          if [ -z "$(ls -A release_files/)" ]; then
-            echo "No archives found, looking for directories to package..."
-            for dir in artifacts/*/; do
-              if [ -d "$dir" ]; then
-                artifact_name=$(basename "$dir")
-                echo "Packaging $artifact_name"
-                
-                # 检查是否是 Windows 构建
-                if echo "$artifact_name" | grep -q "windows"; then
-                  (cd "$dir" && zip -r "../../release_files/${artifact_name}.zip" .)
-                else
-                  tar -czf "release_files/${artifact_name}.tar.gz" -C "$dir" .
-                fi
-              fi
-            done
-          fi
-
-          echo "Files in release_files:"
-          ls -lh release_files/
-
-      - name: Generate checksums
-        run: |
-          cd release_files
-          if [ -n "$(ls -A .)" ]; then
-            sha256sum * > sha256sum.txt
-            cat sha256sum.txt
-          else
-            echo "No files to generate checksums for!"
-            exit 1
-          fi
-
-      - name: Debug - Check tags and commits
-        run: |
-          echo "Current tag: ${{ steps.tag.outputs.tag }}"
-          PREV_TAG=$(git describe --tags --abbrev=0 ${{ steps.tag.outputs.tag }}^ 2>/dev/null || echo "none")
-          echo "Previous tag: $PREV_TAG"
-
-          echo ""
-          echo "Commits between tags:"
-          if [ "$PREV_TAG" != "none" ]; then
-            git log --oneline $PREV_TAG..${{ steps.tag.outputs.tag }}
-          else
-            echo "First tag, showing all commits:"
-            git log --oneline ${{ steps.tag.outputs.tag }}
-          fi
-
-      - name: Build Changelog
-        id: changelog
-        uses: requarks/changelog-action@v1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          tag: ${{ steps.tag.outputs.tag }}
-          writeToFile: false
-          includeInvalidCommits: true
-          useGitmojis: false
-      - name: Create Release
-        uses: softprops/action-gh-release@v1
-        with:
-          tag_name: ${{ steps.tag.outputs.tag }}
-          name: Release ${{ steps.tag.outputs.tag }}
-          body: ${{ steps.changelog.outputs.changes }}
-          draft: false
-          prerelease: false
-          files: |
-            release_files/*
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/stale.yml

@@ -19,7 +19,7 @@ jobs:
       actions: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/stale@v10
+    - uses: actions/stale@v9
       with:
         stale-issue-message: 'Issues go stale after 14d of inactivity. Stale issues rot after an additional 3d of inactivity and eventually close.'
         stale-pr-message: "PRs go stale after 14d of inactivity. Stale PRs rot after an additional 3d of inactivity and eventually close."

.gitignore

@@ -18,7 +18,6 @@ release/
 test/bin/
 vendor/
 lastversion/
-.cache/
 dist/
 .idea/
 .vscode/
@@ -26,16 +25,10 @@ dist/
 client.crt
 client.key
 
-node_modules/
-
 # Cache
 *.swp
 
 # AI
 CLAUDE.md
-.claude/
+AGENTS.md
 .sisyphus/
-.superpowers/
-
-# TLS
-.autotls-cache

.golangci.yml

@@ -18,7 +18,6 @@ linters:
   - lll
   - makezero
   - misspell
-  - modernize
   - prealloc
   - predeclared
   - revive
@@ -34,7 +33,7 @@ linters:
       disabled-checks:
       - exitAfterDefer
     gosec:
-      excludes: ["G115", "G117", "G118", "G204", "G401", "G402", "G404", "G501", "G703", "G704", "G705"]
+      excludes: ["G115", "G117", "G204", "G401", "G402", "G404", "G501", "G703", "G704", "G705"]
       severity: low
       confidence: low
     govet:
@@ -48,9 +47,6 @@ linters:
       ignore-rules:
       - cancelled
       - marshalled
-    modernize:
-      disable:
-      - omitzero
     unparam:
       check-exported: false
   exclusions:
@@ -90,7 +86,6 @@ linters:
     - third_party$
     - builtin$
     - examples$
-    - node_modules
 formatters:
   enable:
   - gci
@@ -113,7 +108,6 @@ formatters:
     - third_party$
     - builtin$
     - examples$
-    - node_modules
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0

AGENTS.md

@@ -1,39 +0,0 @@
-# AGENTS.md
-
-## Development Commands
-
-### Build
-- `make build` - Build both frps and frpc binaries
-- `make frps` - Build server binary only
-- `make frpc` - Build client binary only
-- `make all` - Build everything with formatting
-
-### Testing
-- `make test` - Run unit tests
-- `make e2e` - Run end-to-end tests
-- `make e2e-trace` - Run e2e tests with trace logging
-- `make alltest` - Run all tests including vet, unit tests, and e2e
-
-### Code Quality
-- `make fmt` - Run go fmt
-- `make fmt-more` - Run gofumpt for more strict formatting
-- `make gci` - Run gci import organizer
-- `make vet` - Run go vet
-- `golangci-lint run` - Run comprehensive linting (configured in .golangci.yml)
-
-### Assets
-- `make web` - Build web dashboards (frps and frpc)
-
-### Cleanup
-- `make clean` - Remove built binaries and temporary files
-
-## Testing
-
-- E2E tests using Ginkgo/Gomega framework
-- Mock servers in `/test/e2e/mock/`
-- Run: `make e2e` or `make alltest`
-
-## Agent Runbooks
-
-Operational procedures for agents are in `doc/agents/`:
-- `doc/agents/release.md` - Release process

CLAUDE.md

@@ -1 +0,0 @@
-AGENTS.md

Makefile

@@ -1,13 +1,9 @@
 export PATH := $(PATH):`go env GOPATH`/bin
 export GO111MODULE=on
-# -checklinkname=0: required since Go 1.23+ for github.com/wlynxg/anet (pion dep),
+LDFLAGS := -s -w
-# which uses //go:linkname to reference net.zoneCache on android targets.
-LDFLAGS := -s -w -checklinkname=0
 NOWEB_TAG = $(shell [ ! -d web/frps/dist ] || [ ! -d web/frpc/dist ] && echo ',noweb')
-FRP_COMPAT_BASELINE_COUNT ?= 8
-FRP_COMPAT_FLOOR_VERSION ?= 0.61.0
 
-.PHONY: web web-ci frps-web frpc-web frps frpc e2e-compatibility-smoke e2e-compatibility e2e-compatibility-floor
+.PHONY: web frps-web frpc-web frps frpc
 
 all: env fmt web build
 
@@ -18,9 +14,6 @@ env:
 
 web: frps-web frpc-web
 
-web-ci:
-	cd web && npm ci && npm run lint:check --workspace frps && npm run lint:check --workspace frpc && npm run test:unit && npm run build --workspace frps && npm run build --workspace frpc
-
 frps-web:
 	$(MAKE) -C web/frps build
 
@@ -60,15 +53,6 @@ e2e:
 e2e-trace:
 	DEBUG=true LOG_LEVEL=trace ./hack/run-e2e.sh
 
-e2e-compatibility-smoke: build
-	FRP_COMPAT_BASELINE_COUNT=1 ./hack/run-e2e-compatibility.sh
-
-e2e-compatibility: build
-	FRP_COMPAT_BASELINE_COUNT="$(FRP_COMPAT_BASELINE_COUNT)" ./hack/run-e2e-compatibility.sh
-
-e2e-compatibility-floor: build
-	FRP_COMPAT_BASELINE_VERSIONS="$(FRP_COMPAT_FLOOR_VERSION)" ./hack/run-e2e-compatibility.sh
-
 e2e-compatibility-last-frpc:
 	if [ ! -d "./lastversion" ]; then \
 		TARGET_DIRNAME=lastversion ./hack/download.sh; \
@@ -89,5 +73,3 @@ clean:
 	rm -f ./bin/frpc
 	rm -f ./bin/frps
 	rm -rf ./lastversion
-	rm -rf ./.cache
-	rm -rf ./.compat

Makefile.cross-compiles

@@ -9,7 +9,7 @@ all: build
 build: app
 
 app:
-	@set -e; $(foreach n, $(os-archs), \
+	@$(foreach n, $(os-archs), \
 		os=$(shell echo "$(n)" | cut -d : -f 1); \
 		arch=$(shell echo "$(n)" | cut -d : -f 2); \
 		extra=$(shell echo "$(n)" | cut -d : -f 3); \

README.md

@@ -2,6 +2,7 @@
 
 [![Build Status](https://circleci.com/gh/fatedier/frp.svg?style=shield)](https://circleci.com/gh/fatedier/frp)
 [![GitHub release](https://img.shields.io/github/tag/fatedier/frp.svg?label=release)](https://github.com/fatedier/frp/releases)
+[![Go Report Card](https://goreportcard.com/badge/github.com/fatedier/frp)](https://goreportcard.com/report/github.com/fatedier/frp)
 [![GitHub Releases Stats](https://img.shields.io/github/downloads/fatedier/frp/total.svg?logo=github)](https://somsubhra.github.io/github-release-stats/?username=fatedier&repository=frp)
 
 [README](README.md) | [中文文档](README_zh.md)
@@ -12,16 +13,6 @@ frp is an open source project with its ongoing development made possible entirel
 
 <h3 align="center">Gold Sponsors</h3>
 <!--gold sponsors start-->
-<p align="center">
-  <a href="https://github.com/beclab/Olares" target="_blank">
-    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_olares.jpeg">
-	<br>
-	<b>The sovereign cloud that puts you in control</b>
-	<br>
-	<sub>An open source, self-hosted alternative to public clouds, built for data ownership and privacy</sub>
-  </a>
-</p>
-
 <div align="center">
 
 ## Recall.ai - API for meeting recordings
@@ -32,6 +23,16 @@ an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and
 
 </div>
 
+<p align="center">
+  <a href="https://requestly.com/?utm_source=github&utm_medium=partnered&utm_campaign=frp" target="_blank">
+    <img width="480px" src="https://github.com/user-attachments/assets/24670320-997d-4d62-9bca-955c59fe883d">
+    <br>
+    <b>Requestly - Free & Open-Source alternative to Postman</b>
+    <br>
+    <sub>All-in-one platform to Test, Mock and Intercept APIs.</sub>
+  </a>
+</p>
+
 <p align="center">
   <a href="https://jb.gg/frp" target="_blank">
     <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_jetbrains.jpg">
@@ -39,6 +40,16 @@ an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and
 	<b>The complete IDE crafted for professional Go developers</b>
   </a>
 </p>
+
+<p align="center">
+  <a href="https://github.com/beclab/Olares" target="_blank">
+    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_olares.jpeg">
+	<br>
+	<b>The sovereign cloud that puts you in control</b>
+	<br>
+	<sub>An open source, self-hosted alternative to public clouds, built for data ownership and privacy</sub>
+  </a>
+</p>
 <!--gold sponsors end-->
 
 ## What is frp?
@@ -70,7 +81,6 @@ frp also offers a P2P connect mode.
     * [Split Configures Into Different Files](#split-configures-into-different-files)
     * [Server Dashboard](#server-dashboard)
     * [Client Admin UI](#client-admin-ui)
-        * [Dynamic Proxy Management (Store)](#dynamic-proxy-management-store)
     * [Monitor](#monitor)
         * [Prometheus](#prometheus)
     * [Authenticating the Client](#authenticating-the-client)
@@ -139,9 +149,7 @@ We sincerely appreciate your support for frp.
 
 ## Architecture
 
-<p align="center">
+![architecture](/doc/pic/architecture.png)
-  <img src="/doc/pic/architecture.jpg" alt="architecture" width="760">
-</p>
 
 ## Example Usage
 
@@ -585,7 +593,7 @@ Then visit `https://[serverAddr]:7500` to see the dashboard in secure HTTPS conn
 
 ### Client Admin UI
 
-The Client Admin UI helps you check and manage frpc's configuration and proxies.
+The Client Admin UI helps you check and manage frpc's configuration.
 
 Configure an address for admin UI to enable this feature:
 
@@ -598,19 +606,6 @@ webServer.password = "admin"
 
 Then visit `http://127.0.0.1:7400` to see admin UI, with username and password both being `admin`.
 
-#### Dynamic Proxy Management (Store)
-
-You can dynamically create, update, and delete proxies and visitors at runtime through the Web UI or API, without restarting frpc.
-
-To enable this feature, configure `store.path` to specify a file for persisting the configurations:
-
-```toml
-[store]
-path = "./db.json"
-```
-
-Proxies and visitors managed through the Store are saved to disk and automatically restored on frpc restart. They work alongside proxies defined in the configuration file — Store entries take precedence when names conflict.
-
 ### Monitor
 
 When web server is enabled, frps will save monitor data in cache for 7 days. It will be cleared after process restart.

README_zh.md

@@ -2,6 +2,7 @@
 
 [![Build Status](https://circleci.com/gh/fatedier/frp.svg?style=shield)](https://circleci.com/gh/fatedier/frp)
 [![GitHub release](https://img.shields.io/github/tag/fatedier/frp.svg?label=release)](https://github.com/fatedier/frp/releases)
+[![Go Report Card](https://goreportcard.com/badge/github.com/fatedier/frp)](https://goreportcard.com/report/github.com/fatedier/frp)
 [![GitHub Releases Stats](https://img.shields.io/github/downloads/fatedier/frp/total.svg?logo=github)](https://somsubhra.github.io/github-release-stats/?username=fatedier&repository=frp)
 
 [README](README.md) | [中文文档](README_zh.md)
@@ -14,16 +15,6 @@ frp 是一个完全开源的项目，我们的开发工作完全依靠赞助者
 
 <h3 align="center">Gold Sponsors</h3>
 <!--gold sponsors start-->
-<p align="center">
-  <a href="https://github.com/beclab/Olares" target="_blank">
-    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_olares.jpeg">
-	<br>
-	<b>The sovereign cloud that puts you in control</b>
-	<br>
-	<sub>An open source, self-hosted alternative to public clouds, built for data ownership and privacy</sub>
-  </a>
-</p>
-
 <div align="center">
 
 ## Recall.ai - API for meeting recordings
@@ -34,6 +25,16 @@ an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and
 
 </div>
 
+<p align="center">
+  <a href="https://requestly.com/?utm_source=github&utm_medium=partnered&utm_campaign=frp" target="_blank">
+    <img width="480px" src="https://github.com/user-attachments/assets/24670320-997d-4d62-9bca-955c59fe883d">
+    <br>
+    <b>Requestly - Free & Open-Source alternative to Postman</b>
+    <br>
+    <sub>All-in-one platform to Test, Mock and Intercept APIs.</sub>
+  </a>
+</p>
+
 <p align="center">
   <a href="https://jb.gg/frp" target="_blank">
     <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_jetbrains.jpg">
@@ -41,6 +42,16 @@ an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and
 	<b>The complete IDE crafted for professional Go developers</b>
   </a>
 </p>
+
+<p align="center">
+  <a href="https://github.com/beclab/Olares" target="_blank">
+    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_olares.jpeg">
+	<br>
+	<b>The sovereign cloud that puts you in control</b>
+	<br>
+	<sub>An open source, self-hosted alternative to public clouds, built for data ownership and privacy</sub>
+  </a>
+</p>
 <!--gold sponsors end-->
 
 ## 为什么使用 frp ？

Release.md

@@ -1,9 +1,9 @@
 ## Features
 
-* UDP packet payloads for ordinary UDP proxies and SUDP now use a dedicated binary codec when frpc and frps successfully negotiate the capability under wire protocol v2, using a more compact wire representation. Wire protocol v1 remains JSON; wire protocol v2 falls back to JSON `UDPPacket` when the peer does not support or did not negotiate the capability.
+* Added a built-in `store` capability for frpc, including persisted store source (`[store] path = "..."`), Store CRUD admin APIs (`/api/store/proxies*`, `/api/store/visitors*`) with runtime reload, and Store management pages in the frpc web dashboard.
 
-## Fixes
+## Improvements
 
-* Fixed a server panic and remote denial of service caused by a client sending a negative `pool_count`. Negative values are now rejected before work-connection pool resources are allocated.
+* Kept proxy/visitor names as raw config names during completion; moved user-prefix handling to explicit wire-level naming logic.
-* Fixed `frpc verify` ignoring configured `featureGates`, which caused VirtualNet configurations to be rejected even when the feature was enabled.
+* Added `noweb` build tag to allow compiling without frontend assets. `make build` now auto-detects missing `web/*/dist` directories and skips embedding, so a fresh clone can build without running `make web` first. The dashboard gracefully returns 404 when assets are not embedded.
-* Fixed a case-insensitive validation bypass that allowed `customDomains` under the configured `subDomainHost` to be registered using mixed-case domain names.
+* Improved config parsing errors: for `.toml` files, syntax errors now return immediately with parser position details (line/column when available) instead of falling through to YAML/JSON parsing, and TOML type mismatches report field-level errors without misleading line numbers.

client/api_router.go

@@ -38,8 +38,6 @@ func (svr *Service) registerRouteHandlers(helper *httppkg.RouterRegisterHelper)
 	subRouter.HandleFunc("/api/status", httppkg.MakeHTTPHandlerFunc(apiController.Status)).Methods(http.MethodGet)
 	subRouter.HandleFunc("/api/config", httppkg.MakeHTTPHandlerFunc(apiController.GetConfig)).Methods(http.MethodGet)
 	subRouter.HandleFunc("/api/config", httppkg.MakeHTTPHandlerFunc(apiController.PutConfig)).Methods(http.MethodPut)
-	subRouter.HandleFunc("/api/proxy/{name}/config", httppkg.MakeHTTPHandlerFunc(apiController.GetProxyConfig)).Methods(http.MethodGet)
-	subRouter.HandleFunc("/api/visitor/{name}/config", httppkg.MakeHTTPHandlerFunc(apiController.GetVisitorConfig)).Methods(http.MethodGet)
 
 	if svr.storeSource != nil {
 		subRouter.HandleFunc("/api/store/proxies", httppkg.MakeHTTPHandlerFunc(apiController.ListStoreProxies)).Methods(http.MethodGet)

client/config_manager.go

@@ -80,48 +80,6 @@ func (m *serviceConfigManager) GetProxyStatus() []*proxy.WorkingStatus {
 	return m.svr.getAllProxyStatus()
 }
 
-func (m *serviceConfigManager) GetProxyConfig(name string) (v1.ProxyConfigurer, bool) {
-	// Try running proxy manager first
-	ws, ok := m.svr.getProxyStatus(name)
-	if ok {
-		return ws.Cfg, true
-	}
-
-	// Fallback to store
-	m.svr.reloadMu.Lock()
-	storeSource := m.svr.storeSource
-	m.svr.reloadMu.Unlock()
-
-	if storeSource != nil {
-		cfg := storeSource.GetProxy(name)
-		if cfg != nil {
-			return cfg, true
-		}
-	}
-	return nil, false
-}
-
-func (m *serviceConfigManager) GetVisitorConfig(name string) (v1.VisitorConfigurer, bool) {
-	// Try running visitor manager first
-	cfg, ok := m.svr.getVisitorCfg(name)
-	if ok {
-		return cfg, true
-	}
-
-	// Fallback to store
-	m.svr.reloadMu.Lock()
-	storeSource := m.svr.storeSource
-	m.svr.reloadMu.Unlock()
-
-	if storeSource != nil {
-		vcfg := storeSource.GetVisitor(name)
-		if vcfg != nil {
-			return vcfg, true
-		}
-	}
-	return nil, false
-}
-
 func (m *serviceConfigManager) IsStoreProxyEnabled(name string) bool {
 	if name == "" {
 		return false

client/config_manager_test.go

@@ -2,16 +2,12 @@ package client
 
 import (
 	"errors"
-	"os"
 	"path/filepath"
-	"strings"
 	"testing"
 
 	"github.com/fatedier/frp/client/configmgmt"
 	"github.com/fatedier/frp/pkg/config/source"
 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/policy/security"
-	"github.com/fatedier/frp/pkg/vnet"
 )
 
 func newTestRawTCPProxyConfig(name string) *v1.TCPProxyConfig {
@@ -26,256 +22,6 @@ func newTestRawTCPProxyConfig(name string) *v1.TCPProxyConfig {
 	}
 }
 
-func newTestVirtualNetProxyConfig(name string) *v1.STCPProxyConfig {
-	return &v1.STCPProxyConfig{
-		ProxyBaseConfig: v1.ProxyBaseConfig{
-			Name: name,
-			Type: "stcp",
-			ProxyBackend: v1.ProxyBackend{
-				Plugin: v1.TypedClientPluginOptions{
-					Type:                v1.PluginVirtualNet,
-					ClientPluginOptions: &v1.VirtualNetPluginOptions{Type: v1.PluginVirtualNet},
-				},
-			},
-		},
-	}
-}
-
-func newTestVirtualNetVisitorConfig(name string) *v1.STCPVisitorConfig {
-	return &v1.STCPVisitorConfig{
-		VisitorBaseConfig: v1.VisitorBaseConfig{
-			Name:       name,
-			Type:       "stcp",
-			ServerName: "vnet-server",
-			SecretKey:  "secret",
-			BindPort:   -1,
-			Plugin: v1.TypedVisitorPluginOptions{
-				Type: v1.VisitorPluginVirtualNet,
-				VisitorPluginOptions: &v1.VirtualNetVisitorPluginOptions{
-					Type:          v1.VisitorPluginVirtualNet,
-					DestinationIP: "100.86.0.1",
-				},
-			},
-		},
-	}
-}
-
-func TestServiceConfigManagerReloadVirtualNetRuntimeDependency(t *testing.T) {
-	const runtimeErr = "VirtualNet-dependent configuration requires a VirtualNet runtime enabled at startup"
-
-	tests := []struct {
-		name                  string
-		startupVirtualNetAddr string
-		nextConfig            string
-		wantRuntimeDependency bool
-	}{
-		{
-			name:       "unrelated common config",
-			nextConfig: `serverAddr = "0.0.0.0"`,
-		},
-		{
-			name: "VirtualNet address without startup runtime",
-			nextConfig: `featureGates = { VirtualNet = true }
-virtualNet.address = "100.86.0.4/24"
-`,
-			wantRuntimeDependency: true,
-		},
-		{
-			name: "VirtualNet proxy without startup runtime",
-			nextConfig: `[[proxies]]
-name = "vnet-proxy"
-type = "stcp"
-secretKey = "secret"
-[proxies.plugin]
-type = "virtual_net"
-`,
-			wantRuntimeDependency: true,
-		},
-		{
-			name: "VirtualNet visitor without startup runtime",
-			nextConfig: `[[visitors]]
-name = "vnet-visitor"
-type = "stcp"
-serverName = "vnet-server"
-secretKey = "secret"
-bindPort = -1
-[visitors.plugin]
-type = "virtual_net"
-destinationIP = "100.86.0.1"
-`,
-			wantRuntimeDependency: true,
-		},
-		{
-			name:                  "existing VirtualNet startup runtime",
-			startupVirtualNetAddr: "100.86.0.4/24",
-			nextConfig: `featureGates = { VirtualNet = true }
-virtualNet.address = "100.86.0.5/24"
-`,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			current := &v1.ClientCommonConfig{}
-			if tc.startupVirtualNetAddr != "" {
-				current.FeatureGates = map[string]bool{"VirtualNet": true}
-				current.VirtualNet.Address = tc.startupVirtualNetAddr
-			}
-			if err := current.Complete(); err != nil {
-				t.Fatalf("complete current config: %v", err)
-			}
-
-			configFile := filepath.Join(t.TempDir(), "frpc.toml")
-			if err := os.WriteFile(configFile, []byte(tc.nextConfig), 0o600); err != nil {
-				t.Fatalf("write config: %v", err)
-			}
-
-			configSource := source.NewConfigSource()
-			aggregator := source.NewAggregator(configSource)
-			svr := &Service{
-				common:         current,
-				reloadCommon:   current,
-				configFilePath: configFile,
-				unsafeFeatures: security.NewUnsafeFeatures(nil),
-				aggregator:     aggregator,
-				configSource:   configSource,
-			}
-			if tc.startupVirtualNetAddr != "" {
-				svr.vnetController = vnet.NewController(current.VirtualNet)
-			}
-
-			err := (&serviceConfigManager{svr: svr}).ReloadFromFile(true)
-			if tc.wantRuntimeDependency {
-				if !errors.Is(err, configmgmt.ErrApplyConfig) || !strings.Contains(err.Error(), runtimeErr) {
-					t.Fatalf("expected VirtualNet runtime dependency error, got: %v", err)
-				}
-				return
-			}
-
-			if err != nil {
-				t.Fatalf("reload config: %v", err)
-			}
-			if svr.common != current {
-				t.Fatal("reload should not replace startup common config")
-			}
-			if tc.startupVirtualNetAddr == "" && svr.vnetController != nil {
-				t.Fatal("reload should not enable startup-only VirtualNet runtime state")
-			}
-		})
-	}
-}
-
-func TestServiceConfigManagerReloadVirtualNetRuntimeDependencyUsesMergedSources(t *testing.T) {
-	const runtimeErr = "VirtualNet-dependent configuration requires a VirtualNet runtime enabled at startup"
-
-	tests := []struct {
-		name                  string
-		nextConfig            string
-		storeProxy            v1.ProxyConfigurer
-		storeVisitor          v1.VisitorConfigurer
-		wantRuntimeDependency bool
-		wantProxyPlugin       string
-	}{
-		{
-			name:                  "Store VirtualNet proxy is rejected",
-			nextConfig:            `serverAddr = "0.0.0.0"`,
-			storeProxy:            newTestVirtualNetProxyConfig("store-vnet"),
-			wantRuntimeDependency: true,
-		},
-		{
-			name:                  "Store VirtualNet visitor is rejected",
-			nextConfig:            `serverAddr = "0.0.0.0"`,
-			storeVisitor:          newTestVirtualNetVisitorConfig("store-vnet"),
-			wantRuntimeDependency: true,
-		},
-		{
-			name: "Store VirtualNet proxy overrides file proxy",
-			nextConfig: `[[proxies]]
-name = "shared"
-type = "tcp"
-localPort = 10080
-remotePort = 10081
-`,
-			storeProxy:            newTestVirtualNetProxyConfig("shared"),
-			wantRuntimeDependency: true,
-		},
-		{
-			name: "Store non-VirtualNet proxy overrides file VirtualNet proxy",
-			nextConfig: `[[proxies]]
-name = "shared"
-type = "stcp"
-secretKey = "secret"
-[proxies.plugin]
-type = "virtual_net"
-`,
-			storeProxy:      newTestRawTCPProxyConfig("shared"),
-			wantProxyPlugin: "",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			current := &v1.ClientCommonConfig{}
-			if err := current.Complete(); err != nil {
-				t.Fatalf("complete current config: %v", err)
-			}
-
-			configFile := filepath.Join(t.TempDir(), "frpc.toml")
-			if err := os.WriteFile(configFile, []byte(tc.nextConfig), 0o600); err != nil {
-				t.Fatalf("write config: %v", err)
-			}
-
-			storeSource, err := source.NewStoreSource(source.StoreSourceConfig{
-				Path: filepath.Join(t.TempDir(), "store.json"),
-			})
-			if err != nil {
-				t.Fatalf("new store source: %v", err)
-			}
-			if tc.storeProxy != nil {
-				if err := storeSource.AddProxy(tc.storeProxy); err != nil {
-					t.Fatalf("add store proxy: %v", err)
-				}
-			}
-			if tc.storeVisitor != nil {
-				if err := storeSource.AddVisitor(tc.storeVisitor); err != nil {
-					t.Fatalf("add store visitor: %v", err)
-				}
-			}
-
-			configSource := source.NewConfigSource()
-			aggregator := source.NewAggregator(configSource)
-			aggregator.SetStoreSource(storeSource)
-			svr := &Service{
-				common:         current,
-				reloadCommon:   current,
-				configFilePath: configFile,
-				unsafeFeatures: security.NewUnsafeFeatures(nil),
-				aggregator:     aggregator,
-				configSource:   configSource,
-				storeSource:    storeSource,
-			}
-
-			err = (&serviceConfigManager{svr: svr}).ReloadFromFile(true)
-			if tc.wantRuntimeDependency {
-				if !errors.Is(err, configmgmt.ErrApplyConfig) || !strings.Contains(err.Error(), runtimeErr) {
-					t.Fatalf("expected VirtualNet runtime dependency error, got: %v", err)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("reload config: %v", err)
-			}
-
-			if len(svr.proxyCfgs) != 1 {
-				t.Fatalf("expected one applied proxy, got %d", len(svr.proxyCfgs))
-			}
-			if got := svr.proxyCfgs[0].GetBaseConfig().Plugin.Type; got != tc.wantProxyPlugin {
-				t.Fatalf("unexpected applied proxy plugin: %q", got)
-			}
-		})
-	}
-}
-
 func TestServiceConfigManagerCreateStoreProxyConflict(t *testing.T) {
 	storeSource, err := source.NewStoreSource(source.StoreSourceConfig{
 		Path: filepath.Join(t.TempDir(), "store.json"),

client/configmgmt/types.go

@@ -26,9 +26,6 @@ type ConfigManager interface {
 	IsStoreProxyEnabled(name string) bool
 	StoreEnabled() bool
 
-	GetProxyConfig(name string) (v1.ProxyConfigurer, bool)
-	GetVisitorConfig(name string) (v1.VisitorConfigurer, bool)
-
 	ListStoreProxies() ([]v1.ProxyConfigurer, error)
 	GetStoreProxy(name string) (v1.ProxyConfigurer, error)
 	CreateStoreProxy(cfg v1.ProxyConfigurer) (v1.ProxyConfigurer, error)

client/connector.go

@@ -29,8 +29,6 @@ import (
 	"github.com/samber/lo"
 
 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/proto/wire"
 	"github.com/fatedier/frp/pkg/transport"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
 	"github.com/fatedier/frp/pkg/util/xlog"
@@ -43,39 +41,6 @@ type Connector interface {
 	Close() error
 }
 
-type MessageConnector interface {
-	Connect() (*msg.Conn, error)
-	Close() error
-}
-
-type messageConnector struct {
-	connector    Connector
-	wireProtocol string
-}
-
-func newMessageConnector(connector Connector, wireProtocol string) *messageConnector {
-	return &messageConnector{
-		connector:    connector,
-		wireProtocol: wireProtocol,
-	}
-}
-
-func (c *messageConnector) Connect() (*msg.Conn, error) {
-	conn, err := c.connector.Connect()
-	if err != nil {
-		return nil, err
-	}
-	if err = wire.WriteMagicIfV2(conn, c.wireProtocol); err != nil {
-		conn.Close()
-		return nil, err
-	}
-	return msg.NewConn(conn, msg.NewReadWriter(conn, c.wireProtocol)), nil
-}
-
-func (c *messageConnector) Close() error {
-	return c.connector.Close()
-}
-
 // defaultConnectorImpl is the default implementation of Connector for normal frpc.
 type defaultConnectorImpl struct {
 	ctx context.Context
@@ -154,7 +119,6 @@ func (c *defaultConnectorImpl) Open() error {
 	fmuxCfg.MaxStreamWindowSize = 6 * 1024 * 1024
 	session, err := fmux.Client(conn, fmuxCfg)
 	if err != nil {
-		conn.Close()
 		return err
 	}
 	c.muxSession = session

client/control.go

@@ -16,9 +16,7 @@ package client
 
 import (
 	"context"
-	"fmt"
 	"net"
-	"strings"
 	"sync/atomic"
 	"time"
 
@@ -29,6 +27,7 @@ import (
 	"github.com/fatedier/frp/pkg/msg"
 	"github.com/fatedier/frp/pkg/naming"
 	"github.com/fatedier/frp/pkg/transport"
+	netpkg "github.com/fatedier/frp/pkg/util/net"
 	"github.com/fatedier/frp/pkg/util/wait"
 	"github.com/fatedier/frp/pkg/util/xlog"
 	"github.com/fatedier/frp/pkg/vnet"
@@ -42,15 +41,15 @@ type SessionContext struct {
 	// It should be attached to the login message when reconnecting.
 	RunID string
 	// Underlying control connection. Once conn is closed, the msgDispatcher and the entire Control will exit.
-	Conn *msg.Conn
+	Conn net.Conn
+	// Indicates whether the connection is encrypted.
+	ConnEncrypted bool
 	// Auth runtime used for login, heartbeats, and encryption.
 	Auth *auth.ClientAuth
-	// Connector is used to create message connections to frps.
+	// Connector is used to create new connections, which could be real TCP connections or virtual streams.
-	Connector MessageConnector
+	Connector Connector
 	// Virtual net controller
 	VnetController *vnet.Controller
-	// UDPPacketCodec is immutable for the lifetime of this negotiated session.
-	UDPPacketCodec string
 }
 
 type Control struct {
@@ -92,20 +91,21 @@ func NewControl(ctx context.Context, sessionCtx *SessionContext) (*Control, erro
 	}
 	ctl.lastPong.Store(time.Now())
 
+	if sessionCtx.ConnEncrypted {
+		cryptoRW, err := netpkg.NewCryptoReadWriter(sessionCtx.Conn, sessionCtx.Auth.EncryptionKey())
+		if err != nil {
+			return nil, err
+		}
+		ctl.msgDispatcher = msg.NewDispatcher(cryptoRW)
+	} else {
 		ctl.msgDispatcher = msg.NewDispatcher(sessionCtx.Conn)
+	}
 	ctl.registerMsgHandlers()
 	ctl.msgTransporter = transport.NewMessageTransporter(ctl.msgDispatcher)
 
-	ctl.pm = proxy.NewManager(
+	ctl.pm = proxy.NewManager(ctl.ctx, sessionCtx.Common, sessionCtx.Auth.EncryptionKey(), ctl.msgTransporter, sessionCtx.VnetController)
-		ctl.ctx,
-		sessionCtx.Common,
-		sessionCtx.Auth.EncryptionKey(),
-		ctl.msgTransporter,
-		sessionCtx.VnetController,
-		sessionCtx.UDPPacketCodec,
-	)
 	ctl.vm = visitor.NewManager(ctl.ctx, sessionCtx.RunID, sessionCtx.Common,
-		ctl.connectServer, ctl.msgTransporter, sessionCtx.VnetController, sessionCtx.UDPPacketCodec)
+		ctl.connectServer, ctl.msgTransporter, sessionCtx.VnetController)
 	return ctl, nil
 }
 
@@ -139,14 +139,14 @@ func (ctl *Control) handleReqWorkConn(_ msg.Message) {
 		workConn.Close()
 		return
 	}
-	if err = workConn.WriteMsg(m); err != nil {
+	if err = msg.WriteMsg(workConn, m); err != nil {
 		xl.Warnf("work connection write to server error: %v", err)
 		workConn.Close()
 		return
 	}
 
 	var startMsg msg.StartWorkConn
-	if err = workConn.ReadMsgInto(&startMsg); err != nil {
+	if err = msg.ReadMsgInto(workConn, &startMsg); err != nil {
 		xl.Tracef("work connection closed before response StartWorkConn message: %v", err)
 		workConn.Close()
 		return
@@ -171,44 +171,9 @@ func (ctl *Control) handleNewProxyResp(m msg.Message) {
 	proxyName := naming.StripUserPrefix(ctl.sessionCtx.Common.User, inMsg.ProxyName)
 	err := ctl.pm.StartProxy(proxyName, inMsg.RemoteAddr, inMsg.Error)
 	if err != nil {
-		xl.Warnf("[%s] 启动失败: %v", proxyName, err)
+		xl.Warnf("[%s] start error: %v", proxyName, err)
 	} else {
-		xl.Infof("[%s] 成功启动隧道", proxyName)
+		xl.Infof("[%s] start proxy success", proxyName)
-		if inMsg.RemoteAddr != "" {
-			// Get proxy type to format access message
-			if status, ok := ctl.pm.GetProxyStatus(proxyName); ok {
-				proxyType := status.Type
-				remoteAddr := inMsg.RemoteAddr
-				var accessMsg string
-
-				switch proxyType {
-				case "tcp", "udp", "stcp", "xtcp", "sudp", "tcpmux":
-					// If remoteAddr only contains port (e.g., ":8080"), prepend server address
-					if strings.HasPrefix(remoteAddr, ":") {
-						serverAddr := ctl.sessionCtx.Common.ServerAddr
-						remoteAddr = serverAddr + remoteAddr
-					}
-					accessMsg = fmt.Sprintf("您可通过 %s 访问您的服务", remoteAddr)
-				case "http", "https":
-					// Format as URL with protocol
-					protocol := proxyType
-					addr := remoteAddr
-					// Remove standard ports for cleaner URL
-					if proxyType == "http" && strings.HasSuffix(addr, ":80") {
-						addr = strings.TrimSuffix(addr, ":80")
-					} else if proxyType == "https" && strings.HasSuffix(addr, ":443") {
-						addr = strings.TrimSuffix(addr, ":443")
-					}
-					accessMsg = fmt.Sprintf("您可通过 %s://%s 访问您的服务", protocol, addr)
-				default:
-					accessMsg = fmt.Sprintf("您可通过 %s 访问您的服务", remoteAddr)
-				}
-
-				xl.Infof("[%s] %s", proxyName, accessMsg)
-			} else {
-				xl.Infof("[%s] 您可通过 %s 访问您的服务", proxyName, inMsg.RemoteAddr)
-			}
-		}
 	}
 }
 
@@ -262,7 +227,7 @@ func (ctl *Control) Done() <-chan struct{} {
 }
 
 // connectServer return a new connection to frps
-func (ctl *Control) connectServer() (*msg.Conn, error) {
+func (ctl *Control) connectServer() (net.Conn, error) {
 	return ctl.sessionCtx.Connector.Connect()
 }
 

client/control_session.go

@@ -1,225 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package client
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"os"
-	"runtime"
-	"time"
-
-	"github.com/samber/lo"
-
-	"github.com/fatedier/frp/pkg/auth"
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/proto/wire"
-	netpkg "github.com/fatedier/frp/pkg/util/net"
-	"github.com/fatedier/frp/pkg/util/version"
-	"github.com/fatedier/frp/pkg/vnet"
-)
-
-type controlSessionDialer struct {
-	ctx context.Context
-
-	common         *v1.ClientCommonConfig
-	auth           *auth.ClientAuth
-	clientSpec     *msg.ClientSpec
-	vnetController *vnet.Controller
-
-	connectorCreator func(context.Context, *v1.ClientCommonConfig) Connector
-}
-
-func (d *controlSessionDialer) Dial(previousRunID string) (*SessionContext, error) {
-	connector := d.connectorCreator(d.ctx, d.common)
-	if err := connector.Open(); err != nil {
-		return nil, err
-	}
-
-	success := false
-	defer func() {
-		if !success {
-			_ = connector.Close()
-		}
-	}()
-
-	conn, err := connector.Connect()
-	if err != nil {
-		return nil, err
-	}
-	defer func() {
-		if !success {
-			_ = conn.Close()
-		}
-	}()
-
-	loginMsg, err := d.buildLoginMsg(previousRunID)
-	if err != nil {
-		return nil, err
-	}
-
-	loginResult, err := d.exchangeLogin(conn, loginMsg)
-	if err != nil {
-		return nil, err
-	}
-	loginRespMsg := loginResult.resp
-	if loginRespMsg.Error != "" {
-		return nil, errors.New(loginRespMsg.Error)
-	}
-
-	var controlRW io.ReadWriter = conn
-	if d.clientSpec == nil || d.clientSpec.Type != "ssh-tunnel" {
-		controlRW, err = d.newControlReadWriter(conn, loginResult.crypto)
-		if err != nil {
-			return nil, fmt.Errorf("create control crypto read writer: %w", err)
-		}
-	}
-
-	success = true
-	return &SessionContext{
-		Common:         d.common,
-		RunID:          loginRespMsg.RunID,
-		Conn:           msg.NewConn(conn, msg.NewReadWriter(controlRW, d.common.Transport.WireProtocol)),
-		Auth:           d.auth,
-		Connector:      newMessageConnector(connector, d.common.Transport.WireProtocol),
-		VnetController: d.vnetController,
-		UDPPacketCodec: loginResult.udpPacketCodec,
-	}, nil
-}
-
-func (d *controlSessionDialer) buildLoginMsg(previousRunID string) (*msg.Login, error) {
-	hostname, _ := os.Hostname()
-	loginMsg := &msg.Login{
-		Arch:      runtime.GOARCH,
-		Os:        runtime.GOOS,
-		Hostname:  hostname,
-		PoolCount: d.common.Transport.PoolCount,
-		User:      d.common.User,
-		ClientID:  d.common.ClientID,
-		Version:   version.Full(),
-		Timestamp: time.Now().Unix(),
-		RunID:     previousRunID,
-		Metas:     d.common.Metadatas,
-	}
-	if d.clientSpec != nil {
-		loginMsg.ClientSpec = *d.clientSpec
-	}
-
-	if err := d.auth.Setter.SetLogin(loginMsg); err != nil {
-		return nil, err
-	}
-	return loginMsg, nil
-}
-
-type loginExchangeResult struct {
-	resp           *msg.LoginResp
-	crypto         *wire.CryptoContext
-	udpPacketCodec string
-}
-
-func (d *controlSessionDialer) exchangeLogin(conn net.Conn, loginMsg *msg.Login) (*loginExchangeResult, error) {
-	rw := msg.NewV1ReadWriter(conn)
-	var wireConn *wire.Conn
-	var clientHello wire.ClientHello
-	var clientHelloPayload []byte
-
-	if d.common.Transport.WireProtocol == wire.ProtocolV2 {
-		if err := wire.WriteMagic(conn); err != nil {
-			return nil, err
-		}
-
-		wireConn = wire.NewConn(conn)
-		rw = msg.NewV2ReadWriterWithConn(wireConn)
-		var err error
-		clientHello, err = wire.NewClientHello(wire.BootstrapInfo{
-			Transport: d.common.Transport.Protocol,
-			TLS:       lo.FromPtr(d.common.Transport.TLS.Enable) || d.common.Transport.Protocol == "wss" || d.common.Transport.Protocol == "quic",
-			TCPMux:    lo.FromPtr(d.common.Transport.TCPMux),
-		})
-		if err != nil {
-			return nil, err
-		}
-		clientHelloFrame, err := wire.NewJSONFrame(wire.FrameTypeClientHello, clientHello)
-		if err != nil {
-			return nil, err
-		}
-		if err := wireConn.WriteFrame(clientHelloFrame); err != nil {
-			return nil, err
-		}
-		clientHelloPayload = clientHelloFrame.Payload
-	}
-	if err := rw.WriteMsg(loginMsg); err != nil {
-		return nil, err
-	}
-
-	_ = conn.SetReadDeadline(time.Now().Add(10 * time.Second))
-	defer func() {
-		_ = conn.SetReadDeadline(time.Time{})
-	}()
-
-	var cryptoContext *wire.CryptoContext
-	var udpPacketCodec string
-	if wireConn != nil {
-		serverHelloFrame, err := wireConn.ReadFrame()
-		if err != nil {
-			return nil, err
-		}
-		if serverHelloFrame.Type != wire.FrameTypeServerHello {
-			return nil, fmt.Errorf("unexpected frame type %d, want %d", serverHelloFrame.Type, wire.FrameTypeServerHello)
-		}
-		var serverHello wire.ServerHello
-		if err := wireConn.UnmarshalFrame(serverHelloFrame, &serverHello); err != nil {
-			return nil, err
-		}
-		if serverHello.Error != "" {
-			return nil, errors.New(serverHello.Error)
-		}
-		cryptoContext, err = wire.NewClientCryptoContext(clientHelloPayload, serverHelloFrame.Payload)
-		if err != nil {
-			return nil, err
-		}
-		udpPacketCodec = serverHello.Selected.Message.UDPPacketCodec
-	}
-
-	var loginRespMsg msg.LoginResp
-	if err := rw.ReadMsgInto(&loginRespMsg); err != nil {
-		return nil, err
-	}
-	return &loginExchangeResult{
-		resp:           &loginRespMsg,
-		crypto:         cryptoContext,
-		udpPacketCodec: udpPacketCodec,
-	}, nil
-}
-
-func (d *controlSessionDialer) newControlReadWriter(conn net.Conn, cryptoContext *wire.CryptoContext) (io.ReadWriter, error) {
-	if d.common.Transport.WireProtocol == wire.ProtocolV2 {
-		if cryptoContext == nil {
-			return nil, errors.New("missing v2 crypto negotiation")
-		}
-		return netpkg.NewAEADCryptoReadWriter(
-			conn,
-			d.auth.EncryptionKey(),
-			netpkg.AEADCryptoRoleClient,
-			cryptoContext.Algorithm,
-			cryptoContext.TranscriptHash,
-		)
-	}
-	return netpkg.NewCryptoReadWriter(conn, d.auth.EncryptionKey())
-}

client/control_session_test.go

@@ -1,299 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package client
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/fatedier/frp/pkg/auth"
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/proto/wire"
-	netpkg "github.com/fatedier/frp/pkg/util/net"
-)
-
-type testConnector struct {
-	conn   net.Conn
-	closed atomic.Bool
-}
-
-func (c *testConnector) Open() error {
-	return nil
-}
-
-func (c *testConnector) Connect() (net.Conn, error) {
-	return c.conn, nil
-}
-
-func (c *testConnector) Close() error {
-	c.closed.Store(true)
-	return nil
-}
-
-type trackingConn struct {
-	net.Conn
-	closed atomic.Bool
-}
-
-func (c *trackingConn) Close() error {
-	c.closed.Store(true)
-	return c.Conn.Close()
-}
-
-func newTestControlSessionDialer(t *testing.T, protocol string, connector Connector, clientSpec *msg.ClientSpec) *controlSessionDialer {
-	t.Helper()
-
-	authRuntime, err := auth.BuildClientAuth(&v1.AuthClientConfig{
-		Method: v1.AuthMethodToken,
-		Token:  "token",
-	})
-	require.NoError(t, err)
-
-	return &controlSessionDialer{
-		ctx: context.Background(),
-		common: &v1.ClientCommonConfig{
-			User: "test-user",
-			Transport: v1.ClientTransportConfig{
-				Protocol:     "tcp",
-				WireProtocol: protocol,
-			},
-		},
-		auth:       authRuntime,
-		clientSpec: clientSpec,
-		connectorCreator: func(context.Context, *v1.ClientCommonConfig) Connector {
-			return connector
-		},
-	}
-}
-
-func TestControlSessionDialerDialV1(t *testing.T) {
-	clientRaw, serverRaw := net.Pipe()
-	defer serverRaw.Close()
-
-	connector := &testConnector{conn: &trackingConn{Conn: clientRaw}}
-	serverErrCh := make(chan error, 1)
-	go func() {
-		rw := msg.NewV1ReadWriter(serverRaw)
-		var loginMsg msg.Login
-		if err := rw.ReadMsgInto(&loginMsg); err != nil {
-			serverErrCh <- err
-			return
-		}
-		if loginMsg.RunID != "previous-run-id" {
-			serverErrCh <- fmt.Errorf("unexpected previous run id: %s", loginMsg.RunID)
-			return
-		}
-		if loginMsg.User != "test-user" {
-			serverErrCh <- fmt.Errorf("unexpected user: %s", loginMsg.User)
-			return
-		}
-		serverErrCh <- rw.WriteMsg(&msg.LoginResp{RunID: "run-v1"})
-	}()
-
-	dialer := newTestControlSessionDialer(t, wire.ProtocolV1, connector, nil)
-	sessionCtx, err := dialer.Dial("previous-run-id")
-	require.NoError(t, err)
-	defer sessionCtx.Conn.Close()
-	defer sessionCtx.Connector.Close()
-
-	require.Equal(t, "run-v1", sessionCtx.RunID)
-	require.Empty(t, sessionCtx.UDPPacketCodec)
-	require.NotNil(t, sessionCtx.Conn)
-	require.NotNil(t, sessionCtx.Connector)
-	require.False(t, connector.closed.Load())
-	require.NoError(t, <-serverErrCh)
-}
-
-func TestControlSessionDialerDialV2(t *testing.T) {
-	clientRaw, serverRaw := net.Pipe()
-	defer serverRaw.Close()
-
-	connector := &testConnector{conn: &trackingConn{Conn: clientRaw}}
-	serverErrCh := make(chan error, 1)
-	go func() {
-		magic := make([]byte, len(wire.MagicV2))
-		if _, err := io.ReadFull(serverRaw, magic); err != nil {
-			serverErrCh <- err
-			return
-		}
-		if string(magic) != wire.MagicV2 {
-			serverErrCh <- fmt.Errorf("unexpected magic: %q", string(magic))
-			return
-		}
-
-		wireConn := wire.NewConn(serverRaw)
-		clientHelloFrame, err := wireConn.ReadFrame()
-		if err != nil {
-			serverErrCh <- err
-			return
-		}
-		if clientHelloFrame.Type != wire.FrameTypeClientHello {
-			serverErrCh <- fmt.Errorf("unexpected frame type %d, want %d", clientHelloFrame.Type, wire.FrameTypeClientHello)
-			return
-		}
-		var hello wire.ClientHello
-		if err := wireConn.UnmarshalFrame(clientHelloFrame, &hello); err != nil {
-			serverErrCh <- err
-			return
-		}
-		if err := wire.ValidateClientHello(hello); err != nil {
-			serverErrCh <- err
-			return
-		}
-
-		rw := msg.NewV2ReadWriterWithConn(wireConn)
-		var loginMsg msg.Login
-		if err := rw.ReadMsgInto(&loginMsg); err != nil {
-			serverErrCh <- err
-			return
-		}
-		if loginMsg.User != "test-user" {
-			serverErrCh <- fmt.Errorf("unexpected user: %s", loginMsg.User)
-			return
-		}
-		serverHello, err := wire.NewServerHello(hello)
-		if err != nil {
-			serverErrCh <- err
-			return
-		}
-		serverHelloFrame, err := wire.NewJSONFrame(wire.FrameTypeServerHello, serverHello)
-		if err != nil {
-			serverErrCh <- err
-			return
-		}
-		cryptoContext := wire.NewCryptoContext(
-			serverHello.Selected.Crypto.Algorithm,
-			clientHelloFrame.Payload,
-			serverHelloFrame.Payload,
-		)
-		if err := wireConn.WriteFrame(serverHelloFrame); err != nil {
-			serverErrCh <- err
-			return
-		}
-		if err := rw.WriteMsg(&msg.LoginResp{RunID: "run-v2"}); err != nil {
-			serverErrCh <- err
-			return
-		}
-
-		controlRW, err := netpkg.NewAEADCryptoReadWriter(
-			serverRaw,
-			[]byte("token"),
-			netpkg.AEADCryptoRoleServer,
-			cryptoContext.Algorithm,
-			cryptoContext.TranscriptHash,
-		)
-		if err != nil {
-			serverErrCh <- err
-			return
-		}
-		controlMsgRW := msg.NewReadWriter(controlRW, wire.ProtocolV2)
-		var ping msg.Ping
-		if err := controlMsgRW.ReadMsgInto(&ping); err != nil {
-			serverErrCh <- err
-			return
-		}
-		if ping.PrivilegeKey != "v2-ping" || ping.Timestamp != 12345 {
-			serverErrCh <- fmt.Errorf("unexpected ping: %+v", ping)
-			return
-		}
-		serverErrCh <- nil
-	}()
-
-	dialer := newTestControlSessionDialer(t, wire.ProtocolV2, connector, nil)
-	sessionCtx, err := dialer.Dial("")
-	require.NoError(t, err)
-	defer sessionCtx.Conn.Close()
-	defer sessionCtx.Connector.Close()
-
-	require.Equal(t, "run-v2", sessionCtx.RunID)
-	require.Equal(t, wire.UDPPacketCodecBinary, sessionCtx.UDPPacketCodec)
-	require.NotNil(t, sessionCtx.Conn)
-	require.NotNil(t, sessionCtx.Connector)
-	require.False(t, connector.closed.Load())
-	require.NoError(t, sessionCtx.Conn.WriteMsg(&msg.Ping{PrivilegeKey: "v2-ping", Timestamp: 12345}))
-	require.NoError(t, <-serverErrCh)
-}
-
-func TestControlSessionDialerDialLoginErrorClosesResources(t *testing.T) {
-	clientRaw, serverRaw := net.Pipe()
-	defer serverRaw.Close()
-
-	clientConn := &trackingConn{Conn: clientRaw}
-	connector := &testConnector{conn: clientConn}
-	serverErrCh := make(chan error, 1)
-	go func() {
-		rw := msg.NewV1ReadWriter(serverRaw)
-		var loginMsg msg.Login
-		if err := rw.ReadMsgInto(&loginMsg); err != nil {
-			serverErrCh <- err
-			return
-		}
-		serverErrCh <- rw.WriteMsg(&msg.LoginResp{Error: "login denied"})
-	}()
-
-	dialer := newTestControlSessionDialer(t, wire.ProtocolV1, connector, nil)
-	sessionCtx, err := dialer.Dial("")
-	require.Nil(t, sessionCtx)
-	require.ErrorContains(t, err, "login denied")
-	require.True(t, clientConn.closed.Load())
-	require.True(t, connector.closed.Load())
-	require.NoError(t, <-serverErrCh)
-}
-
-func TestControlSessionDialerDialSSHTunnelSkipsControlEncryption(t *testing.T) {
-	clientRaw, serverRaw := net.Pipe()
-	defer serverRaw.Close()
-
-	connector := &testConnector{conn: &trackingConn{Conn: clientRaw}}
-	serverErrCh := make(chan error, 1)
-	go func() {
-		rw := msg.NewV1ReadWriter(serverRaw)
-		var loginMsg msg.Login
-		if err := rw.ReadMsgInto(&loginMsg); err != nil {
-			serverErrCh <- err
-			return
-		}
-		if err := rw.WriteMsg(&msg.LoginResp{RunID: "run-ssh-tunnel"}); err != nil {
-			serverErrCh <- err
-			return
-		}
-
-		_ = serverRaw.SetReadDeadline(time.Now().Add(time.Second))
-		var ping msg.Ping
-		if err := rw.ReadMsgInto(&ping); err != nil {
-			serverErrCh <- err
-			return
-		}
-		serverErrCh <- nil
-	}()
-
-	dialer := newTestControlSessionDialer(t, wire.ProtocolV1, connector, &msg.ClientSpec{Type: "ssh-tunnel"})
-	sessionCtx, err := dialer.Dial("")
-	require.NoError(t, err)
-	defer sessionCtx.Conn.Close()
-	defer sessionCtx.Connector.Close()
-
-	require.Equal(t, "run-ssh-tunnel", sessionCtx.RunID)
-	require.NoError(t, sessionCtx.Conn.WriteMsg(&msg.Ping{}))
-	require.NoError(t, <-serverErrCh)
-}

client/control_udp_test.go

@@ -1,125 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//go:build !frps
-
-package client
-
-import (
-	"context"
-	"encoding/binary"
-	"net"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	clientproxy "github.com/fatedier/frp/client/proxy"
-	"github.com/fatedier/frp/pkg/auth"
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/proto/wire"
-)
-
-func TestControlPropagatesBinaryUDPPacketCodecToWorkConn(t *testing.T) {
-	echoConn, err := net.ListenUDP("udp4", &net.UDPAddr{IP: net.ParseIP("127.0.0.1")})
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = echoConn.Close() })
-
-	echoDone := make(chan error, 1)
-	go func() {
-		buf := make([]byte, 64)
-		n, addr, err := echoConn.ReadFromUDP(buf)
-		if err == nil {
-			_, err = echoConn.WriteToUDP(buf[:n], addr)
-		}
-		echoDone <- err
-	}()
-
-	authRuntime, err := auth.BuildClientAuth(&v1.AuthClientConfig{
-		Method: v1.AuthMethodToken,
-		Token:  "token",
-	})
-	require.NoError(t, err)
-
-	controlConn, controlPeer := net.Pipe()
-	t.Cleanup(func() {
-		_ = controlConn.Close()
-		_ = controlPeer.Close()
-	})
-	common := &v1.ClientCommonConfig{
-		Transport:     v1.ClientTransportConfig{WireProtocol: wire.ProtocolV2},
-		UDPPacketSize: 1500,
-	}
-	ctl, err := NewControl(context.Background(), &SessionContext{
-		Common:         common,
-		RunID:          "binary-udp-test",
-		Conn:           msg.NewConn(controlConn, msg.NewV2ReadWriter(controlConn)),
-		Auth:           authRuntime,
-		UDPPacketCodec: wire.UDPPacketCodecBinary,
-	})
-	require.NoError(t, err)
-	t.Cleanup(ctl.pm.Close)
-
-	echoAddr := echoConn.LocalAddr().(*net.UDPAddr)
-	proxyCfg := &v1.UDPProxyConfig{
-		ProxyBaseConfig: v1.ProxyBaseConfig{
-			Name: "udp",
-			Type: string(v1.ProxyTypeUDP),
-			ProxyBackend: v1.ProxyBackend{
-				LocalIP:   "127.0.0.1",
-				LocalPort: echoAddr.Port,
-			},
-		},
-	}
-	ctl.pm.UpdateAll([]v1.ProxyConfigurer{proxyCfg})
-	require.Eventually(t, func() bool {
-		status, ok := ctl.pm.GetProxyStatus("udp")
-		return ok && status.Phase == clientproxy.ProxyPhaseWaitStart
-	}, time.Second, 10*time.Millisecond)
-	require.NoError(t, ctl.pm.StartProxy("udp", "", ""))
-
-	workClient, workServer := net.Pipe()
-	t.Cleanup(func() {
-		_ = workClient.Close()
-		_ = workServer.Close()
-	})
-	deadline := time.Now().Add(3 * time.Second)
-	require.NoError(t, workClient.SetDeadline(deadline))
-	require.NoError(t, workServer.SetDeadline(deadline))
-	ctl.pm.HandleWorkConn("udp", workClient, &msg.StartWorkConn{ProxyName: "udp"})
-
-	serverRW, err := msg.NewUDPPacketReadWriter(workServer, wire.ProtocolV2, wire.UDPPacketCodecBinary)
-	require.NoError(t, err)
-	writeDone := make(chan error, 1)
-	in := &msg.UDPPacket{
-		Content:    []byte("binary udp"),
-		RemoteAddr: &net.UDPAddr{IP: net.ParseIP("192.0.2.1"), Port: 12345},
-	}
-	go func() {
-		writeDone <- serverRW.WriteMsg(in)
-	}()
-
-	frame, err := wire.NewConn(workServer).ReadFrame()
-	require.NoError(t, err)
-	require.Equal(t, wire.FrameTypeMessage, frame.Type)
-	require.GreaterOrEqual(t, len(frame.Payload), 2)
-	require.Equal(t, msg.V2TypeUDPPacketBinary, binary.BigEndian.Uint16(frame.Payload[:2]))
-	out, err := msg.DecodeUDPPacketBinary(frame.Payload[2:])
-	require.NoError(t, err)
-	require.Equal(t, in.Content, out.Content)
-	require.Equal(t, in.RemoteAddr.String(), out.RemoteAddr.String())
-	require.NoError(t, <-writeDone)
-	require.NoError(t, <-echoDone)
-}

client/http/controller.go

@@ -162,44 +162,6 @@ func (c *Controller) buildProxyStatusResp(status *proxy.WorkingStatus) model.Pro
 	return psr
 }
 
-// GetProxyConfig handles GET /api/proxy/{name}/config
-func (c *Controller) GetProxyConfig(ctx *httppkg.Context) (any, error) {
-	name := ctx.Param("name")
-	if name == "" {
-		return nil, httppkg.NewError(http.StatusBadRequest, "proxy name is required")
-	}
-
-	cfg, ok := c.manager.GetProxyConfig(name)
-	if !ok {
-		return nil, httppkg.NewError(http.StatusNotFound, fmt.Sprintf("proxy %q not found", name))
-	}
-
-	payload, err := model.ProxyDefinitionFromConfigurer(cfg)
-	if err != nil {
-		return nil, httppkg.NewError(http.StatusInternalServerError, err.Error())
-	}
-	return payload, nil
-}
-
-// GetVisitorConfig handles GET /api/visitor/{name}/config
-func (c *Controller) GetVisitorConfig(ctx *httppkg.Context) (any, error) {
-	name := ctx.Param("name")
-	if name == "" {
-		return nil, httppkg.NewError(http.StatusBadRequest, "visitor name is required")
-	}
-
-	cfg, ok := c.manager.GetVisitorConfig(name)
-	if !ok {
-		return nil, httppkg.NewError(http.StatusNotFound, fmt.Sprintf("visitor %q not found", name))
-	}
-
-	payload, err := model.VisitorDefinitionFromConfigurer(cfg)
-	if err != nil {
-		return nil, httppkg.NewError(http.StatusInternalServerError, err.Error())
-	}
-	return payload, nil
-}
-
 func (c *Controller) ListStoreProxies(ctx *httppkg.Context) (any, error) {
 	proxies, err := c.manager.ListStoreProxies()
 	if err != nil {

client/http/controller_test.go

@@ -26,8 +26,6 @@ type fakeConfigManager struct {
 	getProxyStatusFn      func() []*proxy.WorkingStatus
 	isStoreProxyEnabledFn func(name string) bool
 	storeEnabledFn        func() bool
-	getProxyConfigFn      func(name string) (v1.ProxyConfigurer, bool)
-	getVisitorConfigFn    func(name string) (v1.VisitorConfigurer, bool)
 
 	listStoreProxiesFn  func() ([]v1.ProxyConfigurer, error)
 	getStoreProxyFn     func(name string) (v1.ProxyConfigurer, error)
@@ -84,20 +82,6 @@ func (m *fakeConfigManager) StoreEnabled() bool {
 	return false
 }
 
-func (m *fakeConfigManager) GetProxyConfig(name string) (v1.ProxyConfigurer, bool) {
-	if m.getProxyConfigFn != nil {
-		return m.getProxyConfigFn(name)
-	}
-	return nil, false
-}
-
-func (m *fakeConfigManager) GetVisitorConfig(name string) (v1.VisitorConfigurer, bool) {
-	if m.getVisitorConfigFn != nil {
-		return m.getVisitorConfigFn(name)
-	}
-	return nil, false
-}
-
 func (m *fakeConfigManager) ListStoreProxies() ([]v1.ProxyConfigurer, error) {
 	if m.listStoreProxiesFn != nil {
 		return m.listStoreProxiesFn()
@@ -545,118 +529,3 @@ func TestUpdateStoreProxyReturnsTypedPayload(t *testing.T) {
 		t.Fatalf("unexpected response payload: %#v", payload)
 	}
 }
-
-func TestGetProxyConfigFromManager(t *testing.T) {
-	controller := &Controller{
-		manager: &fakeConfigManager{
-			getProxyConfigFn: func(name string) (v1.ProxyConfigurer, bool) {
-				if name == "ssh" {
-					cfg := &v1.TCPProxyConfig{
-						ProxyBaseConfig: v1.ProxyBaseConfig{
-							Name: "ssh",
-							Type: "tcp",
-							ProxyBackend: v1.ProxyBackend{
-								LocalPort: 22,
-							},
-						},
-					}
-					return cfg, true
-				}
-				return nil, false
-			},
-		},
-	}
-
-	req := httptest.NewRequest(http.MethodGet, "/api/proxy/ssh/config", nil)
-	req = mux.SetURLVars(req, map[string]string{"name": "ssh"})
-	ctx := httppkg.NewContext(httptest.NewRecorder(), req)
-
-	resp, err := controller.GetProxyConfig(ctx)
-	if err != nil {
-		t.Fatalf("get proxy config: %v", err)
-	}
-	payload, ok := resp.(model.ProxyDefinition)
-	if !ok {
-		t.Fatalf("unexpected response type: %T", resp)
-	}
-	if payload.Name != "ssh" || payload.Type != "tcp" || payload.TCP == nil {
-		t.Fatalf("unexpected payload: %#v", payload)
-	}
-}
-
-func TestGetProxyConfigNotFound(t *testing.T) {
-	controller := &Controller{
-		manager: &fakeConfigManager{
-			getProxyConfigFn: func(name string) (v1.ProxyConfigurer, bool) {
-				return nil, false
-			},
-		},
-	}
-
-	req := httptest.NewRequest(http.MethodGet, "/api/proxy/missing/config", nil)
-	req = mux.SetURLVars(req, map[string]string{"name": "missing"})
-	ctx := httppkg.NewContext(httptest.NewRecorder(), req)
-
-	_, err := controller.GetProxyConfig(ctx)
-	if err == nil {
-		t.Fatal("expected error")
-	}
-	assertHTTPCode(t, err, http.StatusNotFound)
-}
-
-func TestGetVisitorConfigFromManager(t *testing.T) {
-	controller := &Controller{
-		manager: &fakeConfigManager{
-			getVisitorConfigFn: func(name string) (v1.VisitorConfigurer, bool) {
-				if name == "my-stcp" {
-					cfg := &v1.STCPVisitorConfig{
-						VisitorBaseConfig: v1.VisitorBaseConfig{
-							Name:       "my-stcp",
-							Type:       "stcp",
-							ServerName: "server1",
-							BindPort:   9000,
-						},
-					}
-					return cfg, true
-				}
-				return nil, false
-			},
-		},
-	}
-
-	req := httptest.NewRequest(http.MethodGet, "/api/visitor/my-stcp/config", nil)
-	req = mux.SetURLVars(req, map[string]string{"name": "my-stcp"})
-	ctx := httppkg.NewContext(httptest.NewRecorder(), req)
-
-	resp, err := controller.GetVisitorConfig(ctx)
-	if err != nil {
-		t.Fatalf("get visitor config: %v", err)
-	}
-	payload, ok := resp.(model.VisitorDefinition)
-	if !ok {
-		t.Fatalf("unexpected response type: %T", resp)
-	}
-	if payload.Name != "my-stcp" || payload.Type != "stcp" || payload.STCP == nil {
-		t.Fatalf("unexpected payload: %#v", payload)
-	}
-}
-
-func TestGetVisitorConfigNotFound(t *testing.T) {
-	controller := &Controller{
-		manager: &fakeConfigManager{
-			getVisitorConfigFn: func(name string) (v1.VisitorConfigurer, bool) {
-				return nil, false
-			},
-		},
-	}
-
-	req := httptest.NewRequest(http.MethodGet, "/api/visitor/missing/config", nil)
-	req = mux.SetURLVars(req, map[string]string{"name": "missing"})
-	ctx := httppkg.NewContext(httptest.NewRecorder(), req)
-
-	_, err := controller.GetVisitorConfig(ctx)
-	if err == nil {
-		t.Fatal("expected error")
-	}
-	assertHTTPCode(t, err, http.StatusNotFound)
-}

client/proxy/proxy.go

@@ -16,13 +16,10 @@ package proxy
 
 import (
 	"context"
-	"fmt"
 	"io"
 	"net"
 	"reflect"
-	"slices"
 	"strconv"
-	"strings"
 	"sync"
 	"time"
 
@@ -63,17 +60,15 @@ func NewProxy(
 	encryptionKey []byte,
 	msgTransporter transport.MessageTransporter,
 	vnetController *vnet.Controller,
-	udpPacketCodec string,
 ) (pxy Proxy) {
 	var limiter *rate.Limiter
 	limitBytes := pxyConf.GetBaseConfig().Transport.BandwidthLimit.Bytes()
 	if limitBytes > 0 && pxyConf.GetBaseConfig().Transport.BandwidthLimitMode == types.BandwidthLimitModeClient {
-		limiter = limit.NewBandwidthLimiter(limitBytes)
+		limiter = rate.NewLimiter(rate.Limit(float64(limitBytes)), int(limitBytes))
 	}
 
 	baseProxy := BaseProxy{
 		baseCfg:        pxyConf.GetBaseConfig(),
-		configurer:     pxyConf,
 		clientCfg:      clientCfg,
 		encryptionKey:  encryptionKey,
 		limiter:        limiter,
@@ -81,7 +76,6 @@ func NewProxy(
 		vnetController: vnetController,
 		xl:             xlog.FromContextSafe(ctx),
 		ctx:            ctx,
-		udpPacketCodec: udpPacketCodec,
 	}
 
 	factory := proxyFactoryRegistry[reflect.TypeOf(pxyConf)]
@@ -93,7 +87,6 @@ func NewProxy(
 
 type BaseProxy struct {
 	baseCfg        *v1.ProxyBaseConfig
-	configurer     v1.ProxyConfigurer
 	clientCfg      *v1.ClientCommonConfig
 	encryptionKey  []byte
 	msgTransporter transport.MessageTransporter
@@ -107,14 +100,12 @@ type BaseProxy struct {
 	mu  sync.RWMutex
 	xl  *xlog.Logger
 	ctx context.Context
-	udpPacketCodec string
 }
 
 func (pxy *BaseProxy) Run() error {
 	if pxy.baseCfg.Plugin.Type != "" {
 		p, err := plugin.Create(pxy.baseCfg.Plugin.Type, plugin.PluginContext{
 			Name:           pxy.baseCfg.Name,
-			HostAllowList:  pxy.getPluginHostAllowList(),
 			VnetController: pxy.vnetController,
 		}, pxy.baseCfg.Plugin.ClientPluginOptions)
 		if err != nil {
@@ -125,72 +116,12 @@ func (pxy *BaseProxy) Run() error {
 	return nil
 }
 
-func (pxy *BaseProxy) getPluginHostAllowList() []string {
-	dedupHosts := make([]string, 0)
-	addHost := func(host string) {
-		host = strings.TrimSpace(strings.ToLower(host))
-		if host == "" {
-			return
-		}
-		// autocert.HostWhitelist only supports exact host names.
-		if strings.Contains(host, "*") {
-			return
-		}
-		if !slices.Contains(dedupHosts, host) {
-			dedupHosts = append(dedupHosts, host)
-		}
-	}
-
-	switch cfg := pxy.configurer.(type) {
-	case *v1.HTTPProxyConfig:
-		for _, host := range cfg.CustomDomains {
-			addHost(host)
-		}
-	case *v1.HTTPSProxyConfig:
-		for _, host := range cfg.CustomDomains {
-			addHost(host)
-		}
-	case *v1.TCPMuxProxyConfig:
-		for _, host := range cfg.CustomDomains {
-			addHost(host)
-		}
-	}
-	return dedupHosts
-}
-
 func (pxy *BaseProxy) Close() {
 	if pxy.proxyPlugin != nil {
 		pxy.proxyPlugin.Close()
 	}
 }
 
-// wrapWorkConn applies rate limiting, encryption, and compression
-// to a work connection based on the proxy's transport configuration.
-// The returned recycle function should be called when the stream is no longer in use
-// to return compression resources to the pool. It is safe to not call recycle,
-// in which case resources will be garbage collected normally.
-func (pxy *BaseProxy) wrapWorkConn(conn net.Conn, encKey []byte) (io.ReadWriteCloser, func(), error) {
-	var rwc io.ReadWriteCloser = conn
-	if pxy.limiter != nil {
-		rwc = libio.WrapReadWriteCloser(limit.NewReader(conn, pxy.limiter), limit.NewWriter(conn, pxy.limiter), func() error {
-			return conn.Close()
-		})
-	}
-	if pxy.baseCfg.Transport.UseEncryption {
-		var err error
-		rwc, err = libio.WithEncryption(rwc, encKey)
-		if err != nil {
-			conn.Close()
-			return nil, nil, fmt.Errorf("create encryption stream error: %w", err)
-		}
-	}
-	var recycleFn func()
-	if pxy.baseCfg.Transport.UseCompression {
-		rwc, recycleFn = libio.WithCompressionFromPool(rwc)
-	}
-	return rwc, recycleFn, nil
-}
-
 func (pxy *BaseProxy) SetInWorkConnCallback(cb func(*v1.ProxyBaseConfig, net.Conn, *msg.StartWorkConn) bool) {
 	pxy.inWorkConnCallback = cb
 }
@@ -208,44 +139,46 @@ func (pxy *BaseProxy) InWorkConn(conn net.Conn, m *msg.StartWorkConn) {
 func (pxy *BaseProxy) HandleTCPWorkConnection(workConn net.Conn, m *msg.StartWorkConn, encKey []byte) {
 	xl := pxy.xl
 	baseCfg := pxy.baseCfg
+	var (
+		remote io.ReadWriteCloser
+		err    error
+	)
+	remote = workConn
+	if pxy.limiter != nil {
+		remote = libio.WrapReadWriteCloser(limit.NewReader(workConn, pxy.limiter), limit.NewWriter(workConn, pxy.limiter), func() error {
+			return workConn.Close()
+		})
+	}
 
 	xl.Tracef("handle tcp work connection, useEncryption: %t, useCompression: %t",
 		baseCfg.Transport.UseEncryption, baseCfg.Transport.UseCompression)
-
+	if baseCfg.Transport.UseEncryption {
-	var srcAddr, dstAddr *net.TCPAddr
+		remote, err = libio.WithEncryption(remote, encKey)
-	if m.SrcAddr != "" && m.SrcPort != 0 {
-		if m.DstAddr == "" {
-			m.DstAddr = "127.0.0.1"
-		}
-		var err error
-		srcAddr, err = net.ResolveTCPAddr("tcp", net.JoinHostPort(m.SrcAddr, strconv.Itoa(int(m.SrcPort))))
 		if err != nil {
-			xl.Warnf("resolve source address [%s] error: %v", m.SrcAddr, err)
+			workConn.Close()
-			_ = workConn.Close()
+			xl.Errorf("create encryption stream error: %v", err)
-			return
-		}
-		dstAddr, err = net.ResolveTCPAddr("tcp", net.JoinHostPort(m.DstAddr, strconv.Itoa(int(m.DstPort))))
-		if err != nil {
-			xl.Warnf("resolve destination address [%s] error: %v", m.DstAddr, err)
-			_ = workConn.Close()
 			return
 		}
 	}
-
+	var compressionResourceRecycleFn func()
-	remote, recycleFn, err := pxy.wrapWorkConn(workConn, encKey)
+	if baseCfg.Transport.UseCompression {
-	if err != nil {
+		remote, compressionResourceRecycleFn = libio.WithCompressionFromPool(remote)
-		xl.Errorf("wrap work connection: %v", err)
-		return
 	}
 
 	// check if we need to send proxy protocol info
 	var connInfo plugin.ConnectionInfo
 	if m.SrcAddr != "" && m.SrcPort != 0 {
+		if m.DstAddr == "" {
+			m.DstAddr = "127.0.0.1"
+		}
+		srcAddr, _ := net.ResolveTCPAddr("tcp", net.JoinHostPort(m.SrcAddr, strconv.Itoa(int(m.SrcPort))))
+		dstAddr, _ := net.ResolveTCPAddr("tcp", net.JoinHostPort(m.DstAddr, strconv.Itoa(int(m.DstPort))))
 		connInfo.SrcAddr = srcAddr
 		connInfo.DstAddr = dstAddr
 	}
 
 	if baseCfg.Transport.ProxyProtocolVersion != "" && m.SrcAddr != "" && m.SrcPort != 0 {
+		// Use the common proxy protocol builder function
 		header := netpkg.BuildProxyProtocolHeaderStruct(connInfo.SrcAddr, connInfo.DstAddr, baseCfg.Transport.ProxyProtocolVersion)
 		connInfo.ProxyProtocolHeader = header
 	}
@@ -254,18 +187,12 @@ func (pxy *BaseProxy) HandleTCPWorkConnection(workConn net.Conn, m *msg.StartWor
 
 	if pxy.proxyPlugin != nil {
 		// if plugin is set, let plugin handle connection first
-		// Don't recycle compression resources here because plugins may
-		// retain the connection after Handle returns.
 		xl.Debugf("handle by plugin: %s", pxy.proxyPlugin.Name())
 		pxy.proxyPlugin.Handle(pxy.ctx, &connInfo)
 		xl.Debugf("handle by plugin finished")
 		return
 	}
 
-	if recycleFn != nil {
-		defer recycleFn()
-	}
-
 	localConn, err := libnet.Dial(
 		net.JoinHostPort(baseCfg.LocalIP, strconv.Itoa(baseCfg.LocalPort)),
 		libnet.WithTimeout(10*time.Second),
@@ -282,7 +209,6 @@ func (pxy *BaseProxy) HandleTCPWorkConnection(workConn net.Conn, m *msg.StartWor
 	if connInfo.ProxyProtocolHeader != nil {
 		if _, err := connInfo.ProxyProtocolHeader.WriteTo(localConn); err != nil {
 			workConn.Close()
-			localConn.Close()
 			xl.Errorf("write proxy protocol header to local conn error: %v", err)
 			return
 		}
@@ -293,4 +219,7 @@ func (pxy *BaseProxy) HandleTCPWorkConnection(workConn net.Conn, m *msg.StartWor
 	if len(errs) > 0 {
 		xl.Tracef("join connections errors: %v", errs)
 	}
+	if compressionResourceRecycleFn != nil {
+		compressionResourceRecycleFn()
+	}
 }

client/proxy/proxy_manager.go

@@ -44,7 +44,6 @@ type Manager struct {
 	clientCfg     *v1.ClientCommonConfig
 
 	ctx context.Context
-	udpPacketCodec string
 }
 
 func NewManager(
@@ -53,7 +52,6 @@ func NewManager(
 	encryptionKey []byte,
 	msgTransporter transport.MessageTransporter,
 	vnetController *vnet.Controller,
-	udpPacketCodec string,
 ) *Manager {
 	return &Manager{
 		proxies:        make(map[string]*Wrapper),
@@ -63,7 +61,6 @@ func NewManager(
 		encryptionKey:  encryptionKey,
 		clientCfg:      clientCfg,
 		ctx:            ctx,
-		udpPacketCodec: udpPacketCodec,
 	}
 }
 
@@ -162,14 +159,14 @@ func (pm *Manager) UpdateAll(proxyCfgs []v1.ProxyConfigurer) {
 		}
 	}
 	if len(delPxyNames) > 0 {
-		xl.Infof("隧道移除: %s", delPxyNames)
+		xl.Infof("proxy removed: %s", delPxyNames)
 	}
 
 	addPxyNames := make([]string, 0)
 	for _, cfg := range proxyCfgs {
 		name := cfg.GetBaseConfig().Name
 		if _, ok := pm.proxies[name]; !ok {
-			pxy := NewWrapper(pm.ctx, cfg, pm.clientCfg, pm.encryptionKey, pm.HandleEvent, pm.msgTransporter, pm.vnetController, pm.udpPacketCodec)
+			pxy := NewWrapper(pm.ctx, cfg, pm.clientCfg, pm.encryptionKey, pm.HandleEvent, pm.msgTransporter, pm.vnetController)
 			if pm.inWorkConnCallback != nil {
 				pxy.SetInWorkConnCallback(pm.inWorkConnCallback)
 			}
@@ -180,6 +177,6 @@ func (pm *Manager) UpdateAll(proxyCfgs []v1.ProxyConfigurer) {
 		}
 	}
 	if len(addPxyNames) > 0 {
-		xl.Infof("添加隧道: %s", addPxyNames)
+		xl.Infof("proxy added: %s", addPxyNames)
 	}
 }

client/proxy/proxy_test.go

@@ -1,47 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//go:build !frps
-
-package proxy
-
-import (
-	"io"
-	"net"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/util/xlog"
-)
-
-func TestHandleTCPWorkConnectionRejectsInvalidAddress(t *testing.T) {
-	workConn, peerConn := net.Pipe()
-	defer peerConn.Close()
-
-	pxy := &BaseProxy{
-		baseCfg: &v1.ProxyBaseConfig{},
-		xl:      xlog.New(),
-	}
-	pxy.HandleTCPWorkConnection(workConn, &msg.StartWorkConn{
-		SrcAddr: "[",
-		SrcPort: 1,
-	}, nil)
-
-	buffer := make([]byte, 1)
-	_, err := peerConn.Read(buffer)
-	require.ErrorIs(t, err, io.EOF)
-}

client/proxy/proxy_wrapper.go

@@ -99,7 +99,6 @@ func NewWrapper(
 	eventHandler event.Handler,
 	msgTransporter transport.MessageTransporter,
 	vnetController *vnet.Controller,
-	udpPacketCodec string,
 ) *Wrapper {
 	baseInfo := cfg.GetBaseConfig()
 	xl := xlog.FromContextSafe(ctx).Spawn().AppendPrefix(baseInfo.Name)
@@ -128,7 +127,7 @@ func NewWrapper(
 		xl.Tracef("enable health check monitor")
 	}
 
-	pw.pxy = NewProxy(pw.ctx, pw.Cfg, clientCfg, encryptionKey, pw.msgTransporter, pw.vnetController, udpPacketCodec)
+	pw.pxy = NewProxy(pw.ctx, pw.Cfg, clientCfg, encryptionKey, pw.msgTransporter, pw.vnetController)
 	return pw
 }
 

client/proxy/sudp.go

@@ -17,6 +17,7 @@
 package proxy
 
 import (
+	"io"
 	"net"
 	"reflect"
 	"strconv"
@@ -24,15 +25,17 @@ import (
 	"time"
 
 	"github.com/fatedier/golib/errors"
+	libio "github.com/fatedier/golib/io"
 
 	v1 "github.com/fatedier/frp/pkg/config/v1"
 	"github.com/fatedier/frp/pkg/msg"
 	"github.com/fatedier/frp/pkg/proto/udp"
+	"github.com/fatedier/frp/pkg/util/limit"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
 )
 
 func init() {
-	RegisterProxyFactory(reflect.TypeFor[*v1.SUDPProxyConfig](), NewSUDPProxy)
+	RegisterProxyFactory(reflect.TypeOf(&v1.SUDPProxyConfig{}), NewSUDPProxy)
 }
 
 type SUDPProxy struct {
@@ -80,20 +83,27 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 	xl := pxy.xl
 	xl.Infof("incoming a new work connection for sudp proxy, %s", conn.RemoteAddr().String())
 
-	remote, _, err := pxy.wrapWorkConn(conn, pxy.encryptionKey)
+	var rwc io.ReadWriteCloser = conn
+	var err error
+	if pxy.limiter != nil {
+		rwc = libio.WrapReadWriteCloser(limit.NewReader(conn, pxy.limiter), limit.NewWriter(conn, pxy.limiter), func() error {
+			return conn.Close()
+		})
+	}
+	if pxy.cfg.Transport.UseEncryption {
+		rwc, err = libio.WithEncryption(rwc, pxy.encryptionKey)
 		if err != nil {
-		xl.Errorf("wrap work connection: %v", err)
+			conn.Close()
+			xl.Errorf("create encryption stream error: %v", err)
 			return
 		}
+	}
+	if pxy.cfg.Transport.UseCompression {
+		rwc = libio.WithCompression(rwc)
+	}
+	conn = netpkg.WrapReadWriteCloserToConn(rwc, conn)
 
-	workConn := netpkg.WrapReadWriteCloserToConn(remote, conn)
+	workConn := conn
-	payloadRW, err := msg.NewUDPPacketReadWriter(workConn, pxy.clientCfg.Transport.WireProtocol, pxy.udpPacketCodec)
-	if err != nil {
-		xl.Errorf("create SUDP packet read writer: %v", err)
-		_ = workConn.Close()
-		return
-	}
-	payloadConn := msg.NewConn(workConn, payloadRW)
 	readCh := make(chan *msg.UDPPacket, 1024)
 	sendCh := make(chan msg.Message, 1024)
 	isClose := false
@@ -116,7 +126,7 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 	}
 
 	// udp service <- frpc <- frps <- frpc visitor <- user
-	workConnReaderFn := func(payloadConn *msg.Conn, readCh chan *msg.UDPPacket) {
+	workConnReaderFn := func(conn net.Conn, readCh chan *msg.UDPPacket) {
 		defer closeFn()
 
 		for {
@@ -129,7 +139,7 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 			}
 
 			var udpMsg msg.UDPPacket
-			if errRet := payloadConn.ReadMsgInto(&udpMsg); errRet != nil {
+			if errRet := msg.ReadMsgInto(conn, &udpMsg); errRet != nil {
 				xl.Warnf("read from workConn for sudp error: %v", errRet)
 				return
 			}
@@ -144,7 +154,7 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 	}
 
 	// udp service -> frpc -> frps -> frpc visitor -> user
-	workConnSenderFn := func(payloadConn *msg.Conn, sendCh chan msg.Message) {
+	workConnSenderFn := func(conn net.Conn, sendCh chan msg.Message) {
 		defer func() {
 			closeFn()
 			xl.Infof("writer goroutine for sudp work connection closed")
@@ -155,12 +165,12 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 			switch m := rawMsg.(type) {
 			case *msg.UDPPacket:
 				xl.Tracef("frpc send udp package to frpc visitor, [udp local: %v, remote: %v], [tcp work conn local: %v, remote: %v]",
-					m.LocalAddr.String(), m.RemoteAddr.String(), payloadConn.LocalAddr().String(), payloadConn.RemoteAddr().String())
+					m.LocalAddr.String(), m.RemoteAddr.String(), conn.LocalAddr().String(), conn.RemoteAddr().String())
 			case *msg.Ping:
 				xl.Tracef("frpc send ping message to frpc visitor")
 			}
 
-			if errRet = payloadConn.WriteMsg(rawMsg); errRet != nil {
+			if errRet = msg.WriteMsg(conn, rawMsg); errRet != nil {
 				xl.Errorf("sudp work write error: %v", errRet)
 				return
 			}
@@ -191,8 +201,8 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 		}
 	}
 
-	go workConnSenderFn(payloadConn, sendCh)
+	go workConnSenderFn(workConn, sendCh)
-	go workConnReaderFn(payloadConn, readCh)
+	go workConnReaderFn(workConn, readCh)
 	go heartbeatFn(sendCh)
 
 	udp.Forwarder(pxy.localAddr, readCh, sendCh, int(pxy.clientCfg.UDPPacketSize), pxy.cfg.Transport.ProxyProtocolVersion)

client/proxy/udp.go

@@ -17,21 +17,24 @@
 package proxy
 
 import (
+	"io"
 	"net"
 	"reflect"
 	"strconv"
 	"time"
 
 	"github.com/fatedier/golib/errors"
+	libio "github.com/fatedier/golib/io"
 
 	v1 "github.com/fatedier/frp/pkg/config/v1"
 	"github.com/fatedier/frp/pkg/msg"
 	"github.com/fatedier/frp/pkg/proto/udp"
+	"github.com/fatedier/frp/pkg/util/limit"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
 )
 
 func init() {
-	RegisterProxyFactory(reflect.TypeFor[*v1.UDPProxyConfig](), NewUDPProxy)
+	RegisterProxyFactory(reflect.TypeOf(&v1.UDPProxyConfig{}), NewUDPProxy)
 }
 
 type UDPProxy struct {
@@ -87,36 +90,41 @@ func (pxy *UDPProxy) Close() {
 
 func (pxy *UDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 	xl := pxy.xl
-	xl.Infof("收到一条新的 UDP 代理工作连接, %s", conn.RemoteAddr().String())
+	xl.Infof("incoming a new work connection for udp proxy, %s", conn.RemoteAddr().String())
 	// close resources related with old workConn
 	pxy.Close()
 
-	remote, _, err := pxy.wrapWorkConn(conn, pxy.encryptionKey)
+	var rwc io.ReadWriteCloser = conn
+	var err error
+	if pxy.limiter != nil {
+		rwc = libio.WrapReadWriteCloser(limit.NewReader(conn, pxy.limiter), limit.NewWriter(conn, pxy.limiter), func() error {
+			return conn.Close()
+		})
+	}
+	if pxy.cfg.Transport.UseEncryption {
+		rwc, err = libio.WithEncryption(rwc, pxy.encryptionKey)
 		if err != nil {
-		xl.Errorf("wrap work connection: %v", err)
+			conn.Close()
+			xl.Errorf("create encryption stream error: %v", err)
 			return
 		}
-
-	workConn := netpkg.WrapReadWriteCloserToConn(remote, conn)
-	// Plain UDP payload follows the configured wire protocol for message framing.
-	payloadRW, err := msg.NewUDPPacketReadWriter(workConn, pxy.clientCfg.Transport.WireProtocol, pxy.udpPacketCodec)
-	if err != nil {
-		xl.Errorf("create UDP packet read writer: %v", err)
-		workConn.Close()
-		return
 	}
+	if pxy.cfg.Transport.UseCompression {
+		rwc = libio.WithCompression(rwc)
+	}
+	conn = netpkg.WrapReadWriteCloserToConn(rwc, conn)
 
 	pxy.mu.Lock()
-	pxy.workConn = workConn
+	pxy.workConn = conn
 	pxy.readCh = make(chan *msg.UDPPacket, 1024)
 	pxy.sendCh = make(chan msg.Message, 1024)
 	pxy.closed = false
 	pxy.mu.Unlock()
 
-	workConnReaderFn := func(rw msg.ReadWriter, readCh chan *msg.UDPPacket) {
+	workConnReaderFn := func(conn net.Conn, readCh chan *msg.UDPPacket) {
 		for {
 			var udpMsg msg.UDPPacket
-			if errRet := rw.ReadMsgInto(&udpMsg); errRet != nil {
+			if errRet := msg.ReadMsgInto(conn, &udpMsg); errRet != nil {
 				xl.Warnf("read from workConn for udp error: %v", errRet)
 				return
 			}
@@ -129,7 +137,7 @@ func (pxy *UDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 			}
 		}
 	}
-	workConnSenderFn := func(rw msg.ReadWriter, sendCh chan msg.Message) {
+	workConnSenderFn := func(conn net.Conn, sendCh chan msg.Message) {
 		defer func() {
 			xl.Infof("writer goroutine for udp work connection closed")
 		}()
@@ -141,7 +149,7 @@ func (pxy *UDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 			case *msg.Ping:
 				xl.Tracef("send ping message to udp workConn")
 			}
-			if errRet = rw.WriteMsg(rawMsg); errRet != nil {
+			if errRet = msg.WriteMsg(conn, rawMsg); errRet != nil {
 				xl.Errorf("udp work write error: %v", errRet)
 				return
 			}
@@ -160,8 +168,8 @@ func (pxy *UDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 		}
 	}
 
-	go workConnSenderFn(payloadRW, pxy.sendCh)
+	go workConnSenderFn(pxy.workConn, pxy.sendCh)
-	go workConnReaderFn(payloadRW, pxy.readCh)
+	go workConnReaderFn(pxy.workConn, pxy.readCh)
 	go heartbeatFn(pxy.sendCh)
 
 	// Call Forwarder with proxy protocol version (empty string means no proxy protocol)

client/proxy/xtcp.go

@@ -34,7 +34,7 @@ import (
 )
 
 func init() {
-	RegisterProxyFactory(reflect.TypeFor[*v1.XTCPProxyConfig](), NewXTCPProxy)
+	RegisterProxyFactory(reflect.TypeOf(&v1.XTCPProxyConfig{}), NewXTCPProxy)
 }
 
 type XTCPProxy struct {
@@ -57,7 +57,8 @@ func NewXTCPProxy(baseProxy *BaseProxy, cfg v1.ProxyConfigurer) Proxy {
 func (pxy *XTCPProxy) InWorkConn(conn net.Conn, startWorkConnMsg *msg.StartWorkConn) {
 	xl := pxy.xl
 	defer conn.Close()
-	natHoleSidMsg, err := readNatHoleSid(conn, pxy.clientCfg.Transport.WireProtocol)
+	var natHoleSidMsg msg.NatHoleSid
+	err := msg.ReadMsgInto(conn, &natHoleSidMsg)
 	if err != nil {
 		xl.Errorf("xtcp read from workConn error: %v", err)
 		return
@@ -130,15 +131,6 @@ func (pxy *XTCPProxy) InWorkConn(conn net.Conn, startWorkConnMsg *msg.StartWorkC
 	pxy.listenByQUIC(listenConn, raddr, startWorkConnMsg)
 }
 
-func readNatHoleSid(conn net.Conn, wireProtocol string) (*msg.NatHoleSid, error) {
-	workMsgConn := msg.NewConn(conn, msg.NewReadWriter(conn, wireProtocol))
-	var natHoleSidMsg msg.NatHoleSid
-	if err := workMsgConn.ReadMsgInto(&natHoleSidMsg); err != nil {
-		return nil, err
-	}
-	return &natHoleSidMsg, nil
-}
-
 func (pxy *XTCPProxy) listenByKCP(listenConn *net.UDPConn, raddr *net.UDPAddr, startWorkConnMsg *msg.StartWorkConn) {
 	xl := pxy.xl
 	listenConn.Close()

client/proxy/xtcp_test.go

@@ -1,66 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//go:build !frps
-
-package proxy
-
-import (
-	"net"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/proto/wire"
-)
-
-func TestReadNatHoleSidUsesSelectedWireProtocol(t *testing.T) {
-	for _, tc := range []struct {
-		name         string
-		wireProtocol string
-	}{
-		{name: "v2", wireProtocol: wire.ProtocolV2},
-		{name: "v1", wireProtocol: wire.ProtocolV1},
-		{name: "default", wireProtocol: ""},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			client, server := net.Pipe()
-			defer client.Close()
-			defer server.Close()
-			setPipeDeadline(t, client, server)
-
-			errCh := make(chan error, 1)
-			go func() {
-				writer := msg.NewConn(server, msg.NewReadWriter(server, tc.wireProtocol))
-				errCh <- writer.WriteMsg(&msg.NatHoleSid{Sid: "sid"})
-			}()
-
-			out, err := readNatHoleSid(client, tc.wireProtocol)
-			require.NoError(t, err)
-			require.Equal(t, "sid", out.Sid)
-			require.NoError(t, <-errCh)
-		})
-	}
-}
-
-func setPipeDeadline(t *testing.T, conns ...net.Conn) {
-	t.Helper()
-
-	deadline := time.Now().Add(time.Second)
-	for _, conn := range conns {
-		require.NoError(t, conn.SetDeadline(deadline))
-	}
-}

client/service.go

@@ -19,10 +19,9 @@ import (
 	"errors"
 	"fmt"
 	"net"
-	"net/http"
 	"os"
+	"runtime"
 	"sync"
-	"sync/atomic"
 	"time"
 
 	"github.com/fatedier/golib/crypto"
@@ -33,12 +32,12 @@ import (
 	"github.com/fatedier/frp/pkg/config"
 	"github.com/fatedier/frp/pkg/config/source"
 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/config/v1/validation"
 	"github.com/fatedier/frp/pkg/msg"
 	"github.com/fatedier/frp/pkg/policy/security"
 	httppkg "github.com/fatedier/frp/pkg/util/http"
 	"github.com/fatedier/frp/pkg/util/log"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
+	"github.com/fatedier/frp/pkg/util/version"
 	"github.com/fatedier/frp/pkg/util/wait"
 	"github.com/fatedier/frp/pkg/util/xlog"
 	"github.com/fatedier/frp/pkg/vnet"
@@ -111,9 +110,6 @@ func setServiceOptionsDefault(options *ServiceOptions) error {
 // Service is the client service that connects to frps and provides proxy services.
 type Service struct {
 	ctlMu sync.RWMutex
-	// Stores gracefulShutdownDuration independently from ctlMu, because the
-	// graceful shutdown wait may hold ctlMu for an arbitrary duration.
-	gracefulShutdownDuration atomic.Int64
 	// manager control connection with server
 	ctl *Control
 	// Uniq id got from frps, it will be attached to loginMsg.
@@ -155,6 +151,7 @@ type Service struct {
 	ctx context.Context
 	// call cancel to stop service
 	cancel                   context.CancelCauseFunc
+	gracefulShutdownDuration time.Duration
 
 	connectorCreator func(context.Context, *v1.ClientCommonConfig) Connector
 	handleWorkConnCb func(*v1.ProxyBaseConfig, net.Conn, *msg.StartWorkConn) bool
@@ -165,6 +162,15 @@ func NewService(options ServiceOptions) (*Service, error) {
 		return nil, err
 	}
 
+	var webServer *httppkg.Server
+	if options.Common.WebServer.Port > 0 {
+		ws, err := httppkg.NewServer(options.Common.WebServer)
+		if err != nil {
+			return nil, err
+		}
+		webServer = ws
+	}
+
 	authRuntime, err := auth.BuildClientAuth(&options.Common.Auth)
 	if err != nil {
 		return nil, err
@@ -185,17 +191,6 @@ func NewService(options ServiceOptions) (*Service, error) {
 	proxyCfgs = config.CompleteProxyConfigurers(proxyCfgs)
 	visitorCfgs = config.CompleteVisitorConfigurers(visitorCfgs)
 
-	// Create the web server after all fallible steps so its listener is not
-	// leaked when an earlier error causes NewService to return.
-	var webServer *httppkg.Server
-	if options.Common.WebServer.Port > 0 {
-		ws, err := httppkg.NewServer(options.Common.WebServer)
-		if err != nil {
-			return nil, err
-		}
-		webServer = ws
-	}
-
 	s := &Service{
 		ctx:              context.Background(),
 		auth:             authRuntime,
@@ -234,25 +229,22 @@ func (svr *Service) Run(ctx context.Context) error {
 	}
 
 	if svr.vnetController != nil {
-		vnetController := svr.vnetController
 		if err := svr.vnetController.Init(); err != nil {
 			log.Errorf("init virtual network controller error: %v", err)
-			svr.stop()
 			return err
 		}
 		go func() {
 			log.Infof("virtual network controller start...")
-			if err := vnetController.Run(); err != nil && !errors.Is(err, net.ErrClosed) {
+			if err := svr.vnetController.Run(); err != nil {
 				log.Warnf("virtual network controller exit with error: %v", err)
 			}
 		}()
 	}
 
 	if svr.webServer != nil {
-		webServer := svr.webServer
 		go func() {
-			log.Infof("admin server listen on %s", webServer.Address())
+			log.Infof("admin server listen on %s", svr.webServer.Address())
-			if err := webServer.Run(); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			if err := svr.webServer.Run(); err != nil {
 				log.Warnf("admin server exit with error: %v", err)
 			}
 		}()
@@ -263,8 +255,7 @@ func (svr *Service) Run(ctx context.Context) error {
 	if svr.ctl == nil {
 		cancelCause := cancelErr{}
 		_ = errors.As(context.Cause(svr.ctx), &cancelCause)
-		svr.stop()
+		return fmt.Errorf("login to the server failed: %v. With loginFailExit enabled, no additional retries will be attempted", cancelCause.Err)
-		return fmt.Errorf("登录服务器失败: %v. 启用 loginFailExit 后，将不再尝试重试", cancelCause.Err)
 	}
 
 	go svr.keepControllerWorking()
@@ -305,41 +296,107 @@ func (svr *Service) keepControllerWorking() {
 	), true, svr.ctx.Done())
 }
 
+// login creates a connection to frps and registers it self as a client
+// conn: control connection
+// session: if it's not nil, using tcp mux
+func (svr *Service) login() (conn net.Conn, connector Connector, err error) {
+	xl := xlog.FromContextSafe(svr.ctx)
+	connector = svr.connectorCreator(svr.ctx, svr.common)
+	if err = connector.Open(); err != nil {
+		return nil, nil, err
+	}
+
+	defer func() {
+		if err != nil {
+			connector.Close()
+		}
+	}()
+
+	conn, err = connector.Connect()
+	if err != nil {
+		return
+	}
+
+	hostname, _ := os.Hostname()
+
+	loginMsg := &msg.Login{
+		Arch:      runtime.GOARCH,
+		Os:        runtime.GOOS,
+		Hostname:  hostname,
+		PoolCount: svr.common.Transport.PoolCount,
+		User:      svr.common.User,
+		ClientID:  svr.common.ClientID,
+		Version:   version.Full(),
+		Timestamp: time.Now().Unix(),
+		RunID:     svr.runID,
+		Metas:     svr.common.Metadatas,
+	}
+	if svr.clientSpec != nil {
+		loginMsg.ClientSpec = *svr.clientSpec
+	}
+
+	// Add auth
+	if err = svr.auth.Setter.SetLogin(loginMsg); err != nil {
+		return
+	}
+
+	if err = msg.WriteMsg(conn, loginMsg); err != nil {
+		return
+	}
+
+	var loginRespMsg msg.LoginResp
+	_ = conn.SetReadDeadline(time.Now().Add(10 * time.Second))
+	if err = msg.ReadMsgInto(conn, &loginRespMsg); err != nil {
+		return
+	}
+	_ = conn.SetReadDeadline(time.Time{})
+
+	if loginRespMsg.Error != "" {
+		err = fmt.Errorf("%s", loginRespMsg.Error)
+		xl.Errorf("%s", loginRespMsg.Error)
+		return
+	}
+
+	svr.runID = loginRespMsg.RunID
+	xl.AddPrefix(xlog.LogPrefix{Name: "runID", Value: svr.runID})
+
+	xl.Infof("login to server success, get run id [%s]", loginRespMsg.RunID)
+	return
+}
+
 func (svr *Service) loopLoginUntilSuccess(maxInterval time.Duration, firstLoginExit bool) {
 	xl := xlog.FromContextSafe(svr.ctx)
 
 	loginFunc := func() (bool, error) {
-		xl.Infof("尝试连接到服务器...")
+		xl.Infof("try to connect to server...")
-		dialer := &controlSessionDialer{
+		conn, connector, err := svr.login()
-			ctx:              svr.ctx,
-			common:           svr.common,
-			auth:             svr.auth,
-			clientSpec:       svr.clientSpec,
-			vnetController:   svr.vnetController,
-			connectorCreator: svr.connectorCreator,
-		}
-		sessionCtx, err := dialer.Dial(svr.runID)
 		if err != nil {
-			xl.Warnf("连接服务器错误: %v", err)
+			xl.Warnf("connect to server error: %v", err)
 			if firstLoginExit {
 				svr.cancel(cancelErr{Err: err})
 			}
 			return false, err
 		}
 
-		svr.runID = sessionCtx.RunID
-		xl.AddPrefix(xlog.LogPrefix{Name: "runID", Value: svr.runID})
-		xl.Infof("login to server success, get run id [%s]", svr.runID)
-
 		svr.cfgMu.RLock()
 		proxyCfgs := svr.proxyCfgs
 		visitorCfgs := svr.visitorCfgs
 		svr.cfgMu.RUnlock()
 
+		connEncrypted := svr.clientSpec == nil || svr.clientSpec.Type != "ssh-tunnel"
+
+		sessionCtx := &SessionContext{
+			Common:         svr.common,
+			RunID:          svr.runID,
+			Conn:           conn,
+			ConnEncrypted:  connEncrypted,
+			Auth:           svr.auth,
+			Connector:      connector,
+			VnetController: svr.vnetController,
+		}
 		ctl, err := NewControl(svr.ctx, sessionCtx)
 		if err != nil {
-			sessionCtx.Conn.Close()
+			conn.Close()
-			sessionCtx.Connector.Close()
 			xl.Errorf("new control error: %v", err)
 			return false, err
 		}
@@ -416,7 +473,7 @@ func (svr *Service) Close() {
 }
 
 func (svr *Service) GracefulClose(d time.Duration) {
-	svr.gracefulShutdownDuration.Store(int64(d))
+	svr.gracefulShutdownDuration = d
 	svr.cancel(nil)
 }
 
@@ -433,18 +490,13 @@ func (svr *Service) stop() {
 	svr.ctlMu.Lock()
 	defer svr.ctlMu.Unlock()
 	if svr.ctl != nil {
-		d := time.Duration(svr.gracefulShutdownDuration.Load())
+		svr.ctl.GracefulClose(svr.gracefulShutdownDuration)
-		svr.ctl.GracefulClose(d)
 		svr.ctl = nil
 	}
 	if svr.webServer != nil {
 		svr.webServer.Close()
 		svr.webServer = nil
 	}
-	if svr.vnetController != nil {
-		_ = svr.vnetController.Stop()
-		svr.vnetController = nil
-	}
 }
 
 func (svr *Service) getProxyStatus(name string) (*proxy.WorkingStatus, bool) {
@@ -458,17 +510,6 @@ func (svr *Service) getProxyStatus(name string) (*proxy.WorkingStatus, bool) {
 	return ctl.pm.GetProxyStatus(name)
 }
 
-func (svr *Service) getVisitorCfg(name string) (v1.VisitorConfigurer, bool) {
-	svr.ctlMu.RLock()
-	ctl := svr.ctl
-	svr.ctlMu.RUnlock()
-
-	if ctl == nil {
-		return nil, false
-	}
-	return ctl.vm.GetVisitorCfg(name)
-}
-
 func (svr *Service) StatusExporter() StatusExporter {
 	return &statusExporterImpl{
 		getProxyStatusFunc: svr.getProxyStatus,
@@ -511,13 +552,6 @@ func (svr *Service) reloadConfigFromSourcesLocked() error {
 	proxies, visitors = config.FilterClientConfigurers(reloadCommon, proxies, visitors)
 	proxies = config.CompleteProxyConfigurers(proxies)
 	visitors = config.CompleteVisitorConfigurers(visitors)
-	requirements := validation.GetClientConfigRequirements(reloadCommon, proxies, visitors)
-	if svr.vnetController == nil && requirements.VirtualNet {
-		return errors.New(
-			"VirtualNet-dependent configuration requires a VirtualNet runtime enabled at startup; " +
-				"restart frpc after configuring featureGates.VirtualNet and virtualNet.address",
-		)
-	}
 
 	// Atomically replace the entire configuration
 	if err := svr.UpdateAllConfigurer(proxies, visitors); err != nil {

client/service_shutdown_test.go

@@ -1,95 +0,0 @@
-package client
-
-import (
-	"context"
-	"net"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/fatedier/frp/client/proxy"
-	"github.com/fatedier/frp/client/visitor"
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
-)
-
-type gracefulCloseTestConnector struct {
-	conn net.Conn
-}
-
-func (*gracefulCloseTestConnector) Connect() (*msg.Conn, error) { return nil, net.ErrClosed }
-func (c *gracefulCloseTestConnector) Close() error              { return c.conn.Close() }
-
-func newGracefulCloseTestService() *Service {
-	ctx := context.Background()
-	common := &v1.ClientCommonConfig{}
-	serverConn, clientConn := net.Pipe()
-	ctl := &Control{
-		ctx: ctx,
-		sessionCtx: &SessionContext{
-			Common:    common,
-			RunID:     "graceful-close-race",
-			Conn:      msg.NewConn(clientConn, msg.NewV1ReadWriter(clientConn)),
-			Connector: &gracefulCloseTestConnector{conn: serverConn},
-		},
-		doneCh: make(chan struct{}),
-	}
-	ctl.pm = proxy.NewManager(ctx, common, nil, nil, nil, "")
-	ctl.vm = visitor.NewManager(ctx, "graceful-close-race", common, nil, nil, nil, "")
-	return &Service{ctl: ctl, cancel: context.CancelCauseFunc(func(error) {})}
-}
-
-func TestGracefulCloseAndStopSynchronizeDuration(t *testing.T) {
-	for i := range 10000 {
-		svr := newGracefulCloseTestService()
-		start := make(chan struct{})
-		var wg sync.WaitGroup
-		wg.Add(2)
-		go func() {
-			defer wg.Done()
-			<-start
-			svr.GracefulClose(time.Duration(i))
-		}()
-		go func() {
-			defer wg.Done()
-			<-start
-			svr.stop()
-		}()
-		close(start)
-		wg.Wait()
-	}
-}
-
-func TestGracefulCloseDoesNotBlockDuringStop(t *testing.T) {
-	const gracefulDuration = 200 * time.Millisecond
-
-	svr := newGracefulCloseTestService()
-	svr.GracefulClose(gracefulDuration)
-	stopDone := make(chan struct{})
-	go func() {
-		svr.stop()
-		close(stopDone)
-	}()
-	defer func() {
-		select {
-		case <-stopDone:
-		case <-time.After(time.Second):
-			t.Error("stop did not finish")
-		}
-	}()
-
-	deadline := time.Now().Add(time.Second)
-	for svr.ctlMu.TryLock() {
-		svr.ctlMu.Unlock()
-		if time.Now().After(deadline) {
-			t.Fatal("stop did not acquire ctlMu")
-		}
-		time.Sleep(time.Millisecond)
-	}
-
-	start := time.Now()
-	svr.GracefulClose(0)
-	if elapsed := time.Since(start); elapsed >= gracefulDuration/2 {
-		t.Fatalf("GracefulClose blocked for %v while stop was waiting", elapsed)
-	}
-}

client/service_test.go

@@ -1,120 +1,14 @@
 package client
 
 import (
-	"context"
-	"errors"
-	"net"
 	"path/filepath"
-	"strconv"
 	"strings"
 	"testing"
 
-	"github.com/samber/lo"
-
 	"github.com/fatedier/frp/pkg/config/source"
 	v1 "github.com/fatedier/frp/pkg/config/v1"
 )
 
-type failingConnector struct {
-	err error
-}
-
-func (c *failingConnector) Open() error {
-	return c.err
-}
-
-func (c *failingConnector) Connect() (net.Conn, error) {
-	return nil, c.err
-}
-
-func (c *failingConnector) Close() error {
-	return nil
-}
-
-func getFreeTCPPort(t *testing.T) int {
-	t.Helper()
-
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen on ephemeral port: %v", err)
-	}
-	defer ln.Close()
-
-	return ln.Addr().(*net.TCPAddr).Port
-}
-
-func TestRunStopsStartedComponentsOnInitialLoginFailure(t *testing.T) {
-	port := getFreeTCPPort(t)
-	agg := source.NewAggregator(source.NewConfigSource())
-
-	svr, err := NewService(ServiceOptions{
-		Common: &v1.ClientCommonConfig{
-			LoginFailExit: lo.ToPtr(true),
-			WebServer: v1.WebServerConfig{
-				Addr: "127.0.0.1",
-				Port: port,
-			},
-		},
-		ConfigSourceAggregator: agg,
-		ConnectorCreator: func(context.Context, *v1.ClientCommonConfig) Connector {
-			return &failingConnector{err: errors.New("login boom")}
-		},
-	})
-	if err != nil {
-		t.Fatalf("new service: %v", err)
-	}
-
-	err = svr.Run(context.Background())
-	if err == nil {
-		t.Fatal("expected run error, got nil")
-	}
-	if !strings.Contains(err.Error(), "login boom") {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if svr.webServer != nil {
-		t.Fatal("expected web server to be cleaned up after initial login failure")
-	}
-
-	ln, err := net.Listen("tcp", net.JoinHostPort("127.0.0.1", strconv.Itoa(port)))
-	if err != nil {
-		t.Fatalf("expected admin port to be released: %v", err)
-	}
-	_ = ln.Close()
-}
-
-func TestNewServiceDoesNotLeakAdminListenerOnAuthBuildFailure(t *testing.T) {
-	port := getFreeTCPPort(t)
-	agg := source.NewAggregator(source.NewConfigSource())
-
-	_, err := NewService(ServiceOptions{
-		Common: &v1.ClientCommonConfig{
-			Auth: v1.AuthClientConfig{
-				Method: v1.AuthMethodOIDC,
-				OIDC: v1.AuthOIDCClientConfig{
-					TokenEndpointURL: "://bad",
-				},
-			},
-			WebServer: v1.WebServerConfig{
-				Addr: "127.0.0.1",
-				Port: port,
-			},
-		},
-		ConfigSourceAggregator: agg,
-	})
-	if err == nil {
-		t.Fatal("expected new service error, got nil")
-	}
-	if !strings.Contains(err.Error(), "auth.oidc.tokenEndpointURL") {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	ln, err := net.Listen("tcp", net.JoinHostPort("127.0.0.1", strconv.Itoa(port)))
-	if err != nil {
-		t.Fatalf("expected admin port to remain free: %v", err)
-	}
-	_ = ln.Close()
-}
-
 func TestUpdateConfigSourceRollsBackReloadCommonOnReplaceAllFailure(t *testing.T) {
 	prevCommon := &v1.ClientCommonConfig{User: "old-user"}
 	newCommon := &v1.ClientCommonConfig{User: "new-user"}

client/visitor/stcp.go

@@ -15,12 +15,18 @@
 package visitor
 
 import (
+	"fmt"
+	"io"
 	"net"
 	"strconv"
+	"time"
 
 	libio "github.com/fatedier/golib/io"
 
 	v1 "github.com/fatedier/frp/pkg/config/v1"
+	"github.com/fatedier/frp/pkg/msg"
+	"github.com/fatedier/frp/pkg/naming"
+	"github.com/fatedier/frp/pkg/util/util"
 	"github.com/fatedier/frp/pkg/util/xlog"
 )
 
@@ -36,10 +42,10 @@ func (sv *STCPVisitor) Run() (err error) {
 		if err != nil {
 			return
 		}
-		go sv.acceptLoop(sv.l, "stcp local", sv.handleConn)
+		go sv.worker()
 	}
 
-	go sv.acceptLoop(sv.internalLn, "stcp internal", sv.handleConn)
+	go sv.internalConnWorker()
 
 	if sv.plugin != nil {
 		sv.plugin.Start()
@@ -51,10 +57,35 @@ func (sv *STCPVisitor) Close() {
 	sv.BaseVisitor.Close()
 }
 
+func (sv *STCPVisitor) worker() {
+	xl := xlog.FromContextSafe(sv.ctx)
+	for {
+		conn, err := sv.l.Accept()
+		if err != nil {
+			xl.Warnf("stcp local listener closed")
+			return
+		}
+		go sv.handleConn(conn)
+	}
+}
+
+func (sv *STCPVisitor) internalConnWorker() {
+	xl := xlog.FromContextSafe(sv.ctx)
+	for {
+		conn, err := sv.internalLn.Accept()
+		if err != nil {
+			xl.Warnf("stcp internal listener closed")
+			return
+		}
+		go sv.handleConn(conn)
+	}
+}
+
 func (sv *STCPVisitor) handleConn(userConn net.Conn) {
 	xl := xlog.FromContextSafe(sv.ctx)
 	var tunnelErr error
 	defer func() {
+		// If there was an error and connection supports CloseWithError, use it
 		if tunnelErr != nil {
 			if eConn, ok := userConn.(interface{ CloseWithError(error) error }); ok {
 				_ = eConn.CloseWithError(tunnelErr)
@@ -65,21 +96,62 @@ func (sv *STCPVisitor) handleConn(userConn net.Conn) {
 	}()
 
 	xl.Debugf("get a new stcp user connection")
-	visitorConn, err := sv.dialRawVisitorConn(sv.cfg.GetBaseConfig())
+	visitorConn, err := sv.helper.ConnectServer()
 	if err != nil {
-		xl.Warnf("dialRawVisitorConn error: %v", err)
 		tunnelErr = err
 		return
 	}
 	defer visitorConn.Close()
 
-	remote, recycleFn, err := wrapVisitorConn(visitorConn, sv.cfg.GetBaseConfig())
+	now := time.Now().Unix()
+	targetProxyName := naming.BuildTargetServerProxyName(sv.clientCfg.User, sv.cfg.ServerUser, sv.cfg.ServerName)
+	newVisitorConnMsg := &msg.NewVisitorConn{
+		RunID:          sv.helper.RunID(),
+		ProxyName:      targetProxyName,
+		SignKey:        util.GetAuthKey(sv.cfg.SecretKey, now),
+		Timestamp:      now,
+		UseEncryption:  sv.cfg.Transport.UseEncryption,
+		UseCompression: sv.cfg.Transport.UseCompression,
+	}
+	err = msg.WriteMsg(visitorConn, newVisitorConnMsg)
 	if err != nil {
-		xl.Warnf("wrapVisitorConn error: %v", err)
+		xl.Warnf("send newVisitorConnMsg to server error: %v", err)
 		tunnelErr = err
 		return
 	}
+
+	var newVisitorConnRespMsg msg.NewVisitorConnResp
+	_ = visitorConn.SetReadDeadline(time.Now().Add(10 * time.Second))
+	err = msg.ReadMsgInto(visitorConn, &newVisitorConnRespMsg)
+	if err != nil {
+		xl.Warnf("get newVisitorConnRespMsg error: %v", err)
+		tunnelErr = err
+		return
+	}
+	_ = visitorConn.SetReadDeadline(time.Time{})
+
+	if newVisitorConnRespMsg.Error != "" {
+		xl.Warnf("start new visitor connection error: %s", newVisitorConnRespMsg.Error)
+		tunnelErr = fmt.Errorf("%s", newVisitorConnRespMsg.Error)
+		return
+	}
+
+	var remote io.ReadWriteCloser
+	remote = visitorConn
+	if sv.cfg.Transport.UseEncryption {
+		remote, err = libio.WithEncryption(remote, []byte(sv.cfg.SecretKey))
+		if err != nil {
+			xl.Errorf("create encryption stream error: %v", err)
+			tunnelErr = err
+			return
+		}
+	}
+
+	if sv.cfg.Transport.UseCompression {
+		var recycleFn func()
+		remote, recycleFn = libio.WithCompressionFromPool(remote)
 		defer recycleFn()
+	}
 
 	libio.Join(userConn, remote)
 }

client/visitor/sudp.go

@@ -16,17 +16,21 @@ package visitor
 
 import (
 	"fmt"
+	"io"
 	"net"
 	"strconv"
 	"sync"
 	"time"
 
 	"github.com/fatedier/golib/errors"
+	libio "github.com/fatedier/golib/io"
 
 	v1 "github.com/fatedier/frp/pkg/config/v1"
 	"github.com/fatedier/frp/pkg/msg"
+	"github.com/fatedier/frp/pkg/naming"
 	"github.com/fatedier/frp/pkg/proto/udp"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
+	"github.com/fatedier/frp/pkg/util/util"
 	"github.com/fatedier/frp/pkg/util/xlog"
 )
 
@@ -72,7 +76,6 @@ func (sv *SUDPVisitor) dispatcher() {
 
 	var (
 		visitorConn net.Conn
-		recycleFn   func()
 		err         error
 
 		firstPacket *msg.UDPPacket
@@ -90,17 +93,14 @@ func (sv *SUDPVisitor) dispatcher() {
 			return
 		}
 
-		visitorConn, recycleFn, err = sv.getNewVisitorConn()
+		visitorConn, err = sv.getNewVisitorConn()
 		if err != nil {
 			xl.Warnf("newVisitorConn to frps error: %v, try to reconnect", err)
 			continue
 		}
 
 		// visitorConn always be closed when worker done.
-		func() {
-			defer recycleFn()
 		sv.worker(visitorConn, firstPacket)
-		}()
 
 		select {
 		case <-sv.checkCloseCh:
@@ -113,22 +113,15 @@ func (sv *SUDPVisitor) dispatcher() {
 func (sv *SUDPVisitor) worker(workConn net.Conn, firstPacket *msg.UDPPacket) {
 	xl := xlog.FromContextSafe(sv.ctx)
 	xl.Debugf("starting sudp proxy worker")
-	payloadRW, err := msg.NewUDPPacketReadWriter(workConn, sv.clientCfg.Transport.WireProtocol, udpPacketCodecFromHelper(sv.helper))
-	if err != nil {
-		xl.Errorf("create SUDP packet read writer: %v", err)
-		_ = workConn.Close()
-		return
-	}
-	payloadConn := msg.NewConn(workConn, payloadRW)
 
 	wg := &sync.WaitGroup{}
 	wg.Add(2)
 	closeCh := make(chan struct{})
 
 	// udp service -> frpc -> frps -> frpc visitor -> user
-	workConnReaderFn := func(payloadConn *msg.Conn) {
+	workConnReaderFn := func(conn net.Conn) {
 		defer func() {
-			payloadConn.Close()
+			conn.Close()
 			close(closeCh)
 			wg.Done()
 		}()
@@ -140,13 +133,13 @@ func (sv *SUDPVisitor) worker(workConn net.Conn, firstPacket *msg.UDPPacket) {
 			)
 
 			// frpc will send heartbeat in workConn to frpc visitor for keeping alive
-			_ = payloadConn.SetReadDeadline(time.Now().Add(60 * time.Second))
+			_ = conn.SetReadDeadline(time.Now().Add(60 * time.Second))
-			if rawMsg, errRet = payloadConn.ReadMsg(); errRet != nil {
+			if rawMsg, errRet = msg.ReadMsg(conn); errRet != nil {
 				xl.Warnf("read from workconn for user udp conn error: %v", errRet)
 				return
 			}
 
-			_ = payloadConn.SetReadDeadline(time.Time{})
+			_ = conn.SetReadDeadline(time.Time{})
 			switch m := rawMsg.(type) {
 			case *msg.Ping:
 				xl.Debugf("frpc visitor get ping message from frpc")
@@ -164,15 +157,15 @@ func (sv *SUDPVisitor) worker(workConn net.Conn, firstPacket *msg.UDPPacket) {
 	}
 
 	// udp service <- frpc <- frps <- frpc visitor <- user
-	workConnSenderFn := func(payloadConn *msg.Conn) {
+	workConnSenderFn := func(conn net.Conn) {
 		defer func() {
-			payloadConn.Close()
+			conn.Close()
 			wg.Done()
 		}()
 
 		var errRet error
 		if firstPacket != nil {
-			if errRet = payloadConn.WriteMsg(firstPacket); errRet != nil {
+			if errRet = msg.WriteMsg(conn, firstPacket); errRet != nil {
 				xl.Warnf("sender goroutine for udp work connection closed: %v", errRet)
 				return
 			}
@@ -187,7 +180,7 @@ func (sv *SUDPVisitor) worker(workConn net.Conn, firstPacket *msg.UDPPacket) {
 					return
 				}
 
-				if errRet = payloadConn.WriteMsg(udpMsg); errRet != nil {
+				if errRet = msg.WriteMsg(conn, udpMsg); errRet != nil {
 					xl.Warnf("sender goroutine for udp work connection closed: %v", errRet)
 					return
 				}
@@ -198,24 +191,60 @@ func (sv *SUDPVisitor) worker(workConn net.Conn, firstPacket *msg.UDPPacket) {
 		}
 	}
 
-	go workConnReaderFn(payloadConn)
+	go workConnReaderFn(workConn)
-	go workConnSenderFn(payloadConn)
+	go workConnSenderFn(workConn)
 
 	wg.Wait()
 	xl.Infof("sudp worker is closed")
 }
 
-func (sv *SUDPVisitor) getNewVisitorConn() (net.Conn, func(), error) {
+func (sv *SUDPVisitor) getNewVisitorConn() (net.Conn, error) {
-	rawConn, err := sv.dialRawVisitorConn(sv.cfg.GetBaseConfig())
+	xl := xlog.FromContextSafe(sv.ctx)
+	visitorConn, err := sv.helper.ConnectServer()
 	if err != nil {
-		return nil, func() {}, err
+		return nil, fmt.Errorf("frpc connect frps error: %v", err)
 	}
-	rwc, recycleFn, err := wrapVisitorConn(rawConn, sv.cfg.GetBaseConfig())
+
+	now := time.Now().Unix()
+	targetProxyName := naming.BuildTargetServerProxyName(sv.clientCfg.User, sv.cfg.ServerUser, sv.cfg.ServerName)
+	newVisitorConnMsg := &msg.NewVisitorConn{
+		RunID:          sv.helper.RunID(),
+		ProxyName:      targetProxyName,
+		SignKey:        util.GetAuthKey(sv.cfg.SecretKey, now),
+		Timestamp:      now,
+		UseEncryption:  sv.cfg.Transport.UseEncryption,
+		UseCompression: sv.cfg.Transport.UseCompression,
+	}
+	err = msg.WriteMsg(visitorConn, newVisitorConnMsg)
 	if err != nil {
-		rawConn.Close()
+		return nil, fmt.Errorf("frpc send newVisitorConnMsg to frps error: %v", err)
-		return nil, func() {}, err
 	}
-	return netpkg.WrapReadWriteCloserToConn(rwc, rawConn), recycleFn, nil
+
+	var newVisitorConnRespMsg msg.NewVisitorConnResp
+	_ = visitorConn.SetReadDeadline(time.Now().Add(10 * time.Second))
+	err = msg.ReadMsgInto(visitorConn, &newVisitorConnRespMsg)
+	if err != nil {
+		return nil, fmt.Errorf("frpc read newVisitorConnRespMsg error: %v", err)
+	}
+	_ = visitorConn.SetReadDeadline(time.Time{})
+
+	if newVisitorConnRespMsg.Error != "" {
+		return nil, fmt.Errorf("start new visitor connection error: %s", newVisitorConnRespMsg.Error)
+	}
+
+	var remote io.ReadWriteCloser
+	remote = visitorConn
+	if sv.cfg.Transport.UseEncryption {
+		remote, err = libio.WithEncryption(remote, []byte(sv.cfg.SecretKey))
+		if err != nil {
+			xl.Errorf("create encryption stream error: %v", err)
+			return nil, err
+		}
+	}
+	if sv.cfg.Transport.UseCompression {
+		remote = libio.WithCompression(remote)
+	}
+	return netpkg.WrapReadWriteCloserToConn(remote, visitorConn), nil
 }
 
 func (sv *SUDPVisitor) Close() {

client/visitor/visitor.go

@@ -16,21 +16,13 @@ package visitor
 
 import (
 	"context"
-	"fmt"
-	"io"
 	"net"
 	"sync"
-	"time"
-
-	libio "github.com/fatedier/golib/io"
 
 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/naming"
 	plugin "github.com/fatedier/frp/pkg/plugin/visitor"
 	"github.com/fatedier/frp/pkg/transport"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
-	"github.com/fatedier/frp/pkg/util/util"
 	"github.com/fatedier/frp/pkg/util/xlog"
 	"github.com/fatedier/frp/pkg/vnet"
 )
@@ -38,7 +30,7 @@ import (
 // Helper wraps some functions for visitor to use.
 type Helper interface {
 	// ConnectServer directly connects to the frp server.
-	ConnectServer() (*msg.Conn, error)
+	ConnectServer() (net.Conn, error)
 	// TransferConn transfers the connection to another visitor.
 	TransferConn(string, net.Conn) error
 	// MsgTransporter returns the message transporter that is used to send and receive messages
@@ -50,17 +42,6 @@ type Helper interface {
 	RunID() string
 }
 
-type udpPacketCodecProvider interface {
-	UDPPacketCodec() string
-}
-
-func udpPacketCodecFromHelper(helper Helper) string {
-	if provider, ok := helper.(udpPacketCodecProvider); ok {
-		return provider.UDPPacketCodec()
-	}
-	return ""
-}
-
 // Visitor is used for forward traffics from local port tot remote service.
 type Visitor interface {
 	Run() error
@@ -138,18 +119,6 @@ func (v *BaseVisitor) AcceptConn(conn net.Conn) error {
 	return v.internalLn.PutConn(conn)
 }
 
-func (v *BaseVisitor) acceptLoop(l net.Listener, name string, handleConn func(net.Conn)) {
-	xl := xlog.FromContextSafe(v.ctx)
-	for {
-		conn, err := l.Accept()
-		if err != nil {
-			xl.Warnf("%s listener closed", name)
-			return
-		}
-		go handleConn(conn)
-	}
-}
-
 func (v *BaseVisitor) Close() {
 	if v.l != nil {
 		v.l.Close()
@@ -161,57 +130,3 @@ func (v *BaseVisitor) Close() {
 		v.plugin.Close()
 	}
 }
-
-func (v *BaseVisitor) dialRawVisitorConn(cfg *v1.VisitorBaseConfig) (net.Conn, error) {
-	visitorConn, err := v.helper.ConnectServer()
-	if err != nil {
-		return nil, fmt.Errorf("connect to server error: %v", err)
-	}
-
-	now := time.Now().Unix()
-	targetProxyName := naming.BuildTargetServerProxyName(v.clientCfg.User, cfg.ServerUser, cfg.ServerName)
-	newVisitorConnMsg := &msg.NewVisitorConn{
-		RunID:          v.helper.RunID(),
-		ProxyName:      targetProxyName,
-		SignKey:        util.GetAuthKey(cfg.SecretKey, now),
-		Timestamp:      now,
-		UseEncryption:  cfg.Transport.UseEncryption,
-		UseCompression: cfg.Transport.UseCompression,
-	}
-	err = visitorConn.WriteMsg(newVisitorConnMsg)
-	if err != nil {
-		visitorConn.Close()
-		return nil, fmt.Errorf("send newVisitorConnMsg to server error: %v", err)
-	}
-
-	_ = visitorConn.SetReadDeadline(time.Now().Add(10 * time.Second))
-	var newVisitorConnRespMsg msg.NewVisitorConnResp
-	err = visitorConn.ReadMsgInto(&newVisitorConnRespMsg)
-	if err != nil {
-		visitorConn.Close()
-		return nil, fmt.Errorf("read newVisitorConnRespMsg error: %v", err)
-	}
-	_ = visitorConn.SetReadDeadline(time.Time{})
-
-	if newVisitorConnRespMsg.Error != "" {
-		visitorConn.Close()
-		return nil, fmt.Errorf("start new visitor connection error: %s", newVisitorConnRespMsg.Error)
-	}
-	return visitorConn, nil
-}
-
-func wrapVisitorConn(conn io.ReadWriteCloser, cfg *v1.VisitorBaseConfig) (io.ReadWriteCloser, func(), error) {
-	rwc := conn
-	if cfg.Transport.UseEncryption {
-		var err error
-		rwc, err = libio.WithEncryption(rwc, []byte(cfg.SecretKey))
-		if err != nil {
-			return nil, func() {}, fmt.Errorf("create encryption stream error: %v", err)
-		}
-	}
-	recycleFn := func() {}
-	if cfg.Transport.UseCompression {
-		rwc, recycleFn = libio.WithCompressionFromPool(rwc)
-	}
-	return rwc, recycleFn, nil
-}

client/visitor/visitor_manager.go

@@ -25,7 +25,6 @@ import (
 	"github.com/samber/lo"
 
 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
 	"github.com/fatedier/frp/pkg/transport"
 	"github.com/fatedier/frp/pkg/util/xlog"
 	"github.com/fatedier/frp/pkg/vnet"
@@ -50,15 +49,10 @@ func NewManager(
 	ctx context.Context,
 	runID string,
 	clientCfg *v1.ClientCommonConfig,
-	connectServer func() (*msg.Conn, error),
+	connectServer func() (net.Conn, error),
 	msgTransporter transport.MessageTransporter,
 	vnetController *vnet.Controller,
-	udpPacketCodecs ...string,
 ) *Manager {
-	udpPacketCodec := ""
-	if len(udpPacketCodecs) > 0 {
-		udpPacketCodec = udpPacketCodecs[0]
-	}
 	m := &Manager{
 		clientCfg:     clientCfg,
 		cfgs:          make(map[string]v1.VisitorConfigurer),
@@ -73,7 +67,6 @@ func NewManager(
 		vnetController:  vnetController,
 		transferConnFn:  m.TransferConn,
 		runID:           runID,
-		udpPacketCodec:  udpPacketCodec,
 	}
 	return m
 }
@@ -198,23 +191,15 @@ func (vm *Manager) TransferConn(name string, conn net.Conn) error {
 	return v.AcceptConn(conn)
 }
 
-func (vm *Manager) GetVisitorCfg(name string) (v1.VisitorConfigurer, bool) {
-	vm.mu.RLock()
-	defer vm.mu.RUnlock()
-	cfg, ok := vm.cfgs[name]
-	return cfg, ok
-}
-
 type visitorHelperImpl struct {
-	connectServerFn func() (*msg.Conn, error)
+	connectServerFn func() (net.Conn, error)
 	msgTransporter  transport.MessageTransporter
 	vnetController  *vnet.Controller
 	transferConnFn  func(name string, conn net.Conn) error
 	runID           string
-	udpPacketCodec  string
 }
 
-func (v *visitorHelperImpl) ConnectServer() (*msg.Conn, error) {
+func (v *visitorHelperImpl) ConnectServer() (net.Conn, error) {
 	return v.connectServerFn()
 }
 
@@ -233,7 +218,3 @@ func (v *visitorHelperImpl) VNetController() *vnet.Controller {
 func (v *visitorHelperImpl) RunID() string {
 	return v.runID
 }
-
-func (v *visitorHelperImpl) UDPPacketCodec() string {
-	return v.udpPacketCodec
-}

client/visitor/xtcp.go

@@ -65,10 +65,10 @@ func (sv *XTCPVisitor) Run() (err error) {
 		if err != nil {
 			return
 		}
-		go sv.acceptLoop(sv.l, "xtcp local", sv.handleConn)
+		go sv.worker()
 	}
 
-	go sv.acceptLoop(sv.internalLn, "xtcp internal", sv.handleConn)
+	go sv.internalConnWorker()
 	go sv.processTunnelStartEvents()
 	if sv.cfg.KeepTunnelOpen {
 		sv.retryLimiter = rate.NewLimiter(rate.Every(time.Hour/time.Duration(sv.cfg.MaxRetriesAnHour)), sv.cfg.MaxRetriesAnHour)
@@ -93,6 +93,30 @@ func (sv *XTCPVisitor) Close() {
 	}
 }
 
+func (sv *XTCPVisitor) worker() {
+	xl := xlog.FromContextSafe(sv.ctx)
+	for {
+		conn, err := sv.l.Accept()
+		if err != nil {
+			xl.Warnf("xtcp local listener closed")
+			return
+		}
+		go sv.handleConn(conn)
+	}
+}
+
+func (sv *XTCPVisitor) internalConnWorker() {
+	xl := xlog.FromContextSafe(sv.ctx)
+	for {
+		conn, err := sv.internalLn.Accept()
+		if err != nil {
+			xl.Warnf("xtcp internal listener closed")
+			return
+		}
+		go sv.handleConn(conn)
+	}
+}
+
 func (sv *XTCPVisitor) processTunnelStartEvents() {
 	for {
 		select {
@@ -182,14 +206,20 @@ func (sv *XTCPVisitor) handleConn(userConn net.Conn) {
 		return
 	}
 
-	muxConnRWCloser, recycleFn, err := wrapVisitorConn(tunnelConn, sv.cfg.GetBaseConfig())
+	var muxConnRWCloser io.ReadWriteCloser = tunnelConn
+	if sv.cfg.Transport.UseEncryption {
+		muxConnRWCloser, err = libio.WithEncryption(muxConnRWCloser, []byte(sv.cfg.SecretKey))
 		if err != nil {
-		xl.Errorf("%v", err)
+			xl.Errorf("create encryption stream error: %v", err)
-		tunnelConn.Close()
 			tunnelErr = err
 			return
 		}
+	}
+	if sv.cfg.Transport.UseCompression {
+		var recycleFn func()
+		muxConnRWCloser, recycleFn = libio.WithCompressionFromPool(muxConnRWCloser)
 		defer recycleFn()
+	}
 
 	_, _, errs := libio.Join(userConn, muxConnRWCloser)
 	xl.Debugf("join connections closed")
@@ -343,7 +373,6 @@ func (ks *KCPTunnelSession) Init(listenConn *net.UDPConn, raddr *net.UDPAddr) er
 	}
 	remote, err := netpkg.NewKCPConnFromUDP(lConn, true, raddr.String())
 	if err != nil {
-		lConn.Close()
 		return fmt.Errorf("create kcp connection from udp connection error: %v", err)
 	}
 

cmd/frpc/sub/admin.go

@@ -54,11 +54,7 @@ func NewAdminCommand(name, short string, handler func(*v1.ClientCommonConfig) er
 		Use:   name,
 		Short: short,
 		Run: func(cmd *cobra.Command, args []string) {
-			if len(cfgFiles) == 0 || cfgFiles[0] == "" {
+			cfg, _, _, _, err := config.LoadClientConfig(cfgFile, strictConfigMode)
-				fmt.Println("frpc: the configuration file is not specified")
-				os.Exit(1)
-			}
-			cfg, _, _, _, err := config.LoadClientConfig(cfgFiles[0], strictConfigMode)
 			if err != nil {
 				fmt.Println(err)
 				os.Exit(1)

cmd/frpc/sub/nathole.go

@@ -47,25 +47,14 @@ var natholeDiscoveryCmd = &cobra.Command{
 	Use:   "discover",
 	Short: "Discover nathole information from stun server",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		// ignore error here, because we can use command line parameters
+		// ignore error here, because we can use command line pameters
-		var cfg *v1.ClientCommonConfig
+		cfg, _, _, _, err := config.LoadClientConfig(cfgFile, strictConfigMode)
-		if len(cfgFiles) > 0 && cfgFiles[0] != "" {
-			loaded, _, _, _, err := config.LoadClientConfig(cfgFiles[0], strictConfigMode)
 		if err != nil {
 			cfg = &v1.ClientCommonConfig{}
 			if err := cfg.Complete(); err != nil {
 				fmt.Printf("failed to complete config: %v\n", err)
 				os.Exit(1)
 			}
-			} else {
-				cfg = loaded
-			}
-		} else {
-			cfg = &v1.ClientCommonConfig{}
-			if err := cfg.Complete(); err != nil {
-				fmt.Printf("failed to complete config: %v\n", err)
-				os.Exit(1)
-			}
 		}
 		if natHoleSTUNServer != "" {
 			cfg.NatHoleSTUNServer = natHoleSTUNServer

cmd/frpc/sub/proxy.go

@@ -94,7 +94,7 @@ func NewProxyCommand(name string, c v1.ProxyConfigurer, clientCfg *v1.ClientComm
 				fmt.Println(err)
 				os.Exit(1)
 			}
-			err := startService(clientCfg, []v1.ProxyConfigurer{proxyCfg}, nil, unsafeFeatures, "", "", "")
+			err := startService(clientCfg, []v1.ProxyConfigurer{proxyCfg}, nil, unsafeFeatures, "")
 			if err != nil {
 				fmt.Println(err)
 				os.Exit(1)
@@ -126,7 +126,7 @@ func NewVisitorCommand(name string, c v1.VisitorConfigurer, clientCfg *v1.Client
 				fmt.Println(err)
 				os.Exit(1)
 			}
-			err := startService(clientCfg, nil, []v1.VisitorConfigurer{visitorCfg}, unsafeFeatures, "", "", "")
+			err := startService(clientCfg, nil, []v1.VisitorConfigurer{visitorCfg}, unsafeFeatures, "")
 			if err != nil {
 				fmt.Println(err)
 				os.Exit(1)
@@ -141,13 +141,11 @@ func startService(
 	visitorCfgs []v1.VisitorConfigurer,
 	unsafeFeatures *security.UnsafeFeatures,
 	cfgFile string,
-	nodeName string,
-	tunnelRemark string,
 ) error {
 	configSource := source.NewConfigSource()
 	if err := configSource.ReplaceAll(proxyCfgs, visitorCfgs); err != nil {
 		return fmt.Errorf("failed to set config source: %w", err)
 	}
 	aggregator := source.NewAggregator(configSource)
-	return startServiceWithAggregator(cfg, aggregator, unsafeFeatures, cfgFile, nodeName, tunnelRemark)
+	return startServiceWithAggregator(cfg, aggregator, unsafeFeatures, cfgFile)
 }

cmd/frpc/sub/root.go

@@ -16,11 +16,8 @@ package sub
 
 import (
 	"context"
-	"encoding/base64"
-	"encoding/json"
 	"fmt"
 	"io/fs"
-	"net/http"
 	"os"
 	"os/signal"
 	"path/filepath"
@@ -36,29 +33,26 @@ import (
 	"github.com/fatedier/frp/pkg/config/source"
 	v1 "github.com/fatedier/frp/pkg/config/v1"
 	"github.com/fatedier/frp/pkg/config/v1/validation"
+	"github.com/fatedier/frp/pkg/policy/featuregate"
 	"github.com/fatedier/frp/pkg/policy/security"
-	"github.com/fatedier/frp/pkg/util/banner"
 	"github.com/fatedier/frp/pkg/util/log"
 	"github.com/fatedier/frp/pkg/util/version"
 )
 
 var (
-	cfgFiles         []string
+	cfgFile          string
 	cfgDir           string
 	showVersion      bool
 	strictConfigMode bool
 	allowUnsafe      []string
-	authTokens       []string
-
-	bannerDisplayed bool
 )
 
 func init() {
-	rootCmd.PersistentFlags().StringSliceVarP(&cfgFiles, "config", "c", []string{"./frpc.ini"}, "config files of frpc (support multiple files)")
+	rootCmd.PersistentFlags().StringVarP(&cfgFile, "config", "c", "./frpc.ini", "config file of frpc")
 	rootCmd.PersistentFlags().StringVarP(&cfgDir, "config_dir", "", "", "config directory, run one frpc service for each file in config directory")
 	rootCmd.PersistentFlags().BoolVarP(&showVersion, "version", "v", false, "version of frpc")
 	rootCmd.PersistentFlags().BoolVarP(&strictConfigMode, "strict_config", "", true, "strict config parsing mode, unknown fields will cause an errors")
-	rootCmd.PersistentFlags().StringSliceVarP(&authTokens, "token", "t", []string{}, "authentication tokens in format 'id:token' (LoliaFRP only)")
+
 	rootCmd.PersistentFlags().StringSliceVarP(&allowUnsafe, "allow-unsafe", "", []string{},
 		fmt.Sprintf("allowed unsafe features, one or more of: %s", strings.Join(security.ClientUnsafeFeatures, ", ")))
 }
@@ -74,30 +68,15 @@ var rootCmd = &cobra.Command{
 
 		unsafeFeatures := security.NewUnsafeFeatures(allowUnsafe)
 
-		// If authTokens is provided, fetch config from API
-		if len(authTokens) > 0 {
-			err := runClientWithTokens(authTokens, unsafeFeatures)
-			if err != nil {
-				fmt.Println(err)
-				os.Exit(1)
-			}
-			return nil
-		}
-
 		// If cfgDir is not empty, run multiple frpc service for each config file in cfgDir.
+		// Note that it's only designed for testing. It's not guaranteed to be stable.
 		if cfgDir != "" {
 			_ = runMultipleClients(cfgDir, unsafeFeatures)
 			return nil
 		}
 
-		// If multiple config files are specified, run one frpc service for each file
-		if len(cfgFiles) > 1 {
-			runMultipleClientsFromFiles(cfgFiles, unsafeFeatures)
-			return nil
-		}
-
 		// Do not show command usage here.
-		err := runClient(cfgFiles[0], unsafeFeatures)
+		err := runClient(cfgFile, unsafeFeatures)
 		if err != nil {
 			fmt.Println(err)
 			os.Exit(1)
@@ -127,29 +106,6 @@ func runMultipleClients(cfgDir string, unsafeFeatures *security.UnsafeFeatures)
 	return err
 }
 
-func runMultipleClientsFromFiles(cfgFiles []string, unsafeFeatures *security.UnsafeFeatures) {
-	var wg sync.WaitGroup
-
-	// Display banner first
-	banner.DisplayBanner()
-	bannerDisplayed = true
-	log.Infof("检测到 %d 个配置文件，将启动多个 frpc 服务实例", len(cfgFiles))
-
-	for _, cfgFile := range cfgFiles {
-		wg.Add(1)
-		// Add a small delay to avoid log output mixing
-		time.Sleep(100 * time.Millisecond)
-		go func(path string) {
-			defer wg.Done()
-			err := runClient(path, unsafeFeatures)
-			if err != nil {
-				fmt.Printf("\n配置文件 [%s] 启动失败: %v\n", path, err)
-			}
-		}(cfgFile)
-	}
-	wg.Wait()
-}
-
 func Execute() {
 	rootCmd.SetGlobalNormalizationFunc(config.WordSepNormalizeFunc)
 	if err := rootCmd.Execute(); err != nil {
@@ -175,6 +131,12 @@ func runClient(cfgFilePath string, unsafeFeatures *security.UnsafeFeatures) erro
 			"please use yaml/json/toml format instead!\n")
 	}
 
+	if len(result.Common.FeatureGates) > 0 {
+		if err := featuregate.SetFromMap(result.Common.FeatureGates); err != nil {
+			return err
+		}
+	}
+
 	return runClientWithAggregator(result, unsafeFeatures, cfgFilePath)
 }
 
@@ -224,7 +186,7 @@ func runClientWithAggregator(result *config.ClientConfigLoadResult, unsafeFeatur
 		return err
 	}
 
-	return startServiceWithAggregator(result.Common, aggregator, unsafeFeatures, cfgFilePath, "", "")
+	return startServiceWithAggregator(result.Common, aggregator, unsafeFeatures, cfgFilePath)
 }
 
 func startServiceWithAggregator(
@@ -232,25 +194,12 @@ func startServiceWithAggregator(
 	aggregator *source.Aggregator,
 	unsafeFeatures *security.UnsafeFeatures,
 	cfgFile string,
-	nodeName string,
-	tunnelRemark string,
 ) error {
 	log.InitLogger(cfg.Log.To, cfg.Log.Level, int(cfg.Log.MaxDays), cfg.Log.DisablePrintColor)
 
-	// Display banner only once before starting the first service
-	if !bannerDisplayed {
-		banner.DisplayBanner()
-		bannerDisplayed = true
-	}
-
-	// Display node information if available
-	if nodeName != "" {
-		log.Info("已获取到配置文件", "隧道名称", tunnelRemark, "使用节点", nodeName)
-	}
-
 	if cfgFile != "" {
-		log.Infof("启动 frpc 服务 [%s]", cfgFile)
+		log.Infof("start frpc service for config file [%s] with aggregated configuration", cfgFile)
-		defer log.Infof("frpc 服务 [%s] 已停止", cfgFile)
+		defer log.Infof("frpc service for config file [%s] stopped", cfgFile)
 	}
 	svr, err := client.NewService(client.ServiceOptions{
 		Common:                 cfg,
@@ -268,183 +217,3 @@ func startServiceWithAggregator(
 	}
 	return svr.Run(context.Background())
 }
-
-// APIResponse represents the response from LoliaFRP API
-type APIResponse struct {
-	Code int    `json:"code"`
-	Msg  string `json:"msg"`
-	Data struct {
-		Config       string `json:"config"`
-		NodeName     string `json:"node_name"`
-		TunnelRemark string `json:"tunnel_remark"`
-	} `json:"data"`
-}
-
-// TokenInfo stores parsed id and token from the -t parameter
-type TokenInfo struct {
-	ID    string
-	Token string
-}
-
-func runClientWithTokens(tokens []string, unsafeFeatures *security.UnsafeFeatures) error {
-	// Parse all tokens (format: id:token)
-	tokenInfos := make([]TokenInfo, 0, len(tokens))
-	for _, t := range tokens {
-		parts := strings.SplitN(t, ":", 2)
-		if len(parts) != 2 {
-			return fmt.Errorf("invalid token format '%s', expected 'id:token'", t)
-		}
-		tokenInfos = append(tokenInfos, TokenInfo{
-			ID:    strings.TrimSpace(parts[0]),
-			Token: strings.TrimSpace(parts[1]),
-		})
-	}
-
-	// Group tokens by token value (same token can have multiple IDs)
-	tokenToIDs := make(map[string][]string)
-	for _, ti := range tokenInfos {
-		tokenToIDs[ti.Token] = append(tokenToIDs[ti.Token], ti.ID)
-	}
-
-	// If we have multiple different tokens, start one service for each token group
-	if len(tokenToIDs) > 1 {
-		return runMultipleClientsWithTokens(tokenToIDs, unsafeFeatures)
-	}
-
-	// Get the single token and all its IDs
-	var token string
-	var ids []string
-	for t, idList := range tokenToIDs {
-		token = t
-		ids = idList
-		break
-	}
-
-	return runClientWithTokenAndIDs(token, ids, unsafeFeatures)
-}
-
-func runClientWithTokenAndIDs(token string, ids []string, unsafeFeatures *security.UnsafeFeatures) error {
-	// Get API server address from environment variable
-	apiServer := os.Getenv("LOLIA_API")
-	if apiServer == "" {
-		apiServer = "https://api.lolia.link"
-	}
-
-	// Build URL with query parameters
-	url := fmt.Sprintf("%s/api/v1/tunnel/frpc/config?token=%s&id=%s", apiServer, token, strings.Join(ids, ","))
-	// URL is constructed from trusted source (environment variable or hardcoded)
-	req, err := http.NewRequest("GET", url, nil)
-	if err != nil {
-		return fmt.Errorf("failed to create API request: %v", err)
-	}
-	// Carry client version in User-Agent so the API knows which frpc version is requesting
-	req.Header.Set("User-Agent", version.Full())
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return fmt.Errorf("failed to fetch config from API: %v", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("API returned status code: %d", resp.StatusCode)
-	}
-
-	var apiResp APIResponse
-	if err := json.NewDecoder(resp.Body).Decode(&apiResp); err != nil {
-		return fmt.Errorf("failed to decode API response: %v", err)
-	}
-
-	if apiResp.Code != 200 {
-		return fmt.Errorf("API error: %s", apiResp.Msg)
-	}
-
-	// Decode base64 config
-	configBytes, err := base64.StdEncoding.DecodeString(apiResp.Data.Config)
-	if err != nil {
-		return fmt.Errorf("failed to decode base64 config: %v", err)
-	}
-
-	// Load config directly from bytes
-	return runClientWithConfig(configBytes, unsafeFeatures, apiResp.Data.NodeName, apiResp.Data.TunnelRemark)
-}
-
-func runMultipleClientsWithTokens(tokenToIDs map[string][]string, unsafeFeatures *security.UnsafeFeatures) error {
-	var wg sync.WaitGroup
-
-	// Display banner first
-	banner.DisplayBanner()
-	bannerDisplayed = true
-	log.Infof("检测到 %d 个不同的 token，将并行启动多个 frpc 服务实例", len(tokenToIDs))
-
-	index := 0
-	for token, ids := range tokenToIDs {
-		wg.Add(1)
-		currentIndex := index
-		currentToken := token
-		currentIDs := ids
-		totalCount := len(tokenToIDs)
-
-		// Add a small delay to avoid log output mixing
-		time.Sleep(100 * time.Millisecond)
-
-		go func() {
-			defer wg.Done()
-			maskedToken := currentToken
-			if len(maskedToken) > 6 {
-				maskedToken = maskedToken[:3] + "***" + maskedToken[len(maskedToken)-3:]
-			} else {
-				maskedToken = "***"
-			}
-			log.Infof("[%d/%d] 启动 token: %s (IDs: %v)", currentIndex+1, totalCount, maskedToken, currentIDs)
-			err := runClientWithTokenAndIDs(currentToken, currentIDs, unsafeFeatures)
-			if err != nil {
-				fmt.Printf("\nToken [%s] 启动失败: %v\n", maskedToken, err)
-			}
-		}()
-		index++
-	}
-	wg.Wait()
-	return nil
-}
-
-func runClientWithConfig(configBytes []byte, unsafeFeatures *security.UnsafeFeatures, nodeName, tunnelRemark string) error {
-	// Render template first
-	renderedBytes, err := config.RenderWithTemplate(configBytes, config.GetValues())
-	if err != nil {
-		return fmt.Errorf("failed to render template: %v", err)
-	}
-
-	var allCfg v1.ClientConfig
-	if err := config.LoadConfigure(renderedBytes, &allCfg, strictConfigMode); err != nil {
-		return fmt.Errorf("failed to parse config: %v", err)
-	}
-
-	cfg := &allCfg.ClientCommonConfig
-	proxyCfgs := make([]v1.ProxyConfigurer, 0, len(allCfg.Proxies))
-	for _, c := range allCfg.Proxies {
-		proxyCfgs = append(proxyCfgs, c.ProxyConfigurer)
-	}
-	visitorCfgs := make([]v1.VisitorConfigurer, 0, len(allCfg.Visitors))
-	for _, c := range allCfg.Visitors {
-		visitorCfgs = append(visitorCfgs, c.VisitorConfigurer)
-	}
-
-	// Call Complete to fill in default values
-	if err := cfg.Complete(); err != nil {
-		return fmt.Errorf("failed to complete config: %v", err)
-	}
-
-	proxyCfgs, visitorCfgs = config.FilterClientConfigurers(cfg, proxyCfgs, visitorCfgs)
-	proxyCfgs = config.CompleteProxyConfigurers(proxyCfgs)
-	visitorCfgs = config.CompleteVisitorConfigurers(visitorCfgs)
-
-	warning, err := validation.ValidateAllClientConfig(cfg, proxyCfgs, visitorCfgs, unsafeFeatures)
-	if warning != nil {
-		fmt.Printf("WARNING: %v\n", warning)
-	}
-	if err != nil {
-		return err
-	}
-
-	return startService(cfg, proxyCfgs, visitorCfgs, unsafeFeatures, "", nodeName, tunnelRemark)
-}

cmd/frpc/sub/verify.go

@@ -29,30 +29,22 @@ func init() {
 	rootCmd.AddCommand(verifyCmd)
 }
 
-func verifyClientConfig(
-	configFile string,
-	strict bool,
-	unsafeFeatures *security.UnsafeFeatures,
-) (validation.Warning, error) {
-	cliCfg, proxyCfgs, visitorCfgs, _, err := config.LoadClientConfig(configFile, strict)
-	if err != nil {
-		return nil, err
-	}
-	return validation.ValidateAllClientConfig(cliCfg, proxyCfgs, visitorCfgs, unsafeFeatures)
-}
-
 var verifyCmd = &cobra.Command{
 	Use:   "verify",
 	Short: "Verify that the configures is valid",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		if len(cfgFiles) == 0 || cfgFiles[0] == "" {
+		if cfgFile == "" {
 			fmt.Println("frpc: the configuration file is not specified")
 			return nil
 		}
 
-		cfgFile := cfgFiles[0]
+		cliCfg, proxyCfgs, visitorCfgs, _, err := config.LoadClientConfig(cfgFile, strictConfigMode)
+		if err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
 		unsafeFeatures := security.NewUnsafeFeatures(allowUnsafe)
-		warning, err := verifyClientConfig(cfgFile, strictConfigMode, unsafeFeatures)
+		warning, err := validation.ValidateAllClientConfig(cliCfg, proxyCfgs, visitorCfgs, unsafeFeatures)
 		if warning != nil {
 			fmt.Printf("WARNING: %v\n", warning)
 		}

cmd/frpc/sub/verify_test.go

@@ -1,67 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package sub
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/fatedier/frp/pkg/policy/security"
-)
-
-func TestVerifyClientConfigFeatureGates(t *testing.T) {
-	tests := []struct {
-		name    string
-		content string
-		wantErr string
-	}{
-		{
-			name: "VirtualNet enabled",
-			content: `featureGates = { VirtualNet = true }
-virtualNet.address = "100.86.0.4/24"
-`,
-		},
-		{
-			name: "VirtualNet disabled",
-			content: `featureGates = { VirtualNet = false }
-virtualNet.address = "100.86.0.4/24"
-`,
-			wantErr: "VirtualNet feature is not enabled",
-		},
-		{
-			name:    "unknown feature gate",
-			content: `featureGates = { UnknownFeature = true }`,
-			wantErr: "unrecognized feature gate: UnknownFeature",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			configFile := filepath.Join(t.TempDir(), "frpc.toml")
-			require.NoError(t, os.WriteFile(configFile, []byte(tc.content), 0o600))
-
-			warning, err := verifyClientConfig(configFile, true, security.NewUnsafeFeatures(nil))
-			require.NoError(t, warning)
-			if tc.wantErr == "" {
-				require.NoError(t, err)
-				return
-			}
-			require.ErrorContains(t, err, tc.wantErr)
-		})
-	}
-}

conf/frpc_full_example.toml

@@ -103,10 +103,6 @@ transport.poolCount = 5
 # supports tcp, kcp, quic, websocket and wss now, default is tcp
 transport.protocol = "tcp"
 
-# FRP wire protocol used inside the selected transport.
-# supports v1 and v2, default is v1. v2 requires frps support and must be enabled explicitly.
-# transport.wireProtocol = "v1"
-
 # set client binding ip when connect server, default is empty.
 # only when protocol = tcp or websocket, the value will be used.
 transport.connectServerLocalIP = "0.0.0.0"
@@ -275,10 +271,6 @@ localIP = "127.0.0.1"
 localPort = 8000
 subdomain = "web02"
 customDomains = ["web02.yourdomain.com"]
-# if true, frps will redirect plain HTTP requests for the domains above to HTTPS.
-# It requires vhostHTTPPort to be enabled on frps, and an HTTP proxy registered
-# on the same domain always takes precedence over the redirect.
-# httpRedirect = true
 # if not empty, frpc will use proxy protocol to transfer connection info to your local service
 # v1 or v2 or empty
 transport.proxyProtocolVersion = "v2"
@@ -340,14 +332,6 @@ type = "https2http"
 localAddr = "127.0.0.1:80"
 crtPath = "./server.crt"
 keyPath = "./server.key"
-# autoTLS can replace crtPath/keyPath and automatically apply/renew certificates.
-# [proxies.plugin.autoTLS]
-# enable = true
-# email = "admin@example.com"
-# cacheDir = "./.autotls-cache"
-# hostAllowList is optional. If omitted, frpc will use customDomains automatically.
-# hostAllowList = ["test.yourdomain.com"]
-# caDirURL = "https://acme-v02.api.letsencrypt.org/directory"
 hostHeaderRewrite = "127.0.0.1"
 requestHeaders.set.x-from-where = "frp"
 
@@ -360,14 +344,6 @@ type = "https2https"
 localAddr = "127.0.0.1:443"
 crtPath = "./server.crt"
 keyPath = "./server.key"
-# autoTLS can replace crtPath/keyPath and automatically apply/renew certificates.
-# [proxies.plugin.autoTLS]
-# enable = true
-# email = "admin@example.com"
-# cacheDir = "./.autotls-cache"
-# hostAllowList is optional. If omitted, frpc will use customDomains automatically.
-# hostAllowList = ["test.yourdomain.com"]
-# caDirURL = "https://acme-v02.api.letsencrypt.org/directory"
 hostHeaderRewrite = "127.0.0.1"
 requestHeaders.set.x-from-where = "frp"
 
@@ -381,15 +357,6 @@ localAddr = "127.0.0.1:443"
 hostHeaderRewrite = "127.0.0.1"
 requestHeaders.set.x-from-where = "frp"
 
-[[proxies]]
-name = "plugin_http2https_redirect"
-type = "http"
-customDomains = ["test.yourdomain.com"]
-[proxies.plugin]
-type = "http2https_redirect"
-# Optional. Defaults to 443. Set this if the HTTPS entry is exposed on a non-standard port.
-# httpsPort = 443
-
 [[proxies]]
 name = "plugin_http2http"
 type = "tcp"
@@ -409,14 +376,6 @@ type = "tls2raw"
 localAddr = "127.0.0.1:80"
 crtPath = "./server.crt"
 keyPath = "./server.key"
-# autoTLS can replace crtPath/keyPath and automatically apply/renew certificates.
-# [proxies.plugin.autoTLS]
-# enable = true
-# email = "admin@example.com"
-# cacheDir = "./.autotls-cache"
-# hostAllowList is optional. If omitted, frpc will use customDomains automatically.
-# hostAllowList = ["test.yourdomain.com"]
-# caDirURL = "https://acme-v02.api.letsencrypt.org/directory"
 
 [[proxies]]
 name = "secret_tcp"

conf/frps_full_example.toml

@@ -40,12 +40,6 @@ transport.maxPoolCount = 5
 # If negative, keep-alive probes are disabled.
 # transport.tcpKeepalive = 7200
 
-# proxyIdleTimeout specifies the maximum time in seconds that a proxied user connection
-# can stay open without any traffic in either direction before frps closes it.
-# It reclaims connections whose endpoints are still open at the TCP level but will never send data again.
-# By default, this value is 0, which disables the idle timeout.
-# transport.proxyIdleTimeout = 7200
-
 # transport.tls.force specifies whether to only accept TLS-encrypted connections. By default, the value is false.
 transport.tls.force = false
 
@@ -58,12 +52,6 @@ transport.tls.force = false
 vhostHTTPPort = 80
 vhostHTTPSPort = 443
 
-# Port used in the Location header when redirecting HTTP requests to HTTPS for
-# proxies with httpRedirect enabled. Set it when browsers reach the HTTPS vhost
-# through a port mapping, so it differs from vhostHTTPSPort.
-# By default, this value is vhostHTTPSPort.
-# vhostHTTPSRedirectPort = 443
-
 # Response header timeout(seconds) for vhost http server, default is 60s
 # vhostHTTPTimeout = 60
 

doc/agents/release.md

@@ -1,124 +0,0 @@
-# Release Process
-
-## 1. Update Release Notes
-
-Edit `Release.md` in the project root with the changes for this version:
-
-```markdown
-## Features
-* ...
-
-## Improvements
-* ...
-
-## Fixes
-* ...
-```
-
-This file is used by GoReleaser as the GitHub Release body.
-
-## 2. Bump Version
-
-Update the version string in `pkg/util/version/version.go`:
-
-```go
-var version = "0.X.0"
-```
-
-Commit and push to `dev`:
-
-```bash
-git add pkg/util/version/version.go Release.md
-git commit -m "bump version to vX.Y.Z"
-git push origin dev
-```
-
-## 3. Pre-release Validation
-
-Run the standard e2e suite locally:
-
-```bash
-make e2e
-```
-
-For releases that touch compatibility-sensitive areas such as login, control
-connections, work connections, visitors, transport, or wire protocol handling,
-also run the manual compatibility e2e suite:
-
-```bash
-make e2e-compatibility
-make e2e-compatibility-floor
-```
-
-`make e2e-compatibility` builds the current `frps` and `frpc`, resolves the
-recent stable release baselines from GitHub, downloads or reuses their binaries,
-and tests current binaries against those historical releases. The default number
-of recent baselines is controlled by `FRP_COMPAT_BASELINE_COUNT` in the
-`Makefile`.
-
-Downloaded release binaries are cached under:
-
-```text
-.cache/e2e-compat/<version>/<os>_<arch>/
-```
-
-For a release validation run that must be exactly reproducible, pass an explicit
-baseline matrix instead of using the floating recent-release list:
-
-```bash
-FRP_COMPAT_BASELINE_VERSIONS="0.X.0 0.Y.0" make e2e-compatibility
-```
-
-Use `make e2e-compatibility-smoke` for a quick single-baseline check while
-iterating locally. If GitHub release metadata requests are rate-limited, set
-`GITHUB_TOKEN` or use `FRP_COMPAT_BASELINE_VERSIONS`.
-
-The compatibility floor is a support-policy decision, not a value that should
-change every release. Update `FRP_COMPAT_FLOOR_VERSION` only when the declared
-compatibility window changes.
-
-## 4. Merge dev → master
-
-Create a PR from `dev` to `master`:
-
-```bash
-gh pr create --base master --head dev --title "bump version"
-```
-
-Wait for CI to pass, then merge using **merge commit** (not squash).
-
-## 5. Tag the Release
-
-```bash
-git checkout master
-git pull origin master
-git tag -a vX.Y.Z -m "bump version"
-git push origin vX.Y.Z
-```
-
-## 6. Trigger GoReleaser
-
-Manually trigger the `goreleaser` workflow in GitHub Actions:
-
-```bash
-gh workflow run goreleaser --ref master
-```
-
-GoReleaser will:
-1. Run `package.sh` to cross-compile all platforms and create archives
-2. Create a GitHub Release with all packages, using `Release.md` as release notes
-
-## Key Files
-
-| File | Purpose |
-|------|---------|
-| `pkg/util/version/version.go` | Version string |
-| `Release.md` | Release notes (read by GoReleaser) |
-| `.goreleaser.yml` | GoReleaser config |
-| `package.sh` | Cross-compile and packaging script |
-| `.github/workflows/goreleaser.yml` | GitHub Actions workflow (manual trigger) |
-
-## Versioning
-
-- Minor release: `v0.X.0`
-- Patch release: `v0.X.Y` (e.g., `v0.62.1`)

doc/deprecations.md

@@ -1,38 +0,0 @@
-# Deprecations
-
-This document tracks deprecated features and APIs that are still shipped but scheduled for removal. Maintainers should review this list before each release to decide whether any items are due for removal.
-
-For the version compatibility policy that bounds these support windows, see the latest `Release.md`.
-
-## Active
-
-### Wire protocol v1
-
-- **Deprecated since:** v0.70.0 (planned, when v2 becomes the default).
-- **Removal target:** v0.78.0 or later. v0.69.0 (the last release where v1 is the default) is supported until v0.78.0 is released, so v0.77.0 is the last release that must keep v1 support.
-- **Replacement:** wire protocol v2 (`transport.wireProtocol = "v2"` in frpc).
-- **Code references:** v1 message types and codec under `pkg/msg/` and the protocol negotiation path in `client/` and `server/`.
-- **Notes:** Removing v1 will also drop compatibility with any frpc/frps that does not negotiate v2.
-
-### INI configuration format
-
-- **Deprecated since:** predates this document; startup warning has been in place for several releases.
-- **Removal target:** TBD.
-- **Replacement:** YAML / JSON / TOML.
-- **Code references:**
-  - `cmd/frpc/sub/root.go` — frpc startup warning.
-  - `cmd/frps/root.go` — frps startup warning.
-  - `pkg/config/legacy/` — legacy INI parser; remove together with the warnings.
-
-### Visitor connections without `runID`
-
-- **Deprecated since:** v0.50.0 (when `runID` was introduced).
-- **Removal target:** TBD.
-- **Replacement:** require `runID` on every visitor connection.
-- **Code references:**
-  - `server/service.go` — `RegisterVisitorConn` still accepts empty `runID` for backward compatibility.
-- **Notes:** Removal will break frpc clients released before v0.50.0. Schedule for a release where dropping pre-v0.50.0 frpc is acceptable.
-
-## Removed
-
-_None yet._

dockerfiles/Dockerfile-for-frpc

@@ -1,11 +1,8 @@
 FROM node:22 AS web-builder
 
-COPY web/package.json /web/package.json
-COPY web/shared/ /web/shared/
-COPY web/frpc/ /web/frpc/
-WORKDIR /web
-RUN npm install
 WORKDIR /web/frpc
+COPY web/frpc/ ./
+RUN npm install
 RUN npm run build
 
 FROM golang:1.25 AS building

dockerfiles/Dockerfile-for-frps

@@ -1,11 +1,8 @@
 FROM node:22 AS web-builder
 
-COPY web/package.json /web/package.json
-COPY web/shared/ /web/shared/
-COPY web/frps/ /web/frps/
-WORKDIR /web
-RUN npm install
 WORKDIR /web/frps
+COPY web/frps/ ./
+RUN npm install
 RUN npm run build
 
 FROM golang:1.25 AS building

go.mod

@@ -4,10 +4,8 @@ go 1.25.0
 
 require (
 	github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5
-	github.com/charmbracelet/lipgloss v1.1.0
+	github.com/coreos/go-oidc/v3 v3.14.1
-	github.com/charmbracelet/log v0.4.2
+	github.com/fatedier/golib v0.5.1
-	github.com/coreos/go-oidc/v3 v3.18.0
-	github.com/fatedier/golib v0.8.1
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.1
 	github.com/gorilla/websocket v1.5.0
@@ -15,43 +13,36 @@ require (
 	github.com/onsi/ginkgo/v2 v2.23.4
 	github.com/onsi/gomega v1.36.3
 	github.com/pelletier/go-toml/v2 v2.2.0
-	github.com/pires/go-proxyproto v0.15.0
+	github.com/pion/stun/v2 v2.0.0
+	github.com/pires/go-proxyproto v0.7.0
 	github.com/prometheus/client_golang v1.19.1
-	github.com/quic-go/quic-go v0.60.0
+	github.com/quic-go/quic-go v0.55.0
 	github.com/rodaine/table v1.2.0
 	github.com/samber/lo v1.47.0
 	github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8
 	github.com/spf13/cobra v1.8.0
 	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.11.1
+	github.com/stretchr/testify v1.10.0
 	github.com/tidwall/gjson v1.17.1
 	github.com/vishvananda/netlink v1.3.0
 	github.com/xtaci/kcp-go/v5 v5.6.13
-	golang.org/x/crypto v0.54.0
+	golang.org/x/crypto v0.41.0
-	golang.org/x/net v0.56.0
+	golang.org/x/net v0.43.0
-	golang.org/x/oauth2 v0.36.0
+	golang.org/x/oauth2 v0.28.0
-	golang.org/x/sync v0.22.0
+	golang.org/x/sync v0.16.0
-	golang.org/x/sys v0.47.0
+	golang.org/x/time v0.5.0
-	golang.org/x/time v0.10.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	gopkg.in/ini.v1 v1.67.0
 	k8s.io/apimachinery v0.28.8
 	k8s.io/client-go v0.28.8
-	k8s.io/utils v0.0.0-20230406110748-d93618cff8a2
 )
 
 require (
-	github.com/Azure/go-ntlmssp v0.1.0 // indirect
+	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
-	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
-	github.com/charmbracelet/x/ansi v0.8.0 // indirect
-	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
-	github.com/charmbracelet/x/term v0.2.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
+	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
-	github.com/go-logfmt/logfmt v0.6.0 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
@@ -60,37 +51,34 @@ require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.6 // indirect
 	github.com/klauspost/reedsolomon v1.12.0 // indirect
-	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
+	github.com/pion/dtls/v2 v2.2.7 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/pion/logging v0.2.2 // indirect
-	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/pion/transport/v2 v2.2.1 // indirect
-	github.com/muesli/termenv v0.16.0 // indirect
+	github.com/pion/transport/v3 v3.0.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.5.0 // indirect
 	github.com/prometheus/common v0.48.0 // indirect
 	github.com/prometheus/procfs v0.12.0 // indirect
-	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/templexxx/cpu v0.1.1 // indirect
 	github.com/templexxx/xorsimd v0.4.3 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.0 // indirect
 	github.com/tjfoc/gmsm v1.4.1 // indirect
 	github.com/vishvananda/netns v0.0.4 // indirect
-	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	go.uber.org/automaxprocs v1.6.0 // indirect
-	golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
+	golang.org/x/mod v0.27.0 // indirect
-	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/sys v0.35.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
+	golang.org/x/text v0.28.0 // indirect
+	golang.org/x/tools v0.36.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/yaml v1.3.0 // indirect
 )
 
 // TODO(fatedier): Temporary use the modified version, update to the official version after merging into the official repository.
 replace github.com/hashicorp/yamux => github.com/fatedier/yamux v0.0.0-20250825093530-d0154be01cd6
-
-// Use the Lolia-FRP fork of golib: io.Join relays with adaptively sized buffers.
-replace github.com/fatedier/golib => github.com/Lolia-FRP/golib v0.0.0-20260810035216-6e2252e33564

go.sum

@@ -1,34 +1,18 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-github.com/Azure/go-ntlmssp v0.1.0 h1:DjFo6YtWzNqNvQdrwEyr/e4nhU3vRiwenz5QX7sFz+A=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
-github.com/Azure/go-ntlmssp v0.1.0/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/Lolia-FRP/golib v0.0.0-20260810035216-6e2252e33564 h1:L9XoKV/oAoTJNe/h93oNPlhMf6EsM0V54/tpucjbz1A=
-github.com/Lolia-FRP/golib v0.0.0-20260810035216-6e2252e33564/go.mod h1:ArUGvPg2cOw/py2RAuBt46nNZH2VQ5Z70p109MAZpJw=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
-github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
-github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc h1:4pZI35227imm7yK2bGPcfpFEmuY1gc2YSTShr4iJBfs=
-github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc/go.mod h1:X4/0JoqgTIPSFcRA/P6INZzIuyqdFY5rm8tb41s9okk=
-github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
-github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
-github.com/charmbracelet/log v0.4.2 h1:hYt8Qj6a8yLnvR+h7MwsJv/XvmBJXiueUcI3cIxsyig=
-github.com/charmbracelet/log v0.4.2/go.mod h1:qifHGX/tc7eluv2R6pWIpyHDDrrb/AG71Pf2ysQu5nw=
-github.com/charmbracelet/x/ansi v0.8.0 h1:9GTq3xq9caJW8ZrBTe0LIe2fvfLR/bYXKTx2llXn7xE=
-github.com/charmbracelet/x/ansi v0.8.0/go.mod h1:wdYl/ONOLHLIVmQaxbIYEC/cRKOQyjTkowiI4blgS9Q=
-github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd h1:vy0GVL4jeHEwG5YOXDmi86oYw2yuYUGqz6a8sLwg0X8=
-github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
-github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
-github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/coreos/go-oidc/v3 v3.18.0 h1:V9orjXynvu5wiC9SemFTWnG4F45v403aIcjWo0d41+A=
+github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
-github.com/coreos/go-oidc/v3 v3.18.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=
+github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
 github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -36,12 +20,12 @@ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/fatedier/golib v0.5.1 h1:hcKAnaw5mdI/1KWRGejxR+i1Hn/NvbY5UsMKDr7o13M=
+github.com/fatedier/golib v0.5.1/go.mod h1:W6kIYkIFxHsTzbgqg5piCxIiDo4LzwgTY6R5W8l9NFQ=
 github.com/fatedier/yamux v0.0.0-20250825093530-d0154be01cd6 h1:u92UUy6FURPmNsMBUuongRWC0rBqN6gd01Dzu+D21NE=
 github.com/fatedier/yamux v0.0.0-20250825093530-d0154be01cd6/go.mod h1:c5/tk6G0dSpXGzJN7Wk1OEie8grdSJAmeawId9Zvd34=
-github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
-github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
-github.com/go-logfmt/logfmt v0.6.0 h1:wGYYu3uicYdqXVgoYbvnkrPVXkuLM1p1ifugDMEdRi4=
-github.com/go-logfmt/logfmt v0.6.0/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
@@ -86,23 +70,26 @@ github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
+github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
-github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
-github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
-github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
-github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
-github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus=
 github.com/onsi/ginkgo/v2 v2.23.4/go.mod h1:Bt66ApGPBFzHyR+JO10Zbt0Gsp4uWxu5mIOTusL46e8=
 github.com/onsi/gomega v1.36.3 h1:hID7cr8t3Wp26+cYnfcjR6HpJ00fdogN6dqZ1t6IylU=
 github.com/onsi/gomega v1.36.3/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
 github.com/pelletier/go-toml/v2 v2.2.0 h1:QLgLl2yMN7N+ruc31VynXs1vhMZa7CeHHejIeBAsoHo=
 github.com/pelletier/go-toml/v2 v2.2.0/go.mod h1:1t835xjRzz80PqgE6HHgN2JOsmgYu/h4qDAS4n929Rs=
-github.com/pires/go-proxyproto v0.15.0 h1:dTshmNbFm/D+0+sbrxUuddPOZ5Y0B7c5NhtsBkm6LqI=
+github.com/pion/dtls/v2 v2.2.7 h1:cSUBsETxepsCSFSxC3mc/aDo14qQLMSL+O6IjG28yV8=
-github.com/pires/go-proxyproto v0.15.0/go.mod h1:OXsCrKwrK2tXS9YrI5tkHx5xaQlO8FH3lFW76orFh24=
+github.com/pion/dtls/v2 v2.2.7/go.mod h1:8WiMkebSHFD0T+dIU+UeBaoV7kDhOW5oDCzZ7WZ/F9s=
+github.com/pion/logging v0.2.2 h1:M9+AIj/+pxNsDfAT64+MAVgJO0rsyLnoJKCqf//DoeY=
+github.com/pion/logging v0.2.2/go.mod h1:k0/tDVsRCX2Mb2ZEmTqNa7CWsQPc+YYCB7Q+5pahoms=
+github.com/pion/stun/v2 v2.0.0 h1:A5+wXKLAypxQri59+tmQKVs7+l6mMM+3d+eER9ifRU0=
+github.com/pion/stun/v2 v2.0.0/go.mod h1:22qRSh08fSEttYUmJZGlriq9+03jtVmXNODgLccj8GQ=
+github.com/pion/transport/v2 v2.2.1 h1:7qYnCBlpgSJNYMbLCKuSY9KbQdBFoETvPNETv0y4N7c=
+github.com/pion/transport/v2 v2.2.1/go.mod h1:cXXWavvCnFF6McHTft3DWS9iic2Mftcz1Aq29pGcU5g=
+github.com/pion/transport/v3 v3.0.1 h1:gDTlPJwROfSfz6QfSi0ZmeCSkFcnWWiiR9ES0ouANiM=
+github.com/pion/transport/v3 v3.0.1/go.mod h1:UY7kiITrlMv7/IKgd5eTUcaahZx5oUN3l9SzK5f5xE0=
+github.com/pires/go-proxyproto v0.7.0 h1:IukmRewDQFWC7kfnb66CSomk2q/seBuilHBYFwyq0Hs=
+github.com/pires/go-proxyproto v0.7.0/go.mod h1:Vz/1JPY/OACxWGQNIRY2BeyDmpoaWmEP40O9LbuiFR4=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -118,13 +105,10 @@ github.com/prometheus/common v0.48.0 h1:QO8U2CdOzSn1BBsmXJXduaaW+dY/5QLjfB8svtSz
 github.com/prometheus/common v0.48.0/go.mod h1:0/KsvlIEfPQCQ5I2iNSAWKPZziNCvRs5EC6ILDTlAPc=
 github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
 github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
-github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4TzM7MFjy0=
+github.com/quic-go/quic-go v0.55.0 h1:zccPQIqYCXDt5NmcEabyYvOnomjs8Tlwl7tISjJh9Mk=
-github.com/quic-go/go-ossfuzz-seeds v0.1.0/go.mod h1:3IOHRbJIc+L6YKMwfDtJAM9Vj9k0YY4muhuyUYk5tbk=
+github.com/quic-go/quic-go v0.55.0/go.mod h1:DR51ilwU1uE164KuWXhinFcKWGlEjzys2l8zUl5Ss1U=
-github.com/quic-go/quic-go v0.60.0 h1:xcQioE8OM66UQLeUMHltK1CCcOu3JbVB4JAQdDQSB+0=
+github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
-github.com/quic-go/quic-go v0.60.0/go.mod h1:wpKpjmPpftl30sL6pFh7REVpjbcCVy4zt2vDyK1TuJk=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
-github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
-github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rodaine/table v1.2.0 h1:38HEnwK4mKSHQJIkavVj+bst1TEY7j9zhLMWu4QJrMA=
 github.com/rodaine/table v1.2.0/go.mod h1:wejb/q/Yd4T/SVmBSRMr7GCq3KlcZp3gyNYdLSBhkaE=
 github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
@@ -144,10 +128,11 @@ github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpE
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/templexxx/cpu v0.1.1 h1:isxHaxBXpYFWnk2DReuKkigaZyrjs2+9ypIdGP4h+HI=
 github.com/templexxx/cpu v0.1.1/go.mod h1:w7Tb+7qgcAlIyX4NhLuDKt78AHA5SzPmq0Wj6HiEnnk=
 github.com/templexxx/xorsimd v0.4.3 h1:9AQTFHd7Bhk3dIT7Al2XeBX5DWOvsUPZCuhyAtNbHjU=
@@ -164,12 +149,11 @@ github.com/vishvananda/netlink v1.3.0 h1:X7l42GfcV4S6E4vHTsw48qbrV+9PVojNfIhZcwQ
 github.com/vishvananda/netlink v1.3.0/go.mod h1:i6NetklAujEcC6fK0JPjT8qSwWyO0HLn4UKG+hGqeJs=
 github.com/vishvananda/netns v0.0.4 h1:Oeaw1EM2JMxD51g9uhtC0D7erkIjgmj8+JZc26m1YX8=
 github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
-github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
-github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/xtaci/kcp-go/v5 v5.6.13 h1:FEjtz9+D4p8t2x4WjciGt/jsIuhlWjjgPCCWjrVR4Hk=
 github.com/xtaci/kcp-go/v5 v5.6.13/go.mod h1:75S1AKYYzNUSXIv30h+jPKJYZUwqpfvLshu63nCNSOM=
 github.com/xtaci/lossyconn v0.0.0-20200209145036-adba10fffc37 h1:EWU6Pktpas0n8lLQwDsRyZfmkPeRbdgPtW609es+/9E=
 github.com/xtaci/lossyconn v0.0.0-20200209145036-adba10fffc37/go.mod h1:HpMP7DB2CyokmAh4lp0EQnnWhmycP/TvwBGzvuie+H0=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
 go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
@@ -177,55 +161,89 @@ go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201012173705-84dcc777aaee/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE=
+golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
+golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
+golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
-golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
+golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201010224723-4f7140c49acb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
+golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
+golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.28.0 h1:CrgCKl8PPAVtLnU3c+EDw6x11699EWlsDeWNWKdIOkc=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/oauth2 v0.28.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
+golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
+golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/time v0.10.0 h1:3usCWA8tQn0L8+hFJQNgzpWbd89begxN66o1Ojdn5L4=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/time v0.10.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
+golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=

hack/run-e2e-compatibility.sh

@@ -1,162 +0,0 @@
-#!/bin/sh
-
-set -eu
-
-SCRIPT=$(readlink -f "$0")
-ROOT=$(unset CDPATH && cd "$(dirname "$SCRIPT")/.." && pwd)
-
-if ! command -v ginkgo >/dev/null 2>&1; then
-    echo "ginkgo not found, try to install..."
-    go install github.com/onsi/ginkgo/v2/ginkgo@v2.23.4
-fi
-
-debug=false
-if [ "x${DEBUG:-}" = "xtrue" ]; then
-    debug=true
-fi
-logLevel=debug
-if [ "${LOG_LEVEL:-}" ]; then
-    logLevel="${LOG_LEVEL}"
-fi
-
-currentFrpsPath=${CURRENT_FRPS_PATH:-${ROOT}/bin/frps}
-currentFrpcPath=${CURRENT_FRPC_PATH:-${ROOT}/bin/frpc}
-baselineCount=${FRP_COMPAT_BASELINE_COUNT:-8}
-targetOS=${TARGET_OS:-$(go env GOOS)}
-targetArch=${TARGET_ARCH:-$(go env GOARCH)}
-targetPlatform="${targetOS}_${targetArch}"
-cacheRoot=${FRP_COMPAT_CACHE_DIR:-${ROOT}/.cache/e2e-compat}
-
-check_file() {
-    if [ ! -f "$2" ]; then
-        echo "$1 not found: $2"
-        exit 1
-    fi
-}
-
-check_file "current frps" "${currentFrpsPath}"
-check_file "current frpc" "${currentFrpcPath}"
-
-run_current_current=true
-
-run_compatibility() {
-    baselineVersion=$1
-    baselineFrpsPath=$2
-    baselineFrpcPath=$3
-
-    check_file "baseline frps" "${baselineFrpsPath}"
-    check_file "baseline frpc" "${baselineFrpcPath}"
-
-    echo "Running compatibility e2e with baseline ${baselineVersion}"
-    ginkgo -nodes=1 --poll-progress-after=60s "${ROOT}/test/e2e/compatibility" -- \
-        -current-frps-path="${currentFrpsPath}" \
-        -current-frpc-path="${currentFrpcPath}" \
-        -baseline-frps-path="${baselineFrpsPath}" \
-        -baseline-frpc-path="${baselineFrpcPath}" \
-        -baseline-version="${baselineVersion}" \
-        -run-current-current="${run_current_current}" \
-        -log-level="${logLevel}" \
-        -debug="${debug}"
-    run_current_current=false
-}
-
-github_api_curl() {
-    if [ "${GITHUB_TOKEN:-}" ]; then
-        curl -fsSL \
-            -H "Accept: application/vnd.github+json" \
-            -H "Authorization: Bearer ${GITHUB_TOKEN}" \
-            "$1"
-    else
-        curl -fsSL "$1"
-    fi
-}
-
-resolve_versions() {
-    if [ "${FRP_COMPAT_BASELINE_VERSIONS:-}" ]; then
-        printf "%s\n" "${FRP_COMPAT_BASELINE_VERSIONS}"
-        return
-    fi
-
-    case "${baselineCount}" in
-        '' | *[!0-9]*)
-            echo "FRP_COMPAT_BASELINE_COUNT must be a positive integer: ${baselineCount}" >&2
-            exit 1
-            ;;
-    esac
-    if [ "${baselineCount}" -eq 0 ]; then
-        echo "FRP_COMPAT_BASELINE_COUNT must be greater than 0" >&2
-        exit 1
-    fi
-    if [ "${baselineCount}" -gt 100 ]; then
-        echo "FRP_COMPAT_BASELINE_COUNT must be less than or equal to 100" >&2
-        exit 1
-    fi
-
-    releaseURL="https://api.github.com/repos/fatedier/frp/releases?per_page=100"
-    resolvedVersions=""
-    if releases=$(github_api_curl "${releaseURL}" 2>/dev/null); then
-        resolvedVersions=$(printf "%s\n" "${releases}" |
-            sed -n 's/.*"tag_name":[[:space:]]*"v\([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\)".*/\1/p' |
-            awk '!seen[$0]++' |
-            head -n "${baselineCount}" |
-            tr '\n' ' ' |
-            sed 's/[[:space:]]*$//')
-    else
-        echo "Failed to fetch release metadata from GitHub API, falling back to GitHub releases page." >&2
-    fi
-
-    if [ -z "${resolvedVersions}" ]; then
-        releasesPageURL="https://github.com/fatedier/frp/releases"
-        if ! releases=$(curl -fsSL "${releasesPageURL}"); then
-            echo "Failed to fetch release metadata from GitHub: ${releasesPageURL}" >&2
-            echo "Set FRP_COMPAT_BASELINE_VERSIONS to run with explicit baseline versions." >&2
-            exit 1
-        fi
-        resolvedVersions=$(printf "%s\n" "${releases}" |
-            grep -o 'releases/tag/v[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"' |
-            sed 's#.*/v##; s/"$//' |
-            awk '!seen[$0]++' |
-            head -n "${baselineCount}" |
-            tr '\n' ' ' |
-            sed 's/[[:space:]]*$//')
-    fi
-
-    set -- ${resolvedVersions}
-    if [ "$#" -lt "${baselineCount}" ]; then
-        echo "Only resolved $# stable release versions from GitHub, expected ${baselineCount}." >&2
-        echo "Set FRP_COMPAT_BASELINE_VERSIONS to run with explicit baseline versions." >&2
-        exit 1
-    fi
-
-    printf "%s\n" "${resolvedVersions}"
-}
-
-if [ "${BASELINE_FRPS_PATH:-}" ] || [ "${BASELINE_FRPC_PATH:-}" ]; then
-    if [ -z "${BASELINE_FRPS_PATH:-}" ] || [ -z "${BASELINE_FRPC_PATH:-}" ]; then
-        echo "BASELINE_FRPS_PATH and BASELINE_FRPC_PATH must be set together"
-        exit 1
-    fi
-    run_compatibility "${FRP_COMPAT_BASELINE_VERSION:-custom}" "${BASELINE_FRPS_PATH}" "${BASELINE_FRPC_PATH}"
-    exit 0
-fi
-
-versions=$(resolve_versions)
-echo "Compatibility baseline versions: ${versions}"
-
-mkdir -p "${cacheRoot}"
-for version in ${versions}; do
-    baselineDir="${cacheRoot}/${version}/${targetPlatform}"
-    if [ ! -f "${baselineDir}/frps" ] || [ ! -f "${baselineDir}/frpc" ]; then
-        tmpDir="${cacheRoot}/.download-${version}-${targetPlatform}"
-        rm -rf "${tmpDir}"
-        (
-            cd "${cacheRoot}"
-            FRP_VERSION="${version}" TARGET_DIRNAME="$(basename "${tmpDir}")" "${ROOT}/hack/download.sh"
-        )
-        mkdir -p "$(dirname "${baselineDir}")"
-        rm -rf "${baselineDir}"
-        mv "${tmpDir}" "${baselineDir}"
-    fi
-
-    run_compatibility "${version}" "${baselineDir}/frps" "${baselineDir}/frpc"
-done

package.sh

@@ -18,7 +18,7 @@ rm -rf ./release/packages
 mkdir -p ./release/packages
 
 os_all='linux windows darwin freebsd openbsd android'
-arch_all='amd64 arm arm64'
+arch_all='386 amd64 arm arm64 mips64 mips64le mips mipsle riscv64 loong64'
 extra_all='_ hf'
 
 cd ./release

pkg/auth/oidc.go

@@ -23,14 +23,12 @@ import (
 	"net/url"
 	"os"
 	"slices"
-	"sync"
 
 	"github.com/coreos/go-oidc/v3/oidc"
 	"golang.org/x/oauth2"
 	"golang.org/x/oauth2/clientcredentials"
 
 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/config/v1/validation"
 	"github.com/fatedier/frp/pkg/msg"
 )
 
@@ -76,64 +74,14 @@ func createOIDCHTTPClient(trustedCAFile string, insecureSkipVerify bool, proxyUR
 	return &http.Client{Transport: transport}, nil
 }
 
-// nonCachingTokenSource wraps a clientcredentials.Config to fetch a fresh
-// token on every call. This is used as a fallback when the OIDC provider
-// does not return expires_in, which would cause a caching TokenSource to
-// hold onto a stale token forever.
-type nonCachingTokenSource struct {
-	cfg *clientcredentials.Config
-	ctx context.Context
-}
-
-func (s *nonCachingTokenSource) Token() (*oauth2.Token, error) {
-	return s.cfg.Token(s.ctx)
-}
-
-// oidcTokenSource wraps a caching oauth2.TokenSource and, on the first
-// successful Token() call, checks whether the provider returns an expiry.
-// If not, it permanently switches to nonCachingTokenSource so that a fresh
-// token is fetched every time.  This avoids an eager network call at
-// construction time, letting the login retry loop handle transient IdP
-// outages.
-type oidcTokenSource struct {
-	mu          sync.Mutex
-	initialized bool
-	source      oauth2.TokenSource
-	fallbackCfg *clientcredentials.Config
-	fallbackCtx context.Context
-}
-
-func (s *oidcTokenSource) Token() (*oauth2.Token, error) {
-	s.mu.Lock()
-	if !s.initialized {
-		token, err := s.source.Token()
-		if err != nil {
-			s.mu.Unlock()
-			return nil, err
-		}
-		if token.Expiry.IsZero() {
-			s.source = &nonCachingTokenSource{cfg: s.fallbackCfg, ctx: s.fallbackCtx}
-		}
-		s.initialized = true
-		s.mu.Unlock()
-		return token, nil
-	}
-	source := s.source
-	s.mu.Unlock()
-	return source.Token()
-}
-
 type OidcAuthProvider struct {
 	additionalAuthScopes []v1.AuthScope
 
-	tokenSource oauth2.TokenSource
+	tokenGenerator *clientcredentials.Config
+	httpClient     *http.Client
 }
 
 func NewOidcAuthSetter(additionalAuthScopes []v1.AuthScope, cfg v1.AuthOIDCClientConfig) (*OidcAuthProvider, error) {
-	if err := validation.ValidateOIDCClientCredentialsConfig(&cfg); err != nil {
-		return nil, err
-	}
-
 	eps := make(map[string][]string)
 	for k, v := range cfg.AdditionalEndpointParams {
 		eps[k] = []string{v}
@@ -151,42 +99,30 @@ func NewOidcAuthSetter(additionalAuthScopes []v1.AuthScope, cfg v1.AuthOIDCClien
 		EndpointParams: eps,
 	}
 
-	// Build the context that TokenSource will use for all future HTTP requests.
+	// Create custom HTTP client if needed
-	// context.Background() is appropriate here because the token source is
+	var httpClient *http.Client
-	// long-lived and outlives any single request.
-	ctx := context.Background()
 	if cfg.TrustedCaFile != "" || cfg.InsecureSkipVerify || cfg.ProxyURL != "" {
-		httpClient, err := createOIDCHTTPClient(cfg.TrustedCaFile, cfg.InsecureSkipVerify, cfg.ProxyURL)
+		var err error
+		httpClient, err = createOIDCHTTPClient(cfg.TrustedCaFile, cfg.InsecureSkipVerify, cfg.ProxyURL)
 		if err != nil {
 			return nil, fmt.Errorf("failed to create OIDC HTTP client: %w", err)
 		}
-		ctx = context.WithValue(ctx, oauth2.HTTPClient, httpClient)
 	}
 
-	// Create a persistent TokenSource that caches the token and refreshes
-	// it before expiry. This avoids making a new HTTP request to the OIDC
-	// provider on every heartbeat/ping.
-	//
-	// We wrap it in an oidcTokenSource so that the first Token() call
-	// (deferred to SetLogin inside the login retry loop) probes whether the
-	// provider returns expires_in.  If not, it switches to a non-caching
-	// source.  This avoids an eager network call at construction time, which
-	// would prevent loopLoginUntilSuccess from retrying on transient IdP
-	// outages.
-	cachingSource := tokenGenerator.TokenSource(ctx)
-
 	return &OidcAuthProvider{
 		additionalAuthScopes: additionalAuthScopes,
-		tokenSource: &oidcTokenSource{
+		tokenGenerator:       tokenGenerator,
-			source:      cachingSource,
+		httpClient:           httpClient,
-			fallbackCfg: tokenGenerator,
-			fallbackCtx: ctx,
-		},
 	}, nil
 }
 
 func (auth *OidcAuthProvider) generateAccessToken() (accessToken string, err error) {
-	tokenObj, err := auth.tokenSource.Token()
+	ctx := context.Background()
+	if auth.httpClient != nil {
+		ctx = context.WithValue(ctx, oauth2.HTTPClient, auth.httpClient)
+	}
+
+	tokenObj, err := auth.tokenGenerator.Token(ctx)
 	if err != nil {
 		return "", fmt.Errorf("couldn't generate OIDC token for login: %v", err)
 	}
@@ -269,8 +205,7 @@ type OidcAuthConsumer struct {
 	additionalAuthScopes []v1.AuthScope
 
 	verifier          TokenVerifier
-	mu                sync.RWMutex
+	subjectsFromLogin []string
-	subjectsFromLogin map[string]struct{}
 }
 
 func NewTokenVerifier(cfg v1.AuthOIDCServerConfig) TokenVerifier {
@@ -291,7 +226,7 @@ func NewOidcAuthVerifier(additionalAuthScopes []v1.AuthScope, verifier TokenVeri
 	return &OidcAuthConsumer{
 		additionalAuthScopes: additionalAuthScopes,
 		verifier:             verifier,
-		subjectsFromLogin:    make(map[string]struct{}),
+		subjectsFromLogin:    []string{},
 	}
 }
 
@@ -300,9 +235,9 @@ func (auth *OidcAuthConsumer) VerifyLogin(loginMsg *msg.Login) (err error) {
 	if err != nil {
 		return fmt.Errorf("invalid OIDC token in login: %v", err)
 	}
-	auth.mu.Lock()
+	if !slices.Contains(auth.subjectsFromLogin, token.Subject) {
-	auth.subjectsFromLogin[token.Subject] = struct{}{}
+		auth.subjectsFromLogin = append(auth.subjectsFromLogin, token.Subject)
-	auth.mu.Unlock()
+	}
 	return nil
 }
 
@@ -311,13 +246,11 @@ func (auth *OidcAuthConsumer) verifyPostLoginToken(privilegeKey string) (err err
 	if err != nil {
 		return fmt.Errorf("invalid OIDC token in ping: %v", err)
 	}
-	auth.mu.RLock()
+	if !slices.Contains(auth.subjectsFromLogin, token.Subject) {
-	_, ok := auth.subjectsFromLogin[token.Subject]
-	auth.mu.RUnlock()
-	if !ok {
 		return fmt.Errorf("received different OIDC subject in login and ping. "+
+			"original subjects: %s, "+
 			"new subject: %s",
-			token.Subject)
+			auth.subjectsFromLogin, token.Subject)
 	}
 	return nil
 }

pkg/auth/oidc_test.go

@@ -2,10 +2,6 @@ package auth_test
 
 import (
 	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"sync/atomic"
 	"testing"
 	"time"
 
@@ -66,188 +62,3 @@ func TestPingAfterLoginWithDifferentSubjectFails(t *testing.T) {
 	r.Error(err)
 	r.Contains(err.Error(), "received different OIDC subject in login and ping")
 }
-
-func TestOidcAuthProviderFallsBackWhenNoExpiry(t *testing.T) {
-	r := require.New(t)
-
-	var requestCount atomic.Int32
-	tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		requestCount.Add(1)
-		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(map[string]any{ //nolint:gosec // test-only dummy token response
-			"access_token": "fresh-test-token",
-			"token_type":   "Bearer",
-		})
-	}))
-	defer tokenServer.Close()
-
-	provider, err := auth.NewOidcAuthSetter(
-		[]v1.AuthScope{v1.AuthScopeHeartBeats},
-		v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			ClientSecret:     "test-secret",
-			TokenEndpointURL: tokenServer.URL,
-		},
-	)
-	r.NoError(err)
-
-	// Constructor no longer fetches a token eagerly.
-	// The first SetLogin triggers the adaptive probe.
-	r.Equal(int32(0), requestCount.Load())
-
-	loginMsg := &msg.Login{}
-	err = provider.SetLogin(loginMsg)
-	r.NoError(err)
-	r.Equal("fresh-test-token", loginMsg.PrivilegeKey)
-
-	for range 3 {
-		pingMsg := &msg.Ping{}
-		err = provider.SetPing(pingMsg)
-		r.NoError(err)
-		r.Equal("fresh-test-token", pingMsg.PrivilegeKey)
-	}
-
-	// 1 probe (login) + 3 pings = 4 requests (probe doubles as the login token fetch)
-	r.Equal(int32(4), requestCount.Load(), "each call should fetch a fresh token when expires_in is missing")
-}
-
-func TestOidcAuthProviderCachesToken(t *testing.T) {
-	r := require.New(t)
-
-	var requestCount atomic.Int32
-	tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		requestCount.Add(1)
-		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(map[string]any{ //nolint:gosec // test-only dummy token response
-			"access_token": "cached-test-token",
-			"token_type":   "Bearer",
-			"expires_in":   3600,
-		})
-	}))
-	defer tokenServer.Close()
-
-	provider, err := auth.NewOidcAuthSetter(
-		[]v1.AuthScope{v1.AuthScopeHeartBeats},
-		v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			ClientSecret:     "test-secret",
-			TokenEndpointURL: tokenServer.URL,
-		},
-	)
-	r.NoError(err)
-
-	// Constructor no longer fetches eagerly; first SetLogin triggers the probe.
-	r.Equal(int32(0), requestCount.Load())
-
-	// SetLogin triggers the adaptive probe and caches the token.
-	loginMsg := &msg.Login{}
-	err = provider.SetLogin(loginMsg)
-	r.NoError(err)
-	r.Equal("cached-test-token", loginMsg.PrivilegeKey)
-	r.Equal(int32(1), requestCount.Load())
-
-	// Subsequent calls should also reuse the cached token
-	for range 5 {
-		pingMsg := &msg.Ping{}
-		err = provider.SetPing(pingMsg)
-		r.NoError(err)
-		r.Equal("cached-test-token", pingMsg.PrivilegeKey)
-	}
-	r.Equal(int32(1), requestCount.Load(), "token endpoint should only be called once; cached token should be reused")
-}
-
-func TestOidcAuthProviderRetriesOnInitialFailure(t *testing.T) {
-	r := require.New(t)
-
-	var requestCount atomic.Int32
-	tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		n := requestCount.Add(1)
-		// The oauth2 library retries once internally, so we need two
-		// consecutive failures to surface an error to the caller.
-		if n <= 2 {
-			w.Header().Set("Content-Type", "application/json")
-			w.WriteHeader(http.StatusBadRequest)
-			_ = json.NewEncoder(w).Encode(map[string]any{
-				"error":             "temporarily_unavailable",
-				"error_description": "service is starting up",
-			})
-			return
-		}
-		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(map[string]any{ //nolint:gosec // test-only dummy token response
-			"access_token": "retry-test-token",
-			"token_type":   "Bearer",
-			"expires_in":   3600,
-		})
-	}))
-	defer tokenServer.Close()
-
-	// Constructor succeeds even though the IdP is "down".
-	provider, err := auth.NewOidcAuthSetter(
-		[]v1.AuthScope{v1.AuthScopeHeartBeats},
-		v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			ClientSecret:     "test-secret",
-			TokenEndpointURL: tokenServer.URL,
-		},
-	)
-	r.NoError(err)
-	r.Equal(int32(0), requestCount.Load())
-
-	// First SetLogin hits the IdP, which returns an error (after internal retry).
-	loginMsg := &msg.Login{}
-	err = provider.SetLogin(loginMsg)
-	r.Error(err)
-	r.Equal(int32(2), requestCount.Load())
-
-	// Second SetLogin retries and succeeds.
-	err = provider.SetLogin(loginMsg)
-	r.NoError(err)
-	r.Equal("retry-test-token", loginMsg.PrivilegeKey)
-	r.Equal(int32(3), requestCount.Load())
-
-	// Subsequent calls use cached token.
-	pingMsg := &msg.Ping{}
-	err = provider.SetPing(pingMsg)
-	r.NoError(err)
-	r.Equal("retry-test-token", pingMsg.PrivilegeKey)
-	r.Equal(int32(3), requestCount.Load())
-}
-
-func TestNewOidcAuthSetterRejectsInvalidStaticConfig(t *testing.T) {
-	r := require.New(t)
-	tokenServer := httptest.NewServer(http.NotFoundHandler())
-	defer tokenServer.Close()
-
-	_, err := auth.NewOidcAuthSetter(nil, v1.AuthOIDCClientConfig{
-		ClientID:         "test-client",
-		TokenEndpointURL: "://bad",
-	})
-	r.Error(err)
-	r.Contains(err.Error(), "auth.oidc.tokenEndpointURL")
-
-	_, err = auth.NewOidcAuthSetter(nil, v1.AuthOIDCClientConfig{
-		TokenEndpointURL: tokenServer.URL,
-	})
-	r.Error(err)
-	r.Contains(err.Error(), "auth.oidc.clientID is required")
-
-	_, err = auth.NewOidcAuthSetter(nil, v1.AuthOIDCClientConfig{
-		ClientID:         "test-client",
-		TokenEndpointURL: tokenServer.URL,
-		AdditionalEndpointParams: map[string]string{
-			"scope": "profile",
-		},
-	})
-	r.Error(err)
-	r.Contains(err.Error(), "auth.oidc.additionalEndpointParams.scope is not allowed; use auth.oidc.scope instead")
-
-	_, err = auth.NewOidcAuthSetter(nil, v1.AuthOIDCClientConfig{
-		ClientID:                 "test-client",
-		TokenEndpointURL:         tokenServer.URL,
-		Audience:                 "api",
-		AdditionalEndpointParams: map[string]string{"audience": "override"},
-	})
-	r.Error(err)
-	r.Contains(err.Error(), "cannot specify both auth.oidc.audience and auth.oidc.additionalEndpointParams.audience")
-}

pkg/config/flags.go

@@ -163,7 +163,7 @@ func RegisterClientCommonConfigFlags(cmd *cobra.Command, c *v1.ClientCommonConfi
 		cmd.PersistentFlags().Int64VarP(&c.Log.MaxDays, "log_max_days", "", 3, "log file reversed days")
 		cmd.PersistentFlags().BoolVarP(&c.Log.DisablePrintColor, "disable_log_color", "", false, "disable log color in console")
 		cmd.PersistentFlags().StringVarP(&c.Transport.TLS.ServerName, "tls_server_name", "", "", "specify the custom server name of tls certificate")
-		cmd.PersistentFlags().StringVarP(&c.DNSServer, "dns_server", "", "", "specify dns server or DoH url (https://1.1.1.1/dns-query) instead of system default")
+		cmd.PersistentFlags().StringVarP(&c.DNSServer, "dns_server", "", "", "specify dns server instead of using system default one")
 		c.Transport.TLS.Enable = cmd.PersistentFlags().BoolP("tls_enable", "", true, "enable frpc tls")
 	}
 	cmd.PersistentFlags().StringVarP(&c.User, "user", "u", "", "user")

pkg/config/legacy/conversion.go

@@ -171,15 +171,16 @@ func Convert_ServerCommonConf_To_v1(conf *ServerCommonConf) *v1.ServerConfig {
 func transformHeadersFromPluginParams(params map[string]string) v1.HeaderOperations {
 	out := v1.HeaderOperations{}
 	for k, v := range params {
-		k, ok := strings.CutPrefix(k, "plugin_header_")
+		if !strings.HasPrefix(k, "plugin_header_") {
-		if !ok || k == "" {
 			continue
 		}
+		if k = strings.TrimPrefix(k, "plugin_header_"); k != "" {
 			if out.Set == nil {
 				out.Set = make(map[string]string)
 			}
 			out.Set[k] = v
 		}
+	}
 	return out
 }
 

pkg/config/legacy/proxy.go

@@ -39,14 +39,14 @@ const (
 // Proxy
 var (
 	proxyConfTypeMap = map[ProxyType]reflect.Type{
-		ProxyTypeTCP:    reflect.TypeFor[TCPProxyConf](),
+		ProxyTypeTCP:    reflect.TypeOf(TCPProxyConf{}),
-		ProxyTypeUDP:    reflect.TypeFor[UDPProxyConf](),
+		ProxyTypeUDP:    reflect.TypeOf(UDPProxyConf{}),
-		ProxyTypeTCPMUX: reflect.TypeFor[TCPMuxProxyConf](),
+		ProxyTypeTCPMUX: reflect.TypeOf(TCPMuxProxyConf{}),
-		ProxyTypeHTTP:   reflect.TypeFor[HTTPProxyConf](),
+		ProxyTypeHTTP:   reflect.TypeOf(HTTPProxyConf{}),
-		ProxyTypeHTTPS:  reflect.TypeFor[HTTPSProxyConf](),
+		ProxyTypeHTTPS:  reflect.TypeOf(HTTPSProxyConf{}),
-		ProxyTypeSTCP:   reflect.TypeFor[STCPProxyConf](),
+		ProxyTypeSTCP:   reflect.TypeOf(STCPProxyConf{}),
-		ProxyTypeXTCP:   reflect.TypeFor[XTCPProxyConf](),
+		ProxyTypeXTCP:   reflect.TypeOf(XTCPProxyConf{}),
-		ProxyTypeSUDP:   reflect.TypeFor[SUDPProxyConf](),
+		ProxyTypeSUDP:   reflect.TypeOf(SUDPProxyConf{}),
 	}
 )
 

pkg/config/legacy/utils.go

@@ -22,8 +22,8 @@ func GetMapWithoutPrefix(set map[string]string, prefix string) map[string]string
 	m := make(map[string]string)
 
 	for key, value := range set {
-		if trimmed, ok := strings.CutPrefix(key, prefix); ok {
+		if strings.HasPrefix(key, prefix) {
-			m[trimmed] = value
+			m[strings.TrimPrefix(key, prefix)] = value
 		}
 	}
 

pkg/config/legacy/visitor.go

@@ -32,9 +32,9 @@ const (
 // Visitor
 var (
 	visitorConfTypeMap = map[VisitorType]reflect.Type{
-		VisitorTypeSTCP: reflect.TypeFor[STCPVisitorConf](),
+		VisitorTypeSTCP: reflect.TypeOf(STCPVisitorConf{}),
-		VisitorTypeXTCP: reflect.TypeFor[XTCPVisitorConf](),
+		VisitorTypeXTCP: reflect.TypeOf(XTCPVisitorConf{}),
-		VisitorTypeSUDP: reflect.TypeFor[SUDPVisitorConf](),
+		VisitorTypeSUDP: reflect.TypeOf(SUDPVisitorConf{}),
 	}
 )
 

pkg/config/load.go

@@ -394,10 +394,6 @@ func LoadClientConfigResult(path string, strict bool) (*ClientConfigLoadResult,
 		}
 	}
 
-	if err := validateNoDuplicateNames(result.Proxies, result.Visitors); err != nil {
-		return nil, err
-	}
-
 	return result, nil
 }
 
@@ -421,31 +417,6 @@ func LoadClientConfig(path string, strict bool) (
 	return result.Common, proxyCfgs, visitorCfgs, result.IsLegacyFormat, nil
 }
 
-// validateNoDuplicateNames rejects proxies or visitors that share a name. They are
-// keyed by name in the config sources, so a duplicate would otherwise be silently
-// overwritten and never started, with no error or log.
-func validateNoDuplicateNames(proxies []v1.ProxyConfigurer, visitors []v1.VisitorConfigurer) error {
-	proxyNames := make(map[string]struct{}, len(proxies))
-	for _, p := range proxies {
-		name := p.GetBaseConfig().Name
-		if _, ok := proxyNames[name]; ok {
-			return fmt.Errorf("proxy name [%s] is duplicated", name)
-		}
-		proxyNames[name] = struct{}{}
-	}
-
-	visitorNames := make(map[string]struct{}, len(visitors))
-	for _, v := range visitors {
-		name := v.GetBaseConfig().Name
-		if _, ok := visitorNames[name]; ok {
-			return fmt.Errorf("visitor name [%s] is duplicated", name)
-		}
-		visitorNames[name] = struct{}{}
-	}
-
-	return nil
-}
-
 func CompleteProxyConfigurers(proxies []v1.ProxyConfigurer) []v1.ProxyConfigurer {
 	proxyCfgs := proxies
 	for _, c := range proxyCfgs {

pkg/config/load_test.go

@@ -17,8 +17,6 @@ package config
 import (
 	"encoding/json"
 	"fmt"
-	"os"
-	"path/filepath"
 	"strings"
 	"testing"
 
@@ -464,111 +462,6 @@ func TestFilterClientConfigurers_FilterByStartAndEnabled(t *testing.T) {
 	require.Equal("keep", proxies[0].GetBaseConfig().Name)
 }
 
-func TestLoadClientConfigResult_DuplicateNames(t *testing.T) {
-	tests := []struct {
-		name      string
-		content   string
-		errSubstr string
-	}{
-		{
-			name: "duplicate proxy names",
-			content: `
-serverAddr = "127.0.0.1"
-serverPort = 7000
-
-[[proxies]]
-name = "dup"
-type = "tcp"
-localPort = 22
-remotePort = 6000
-
-[[proxies]]
-name = "dup"
-type = "tcp"
-localPort = 3306
-remotePort = 6001
-`,
-			errSubstr: "proxy name [dup] is duplicated",
-		},
-		{
-			name: "duplicate visitor names",
-			content: `
-serverAddr = "127.0.0.1"
-serverPort = 7000
-
-[[visitors]]
-name = "dup"
-type = "stcp"
-serverName = "a"
-secretKey = "secret"
-bindPort = 9001
-
-[[visitors]]
-name = "dup"
-type = "stcp"
-serverName = "b"
-secretKey = "secret"
-bindPort = 9002
-`,
-			errSubstr: "visitor name [dup] is duplicated",
-		},
-		{
-			name: "unique names",
-			content: `
-serverAddr = "127.0.0.1"
-serverPort = 7000
-
-[[proxies]]
-name = "p1"
-type = "tcp"
-localPort = 22
-remotePort = 6000
-
-[[proxies]]
-name = "p2"
-type = "tcp"
-localPort = 3306
-remotePort = 6001
-`,
-		},
-		{
-			name: "same name across proxy and visitor",
-			content: `
-serverAddr = "127.0.0.1"
-serverPort = 7000
-
-[[proxies]]
-name = "same"
-type = "tcp"
-localPort = 22
-remotePort = 6000
-
-[[visitors]]
-name = "same"
-type = "stcp"
-serverName = "a"
-secretKey = "secret"
-bindPort = 9001
-`,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			require := require.New(t)
-			path := filepath.Join(t.TempDir(), "frpc.toml")
-			require.NoError(os.WriteFile(path, []byte(tc.content), 0o600))
-
-			_, err := LoadClientConfigResult(path, false)
-			if tc.errSubstr == "" {
-				require.NoError(err)
-			} else {
-				require.ErrorContains(err, tc.errSubstr)
-			}
-		})
-	}
-}
-
 // TestYAMLEdgeCases tests edge cases for YAML parsing, including non-map types
 func TestYAMLEdgeCases(t *testing.T) {
 	require := require.New(t)

pkg/config/source/aggregator.go

@@ -15,11 +15,9 @@
 package source
 
 import (
-	"cmp"
 	"errors"
 	"fmt"
-	"maps"
+	"sort"
-	"slices"
 	"sync"
 
 	v1 "github.com/fatedier/frp/pkg/config/v1"
@@ -99,11 +97,21 @@ func (a *Aggregator) mapsToSortedSlices(
 	proxyMap map[string]v1.ProxyConfigurer,
 	visitorMap map[string]v1.VisitorConfigurer,
 ) ([]v1.ProxyConfigurer, []v1.VisitorConfigurer) {
-	proxies := slices.SortedFunc(maps.Values(proxyMap), func(x, y v1.ProxyConfigurer) int {
+	proxies := make([]v1.ProxyConfigurer, 0, len(proxyMap))
-		return cmp.Compare(x.GetBaseConfig().Name, y.GetBaseConfig().Name)
+	for _, p := range proxyMap {
+		proxies = append(proxies, p)
+	}
+	sort.Slice(proxies, func(i, j int) bool {
+		return proxies[i].GetBaseConfig().Name < proxies[j].GetBaseConfig().Name
 	})
-	visitors := slices.SortedFunc(maps.Values(visitorMap), func(x, y v1.VisitorConfigurer) int {
+
-		return cmp.Compare(x.GetBaseConfig().Name, y.GetBaseConfig().Name)
+	visitors := make([]v1.VisitorConfigurer, 0, len(visitorMap))
+	for _, v := range visitorMap {
+		visitors = append(visitors, v)
+	}
+	sort.Slice(visitors, func(i, j int) bool {
+		return visitors[i].GetBaseConfig().Name < visitors[j].GetBaseConfig().Name
 	})
+
 	return proxies, visitors
 }

pkg/config/source/aggregator_test.go

@@ -196,27 +196,6 @@ func TestAggregator_VisitorMerge(t *testing.T) {
 	require.Len(visitors, 2)
 }
 
-func TestAggregator_Load_ReturnsSortedByName(t *testing.T) {
-	require := require.New(t)
-
-	agg := newTestAggregator(t, nil)
-	err := agg.ConfigSource().ReplaceAll(
-		[]v1.ProxyConfigurer{mockProxy("charlie"), mockProxy("alice"), mockProxy("bob")},
-		[]v1.VisitorConfigurer{mockVisitor("zulu"), mockVisitor("alpha")},
-	)
-	require.NoError(err)
-
-	proxies, visitors, err := agg.Load()
-	require.NoError(err)
-	require.Len(proxies, 3)
-	require.Equal("alice", proxies[0].GetBaseConfig().Name)
-	require.Equal("bob", proxies[1].GetBaseConfig().Name)
-	require.Equal("charlie", proxies[2].GetBaseConfig().Name)
-	require.Len(visitors, 2)
-	require.Equal("alpha", visitors[0].GetBaseConfig().Name)
-	require.Equal("zulu", visitors[1].GetBaseConfig().Name)
-}
-
 func TestAggregator_Load_ReturnsDefensiveCopies(t *testing.T) {
 	require := require.New(t)
 

pkg/config/source/config_source.go

@@ -14,7 +14,11 @@
 
 package source
 
-import v1 "github.com/fatedier/frp/pkg/config/v1"
+import (
+	"fmt"
+
+	v1 "github.com/fatedier/frp/pkg/config/v1"
+)
 
 // ConfigSource implements Source for in-memory configuration.
 // All operations are thread-safe.
@@ -35,17 +39,23 @@ func (s *ConfigSource) ReplaceAll(proxies []v1.ProxyConfigurer, visitors []v1.Vi
 
 	nextProxies := make(map[string]v1.ProxyConfigurer, len(proxies))
 	for _, p := range proxies {
-		name, err := validateProxyName(p)
+		if p == nil {
-		if err != nil {
+			return fmt.Errorf("proxy cannot be nil")
-			return err
+		}
+		name := p.GetBaseConfig().Name
+		if name == "" {
+			return fmt.Errorf("proxy name cannot be empty")
 		}
 		nextProxies[name] = p
 	}
 	nextVisitors := make(map[string]v1.VisitorConfigurer, len(visitors))
 	for _, v := range visitors {
-		name, err := validateVisitorName(v)
+		if v == nil {
-		if err != nil {
+			return fmt.Errorf("visitor cannot be nil")
-			return err
+		}
+		name := v.GetBaseConfig().Name
+		if name == "" {
+			return fmt.Errorf("visitor name cannot be empty")
 		}
 		nextVisitors[name] = v
 	}

pkg/config/source/store.go

@@ -43,11 +43,6 @@ var (
 	ErrNotFound      = errors.New("not found")
 )
 
-const (
-	storeKindProxy   = "proxy"
-	storeKindVisitor = "visitor"
-)
-
 func NewStoreSource(cfg StoreSourceConfig) (*StoreSource, error) {
 	if cfg.Path == "" {
 		return nil, fmt.Errorf("path is required")
@@ -177,111 +172,79 @@ func (s *StoreSource) saveToFileUnlocked() error {
 	return nil
 }
 
-func (s *StoreSource) persistOrRollbackUnlocked(rollback func()) error {
+func (s *StoreSource) AddProxy(proxy v1.ProxyConfigurer) error {
+	if proxy == nil {
+		return fmt.Errorf("proxy cannot be nil")
+	}
+
+	name := proxy.GetBaseConfig().Name
+	if name == "" {
+		return fmt.Errorf("proxy name cannot be empty")
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if _, exists := s.proxies[name]; exists {
+		return fmt.Errorf("%w: proxy %q", ErrAlreadyExists, name)
+	}
+
+	s.proxies[name] = proxy
+
 	if err := s.saveToFileUnlocked(); err != nil {
-		rollback()
+		delete(s.proxies, name)
 		return fmt.Errorf("failed to persist: %w", err)
 	}
 	return nil
 }
 
-// Store map selectors return the target map for generic helpers.
-func proxyStoreEntries(s *StoreSource) map[string]v1.ProxyConfigurer {
-	return s.proxies
-}
-
-func visitorStoreEntries(s *StoreSource) map[string]v1.VisitorConfigurer {
-	return s.visitors
-}
-
-// Store entry helpers share mutation, persistence, and rollback for proxy and visitor maps.
-// T is intentionally limited by callers to v1.ProxyConfigurer or v1.VisitorConfigurer.
-func addStoreEntry[T any](
-	s *StoreSource,
-	entriesFn func(*StoreSource) map[string]T,
-	kind string,
-	name string,
-	value T,
-) error {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	entries := entriesFn(s)
-	if _, exists := entries[name]; exists {
-		return fmt.Errorf("%w: %s %q", ErrAlreadyExists, kind, name)
-	}
-
-	entries[name] = value
-	return s.persistOrRollbackUnlocked(func() {
-		delete(entries, name)
-	})
-}
-
-func updateStoreEntry[T any](
-	s *StoreSource,
-	entriesFn func(*StoreSource) map[string]T,
-	kind string,
-	name string,
-	value T,
-) error {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	entries := entriesFn(s)
-	old, exists := entries[name]
-	if !exists {
-		return fmt.Errorf("%w: %s %q", ErrNotFound, kind, name)
-	}
-
-	entries[name] = value
-	return s.persistOrRollbackUnlocked(func() {
-		entries[name] = old
-	})
-}
-
-func removeStoreEntry[T any](
-	s *StoreSource,
-	entriesFn func(*StoreSource) map[string]T,
-	kind string,
-	name string,
-) error {
-	if name == "" {
-		return fmt.Errorf("%s name cannot be empty", kind)
-	}
-
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	entries := entriesFn(s)
-	old, exists := entries[name]
-	if !exists {
-		return fmt.Errorf("%w: %s %q", ErrNotFound, kind, name)
-	}
-
-	delete(entries, name)
-	return s.persistOrRollbackUnlocked(func() {
-		entries[name] = old
-	})
-}
-
-func (s *StoreSource) AddProxy(proxy v1.ProxyConfigurer) error {
-	name, err := validateProxyName(proxy)
-	if err != nil {
-		return err
-	}
-	return addStoreEntry(s, proxyStoreEntries, storeKindProxy, name, proxy)
-}
-
 func (s *StoreSource) UpdateProxy(proxy v1.ProxyConfigurer) error {
-	name, err := validateProxyName(proxy)
+	if proxy == nil {
-	if err != nil {
+		return fmt.Errorf("proxy cannot be nil")
-		return err
 	}
-	return updateStoreEntry(s, proxyStoreEntries, storeKindProxy, name, proxy)
+
+	name := proxy.GetBaseConfig().Name
+	if name == "" {
+		return fmt.Errorf("proxy name cannot be empty")
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	oldProxy, exists := s.proxies[name]
+	if !exists {
+		return fmt.Errorf("%w: proxy %q", ErrNotFound, name)
+	}
+
+	s.proxies[name] = proxy
+
+	if err := s.saveToFileUnlocked(); err != nil {
+		s.proxies[name] = oldProxy
+		return fmt.Errorf("failed to persist: %w", err)
+	}
+	return nil
 }
 
 func (s *StoreSource) RemoveProxy(name string) error {
-	return removeStoreEntry(s, proxyStoreEntries, storeKindProxy, name)
+	if name == "" {
+		return fmt.Errorf("proxy name cannot be empty")
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	oldProxy, exists := s.proxies[name]
+	if !exists {
+		return fmt.Errorf("%w: proxy %q", ErrNotFound, name)
+	}
+
+	delete(s.proxies, name)
+
+	if err := s.saveToFileUnlocked(); err != nil {
+		s.proxies[name] = oldProxy
+		return fmt.Errorf("failed to persist: %w", err)
+	}
+	return nil
 }
 
 func (s *StoreSource) GetProxy(name string) v1.ProxyConfigurer {
@@ -296,23 +259,78 @@ func (s *StoreSource) GetProxy(name string) v1.ProxyConfigurer {
 }
 
 func (s *StoreSource) AddVisitor(visitor v1.VisitorConfigurer) error {
-	name, err := validateVisitorName(visitor)
+	if visitor == nil {
-	if err != nil {
+		return fmt.Errorf("visitor cannot be nil")
-		return err
 	}
-	return addStoreEntry(s, visitorStoreEntries, storeKindVisitor, name, visitor)
+
+	name := visitor.GetBaseConfig().Name
+	if name == "" {
+		return fmt.Errorf("visitor name cannot be empty")
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if _, exists := s.visitors[name]; exists {
+		return fmt.Errorf("%w: visitor %q", ErrAlreadyExists, name)
+	}
+
+	s.visitors[name] = visitor
+
+	if err := s.saveToFileUnlocked(); err != nil {
+		delete(s.visitors, name)
+		return fmt.Errorf("failed to persist: %w", err)
+	}
+	return nil
 }
 
 func (s *StoreSource) UpdateVisitor(visitor v1.VisitorConfigurer) error {
-	name, err := validateVisitorName(visitor)
+	if visitor == nil {
-	if err != nil {
+		return fmt.Errorf("visitor cannot be nil")
-		return err
 	}
-	return updateStoreEntry(s, visitorStoreEntries, storeKindVisitor, name, visitor)
+
+	name := visitor.GetBaseConfig().Name
+	if name == "" {
+		return fmt.Errorf("visitor name cannot be empty")
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	oldVisitor, exists := s.visitors[name]
+	if !exists {
+		return fmt.Errorf("%w: visitor %q", ErrNotFound, name)
+	}
+
+	s.visitors[name] = visitor
+
+	if err := s.saveToFileUnlocked(); err != nil {
+		s.visitors[name] = oldVisitor
+		return fmt.Errorf("failed to persist: %w", err)
+	}
+	return nil
 }
 
 func (s *StoreSource) RemoveVisitor(name string) error {
-	return removeStoreEntry(s, visitorStoreEntries, storeKindVisitor, name)
+	if name == "" {
+		return fmt.Errorf("visitor name cannot be empty")
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	oldVisitor, exists := s.visitors[name]
+	if !exists {
+		return fmt.Errorf("%w: visitor %q", ErrNotFound, name)
+	}
+
+	delete(s.visitors, name)
+
+	if err := s.saveToFileUnlocked(); err != nil {
+		s.visitors[name] = oldVisitor
+		return fmt.Errorf("failed to persist: %w", err)
+	}
+	return nil
 }
 
 func (s *StoreSource) GetVisitor(name string) v1.VisitorConfigurer {

pkg/config/source/store_test.go

@@ -17,7 +17,6 @@ package source
 import (
 	"os"
 	"path/filepath"
-	"runtime"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -60,101 +59,6 @@ func TestStoreSource_AddProxyAndVisitor_DoesNotApplyRuntimeDefaults(t *testing.T
 	require.Empty(gotVisitor.(*v1.XTCPVisitorConfig).Protocol)
 }
 
-func TestStoreSource_UpdateAndRemoveProxyAndVisitor(t *testing.T) {
-	require := require.New(t)
-
-	storeSource := newTestStoreSource(t)
-
-	proxyCfg := mockProxy("proxy1")
-	visitorCfg := mockVisitor("visitor1")
-
-	require.NoError(storeSource.AddProxy(proxyCfg))
-	require.NoError(storeSource.AddVisitor(visitorCfg))
-	require.ErrorIs(storeSource.AddProxy(proxyCfg), ErrAlreadyExists)
-	require.ErrorIs(storeSource.AddVisitor(visitorCfg), ErrAlreadyExists)
-	require.ErrorContains(storeSource.RemoveProxy(""), "proxy name cannot be empty")
-	require.ErrorContains(storeSource.RemoveVisitor(""), "visitor name cannot be empty")
-
-	updatedProxy := mockProxy("proxy1").(*v1.TCPProxyConfig)
-	updatedProxy.RemotePort = 19090
-	require.NoError(storeSource.UpdateProxy(updatedProxy))
-	require.Equal(19090, storeSource.GetProxy("proxy1").(*v1.TCPProxyConfig).RemotePort)
-
-	updatedVisitor := mockVisitor("visitor1").(*v1.STCPVisitorConfig)
-	updatedVisitor.ServerName = "updated-server"
-	require.NoError(storeSource.UpdateVisitor(updatedVisitor))
-	require.Equal("updated-server", storeSource.GetVisitor("visitor1").(*v1.STCPVisitorConfig).ServerName)
-
-	require.NoError(storeSource.RemoveProxy("proxy1"))
-	require.Nil(storeSource.GetProxy("proxy1"))
-	require.ErrorIs(storeSource.RemoveProxy("proxy1"), ErrNotFound)
-
-	require.NoError(storeSource.RemoveVisitor("visitor1"))
-	require.Nil(storeSource.GetVisitor("visitor1"))
-	require.ErrorIs(storeSource.RemoveVisitor("visitor1"), ErrNotFound)
-
-	require.ErrorIs(storeSource.UpdateProxy(updatedProxy), ErrNotFound)
-	require.ErrorIs(storeSource.UpdateVisitor(updatedVisitor), ErrNotFound)
-}
-
-func TestStoreSource_MutationRollsBackOnPersistFailure(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("chmod does not make directories unwritable on Windows")
-	}
-	if os.Getuid() == 0 {
-		t.Skip("chmod does not block writes for uid 0")
-	}
-
-	require := require.New(t)
-
-	dir := t.TempDir()
-	path := filepath.Join(dir, "store.json")
-	storeSource, err := NewStoreSource(StoreSourceConfig{Path: path})
-	require.NoError(err)
-
-	proxyCfg := mockProxy("proxy1")
-	visitorCfg := mockVisitor("visitor1")
-	originalRemotePort := proxyCfg.(*v1.TCPProxyConfig).RemotePort
-	originalServerName := visitorCfg.(*v1.STCPVisitorConfig).ServerName
-	require.NoError(storeSource.AddProxy(proxyCfg))
-	require.NoError(storeSource.AddVisitor(visitorCfg))
-
-	require.NoError(os.Chmod(dir, 0o500))
-	t.Cleanup(func() {
-		_ = os.Chmod(dir, 0o700)
-	})
-
-	requirePersistError := func(err error) {
-		t.Helper()
-		require.Error(err)
-		require.ErrorContains(err, "failed to persist")
-		require.NotErrorIs(err, ErrAlreadyExists)
-		require.NotErrorIs(err, ErrNotFound)
-	}
-
-	requirePersistError(storeSource.AddProxy(mockProxy("proxy2")))
-	require.Nil(storeSource.GetProxy("proxy2"))
-
-	updatedProxy := mockProxy("proxy1").(*v1.TCPProxyConfig)
-	updatedProxy.RemotePort = 19090
-	requirePersistError(storeSource.UpdateProxy(updatedProxy))
-	require.Equal(originalRemotePort, storeSource.GetProxy("proxy1").(*v1.TCPProxyConfig).RemotePort)
-
-	requirePersistError(storeSource.RemoveProxy("proxy1"))
-	require.NotNil(storeSource.GetProxy("proxy1"))
-
-	requirePersistError(storeSource.AddVisitor(mockVisitor("visitor2")))
-	require.Nil(storeSource.GetVisitor("visitor2"))
-
-	updatedVisitor := mockVisitor("visitor1").(*v1.STCPVisitorConfig)
-	updatedVisitor.ServerName = "updated-server"
-	requirePersistError(storeSource.UpdateVisitor(updatedVisitor))
-	require.Equal(originalServerName, storeSource.GetVisitor("visitor1").(*v1.STCPVisitorConfig).ServerName)
-
-	requirePersistError(storeSource.RemoveVisitor("visitor1"))
-	require.NotNil(storeSource.GetVisitor("visitor1"))
-}
-
 func TestStoreSource_LoadFromFile_DoesNotApplyRuntimeDefaults(t *testing.T) {
 	require := require.New(t)
 

pkg/config/source/validation.go

@@ -1,43 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package source
-
-import (
-	"fmt"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-)
-
-func validateProxyName(proxy v1.ProxyConfigurer) (string, error) {
-	if proxy == nil {
-		return "", fmt.Errorf("proxy cannot be nil")
-	}
-	name := proxy.GetBaseConfig().Name
-	if name == "" {
-		return "", fmt.Errorf("proxy name cannot be empty")
-	}
-	return name, nil
-}
-
-func validateVisitorName(visitor v1.VisitorConfigurer) (string, error) {
-	if visitor == nil {
-		return "", fmt.Errorf("visitor cannot be nil")
-	}
-	name := visitor.GetBaseConfig().Name
-	if name == "" {
-		return "", fmt.Errorf("visitor name cannot be empty")
-	}
-	return name, nil
-}

pkg/config/template.go

@@ -38,7 +38,7 @@ func parseNumberRangePair(firstRangeStr, secondRangeStr string) ([]NumberPair, e
 		return nil, fmt.Errorf("first and second range numbers are not in pairs")
 	}
 	pairs := make([]NumberPair, 0, len(firstRangeNumbers))
-	for i := range firstRangeNumbers {
+	for i := 0; i < len(firstRangeNumbers); i++ {
 		pairs = append(pairs, NumberPair{
 			First:  firstRangeNumbers[i],
 			Second: secondRangeNumbers[i],

pkg/config/types/types.go

@@ -70,18 +70,24 @@ func (q *BandwidthQuantity) UnmarshalString(s string) error {
 		f    float64
 		err  error
 	)
-	if fstr, ok := strings.CutSuffix(s, "MB"); ok {
+	switch {
+	case strings.HasSuffix(s, "MB"):
 		base = MB
+		fstr := strings.TrimSuffix(s, "MB")
 		f, err = strconv.ParseFloat(fstr, 64)
-	} else if fstr, ok := strings.CutSuffix(s, "KB"); ok {
-		base = KB
-		f, err = strconv.ParseFloat(fstr, 64)
-	} else {
-		return errors.New("unit not support")
-	}
 		if err != nil {
 			return err
 		}
+	case strings.HasSuffix(s, "KB"):
+		base = KB
+		fstr := strings.TrimSuffix(s, "KB")
+		f, err = strconv.ParseFloat(fstr, 64)
+		if err != nil {
+			return err
+		}
+	default:
+		return errors.New("unit not support")
+	}
 
 	q.s = s
 	q.i = int64(f * float64(base))
@@ -137,8 +143,8 @@ func (p PortsRangeSlice) String() string {
 func NewPortsRangeSliceFromString(str string) ([]PortsRange, error) {
 	str = strings.TrimSpace(str)
 	out := []PortsRange{}
-	numRanges := strings.SplitSeq(str, ",")
+	numRanges := strings.Split(str, ",")
-	for numRangeStr := range numRanges {
+	for _, numRangeStr := range numRanges {
 		// 1000-2000 or 2001
 		numArray := strings.Split(numRangeStr, "-")
 		// length: only 1 or 2 is correct

pkg/config/types/types_test.go

@@ -39,31 +39,6 @@ func TestBandwidthQuantity(t *testing.T) {
 	require.Equal(`{"b":"1KB","int":5}`, string(buf))
 }
 
-func TestBandwidthQuantity_MB(t *testing.T) {
-	require := require.New(t)
-
-	var w Wrap
-	err := json.Unmarshal([]byte(`{"b":"2MB","int":1}`), &w)
-	require.NoError(err)
-	require.EqualValues(2*MB, w.B.Bytes())
-
-	buf, err := json.Marshal(&w)
-	require.NoError(err)
-	require.Equal(`{"b":"2MB","int":1}`, string(buf))
-}
-
-func TestBandwidthQuantity_InvalidUnit(t *testing.T) {
-	var w Wrap
-	err := json.Unmarshal([]byte(`{"b":"1GB","int":1}`), &w)
-	require.Error(t, err)
-}
-
-func TestBandwidthQuantity_InvalidNumber(t *testing.T) {
-	var w Wrap
-	err := json.Unmarshal([]byte(`{"b":"abcKB","int":1}`), &w)
-	require.Error(t, err)
-}
-
 func TestPortsRangeSlice2String(t *testing.T) {
 	require := require.New(t)
 

pkg/config/v1/client.go

@@ -49,8 +49,7 @@ type ClientCommonConfig struct {
 	// STUN server to help penetrate NAT hole.
 	NatHoleSTUNServer string `json:"natHoleStunServer,omitempty"`
 	// DNSServer specifies a DNS server address for FRPC to use. If this value
-	// is "", the default DNS will be used. A DNS-over-HTTPS endpoint is also
+	// is "", the default DNS will be used.
-	// supported, e.g. "https://1.1.1.1/dns-query".
 	DNSServer string `json:"dnsServer,omitempty"`
 	// LoginFailExit controls whether or not the client should exit after a
 	// failed login attempt. If false, the client will retry until a login
@@ -105,9 +104,6 @@ type ClientTransportConfig struct {
 	// Valid values are "tcp", "kcp", "quic", "websocket" and "wss". By default, this value
 	// is "tcp".
 	Protocol string `json:"protocol,omitempty"`
-	// WireProtocol specifies the frpc/frps internal wire protocol version.
-	// Valid values are "v1" and "v2". By default, this value is "v1".
-	WireProtocol string `json:"wireProtocol,omitempty"`
 	// The maximum amount of time a dial to server will wait for a connect to complete.
 	DialServerTimeout int64 `json:"dialServerTimeout,omitempty"`
 	// DialServerKeepAlive specifies the interval between keep-alive probes for an active network connection between frpc and frps.
@@ -147,7 +143,6 @@ type ClientTransportConfig struct {
 
 func (c *ClientTransportConfig) Complete() {
 	c.Protocol = util.EmptyOr(c.Protocol, "tcp")
-	c.WireProtocol = util.EmptyOr(c.WireProtocol, "v1")
 	c.DialServerTimeout = util.EmptyOr(c.DialServerTimeout, 10)
 	c.DialServerKeepAlive = util.EmptyOr(c.DialServerKeepAlive, 7200)
 	c.ProxyURL = util.EmptyOr(c.ProxyURL, os.Getenv("http_proxy"))

pkg/config/v1/client_test.go

@@ -29,7 +29,6 @@ func TestClientConfigComplete(t *testing.T) {
 
 	require.EqualValues("token", c.Auth.Method)
 	require.Equal(true, lo.FromPtr(c.Transport.TCPMux))
-	require.Equal("v1", c.Transport.WireProtocol)
 	require.Equal(true, lo.FromPtr(c.LoginFailExit))
 	require.Equal(true, lo.FromPtr(c.Transport.TLS.Enable))
 	require.Equal(true, lo.FromPtr(c.Transport.TLS.DisableCustomTLSFirstByte))

pkg/config/v1/proxy.go

@@ -239,14 +239,14 @@ const (
 )
 
 var proxyConfigTypeMap = map[ProxyType]reflect.Type{
-	ProxyTypeTCP:    reflect.TypeFor[TCPProxyConfig](),
+	ProxyTypeTCP:    reflect.TypeOf(TCPProxyConfig{}),
-	ProxyTypeUDP:    reflect.TypeFor[UDPProxyConfig](),
+	ProxyTypeUDP:    reflect.TypeOf(UDPProxyConfig{}),
-	ProxyTypeHTTP:   reflect.TypeFor[HTTPProxyConfig](),
+	ProxyTypeHTTP:   reflect.TypeOf(HTTPProxyConfig{}),
-	ProxyTypeHTTPS:  reflect.TypeFor[HTTPSProxyConfig](),
+	ProxyTypeHTTPS:  reflect.TypeOf(HTTPSProxyConfig{}),
-	ProxyTypeTCPMUX: reflect.TypeFor[TCPMuxProxyConfig](),
+	ProxyTypeTCPMUX: reflect.TypeOf(TCPMuxProxyConfig{}),
-	ProxyTypeSTCP:   reflect.TypeFor[STCPProxyConfig](),
+	ProxyTypeSTCP:   reflect.TypeOf(STCPProxyConfig{}),
-	ProxyTypeXTCP:   reflect.TypeFor[XTCPProxyConfig](),
+	ProxyTypeXTCP:   reflect.TypeOf(XTCPProxyConfig{}),
-	ProxyTypeSUDP:   reflect.TypeFor[SUDPProxyConfig](),
+	ProxyTypeSUDP:   reflect.TypeOf(SUDPProxyConfig{}),
 }
 
 func NewProxyConfigurerByType(proxyType ProxyType) ProxyConfigurer {
@@ -369,12 +369,6 @@ var _ ProxyConfigurer = &HTTPSProxyConfig{}
 type HTTPSProxyConfig struct {
 	ProxyBaseConfig
 	DomainConfig
-
-	// HTTPRedirect requests frps to redirect plain HTTP requests for the
-	// proxy's domains to their HTTPS endpoint. It only takes effect when
-	// frps has vhostHTTPPort enabled, and never overrides a real HTTP
-	// proxy registered on the same domain.
-	HTTPRedirect bool `json:"httpRedirect,omitempty"`
 }
 
 func (c *HTTPSProxyConfig) MarshalToMsg(m *msg.NewProxy) {
@@ -382,7 +376,6 @@ func (c *HTTPSProxyConfig) MarshalToMsg(m *msg.NewProxy) {
 
 	m.CustomDomains = c.CustomDomains
 	m.SubDomain = c.SubDomain
-	m.HTTPRedirect = c.HTTPRedirect
 }
 
 func (c *HTTPSProxyConfig) UnmarshalFromMsg(m *msg.NewProxy) {
@@ -390,7 +383,6 @@ func (c *HTTPSProxyConfig) UnmarshalFromMsg(m *msg.NewProxy) {
 
 	c.CustomDomains = m.CustomDomains
 	c.SubDomain = m.SubDomain
-	c.HTTPRedirect = m.HTTPRedirect
 }
 
 func (c *HTTPSProxyConfig) Clone() ProxyConfigurer {

pkg/config/v1/proxy_plugin.go

@@ -16,7 +16,6 @@ package v1
 
 import (
 	"reflect"
-	"slices"
 
 	"github.com/samber/lo"
 
@@ -26,7 +25,6 @@ import (
 
 const (
 	PluginHTTP2HTTPS       = "http2https"
-	PluginHTTP2HTTPSRedirect = "http2https_redirect"
 	PluginHTTPProxy        = "http_proxy"
 	PluginHTTPS2HTTP       = "https2http"
 	PluginHTTPS2HTTPS      = "https2https"
@@ -39,17 +37,16 @@ const (
 )
 
 var clientPluginOptionsTypeMap = map[string]reflect.Type{
-	PluginHTTP2HTTPS:         reflect.TypeFor[HTTP2HTTPSPluginOptions](),
+	PluginHTTP2HTTPS:       reflect.TypeOf(HTTP2HTTPSPluginOptions{}),
-	PluginHTTP2HTTPSRedirect: reflect.TypeFor[HTTP2HTTPSRedirectPluginOptions](),
+	PluginHTTPProxy:        reflect.TypeOf(HTTPProxyPluginOptions{}),
-	PluginHTTPProxy:          reflect.TypeFor[HTTPProxyPluginOptions](),
+	PluginHTTPS2HTTP:       reflect.TypeOf(HTTPS2HTTPPluginOptions{}),
-	PluginHTTPS2HTTP:         reflect.TypeFor[HTTPS2HTTPPluginOptions](),
+	PluginHTTPS2HTTPS:      reflect.TypeOf(HTTPS2HTTPSPluginOptions{}),
-	PluginHTTPS2HTTPS:        reflect.TypeFor[HTTPS2HTTPSPluginOptions](),
+	PluginHTTP2HTTP:        reflect.TypeOf(HTTP2HTTPPluginOptions{}),
-	PluginHTTP2HTTP:          reflect.TypeFor[HTTP2HTTPPluginOptions](),
+	PluginSocks5:           reflect.TypeOf(Socks5PluginOptions{}),
-	PluginSocks5:             reflect.TypeFor[Socks5PluginOptions](),
+	PluginStaticFile:       reflect.TypeOf(StaticFilePluginOptions{}),
-	PluginStaticFile:         reflect.TypeFor[StaticFilePluginOptions](),
+	PluginUnixDomainSocket: reflect.TypeOf(UnixDomainSocketPluginOptions{}),
-	PluginUnixDomainSocket:   reflect.TypeFor[UnixDomainSocketPluginOptions](),
+	PluginTLS2Raw:          reflect.TypeOf(TLS2RawPluginOptions{}),
-	PluginTLS2Raw:            reflect.TypeFor[TLS2RawPluginOptions](),
+	PluginVirtualNet:       reflect.TypeOf(VirtualNetPluginOptions{}),
-	PluginVirtualNet:         reflect.TypeFor[VirtualNetPluginOptions](),
 }
 
 type ClientPluginOptions interface {
@@ -83,29 +80,6 @@ func (c *TypedClientPluginOptions) MarshalJSON() ([]byte, error) {
 	return jsonx.Marshal(c.ClientPluginOptions)
 }
 
-// AutoTLSOptions configures automatic certificate provisioning (ACME) for plugins
-// that terminate TLS locally.
-type AutoTLSOptions struct {
-	Enable bool `json:"enable,omitempty"`
-	// Contact email for certificate expiration and important notices.
-	Email string `json:"email,omitempty"`
-	// Directory used to cache ACME account and certificates.
-	CacheDir string `json:"cacheDir,omitempty"`
-	// ACME directory URL, e.g. Let's Encrypt staging/prod endpoint.
-	CADirURL string `json:"caDirURL,omitempty"`
-	// Restrict certificate issuance to the listed domains.
-	HostAllowList []string `json:"hostAllowList,omitempty"`
-}
-
-func (o *AutoTLSOptions) Clone() *AutoTLSOptions {
-	if o == nil {
-		return nil
-	}
-	out := *o
-	out.HostAllowList = slices.Clone(o.HostAllowList)
-	return &out
-}
-
 type HTTP2HTTPSPluginOptions struct {
 	Type              string           `json:"type,omitempty"`
 	LocalAddr         string           `json:"localAddr,omitempty"`
@@ -124,21 +98,6 @@ func (o *HTTP2HTTPSPluginOptions) Clone() ClientPluginOptions {
 	return &out
 }
 
-type HTTP2HTTPSRedirectPluginOptions struct {
-	Type      string `json:"type,omitempty"`
-	HTTPSPort int    `json:"httpsPort,omitempty"`
-}
-
-func (o *HTTP2HTTPSRedirectPluginOptions) Complete() {}
-
-func (o *HTTP2HTTPSRedirectPluginOptions) Clone() ClientPluginOptions {
-	if o == nil {
-		return nil
-	}
-	out := *o
-	return &out
-}
-
 type HTTPProxyPluginOptions struct {
 	Type         string `json:"type,omitempty"`
 	HTTPUser     string `json:"httpUser,omitempty"`
@@ -163,7 +122,6 @@ type HTTPS2HTTPPluginOptions struct {
 	EnableHTTP2       *bool            `json:"enableHTTP2,omitempty"`
 	CrtPath           string           `json:"crtPath,omitempty"`
 	KeyPath           string           `json:"keyPath,omitempty"`
-	AutoTLS           *AutoTLSOptions  `json:"autoTLS,omitempty"`
 }
 
 func (o *HTTPS2HTTPPluginOptions) Complete() {
@@ -177,7 +135,6 @@ func (o *HTTPS2HTTPPluginOptions) Clone() ClientPluginOptions {
 	out := *o
 	out.RequestHeaders = o.RequestHeaders.Clone()
 	out.EnableHTTP2 = util.ClonePtr(o.EnableHTTP2)
-	out.AutoTLS = o.AutoTLS.Clone()
 	return &out
 }
 
@@ -189,7 +146,6 @@ type HTTPS2HTTPSPluginOptions struct {
 	EnableHTTP2       *bool            `json:"enableHTTP2,omitempty"`
 	CrtPath           string           `json:"crtPath,omitempty"`
 	KeyPath           string           `json:"keyPath,omitempty"`
-	AutoTLS           *AutoTLSOptions  `json:"autoTLS,omitempty"`
 }
 
 func (o *HTTPS2HTTPSPluginOptions) Complete() {
@@ -203,7 +159,6 @@ func (o *HTTPS2HTTPSPluginOptions) Clone() ClientPluginOptions {
 	out := *o
 	out.RequestHeaders = o.RequestHeaders.Clone()
 	out.EnableHTTP2 = util.ClonePtr(o.EnableHTTP2)
-	out.AutoTLS = o.AutoTLS.Clone()
 	return &out
 }
 
@@ -279,7 +234,6 @@ type TLS2RawPluginOptions struct {
 	LocalAddr string `json:"localAddr,omitempty"`
 	CrtPath   string `json:"crtPath,omitempty"`
 	KeyPath   string `json:"keyPath,omitempty"`
-	AutoTLS   *AutoTLSOptions `json:"autoTLS,omitempty"`
 }
 
 func (o *TLS2RawPluginOptions) Complete() {}
@@ -289,7 +243,6 @@ func (o *TLS2RawPluginOptions) Clone() ClientPluginOptions {
 		return nil
 	}
 	out := *o
-	out.AutoTLS = o.AutoTLS.Clone()
 	return &out
 }
 

pkg/config/v1/server.go

@@ -51,12 +51,6 @@ type ServerConfig struct {
 	// Vhost requests. If this value is 0, the server will not listen for HTTPS
 	// requests.
 	VhostHTTPSPort int `json:"vhostHTTPSPort,omitempty"`
-	// VhostHTTPSRedirectPort specifies the port used in the Location header
-	// when redirecting HTTP requests to HTTPS for proxies with httpRedirect
-	// enabled. Set it when browsers reach the HTTPS vhost through a port
-	// mapping, so it differs from VhostHTTPSPort. By default, this value is
-	// VhostHTTPSPort.
-	VhostHTTPSRedirectPort int `json:"vhostHTTPSRedirectPort,omitempty"`
 	// TCPMuxHTTPConnectPort specifies the port that the server listens for TCP
 	// HTTP CONNECT requests. If the value is 0, the server will not multiplex TCP
 	// requests on one single port. If it's not - it will listen on this value for
@@ -124,7 +118,6 @@ func (c *ServerConfig) Complete() error {
 	}
 
 	c.VhostHTTPTimeout = util.EmptyOr(c.VhostHTTPTimeout, 60)
-	c.VhostHTTPSRedirectPort = util.EmptyOr(c.VhostHTTPSRedirectPort, c.VhostHTTPSPort)
 	c.DetailedErrorsToClient = util.EmptyOr(c.DetailedErrorsToClient, lo.ToPtr(true))
 	c.UserConnTimeout = util.EmptyOr(c.UserConnTimeout, 10)
 	c.UDPPacketSize = util.EmptyOr(c.UDPPacketSize, 1500)
@@ -174,18 +167,12 @@ type ServerTransportConfig struct {
 	// If negative, keep-alive probes are disabled.
 	TCPKeepAlive int64 `json:"tcpKeepalive,omitempty"`
 	// MaxPoolCount specifies the maximum pool size for each proxy. By default,
-	// this value is 5. Negative values are invalid.
+	// this value is 5.
 	MaxPoolCount int64 `json:"maxPoolCount,omitempty"`
 	// HeartBeatTimeout specifies the maximum time to wait for a heartbeat
 	// before terminating the connection. It is not recommended to change this
 	// value. By default, this value is 90. Set negative value to disable it.
 	HeartbeatTimeout int64 `json:"heartbeatTimeout,omitempty"`
-	// ProxyIdleTimeout specifies the maximum time in seconds that a proxied
-	// user connection can stay open without any traffic in either direction
-	// before frps closes it. This reclaims connections whose endpoints are
-	// still open at the TCP level but will never send data again. By default,
-	// this value is 0, which disables the idle timeout.
-	ProxyIdleTimeout int64 `json:"proxyIdleTimeout,omitempty"`
 	// QUIC options.
 	QUIC QUICOptions `json:"quic,omitempty"`
 	// TLS specifies TLS settings for the connection from the client.

pkg/config/v1/validation/auth.go

@@ -1,43 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package validation
-
-import (
-	"fmt"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/policy/security"
-)
-
-func (v *ConfigValidator) validateAuthTokenSource(token string, tokenSource *v1.ValueSource) error {
-	var errs error
-	// Preserve the previous client/server validation order for joined errors.
-	if token != "" && tokenSource != nil {
-		errs = AppendError(errs, fmt.Errorf("cannot specify both auth.token and auth.tokenSource"))
-	}
-	if tokenSource == nil {
-		return errs
-	}
-
-	if tokenSource.Type == "exec" {
-		if err := v.ValidateUnsafeFeature(security.TokenSourceExec); err != nil {
-			errs = AppendError(errs, err)
-		}
-	}
-	if err := tokenSource.Validate(); err != nil {
-		errs = AppendError(errs, fmt.Errorf("invalid auth.tokenSource: %v", err))
-	}
-	return errs
-}

pkg/config/v1/validation/auth_test.go

@@ -1,228 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package validation
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/policy/security"
-)
-
-const (
-	tokenSourceConflictErr = "cannot specify both auth.token and auth.tokenSource"
-	tokenSourceExecErr     = "unsafe feature \"TokenSourceExec\" is not enabled. To enable it, ensure it is allowed in the configuration or command line flags"
-	invalidFileSourceErr   = "invalid auth.tokenSource: file configuration is required when type is 'file'"
-	unsupportedSourceErr   = "invalid auth.tokenSource: unsupported value source type: env (only 'file' and 'exec' are supported)"
-)
-
-func TestValidateAuthTokenSource(t *testing.T) {
-	for _, tc := range authTokenSourceTestCases() {
-		t.Run(tc.name, func(t *testing.T) {
-			validator := newAuthTokenSourceValidator(tc.unsafeAllowed)
-			err := validator.validateAuthTokenSource(tc.token, tc.tokenSource())
-			requireValidationErrors(t, err, tc.wantErrs)
-		})
-	}
-}
-
-func TestValidateClientAuthTokenSource(t *testing.T) {
-	for _, tc := range authTokenSourceTestCases() {
-		t.Run(tc.name, func(t *testing.T) {
-			auth := v1.AuthClientConfig{
-				Method:      v1.AuthMethodToken,
-				Token:       tc.token,
-				TokenSource: tc.tokenSource(),
-			}
-			validator := newAuthTokenSourceValidator(tc.unsafeAllowed)
-			_, err := validator.ValidateClientCommonConfig(validClientConfigWithAuth(auth))
-			requireValidationErrors(t, err, tc.wantErrs)
-		})
-	}
-}
-
-func TestValidateServerAuthTokenSource(t *testing.T) {
-	for _, tc := range authTokenSourceTestCases() {
-		t.Run(tc.name, func(t *testing.T) {
-			auth := v1.AuthServerConfig{
-				Method:      v1.AuthMethodToken,
-				Token:       tc.token,
-				TokenSource: tc.tokenSource(),
-			}
-			validator := newAuthTokenSourceValidator(tc.unsafeAllowed)
-			_, err := validator.ValidateServerConfig(validServerConfigWithAuth(auth))
-			requireValidationErrors(t, err, tc.wantErrs)
-		})
-	}
-}
-
-type authTokenSourceTestCase struct {
-	name          string
-	token         string
-	tokenSource   func() *v1.ValueSource
-	unsafeAllowed bool
-	wantErrs      []string
-}
-
-func authTokenSourceTestCases() []authTokenSourceTestCase {
-	return []authTokenSourceTestCase{
-		{
-			name:        "empty token config",
-			tokenSource: nilTokenSource,
-		},
-		{
-			name:        "valid file tokenSource",
-			tokenSource: validFileTokenSource,
-		},
-		{
-			name:        "literal token without tokenSource",
-			token:       "token",
-			tokenSource: nilTokenSource,
-		},
-		{
-			name:        "literal token conflicts with file tokenSource",
-			token:       "token",
-			tokenSource: validFileTokenSource,
-			wantErrs:    []string{tokenSourceConflictErr},
-		},
-		{
-			name:        "exec tokenSource requires unsafe feature",
-			tokenSource: validExecTokenSource,
-			wantErrs:    []string{tokenSourceExecErr},
-		},
-		{
-			name:          "exec tokenSource with unsafe feature allowed",
-			tokenSource:   validExecTokenSource,
-			unsafeAllowed: true,
-		},
-		{
-			name:        "literal token conflicts with exec tokenSource and unsafe feature disabled",
-			token:       "token",
-			tokenSource: validExecTokenSource,
-			wantErrs: []string{
-				tokenSourceConflictErr,
-				tokenSourceExecErr,
-			},
-		},
-		{
-			name:          "literal token conflicts with exec tokenSource and unsafe feature allowed",
-			token:         "token",
-			tokenSource:   validExecTokenSource,
-			unsafeAllowed: true,
-			wantErrs:      []string{tokenSourceConflictErr},
-		},
-		{
-			name:        "invalid file tokenSource is wrapped",
-			tokenSource: invalidFileTokenSource,
-			wantErrs:    []string{invalidFileSourceErr},
-		},
-		{
-			name:        "unsupported tokenSource type is wrapped",
-			tokenSource: unsupportedTokenSource,
-			wantErrs:    []string{unsupportedSourceErr},
-		},
-	}
-}
-
-func newAuthTokenSourceValidator(unsafeAllowed bool) *ConfigValidator {
-	if !unsafeAllowed {
-		return NewConfigValidator(nil)
-	}
-	return NewConfigValidator(security.NewUnsafeFeatures([]string{security.TokenSourceExec}))
-}
-
-func requireValidationErrors(t *testing.T, err error, wantErrs []string) {
-	t.Helper()
-	if len(wantErrs) == 0 {
-		require.NoError(t, err)
-		return
-	}
-	require.Error(t, err)
-	// Client/server validators may wrap joined errors in another join layer; compare leaf errors.
-	gotErrs := unwrapValidationErrors(err)
-	require.Len(t, gotErrs, len(wantErrs))
-	for i, wantErr := range wantErrs {
-		require.EqualError(t, gotErrs[i], wantErr)
-	}
-}
-
-func unwrapValidationErrors(err error) []error {
-	type joinedError interface {
-		Unwrap() []error
-	}
-	joined, ok := err.(joinedError)
-	if !ok {
-		return []error{err}
-	}
-
-	var errs []error
-	for _, err := range joined.Unwrap() {
-		errs = append(errs, unwrapValidationErrors(err)...)
-	}
-	return errs
-}
-
-// nilTokenSource keeps the shared table shape uniform for cases without a tokenSource.
-func nilTokenSource() *v1.ValueSource {
-	return nil
-}
-
-func validFileTokenSource() *v1.ValueSource {
-	return &v1.ValueSource{
-		Type: "file",
-		File: &v1.FileSource{Path: "token.txt"},
-	}
-}
-
-func validExecTokenSource() *v1.ValueSource {
-	return &v1.ValueSource{
-		Type: "exec",
-		Exec: &v1.ExecSource{Command: "print-token"},
-	}
-}
-
-func invalidFileTokenSource() *v1.ValueSource {
-	return &v1.ValueSource{
-		Type: "file",
-	}
-}
-
-func unsupportedTokenSource() *v1.ValueSource {
-	return &v1.ValueSource{Type: "env"}
-}
-
-func validClientConfigWithAuth(auth v1.AuthClientConfig) *v1.ClientCommonConfig {
-	return &v1.ClientCommonConfig{
-		Auth: auth,
-		Log: v1.LogConfig{
-			Level: "info",
-		},
-		Transport: v1.ClientTransportConfig{
-			Protocol:     "tcp",
-			WireProtocol: "v1",
-		},
-	}
-}
-
-func validServerConfigWithAuth(auth v1.AuthServerConfig) *v1.ServerConfig {
-	return &v1.ServerConfig{
-		Auth: auth,
-		Log: v1.LogConfig{
-			Level: "info",
-		},
-	}
-}

pkg/config/v1/validation/client.go

@@ -51,51 +51,14 @@ func (v *ConfigValidator) ValidateClientCommonConfig(c *v1.ClientCommonConfig) (
 }
 
 func validateFeatureGates(c *v1.ClientCommonConfig) (Warning, error) {
-	gates := featuregate.NewFeatureGate()
-	if err := gates.SetFromMap(c.FeatureGates); err != nil {
-		return nil, err
-	}
-
 	if c.VirtualNet.Address != "" {
-		if !gates.Enabled(featuregate.VirtualNet) {
+		if !featuregate.Enabled(featuregate.VirtualNet) {
 			return nil, fmt.Errorf("VirtualNet feature is not enabled; enable it by setting the appropriate feature gate flag")
 		}
 	}
 	return nil, nil
 }
 
-// ClientConfigRequirements describes runtime capabilities needed by a client configuration.
-type ClientConfigRequirements struct {
-	VirtualNet bool
-}
-
-// GetClientConfigRequirements returns the runtime capabilities needed by a client configuration.
-func GetClientConfigRequirements(
-	common *v1.ClientCommonConfig,
-	proxyCfgs []v1.ProxyConfigurer,
-	visitorCfgs []v1.VisitorConfigurer,
-) ClientConfigRequirements {
-	requirements := ClientConfigRequirements{}
-	if common != nil && common.VirtualNet.Address != "" {
-		requirements.VirtualNet = true
-	}
-	for _, cfg := range proxyCfgs {
-		if cfg.GetBaseConfig().Plugin.Type == v1.PluginVirtualNet {
-			requirements.VirtualNet = true
-			break
-		}
-	}
-	if !requirements.VirtualNet {
-		for _, cfg := range visitorCfgs {
-			if cfg.GetBaseConfig().Plugin.Type == v1.VisitorPluginVirtualNet {
-				requirements.VirtualNet = true
-				break
-			}
-		}
-	}
-	return requirements
-}
-
 func (v *ConfigValidator) validateAuthConfig(c *v1.AuthClientConfig) (Warning, error) {
 	var errs error
 	if !slices.Contains(SupportedAuthMethods, c.Method) {
@@ -105,16 +68,26 @@ func (v *ConfigValidator) validateAuthConfig(c *v1.AuthClientConfig) (Warning, e
 		errs = AppendError(errs, fmt.Errorf("invalid auth additional scopes, optional values are %v", SupportedAuthAdditionalScopes))
 	}
 
-	errs = AppendError(errs, v.validateAuthTokenSource(c.Token, c.TokenSource))
+	// Validate token/tokenSource mutual exclusivity
+	if c.Token != "" && c.TokenSource != nil {
+		errs = AppendError(errs, fmt.Errorf("cannot specify both auth.token and auth.tokenSource"))
+	}
+
+	// Validate tokenSource if specified
+	if c.TokenSource != nil {
+		if c.TokenSource.Type == "exec" {
+			if err := v.ValidateUnsafeFeature(security.TokenSourceExec); err != nil {
+				errs = AppendError(errs, err)
+			}
+		}
+		if err := c.TokenSource.Validate(); err != nil {
+			errs = AppendError(errs, fmt.Errorf("invalid auth.tokenSource: %v", err))
+		}
+	}
 
 	if err := v.validateOIDCConfig(&c.OIDC); err != nil {
 		errs = AppendError(errs, err)
 	}
-	if c.Method == v1.AuthMethodOIDC && c.OIDC.TokenSource == nil {
-		if err := ValidateOIDCClientCredentialsConfig(&c.OIDC); err != nil {
-			errs = AppendError(errs, err)
-		}
-	}
 	return nil, errs
 }
 
@@ -168,9 +141,6 @@ func validateTransportConfig(c *v1.ClientTransportConfig) (Warning, error) {
 	if !slices.Contains(SupportedTransportProtocols, c.Protocol) {
 		errs = AppendError(errs, fmt.Errorf("invalid transport.protocol, optional values are %v", SupportedTransportProtocols))
 	}
-	if !slices.Contains(SupportedWireProtocols, c.WireProtocol) {
-		errs = AppendError(errs, fmt.Errorf("invalid transport.wireProtocol, optional values are %v", SupportedWireProtocols))
-	}
 	return warnings, errs
 }
 

pkg/config/v1/validation/client_test.go

@@ -1,140 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package validation
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/policy/featuregate"
-	"github.com/fatedier/frp/pkg/policy/security"
-)
-
-func validateClientFeatureGates(t *testing.T, gates map[string]bool, virtualNetAddress string) error {
-	t.Helper()
-
-	cfg := &v1.ClientCommonConfig{
-		FeatureGates: gates,
-		VirtualNet: v1.VirtualNetConfig{
-			Address: virtualNetAddress,
-		},
-	}
-	require.NoError(t, cfg.Complete())
-
-	_, err := NewConfigValidator(security.NewUnsafeFeatures(nil)).ValidateClientCommonConfig(cfg)
-	return err
-}
-
-func TestValidateClientFeatureGates(t *testing.T) {
-	tests := []struct {
-		name              string
-		featureGates      map[string]bool
-		virtualNetAddress string
-		wantErr           string
-	}{
-		{
-			name:              "VirtualNet enabled",
-			featureGates:      map[string]bool{"VirtualNet": true},
-			virtualNetAddress: "100.86.0.4/24",
-		},
-		{
-			name:              "VirtualNet explicitly disabled",
-			featureGates:      map[string]bool{"VirtualNet": false},
-			virtualNetAddress: "100.86.0.4/24",
-			wantErr:           "VirtualNet feature is not enabled",
-		},
-		{
-			name:              "VirtualNet disabled by default",
-			virtualNetAddress: "100.86.0.4/24",
-			wantErr:           "VirtualNet feature is not enabled",
-		},
-		{
-			name:         "unknown feature gate",
-			featureGates: map[string]bool{"UnknownFeature": true},
-			wantErr:      "unrecognized feature gate: UnknownFeature",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			err := validateClientFeatureGates(t, tc.featureGates, tc.virtualNetAddress)
-			if tc.wantErr == "" {
-				require.NoError(t, err)
-				return
-			}
-			require.ErrorContains(t, err, tc.wantErr)
-		})
-	}
-}
-
-func TestGetClientConfigRequirements(t *testing.T) {
-	virtualNetProxy := &v1.STCPProxyConfig{
-		ProxyBaseConfig: v1.ProxyBaseConfig{
-			ProxyBackend: v1.ProxyBackend{
-				Plugin: v1.TypedClientPluginOptions{Type: v1.PluginVirtualNet},
-			},
-		},
-	}
-	virtualNetVisitor := &v1.STCPVisitorConfig{
-		VisitorBaseConfig: v1.VisitorBaseConfig{
-			Plugin: v1.TypedVisitorPluginOptions{Type: v1.VisitorPluginVirtualNet},
-		},
-	}
-
-	tests := []struct {
-		name     string
-		common   *v1.ClientCommonConfig
-		proxies  []v1.ProxyConfigurer
-		visitors []v1.VisitorConfigurer
-		wantVNet bool
-	}{
-		{name: "no requirements"},
-		{
-			name:     "common VirtualNet address",
-			common:   &v1.ClientCommonConfig{VirtualNet: v1.VirtualNetConfig{Address: "100.86.0.4/24"}},
-			wantVNet: true,
-		},
-		{name: "VirtualNet proxy", proxies: []v1.ProxyConfigurer{virtualNetProxy}, wantVNet: true},
-		{name: "VirtualNet visitor", visitors: []v1.VisitorConfigurer{virtualNetVisitor}, wantVNet: true},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got := GetClientConfigRequirements(tc.common, tc.proxies, tc.visitors)
-			require.Equal(t, tc.wantVNet, got.VirtualNet)
-		})
-	}
-}
-
-func TestValidateClientFeatureGatesAreConfigScoped(t *testing.T) {
-	defaultGatesBefore := featuregate.DefaultFeatureGates.String()
-
-	require.NoError(t, validateClientFeatureGates(
-		t,
-		map[string]bool{"VirtualNet": true},
-		"100.86.0.4/24",
-	))
-	require.Equal(t, defaultGatesBefore, featuregate.DefaultFeatureGates.String())
-
-	err := validateClientFeatureGates(
-		t,
-		map[string]bool{"VirtualNet": false},
-		"100.86.0.4/24",
-	)
-	require.ErrorContains(t, err, "VirtualNet feature is not enabled")
-	require.Equal(t, defaultGatesBefore, featuregate.DefaultFeatureGates.String())
-}

pkg/config/v1/validation/oidc.go

@@ -1,57 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package validation
-
-import (
-	"errors"
-	"net/url"
-	"strings"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-)
-
-func ValidateOIDCClientCredentialsConfig(c *v1.AuthOIDCClientConfig) error {
-	var errs []string
-
-	if c.ClientID == "" {
-		errs = append(errs, "auth.oidc.clientID is required")
-	}
-
-	if c.TokenEndpointURL == "" {
-		errs = append(errs, "auth.oidc.tokenEndpointURL is required")
-	} else {
-		tokenURL, err := url.Parse(c.TokenEndpointURL)
-		if err != nil || !tokenURL.IsAbs() || tokenURL.Host == "" {
-			errs = append(errs, "auth.oidc.tokenEndpointURL must be an absolute http or https URL")
-		} else if tokenURL.Scheme != "http" && tokenURL.Scheme != "https" {
-			errs = append(errs, "auth.oidc.tokenEndpointURL must use http or https")
-		}
-	}
-
-	if _, ok := c.AdditionalEndpointParams["scope"]; ok {
-		errs = append(errs, "auth.oidc.additionalEndpointParams.scope is not allowed; use auth.oidc.scope instead")
-	}
-
-	if c.Audience != "" {
-		if _, ok := c.AdditionalEndpointParams["audience"]; ok {
-			errs = append(errs, "cannot specify both auth.oidc.audience and auth.oidc.additionalEndpointParams.audience")
-		}
-	}
-
-	if len(errs) == 0 {
-		return nil
-	}
-	return errors.New(strings.Join(errs, "; "))
-}

pkg/config/v1/validation/oidc_test.go

@@ -1,78 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package validation
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-)
-
-func TestValidateOIDCClientCredentialsConfig(t *testing.T) {
-	tokenServer := httptest.NewServer(http.NotFoundHandler())
-	defer tokenServer.Close()
-
-	t.Run("valid", func(t *testing.T) {
-		require.NoError(t, ValidateOIDCClientCredentialsConfig(&v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			TokenEndpointURL: tokenServer.URL,
-			AdditionalEndpointParams: map[string]string{
-				"resource": "api",
-			},
-		}))
-	})
-
-	t.Run("invalid token endpoint url", func(t *testing.T) {
-		err := ValidateOIDCClientCredentialsConfig(&v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			TokenEndpointURL: "://bad",
-		})
-		require.ErrorContains(t, err, "auth.oidc.tokenEndpointURL")
-	})
-
-	t.Run("missing client id", func(t *testing.T) {
-		err := ValidateOIDCClientCredentialsConfig(&v1.AuthOIDCClientConfig{
-			TokenEndpointURL: tokenServer.URL,
-		})
-		require.ErrorContains(t, err, "auth.oidc.clientID is required")
-	})
-
-	t.Run("scope endpoint param is not allowed", func(t *testing.T) {
-		err := ValidateOIDCClientCredentialsConfig(&v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			TokenEndpointURL: tokenServer.URL,
-			AdditionalEndpointParams: map[string]string{
-				"scope": "email",
-			},
-		})
-		require.ErrorContains(t, err, "auth.oidc.additionalEndpointParams.scope is not allowed; use auth.oidc.scope instead")
-	})
-
-	t.Run("audience conflict", func(t *testing.T) {
-		err := ValidateOIDCClientCredentialsConfig(&v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			TokenEndpointURL: tokenServer.URL,
-			Audience:         "api",
-			AdditionalEndpointParams: map[string]string{
-				"audience": "override",
-			},
-		})
-		require.ErrorContains(t, err, "cannot specify both auth.oidc.audience and auth.oidc.additionalEndpointParams.audience")
-	})
-}

pkg/config/v1/validation/plugin.go

@@ -16,8 +16,6 @@ package validation
 
 import (
 	"errors"
-	"fmt"
-	"strings"
 
 	v1 "github.com/fatedier/frp/pkg/config/v1"
 )
@@ -26,8 +24,6 @@ func ValidateClientPluginOptions(c v1.ClientPluginOptions) error {
 	switch v := c.(type) {
 	case *v1.HTTP2HTTPSPluginOptions:
 		return validateHTTP2HTTPSPluginOptions(v)
-	case *v1.HTTP2HTTPSRedirectPluginOptions:
-		return validateHTTP2HTTPSRedirectPluginOptions(v)
 	case *v1.HTTPS2HTTPPluginOptions:
 		return validateHTTPS2HTTPPluginOptions(v)
 	case *v1.HTTPS2HTTPSPluginOptions:
@@ -49,17 +45,10 @@ func validateHTTP2HTTPSPluginOptions(c *v1.HTTP2HTTPSPluginOptions) error {
 	return nil
 }
 
-func validateHTTP2HTTPSRedirectPluginOptions(c *v1.HTTP2HTTPSRedirectPluginOptions) error {
-	return ValidatePort(c.HTTPSPort, "httpsPort")
-}
-
 func validateHTTPS2HTTPPluginOptions(c *v1.HTTPS2HTTPPluginOptions) error {
 	if c.LocalAddr == "" {
 		return errors.New("localAddr is required")
 	}
-	if err := validateAutoTLSOptions(c.AutoTLS, c.CrtPath, c.KeyPath); err != nil {
-		return fmt.Errorf("invalid autoTLS options: %w", err)
-	}
 	return nil
 }
 
@@ -67,9 +56,6 @@ func validateHTTPS2HTTPSPluginOptions(c *v1.HTTPS2HTTPSPluginOptions) error {
 	if c.LocalAddr == "" {
 		return errors.New("localAddr is required")
 	}
-	if err := validateAutoTLSOptions(c.AutoTLS, c.CrtPath, c.KeyPath); err != nil {
-		return fmt.Errorf("invalid autoTLS options: %w", err)
-	}
 	return nil
 }
 
@@ -91,29 +77,5 @@ func validateTLS2RawPluginOptions(c *v1.TLS2RawPluginOptions) error {
 	if c.LocalAddr == "" {
 		return errors.New("localAddr is required")
 	}
-	if err := validateAutoTLSOptions(c.AutoTLS, c.CrtPath, c.KeyPath); err != nil {
-		return fmt.Errorf("invalid autoTLS options: %w", err)
-	}
-	return nil
-}
-
-func validateAutoTLSOptions(c *v1.AutoTLSOptions, crtPath, keyPath string) error {
-	if c == nil || !c.Enable {
-		return nil
-	}
-
-	if crtPath != "" || keyPath != "" {
-		return errors.New("crtPath and keyPath must be empty when autoTLS.enable is true")
-	}
-	if strings.TrimSpace(c.CacheDir) == "" {
-		return errors.New("autoTLS.cacheDir is required when autoTLS.enable is true")
-	}
-	if len(c.HostAllowList) > 0 {
-		for _, host := range c.HostAllowList {
-			if strings.TrimSpace(host) == "" {
-				return errors.New("autoTLS.hostAllowList cannot contain empty domain")
-			}
-		}
-	}
 	return nil
 }

pkg/config/v1/validation/proxy.go

@@ -79,11 +79,9 @@ func validateDomainConfigForClient(c *v1.DomainConfig) error {
 }
 
 func validateDomainConfigForServer(c *v1.DomainConfig, s *v1.ServerConfig) error {
-	subDomainHost := strings.ToLower(s.SubDomainHost)
 	for _, domain := range c.CustomDomains {
-		canonicalDomain := strings.ToLower(domain)
+		if s.SubDomainHost != "" && len(strings.Split(s.SubDomainHost, ".")) < len(strings.Split(domain, ".")) {
-		if subDomainHost != "" && len(strings.Split(subDomainHost, ".")) < len(strings.Split(canonicalDomain, ".")) {
+			if strings.HasSuffix(domain, "."+s.SubDomainHost) {
-			if strings.HasSuffix(canonicalDomain, "."+subDomainHost) {
 				return fmt.Errorf("custom domain [%s] should not belong to subdomain host [%s]", domain, s.SubDomainHost)
 			}
 		}

pkg/config/v1/validation/proxy_test.go

@@ -1,76 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package validation
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-)
-
-func TestValidateDomainConfigForServerRejectsSubdomainHostCaseInsensitively(t *testing.T) {
-	tests := []struct {
-		name          string
-		subDomainHost string
-		customDomain  string
-		wantErr       bool
-	}{
-		{
-			name:          "lowercase subdomain",
-			subDomainHost: "frp.example.com",
-			customDomain:  "victim.frp.example.com",
-			wantErr:       true,
-		},
-		{
-			name:          "mixed case custom domain",
-			subDomainHost: "frp.example.com",
-			customDomain:  "victim.FRP.example.com",
-			wantErr:       true,
-		},
-		{
-			name:          "mixed case wildcard domain",
-			subDomainHost: "frp.example.com",
-			customDomain:  "*.FRP.example.com",
-			wantErr:       true,
-		},
-		{
-			name:          "mixed case subdomain host",
-			subDomainHost: "FRP.Example.Com",
-			customDomain:  "victim.frp.example.com",
-			wantErr:       true,
-		},
-		{
-			name:          "external domain",
-			subDomainHost: "frp.example.com",
-			customDomain:  "victim.example.net",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := validateDomainConfigForServer(
-				&v1.DomainConfig{CustomDomains: []string{tt.customDomain}},
-				&v1.ServerConfig{SubDomainHost: tt.subDomainHost},
-			)
-			if tt.wantErr {
-				require.ErrorContains(t, err, "should not belong to subdomain host")
-				return
-			}
-			require.NoError(t, err)
-		})
-	}
-}

pkg/config/v1/validation/server.go

@@ -21,6 +21,7 @@ import (
 	"github.com/samber/lo"
 
 	v1 "github.com/fatedier/frp/pkg/config/v1"
+	"github.com/fatedier/frp/pkg/policy/security"
 )
 
 func (v *ConfigValidator) ValidateServerConfig(c *v1.ServerConfig) (Warning, error) {
@@ -35,7 +36,22 @@ func (v *ConfigValidator) ValidateServerConfig(c *v1.ServerConfig) (Warning, err
 		errs = AppendError(errs, fmt.Errorf("invalid auth additional scopes, optional values are %v", SupportedAuthAdditionalScopes))
 	}
 
-	errs = AppendError(errs, v.validateAuthTokenSource(c.Auth.Token, c.Auth.TokenSource))
+	// Validate token/tokenSource mutual exclusivity
+	if c.Auth.Token != "" && c.Auth.TokenSource != nil {
+		errs = AppendError(errs, fmt.Errorf("cannot specify both auth.token and auth.tokenSource"))
+	}
+
+	// Validate tokenSource if specified
+	if c.Auth.TokenSource != nil {
+		if c.Auth.TokenSource.Type == "exec" {
+			if err := v.ValidateUnsafeFeature(security.TokenSourceExec); err != nil {
+				errs = AppendError(errs, err)
+			}
+		}
+		if err := c.Auth.TokenSource.Validate(); err != nil {
+			errs = AppendError(errs, fmt.Errorf("invalid auth.tokenSource: %v", err))
+		}
+	}
 
 	if err := validateLogConfig(&c.Log); err != nil {
 		errs = AppendError(errs, err)
@@ -51,9 +67,6 @@ func (v *ConfigValidator) ValidateServerConfig(c *v1.ServerConfig) (Warning, err
 	errs = AppendError(errs, ValidatePort(c.VhostHTTPPort, "vhostHTTPPort"))
 	errs = AppendError(errs, ValidatePort(c.VhostHTTPSPort, "vhostHTTPSPort"))
 	errs = AppendError(errs, ValidatePort(c.TCPMuxHTTPConnectPort, "tcpMuxHTTPConnectPort"))
-	if c.Transport.MaxPoolCount < 0 {
-		errs = AppendError(errs, fmt.Errorf("invalid transport.maxPoolCount, must be non-negative"))
-	}
 
 	for _, p := range c.HTTPPlugins {
 		if !lo.Every(SupportedHTTPPluginOps, p.Ops) {

pkg/config/v1/validation/server_test.go

@@ -1,51 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package validation
-
-import (
-	"math"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-)
-
-func TestValidateServerConfigMaxPoolCount(t *testing.T) {
-	for _, tc := range []struct {
-		name         string
-		maxPoolCount int64
-		wantErr      bool
-	}{
-		{name: "negative", maxPoolCount: -1, wantErr: true},
-		{name: "zero", maxPoolCount: 0},
-		{name: "positive", maxPoolCount: 5},
-		{name: "maximum int64", maxPoolCount: math.MaxInt64},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			cfg := validServerConfigWithAuth(v1.AuthServerConfig{Method: v1.AuthMethodToken})
-			cfg.Transport.MaxPoolCount = tc.maxPoolCount
-			require.NoError(t, cfg.Complete())
-
-			_, err := NewConfigValidator(nil).ValidateServerConfig(cfg)
-			if tc.wantErr {
-				require.ErrorContains(t, err, "invalid transport.maxPoolCount")
-				require.ErrorContains(t, err, "must be non-negative")
-				return
-			}
-			require.NoError(t, err)
-		})
-	}
-}

pkg/config/v1/validation/validation.go

@@ -29,10 +29,6 @@ var (
 		"websocket",
 		"wss",
 	}
-	SupportedWireProtocols = []string{
-		"v1",
-		"v2",
-	}
 
 	SupportedAuthMethods = []v1.AuthMethod{
 		"token",