Initial plan

pkg/msg: change UDPPacket.Content from string to []byte to avoid redundant base64 encode/decode
2026-04-27 03:19:11 +08:00 · 2026-03-05 17:33:24 +00:00 · 2026-03-06 01:25:52 +08:00
256 changed files with 14850 additions and 12544 deletions
--- a/.github/workflows/build-and-push-image.yml
+++ b/.github/workflows/build-and-push-image.yml
@@ -19,15 +19,15 @@ jobs:
    steps:
      # environment
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
        with:
          fetch-depth: '0'

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      # get image tag name
      - name: Get Image Tag Name
@@ -38,13 +38,13 @@ jobs:
            echo "TAG_NAME=${{ github.event.inputs.tag }}" >> $GITHUB_ENV
          fi
      - name: Login to DockerHub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: Login to the GPR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -61,7 +61,7 @@ jobs:
          echo "TAG_FRPS_GPR=ghcr.io/fatedier/frps:${{ env.TAG_NAME }}" >> $GITHUB_ENV

      - name: Build and push frpc
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./dockerfiles/Dockerfile-for-frpc
@@ -72,7 +72,7 @@ jobs:
            ${{ env.TAG_FRPC_GPR }}

      - name: Build and push frps
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./dockerfiles/Dockerfile-for-frps
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -14,12 +14,12 @@ jobs:
    name: lint
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v6
-    - uses: actions/setup-go@v6
+    - uses: actions/checkout@v4
+    - uses: actions/setup-go@v5
      with:
        go-version: '1.25'
        cache: false
-    - uses: actions/setup-node@v6
+    - uses: actions/setup-node@v4
      with:
        node-version: '22'
    - name: Build web assets (frps)
@@ -32,4 +32,4 @@ jobs:
      uses: golangci/golangci-lint-action@v9
      with:
        # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
-        version: v2.11
+        version: v2.10
--- a/.github/workflows/goreleaser.yml
+++ b/.github/workflows/goreleaser.yml
@@ -8,15 +8,15 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
        with:
          go-version: '1.25'
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - name: Build web assets (frps)
@@ -30,7 +30,7 @@ jobs:
          ./package.sh

      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@v6
        with:
          version: latest
          args: release --clean --release-notes=./Release.md
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -19,7 +19,7 @@ jobs:
      actions: write
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/stale@v10
+    - uses: actions/stale@v9
      with:
        stale-issue-message: 'Issues go stale after 14d of inactivity. Stale issues rot after an additional 3d of inactivity and eventually close.'
        stale-pr-message: "PRs go stale after 14d of inactivity. Stale PRs rot after an additional 3d of inactivity and eventually close."
--- a/.gitignore
+++ b/.gitignore
@@ -25,12 +25,10 @@ dist/
 client.crt
 client.key

-node_modules/
-
 # Cache
 *.swp

 # AI
-.claude/
+CLAUDE.md
+AGENTS.md
 .sisyphus/
-.superpowers/
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -18,7 +18,6 @@ linters:
  - lll
  - makezero
  - misspell
-  - modernize
  - prealloc
  - predeclared
  - revive
@@ -34,7 +33,7 @@ linters:
      disabled-checks:
      - exitAfterDefer
    gosec:
-      excludes: ["G115", "G117", "G118", "G204", "G401", "G402", "G404", "G501", "G703", "G704", "G705"]
+      excludes: ["G115", "G117", "G204", "G401", "G402", "G404", "G501", "G703", "G704", "G705"]
      severity: low
      confidence: low
    govet:
@@ -48,9 +47,6 @@ linters:
      ignore-rules:
      - cancelled
      - marshalled
-    modernize:
-      disable:
-      - omitzero
    unparam:
      check-exported: false
  exclusions:
@@ -90,7 +86,6 @@ linters:
    - third_party$
    - builtin$
    - examples$
-    - node_modules
 formatters:
  enable:
  - gci
@@ -113,7 +108,6 @@ formatters:
    - third_party$
    - builtin$
    - examples$
-    - node_modules
 issues:
  max-issues-per-linter: 0
  max-same-issues: 0
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,39 +0,0 @@
-# AGENTS.md
-
-## Development Commands
-
-### Build
- `make build` - Build both frps and frpc binaries
- `make frps` - Build server binary only
- `make frpc` - Build client binary only
- `make all` - Build everything with formatting
-
-### Testing
- `make test` - Run unit tests
- `make e2e` - Run end-to-end tests
- `make e2e-trace` - Run e2e tests with trace logging
- `make alltest` - Run all tests including vet, unit tests, and e2e
-
-### Code Quality
- `make fmt` - Run go fmt
- `make fmt-more` - Run gofumpt for more strict formatting
- `make gci` - Run gci import organizer
- `make vet` - Run go vet
- `golangci-lint run` - Run comprehensive linting (configured in .golangci.yml)
-
-### Assets
- `make web` - Build web dashboards (frps and frpc)
-
-### Cleanup
- `make clean` - Remove built binaries and temporary files
-
-## Testing
-
- E2E tests using Ginkgo/Gomega framework
- Mock servers in `/test/e2e/mock/`
- Run: `make e2e` or `make alltest`
-
-## Agent Runbooks
-
-Operational procedures for agents are in `doc/agents/`:
- `doc/agents/release.md` - Release process
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1 +0,0 @@
-AGENTS.md
--- a/README.md
+++ b/README.md
@@ -13,16 +13,6 @@ frp is an open source project with its ongoing development made possible entirel

 <h3 align="center">Gold Sponsors</h3>
 <!--gold sponsors start-->
-<p align="center">
-  <a href="https://github.com/beclab/Olares" target="_blank">
-    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_olares.jpeg">
-	<br>
-	<b>The sovereign cloud that puts you in control</b>
-	<br>
-	<sub>An open source, self-hosted alternative to public clouds, built for data ownership and privacy</sub>
-  </a>
-</p>
-
 <div align="center">

 ## Recall.ai - API for meeting recordings
@@ -50,6 +40,16 @@ an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and
 	<b>The complete IDE crafted for professional Go developers</b>
  </a>
 </p>
+
+<p align="center">
+  <a href="https://github.com/beclab/Olares" target="_blank">
+    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_olares.jpeg">
+	<br>
+	<b>The sovereign cloud that puts you in control</b>
+	<br>
+	<sub>An open source, self-hosted alternative to public clouds, built for data ownership and privacy</sub>
+  </a>
+</p>
 <!--gold sponsors end-->

 ## What is frp?
@@ -81,7 +81,6 @@ frp also offers a P2P connect mode.
    * [Split Configures Into Different Files](#split-configures-into-different-files)
    * [Server Dashboard](#server-dashboard)
    * [Client Admin UI](#client-admin-ui)
-        * [Dynamic Proxy Management (Store)](#dynamic-proxy-management-store)
    * [Monitor](#monitor)
        * [Prometheus](#prometheus)
    * [Authenticating the Client](#authenticating-the-client)
@@ -150,9 +149,7 @@ We sincerely appreciate your support for frp.

 ## Architecture

-<p align="center">
-  <img src="/doc/pic/architecture.jpg" alt="architecture" width="760">
-</p>
+![architecture](/doc/pic/architecture.png)

 ## Example Usage

@@ -596,7 +593,7 @@ Then visit `https://[serverAddr]:7500` to see the dashboard in secure HTTPS conn

 ### Client Admin UI

-The Client Admin UI helps you check and manage frpc's configuration and proxies.
+The Client Admin UI helps you check and manage frpc's configuration.

 Configure an address for admin UI to enable this feature:

@@ -609,19 +606,6 @@ webServer.password = "admin"

 Then visit `http://127.0.0.1:7400` to see admin UI, with username and password both being `admin`.

-#### Dynamic Proxy Management (Store)
-
-You can dynamically create, update, and delete proxies and visitors at runtime through the Web UI or API, without restarting frpc.
-
-To enable this feature, configure `store.path` to specify a file for persisting the configurations:
-
-```toml
-[store]
-path = "./db.json"
-```
-
-Proxies and visitors managed through the Store are saved to disk and automatically restored on frpc restart. They work alongside proxies defined in the configuration file — Store entries take precedence when names conflict.
-
 ### Monitor

 When web server is enabled, frps will save monitor data in cache for 7 days. It will be cleared after process restart.
--- a/README_zh.md
+++ b/README_zh.md
@@ -15,16 +15,6 @@ frp 是一个完全开源的项目，我们的开发工作完全依靠赞助者

 <h3 align="center">Gold Sponsors</h3>
 <!--gold sponsors start-->
-<p align="center">
-  <a href="https://github.com/beclab/Olares" target="_blank">
-    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_olares.jpeg">
-	<br>
-	<b>The sovereign cloud that puts you in control</b>
-	<br>
-	<sub>An open source, self-hosted alternative to public clouds, built for data ownership and privacy</sub>
-  </a>
-</p>
-
 <div align="center">

 ## Recall.ai - API for meeting recordings
@@ -52,6 +42,16 @@ an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and
 	<b>The complete IDE crafted for professional Go developers</b>
  </a>
 </p>
+
+<p align="center">
+  <a href="https://github.com/beclab/Olares" target="_blank">
+    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_olares.jpeg">
+	<br>
+	<b>The sovereign cloud that puts you in control</b>
+	<br>
+	<sub>An open source, self-hosted alternative to public clouds, built for data ownership and privacy</sub>
+  </a>
+</p>
 <!--gold sponsors end-->

 ## 为什么使用 frp ？
--- a/Release.md
+++ b/Release.md
@@ -1,18 +1,9 @@
-## Compatibility Policy
-
-Starting with v0.69.0, each minor release is supported until there are nine newer minor releases. For example, v0.69.0 will be supported until v0.78.0 is released. Within this window, frpc v0.69.0 is guaranteed to work with any frps from v0.61.0 to v0.77.0, and vice versa. Patch releases within the same minor are always compatible. Versions outside the support window may continue to work on a best-effort basis, but compatibility is no longer guaranteed.
-
-For mixed-version deployments, upgrade frps first, then upgrade frpc. This keeps the server side ready for newer client-side protocol behavior before clients start using it.
-
-## Notes
-
-This release introduces wire protocol v2 as a transition path for future frpc/frps protocol changes. The existing wire protocol is difficult to extend without compatibility risk, and upcoming changes, including replacing deprecated stream encryption methods, require a versioned protocol.
-
-**The default value of `transport.wireProtocol` remains `v1` in this release.** Users can keep the default for now. To test v2 early, upgrade both frpc and frps to versions that support it, then set `transport.wireProtocol = "v2"` in frpc. A v2-enabled frpc cannot connect to an older frps.
-
-v1 will be deprecated when v2 becomes the default in a future release. It will continue to be supported until v0.78.0 is released, and may be removed in v0.78.0 or later.
-
 ## Features

-* Added `transport.wireProtocol` for frpc to select the internal message protocol used between frpc and frps. Supported values are `v1` and `v2`.
-* Added client protocol visibility in the frps dashboard and `/api/clients` API. Online clients now report their negotiated protocol as `v1` or `v2`.
+* Added a built-in `store` capability for frpc, including persisted store source (`[store] path = "..."`), Store CRUD admin APIs (`/api/store/proxies*`, `/api/store/visitors*`) with runtime reload, and Store management pages in the frpc web dashboard.
+
+## Improvements
+
+* Kept proxy/visitor names as raw config names during completion; moved user-prefix handling to explicit wire-level naming logic.
+* Added `noweb` build tag to allow compiling without frontend assets. `make build` now auto-detects missing `web/*/dist` directories and skips embedding, so a fresh clone can build without running `make web` first. The dashboard gracefully returns 404 when assets are not embedded.
+* Improved config parsing errors: for `.toml` files, syntax errors now return immediately with parser position details (line/column when available) instead of falling through to YAML/JSON parsing, and TOML type mismatches report field-level errors without misleading line numbers.
--- a/client/api_router.go
+++ b/client/api_router.go
@@ -38,8 +38,6 @@ func (svr *Service) registerRouteHandlers(helper *httppkg.RouterRegisterHelper)
 	subRouter.HandleFunc("/api/status", httppkg.MakeHTTPHandlerFunc(apiController.Status)).Methods(http.MethodGet)
 	subRouter.HandleFunc("/api/config", httppkg.MakeHTTPHandlerFunc(apiController.GetConfig)).Methods(http.MethodGet)
 	subRouter.HandleFunc("/api/config", httppkg.MakeHTTPHandlerFunc(apiController.PutConfig)).Methods(http.MethodPut)
-	subRouter.HandleFunc("/api/proxy/{name}/config", httppkg.MakeHTTPHandlerFunc(apiController.GetProxyConfig)).Methods(http.MethodGet)
-	subRouter.HandleFunc("/api/visitor/{name}/config", httppkg.MakeHTTPHandlerFunc(apiController.GetVisitorConfig)).Methods(http.MethodGet)

 	if svr.storeSource != nil {
 		subRouter.HandleFunc("/api/store/proxies", httppkg.MakeHTTPHandlerFunc(apiController.ListStoreProxies)).Methods(http.MethodGet)
--- a/client/config_manager.go
+++ b/client/config_manager.go
@@ -80,48 +80,6 @@ func (m *serviceConfigManager) GetProxyStatus() []*proxy.WorkingStatus {
 	return m.svr.getAllProxyStatus()
 }

-func (m *serviceConfigManager) GetProxyConfig(name string) (v1.ProxyConfigurer, bool) {
-	// Try running proxy manager first
-	ws, ok := m.svr.getProxyStatus(name)
-	if ok {
-		return ws.Cfg, true
-	}
-
-	// Fallback to store
-	m.svr.reloadMu.Lock()
-	storeSource := m.svr.storeSource
-	m.svr.reloadMu.Unlock()
-
-	if storeSource != nil {
-		cfg := storeSource.GetProxy(name)
-		if cfg != nil {
-			return cfg, true
-		}
-	}
-	return nil, false
-}
-
-func (m *serviceConfigManager) GetVisitorConfig(name string) (v1.VisitorConfigurer, bool) {
-	// Try running visitor manager first
-	cfg, ok := m.svr.getVisitorCfg(name)
-	if ok {
-		return cfg, true
-	}
-
-	// Fallback to store
-	m.svr.reloadMu.Lock()
-	storeSource := m.svr.storeSource
-	m.svr.reloadMu.Unlock()
-
-	if storeSource != nil {
-		vcfg := storeSource.GetVisitor(name)
-		if vcfg != nil {
-			return vcfg, true
-		}
-	}
-	return nil, false
-}
-
 func (m *serviceConfigManager) IsStoreProxyEnabled(name string) bool {
 	if name == "" {
 		return false
--- a/client/configmgmt/types.go
+++ b/client/configmgmt/types.go
@@ -26,9 +26,6 @@ type ConfigManager interface {
 	IsStoreProxyEnabled(name string) bool
 	StoreEnabled() bool

-	GetProxyConfig(name string) (v1.ProxyConfigurer, bool)
-	GetVisitorConfig(name string) (v1.VisitorConfigurer, bool)
-
 	ListStoreProxies() ([]v1.ProxyConfigurer, error)
 	GetStoreProxy(name string) (v1.ProxyConfigurer, error)
 	CreateStoreProxy(cfg v1.ProxyConfigurer) (v1.ProxyConfigurer, error)
--- a/client/connector.go
+++ b/client/connector.go
@@ -29,8 +29,6 @@ import (
 	"github.com/samber/lo"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/proto/wire"
 	"github.com/fatedier/frp/pkg/transport"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
 	"github.com/fatedier/frp/pkg/util/xlog"
@@ -43,39 +41,6 @@ type Connector interface {
 	Close() error
 }

-type MessageConnector interface {
-	Connect() (*msg.Conn, error)
-	Close() error
-}
-
-type messageConnector struct {
-	connector    Connector
-	wireProtocol string
-}
-
-func newMessageConnector(connector Connector, wireProtocol string) *messageConnector {
-	return &messageConnector{
-		connector:    connector,
-		wireProtocol: wireProtocol,
-	}
-}
-
-func (c *messageConnector) Connect() (*msg.Conn, error) {
-	conn, err := c.connector.Connect()
-	if err != nil {
-		return nil, err
-	}
-	if err = wire.WriteMagicIfV2(conn, c.wireProtocol); err != nil {
-		conn.Close()
-		return nil, err
-	}
-	return msg.NewConn(conn, msg.NewReadWriter(conn, c.wireProtocol)), nil
-}
-
-func (c *messageConnector) Close() error {
-	return c.connector.Close()
-}
-
 // defaultConnectorImpl is the default implementation of Connector for normal frpc.
 type defaultConnectorImpl struct {
 	ctx context.Context
@@ -154,7 +119,6 @@ func (c *defaultConnectorImpl) Open() error {
 	fmuxCfg.MaxStreamWindowSize = 6 * 1024 * 1024
 	session, err := fmux.Client(conn, fmuxCfg)
 	if err != nil {
-		conn.Close()
 		return err
 	}
 	c.muxSession = session
--- a/client/control.go
+++ b/client/control.go
@@ -27,6 +27,7 @@ import (
 	"github.com/fatedier/frp/pkg/msg"
 	"github.com/fatedier/frp/pkg/naming"
 	"github.com/fatedier/frp/pkg/transport"
+	netpkg "github.com/fatedier/frp/pkg/util/net"
 	"github.com/fatedier/frp/pkg/util/wait"
 	"github.com/fatedier/frp/pkg/util/xlog"
 	"github.com/fatedier/frp/pkg/vnet"
@@ -40,11 +41,13 @@ type SessionContext struct {
 	// It should be attached to the login message when reconnecting.
 	RunID string
 	// Underlying control connection. Once conn is closed, the msgDispatcher and the entire Control will exit.
-	Conn *msg.Conn
+	Conn net.Conn
+	// Indicates whether the connection is encrypted.
+	ConnEncrypted bool
 	// Auth runtime used for login, heartbeats, and encryption.
 	Auth *auth.ClientAuth
-	// Connector is used to create message connections to frps.
-	Connector MessageConnector
+	// Connector is used to create new connections, which could be real TCP connections or virtual streams.
+	Connector Connector
 	// Virtual net controller
 	VnetController *vnet.Controller
 }
@@ -88,7 +91,15 @@ func NewControl(ctx context.Context, sessionCtx *SessionContext) (*Control, erro
 	}
 	ctl.lastPong.Store(time.Now())

-	ctl.msgDispatcher = msg.NewDispatcher(sessionCtx.Conn)
+	if sessionCtx.ConnEncrypted {
+		cryptoRW, err := netpkg.NewCryptoReadWriter(sessionCtx.Conn, sessionCtx.Auth.EncryptionKey())
+		if err != nil {
+			return nil, err
+		}
+		ctl.msgDispatcher = msg.NewDispatcher(cryptoRW)
+	} else {
+		ctl.msgDispatcher = msg.NewDispatcher(sessionCtx.Conn)
+	}
 	ctl.registerMsgHandlers()
 	ctl.msgTransporter = transport.NewMessageTransporter(ctl.msgDispatcher)

@@ -128,14 +139,14 @@ func (ctl *Control) handleReqWorkConn(_ msg.Message) {
 		workConn.Close()
 		return
 	}
-	if err = workConn.WriteMsg(m); err != nil {
+	if err = msg.WriteMsg(workConn, m); err != nil {
 		xl.Warnf("work connection write to server error: %v", err)
 		workConn.Close()
 		return
 	}

 	var startMsg msg.StartWorkConn
-	if err = workConn.ReadMsgInto(&startMsg); err != nil {
+	if err = msg.ReadMsgInto(workConn, &startMsg); err != nil {
 		xl.Tracef("work connection closed before response StartWorkConn message: %v", err)
 		workConn.Close()
 		return
@@ -216,7 +227,7 @@ func (ctl *Control) Done() <-chan struct{} {
 }

 // connectServer return a new connection to frps
-func (ctl *Control) connectServer() (*msg.Conn, error) {
+func (ctl *Control) connectServer() (net.Conn, error) {
 	return ctl.sessionCtx.Connector.Connect()
 }

--- a/client/control_session.go
+++ b/client/control_session.go
@@ -1,172 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package client
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"os"
-	"runtime"
-	"time"
-
-	"github.com/samber/lo"
-
-	"github.com/fatedier/frp/pkg/auth"
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/proto/wire"
-	netpkg "github.com/fatedier/frp/pkg/util/net"
-	"github.com/fatedier/frp/pkg/util/version"
-	"github.com/fatedier/frp/pkg/vnet"
-)
-
-type controlSessionDialer struct {
-	ctx context.Context
-
-	common         *v1.ClientCommonConfig
-	auth           *auth.ClientAuth
-	clientSpec     *msg.ClientSpec
-	vnetController *vnet.Controller
-
-	connectorCreator func(context.Context, *v1.ClientCommonConfig) Connector
-}
-
-func (d *controlSessionDialer) Dial(previousRunID string) (*SessionContext, error) {
-	connector := d.connectorCreator(d.ctx, d.common)
-	if err := connector.Open(); err != nil {
-		return nil, err
-	}
-
-	success := false
-	defer func() {
-		if !success {
-			_ = connector.Close()
-		}
-	}()
-
-	conn, err := connector.Connect()
-	if err != nil {
-		return nil, err
-	}
-	defer func() {
-		if !success {
-			_ = conn.Close()
-		}
-	}()
-
-	loginMsg, err := d.buildLoginMsg(previousRunID)
-	if err != nil {
-		return nil, err
-	}
-
-	loginRespMsg, err := d.exchangeLogin(conn, loginMsg)
-	if err != nil {
-		return nil, err
-	}
-	if loginRespMsg.Error != "" {
-		return nil, errors.New(loginRespMsg.Error)
-	}
-
-	var controlRW io.ReadWriter = conn
-	if d.clientSpec == nil || d.clientSpec.Type != "ssh-tunnel" {
-		controlRW, err = netpkg.NewCryptoReadWriter(conn, d.auth.EncryptionKey())
-		if err != nil {
-			return nil, fmt.Errorf("create control crypto read writer: %w", err)
-		}
-	}
-
-	success = true
-	return &SessionContext{
-		Common:         d.common,
-		RunID:          loginRespMsg.RunID,
-		Conn:           msg.NewConn(conn, msg.NewReadWriter(controlRW, d.common.Transport.WireProtocol)),
-		Auth:           d.auth,
-		Connector:      newMessageConnector(connector, d.common.Transport.WireProtocol),
-		VnetController: d.vnetController,
-	}, nil
-}
-
-func (d *controlSessionDialer) buildLoginMsg(previousRunID string) (*msg.Login, error) {
-	hostname, _ := os.Hostname()
-	loginMsg := &msg.Login{
-		Arch:      runtime.GOARCH,
-		Os:        runtime.GOOS,
-		Hostname:  hostname,
-		PoolCount: d.common.Transport.PoolCount,
-		User:      d.common.User,
-		ClientID:  d.common.ClientID,
-		Version:   version.Full(),
-		Timestamp: time.Now().Unix(),
-		RunID:     previousRunID,
-		Metas:     d.common.Metadatas,
-	}
-	if d.clientSpec != nil {
-		loginMsg.ClientSpec = *d.clientSpec
-	}
-
-	if err := d.auth.Setter.SetLogin(loginMsg); err != nil {
-		return nil, err
-	}
-	return loginMsg, nil
-}
-
-func (d *controlSessionDialer) exchangeLogin(conn net.Conn, loginMsg *msg.Login) (*msg.LoginResp, error) {
-	rw := msg.NewV1ReadWriter(conn)
-	var wireConn *wire.Conn
-
-	if d.common.Transport.WireProtocol == wire.ProtocolV2 {
-		if err := wire.WriteMagic(conn); err != nil {
-			return nil, err
-		}
-
-		wireConn = wire.NewConn(conn)
-		rw = msg.NewV2ReadWriterWithConn(wireConn)
-		hello := wire.DefaultClientHello(wire.BootstrapInfo{
-			Transport: d.common.Transport.Protocol,
-			TLS:       lo.FromPtr(d.common.Transport.TLS.Enable) || d.common.Transport.Protocol == "wss" || d.common.Transport.Protocol == "quic",
-			TCPMux:    lo.FromPtr(d.common.Transport.TCPMux),
-		})
-		if err := wireConn.WriteJSONFrame(wire.FrameTypeClientHello, hello); err != nil {
-			return nil, err
-		}
-	}
-	if err := rw.WriteMsg(loginMsg); err != nil {
-		return nil, err
-	}
-
-	_ = conn.SetReadDeadline(time.Now().Add(10 * time.Second))
-	defer func() {
-		_ = conn.SetReadDeadline(time.Time{})
-	}()
-
-	if wireConn != nil {
-		var serverHello wire.ServerHello
-		if err := wireConn.ReadJSONFrame(wire.FrameTypeServerHello, &serverHello); err != nil {
-			return nil, err
-		}
-		if serverHello.Error != "" {
-			return nil, errors.New(serverHello.Error)
-		}
-	}
-
-	var loginRespMsg msg.LoginResp
-	if err := rw.ReadMsgInto(&loginRespMsg); err != nil {
-		return nil, err
-	}
-	return &loginRespMsg, nil
-}
--- a/client/control_session_test.go
+++ b/client/control_session_test.go
@@ -1,245 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package client
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/fatedier/frp/pkg/auth"
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/proto/wire"
-)
-
-type testConnector struct {
-	conn   net.Conn
-	closed atomic.Bool
-}
-
-func (c *testConnector) Open() error {
-	return nil
-}
-
-func (c *testConnector) Connect() (net.Conn, error) {
-	return c.conn, nil
-}
-
-func (c *testConnector) Close() error {
-	c.closed.Store(true)
-	return nil
-}
-
-type trackingConn struct {
-	net.Conn
-	closed atomic.Bool
-}
-
-func (c *trackingConn) Close() error {
-	c.closed.Store(true)
-	return c.Conn.Close()
-}
-
-func newTestControlSessionDialer(t *testing.T, protocol string, connector Connector, clientSpec *msg.ClientSpec) *controlSessionDialer {
-	t.Helper()
-
-	authRuntime, err := auth.BuildClientAuth(&v1.AuthClientConfig{
-		Method: v1.AuthMethodToken,
-		Token:  "token",
-	})
-	require.NoError(t, err)
-
-	return &controlSessionDialer{
-		ctx: context.Background(),
-		common: &v1.ClientCommonConfig{
-			User: "test-user",
-			Transport: v1.ClientTransportConfig{
-				Protocol:     "tcp",
-				WireProtocol: protocol,
-			},
-		},
-		auth:       authRuntime,
-		clientSpec: clientSpec,
-		connectorCreator: func(context.Context, *v1.ClientCommonConfig) Connector {
-			return connector
-		},
-	}
-}
-
-func TestControlSessionDialerDialV1(t *testing.T) {
-	clientRaw, serverRaw := net.Pipe()
-	defer serverRaw.Close()
-
-	connector := &testConnector{conn: &trackingConn{Conn: clientRaw}}
-	serverErrCh := make(chan error, 1)
-	go func() {
-		rw := msg.NewV1ReadWriter(serverRaw)
-		var loginMsg msg.Login
-		if err := rw.ReadMsgInto(&loginMsg); err != nil {
-			serverErrCh <- err
-			return
-		}
-		if loginMsg.RunID != "previous-run-id" {
-			serverErrCh <- fmt.Errorf("unexpected previous run id: %s", loginMsg.RunID)
-			return
-		}
-		if loginMsg.User != "test-user" {
-			serverErrCh <- fmt.Errorf("unexpected user: %s", loginMsg.User)
-			return
-		}
-		serverErrCh <- rw.WriteMsg(&msg.LoginResp{RunID: "run-v1"})
-	}()
-
-	dialer := newTestControlSessionDialer(t, wire.ProtocolV1, connector, nil)
-	sessionCtx, err := dialer.Dial("previous-run-id")
-	require.NoError(t, err)
-	defer sessionCtx.Conn.Close()
-	defer sessionCtx.Connector.Close()
-
-	require.Equal(t, "run-v1", sessionCtx.RunID)
-	require.NotNil(t, sessionCtx.Conn)
-	require.NotNil(t, sessionCtx.Connector)
-	require.False(t, connector.closed.Load())
-	require.NoError(t, <-serverErrCh)
-}
-
-func TestControlSessionDialerDialV2(t *testing.T) {
-	clientRaw, serverRaw := net.Pipe()
-	defer serverRaw.Close()
-
-	connector := &testConnector{conn: &trackingConn{Conn: clientRaw}}
-	serverErrCh := make(chan error, 1)
-	go func() {
-		magic := make([]byte, len(wire.MagicV2))
-		if _, err := io.ReadFull(serverRaw, magic); err != nil {
-			serverErrCh <- err
-			return
-		}
-		if string(magic) != wire.MagicV2 {
-			serverErrCh <- fmt.Errorf("unexpected magic: %q", string(magic))
-			return
-		}
-
-		wireConn := wire.NewConn(serverRaw)
-		var hello wire.ClientHello
-		if err := wireConn.ReadJSONFrame(wire.FrameTypeClientHello, &hello); err != nil {
-			serverErrCh <- err
-			return
-		}
-		if err := wire.ValidateClientHello(hello); err != nil {
-			serverErrCh <- err
-			return
-		}
-
-		rw := msg.NewV2ReadWriterWithConn(wireConn)
-		var loginMsg msg.Login
-		if err := rw.ReadMsgInto(&loginMsg); err != nil {
-			serverErrCh <- err
-			return
-		}
-		if loginMsg.User != "test-user" {
-			serverErrCh <- fmt.Errorf("unexpected user: %s", loginMsg.User)
-			return
-		}
-		if err := wireConn.WriteJSONFrame(wire.FrameTypeServerHello, wire.DefaultServerHello()); err != nil {
-			serverErrCh <- err
-			return
-		}
-		serverErrCh <- rw.WriteMsg(&msg.LoginResp{RunID: "run-v2"})
-	}()
-
-	dialer := newTestControlSessionDialer(t, wire.ProtocolV2, connector, nil)
-	sessionCtx, err := dialer.Dial("")
-	require.NoError(t, err)
-	defer sessionCtx.Conn.Close()
-	defer sessionCtx.Connector.Close()
-
-	require.Equal(t, "run-v2", sessionCtx.RunID)
-	require.NotNil(t, sessionCtx.Conn)
-	require.NotNil(t, sessionCtx.Connector)
-	require.False(t, connector.closed.Load())
-	require.NoError(t, <-serverErrCh)
-}
-
-func TestControlSessionDialerDialLoginErrorClosesResources(t *testing.T) {
-	clientRaw, serverRaw := net.Pipe()
-	defer serverRaw.Close()
-
-	clientConn := &trackingConn{Conn: clientRaw}
-	connector := &testConnector{conn: clientConn}
-	serverErrCh := make(chan error, 1)
-	go func() {
-		rw := msg.NewV1ReadWriter(serverRaw)
-		var loginMsg msg.Login
-		if err := rw.ReadMsgInto(&loginMsg); err != nil {
-			serverErrCh <- err
-			return
-		}
-		serverErrCh <- rw.WriteMsg(&msg.LoginResp{Error: "login denied"})
-	}()
-
-	dialer := newTestControlSessionDialer(t, wire.ProtocolV1, connector, nil)
-	sessionCtx, err := dialer.Dial("")
-	require.Nil(t, sessionCtx)
-	require.ErrorContains(t, err, "login denied")
-	require.True(t, clientConn.closed.Load())
-	require.True(t, connector.closed.Load())
-	require.NoError(t, <-serverErrCh)
-}
-
-func TestControlSessionDialerDialSSHTunnelSkipsControlEncryption(t *testing.T) {
-	clientRaw, serverRaw := net.Pipe()
-	defer serverRaw.Close()
-
-	connector := &testConnector{conn: &trackingConn{Conn: clientRaw}}
-	serverErrCh := make(chan error, 1)
-	go func() {
-		rw := msg.NewV1ReadWriter(serverRaw)
-		var loginMsg msg.Login
-		if err := rw.ReadMsgInto(&loginMsg); err != nil {
-			serverErrCh <- err
-			return
-		}
-		if err := rw.WriteMsg(&msg.LoginResp{RunID: "run-ssh-tunnel"}); err != nil {
-			serverErrCh <- err
-			return
-		}
-
-		_ = serverRaw.SetReadDeadline(time.Now().Add(time.Second))
-		var ping msg.Ping
-		if err := rw.ReadMsgInto(&ping); err != nil {
-			serverErrCh <- err
-			return
-		}
-		serverErrCh <- nil
-	}()
-
-	dialer := newTestControlSessionDialer(t, wire.ProtocolV1, connector, &msg.ClientSpec{Type: "ssh-tunnel"})
-	sessionCtx, err := dialer.Dial("")
-	require.NoError(t, err)
-	defer sessionCtx.Conn.Close()
-	defer sessionCtx.Connector.Close()
-
-	require.Equal(t, "run-ssh-tunnel", sessionCtx.RunID)
-	require.NoError(t, sessionCtx.Conn.WriteMsg(&msg.Ping{}))
-	require.NoError(t, <-serverErrCh)
-}
--- a/client/http/controller.go
+++ b/client/http/controller.go
@@ -162,44 +162,6 @@ func (c *Controller) buildProxyStatusResp(status *proxy.WorkingStatus) model.Pro
 	return psr
 }

-// GetProxyConfig handles GET /api/proxy/{name}/config
-func (c *Controller) GetProxyConfig(ctx *httppkg.Context) (any, error) {
-	name := ctx.Param("name")
-	if name == "" {
-		return nil, httppkg.NewError(http.StatusBadRequest, "proxy name is required")
-	}
-
-	cfg, ok := c.manager.GetProxyConfig(name)
-	if !ok {
-		return nil, httppkg.NewError(http.StatusNotFound, fmt.Sprintf("proxy %q not found", name))
-	}
-
-	payload, err := model.ProxyDefinitionFromConfigurer(cfg)
-	if err != nil {
-		return nil, httppkg.NewError(http.StatusInternalServerError, err.Error())
-	}
-	return payload, nil
-}
-
-// GetVisitorConfig handles GET /api/visitor/{name}/config
-func (c *Controller) GetVisitorConfig(ctx *httppkg.Context) (any, error) {
-	name := ctx.Param("name")
-	if name == "" {
-		return nil, httppkg.NewError(http.StatusBadRequest, "visitor name is required")
-	}
-
-	cfg, ok := c.manager.GetVisitorConfig(name)
-	if !ok {
-		return nil, httppkg.NewError(http.StatusNotFound, fmt.Sprintf("visitor %q not found", name))
-	}
-
-	payload, err := model.VisitorDefinitionFromConfigurer(cfg)
-	if err != nil {
-		return nil, httppkg.NewError(http.StatusInternalServerError, err.Error())
-	}
-	return payload, nil
-}
-
 func (c *Controller) ListStoreProxies(ctx *httppkg.Context) (any, error) {
 	proxies, err := c.manager.ListStoreProxies()
 	if err != nil {
--- a/client/http/controller_test.go
+++ b/client/http/controller_test.go
@@ -26,8 +26,6 @@ type fakeConfigManager struct {
 	getProxyStatusFn      func() []*proxy.WorkingStatus
 	isStoreProxyEnabledFn func(name string) bool
 	storeEnabledFn        func() bool
-	getProxyConfigFn      func(name string) (v1.ProxyConfigurer, bool)
-	getVisitorConfigFn    func(name string) (v1.VisitorConfigurer, bool)

 	listStoreProxiesFn  func() ([]v1.ProxyConfigurer, error)
 	getStoreProxyFn     func(name string) (v1.ProxyConfigurer, error)
@@ -84,20 +82,6 @@ func (m *fakeConfigManager) StoreEnabled() bool {
 	return false
 }

-func (m *fakeConfigManager) GetProxyConfig(name string) (v1.ProxyConfigurer, bool) {
-	if m.getProxyConfigFn != nil {
-		return m.getProxyConfigFn(name)
-	}
-	return nil, false
-}
-
-func (m *fakeConfigManager) GetVisitorConfig(name string) (v1.VisitorConfigurer, bool) {
-	if m.getVisitorConfigFn != nil {
-		return m.getVisitorConfigFn(name)
-	}
-	return nil, false
-}
-
 func (m *fakeConfigManager) ListStoreProxies() ([]v1.ProxyConfigurer, error) {
 	if m.listStoreProxiesFn != nil {
 		return m.listStoreProxiesFn()
@@ -545,118 +529,3 @@ func TestUpdateStoreProxyReturnsTypedPayload(t *testing.T) {
 		t.Fatalf("unexpected response payload: %#v", payload)
 	}
 }
-
-func TestGetProxyConfigFromManager(t *testing.T) {
-	controller := &Controller{
-		manager: &fakeConfigManager{
-			getProxyConfigFn: func(name string) (v1.ProxyConfigurer, bool) {
-				if name == "ssh" {
-					cfg := &v1.TCPProxyConfig{
-						ProxyBaseConfig: v1.ProxyBaseConfig{
-							Name: "ssh",
-							Type: "tcp",
-							ProxyBackend: v1.ProxyBackend{
-								LocalPort: 22,
-							},
-						},
-					}
-					return cfg, true
-				}
-				return nil, false
-			},
-		},
-	}
-
-	req := httptest.NewRequest(http.MethodGet, "/api/proxy/ssh/config", nil)
-	req = mux.SetURLVars(req, map[string]string{"name": "ssh"})
-	ctx := httppkg.NewContext(httptest.NewRecorder(), req)
-
-	resp, err := controller.GetProxyConfig(ctx)
-	if err != nil {
-		t.Fatalf("get proxy config: %v", err)
-	}
-	payload, ok := resp.(model.ProxyDefinition)
-	if !ok {
-		t.Fatalf("unexpected response type: %T", resp)
-	}
-	if payload.Name != "ssh" || payload.Type != "tcp" || payload.TCP == nil {
-		t.Fatalf("unexpected payload: %#v", payload)
-	}
-}
-
-func TestGetProxyConfigNotFound(t *testing.T) {
-	controller := &Controller{
-		manager: &fakeConfigManager{
-			getProxyConfigFn: func(name string) (v1.ProxyConfigurer, bool) {
-				return nil, false
-			},
-		},
-	}
-
-	req := httptest.NewRequest(http.MethodGet, "/api/proxy/missing/config", nil)
-	req = mux.SetURLVars(req, map[string]string{"name": "missing"})
-	ctx := httppkg.NewContext(httptest.NewRecorder(), req)
-
-	_, err := controller.GetProxyConfig(ctx)
-	if err == nil {
-		t.Fatal("expected error")
-	}
-	assertHTTPCode(t, err, http.StatusNotFound)
-}
-
-func TestGetVisitorConfigFromManager(t *testing.T) {
-	controller := &Controller{
-		manager: &fakeConfigManager{
-			getVisitorConfigFn: func(name string) (v1.VisitorConfigurer, bool) {
-				if name == "my-stcp" {
-					cfg := &v1.STCPVisitorConfig{
-						VisitorBaseConfig: v1.VisitorBaseConfig{
-							Name:       "my-stcp",
-							Type:       "stcp",
-							ServerName: "server1",
-							BindPort:   9000,
-						},
-					}
-					return cfg, true
-				}
-				return nil, false
-			},
-		},
-	}
-
-	req := httptest.NewRequest(http.MethodGet, "/api/visitor/my-stcp/config", nil)
-	req = mux.SetURLVars(req, map[string]string{"name": "my-stcp"})
-	ctx := httppkg.NewContext(httptest.NewRecorder(), req)
-
-	resp, err := controller.GetVisitorConfig(ctx)
-	if err != nil {
-		t.Fatalf("get visitor config: %v", err)
-	}
-	payload, ok := resp.(model.VisitorDefinition)
-	if !ok {
-		t.Fatalf("unexpected response type: %T", resp)
-	}
-	if payload.Name != "my-stcp" || payload.Type != "stcp" || payload.STCP == nil {
-		t.Fatalf("unexpected payload: %#v", payload)
-	}
-}
-
-func TestGetVisitorConfigNotFound(t *testing.T) {
-	controller := &Controller{
-		manager: &fakeConfigManager{
-			getVisitorConfigFn: func(name string) (v1.VisitorConfigurer, bool) {
-				return nil, false
-			},
-		},
-	}
-
-	req := httptest.NewRequest(http.MethodGet, "/api/visitor/missing/config", nil)
-	req = mux.SetURLVars(req, map[string]string{"name": "missing"})
-	ctx := httppkg.NewContext(httptest.NewRecorder(), req)
-
-	_, err := controller.GetVisitorConfig(ctx)
-	if err == nil {
-		t.Fatal("expected error")
-	}
-	assertHTTPCode(t, err, http.StatusNotFound)
-}
--- a/client/proxy/proxy.go
+++ b/client/proxy/proxy.go
@@ -16,7 +16,6 @@ package proxy

 import (
 	"context"
-	"fmt"
 	"io"
 	"net"
 	"reflect"
@@ -123,33 +122,6 @@ func (pxy *BaseProxy) Close() {
 	}
 }

-// wrapWorkConn applies rate limiting, encryption, and compression
-// to a work connection based on the proxy's transport configuration.
-// The returned recycle function should be called when the stream is no longer in use
-// to return compression resources to the pool. It is safe to not call recycle,
-// in which case resources will be garbage collected normally.
-func (pxy *BaseProxy) wrapWorkConn(conn net.Conn, encKey []byte) (io.ReadWriteCloser, func(), error) {
-	var rwc io.ReadWriteCloser = conn
-	if pxy.limiter != nil {
-		rwc = libio.WrapReadWriteCloser(limit.NewReader(conn, pxy.limiter), limit.NewWriter(conn, pxy.limiter), func() error {
-			return conn.Close()
-		})
-	}
-	if pxy.baseCfg.Transport.UseEncryption {
-		var err error
-		rwc, err = libio.WithEncryption(rwc, encKey)
-		if err != nil {
-			conn.Close()
-			return nil, nil, fmt.Errorf("create encryption stream error: %w", err)
-		}
-	}
-	var recycleFn func()
-	if pxy.baseCfg.Transport.UseCompression {
-		rwc, recycleFn = libio.WithCompressionFromPool(rwc)
-	}
-	return rwc, recycleFn, nil
-}
-
 func (pxy *BaseProxy) SetInWorkConnCallback(cb func(*v1.ProxyBaseConfig, net.Conn, *msg.StartWorkConn) bool) {
 	pxy.inWorkConnCallback = cb
 }
@@ -167,14 +139,30 @@ func (pxy *BaseProxy) InWorkConn(conn net.Conn, m *msg.StartWorkConn) {
 func (pxy *BaseProxy) HandleTCPWorkConnection(workConn net.Conn, m *msg.StartWorkConn, encKey []byte) {
 	xl := pxy.xl
 	baseCfg := pxy.baseCfg
+	var (
+		remote io.ReadWriteCloser
+		err    error
+	)
+	remote = workConn
+	if pxy.limiter != nil {
+		remote = libio.WrapReadWriteCloser(limit.NewReader(workConn, pxy.limiter), limit.NewWriter(workConn, pxy.limiter), func() error {
+			return workConn.Close()
+		})
+	}

 	xl.Tracef("handle tcp work connection, useEncryption: %t, useCompression: %t",
 		baseCfg.Transport.UseEncryption, baseCfg.Transport.UseCompression)
-
-	remote, recycleFn, err := pxy.wrapWorkConn(workConn, encKey)
-	if err != nil {
-		xl.Errorf("wrap work connection: %v", err)
-		return
+	if baseCfg.Transport.UseEncryption {
+		remote, err = libio.WithEncryption(remote, encKey)
+		if err != nil {
+			workConn.Close()
+			xl.Errorf("create encryption stream error: %v", err)
+			return
+		}
+	}
+	var compressionResourceRecycleFn func()
+	if baseCfg.Transport.UseCompression {
+		remote, compressionResourceRecycleFn = libio.WithCompressionFromPool(remote)
 	}

 	// check if we need to send proxy protocol info
@@ -190,6 +178,7 @@ func (pxy *BaseProxy) HandleTCPWorkConnection(workConn net.Conn, m *msg.StartWor
 	}

 	if baseCfg.Transport.ProxyProtocolVersion != "" && m.SrcAddr != "" && m.SrcPort != 0 {
+		// Use the common proxy protocol builder function
 		header := netpkg.BuildProxyProtocolHeaderStruct(connInfo.SrcAddr, connInfo.DstAddr, baseCfg.Transport.ProxyProtocolVersion)
 		connInfo.ProxyProtocolHeader = header
 	}
@@ -198,18 +187,12 @@ func (pxy *BaseProxy) HandleTCPWorkConnection(workConn net.Conn, m *msg.StartWor

 	if pxy.proxyPlugin != nil {
 		// if plugin is set, let plugin handle connection first
-		// Don't recycle compression resources here because plugins may
-		// retain the connection after Handle returns.
 		xl.Debugf("handle by plugin: %s", pxy.proxyPlugin.Name())
 		pxy.proxyPlugin.Handle(pxy.ctx, &connInfo)
 		xl.Debugf("handle by plugin finished")
 		return
 	}

-	if recycleFn != nil {
-		defer recycleFn()
-	}
-
 	localConn, err := libnet.Dial(
 		net.JoinHostPort(baseCfg.LocalIP, strconv.Itoa(baseCfg.LocalPort)),
 		libnet.WithTimeout(10*time.Second),
@@ -226,7 +209,6 @@ func (pxy *BaseProxy) HandleTCPWorkConnection(workConn net.Conn, m *msg.StartWor
 	if connInfo.ProxyProtocolHeader != nil {
 		if _, err := connInfo.ProxyProtocolHeader.WriteTo(localConn); err != nil {
 			workConn.Close()
-			localConn.Close()
 			xl.Errorf("write proxy protocol header to local conn error: %v", err)
 			return
 		}
@@ -237,4 +219,7 @@ func (pxy *BaseProxy) HandleTCPWorkConnection(workConn net.Conn, m *msg.StartWor
 	if len(errs) > 0 {
 		xl.Tracef("join connections errors: %v", errs)
 	}
+	if compressionResourceRecycleFn != nil {
+		compressionResourceRecycleFn()
+	}
 }
--- a/client/proxy/sudp.go
+++ b/client/proxy/sudp.go
@@ -17,6 +17,7 @@
 package proxy

 import (
+	"io"
 	"net"
 	"reflect"
 	"strconv"
@@ -24,15 +25,17 @@ import (
 	"time"

 	"github.com/fatedier/golib/errors"
+	libio "github.com/fatedier/golib/io"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
 	"github.com/fatedier/frp/pkg/msg"
 	"github.com/fatedier/frp/pkg/proto/udp"
+	"github.com/fatedier/frp/pkg/util/limit"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
 )

 func init() {
-	RegisterProxyFactory(reflect.TypeFor[*v1.SUDPProxyConfig](), NewSUDPProxy)
+	RegisterProxyFactory(reflect.TypeOf(&v1.SUDPProxyConfig{}), NewSUDPProxy)
 }

 type SUDPProxy struct {
@@ -80,13 +83,27 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 	xl := pxy.xl
 	xl.Infof("incoming a new work connection for sudp proxy, %s", conn.RemoteAddr().String())

-	remote, _, err := pxy.wrapWorkConn(conn, pxy.encryptionKey)
-	if err != nil {
-		xl.Errorf("wrap work connection: %v", err)
-		return
+	var rwc io.ReadWriteCloser = conn
+	var err error
+	if pxy.limiter != nil {
+		rwc = libio.WrapReadWriteCloser(limit.NewReader(conn, pxy.limiter), limit.NewWriter(conn, pxy.limiter), func() error {
+			return conn.Close()
+		})
 	}
+	if pxy.cfg.Transport.UseEncryption {
+		rwc, err = libio.WithEncryption(rwc, pxy.encryptionKey)
+		if err != nil {
+			conn.Close()
+			xl.Errorf("create encryption stream error: %v", err)
+			return
+		}
+	}
+	if pxy.cfg.Transport.UseCompression {
+		rwc = libio.WithCompression(rwc)
+	}
+	conn = netpkg.WrapReadWriteCloserToConn(rwc, conn)

-	workConn := netpkg.WrapReadWriteCloserToConn(remote, conn)
+	workConn := conn
 	readCh := make(chan *msg.UDPPacket, 1024)
 	sendCh := make(chan msg.Message, 1024)
 	isClose := false
--- a/client/proxy/udp.go
+++ b/client/proxy/udp.go
@@ -17,21 +17,24 @@
 package proxy

 import (
+	"io"
 	"net"
 	"reflect"
 	"strconv"
 	"time"

 	"github.com/fatedier/golib/errors"
+	libio "github.com/fatedier/golib/io"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
 	"github.com/fatedier/frp/pkg/msg"
 	"github.com/fatedier/frp/pkg/proto/udp"
+	"github.com/fatedier/frp/pkg/util/limit"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
 )

 func init() {
-	RegisterProxyFactory(reflect.TypeFor[*v1.UDPProxyConfig](), NewUDPProxy)
+	RegisterProxyFactory(reflect.TypeOf(&v1.UDPProxyConfig{}), NewUDPProxy)
 }

 type UDPProxy struct {
@@ -91,14 +94,28 @@ func (pxy *UDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 	// close resources related with old workConn
 	pxy.Close()

-	remote, _, err := pxy.wrapWorkConn(conn, pxy.encryptionKey)
-	if err != nil {
-		xl.Errorf("wrap work connection: %v", err)
-		return
+	var rwc io.ReadWriteCloser = conn
+	var err error
+	if pxy.limiter != nil {
+		rwc = libio.WrapReadWriteCloser(limit.NewReader(conn, pxy.limiter), limit.NewWriter(conn, pxy.limiter), func() error {
+			return conn.Close()
+		})
 	}
+	if pxy.cfg.Transport.UseEncryption {
+		rwc, err = libio.WithEncryption(rwc, pxy.encryptionKey)
+		if err != nil {
+			conn.Close()
+			xl.Errorf("create encryption stream error: %v", err)
+			return
+		}
+	}
+	if pxy.cfg.Transport.UseCompression {
+		rwc = libio.WithCompression(rwc)
+	}
+	conn = netpkg.WrapReadWriteCloserToConn(rwc, conn)

 	pxy.mu.Lock()
-	pxy.workConn = netpkg.WrapReadWriteCloserToConn(remote, conn)
+	pxy.workConn = conn
 	pxy.readCh = make(chan *msg.UDPPacket, 1024)
 	pxy.sendCh = make(chan msg.Message, 1024)
 	pxy.closed = false
--- a/client/proxy/xtcp.go
+++ b/client/proxy/xtcp.go
@@ -34,7 +34,7 @@ import (
 )

 func init() {
-	RegisterProxyFactory(reflect.TypeFor[*v1.XTCPProxyConfig](), NewXTCPProxy)
+	RegisterProxyFactory(reflect.TypeOf(&v1.XTCPProxyConfig{}), NewXTCPProxy)
 }

 type XTCPProxy struct {
--- a/client/service.go
+++ b/client/service.go
@@ -19,8 +19,8 @@ import (
 	"errors"
 	"fmt"
 	"net"
-	"net/http"
 	"os"
+	"runtime"
 	"sync"
 	"time"

@@ -37,6 +37,7 @@ import (
 	httppkg "github.com/fatedier/frp/pkg/util/http"
 	"github.com/fatedier/frp/pkg/util/log"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
+	"github.com/fatedier/frp/pkg/util/version"
 	"github.com/fatedier/frp/pkg/util/wait"
 	"github.com/fatedier/frp/pkg/util/xlog"
 	"github.com/fatedier/frp/pkg/vnet"
@@ -161,6 +162,15 @@ func NewService(options ServiceOptions) (*Service, error) {
 		return nil, err
 	}

+	var webServer *httppkg.Server
+	if options.Common.WebServer.Port > 0 {
+		ws, err := httppkg.NewServer(options.Common.WebServer)
+		if err != nil {
+			return nil, err
+		}
+		webServer = ws
+	}
+
 	authRuntime, err := auth.BuildClientAuth(&options.Common.Auth)
 	if err != nil {
 		return nil, err
@@ -181,17 +191,6 @@ func NewService(options ServiceOptions) (*Service, error) {
 	proxyCfgs = config.CompleteProxyConfigurers(proxyCfgs)
 	visitorCfgs = config.CompleteVisitorConfigurers(visitorCfgs)

-	// Create the web server after all fallible steps so its listener is not
-	// leaked when an earlier error causes NewService to return.
-	var webServer *httppkg.Server
-	if options.Common.WebServer.Port > 0 {
-		ws, err := httppkg.NewServer(options.Common.WebServer)
-		if err != nil {
-			return nil, err
-		}
-		webServer = ws
-	}
-
 	s := &Service{
 		ctx:              context.Background(),
 		auth:             authRuntime,
@@ -230,25 +229,22 @@ func (svr *Service) Run(ctx context.Context) error {
 	}

 	if svr.vnetController != nil {
-		vnetController := svr.vnetController
 		if err := svr.vnetController.Init(); err != nil {
 			log.Errorf("init virtual network controller error: %v", err)
-			svr.stop()
 			return err
 		}
 		go func() {
 			log.Infof("virtual network controller start...")
-			if err := vnetController.Run(); err != nil && !errors.Is(err, net.ErrClosed) {
+			if err := svr.vnetController.Run(); err != nil {
 				log.Warnf("virtual network controller exit with error: %v", err)
 			}
 		}()
 	}

 	if svr.webServer != nil {
-		webServer := svr.webServer
 		go func() {
-			log.Infof("admin server listen on %s", webServer.Address())
-			if err := webServer.Run(); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			log.Infof("admin server listen on %s", svr.webServer.Address())
+			if err := svr.webServer.Run(); err != nil {
 				log.Warnf("admin server exit with error: %v", err)
 			}
 		}()
@@ -259,7 +255,6 @@ func (svr *Service) Run(ctx context.Context) error {
 	if svr.ctl == nil {
 		cancelCause := cancelErr{}
 		_ = errors.As(context.Cause(svr.ctx), &cancelCause)
-		svr.stop()
 		return fmt.Errorf("login to the server failed: %v. With loginFailExit enabled, no additional retries will be attempted", cancelCause.Err)
 	}

@@ -301,20 +296,80 @@ func (svr *Service) keepControllerWorking() {
 	), true, svr.ctx.Done())
 }

+// login creates a connection to frps and registers it self as a client
+// conn: control connection
+// session: if it's not nil, using tcp mux
+func (svr *Service) login() (conn net.Conn, connector Connector, err error) {
+	xl := xlog.FromContextSafe(svr.ctx)
+	connector = svr.connectorCreator(svr.ctx, svr.common)
+	if err = connector.Open(); err != nil {
+		return nil, nil, err
+	}
+
+	defer func() {
+		if err != nil {
+			connector.Close()
+		}
+	}()
+
+	conn, err = connector.Connect()
+	if err != nil {
+		return
+	}
+
+	hostname, _ := os.Hostname()
+
+	loginMsg := &msg.Login{
+		Arch:      runtime.GOARCH,
+		Os:        runtime.GOOS,
+		Hostname:  hostname,
+		PoolCount: svr.common.Transport.PoolCount,
+		User:      svr.common.User,
+		ClientID:  svr.common.ClientID,
+		Version:   version.Full(),
+		Timestamp: time.Now().Unix(),
+		RunID:     svr.runID,
+		Metas:     svr.common.Metadatas,
+	}
+	if svr.clientSpec != nil {
+		loginMsg.ClientSpec = *svr.clientSpec
+	}
+
+	// Add auth
+	if err = svr.auth.Setter.SetLogin(loginMsg); err != nil {
+		return
+	}
+
+	if err = msg.WriteMsg(conn, loginMsg); err != nil {
+		return
+	}
+
+	var loginRespMsg msg.LoginResp
+	_ = conn.SetReadDeadline(time.Now().Add(10 * time.Second))
+	if err = msg.ReadMsgInto(conn, &loginRespMsg); err != nil {
+		return
+	}
+	_ = conn.SetReadDeadline(time.Time{})
+
+	if loginRespMsg.Error != "" {
+		err = fmt.Errorf("%s", loginRespMsg.Error)
+		xl.Errorf("%s", loginRespMsg.Error)
+		return
+	}
+
+	svr.runID = loginRespMsg.RunID
+	xl.AddPrefix(xlog.LogPrefix{Name: "runID", Value: svr.runID})
+
+	xl.Infof("login to server success, get run id [%s]", loginRespMsg.RunID)
+	return
+}
+
 func (svr *Service) loopLoginUntilSuccess(maxInterval time.Duration, firstLoginExit bool) {
 	xl := xlog.FromContextSafe(svr.ctx)

 	loginFunc := func() (bool, error) {
 		xl.Infof("try to connect to server...")
-		dialer := &controlSessionDialer{
-			ctx:              svr.ctx,
-			common:           svr.common,
-			auth:             svr.auth,
-			clientSpec:       svr.clientSpec,
-			vnetController:   svr.vnetController,
-			connectorCreator: svr.connectorCreator,
-		}
-		sessionCtx, err := dialer.Dial(svr.runID)
+		conn, connector, err := svr.login()
 		if err != nil {
 			xl.Warnf("connect to server error: %v", err)
 			if firstLoginExit {
@@ -323,19 +378,25 @@ func (svr *Service) loopLoginUntilSuccess(maxInterval time.Duration, firstLoginE
 			return false, err
 		}

-		svr.runID = sessionCtx.RunID
-		xl.AddPrefix(xlog.LogPrefix{Name: "runID", Value: svr.runID})
-		xl.Infof("login to server success, get run id [%s]", svr.runID)
-
 		svr.cfgMu.RLock()
 		proxyCfgs := svr.proxyCfgs
 		visitorCfgs := svr.visitorCfgs
 		svr.cfgMu.RUnlock()

+		connEncrypted := svr.clientSpec == nil || svr.clientSpec.Type != "ssh-tunnel"
+
+		sessionCtx := &SessionContext{
+			Common:         svr.common,
+			RunID:          svr.runID,
+			Conn:           conn,
+			ConnEncrypted:  connEncrypted,
+			Auth:           svr.auth,
+			Connector:      connector,
+			VnetController: svr.vnetController,
+		}
 		ctl, err := NewControl(svr.ctx, sessionCtx)
 		if err != nil {
-			sessionCtx.Conn.Close()
-			sessionCtx.Connector.Close()
+			conn.Close()
 			xl.Errorf("new control error: %v", err)
 			return false, err
 		}
@@ -436,10 +497,6 @@ func (svr *Service) stop() {
 		svr.webServer.Close()
 		svr.webServer = nil
 	}
-	if svr.vnetController != nil {
-		_ = svr.vnetController.Stop()
-		svr.vnetController = nil
-	}
 }

 func (svr *Service) getProxyStatus(name string) (*proxy.WorkingStatus, bool) {
@@ -453,17 +510,6 @@ func (svr *Service) getProxyStatus(name string) (*proxy.WorkingStatus, bool) {
 	return ctl.pm.GetProxyStatus(name)
 }

-func (svr *Service) getVisitorCfg(name string) (v1.VisitorConfigurer, bool) {
-	svr.ctlMu.RLock()
-	ctl := svr.ctl
-	svr.ctlMu.RUnlock()
-
-	if ctl == nil {
-		return nil, false
-	}
-	return ctl.vm.GetVisitorCfg(name)
-}
-
 func (svr *Service) StatusExporter() StatusExporter {
 	return &statusExporterImpl{
 		getProxyStatusFunc: svr.getProxyStatus,
--- a/client/service_test.go
+++ b/client/service_test.go
@@ -1,120 +1,14 @@
 package client

 import (
-	"context"
-	"errors"
-	"net"
 	"path/filepath"
-	"strconv"
 	"strings"
 	"testing"

-	"github.com/samber/lo"
-
 	"github.com/fatedier/frp/pkg/config/source"
 	v1 "github.com/fatedier/frp/pkg/config/v1"
 )

-type failingConnector struct {
-	err error
-}
-
-func (c *failingConnector) Open() error {
-	return c.err
-}
-
-func (c *failingConnector) Connect() (net.Conn, error) {
-	return nil, c.err
-}
-
-func (c *failingConnector) Close() error {
-	return nil
-}
-
-func getFreeTCPPort(t *testing.T) int {
-	t.Helper()
-
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen on ephemeral port: %v", err)
-	}
-	defer ln.Close()
-
-	return ln.Addr().(*net.TCPAddr).Port
-}
-
-func TestRunStopsStartedComponentsOnInitialLoginFailure(t *testing.T) {
-	port := getFreeTCPPort(t)
-	agg := source.NewAggregator(source.NewConfigSource())
-
-	svr, err := NewService(ServiceOptions{
-		Common: &v1.ClientCommonConfig{
-			LoginFailExit: lo.ToPtr(true),
-			WebServer: v1.WebServerConfig{
-				Addr: "127.0.0.1",
-				Port: port,
-			},
-		},
-		ConfigSourceAggregator: agg,
-		ConnectorCreator: func(context.Context, *v1.ClientCommonConfig) Connector {
-			return &failingConnector{err: errors.New("login boom")}
-		},
-	})
-	if err != nil {
-		t.Fatalf("new service: %v", err)
-	}
-
-	err = svr.Run(context.Background())
-	if err == nil {
-		t.Fatal("expected run error, got nil")
-	}
-	if !strings.Contains(err.Error(), "login boom") {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if svr.webServer != nil {
-		t.Fatal("expected web server to be cleaned up after initial login failure")
-	}
-
-	ln, err := net.Listen("tcp", net.JoinHostPort("127.0.0.1", strconv.Itoa(port)))
-	if err != nil {
-		t.Fatalf("expected admin port to be released: %v", err)
-	}
-	_ = ln.Close()
-}
-
-func TestNewServiceDoesNotLeakAdminListenerOnAuthBuildFailure(t *testing.T) {
-	port := getFreeTCPPort(t)
-	agg := source.NewAggregator(source.NewConfigSource())
-
-	_, err := NewService(ServiceOptions{
-		Common: &v1.ClientCommonConfig{
-			Auth: v1.AuthClientConfig{
-				Method: v1.AuthMethodOIDC,
-				OIDC: v1.AuthOIDCClientConfig{
-					TokenEndpointURL: "://bad",
-				},
-			},
-			WebServer: v1.WebServerConfig{
-				Addr: "127.0.0.1",
-				Port: port,
-			},
-		},
-		ConfigSourceAggregator: agg,
-	})
-	if err == nil {
-		t.Fatal("expected new service error, got nil")
-	}
-	if !strings.Contains(err.Error(), "auth.oidc.tokenEndpointURL") {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	ln, err := net.Listen("tcp", net.JoinHostPort("127.0.0.1", strconv.Itoa(port)))
-	if err != nil {
-		t.Fatalf("expected admin port to remain free: %v", err)
-	}
-	_ = ln.Close()
-}
-
 func TestUpdateConfigSourceRollsBackReloadCommonOnReplaceAllFailure(t *testing.T) {
 	prevCommon := &v1.ClientCommonConfig{User: "old-user"}
 	newCommon := &v1.ClientCommonConfig{User: "new-user"}
--- a/client/visitor/stcp.go
+++ b/client/visitor/stcp.go
@@ -15,12 +15,18 @@
 package visitor

 import (
+	"fmt"
+	"io"
 	"net"
 	"strconv"
+	"time"

 	libio "github.com/fatedier/golib/io"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
+	"github.com/fatedier/frp/pkg/msg"
+	"github.com/fatedier/frp/pkg/naming"
+	"github.com/fatedier/frp/pkg/util/util"
 	"github.com/fatedier/frp/pkg/util/xlog"
 )

@@ -36,10 +42,10 @@ func (sv *STCPVisitor) Run() (err error) {
 		if err != nil {
 			return
 		}
-		go sv.acceptLoop(sv.l, "stcp local", sv.handleConn)
+		go sv.worker()
 	}

-	go sv.acceptLoop(sv.internalLn, "stcp internal", sv.handleConn)
+	go sv.internalConnWorker()

 	if sv.plugin != nil {
 		sv.plugin.Start()
@@ -51,10 +57,35 @@ func (sv *STCPVisitor) Close() {
 	sv.BaseVisitor.Close()
 }

+func (sv *STCPVisitor) worker() {
+	xl := xlog.FromContextSafe(sv.ctx)
+	for {
+		conn, err := sv.l.Accept()
+		if err != nil {
+			xl.Warnf("stcp local listener closed")
+			return
+		}
+		go sv.handleConn(conn)
+	}
+}
+
+func (sv *STCPVisitor) internalConnWorker() {
+	xl := xlog.FromContextSafe(sv.ctx)
+	for {
+		conn, err := sv.internalLn.Accept()
+		if err != nil {
+			xl.Warnf("stcp internal listener closed")
+			return
+		}
+		go sv.handleConn(conn)
+	}
+}
+
 func (sv *STCPVisitor) handleConn(userConn net.Conn) {
 	xl := xlog.FromContextSafe(sv.ctx)
 	var tunnelErr error
 	defer func() {
+		// If there was an error and connection supports CloseWithError, use it
 		if tunnelErr != nil {
 			if eConn, ok := userConn.(interface{ CloseWithError(error) error }); ok {
 				_ = eConn.CloseWithError(tunnelErr)
@@ -65,21 +96,62 @@ func (sv *STCPVisitor) handleConn(userConn net.Conn) {
 	}()

 	xl.Debugf("get a new stcp user connection")
-	visitorConn, err := sv.dialRawVisitorConn(sv.cfg.GetBaseConfig())
+	visitorConn, err := sv.helper.ConnectServer()
 	if err != nil {
-		xl.Warnf("dialRawVisitorConn error: %v", err)
 		tunnelErr = err
 		return
 	}
 	defer visitorConn.Close()

-	remote, recycleFn, err := wrapVisitorConn(visitorConn, sv.cfg.GetBaseConfig())
+	now := time.Now().Unix()
+	targetProxyName := naming.BuildTargetServerProxyName(sv.clientCfg.User, sv.cfg.ServerUser, sv.cfg.ServerName)
+	newVisitorConnMsg := &msg.NewVisitorConn{
+		RunID:          sv.helper.RunID(),
+		ProxyName:      targetProxyName,
+		SignKey:        util.GetAuthKey(sv.cfg.SecretKey, now),
+		Timestamp:      now,
+		UseEncryption:  sv.cfg.Transport.UseEncryption,
+		UseCompression: sv.cfg.Transport.UseCompression,
+	}
+	err = msg.WriteMsg(visitorConn, newVisitorConnMsg)
 	if err != nil {
-		xl.Warnf("wrapVisitorConn error: %v", err)
+		xl.Warnf("send newVisitorConnMsg to server error: %v", err)
 		tunnelErr = err
 		return
 	}
-	defer recycleFn()
+
+	var newVisitorConnRespMsg msg.NewVisitorConnResp
+	_ = visitorConn.SetReadDeadline(time.Now().Add(10 * time.Second))
+	err = msg.ReadMsgInto(visitorConn, &newVisitorConnRespMsg)
+	if err != nil {
+		xl.Warnf("get newVisitorConnRespMsg error: %v", err)
+		tunnelErr = err
+		return
+	}
+	_ = visitorConn.SetReadDeadline(time.Time{})
+
+	if newVisitorConnRespMsg.Error != "" {
+		xl.Warnf("start new visitor connection error: %s", newVisitorConnRespMsg.Error)
+		tunnelErr = fmt.Errorf("%s", newVisitorConnRespMsg.Error)
+		return
+	}
+
+	var remote io.ReadWriteCloser
+	remote = visitorConn
+	if sv.cfg.Transport.UseEncryption {
+		remote, err = libio.WithEncryption(remote, []byte(sv.cfg.SecretKey))
+		if err != nil {
+			xl.Errorf("create encryption stream error: %v", err)
+			tunnelErr = err
+			return
+		}
+	}
+
+	if sv.cfg.Transport.UseCompression {
+		var recycleFn func()
+		remote, recycleFn = libio.WithCompressionFromPool(remote)
+		defer recycleFn()
+	}

 	libio.Join(userConn, remote)
 }
--- a/client/visitor/sudp.go
+++ b/client/visitor/sudp.go
@@ -16,17 +16,21 @@ package visitor

 import (
 	"fmt"
+	"io"
 	"net"
 	"strconv"
 	"sync"
 	"time"

 	"github.com/fatedier/golib/errors"
+	libio "github.com/fatedier/golib/io"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
 	"github.com/fatedier/frp/pkg/msg"
+	"github.com/fatedier/frp/pkg/naming"
 	"github.com/fatedier/frp/pkg/proto/udp"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
+	"github.com/fatedier/frp/pkg/util/util"
 	"github.com/fatedier/frp/pkg/util/xlog"
 )

@@ -72,7 +76,6 @@ func (sv *SUDPVisitor) dispatcher() {

 	var (
 		visitorConn net.Conn
-		recycleFn   func()
 		err         error

 		firstPacket *msg.UDPPacket
@@ -90,17 +93,14 @@ func (sv *SUDPVisitor) dispatcher() {
 			return
 		}

-		visitorConn, recycleFn, err = sv.getNewVisitorConn()
+		visitorConn, err = sv.getNewVisitorConn()
 		if err != nil {
 			xl.Warnf("newVisitorConn to frps error: %v, try to reconnect", err)
 			continue
 		}

 		// visitorConn always be closed when worker done.
-		func() {
-			defer recycleFn()
-			sv.worker(visitorConn, firstPacket)
-		}()
+		sv.worker(visitorConn, firstPacket)

 		select {
 		case <-sv.checkCloseCh:
@@ -198,17 +198,53 @@ func (sv *SUDPVisitor) worker(workConn net.Conn, firstPacket *msg.UDPPacket) {
 	xl.Infof("sudp worker is closed")
 }

-func (sv *SUDPVisitor) getNewVisitorConn() (net.Conn, func(), error) {
-	rawConn, err := sv.dialRawVisitorConn(sv.cfg.GetBaseConfig())
+func (sv *SUDPVisitor) getNewVisitorConn() (net.Conn, error) {
+	xl := xlog.FromContextSafe(sv.ctx)
+	visitorConn, err := sv.helper.ConnectServer()
 	if err != nil {
-		return nil, func() {}, err
+		return nil, fmt.Errorf("frpc connect frps error: %v", err)
 	}
-	rwc, recycleFn, err := wrapVisitorConn(rawConn, sv.cfg.GetBaseConfig())
+
+	now := time.Now().Unix()
+	targetProxyName := naming.BuildTargetServerProxyName(sv.clientCfg.User, sv.cfg.ServerUser, sv.cfg.ServerName)
+	newVisitorConnMsg := &msg.NewVisitorConn{
+		RunID:          sv.helper.RunID(),
+		ProxyName:      targetProxyName,
+		SignKey:        util.GetAuthKey(sv.cfg.SecretKey, now),
+		Timestamp:      now,
+		UseEncryption:  sv.cfg.Transport.UseEncryption,
+		UseCompression: sv.cfg.Transport.UseCompression,
+	}
+	err = msg.WriteMsg(visitorConn, newVisitorConnMsg)
 	if err != nil {
-		rawConn.Close()
-		return nil, func() {}, err
+		return nil, fmt.Errorf("frpc send newVisitorConnMsg to frps error: %v", err)
 	}
-	return netpkg.WrapReadWriteCloserToConn(rwc, rawConn), recycleFn, nil
+
+	var newVisitorConnRespMsg msg.NewVisitorConnResp
+	_ = visitorConn.SetReadDeadline(time.Now().Add(10 * time.Second))
+	err = msg.ReadMsgInto(visitorConn, &newVisitorConnRespMsg)
+	if err != nil {
+		return nil, fmt.Errorf("frpc read newVisitorConnRespMsg error: %v", err)
+	}
+	_ = visitorConn.SetReadDeadline(time.Time{})
+
+	if newVisitorConnRespMsg.Error != "" {
+		return nil, fmt.Errorf("start new visitor connection error: %s", newVisitorConnRespMsg.Error)
+	}
+
+	var remote io.ReadWriteCloser
+	remote = visitorConn
+	if sv.cfg.Transport.UseEncryption {
+		remote, err = libio.WithEncryption(remote, []byte(sv.cfg.SecretKey))
+		if err != nil {
+			xl.Errorf("create encryption stream error: %v", err)
+			return nil, err
+		}
+	}
+	if sv.cfg.Transport.UseCompression {
+		remote = libio.WithCompression(remote)
+	}
+	return netpkg.WrapReadWriteCloserToConn(remote, visitorConn), nil
 }

 func (sv *SUDPVisitor) Close() {
--- a/client/visitor/visitor.go
+++ b/client/visitor/visitor.go
@@ -16,21 +16,13 @@ package visitor

 import (
 	"context"
-	"fmt"
-	"io"
 	"net"
 	"sync"
-	"time"
-
-	libio "github.com/fatedier/golib/io"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/naming"
 	plugin "github.com/fatedier/frp/pkg/plugin/visitor"
 	"github.com/fatedier/frp/pkg/transport"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
-	"github.com/fatedier/frp/pkg/util/util"
 	"github.com/fatedier/frp/pkg/util/xlog"
 	"github.com/fatedier/frp/pkg/vnet"
 )
@@ -38,7 +30,7 @@ import (
 // Helper wraps some functions for visitor to use.
 type Helper interface {
 	// ConnectServer directly connects to the frp server.
-	ConnectServer() (*msg.Conn, error)
+	ConnectServer() (net.Conn, error)
 	// TransferConn transfers the connection to another visitor.
 	TransferConn(string, net.Conn) error
 	// MsgTransporter returns the message transporter that is used to send and receive messages
@@ -127,18 +119,6 @@ func (v *BaseVisitor) AcceptConn(conn net.Conn) error {
 	return v.internalLn.PutConn(conn)
 }

-func (v *BaseVisitor) acceptLoop(l net.Listener, name string, handleConn func(net.Conn)) {
-	xl := xlog.FromContextSafe(v.ctx)
-	for {
-		conn, err := l.Accept()
-		if err != nil {
-			xl.Warnf("%s listener closed", name)
-			return
-		}
-		go handleConn(conn)
-	}
-}
-
 func (v *BaseVisitor) Close() {
 	if v.l != nil {
 		v.l.Close()
@@ -150,57 +130,3 @@ func (v *BaseVisitor) Close() {
 		v.plugin.Close()
 	}
 }
-
-func (v *BaseVisitor) dialRawVisitorConn(cfg *v1.VisitorBaseConfig) (net.Conn, error) {
-	visitorConn, err := v.helper.ConnectServer()
-	if err != nil {
-		return nil, fmt.Errorf("connect to server error: %v", err)
-	}
-
-	now := time.Now().Unix()
-	targetProxyName := naming.BuildTargetServerProxyName(v.clientCfg.User, cfg.ServerUser, cfg.ServerName)
-	newVisitorConnMsg := &msg.NewVisitorConn{
-		RunID:          v.helper.RunID(),
-		ProxyName:      targetProxyName,
-		SignKey:        util.GetAuthKey(cfg.SecretKey, now),
-		Timestamp:      now,
-		UseEncryption:  cfg.Transport.UseEncryption,
-		UseCompression: cfg.Transport.UseCompression,
-	}
-	err = visitorConn.WriteMsg(newVisitorConnMsg)
-	if err != nil {
-		visitorConn.Close()
-		return nil, fmt.Errorf("send newVisitorConnMsg to server error: %v", err)
-	}
-
-	_ = visitorConn.SetReadDeadline(time.Now().Add(10 * time.Second))
-	var newVisitorConnRespMsg msg.NewVisitorConnResp
-	err = visitorConn.ReadMsgInto(&newVisitorConnRespMsg)
-	if err != nil {
-		visitorConn.Close()
-		return nil, fmt.Errorf("read newVisitorConnRespMsg error: %v", err)
-	}
-	_ = visitorConn.SetReadDeadline(time.Time{})
-
-	if newVisitorConnRespMsg.Error != "" {
-		visitorConn.Close()
-		return nil, fmt.Errorf("start new visitor connection error: %s", newVisitorConnRespMsg.Error)
-	}
-	return visitorConn, nil
-}
-
-func wrapVisitorConn(conn io.ReadWriteCloser, cfg *v1.VisitorBaseConfig) (io.ReadWriteCloser, func(), error) {
-	rwc := conn
-	if cfg.Transport.UseEncryption {
-		var err error
-		rwc, err = libio.WithEncryption(rwc, []byte(cfg.SecretKey))
-		if err != nil {
-			return nil, func() {}, fmt.Errorf("create encryption stream error: %v", err)
-		}
-	}
-	recycleFn := func() {}
-	if cfg.Transport.UseCompression {
-		rwc, recycleFn = libio.WithCompressionFromPool(rwc)
-	}
-	return rwc, recycleFn, nil
-}
--- a/client/visitor/visitor_manager.go
+++ b/client/visitor/visitor_manager.go
@@ -25,7 +25,6 @@ import (
 	"github.com/samber/lo"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
 	"github.com/fatedier/frp/pkg/transport"
 	"github.com/fatedier/frp/pkg/util/xlog"
 	"github.com/fatedier/frp/pkg/vnet"
@@ -50,7 +49,7 @@ func NewManager(
 	ctx context.Context,
 	runID string,
 	clientCfg *v1.ClientCommonConfig,
-	connectServer func() (*msg.Conn, error),
+	connectServer func() (net.Conn, error),
 	msgTransporter transport.MessageTransporter,
 	vnetController *vnet.Controller,
 ) *Manager {
@@ -192,22 +191,15 @@ func (vm *Manager) TransferConn(name string, conn net.Conn) error {
 	return v.AcceptConn(conn)
 }

-func (vm *Manager) GetVisitorCfg(name string) (v1.VisitorConfigurer, bool) {
-	vm.mu.RLock()
-	defer vm.mu.RUnlock()
-	cfg, ok := vm.cfgs[name]
-	return cfg, ok
-}
-
 type visitorHelperImpl struct {
-	connectServerFn func() (*msg.Conn, error)
+	connectServerFn func() (net.Conn, error)
 	msgTransporter  transport.MessageTransporter
 	vnetController  *vnet.Controller
 	transferConnFn  func(name string, conn net.Conn) error
 	runID           string
 }

-func (v *visitorHelperImpl) ConnectServer() (*msg.Conn, error) {
+func (v *visitorHelperImpl) ConnectServer() (net.Conn, error) {
 	return v.connectServerFn()
 }

--- a/client/visitor/xtcp.go
+++ b/client/visitor/xtcp.go
@@ -65,10 +65,10 @@ func (sv *XTCPVisitor) Run() (err error) {
 		if err != nil {
 			return
 		}
-		go sv.acceptLoop(sv.l, "xtcp local", sv.handleConn)
+		go sv.worker()
 	}

-	go sv.acceptLoop(sv.internalLn, "xtcp internal", sv.handleConn)
+	go sv.internalConnWorker()
 	go sv.processTunnelStartEvents()
 	if sv.cfg.KeepTunnelOpen {
 		sv.retryLimiter = rate.NewLimiter(rate.Every(time.Hour/time.Duration(sv.cfg.MaxRetriesAnHour)), sv.cfg.MaxRetriesAnHour)
@@ -93,6 +93,30 @@ func (sv *XTCPVisitor) Close() {
 	}
 }

+func (sv *XTCPVisitor) worker() {
+	xl := xlog.FromContextSafe(sv.ctx)
+	for {
+		conn, err := sv.l.Accept()
+		if err != nil {
+			xl.Warnf("xtcp local listener closed")
+			return
+		}
+		go sv.handleConn(conn)
+	}
+}
+
+func (sv *XTCPVisitor) internalConnWorker() {
+	xl := xlog.FromContextSafe(sv.ctx)
+	for {
+		conn, err := sv.internalLn.Accept()
+		if err != nil {
+			xl.Warnf("xtcp internal listener closed")
+			return
+		}
+		go sv.handleConn(conn)
+	}
+}
+
 func (sv *XTCPVisitor) processTunnelStartEvents() {
 	for {
 		select {
@@ -182,14 +206,20 @@ func (sv *XTCPVisitor) handleConn(userConn net.Conn) {
 		return
 	}

-	muxConnRWCloser, recycleFn, err := wrapVisitorConn(tunnelConn, sv.cfg.GetBaseConfig())
-	if err != nil {
-		xl.Errorf("%v", err)
-		tunnelConn.Close()
-		tunnelErr = err
-		return
+	var muxConnRWCloser io.ReadWriteCloser = tunnelConn
+	if sv.cfg.Transport.UseEncryption {
+		muxConnRWCloser, err = libio.WithEncryption(muxConnRWCloser, []byte(sv.cfg.SecretKey))
+		if err != nil {
+			xl.Errorf("create encryption stream error: %v", err)
+			tunnelErr = err
+			return
+		}
+	}
+	if sv.cfg.Transport.UseCompression {
+		var recycleFn func()
+		muxConnRWCloser, recycleFn = libio.WithCompressionFromPool(muxConnRWCloser)
+		defer recycleFn()
 	}
-	defer recycleFn()

 	_, _, errs := libio.Join(userConn, muxConnRWCloser)
 	xl.Debugf("join connections closed")
@@ -343,7 +373,6 @@ func (ks *KCPTunnelSession) Init(listenConn *net.UDPConn, raddr *net.UDPAddr) er
 	}
 	remote, err := netpkg.NewKCPConnFromUDP(lConn, true, raddr.String())
 	if err != nil {
-		lConn.Close()
 		return fmt.Errorf("create kcp connection from udp connection error: %v", err)
 	}

--- a/cmd/frpc/sub/nathole.go
+++ b/cmd/frpc/sub/nathole.go
@@ -47,7 +47,7 @@ var natholeDiscoveryCmd = &cobra.Command{
 	Use:   "discover",
 	Short: "Discover nathole information from stun server",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		// ignore error here, because we can use command line parameters
+		// ignore error here, because we can use command line pameters
 		cfg, _, _, _, err := config.LoadClientConfig(cfgFile, strictConfigMode)
 		if err != nil {
 			cfg = &v1.ClientCommonConfig{}
--- a/conf/frpc_full_example.toml
+++ b/conf/frpc_full_example.toml
@@ -103,10 +103,6 @@ transport.poolCount = 5
 # supports tcp, kcp, quic, websocket and wss now, default is tcp
 transport.protocol = "tcp"

-# FRP wire protocol used inside the selected transport.
-# supports v1 and v2, default is v1. v2 requires frps support and must be enabled explicitly.
-# transport.wireProtocol = "v1"
-
 # set client binding ip when connect server, default is empty.
 # only when protocol = tcp or websocket, the value will be used.
 transport.connectServerLocalIP = "0.0.0.0"
--- a/doc/agents/release.md
+++ b/doc/agents/release.md
@@ -1,80 +0,0 @@
-# Release Process
-
-## 1. Update Release Notes
-
-Edit `Release.md` in the project root with the changes for this version:
-
-```markdown
-## Features
-* ...
-
-## Improvements
-* ...
-
-## Fixes
-* ...
-```
-
-This file is used by GoReleaser as the GitHub Release body.
-
-## 2. Bump Version
-
-Update the version string in `pkg/util/version/version.go`:
-
-```go
-var version = "0.X.0"
-```
-
-Commit and push to `dev`:
-
-```bash
-git add pkg/util/version/version.go Release.md
-git commit -m "bump version to vX.Y.Z"
-git push origin dev
-```
-
-## 3. Merge dev → master
-
-Create a PR from `dev` to `master`:
-
-```bash
-gh pr create --base master --head dev --title "bump version"
-```
-
-Wait for CI to pass, then merge using **merge commit** (not squash).
-
-## 4. Tag the Release
-
-```bash
-git checkout master
-git pull origin master
-git tag -a vX.Y.Z -m "bump version"
-git push origin vX.Y.Z
-```
-
-## 5. Trigger GoReleaser
-
-Manually trigger the `goreleaser` workflow in GitHub Actions:
-
-```bash
-gh workflow run goreleaser --ref master
-```
-
-GoReleaser will:
-1. Run `package.sh` to cross-compile all platforms and create archives
-2. Create a GitHub Release with all packages, using `Release.md` as release notes
-
-## Key Files
-
-| File | Purpose |
-|------|---------|
-| `pkg/util/version/version.go` | Version string |
-| `Release.md` | Release notes (read by GoReleaser) |
-| `.goreleaser.yml` | GoReleaser config |
-| `package.sh` | Cross-compile and packaging script |
-| `.github/workflows/goreleaser.yml` | GitHub Actions workflow (manual trigger) |
-
-## Versioning
-
- Minor release: `v0.X.0`
- Patch release: `v0.X.Y` (e.g., `v0.62.1`)
--- a/doc/deprecations.md
+++ b/doc/deprecations.md
@@ -1,38 +0,0 @@
-# Deprecations
-
-This document tracks deprecated features and APIs that are still shipped but scheduled for removal. Maintainers should review this list before each release to decide whether any items are due for removal.
-
-For the version compatibility policy that bounds these support windows, see the latest `Release.md`.
-
-## Active
-
-### Wire protocol v1
-
- **Deprecated since:** v0.70.0 (planned, when v2 becomes the default).
- **Removal target:** v0.78.0 or later. v0.69.0 (the last release where v1 is the default) is supported until v0.78.0 is released, so v0.77.0 is the last release that must keep v1 support.
- **Replacement:** wire protocol v2 (`transport.wireProtocol = "v2"` in frpc).
- **Code references:** v1 message types and codec under `pkg/msg/` and the protocol negotiation path in `client/` and `server/`.
- **Notes:** Removing v1 will also drop compatibility with any frpc/frps that does not negotiate v2.
-
-### INI configuration format
-
- **Deprecated since:** predates this document; startup warning has been in place for several releases.
- **Removal target:** TBD.
- **Replacement:** YAML / JSON / TOML.
- **Code references:**
-  - `cmd/frpc/sub/root.go` — frpc startup warning.
-  - `cmd/frps/root.go` — frps startup warning.
-  - `pkg/config/legacy/` — legacy INI parser; remove together with the warnings.
-
-### Visitor connections without `runID`
-
- **Deprecated since:** v0.50.0 (when `runID` was introduced).
- **Removal target:** TBD.
- **Replacement:** require `runID` on every visitor connection.
- **Code references:**
-  - `server/service.go` — `RegisterVisitorConn` still accepts empty `runID` for backward compatibility.
- **Notes:** Removal will break frpc clients released before v0.50.0. Schedule for a release where dropping pre-v0.50.0 frpc is acceptable.
-
-## Removed
-
-_None yet._
--- a/doc/pic/architecture.jpg
+++ b/doc/pic/architecture.jpg
--- a/doc/pic/architecture.png
+++ b/doc/pic/architecture.png
--- a/dockerfiles/Dockerfile-for-frpc
+++ b/dockerfiles/Dockerfile-for-frpc
@@ -1,11 +1,8 @@
 FROM node:22 AS web-builder

-COPY web/package.json /web/package.json
-COPY web/shared/ /web/shared/
-COPY web/frpc/ /web/frpc/
-WORKDIR /web
-RUN npm install
 WORKDIR /web/frpc
+COPY web/frpc/ ./
+RUN npm install
 RUN npm run build

 FROM golang:1.25 AS building
--- a/dockerfiles/Dockerfile-for-frps
+++ b/dockerfiles/Dockerfile-for-frps
@@ -1,11 +1,8 @@
 FROM node:22 AS web-builder

-COPY web/package.json /web/package.json
-COPY web/shared/ /web/shared/
-COPY web/frps/ /web/frps/
-WORKDIR /web
-RUN npm install
 WORKDIR /web/frps
+COPY web/frps/ ./
+RUN npm install
 RUN npm run build

 FROM golang:1.25 AS building
--- a/go.mod
+++ b/go.mod
@@ -5,7 +5,7 @@ go 1.25.0
 require (
 	github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5
 	github.com/coreos/go-oidc/v3 v3.14.1
-	github.com/fatedier/golib v0.6.0
+	github.com/fatedier/golib v0.5.1
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.1
 	github.com/gorilla/websocket v1.5.0
@@ -13,7 +13,7 @@ require (
 	github.com/onsi/ginkgo/v2 v2.23.4
 	github.com/onsi/gomega v1.36.3
 	github.com/pelletier/go-toml/v2 v2.2.0
-	github.com/pion/stun/v3 v3.1.1
+	github.com/pion/stun/v2 v2.0.0
 	github.com/pires/go-proxyproto v0.7.0
 	github.com/prometheus/client_golang v1.19.1
 	github.com/quic-go/quic-go v0.55.0
@@ -22,15 +22,15 @@ require (
 	github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8
 	github.com/spf13/cobra v1.8.0
 	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.11.1
+	github.com/stretchr/testify v1.10.0
 	github.com/tidwall/gjson v1.17.1
 	github.com/vishvananda/netlink v1.3.0
 	github.com/xtaci/kcp-go/v5 v5.6.13
-	golang.org/x/crypto v0.49.0
-	golang.org/x/net v0.52.0
+	golang.org/x/crypto v0.41.0
+	golang.org/x/net v0.43.0
 	golang.org/x/oauth2 v0.28.0
-	golang.org/x/sync v0.20.0
-	golang.org/x/time v0.10.0
+	golang.org/x/sync v0.16.0
+	golang.org/x/time v0.5.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	gopkg.in/ini.v1 v1.67.0
 	k8s.io/apimachinery v0.28.8
@@ -38,7 +38,7 @@ require (
 )

 require (
-	github.com/Azure/go-ntlmssp v0.1.0 // indirect
+	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
@@ -51,9 +51,10 @@ require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.6 // indirect
 	github.com/klauspost/reedsolomon v1.12.0 // indirect
-	github.com/pion/dtls/v3 v3.0.10 // indirect
-	github.com/pion/logging v0.2.4 // indirect
-	github.com/pion/transport/v4 v4.0.1 // indirect
+	github.com/pion/dtls/v2 v2.2.7 // indirect
+	github.com/pion/logging v0.2.2 // indirect
+	github.com/pion/transport/v2 v2.2.1 // indirect
+	github.com/pion/transport/v3 v3.0.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.5.0 // indirect
@@ -65,12 +66,11 @@ require (
 	github.com/tidwall/pretty v1.2.0 // indirect
 	github.com/tjfoc/gmsm v1.4.1 // indirect
 	github.com/vishvananda/netns v0.0.4 // indirect
-	github.com/wlynxg/anet v0.0.5 // indirect
 	go.uber.org/automaxprocs v1.6.0 // indirect
-	golang.org/x/mod v0.33.0 // indirect
-	golang.org/x/sys v0.42.0 // indirect
-	golang.org/x/text v0.35.0 // indirect
-	golang.org/x/tools v0.42.0 // indirect
+	golang.org/x/mod v0.27.0 // indirect
+	golang.org/x/sys v0.35.0 // indirect
+	golang.org/x/text v0.28.0 // indirect
+	golang.org/x/tools v0.36.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
--- a/go.sum
+++ b/go.sum
@@ -1,6 +1,6 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-github.com/Azure/go-ntlmssp v0.1.0 h1:DjFo6YtWzNqNvQdrwEyr/e4nhU3vRiwenz5QX7sFz+A=
-github.com/Azure/go-ntlmssp v0.1.0/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
@@ -20,8 +20,8 @@ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/fatedier/golib v0.6.0 h1:/mgBZZbkbMhIEZoXf7nV8knpUDzas/b+2ruYKxx1lww=
-github.com/fatedier/golib v0.6.0/go.mod h1:ArUGvPg2cOw/py2RAuBt46nNZH2VQ5Z70p109MAZpJw=
+github.com/fatedier/golib v0.5.1 h1:hcKAnaw5mdI/1KWRGejxR+i1Hn/NvbY5UsMKDr7o13M=
+github.com/fatedier/golib v0.5.1/go.mod h1:W6kIYkIFxHsTzbgqg5piCxIiDo4LzwgTY6R5W8l9NFQ=
 github.com/fatedier/yamux v0.0.0-20250825093530-d0154be01cd6 h1:u92UUy6FURPmNsMBUuongRWC0rBqN6gd01Dzu+D21NE=
 github.com/fatedier/yamux v0.0.0-20250825093530-d0154be01cd6/go.mod h1:c5/tk6G0dSpXGzJN7Wk1OEie8grdSJAmeawId9Zvd34=
 github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
@@ -78,14 +78,16 @@ github.com/onsi/gomega v1.36.3 h1:hID7cr8t3Wp26+cYnfcjR6HpJ00fdogN6dqZ1t6IylU=
 github.com/onsi/gomega v1.36.3/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
 github.com/pelletier/go-toml/v2 v2.2.0 h1:QLgLl2yMN7N+ruc31VynXs1vhMZa7CeHHejIeBAsoHo=
 github.com/pelletier/go-toml/v2 v2.2.0/go.mod h1:1t835xjRzz80PqgE6HHgN2JOsmgYu/h4qDAS4n929Rs=
-github.com/pion/dtls/v3 v3.0.10 h1:k9ekkq1kaZoxnNEbyLKI8DI37j/Nbk1HWmMuywpQJgg=
-github.com/pion/dtls/v3 v3.0.10/go.mod h1:YEmmBYIoBsY3jmG56dsziTv/Lca9y4Om83370CXfqJ8=
-github.com/pion/logging v0.2.4 h1:tTew+7cmQ+Mc1pTBLKH2puKsOvhm32dROumOZ655zB8=
-github.com/pion/logging v0.2.4/go.mod h1:DffhXTKYdNZU+KtJ5pyQDjvOAh/GsNSyv1lbkFbe3so=
-github.com/pion/stun/v3 v3.1.1 h1:CkQxveJ4xGQjulGSROXbXq94TAWu8gIX2dT+ePhUkqw=
-github.com/pion/stun/v3 v3.1.1/go.mod h1:qC1DfmcCTQjl9PBaMa5wSn3x9IPmKxSdcCsxBcDBndM=
-github.com/pion/transport/v4 v4.0.1 h1:sdROELU6BZ63Ab7FrOLn13M6YdJLY20wldXW2Cu2k8o=
-github.com/pion/transport/v4 v4.0.1/go.mod h1:nEuEA4AD5lPdcIegQDpVLgNoDGreqM/YqmEx3ovP4jM=
+github.com/pion/dtls/v2 v2.2.7 h1:cSUBsETxepsCSFSxC3mc/aDo14qQLMSL+O6IjG28yV8=
+github.com/pion/dtls/v2 v2.2.7/go.mod h1:8WiMkebSHFD0T+dIU+UeBaoV7kDhOW5oDCzZ7WZ/F9s=
+github.com/pion/logging v0.2.2 h1:M9+AIj/+pxNsDfAT64+MAVgJO0rsyLnoJKCqf//DoeY=
+github.com/pion/logging v0.2.2/go.mod h1:k0/tDVsRCX2Mb2ZEmTqNa7CWsQPc+YYCB7Q+5pahoms=
+github.com/pion/stun/v2 v2.0.0 h1:A5+wXKLAypxQri59+tmQKVs7+l6mMM+3d+eER9ifRU0=
+github.com/pion/stun/v2 v2.0.0/go.mod h1:22qRSh08fSEttYUmJZGlriq9+03jtVmXNODgLccj8GQ=
+github.com/pion/transport/v2 v2.2.1 h1:7qYnCBlpgSJNYMbLCKuSY9KbQdBFoETvPNETv0y4N7c=
+github.com/pion/transport/v2 v2.2.1/go.mod h1:cXXWavvCnFF6McHTft3DWS9iic2Mftcz1Aq29pGcU5g=
+github.com/pion/transport/v3 v3.0.1 h1:gDTlPJwROfSfz6QfSi0ZmeCSkFcnWWiiR9ES0ouANiM=
+github.com/pion/transport/v3 v3.0.1/go.mod h1:UY7kiITrlMv7/IKgd5eTUcaahZx5oUN3l9SzK5f5xE0=
 github.com/pires/go-proxyproto v0.7.0 h1:IukmRewDQFWC7kfnb66CSomk2q/seBuilHBYFwyq0Hs=
 github.com/pires/go-proxyproto v0.7.0/go.mod h1:Vz/1JPY/OACxWGQNIRY2BeyDmpoaWmEP40O9LbuiFR4=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -126,10 +128,11 @@ github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpE
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/templexxx/cpu v0.1.1 h1:isxHaxBXpYFWnk2DReuKkigaZyrjs2+9ypIdGP4h+HI=
 github.com/templexxx/cpu v0.1.1/go.mod h1:w7Tb+7qgcAlIyX4NhLuDKt78AHA5SzPmq0Wj6HiEnnk=
 github.com/templexxx/xorsimd v0.4.3 h1:9AQTFHd7Bhk3dIT7Al2XeBX5DWOvsUPZCuhyAtNbHjU=
@@ -146,12 +149,11 @@ github.com/vishvananda/netlink v1.3.0 h1:X7l42GfcV4S6E4vHTsw48qbrV+9PVojNfIhZcwQ
 github.com/vishvananda/netlink v1.3.0/go.mod h1:i6NetklAujEcC6fK0JPjT8qSwWyO0HLn4UKG+hGqeJs=
 github.com/vishvananda/netns v0.0.4 h1:Oeaw1EM2JMxD51g9uhtC0D7erkIjgmj8+JZc26m1YX8=
 github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
-github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
-github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
 github.com/xtaci/kcp-go/v5 v5.6.13 h1:FEjtz9+D4p8t2x4WjciGt/jsIuhlWjjgPCCWjrVR4Hk=
 github.com/xtaci/kcp-go/v5 v5.6.13/go.mod h1:75S1AKYYzNUSXIv30h+jPKJYZUwqpfvLshu63nCNSOM=
 github.com/xtaci/lossyconn v0.0.0-20200209145036-adba10fffc37 h1:EWU6Pktpas0n8lLQwDsRyZfmkPeRbdgPtW609es+/9E=
 github.com/xtaci/lossyconn v0.0.0-20200209145036-adba10fffc37/go.mod h1:HpMP7DB2CyokmAh4lp0EQnnWhmycP/TvwBGzvuie+H0=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
 go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
@@ -159,54 +161,89 @@ go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201012173705-84dcc777aaee/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
-golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE=
+golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
+golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
+golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
-golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
+golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201010224723-4f7140c49acb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
+golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
+golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.28.0 h1:CrgCKl8PPAVtLnU3c+EDw6x11699EWlsDeWNWKdIOkc=
 golang.org/x/oauth2 v0.28.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
+golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
+golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
-golang.org/x/time v0.10.0 h1:3usCWA8tQn0L8+hFJQNgzpWbd89begxN66o1Ojdn5L4=
-golang.org/x/time v0.10.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
+golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
-golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
--- a/pkg/auth/oidc.go
+++ b/pkg/auth/oidc.go
@@ -23,14 +23,12 @@ import (
 	"net/url"
 	"os"
 	"slices"
-	"sync"

 	"github.com/coreos/go-oidc/v3/oidc"
 	"golang.org/x/oauth2"
 	"golang.org/x/oauth2/clientcredentials"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/config/v1/validation"
 	"github.com/fatedier/frp/pkg/msg"
 )

@@ -76,64 +74,14 @@ func createOIDCHTTPClient(trustedCAFile string, insecureSkipVerify bool, proxyUR
 	return &http.Client{Transport: transport}, nil
 }

-// nonCachingTokenSource wraps a clientcredentials.Config to fetch a fresh
-// token on every call. This is used as a fallback when the OIDC provider
-// does not return expires_in, which would cause a caching TokenSource to
-// hold onto a stale token forever.
-type nonCachingTokenSource struct {
-	cfg *clientcredentials.Config
-	ctx context.Context
-}
-
-func (s *nonCachingTokenSource) Token() (*oauth2.Token, error) {
-	return s.cfg.Token(s.ctx)
-}
-
-// oidcTokenSource wraps a caching oauth2.TokenSource and, on the first
-// successful Token() call, checks whether the provider returns an expiry.
-// If not, it permanently switches to nonCachingTokenSource so that a fresh
-// token is fetched every time.  This avoids an eager network call at
-// construction time, letting the login retry loop handle transient IdP
-// outages.
-type oidcTokenSource struct {
-	mu          sync.Mutex
-	initialized bool
-	source      oauth2.TokenSource
-	fallbackCfg *clientcredentials.Config
-	fallbackCtx context.Context
-}
-
-func (s *oidcTokenSource) Token() (*oauth2.Token, error) {
-	s.mu.Lock()
-	if !s.initialized {
-		token, err := s.source.Token()
-		if err != nil {
-			s.mu.Unlock()
-			return nil, err
-		}
-		if token.Expiry.IsZero() {
-			s.source = &nonCachingTokenSource{cfg: s.fallbackCfg, ctx: s.fallbackCtx}
-		}
-		s.initialized = true
-		s.mu.Unlock()
-		return token, nil
-	}
-	source := s.source
-	s.mu.Unlock()
-	return source.Token()
-}
-
 type OidcAuthProvider struct {
 	additionalAuthScopes []v1.AuthScope

-	tokenSource oauth2.TokenSource
+	tokenGenerator *clientcredentials.Config
+	httpClient     *http.Client
 }

 func NewOidcAuthSetter(additionalAuthScopes []v1.AuthScope, cfg v1.AuthOIDCClientConfig) (*OidcAuthProvider, error) {
-	if err := validation.ValidateOIDCClientCredentialsConfig(&cfg); err != nil {
-		return nil, err
-	}
-
 	eps := make(map[string][]string)
 	for k, v := range cfg.AdditionalEndpointParams {
 		eps[k] = []string{v}
@@ -151,42 +99,30 @@ func NewOidcAuthSetter(additionalAuthScopes []v1.AuthScope, cfg v1.AuthOIDCClien
 		EndpointParams: eps,
 	}

-	// Build the context that TokenSource will use for all future HTTP requests.
-	// context.Background() is appropriate here because the token source is
-	// long-lived and outlives any single request.
-	ctx := context.Background()
+	// Create custom HTTP client if needed
+	var httpClient *http.Client
 	if cfg.TrustedCaFile != "" || cfg.InsecureSkipVerify || cfg.ProxyURL != "" {
-		httpClient, err := createOIDCHTTPClient(cfg.TrustedCaFile, cfg.InsecureSkipVerify, cfg.ProxyURL)
+		var err error
+		httpClient, err = createOIDCHTTPClient(cfg.TrustedCaFile, cfg.InsecureSkipVerify, cfg.ProxyURL)
 		if err != nil {
 			return nil, fmt.Errorf("failed to create OIDC HTTP client: %w", err)
 		}
-		ctx = context.WithValue(ctx, oauth2.HTTPClient, httpClient)
 	}

-	// Create a persistent TokenSource that caches the token and refreshes
-	// it before expiry. This avoids making a new HTTP request to the OIDC
-	// provider on every heartbeat/ping.
-	//
-	// We wrap it in an oidcTokenSource so that the first Token() call
-	// (deferred to SetLogin inside the login retry loop) probes whether the
-	// provider returns expires_in.  If not, it switches to a non-caching
-	// source.  This avoids an eager network call at construction time, which
-	// would prevent loopLoginUntilSuccess from retrying on transient IdP
-	// outages.
-	cachingSource := tokenGenerator.TokenSource(ctx)
-
 	return &OidcAuthProvider{
 		additionalAuthScopes: additionalAuthScopes,
-		tokenSource: &oidcTokenSource{
-			source:      cachingSource,
-			fallbackCfg: tokenGenerator,
-			fallbackCtx: ctx,
-		},
+		tokenGenerator:       tokenGenerator,
+		httpClient:           httpClient,
 	}, nil
 }

 func (auth *OidcAuthProvider) generateAccessToken() (accessToken string, err error) {
-	tokenObj, err := auth.tokenSource.Token()
+	ctx := context.Background()
+	if auth.httpClient != nil {
+		ctx = context.WithValue(ctx, oauth2.HTTPClient, auth.httpClient)
+	}
+
+	tokenObj, err := auth.tokenGenerator.Token(ctx)
 	if err != nil {
 		return "", fmt.Errorf("couldn't generate OIDC token for login: %v", err)
 	}
@@ -269,8 +205,7 @@ type OidcAuthConsumer struct {
 	additionalAuthScopes []v1.AuthScope

 	verifier          TokenVerifier
-	mu                sync.RWMutex
-	subjectsFromLogin map[string]struct{}
+	subjectsFromLogin []string
 }

 func NewTokenVerifier(cfg v1.AuthOIDCServerConfig) TokenVerifier {
@@ -291,7 +226,7 @@ func NewOidcAuthVerifier(additionalAuthScopes []v1.AuthScope, verifier TokenVeri
 	return &OidcAuthConsumer{
 		additionalAuthScopes: additionalAuthScopes,
 		verifier:             verifier,
-		subjectsFromLogin:    make(map[string]struct{}),
+		subjectsFromLogin:    []string{},
 	}
 }

@@ -300,9 +235,9 @@ func (auth *OidcAuthConsumer) VerifyLogin(loginMsg *msg.Login) (err error) {
 	if err != nil {
 		return fmt.Errorf("invalid OIDC token in login: %v", err)
 	}
-	auth.mu.Lock()
-	auth.subjectsFromLogin[token.Subject] = struct{}{}
-	auth.mu.Unlock()
+	if !slices.Contains(auth.subjectsFromLogin, token.Subject) {
+		auth.subjectsFromLogin = append(auth.subjectsFromLogin, token.Subject)
+	}
 	return nil
 }

@@ -311,13 +246,11 @@ func (auth *OidcAuthConsumer) verifyPostLoginToken(privilegeKey string) (err err
 	if err != nil {
 		return fmt.Errorf("invalid OIDC token in ping: %v", err)
 	}
-	auth.mu.RLock()
-	_, ok := auth.subjectsFromLogin[token.Subject]
-	auth.mu.RUnlock()
-	if !ok {
+	if !slices.Contains(auth.subjectsFromLogin, token.Subject) {
 		return fmt.Errorf("received different OIDC subject in login and ping. "+
+			"original subjects: %s, "+
 			"new subject: %s",
-			token.Subject)
+			auth.subjectsFromLogin, token.Subject)
 	}
 	return nil
 }
--- a/pkg/auth/oidc_test.go
+++ b/pkg/auth/oidc_test.go
@@ -2,10 +2,6 @@ package auth_test

 import (
 	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"sync/atomic"
 	"testing"
 	"time"

@@ -66,188 +62,3 @@ func TestPingAfterLoginWithDifferentSubjectFails(t *testing.T) {
 	r.Error(err)
 	r.Contains(err.Error(), "received different OIDC subject in login and ping")
 }
-
-func TestOidcAuthProviderFallsBackWhenNoExpiry(t *testing.T) {
-	r := require.New(t)
-
-	var requestCount atomic.Int32
-	tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		requestCount.Add(1)
-		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(map[string]any{ //nolint:gosec // test-only dummy token response
-			"access_token": "fresh-test-token",
-			"token_type":   "Bearer",
-		})
-	}))
-	defer tokenServer.Close()
-
-	provider, err := auth.NewOidcAuthSetter(
-		[]v1.AuthScope{v1.AuthScopeHeartBeats},
-		v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			ClientSecret:     "test-secret",
-			TokenEndpointURL: tokenServer.URL,
-		},
-	)
-	r.NoError(err)
-
-	// Constructor no longer fetches a token eagerly.
-	// The first SetLogin triggers the adaptive probe.
-	r.Equal(int32(0), requestCount.Load())
-
-	loginMsg := &msg.Login{}
-	err = provider.SetLogin(loginMsg)
-	r.NoError(err)
-	r.Equal("fresh-test-token", loginMsg.PrivilegeKey)
-
-	for range 3 {
-		pingMsg := &msg.Ping{}
-		err = provider.SetPing(pingMsg)
-		r.NoError(err)
-		r.Equal("fresh-test-token", pingMsg.PrivilegeKey)
-	}
-
-	// 1 probe (login) + 3 pings = 4 requests (probe doubles as the login token fetch)
-	r.Equal(int32(4), requestCount.Load(), "each call should fetch a fresh token when expires_in is missing")
-}
-
-func TestOidcAuthProviderCachesToken(t *testing.T) {
-	r := require.New(t)
-
-	var requestCount atomic.Int32
-	tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		requestCount.Add(1)
-		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(map[string]any{ //nolint:gosec // test-only dummy token response
-			"access_token": "cached-test-token",
-			"token_type":   "Bearer",
-			"expires_in":   3600,
-		})
-	}))
-	defer tokenServer.Close()
-
-	provider, err := auth.NewOidcAuthSetter(
-		[]v1.AuthScope{v1.AuthScopeHeartBeats},
-		v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			ClientSecret:     "test-secret",
-			TokenEndpointURL: tokenServer.URL,
-		},
-	)
-	r.NoError(err)
-
-	// Constructor no longer fetches eagerly; first SetLogin triggers the probe.
-	r.Equal(int32(0), requestCount.Load())
-
-	// SetLogin triggers the adaptive probe and caches the token.
-	loginMsg := &msg.Login{}
-	err = provider.SetLogin(loginMsg)
-	r.NoError(err)
-	r.Equal("cached-test-token", loginMsg.PrivilegeKey)
-	r.Equal(int32(1), requestCount.Load())
-
-	// Subsequent calls should also reuse the cached token
-	for range 5 {
-		pingMsg := &msg.Ping{}
-		err = provider.SetPing(pingMsg)
-		r.NoError(err)
-		r.Equal("cached-test-token", pingMsg.PrivilegeKey)
-	}
-	r.Equal(int32(1), requestCount.Load(), "token endpoint should only be called once; cached token should be reused")
-}
-
-func TestOidcAuthProviderRetriesOnInitialFailure(t *testing.T) {
-	r := require.New(t)
-
-	var requestCount atomic.Int32
-	tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		n := requestCount.Add(1)
-		// The oauth2 library retries once internally, so we need two
-		// consecutive failures to surface an error to the caller.
-		if n <= 2 {
-			w.Header().Set("Content-Type", "application/json")
-			w.WriteHeader(http.StatusBadRequest)
-			_ = json.NewEncoder(w).Encode(map[string]any{
-				"error":             "temporarily_unavailable",
-				"error_description": "service is starting up",
-			})
-			return
-		}
-		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(map[string]any{ //nolint:gosec // test-only dummy token response
-			"access_token": "retry-test-token",
-			"token_type":   "Bearer",
-			"expires_in":   3600,
-		})
-	}))
-	defer tokenServer.Close()
-
-	// Constructor succeeds even though the IdP is "down".
-	provider, err := auth.NewOidcAuthSetter(
-		[]v1.AuthScope{v1.AuthScopeHeartBeats},
-		v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			ClientSecret:     "test-secret",
-			TokenEndpointURL: tokenServer.URL,
-		},
-	)
-	r.NoError(err)
-	r.Equal(int32(0), requestCount.Load())
-
-	// First SetLogin hits the IdP, which returns an error (after internal retry).
-	loginMsg := &msg.Login{}
-	err = provider.SetLogin(loginMsg)
-	r.Error(err)
-	r.Equal(int32(2), requestCount.Load())
-
-	// Second SetLogin retries and succeeds.
-	err = provider.SetLogin(loginMsg)
-	r.NoError(err)
-	r.Equal("retry-test-token", loginMsg.PrivilegeKey)
-	r.Equal(int32(3), requestCount.Load())
-
-	// Subsequent calls use cached token.
-	pingMsg := &msg.Ping{}
-	err = provider.SetPing(pingMsg)
-	r.NoError(err)
-	r.Equal("retry-test-token", pingMsg.PrivilegeKey)
-	r.Equal(int32(3), requestCount.Load())
-}
-
-func TestNewOidcAuthSetterRejectsInvalidStaticConfig(t *testing.T) {
-	r := require.New(t)
-	tokenServer := httptest.NewServer(http.NotFoundHandler())
-	defer tokenServer.Close()
-
-	_, err := auth.NewOidcAuthSetter(nil, v1.AuthOIDCClientConfig{
-		ClientID:         "test-client",
-		TokenEndpointURL: "://bad",
-	})
-	r.Error(err)
-	r.Contains(err.Error(), "auth.oidc.tokenEndpointURL")
-
-	_, err = auth.NewOidcAuthSetter(nil, v1.AuthOIDCClientConfig{
-		TokenEndpointURL: tokenServer.URL,
-	})
-	r.Error(err)
-	r.Contains(err.Error(), "auth.oidc.clientID is required")
-
-	_, err = auth.NewOidcAuthSetter(nil, v1.AuthOIDCClientConfig{
-		ClientID:         "test-client",
-		TokenEndpointURL: tokenServer.URL,
-		AdditionalEndpointParams: map[string]string{
-			"scope": "profile",
-		},
-	})
-	r.Error(err)
-	r.Contains(err.Error(), "auth.oidc.additionalEndpointParams.scope is not allowed; use auth.oidc.scope instead")
-
-	_, err = auth.NewOidcAuthSetter(nil, v1.AuthOIDCClientConfig{
-		ClientID:                 "test-client",
-		TokenEndpointURL:         tokenServer.URL,
-		Audience:                 "api",
-		AdditionalEndpointParams: map[string]string{"audience": "override"},
-	})
-	r.Error(err)
-	r.Contains(err.Error(), "cannot specify both auth.oidc.audience and auth.oidc.additionalEndpointParams.audience")
-}
--- a/pkg/config/legacy/conversion.go
+++ b/pkg/config/legacy/conversion.go
@@ -171,14 +171,15 @@ func Convert_ServerCommonConf_To_v1(conf *ServerCommonConf) *v1.ServerConfig {
 func transformHeadersFromPluginParams(params map[string]string) v1.HeaderOperations {
 	out := v1.HeaderOperations{}
 	for k, v := range params {
-		k, ok := strings.CutPrefix(k, "plugin_header_")
-		if !ok || k == "" {
+		if !strings.HasPrefix(k, "plugin_header_") {
 			continue
 		}
-		if out.Set == nil {
-			out.Set = make(map[string]string)
+		if k = strings.TrimPrefix(k, "plugin_header_"); k != "" {
+			if out.Set == nil {
+				out.Set = make(map[string]string)
+			}
+			out.Set[k] = v
 		}
-		out.Set[k] = v
 	}
 	return out
 }
--- a/pkg/config/legacy/proxy.go
+++ b/pkg/config/legacy/proxy.go
@@ -39,14 +39,14 @@ const (
 // Proxy
 var (
 	proxyConfTypeMap = map[ProxyType]reflect.Type{
-		ProxyTypeTCP:    reflect.TypeFor[TCPProxyConf](),
-		ProxyTypeUDP:    reflect.TypeFor[UDPProxyConf](),
-		ProxyTypeTCPMUX: reflect.TypeFor[TCPMuxProxyConf](),
-		ProxyTypeHTTP:   reflect.TypeFor[HTTPProxyConf](),
-		ProxyTypeHTTPS:  reflect.TypeFor[HTTPSProxyConf](),
-		ProxyTypeSTCP:   reflect.TypeFor[STCPProxyConf](),
-		ProxyTypeXTCP:   reflect.TypeFor[XTCPProxyConf](),
-		ProxyTypeSUDP:   reflect.TypeFor[SUDPProxyConf](),
+		ProxyTypeTCP:    reflect.TypeOf(TCPProxyConf{}),
+		ProxyTypeUDP:    reflect.TypeOf(UDPProxyConf{}),
+		ProxyTypeTCPMUX: reflect.TypeOf(TCPMuxProxyConf{}),
+		ProxyTypeHTTP:   reflect.TypeOf(HTTPProxyConf{}),
+		ProxyTypeHTTPS:  reflect.TypeOf(HTTPSProxyConf{}),
+		ProxyTypeSTCP:   reflect.TypeOf(STCPProxyConf{}),
+		ProxyTypeXTCP:   reflect.TypeOf(XTCPProxyConf{}),
+		ProxyTypeSUDP:   reflect.TypeOf(SUDPProxyConf{}),
 	}
 )

--- a/pkg/config/legacy/utils.go
+++ b/pkg/config/legacy/utils.go
@@ -22,8 +22,8 @@ func GetMapWithoutPrefix(set map[string]string, prefix string) map[string]string
 	m := make(map[string]string)

 	for key, value := range set {
-		if trimmed, ok := strings.CutPrefix(key, prefix); ok {
-			m[trimmed] = value
+		if strings.HasPrefix(key, prefix) {
+			m[strings.TrimPrefix(key, prefix)] = value
 		}
 	}

--- a/pkg/config/legacy/visitor.go
+++ b/pkg/config/legacy/visitor.go
@@ -32,9 +32,9 @@ const (
 // Visitor
 var (
 	visitorConfTypeMap = map[VisitorType]reflect.Type{
-		VisitorTypeSTCP: reflect.TypeFor[STCPVisitorConf](),
-		VisitorTypeXTCP: reflect.TypeFor[XTCPVisitorConf](),
-		VisitorTypeSUDP: reflect.TypeFor[SUDPVisitorConf](),
+		VisitorTypeSTCP: reflect.TypeOf(STCPVisitorConf{}),
+		VisitorTypeXTCP: reflect.TypeOf(XTCPVisitorConf{}),
+		VisitorTypeSUDP: reflect.TypeOf(SUDPVisitorConf{}),
 	}
 )

--- a/pkg/config/source/aggregator.go
+++ b/pkg/config/source/aggregator.go
@@ -15,11 +15,9 @@
 package source

 import (
-	"cmp"
 	"errors"
 	"fmt"
-	"maps"
-	"slices"
+	"sort"
 	"sync"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
@@ -99,11 +97,21 @@ func (a *Aggregator) mapsToSortedSlices(
 	proxyMap map[string]v1.ProxyConfigurer,
 	visitorMap map[string]v1.VisitorConfigurer,
 ) ([]v1.ProxyConfigurer, []v1.VisitorConfigurer) {
-	proxies := slices.SortedFunc(maps.Values(proxyMap), func(x, y v1.ProxyConfigurer) int {
-		return cmp.Compare(x.GetBaseConfig().Name, y.GetBaseConfig().Name)
+	proxies := make([]v1.ProxyConfigurer, 0, len(proxyMap))
+	for _, p := range proxyMap {
+		proxies = append(proxies, p)
+	}
+	sort.Slice(proxies, func(i, j int) bool {
+		return proxies[i].GetBaseConfig().Name < proxies[j].GetBaseConfig().Name
 	})
-	visitors := slices.SortedFunc(maps.Values(visitorMap), func(x, y v1.VisitorConfigurer) int {
-		return cmp.Compare(x.GetBaseConfig().Name, y.GetBaseConfig().Name)
+
+	visitors := make([]v1.VisitorConfigurer, 0, len(visitorMap))
+	for _, v := range visitorMap {
+		visitors = append(visitors, v)
+	}
+	sort.Slice(visitors, func(i, j int) bool {
+		return visitors[i].GetBaseConfig().Name < visitors[j].GetBaseConfig().Name
 	})
+
 	return proxies, visitors
 }
--- a/pkg/config/source/aggregator_test.go
+++ b/pkg/config/source/aggregator_test.go
@@ -196,27 +196,6 @@ func TestAggregator_VisitorMerge(t *testing.T) {
 	require.Len(visitors, 2)
 }

-func TestAggregator_Load_ReturnsSortedByName(t *testing.T) {
-	require := require.New(t)
-
-	agg := newTestAggregator(t, nil)
-	err := agg.ConfigSource().ReplaceAll(
-		[]v1.ProxyConfigurer{mockProxy("charlie"), mockProxy("alice"), mockProxy("bob")},
-		[]v1.VisitorConfigurer{mockVisitor("zulu"), mockVisitor("alpha")},
-	)
-	require.NoError(err)
-
-	proxies, visitors, err := agg.Load()
-	require.NoError(err)
-	require.Len(proxies, 3)
-	require.Equal("alice", proxies[0].GetBaseConfig().Name)
-	require.Equal("bob", proxies[1].GetBaseConfig().Name)
-	require.Equal("charlie", proxies[2].GetBaseConfig().Name)
-	require.Len(visitors, 2)
-	require.Equal("alpha", visitors[0].GetBaseConfig().Name)
-	require.Equal("zulu", visitors[1].GetBaseConfig().Name)
-}
-
 func TestAggregator_Load_ReturnsDefensiveCopies(t *testing.T) {
 	require := require.New(t)

--- a/pkg/config/template.go
+++ b/pkg/config/template.go
@@ -38,7 +38,7 @@ func parseNumberRangePair(firstRangeStr, secondRangeStr string) ([]NumberPair, e
 		return nil, fmt.Errorf("first and second range numbers are not in pairs")
 	}
 	pairs := make([]NumberPair, 0, len(firstRangeNumbers))
-	for i := range firstRangeNumbers {
+	for i := 0; i < len(firstRangeNumbers); i++ {
 		pairs = append(pairs, NumberPair{
 			First:  firstRangeNumbers[i],
 			Second: secondRangeNumbers[i],
--- a/pkg/config/types/types.go
+++ b/pkg/config/types/types.go
@@ -70,18 +70,24 @@ func (q *BandwidthQuantity) UnmarshalString(s string) error {
 		f    float64
 		err  error
 	)
-	if fstr, ok := strings.CutSuffix(s, "MB"); ok {
+	switch {
+	case strings.HasSuffix(s, "MB"):
 		base = MB
+		fstr := strings.TrimSuffix(s, "MB")
 		f, err = strconv.ParseFloat(fstr, 64)
-	} else if fstr, ok := strings.CutSuffix(s, "KB"); ok {
+		if err != nil {
+			return err
+		}
+	case strings.HasSuffix(s, "KB"):
 		base = KB
+		fstr := strings.TrimSuffix(s, "KB")
 		f, err = strconv.ParseFloat(fstr, 64)
-	} else {
+		if err != nil {
+			return err
+		}
+	default:
 		return errors.New("unit not support")
 	}
-	if err != nil {
-		return err
-	}

 	q.s = s
 	q.i = int64(f * float64(base))
@@ -137,8 +143,8 @@ func (p PortsRangeSlice) String() string {
 func NewPortsRangeSliceFromString(str string) ([]PortsRange, error) {
 	str = strings.TrimSpace(str)
 	out := []PortsRange{}
-	numRanges := strings.SplitSeq(str, ",")
-	for numRangeStr := range numRanges {
+	numRanges := strings.Split(str, ",")
+	for _, numRangeStr := range numRanges {
 		// 1000-2000 or 2001
 		numArray := strings.Split(numRangeStr, "-")
 		// length: only 1 or 2 is correct
--- a/pkg/config/types/types_test.go
+++ b/pkg/config/types/types_test.go
@@ -39,31 +39,6 @@ func TestBandwidthQuantity(t *testing.T) {
 	require.Equal(`{"b":"1KB","int":5}`, string(buf))
 }

-func TestBandwidthQuantity_MB(t *testing.T) {
-	require := require.New(t)
-
-	var w Wrap
-	err := json.Unmarshal([]byte(`{"b":"2MB","int":1}`), &w)
-	require.NoError(err)
-	require.EqualValues(2*MB, w.B.Bytes())
-
-	buf, err := json.Marshal(&w)
-	require.NoError(err)
-	require.Equal(`{"b":"2MB","int":1}`, string(buf))
-}
-
-func TestBandwidthQuantity_InvalidUnit(t *testing.T) {
-	var w Wrap
-	err := json.Unmarshal([]byte(`{"b":"1GB","int":1}`), &w)
-	require.Error(t, err)
-}
-
-func TestBandwidthQuantity_InvalidNumber(t *testing.T) {
-	var w Wrap
-	err := json.Unmarshal([]byte(`{"b":"abcKB","int":1}`), &w)
-	require.Error(t, err)
-}
-
 func TestPortsRangeSlice2String(t *testing.T) {
 	require := require.New(t)

--- a/pkg/config/v1/client.go
+++ b/pkg/config/v1/client.go
@@ -104,9 +104,6 @@ type ClientTransportConfig struct {
 	// Valid values are "tcp", "kcp", "quic", "websocket" and "wss". By default, this value
 	// is "tcp".
 	Protocol string `json:"protocol,omitempty"`
-	// WireProtocol specifies the frpc/frps internal wire protocol version.
-	// Valid values are "v1" and "v2". By default, this value is "v1".
-	WireProtocol string `json:"wireProtocol,omitempty"`
 	// The maximum amount of time a dial to server will wait for a connect to complete.
 	DialServerTimeout int64 `json:"dialServerTimeout,omitempty"`
 	// DialServerKeepAlive specifies the interval between keep-alive probes for an active network connection between frpc and frps.
@@ -146,7 +143,6 @@ type ClientTransportConfig struct {

 func (c *ClientTransportConfig) Complete() {
 	c.Protocol = util.EmptyOr(c.Protocol, "tcp")
-	c.WireProtocol = util.EmptyOr(c.WireProtocol, "v1")
 	c.DialServerTimeout = util.EmptyOr(c.DialServerTimeout, 10)
 	c.DialServerKeepAlive = util.EmptyOr(c.DialServerKeepAlive, 7200)
 	c.ProxyURL = util.EmptyOr(c.ProxyURL, os.Getenv("http_proxy"))
--- a/pkg/config/v1/client_test.go
+++ b/pkg/config/v1/client_test.go
@@ -29,7 +29,6 @@ func TestClientConfigComplete(t *testing.T) {

 	require.EqualValues("token", c.Auth.Method)
 	require.Equal(true, lo.FromPtr(c.Transport.TCPMux))
-	require.Equal("v1", c.Transport.WireProtocol)
 	require.Equal(true, lo.FromPtr(c.LoginFailExit))
 	require.Equal(true, lo.FromPtr(c.Transport.TLS.Enable))
 	require.Equal(true, lo.FromPtr(c.Transport.TLS.DisableCustomTLSFirstByte))
--- a/pkg/config/v1/proxy.go
+++ b/pkg/config/v1/proxy.go
@@ -239,14 +239,14 @@ const (
 )

 var proxyConfigTypeMap = map[ProxyType]reflect.Type{
-	ProxyTypeTCP:    reflect.TypeFor[TCPProxyConfig](),
-	ProxyTypeUDP:    reflect.TypeFor[UDPProxyConfig](),
-	ProxyTypeHTTP:   reflect.TypeFor[HTTPProxyConfig](),
-	ProxyTypeHTTPS:  reflect.TypeFor[HTTPSProxyConfig](),
-	ProxyTypeTCPMUX: reflect.TypeFor[TCPMuxProxyConfig](),
-	ProxyTypeSTCP:   reflect.TypeFor[STCPProxyConfig](),
-	ProxyTypeXTCP:   reflect.TypeFor[XTCPProxyConfig](),
-	ProxyTypeSUDP:   reflect.TypeFor[SUDPProxyConfig](),
+	ProxyTypeTCP:    reflect.TypeOf(TCPProxyConfig{}),
+	ProxyTypeUDP:    reflect.TypeOf(UDPProxyConfig{}),
+	ProxyTypeHTTP:   reflect.TypeOf(HTTPProxyConfig{}),
+	ProxyTypeHTTPS:  reflect.TypeOf(HTTPSProxyConfig{}),
+	ProxyTypeTCPMUX: reflect.TypeOf(TCPMuxProxyConfig{}),
+	ProxyTypeSTCP:   reflect.TypeOf(STCPProxyConfig{}),
+	ProxyTypeXTCP:   reflect.TypeOf(XTCPProxyConfig{}),
+	ProxyTypeSUDP:   reflect.TypeOf(SUDPProxyConfig{}),
 }

 func NewProxyConfigurerByType(proxyType ProxyType) ProxyConfigurer {
--- a/pkg/config/v1/proxy_plugin.go
+++ b/pkg/config/v1/proxy_plugin.go
@@ -37,16 +37,16 @@ const (
 )

 var clientPluginOptionsTypeMap = map[string]reflect.Type{
-	PluginHTTP2HTTPS:       reflect.TypeFor[HTTP2HTTPSPluginOptions](),
-	PluginHTTPProxy:        reflect.TypeFor[HTTPProxyPluginOptions](),
-	PluginHTTPS2HTTP:       reflect.TypeFor[HTTPS2HTTPPluginOptions](),
-	PluginHTTPS2HTTPS:      reflect.TypeFor[HTTPS2HTTPSPluginOptions](),
-	PluginHTTP2HTTP:        reflect.TypeFor[HTTP2HTTPPluginOptions](),
-	PluginSocks5:           reflect.TypeFor[Socks5PluginOptions](),
-	PluginStaticFile:       reflect.TypeFor[StaticFilePluginOptions](),
-	PluginUnixDomainSocket: reflect.TypeFor[UnixDomainSocketPluginOptions](),
-	PluginTLS2Raw:          reflect.TypeFor[TLS2RawPluginOptions](),
-	PluginVirtualNet:       reflect.TypeFor[VirtualNetPluginOptions](),
+	PluginHTTP2HTTPS:       reflect.TypeOf(HTTP2HTTPSPluginOptions{}),
+	PluginHTTPProxy:        reflect.TypeOf(HTTPProxyPluginOptions{}),
+	PluginHTTPS2HTTP:       reflect.TypeOf(HTTPS2HTTPPluginOptions{}),
+	PluginHTTPS2HTTPS:      reflect.TypeOf(HTTPS2HTTPSPluginOptions{}),
+	PluginHTTP2HTTP:        reflect.TypeOf(HTTP2HTTPPluginOptions{}),
+	PluginSocks5:           reflect.TypeOf(Socks5PluginOptions{}),
+	PluginStaticFile:       reflect.TypeOf(StaticFilePluginOptions{}),
+	PluginUnixDomainSocket: reflect.TypeOf(UnixDomainSocketPluginOptions{}),
+	PluginTLS2Raw:          reflect.TypeOf(TLS2RawPluginOptions{}),
+	PluginVirtualNet:       reflect.TypeOf(VirtualNetPluginOptions{}),
 }

 type ClientPluginOptions interface {
--- a/pkg/config/v1/validation/client.go
+++ b/pkg/config/v1/validation/client.go
@@ -88,11 +88,6 @@ func (v *ConfigValidator) validateAuthConfig(c *v1.AuthClientConfig) (Warning, e
 	if err := v.validateOIDCConfig(&c.OIDC); err != nil {
 		errs = AppendError(errs, err)
 	}
-	if c.Method == v1.AuthMethodOIDC && c.OIDC.TokenSource == nil {
-		if err := ValidateOIDCClientCredentialsConfig(&c.OIDC); err != nil {
-			errs = AppendError(errs, err)
-		}
-	}
 	return nil, errs
 }

@@ -146,9 +141,6 @@ func validateTransportConfig(c *v1.ClientTransportConfig) (Warning, error) {
 	if !slices.Contains(SupportedTransportProtocols, c.Protocol) {
 		errs = AppendError(errs, fmt.Errorf("invalid transport.protocol, optional values are %v", SupportedTransportProtocols))
 	}
-	if !slices.Contains(SupportedWireProtocols, c.WireProtocol) {
-		errs = AppendError(errs, fmt.Errorf("invalid transport.wireProtocol, optional values are %v", SupportedWireProtocols))
-	}
 	return warnings, errs
 }

--- a/pkg/config/v1/validation/oidc.go
+++ b/pkg/config/v1/validation/oidc.go
@@ -1,57 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package validation
-
-import (
-	"errors"
-	"net/url"
-	"strings"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-)
-
-func ValidateOIDCClientCredentialsConfig(c *v1.AuthOIDCClientConfig) error {
-	var errs []string
-
-	if c.ClientID == "" {
-		errs = append(errs, "auth.oidc.clientID is required")
-	}
-
-	if c.TokenEndpointURL == "" {
-		errs = append(errs, "auth.oidc.tokenEndpointURL is required")
-	} else {
-		tokenURL, err := url.Parse(c.TokenEndpointURL)
-		if err != nil || !tokenURL.IsAbs() || tokenURL.Host == "" {
-			errs = append(errs, "auth.oidc.tokenEndpointURL must be an absolute http or https URL")
-		} else if tokenURL.Scheme != "http" && tokenURL.Scheme != "https" {
-			errs = append(errs, "auth.oidc.tokenEndpointURL must use http or https")
-		}
-	}
-
-	if _, ok := c.AdditionalEndpointParams["scope"]; ok {
-		errs = append(errs, "auth.oidc.additionalEndpointParams.scope is not allowed; use auth.oidc.scope instead")
-	}
-
-	if c.Audience != "" {
-		if _, ok := c.AdditionalEndpointParams["audience"]; ok {
-			errs = append(errs, "cannot specify both auth.oidc.audience and auth.oidc.additionalEndpointParams.audience")
-		}
-	}
-
-	if len(errs) == 0 {
-		return nil
-	}
-	return errors.New(strings.Join(errs, "; "))
-}
--- a/pkg/config/v1/validation/oidc_test.go
+++ b/pkg/config/v1/validation/oidc_test.go
@@ -1,78 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package validation
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-)
-
-func TestValidateOIDCClientCredentialsConfig(t *testing.T) {
-	tokenServer := httptest.NewServer(http.NotFoundHandler())
-	defer tokenServer.Close()
-
-	t.Run("valid", func(t *testing.T) {
-		require.NoError(t, ValidateOIDCClientCredentialsConfig(&v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			TokenEndpointURL: tokenServer.URL,
-			AdditionalEndpointParams: map[string]string{
-				"resource": "api",
-			},
-		}))
-	})
-
-	t.Run("invalid token endpoint url", func(t *testing.T) {
-		err := ValidateOIDCClientCredentialsConfig(&v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			TokenEndpointURL: "://bad",
-		})
-		require.ErrorContains(t, err, "auth.oidc.tokenEndpointURL")
-	})
-
-	t.Run("missing client id", func(t *testing.T) {
-		err := ValidateOIDCClientCredentialsConfig(&v1.AuthOIDCClientConfig{
-			TokenEndpointURL: tokenServer.URL,
-		})
-		require.ErrorContains(t, err, "auth.oidc.clientID is required")
-	})
-
-	t.Run("scope endpoint param is not allowed", func(t *testing.T) {
-		err := ValidateOIDCClientCredentialsConfig(&v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			TokenEndpointURL: tokenServer.URL,
-			AdditionalEndpointParams: map[string]string{
-				"scope": "email",
-			},
-		})
-		require.ErrorContains(t, err, "auth.oidc.additionalEndpointParams.scope is not allowed; use auth.oidc.scope instead")
-	})
-
-	t.Run("audience conflict", func(t *testing.T) {
-		err := ValidateOIDCClientCredentialsConfig(&v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			TokenEndpointURL: tokenServer.URL,
-			Audience:         "api",
-			AdditionalEndpointParams: map[string]string{
-				"audience": "override",
-			},
-		})
-		require.ErrorContains(t, err, "cannot specify both auth.oidc.audience and auth.oidc.additionalEndpointParams.audience")
-	})
-}
--- a/pkg/config/v1/validation/validation.go
+++ b/pkg/config/v1/validation/validation.go
@@ -29,10 +29,6 @@ var (
 		"websocket",
 		"wss",
 	}
-	SupportedWireProtocols = []string{
-		"v1",
-		"v2",
-	}

 	SupportedAuthMethods = []v1.AuthMethod{
 		"token",
--- a/pkg/config/v1/visitor.go
+++ b/pkg/config/v1/visitor.go
@@ -79,9 +79,9 @@ const (
 )

 var visitorConfigTypeMap = map[VisitorType]reflect.Type{
-	VisitorTypeSTCP: reflect.TypeFor[STCPVisitorConfig](),
-	VisitorTypeXTCP: reflect.TypeFor[XTCPVisitorConfig](),
-	VisitorTypeSUDP: reflect.TypeFor[SUDPVisitorConfig](),
+	VisitorTypeSTCP: reflect.TypeOf(STCPVisitorConfig{}),
+	VisitorTypeXTCP: reflect.TypeOf(XTCPVisitorConfig{}),
+	VisitorTypeSUDP: reflect.TypeOf(SUDPVisitorConfig{}),
 }

 type TypedVisitorConfig struct {
--- a/pkg/config/v1/visitor_plugin.go
+++ b/pkg/config/v1/visitor_plugin.go
@@ -25,7 +25,7 @@ const (
 )

 var visitorPluginOptionsTypeMap = map[string]reflect.Type{
-	VisitorPluginVirtualNet: reflect.TypeFor[VirtualNetVisitorPluginOptions](),
+	VisitorPluginVirtualNet: reflect.TypeOf(VirtualNetVisitorPluginOptions{}),
 }

 type VisitorPluginOptions interface {
--- a/pkg/metrics/mem/server.go
+++ b/pkg/metrics/mem/server.go
@@ -143,6 +143,7 @@ func (m *serverMetrics) OpenConnection(name string, _ string) {
 	proxyStats, ok := m.info.ProxyStatistics[name]
 	if ok {
 		proxyStats.CurConns.Inc(1)
+		m.info.ProxyStatistics[name] = proxyStats
 	}
 }

@@ -154,6 +155,7 @@ func (m *serverMetrics) CloseConnection(name string, _ string) {
 	proxyStats, ok := m.info.ProxyStatistics[name]
 	if ok {
 		proxyStats.CurConns.Dec(1)
+		m.info.ProxyStatistics[name] = proxyStats
 	}
 }

@@ -166,6 +168,7 @@ func (m *serverMetrics) AddTrafficIn(name string, _ string, trafficBytes int64)
 	proxyStats, ok := m.info.ProxyStatistics[name]
 	if ok {
 		proxyStats.TrafficIn.Inc(trafficBytes)
+		m.info.ProxyStatistics[name] = proxyStats
 	}
 }

@@ -178,6 +181,7 @@ func (m *serverMetrics) AddTrafficOut(name string, _ string, trafficBytes int64)
 	proxyStats, ok := m.info.ProxyStatistics[name]
 	if ok {
 		proxyStats.TrafficOut.Inc(trafficBytes)
+		m.info.ProxyStatistics[name] = proxyStats
 	}
 }

@@ -199,25 +203,6 @@ func (m *serverMetrics) GetServer() *ServerStats {
 	return s
 }

-func toProxyStats(name string, proxyStats *ProxyStatistics) *ProxyStats {
-	ps := &ProxyStats{
-		Name:            name,
-		Type:            proxyStats.ProxyType,
-		User:            proxyStats.User,
-		ClientID:        proxyStats.ClientID,
-		TodayTrafficIn:  proxyStats.TrafficIn.TodayCount(),
-		TodayTrafficOut: proxyStats.TrafficOut.TodayCount(),
-		CurConns:        int64(proxyStats.CurConns.Count()),
-	}
-	if !proxyStats.LastStartTime.IsZero() {
-		ps.LastStartTime = proxyStats.LastStartTime.Format("01-02 15:04:05")
-	}
-	if !proxyStats.LastCloseTime.IsZero() {
-		ps.LastCloseTime = proxyStats.LastCloseTime.Format("01-02 15:04:05")
-	}
-	return ps
-}
-
 func (m *serverMetrics) GetProxiesByType(proxyType string) []*ProxyStats {
 	res := make([]*ProxyStats, 0)
 	m.mu.Lock()
@@ -227,7 +212,23 @@ func (m *serverMetrics) GetProxiesByType(proxyType string) []*ProxyStats {
 		if proxyStats.ProxyType != proxyType {
 			continue
 		}
-		res = append(res, toProxyStats(name, proxyStats))
+
+		ps := &ProxyStats{
+			Name:            name,
+			Type:            proxyStats.ProxyType,
+			User:            proxyStats.User,
+			ClientID:        proxyStats.ClientID,
+			TodayTrafficIn:  proxyStats.TrafficIn.TodayCount(),
+			TodayTrafficOut: proxyStats.TrafficOut.TodayCount(),
+			CurConns:        int64(proxyStats.CurConns.Count()),
+		}
+		if !proxyStats.LastStartTime.IsZero() {
+			ps.LastStartTime = proxyStats.LastStartTime.Format("01-02 15:04:05")
+		}
+		if !proxyStats.LastCloseTime.IsZero() {
+			ps.LastCloseTime = proxyStats.LastCloseTime.Format("01-02 15:04:05")
+		}
+		res = append(res, ps)
 	}
 	return res
 }
@@ -236,9 +237,31 @@ func (m *serverMetrics) GetProxiesByTypeAndName(proxyType string, proxyName stri
 	m.mu.Lock()
 	defer m.mu.Unlock()

-	proxyStats, ok := m.info.ProxyStatistics[proxyName]
-	if ok && proxyStats.ProxyType == proxyType {
-		res = toProxyStats(proxyName, proxyStats)
+	for name, proxyStats := range m.info.ProxyStatistics {
+		if proxyStats.ProxyType != proxyType {
+			continue
+		}
+
+		if name != proxyName {
+			continue
+		}
+
+		res = &ProxyStats{
+			Name:            name,
+			Type:            proxyStats.ProxyType,
+			User:            proxyStats.User,
+			ClientID:        proxyStats.ClientID,
+			TodayTrafficIn:  proxyStats.TrafficIn.TodayCount(),
+			TodayTrafficOut: proxyStats.TrafficOut.TodayCount(),
+			CurConns:        int64(proxyStats.CurConns.Count()),
+		}
+		if !proxyStats.LastStartTime.IsZero() {
+			res.LastStartTime = proxyStats.LastStartTime.Format("01-02 15:04:05")
+		}
+		if !proxyStats.LastCloseTime.IsZero() {
+			res.LastCloseTime = proxyStats.LastCloseTime.Format("01-02 15:04:05")
+		}
+		break
 	}
 	return
 }
@@ -249,7 +272,21 @@ func (m *serverMetrics) GetProxyByName(proxyName string) (res *ProxyStats) {

 	proxyStats, ok := m.info.ProxyStatistics[proxyName]
 	if ok {
-		res = toProxyStats(proxyName, proxyStats)
+		res = &ProxyStats{
+			Name:            proxyName,
+			Type:            proxyStats.ProxyType,
+			User:            proxyStats.User,
+			ClientID:        proxyStats.ClientID,
+			TodayTrafficIn:  proxyStats.TrafficIn.TodayCount(),
+			TodayTrafficOut: proxyStats.TrafficOut.TodayCount(),
+			CurConns:        int64(proxyStats.CurConns.Count()),
+		}
+		if !proxyStats.LastStartTime.IsZero() {
+			res.LastStartTime = proxyStats.LastStartTime.Format("01-02 15:04:05")
+		}
+		if !proxyStats.LastCloseTime.IsZero() {
+			res.LastCloseTime = proxyStats.LastCloseTime.Format("01-02 15:04:05")
+		}
 	}
 	return
 }
--- a/pkg/msg/conn_test.go
+++ b/pkg/msg/conn_test.go
@@ -1,56 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package msg
-
-import (
-	"net"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/fatedier/frp/pkg/proto/wire"
-)
-
-func TestConnReadWriteMsg(t *testing.T) {
-	tests := []struct {
-		name     string
-		protocol string
-	}{
-		{name: "v1", protocol: wire.ProtocolV1},
-		{name: "v2", protocol: wire.ProtocolV2},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			client, server := net.Pipe()
-			defer client.Close()
-			defer server.Close()
-
-			clientConn := NewConn(client, NewReadWriter(client, tt.protocol))
-			serverConn := NewConn(server, NewReadWriter(server, tt.protocol))
-
-			in := &Ping{PrivilegeKey: "key", Timestamp: 123}
-			errCh := make(chan error, 1)
-			go func() {
-				errCh <- clientConn.WriteMsg(in)
-			}()
-
-			out, err := serverConn.ReadMsg()
-			require.NoError(t, err)
-			require.Equal(t, in, out)
-			require.NoError(t, <-errCh)
-		})
-	}
-}
--- a/pkg/msg/handler.go
+++ b/pkg/msg/handler.go
@@ -15,90 +15,10 @@
 package msg

 import (
-	"context"
 	"io"
-	"net"
 	"reflect"
-
-	"github.com/fatedier/frp/pkg/proto/wire"
 )

-type ReadWriter interface {
-	ReadMsg() (Message, error)
-	ReadMsgInto(Message) error
-	WriteMsg(Message) error
-}
-
-type Conn struct {
-	net.Conn
-	rw ReadWriter
-}
-
-func NewConn(conn net.Conn, rw ReadWriter) *Conn {
-	return &Conn{
-		Conn: conn,
-		rw:   rw,
-	}
-}
-
-func (c *Conn) ReadMsg() (Message, error) {
-	return c.rw.ReadMsg()
-}
-
-func (c *Conn) ReadMsgInto(m Message) error {
-	return c.rw.ReadMsgInto(m)
-}
-
-func (c *Conn) WriteMsg(m Message) error {
-	return c.rw.WriteMsg(m)
-}
-
-func (c *Conn) Context() context.Context {
-	if getter, ok := c.Conn.(interface{ Context() context.Context }); ok {
-		return getter.Context()
-	}
-	return context.Background()
-}
-
-func (c *Conn) WithContext(ctx context.Context) {
-	if setter, ok := c.Conn.(interface{ WithContext(context.Context) }); ok {
-		setter.WithContext(ctx)
-	}
-}
-
-type V1ReadWriter struct {
-	rw io.ReadWriter
-}
-
-func NewV1ReadWriter(rw io.ReadWriter) ReadWriter {
-	return &V1ReadWriter{rw: rw}
-}
-
-// NewReadWriter wraps rw with the message codec for the selected wire protocol.
-// An empty protocol keeps the historical v1 behavior for tests and older call sites.
-func NewReadWriter(rw io.ReadWriter, wireProtocol string) ReadWriter {
-	switch wireProtocol {
-	case wire.ProtocolV2:
-		return NewV2ReadWriter(rw)
-	case "", wire.ProtocolV1:
-		return NewV1ReadWriter(rw)
-	default:
-		return NewV1ReadWriter(rw)
-	}
-}
-
-func (rw *V1ReadWriter) ReadMsg() (Message, error) {
-	return ReadMsg(rw.rw)
-}
-
-func (rw *V1ReadWriter) ReadMsgInto(m Message) error {
-	return ReadMsgInto(rw.rw, m)
-}
-
-func (rw *V1ReadWriter) WriteMsg(m Message) error {
-	return WriteMsg(rw.rw, m)
-}
-
 func AsyncHandler(f func(Message)) func(Message) {
 	return func(m Message) {
 		go f(m)
@@ -107,7 +27,7 @@ func AsyncHandler(f func(Message)) func(Message) {

 // Dispatcher is used to send messages to net.Conn or register handlers for messages read from net.Conn.
 type Dispatcher struct {
-	rw ReadWriter
+	rw io.ReadWriter

 	sendCh         chan Message
 	doneCh         chan struct{}
@@ -115,7 +35,7 @@ type Dispatcher struct {
 	defaultHandler func(Message)
 }

-func NewDispatcher(rw ReadWriter) *Dispatcher {
+func NewDispatcher(rw io.ReadWriter) *Dispatcher {
 	return &Dispatcher{
 		rw:          rw,
 		sendCh:      make(chan Message, 100),
@@ -136,14 +56,14 @@ func (d *Dispatcher) sendLoop() {
 		case <-d.doneCh:
 			return
 		case m := <-d.sendCh:
-			_ = d.rw.WriteMsg(m)
+			_ = WriteMsg(d.rw, m)
 		}
 	}
 }

 func (d *Dispatcher) readLoop() {
 	for {
-		m, err := d.rw.ReadMsg()
+		m, err := ReadMsg(d.rw)
 		if err != nil {
 			close(d.doneCh)
 			return
--- a/pkg/msg/msg.go
+++ b/pkg/msg/msg.go
@@ -20,24 +20,24 @@ import (
 )

 const (
-	TypeLogin              byte = 'o'
-	TypeLoginResp          byte = '1'
-	TypeNewProxy           byte = 'p'
-	TypeNewProxyResp       byte = '2'
-	TypeCloseProxy         byte = 'c'
-	TypeNewWorkConn        byte = 'w'
-	TypeReqWorkConn        byte = 'r'
-	TypeStartWorkConn      byte = 's'
-	TypeNewVisitorConn     byte = 'v'
-	TypeNewVisitorConnResp byte = '3'
-	TypePing               byte = 'h'
-	TypePong               byte = '4'
-	TypeUDPPacket          byte = 'u'
-	TypeNatHoleVisitor     byte = 'i'
-	TypeNatHoleClient      byte = 'n'
-	TypeNatHoleResp        byte = 'm'
-	TypeNatHoleSid         byte = '5'
-	TypeNatHoleReport      byte = '6'
+	TypeLogin              = 'o'
+	TypeLoginResp          = '1'
+	TypeNewProxy           = 'p'
+	TypeNewProxyResp       = '2'
+	TypeCloseProxy         = 'c'
+	TypeNewWorkConn        = 'w'
+	TypeReqWorkConn        = 'r'
+	TypeStartWorkConn      = 's'
+	TypeNewVisitorConn     = 'v'
+	TypeNewVisitorConnResp = '3'
+	TypePing               = 'h'
+	TypePong               = '4'
+	TypeUDPPacket          = 'u'
+	TypeNatHoleVisitor     = 'i'
+	TypeNatHoleClient      = 'n'
+	TypeNatHoleResp        = 'm'
+	TypeNatHoleSid         = '5'
+	TypeNatHoleReport      = '6'
 )

 var msgTypeMap = map[byte]any{
@@ -61,7 +61,7 @@ var msgTypeMap = map[byte]any{
 	TypeNatHoleReport:      NatHoleReport{},
 }

-var TypeNameNatHoleResp = reflect.TypeFor[NatHoleResp]().Name()
+var TypeNameNatHoleResp = reflect.TypeOf(&NatHoleResp{}).Elem().Name()

 type ClientSpec struct {
 	// Due to the support of VirtualClient, frps needs to know the client type in order to
--- a/pkg/msg/msg_test.go
+++ b/pkg/msg/msg_test.go
@@ -1,55 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package msg
-
-import (
-	"reflect"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestV1MessageTypeIDsAreStable(t *testing.T) {
-	require.Equal(t, byte('o'), TypeLogin)
-	require.Equal(t, byte('1'), TypeLoginResp)
-	require.Equal(t, byte('p'), TypeNewProxy)
-	require.Equal(t, byte('2'), TypeNewProxyResp)
-	require.Equal(t, byte('c'), TypeCloseProxy)
-	require.Equal(t, byte('w'), TypeNewWorkConn)
-	require.Equal(t, byte('r'), TypeReqWorkConn)
-	require.Equal(t, byte('s'), TypeStartWorkConn)
-	require.Equal(t, byte('v'), TypeNewVisitorConn)
-	require.Equal(t, byte('3'), TypeNewVisitorConnResp)
-	require.Equal(t, byte('h'), TypePing)
-	require.Equal(t, byte('4'), TypePong)
-	require.Equal(t, byte('u'), TypeUDPPacket)
-	require.Equal(t, byte('i'), TypeNatHoleVisitor)
-	require.Equal(t, byte('n'), TypeNatHoleClient)
-	require.Equal(t, byte('m'), TypeNatHoleResp)
-	require.Equal(t, byte('5'), TypeNatHoleSid)
-	require.Equal(t, byte('6'), TypeNatHoleReport)
-}
-
-func TestMessageTypeMapIsCompleteAndUnique(t *testing.T) {
-	require.Len(t, msgTypeMap, 18)
-
-	msgTypes := make(map[reflect.Type]struct{}, len(msgTypeMap))
-
-	for _, m := range msgTypeMap {
-		msgType := reflect.TypeOf(m)
-		require.NotContains(t, msgTypes, msgType)
-		msgTypes[msgType] = struct{}{}
-	}
-}
--- a/pkg/msg/wire_v2.go
+++ b/pkg/msg/wire_v2.go
@@ -1,192 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package msg
-
-import (
-	"encoding/binary"
-	"encoding/json"
-	"fmt"
-	"io"
-	"reflect"
-
-	"github.com/fatedier/frp/pkg/proto/wire"
-)
-
-const (
-	V2TypeLogin              uint16 = 1
-	V2TypeLoginResp          uint16 = 2
-	V2TypeNewProxy           uint16 = 3
-	V2TypeNewProxyResp       uint16 = 4
-	V2TypeCloseProxy         uint16 = 5
-	V2TypeNewWorkConn        uint16 = 6
-	V2TypeReqWorkConn        uint16 = 7
-	V2TypeStartWorkConn      uint16 = 8
-	V2TypeNewVisitorConn     uint16 = 9
-	V2TypeNewVisitorConnResp uint16 = 10
-	V2TypePing               uint16 = 11
-	V2TypePong               uint16 = 12
-	V2TypeUDPPacket          uint16 = 13
-	V2TypeNatHoleVisitor     uint16 = 14
-	V2TypeNatHoleClient      uint16 = 15
-	V2TypeNatHoleResp        uint16 = 16
-	V2TypeNatHoleSid         uint16 = 17
-	V2TypeNatHoleReport      uint16 = 18
-)
-
-var v2MsgTypeMap = map[uint16]any{
-	V2TypeLogin:              Login{},
-	V2TypeLoginResp:          LoginResp{},
-	V2TypeNewProxy:           NewProxy{},
-	V2TypeNewProxyResp:       NewProxyResp{},
-	V2TypeCloseProxy:         CloseProxy{},
-	V2TypeNewWorkConn:        NewWorkConn{},
-	V2TypeReqWorkConn:        ReqWorkConn{},
-	V2TypeStartWorkConn:      StartWorkConn{},
-	V2TypeNewVisitorConn:     NewVisitorConn{},
-	V2TypeNewVisitorConnResp: NewVisitorConnResp{},
-	V2TypePing:               Ping{},
-	V2TypePong:               Pong{},
-	V2TypeUDPPacket:          UDPPacket{},
-	V2TypeNatHoleVisitor:     NatHoleVisitor{},
-	V2TypeNatHoleClient:      NatHoleClient{},
-	V2TypeNatHoleResp:        NatHoleResp{},
-	V2TypeNatHoleSid:         NatHoleSid{},
-	V2TypeNatHoleReport:      NatHoleReport{},
-}
-
-var v2MsgReflectTypeMap, v2MsgTypeIDMap = buildV2MsgTypeMaps()
-
-func buildV2MsgTypeMaps() (map[uint16]reflect.Type, map[reflect.Type]uint16) {
-	reflectTypeMap := make(map[uint16]reflect.Type, len(v2MsgTypeMap))
-	typeIDMap := make(map[reflect.Type]uint16, len(v2MsgTypeMap))
-	for typeID, m := range v2MsgTypeMap {
-		t := reflect.TypeOf(m)
-		reflectTypeMap[typeID] = t
-		typeIDMap[t] = typeID
-	}
-	return reflectTypeMap, typeIDMap
-}
-
-type V2ReadWriter struct {
-	conn *wire.Conn
-}
-
-func NewV2ReadWriter(rw io.ReadWriter) *V2ReadWriter {
-	return NewV2ReadWriterWithConn(wire.NewConn(rw))
-}
-
-func NewV2ReadWriterWithConn(conn *wire.Conn) *V2ReadWriter {
-	return &V2ReadWriter{conn: conn}
-}
-
-func (rw *V2ReadWriter) WireConn() *wire.Conn {
-	return rw.conn
-}
-
-func (rw *V2ReadWriter) ReadMsg() (Message, error) {
-	f, err := rw.conn.ReadFrame()
-	if err != nil {
-		return nil, err
-	}
-	return DecodeV2MessageFrame(f)
-}
-
-func (rw *V2ReadWriter) ReadMsgInto(m Message) error {
-	f, err := rw.conn.ReadFrame()
-	if err != nil {
-		return err
-	}
-	return DecodeV2MessageFrameInto(f, m)
-}
-
-func (rw *V2ReadWriter) WriteMsg(m Message) error {
-	f, err := EncodeV2MessageFrame(m)
-	if err != nil {
-		return err
-	}
-	return rw.conn.WriteFrame(f)
-}
-
-func DecodeV2MessageFrame(f *wire.Frame) (Message, error) {
-	if f.Type != wire.FrameTypeMessage {
-		return nil, fmt.Errorf("unexpected frame type %d, want %d", f.Type, wire.FrameTypeMessage)
-	}
-	if len(f.Payload) < 2 {
-		return nil, fmt.Errorf("message frame payload too short")
-	}
-	typeID := binary.BigEndian.Uint16(f.Payload[:2])
-	t, ok := v2MsgReflectTypeMap[typeID]
-	if !ok {
-		return nil, fmt.Errorf("unknown v2 message type %d", typeID)
-	}
-	m := reflect.New(t).Interface()
-	if err := json.Unmarshal(f.Payload[2:], m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
-
-func DecodeV2MessageFrameInto(f *wire.Frame, out Message) error {
-	if f.Type != wire.FrameTypeMessage {
-		return fmt.Errorf("unexpected frame type %d, want %d", f.Type, wire.FrameTypeMessage)
-	}
-	if len(f.Payload) < 2 {
-		return fmt.Errorf("message frame payload too short")
-	}
-
-	typeID := binary.BigEndian.Uint16(f.Payload[:2])
-	outType := reflect.TypeOf(out)
-	if outType == nil || outType.Kind() != reflect.Pointer {
-		return fmt.Errorf("message target must be a pointer")
-	}
-	elemType := outType.Elem()
-	expectedTypeID, ok := v2MsgTypeIDMap[elemType]
-	if !ok {
-		return fmt.Errorf("unknown v2 message type %s", elemType.String())
-	}
-	if typeID != expectedTypeID {
-		actualType, ok := v2MsgReflectTypeMap[typeID]
-		if !ok {
-			return fmt.Errorf("unknown v2 message type %d", typeID)
-		}
-		return fmt.Errorf("unexpected message type %s, want %s", actualType.String(), elemType.String())
-	}
-	return json.Unmarshal(f.Payload[2:], out)
-}
-
-func EncodeV2MessageFrame(m Message) (*wire.Frame, error) {
-	t := reflect.TypeOf(m)
-	if t == nil {
-		return nil, fmt.Errorf("nil message")
-	}
-	if t.Kind() == reflect.Pointer {
-		t = t.Elem()
-	}
-	typeID, ok := v2MsgTypeIDMap[t]
-	if !ok {
-		return nil, fmt.Errorf("unknown v2 message type %s", t.String())
-	}
-	content, err := json.Marshal(m)
-	if err != nil {
-		return nil, err
-	}
-	payload := make([]byte, 2+len(content))
-	binary.BigEndian.PutUint16(payload[:2], typeID)
-	copy(payload[2:], content)
-	return &wire.Frame{
-		Type:    wire.FrameTypeMessage,
-		Payload: payload,
-	}, nil
-}
--- a/pkg/msg/wire_v2_test.go
+++ b/pkg/msg/wire_v2_test.go
@@ -1,121 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package msg
-
-import (
-	"bytes"
-	"encoding/binary"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/fatedier/frp/pkg/proto/wire"
-)
-
-func TestV2ReadWriterRoundTrip(t *testing.T) {
-	var buf bytes.Buffer
-	rw := NewV2ReadWriter(&buf)
-
-	in := &Login{
-		Version: "test-version",
-		RunID:   "run-id",
-		User:    "user",
-	}
-	require.NoError(t, rw.WriteMsg(in))
-
-	out, err := rw.ReadMsg()
-	require.NoError(t, err)
-	require.Equal(t, in, out)
-}
-
-func TestNewReadWriter(t *testing.T) {
-	require.IsType(t, &V1ReadWriter{}, NewReadWriter(&bytes.Buffer{}, ""))
-	require.IsType(t, &V1ReadWriter{}, NewReadWriter(&bytes.Buffer{}, wire.ProtocolV1))
-	require.IsType(t, &V2ReadWriter{}, NewReadWriter(&bytes.Buffer{}, wire.ProtocolV2))
-}
-
-func TestV2MessageTypeIDsAreStable(t *testing.T) {
-	require.Equal(t, uint16(1), V2TypeLogin)
-	require.Equal(t, uint16(2), V2TypeLoginResp)
-	require.Equal(t, uint16(3), V2TypeNewProxy)
-	require.Equal(t, uint16(4), V2TypeNewProxyResp)
-	require.Equal(t, uint16(5), V2TypeCloseProxy)
-	require.Equal(t, uint16(6), V2TypeNewWorkConn)
-	require.Equal(t, uint16(7), V2TypeReqWorkConn)
-	require.Equal(t, uint16(8), V2TypeStartWorkConn)
-	require.Equal(t, uint16(9), V2TypeNewVisitorConn)
-	require.Equal(t, uint16(10), V2TypeNewVisitorConnResp)
-	require.Equal(t, uint16(11), V2TypePing)
-	require.Equal(t, uint16(12), V2TypePong)
-	require.Equal(t, uint16(13), V2TypeUDPPacket)
-	require.Equal(t, uint16(14), V2TypeNatHoleVisitor)
-	require.Equal(t, uint16(15), V2TypeNatHoleClient)
-	require.Equal(t, uint16(16), V2TypeNatHoleResp)
-	require.Equal(t, uint16(17), V2TypeNatHoleSid)
-	require.Equal(t, uint16(18), V2TypeNatHoleReport)
-}
-
-func TestV2MessageFrameEncoding(t *testing.T) {
-	frame, err := EncodeV2MessageFrame(&ReqWorkConn{})
-	require.NoError(t, err)
-	require.Equal(t, wire.FrameTypeMessage, frame.Type)
-	require.Len(t, frame.Payload, 4)
-	require.Equal(t, V2TypeReqWorkConn, binary.BigEndian.Uint16(frame.Payload[:2]))
-
-	out, err := DecodeV2MessageFrame(frame)
-	require.NoError(t, err)
-	require.IsType(t, &ReqWorkConn{}, out)
-}
-
-func TestDecodeV2MessageFrameInto(t *testing.T) {
-	in := &StartWorkConn{ProxyName: "tcp", SrcAddr: "127.0.0.1", SrcPort: 1234}
-	frame, err := EncodeV2MessageFrame(in)
-	require.NoError(t, err)
-
-	var out StartWorkConn
-	require.NoError(t, DecodeV2MessageFrameInto(frame, &out))
-	require.Equal(t, *in, out)
-}
-
-func TestDecodeV2MessageFrameRejectsInvalidFrame(t *testing.T) {
-	_, err := DecodeV2MessageFrame(&wire.Frame{Type: wire.FrameTypeClientHello})
-	require.ErrorContains(t, err, "unexpected frame type")
-
-	_, err = DecodeV2MessageFrame(&wire.Frame{Type: wire.FrameTypeMessage, Payload: []byte{0}})
-	require.ErrorContains(t, err, "payload too short")
-
-	payload := make([]byte, 4)
-	binary.BigEndian.PutUint16(payload[:2], 65535)
-	copy(payload[2:], []byte("{}"))
-	_, err = DecodeV2MessageFrame(&wire.Frame{Type: wire.FrameTypeMessage, Payload: payload})
-	require.ErrorContains(t, err, "unknown v2 message type")
-}
-
-func TestDecodeV2MessageFrameIntoRejectsWrongTarget(t *testing.T) {
-	frame, err := EncodeV2MessageFrame(&ReqWorkConn{})
-	require.NoError(t, err)
-
-	var out StartWorkConn
-	err = DecodeV2MessageFrameInto(frame, &out)
-	require.ErrorContains(t, err, "unexpected message type")
-
-	err = DecodeV2MessageFrameInto(frame, StartWorkConn{})
-	require.ErrorContains(t, err, "must be a pointer")
-}
-
-func TestEncodeV2MessageFrameRejectsUnknownMessage(t *testing.T) {
-	_, err := EncodeV2MessageFrame(struct{}{})
-	require.ErrorContains(t, err, "unknown v2 message type")
-}
--- a/pkg/naming/names.go
+++ b/pkg/naming/names.go
@@ -16,8 +16,9 @@ func StripUserPrefix(user, name string) string {
 	if user == "" {
 		return name
 	}
-	if trimmed, ok := strings.CutPrefix(name, user+"."); ok {
-		return trimmed
+	prefix := user + "."
+	if strings.HasPrefix(name, prefix) {
+		return strings.TrimPrefix(name, prefix)
 	}
 	return name
 }
--- a/pkg/nathole/analysis.go
+++ b/pkg/nathole/analysis.go
@@ -151,7 +151,7 @@ func getBehaviorScoresByMode(mode int, defaultScore int) []*BehaviorScore {
 func getBehaviorScoresByMode2(mode int, senderScore, receiverScore int) []*BehaviorScore {
 	behaviors := getBehaviorByMode(mode)
 	scores := make([]*BehaviorScore, 0, len(behaviors))
-	for i := range behaviors {
+	for i := 0; i < len(behaviors); i++ {
 		score := receiverScore
 		if behaviors[i].A.Role == DetectRoleSender {
 			score = senderScore
--- a/pkg/nathole/classify.go
+++ b/pkg/nathole/classify.go
@@ -70,8 +70,12 @@ func ClassifyNATFeature(addresses []string, localIPs []string) (*NatFeature, err
 			continue
 		}

-		portMax = max(portMax, portNum)
-		portMin = min(portMin, portNum)
+		if portNum > portMax {
+			portMax = portNum
+		}
+		if portNum < portMin {
+			portMin = portNum
+		}
 		if baseIP != ip {
 			ipChanged = true
 		}
--- a/pkg/nathole/controller.go
+++ b/pkg/nathole/controller.go
@@ -152,9 +152,7 @@ func (c *Controller) GenSid() string {

 func (c *Controller) HandleVisitor(m *msg.NatHoleVisitor, transporter transport.MessageTransporter, visitorUser string) {
 	if m.PreCheck {
-		c.mu.RLock()
 		cfg, ok := c.clientCfgs[m.ProxyName]
-		c.mu.RUnlock()
 		if !ok {
 			_ = transporter.Send(c.GenNatHoleResponse(m.TransactionID, nil, fmt.Sprintf("xtcp server for [%s] doesn't exist", m.ProxyName)))
 			return
--- a/pkg/nathole/discovery.go
+++ b/pkg/nathole/discovery.go
@@ -19,7 +19,7 @@ import (
 	"net"
 	"time"

-	"github.com/pion/stun/v3"
+	"github.com/pion/stun/v2"
 )

 var responseTimeout = 3 * time.Second
--- a/pkg/nathole/nathole.go
+++ b/pkg/nathole/nathole.go
@@ -298,13 +298,11 @@ func waitDetectMessage(
 		n, raddr, err := conn.ReadFromUDP(buf)
 		_ = conn.SetReadDeadline(time.Time{})
 		if err != nil {
-			pool.PutBuf(buf)
 			return nil, err
 		}
 		xl.Debugf("get udp message local %s, from %s", conn.LocalAddr(), raddr)
 		var m msg.NatHoleSid
 		if err := DecodeMessageInto(buf[:n], key, &m); err != nil {
-			pool.PutBuf(buf)
 			xl.Warnf("decode sid message error: %v", err)
 			continue
 		}
@@ -410,7 +408,7 @@ func sendSidMessageToRandomPorts(
 	xl := xlog.FromContextSafe(ctx)
 	used := sets.New[int]()
 	getUnusedPort := func() int {
-		for range 10 {
+		for i := 0; i < 10; i++ {
 			port := rand.IntN(65535-1024) + 1024
 			if !used.Has(port) {
 				used.Insert(port)
@@ -420,7 +418,7 @@ func sendSidMessageToRandomPorts(
 		return 0
 	}

-	for range count {
+	for i := 0; i < count; i++ {
 		select {
 		case <-ctx.Done():
 			return
--- a/pkg/nathole/utils.go
+++ b/pkg/nathole/utils.go
@@ -21,7 +21,7 @@ import (
 	"strconv"

 	"github.com/fatedier/golib/crypto"
-	"github.com/pion/stun/v3"
+	"github.com/pion/stun/v2"

 	"github.com/fatedier/frp/pkg/msg"
 )
--- a/pkg/plugin/client/http2http.go
+++ b/pkg/plugin/client/http2http.go
@@ -21,7 +21,6 @@ import (
 	stdlog "log"
 	"net/http"
 	"net/http/httputil"
-	"time"

 	"github.com/fatedier/golib/pool"

@@ -69,7 +68,7 @@ func NewHTTP2HTTPPlugin(_ PluginContext, options v1.ClientPluginOptions) (Plugin

 	p.s = &http.Server{
 		Handler:           rp,
-		ReadHeaderTimeout: 60 * time.Second,
+		ReadHeaderTimeout: 0,
 	}

 	go func() {
--- a/pkg/plugin/client/http2https.go
+++ b/pkg/plugin/client/http2https.go
@@ -22,7 +22,6 @@ import (
 	stdlog "log"
 	"net/http"
 	"net/http/httputil"
-	"time"

 	"github.com/fatedier/golib/pool"

@@ -78,7 +77,7 @@ func NewHTTP2HTTPSPlugin(_ PluginContext, options v1.ClientPluginOptions) (Plugi

 	p.s = &http.Server{
 		Handler:           rp,
-		ReadHeaderTimeout: 60 * time.Second,
+		ReadHeaderTimeout: 0,
 	}

 	go func() {
--- a/pkg/plugin/client/http_proxy.go
+++ b/pkg/plugin/client/http_proxy.go
@@ -45,8 +45,6 @@ type HTTPProxy struct {
 	s *http.Server
 }

-const httpProxyReadHeaderTimeout = 60 * time.Second
-
 func NewHTTPProxyPlugin(_ PluginContext, options v1.ClientPluginOptions) (Plugin, error) {
 	opts := options.(*v1.HTTPProxyPluginOptions)
 	listener := NewProxyListener()
@@ -58,7 +56,7 @@ func NewHTTPProxyPlugin(_ PluginContext, options v1.ClientPluginOptions) (Plugin

 	hp.s = &http.Server{
 		Handler:           hp,
-		ReadHeaderTimeout: httpProxyReadHeaderTimeout,
+		ReadHeaderTimeout: 60 * time.Second,
 	}

 	go func() {
@@ -75,19 +73,16 @@ func (hp *HTTPProxy) Handle(_ context.Context, connInfo *ConnectionInfo) {
 	wrapConn := netpkg.WrapReadWriteCloserToConn(connInfo.Conn, connInfo.UnderlyingConn)

 	sc, rd := libnet.NewSharedConn(wrapConn)
-	firstBytes := make([]byte, len(http.MethodConnect))
-	_ = wrapConn.SetReadDeadline(time.Now().Add(httpProxyReadHeaderTimeout))
-	_, err := io.ReadFull(rd, firstBytes)
+	firstBytes := make([]byte, 7)
+	_, err := rd.Read(firstBytes)
 	if err != nil {
-		_ = wrapConn.SetReadDeadline(time.Time{})
 		wrapConn.Close()
 		return
 	}

-	if strings.EqualFold(string(firstBytes), http.MethodConnect) {
+	if strings.ToUpper(string(firstBytes)) == "CONNECT" {
 		bufRd := bufio.NewReader(sc)
 		request, err := http.ReadRequest(bufRd)
-		_ = wrapConn.SetReadDeadline(time.Time{})
 		if err != nil {
 			wrapConn.Close()
 			return
@@ -96,7 +91,6 @@ func (hp *HTTPProxy) Handle(_ context.Context, connInfo *ConnectionInfo) {
 		return
 	}

-	_ = wrapConn.SetReadDeadline(time.Time{})
 	_ = hp.l.PutConn(sc)
 }

@@ -113,7 +107,13 @@ func (hp *HTTPProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 		return
 	}

-	hp.HTTPHandler(rw, req)
+	if req.Method == http.MethodConnect {
+		// deprecated
+		// Connect request is handled in Handle function.
+		hp.ConnectHandler(rw, req)
+	} else {
+		hp.HTTPHandler(rw, req)
+	}
 }

 func (hp *HTTPProxy) HTTPHandler(rw http.ResponseWriter, req *http.Request) {
@@ -135,6 +135,33 @@ func (hp *HTTPProxy) HTTPHandler(rw http.ResponseWriter, req *http.Request) {
 	}
 }

+// deprecated
+// Hijack needs to SetReadDeadline on the Conn of the request, but if we use stream compression here,
+// we may always get i/o timeout error.
+func (hp *HTTPProxy) ConnectHandler(rw http.ResponseWriter, req *http.Request) {
+	hj, ok := rw.(http.Hijacker)
+	if !ok {
+		rw.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+
+	client, _, err := hj.Hijack()
+	if err != nil {
+		rw.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+
+	remote, err := net.Dial("tcp", req.URL.Host)
+	if err != nil {
+		http.Error(rw, "Failed", http.StatusBadRequest)
+		client.Close()
+		return
+	}
+	_, _ = client.Write([]byte("HTTP/1.1 200 OK\r\n\r\n"))
+
+	go libio.Join(remote, client)
+}
+
 func (hp *HTTPProxy) Auth(req *http.Request) bool {
 	if hp.opts.HTTPUser == "" && hp.opts.HTTPPassword == "" {
 		return true
--- a/pkg/plugin/client/http_proxy_test.go
+++ b/pkg/plugin/client/http_proxy_test.go
@@ -1,107 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//go:build !frps
-
-package client
-
-import (
-	"bufio"
-	"context"
-	"fmt"
-	"io"
-	"net"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-)
-
-func TestHTTPProxyHandleFragmentedConnectMethod(t *testing.T) {
-	require := require.New(t)
-
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	require.NoError(err)
-	defer ln.Close()
-
-	const payload = "ping"
-	echoErr := make(chan error, 1)
-	go func() {
-		conn, err := ln.Accept()
-		if err != nil {
-			echoErr <- err
-			return
-		}
-		defer conn.Close()
-
-		buf := make([]byte, len(payload))
-		if _, err = io.ReadFull(conn, buf); err != nil {
-			echoErr <- err
-			return
-		}
-		if string(buf) != payload {
-			echoErr <- fmt.Errorf("unexpected payload %q", string(buf))
-			return
-		}
-		_, err = conn.Write([]byte("echo:" + payload))
-		echoErr <- err
-	}()
-
-	hp := &HTTPProxy{
-		opts: &v1.HTTPProxyPluginOptions{},
-		l:    NewProxyListener(),
-	}
-
-	clientConn, serverConn := net.Pipe()
-	defer clientConn.Close()
-
-	go hp.Handle(context.Background(), &ConnectionInfo{
-		Conn:           serverConn,
-		UnderlyingConn: serverConn,
-	})
-
-	require.NoError(clientConn.SetDeadline(time.Now().Add(5 * time.Second)))
-
-	targetAddr := ln.Addr().String()
-	req := "CONNECT " + targetAddr + " HTTP/1.1\r\nHost: " + targetAddr + "\r\n\r\n"
-	_, err = clientConn.Write([]byte("CON"))
-	require.NoError(err)
-	_, err = clientConn.Write([]byte(req[len("CON"):]))
-	require.NoError(err)
-
-	rd := bufio.NewReader(clientConn)
-	status, err := rd.ReadString('\n')
-	require.NoError(err)
-	require.Equal("HTTP/1.1 200 OK\r\n", status)
-	line, err := rd.ReadString('\n')
-	require.NoError(err)
-	require.Equal("\r\n", line)
-
-	_, err = clientConn.Write([]byte(payload))
-	require.NoError(err)
-
-	got := make([]byte, len("echo:"+payload))
-	_, err = io.ReadFull(rd, got)
-	require.NoError(err)
-	require.Equal("echo:"+payload, string(got))
-
-	select {
-	case err := <-echoErr:
-		require.NoError(err)
-	case <-time.After(time.Second):
-		t.Fatal("timed out waiting for echo server")
-	}
-}
--- a/pkg/plugin/client/tls2raw.go
+++ b/pkg/plugin/client/tls2raw.go
@@ -62,13 +62,11 @@ func (p *TLS2RawPlugin) Handle(ctx context.Context, connInfo *ConnectionInfo) {

 	if err := tlsConn.Handshake(); err != nil {
 		xl.Warnf("tls handshake error: %v", err)
-		tlsConn.Close()
 		return
 	}
 	rawConn, err := net.Dial("tcp", p.opts.LocalAddr)
 	if err != nil {
 		xl.Warnf("dial to local addr error: %v", err)
-		tlsConn.Close()
 		return
 	}

--- a/pkg/plugin/client/unix_domain_socket.go
+++ b/pkg/plugin/client/unix_domain_socket.go
@@ -54,13 +54,10 @@ func (uds *UnixDomainSocketPlugin) Handle(ctx context.Context, connInfo *Connect
 	localConn, err := net.DialUnix("unix", nil, uds.UnixAddr)
 	if err != nil {
 		xl.Warnf("dial to uds %s error: %v", uds.UnixAddr, err)
-		connInfo.Conn.Close()
 		return
 	}
 	if connInfo.ProxyProtocolHeader != nil {
 		if _, err := connInfo.ProxyProtocolHeader.WriteTo(localConn); err != nil {
-			localConn.Close()
-			connInfo.Conn.Close()
 			return
 		}
 	}
--- a/pkg/plugin/server/http.go
+++ b/pkg/plugin/server/http.go
@@ -24,7 +24,6 @@ import (
 	"net/http"
 	"net/url"
 	"reflect"
-	"slices"
 	"strings"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
@@ -65,7 +64,12 @@ func (p *httpPlugin) Name() string {
 }

 func (p *httpPlugin) IsSupport(op string) bool {
-	return slices.Contains(p.options.Ops, op)
+	for _, v := range p.options.Ops {
+		if v == op {
+			return true
+		}
+	}
+	return false
 }

 func (p *httpPlugin) Handle(ctx context.Context, op string, content any) (*Response, any, error) {
--- a/pkg/plugin/visitor/virtual_net.go
+++ b/pkg/plugin/visitor/virtual_net.go
@@ -153,7 +153,10 @@ func (p *VirtualNetPlugin) run() {

 				// Exponential backoff: 60s, 120s, 240s, 300s (capped)
 				baseDelay := 60 * time.Second
-				reconnectDelay = min(baseDelay*time.Duration(1<<uint(p.consecutiveErrors-1)), 300*time.Second)
+				reconnectDelay = baseDelay * time.Duration(1<<uint(p.consecutiveErrors-1))
+				if reconnectDelay > 300*time.Second {
+					reconnectDelay = 300 * time.Second
+				}
 			} else {
 				// Reset consecutive errors on successful connection
 				if p.consecutiveErrors > 0 {
--- a/pkg/policy/featuregate/feature_gate.go
+++ b/pkg/policy/featuregate/feature_gate.go
@@ -16,7 +16,6 @@ package featuregate

 import (
 	"fmt"
-	"maps"
 	"sort"
 	"strings"
 	"sync"
@@ -93,7 +92,10 @@ type featureGate struct {

 // NewFeatureGate creates a new feature gate with the default features
 func NewFeatureGate() MutableFeatureGate {
-	known := maps.Clone(defaultFeatures)
+	known := map[Feature]FeatureSpec{}
+	for k, v := range defaultFeatures {
+		known[k] = v
+	}

 	f := &featureGate{}
 	f.known.Store(known)
@@ -107,8 +109,14 @@ func (f *featureGate) SetFromMap(m map[string]bool) error {
 	defer f.lock.Unlock()

 	// Copy existing state
-	known := maps.Clone(f.known.Load().(map[Feature]FeatureSpec))
-	enabled := maps.Clone(f.enabled.Load().(map[Feature]bool))
+	known := map[Feature]FeatureSpec{}
+	for k, v := range f.known.Load().(map[Feature]FeatureSpec) {
+		known[k] = v
+	}
+	enabled := map[Feature]bool{}
+	for k, v := range f.enabled.Load().(map[Feature]bool) {
+		enabled[k] = v
+	}

 	// Apply the new settings
 	for k, v := range m {
@@ -139,7 +147,10 @@ func (f *featureGate) Add(features map[Feature]FeatureSpec) error {
 	}

 	// Copy existing state
-	known := maps.Clone(f.known.Load().(map[Feature]FeatureSpec))
+	known := map[Feature]FeatureSpec{}
+	for k, v := range f.known.Load().(map[Feature]FeatureSpec) {
+		known[k] = v
+	}

 	// Add new features
 	for name, spec := range features {
--- a/pkg/proto/udp/udp.go
+++ b/pkg/proto/udp/udp.go
@@ -85,7 +85,6 @@ func Forwarder(dstAddr *net.UDPAddr, readCh <-chan *msg.UDPPacket, sendCh chan<-
 		}()

 		buf := pool.GetBuf(bufSize)
-		defer pool.PutBuf(buf)
 		for {
 			_ = udpConn.SetReadDeadline(time.Now().Add(30 * time.Second))
 			n, _, err := udpConn.ReadFromUDP(buf)
--- a/pkg/proto/wire/wire.go
+++ b/pkg/proto/wire/wire.go
@@ -1,222 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package wire
-
-import (
-	"encoding/binary"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net"
-	"slices"
-
-	libnet "github.com/fatedier/golib/net"
-)
-
-const (
-	ProtocolV1 = "v1"
-	ProtocolV2 = "v2"
-
-	WireVersionV2 = 2
-
-	FrameTypeClientHello uint16 = 1
-	FrameTypeServerHello uint16 = 2
-	FrameTypeMessage     uint16 = 16
-
-	MessageCodecJSON           = "json"
-	DefaultMaxFramePayloadSize = 64 * 1024
-
-	MagicV2 = "FRP\x00\x02\r\n"
-)
-
-type Frame struct {
-	Type    uint16
-	Flags   uint16
-	Payload []byte
-}
-
-type Conn struct {
-	rw                  io.ReadWriter
-	maxFramePayloadSize uint32
-}
-
-func NewConn(rw io.ReadWriter) *Conn {
-	return &Conn{
-		rw:                  rw,
-		maxFramePayloadSize: DefaultMaxFramePayloadSize,
-	}
-}
-
-func (c *Conn) ReadFrame() (*Frame, error) {
-	header := make([]byte, 8)
-	if _, err := io.ReadFull(c.rw, header); err != nil {
-		return nil, err
-	}
-
-	frameType := binary.BigEndian.Uint16(header[0:2])
-	flags := binary.BigEndian.Uint16(header[2:4])
-	length := binary.BigEndian.Uint32(header[4:8])
-	if flags != 0 {
-		return nil, fmt.Errorf("unsupported frame flags: %d", flags)
-	}
-	if length > c.maxFramePayloadSize {
-		return nil, fmt.Errorf("frame payload length %d exceeds limit %d", length, c.maxFramePayloadSize)
-	}
-
-	payload := make([]byte, length)
-	if _, err := io.ReadFull(c.rw, payload); err != nil {
-		return nil, err
-	}
-	return &Frame{
-		Type:    frameType,
-		Flags:   flags,
-		Payload: payload,
-	}, nil
-}
-
-func (c *Conn) WriteFrame(f *Frame) error {
-	if f.Flags != 0 {
-		return fmt.Errorf("unsupported frame flags: %d", f.Flags)
-	}
-	if len(f.Payload) > int(c.maxFramePayloadSize) {
-		return fmt.Errorf("frame payload length %d exceeds limit %d", len(f.Payload), c.maxFramePayloadSize)
-	}
-
-	header := make([]byte, 8)
-	binary.BigEndian.PutUint16(header[0:2], f.Type)
-	binary.BigEndian.PutUint16(header[2:4], f.Flags)
-	binary.BigEndian.PutUint32(header[4:8], uint32(len(f.Payload)))
-	if _, err := c.rw.Write(header); err != nil {
-		return err
-	}
-	_, err := c.rw.Write(f.Payload)
-	return err
-}
-
-func (c *Conn) ReadJSONFrame(frameType uint16, out any) error {
-	f, err := c.ReadFrame()
-	if err != nil {
-		return err
-	}
-	if f.Type != frameType {
-		return fmt.Errorf("unexpected frame type %d, want %d", f.Type, frameType)
-	}
-	return c.UnmarshalFrame(f, out)
-}
-
-func (c *Conn) UnmarshalFrame(f *Frame, out any) error {
-	return json.Unmarshal(f.Payload, out)
-}
-
-func (c *Conn) WriteJSONFrame(frameType uint16, in any) error {
-	payload, err := json.Marshal(in)
-	if err != nil {
-		return err
-	}
-	return c.WriteFrame(&Frame{
-		Type:    frameType,
-		Payload: payload,
-	})
-}
-
-func WriteMagic(w io.Writer) error {
-	_, err := io.WriteString(w, MagicV2)
-	return err
-}
-
-func WriteMagicIfV2(w io.Writer, wireProtocol string) error {
-	if wireProtocol != ProtocolV2 {
-		return nil
-	}
-	return WriteMagic(w)
-}
-
-func CheckMagic(conn net.Conn) (out net.Conn, isV2 bool, err error) {
-	sharedConn, r := libnet.NewSharedConnSize(conn, len(MagicV2))
-	buf := make([]byte, len(MagicV2))
-	if _, err = io.ReadFull(r, buf); err != nil {
-		return nil, false, err
-	}
-	for i := range MagicV2 {
-		if buf[i] != MagicV2[i] {
-			return sharedConn, false, nil
-		}
-	}
-	return conn, true, nil
-}
-
-type BootstrapInfo struct {
-	Transport string `json:"transport,omitempty"`
-	TLS       bool   `json:"tls,omitempty"`
-	TCPMux    bool   `json:"tcpMux,omitempty"`
-}
-
-type ClientHello struct {
-	Bootstrap    BootstrapInfo      `json:"bootstrap,omitempty"`
-	Capabilities ClientCapabilities `json:"capabilities,omitempty"`
-}
-
-type ClientCapabilities struct {
-	Message MessageCapabilities `json:"message,omitempty"`
-}
-
-type MessageCapabilities struct {
-	Codecs []string `json:"codecs,omitempty"`
-}
-
-type ServerHello struct {
-	Selected ServerSelection `json:"selected,omitempty"`
-	Error    string          `json:"error,omitempty"`
-}
-
-type ServerSelection struct {
-	Message MessageSelection `json:"message,omitempty"`
-}
-
-type MessageSelection struct {
-	Codec string `json:"codec,omitempty"`
-}
-
-func DefaultClientHello(bootstrap BootstrapInfo) ClientHello {
-	return ClientHello{
-		Bootstrap: bootstrap,
-		Capabilities: ClientCapabilities{
-			Message: MessageCapabilities{
-				Codecs: []string{MessageCodecJSON},
-			},
-		},
-	}
-}
-
-func DefaultServerHello() ServerHello {
-	return ServerHello{
-		Selected: ServerSelection{
-			Message: MessageSelection{
-				Codec: MessageCodecJSON,
-			},
-		},
-	}
-}
-
-func Supports(list []string, value string) bool {
-	return slices.Contains(list, value)
-}
-
-func ValidateClientHello(h ClientHello) error {
-	if !Supports(h.Capabilities.Message.Codecs, MessageCodecJSON) {
-		return fmt.Errorf("unsupported message codec")
-	}
-	return nil
-}
--- a/pkg/proto/wire/wire_test.go
+++ b/pkg/proto/wire/wire_test.go
@@ -1,120 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package wire
-
-import (
-	"bytes"
-	"encoding/binary"
-	"io"
-	"net"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestFrameRoundTrip(t *testing.T) {
-	var buf bytes.Buffer
-	conn := NewConn(&buf)
-
-	in := DefaultClientHello(BootstrapInfo{
-		Transport: "tcp",
-		TLS:       true,
-		TCPMux:    true,
-	})
-	require.NoError(t, conn.WriteJSONFrame(FrameTypeClientHello, in))
-
-	var out ClientHello
-	require.NoError(t, conn.ReadJSONFrame(FrameTypeClientHello, &out))
-	require.Equal(t, in, out)
-}
-
-func TestReadFrameRejectsUnsupportedFlags(t *testing.T) {
-	var buf bytes.Buffer
-	header := make([]byte, 8)
-	binary.BigEndian.PutUint16(header[0:2], FrameTypeMessage)
-	binary.BigEndian.PutUint16(header[2:4], 1)
-	binary.BigEndian.PutUint32(header[4:8], 0)
-	buf.Write(header)
-
-	_, err := NewConn(&buf).ReadFrame()
-	require.ErrorContains(t, err, "unsupported frame flags")
-}
-
-func TestReadFrameRejectsOversizedPayload(t *testing.T) {
-	var buf bytes.Buffer
-	header := make([]byte, 8)
-	binary.BigEndian.PutUint16(header[0:2], FrameTypeMessage)
-	binary.BigEndian.PutUint32(header[4:8], DefaultMaxFramePayloadSize+1)
-	buf.Write(header)
-
-	_, err := NewConn(&buf).ReadFrame()
-	require.ErrorContains(t, err, "exceeds limit")
-}
-
-func TestCheckMagicV2ConsumesMagic(t *testing.T) {
-	client, server := net.Pipe()
-	defer server.Close()
-
-	want := []byte("payload")
-	go func() {
-		defer client.Close()
-		_, _ = client.Write(append([]byte(MagicV2), want...))
-	}()
-
-	out, isV2, err := CheckMagic(server)
-	require.NoError(t, err)
-	require.True(t, isV2)
-
-	got := make([]byte, len(want))
-	_, err = io.ReadFull(out, got)
-	require.NoError(t, err)
-	require.Equal(t, want, got)
-}
-
-func TestWriteMagicIfV2(t *testing.T) {
-	var buf bytes.Buffer
-	require.NoError(t, WriteMagicIfV2(&buf, ProtocolV1))
-	require.Empty(t, buf.Bytes())
-
-	require.NoError(t, WriteMagicIfV2(&buf, ProtocolV2))
-	require.Equal(t, []byte(MagicV2), buf.Bytes())
-}
-
-func TestCheckMagicV1PreservesReadBytes(t *testing.T) {
-	client, server := net.Pipe()
-	defer server.Close()
-
-	want := []byte("legacy payload")
-	go func() {
-		defer client.Close()
-		_, _ = client.Write(want)
-	}()
-
-	out, isV2, err := CheckMagic(server)
-	require.NoError(t, err)
-	require.False(t, isV2)
-
-	got, err := io.ReadAll(out)
-	require.NoError(t, err)
-	require.Equal(t, want, got)
-}
-
-func TestValidateClientHello(t *testing.T) {
-	require.NoError(t, ValidateClientHello(DefaultClientHello(BootstrapInfo{})))
-
-	hello := DefaultClientHello(BootstrapInfo{})
-	hello.Capabilities.Message.Codecs = []string{"unknown"}
-	require.ErrorContains(t, ValidateClientHello(hello), "unsupported message codec")
-}
--- a/pkg/transport/tls.go
+++ b/pkg/transport/tls.go
@@ -20,7 +20,6 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/pem"
-	"fmt"
 	"math/big"
 	"os"
 	"time"
@@ -86,9 +85,7 @@ func newCertPool(caPath string) (*x509.CertPool, error) {
 		return nil, err
 	}

-	if !pool.AppendCertsFromPEM(caCrt) {
-		return nil, fmt.Errorf("failed to parse CA certificate from file %q: no valid PEM certificates found", caPath)
-	}
+	pool.AppendCertsFromPEM(caCrt)

 	return pool, nil
 }
--- a/pkg/util/http/http.go
+++ b/pkg/util/http/http.go
@@ -89,11 +89,11 @@ func ParseBasicAuth(auth string) (username, password string, ok bool) {
 		return
 	}
 	cs := string(c)
-	before, after, found := strings.Cut(cs, ":")
-	if !found {
+	s := strings.IndexByte(cs, ':')
+	if s < 0 {
 		return
 	}
-	return before, after, true
+	return cs[:s], cs[s+1:], true
 }

 func BasicAuth(username, passwd string) string {
--- a/pkg/util/http/server.go
+++ b/pkg/util/http/server.go
@@ -100,11 +100,7 @@ func (s *Server) Run() error {
 }

 func (s *Server) Close() error {
-	err := s.hs.Close()
-	if s.ln != nil {
-		_ = s.ln.Close()
-	}
-	return err
+	return s.hs.Close()
 }

 type RouterRegisterHelper struct {
--- a/pkg/util/net/conn.go
+++ b/pkg/util/net/conn.go
@@ -133,7 +133,7 @@ type CloseNotifyConn struct {
 	net.Conn

 	// 1 means closed
-	closeFlag atomic.Int32
+	closeFlag int32

 	closeFn func(error)
 }
@@ -147,7 +147,7 @@ func WrapCloseNotifyConn(c net.Conn, closeFn func(error)) *CloseNotifyConn {
 }

 func (cc *CloseNotifyConn) Close() (err error) {
-	pflag := cc.closeFlag.Swap(1)
+	pflag := atomic.SwapInt32(&cc.closeFlag, 1)
 	if pflag == 0 {
 		err = cc.Conn.Close()
 		if cc.closeFn != nil {
@@ -159,7 +159,7 @@ func (cc *CloseNotifyConn) Close() (err error) {

 // CloseWithError closes the connection and passes the error to the close callback.
 func (cc *CloseNotifyConn) CloseWithError(err error) error {
-	pflag := cc.closeFlag.Swap(1)
+	pflag := atomic.SwapInt32(&cc.closeFlag, 1)
 	if pflag == 0 {
 		closeErr := cc.Conn.Close()
 		if cc.closeFn != nil {
@@ -173,7 +173,7 @@ func (cc *CloseNotifyConn) CloseWithError(err error) error {
 type StatsConn struct {
 	net.Conn

-	closed     atomic.Int64 // 1 means closed
+	closed     int64 // 1 means closed
 	totalRead  int64
 	totalWrite int64
 	statsFunc  func(totalRead, totalWrite int64)
@@ -199,7 +199,7 @@ func (statsConn *StatsConn) Write(p []byte) (n int, err error) {
 }

 func (statsConn *StatsConn) Close() (err error) {
-	old := statsConn.closed.Swap(1)
+	old := atomic.SwapInt64(&statsConn.closed, 1)
 	if old != 1 {
 		err = statsConn.Conn.Close()
 		if statsConn.statsFunc != nil {
--- a/pkg/util/net/udp.go
+++ b/pkg/util/net/udp.go
@@ -86,7 +86,11 @@ func (c *FakeUDPConn) Read(b []byte) (n int, err error) {
 	c.lastActive = time.Now()
 	c.mu.Unlock()

-	n = min(len(b), len(content))
+	if len(b) < len(content) {
+		n = len(b)
+	} else {
+		n = len(content)
+	}
 	copy(b, content)
 	return n, nil
 }
@@ -164,15 +168,11 @@ func ListenUDP(bindAddr string, bindPort int) (l *UDPListener, err error) {
 		return l, err
 	}
 	readConn, err := net.ListenUDP("udp", udpAddr)
-	if err != nil {
-		return l, err
-	}

 	l = &UDPListener{
 		addr:      udpAddr,
 		acceptCh:  make(chan net.Conn),
 		writeCh:   make(chan *UDPPacket, 1000),
-		readConn:  readConn,
 		fakeConns: make(map[string]*FakeUDPConn),
 	}

--- a/pkg/util/net/websocket.go
+++ b/pkg/util/net/websocket.go
@@ -26,7 +26,6 @@ type WebsocketListener struct {
 // ln: tcp listener for websocket connections
 func NewWebsocketListener(ln net.Listener) (wl *WebsocketListener) {
 	wl = &WebsocketListener{
-		ln:       ln,
 		acceptCh: make(chan net.Conn),
 	}

--- a/pkg/util/util/util.go
+++ b/pkg/util/util/util.go
@@ -68,8 +68,8 @@ func ParseRangeNumbers(rangeStr string) (numbers []int64, err error) {
 	rangeStr = strings.TrimSpace(rangeStr)
 	numbers = make([]int64, 0)
 	// e.g. 1000-2000,2001,2002,3000-4000
-	numRanges := strings.SplitSeq(rangeStr, ",")
-	for numRangeStr := range numRanges {
+	numRanges := strings.Split(rangeStr, ",")
+	for _, numRangeStr := range numRanges {
 		// 1000-2000 or 2001
 		numArray := strings.Split(numRangeStr, "-")
 		// length: only 1 or 2 is correct
--- a/pkg/util/version/version.go
+++ b/pkg/util/version/version.go
@@ -14,7 +14,7 @@

 package version

-var version = "0.69.0"
+var version = "0.68.0"

 func Full() string {
 	return version
--- a/pkg/util/vhost/http.go
+++ b/pkg/util/vhost/http.go
@@ -187,25 +187,16 @@ func (rp *HTTPReverseProxy) CreateConnection(reqRouteInfo *RequestRouteInfo, byE
 	return nil, fmt.Errorf("%v: %s %s %s", ErrNoRouteFound, host, reqRouteInfo.URL, reqRouteInfo.HTTPUser)
 }

-func checkRouteAuthByRequest(req *http.Request, rc *RouteConfig) bool {
-	if rc == nil {
-		return true
-	}
-	if rc.Username == "" && rc.Password == "" {
-		return true
-	}
-
-	if req.URL.Host != "" {
-		proxyAuth := req.Header.Get("Proxy-Authorization")
-		if proxyAuth == "" {
+func (rp *HTTPReverseProxy) CheckAuth(domain, location, routeByHTTPUser, user, passwd string) bool {
+	vr, ok := rp.getVhost(domain, location, routeByHTTPUser)
+	if ok {
+		checkUser := vr.payload.(*RouteConfig).Username
+		checkPasswd := vr.payload.(*RouteConfig).Password
+		if (checkUser != "" || checkPasswd != "") && (checkUser != user || checkPasswd != passwd) {
 			return false
 		}
-		user, passwd, ok := httppkg.ParseBasicAuth(proxyAuth)
-		return ok && user == rc.Username && passwd == rc.Password
 	}
-
-	user, passwd, ok := req.BasicAuth()
-	return ok && user == rc.Username && passwd == rc.Password
+	return true
 }

 // getVhost tries to get vhost router by route policy.
@@ -275,25 +266,36 @@ func (rp *HTTPReverseProxy) connectHandler(rw http.ResponseWriter, req *http.Req
 	go libio.Join(remote, client)
 }

-func getRequestRouteUser(req *http.Request) string {
-	if req.URL.Host != "" {
-		proxyAuth := req.Header.Get("Proxy-Authorization")
-		if proxyAuth == "" {
-			// Preserve legacy proxy-mode routing when clients send only Authorization,
-			// so requests still hit the matched route and return 407 instead of 404.
-			// Auth validation intentionally does not share this fallback.
-			user, _, _ := req.BasicAuth()
-			return user
-		}
-		user, _, _ := httppkg.ParseBasicAuth(proxyAuth)
-		return user
+func parseBasicAuth(auth string) (username, password string, ok bool) {
+	const prefix = "Basic "
+	// Case insensitive prefix match. See Issue 22736.
+	if len(auth) < len(prefix) || !strings.EqualFold(auth[:len(prefix)], prefix) {
+		return
 	}
-	user, _, _ := req.BasicAuth()
-	return user
+	c, err := base64.StdEncoding.DecodeString(auth[len(prefix):])
+	if err != nil {
+		return
+	}
+	cs := string(c)
+	s := strings.IndexByte(cs, ':')
+	if s < 0 {
+		return
+	}
+	return cs[:s], cs[s+1:], true
 }

 func (rp *HTTPReverseProxy) injectRequestInfoToCtx(req *http.Request) *http.Request {
-	user := getRequestRouteUser(req)
+	user := ""
+	// If url host isn't empty, it's a proxy request. Get http user from Proxy-Authorization header.
+	if req.URL.Host != "" {
+		proxyAuth := req.Header.Get("Proxy-Authorization")
+		if proxyAuth != "" {
+			user, _, _ = parseBasicAuth(proxyAuth)
+		}
+	}
+	if user == "" {
+		user, _, _ = req.BasicAuth()
+	}

 	reqRouteInfo := &RequestRouteInfo{
 		URL:        req.URL.Path,
@@ -313,19 +315,16 @@ func (rp *HTTPReverseProxy) injectRequestInfoToCtx(req *http.Request) *http.Requ
 }

 func (rp *HTTPReverseProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
-	newreq := rp.injectRequestInfoToCtx(req)
-	rc := newreq.Context().Value(RouteConfigKey).(*RouteConfig)
-	if !checkRouteAuthByRequest(req, rc) {
-		if req.URL.Host != "" {
-			rw.Header().Set("Proxy-Authenticate", `Basic realm="Restricted"`)
-			http.Error(rw, http.StatusText(http.StatusProxyAuthRequired), http.StatusProxyAuthRequired)
-		} else {
-			rw.Header().Set("WWW-Authenticate", `Basic realm="Restricted"`)
-			http.Error(rw, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
-		}
+	domain, _ := httppkg.CanonicalHost(req.Host)
+	location := req.URL.Path
+	user, passwd, _ := req.BasicAuth()
+	if !rp.CheckAuth(domain, location, user, user, passwd) {
+		rw.Header().Set("WWW-Authenticate", `Basic realm="Restricted"`)
+		http.Error(rw, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
 		return
 	}

+	newreq := rp.injectRequestInfoToCtx(req)
 	if req.Method == http.MethodConnect {
 		rp.connectHandler(rw, newreq)
 	} else {
--- a/pkg/util/vhost/http_test.go
+++ b/pkg/util/vhost/http_test.go
@@ -1,102 +0,0 @@
-package vhost
-
-import (
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	httppkg "github.com/fatedier/frp/pkg/util/http"
-)
-
-func TestCheckRouteAuthByRequest(t *testing.T) {
-	rc := &RouteConfig{
-		Username: "alice",
-		Password: "secret",
-	}
-
-	t.Run("accepts nil route config", func(t *testing.T) {
-		req := httptest.NewRequest("GET", "/", nil)
-		require.True(t, checkRouteAuthByRequest(req, nil))
-	})
-
-	t.Run("accepts route without credentials", func(t *testing.T) {
-		req := httptest.NewRequest("GET", "/", nil)
-		require.True(t, checkRouteAuthByRequest(req, &RouteConfig{}))
-	})
-
-	t.Run("accepts authorization header", func(t *testing.T) {
-		req := httptest.NewRequest("GET", "/", nil)
-		req.SetBasicAuth("alice", "secret")
-		require.True(t, checkRouteAuthByRequest(req, rc))
-	})
-
-	t.Run("accepts proxy authorization header", func(t *testing.T) {
-		req := httptest.NewRequest("GET", "http://target.example.com/", nil)
-		req.Header.Set("Proxy-Authorization", httppkg.BasicAuth("alice", "secret"))
-		require.True(t, checkRouteAuthByRequest(req, rc))
-	})
-
-	t.Run("rejects authorization fallback for proxy request", func(t *testing.T) {
-		req := httptest.NewRequest("GET", "http://target.example.com/", nil)
-		req.SetBasicAuth("alice", "secret")
-		require.False(t, checkRouteAuthByRequest(req, rc))
-	})
-
-	t.Run("rejects wrong proxy authorization even when authorization matches", func(t *testing.T) {
-		req := httptest.NewRequest("GET", "http://target.example.com/", nil)
-		req.SetBasicAuth("alice", "secret")
-		req.Header.Set("Proxy-Authorization", httppkg.BasicAuth("alice", "wrong"))
-		require.False(t, checkRouteAuthByRequest(req, rc))
-	})
-
-	t.Run("rejects when neither header matches", func(t *testing.T) {
-		req := httptest.NewRequest("GET", "http://target.example.com/", nil)
-		req.SetBasicAuth("alice", "wrong")
-		req.Header.Set("Proxy-Authorization", httppkg.BasicAuth("alice", "wrong"))
-		require.False(t, checkRouteAuthByRequest(req, rc))
-	})
-
-	t.Run("rejects proxy authorization on direct request", func(t *testing.T) {
-		req := httptest.NewRequest("GET", "/", nil)
-		req.Header.Set("Proxy-Authorization", httppkg.BasicAuth("alice", "secret"))
-		require.False(t, checkRouteAuthByRequest(req, rc))
-	})
-}
-
-func TestGetRequestRouteUser(t *testing.T) {
-	t.Run("proxy request uses proxy authorization username", func(t *testing.T) {
-		req := httptest.NewRequest("GET", "http://target.example.com/", nil)
-		req.Host = "target.example.com"
-		req.Header.Set("Proxy-Authorization", httppkg.BasicAuth("proxy-user", "proxy-pass"))
-		req.SetBasicAuth("direct-user", "direct-pass")
-
-		require.Equal(t, "proxy-user", getRequestRouteUser(req))
-	})
-
-	t.Run("connect request keeps proxy authorization routing", func(t *testing.T) {
-		req := httptest.NewRequest("CONNECT", "http://target.example.com:443", nil)
-		req.Host = "target.example.com:443"
-		req.Header.Set("Proxy-Authorization", httppkg.BasicAuth("proxy-user", "proxy-pass"))
-		req.SetBasicAuth("direct-user", "direct-pass")
-
-		require.Equal(t, "proxy-user", getRequestRouteUser(req))
-	})
-
-	t.Run("direct request uses authorization username", func(t *testing.T) {
-		req := httptest.NewRequest("GET", "/", nil)
-		req.Host = "example.com"
-		req.SetBasicAuth("direct-user", "direct-pass")
-
-		require.Equal(t, "direct-user", getRequestRouteUser(req))
-	})
-
-	t.Run("proxy request does not fall back when proxy authorization is invalid", func(t *testing.T) {
-		req := httptest.NewRequest("GET", "http://target.example.com/", nil)
-		req.Host = "target.example.com"
-		req.Header.Set("Proxy-Authorization", "Basic !!!")
-		req.SetBasicAuth("direct-user", "direct-pass")
-
-		require.Empty(t, getRequestRouteUser(req))
-	})
-}
--- a/pkg/util/xlog/xlog.go
+++ b/pkg/util/xlog/xlog.go
@@ -63,12 +63,11 @@ func (l *Logger) AddPrefix(prefix LogPrefix) *Logger {
 	if prefix.Priority <= 0 {
 		prefix.Priority = 10
 	}
-	for i, p := range l.prefixes {
+	for _, p := range l.prefixes {
 		if p.Name == prefix.Name {
 			found = true
-			l.prefixes[i].Value = prefix.Value
-			l.prefixes[i].Priority = prefix.Priority
-			break
+			p.Value = prefix.Value
+			p.Priority = prefix.Priority
 		}
 	}
 	if !found {
--- a/pkg/vnet/controller.go
+++ b/pkg/vnet/controller.go
@@ -131,9 +131,6 @@ func (c *Controller) handlePacket(buf []byte) {
 }

 func (c *Controller) Stop() error {
-	if c.tun == nil {
-		return nil
-	}
 	return c.tun.Close()
 }

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
copilot-swe-agent[bot]	7993225be1	Initial plan	2026-03-05 17:33:24 +00:00
fatedier	17b27d8d96	pkg/msg: change UDPPacket.Content from string to []byte to avoid redundant base64 encode/decode	2026-03-06 01:25:52 +08:00