Merge pull request #4999 from fatedier/dev

bump version
Merge pull request #4925 from fatedier/dev
2026-08-02 04:32:55 +08:00 · 2025-09-25 20:23:42 +08:00 · 2025-08-10 23:26:32 +08:00 · 2025-06-25 11:51:19 +08:00
139 changed files with 3341 additions and 7015 deletions
@@ -39,7 +39,6 @@ linters:
      - G404
      - G501
      - G115
-      - G204
      severity: low
      confidence: low
    govet:
@@ -13,6 +13,13 @@ frp is an open source project with its ongoing development made possible entirel

 <h3 align="center">Gold Sponsors</h3>
 <!--gold sponsors start-->
+<p align="center">
+  <a href="https://www.recall.ai/?utm_source=github&utm_medium=sponsorship&utm_campaign=fatedier-frp" target="_blank">
+    <b>Recall.ai - API for meeting recordings</b><br>
+    <br>
+    <sup>If you're looking for a meeting recording API, consider checking out Recall.ai, an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and more.</sup>
+  </a>
+</p>
 <p align="center">
  <a href="https://go.warp.dev/frp" target="_blank">
    <img width="360px" src="https://raw.githubusercontent.com/warpdotdev/brand-assets/refs/heads/main/Github/Sponsor/Warp-Github-LG-01.png">
@@ -22,7 +29,6 @@ frp is an open source project with its ongoing development made possible entirel
 	<sub>Available for macOS, Linux and Windows</sub>
  </a>
 </p>
-
 <p align="center">
  <a href="https://jb.gg/frp" target="_blank">
    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_jetbrains.jpg">
@@ -30,7 +36,13 @@ frp is an open source project with its ongoing development made possible entirel
 	<b>The complete IDE crafted for professional Go developers</b>
  </a>
 </p>
-
+<p align="center">
+  <a href="https://github.com/daytonaio/daytona" target="_blank">
+    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_daytona.png">
+	<br>
+	<b>Secure and Elastic Infrastructure for Running Your AI-Generated Code</b>
+  </a>
+</p>
 <p align="center">
  <a href="https://github.com/beclab/Olares" target="_blank">
    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_olares.jpeg">
@@ -40,25 +52,6 @@ frp is an open source project with its ongoing development made possible entirel
 	<sub>An open source, self-hosted alternative to public clouds, built for data ownership and privacy</sub>
  </a>
 </p>
-
-<div align="center">
-
-## Recall.ai - API for meeting recordings
-
-If you're looking for a meeting recording API, consider checking out [Recall.ai](https://www.recall.ai/?utm_source=github&utm_medium=sponsorship&utm_campaign=fatedier-frp),
-
-an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and more.
-
-</div>
-<p align="center">
-  <a href="https://requestly.com/?utm_source=github&utm_medium=partnered&utm_campaign=frp" target="_blank">
-    <img width="480px" src="https://github.com/user-attachments/assets/24670320-997d-4d62-9bca-955c59fe883d">
-    <br>
-    <b>Requestly - Free & Open-Source alternative to Postman</b>
-    <br>
-    <sub>All-in-one platform to Test, Mock and Intercept APIs.</sub>
-  </a>
-</p>
 <!--gold sponsors end-->

 ## What is frp?
@@ -15,6 +15,13 @@ frp 是一个完全开源的项目，我们的开发工作完全依靠赞助者

 <h3 align="center">Gold Sponsors</h3>
 <!--gold sponsors start-->
+<p align="center">
+  <a href="https://www.recall.ai/?utm_source=github&utm_medium=sponsorship&utm_campaign=fatedier-frp" target="_blank">
+    <b>Recall.ai - API for meeting recordings</b><br>
+    <br>
+    <sup>If you're looking for a meeting recording API, consider checking out Recall.ai, an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and more.</sup>
+  </a>
+</p>
 <p align="center">
  <a href="https://go.warp.dev/frp" target="_blank">
    <img width="360px" src="https://raw.githubusercontent.com/warpdotdev/brand-assets/refs/heads/main/Github/Sponsor/Warp-Github-LG-01.png">
@@ -24,7 +31,6 @@ frp 是一个完全开源的项目，我们的开发工作完全依靠赞助者
 	<sub>Available for macOS, Linux and Windows</sub>
  </a>
 </p>
-
 <p align="center">
  <a href="https://jb.gg/frp" target="_blank">
    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_jetbrains.jpg">
@@ -32,7 +38,13 @@ frp 是一个完全开源的项目，我们的开发工作完全依靠赞助者
 	<b>The complete IDE crafted for professional Go developers</b>
  </a>
 </p>
-
+<p align="center">
+  <a href="https://github.com/daytonaio/daytona" target="_blank">
+    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_daytona.png">
+	<br>
+	<b>Secure and Elastic Infrastructure for Running Your AI-Generated Code</b>
+  </a>
+</p>
 <p align="center">
  <a href="https://github.com/beclab/Olares" target="_blank">
    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_olares.jpeg">
@@ -42,24 +54,6 @@ frp 是一个完全开源的项目，我们的开发工作完全依靠赞助者
 	<sub>An open source, self-hosted alternative to public clouds, built for data ownership and privacy</sub>
  </a>
 </p>
-<div align="center">
-
-## Recall.ai - API for meeting recordings
-
-If you're looking for a meeting recording API, consider checking out [Recall.ai](https://www.recall.ai/?utm_source=github&utm_medium=sponsorship&utm_campaign=fatedier-frp),
-
-an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and more.
-
-</div>
-<p align="center">
-  <a href="https://requestly.com/?utm_source=github&utm_medium=partnered&utm_campaign=frp" target="_blank">
-    <img width="480px" src="https://github.com/user-attachments/assets/24670320-997d-4d62-9bca-955c59fe883d">
-    <br>
-    <b>Requestly - Free & Open-Source alternative to Postman</b>
-    <br>
-    <sub>All-in-one platform to Test, Mock and Intercept APIs.</sub>
-  </a>
-</p>
 <!--gold sponsors end-->

 ## 为什么使用 frp ？
@@ -132,3 +126,9 @@ frp 是一个免费且开源的项目，我们欢迎任何人为其开发和进
 国内用户可以通过 [爱发电](https://afdian.com/a/fatedier) 赞助我们。

 企业赞助者可以将贵公司的 Logo 以及链接放置在项目 README 文件中。
+
+### 知识星球
+
+如果您想了解更多 frp 相关技术以及更新详解，或者寻求任何 frp 使用方面的帮助，都可以通过微信扫描下方的二维码付费加入知识星球的官方社群：
+
+![zsxq](/doc/pic/zsxq.jpg)
@@ -1,8 +1,5 @@
 ## Features

-* frpc now supports a `clientID` option to uniquely identify client instances. The server dashboard displays all connected clients with their online/offline status, connection history, and metadata, making it easier to monitor and manage multiple frpc deployments.
-* Redesigned the frps web dashboard with a modern UI, dark mode support, and improved navigation.
-
-## Fixes
-
-* Fixed UDP proxy protocol sending header on every packet instead of only the first packet of each session.
+* Add NAT traversal configuration options for XTCP proxies and visitors. Support disabling assisted addresses to avoid using slow VPN connections during NAT hole punching.
+* Enhanced OIDC client configuration with support for custom TLS certificate verification and proxy settings. Added `trustedCaFile`, `insecureSkipVerify`, and `proxyURL` options for OIDC token endpoint connections.
+* Added detailed Prometheus metrics with `proxy_counts_detailed` metric that includes both proxy type and proxy name labels, enabling monitoring of individual proxy connections instead of just aggregate counts.
@@ -3,9 +3,9 @@

 <head>
    <meta charset="utf-8">
-    <title>frp client</title>
-  <script type="module" crossorigin src="./index-BAsh6RH1.js"></script>
-  <link rel="stylesheet" crossorigin href="./index-JCcyRUo1.css">
+    <title>frp client admin UI</title>
+  <script type="module" crossorigin src="./index-bLBhaJo8.js"></script>
+  <link rel="stylesheet" crossorigin href="./index-iuf46MlF.css">
 </head>

 <body>
@@ -3,9 +3,9 @@

 <head>
    <meta charset="utf-8">
-    <title>frp server</title>
-  <script type="module" crossorigin src="./index-r9B2t7lx.js"></script>
-  <link rel="stylesheet" crossorigin href="./index-Cl4R6mJh.css">
+    <title>frps dashboard</title>
+  <script type="module" crossorigin src="./index-82-40HIG.js"></script>
+  <link rel="stylesheet" crossorigin href="./index-rzPDshRD.css">
 </head>

 <body>
@@ -92,7 +92,7 @@ func (svr *Service) apiReload(w http.ResponseWriter, r *http.Request) {
 		log.Warnf("reload frpc proxy config error: %s", res.Msg)
 		return
 	}
-	if _, err := validation.ValidateAllClientConfig(cliCfg, proxyCfgs, visitorCfgs, svr.unsafeFeatures); err != nil {
+	if _, err := validation.ValidateAllClientConfig(cliCfg, proxyCfgs, visitorCfgs); err != nil {
 		res.Code = 400
 		res.Msg = err.Error()
 		log.Warnf("reload frpc proxy config error: %s", res.Msg)
@@ -168,7 +168,6 @@ func (svr *Service) apiStatus(w http.ResponseWriter, _ *http.Request) {
 	log.Infof("http request [/api/status]")
 	defer func() {
 		log.Infof("http response [/api/status]")
-		w.Header().Set("Content-Type", "application/json")
 		buf, _ = json.Marshal(&res)
 		_, _ = w.Write(buf)
 	}()
@@ -43,8 +43,8 @@ type SessionContext struct {
 	Conn net.Conn
 	// Indicates whether the connection is encrypted.
 	ConnEncrypted bool
-	// Auth runtime used for login, heartbeats, and encryption.
-	Auth *auth.ClientAuth
+	// Sets authentication based on selected method
+	AuthSetter auth.Setter
 	// Connector is used to create new connections, which could be real TCP connections or virtual streams.
 	Connector Connector
 	// Virtual net controller
@@ -91,7 +91,7 @@ func NewControl(ctx context.Context, sessionCtx *SessionContext) (*Control, erro
 	ctl.lastPong.Store(time.Now())

 	if sessionCtx.ConnEncrypted {
-		cryptoRW, err := netpkg.NewCryptoReadWriter(sessionCtx.Conn, sessionCtx.Auth.EncryptionKey())
+		cryptoRW, err := netpkg.NewCryptoReadWriter(sessionCtx.Conn, []byte(sessionCtx.Common.Auth.Token))
 		if err != nil {
 			return nil, err
 		}
@@ -100,9 +100,9 @@ func NewControl(ctx context.Context, sessionCtx *SessionContext) (*Control, erro
 		ctl.msgDispatcher = msg.NewDispatcher(sessionCtx.Conn)
 	}
 	ctl.registerMsgHandlers()
-	ctl.msgTransporter = transport.NewMessageTransporter(ctl.msgDispatcher)
+	ctl.msgTransporter = transport.NewMessageTransporter(ctl.msgDispatcher.SendChannel())

-	ctl.pm = proxy.NewManager(ctl.ctx, sessionCtx.Common, sessionCtx.Auth.EncryptionKey(), ctl.msgTransporter, sessionCtx.VnetController)
+	ctl.pm = proxy.NewManager(ctl.ctx, sessionCtx.Common, ctl.msgTransporter, sessionCtx.VnetController)
 	ctl.vm = visitor.NewManager(ctl.ctx, sessionCtx.RunID, sessionCtx.Common,
 		ctl.connectServer, ctl.msgTransporter, sessionCtx.VnetController)
 	return ctl, nil
@@ -133,7 +133,7 @@ func (ctl *Control) handleReqWorkConn(_ msg.Message) {
 	m := &msg.NewWorkConn{
 		RunID: ctl.sessionCtx.RunID,
 	}
-	if err = ctl.sessionCtx.Auth.Setter.SetNewWorkConn(m); err != nil {
+	if err = ctl.sessionCtx.AuthSetter.SetNewWorkConn(m); err != nil {
 		xl.Warnf("error during NewWorkConn authentication: %v", err)
 		workConn.Close()
 		return
@@ -243,7 +243,7 @@ func (ctl *Control) heartbeatWorker() {
 		sendHeartBeat := func() (bool, error) {
 			xl.Debugf("send heartbeat to server")
 			pingMsg := &msg.Ping{}
-			if err := ctl.sessionCtx.Auth.Setter.SetPing(pingMsg); err != nil {
+			if err := ctl.sessionCtx.AuthSetter.SetPing(pingMsg); err != nil {
 				xl.Warnf("error during ping authentication: %v, skip sending ping message", err)
 				return false, err
 			}
@@ -57,7 +57,6 @@ func NewProxy(
 	ctx context.Context,
 	pxyConf v1.ProxyConfigurer,
 	clientCfg *v1.ClientCommonConfig,
-	encryptionKey []byte,
 	msgTransporter transport.MessageTransporter,
 	vnetController *vnet.Controller,
 ) (pxy Proxy) {
@@ -70,7 +69,6 @@ func NewProxy(
 	baseProxy := BaseProxy{
 		baseCfg:        pxyConf.GetBaseConfig(),
 		clientCfg:      clientCfg,
-		encryptionKey:  encryptionKey,
 		limiter:        limiter,
 		msgTransporter: msgTransporter,
 		vnetController: vnetController,
@@ -88,7 +86,6 @@ func NewProxy(
 type BaseProxy struct {
 	baseCfg        *v1.ProxyBaseConfig
 	clientCfg      *v1.ClientCommonConfig
-	encryptionKey  []byte
 	msgTransporter transport.MessageTransporter
 	vnetController *vnet.Controller
 	limiter        *rate.Limiter
@@ -132,7 +129,7 @@ func (pxy *BaseProxy) InWorkConn(conn net.Conn, m *msg.StartWorkConn) {
 			return
 		}
 	}
-	pxy.HandleTCPWorkConnection(conn, m, pxy.encryptionKey)
+	pxy.HandleTCPWorkConnection(conn, m, []byte(pxy.clientCfg.Auth.Token))
 }

 // Common handler for tcp work connections.
@@ -40,8 +40,7 @@ type Manager struct {
 	closed bool
 	mu     sync.RWMutex

-	encryptionKey []byte
-	clientCfg     *v1.ClientCommonConfig
+	clientCfg *v1.ClientCommonConfig

 	ctx context.Context
 }
@@ -49,7 +48,6 @@ type Manager struct {
 func NewManager(
 	ctx context.Context,
 	clientCfg *v1.ClientCommonConfig,
-	encryptionKey []byte,
 	msgTransporter transport.MessageTransporter,
 	vnetController *vnet.Controller,
 ) *Manager {
@@ -58,7 +56,6 @@ func NewManager(
 		msgTransporter: msgTransporter,
 		vnetController: vnetController,
 		closed:         false,
-		encryptionKey:  encryptionKey,
 		clientCfg:      clientCfg,
 		ctx:            ctx,
 	}
@@ -166,7 +163,7 @@ func (pm *Manager) UpdateAll(proxyCfgs []v1.ProxyConfigurer) {
 	for _, cfg := range proxyCfgs {
 		name := cfg.GetBaseConfig().Name
 		if _, ok := pm.proxies[name]; !ok {
-			pxy := NewWrapper(pm.ctx, cfg, pm.clientCfg, pm.encryptionKey, pm.HandleEvent, pm.msgTransporter, pm.vnetController)
+			pxy := NewWrapper(pm.ctx, cfg, pm.clientCfg, pm.HandleEvent, pm.msgTransporter, pm.vnetController)
 			if pm.inWorkConnCallback != nil {
 				pxy.SetInWorkConnCallback(pm.inWorkConnCallback)
 			}
@@ -92,7 +92,6 @@ func NewWrapper(
 	ctx context.Context,
 	cfg v1.ProxyConfigurer,
 	clientCfg *v1.ClientCommonConfig,
-	encryptionKey []byte,
 	eventHandler event.Handler,
 	msgTransporter transport.MessageTransporter,
 	vnetController *vnet.Controller,
@@ -123,7 +122,7 @@ func NewWrapper(
 		xl.Tracef("enable health check monitor")
 	}

-	pw.pxy = NewProxy(pw.ctx, pw.Cfg, clientCfg, encryptionKey, pw.msgTransporter, pw.vnetController)
+	pw.pxy = NewProxy(pw.ctx, pw.Cfg, clientCfg, pw.msgTransporter, pw.vnetController)
 	return pw
 }

@@ -91,7 +91,7 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 		})
 	}
 	if pxy.cfg.Transport.UseEncryption {
-		rwc, err = libio.WithEncryption(rwc, pxy.encryptionKey)
+		rwc, err = libio.WithEncryption(rwc, []byte(pxy.clientCfg.Auth.Token))
 		if err != nil {
 			conn.Close()
 			xl.Errorf("create encryption stream error: %v", err)
@@ -102,7 +102,7 @@ func (pxy *UDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 		})
 	}
 	if pxy.cfg.Transport.UseEncryption {
-		rwc, err = libio.WithEncryption(rwc, pxy.encryptionKey)
+		rwc, err = libio.WithEncryption(rwc, []byte(pxy.clientCfg.Auth.Token))
 		if err != nil {
 			conn.Close()
 			xl.Errorf("create encryption stream error: %v", err)
@@ -31,7 +31,6 @@ import (
 	"github.com/fatedier/frp/pkg/auth"
 	v1 "github.com/fatedier/frp/pkg/config/v1"
 	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/policy/security"
 	httppkg "github.com/fatedier/frp/pkg/util/http"
 	"github.com/fatedier/frp/pkg/util/log"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
@@ -65,8 +64,6 @@ type ServiceOptions struct {
 	ProxyCfgs   []v1.ProxyConfigurer
 	VisitorCfgs []v1.VisitorConfigurer

-	UnsafeFeatures *security.UnsafeFeatures
-
 	// ConfigFilePath is the path to the configuration file used to initialize.
 	// If it is empty, it means that the configuration file is not used for initialization.
 	// It may be initialized using command line parameters or called directly.
@@ -111,8 +108,8 @@ type Service struct {
 	// Uniq id got from frps, it will be attached to loginMsg.
 	runID string

-	// Auth runtime and encryption materials
-	auth *auth.ClientAuth
+	// Sets authentication based on selected method
+	authSetter auth.Setter

 	// web server for admin UI and apis
 	webServer *httppkg.Server
@@ -125,8 +122,6 @@ type Service struct {
 	visitorCfgs []v1.VisitorConfigurer
 	clientSpec  *msg.ClientSpec

-	unsafeFeatures *security.UnsafeFeatures
-
 	// The configuration file used to initialize this client, or an empty
 	// string if no configuration file was used.
 	configFilePath string
@@ -155,18 +150,17 @@ func NewService(options ServiceOptions) (*Service, error) {
 		webServer = ws
 	}

-	authRuntime, err := auth.BuildClientAuth(&options.Common.Auth)
+	authSetter, err := auth.NewAuthSetter(options.Common.Auth)
 	if err != nil {
 		return nil, err
 	}

 	s := &Service{
 		ctx:              context.Background(),
-		auth:             authRuntime,
+		authSetter:       authSetter,
 		webServer:        webServer,
 		common:           options.Common,
 		configFilePath:   options.ConfigFilePath,
-		unsafeFeatures:   options.UnsafeFeatures,
 		proxyCfgs:        options.ProxyCfgs,
 		visitorCfgs:      options.VisitorCfgs,
 		clientSpec:       options.ClientSpec,
@@ -281,15 +275,11 @@ func (svr *Service) login() (conn net.Conn, connector Connector, err error) {
 		return
 	}

-	hostname, _ := os.Hostname()
-
 	loginMsg := &msg.Login{
 		Arch:      runtime.GOARCH,
 		Os:        runtime.GOOS,
-		Hostname:  hostname,
 		PoolCount: svr.common.Transport.PoolCount,
 		User:      svr.common.User,
-		ClientID:  svr.common.ClientID,
 		Version:   version.Full(),
 		Timestamp: time.Now().Unix(),
 		RunID:     svr.runID,
@@ -300,7 +290,7 @@ func (svr *Service) login() (conn net.Conn, connector Connector, err error) {
 	}

 	// Add auth
-	if err = svr.auth.Setter.SetLogin(loginMsg); err != nil {
+	if err = svr.authSetter.SetLogin(loginMsg); err != nil {
 		return
 	}

@@ -354,7 +344,7 @@ func (svr *Service) loopLoginUntilSuccess(maxInterval time.Duration, firstLoginE
 			RunID:          svr.runID,
 			Conn:           conn,
 			ConnEncrypted:  connEncrypted,
-			Auth:           svr.auth,
+			AuthSetter:     svr.authSetter,
 			Connector:      connector,
 			VnetController: svr.vnetController,
 		}
@@ -15,7 +15,6 @@
 package visitor

 import (
-	"fmt"
 	"io"
 	"net"
 	"strconv"
@@ -82,22 +81,11 @@ func (sv *STCPVisitor) internalConnWorker() {

 func (sv *STCPVisitor) handleConn(userConn net.Conn) {
 	xl := xlog.FromContextSafe(sv.ctx)
-	var tunnelErr error
-	defer func() {
-		// If there was an error and connection supports CloseWithError, use it
-		if tunnelErr != nil {
-			if eConn, ok := userConn.(interface{ CloseWithError(error) error }); ok {
-				_ = eConn.CloseWithError(tunnelErr)
-				return
-			}
-		}
-		userConn.Close()
-	}()
+	defer userConn.Close()

 	xl.Debugf("get a new stcp user connection")
 	visitorConn, err := sv.helper.ConnectServer()
 	if err != nil {
-		tunnelErr = err
 		return
 	}
 	defer visitorConn.Close()
@@ -114,7 +102,6 @@ func (sv *STCPVisitor) handleConn(userConn net.Conn) {
 	err = msg.WriteMsg(visitorConn, newVisitorConnMsg)
 	if err != nil {
 		xl.Warnf("send newVisitorConnMsg to server error: %v", err)
-		tunnelErr = err
 		return
 	}

@@ -123,14 +110,12 @@ func (sv *STCPVisitor) handleConn(userConn net.Conn) {
 	err = msg.ReadMsgInto(visitorConn, &newVisitorConnRespMsg)
 	if err != nil {
 		xl.Warnf("get newVisitorConnRespMsg error: %v", err)
-		tunnelErr = err
 		return
 	}
 	_ = visitorConn.SetReadDeadline(time.Time{})

 	if newVisitorConnRespMsg.Error != "" {
 		xl.Warnf("start new visitor connection error: %s", newVisitorConnRespMsg.Error)
-		tunnelErr = fmt.Errorf("%s", newVisitorConnRespMsg.Error)
 		return
 	}

@@ -140,7 +125,6 @@ func (sv *STCPVisitor) handleConn(userConn net.Conn) {
 		remote, err = libio.WithEncryption(remote, []byte(sv.cfg.SecretKey))
 		if err != nil {
 			xl.Errorf("create encryption stream error: %v", err)
-			tunnelErr = err
 			return
 		}
 	}
@@ -71,7 +71,7 @@ func NewVisitor(
 				Name:           cfg.GetBaseConfig().Name,
 				Ctx:            ctx,
 				VnetController: helper.VNetController(),
-				SendConnToVisitor: func(conn net.Conn) {
+				HandleConn: func(conn net.Conn) {
 					_ = baseVisitor.AcceptConn(conn)
 				},
 			},
@@ -162,16 +162,8 @@ func (sv *XTCPVisitor) keepTunnelOpenWorker() {
 func (sv *XTCPVisitor) handleConn(userConn net.Conn) {
 	xl := xlog.FromContextSafe(sv.ctx)
 	isConnTransferred := false
-	var tunnelErr error
 	defer func() {
 		if !isConnTransferred {
-			// If there was an error and connection supports CloseWithError, use it
-			if tunnelErr != nil {
-				if eConn, ok := userConn.(interface{ CloseWithError(error) error }); ok {
-					_ = eConn.CloseWithError(tunnelErr)
-					return
-				}
-			}
 			userConn.Close()
 		}
 	}()
@@ -189,8 +181,6 @@ func (sv *XTCPVisitor) handleConn(userConn net.Conn) {
 	tunnelConn, err := sv.openTunnel(ctx)
 	if err != nil {
 		xl.Errorf("open tunnel error: %v", err)
-		tunnelErr = err
-
 		// no fallback, just return
 		if sv.cfg.FallbackTo == "" {
 			return
@@ -210,7 +200,6 @@ func (sv *XTCPVisitor) handleConn(userConn net.Conn) {
 		muxConnRWCloser, err = libio.WithEncryption(muxConnRWCloser, []byte(sv.cfg.SecretKey))
 		if err != nil {
 			xl.Errorf("create encryption stream error: %v", err)
-			tunnelErr = err
 			return
 		}
 	}
@@ -24,7 +24,6 @@ import (
 	"github.com/fatedier/frp/pkg/config"
 	v1 "github.com/fatedier/frp/pkg/config/v1"
 	"github.com/fatedier/frp/pkg/config/v1/validation"
-	"github.com/fatedier/frp/pkg/policy/security"
 )

 var proxyTypes = []v1.ProxyType{
@@ -78,10 +77,7 @@ func NewProxyCommand(name string, c v1.ProxyConfigurer, clientCfg *v1.ClientComm
 				fmt.Println(err)
 				os.Exit(1)
 			}
-
-			unsafeFeatures := security.NewUnsafeFeatures(allowUnsafe)
-			validator := validation.NewConfigValidator(unsafeFeatures)
-			if _, err := validator.ValidateClientCommonConfig(clientCfg); err != nil {
+			if _, err := validation.ValidateClientCommonConfig(clientCfg); err != nil {
 				fmt.Println(err)
 				os.Exit(1)
 			}
@@ -92,7 +88,7 @@ func NewProxyCommand(name string, c v1.ProxyConfigurer, clientCfg *v1.ClientComm
 				fmt.Println(err)
 				os.Exit(1)
 			}
-			err := startService(clientCfg, []v1.ProxyConfigurer{c}, nil, unsafeFeatures, "")
+			err := startService(clientCfg, []v1.ProxyConfigurer{c}, nil, "")
 			if err != nil {
 				fmt.Println(err)
 				os.Exit(1)
@@ -110,9 +106,7 @@ func NewVisitorCommand(name string, c v1.VisitorConfigurer, clientCfg *v1.Client
 				fmt.Println(err)
 				os.Exit(1)
 			}
-			unsafeFeatures := security.NewUnsafeFeatures(allowUnsafe)
-			validator := validation.NewConfigValidator(unsafeFeatures)
-			if _, err := validator.ValidateClientCommonConfig(clientCfg); err != nil {
+			if _, err := validation.ValidateClientCommonConfig(clientCfg); err != nil {
 				fmt.Println(err)
 				os.Exit(1)
 			}
@@ -123,7 +117,7 @@ func NewVisitorCommand(name string, c v1.VisitorConfigurer, clientCfg *v1.Client
 				fmt.Println(err)
 				os.Exit(1)
 			}
-			err := startService(clientCfg, nil, []v1.VisitorConfigurer{c}, unsafeFeatures, "")
+			err := startService(clientCfg, nil, []v1.VisitorConfigurer{c}, "")
 			if err != nil {
 				fmt.Println(err)
 				os.Exit(1)
@@ -21,7 +21,6 @@ import (
 	"os"
 	"os/signal"
 	"path/filepath"
-	"strings"
 	"sync"
 	"syscall"
 	"time"
@@ -32,8 +31,7 @@ import (
 	"github.com/fatedier/frp/pkg/config"
 	v1 "github.com/fatedier/frp/pkg/config/v1"
 	"github.com/fatedier/frp/pkg/config/v1/validation"
-	"github.com/fatedier/frp/pkg/policy/featuregate"
-	"github.com/fatedier/frp/pkg/policy/security"
+	"github.com/fatedier/frp/pkg/featuregate"
 	"github.com/fatedier/frp/pkg/util/log"
 	"github.com/fatedier/frp/pkg/util/version"
 )
@@ -43,7 +41,6 @@ var (
 	cfgDir           string
 	showVersion      bool
 	strictConfigMode bool
-	allowUnsafe      []string
 )

 func init() {
@@ -51,9 +48,6 @@ func init() {
 	rootCmd.PersistentFlags().StringVarP(&cfgDir, "config_dir", "", "", "config directory, run one frpc service for each file in config directory")
 	rootCmd.PersistentFlags().BoolVarP(&showVersion, "version", "v", false, "version of frpc")
 	rootCmd.PersistentFlags().BoolVarP(&strictConfigMode, "strict_config", "", true, "strict config parsing mode, unknown fields will cause an errors")
-
-	rootCmd.PersistentFlags().StringSliceVarP(&allowUnsafe, "allow-unsafe", "", []string{},
-		fmt.Sprintf("allowed unsafe features, one or more of: %s", strings.Join(security.ClientUnsafeFeatures, ", ")))
 }

 var rootCmd = &cobra.Command{
@@ -65,17 +59,15 @@ var rootCmd = &cobra.Command{
 			return nil
 		}

-		unsafeFeatures := security.NewUnsafeFeatures(allowUnsafe)
-
 		// If cfgDir is not empty, run multiple frpc service for each config file in cfgDir.
 		// Note that it's only designed for testing. It's not guaranteed to be stable.
 		if cfgDir != "" {
-			_ = runMultipleClients(cfgDir, unsafeFeatures)
+			_ = runMultipleClients(cfgDir)
 			return nil
 		}

 		// Do not show command usage here.
-		err := runClient(cfgFile, unsafeFeatures)
+		err := runClient(cfgFile)
 		if err != nil {
 			fmt.Println(err)
 			os.Exit(1)
@@ -84,7 +76,7 @@ var rootCmd = &cobra.Command{
 	},
 }

-func runMultipleClients(cfgDir string, unsafeFeatures *security.UnsafeFeatures) error {
+func runMultipleClients(cfgDir string) error {
 	var wg sync.WaitGroup
 	err := filepath.WalkDir(cfgDir, func(path string, d fs.DirEntry, err error) error {
 		if err != nil || d.IsDir() {
@@ -94,7 +86,7 @@ func runMultipleClients(cfgDir string, unsafeFeatures *security.UnsafeFeatures)
 		time.Sleep(time.Millisecond)
 		go func() {
 			defer wg.Done()
-			err := runClient(path, unsafeFeatures)
+			err := runClient(path)
 			if err != nil {
 				fmt.Printf("frpc service error for config file [%s]\n", path)
 			}
@@ -119,7 +111,7 @@ func handleTermSignal(svr *client.Service) {
 	svr.GracefulClose(500 * time.Millisecond)
 }

-func runClient(cfgFilePath string, unsafeFeatures *security.UnsafeFeatures) error {
+func runClient(cfgFilePath string) error {
 	cfg, proxyCfgs, visitorCfgs, isLegacyFormat, err := config.LoadClientConfig(cfgFilePath, strictConfigMode)
 	if err != nil {
 		return err
@@ -135,22 +127,20 @@ func runClient(cfgFilePath string, unsafeFeatures *security.UnsafeFeatures) erro
 		}
 	}

-	warning, err := validation.ValidateAllClientConfig(cfg, proxyCfgs, visitorCfgs, unsafeFeatures)
+	warning, err := validation.ValidateAllClientConfig(cfg, proxyCfgs, visitorCfgs)
 	if warning != nil {
 		fmt.Printf("WARNING: %v\n", warning)
 	}
 	if err != nil {
 		return err
 	}
-
-	return startService(cfg, proxyCfgs, visitorCfgs, unsafeFeatures, cfgFilePath)
+	return startService(cfg, proxyCfgs, visitorCfgs, cfgFilePath)
 }

 func startService(
 	cfg *v1.ClientCommonConfig,
 	proxyCfgs []v1.ProxyConfigurer,
 	visitorCfgs []v1.VisitorConfigurer,
-	unsafeFeatures *security.UnsafeFeatures,
 	cfgFile string,
 ) error {
 	log.InitLogger(cfg.Log.To, cfg.Log.Level, int(cfg.Log.MaxDays), cfg.Log.DisablePrintColor)
@@ -163,7 +153,6 @@ func startService(
 		Common:         cfg,
 		ProxyCfgs:      proxyCfgs,
 		VisitorCfgs:    visitorCfgs,
-		UnsafeFeatures: unsafeFeatures,
 		ConfigFilePath: cfgFile,
 	})
 	if err != nil {
@@ -22,7 +22,6 @@ import (

 	"github.com/fatedier/frp/pkg/config"
 	"github.com/fatedier/frp/pkg/config/v1/validation"
-	"github.com/fatedier/frp/pkg/policy/security"
 )

 func init() {
@@ -43,8 +42,7 @@ var verifyCmd = &cobra.Command{
 			fmt.Println(err)
 			os.Exit(1)
 		}
-		unsafeFeatures := security.NewUnsafeFeatures(allowUnsafe)
-		warning, err := validation.ValidateAllClientConfig(cliCfg, proxyCfgs, visitorCfgs, unsafeFeatures)
+		warning, err := validation.ValidateAllClientConfig(cliCfg, proxyCfgs, visitorCfgs)
 		if warning != nil {
 			fmt.Printf("WARNING: %v\n", warning)
 		}
@@ -18,14 +18,12 @@ import (
 	"context"
 	"fmt"
 	"os"
-	"strings"

 	"github.com/spf13/cobra"

 	"github.com/fatedier/frp/pkg/config"
 	v1 "github.com/fatedier/frp/pkg/config/v1"
 	"github.com/fatedier/frp/pkg/config/v1/validation"
-	"github.com/fatedier/frp/pkg/policy/security"
 	"github.com/fatedier/frp/pkg/util/log"
 	"github.com/fatedier/frp/pkg/util/version"
 	"github.com/fatedier/frp/server"
@@ -35,7 +33,6 @@ var (
 	cfgFile          string
 	showVersion      bool
 	strictConfigMode bool
-	allowUnsafe      []string

 	serverCfg v1.ServerConfig
 )
@@ -44,8 +41,6 @@ func init() {
 	rootCmd.PersistentFlags().StringVarP(&cfgFile, "config", "c", "", "config file of frps")
 	rootCmd.PersistentFlags().BoolVarP(&showVersion, "version", "v", false, "version of frps")
 	rootCmd.PersistentFlags().BoolVarP(&strictConfigMode, "strict_config", "", true, "strict config parsing mode, unknown fields will cause errors")
-	rootCmd.PersistentFlags().StringSliceVarP(&allowUnsafe, "allow-unsafe", "", []string{},
-		fmt.Sprintf("allowed unsafe features, one or more of: %s", strings.Join(security.ServerUnsafeFeatures, ", ")))

 	config.RegisterServerConfigFlags(rootCmd, &serverCfg)
 }
@@ -82,9 +77,7 @@ var rootCmd = &cobra.Command{
 			svrCfg = &serverCfg
 		}

-		unsafeFeatures := security.NewUnsafeFeatures(allowUnsafe)
-		validator := validation.NewConfigValidator(unsafeFeatures)
-		warning, err := validator.ValidateServerConfig(svrCfg)
+		warning, err := validation.ValidateServerConfig(svrCfg)
 		if warning != nil {
 			fmt.Printf("WARNING: %v\n", warning)
 		}
@@ -22,7 +22,6 @@ import (

 	"github.com/fatedier/frp/pkg/config"
 	"github.com/fatedier/frp/pkg/config/v1/validation"
-	"github.com/fatedier/frp/pkg/policy/security"
 )

 func init() {
@@ -43,9 +42,7 @@ var verifyCmd = &cobra.Command{
 			os.Exit(1)
 		}

-		unsafeFeatures := security.NewUnsafeFeatures(allowUnsafe)
-		validator := validation.NewConfigValidator(unsafeFeatures)
-		warning, err := validator.ValidateServerConfig(svrCfg)
+		warning, err := validation.ValidateServerConfig(svrCfg)
 		if warning != nil {
 			fmt.Printf("WARNING: %v\n", warning)
 		}
@@ -1,7 +1,5 @@
 # This configuration file is for reference only. Please do not use this configuration directly to run the program as it may have various issues.

-# Optional unique identifier for this frpc instance.
-clientID = "your_client_id"
 # your proxy name will be changed to {user}.{proxy}
 user = "your_name"

@@ -145,11 +143,6 @@ transport.tls.enable = true
 # Default is empty, means all proxies.
 # start = ["ssh", "dns"]

-# Alternative to 'start': You can control each proxy individually using the 'enabled' field.
-# Set 'enabled = false' in a proxy configuration to disable it.
-# If 'enabled' is not set or set to true, the proxy is enabled by default.
-# The 'enabled' field provides more granular control and is recommended over 'start'.
-
 # Specify udp packet size, unit is byte. If not set, the default value is 1500.
 # This parameter should be same between client and server.
 # It affects the udp and sudp proxy.
@@ -176,8 +169,6 @@ metadatas.var2 = "123"
 # If global user is not empty, it will be changed to {user}.{proxy} such as 'your_name.ssh'
 name = "ssh"
 type = "tcp"
-# Enable or disable this proxy. true or omit this field to enable, false to disable.
-# enabled = true
 localIP = "127.0.0.1"
 localPort = 22
 # Limit bandwidth for this proxy, unit is KB and MB
@@ -262,8 +253,6 @@ healthCheck.httpHeaders=[
 [[proxies]]
 name = "web02"
 type = "https"
-# Disable this proxy by setting enabled to false
-# enabled = false
 localIP = "127.0.0.1"
 localPort = 8000
 subdomain = "web02"
@@ -16,7 +16,7 @@ require (
 	github.com/pion/stun/v2 v2.0.0
 	github.com/pires/go-proxyproto v0.7.0
 	github.com/prometheus/client_golang v1.19.1
-	github.com/quic-go/quic-go v0.55.0
+	github.com/quic-go/quic-go v0.53.0
 	github.com/rodaine/table v1.2.0
 	github.com/samber/lo v1.47.0
 	github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8
@@ -26,10 +26,10 @@ require (
 	github.com/tidwall/gjson v1.17.1
 	github.com/vishvananda/netlink v1.3.0
 	github.com/xtaci/kcp-go/v5 v5.6.13
-	golang.org/x/crypto v0.41.0
-	golang.org/x/net v0.43.0
+	golang.org/x/crypto v0.37.0
+	golang.org/x/net v0.39.0
 	golang.org/x/oauth2 v0.28.0
-	golang.org/x/sync v0.16.0
+	golang.org/x/sync v0.13.0
 	golang.org/x/time v0.5.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	gopkg.in/ini.v1 v1.67.0
@@ -67,10 +67,11 @@ require (
 	github.com/tjfoc/gmsm v1.4.1 // indirect
 	github.com/vishvananda/netns v0.0.4 // indirect
 	go.uber.org/automaxprocs v1.6.0 // indirect
-	golang.org/x/mod v0.27.0 // indirect
-	golang.org/x/sys v0.35.0 // indirect
-	golang.org/x/text v0.28.0 // indirect
-	golang.org/x/tools v0.36.0 // indirect
+	go.uber.org/mock v0.5.0 // indirect
+	golang.org/x/mod v0.24.0 // indirect
+	golang.org/x/sys v0.32.0 // indirect
+	golang.org/x/text v0.24.0 // indirect
+	golang.org/x/tools v0.31.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
@@ -105,8 +105,8 @@ github.com/prometheus/common v0.48.0 h1:QO8U2CdOzSn1BBsmXJXduaaW+dY/5QLjfB8svtSz
 github.com/prometheus/common v0.48.0/go.mod h1:0/KsvlIEfPQCQ5I2iNSAWKPZziNCvRs5EC6ILDTlAPc=
 github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
 github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
-github.com/quic-go/quic-go v0.55.0 h1:zccPQIqYCXDt5NmcEabyYvOnomjs8Tlwl7tISjJh9Mk=
-github.com/quic-go/quic-go v0.55.0/go.mod h1:DR51ilwU1uE164KuWXhinFcKWGlEjzys2l8zUl5Ss1U=
+github.com/quic-go/quic-go v0.53.0 h1:QHX46sISpG2S03dPeZBgVIZp8dGagIaiu2FiVYvpCZI=
+github.com/quic-go/quic-go v0.53.0/go.mod h1:e68ZEaCdyviluZmy44P6Iey98v/Wfz6HCjQEm+l8zTY=
 github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rodaine/table v1.2.0 h1:38HEnwK4mKSHQJIkavVj+bst1TEY7j9zhLMWu4QJrMA=
@@ -156,24 +156,24 @@ github.com/xtaci/lossyconn v0.0.0-20200209145036-adba10fffc37/go.mod h1:HpMP7DB2
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
 go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
-go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
-go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
+go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
+go.uber.org/mock v0.5.0/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201012173705-84dcc777aaee/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE=
 golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
-golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
-golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
+golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
+golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
-golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
+golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
+golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -187,8 +187,8 @@ golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
-golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
-golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
+golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
+golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.28.0 h1:CrgCKl8PPAVtLnU3c+EDw6x11699EWlsDeWNWKdIOkc=
 golang.org/x/oauth2 v0.28.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
@@ -197,8 +197,8 @@ golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
-golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
+golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -213,24 +213,24 @@ golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
-golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
+golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
-golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
-golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
+golang.org/x/term v0.31.0 h1:erwDkOK1Msy6offm1mOgvspSkslFnIGsFnxOKoufg3o=
+golang.org/x/term v0.31.0/go.mod h1:R4BeIy7D95HzImkxGkTW1UQTtP54tio2RyHz7PwK0aw=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
-golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
+golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -241,8 +241,8 @@ golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBn
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
-golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
+golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
@@ -15,7 +15,6 @@
 package auth

 import (
-	"context"
 	"fmt"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
@@ -28,51 +27,14 @@ type Setter interface {
 	SetNewWorkConn(*msg.NewWorkConn) error
 }

-type ClientAuth struct {
-	Setter Setter
-	key    []byte
-}
-
-func (a *ClientAuth) EncryptionKey() []byte {
-	return a.key
-}
-
-// BuildClientAuth resolves any dynamic auth values and returns a prepared auth runtime.
-// Caller must run validation before calling this function.
-func BuildClientAuth(cfg *v1.AuthClientConfig) (*ClientAuth, error) {
-	if cfg == nil {
-		return nil, fmt.Errorf("auth config is nil")
-	}
-	resolved := *cfg
-	if resolved.Method == v1.AuthMethodToken && resolved.TokenSource != nil {
-		token, err := resolved.TokenSource.Resolve(context.Background())
-		if err != nil {
-			return nil, fmt.Errorf("failed to resolve auth.tokenSource: %w", err)
-		}
-		resolved.Token = token
-	}
-	setter, err := NewAuthSetter(resolved)
-	if err != nil {
-		return nil, err
-	}
-	return &ClientAuth{
-		Setter: setter,
-		key:    []byte(resolved.Token),
-	}, nil
-}
-
 func NewAuthSetter(cfg v1.AuthClientConfig) (authProvider Setter, err error) {
 	switch cfg.Method {
 	case v1.AuthMethodToken:
 		authProvider = NewTokenAuth(cfg.AdditionalScopes, cfg.Token)
 	case v1.AuthMethodOIDC:
-		if cfg.OIDC.TokenSource != nil {
-			authProvider = NewOidcTokenSourceAuthSetter(cfg.AdditionalScopes, cfg.OIDC.TokenSource)
-		} else {
-			authProvider, err = NewOidcAuthSetter(cfg.AdditionalScopes, cfg.OIDC)
-			if err != nil {
-				return nil, err
-			}
+		authProvider, err = NewOidcAuthSetter(cfg.AdditionalScopes, cfg.OIDC)
+		if err != nil {
+			return nil, err
 		}
 	default:
 		return nil, fmt.Errorf("unsupported auth method: %s", cfg.Method)
@@ -86,35 +48,6 @@ type Verifier interface {
 	VerifyNewWorkConn(*msg.NewWorkConn) error
 }

-type ServerAuth struct {
-	Verifier Verifier
-	key      []byte
-}
-
-func (a *ServerAuth) EncryptionKey() []byte {
-	return a.key
-}
-
-// BuildServerAuth resolves any dynamic auth values and returns a prepared auth runtime.
-// Caller must run validation before calling this function.
-func BuildServerAuth(cfg *v1.AuthServerConfig) (*ServerAuth, error) {
-	if cfg == nil {
-		return nil, fmt.Errorf("auth config is nil")
-	}
-	resolved := *cfg
-	if resolved.Method == v1.AuthMethodToken && resolved.TokenSource != nil {
-		token, err := resolved.TokenSource.Resolve(context.Background())
-		if err != nil {
-			return nil, fmt.Errorf("failed to resolve auth.tokenSource: %w", err)
-		}
-		resolved.Token = token
-	}
-	return &ServerAuth{
-		Verifier: NewAuthVerifier(resolved),
-		key:      []byte(resolved.Token),
-	}, nil
-}
-
 func NewAuthVerifier(cfg v1.AuthServerConfig) (authVerifier Verifier) {
 	switch cfg.Method {
 	case v1.AuthMethodToken:
@@ -152,51 +152,6 @@ func (auth *OidcAuthProvider) SetNewWorkConn(newWorkConnMsg *msg.NewWorkConn) (e
 	return err
 }

-type OidcTokenSourceAuthProvider struct {
-	additionalAuthScopes []v1.AuthScope
-
-	valueSource *v1.ValueSource
-}
-
-func NewOidcTokenSourceAuthSetter(additionalAuthScopes []v1.AuthScope, valueSource *v1.ValueSource) *OidcTokenSourceAuthProvider {
-	return &OidcTokenSourceAuthProvider{
-		additionalAuthScopes: additionalAuthScopes,
-		valueSource:          valueSource,
-	}
-}
-
-func (auth *OidcTokenSourceAuthProvider) generateAccessToken() (accessToken string, err error) {
-	ctx := context.Background()
-	accessToken, err = auth.valueSource.Resolve(ctx)
-	if err != nil {
-		return "", fmt.Errorf("couldn't acquire OIDC token for login: %v", err)
-	}
-	return
-}
-
-func (auth *OidcTokenSourceAuthProvider) SetLogin(loginMsg *msg.Login) (err error) {
-	loginMsg.PrivilegeKey, err = auth.generateAccessToken()
-	return err
-}
-
-func (auth *OidcTokenSourceAuthProvider) SetPing(pingMsg *msg.Ping) (err error) {
-	if !slices.Contains(auth.additionalAuthScopes, v1.AuthScopeHeartBeats) {
-		return nil
-	}
-
-	pingMsg.PrivilegeKey, err = auth.generateAccessToken()
-	return err
-}
-
-func (auth *OidcTokenSourceAuthProvider) SetNewWorkConn(newWorkConnMsg *msg.NewWorkConn) (err error) {
-	if !slices.Contains(auth.additionalAuthScopes, v1.AuthScopeNewWorkConns) {
-		return nil
-	}
-
-	newWorkConnMsg.PrivilegeKey, err = auth.generateAccessToken()
-	return err
-}
-
 type TokenVerifier interface {
 	Verify(context.Context, string) (*oidc.IDToken, error)
 }
@@ -167,7 +167,6 @@ func RegisterClientCommonConfigFlags(cmd *cobra.Command, c *v1.ClientCommonConfi
 		c.Transport.TLS.Enable = cmd.PersistentFlags().BoolP("tls_enable", "", true, "enable frpc tls")
 	}
 	cmd.PersistentFlags().StringVarP(&c.User, "user", "u", "", "user")
-	cmd.PersistentFlags().StringVar(&c.ClientID, "client-id", "", "unique identifier for this frpc instance")
 	cmd.PersistentFlags().StringVarP(&c.Auth.Token, "token", "t", "", "auth token")
 }

@@ -281,17 +281,6 @@ func LoadClientConfig(path string, strict bool) (
 		})
 	}

-	// Filter by enabled field in each proxy
-	// nil or true means enabled, false means disabled
-	proxyCfgs = lo.Filter(proxyCfgs, func(c v1.ProxyConfigurer, _ int) bool {
-		enabled := c.GetBaseConfig().Enabled
-		return enabled == nil || *enabled
-	})
-	visitorCfgs = lo.Filter(visitorCfgs, func(c v1.VisitorConfigurer, _ int) bool {
-		enabled := c.GetBaseConfig().Enabled
-		return enabled == nil || *enabled
-	})
-
 	if cliCfg != nil {
 		if err := cliCfg.Complete(); err != nil {
 			return nil, nil, nil, isLegacyFormat, err
@@ -15,6 +15,8 @@
 package v1

 import (
+	"context"
+	"fmt"
 	"os"

 	"github.com/samber/lo"
@@ -37,8 +39,6 @@ type ClientCommonConfig struct {
 	// clients. If this value is not "", proxy names will automatically be
 	// changed to "{user}.{proxy_name}".
 	User string `json:"user,omitempty"`
-	// ClientID uniquely identifies this frpc instance.
-	ClientID string `json:"clientID,omitempty"`

 	// ServerAddr specifies the address of the server to connect to. By
 	// default, this value is "0.0.0.0".
@@ -198,6 +198,17 @@ type AuthClientConfig struct {

 func (c *AuthClientConfig) Complete() error {
 	c.Method = util.EmptyOr(c.Method, "token")
+
+	// Resolve tokenSource during configuration loading
+	if c.Method == AuthMethodToken && c.TokenSource != nil {
+		token, err := c.TokenSource.Resolve(context.Background())
+		if err != nil {
+			return fmt.Errorf("failed to resolve auth.tokenSource: %w", err)
+		}
+		// Move the resolved token to the Token field and clear TokenSource
+		c.Token = token
+		c.TokenSource = nil
+	}
 	return nil
 }

@@ -228,10 +239,6 @@ type AuthOIDCClientConfig struct {
 	// Supports http, https, socks5, and socks5h proxy protocols.
 	// If empty, no proxy is used for OIDC connections.
 	ProxyURL string `json:"proxyURL,omitempty"`
-
-	// TokenSource specifies a custom dynamic source for the authorization token.
-	// This is mutually exclusive with every other field of this structure.
-	TokenSource *ValueSource `json:"tokenSource,omitempty"`
 }

 type VirtualNetConfig struct {
@@ -15,6 +15,8 @@
 package v1

 import (
+	"os"
+	"path/filepath"
 	"testing"

 	"github.com/samber/lo"
@@ -36,9 +38,68 @@ func TestClientConfigComplete(t *testing.T) {
 }

 func TestAuthClientConfig_Complete(t *testing.T) {
-	require := require.New(t)
-	cfg := &AuthClientConfig{}
-	err := cfg.Complete()
-	require.NoError(err)
-	require.EqualValues("token", cfg.Method)
+	// Create a temporary file for testing
+	tmpDir := t.TempDir()
+	testFile := filepath.Join(tmpDir, "test_token")
+	testContent := "client-token-value"
+	err := os.WriteFile(testFile, []byte(testContent), 0o600)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name        string
+		config      AuthClientConfig
+		expectToken string
+		expectPanic bool
+	}{
+		{
+			name: "tokenSource resolved to token",
+			config: AuthClientConfig{
+				Method: AuthMethodToken,
+				TokenSource: &ValueSource{
+					Type: "file",
+					File: &FileSource{
+						Path: testFile,
+					},
+				},
+			},
+			expectToken: testContent,
+			expectPanic: false,
+		},
+		{
+			name: "direct token unchanged",
+			config: AuthClientConfig{
+				Method: AuthMethodToken,
+				Token:  "direct-token",
+			},
+			expectToken: "direct-token",
+			expectPanic: false,
+		},
+		{
+			name: "invalid tokenSource should panic",
+			config: AuthClientConfig{
+				Method: AuthMethodToken,
+				TokenSource: &ValueSource{
+					Type: "file",
+					File: &FileSource{
+						Path: "/non/existent/file",
+					},
+				},
+			},
+			expectPanic: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.expectPanic {
+				err := tt.config.Complete()
+				require.Error(t, err)
+			} else {
+				err := tt.config.Complete()
+				require.NoError(t, err)
+				require.Equal(t, tt.expectToken, tt.config.Token)
+				require.Nil(t, tt.config.TokenSource, "TokenSource should be cleared after resolution")
+			}
+		})
+	}
 }
@@ -108,11 +108,8 @@ type DomainConfig struct {
 }

 type ProxyBaseConfig struct {
-	Name string `json:"name"`
-	Type string `json:"type"`
-	// Enabled controls whether this proxy is enabled. nil or true means enabled, false means disabled.
-	// This allows individual control over each proxy, complementing the global "start" field.
-	Enabled     *bool             `json:"enabled,omitempty"`
+	Name        string            `json:"name"`
+	Type        string            `json:"type"`
 	Annotations map[string]string `json:"annotations,omitempty"`
 	Transport   ProxyTransport    `json:"transport,omitempty"`
 	// metadata info for each proxy
@@ -15,6 +15,9 @@
 package v1

 import (
+	"context"
+	"fmt"
+
 	"github.com/samber/lo"

 	"github.com/fatedier/frp/pkg/config/types"
@@ -135,6 +138,17 @@ type AuthServerConfig struct {

 func (c *AuthServerConfig) Complete() error {
 	c.Method = util.EmptyOr(c.Method, "token")
+
+	// Resolve tokenSource during configuration loading
+	if c.Method == AuthMethodToken && c.TokenSource != nil {
+		token, err := c.TokenSource.Resolve(context.Background())
+		if err != nil {
+			return fmt.Errorf("failed to resolve auth.tokenSource: %w", err)
+		}
+		// Move the resolved token to the Token field and clear TokenSource
+		c.Token = token
+		c.TokenSource = nil
+	}
 	return nil
 }

@@ -15,6 +15,8 @@
 package v1

 import (
+	"os"
+	"path/filepath"
 	"testing"

 	"github.com/samber/lo"
@@ -33,9 +35,68 @@ func TestServerConfigComplete(t *testing.T) {
 }

 func TestAuthServerConfig_Complete(t *testing.T) {
-	require := require.New(t)
-	cfg := &AuthServerConfig{}
-	err := cfg.Complete()
-	require.NoError(err)
-	require.EqualValues("token", cfg.Method)
+	// Create a temporary file for testing
+	tmpDir := t.TempDir()
+	testFile := filepath.Join(tmpDir, "test_token")
+	testContent := "file-token-value"
+	err := os.WriteFile(testFile, []byte(testContent), 0o600)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name        string
+		config      AuthServerConfig
+		expectToken string
+		expectPanic bool
+	}{
+		{
+			name: "tokenSource resolved to token",
+			config: AuthServerConfig{
+				Method: AuthMethodToken,
+				TokenSource: &ValueSource{
+					Type: "file",
+					File: &FileSource{
+						Path: testFile,
+					},
+				},
+			},
+			expectToken: testContent,
+			expectPanic: false,
+		},
+		{
+			name: "direct token unchanged",
+			config: AuthServerConfig{
+				Method: AuthMethodToken,
+				Token:  "direct-token",
+			},
+			expectToken: "direct-token",
+			expectPanic: false,
+		},
+		{
+			name: "invalid tokenSource should panic",
+			config: AuthServerConfig{
+				Method: AuthMethodToken,
+				TokenSource: &ValueSource{
+					Type: "file",
+					File: &FileSource{
+						Path: "/non/existent/file",
+					},
+				},
+			},
+			expectPanic: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.expectPanic {
+				err := tt.config.Complete()
+				require.Error(t, err)
+			} else {
+				err := tt.config.Complete()
+				require.NoError(t, err)
+				require.Equal(t, tt.expectToken, tt.config.Token)
+				require.Nil(t, tt.config.TokenSource, "TokenSource should be cleared after resolution")
+			}
+		})
+	}
 }
@@ -23,109 +23,55 @@ import (
 	"github.com/samber/lo"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/policy/featuregate"
-	"github.com/fatedier/frp/pkg/policy/security"
+	"github.com/fatedier/frp/pkg/featuregate"
 )

-func (v *ConfigValidator) ValidateClientCommonConfig(c *v1.ClientCommonConfig) (Warning, error) {
+func ValidateClientCommonConfig(c *v1.ClientCommonConfig) (Warning, error) {
 	var (
 		warnings Warning
 		errs     error
 	)
-
-	validators := []func() (Warning, error){
-		func() (Warning, error) { return validateFeatureGates(c) },
-		func() (Warning, error) { return v.validateAuthConfig(&c.Auth) },
-		func() (Warning, error) { return nil, validateLogConfig(&c.Log) },
-		func() (Warning, error) { return nil, validateWebServerConfig(&c.WebServer) },
-		func() (Warning, error) { return validateTransportConfig(&c.Transport) },
-		func() (Warning, error) { return validateIncludeFiles(c.IncludeConfigFiles) },
-	}
-
-	for _, validator := range validators {
-		w, err := validator()
-		warnings = AppendError(warnings, w)
-		errs = AppendError(errs, err)
-	}
-	return warnings, errs
-}
-
-func validateFeatureGates(c *v1.ClientCommonConfig) (Warning, error) {
+	// validate feature gates
 	if c.VirtualNet.Address != "" {
 		if !featuregate.Enabled(featuregate.VirtualNet) {
-			return nil, fmt.Errorf("VirtualNet feature is not enabled; enable it by setting the appropriate feature gate flag")
+			return warnings, fmt.Errorf("VirtualNet feature is not enabled; enable it by setting the appropriate feature gate flag")
 		}
 	}
-	return nil, nil
-}

-func (v *ConfigValidator) validateAuthConfig(c *v1.AuthClientConfig) (Warning, error) {
-	var errs error
-	if !slices.Contains(SupportedAuthMethods, c.Method) {
+	if !slices.Contains(SupportedAuthMethods, c.Auth.Method) {
 		errs = AppendError(errs, fmt.Errorf("invalid auth method, optional values are %v", SupportedAuthMethods))
 	}
-	if !lo.Every(SupportedAuthAdditionalScopes, c.AdditionalScopes) {
+	if !lo.Every(SupportedAuthAdditionalScopes, c.Auth.AdditionalScopes) {
 		errs = AppendError(errs, fmt.Errorf("invalid auth additional scopes, optional values are %v", SupportedAuthAdditionalScopes))
 	}

 	// Validate token/tokenSource mutual exclusivity
-	if c.Token != "" && c.TokenSource != nil {
+	if c.Auth.Token != "" && c.Auth.TokenSource != nil {
 		errs = AppendError(errs, fmt.Errorf("cannot specify both auth.token and auth.tokenSource"))
 	}

 	// Validate tokenSource if specified
-	if c.TokenSource != nil {
-		if c.TokenSource.Type == "exec" {
-			if err := v.ValidateUnsafeFeature(security.TokenSourceExec); err != nil {
-				errs = AppendError(errs, err)
-			}
-		}
-		if err := c.TokenSource.Validate(); err != nil {
+	if c.Auth.TokenSource != nil {
+		if err := c.Auth.TokenSource.Validate(); err != nil {
 			errs = AppendError(errs, fmt.Errorf("invalid auth.tokenSource: %v", err))
 		}
 	}

-	if err := v.validateOIDCConfig(&c.OIDC); err != nil {
+	if err := validateLogConfig(&c.Log); err != nil {
 		errs = AppendError(errs, err)
 	}
-	return nil, errs
-}

-func (v *ConfigValidator) validateOIDCConfig(c *v1.AuthOIDCClientConfig) error {
-	if c.TokenSource == nil {
-		return nil
+	if err := validateWebServerConfig(&c.WebServer); err != nil {
+		errs = AppendError(errs, err)
 	}
-	var errs error
-	// Validate oidc.tokenSource mutual exclusivity with other fields of oidc
-	if c.ClientID != "" || c.ClientSecret != "" || c.Audience != "" ||
-		c.Scope != "" || c.TokenEndpointURL != "" || len(c.AdditionalEndpointParams) > 0 ||
-		c.TrustedCaFile != "" || c.InsecureSkipVerify || c.ProxyURL != "" {
-		errs = AppendError(errs, fmt.Errorf("cannot specify both auth.oidc.tokenSource and any other field of auth.oidc"))
-	}
-	if c.TokenSource.Type == "exec" {
-		if err := v.ValidateUnsafeFeature(security.TokenSourceExec); err != nil {
-			errs = AppendError(errs, err)
-		}
-	}
-	if err := c.TokenSource.Validate(); err != nil {
-		errs = AppendError(errs, fmt.Errorf("invalid auth.oidc.tokenSource: %v", err))
-	}
-	return errs
-}

-func validateTransportConfig(c *v1.ClientTransportConfig) (Warning, error) {
-	var (
-		warnings Warning
-		errs     error
-	)
-
-	if c.HeartbeatTimeout > 0 && c.HeartbeatInterval > 0 {
-		if c.HeartbeatTimeout < c.HeartbeatInterval {
+	if c.Transport.HeartbeatTimeout > 0 && c.Transport.HeartbeatInterval > 0 {
+		if c.Transport.HeartbeatTimeout < c.Transport.HeartbeatInterval {
 			errs = AppendError(errs, fmt.Errorf("invalid transport.heartbeatTimeout, heartbeat timeout should not less than heartbeat interval"))
 		}
 	}

-	if !lo.FromPtr(c.TLS.Enable) {
+	if !lo.FromPtr(c.Transport.TLS.Enable) {
 		checkTLSConfig := func(name string, value string) Warning {
 			if value != "" {
 				return fmt.Errorf("%s is invalid when transport.tls.enable is false", name)
@@ -133,20 +79,16 @@ func validateTransportConfig(c *v1.ClientTransportConfig) (Warning, error) {
 			return nil
 		}

-		warnings = AppendError(warnings, checkTLSConfig("transport.tls.certFile", c.TLS.CertFile))
-		warnings = AppendError(warnings, checkTLSConfig("transport.tls.keyFile", c.TLS.KeyFile))
-		warnings = AppendError(warnings, checkTLSConfig("transport.tls.trustedCaFile", c.TLS.TrustedCaFile))
+		warnings = AppendError(warnings, checkTLSConfig("transport.tls.certFile", c.Transport.TLS.CertFile))
+		warnings = AppendError(warnings, checkTLSConfig("transport.tls.keyFile", c.Transport.TLS.KeyFile))
+		warnings = AppendError(warnings, checkTLSConfig("transport.tls.trustedCaFile", c.Transport.TLS.TrustedCaFile))
 	}

-	if !slices.Contains(SupportedTransportProtocols, c.Protocol) {
+	if !slices.Contains(SupportedTransportProtocols, c.Transport.Protocol) {
 		errs = AppendError(errs, fmt.Errorf("invalid transport.protocol, optional values are %v", SupportedTransportProtocols))
 	}
-	return warnings, errs
-}

-func validateIncludeFiles(files []string) (Warning, error) {
-	var errs error
-	for _, f := range files {
+	for _, f := range c.IncludeConfigFiles {
 		absDir, err := filepath.Abs(filepath.Dir(f))
 		if err != nil {
 			errs = AppendError(errs, fmt.Errorf("include: parse directory of %s failed: %v", f, err))
@@ -156,19 +98,13 @@ func validateIncludeFiles(files []string) (Warning, error) {
 			errs = AppendError(errs, fmt.Errorf("include: directory of %s not exist", f))
 		}
 	}
-	return nil, errs
+	return warnings, errs
 }

-func ValidateAllClientConfig(
-	c *v1.ClientCommonConfig,
-	proxyCfgs []v1.ProxyConfigurer,
-	visitorCfgs []v1.VisitorConfigurer,
-	unsafeFeatures *security.UnsafeFeatures,
-) (Warning, error) {
-	validator := NewConfigValidator(unsafeFeatures)
+func ValidateAllClientConfig(c *v1.ClientCommonConfig, proxyCfgs []v1.ProxyConfigurer, visitorCfgs []v1.VisitorConfigurer) (Warning, error) {
 	var warnings Warning
 	if c != nil {
-		warning, err := validator.ValidateClientCommonConfig(c)
+		warning, err := ValidateClientCommonConfig(c)
 		warnings = AppendError(warnings, warning)
 		if err != nil {
 			return warnings, err
@@ -21,10 +21,9 @@ import (
 	"github.com/samber/lo"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/policy/security"
 )

-func (v *ConfigValidator) ValidateServerConfig(c *v1.ServerConfig) (Warning, error) {
+func ValidateServerConfig(c *v1.ServerConfig) (Warning, error) {
 	var (
 		warnings Warning
 		errs     error
@@ -43,11 +42,6 @@ func (v *ConfigValidator) ValidateServerConfig(c *v1.ServerConfig) (Warning, err

 	// Validate tokenSource if specified
 	if c.Auth.TokenSource != nil {
-		if c.Auth.TokenSource.Type == "exec" {
-			if err := v.ValidateUnsafeFeature(security.TokenSourceExec); err != nil {
-				errs = AppendError(errs, err)
-			}
-		}
 		if err := c.Auth.TokenSource.Validate(); err != nil {
 			errs = AppendError(errs, fmt.Errorf("invalid auth.tokenSource: %v", err))
 		}
@@ -1,28 +0,0 @@
-package validation
-
-import (
-	"fmt"
-
-	"github.com/fatedier/frp/pkg/policy/security"
-)
-
-// ConfigValidator holds the context dependencies for configuration validation.
-type ConfigValidator struct {
-	unsafeFeatures *security.UnsafeFeatures
-}
-
-// NewConfigValidator creates a new ConfigValidator instance.
-func NewConfigValidator(unsafeFeatures *security.UnsafeFeatures) *ConfigValidator {
-	return &ConfigValidator{
-		unsafeFeatures: unsafeFeatures,
-	}
-}
-
-// ValidateUnsafeFeature checks if a specific unsafe feature is enabled.
-func (v *ConfigValidator) ValidateUnsafeFeature(feature string) error {
-	if !v.unsafeFeatures.IsEnabled(feature) {
-		return fmt.Errorf("unsafe feature %q is not enabled. "+
-			"To enable it, ensure it is allowed in the configuration or command line flags", feature)
-	}
-	return nil
-}
@@ -19,7 +19,6 @@ import (
 	"errors"
 	"fmt"
 	"os"
-	"os/exec"
 	"strings"
 )

@@ -28,7 +27,6 @@ import (
 type ValueSource struct {
 	Type string      `json:"type"`
 	File *FileSource `json:"file,omitempty"`
-	Exec *ExecSource `json:"exec,omitempty"`
 }

 // FileSource specifies how to load a value from a file.
@@ -36,18 +34,6 @@ type FileSource struct {
 	Path string `json:"path"`
 }

-// ExecSource specifies how to get a value from another program launched as subprocess.
-type ExecSource struct {
-	Command string       `json:"command"`
-	Args    []string     `json:"args,omitempty"`
-	Env     []ExecEnvVar `json:"env,omitempty"`
-}
-
-type ExecEnvVar struct {
-	Name  string `json:"name"`
-	Value string `json:"value"`
-}
-
 // Validate validates the ValueSource configuration.
 func (v *ValueSource) Validate() error {
 	if v == nil {
@@ -60,13 +46,8 @@ func (v *ValueSource) Validate() error {
 			return errors.New("file configuration is required when type is 'file'")
 		}
 		return v.File.Validate()
-	case "exec":
-		if v.Exec == nil {
-			return errors.New("exec configuration is required when type is 'exec'")
-		}
-		return v.Exec.Validate()
 	default:
-		return fmt.Errorf("unsupported value source type: %s (only 'file' and 'exec' are supported)", v.Type)
+		return fmt.Errorf("unsupported value source type: %s (only 'file' is supported)", v.Type)
 	}
 }

@@ -79,8 +60,6 @@ func (v *ValueSource) Resolve(ctx context.Context) (string, error) {
 	switch v.Type {
 	case "file":
 		return v.File.Resolve(ctx)
-	case "exec":
-		return v.Exec.Resolve(ctx)
 	default:
 		return "", fmt.Errorf("unsupported value source type: %s", v.Type)
 	}
@@ -112,47 +91,3 @@ func (f *FileSource) Resolve(_ context.Context) (string, error) {
 	// Trim whitespace, which is important for file-based tokens
 	return strings.TrimSpace(string(content)), nil
 }
-
-// Validate validates the ExecSource configuration.
-func (e *ExecSource) Validate() error {
-	if e == nil {
-		return errors.New("execSource cannot be nil")
-	}
-
-	if e.Command == "" {
-		return errors.New("exec command cannot be empty")
-	}
-
-	for _, env := range e.Env {
-		if env.Name == "" {
-			return errors.New("exec env name cannot be empty")
-		}
-		if strings.Contains(env.Name, "=") {
-			return errors.New("exec env name cannot contain '='")
-		}
-	}
-	return nil
-}
-
-// Resolve reads and returns the content captured from stdout of launched subprocess.
-func (e *ExecSource) Resolve(ctx context.Context) (string, error) {
-	if err := e.Validate(); err != nil {
-		return "", err
-	}
-
-	cmd := exec.CommandContext(ctx, e.Command, e.Args...)
-	if len(e.Env) != 0 {
-		cmd.Env = os.Environ()
-		for _, env := range e.Env {
-			cmd.Env = append(cmd.Env, env.Name+"="+env.Value)
-		}
-	}
-
-	content, err := cmd.Output()
-	if err != nil {
-		return "", fmt.Errorf("failed to execute command %v: %v", e.Command, err)
-	}
-
-	// Trim whitespace, which is important for exec-based tokens
-	return strings.TrimSpace(string(content)), nil
-}
@@ -32,11 +32,8 @@ type VisitorTransport struct {
 }

 type VisitorBaseConfig struct {
-	Name string `json:"name"`
-	Type string `json:"type"`
-	// Enabled controls whether this visitor is enabled. nil or true means enabled, false means disabled.
-	// This allows individual control over each visitor, complementing the global "start" field.
-	Enabled   *bool            `json:"enabled,omitempty"`
+	Name      string           `json:"name"`
+	Type      string           `json:"type"`
 	Transport VisitorTransport `json:"transport,omitempty"`
 	SecretKey string           `json:"secretKey,omitempty"`
 	// if the server user is not set, it defaults to the current user
@@ -86,6 +86,10 @@ func (d *Dispatcher) Send(m Message) error {
 	}
 }

+func (d *Dispatcher) SendChannel() chan Message {
+	return d.sendCh
+}
+
 func (d *Dispatcher) RegisterHandler(msg Message, handler func(Message)) {
 	d.msgHandlers[reflect.TypeOf(msg)] = handler
 }
@@ -82,7 +82,6 @@ type Login struct {
 	PrivilegeKey string            `json:"privilege_key,omitempty"`
 	Timestamp    int64             `json:"timestamp,omitempty"`
 	RunID        string            `json:"run_id,omitempty"`
-	ClientID     string            `json:"client_id,omitempty"`
 	Metas        map[string]string `json:"metas,omitempty"`

 	// Currently only effective for VirtualClient.
@@ -23,20 +23,11 @@ import (
 	"github.com/fatedier/frp/pkg/vnet"
 )

-// PluginContext provides the necessary context and callbacks for visitor plugins.
 type PluginContext struct {
-	// Name is the unique identifier for this visitor, used for logging and routing.
-	Name string
-
-	// Ctx manages the plugin's lifecycle and carries the logger for structured logging.
-	Ctx context.Context
-
-	// VnetController manages TUN device routing. May be nil if virtual networking is disabled.
+	Name           string
+	Ctx            context.Context
 	VnetController *vnet.Controller
-
-	// SendConnToVisitor sends a connection to the visitor's internal processing queue.
-	// Does not return error; failures are handled by closing the connection.
-	SendConnToVisitor func(net.Conn)
+	HandleConn     func(net.Conn)
 }

 // Creators is used for create plugins to handle connections.
@@ -42,8 +42,6 @@ type VirtualNetPlugin struct {
 	controllerConn net.Conn
 	closeSignal    chan struct{}

-	consecutiveErrors int // Tracks consecutive connection errors for exponential backoff
-
 	ctx    context.Context
 	cancel context.CancelFunc
 }
@@ -100,6 +98,7 @@ func (p *VirtualNetPlugin) Start() {

 func (p *VirtualNetPlugin) run() {
 	xl := xlog.FromContextSafe(p.ctx)
+	reconnectDelay := 10 * time.Second

 	for {
 		currentCloseSignal := make(chan struct{})
@@ -122,10 +121,7 @@ func (p *VirtualNetPlugin) run() {
 		p.controllerConn = controllerConn
 		p.mu.Unlock()

-		// Wrap with CloseNotifyConn which supports both close notification and error recording
-		var closeErr error
-		pluginNotifyConn := netutil.WrapCloseNotifyConn(pluginConn, func(err error) {
-			closeErr = err
+		pluginNotifyConn := netutil.WrapCloseNotifyConn(pluginConn, func() {
 			close(currentCloseSignal) // Signal the run loop on close.
 		})

@@ -133,9 +129,9 @@ func (p *VirtualNetPlugin) run() {
 		p.pluginCtx.VnetController.RegisterClientRoute(p.ctx, p.pluginCtx.Name, p.routes, controllerConn)
 		xl.Infof("successfully registered client route for visitor [%s]. Starting connection handler with CloseNotifyConn.", p.pluginCtx.Name)

-		// Pass the CloseNotifyConn to the visitor for handling.
-		// The visitor can call CloseWithError to record the failure reason.
-		p.pluginCtx.SendConnToVisitor(pluginNotifyConn)
+		// Pass the CloseNotifyConn to HandleConn.
+		// HandleConn is responsible for calling Close() on pluginNotifyConn.
+		p.pluginCtx.HandleConn(pluginNotifyConn)

 		// Wait for context cancellation or connection close.
 		select {
@@ -144,32 +140,8 @@ func (p *VirtualNetPlugin) run() {
 			p.cleanupControllerConn(xl)
 			return
 		case <-currentCloseSignal:
-			// Determine reconnect delay based on error with exponential backoff
-			var reconnectDelay time.Duration
-			if closeErr != nil {
-				p.consecutiveErrors++
-				xl.Warnf("connection closed with error for visitor [%s] (consecutive errors: %d): %v",
-					p.pluginCtx.Name, p.consecutiveErrors, closeErr)
-
-				// Exponential backoff: 60s, 120s, 240s, 300s (capped)
-				baseDelay := 60 * time.Second
-				reconnectDelay = baseDelay * time.Duration(1<<uint(p.consecutiveErrors-1))
-				if reconnectDelay > 300*time.Second {
-					reconnectDelay = 300 * time.Second
-				}
-			} else {
-				// Reset consecutive errors on successful connection
-				if p.consecutiveErrors > 0 {
-					xl.Infof("connection closed normally for visitor [%s], resetting error counter (was %d)",
-						p.pluginCtx.Name, p.consecutiveErrors)
-					p.consecutiveErrors = 0
-				} else {
-					xl.Infof("connection closed normally for visitor [%s]", p.pluginCtx.Name)
-				}
-				reconnectDelay = 10 * time.Second
-			}
-
-			// The visitor closed the plugin side. Close the controller side.
+			xl.Infof("detected connection closed via CloseNotifyConn for visitor [%s].", p.pluginCtx.Name)
+			// HandleConn closed the plugin side. Close the controller side.
 			p.cleanupControllerConn(xl)

 			xl.Infof("waiting %v before attempting reconnection for visitor [%s]...", reconnectDelay, p.pluginCtx.Name)
@@ -212,7 +184,7 @@ func (p *VirtualNetPlugin) Close() error {
 	}

 	// Explicitly close the controller side of the pipe.
-	// This ensures the pipe is broken even if the run loop is stuck or the visitor hasn't closed its end.
+	// This ensures the pipe is broken even if the run loop is stuck or HandleConn hasn't closed its end.
 	p.cleanupControllerConn(xl)
 	xl.Infof("finished cleaning up connections during close for visitor [%s]", p.pluginCtx.Name)

@@ -1,34 +0,0 @@
-package security
-
-const (
-	TokenSourceExec = "TokenSourceExec"
-)
-
-var (
-	ClientUnsafeFeatures = []string{
-		TokenSourceExec,
-	}
-
-	ServerUnsafeFeatures = []string{
-		TokenSourceExec,
-	}
-)
-
-type UnsafeFeatures struct {
-	features map[string]bool
-}
-
-func NewUnsafeFeatures(allowed []string) *UnsafeFeatures {
-	features := make(map[string]bool)
-	for _, f := range allowed {
-		features[f] = true
-	}
-	return &UnsafeFeatures{features: features}
-}
-
-func (u *UnsafeFeatures) IsEnabled(feature string) bool {
-	if u == nil {
-		return false
-	}
-	return u.features[feature]
-}
@@ -124,8 +124,8 @@ func Forwarder(dstAddr *net.UDPAddr, readCh <-chan *msg.UDPPacket, sendCh chan<-
 			}
 			mu.Unlock()

-			// Add proxy protocol header if configured (only for the first packet of a new connection)
-			if !ok && proxyProtocolVersion != "" && udpMsg.RemoteAddr != nil {
+			// Add proxy protocol header if configured
+			if proxyProtocolVersion != "" && udpMsg.RemoteAddr != nil {
 				ppBuf, err := netpkg.BuildProxyProtocolHeader(udpMsg.RemoteAddr, dstAddr, proxyProtocolVersion)
 				if err == nil {
 					// Prepend proxy protocol header to the UDP payload
@@ -35,19 +35,15 @@ type MessageTransporter interface {
 	DispatchWithType(m msg.Message, msgType, laneKey string) bool
 }

-type MessageSender interface {
-	Send(msg.Message) error
-}
-
-func NewMessageTransporter(sender MessageSender) MessageTransporter {
+func NewMessageTransporter(sendCh chan msg.Message) MessageTransporter {
 	return &transporterImpl{
-		sender:   sender,
+		sendCh:   sendCh,
 		registry: make(map[string]map[string]chan msg.Message),
 	}
 }

 type transporterImpl struct {
-	sender MessageSender
+	sendCh chan msg.Message

 	// First key is message type and second key is lane key.
 	// Dispatch will dispatch message to related channel by its message type
@@ -57,7 +53,9 @@ type transporterImpl struct {
 }

 func (impl *transporterImpl) Send(m msg.Message) error {
-	return impl.sender.Send(m)
+	return errors.PanicToError(func() {
+		impl.sendCh <- m
+	})
 }

 func (impl *transporterImpl) Do(ctx context.Context, req msg.Message, laneKey, recvMsgType string) (msg.Message, error) {
@@ -135,11 +135,11 @@ type CloseNotifyConn struct {
 	// 1 means closed
 	closeFlag int32

-	closeFn func(error)
+	closeFn func()
 }

-// closeFn will be only called once with the error (nil if Close() was called, non-nil if CloseWithError() was called)
-func WrapCloseNotifyConn(c net.Conn, closeFn func(error)) *CloseNotifyConn {
+// closeFn will be only called once
+func WrapCloseNotifyConn(c net.Conn, closeFn func()) net.Conn {
 	return &CloseNotifyConn{
 		Conn:    c,
 		closeFn: closeFn,
@@ -149,27 +149,14 @@ func WrapCloseNotifyConn(c net.Conn, closeFn func(error)) *CloseNotifyConn {
 func (cc *CloseNotifyConn) Close() (err error) {
 	pflag := atomic.SwapInt32(&cc.closeFlag, 1)
 	if pflag == 0 {
-		err = cc.Conn.Close()
+		err = cc.Close()
 		if cc.closeFn != nil {
-			cc.closeFn(nil)
+			cc.closeFn()
 		}
 	}
 	return
 }

-// CloseWithError closes the connection and passes the error to the close callback.
-func (cc *CloseNotifyConn) CloseWithError(err error) error {
-	pflag := atomic.SwapInt32(&cc.closeFlag, 1)
-	if pflag == 0 {
-		closeErr := cc.Conn.Close()
-		if cc.closeFn != nil {
-			cc.closeFn(err)
-		}
-		return closeErr
-	}
-	return nil
-}
-
 type StatsConn struct {
 	net.Conn

@@ -32,7 +32,7 @@ func NewWebsocketListener(ln net.Listener) (wl *WebsocketListener) {
 	muxer := http.NewServeMux()
 	muxer.Handle(FrpWebsocketPath, websocket.Handler(func(c *websocket.Conn) {
 		notifyCh := make(chan struct{})
-		conn := WrapCloseNotifyConn(c, func(_ error) {
+		conn := WrapCloseNotifyConn(c, func() {
 			close(notifyCh)
 		})
 		wl.acceptCh <- conn
@@ -14,7 +14,7 @@

 package version

-var version = "0.66.0"
+var version = "0.65.0"

 func Full() string {
 	return version
@@ -1,141 +0,0 @@
-package server
-
-import (
-	"fmt"
-	"sync"
-	"time"
-)
-
-// ClientInfo captures metadata about a connected frpc instance.
-type ClientInfo struct {
-	Key              string
-	User             string
-	ClientID         string
-	RunID            string
-	Hostname         string
-	IP               string
-	FirstConnectedAt time.Time
-	LastConnectedAt  time.Time
-	DisconnectedAt   time.Time
-	Online           bool
-}
-
-// ClientRegistry keeps track of active clients keyed by "{user}.{clientID}" (or runID if clientID is empty).
-// Entries without an explicit clientID are removed on disconnect to avoid stale offline records.
-type ClientRegistry struct {
-	mu       sync.RWMutex
-	clients  map[string]*ClientInfo
-	runIndex map[string]string
-}
-
-func NewClientRegistry() *ClientRegistry {
-	return &ClientRegistry{
-		clients:  make(map[string]*ClientInfo),
-		runIndex: make(map[string]string),
-	}
-}
-
-// Register stores/updates metadata for a client and returns the registry key plus whether it conflicts with an online client.
-func (cr *ClientRegistry) Register(user, clientID, runID, hostname, remoteAddr string) (key string, conflict bool) {
-	if runID == "" {
-		return "", false
-	}
-
-	effectiveID := clientID
-	if effectiveID == "" {
-		effectiveID = runID
-	}
-	key = cr.composeClientKey(user, effectiveID)
-	enforceUnique := clientID != ""
-
-	now := time.Now()
-	cr.mu.Lock()
-	defer cr.mu.Unlock()
-
-	info, exists := cr.clients[key]
-	if enforceUnique && exists && info.Online && info.RunID != "" && info.RunID != runID {
-		return key, true
-	}
-
-	if !exists {
-		info = &ClientInfo{
-			Key:              key,
-			User:             user,
-			ClientID:         clientID,
-			FirstConnectedAt: now,
-		}
-		cr.clients[key] = info
-	} else if info.RunID != "" {
-		delete(cr.runIndex, info.RunID)
-	}
-
-	info.RunID = runID
-	info.Hostname = hostname
-	info.IP = remoteAddr
-	if info.FirstConnectedAt.IsZero() {
-		info.FirstConnectedAt = now
-	}
-	info.LastConnectedAt = now
-	info.DisconnectedAt = time.Time{}
-	info.Online = true
-
-	cr.runIndex[runID] = key
-	return key, false
-}
-
-// MarkOfflineByRunID marks the client as offline when the corresponding control disconnects.
-func (cr *ClientRegistry) MarkOfflineByRunID(runID string) {
-	cr.mu.Lock()
-	defer cr.mu.Unlock()
-
-	key, ok := cr.runIndex[runID]
-	if !ok {
-		return
-	}
-	if info, ok := cr.clients[key]; ok && info.RunID == runID {
-		if info.ClientID == "" {
-			delete(cr.clients, key)
-		} else {
-			info.RunID = ""
-			info.Online = false
-			now := time.Now()
-			info.DisconnectedAt = now
-		}
-	}
-	delete(cr.runIndex, runID)
-}
-
-// List returns a snapshot of all known clients.
-func (cr *ClientRegistry) List() []ClientInfo {
-	cr.mu.RLock()
-	defer cr.mu.RUnlock()
-
-	result := make([]ClientInfo, 0, len(cr.clients))
-	for _, info := range cr.clients {
-		result = append(result, *info)
-	}
-	return result
-}
-
-// GetByKey retrieves a client by its composite key ({user}.{clientID} or runID fallback).
-func (cr *ClientRegistry) GetByKey(key string) (ClientInfo, bool) {
-	cr.mu.RLock()
-	defer cr.mu.RUnlock()
-
-	info, ok := cr.clients[key]
-	if !ok {
-		return ClientInfo{}, false
-	}
-	return *info, true
-}
-
-func (cr *ClientRegistry) composeClientKey(user, id string) string {
-	switch {
-	case user == "":
-		return id
-	case id == "":
-		return user
-	default:
-		return fmt.Sprintf("%s.%s", user, id)
-	}
-}
@@ -106,8 +106,6 @@ type Control struct {

 	// verifies authentication based on selected method
 	authVerifier auth.Verifier
-	// key used for connection encryption
-	encryptionKey []byte

 	// other components can use this to communicate with client
 	msgTransporter transport.MessageTransporter
@@ -147,8 +145,6 @@ type Control struct {
 	// Server configuration information
 	serverCfg *v1.ServerConfig

-	clientRegistry *ClientRegistry
-
 	xl     *xlog.Logger
 	ctx    context.Context
 	doneCh chan struct{}
@@ -161,7 +157,6 @@ func NewControl(
 	pxyManager *proxy.Manager,
 	pluginManager *plugin.Manager,
 	authVerifier auth.Verifier,
-	encryptionKey []byte,
 	ctlConn net.Conn,
 	ctlConnEncrypted bool,
 	loginMsg *msg.Login,
@@ -176,7 +171,6 @@ func NewControl(
 		pxyManager:    pxyManager,
 		pluginManager: pluginManager,
 		authVerifier:  authVerifier,
-		encryptionKey: encryptionKey,
 		conn:          ctlConn,
 		loginMsg:      loginMsg,
 		workConnCh:    make(chan net.Conn, poolCount+10),
@@ -192,7 +186,7 @@ func NewControl(
 	ctl.lastPing.Store(time.Now())

 	if ctlConnEncrypted {
-		cryptoRW, err := netpkg.NewCryptoReadWriter(ctl.conn, ctl.encryptionKey)
+		cryptoRW, err := netpkg.NewCryptoReadWriter(ctl.conn, []byte(ctl.serverCfg.Auth.Token))
 		if err != nil {
 			return nil, err
 		}
@@ -201,7 +195,7 @@ func NewControl(
 		ctl.msgDispatcher = msg.NewDispatcher(ctl.conn)
 	}
 	ctl.registerMsgHandlers()
-	ctl.msgTransporter = transport.NewMessageTransporter(ctl.msgDispatcher)
+	ctl.msgTransporter = transport.NewMessageTransporter(ctl.msgDispatcher.SendChannel())
 	return ctl, nil
 }

@@ -360,7 +354,6 @@ func (ctl *Control) worker() {
 	}

 	metrics.Server.CloseClient()
-	ctl.clientRegistry.MarkOfflineByRunID(ctl.runID)
 	xl.Infof("client exit success")
 	close(ctl.doneCh)
 }
@@ -485,7 +478,6 @@ func (ctl *Control) RegisterProxy(pxyMsg *msg.NewProxy) (remoteAddr string, err
 		GetWorkConnFn:      ctl.GetWorkConn,
 		Configurer:         pxyConf,
 		ServerCfg:          ctl.serverCfg,
-		EncryptionKey:      ctl.encryptionKey,
 	})
 	if err != nil {
 		return remoteAddr, err
@@ -35,9 +35,6 @@ type ResourceController struct {
 	// HTTP Group Controller
 	HTTPGroupCtl *group.HTTPGroupController

-	// HTTPS Group Controller
-	HTTPSGroupCtl *group.HTTPSGroupController
-
 	// TCP Mux Group Controller
 	TCPMuxGroupCtl *group.TCPMuxGroupCtl

@@ -17,11 +17,8 @@ package server
 import (
 	"cmp"
 	"encoding/json"
-	"fmt"
 	"net/http"
 	"slices"
-	"strings"
-	"time"

 	"github.com/gorilla/mux"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
@@ -56,8 +53,6 @@ func (svr *Service) registerRouteHandlers(helper *httppkg.RouterRegisterHelper)
 	subRouter.HandleFunc("/api/proxy/{type}", svr.apiProxyByType).Methods("GET")
 	subRouter.HandleFunc("/api/proxy/{type}/{name}", svr.apiProxyByTypeAndName).Methods("GET")
 	subRouter.HandleFunc("/api/traffic/{name}", svr.apiProxyTraffic).Methods("GET")
-	subRouter.HandleFunc("/api/clients", svr.apiClientList).Methods("GET")
-	subRouter.HandleFunc("/api/clients/{key}", svr.apiClientDetail).Methods("GET")
 	subRouter.HandleFunc("/api/proxies", svr.deleteProxies).Methods("DELETE")

 	// view
@@ -93,19 +88,6 @@ type serverInfoResp struct {
 	ProxyTypeCounts map[string]int64 `json:"proxyTypeCount"`
 }

-type clientInfoResp struct {
-	Key              string `json:"key"`
-	User             string `json:"user"`
-	ClientID         string `json:"clientID"`
-	RunID            string `json:"runID"`
-	Hostname         string `json:"hostname"`
-	ClientIP         string `json:"clientIP,omitempty"`
-	FirstConnectedAt int64  `json:"firstConnectedAt"`
-	LastConnectedAt  int64  `json:"lastConnectedAt"`
-	DisconnectedAt   int64  `json:"disconnectedAt,omitempty"`
-	Online           bool   `json:"online"`
-}
-
 // /healthz
 func (svr *Service) healthz(w http.ResponseWriter, _ *http.Request) {
 	w.WriteHeader(200)
@@ -123,7 +105,6 @@ func (svr *Service) apiServerInfo(w http.ResponseWriter, r *http.Request) {
 	}()

 	log.Infof("http request: [%s]", r.URL.Path)
-	w.Header().Set("Content-Type", "application/json")
 	serverStats := mem.StatsCollector.GetServer()
 	svrResp := serverInfoResp{
 		Version:               version.Full(),
@@ -151,103 +132,6 @@ func (svr *Service) apiServerInfo(w http.ResponseWriter, r *http.Request) {
 	res.Msg = string(buf)
 }

-// /api/clients
-func (svr *Service) apiClientList(w http.ResponseWriter, r *http.Request) {
-	res := GeneralResponse{Code: 200}
-	defer func() {
-		log.Infof("http response [%s]: code [%d]", r.URL.RequestURI(), res.Code)
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(res.Code)
-		if len(res.Msg) > 0 {
-			_, _ = w.Write([]byte(res.Msg))
-		}
-	}()
-
-	log.Infof("http request: [%s]", r.URL.RequestURI())
-
-	if svr.clientRegistry == nil {
-		res.Code = http.StatusInternalServerError
-		res.Msg = "client registry unavailable"
-		return
-	}
-
-	query := r.URL.Query()
-	userFilter := query.Get("user")
-	clientIDFilter := query.Get("clientId")
-	runIDFilter := query.Get("runId")
-	statusFilter := strings.ToLower(query.Get("status"))
-
-	records := svr.clientRegistry.List()
-	items := make([]clientInfoResp, 0, len(records))
-	for _, info := range records {
-		if userFilter != "" && info.User != userFilter {
-			continue
-		}
-		if clientIDFilter != "" && info.ClientID != clientIDFilter {
-			continue
-		}
-		if runIDFilter != "" && info.RunID != runIDFilter {
-			continue
-		}
-		if !matchStatusFilter(info.Online, statusFilter) {
-			continue
-		}
-		items = append(items, buildClientInfoResp(info))
-	}
-
-	slices.SortFunc(items, func(a, b clientInfoResp) int {
-		if v := cmp.Compare(a.User, b.User); v != 0 {
-			return v
-		}
-		if v := cmp.Compare(a.ClientID, b.ClientID); v != 0 {
-			return v
-		}
-		return cmp.Compare(a.Key, b.Key)
-	})
-
-	buf, _ := json.Marshal(items)
-	res.Msg = string(buf)
-}
-
-// /api/clients/{key}
-func (svr *Service) apiClientDetail(w http.ResponseWriter, r *http.Request) {
-	res := GeneralResponse{Code: 200}
-	defer func() {
-		log.Infof("http response [%s]: code [%d]", r.URL.RequestURI(), res.Code)
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(res.Code)
-		if len(res.Msg) > 0 {
-			_, _ = w.Write([]byte(res.Msg))
-		}
-	}()
-
-	log.Infof("http request: [%s]", r.URL.RequestURI())
-
-	vars := mux.Vars(r)
-	key := vars["key"]
-	if key == "" {
-		res.Code = http.StatusBadRequest
-		res.Msg = "missing client key"
-		return
-	}
-
-	if svr.clientRegistry == nil {
-		res.Code = http.StatusInternalServerError
-		res.Msg = "client registry unavailable"
-		return
-	}
-
-	info, ok := svr.clientRegistry.GetByKey(key)
-	if !ok {
-		res.Code = http.StatusNotFound
-		res.Msg = fmt.Sprintf("client %s not found", key)
-		return
-	}
-
-	buf, _ := json.Marshal(buildClientInfoResp(info))
-	res.Msg = string(buf)
-}
-
 type BaseOutConf struct {
 	v1.ProxyBaseConfig
 }
@@ -335,7 +219,6 @@ func (svr *Service) apiProxyByType(w http.ResponseWriter, r *http.Request) {

 	defer func() {
 		log.Infof("http response [%s]: code [%d]", r.URL.Path, res.Code)
-		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(res.Code)
 		if len(res.Msg) > 0 {
 			_, _ = w.Write([]byte(res.Msg))
@@ -408,7 +291,6 @@ func (svr *Service) apiProxyByTypeAndName(w http.ResponseWriter, r *http.Request

 	defer func() {
 		log.Infof("http response [%s]: code [%d]", r.URL.Path, res.Code)
-		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(res.Code)
 		if len(res.Msg) > 0 {
 			_, _ = w.Write([]byte(res.Msg))
@@ -477,7 +359,6 @@ func (svr *Service) apiProxyTraffic(w http.ResponseWriter, r *http.Request) {

 	defer func() {
 		log.Infof("http response [%s]: code [%d]", r.URL.Path, res.Code)
-		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(res.Code)
 		if len(res.Msg) > 0 {
 			_, _ = w.Write([]byte(res.Msg))
@@ -523,41 +404,3 @@ func (svr *Service) deleteProxies(w http.ResponseWriter, r *http.Request) {
 	cleared, total := mem.StatsCollector.ClearOfflineProxies()
 	log.Infof("cleared [%d] offline proxies, total [%d] proxies", cleared, total)
 }
-
-func buildClientInfoResp(info ClientInfo) clientInfoResp {
-	resp := clientInfoResp{
-		Key:              info.Key,
-		User:             info.User,
-		ClientID:         info.ClientID,
-		RunID:            info.RunID,
-		Hostname:         info.Hostname,
-		ClientIP:         info.IP,
-		FirstConnectedAt: toUnix(info.FirstConnectedAt),
-		LastConnectedAt:  toUnix(info.LastConnectedAt),
-		Online:           info.Online,
-	}
-	if !info.DisconnectedAt.IsZero() {
-		resp.DisconnectedAt = info.DisconnectedAt.Unix()
-	}
-	return resp
-}
-
-func toUnix(t time.Time) int64 {
-	if t.IsZero() {
-		return 0
-	}
-	return t.Unix()
-}
-
-func matchStatusFilter(online bool, filter string) bool {
-	switch strings.ToLower(filter) {
-	case "", "all":
-		return true
-	case "online":
-		return online
-	case "offline":
-		return !online
-	default:
-		return true
-	}
-}
@@ -1,197 +0,0 @@
-// Copyright 2025 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package group
-
-import (
-	"context"
-	"net"
-	"sync"
-
-	gerr "github.com/fatedier/golib/errors"
-
-	"github.com/fatedier/frp/pkg/util/vhost"
-)
-
-type HTTPSGroupController struct {
-	groups map[string]*HTTPSGroup
-
-	httpsMuxer *vhost.HTTPSMuxer
-
-	mu sync.Mutex
-}
-
-func NewHTTPSGroupController(httpsMuxer *vhost.HTTPSMuxer) *HTTPSGroupController {
-	return &HTTPSGroupController{
-		groups:     make(map[string]*HTTPSGroup),
-		httpsMuxer: httpsMuxer,
-	}
-}
-
-func (ctl *HTTPSGroupController) Listen(
-	ctx context.Context,
-	group, groupKey string,
-	routeConfig vhost.RouteConfig,
-) (l net.Listener, err error) {
-	indexKey := group
-	ctl.mu.Lock()
-	g, ok := ctl.groups[indexKey]
-	if !ok {
-		g = NewHTTPSGroup(ctl)
-		ctl.groups[indexKey] = g
-	}
-	ctl.mu.Unlock()
-
-	return g.Listen(ctx, group, groupKey, routeConfig)
-}
-
-func (ctl *HTTPSGroupController) RemoveGroup(group string) {
-	ctl.mu.Lock()
-	defer ctl.mu.Unlock()
-	delete(ctl.groups, group)
-}
-
-type HTTPSGroup struct {
-	group    string
-	groupKey string
-	domain   string
-
-	acceptCh chan net.Conn
-	httpsLn  *vhost.Listener
-	lns      []*HTTPSGroupListener
-	ctl      *HTTPSGroupController
-	mu       sync.Mutex
-}
-
-func NewHTTPSGroup(ctl *HTTPSGroupController) *HTTPSGroup {
-	return &HTTPSGroup{
-		lns:      make([]*HTTPSGroupListener, 0),
-		ctl:      ctl,
-		acceptCh: make(chan net.Conn),
-	}
-}
-
-func (g *HTTPSGroup) Listen(
-	ctx context.Context,
-	group, groupKey string,
-	routeConfig vhost.RouteConfig,
-) (ln *HTTPSGroupListener, err error) {
-	g.mu.Lock()
-	defer g.mu.Unlock()
-	if len(g.lns) == 0 {
-		// the first listener, listen on the real address
-		httpsLn, errRet := g.ctl.httpsMuxer.Listen(ctx, &routeConfig)
-		if errRet != nil {
-			return nil, errRet
-		}
-		ln = newHTTPSGroupListener(group, g, httpsLn.Addr())
-
-		g.group = group
-		g.groupKey = groupKey
-		g.domain = routeConfig.Domain
-		g.httpsLn = httpsLn
-		g.lns = append(g.lns, ln)
-		go g.worker()
-	} else {
-		// route config in the same group must be equal
-		if g.group != group || g.domain != routeConfig.Domain {
-			return nil, ErrGroupParamsInvalid
-		}
-		if g.groupKey != groupKey {
-			return nil, ErrGroupAuthFailed
-		}
-		ln = newHTTPSGroupListener(group, g, g.lns[0].Addr())
-		g.lns = append(g.lns, ln)
-	}
-	return
-}
-
-func (g *HTTPSGroup) worker() {
-	for {
-		c, err := g.httpsLn.Accept()
-		if err != nil {
-			return
-		}
-		err = gerr.PanicToError(func() {
-			g.acceptCh <- c
-		})
-		if err != nil {
-			return
-		}
-	}
-}
-
-func (g *HTTPSGroup) Accept() <-chan net.Conn {
-	return g.acceptCh
-}
-
-func (g *HTTPSGroup) CloseListener(ln *HTTPSGroupListener) {
-	g.mu.Lock()
-	defer g.mu.Unlock()
-	for i, tmpLn := range g.lns {
-		if tmpLn == ln {
-			g.lns = append(g.lns[:i], g.lns[i+1:]...)
-			break
-		}
-	}
-	if len(g.lns) == 0 {
-		close(g.acceptCh)
-		if g.httpsLn != nil {
-			g.httpsLn.Close()
-		}
-		g.ctl.RemoveGroup(g.group)
-	}
-}
-
-type HTTPSGroupListener struct {
-	groupName string
-	group     *HTTPSGroup
-
-	addr    net.Addr
-	closeCh chan struct{}
-}
-
-func newHTTPSGroupListener(name string, group *HTTPSGroup, addr net.Addr) *HTTPSGroupListener {
-	return &HTTPSGroupListener{
-		groupName: name,
-		group:     group,
-		addr:      addr,
-		closeCh:   make(chan struct{}),
-	}
-}
-
-func (ln *HTTPSGroupListener) Accept() (c net.Conn, err error) {
-	var ok bool
-	select {
-	case <-ln.closeCh:
-		return nil, ErrListenerClosed
-	case c, ok = <-ln.group.Accept():
-		if !ok {
-			return nil, ErrListenerClosed
-		}
-		return c, nil
-	}
-}
-
-func (ln *HTTPSGroupListener) Addr() net.Addr {
-	return ln.addr
-}
-
-func (ln *HTTPSGroupListener) Close() (err error) {
-	close(ln.closeCh)
-
-	// remove self from HTTPSGroup
-	ln.group.CloseListener(ln)
-	return
-}
@@ -165,7 +165,7 @@ func (pxy *HTTPProxy) GetRealConn(remoteAddr string) (workConn net.Conn, err err

 	var rwc io.ReadWriteCloser = tmpConn
 	if pxy.cfg.Transport.UseEncryption {
-		rwc, err = libio.WithEncryption(rwc, pxy.encryptionKey)
+		rwc, err = libio.WithEncryption(rwc, []byte(pxy.serverCfg.Auth.Token))
 		if err != nil {
 			xl.Errorf("create encryption stream error: %v", err)
 			return
@@ -15,7 +15,6 @@
 package proxy

 import (
-	"net"
 	"reflect"
 	"strings"

@@ -59,24 +58,27 @@ func (pxy *HTTPSProxy) Run() (remoteAddr string, err error) {
 			continue
 		}

-		l, err := pxy.listenForDomain(routeConfig, domain)
-		if err != nil {
-			return "", err
+		routeConfig.Domain = domain
+		l, errRet := pxy.rc.VhostHTTPSMuxer.Listen(pxy.ctx, routeConfig)
+		if errRet != nil {
+			err = errRet
+			return
 		}
+		xl.Infof("https proxy listen for host [%s]", routeConfig.Domain)
 		pxy.listeners = append(pxy.listeners, l)
-		addrs = append(addrs, util.CanonicalAddr(domain, pxy.serverCfg.VhostHTTPSPort))
-		xl.Infof("https proxy listen for host [%s] group [%s]", domain, pxy.cfg.LoadBalancer.Group)
+		addrs = append(addrs, util.CanonicalAddr(routeConfig.Domain, pxy.serverCfg.VhostHTTPSPort))
 	}

 	if pxy.cfg.SubDomain != "" {
-		domain := pxy.cfg.SubDomain + "." + pxy.serverCfg.SubDomainHost
-		l, err := pxy.listenForDomain(routeConfig, domain)
-		if err != nil {
-			return "", err
+		routeConfig.Domain = pxy.cfg.SubDomain + "." + pxy.serverCfg.SubDomainHost
+		l, errRet := pxy.rc.VhostHTTPSMuxer.Listen(pxy.ctx, routeConfig)
+		if errRet != nil {
+			err = errRet
+			return
 		}
+		xl.Infof("https proxy listen for host [%s]", routeConfig.Domain)
 		pxy.listeners = append(pxy.listeners, l)
-		addrs = append(addrs, util.CanonicalAddr(domain, pxy.serverCfg.VhostHTTPSPort))
-		xl.Infof("https proxy listen for host [%s] group [%s]", domain, pxy.cfg.LoadBalancer.Group)
+		addrs = append(addrs, util.CanonicalAddr(routeConfig.Domain, pxy.serverCfg.VhostHTTPSPort))
 	}

 	pxy.startCommonTCPListenersHandler()
@@ -87,18 +89,3 @@ func (pxy *HTTPSProxy) Run() (remoteAddr string, err error) {
 func (pxy *HTTPSProxy) Close() {
 	pxy.BaseProxy.Close()
 }
-
-func (pxy *HTTPSProxy) listenForDomain(routeConfig *vhost.RouteConfig, domain string) (net.Listener, error) {
-	tmpRouteConfig := *routeConfig
-	tmpRouteConfig.Domain = domain
-
-	if pxy.cfg.LoadBalancer.Group != "" {
-		return pxy.rc.HTTPSGroupCtl.Listen(
-			pxy.ctx,
-			pxy.cfg.LoadBalancer.Group,
-			pxy.cfg.LoadBalancer.GroupKey,
-			tmpRouteConfig,
-		)
-	}
-	return pxy.rc.VhostHTTPSMuxer.Listen(pxy.ctx, &tmpRouteConfig)
-}
@@ -68,7 +68,6 @@ type BaseProxy struct {
 	poolCount     int
 	getWorkConnFn GetWorkConnFn
 	serverCfg     *v1.ServerConfig
-	encryptionKey []byte
 	limiter       *rate.Limiter
 	userInfo      plugin.UserInfo
 	loginMsg      *msg.Login
@@ -214,6 +213,7 @@ func (pxy *BaseProxy) handleUserTCPConnection(userConn net.Conn) {
 	xl := xlog.FromContextSafe(pxy.Context())
 	defer userConn.Close()

+	serverCfg := pxy.serverCfg
 	cfg := pxy.configurer.GetBaseConfig()
 	// server plugin hook
 	rc := pxy.GetResourceController()
@@ -240,7 +240,7 @@ func (pxy *BaseProxy) handleUserTCPConnection(userConn net.Conn) {
 	xl.Tracef("handler user tcp connection, use_encryption: %t, use_compression: %t",
 		cfg.Transport.UseEncryption, cfg.Transport.UseCompression)
 	if cfg.Transport.UseEncryption {
-		local, err = libio.WithEncryption(local, pxy.encryptionKey)
+		local, err = libio.WithEncryption(local, []byte(serverCfg.Auth.Token))
 		if err != nil {
 			xl.Errorf("create encryption stream error: %v", err)
 			return
@@ -279,7 +279,6 @@ type Options struct {
 	GetWorkConnFn      GetWorkConnFn
 	Configurer         v1.ProxyConfigurer
 	ServerCfg          *v1.ServerConfig
-	EncryptionKey      []byte
 }

 func NewProxy(ctx context.Context, options *Options) (pxy Proxy, err error) {
@@ -299,7 +298,6 @@ func NewProxy(ctx context.Context, options *Options) (pxy Proxy, err error) {
 		poolCount:     options.PoolCount,
 		getWorkConnFn: options.GetWorkConnFn,
 		serverCfg:     options.ServerCfg,
-		encryptionKey: options.EncryptionKey,
 		limiter:       limiter,
 		xl:            xl,
 		ctx:           xlog.NewContext(ctx, xl),
@@ -205,7 +205,7 @@ func (pxy *UDPProxy) Run() (remoteAddr string, err error) {

 			var rwc io.ReadWriteCloser = workConn
 			if pxy.cfg.Transport.UseEncryption {
-				rwc, err = libio.WithEncryption(rwc, pxy.encryptionKey)
+				rwc, err = libio.WithEncryption(rwc, []byte(pxy.serverCfg.Auth.Token))
 				if err != nil {
 					xl.Errorf("create encryption stream error: %v", err)
 					workConn.Close()
@@ -96,9 +96,6 @@ type Service struct {
 	// Manage all controllers
 	ctlManager *ControlManager

-	// Track logical clients keyed by user.clientID.
-	clientRegistry *ClientRegistry
-
 	// Manage all proxies
 	pxyManager *proxy.Manager

@@ -116,8 +113,8 @@ type Service struct {

 	sshTunnelGateway *ssh.Gateway

-	// Auth runtime and encryption materials
-	auth *auth.ServerAuth
+	// Verifies authentication based on selected method
+	authVerifier auth.Verifier

 	tlsConfig *tls.Config

@@ -152,16 +149,10 @@ func NewService(cfg *v1.ServerConfig) (*Service, error) {
 		}
 	}

-	authRuntime, err := auth.BuildServerAuth(&cfg.Auth)
-	if err != nil {
-		return nil, err
-	}
-
 	svr := &Service{
-		ctlManager:     NewControlManager(),
-		clientRegistry: NewClientRegistry(),
-		pxyManager:     proxy.NewManager(),
-		pluginManager:  plugin.NewManager(),
+		ctlManager:    NewControlManager(),
+		pxyManager:    proxy.NewManager(),
+		pluginManager: plugin.NewManager(),
 		rc: &controller.ResourceController{
 			VisitorManager: visitor.NewManager(),
 			TCPPortManager: ports.NewManager("tcp", cfg.ProxyBindAddr, cfg.AllowPorts),
@@ -169,7 +160,7 @@ func NewService(cfg *v1.ServerConfig) (*Service, error) {
 		},
 		sshTunnelListener: netpkg.NewInternalListener(),
 		httpVhostRouter:   vhost.NewRouters(),
-		auth:              authRuntime,
+		authVerifier:      auth.NewAuthVerifier(cfg.Auth),
 		webServer:         webServer,
 		tlsConfig:         tlsConfig,
 		cfg:               cfg,
@@ -331,9 +322,6 @@ func NewService(cfg *v1.ServerConfig) (*Service, error) {
 		if err != nil {
 			return nil, fmt.Errorf("create vhost httpsMuxer error, %v", err)
 		}
-
-		// Init HTTPS group controller after HTTPSMuxer is created
-		svr.rc.HTTPSGroupCtl = group.NewHTTPSGroupController(svr.rc.VhostHTTPSMuxer)
 	}

 	// frp tls listener
@@ -595,7 +583,7 @@ func (svr *Service) RegisterControl(ctlConn net.Conn, loginMsg *msg.Login, inter
 		ctlConn.RemoteAddr().String(), loginMsg.Version, loginMsg.Hostname, loginMsg.Os, loginMsg.Arch)

 	// Check auth.
-	authVerifier := svr.auth.Verifier
+	authVerifier := svr.authVerifier
 	if internal && loginMsg.ClientSpec.AlwaysAuthPass {
 		authVerifier = auth.AlwaysPassVerifier
 	}
@@ -604,29 +592,16 @@ func (svr *Service) RegisterControl(ctlConn net.Conn, loginMsg *msg.Login, inter
 	}

 	// TODO(fatedier): use SessionContext
-	ctl, err := NewControl(ctx, svr.rc, svr.pxyManager, svr.pluginManager, authVerifier, svr.auth.EncryptionKey(), ctlConn, !internal, loginMsg, svr.cfg)
+	ctl, err := NewControl(ctx, svr.rc, svr.pxyManager, svr.pluginManager, authVerifier, ctlConn, !internal, loginMsg, svr.cfg)
 	if err != nil {
 		xl.Warnf("create new controller error: %v", err)
 		// don't return detailed errors to client
 		return fmt.Errorf("unexpected error when creating new controller")
 	}
-
 	if oldCtl := svr.ctlManager.Add(loginMsg.RunID, ctl); oldCtl != nil {
 		oldCtl.WaitClosed()
 	}

-	remoteAddr := ctlConn.RemoteAddr().String()
-	if host, _, err := net.SplitHostPort(remoteAddr); err == nil {
-		remoteAddr = host
-	}
-	_, conflict := svr.clientRegistry.Register(loginMsg.User, loginMsg.ClientID, loginMsg.RunID, loginMsg.Hostname, remoteAddr)
-	if conflict {
-		svr.ctlManager.Del(loginMsg.RunID, ctl)
-		ctl.Close()
-		return fmt.Errorf("client_id [%s] for user [%s] is already online", loginMsg.ClientID, loginMsg.User)
-	}
-	ctl.clientRegistry = svr.clientRegistry
-
 	ctl.Start()

 	// for statistics
@@ -75,8 +75,8 @@ func (f *Framework) RunFrps(args ...string) (*process.Process, string, error) {
 	if err != nil {
 		return p, p.StdOutput(), err
 	}
-	// Give frps extra time to finish binding ports before proceeding.
-	time.Sleep(4 * time.Second)
+	// sleep for a while to get std output
+	time.Sleep(2 * time.Second)
 	return p, p.StdOutput(), nil
 }

@@ -29,18 +29,6 @@ import (
 var _ = ginkgo.Describe("[Feature: TokenSource]", func() {
 	f := framework.NewDefaultFramework()

-	createExecTokenScript := func(name string) string {
-		scriptPath := filepath.Join(f.TempDirectory, name)
-		scriptContent := `#!/bin/sh
-printf '%s\n' "$1"
-`
-		err := os.WriteFile(scriptPath, []byte(scriptContent), 0o600)
-		framework.ExpectNoError(err)
-		err = os.Chmod(scriptPath, 0o700)
-		framework.ExpectNoError(err)
-		return scriptPath
-	}
-
 	ginkgo.Describe("File-based token loading", func() {
 		ginkgo.It("should work with file tokenSource", func() {
 			// Create a temporary token file
@@ -226,154 +214,4 @@ auth.tokenSource.file.path = "%s"
 			f.RunProcesses([]string{serverConf}, []string{})
 		})
 	})
-
-	ginkgo.Describe("Exec-based token loading", func() {
-		ginkgo.It("should work with server tokenSource", func() {
-			execValue := "exec-server-value"
-			scriptPath := createExecTokenScript("server_token_exec.sh")
-
-			serverPort := f.AllocPort()
-			remotePort := f.AllocPort()
-
-			serverConf := fmt.Sprintf(`
-bindAddr = "0.0.0.0"
-bindPort = %d
-
-auth.tokenSource.type = "exec"
-auth.tokenSource.exec.command = %q
-auth.tokenSource.exec.args = [%q]
-`, serverPort, scriptPath, execValue)
-
-			clientConf := fmt.Sprintf(`
-serverAddr = "127.0.0.1"
-serverPort = %d
-loginFailExit = false
-auth.token = %q
-
-[[proxies]]
-name = "tcp"
-type = "tcp"
-localPort = %d
-remotePort = %d
-`, serverPort, execValue, f.PortByName(framework.TCPEchoServerPort), remotePort)
-
-			serverConfigPath := f.GenerateConfigFile(serverConf)
-			clientConfigPath := f.GenerateConfigFile(clientConf)
-
-			_, _, err := f.RunFrps("-c", serverConfigPath, "--allow-unsafe=TokenSourceExec")
-			framework.ExpectNoError(err)
-
-			_, _, err = f.RunFrpc("-c", clientConfigPath, "--allow-unsafe=TokenSourceExec")
-			framework.ExpectNoError(err)
-
-			framework.NewRequestExpect(f).Port(remotePort).Ensure()
-		})
-
-		ginkgo.It("should work with client tokenSource", func() {
-			execValue := "exec-client-value"
-			scriptPath := createExecTokenScript("client_token_exec.sh")
-
-			serverPort := f.AllocPort()
-			remotePort := f.AllocPort()
-
-			serverConf := fmt.Sprintf(`
-bindAddr = "0.0.0.0"
-bindPort = %d
-
-auth.token = %q
-`, serverPort, execValue)
-
-			clientConf := fmt.Sprintf(`
-serverAddr = "127.0.0.1"
-serverPort = %d
-loginFailExit = false
-
-auth.tokenSource.type = "exec"
-auth.tokenSource.exec.command = %q
-auth.tokenSource.exec.args = [%q]
-
-[[proxies]]
-name = "tcp"
-type = "tcp"
-localPort = %d
-remotePort = %d
-`, serverPort, scriptPath, execValue, f.PortByName(framework.TCPEchoServerPort), remotePort)
-
-			serverConfigPath := f.GenerateConfigFile(serverConf)
-			clientConfigPath := f.GenerateConfigFile(clientConf)
-
-			_, _, err := f.RunFrps("-c", serverConfigPath, "--allow-unsafe=TokenSourceExec")
-			framework.ExpectNoError(err)
-
-			_, _, err = f.RunFrpc("-c", clientConfigPath, "--allow-unsafe=TokenSourceExec")
-			framework.ExpectNoError(err)
-
-			framework.NewRequestExpect(f).Port(remotePort).Ensure()
-		})
-
-		ginkgo.It("should work with both server and client tokenSource", func() {
-			execValue := "exec-shared-value"
-			scriptPath := createExecTokenScript("shared_token_exec.sh")
-
-			serverPort := f.AllocPort()
-			remotePort := f.AllocPort()
-
-			serverConf := fmt.Sprintf(`
-bindAddr = "0.0.0.0"
-bindPort = %d
-
-auth.tokenSource.type = "exec"
-auth.tokenSource.exec.command = %q
-auth.tokenSource.exec.args = [%q]
-`, serverPort, scriptPath, execValue)
-
-			clientConf := fmt.Sprintf(`
-serverAddr = "127.0.0.1"
-serverPort = %d
-loginFailExit = false
-
-auth.tokenSource.type = "exec"
-auth.tokenSource.exec.command = %q
-auth.tokenSource.exec.args = [%q]
-
-[[proxies]]
-name = "tcp"
-type = "tcp"
-localPort = %d
-remotePort = %d
-`, serverPort, scriptPath, execValue, f.PortByName(framework.TCPEchoServerPort), remotePort)
-
-			serverConfigPath := f.GenerateConfigFile(serverConf)
-			clientConfigPath := f.GenerateConfigFile(clientConf)
-
-			_, _, err := f.RunFrps("-c", serverConfigPath, "--allow-unsafe=TokenSourceExec")
-			framework.ExpectNoError(err)
-
-			_, _, err = f.RunFrpc("-c", clientConfigPath, "--allow-unsafe=TokenSourceExec")
-			framework.ExpectNoError(err)
-
-			framework.NewRequestExpect(f).Port(remotePort).Ensure()
-		})
-
-		ginkgo.It("should fail validation without allow-unsafe", func() {
-			execValue := "exec-unsafe-value"
-			scriptPath := createExecTokenScript("unsafe_token_exec.sh")
-
-			serverPort := f.AllocPort()
-			serverConf := fmt.Sprintf(`
-bindAddr = "0.0.0.0"
-bindPort = %d
-
-auth.tokenSource.type = "exec"
-auth.tokenSource.exec.command = %q
-auth.tokenSource.exec.args = [%q]
-`, serverPort, scriptPath, execValue)
-
-			serverConfigPath := f.GenerateConfigFile(serverConf)
-
-			_, output, err := f.RunFrps("verify", "-c", serverConfigPath)
-			framework.ExpectNoError(err)
-			framework.ExpectContainSubstring(output, "unsafe feature \"TokenSourceExec\" is not enabled")
-		})
-	})
 })
@@ -1,7 +1,6 @@
 package features

 import (
-	"crypto/tls"
 	"fmt"
 	"strconv"
 	"sync"
@@ -9,7 +8,6 @@ import (

 	"github.com/onsi/ginkgo/v2"

-	"github.com/fatedier/frp/pkg/transport"
 	"github.com/fatedier/frp/test/e2e/framework"
 	"github.com/fatedier/frp/test/e2e/framework/consts"
 	"github.com/fatedier/frp/test/e2e/mock/server/httpserver"
@@ -114,80 +112,6 @@ var _ = ginkgo.Describe("[Feature: Group]", func() {

 			framework.ExpectTrue(fooCount > 1 && barCount > 1, "fooCount: %d, barCount: %d", fooCount, barCount)
 		})
-
-		ginkgo.It("HTTPS", func() {
-			vhostHTTPSPort := f.AllocPort()
-			serverConf := consts.DefaultServerConfig + fmt.Sprintf(`
-			vhostHTTPSPort = %d
-			`, vhostHTTPSPort)
-			clientConf := consts.DefaultClientConfig
-
-			tlsConfig, err := transport.NewServerTLSConfig("", "", "")
-			framework.ExpectNoError(err)
-
-			fooPort := f.AllocPort()
-			fooServer := httpserver.New(
-				httpserver.WithBindPort(fooPort),
-				httpserver.WithHandler(framework.SpecifiedHTTPBodyHandler([]byte("foo"))),
-				httpserver.WithTLSConfig(tlsConfig),
-			)
-			f.RunServer("", fooServer)
-
-			barPort := f.AllocPort()
-			barServer := httpserver.New(
-				httpserver.WithBindPort(barPort),
-				httpserver.WithHandler(framework.SpecifiedHTTPBodyHandler([]byte("bar"))),
-				httpserver.WithTLSConfig(tlsConfig),
-			)
-			f.RunServer("", barServer)
-
-			clientConf += fmt.Sprintf(`
-			[[proxies]]
-			name = "foo"
-			type = "https"
-			localPort = %d
-			customDomains = ["example.com"]
-			loadBalancer.group = "test"
-			loadBalancer.groupKey = "123"
-
-			[[proxies]]
-			name = "bar"
-			type = "https"
-			localPort = %d
-			customDomains = ["example.com"]
-			loadBalancer.group = "test"
-			loadBalancer.groupKey = "123"
-			`, fooPort, barPort)
-
-			f.RunProcesses([]string{serverConf}, []string{clientConf})
-
-			fooCount := 0
-			barCount := 0
-			for i := 0; i < 10; i++ {
-				framework.NewRequestExpect(f).
-					Explain("times " + strconv.Itoa(i)).
-					Port(vhostHTTPSPort).
-					RequestModify(func(r *request.Request) {
-						r.HTTPS().HTTPHost("example.com").TLSConfig(&tls.Config{
-							ServerName:         "example.com",
-							InsecureSkipVerify: true,
-						})
-					}).
-					Ensure(func(resp *request.Response) bool {
-						switch string(resp.Content) {
-						case "foo":
-							fooCount++
-						case "bar":
-							barCount++
-						default:
-							return false
-						}
-						return true
-					})
-			}
-
-			framework.ExpectTrue(fooCount > 1 && barCount > 1, "fooCount: %d, barCount: %d", fooCount, barCount)
-		})
 	})

 	ginkgo.Describe("Health Check", func() {
@@ -7,20 +7,18 @@ export {}

 declare module 'vue' {
  export interface GlobalComponents {
+    ClientConfigure: typeof import('./src/components/ClientConfigure.vue')['default']
    ElButton: typeof import('element-plus/es')['ElButton']
-    ElCard: typeof import('element-plus/es')['ElCard']
+    ElCol: typeof import('element-plus/es')['ElCol']
    ElInput: typeof import('element-plus/es')['ElInput']
    ElMenu: typeof import('element-plus/es')['ElMenu']
    ElMenuItem: typeof import('element-plus/es')['ElMenuItem']
+    ElRow: typeof import('element-plus/es')['ElRow']
    ElSwitch: typeof import('element-plus/es')['ElSwitch']
    ElTable: typeof import('element-plus/es')['ElTable']
    ElTableColumn: typeof import('element-plus/es')['ElTableColumn']
-    ElTag: typeof import('element-plus/es')['ElTag']
-    ElTooltip: typeof import('element-plus/es')['ElTooltip']
+    Overview: typeof import('./src/components/Overview.vue')['default']
    RouterLink: typeof import('vue-router')['RouterLink']
    RouterView: typeof import('vue-router')['RouterView']
  }
-  export interface ComponentCustomProperties {
-    vLoading: typeof import('element-plus/es')['ElLoadingDirective']
-  }
 }
@@ -3,7 +3,7 @@

 <head>
    <meta charset="utf-8">
-    <title>frp client</title>
+    <title>frp client admin UI</title>
 </head>

 <body>
@@ -11,30 +11,25 @@
    "lint": "eslint . --ext .vue,.js,.jsx,.cjs,.mjs,.ts,.tsx,.cts,.mts --fix --ignore-path .gitignore"
  },
  "dependencies": {
-    "element-plus": "^2.13.0",
-    "vue": "^3.5.26",
-    "vue-router": "^4.6.4"
+    "element-plus": "^2.5.3",
+    "vue": "^3.4.15",
+    "vue-router": "^4.2.5"
  },
  "devDependencies": {
-    "@rushstack/eslint-patch": "^1.15.0",
-    "@types/node": "24",
-    "@vitejs/plugin-vue": "^6.0.3",
+    "@rushstack/eslint-patch": "^1.7.2",
+    "@types/node": "^18.11.12",
+    "@vitejs/plugin-vue": "^5.0.3",
    "@vue/eslint-config-prettier": "^9.0.0",
    "@vue/eslint-config-typescript": "^12.0.0",
-    "@vue/tsconfig": "^0.8.1",
-    "@vueuse/core": "^14.1.0",
+    "@vue/tsconfig": "^0.5.1",
    "eslint": "^8.56.0",
-    "eslint-plugin-vue": "^9.33.0",
+    "eslint-plugin-vue": "^9.21.0",
    "npm-run-all": "^4.1.5",
-    "prettier": "^3.7.4",
-    "sass": "^1.97.2",
-    "terser": "^5.44.1",
-    "typescript": "^5.9.3",
+    "prettier": "^3.2.4",
+    "typescript": "~5.3.3",
    "unplugin-auto-import": "^0.17.5",
-    "unplugin-element-plus": "^0.11.2",
    "unplugin-vue-components": "^0.26.0",
-    "vite": "^7.3.0",
-    "vite-svg-loader": "^5.1.0",
-    "vue-tsc": "^3.2.2"
+    "vite": "^5.0.12",
+    "vue-tsc": "^1.8.27"
  }
-}
+}
@@ -1,295 +1,116 @@
 <template>
  <div id="app">
-    <header class="header">
-      <div class="header-top">
+    <header class="grid-content header-color">
+      <div class="header-content">
        <div class="brand">
-          <a href="#" @click.prevent="router.push('/')">frpc</a>
+          <a href="#">frp client</a>
        </div>
-        <div class="header-actions">
-          <a
-            class="github-link"
-            href="https://github.com/fatedier/frp"
-            target="_blank"
-            aria-label="GitHub"
-          >
-            <GitHubIcon class="github-icon" />
-          </a>
+        <div class="dark-switch">
          <el-switch
            v-model="darkmodeSwitch"
            inline-prompt
-            :active-icon="Moon"
-            :inactive-icon="Sunny"
+            active-text="Dark"
+            inactive-text="Light"
            @change="toggleDark"
-            class="theme-switch"
+            style="
+              --el-switch-on-color: #444452;
+              --el-switch-off-color: #589ef8;
+            "
          />
        </div>
      </div>
-      <nav class="header-nav">
-        <el-menu
-          :default-active="currentRoute"
-          mode="horizontal"
-          :ellipsis="false"
-          @select="handleSelect"
-          class="nav-menu"
-        >
-          <el-menu-item index="/">Overview</el-menu-item>
-          <el-menu-item index="/configure">Configure</el-menu-item>
-        </el-menu>
-      </nav>
    </header>
-    <main id="content">
-      <router-view></router-view>
-    </main>
+    <section>
+      <el-row>
+        <el-col id="side-nav" :xs="24" :md="4">
+          <el-menu
+            default-active="1"
+            mode="vertical"
+            theme="light"
+            router="false"
+            @select="handleSelect"
+          >
+            <el-menu-item index="/">Overview</el-menu-item>
+            <el-menu-item index="/configure">Configure</el-menu-item>
+            <el-menu-item index="">Help</el-menu-item>
+          </el-menu>
+        </el-col>
+
+        <el-col :xs="24" :md="20">
+          <div id="content">
+            <router-view></router-view>
+          </div>
+        </el-col>
+      </el-row>
+    </section>
+    <footer></footer>
  </div>
 </template>

 <script setup lang="ts">
-import { ref, computed } from 'vue'
-import { useRouter, useRoute } from 'vue-router'
+import { ref } from 'vue'
 import { useDark, useToggle } from '@vueuse/core'
-import { Moon, Sunny } from '@element-plus/icons-vue'
-import GitHubIcon from './assets/icons/github.svg?component'

-const router = useRouter()
-const route = useRoute()
 const isDark = useDark()
 const darkmodeSwitch = ref(isDark)
 const toggleDark = useToggle(isDark)

-const currentRoute = computed(() => {
-  return route.path
-})
-
 const handleSelect = (key: string) => {
-  router.push(key)
+  if (key == '') {
+    window.open('https://github.com/fatedier/frp')
+  }
 }
 </script>

 <style>
 body {
-  margin: 0;
-  font-family:
-    -apple-system,
-    BlinkMacSystemFont,
-    Helvetica Neue,
-    sans-serif;
+  margin: 0px;
+  font-family: -apple-system, BlinkMacSystemFont, Helvetica Neue, sans-serif;
 }

-#app {
-  min-height: 100vh;
-  display: flex;
-  flex-direction: column;
-  background: #f2f2f2;
+header {
+  width: 100%;
+  height: 60px;
 }

-html.dark #app {
-  background: #1a1a2e;
+.header-color {
+  background: #58b7ff;
 }

-.header {
-  position: sticky;
-  top: 0;
-  z-index: 100;
-  background: #fff;
+html.dark .header-color {
+  background: #395c74;
 }

-html.dark .header {
-  background: #1e1e2d;
-}
-
-.header-top {
+.header-content {
  display: flex;
  align-items: center;
-  justify-content: space-between;
-  height: 48px;
-  padding: 0 32px;
-}
-
-.brand a {
-  color: #303133;
-  font-size: 20px;
-  font-weight: 700;
-  text-decoration: none;
-  letter-spacing: -0.5px;
-}
-
-html.dark .brand a {
-  color: #e5e7eb;
-}
-
-.brand a:hover {
-  color: #409eff;
-}
-
-.header-actions {
-  display: flex;
-  align-items: center;
-  gap: 16px;
-}
-
-.github-link {
-  display: flex;
-  align-items: center;
-  padding: 6px;
-  border-radius: 6px;
-  transition: all 0.2s;
-}
-
-.github-link:hover {
-  background: #f2f3f5;
-}
-
-html.dark .github-link:hover {
-  background: #2a2a3c;
-}
-
-.github-icon {
-  width: 20px;
-  height: 20px;
-  color: #606266;
-  transition: color 0.2s;
-}
-
-.github-link:hover .github-icon {
-  color: #303133;
-}
-
-html.dark .github-icon {
-  color: #a0a3ad;
-}
-
-html.dark .github-link:hover .github-icon {
-  color: #e5e7eb;
-}
-
-.theme-switch {
-  --el-switch-on-color: #2c2c3a;
-  --el-switch-off-color: #f2f2f2;
-  --el-switch-border-color: #dcdfe6;
-}
-
-.theme-switch .el-switch__core .el-switch__inner .el-icon {
-  color: #909399 !important;
-}
-
-.header-nav {
-  position: relative;
-  padding: 0 32px;
-  border-bottom: 1px solid #e4e7ed;
-}
-
-html.dark .header-nav {
-  border-bottom-color: #3a3d5c;
-}
-
-.nav-menu {
-  background: transparent !important;
-  border-bottom: none !important;
-  height: 46px;
-}
-
-.nav-menu .el-menu-item,
-.nav-menu .el-sub-menu__title {
-  position: relative;
-  height: 32px !important;
-  line-height: 32px !important;
-  border-bottom: none !important;
-  border-radius: 6px !important;
-  color: #666 !important;
-  font-weight: 400;
-  font-size: 14px;
-  padding: 0 12px !important;
-  margin: 7px 0;
-  transition:
-    background 0.15s ease,
-    color 0.15s ease;
-}
-
-.nav-menu > .el-menu-item,
-.nav-menu > .el-sub-menu {
-  margin-right: 4px;
-}
-
-.nav-menu > .el-sub-menu {
-  padding: 0 !important;
-}
-
-html.dark .nav-menu .el-menu-item,
-html.dark .nav-menu .el-sub-menu__title {
-  color: #888 !important;
-}
-
-.nav-menu .el-menu-item:hover,
-.nav-menu .el-sub-menu__title:hover {
-  background: #f2f2f2 !important;
-  color: #171717 !important;
-}
-
-html.dark .nav-menu .el-menu-item:hover,
-html.dark .nav-menu .el-sub-menu__title:hover {
-  background: #2a2a3c !important;
-  color: #e5e7eb !important;
-}
-
-.nav-menu .el-menu-item.is-active {
-  background: transparent !important;
-  color: #171717 !important;
-  font-weight: 500;
-}
-
-.nav-menu .el-menu-item.is-active::after {
-  content: '';
-  position: absolute;
-  left: 0;
-  right: 0;
-  bottom: -3px;
-  height: 2px;
-  background: #171717;
-  border-radius: 1px;
-}
-
-.nav-menu .el-menu-item.is-active:hover {
-  background: #f2f2f2 !important;
-}
-
-html.dark .nav-menu .el-menu-item.is-active {
-  background: transparent !important;
-  color: #e5e7eb !important;
-  font-weight: 500;
-}
-
-html.dark .nav-menu .el-menu-item.is-active::after {
-  background: #e5e7eb;
-}
-
-html.dark .nav-menu .el-menu-item.is-active:hover {
-  background: #2a2a3c !important;
 }

 #content {
-  flex: 1;
-  padding: 24px 40px;
-  max-width: 1400px;
-  margin: 0 auto;
-  width: 100%;
-  box-sizing: border-box;
+  margin-top: 20px;
+  padding-right: 40px;
 }

-@media (max-width: 768px) {
-  .header-top {
-    padding: 0 16px;
-  }
-
-  .header-nav {
-    padding: 0 16px;
-  }
-
-  #content {
-    padding: 16px;
-  }
-
-  .brand a {
-    font-size: 18px;
-  }
+.brand {
+  display: flex;
+  justify-content: flex-start;
 }
-</style>
+
+.brand a {
+  color: #fff;
+  background-color: transparent;
+  margin-left: 20px;
+  line-height: 25px;
+  font-size: 25px;
+  padding: 15px 15px;
+  height: 30px;
+  text-decoration: none;
+}
+
+.dark-switch {
+  display: flex;
+  justify-content: flex-end;
+  flex-grow: 1;
+  padding-right: 40px;
+}
+</style>
@@ -1,18 +0,0 @@
-import { http } from './http'
-import type { StatusResponse } from '../types/proxy'
-
-export const getStatus = () => {
-  return http.get<StatusResponse>('/api/status')
-}
-
-export const getConfig = () => {
-  return http.get<string>('/api/config')
-}
-
-export const putConfig = (content: string) => {
-  return http.put<void>('/api/config', content)
-}
-
-export const reloadConfig = () => {
-  return http.get<void>('/api/reload')
-}
@@ -1,76 +0,0 @@
-// http.ts - Base HTTP client
-
-class HTTPError extends Error {
-  status: number
-  statusText: string
-
-  constructor(status: number, statusText: string, message?: string) {
-    super(message || statusText)
-    this.status = status
-    this.statusText = statusText
-  }
-}
-
-async function request<T>(url: string, options: RequestInit = {}): Promise<T> {
-  const defaultOptions: RequestInit = {
-    credentials: 'include',
-  }
-
-  const response = await fetch(url, { ...defaultOptions, ...options })
-
-  if (!response.ok) {
-    throw new HTTPError(response.status, response.statusText, `HTTP ${response.status}`)
-  }
-
-  // Handle empty response (e.g. 204 No Content)
-  if (response.status === 204) {
-    return {} as T
-  }
-
-  const contentType = response.headers.get('content-type')
-  if (contentType && contentType.includes('application/json')) {
-    return response.json()
-  }
-  return response.text() as unknown as T
-}
-
-export const http = {
-  get: <T>(url: string, options?: RequestInit) => request<T>(url, { ...options, method: 'GET' }),
-  post: <T>(url: string, body?: any, options?: RequestInit) => {
-    const headers: HeadersInit = { ...options?.headers }
-    let requestBody = body
-
-    if (body && typeof body === 'object' && !(body instanceof FormData) && !(body instanceof Blob)) {
-        if (!('Content-Type' in headers)) {
-             (headers as any)['Content-Type'] = 'application/json'
-        }
-        requestBody = JSON.stringify(body)
-    }
-
-    return request<T>(url, { 
-      ...options, 
-      method: 'POST', 
-      headers,
-      body: requestBody
-    })
-  },
-  put: <T>(url: string, body?: any, options?: RequestInit) => {
-    const headers: HeadersInit = { ...options?.headers }
-    let requestBody = body
-
-    if (body && typeof body === 'object' && !(body instanceof FormData) && !(body instanceof Blob)) {
-        if (!('Content-Type' in headers)) {
-             (headers as any)['Content-Type'] = 'application/json'
-        }
-        requestBody = JSON.stringify(body)
-    }
-
-    return request<T>(url, { 
-      ...options, 
-      method: 'PUT', 
-      headers,
-      body: requestBody
-    })
-  },
-  delete: <T>(url: string, options?: RequestInit) => request<T>(url, { ...options, method: 'DELETE' }),
-}
@@ -1,89 +0,0 @@
-.el-form-item span {
-  margin-left: 15px;
-}
-
-.proxy-table-expand {
-  font-size: 0;
-}
-
-.proxy-table-expand .el-form-item__label{
-  width: 90px;
-  color: #99a9bf;
-}
-
-.proxy-table-expand .el-form-item {
-  margin-right: 0;
-  margin-bottom: 0;
-  width: 50%;
-}
-
-.el-table .el-table__expanded-cell {
-  padding: 20px 50px;
-}
-
-/* Modern styles */
-* {
-  box-sizing: border-box;
-}
-
-/* Smooth transitions */
-.el-button,
-.el-card,
-.el-input,
-.el-select,
-.el-tag {
-  transition: all 0.3s ease;
-}
-
-/* Card hover effects */
-.el-card:hover {
-  box-shadow: 0 8px 16px rgba(0, 0, 0, 0.1);
-}
-
-/* Better scrollbar */
-::-webkit-scrollbar {
-  width: 8px;
-  height: 8px;
-}
-
-::-webkit-scrollbar-track {
-  background: #f1f1f1;
-  border-radius: 4px;
-}
-
-::-webkit-scrollbar-thumb {
-  background: #c1c1c1;
-  border-radius: 4px;
-}
-
-::-webkit-scrollbar-thumb:hover {
-  background: #a8a8a8;
-}
-
-/* Page headers */
-.el-page-header {
-  padding: 16px 0;
-}
-
-.el-page-header__title {
-  font-size: 20px;
-  font-weight: 600;
-}
-
-/* Better form layouts */
-.el-form-item {
-  margin-bottom: 18px;
-}
-
-/* Responsive adjustments */
-@media (max-width: 768px) {
-  .el-row {
-    margin-left: 0 !important;
-    margin-right: 0 !important;
-  }
-
-  .el-col {
-    padding-left: 10px !important;
-    padding-right: 10px !important;
-  }
-}
@@ -1,58 +0,0 @@
-html.dark {
-  --el-bg-color: #1e1e2e;
-  --el-fill-color-blank: #1e1e2e;
-  background-color: #1e1e2e;
-}
-
-html.dark body {
-  background-color: #1e1e2e;
-  color: #e5e7eb;
-}
-
-/* Dark mode scrollbar */
-html.dark ::-webkit-scrollbar-track {
-  background: #27293d;
-}
-
-html.dark ::-webkit-scrollbar-thumb {
-  background: #3a3d5c;
-}
-
-html.dark ::-webkit-scrollbar-thumb:hover {
-  background: #4a4d6c;
-}
-
-/* Dark mode cards */
-html.dark .el-card {
-  background-color: #27293d;
-  border-color: #3a3d5c;
-}
-
-/* Dark mode inputs */
-html.dark .el-input__wrapper {
-  background-color: #27293d;
-  border-color: #3a3d5c;
-}
-
-html.dark .el-input__inner {
-  color: #e5e7eb;
-}
-
-/* Dark mode table */
-html.dark .el-table {
-  background-color: #27293d;
-  color: #e5e7eb;
-}
-
-html.dark .el-table th {
-  background-color: #1e1e2e;
-  color: #e5e7eb;
-}
-
-html.dark .el-table tr {
-  background-color: #27293d;
-}
-
-html.dark .el-table--striped .el-table__body tr.el-table__row--striped td {
-  background-color: #1e1e2e;
-}
@@ -0,0 +1,5 @@
+html.dark {
+  --el-bg-color: #343432;
+  --el-fill-color-blank: #343432;
+  background-color: #343432;
+}
@@ -1,3 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" fill="currentColor">
-  <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
-</svg>
@@ -0,0 +1,102 @@
+<template>
+  <div>
+    <el-row id="head">
+      <el-button type="primary" @click="fetchData">Refresh</el-button>
+      <el-button type="primary" @click="uploadConfig">Upload</el-button>
+    </el-row>
+    <el-input
+      type="textarea"
+      autosize
+      v-model="textarea"
+      placeholder="frpc configure file, can not be empty..."
+    ></el-input>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref } from 'vue'
+import { ElMessage, ElMessageBox } from 'element-plus'
+
+let textarea = ref('')
+
+const fetchData = () => {
+  fetch('/api/config', { credentials: 'include' })
+    .then((res) => {
+      return res.text()
+    })
+    .then((text) => {
+      textarea.value = text
+    })
+    .catch(() => {
+      ElMessage({
+        showClose: true,
+        message: 'Get configure content from frpc failed!',
+        type: 'warning',
+      })
+    })
+}
+
+const uploadConfig = () => {
+  ElMessageBox.confirm(
+    'This operation will upload your frpc configure file content and hot reload it, do you want to continue?',
+    'Notice',
+    {
+      confirmButtonText: 'Yes',
+      cancelButtonText: 'No',
+      type: 'warning',
+    }
+  )
+    .then(() => {
+      if (textarea.value == '') {
+        ElMessage({
+          message: 'Configure content can not be empty!',
+          type: 'warning',
+        })
+        return
+      }
+
+      fetch('/api/config', {
+        credentials: 'include',
+        method: 'PUT',
+        body: textarea.value,
+      })
+        .then(() => {
+          fetch('/api/reload', { credentials: 'include' })
+            .then(() => {
+              ElMessage({
+                type: 'success',
+                message: 'Success',
+              })
+            })
+            .catch((err) => {
+              ElMessage({
+                showClose: true,
+                message: 'Reload frpc configure file error, ' + err,
+                type: 'warning',
+              })
+            })
+        })
+        .catch(() => {
+          ElMessage({
+            showClose: true,
+            message: 'Put config to frpc and hot reload failed!',
+            type: 'warning',
+          })
+        })
+    })
+    .catch(() => {
+      ElMessage({
+        message: 'Canceled',
+        type: 'info',
+      })
+    })
+}
+
+fetchData()
+</script>
+
+<style>
+#head {
+  margin-bottom: 30px;
+}
+</style>
@@ -0,0 +1,85 @@
+<template>
+  <div>
+    <el-row>
+      <el-col :md="24">
+        <div>
+          <el-table
+            :data="status"
+            stripe
+            style="width: 100%"
+            :default-sort="{ prop: 'type', order: 'ascending' }"
+          >
+            <el-table-column
+              prop="name"
+              label="name"
+              sortable
+            ></el-table-column>
+            <el-table-column
+              prop="type"
+              label="type"
+              width="150"
+              sortable
+            ></el-table-column>
+            <el-table-column
+              prop="local_addr"
+              label="local address"
+              width="200"
+              sortable
+            ></el-table-column>
+            <el-table-column
+              prop="plugin"
+              label="plugin"
+              width="200"
+              sortable
+            ></el-table-column>
+            <el-table-column
+              prop="remote_addr"
+              label="remote address"
+              sortable
+            ></el-table-column>
+            <el-table-column
+              prop="status"
+              label="status"
+              width="150"
+              sortable
+            ></el-table-column>
+            <el-table-column prop="err" label="info"></el-table-column>
+          </el-table>
+        </div>
+      </el-col>
+    </el-row>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref } from 'vue'
+import { ElMessage } from 'element-plus'
+
+let status = ref<any[]>([])
+
+const fetchData = () => {
+  fetch('/api/status', { credentials: 'include' })
+    .then((res) => {
+      return res.json()
+    })
+    .then((json) => {
+      status.value = new Array()
+      for (let key in json) {
+        for (let ps of json[key]) {
+          console.log(ps)
+          status.value.push(ps)
+        }
+      }
+    })
+    .catch((err) => {
+      ElMessage({
+        showClose: true,
+        message: 'Get status info from frpc failed!' + err,
+        type: 'warning',
+      })
+    })
+}
+fetchData()
+</script>
+
+<style></style>
@@ -1,13 +1,13 @@
 import { createApp } from 'vue'
+import 'element-plus/dist/index.css'
 import 'element-plus/theme-chalk/dark/css-vars.css'
 import App from './App.vue'
 import router from './router'

-import './assets/css/custom.css'
-import './assets/css/dark.css'
+import './assets/dark.css'

 const app = createApp(App)

 app.use(router)

-app.mount('#app')
+app.mount('#app')
@@ -1,6 +1,6 @@
 import { createRouter, createWebHashHistory } from 'vue-router'
-import Overview from '../views/Overview.vue'
-import ClientConfigure from '../views/ClientConfigure.vue'
+import Overview from '../components/Overview.vue'
+import ClientConfigure from '../components/ClientConfigure.vue'

 const router = createRouter({
  history: createWebHashHistory(),
@@ -18,4 +18,4 @@ const router = createRouter({
  ],
 })

-export default router
+export default router
@@ -1,5 +0,0 @@
-declare module '*.svg?component' {
-  import type { DefineComponent } from 'vue'
-  const component: DefineComponent<object, object, unknown>
-  export default component
-}
@@ -1,12 +0,0 @@
-export interface ProxyStatus {
-    name: string
-    type: string
-    status: string
-    err: string
-    local_addr: string
-    plugin: string
-    remote_addr: string
-    [key: string]: any
-}
-
-export type StatusResponse = Record<string, ProxyStatus[]>
@@ -1,33 +0,0 @@
-export function formatDistanceToNow(date: Date): string {
-  const seconds = Math.floor((new Date().getTime() - date.getTime()) / 1000)
-
-  let interval = seconds / 31536000
-  if (interval > 1) return Math.floor(interval) + ' years ago'
-
-  interval = seconds / 2592000
-  if (interval > 1) return Math.floor(interval) + ' months ago'
-
-  interval = seconds / 86400
-  if (interval > 1) return Math.floor(interval) + ' days ago'
-
-  interval = seconds / 3600
-  if (interval > 1) return Math.floor(interval) + ' hours ago'
-
-  interval = seconds / 60
-  if (interval > 1) return Math.floor(interval) + ' minutes ago'
-
-  return Math.floor(seconds) + ' seconds ago'
-}
-
-export function formatFileSize(bytes: number): string {
-  if (!Number.isFinite(bytes) || bytes < 0) return '0 B'
-  if (bytes === 0) return '0 B'
-  const k = 1024
-  const sizes = ['B', 'KB', 'MB', 'GB', 'TB', 'PB', 'EB', 'ZB', 'YB']
-  const i = Math.floor(Math.log(bytes) / Math.log(k))
-  // Prevent index out of bounds for extremely large numbers
-  const unit = sizes[i] || sizes[sizes.length - 1]
-  const val = bytes / Math.pow(k, i)
-  
-  return parseFloat(val.toFixed(2)) + ' ' + unit
-}
@@ -1,115 +0,0 @@
-<template>
-  <div class="configure-page">
-    <el-card class="main-card" shadow="never">
-      <div class="toolbar-header">
-        <h2 class="card-title">Client Configuration</h2>
-        <div class="toolbar-actions">
-          <el-tooltip content="Refresh" placement="top">
-            <el-button :icon="Refresh" circle @click="fetchData" />
-          </el-tooltip>
-          <el-button type="primary" :icon="Upload" @click="handleUpload">Update</el-button>
-        </div>
-      </div>
-
-      <div class="config-editor">
-        <el-input
-          type="textarea"
-          :autosize="{ minRows: 10, maxRows: 30 }"
-          v-model="configContent"
-          placeholder="frpc configuration file content..."
-          class="code-input"
-        ></el-input>
-      </div>
-    </el-card>
-  </div>
-</template>
-
-<script setup lang="ts">
-import { ref } from 'vue'
-import { ElMessage, ElMessageBox } from 'element-plus'
-import { Refresh, Upload } from '@element-plus/icons-vue'
-import { getConfig, putConfig, reloadConfig } from '../api/frpc'
-
-const configContent = ref('')
-
-const fetchData = async () => {
-  try {
-    const text = await getConfig()
-    configContent.value = text
-  } catch (err: any) {
-    ElMessage({
-      showClose: true,
-      message: 'Get configuration failed: ' + err.message,
-      type: 'warning',
-    })
-  }
-}
-
-const handleUpload = () => {
-  ElMessageBox.confirm(
-    'This operation will update your frpc configuration and reload it. Do you want to continue?',
-    'Confirm Update',
-    {
-      confirmButtonText: 'Update',
-      cancelButtonText: 'Cancel',
-      type: 'warning',
-    }
-  )
-    .then(async () => {
-      if (!configContent.value.trim()) {
-        ElMessage({
-          message: 'Configuration content cannot be empty!',
-          type: 'warning',
-        })
-        return
-      }
-
-      try {
-        await putConfig(configContent.value)
-        await reloadConfig()
-        ElMessage({
-          type: 'success',
-          message: 'Configuration updated and reloaded successfully',
-        })
-      } catch (err: any) {
-        ElMessage({
-          showClose: true,
-          message: 'Update failed: ' + err.message,
-          type: 'error',
-        })
-      }
-    })
-    .catch(() => {
-        // cancelled
-    })
-}
-
-fetchData()
-</script>
-
-<style scoped>
-.main-card {
-  border-radius: 12px;
-  border: none;
-}
-
-.toolbar-header {
-  display: flex;
-  justify-content: space-between;
-  align-items: center;
-  margin-bottom: 20px;
-  border-bottom: 1px solid var(--el-border-color-lighter);
-  padding-bottom: 16px;
-}
-
-.card-title {
-    margin: 0;
-    font-size: 18px;
-    font-weight: 600;
-}
-
-.code-input {
-    font-family: 'Menlo', 'Monaco', 'Courier New', monospace;
-    font-size: 14px;
-}
-</style>
@@ -1,215 +0,0 @@
-<template>
-  <div class="overview-page">
-    <el-card class="main-card" shadow="never">
-      <div class="toolbar-header">
-        <h2 class="card-title">Proxy Status</h2>
-        <div class="toolbar-actions">
-          <el-input
-            v-model="searchText"
-            placeholder="Search..."
-            :prefix-icon="Search"
-            clearable
-            class="search-input"
-          />
-          <el-tooltip content="Refresh" placement="top">
-            <el-button :icon="Refresh" circle @click="fetchData" />
-          </el-tooltip>
-        </div>
-      </div>
-
-      <el-table
-        v-loading="loading"
-        :data="filteredStatus"
-        :default-sort="{ prop: 'name', order: 'ascending' }"
-        stripe
-        style="width: 100%"
-        class="proxy-table"
-      >
-        <el-table-column
-          prop="name"
-          label="Name"
-          sortable
-          min-width="120"
-        ></el-table-column>
-        <el-table-column
-          prop="type"
-          label="Type"
-          width="100"
-          sortable
-        >
-          <template #default="scope">
-            <span class="type-text">{{ scope.row.type }}</span>
-          </template>
-        </el-table-column>
-        <el-table-column
-          prop="local_addr"
-          label="Local Address"
-          min-width="150"
-          sortable
-          show-overflow-tooltip
-        ></el-table-column>
-        <el-table-column
-          prop="plugin"
-          label="Plugin"
-          width="120"
-          sortable
-          show-overflow-tooltip
-        ></el-table-column>
-        <el-table-column
-          prop="remote_addr"
-          label="Remote Address"
-          min-width="150"
-          sortable
-          show-overflow-tooltip
-        ></el-table-column>
-        <el-table-column
-          prop="status"
-          label="Status"
-          width="120"
-          sortable
-          align="center"
-        >
-          <template #default="scope">
-            <el-tag
-              :type="getStatusColor(scope.row.status)"
-              effect="light"
-              round
-            >
-              {{ scope.row.status }}
-            </el-tag>
-          </template>
-        </el-table-column>
-        <el-table-column prop="err" label="Info" min-width="150" show-overflow-tooltip>
-             <template #default="scope">
-                <span v-if="scope.row.err" class="error-text">{{ scope.row.err }}</span>
-                <span v-else>-</span>
-             </template>
-        </el-table-column>
-      </el-table>
-    </el-card>
-  </div>
-</template>
-
-<script setup lang="ts">
-import { ref, computed } from 'vue'
-import { ElMessage } from 'element-plus'
-import { Search, Refresh } from '@element-plus/icons-vue'
-import { getStatus } from '../api/frpc'
-import type { ProxyStatus } from '../types/proxy'
-
-const status = ref<ProxyStatus[]>([])
-const loading = ref(false)
-const searchText = ref('')
-
-const filteredStatus = computed(() => {
-  if (!searchText.value) {
-    return status.value
-  }
-  const search = searchText.value.toLowerCase()
-  return status.value.filter(
-    (p) =>
-      p.name.toLowerCase().includes(search) ||
-      p.type.toLowerCase().includes(search) ||
-      p.local_addr.toLowerCase().includes(search) ||
-      p.remote_addr.toLowerCase().includes(search)
-  )
-})
-
-const getStatusColor = (status: string) => {
-  switch (status) {
-    case 'running':
-      return 'success'
-    case 'error':
-      return 'danger'
-    default:
-      return 'warning'
-  }
-}
-
-const fetchData = async () => {
-  loading.value = true
-  try {
-    const json = await getStatus()
-    status.value = []
-    for (const key in json) {
-      // json[key] is generic array, we assume it matches ProxyStatus
-      for (const ps of json[key]) {
-        status.value.push(ps)
-      }
-    }
-  } catch (err: any) {
-    ElMessage({
-      showClose: true,
-      message: 'Get status info from frpc failed! ' + err.message,
-      type: 'warning',
-    })
-  } finally {
-    loading.value = false
-  }
-}
-
-fetchData()
-</script>
-
-<style scoped>
-.overview-page {
-  /* No special padding needed if App.vue handles content padding */
-}
-
-.main-card {
-  border-radius: 12px;
-  border: none;
-}
-
-.card-title {
-    margin: 0;
-    font-size: 18px;
-    font-weight: 600;
-}
-
-.toolbar-header {
-  display: flex;
-  justify-content: space-between;
-  align-items: center;
-  margin-bottom: 20px;
-  flex-wrap: wrap;
-  gap: 16px;
-  border-bottom: 1px solid var(--el-border-color-lighter);
-  padding-bottom: 16px;
-}
-
-.toolbar-actions {
-  display: flex;
-  gap: 12px;
-  align-items: center;
-}
-
-.search-input {
-  width: 240px;
-}
-
-.error-text {
-    color: var(--el-color-danger);
-}
-
-.type-text {
-  display: inline-block;
-  padding: 2px 8px;
-  font-size: 12px;
-  font-family: ui-monospace, SFMono-Regular, 'SF Mono', Menlo, Monaco, Consolas, monospace;
-  background: var(--el-fill-color-light);
-  border-radius: 4px;
-  color: var(--el-text-color-regular);
-}
-
-@media (max-width: 768px) {
-  .toolbar-header {
-    flex-direction: column;
-    align-items: stretch;
-  }
-  
-  .search-input {
-    width: 100%;
-  }
-}
-</style>
@@ -2,19 +2,15 @@ import { fileURLToPath, URL } from 'node:url'

 import { defineConfig } from 'vite'
 import vue from '@vitejs/plugin-vue'
-import svgLoader from 'vite-svg-loader'
 import AutoImport from 'unplugin-auto-import/vite'
 import Components from 'unplugin-vue-components/vite'
 import { ElementPlusResolver } from 'unplugin-vue-components/resolvers'
-import ElementPlus from 'unplugin-element-plus/vite'

 // https://vitejs.dev/config/
 export default defineConfig({
  base: '',
  plugins: [
    vue(),
-    svgLoader(),
-    ElementPlus({}),
    AutoImport({
      resolvers: [ElementPlusResolver()],
    }),
@@ -29,22 +25,5 @@ export default defineConfig({
  },
  build: {
    assetsDir: '',
-    chunkSizeWarningLimit: 1000,
-    minify: 'terser',
-    terserOptions: {
-      compress: {
-        drop_console: true,
-        drop_debugger: true,
-      },
-    },
  },
-  server: {
-    allowedHosts: process.env.ALLOWED_HOSTS ? process.env.ALLOWED_HOSTS.split(',') : [],
-    proxy: {
-      '/api': {
-        target: process.env.VITE_API_URL || 'http://127.0.0.1:7400',
-        changeOrigin: true,
-      },
-    },
-  },
-})
+})
@@ -23,7 +23,7 @@ module.exports = {
    'vue/multi-word-component-names': [
      'error',
      {
-        ignores: ['Traffic', 'Proxies', 'Clients'],
+        ignores: ['Traffic'],
      },
    ],
  },
@@ -7,38 +7,37 @@ export {}

 declare module 'vue' {
  export interface GlobalComponents {
-    ClientCard: typeof import('./src/components/ClientCard.vue')['default']
    ElButton: typeof import('element-plus/es')['ElButton']
-    ElCard: typeof import('element-plus/es')['ElCard']
    ElCol: typeof import('element-plus/es')['ElCol']
    ElDialog: typeof import('element-plus/es')['ElDialog']
    ElDivider: typeof import('element-plus/es')['ElDivider']
-    ElEmpty: typeof import('element-plus/es')['ElEmpty']
    ElForm: typeof import('element-plus/es')['ElForm']
    ElFormItem: typeof import('element-plus/es')['ElFormItem']
-    ElIcon: typeof import('element-plus/es')['ElIcon']
-    ElInput: typeof import('element-plus/es')['ElInput']
    ElMenu: typeof import('element-plus/es')['ElMenu']
    ElMenuItem: typeof import('element-plus/es')['ElMenuItem']
+    ElPageHeader: typeof import('element-plus/es')['ElPageHeader']
    ElPopconfirm: typeof import('element-plus/es')['ElPopconfirm']
-    ElRadioButton: typeof import('element-plus/es')['ElRadioButton']
-    ElRadioGroup: typeof import('element-plus/es')['ElRadioGroup']
    ElRow: typeof import('element-plus/es')['ElRow']
+    ElSubMenu: typeof import('element-plus/es')['ElSubMenu']
    ElSwitch: typeof import('element-plus/es')['ElSwitch']
    ElTable: typeof import('element-plus/es')['ElTable']
    ElTableColumn: typeof import('element-plus/es')['ElTableColumn']
-    ElTabPane: typeof import('element-plus/es')['ElTabPane']
-    ElTabs: typeof import('element-plus/es')['ElTabs']
    ElTag: typeof import('element-plus/es')['ElTag']
    ElText: typeof import('element-plus/es')['ElText']
    ElTooltip: typeof import('element-plus/es')['ElTooltip']
+    LongSpan: typeof import('./src/components/LongSpan.vue')['default']
+    ProxiesHTTP: typeof import('./src/components/ProxiesHTTP.vue')['default']
+    ProxiesHTTPS: typeof import('./src/components/ProxiesHTTPS.vue')['default']
+    ProxiesSTCP: typeof import('./src/components/ProxiesSTCP.vue')['default']
+    ProxiesSUDP: typeof import('./src/components/ProxiesSUDP.vue')['default']
+    ProxiesTCP: typeof import('./src/components/ProxiesTCP.vue')['default']
+    ProxiesTCPMux: typeof import('./src/components/ProxiesTCPMux.vue')['default']
+    ProxiesUDP: typeof import('./src/components/ProxiesUDP.vue')['default']
+    ProxyView: typeof import('./src/components/ProxyView.vue')['default']
    ProxyViewExpand: typeof import('./src/components/ProxyViewExpand.vue')['default']
    RouterLink: typeof import('vue-router')['RouterLink']
    RouterView: typeof import('vue-router')['RouterView']
-    StatCard: typeof import('./src/components/StatCard.vue')['default']
+    ServerOverview: typeof import('./src/components/ServerOverview.vue')['default']
    Traffic: typeof import('./src/components/Traffic.vue')['default']
  }
-  export interface ComponentCustomProperties {
-    vLoading: typeof import('element-plus/es')['ElLoadingDirective']
-  }
 }
@@ -3,7 +3,7 @@

 <head>
    <meta charset="utf-8">
-    <title>frp server</title>
+    <title>frps dashboard</title>
 </head>

 <body>
@@ -11,30 +11,28 @@
    "lint": "eslint . --ext .vue,.js,.jsx,.cjs,.mjs,.ts,.tsx,.cts,.mts --fix --ignore-path .gitignore"
  },
  "dependencies": {
-    "element-plus": "^2.13.0",
-    "vue": "^3.5.26",
-    "vue-router": "^4.6.4"
+    "@types/humanize-plus": "^1.8.0",
+    "echarts": "^5.4.3",
+    "element-plus": "^2.5.3",
+    "humanize-plus": "^1.8.2",
+    "vue": "^3.4.15",
+    "vue-router": "^4.2.5"
  },
  "devDependencies": {
-    "@rushstack/eslint-patch": "^1.15.0",
-    "@types/node": "24",
-    "@vitejs/plugin-vue": "^6.0.3",
+    "@rushstack/eslint-patch": "^1.7.2",
+    "@types/node": "^18.11.12",
+    "@vitejs/plugin-vue": "^5.0.3",
    "@vue/eslint-config-prettier": "^9.0.0",
    "@vue/eslint-config-typescript": "^12.0.0",
-    "@vue/tsconfig": "^0.8.1",
-    "@vueuse/core": "^14.1.0",
+    "@vue/tsconfig": "^0.5.1",
    "eslint": "^8.56.0",
-    "eslint-plugin-vue": "^9.33.0",
+    "eslint-plugin-vue": "^9.21.0",
    "npm-run-all": "^4.1.5",
-    "prettier": "^3.7.4",
-    "sass": "^1.97.2",
-    "terser": "^5.44.1",
-    "typescript": "^5.9.3",
+    "prettier": "^3.2.4",
+    "typescript": "~5.3.3",
    "unplugin-auto-import": "^0.17.5",
-    "unplugin-element-plus": "^0.11.2",
    "unplugin-vue-components": "^0.26.0",
-    "vite": "^7.3.0",
-    "vite-svg-loader": "^5.1.0",
-    "vue-tsc": "^3.2.2"
+    "vite": "^5.0.12",
+    "vue-tsc": "^1.8.27"
  }
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
fatedierandGitHub	2f5e1f7945	Merge pull request #4999 from fatedier/dev bump version	2025-09-25 20:23:42 +08:00
fatedierandGitHub	22ae8166d3	Merge pull request #4925 from fatedier/dev bump version	2025-08-10 23:26:32 +08:00
fatedierandGitHub	af6bc6369d	Merge pull request #4849 from fatedier/dev bump version	2025-06-25 11:51:19 +08:00