Initial plan

pkg/msg: change UDPPacket.Content from string to []byte to avoid redundant base64 encode/decode
2026-10-18 01:03:28 +08:00 · 2026-03-05 17:33:24 +00:00 · 2026-03-06 01:25:52 +08:00
382 changed files with 17640 additions and 31932 deletions
@@ -1,26 +1,24 @@
-version: 2.1
+version: 2
 jobs:
  go-version-latest:
    docker:
-    - image: cimg/go:1.26-node
+    - image: cimg/go:1.25-node
    resource_class: large
    steps:
    - checkout
    - run:
-        name: Test and build web assets
-        command: make web-ci
+        name: Build web assets (frps)
+        command: make install build
+        working_directory: web/frps
    - run:
-        name: Check Go formatting and build binaries
-        command: |
-          set -e
-          make env fmt
-          git diff --exit-code
-          make build
-    - run:
-        name: Run all tests
-        command: make alltest
+        name: Build web assets (frpc)
+        command: make install build
+        working_directory: web/frpc
+    - run: make
+    - run: make alltest

 workflows:
+  version: 2
  build_and_test:
    jobs:
    - go-version-latest
@@ -19,15 +19,15 @@ jobs:
    steps:
      # environment
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
        with:
          fetch-depth: '0'

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      # get image tag name
      - name: Get Image Tag Name
@@ -38,13 +38,13 @@ jobs:
            echo "TAG_NAME=${{ github.event.inputs.tag }}" >> $GITHUB_ENV
          fi
      - name: Login to DockerHub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: Login to the GPR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -61,22 +61,22 @@ jobs:
          echo "TAG_FRPS_GPR=ghcr.io/fatedier/frps:${{ env.TAG_NAME }}" >> $GITHUB_ENV

      - name: Build and push frpc
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./dockerfiles/Dockerfile-for-frpc
-          platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le
+          platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
          push: true
          tags: |
            ${{ env.TAG_FRPC }}
            ${{ env.TAG_FRPC_GPR }}

      - name: Build and push frps
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./dockerfiles/Dockerfile-for-frps
-          platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le
+          platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
          push: true
          tags: |
            ${{ env.TAG_FRPS }}
@@ -14,18 +14,22 @@ jobs:
    name: lint
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v6
-    - uses: actions/setup-go@v6
+    - uses: actions/checkout@v4
+    - uses: actions/setup-go@v5
      with:
-        go-version: '1.26'
+        go-version: '1.25'
        cache: false
-    - uses: actions/setup-node@v6
+    - uses: actions/setup-node@v4
      with:
        node-version: '22'
-    - name: Test and build web assets
-      run: make web-ci
+    - name: Build web assets (frps)
+      run: make build
+      working-directory: web/frps
+    - name: Build web assets (frpc)
+      run: make build
+      working-directory: web/frpc
    - name: golangci-lint
      uses: golangci/golangci-lint-action@v9
      with:
        # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
-        version: v2.12.2
+        version: v2.10
@@ -8,15 +8,15 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
        with:
-          go-version: '1.26'
-      - uses: actions/setup-node@v6
+          go-version: '1.25'
+      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - name: Build web assets (frps)
@@ -30,7 +30,7 @@ jobs:
          ./package.sh

      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@v6
        with:
          version: latest
          args: release --clean --release-notes=./Release.md
@@ -19,7 +19,7 @@ jobs:
      actions: write
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/stale@v10
+    - uses: actions/stale@v9
      with:
        stale-issue-message: 'Issues go stale after 14d of inactivity. Stale issues rot after an additional 3d of inactivity and eventually close.'
        stale-pr-message: "PRs go stale after 14d of inactivity. Stale PRs rot after an additional 3d of inactivity and eventually close."
@@ -18,7 +18,6 @@ release/
 test/bin/
 vendor/
 lastversion/
-.cache/
 dist/
 .idea/
 .vscode/
@@ -26,12 +25,10 @@ dist/
 client.crt
 client.key

-node_modules/
-
 # Cache
 *.swp

 # AI
-.claude/
+CLAUDE.md
+AGENTS.md
 .sisyphus/
-.superpowers/
@@ -18,7 +18,6 @@ linters:
  - lll
  - makezero
  - misspell
-  - modernize
  - prealloc
  - predeclared
  - revive
@@ -34,7 +33,7 @@ linters:
      disabled-checks:
      - exitAfterDefer
    gosec:
-      excludes: ["G115", "G117", "G118", "G204", "G401", "G402", "G404", "G501", "G703", "G704", "G705"]
+      excludes: ["G115", "G117", "G204", "G401", "G402", "G404", "G501", "G703", "G704", "G705"]
      severity: low
      confidence: low
    govet:
@@ -48,9 +47,6 @@ linters:
      ignore-rules:
      - cancelled
      - marshalled
-    modernize:
-      disable:
-      - omitzero
    unparam:
      check-exported: false
  exclusions:
@@ -90,7 +86,6 @@ linters:
    - third_party$
    - builtin$
    - examples$
-    - node_modules
 formatters:
  enable:
  - gci
@@ -113,7 +108,6 @@ formatters:
    - third_party$
    - builtin$
    - examples$
-    - node_modules
 issues:
  max-issues-per-linter: 0
  max-same-issues: 0
@@ -1,39 +0,0 @@
-# AGENTS.md
-
-## Development Commands
-
-### Build
- `make build` - Build both frps and frpc binaries
- `make frps` - Build server binary only
- `make frpc` - Build client binary only
- `make all` - Build everything with formatting
-
-### Testing
- `make test` - Run unit tests
- `make e2e` - Run end-to-end tests
- `make e2e-trace` - Run e2e tests with trace logging
- `make alltest` - Run all tests including vet, unit tests, and e2e
-
-### Code Quality
- `make fmt` - Run go fmt
- `make fmt-more` - Run gofumpt for more strict formatting
- `make gci` - Run gci import organizer
- `make vet` - Run go vet
- `golangci-lint run` - Run comprehensive linting (configured in .golangci.yml)
-
-### Assets
- `make web` - Build web dashboards (frps and frpc)
-
-### Cleanup
- `make clean` - Remove built binaries and temporary files
-
-## Testing
-
- E2E tests using Ginkgo/Gomega framework
- Mock servers in `/test/e2e/mock/`
- Run: `make e2e` or `make alltest`
-
-## Agent Runbooks
-
-Operational procedures for agents are in `doc/agents/`:
- `doc/agents/release.md` - Release process
@@ -1 +0,0 @@
-AGENTS.md
@@ -2,10 +2,8 @@ export PATH := $(PATH):`go env GOPATH`/bin
 export GO111MODULE=on
 LDFLAGS := -s -w
 NOWEB_TAG = $(shell [ ! -d web/frps/dist ] || [ ! -d web/frpc/dist ] && echo ',noweb')
-FRP_COMPAT_BASELINE_COUNT ?= 8
-FRP_COMPAT_FLOOR_VERSION ?= 0.61.0

-.PHONY: web web-ci frps-web frpc-web frps frpc e2e-compatibility-smoke e2e-compatibility e2e-compatibility-floor
+.PHONY: web frps-web frpc-web frps frpc

 all: env fmt web build

@@ -16,9 +14,6 @@ env:

 web: frps-web frpc-web

-web-ci:
-	cd web && npm ci && npm run lint:check --workspace frps && npm run lint:check --workspace frpc && npm run test:unit && npm run build --workspace frps && npm run build --workspace frpc
-
 frps-web:
 	$(MAKE) -C web/frps build

@@ -58,15 +53,6 @@ e2e:
 e2e-trace:
 	DEBUG=true LOG_LEVEL=trace ./hack/run-e2e.sh

-e2e-compatibility-smoke: build
-	FRP_COMPAT_BASELINE_COUNT=1 ./hack/run-e2e-compatibility.sh
-
-e2e-compatibility: build
-	FRP_COMPAT_BASELINE_COUNT="$(FRP_COMPAT_BASELINE_COUNT)" ./hack/run-e2e-compatibility.sh
-
-e2e-compatibility-floor: build
-	FRP_COMPAT_BASELINE_VERSIONS="$(FRP_COMPAT_FLOOR_VERSION)" ./hack/run-e2e-compatibility.sh
-
 e2e-compatibility-last-frpc:
 	if [ ! -d "./lastversion" ]; then \
 		TARGET_DIRNAME=lastversion ./hack/download.sh; \
@@ -87,5 +73,3 @@ clean:
 	rm -f ./bin/frpc
 	rm -f ./bin/frps
 	rm -rf ./lastversion
-	rm -rf ./.cache
-	rm -rf ./.compat
@@ -9,7 +9,7 @@ all: build
 build: app

 app:
-	@set -e; $(foreach n, $(os-archs), \
+	@$(foreach n, $(os-archs), \
 		os=$(shell echo "$(n)" | cut -d : -f 1); \
 		arch=$(shell echo "$(n)" | cut -d : -f 2); \
 		extra=$(shell echo "$(n)" | cut -d : -f 3); \
@@ -2,6 +2,7 @@

 [![Build Status](https://circleci.com/gh/fatedier/frp.svg?style=shield)](https://circleci.com/gh/fatedier/frp)
 [![GitHub release](https://img.shields.io/github/tag/fatedier/frp.svg?label=release)](https://github.com/fatedier/frp/releases)
+[![Go Report Card](https://goreportcard.com/badge/github.com/fatedier/frp)](https://goreportcard.com/report/github.com/fatedier/frp)
 [![GitHub Releases Stats](https://img.shields.io/github/downloads/fatedier/frp/total.svg?logo=github)](https://somsubhra.github.io/github-release-stats/?username=fatedier&repository=frp)

 [README](README.md) | [中文文档](README_zh.md)
@@ -22,6 +23,16 @@ an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and

 </div>

+<p align="center">
+  <a href="https://requestly.com/?utm_source=github&utm_medium=partnered&utm_campaign=frp" target="_blank">
+    <img width="480px" src="https://github.com/user-attachments/assets/24670320-997d-4d62-9bca-955c59fe883d">
+    <br>
+    <b>Requestly - Free & Open-Source alternative to Postman</b>
+    <br>
+    <sub>All-in-one platform to Test, Mock and Intercept APIs.</sub>
+  </a>
+</p>
+
 <p align="center">
  <a href="https://jb.gg/frp" target="_blank">
    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_jetbrains.jpg">
@@ -39,7 +50,6 @@ an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and
 	<sub>An open source, self-hosted alternative to public clouds, built for data ownership and privacy</sub>
  </a>
 </p>
-
 <!--gold sponsors end-->

 ## What is frp?
@@ -71,7 +81,6 @@ frp also offers a P2P connect mode.
    * [Split Configures Into Different Files](#split-configures-into-different-files)
    * [Server Dashboard](#server-dashboard)
    * [Client Admin UI](#client-admin-ui)
-        * [Dynamic Proxy Management (Store)](#dynamic-proxy-management-store)
    * [Monitor](#monitor)
        * [Prometheus](#prometheus)
    * [Authenticating the Client](#authenticating-the-client)
@@ -140,9 +149,7 @@ We sincerely appreciate your support for frp.

 ## Architecture

-<p align="center">
-  <img src="/doc/pic/architecture.jpg" alt="architecture" width="760">
-</p>
+![architecture](/doc/pic/architecture.png)

 ## Example Usage

@@ -586,7 +593,7 @@ Then visit `https://[serverAddr]:7500` to see the dashboard in secure HTTPS conn

 ### Client Admin UI

-The Client Admin UI helps you check and manage frpc's configuration and proxies.
+The Client Admin UI helps you check and manage frpc's configuration.

 Configure an address for admin UI to enable this feature:

@@ -599,19 +606,6 @@ webServer.password = "admin"

 Then visit `http://127.0.0.1:7400` to see admin UI, with username and password both being `admin`.

-#### Dynamic Proxy Management (Store)
-
-You can dynamically create, update, and delete proxies and visitors at runtime through the Web UI or API, without restarting frpc.
-
-To enable this feature, configure `store.path` to specify a file for persisting the configurations:
-
-```toml
-[store]
-path = "./db.json"
-```
-
-Proxies and visitors managed through the Store are saved to disk and automatically restored on frpc restart. They work alongside proxies defined in the configuration file — Store entries take precedence when names conflict.
-
 ### Monitor

 When web server is enabled, frps will save monitor data in cache for 7 days. It will be cleared after process restart.
@@ -2,6 +2,7 @@

 [![Build Status](https://circleci.com/gh/fatedier/frp.svg?style=shield)](https://circleci.com/gh/fatedier/frp)
 [![GitHub release](https://img.shields.io/github/tag/fatedier/frp.svg?label=release)](https://github.com/fatedier/frp/releases)
+[![Go Report Card](https://goreportcard.com/badge/github.com/fatedier/frp)](https://goreportcard.com/report/github.com/fatedier/frp)
 [![GitHub Releases Stats](https://img.shields.io/github/downloads/fatedier/frp/total.svg?logo=github)](https://somsubhra.github.io/github-release-stats/?username=fatedier&repository=frp)

 [README](README.md) | [中文文档](README_zh.md)
@@ -24,6 +25,16 @@ an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and

 </div>

+<p align="center">
+  <a href="https://requestly.com/?utm_source=github&utm_medium=partnered&utm_campaign=frp" target="_blank">
+    <img width="480px" src="https://github.com/user-attachments/assets/24670320-997d-4d62-9bca-955c59fe883d">
+    <br>
+    <b>Requestly - Free & Open-Source alternative to Postman</b>
+    <br>
+    <sub>All-in-one platform to Test, Mock and Intercept APIs.</sub>
+  </a>
+</p>
+
 <p align="center">
  <a href="https://jb.gg/frp" target="_blank">
    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_jetbrains.jpg">
@@ -41,7 +52,6 @@ an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and
 	<sub>An open source, self-hosted alternative to public clouds, built for data ownership and privacy</sub>
  </a>
 </p>
-
 <!--gold sponsors end-->

 ## 为什么使用 frp ？
@@ -1 +1,9 @@
 ## Features
+
+* Added a built-in `store` capability for frpc, including persisted store source (`[store] path = "..."`), Store CRUD admin APIs (`/api/store/proxies*`, `/api/store/visitors*`) with runtime reload, and Store management pages in the frpc web dashboard.
+
+## Improvements
+
+* Kept proxy/visitor names as raw config names during completion; moved user-prefix handling to explicit wire-level naming logic.
+* Added `noweb` build tag to allow compiling without frontend assets. `make build` now auto-detects missing `web/*/dist` directories and skips embedding, so a fresh clone can build without running `make web` first. The dashboard gracefully returns 404 when assets are not embedded.
+* Improved config parsing errors: for `.toml` files, syntax errors now return immediately with parser position details (line/column when available) instead of falling through to YAML/JSON parsing, and TOML type mismatches report field-level errors without misleading line numbers.
@@ -38,8 +38,6 @@ func (svr *Service) registerRouteHandlers(helper *httppkg.RouterRegisterHelper)
 	subRouter.HandleFunc("/api/status", httppkg.MakeHTTPHandlerFunc(apiController.Status)).Methods(http.MethodGet)
 	subRouter.HandleFunc("/api/config", httppkg.MakeHTTPHandlerFunc(apiController.GetConfig)).Methods(http.MethodGet)
 	subRouter.HandleFunc("/api/config", httppkg.MakeHTTPHandlerFunc(apiController.PutConfig)).Methods(http.MethodPut)
-	subRouter.HandleFunc("/api/proxy/{name}/config", httppkg.MakeHTTPHandlerFunc(apiController.GetProxyConfig)).Methods(http.MethodGet)
-	subRouter.HandleFunc("/api/visitor/{name}/config", httppkg.MakeHTTPHandlerFunc(apiController.GetVisitorConfig)).Methods(http.MethodGet)

 	if svr.storeSource != nil {
 		subRouter.HandleFunc("/api/store/proxies", httppkg.MakeHTTPHandlerFunc(apiController.ListStoreProxies)).Methods(http.MethodGet)
@@ -80,48 +80,6 @@ func (m *serviceConfigManager) GetProxyStatus() []*proxy.WorkingStatus {
 	return m.svr.getAllProxyStatus()
 }

-func (m *serviceConfigManager) GetProxyConfig(name string) (v1.ProxyConfigurer, bool) {
-	// Try running proxy manager first
-	ws, ok := m.svr.getProxyStatus(name)
-	if ok {
-		return ws.Cfg, true
-	}
-
-	// Fallback to store
-	m.svr.reloadMu.Lock()
-	storeSource := m.svr.storeSource
-	m.svr.reloadMu.Unlock()
-
-	if storeSource != nil {
-		cfg := storeSource.GetProxy(name)
-		if cfg != nil {
-			return cfg, true
-		}
-	}
-	return nil, false
-}
-
-func (m *serviceConfigManager) GetVisitorConfig(name string) (v1.VisitorConfigurer, bool) {
-	// Try running visitor manager first
-	cfg, ok := m.svr.getVisitorCfg(name)
-	if ok {
-		return cfg, true
-	}
-
-	// Fallback to store
-	m.svr.reloadMu.Lock()
-	storeSource := m.svr.storeSource
-	m.svr.reloadMu.Unlock()
-
-	if storeSource != nil {
-		vcfg := storeSource.GetVisitor(name)
-		if vcfg != nil {
-			return vcfg, true
-		}
-	}
-	return nil, false
-}
-
 func (m *serviceConfigManager) IsStoreProxyEnabled(name string) bool {
 	if name == "" {
 		return false
@@ -2,16 +2,12 @@ package client

 import (
 	"errors"
-	"os"
 	"path/filepath"
-	"strings"
 	"testing"

 	"github.com/fatedier/frp/client/configmgmt"
 	"github.com/fatedier/frp/pkg/config/source"
 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/policy/security"
-	"github.com/fatedier/frp/pkg/vnet"
 )

 func newTestRawTCPProxyConfig(name string) *v1.TCPProxyConfig {
@@ -26,256 +22,6 @@ func newTestRawTCPProxyConfig(name string) *v1.TCPProxyConfig {
 	}
 }

-func newTestVirtualNetProxyConfig(name string) *v1.STCPProxyConfig {
-	return &v1.STCPProxyConfig{
-		ProxyBaseConfig: v1.ProxyBaseConfig{
-			Name: name,
-			Type: "stcp",
-			ProxyBackend: v1.ProxyBackend{
-				Plugin: v1.TypedClientPluginOptions{
-					Type:                v1.PluginVirtualNet,
-					ClientPluginOptions: &v1.VirtualNetPluginOptions{Type: v1.PluginVirtualNet},
-				},
-			},
-		},
-	}
-}
-
-func newTestVirtualNetVisitorConfig(name string) *v1.STCPVisitorConfig {
-	return &v1.STCPVisitorConfig{
-		VisitorBaseConfig: v1.VisitorBaseConfig{
-			Name:       name,
-			Type:       "stcp",
-			ServerName: "vnet-server",
-			SecretKey:  "secret",
-			BindPort:   -1,
-			Plugin: v1.TypedVisitorPluginOptions{
-				Type: v1.VisitorPluginVirtualNet,
-				VisitorPluginOptions: &v1.VirtualNetVisitorPluginOptions{
-					Type:          v1.VisitorPluginVirtualNet,
-					DestinationIP: "100.86.0.1",
-				},
-			},
-		},
-	}
-}
-
-func TestServiceConfigManagerReloadVirtualNetRuntimeDependency(t *testing.T) {
-	const runtimeErr = "VirtualNet-dependent configuration requires a VirtualNet runtime enabled at startup"
-
-	tests := []struct {
-		name                  string
-		startupVirtualNetAddr string
-		nextConfig            string
-		wantRuntimeDependency bool
-	}{
-		{
-			name:       "unrelated common config",
-			nextConfig: `serverAddr = "0.0.0.0"`,
-		},
-		{
-			name: "VirtualNet address without startup runtime",
-			nextConfig: `featureGates = { VirtualNet = true }
-virtualNet.address = "100.86.0.4/24"
-`,
-			wantRuntimeDependency: true,
-		},
-		{
-			name: "VirtualNet proxy without startup runtime",
-			nextConfig: `[[proxies]]
-name = "vnet-proxy"
-type = "stcp"
-secretKey = "secret"
-[proxies.plugin]
-type = "virtual_net"
-`,
-			wantRuntimeDependency: true,
-		},
-		{
-			name: "VirtualNet visitor without startup runtime",
-			nextConfig: `[[visitors]]
-name = "vnet-visitor"
-type = "stcp"
-serverName = "vnet-server"
-secretKey = "secret"
-bindPort = -1
-[visitors.plugin]
-type = "virtual_net"
-destinationIP = "100.86.0.1"
-`,
-			wantRuntimeDependency: true,
-		},
-		{
-			name:                  "existing VirtualNet startup runtime",
-			startupVirtualNetAddr: "100.86.0.4/24",
-			nextConfig: `featureGates = { VirtualNet = true }
-virtualNet.address = "100.86.0.5/24"
-`,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			current := &v1.ClientCommonConfig{}
-			if tc.startupVirtualNetAddr != "" {
-				current.FeatureGates = map[string]bool{"VirtualNet": true}
-				current.VirtualNet.Address = tc.startupVirtualNetAddr
-			}
-			if err := current.Complete(); err != nil {
-				t.Fatalf("complete current config: %v", err)
-			}
-
-			configFile := filepath.Join(t.TempDir(), "frpc.toml")
-			if err := os.WriteFile(configFile, []byte(tc.nextConfig), 0o600); err != nil {
-				t.Fatalf("write config: %v", err)
-			}
-
-			configSource := source.NewConfigSource()
-			aggregator := source.NewAggregator(configSource)
-			svr := &Service{
-				common:         current,
-				reloadCommon:   current,
-				configFilePath: configFile,
-				unsafeFeatures: security.NewUnsafeFeatures(nil),
-				aggregator:     aggregator,
-				configSource:   configSource,
-			}
-			if tc.startupVirtualNetAddr != "" {
-				svr.vnetController = vnet.NewController(current.VirtualNet)
-			}
-
-			err := (&serviceConfigManager{svr: svr}).ReloadFromFile(true)
-			if tc.wantRuntimeDependency {
-				if !errors.Is(err, configmgmt.ErrApplyConfig) || !strings.Contains(err.Error(), runtimeErr) {
-					t.Fatalf("expected VirtualNet runtime dependency error, got: %v", err)
-				}
-				return
-			}
-
-			if err != nil {
-				t.Fatalf("reload config: %v", err)
-			}
-			if svr.common != current {
-				t.Fatal("reload should not replace startup common config")
-			}
-			if tc.startupVirtualNetAddr == "" && svr.vnetController != nil {
-				t.Fatal("reload should not enable startup-only VirtualNet runtime state")
-			}
-		})
-	}
-}
-
-func TestServiceConfigManagerReloadVirtualNetRuntimeDependencyUsesMergedSources(t *testing.T) {
-	const runtimeErr = "VirtualNet-dependent configuration requires a VirtualNet runtime enabled at startup"
-
-	tests := []struct {
-		name                  string
-		nextConfig            string
-		storeProxy            v1.ProxyConfigurer
-		storeVisitor          v1.VisitorConfigurer
-		wantRuntimeDependency bool
-		wantProxyPlugin       string
-	}{
-		{
-			name:                  "Store VirtualNet proxy is rejected",
-			nextConfig:            `serverAddr = "0.0.0.0"`,
-			storeProxy:            newTestVirtualNetProxyConfig("store-vnet"),
-			wantRuntimeDependency: true,
-		},
-		{
-			name:                  "Store VirtualNet visitor is rejected",
-			nextConfig:            `serverAddr = "0.0.0.0"`,
-			storeVisitor:          newTestVirtualNetVisitorConfig("store-vnet"),
-			wantRuntimeDependency: true,
-		},
-		{
-			name: "Store VirtualNet proxy overrides file proxy",
-			nextConfig: `[[proxies]]
-name = "shared"
-type = "tcp"
-localPort = 10080
-remotePort = 10081
-`,
-			storeProxy:            newTestVirtualNetProxyConfig("shared"),
-			wantRuntimeDependency: true,
-		},
-		{
-			name: "Store non-VirtualNet proxy overrides file VirtualNet proxy",
-			nextConfig: `[[proxies]]
-name = "shared"
-type = "stcp"
-secretKey = "secret"
-[proxies.plugin]
-type = "virtual_net"
-`,
-			storeProxy:      newTestRawTCPProxyConfig("shared"),
-			wantProxyPlugin: "",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			current := &v1.ClientCommonConfig{}
-			if err := current.Complete(); err != nil {
-				t.Fatalf("complete current config: %v", err)
-			}
-
-			configFile := filepath.Join(t.TempDir(), "frpc.toml")
-			if err := os.WriteFile(configFile, []byte(tc.nextConfig), 0o600); err != nil {
-				t.Fatalf("write config: %v", err)
-			}
-
-			storeSource, err := source.NewStoreSource(source.StoreSourceConfig{
-				Path: filepath.Join(t.TempDir(), "store.json"),
-			})
-			if err != nil {
-				t.Fatalf("new store source: %v", err)
-			}
-			if tc.storeProxy != nil {
-				if err := storeSource.AddProxy(tc.storeProxy); err != nil {
-					t.Fatalf("add store proxy: %v", err)
-				}
-			}
-			if tc.storeVisitor != nil {
-				if err := storeSource.AddVisitor(tc.storeVisitor); err != nil {
-					t.Fatalf("add store visitor: %v", err)
-				}
-			}
-
-			configSource := source.NewConfigSource()
-			aggregator := source.NewAggregator(configSource)
-			aggregator.SetStoreSource(storeSource)
-			svr := &Service{
-				common:         current,
-				reloadCommon:   current,
-				configFilePath: configFile,
-				unsafeFeatures: security.NewUnsafeFeatures(nil),
-				aggregator:     aggregator,
-				configSource:   configSource,
-				storeSource:    storeSource,
-			}
-
-			err = (&serviceConfigManager{svr: svr}).ReloadFromFile(true)
-			if tc.wantRuntimeDependency {
-				if !errors.Is(err, configmgmt.ErrApplyConfig) || !strings.Contains(err.Error(), runtimeErr) {
-					t.Fatalf("expected VirtualNet runtime dependency error, got: %v", err)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("reload config: %v", err)
-			}
-
-			if len(svr.proxyCfgs) != 1 {
-				t.Fatalf("expected one applied proxy, got %d", len(svr.proxyCfgs))
-			}
-			if got := svr.proxyCfgs[0].GetBaseConfig().Plugin.Type; got != tc.wantProxyPlugin {
-				t.Fatalf("unexpected applied proxy plugin: %q", got)
-			}
-		})
-	}
-}
-
 func TestServiceConfigManagerCreateStoreProxyConflict(t *testing.T) {
 	storeSource, err := source.NewStoreSource(source.StoreSourceConfig{
 		Path: filepath.Join(t.TempDir(), "store.json"),
@@ -26,9 +26,6 @@ type ConfigManager interface {
 	IsStoreProxyEnabled(name string) bool
 	StoreEnabled() bool

-	GetProxyConfig(name string) (v1.ProxyConfigurer, bool)
-	GetVisitorConfig(name string) (v1.VisitorConfigurer, bool)
-
 	ListStoreProxies() ([]v1.ProxyConfigurer, error)
 	GetStoreProxy(name string) (v1.ProxyConfigurer, error)
 	CreateStoreProxy(cfg v1.ProxyConfigurer) (v1.ProxyConfigurer, error)
@@ -24,13 +24,11 @@ import (
 	"time"

 	libnet "github.com/fatedier/golib/net"
-	fmux "github.com/fatedier/yamux"
+	fmux "github.com/hashicorp/yamux"
 	quic "github.com/quic-go/quic-go"
 	"github.com/samber/lo"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/proto/wire"
 	"github.com/fatedier/frp/pkg/transport"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
 	"github.com/fatedier/frp/pkg/util/xlog"
@@ -43,39 +41,6 @@ type Connector interface {
 	Close() error
 }

-type MessageConnector interface {
-	Connect() (*msg.Conn, error)
-	Close() error
-}
-
-type messageConnector struct {
-	connector    Connector
-	wireProtocol string
-}
-
-func newMessageConnector(connector Connector, wireProtocol string) *messageConnector {
-	return &messageConnector{
-		connector:    connector,
-		wireProtocol: wireProtocol,
-	}
-}
-
-func (c *messageConnector) Connect() (*msg.Conn, error) {
-	conn, err := c.connector.Connect()
-	if err != nil {
-		return nil, err
-	}
-	if err = wire.WriteMagicIfV2(conn, c.wireProtocol); err != nil {
-		conn.Close()
-		return nil, err
-	}
-	return msg.NewConn(conn, msg.NewReadWriter(conn, c.wireProtocol)), nil
-}
-
-func (c *messageConnector) Close() error {
-	return c.connector.Close()
-}
-
 // defaultConnectorImpl is the default implementation of Connector for normal frpc.
 type defaultConnectorImpl struct {
 	ctx context.Context
@@ -154,7 +119,6 @@ func (c *defaultConnectorImpl) Open() error {
 	fmuxCfg.MaxStreamWindowSize = 6 * 1024 * 1024
 	session, err := fmux.Client(conn, fmuxCfg)
 	if err != nil {
-		conn.Close()
 		return err
 	}
 	c.muxSession = session
@@ -27,6 +27,7 @@ import (
 	"github.com/fatedier/frp/pkg/msg"
 	"github.com/fatedier/frp/pkg/naming"
 	"github.com/fatedier/frp/pkg/transport"
+	netpkg "github.com/fatedier/frp/pkg/util/net"
 	"github.com/fatedier/frp/pkg/util/wait"
 	"github.com/fatedier/frp/pkg/util/xlog"
 	"github.com/fatedier/frp/pkg/vnet"
@@ -40,15 +41,15 @@ type SessionContext struct {
 	// It should be attached to the login message when reconnecting.
 	RunID string
 	// Underlying control connection. Once conn is closed, the msgDispatcher and the entire Control will exit.
-	Conn *msg.Conn
+	Conn net.Conn
+	// Indicates whether the connection is encrypted.
+	ConnEncrypted bool
 	// Auth runtime used for login, heartbeats, and encryption.
 	Auth *auth.ClientAuth
-	// Connector is used to create message connections to frps.
-	Connector MessageConnector
+	// Connector is used to create new connections, which could be real TCP connections or virtual streams.
+	Connector Connector
 	// Virtual net controller
 	VnetController *vnet.Controller
-	// UDPPacketCodec is immutable for the lifetime of this negotiated session.
-	UDPPacketCodec string
 }

 type Control struct {
@@ -90,20 +91,21 @@ func NewControl(ctx context.Context, sessionCtx *SessionContext) (*Control, erro
 	}
 	ctl.lastPong.Store(time.Now())

+	if sessionCtx.ConnEncrypted {
+		cryptoRW, err := netpkg.NewCryptoReadWriter(sessionCtx.Conn, sessionCtx.Auth.EncryptionKey())
+		if err != nil {
+			return nil, err
+		}
+		ctl.msgDispatcher = msg.NewDispatcher(cryptoRW)
+	} else {
 		ctl.msgDispatcher = msg.NewDispatcher(sessionCtx.Conn)
+	}
 	ctl.registerMsgHandlers()
 	ctl.msgTransporter = transport.NewMessageTransporter(ctl.msgDispatcher)

-	ctl.pm = proxy.NewManager(
-		ctl.ctx,
-		sessionCtx.Common,
-		sessionCtx.Auth.EncryptionKey(),
-		ctl.msgTransporter,
-		sessionCtx.VnetController,
-		sessionCtx.UDPPacketCodec,
-	)
+	ctl.pm = proxy.NewManager(ctl.ctx, sessionCtx.Common, sessionCtx.Auth.EncryptionKey(), ctl.msgTransporter, sessionCtx.VnetController)
 	ctl.vm = visitor.NewManager(ctl.ctx, sessionCtx.RunID, sessionCtx.Common,
-		ctl.connectServer, ctl.msgTransporter, sessionCtx.VnetController, sessionCtx.UDPPacketCodec)
+		ctl.connectServer, ctl.msgTransporter, sessionCtx.VnetController)
 	return ctl, nil
 }

@@ -137,14 +139,14 @@ func (ctl *Control) handleReqWorkConn(_ msg.Message) {
 		workConn.Close()
 		return
 	}
-	if err = workConn.WriteMsg(m); err != nil {
+	if err = msg.WriteMsg(workConn, m); err != nil {
 		xl.Warnf("work connection write to server error: %v", err)
 		workConn.Close()
 		return
 	}

 	var startMsg msg.StartWorkConn
-	if err = workConn.ReadMsgInto(&startMsg); err != nil {
+	if err = msg.ReadMsgInto(workConn, &startMsg); err != nil {
 		xl.Tracef("work connection closed before response StartWorkConn message: %v", err)
 		workConn.Close()
 		return
@@ -225,7 +227,7 @@ func (ctl *Control) Done() <-chan struct{} {
 }

 // connectServer return a new connection to frps
-func (ctl *Control) connectServer() (*msg.Conn, error) {
+func (ctl *Control) connectServer() (net.Conn, error) {
 	return ctl.sessionCtx.Connector.Connect()
 }

@@ -1,225 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package client
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"os"
-	"runtime"
-	"time"
-
-	"github.com/samber/lo"
-
-	"github.com/fatedier/frp/pkg/auth"
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/proto/wire"
-	netpkg "github.com/fatedier/frp/pkg/util/net"
-	"github.com/fatedier/frp/pkg/util/version"
-	"github.com/fatedier/frp/pkg/vnet"
-)
-
-type controlSessionDialer struct {
-	ctx context.Context
-
-	common         *v1.ClientCommonConfig
-	auth           *auth.ClientAuth
-	clientSpec     *msg.ClientSpec
-	vnetController *vnet.Controller
-
-	connectorCreator func(context.Context, *v1.ClientCommonConfig) Connector
-}
-
-func (d *controlSessionDialer) Dial(previousRunID string) (*SessionContext, error) {
-	connector := d.connectorCreator(d.ctx, d.common)
-	if err := connector.Open(); err != nil {
-		return nil, err
-	}
-
-	success := false
-	defer func() {
-		if !success {
-			_ = connector.Close()
-		}
-	}()
-
-	conn, err := connector.Connect()
-	if err != nil {
-		return nil, err
-	}
-	defer func() {
-		if !success {
-			_ = conn.Close()
-		}
-	}()
-
-	loginMsg, err := d.buildLoginMsg(previousRunID)
-	if err != nil {
-		return nil, err
-	}
-
-	loginResult, err := d.exchangeLogin(conn, loginMsg)
-	if err != nil {
-		return nil, err
-	}
-	loginRespMsg := loginResult.resp
-	if loginRespMsg.Error != "" {
-		return nil, errors.New(loginRespMsg.Error)
-	}
-
-	var controlRW io.ReadWriter = conn
-	if d.clientSpec == nil || d.clientSpec.Type != "ssh-tunnel" {
-		controlRW, err = d.newControlReadWriter(conn, loginResult.crypto)
-		if err != nil {
-			return nil, fmt.Errorf("create control crypto read writer: %w", err)
-		}
-	}
-
-	success = true
-	return &SessionContext{
-		Common:         d.common,
-		RunID:          loginRespMsg.RunID,
-		Conn:           msg.NewConn(conn, msg.NewReadWriter(controlRW, d.common.Transport.WireProtocol)),
-		Auth:           d.auth,
-		Connector:      newMessageConnector(connector, d.common.Transport.WireProtocol),
-		VnetController: d.vnetController,
-		UDPPacketCodec: loginResult.udpPacketCodec,
-	}, nil
-}
-
-func (d *controlSessionDialer) buildLoginMsg(previousRunID string) (*msg.Login, error) {
-	hostname, _ := os.Hostname()
-	loginMsg := &msg.Login{
-		Arch:      runtime.GOARCH,
-		Os:        runtime.GOOS,
-		Hostname:  hostname,
-		PoolCount: d.common.Transport.PoolCount,
-		User:      d.common.User,
-		ClientID:  d.common.ClientID,
-		Version:   version.Full(),
-		Timestamp: time.Now().Unix(),
-		RunID:     previousRunID,
-		Metas:     d.common.Metadatas,
-	}
-	if d.clientSpec != nil {
-		loginMsg.ClientSpec = *d.clientSpec
-	}
-
-	if err := d.auth.Setter.SetLogin(loginMsg); err != nil {
-		return nil, err
-	}
-	return loginMsg, nil
-}
-
-type loginExchangeResult struct {
-	resp           *msg.LoginResp
-	crypto         *wire.CryptoContext
-	udpPacketCodec string
-}
-
-func (d *controlSessionDialer) exchangeLogin(conn net.Conn, loginMsg *msg.Login) (*loginExchangeResult, error) {
-	rw := msg.NewV1ReadWriter(conn)
-	var wireConn *wire.Conn
-	var clientHello wire.ClientHello
-	var clientHelloPayload []byte
-
-	if d.common.Transport.WireProtocol == wire.ProtocolV2 {
-		if err := wire.WriteMagic(conn); err != nil {
-			return nil, err
-		}
-
-		wireConn = wire.NewConn(conn)
-		rw = msg.NewV2ReadWriterWithConn(wireConn)
-		var err error
-		clientHello, err = wire.NewClientHello(wire.BootstrapInfo{
-			Transport: d.common.Transport.Protocol,
-			TLS:       lo.FromPtr(d.common.Transport.TLS.Enable) || d.common.Transport.Protocol == "wss" || d.common.Transport.Protocol == "quic",
-			TCPMux:    lo.FromPtr(d.common.Transport.TCPMux),
-		})
-		if err != nil {
-			return nil, err
-		}
-		clientHelloFrame, err := wire.NewJSONFrame(wire.FrameTypeClientHello, clientHello)
-		if err != nil {
-			return nil, err
-		}
-		if err := wireConn.WriteFrame(clientHelloFrame); err != nil {
-			return nil, err
-		}
-		clientHelloPayload = clientHelloFrame.Payload
-	}
-	if err := rw.WriteMsg(loginMsg); err != nil {
-		return nil, err
-	}
-
-	_ = conn.SetReadDeadline(time.Now().Add(10 * time.Second))
-	defer func() {
-		_ = conn.SetReadDeadline(time.Time{})
-	}()
-
-	var cryptoContext *wire.CryptoContext
-	var udpPacketCodec string
-	if wireConn != nil {
-		serverHelloFrame, err := wireConn.ReadFrame()
-		if err != nil {
-			return nil, err
-		}
-		if serverHelloFrame.Type != wire.FrameTypeServerHello {
-			return nil, fmt.Errorf("unexpected frame type %d, want %d", serverHelloFrame.Type, wire.FrameTypeServerHello)
-		}
-		var serverHello wire.ServerHello
-		if err := wireConn.UnmarshalFrame(serverHelloFrame, &serverHello); err != nil {
-			return nil, err
-		}
-		if serverHello.Error != "" {
-			return nil, errors.New(serverHello.Error)
-		}
-		cryptoContext, err = wire.NewClientCryptoContext(clientHelloPayload, serverHelloFrame.Payload)
-		if err != nil {
-			return nil, err
-		}
-		udpPacketCodec = serverHello.Selected.Message.UDPPacketCodec
-	}
-
-	var loginRespMsg msg.LoginResp
-	if err := rw.ReadMsgInto(&loginRespMsg); err != nil {
-		return nil, err
-	}
-	return &loginExchangeResult{
-		resp:           &loginRespMsg,
-		crypto:         cryptoContext,
-		udpPacketCodec: udpPacketCodec,
-	}, nil
-}
-
-func (d *controlSessionDialer) newControlReadWriter(conn net.Conn, cryptoContext *wire.CryptoContext) (io.ReadWriter, error) {
-	if d.common.Transport.WireProtocol == wire.ProtocolV2 {
-		if cryptoContext == nil {
-			return nil, errors.New("missing v2 crypto negotiation")
-		}
-		return netpkg.NewAEADCryptoReadWriter(
-			conn,
-			d.auth.EncryptionKey(),
-			netpkg.AEADCryptoRoleClient,
-			cryptoContext.Algorithm,
-			cryptoContext.TranscriptHash,
-		)
-	}
-	return netpkg.NewCryptoReadWriter(conn, d.auth.EncryptionKey())
-}
@@ -1,299 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package client
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/fatedier/frp/pkg/auth"
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/proto/wire"
-	netpkg "github.com/fatedier/frp/pkg/util/net"
-)
-
-type testConnector struct {
-	conn   net.Conn
-	closed atomic.Bool
-}
-
-func (c *testConnector) Open() error {
-	return nil
-}
-
-func (c *testConnector) Connect() (net.Conn, error) {
-	return c.conn, nil
-}
-
-func (c *testConnector) Close() error {
-	c.closed.Store(true)
-	return nil
-}
-
-type trackingConn struct {
-	net.Conn
-	closed atomic.Bool
-}
-
-func (c *trackingConn) Close() error {
-	c.closed.Store(true)
-	return c.Conn.Close()
-}
-
-func newTestControlSessionDialer(t *testing.T, protocol string, connector Connector, clientSpec *msg.ClientSpec) *controlSessionDialer {
-	t.Helper()
-
-	authRuntime, err := auth.BuildClientAuth(&v1.AuthClientConfig{
-		Method: v1.AuthMethodToken,
-		Token:  "token",
-	})
-	require.NoError(t, err)
-
-	return &controlSessionDialer{
-		ctx: context.Background(),
-		common: &v1.ClientCommonConfig{
-			User: "test-user",
-			Transport: v1.ClientTransportConfig{
-				Protocol:     "tcp",
-				WireProtocol: protocol,
-			},
-		},
-		auth:       authRuntime,
-		clientSpec: clientSpec,
-		connectorCreator: func(context.Context, *v1.ClientCommonConfig) Connector {
-			return connector
-		},
-	}
-}
-
-func TestControlSessionDialerDialV1(t *testing.T) {
-	clientRaw, serverRaw := net.Pipe()
-	defer serverRaw.Close()
-
-	connector := &testConnector{conn: &trackingConn{Conn: clientRaw}}
-	serverErrCh := make(chan error, 1)
-	go func() {
-		rw := msg.NewV1ReadWriter(serverRaw)
-		var loginMsg msg.Login
-		if err := rw.ReadMsgInto(&loginMsg); err != nil {
-			serverErrCh <- err
-			return
-		}
-		if loginMsg.RunID != "previous-run-id" {
-			serverErrCh <- fmt.Errorf("unexpected previous run id: %s", loginMsg.RunID)
-			return
-		}
-		if loginMsg.User != "test-user" {
-			serverErrCh <- fmt.Errorf("unexpected user: %s", loginMsg.User)
-			return
-		}
-		serverErrCh <- rw.WriteMsg(&msg.LoginResp{RunID: "run-v1"})
-	}()
-
-	dialer := newTestControlSessionDialer(t, wire.ProtocolV1, connector, nil)
-	sessionCtx, err := dialer.Dial("previous-run-id")
-	require.NoError(t, err)
-	defer sessionCtx.Conn.Close()
-	defer sessionCtx.Connector.Close()
-
-	require.Equal(t, "run-v1", sessionCtx.RunID)
-	require.Empty(t, sessionCtx.UDPPacketCodec)
-	require.NotNil(t, sessionCtx.Conn)
-	require.NotNil(t, sessionCtx.Connector)
-	require.False(t, connector.closed.Load())
-	require.NoError(t, <-serverErrCh)
-}
-
-func TestControlSessionDialerDialV2(t *testing.T) {
-	clientRaw, serverRaw := net.Pipe()
-	defer serverRaw.Close()
-
-	connector := &testConnector{conn: &trackingConn{Conn: clientRaw}}
-	serverErrCh := make(chan error, 1)
-	go func() {
-		magic := make([]byte, len(wire.MagicV2))
-		if _, err := io.ReadFull(serverRaw, magic); err != nil {
-			serverErrCh <- err
-			return
-		}
-		if string(magic) != wire.MagicV2 {
-			serverErrCh <- fmt.Errorf("unexpected magic: %q", string(magic))
-			return
-		}
-
-		wireConn := wire.NewConn(serverRaw)
-		clientHelloFrame, err := wireConn.ReadFrame()
-		if err != nil {
-			serverErrCh <- err
-			return
-		}
-		if clientHelloFrame.Type != wire.FrameTypeClientHello {
-			serverErrCh <- fmt.Errorf("unexpected frame type %d, want %d", clientHelloFrame.Type, wire.FrameTypeClientHello)
-			return
-		}
-		var hello wire.ClientHello
-		if err := wireConn.UnmarshalFrame(clientHelloFrame, &hello); err != nil {
-			serverErrCh <- err
-			return
-		}
-		if err := wire.ValidateClientHello(hello); err != nil {
-			serverErrCh <- err
-			return
-		}
-
-		rw := msg.NewV2ReadWriterWithConn(wireConn)
-		var loginMsg msg.Login
-		if err := rw.ReadMsgInto(&loginMsg); err != nil {
-			serverErrCh <- err
-			return
-		}
-		if loginMsg.User != "test-user" {
-			serverErrCh <- fmt.Errorf("unexpected user: %s", loginMsg.User)
-			return
-		}
-		serverHello, err := wire.NewServerHello(hello)
-		if err != nil {
-			serverErrCh <- err
-			return
-		}
-		serverHelloFrame, err := wire.NewJSONFrame(wire.FrameTypeServerHello, serverHello)
-		if err != nil {
-			serverErrCh <- err
-			return
-		}
-		cryptoContext := wire.NewCryptoContext(
-			serverHello.Selected.Crypto.Algorithm,
-			clientHelloFrame.Payload,
-			serverHelloFrame.Payload,
-		)
-		if err := wireConn.WriteFrame(serverHelloFrame); err != nil {
-			serverErrCh <- err
-			return
-		}
-		if err := rw.WriteMsg(&msg.LoginResp{RunID: "run-v2"}); err != nil {
-			serverErrCh <- err
-			return
-		}
-
-		controlRW, err := netpkg.NewAEADCryptoReadWriter(
-			serverRaw,
-			[]byte("token"),
-			netpkg.AEADCryptoRoleServer,
-			cryptoContext.Algorithm,
-			cryptoContext.TranscriptHash,
-		)
-		if err != nil {
-			serverErrCh <- err
-			return
-		}
-		controlMsgRW := msg.NewReadWriter(controlRW, wire.ProtocolV2)
-		var ping msg.Ping
-		if err := controlMsgRW.ReadMsgInto(&ping); err != nil {
-			serverErrCh <- err
-			return
-		}
-		if ping.PrivilegeKey != "v2-ping" || ping.Timestamp != 12345 {
-			serverErrCh <- fmt.Errorf("unexpected ping: %+v", ping)
-			return
-		}
-		serverErrCh <- nil
-	}()
-
-	dialer := newTestControlSessionDialer(t, wire.ProtocolV2, connector, nil)
-	sessionCtx, err := dialer.Dial("")
-	require.NoError(t, err)
-	defer sessionCtx.Conn.Close()
-	defer sessionCtx.Connector.Close()
-
-	require.Equal(t, "run-v2", sessionCtx.RunID)
-	require.Equal(t, wire.UDPPacketCodecBinary, sessionCtx.UDPPacketCodec)
-	require.NotNil(t, sessionCtx.Conn)
-	require.NotNil(t, sessionCtx.Connector)
-	require.False(t, connector.closed.Load())
-	require.NoError(t, sessionCtx.Conn.WriteMsg(&msg.Ping{PrivilegeKey: "v2-ping", Timestamp: 12345}))
-	require.NoError(t, <-serverErrCh)
-}
-
-func TestControlSessionDialerDialLoginErrorClosesResources(t *testing.T) {
-	clientRaw, serverRaw := net.Pipe()
-	defer serverRaw.Close()
-
-	clientConn := &trackingConn{Conn: clientRaw}
-	connector := &testConnector{conn: clientConn}
-	serverErrCh := make(chan error, 1)
-	go func() {
-		rw := msg.NewV1ReadWriter(serverRaw)
-		var loginMsg msg.Login
-		if err := rw.ReadMsgInto(&loginMsg); err != nil {
-			serverErrCh <- err
-			return
-		}
-		serverErrCh <- rw.WriteMsg(&msg.LoginResp{Error: "login denied"})
-	}()
-
-	dialer := newTestControlSessionDialer(t, wire.ProtocolV1, connector, nil)
-	sessionCtx, err := dialer.Dial("")
-	require.Nil(t, sessionCtx)
-	require.ErrorContains(t, err, "login denied")
-	require.True(t, clientConn.closed.Load())
-	require.True(t, connector.closed.Load())
-	require.NoError(t, <-serverErrCh)
-}
-
-func TestControlSessionDialerDialSSHTunnelSkipsControlEncryption(t *testing.T) {
-	clientRaw, serverRaw := net.Pipe()
-	defer serverRaw.Close()
-
-	connector := &testConnector{conn: &trackingConn{Conn: clientRaw}}
-	serverErrCh := make(chan error, 1)
-	go func() {
-		rw := msg.NewV1ReadWriter(serverRaw)
-		var loginMsg msg.Login
-		if err := rw.ReadMsgInto(&loginMsg); err != nil {
-			serverErrCh <- err
-			return
-		}
-		if err := rw.WriteMsg(&msg.LoginResp{RunID: "run-ssh-tunnel"}); err != nil {
-			serverErrCh <- err
-			return
-		}
-
-		_ = serverRaw.SetReadDeadline(time.Now().Add(time.Second))
-		var ping msg.Ping
-		if err := rw.ReadMsgInto(&ping); err != nil {
-			serverErrCh <- err
-			return
-		}
-		serverErrCh <- nil
-	}()
-
-	dialer := newTestControlSessionDialer(t, wire.ProtocolV1, connector, &msg.ClientSpec{Type: "ssh-tunnel"})
-	sessionCtx, err := dialer.Dial("")
-	require.NoError(t, err)
-	defer sessionCtx.Conn.Close()
-	defer sessionCtx.Connector.Close()
-
-	require.Equal(t, "run-ssh-tunnel", sessionCtx.RunID)
-	require.NoError(t, sessionCtx.Conn.WriteMsg(&msg.Ping{}))
-	require.NoError(t, <-serverErrCh)
-}
@@ -1,125 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//go:build !frps
-
-package client
-
-import (
-	"context"
-	"encoding/binary"
-	"net"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	clientproxy "github.com/fatedier/frp/client/proxy"
-	"github.com/fatedier/frp/pkg/auth"
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/proto/wire"
-)
-
-func TestControlPropagatesBinaryUDPPacketCodecToWorkConn(t *testing.T) {
-	echoConn, err := net.ListenUDP("udp4", &net.UDPAddr{IP: net.ParseIP("127.0.0.1")})
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = echoConn.Close() })
-
-	echoDone := make(chan error, 1)
-	go func() {
-		buf := make([]byte, 64)
-		n, addr, err := echoConn.ReadFromUDP(buf)
-		if err == nil {
-			_, err = echoConn.WriteToUDP(buf[:n], addr)
-		}
-		echoDone <- err
-	}()
-
-	authRuntime, err := auth.BuildClientAuth(&v1.AuthClientConfig{
-		Method: v1.AuthMethodToken,
-		Token:  "token",
-	})
-	require.NoError(t, err)
-
-	controlConn, controlPeer := net.Pipe()
-	t.Cleanup(func() {
-		_ = controlConn.Close()
-		_ = controlPeer.Close()
-	})
-	common := &v1.ClientCommonConfig{
-		Transport:     v1.ClientTransportConfig{WireProtocol: wire.ProtocolV2},
-		UDPPacketSize: 1500,
-	}
-	ctl, err := NewControl(context.Background(), &SessionContext{
-		Common:         common,
-		RunID:          "binary-udp-test",
-		Conn:           msg.NewConn(controlConn, msg.NewV2ReadWriter(controlConn)),
-		Auth:           authRuntime,
-		UDPPacketCodec: wire.UDPPacketCodecBinary,
-	})
-	require.NoError(t, err)
-	t.Cleanup(ctl.pm.Close)
-
-	echoAddr := echoConn.LocalAddr().(*net.UDPAddr)
-	proxyCfg := &v1.UDPProxyConfig{
-		ProxyBaseConfig: v1.ProxyBaseConfig{
-			Name: "udp",
-			Type: string(v1.ProxyTypeUDP),
-			ProxyBackend: v1.ProxyBackend{
-				LocalIP:   "127.0.0.1",
-				LocalPort: echoAddr.Port,
-			},
-		},
-	}
-	ctl.pm.UpdateAll([]v1.ProxyConfigurer{proxyCfg})
-	require.Eventually(t, func() bool {
-		status, ok := ctl.pm.GetProxyStatus("udp")
-		return ok && status.Phase == clientproxy.ProxyPhaseWaitStart
-	}, time.Second, 10*time.Millisecond)
-	require.NoError(t, ctl.pm.StartProxy("udp", "", ""))
-
-	workClient, workServer := net.Pipe()
-	t.Cleanup(func() {
-		_ = workClient.Close()
-		_ = workServer.Close()
-	})
-	deadline := time.Now().Add(3 * time.Second)
-	require.NoError(t, workClient.SetDeadline(deadline))
-	require.NoError(t, workServer.SetDeadline(deadline))
-	ctl.pm.HandleWorkConn("udp", workClient, &msg.StartWorkConn{ProxyName: "udp"})
-
-	serverRW, err := msg.NewUDPPacketReadWriter(workServer, wire.ProtocolV2, wire.UDPPacketCodecBinary)
-	require.NoError(t, err)
-	writeDone := make(chan error, 1)
-	in := &msg.UDPPacket{
-		Content:    []byte("binary udp"),
-		RemoteAddr: &net.UDPAddr{IP: net.ParseIP("192.0.2.1"), Port: 12345},
-	}
-	go func() {
-		writeDone <- serverRW.WriteMsg(in)
-	}()
-
-	frame, err := wire.NewConn(workServer).ReadFrame()
-	require.NoError(t, err)
-	require.Equal(t, wire.FrameTypeMessage, frame.Type)
-	require.GreaterOrEqual(t, len(frame.Payload), 2)
-	require.Equal(t, msg.V2TypeUDPPacketBinary, binary.BigEndian.Uint16(frame.Payload[:2]))
-	out, err := msg.DecodeUDPPacketBinary(frame.Payload[2:])
-	require.NoError(t, err)
-	require.Equal(t, in.Content, out.Content)
-	require.Equal(t, in.RemoteAddr.String(), out.RemoteAddr.String())
-	require.NoError(t, <-writeDone)
-	require.NoError(t, <-echoDone)
-}
@@ -30,11 +30,6 @@ import (

 var ErrHealthCheckType = errors.New("error health check type")

-func newHealthTimer(interval time.Duration) (<-chan time.Time, func()) {
-	timer := time.NewTimer(interval)
-	return timer.C, func() { timer.Stop() }
-}
-
 type Monitor struct {
 	checkType      string
 	interval       time.Duration
@@ -54,9 +49,6 @@ type Monitor struct {

 	ctx    context.Context
 	cancel context.CancelFunc
-	doneCh chan struct{}
-
-	timerFactory func(time.Duration) (<-chan time.Time, func())
 }

 func NewMonitor(ctx context.Context, cfg v1.HealthCheckConfig, addr string,
@@ -99,8 +91,6 @@ func NewMonitor(ctx context.Context, cfg v1.HealthCheckConfig, addr string,
 		statusFailedFn: statusFailedFn,
 		ctx:            newctx,
 		cancel:         cancel,
-		doneCh:         make(chan struct{}),
-		timerFactory:   newHealthTimer,
 	}
 }

@@ -112,48 +102,29 @@ func (monitor *Monitor) Stop() {
 	monitor.cancel()
 }

-// Done is closed when the worker launched by Start has exited.
-func (monitor *Monitor) Done() <-chan struct{} {
-	return monitor.doneCh
-}
-
 func (monitor *Monitor) checkWorker() {
-	defer close(monitor.doneCh)
-
+	xl := xlog.FromContextSafe(monitor.ctx)
 	for {
-		if monitor.ctx.Err() != nil {
-			return
-		}
-
 		doCtx, cancel := context.WithDeadline(monitor.ctx, time.Now().Add(monitor.timeout))
 		err := monitor.doCheck(doCtx)
-		cancel()

 		// check if this monitor has been closed
-		if monitor.ctx.Err() != nil {
+		select {
+		case <-monitor.ctx.Done():
+			cancel()
 			return
-		}
-		monitor.handleCheckResult(err)
-
-		if !monitor.waitForNextCheck() {
-			return
-		}
-	}
+		default:
+			cancel()
 		}

-func (monitor *Monitor) handleCheckResult(err error) {
-	xl := xlog.FromContextSafe(monitor.ctx)
 		if err == nil {
 			xl.Tracef("do one health check success")
-		monitor.failedTimes = 0
 			if !monitor.statusOK && monitor.statusNormalFn != nil {
 				xl.Infof("health check status change to success")
 				monitor.statusOK = true
 				monitor.statusNormalFn()
 			}
-		return
-	}
-
+		} else {
 			xl.Warnf("do one health check failed: %v", err)
 			monitor.failedTimes++
 			if monitor.statusOK && int(monitor.failedTimes) >= monitor.maxFailedTimes && monitor.statusFailedFn != nil {
@@ -163,15 +134,7 @@ func (monitor *Monitor) handleCheckResult(err error) {
 			}
 		}

-func (monitor *Monitor) waitForNextCheck() bool {
-	timerC, stopTimer := monitor.timerFactory(monitor.interval)
-	defer stopTimer()
-
-	select {
-	case <-monitor.ctx.Done():
-		return false
-	case <-timerC:
-		return monitor.ctx.Err() == nil
+		time.Sleep(monitor.interval)
 	}
 }

@@ -1,575 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package health
-
-import (
-	"context"
-	"errors"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-)
-
-type tcpHealthBackend struct {
-	listener net.Listener
-	accepted chan struct{}
-	done     chan struct{}
-}
-
-func newTCPHealthBackend(t *testing.T, addr string, accepted chan struct{}) *tcpHealthBackend {
-	listener, err := net.Listen("tcp", addr)
-	require.NoError(t, err)
-
-	backend := &tcpHealthBackend{
-		listener: listener,
-		accepted: accepted,
-		done:     make(chan struct{}),
-	}
-	go func() {
-		defer close(backend.done)
-		for {
-			conn, err := backend.listener.Accept()
-			if err != nil {
-				return
-			}
-			_ = conn.Close()
-			select {
-			case backend.accepted <- struct{}{}:
-			default:
-			}
-		}
-	}()
-	return backend
-}
-
-func (backend *tcpHealthBackend) Close() {
-	_ = backend.listener.Close()
-	<-backend.done
-}
-
-func TestMonitorConsecutiveFailureWindows(t *testing.T) {
-	tests := []struct {
-		name  string
-		setup func(*testing.T, func(), func()) (*Monitor, func(bool))
-	}{
-		{
-			name: "HTTP",
-			setup: func(t *testing.T, normalFn, failedFn func()) (*Monitor, func(bool)) {
-				var healthy atomic.Bool
-				healthy.Store(true)
-				server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-					if !healthy.Load() {
-						w.WriteHeader(http.StatusServiceUnavailable)
-					}
-				}))
-				t.Cleanup(server.Close)
-
-				monitor := NewMonitor(
-					context.Background(),
-					v1.HealthCheckConfig{
-						Type:            "http",
-						Path:            "/health",
-						TimeoutSeconds:  1,
-						IntervalSeconds: 1,
-						MaxFailed:       3,
-					},
-					strings.TrimPrefix(server.URL, "http://"),
-					normalFn,
-					failedFn,
-				)
-				return monitor, healthy.Store
-			},
-		},
-		{
-			name: "TCP",
-			setup: func(t *testing.T, normalFn, failedFn func()) (*Monitor, func(bool)) {
-				listener, err := net.Listen("tcp", "127.0.0.1:0")
-				require.NoError(t, err)
-				t.Cleanup(func() { _ = listener.Close() })
-				go func() {
-					for {
-						conn, err := listener.Accept()
-						if err != nil {
-							return
-						}
-						_ = conn.Close()
-					}
-				}()
-
-				monitor := NewMonitor(
-					context.Background(),
-					v1.HealthCheckConfig{
-						Type:            "tcp",
-						TimeoutSeconds:  1,
-						IntervalSeconds: 1,
-						MaxFailed:       3,
-					},
-					listener.Addr().String(),
-					normalFn,
-					failedFn,
-				)
-				healthyAddr := monitor.addr
-				return monitor, func(healthy bool) {
-					if healthy {
-						monitor.addr = healthyAddr
-					} else {
-						monitor.addr = "127.0.0.1:0"
-					}
-				}
-			},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			var events []string
-			monitor, setHealthy := test.setup(
-				t,
-				func() { events = append(events, "normal") },
-				func() { events = append(events, "failed") },
-			)
-			t.Cleanup(monitor.Stop)
-
-			runCheck := func(healthy bool) {
-				t.Helper()
-				setHealthy(healthy)
-				ctx, cancel := context.WithTimeout(monitor.ctx, time.Second)
-				err := monitor.doCheck(ctx)
-				cancel()
-				if healthy {
-					require.NoError(t, err)
-				} else {
-					require.Error(t, err)
-				}
-				monitor.handleCheckResult(err)
-			}
-
-			runCheck(true)
-			require.True(t, monitor.statusOK)
-			require.Zero(t, monitor.failedTimes)
-			require.Equal(t, []string{"normal"}, events)
-
-			runCheck(false)
-			runCheck(false)
-			require.True(t, monitor.statusOK)
-			require.Equal(t, uint64(2), monitor.failedTimes)
-			require.Equal(t, []string{"normal"}, events)
-
-			runCheck(true)
-			require.True(t, monitor.statusOK)
-			require.Zero(t, monitor.failedTimes)
-			require.Equal(t, []string{"normal"}, events)
-
-			runCheck(false)
-			require.True(t, monitor.statusOK)
-			require.Equal(t, uint64(1), monitor.failedTimes)
-			require.Equal(t, []string{"normal"}, events)
-
-			runCheck(false)
-			require.True(t, monitor.statusOK)
-			require.Equal(t, uint64(2), monitor.failedTimes)
-
-			runCheck(false)
-			require.False(t, monitor.statusOK)
-			require.Equal(t, uint64(3), monitor.failedTimes)
-			require.Equal(t, []string{"normal", "failed"}, events)
-
-			runCheck(true)
-			require.True(t, monitor.statusOK)
-			require.Zero(t, monitor.failedTimes)
-			require.Equal(t, []string{"normal", "failed", "normal"}, events)
-		})
-	}
-}
-
-type workerStatus struct {
-	failedTimes uint64
-	statusOK    bool
-}
-
-type workerInterval struct {
-	status workerStatus
-	timer  chan time.Time
-}
-
-func observeWorkerIntervals(monitor *Monitor) <-chan workerInterval {
-	intervals := make(chan workerInterval, 1)
-	monitor.timerFactory = func(time.Duration) (<-chan time.Time, func()) {
-		timer := make(chan time.Time, 1)
-		// The worker takes this snapshot after handleCheckResult. Sending it
-		// publishes the state to the test; no test goroutine reads live fields.
-		interval := workerInterval{
-			status: workerStatus{failedTimes: monitor.failedTimes, statusOK: monitor.statusOK},
-			timer:  timer,
-		}
-		select {
-		case intervals <- interval:
-		case <-monitor.ctx.Done():
-		}
-		return timer, func() {}
-	}
-	return intervals
-}
-
-func awaitWorkerInterval(t *testing.T, intervals <-chan workerInterval, want workerStatus) chan time.Time {
-	t.Helper()
-	select {
-	case interval := <-intervals:
-		require.Equal(t, want, interval.status)
-		return interval.timer
-	case <-time.After(time.Second):
-		t.Fatal("health worker did not reach the interval barrier")
-		return nil
-	}
-}
-
-func stopMonitorWorker(t *testing.T, monitor *Monitor) {
-	t.Helper()
-	monitor.Stop()
-	select {
-	case <-monitor.Done():
-	case <-time.After(time.Second):
-		t.Error("health worker did not exit after Stop")
-	}
-}
-
-func TestMonitorWorkerProcessesResults(t *testing.T) {
-	requestReady := make(chan struct{}, 1)
-	responses := make(chan int)
-	requestCanceled := make(chan struct{})
-	var cancelOnce sync.Once
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		select {
-		case requestReady <- struct{}{}:
-		case <-r.Context().Done():
-			return
-		}
-		select {
-		case code := <-responses:
-			w.WriteHeader(code)
-		case <-r.Context().Done():
-			cancelOnce.Do(func() { close(requestCanceled) })
-		}
-	}))
-	t.Cleanup(server.Close)
-
-	events := make(chan string, 3)
-	monitor := NewMonitor(
-		context.Background(),
-		v1.HealthCheckConfig{
-			Type:           "http",
-			Path:           "/health",
-			TimeoutSeconds: 5,
-			MaxFailed:      3,
-		},
-		strings.TrimPrefix(server.URL, "http://"),
-		func() { events <- "normal" },
-		func() { events <- "failed" },
-	)
-	intervals := observeWorkerIntervals(monitor)
-	t.Cleanup(func() { stopMonitorWorker(t, monitor) })
-
-	awaitRequest := func() {
-		t.Helper()
-		select {
-		case <-requestReady:
-		case <-time.After(time.Second):
-			t.Fatal("health check request did not start")
-		}
-	}
-	awaitEvent := func(want string) {
-		t.Helper()
-		select {
-		case got := <-events:
-			require.Equal(t, want, got)
-		case <-time.After(time.Second):
-			t.Fatalf("health check callback %q was not called", want)
-		}
-	}
-	checkResult := func(code int, want workerStatus, event string) {
-		t.Helper()
-		awaitRequest()
-		select {
-		case responses <- code:
-		case <-time.After(time.Second):
-			t.Fatal("health check handler did not accept the response")
-		}
-		timer := awaitWorkerInterval(t, intervals, want)
-		if event != "" {
-			awaitEvent(event)
-		}
-		// The worker has finished this result and cannot emit another
-		// callback until the test releases the next check.
-		select {
-		case got := <-events:
-			t.Fatalf("unexpected health check callback %q", got)
-		default:
-		}
-		timer <- time.Now()
-	}
-
-	monitor.Start()
-	checkResult(http.StatusOK, workerStatus{statusOK: true}, "normal")
-	checkResult(http.StatusServiceUnavailable, workerStatus{failedTimes: 1, statusOK: true}, "")
-	checkResult(http.StatusServiceUnavailable, workerStatus{failedTimes: 2, statusOK: true}, "")
-	checkResult(http.StatusOK, workerStatus{statusOK: true}, "")
-	checkResult(http.StatusServiceUnavailable, workerStatus{failedTimes: 1, statusOK: true}, "")
-	checkResult(http.StatusServiceUnavailable, workerStatus{failedTimes: 2, statusOK: true}, "")
-	checkResult(http.StatusServiceUnavailable, workerStatus{failedTimes: 3}, "failed")
-	checkResult(http.StatusOK, workerStatus{statusOK: true}, "normal")
-
-	awaitRequest()
-	stopMonitorWorker(t, monitor)
-	select {
-	case <-requestCanceled:
-	case <-time.After(time.Second):
-		t.Fatal("health check request context was not canceled")
-	}
-}
-
-func TestMonitorTCPWorkerProcessesResults(t *testing.T) {
-	initialAccepted := make(chan struct{}, 1)
-	initialBackend := newTCPHealthBackend(t, "127.0.0.1:0", initialAccepted)
-	addr := initialBackend.listener.Addr().String()
-	recoveryAccepted := make(chan struct{}, 1)
-
-	normalCallbacks := make(chan workerStatus, 2)
-	failedCallbacks := make(chan workerStatus, 2)
-	var monitor *Monitor
-	monitor = NewMonitor(
-		context.Background(),
-		v1.HealthCheckConfig{
-			Type:           "tcp",
-			TimeoutSeconds: 1,
-			MaxFailed:      3,
-		},
-		addr,
-		func() {
-			normalCallbacks <- workerStatus{failedTimes: monitor.failedTimes, statusOK: monitor.statusOK}
-		},
-		func() {
-			failedCallbacks <- workerStatus{failedTimes: monitor.failedTimes, statusOK: monitor.statusOK}
-		},
-	)
-	intervals := observeWorkerIntervals(monitor)
-	recoveryBackend := (*tcpHealthBackend)(nil)
-	t.Cleanup(func() {
-		stopMonitorWorker(t, monitor)
-		initialBackend.Close()
-		if recoveryBackend != nil {
-			recoveryBackend.Close()
-		}
-	})
-
-	awaitStatus := func(ch <-chan workerStatus, want workerStatus, message string) {
-		t.Helper()
-		select {
-		case got := <-ch:
-			require.Equal(t, want, got)
-		case <-time.After(time.Second):
-			t.Fatal(message)
-		}
-	}
-
-	monitor.Start()
-	select {
-	case <-initialAccepted:
-	case <-time.After(time.Second):
-		t.Fatal("TCP health check did not reach the initial backend")
-	}
-	awaitStatus(normalCallbacks, workerStatus{failedTimes: 0, statusOK: true}, "TCP worker did not report the initial success")
-
-	initialTimer := awaitWorkerInterval(t, intervals, workerStatus{statusOK: true})
-	initialBackend.Close()
-	initialTimer <- time.Now()
-
-	firstFailureTimer := awaitWorkerInterval(t, intervals, workerStatus{failedTimes: 1, statusOK: true})
-	firstFailureTimer <- time.Now()
-
-	secondFailureTimer := awaitWorkerInterval(t, intervals, workerStatus{failedTimes: 2, statusOK: true})
-	secondFailureTimer <- time.Now()
-
-	awaitStatus(failedCallbacks, workerStatus{failedTimes: 3, statusOK: false}, "TCP worker did not report the third failed health check")
-	thirdFailureTimer := awaitWorkerInterval(t, intervals, workerStatus{failedTimes: 3})
-
-	recoveryBackend = newTCPHealthBackend(t, addr, recoveryAccepted)
-	thirdFailureTimer <- time.Now()
-	select {
-	case <-recoveryAccepted:
-	case <-time.After(time.Second):
-		t.Fatal("TCP health check did not reach the recovery backend")
-	}
-	awaitStatus(normalCallbacks, workerStatus{failedTimes: 0, statusOK: true}, "TCP worker did not report recovery")
-
-	recoveryTimer := awaitWorkerInterval(t, intervals, workerStatus{statusOK: true})
-	recoveryBackend.Close()
-	recoveryTimer <- time.Now()
-
-	firstRecoveryFailureTimer := awaitWorkerInterval(t, intervals, workerStatus{failedTimes: 1, statusOK: true})
-	firstRecoveryFailureTimer <- time.Now()
-
-	secondRecoveryFailureTimer := awaitWorkerInterval(t, intervals, workerStatus{failedTimes: 2, statusOK: true})
-	secondRecoveryFailureTimer <- time.Now()
-
-	awaitStatus(failedCallbacks, workerStatus{failedTimes: 3, statusOK: false}, "TCP worker did not report the third failed health check after recovery")
-	stopMonitorWorker(t, monitor)
-}
-
-func TestMonitorMaxFailedOne(t *testing.T) {
-	var events []string
-	monitor := NewMonitor(
-		context.Background(),
-		v1.HealthCheckConfig{Type: "tcp", MaxFailed: 1},
-		"",
-		func() { events = append(events, "normal") },
-		func() { events = append(events, "failed") },
-	)
-	t.Cleanup(monitor.Stop)
-
-	checkErr := errors.New("health check failed")
-	monitor.handleCheckResult(nil)
-	monitor.handleCheckResult(checkErr)
-	require.Equal(t, []string{"normal", "failed"}, events)
-	require.False(t, monitor.statusOK)
-	require.Equal(t, uint64(1), monitor.failedTimes)
-
-	monitor.handleCheckResult(checkErr)
-	require.Equal(t, []string{"normal", "failed"}, events)
-
-	monitor.handleCheckResult(nil)
-	monitor.handleCheckResult(checkErr)
-	require.Equal(t, []string{"normal", "failed", "normal", "failed"}, events)
-}
-
-func TestMonitorStopCancelsWork(t *testing.T) {
-	t.Run("in-flight check", func(t *testing.T) {
-		requestStarted := make(chan struct{})
-		requestCanceled := make(chan struct{})
-		server := httptest.NewServer(http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
-			close(requestStarted)
-			<-r.Context().Done()
-			close(requestCanceled)
-		}))
-		t.Cleanup(server.Close)
-
-		monitor := NewMonitor(
-			context.Background(),
-			v1.HealthCheckConfig{Type: "http", Path: "/health"},
-			strings.TrimPrefix(server.URL, "http://"),
-			func() {},
-			func() {},
-		)
-		t.Cleanup(func() { stopMonitorWorker(t, monitor) })
-		monitor.Start()
-
-		select {
-		case <-requestStarted:
-		case <-time.After(time.Second):
-			t.Fatal("health check request did not start")
-		}
-		stopMonitorWorker(t, monitor)
-		select {
-		case <-requestCanceled:
-		case <-time.After(time.Second):
-			t.Fatal("health check request context was not canceled")
-		}
-	})
-
-	t.Run("interval wait", func(t *testing.T) {
-		monitor := NewMonitor(context.Background(), v1.HealthCheckConfig{Type: "tcp"}, "", nil, nil)
-		intervals := observeWorkerIntervals(monitor)
-		t.Cleanup(func() { stopMonitorWorker(t, monitor) })
-		monitor.Start()
-
-		// A real worker has completed its first check and installed a timer
-		// that will never fire. Stop must release the wait and exit the loop.
-		awaitWorkerInterval(t, intervals, workerStatus{})
-		stopMonitorWorker(t, monitor)
-	})
-}
-
-type gatedErrContext struct {
-	context.Context
-	errCalled  chan struct{}
-	releaseErr chan struct{}
-}
-
-func (ctx *gatedErrContext) Err() error {
-	select {
-	case ctx.errCalled <- struct{}{}:
-	default:
-	}
-	<-ctx.releaseErr
-	return ctx.Context.Err()
-}
-
-func TestMonitorTimerCancellationAfterTimerFires(t *testing.T) {
-	baseCtx, cancel := context.WithCancel(context.Background())
-	ctx := &gatedErrContext{
-		Context:    baseCtx,
-		errCalled:  make(chan struct{}, 1),
-		releaseErr: make(chan struct{}),
-	}
-	monitor := NewMonitor(
-		context.Background(),
-		v1.HealthCheckConfig{Type: "tcp"},
-		"",
-		nil,
-		nil,
-	)
-	monitor.ctx = ctx
-	monitor.cancel = cancel
-
-	timerReady := make(chan time.Time, 1)
-	timerReady <- time.Now()
-	var timerStopped atomic.Bool
-	monitor.timerFactory = func(time.Duration) (<-chan time.Time, func()) {
-		return timerReady, func() { timerStopped.Store(true) }
-	}
-
-	waitResult := make(chan bool, 1)
-	go func() {
-		waitResult <- monitor.waitForNextCheck()
-	}()
-
-	// ctx.Done is not ready when select runs, so receiving timerReady is the
-	// only possible branch. Err signals after that receive and blocks until the
-	// test cancels the context, deterministically exercising the cancellation
-	// re-check in the timer branch.
-	select {
-	case <-ctx.errCalled:
-	case <-time.After(time.Second):
-		t.Fatal("timer branch did not re-check the monitor context")
-	}
-	cancel()
-	close(ctx.releaseErr)
-
-	select {
-	case shouldContinue := <-waitResult:
-		require.False(t, shouldContinue)
-	case <-time.After(time.Second):
-		t.Fatal("timer wait did not observe context cancellation")
-	}
-	require.True(t, timerStopped.Load())
-}
@@ -162,44 +162,6 @@ func (c *Controller) buildProxyStatusResp(status *proxy.WorkingStatus) model.Pro
 	return psr
 }

-// GetProxyConfig handles GET /api/proxy/{name}/config
-func (c *Controller) GetProxyConfig(ctx *httppkg.Context) (any, error) {
-	name := ctx.Param("name")
-	if name == "" {
-		return nil, httppkg.NewError(http.StatusBadRequest, "proxy name is required")
-	}
-
-	cfg, ok := c.manager.GetProxyConfig(name)
-	if !ok {
-		return nil, httppkg.NewError(http.StatusNotFound, fmt.Sprintf("proxy %q not found", name))
-	}
-
-	payload, err := model.ProxyDefinitionFromConfigurer(cfg)
-	if err != nil {
-		return nil, httppkg.NewError(http.StatusInternalServerError, err.Error())
-	}
-	return payload, nil
-}
-
-// GetVisitorConfig handles GET /api/visitor/{name}/config
-func (c *Controller) GetVisitorConfig(ctx *httppkg.Context) (any, error) {
-	name := ctx.Param("name")
-	if name == "" {
-		return nil, httppkg.NewError(http.StatusBadRequest, "visitor name is required")
-	}
-
-	cfg, ok := c.manager.GetVisitorConfig(name)
-	if !ok {
-		return nil, httppkg.NewError(http.StatusNotFound, fmt.Sprintf("visitor %q not found", name))
-	}
-
-	payload, err := model.VisitorDefinitionFromConfigurer(cfg)
-	if err != nil {
-		return nil, httppkg.NewError(http.StatusInternalServerError, err.Error())
-	}
-	return payload, nil
-}
-
 func (c *Controller) ListStoreProxies(ctx *httppkg.Context) (any, error) {
 	proxies, err := c.manager.ListStoreProxies()
 	if err != nil {
@@ -26,8 +26,6 @@ type fakeConfigManager struct {
 	getProxyStatusFn      func() []*proxy.WorkingStatus
 	isStoreProxyEnabledFn func(name string) bool
 	storeEnabledFn        func() bool
-	getProxyConfigFn      func(name string) (v1.ProxyConfigurer, bool)
-	getVisitorConfigFn    func(name string) (v1.VisitorConfigurer, bool)

 	listStoreProxiesFn  func() ([]v1.ProxyConfigurer, error)
 	getStoreProxyFn     func(name string) (v1.ProxyConfigurer, error)
@@ -84,20 +82,6 @@ func (m *fakeConfigManager) StoreEnabled() bool {
 	return false
 }

-func (m *fakeConfigManager) GetProxyConfig(name string) (v1.ProxyConfigurer, bool) {
-	if m.getProxyConfigFn != nil {
-		return m.getProxyConfigFn(name)
-	}
-	return nil, false
-}
-
-func (m *fakeConfigManager) GetVisitorConfig(name string) (v1.VisitorConfigurer, bool) {
-	if m.getVisitorConfigFn != nil {
-		return m.getVisitorConfigFn(name)
-	}
-	return nil, false
-}
-
 func (m *fakeConfigManager) ListStoreProxies() ([]v1.ProxyConfigurer, error) {
 	if m.listStoreProxiesFn != nil {
 		return m.listStoreProxiesFn()
@@ -545,118 +529,3 @@ func TestUpdateStoreProxyReturnsTypedPayload(t *testing.T) {
 		t.Fatalf("unexpected response payload: %#v", payload)
 	}
 }
-
-func TestGetProxyConfigFromManager(t *testing.T) {
-	controller := &Controller{
-		manager: &fakeConfigManager{
-			getProxyConfigFn: func(name string) (v1.ProxyConfigurer, bool) {
-				if name == "ssh" {
-					cfg := &v1.TCPProxyConfig{
-						ProxyBaseConfig: v1.ProxyBaseConfig{
-							Name: "ssh",
-							Type: "tcp",
-							ProxyBackend: v1.ProxyBackend{
-								LocalPort: 22,
-							},
-						},
-					}
-					return cfg, true
-				}
-				return nil, false
-			},
-		},
-	}
-
-	req := httptest.NewRequest(http.MethodGet, "/api/proxy/ssh/config", nil)
-	req = mux.SetURLVars(req, map[string]string{"name": "ssh"})
-	ctx := httppkg.NewContext(httptest.NewRecorder(), req)
-
-	resp, err := controller.GetProxyConfig(ctx)
-	if err != nil {
-		t.Fatalf("get proxy config: %v", err)
-	}
-	payload, ok := resp.(model.ProxyDefinition)
-	if !ok {
-		t.Fatalf("unexpected response type: %T", resp)
-	}
-	if payload.Name != "ssh" || payload.Type != "tcp" || payload.TCP == nil {
-		t.Fatalf("unexpected payload: %#v", payload)
-	}
-}
-
-func TestGetProxyConfigNotFound(t *testing.T) {
-	controller := &Controller{
-		manager: &fakeConfigManager{
-			getProxyConfigFn: func(name string) (v1.ProxyConfigurer, bool) {
-				return nil, false
-			},
-		},
-	}
-
-	req := httptest.NewRequest(http.MethodGet, "/api/proxy/missing/config", nil)
-	req = mux.SetURLVars(req, map[string]string{"name": "missing"})
-	ctx := httppkg.NewContext(httptest.NewRecorder(), req)
-
-	_, err := controller.GetProxyConfig(ctx)
-	if err == nil {
-		t.Fatal("expected error")
-	}
-	assertHTTPCode(t, err, http.StatusNotFound)
-}
-
-func TestGetVisitorConfigFromManager(t *testing.T) {
-	controller := &Controller{
-		manager: &fakeConfigManager{
-			getVisitorConfigFn: func(name string) (v1.VisitorConfigurer, bool) {
-				if name == "my-stcp" {
-					cfg := &v1.STCPVisitorConfig{
-						VisitorBaseConfig: v1.VisitorBaseConfig{
-							Name:       "my-stcp",
-							Type:       "stcp",
-							ServerName: "server1",
-							BindPort:   9000,
-						},
-					}
-					return cfg, true
-				}
-				return nil, false
-			},
-		},
-	}
-
-	req := httptest.NewRequest(http.MethodGet, "/api/visitor/my-stcp/config", nil)
-	req = mux.SetURLVars(req, map[string]string{"name": "my-stcp"})
-	ctx := httppkg.NewContext(httptest.NewRecorder(), req)
-
-	resp, err := controller.GetVisitorConfig(ctx)
-	if err != nil {
-		t.Fatalf("get visitor config: %v", err)
-	}
-	payload, ok := resp.(model.VisitorDefinition)
-	if !ok {
-		t.Fatalf("unexpected response type: %T", resp)
-	}
-	if payload.Name != "my-stcp" || payload.Type != "stcp" || payload.STCP == nil {
-		t.Fatalf("unexpected payload: %#v", payload)
-	}
-}
-
-func TestGetVisitorConfigNotFound(t *testing.T) {
-	controller := &Controller{
-		manager: &fakeConfigManager{
-			getVisitorConfigFn: func(name string) (v1.VisitorConfigurer, bool) {
-				return nil, false
-			},
-		},
-	}
-
-	req := httptest.NewRequest(http.MethodGet, "/api/visitor/missing/config", nil)
-	req = mux.SetURLVars(req, map[string]string{"name": "missing"})
-	ctx := httppkg.NewContext(httptest.NewRecorder(), req)
-
-	_, err := controller.GetVisitorConfig(ctx)
-	if err == nil {
-		t.Fatal("expected error")
-	}
-	assertHTTPCode(t, err, http.StatusNotFound)
-}
@@ -16,7 +16,6 @@ package proxy

 import (
 	"context"
-	"fmt"
 	"io"
 	"net"
 	"reflect"
@@ -61,12 +60,11 @@ func NewProxy(
 	encryptionKey []byte,
 	msgTransporter transport.MessageTransporter,
 	vnetController *vnet.Controller,
-	udpPacketCodec string,
 ) (pxy Proxy) {
 	var limiter *rate.Limiter
 	limitBytes := pxyConf.GetBaseConfig().Transport.BandwidthLimit.Bytes()
 	if limitBytes > 0 && pxyConf.GetBaseConfig().Transport.BandwidthLimitMode == types.BandwidthLimitModeClient {
-		limiter = limit.NewBandwidthLimiter(limitBytes)
+		limiter = rate.NewLimiter(rate.Limit(float64(limitBytes)), int(limitBytes))
 	}

 	baseProxy := BaseProxy{
@@ -78,7 +76,6 @@ func NewProxy(
 		vnetController: vnetController,
 		xl:             xlog.FromContextSafe(ctx),
 		ctx:            ctx,
-		udpPacketCodec: udpPacketCodec,
 	}

 	factory := proxyFactoryRegistry[reflect.TypeOf(pxyConf)]
@@ -103,7 +100,6 @@ type BaseProxy struct {
 	mu  sync.RWMutex
 	xl  *xlog.Logger
 	ctx context.Context
-	udpPacketCodec string
 }

 func (pxy *BaseProxy) Run() error {
@@ -126,33 +122,6 @@ func (pxy *BaseProxy) Close() {
 	}
 }

-// wrapWorkConn applies rate limiting, encryption, and compression
-// to a work connection based on the proxy's transport configuration.
-// The returned recycle function should be called when the stream is no longer in use
-// to return compression resources to the pool. It is safe to not call recycle,
-// in which case resources will be garbage collected normally.
-func (pxy *BaseProxy) wrapWorkConn(conn net.Conn, encKey []byte) (io.ReadWriteCloser, func(), error) {
-	var rwc io.ReadWriteCloser = conn
-	if pxy.limiter != nil {
-		rwc = libio.WrapReadWriteCloser(limit.NewReader(conn, pxy.limiter), limit.NewWriter(conn, pxy.limiter), func() error {
-			return conn.Close()
-		})
-	}
-	if pxy.baseCfg.Transport.UseEncryption {
-		var err error
-		rwc, err = libio.WithEncryption(rwc, encKey)
-		if err != nil {
-			conn.Close()
-			return nil, nil, fmt.Errorf("create encryption stream error: %w", err)
-		}
-	}
-	var recycleFn func()
-	if pxy.baseCfg.Transport.UseCompression {
-		rwc, recycleFn = libio.WithCompressionFromPool(rwc)
-	}
-	return rwc, recycleFn, nil
-}
-
 func (pxy *BaseProxy) SetInWorkConnCallback(cb func(*v1.ProxyBaseConfig, net.Conn, *msg.StartWorkConn) bool) {
 	pxy.inWorkConnCallback = cb
 }
@@ -170,44 +139,46 @@ func (pxy *BaseProxy) InWorkConn(conn net.Conn, m *msg.StartWorkConn) {
 func (pxy *BaseProxy) HandleTCPWorkConnection(workConn net.Conn, m *msg.StartWorkConn, encKey []byte) {
 	xl := pxy.xl
 	baseCfg := pxy.baseCfg
+	var (
+		remote io.ReadWriteCloser
+		err    error
+	)
+	remote = workConn
+	if pxy.limiter != nil {
+		remote = libio.WrapReadWriteCloser(limit.NewReader(workConn, pxy.limiter), limit.NewWriter(workConn, pxy.limiter), func() error {
+			return workConn.Close()
+		})
+	}

 	xl.Tracef("handle tcp work connection, useEncryption: %t, useCompression: %t",
 		baseCfg.Transport.UseEncryption, baseCfg.Transport.UseCompression)
-
-	var srcAddr, dstAddr *net.TCPAddr
-	if m.SrcAddr != "" && m.SrcPort != 0 {
-		if m.DstAddr == "" {
-			m.DstAddr = "127.0.0.1"
-		}
-		var err error
-		srcAddr, err = net.ResolveTCPAddr("tcp", net.JoinHostPort(m.SrcAddr, strconv.Itoa(int(m.SrcPort))))
+	if baseCfg.Transport.UseEncryption {
+		remote, err = libio.WithEncryption(remote, encKey)
 		if err != nil {
-			xl.Warnf("resolve source address [%s] error: %v", m.SrcAddr, err)
-			_ = workConn.Close()
-			return
-		}
-		dstAddr, err = net.ResolveTCPAddr("tcp", net.JoinHostPort(m.DstAddr, strconv.Itoa(int(m.DstPort))))
-		if err != nil {
-			xl.Warnf("resolve destination address [%s] error: %v", m.DstAddr, err)
-			_ = workConn.Close()
+			workConn.Close()
+			xl.Errorf("create encryption stream error: %v", err)
 			return
 		}
 	}
-
-	remote, recycleFn, err := pxy.wrapWorkConn(workConn, encKey)
-	if err != nil {
-		xl.Errorf("wrap work connection: %v", err)
-		return
+	var compressionResourceRecycleFn func()
+	if baseCfg.Transport.UseCompression {
+		remote, compressionResourceRecycleFn = libio.WithCompressionFromPool(remote)
 	}

 	// check if we need to send proxy protocol info
 	var connInfo plugin.ConnectionInfo
 	if m.SrcAddr != "" && m.SrcPort != 0 {
+		if m.DstAddr == "" {
+			m.DstAddr = "127.0.0.1"
+		}
+		srcAddr, _ := net.ResolveTCPAddr("tcp", net.JoinHostPort(m.SrcAddr, strconv.Itoa(int(m.SrcPort))))
+		dstAddr, _ := net.ResolveTCPAddr("tcp", net.JoinHostPort(m.DstAddr, strconv.Itoa(int(m.DstPort))))
 		connInfo.SrcAddr = srcAddr
 		connInfo.DstAddr = dstAddr
 	}

 	if baseCfg.Transport.ProxyProtocolVersion != "" && m.SrcAddr != "" && m.SrcPort != 0 {
+		// Use the common proxy protocol builder function
 		header := netpkg.BuildProxyProtocolHeaderStruct(connInfo.SrcAddr, connInfo.DstAddr, baseCfg.Transport.ProxyProtocolVersion)
 		connInfo.ProxyProtocolHeader = header
 	}
@@ -216,18 +187,12 @@ func (pxy *BaseProxy) HandleTCPWorkConnection(workConn net.Conn, m *msg.StartWor

 	if pxy.proxyPlugin != nil {
 		// if plugin is set, let plugin handle connection first
-		// Don't recycle compression resources here because plugins may
-		// retain the connection after Handle returns.
 		xl.Debugf("handle by plugin: %s", pxy.proxyPlugin.Name())
 		pxy.proxyPlugin.Handle(pxy.ctx, &connInfo)
 		xl.Debugf("handle by plugin finished")
 		return
 	}

-	if recycleFn != nil {
-		defer recycleFn()
-	}
-
 	localConn, err := libnet.Dial(
 		net.JoinHostPort(baseCfg.LocalIP, strconv.Itoa(baseCfg.LocalPort)),
 		libnet.WithTimeout(10*time.Second),
@@ -244,7 +209,6 @@ func (pxy *BaseProxy) HandleTCPWorkConnection(workConn net.Conn, m *msg.StartWor
 	if connInfo.ProxyProtocolHeader != nil {
 		if _, err := connInfo.ProxyProtocolHeader.WriteTo(localConn); err != nil {
 			workConn.Close()
-			localConn.Close()
 			xl.Errorf("write proxy protocol header to local conn error: %v", err)
 			return
 		}
@@ -255,4 +219,7 @@ func (pxy *BaseProxy) HandleTCPWorkConnection(workConn net.Conn, m *msg.StartWor
 	if len(errs) > 0 {
 		xl.Tracef("join connections errors: %v", errs)
 	}
+	if compressionResourceRecycleFn != nil {
+		compressionResourceRecycleFn()
+	}
 }
@@ -44,7 +44,6 @@ type Manager struct {
 	clientCfg     *v1.ClientCommonConfig

 	ctx context.Context
-	udpPacketCodec string
 }

 func NewManager(
@@ -53,7 +52,6 @@ func NewManager(
 	encryptionKey []byte,
 	msgTransporter transport.MessageTransporter,
 	vnetController *vnet.Controller,
-	udpPacketCodec string,
 ) *Manager {
 	return &Manager{
 		proxies:        make(map[string]*Wrapper),
@@ -63,7 +61,6 @@ func NewManager(
 		encryptionKey:  encryptionKey,
 		clientCfg:      clientCfg,
 		ctx:            ctx,
-		udpPacketCodec: udpPacketCodec,
 	}
 }

@@ -169,7 +166,7 @@ func (pm *Manager) UpdateAll(proxyCfgs []v1.ProxyConfigurer) {
 	for _, cfg := range proxyCfgs {
 		name := cfg.GetBaseConfig().Name
 		if _, ok := pm.proxies[name]; !ok {
-			pxy := NewWrapper(pm.ctx, cfg, pm.clientCfg, pm.encryptionKey, pm.HandleEvent, pm.msgTransporter, pm.vnetController, pm.udpPacketCodec)
+			pxy := NewWrapper(pm.ctx, cfg, pm.clientCfg, pm.encryptionKey, pm.HandleEvent, pm.msgTransporter, pm.vnetController)
 			if pm.inWorkConnCallback != nil {
 				pxy.SetInWorkConnCallback(pm.inWorkConnCallback)
 			}
@@ -1,47 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//go:build !frps
-
-package proxy
-
-import (
-	"io"
-	"net"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/util/xlog"
-)
-
-func TestHandleTCPWorkConnectionRejectsInvalidAddress(t *testing.T) {
-	workConn, peerConn := net.Pipe()
-	defer peerConn.Close()
-
-	pxy := &BaseProxy{
-		baseCfg: &v1.ProxyBaseConfig{},
-		xl:      xlog.New(),
-	}
-	pxy.HandleTCPWorkConnection(workConn, &msg.StartWorkConn{
-		SrcAddr: "[",
-		SrcPort: 1,
-	}, nil)
-
-	buffer := make([]byte, 1)
-	_, err := peerConn.Read(buffer)
-	require.ErrorIs(t, err, io.EOF)
-}
@@ -99,7 +99,6 @@ func NewWrapper(
 	eventHandler event.Handler,
 	msgTransporter transport.MessageTransporter,
 	vnetController *vnet.Controller,
-	udpPacketCodec string,
 ) *Wrapper {
 	baseInfo := cfg.GetBaseConfig()
 	xl := xlog.FromContextSafe(ctx).Spawn().AppendPrefix(baseInfo.Name)
@@ -128,7 +127,7 @@ func NewWrapper(
 		xl.Tracef("enable health check monitor")
 	}

-	pw.pxy = NewProxy(pw.ctx, pw.Cfg, clientCfg, encryptionKey, pw.msgTransporter, pw.vnetController, udpPacketCodec)
+	pw.pxy = NewProxy(pw.ctx, pw.Cfg, clientCfg, encryptionKey, pw.msgTransporter, pw.vnetController)
 	return pw
 }

@@ -267,9 +266,8 @@ func (pw *Wrapper) InWorkConn(workConn net.Conn, m *msg.StartWorkConn) {
 	xl := pw.xl
 	pw.mu.RLock()
 	pxy := pw.pxy
-	running := pw.Phase == ProxyPhaseRunning
 	pw.mu.RUnlock()
-	if pxy != nil && running {
+	if pxy != nil && pw.Phase == ProxyPhaseRunning {
 		xl.Debugf("start a new work connection, localAddr: %s remoteAddr: %s", workConn.LocalAddr().String(), workConn.RemoteAddr().String())
 		go pxy.InWorkConn(workConn, m)
 	} else {
@@ -1,76 +0,0 @@
-//go:build !frps
-
-package proxy
-
-import (
-	"io"
-	"net"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/util/xlog"
-)
-
-type closingWorkProxy struct {
-	Proxy
-	accepted atomic.Int64
-}
-
-func (p *closingWorkProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
-	p.accepted.Add(1)
-	_ = conn.Close()
-}
-
-func assertWrapperWorkConnClosed(t *testing.T, pw *Wrapper) {
-	t.Helper()
-	conn, peer := net.Pipe()
-	defer conn.Close()
-	defer peer.Close()
-	require.NoError(t, peer.SetReadDeadline(time.Now().Add(time.Second)))
-	pw.InWorkConn(conn, &msg.StartWorkConn{})
-	_, err := peer.Read(make([]byte, 1))
-	require.ErrorIs(t, err, io.EOF)
-}
-
-func TestWrapperInWorkConnPhaseSnapshot(t *testing.T) {
-	pxy := &closingWorkProxy{}
-	pw := &Wrapper{pxy: pxy, xl: xlog.New()}
-	for _, phase := range []string{ProxyPhaseNew, ProxyPhaseWaitStart, ProxyPhaseStartErr, ProxyPhaseCheckFailed, ProxyPhaseClosed} {
-		pw.Phase = phase
-		assertWrapperWorkConnClosed(t, pw)
-	}
-	require.Zero(t, pxy.accepted.Load(), "inactive proxy received a work connection")
-	pw.Phase = ProxyPhaseRunning
-	pw.pxy = nil
-	assertWrapperWorkConnClosed(t, pw)
-	pw.pxy = pxy
-	assertWrapperWorkConnClosed(t, pw)
-	require.Equal(t, int64(1), pxy.accepted.Load())
-
-	start, done := make(chan struct{}), make(chan struct{})
-	go func() {
-		<-start
-		for range 20000 {
-			pw.mu.Lock()
-			pw.Phase = ProxyPhaseRunning
-			pw.mu.Unlock()
-			pw.mu.Lock()
-			pw.Phase = ProxyPhaseClosed
-			pw.mu.Unlock()
-		}
-		close(done)
-	}()
-	close(start)
-	for range 10000 {
-		assertWrapperWorkConnClosed(t, pw)
-	}
-	select {
-	case <-done:
-	case <-time.After(3 * time.Second):
-		t.Fatal("phase writer did not finish")
-	}
-}
@@ -17,6 +17,7 @@
 package proxy

 import (
+	"io"
 	"net"
 	"reflect"
 	"strconv"
@@ -24,15 +25,17 @@ import (
 	"time"

 	"github.com/fatedier/golib/errors"
+	libio "github.com/fatedier/golib/io"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
 	"github.com/fatedier/frp/pkg/msg"
 	"github.com/fatedier/frp/pkg/proto/udp"
+	"github.com/fatedier/frp/pkg/util/limit"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
 )

 func init() {
-	RegisterProxyFactory(reflect.TypeFor[*v1.SUDPProxyConfig](), NewSUDPProxy)
+	RegisterProxyFactory(reflect.TypeOf(&v1.SUDPProxyConfig{}), NewSUDPProxy)
 }

 type SUDPProxy struct {
@@ -80,20 +83,27 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 	xl := pxy.xl
 	xl.Infof("incoming a new work connection for sudp proxy, %s", conn.RemoteAddr().String())

-	remote, _, err := pxy.wrapWorkConn(conn, pxy.encryptionKey)
+	var rwc io.ReadWriteCloser = conn
+	var err error
+	if pxy.limiter != nil {
+		rwc = libio.WrapReadWriteCloser(limit.NewReader(conn, pxy.limiter), limit.NewWriter(conn, pxy.limiter), func() error {
+			return conn.Close()
+		})
+	}
+	if pxy.cfg.Transport.UseEncryption {
+		rwc, err = libio.WithEncryption(rwc, pxy.encryptionKey)
 		if err != nil {
-		xl.Errorf("wrap work connection: %v", err)
+			conn.Close()
+			xl.Errorf("create encryption stream error: %v", err)
 			return
 		}
+	}
+	if pxy.cfg.Transport.UseCompression {
+		rwc = libio.WithCompression(rwc)
+	}
+	conn = netpkg.WrapReadWriteCloserToConn(rwc, conn)

-	workConn := netpkg.WrapReadWriteCloserToConn(remote, conn)
-	payloadRW, err := msg.NewUDPPacketReadWriter(workConn, pxy.clientCfg.Transport.WireProtocol, pxy.udpPacketCodec)
-	if err != nil {
-		xl.Errorf("create SUDP packet read writer: %v", err)
-		_ = workConn.Close()
-		return
-	}
-	payloadConn := msg.NewConn(workConn, payloadRW)
+	workConn := conn
 	readCh := make(chan *msg.UDPPacket, 1024)
 	sendCh := make(chan msg.Message, 1024)
 	isClose := false
@@ -116,7 +126,7 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 	}

 	// udp service <- frpc <- frps <- frpc visitor <- user
-	workConnReaderFn := func(payloadConn *msg.Conn, readCh chan *msg.UDPPacket) {
+	workConnReaderFn := func(conn net.Conn, readCh chan *msg.UDPPacket) {
 		defer closeFn()

 		for {
@@ -129,7 +139,7 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 			}

 			var udpMsg msg.UDPPacket
-			if errRet := payloadConn.ReadMsgInto(&udpMsg); errRet != nil {
+			if errRet := msg.ReadMsgInto(conn, &udpMsg); errRet != nil {
 				xl.Warnf("read from workConn for sudp error: %v", errRet)
 				return
 			}
@@ -144,7 +154,7 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 	}

 	// udp service -> frpc -> frps -> frpc visitor -> user
-	workConnSenderFn := func(payloadConn *msg.Conn, sendCh chan msg.Message) {
+	workConnSenderFn := func(conn net.Conn, sendCh chan msg.Message) {
 		defer func() {
 			closeFn()
 			xl.Infof("writer goroutine for sudp work connection closed")
@@ -155,12 +165,12 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 			switch m := rawMsg.(type) {
 			case *msg.UDPPacket:
 				xl.Tracef("frpc send udp package to frpc visitor, [udp local: %v, remote: %v], [tcp work conn local: %v, remote: %v]",
-					m.LocalAddr.String(), m.RemoteAddr.String(), payloadConn.LocalAddr().String(), payloadConn.RemoteAddr().String())
+					m.LocalAddr.String(), m.RemoteAddr.String(), conn.LocalAddr().String(), conn.RemoteAddr().String())
 			case *msg.Ping:
 				xl.Tracef("frpc send ping message to frpc visitor")
 			}

-			if errRet = payloadConn.WriteMsg(rawMsg); errRet != nil {
+			if errRet = msg.WriteMsg(conn, rawMsg); errRet != nil {
 				xl.Errorf("sudp work write error: %v", errRet)
 				return
 			}
@@ -191,8 +201,8 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 		}
 	}

-	go workConnSenderFn(payloadConn, sendCh)
-	go workConnReaderFn(payloadConn, readCh)
+	go workConnSenderFn(workConn, sendCh)
+	go workConnReaderFn(workConn, readCh)
 	go heartbeatFn(sendCh)

 	udp.Forwarder(pxy.localAddr, readCh, sendCh, int(pxy.clientCfg.UDPPacketSize), pxy.cfg.Transport.ProxyProtocolVersion)
@@ -17,21 +17,24 @@
 package proxy

 import (
+	"io"
 	"net"
 	"reflect"
 	"strconv"
 	"time"

 	"github.com/fatedier/golib/errors"
+	libio "github.com/fatedier/golib/io"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
 	"github.com/fatedier/frp/pkg/msg"
 	"github.com/fatedier/frp/pkg/proto/udp"
+	"github.com/fatedier/frp/pkg/util/limit"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
 )

 func init() {
-	RegisterProxyFactory(reflect.TypeFor[*v1.UDPProxyConfig](), NewUDPProxy)
+	RegisterProxyFactory(reflect.TypeOf(&v1.UDPProxyConfig{}), NewUDPProxy)
 }

 type UDPProxy struct {
@@ -91,32 +94,37 @@ func (pxy *UDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 	// close resources related with old workConn
 	pxy.Close()

-	remote, _, err := pxy.wrapWorkConn(conn, pxy.encryptionKey)
+	var rwc io.ReadWriteCloser = conn
+	var err error
+	if pxy.limiter != nil {
+		rwc = libio.WrapReadWriteCloser(limit.NewReader(conn, pxy.limiter), limit.NewWriter(conn, pxy.limiter), func() error {
+			return conn.Close()
+		})
+	}
+	if pxy.cfg.Transport.UseEncryption {
+		rwc, err = libio.WithEncryption(rwc, pxy.encryptionKey)
 		if err != nil {
-		xl.Errorf("wrap work connection: %v", err)
+			conn.Close()
+			xl.Errorf("create encryption stream error: %v", err)
 			return
 		}
-
-	workConn := netpkg.WrapReadWriteCloserToConn(remote, conn)
-	// Plain UDP payload follows the configured wire protocol for message framing.
-	payloadRW, err := msg.NewUDPPacketReadWriter(workConn, pxy.clientCfg.Transport.WireProtocol, pxy.udpPacketCodec)
-	if err != nil {
-		xl.Errorf("create UDP packet read writer: %v", err)
-		workConn.Close()
-		return
 	}
+	if pxy.cfg.Transport.UseCompression {
+		rwc = libio.WithCompression(rwc)
+	}
+	conn = netpkg.WrapReadWriteCloserToConn(rwc, conn)

 	pxy.mu.Lock()
-	pxy.workConn = workConn
+	pxy.workConn = conn
 	pxy.readCh = make(chan *msg.UDPPacket, 1024)
 	pxy.sendCh = make(chan msg.Message, 1024)
 	pxy.closed = false
 	pxy.mu.Unlock()

-	workConnReaderFn := func(rw msg.ReadWriter, readCh chan *msg.UDPPacket) {
+	workConnReaderFn := func(conn net.Conn, readCh chan *msg.UDPPacket) {
 		for {
 			var udpMsg msg.UDPPacket
-			if errRet := rw.ReadMsgInto(&udpMsg); errRet != nil {
+			if errRet := msg.ReadMsgInto(conn, &udpMsg); errRet != nil {
 				xl.Warnf("read from workConn for udp error: %v", errRet)
 				return
 			}
@@ -129,7 +137,7 @@ func (pxy *UDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 			}
 		}
 	}
-	workConnSenderFn := func(rw msg.ReadWriter, sendCh chan msg.Message) {
+	workConnSenderFn := func(conn net.Conn, sendCh chan msg.Message) {
 		defer func() {
 			xl.Infof("writer goroutine for udp work connection closed")
 		}()
@@ -141,7 +149,7 @@ func (pxy *UDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 			case *msg.Ping:
 				xl.Tracef("send ping message to udp workConn")
 			}
-			if errRet = rw.WriteMsg(rawMsg); errRet != nil {
+			if errRet = msg.WriteMsg(conn, rawMsg); errRet != nil {
 				xl.Errorf("udp work write error: %v", errRet)
 				return
 			}
@@ -160,8 +168,8 @@ func (pxy *UDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 		}
 	}

-	go workConnSenderFn(payloadRW, pxy.sendCh)
-	go workConnReaderFn(payloadRW, pxy.readCh)
+	go workConnSenderFn(pxy.workConn, pxy.sendCh)
+	go workConnReaderFn(pxy.workConn, pxy.readCh)
 	go heartbeatFn(pxy.sendCh)

 	// Call Forwarder with proxy protocol version (empty string means no proxy protocol)
@@ -22,7 +22,7 @@ import (
 	"reflect"
 	"time"

-	fmux "github.com/fatedier/yamux"
+	fmux "github.com/hashicorp/yamux"
 	"github.com/quic-go/quic-go"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
@@ -34,7 +34,7 @@ import (
 )

 func init() {
-	RegisterProxyFactory(reflect.TypeFor[*v1.XTCPProxyConfig](), NewXTCPProxy)
+	RegisterProxyFactory(reflect.TypeOf(&v1.XTCPProxyConfig{}), NewXTCPProxy)
 }

 type XTCPProxy struct {
@@ -57,7 +57,8 @@ func NewXTCPProxy(baseProxy *BaseProxy, cfg v1.ProxyConfigurer) Proxy {
 func (pxy *XTCPProxy) InWorkConn(conn net.Conn, startWorkConnMsg *msg.StartWorkConn) {
 	xl := pxy.xl
 	defer conn.Close()
-	natHoleSidMsg, err := readNatHoleSid(conn, pxy.clientCfg.Transport.WireProtocol)
+	var natHoleSidMsg msg.NatHoleSid
+	err := msg.ReadMsgInto(conn, &natHoleSidMsg)
 	if err != nil {
 		xl.Errorf("xtcp read from workConn error: %v", err)
 		return
@@ -130,15 +131,6 @@ func (pxy *XTCPProxy) InWorkConn(conn net.Conn, startWorkConnMsg *msg.StartWorkC
 	pxy.listenByQUIC(listenConn, raddr, startWorkConnMsg)
 }

-func readNatHoleSid(conn net.Conn, wireProtocol string) (*msg.NatHoleSid, error) {
-	workMsgConn := msg.NewConn(conn, msg.NewReadWriter(conn, wireProtocol))
-	var natHoleSidMsg msg.NatHoleSid
-	if err := workMsgConn.ReadMsgInto(&natHoleSidMsg); err != nil {
-		return nil, err
-	}
-	return &natHoleSidMsg, nil
-}
-
 func (pxy *XTCPProxy) listenByKCP(listenConn *net.UDPConn, raddr *net.UDPAddr, startWorkConnMsg *msg.StartWorkConn) {
 	xl := pxy.xl
 	listenConn.Close()
@@ -1,66 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//go:build !frps
-
-package proxy
-
-import (
-	"net"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/proto/wire"
-)
-
-func TestReadNatHoleSidUsesSelectedWireProtocol(t *testing.T) {
-	for _, tc := range []struct {
-		name         string
-		wireProtocol string
-	}{
-		{name: "v2", wireProtocol: wire.ProtocolV2},
-		{name: "v1", wireProtocol: wire.ProtocolV1},
-		{name: "default", wireProtocol: ""},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			client, server := net.Pipe()
-			defer client.Close()
-			defer server.Close()
-			setPipeDeadline(t, client, server)
-
-			errCh := make(chan error, 1)
-			go func() {
-				writer := msg.NewConn(server, msg.NewReadWriter(server, tc.wireProtocol))
-				errCh <- writer.WriteMsg(&msg.NatHoleSid{Sid: "sid"})
-			}()
-
-			out, err := readNatHoleSid(client, tc.wireProtocol)
-			require.NoError(t, err)
-			require.Equal(t, "sid", out.Sid)
-			require.NoError(t, <-errCh)
-		})
-	}
-}
-
-func setPipeDeadline(t *testing.T, conns ...net.Conn) {
-	t.Helper()
-
-	deadline := time.Now().Add(time.Second)
-	for _, conn := range conns {
-		require.NoError(t, conn.SetDeadline(deadline))
-	}
-}
@@ -19,10 +19,9 @@ import (
 	"errors"
 	"fmt"
 	"net"
-	"net/http"
 	"os"
+	"runtime"
 	"sync"
-	"sync/atomic"
 	"time"

 	"github.com/fatedier/golib/crypto"
@@ -33,12 +32,12 @@ import (
 	"github.com/fatedier/frp/pkg/config"
 	"github.com/fatedier/frp/pkg/config/source"
 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/config/v1/validation"
 	"github.com/fatedier/frp/pkg/msg"
 	"github.com/fatedier/frp/pkg/policy/security"
 	httppkg "github.com/fatedier/frp/pkg/util/http"
 	"github.com/fatedier/frp/pkg/util/log"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
+	"github.com/fatedier/frp/pkg/util/version"
 	"github.com/fatedier/frp/pkg/util/wait"
 	"github.com/fatedier/frp/pkg/util/xlog"
 	"github.com/fatedier/frp/pkg/vnet"
@@ -111,9 +110,6 @@ func setServiceOptionsDefault(options *ServiceOptions) error {
 // Service is the client service that connects to frps and provides proxy services.
 type Service struct {
 	ctlMu sync.RWMutex
-	// Stores gracefulShutdownDuration independently from ctlMu, because the
-	// graceful shutdown wait may hold ctlMu for an arbitrary duration.
-	gracefulShutdownDuration atomic.Int64
 	// manager control connection with server
 	ctl *Control
 	// Uniq id got from frps, it will be attached to loginMsg.
@@ -155,9 +151,7 @@ type Service struct {
 	ctx context.Context
 	// call cancel to stop service
 	cancel                   context.CancelCauseFunc
-	// Protect cancel publication and shutdown before the first Run.
-	lifecycleMu sync.Mutex
-	closed      bool
+	gracefulShutdownDuration time.Duration

 	connectorCreator func(context.Context, *v1.ClientCommonConfig) Connector
 	handleWorkConnCb func(*v1.ProxyBaseConfig, net.Conn, *msg.StartWorkConn) bool
@@ -168,6 +162,15 @@ func NewService(options ServiceOptions) (*Service, error) {
 		return nil, err
 	}

+	var webServer *httppkg.Server
+	if options.Common.WebServer.Port > 0 {
+		ws, err := httppkg.NewServer(options.Common.WebServer)
+		if err != nil {
+			return nil, err
+		}
+		webServer = ws
+	}
+
 	authRuntime, err := auth.BuildClientAuth(&options.Common.Auth)
 	if err != nil {
 		return nil, err
@@ -188,17 +191,6 @@ func NewService(options ServiceOptions) (*Service, error) {
 	proxyCfgs = config.CompleteProxyConfigurers(proxyCfgs)
 	visitorCfgs = config.CompleteVisitorConfigurers(visitorCfgs)

-	// Create the web server after all fallible steps so its listener is not
-	// leaked when an earlier error causes NewService to return.
-	var webServer *httppkg.Server
-	if options.Common.WebServer.Port > 0 {
-		ws, err := httppkg.NewServer(options.Common.WebServer)
-		if err != nil {
-			return nil, err
-		}
-		webServer = ws
-	}
-
 	s := &Service{
 		ctx:              context.Background(),
 		auth:             authRuntime,
@@ -228,20 +220,8 @@ func NewService(options ServiceOptions) (*Service, error) {

 func (svr *Service) Run(ctx context.Context) error {
 	ctx, cancel := context.WithCancelCause(ctx)
-	svr.lifecycleMu.Lock()
-	if svr.closed {
-		svr.lifecycleMu.Unlock()
-		cancel(nil)
-		return ctx.Err()
-	}
 	svr.ctx = xlog.NewContext(ctx, xlog.FromContextSafe(ctx))
 	svr.cancel = cancel
-	svr.lifecycleMu.Unlock()
-	defer cancel(nil)
-	defer svr.stop()
-	if err := ctx.Err(); err != nil {
-		return err
-	}

 	// set custom DNSServer
 	if svr.common.DNSServer != "" {
@@ -249,24 +229,22 @@ func (svr *Service) Run(ctx context.Context) error {
 	}

 	if svr.vnetController != nil {
-		vnetController := svr.vnetController
 		if err := svr.vnetController.Init(); err != nil {
 			log.Errorf("init virtual network controller error: %v", err)
 			return err
 		}
 		go func() {
 			log.Infof("virtual network controller start...")
-			if err := vnetController.Run(); err != nil && !errors.Is(err, net.ErrClosed) {
+			if err := svr.vnetController.Run(); err != nil {
 				log.Warnf("virtual network controller exit with error: %v", err)
 			}
 		}()
 	}

 	if svr.webServer != nil {
-		webServer := svr.webServer
 		go func() {
-			log.Infof("admin server listen on %s", webServer.Address())
-			if err := webServer.Run(); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			log.Infof("admin server listen on %s", svr.webServer.Address())
+			if err := svr.webServer.Run(); err != nil {
 				log.Warnf("admin server exit with error: %v", err)
 			}
 		}()
@@ -283,19 +261,12 @@ func (svr *Service) Run(ctx context.Context) error {
 	go svr.keepControllerWorking()

 	<-svr.ctx.Done()
+	svr.stop()
 	return nil
 }

 func (svr *Service) keepControllerWorking() {
-	// ctl is swapped under ctlMu in loopLoginUntilSuccess / stop; take a
-	// snapshot before waiting so stop's nil write does not race this read.
-	svr.ctlMu.RLock()
-	ctl := svr.ctl
-	svr.ctlMu.RUnlock()
-	if ctl == nil {
-		return
-	}
-	<-ctl.Done()
+	<-svr.ctl.Done()

 	// There is a situation where the login is successful but due to certain reasons,
 	// the control immediately exits. It is necessary to limit the frequency of reconnection in this case.
@@ -305,11 +276,8 @@ func (svr *Service) keepControllerWorking() {
 		// loopLoginUntilSuccess is another layer of loop that will continuously attempt to
 		// login to the server until successful.
 		svr.loopLoginUntilSuccess(20*time.Second, false)
-		svr.ctlMu.RLock()
-		ctl := svr.ctl
-		svr.ctlMu.RUnlock()
-		if ctl != nil {
-			<-ctl.Done()
+		if svr.ctl != nil {
+			<-svr.ctl.Done()
 			return false, errors.New("control is closed and try another loop")
 		}
 		// If the control is nil, it means that the login failed and the service is also closed.
@@ -328,20 +296,80 @@ func (svr *Service) keepControllerWorking() {
 	), true, svr.ctx.Done())
 }

+// login creates a connection to frps and registers it self as a client
+// conn: control connection
+// session: if it's not nil, using tcp mux
+func (svr *Service) login() (conn net.Conn, connector Connector, err error) {
+	xl := xlog.FromContextSafe(svr.ctx)
+	connector = svr.connectorCreator(svr.ctx, svr.common)
+	if err = connector.Open(); err != nil {
+		return nil, nil, err
+	}
+
+	defer func() {
+		if err != nil {
+			connector.Close()
+		}
+	}()
+
+	conn, err = connector.Connect()
+	if err != nil {
+		return
+	}
+
+	hostname, _ := os.Hostname()
+
+	loginMsg := &msg.Login{
+		Arch:      runtime.GOARCH,
+		Os:        runtime.GOOS,
+		Hostname:  hostname,
+		PoolCount: svr.common.Transport.PoolCount,
+		User:      svr.common.User,
+		ClientID:  svr.common.ClientID,
+		Version:   version.Full(),
+		Timestamp: time.Now().Unix(),
+		RunID:     svr.runID,
+		Metas:     svr.common.Metadatas,
+	}
+	if svr.clientSpec != nil {
+		loginMsg.ClientSpec = *svr.clientSpec
+	}
+
+	// Add auth
+	if err = svr.auth.Setter.SetLogin(loginMsg); err != nil {
+		return
+	}
+
+	if err = msg.WriteMsg(conn, loginMsg); err != nil {
+		return
+	}
+
+	var loginRespMsg msg.LoginResp
+	_ = conn.SetReadDeadline(time.Now().Add(10 * time.Second))
+	if err = msg.ReadMsgInto(conn, &loginRespMsg); err != nil {
+		return
+	}
+	_ = conn.SetReadDeadline(time.Time{})
+
+	if loginRespMsg.Error != "" {
+		err = fmt.Errorf("%s", loginRespMsg.Error)
+		xl.Errorf("%s", loginRespMsg.Error)
+		return
+	}
+
+	svr.runID = loginRespMsg.RunID
+	xl.AddPrefix(xlog.LogPrefix{Name: "runID", Value: svr.runID})
+
+	xl.Infof("login to server success, get run id [%s]", loginRespMsg.RunID)
+	return
+}
+
 func (svr *Service) loopLoginUntilSuccess(maxInterval time.Duration, firstLoginExit bool) {
 	xl := xlog.FromContextSafe(svr.ctx)

 	loginFunc := func() (bool, error) {
 		xl.Infof("try to connect to server...")
-		dialer := &controlSessionDialer{
-			ctx:              svr.ctx,
-			common:           svr.common,
-			auth:             svr.auth,
-			clientSpec:       svr.clientSpec,
-			vnetController:   svr.vnetController,
-			connectorCreator: svr.connectorCreator,
-		}
-		sessionCtx, err := dialer.Dial(svr.runID)
+		conn, connector, err := svr.login()
 		if err != nil {
 			xl.Warnf("connect to server error: %v", err)
 			if firstLoginExit {
@@ -350,19 +378,25 @@ func (svr *Service) loopLoginUntilSuccess(maxInterval time.Duration, firstLoginE
 			return false, err
 		}

-		svr.runID = sessionCtx.RunID
-		xl.AddPrefix(xlog.LogPrefix{Name: "runID", Value: svr.runID})
-		xl.Infof("login to server success, get run id [%s]", svr.runID)
-
 		svr.cfgMu.RLock()
 		proxyCfgs := svr.proxyCfgs
 		visitorCfgs := svr.visitorCfgs
 		svr.cfgMu.RUnlock()

+		connEncrypted := svr.clientSpec == nil || svr.clientSpec.Type != "ssh-tunnel"
+
+		sessionCtx := &SessionContext{
+			Common:         svr.common,
+			RunID:          svr.runID,
+			Conn:           conn,
+			ConnEncrypted:  connEncrypted,
+			Auth:           svr.auth,
+			Connector:      connector,
+			VnetController: svr.vnetController,
+		}
 		ctl, err := NewControl(svr.ctx, sessionCtx)
 		if err != nil {
-			sessionCtx.Conn.Close()
-			sessionCtx.Connector.Close()
+			conn.Close()
 			xl.Errorf("new control error: %v", err)
 			return false, err
 		}
@@ -400,7 +434,7 @@ func (svr *Service) UpdateAllConfigurer(proxyCfgs []v1.ProxyConfigurer, visitorC
 	svr.ctlMu.RUnlock()

 	if ctl != nil {
-		return ctl.UpdateAllConfigurer(proxyCfgs, visitorCfgs)
+		return svr.ctl.UpdateAllConfigurer(proxyCfgs, visitorCfgs)
 	}
 	return nil
 }
@@ -439,21 +473,8 @@ func (svr *Service) Close() {
 }

 func (svr *Service) GracefulClose(d time.Duration) {
-	svr.gracefulShutdownDuration.Store(int64(d))
-	svr.lifecycleMu.Lock()
-	if svr.closed {
-		svr.lifecycleMu.Unlock()
-		return
-	}
-	svr.closed = true
-	cancel := svr.cancel
-	svr.lifecycleMu.Unlock()
-	if cancel != nil {
-		// Once Run has claimed startup, it also owns cleanup.
-		cancel(nil)
-	} else {
-		svr.stop()
-	}
+	svr.gracefulShutdownDuration = d
+	svr.cancel(nil)
 }

 func (svr *Service) stop() {
@@ -469,18 +490,13 @@ func (svr *Service) stop() {
 	svr.ctlMu.Lock()
 	defer svr.ctlMu.Unlock()
 	if svr.ctl != nil {
-		d := time.Duration(svr.gracefulShutdownDuration.Load())
-		svr.ctl.GracefulClose(d)
+		svr.ctl.GracefulClose(svr.gracefulShutdownDuration)
 		svr.ctl = nil
 	}
 	if svr.webServer != nil {
 		svr.webServer.Close()
 		svr.webServer = nil
 	}
-	if svr.vnetController != nil {
-		_ = svr.vnetController.Stop()
-		svr.vnetController = nil
-	}
 }

 func (svr *Service) getProxyStatus(name string) (*proxy.WorkingStatus, bool) {
@@ -494,17 +510,6 @@ func (svr *Service) getProxyStatus(name string) (*proxy.WorkingStatus, bool) {
 	return ctl.pm.GetProxyStatus(name)
 }

-func (svr *Service) getVisitorCfg(name string) (v1.VisitorConfigurer, bool) {
-	svr.ctlMu.RLock()
-	ctl := svr.ctl
-	svr.ctlMu.RUnlock()
-
-	if ctl == nil {
-		return nil, false
-	}
-	return ctl.vm.GetVisitorCfg(name)
-}
-
 func (svr *Service) StatusExporter() StatusExporter {
 	return &statusExporterImpl{
 		getProxyStatusFunc: svr.getProxyStatus,
@@ -547,13 +552,6 @@ func (svr *Service) reloadConfigFromSourcesLocked() error {
 	proxies, visitors = config.FilterClientConfigurers(reloadCommon, proxies, visitors)
 	proxies = config.CompleteProxyConfigurers(proxies)
 	visitors = config.CompleteVisitorConfigurers(visitors)
-	requirements := validation.GetClientConfigRequirements(reloadCommon, proxies, visitors)
-	if svr.vnetController == nil && requirements.VirtualNet {
-		return errors.New(
-			"VirtualNet-dependent configuration requires a VirtualNet runtime enabled at startup; " +
-				"restart frpc after configuring featureGates.VirtualNet and virtualNet.address",
-		)
-	}

 	// Atomically replace the entire configuration
 	if err := svr.UpdateAllConfigurer(proxies, visitors); err != nil {
@@ -1,186 +0,0 @@
-package client
-
-import (
-	"context"
-	"io"
-	"net"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/fatedier/frp/pkg/config/source"
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/config/v1/validation"
-	"github.com/fatedier/frp/pkg/msg"
-)
-
-func newLifecycleTestService(t *testing.T, creator func(context.Context, *v1.ClientCommonConfig) Connector) (*Service, string) {
-	t.Helper()
-	svr, err := NewService(ServiceOptions{
-		Common: &v1.ClientCommonConfig{
-			LoginFailExit: new(false),
-			WebServer:     v1.WebServerConfig{Addr: "127.0.0.1", Port: getFreeTCPPort(t)},
-		},
-		ConfigSourceAggregator: source.NewAggregator(source.NewConfigSource()),
-		ConnectorCreator:       creator,
-	})
-	require.NoError(t, err)
-	_, err = validation.NewConfigValidator(nil).ValidateClientCommonConfig(svr.common)
-	require.NoError(t, err)
-	address := svr.webServer.Address()
-	assertLifecycleAdminPort(t, address, false)
-	return svr, address
-}
-
-func assertLifecycleAdminPort(t *testing.T, address string, released bool) {
-	t.Helper()
-	ln, err := net.Listen("tcp", address)
-	if ln != nil {
-		_ = ln.Close()
-	}
-	if released {
-		require.NoError(t, err, "admin listener was not released")
-	} else {
-		require.Error(t, err, "admin listener was not bound")
-	}
-}
-
-func waitLifecycleSignal(t *testing.T, done <-chan struct{}) {
-	t.Helper()
-	select {
-	case <-done:
-	case <-time.After(3 * time.Second):
-		t.Fatal("service lifecycle operation did not finish")
-	}
-}
-
-func TestServiceRunAfterEarlyShutdown(t *testing.T) {
-	for _, mode := range []string{"close before Run", "parent already cancelled"} {
-		t.Run(mode, func(t *testing.T) {
-			var attempts atomic.Int64
-			svr, address := newLifecycleTestService(t, func(context.Context, *v1.ClientCommonConfig) Connector {
-				attempts.Add(1)
-				return &failingConnector{err: net.ErrClosed}
-			})
-			// Detect startup's global DNS side effect without making DNS requests.
-			resolver := net.DefaultResolver
-			t.Cleanup(func() { net.DefaultResolver = resolver })
-			svr.common.DNSServer = "127.0.0.1:53"
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-			if mode == "close before Run" {
-				svr.Close()
-				assertLifecycleAdminPort(t, address, true)
-			} else {
-				cancel()
-			}
-			done := make(chan struct{})
-			var runErr error
-			go func() {
-				runErr = svr.Run(ctx)
-				close(done)
-			}()
-			waitLifecycleSignal(t, done)
-			require.ErrorIs(t, runErr, context.Canceled)
-			require.Zero(t, attempts.Load(), "closed service attempted login")
-			require.Same(t, resolver, net.DefaultResolver, "closed service changed DNS")
-			assertLifecycleAdminPort(t, address, true)
-		})
-	}
-}
-
-func TestServiceStartupShutdownLeavesCleanupToRun(t *testing.T) {
-	for _, mode := range []string{"Close", "parent cancellation"} {
-		t.Run(mode, func(t *testing.T) {
-			entered, resume := make(chan struct{}), make(chan struct{})
-			svr, address := newLifecycleTestService(t, func(ctx context.Context, _ *v1.ClientCommonConfig) Connector {
-				close(entered)
-				<-resume
-				return &failingConnector{err: ctx.Err()}
-			})
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-			defer close(resume)
-			runDone := make(chan struct{})
-			go func() { _ = svr.Run(ctx); close(runDone) }()
-			waitLifecycleSignal(t, entered)
-			closeDone := make(chan struct{})
-			go func() {
-				if mode == "Close" {
-					svr.Close()
-				} else {
-					cancel()
-				}
-				close(closeDone)
-			}()
-			waitLifecycleSignal(t, closeDone)
-			select {
-			case <-runDone:
-				t.Fatal("Run exited while startup still owned its resources")
-			default:
-			}
-			assertLifecycleAdminPort(t, address, false)
-			resume <- struct{}{}
-			waitLifecycleSignal(t, runDone)
-			assertLifecycleAdminPort(t, address, true)
-			require.ErrorIs(t, svr.ctx.Err(), context.Canceled)
-		})
-	}
-}
-
-func TestServiceShutdownAfterLogin(t *testing.T) {
-	for _, mode := range []string{"Close", "parent cancellation"} {
-		t.Run(mode, func(t *testing.T) {
-			clientConn, serverConn := net.Pipe()
-			defer clientConn.Close()
-			defer serverConn.Close()
-			connector := &testConnector{conn: clientConn}
-			svr, address := newLifecycleTestService(t, func(context.Context, *v1.ClientCommonConfig) Connector {
-				return connector
-			})
-			defer svr.Close()
-			peerDone := make(chan error, 1)
-			go func() {
-				rw := msg.NewV1ReadWriter(serverConn)
-				var login msg.Login
-				if err := rw.ReadMsgInto(&login); err != nil {
-					peerDone <- err
-					return
-				}
-				if err := rw.WriteMsg(&msg.LoginResp{RunID: "lifecycle-test"}); err != nil {
-					peerDone <- err
-					return
-				}
-				_, err := io.Copy(io.Discard, serverConn)
-				peerDone <- err
-			}()
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-			runDone := make(chan struct{})
-			var runErr error
-			go func() { runErr = svr.Run(ctx); close(runDone) }()
-			require.Eventually(t, func() bool {
-				svr.ctlMu.RLock()
-				defer svr.ctlMu.RUnlock()
-				return svr.ctl != nil
-			}, 3*time.Second, time.Millisecond, "login did not establish control")
-			if mode == "Close" {
-				svr.Close()
-			} else {
-				cancel()
-			}
-			waitLifecycleSignal(t, runDone)
-			require.NoError(t, runErr)
-			require.True(t, connector.closed.Load())
-			select {
-			case err := <-peerDone:
-				require.NoError(t, err)
-			case <-time.After(3 * time.Second):
-				t.Fatal("control connection was not released")
-			}
-			assertLifecycleAdminPort(t, address, true)
-		})
-	}
-}
@@ -1,95 +0,0 @@
-package client
-
-import (
-	"context"
-	"net"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/fatedier/frp/client/proxy"
-	"github.com/fatedier/frp/client/visitor"
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
-)
-
-type gracefulCloseTestConnector struct {
-	conn net.Conn
-}
-
-func (*gracefulCloseTestConnector) Connect() (*msg.Conn, error) { return nil, net.ErrClosed }
-func (c *gracefulCloseTestConnector) Close() error              { return c.conn.Close() }
-
-func newGracefulCloseTestService() *Service {
-	ctx := context.Background()
-	common := &v1.ClientCommonConfig{}
-	serverConn, clientConn := net.Pipe()
-	ctl := &Control{
-		ctx: ctx,
-		sessionCtx: &SessionContext{
-			Common:    common,
-			RunID:     "graceful-close-race",
-			Conn:      msg.NewConn(clientConn, msg.NewV1ReadWriter(clientConn)),
-			Connector: &gracefulCloseTestConnector{conn: serverConn},
-		},
-		doneCh: make(chan struct{}),
-	}
-	ctl.pm = proxy.NewManager(ctx, common, nil, nil, nil, "")
-	ctl.vm = visitor.NewManager(ctx, "graceful-close-race", common, nil, nil, nil, "")
-	return &Service{ctl: ctl, cancel: context.CancelCauseFunc(func(error) {})}
-}
-
-func TestGracefulCloseAndStopSynchronizeDuration(t *testing.T) {
-	for i := range 10000 {
-		svr := newGracefulCloseTestService()
-		start := make(chan struct{})
-		var wg sync.WaitGroup
-		wg.Add(2)
-		go func() {
-			defer wg.Done()
-			<-start
-			svr.GracefulClose(time.Duration(i))
-		}()
-		go func() {
-			defer wg.Done()
-			<-start
-			svr.stop()
-		}()
-		close(start)
-		wg.Wait()
-	}
-}
-
-func TestGracefulCloseDoesNotBlockDuringStop(t *testing.T) {
-	const gracefulDuration = 200 * time.Millisecond
-
-	svr := newGracefulCloseTestService()
-	svr.GracefulClose(gracefulDuration)
-	stopDone := make(chan struct{})
-	go func() {
-		svr.stop()
-		close(stopDone)
-	}()
-	defer func() {
-		select {
-		case <-stopDone:
-		case <-time.After(time.Second):
-			t.Error("stop did not finish")
-		}
-	}()
-
-	deadline := time.Now().Add(time.Second)
-	for svr.ctlMu.TryLock() {
-		svr.ctlMu.Unlock()
-		if time.Now().After(deadline) {
-			t.Fatal("stop did not acquire ctlMu")
-		}
-		time.Sleep(time.Millisecond)
-	}
-
-	start := time.Now()
-	svr.GracefulClose(0)
-	if elapsed := time.Since(start); elapsed >= gracefulDuration/2 {
-		t.Fatalf("GracefulClose blocked for %v while stop was waiting", elapsed)
-	}
-}
@@ -1,11 +1,7 @@
 package client

 import (
-	"context"
-	"errors"
-	"net"
 	"path/filepath"
-	"strconv"
 	"strings"
 	"testing"

@@ -13,106 +9,6 @@ import (
 	v1 "github.com/fatedier/frp/pkg/config/v1"
 )

-type failingConnector struct {
-	err error
-}
-
-func (c *failingConnector) Open() error {
-	return c.err
-}
-
-func (c *failingConnector) Connect() (net.Conn, error) {
-	return nil, c.err
-}
-
-func (c *failingConnector) Close() error {
-	return nil
-}
-
-func getFreeTCPPort(t *testing.T) int {
-	t.Helper()
-
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen on ephemeral port: %v", err)
-	}
-	defer ln.Close()
-
-	return ln.Addr().(*net.TCPAddr).Port
-}
-
-func TestRunStopsStartedComponentsOnInitialLoginFailure(t *testing.T) {
-	port := getFreeTCPPort(t)
-	agg := source.NewAggregator(source.NewConfigSource())
-
-	svr, err := NewService(ServiceOptions{
-		Common: &v1.ClientCommonConfig{
-			LoginFailExit: new(true),
-			WebServer: v1.WebServerConfig{
-				Addr: "127.0.0.1",
-				Port: port,
-			},
-		},
-		ConfigSourceAggregator: agg,
-		ConnectorCreator: func(context.Context, *v1.ClientCommonConfig) Connector {
-			return &failingConnector{err: errors.New("login boom")}
-		},
-	})
-	if err != nil {
-		t.Fatalf("new service: %v", err)
-	}
-
-	err = svr.Run(context.Background())
-	if err == nil {
-		t.Fatal("expected run error, got nil")
-	}
-	if !strings.Contains(err.Error(), "login boom") {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if svr.webServer != nil {
-		t.Fatal("expected web server to be cleaned up after initial login failure")
-	}
-
-	ln, err := net.Listen("tcp", net.JoinHostPort("127.0.0.1", strconv.Itoa(port)))
-	if err != nil {
-		t.Fatalf("expected admin port to be released: %v", err)
-	}
-	_ = ln.Close()
-}
-
-func TestNewServiceDoesNotLeakAdminListenerOnAuthBuildFailure(t *testing.T) {
-	port := getFreeTCPPort(t)
-	agg := source.NewAggregator(source.NewConfigSource())
-
-	_, err := NewService(ServiceOptions{
-		Common: &v1.ClientCommonConfig{
-			Auth: v1.AuthClientConfig{
-				Method: v1.AuthMethodOIDC,
-				OIDC: v1.AuthOIDCClientConfig{
-					TokenEndpointURL: "://bad",
-				},
-			},
-			WebServer: v1.WebServerConfig{
-				Addr: "127.0.0.1",
-				Port: port,
-			},
-		},
-		ConfigSourceAggregator: agg,
-	})
-	if err == nil {
-		t.Fatal("expected new service error, got nil")
-	}
-	if !strings.Contains(err.Error(), "auth.oidc.tokenEndpointURL") {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	ln, err := net.Listen("tcp", net.JoinHostPort("127.0.0.1", strconv.Itoa(port)))
-	if err != nil {
-		t.Fatalf("expected admin port to remain free: %v", err)
-	}
-	_ = ln.Close()
-}
-
 func TestUpdateConfigSourceRollsBackReloadCommonOnReplaceAllFailure(t *testing.T) {
 	prevCommon := &v1.ClientCommonConfig{User: "old-user"}
 	newCommon := &v1.ClientCommonConfig{User: "new-user"}
@@ -15,12 +15,18 @@
 package visitor

 import (
+	"fmt"
+	"io"
 	"net"
 	"strconv"
+	"time"

 	libio "github.com/fatedier/golib/io"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
+	"github.com/fatedier/frp/pkg/msg"
+	"github.com/fatedier/frp/pkg/naming"
+	"github.com/fatedier/frp/pkg/util/util"
 	"github.com/fatedier/frp/pkg/util/xlog"
 )

@@ -36,10 +42,10 @@ func (sv *STCPVisitor) Run() (err error) {
 		if err != nil {
 			return
 		}
-		go sv.acceptLoop(sv.l, "stcp local", sv.handleConn)
+		go sv.worker()
 	}

-	go sv.acceptLoop(sv.internalLn, "stcp internal", sv.handleConn)
+	go sv.internalConnWorker()

 	if sv.plugin != nil {
 		sv.plugin.Start()
@@ -51,10 +57,35 @@ func (sv *STCPVisitor) Close() {
 	sv.BaseVisitor.Close()
 }

+func (sv *STCPVisitor) worker() {
+	xl := xlog.FromContextSafe(sv.ctx)
+	for {
+		conn, err := sv.l.Accept()
+		if err != nil {
+			xl.Warnf("stcp local listener closed")
+			return
+		}
+		go sv.handleConn(conn)
+	}
+}
+
+func (sv *STCPVisitor) internalConnWorker() {
+	xl := xlog.FromContextSafe(sv.ctx)
+	for {
+		conn, err := sv.internalLn.Accept()
+		if err != nil {
+			xl.Warnf("stcp internal listener closed")
+			return
+		}
+		go sv.handleConn(conn)
+	}
+}
+
 func (sv *STCPVisitor) handleConn(userConn net.Conn) {
 	xl := xlog.FromContextSafe(sv.ctx)
 	var tunnelErr error
 	defer func() {
+		// If there was an error and connection supports CloseWithError, use it
 		if tunnelErr != nil {
 			if eConn, ok := userConn.(interface{ CloseWithError(error) error }); ok {
 				_ = eConn.CloseWithError(tunnelErr)
@@ -65,21 +96,62 @@ func (sv *STCPVisitor) handleConn(userConn net.Conn) {
 	}()

 	xl.Debugf("get a new stcp user connection")
-	visitorConn, err := sv.dialRawVisitorConn(sv.cfg.GetBaseConfig())
+	visitorConn, err := sv.helper.ConnectServer()
 	if err != nil {
-		xl.Warnf("dialRawVisitorConn error: %v", err)
 		tunnelErr = err
 		return
 	}
 	defer visitorConn.Close()

-	remote, recycleFn, err := wrapVisitorConn(visitorConn, sv.cfg.GetBaseConfig())
+	now := time.Now().Unix()
+	targetProxyName := naming.BuildTargetServerProxyName(sv.clientCfg.User, sv.cfg.ServerUser, sv.cfg.ServerName)
+	newVisitorConnMsg := &msg.NewVisitorConn{
+		RunID:          sv.helper.RunID(),
+		ProxyName:      targetProxyName,
+		SignKey:        util.GetAuthKey(sv.cfg.SecretKey, now),
+		Timestamp:      now,
+		UseEncryption:  sv.cfg.Transport.UseEncryption,
+		UseCompression: sv.cfg.Transport.UseCompression,
+	}
+	err = msg.WriteMsg(visitorConn, newVisitorConnMsg)
 	if err != nil {
-		xl.Warnf("wrapVisitorConn error: %v", err)
+		xl.Warnf("send newVisitorConnMsg to server error: %v", err)
 		tunnelErr = err
 		return
 	}
+
+	var newVisitorConnRespMsg msg.NewVisitorConnResp
+	_ = visitorConn.SetReadDeadline(time.Now().Add(10 * time.Second))
+	err = msg.ReadMsgInto(visitorConn, &newVisitorConnRespMsg)
+	if err != nil {
+		xl.Warnf("get newVisitorConnRespMsg error: %v", err)
+		tunnelErr = err
+		return
+	}
+	_ = visitorConn.SetReadDeadline(time.Time{})
+
+	if newVisitorConnRespMsg.Error != "" {
+		xl.Warnf("start new visitor connection error: %s", newVisitorConnRespMsg.Error)
+		tunnelErr = fmt.Errorf("%s", newVisitorConnRespMsg.Error)
+		return
+	}
+
+	var remote io.ReadWriteCloser
+	remote = visitorConn
+	if sv.cfg.Transport.UseEncryption {
+		remote, err = libio.WithEncryption(remote, []byte(sv.cfg.SecretKey))
+		if err != nil {
+			xl.Errorf("create encryption stream error: %v", err)
+			tunnelErr = err
+			return
+		}
+	}
+
+	if sv.cfg.Transport.UseCompression {
+		var recycleFn func()
+		remote, recycleFn = libio.WithCompressionFromPool(remote)
 		defer recycleFn()
+	}

 	libio.Join(userConn, remote)
 }
@@ -16,17 +16,21 @@ package visitor

 import (
 	"fmt"
+	"io"
 	"net"
 	"strconv"
 	"sync"
 	"time"

 	"github.com/fatedier/golib/errors"
+	libio "github.com/fatedier/golib/io"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
 	"github.com/fatedier/frp/pkg/msg"
+	"github.com/fatedier/frp/pkg/naming"
 	"github.com/fatedier/frp/pkg/proto/udp"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
+	"github.com/fatedier/frp/pkg/util/util"
 	"github.com/fatedier/frp/pkg/util/xlog"
 )

@@ -72,7 +76,6 @@ func (sv *SUDPVisitor) dispatcher() {

 	var (
 		visitorConn net.Conn
-		recycleFn   func()
 		err         error

 		firstPacket *msg.UDPPacket
@@ -90,17 +93,14 @@ func (sv *SUDPVisitor) dispatcher() {
 			return
 		}

-		visitorConn, recycleFn, err = sv.getNewVisitorConn()
+		visitorConn, err = sv.getNewVisitorConn()
 		if err != nil {
 			xl.Warnf("newVisitorConn to frps error: %v, try to reconnect", err)
 			continue
 		}

 		// visitorConn always be closed when worker done.
-		func() {
-			defer recycleFn()
 		sv.worker(visitorConn, firstPacket)
-		}()

 		select {
 		case <-sv.checkCloseCh:
@@ -113,22 +113,15 @@ func (sv *SUDPVisitor) dispatcher() {
 func (sv *SUDPVisitor) worker(workConn net.Conn, firstPacket *msg.UDPPacket) {
 	xl := xlog.FromContextSafe(sv.ctx)
 	xl.Debugf("starting sudp proxy worker")
-	payloadRW, err := msg.NewUDPPacketReadWriter(workConn, sv.clientCfg.Transport.WireProtocol, udpPacketCodecFromHelper(sv.helper))
-	if err != nil {
-		xl.Errorf("create SUDP packet read writer: %v", err)
-		_ = workConn.Close()
-		return
-	}
-	payloadConn := msg.NewConn(workConn, payloadRW)

 	wg := &sync.WaitGroup{}
 	wg.Add(2)
 	closeCh := make(chan struct{})

 	// udp service -> frpc -> frps -> frpc visitor -> user
-	workConnReaderFn := func(payloadConn *msg.Conn) {
+	workConnReaderFn := func(conn net.Conn) {
 		defer func() {
-			payloadConn.Close()
+			conn.Close()
 			close(closeCh)
 			wg.Done()
 		}()
@@ -140,13 +133,13 @@ func (sv *SUDPVisitor) worker(workConn net.Conn, firstPacket *msg.UDPPacket) {
 			)

 			// frpc will send heartbeat in workConn to frpc visitor for keeping alive
-			_ = payloadConn.SetReadDeadline(time.Now().Add(60 * time.Second))
-			if rawMsg, errRet = payloadConn.ReadMsg(); errRet != nil {
+			_ = conn.SetReadDeadline(time.Now().Add(60 * time.Second))
+			if rawMsg, errRet = msg.ReadMsg(conn); errRet != nil {
 				xl.Warnf("read from workconn for user udp conn error: %v", errRet)
 				return
 			}

-			_ = payloadConn.SetReadDeadline(time.Time{})
+			_ = conn.SetReadDeadline(time.Time{})
 			switch m := rawMsg.(type) {
 			case *msg.Ping:
 				xl.Debugf("frpc visitor get ping message from frpc")
@@ -164,15 +157,15 @@ func (sv *SUDPVisitor) worker(workConn net.Conn, firstPacket *msg.UDPPacket) {
 	}

 	// udp service <- frpc <- frps <- frpc visitor <- user
-	workConnSenderFn := func(payloadConn *msg.Conn) {
+	workConnSenderFn := func(conn net.Conn) {
 		defer func() {
-			payloadConn.Close()
+			conn.Close()
 			wg.Done()
 		}()

 		var errRet error
 		if firstPacket != nil {
-			if errRet = payloadConn.WriteMsg(firstPacket); errRet != nil {
+			if errRet = msg.WriteMsg(conn, firstPacket); errRet != nil {
 				xl.Warnf("sender goroutine for udp work connection closed: %v", errRet)
 				return
 			}
@@ -187,7 +180,7 @@ func (sv *SUDPVisitor) worker(workConn net.Conn, firstPacket *msg.UDPPacket) {
 					return
 				}

-				if errRet = payloadConn.WriteMsg(udpMsg); errRet != nil {
+				if errRet = msg.WriteMsg(conn, udpMsg); errRet != nil {
 					xl.Warnf("sender goroutine for udp work connection closed: %v", errRet)
 					return
 				}
@@ -198,24 +191,60 @@ func (sv *SUDPVisitor) worker(workConn net.Conn, firstPacket *msg.UDPPacket) {
 		}
 	}

-	go workConnReaderFn(payloadConn)
-	go workConnSenderFn(payloadConn)
+	go workConnReaderFn(workConn)
+	go workConnSenderFn(workConn)

 	wg.Wait()
 	xl.Infof("sudp worker is closed")
 }

-func (sv *SUDPVisitor) getNewVisitorConn() (net.Conn, func(), error) {
-	rawConn, err := sv.dialRawVisitorConn(sv.cfg.GetBaseConfig())
+func (sv *SUDPVisitor) getNewVisitorConn() (net.Conn, error) {
+	xl := xlog.FromContextSafe(sv.ctx)
+	visitorConn, err := sv.helper.ConnectServer()
 	if err != nil {
-		return nil, func() {}, err
+		return nil, fmt.Errorf("frpc connect frps error: %v", err)
 	}
-	rwc, recycleFn, err := wrapVisitorConn(rawConn, sv.cfg.GetBaseConfig())
+
+	now := time.Now().Unix()
+	targetProxyName := naming.BuildTargetServerProxyName(sv.clientCfg.User, sv.cfg.ServerUser, sv.cfg.ServerName)
+	newVisitorConnMsg := &msg.NewVisitorConn{
+		RunID:          sv.helper.RunID(),
+		ProxyName:      targetProxyName,
+		SignKey:        util.GetAuthKey(sv.cfg.SecretKey, now),
+		Timestamp:      now,
+		UseEncryption:  sv.cfg.Transport.UseEncryption,
+		UseCompression: sv.cfg.Transport.UseCompression,
+	}
+	err = msg.WriteMsg(visitorConn, newVisitorConnMsg)
 	if err != nil {
-		rawConn.Close()
-		return nil, func() {}, err
+		return nil, fmt.Errorf("frpc send newVisitorConnMsg to frps error: %v", err)
 	}
-	return netpkg.WrapReadWriteCloserToConn(rwc, rawConn), recycleFn, nil
+
+	var newVisitorConnRespMsg msg.NewVisitorConnResp
+	_ = visitorConn.SetReadDeadline(time.Now().Add(10 * time.Second))
+	err = msg.ReadMsgInto(visitorConn, &newVisitorConnRespMsg)
+	if err != nil {
+		return nil, fmt.Errorf("frpc read newVisitorConnRespMsg error: %v", err)
+	}
+	_ = visitorConn.SetReadDeadline(time.Time{})
+
+	if newVisitorConnRespMsg.Error != "" {
+		return nil, fmt.Errorf("start new visitor connection error: %s", newVisitorConnRespMsg.Error)
+	}
+
+	var remote io.ReadWriteCloser
+	remote = visitorConn
+	if sv.cfg.Transport.UseEncryption {
+		remote, err = libio.WithEncryption(remote, []byte(sv.cfg.SecretKey))
+		if err != nil {
+			xl.Errorf("create encryption stream error: %v", err)
+			return nil, err
+		}
+	}
+	if sv.cfg.Transport.UseCompression {
+		remote = libio.WithCompression(remote)
+	}
+	return netpkg.WrapReadWriteCloserToConn(remote, visitorConn), nil
 }

 func (sv *SUDPVisitor) Close() {
@@ -16,21 +16,13 @@ package visitor

 import (
 	"context"
-	"fmt"
-	"io"
 	"net"
 	"sync"
-	"time"
-
-	libio "github.com/fatedier/golib/io"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
-	"github.com/fatedier/frp/pkg/naming"
 	plugin "github.com/fatedier/frp/pkg/plugin/visitor"
 	"github.com/fatedier/frp/pkg/transport"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
-	"github.com/fatedier/frp/pkg/util/util"
 	"github.com/fatedier/frp/pkg/util/xlog"
 	"github.com/fatedier/frp/pkg/vnet"
 )
@@ -38,7 +30,7 @@ import (
 // Helper wraps some functions for visitor to use.
 type Helper interface {
 	// ConnectServer directly connects to the frp server.
-	ConnectServer() (*msg.Conn, error)
+	ConnectServer() (net.Conn, error)
 	// TransferConn transfers the connection to another visitor.
 	TransferConn(string, net.Conn) error
 	// MsgTransporter returns the message transporter that is used to send and receive messages
@@ -50,17 +42,6 @@ type Helper interface {
 	RunID() string
 }

-type udpPacketCodecProvider interface {
-	UDPPacketCodec() string
-}
-
-func udpPacketCodecFromHelper(helper Helper) string {
-	if provider, ok := helper.(udpPacketCodecProvider); ok {
-		return provider.UDPPacketCodec()
-	}
-	return ""
-}
-
 // Visitor is used for forward traffics from local port tot remote service.
 type Visitor interface {
 	Run() error
@@ -138,18 +119,6 @@ func (v *BaseVisitor) AcceptConn(conn net.Conn) error {
 	return v.internalLn.PutConn(conn)
 }

-func (v *BaseVisitor) acceptLoop(l net.Listener, name string, handleConn func(net.Conn)) {
-	xl := xlog.FromContextSafe(v.ctx)
-	for {
-		conn, err := l.Accept()
-		if err != nil {
-			xl.Warnf("%s listener closed", name)
-			return
-		}
-		go handleConn(conn)
-	}
-}
-
 func (v *BaseVisitor) Close() {
 	if v.l != nil {
 		v.l.Close()
@@ -161,57 +130,3 @@ func (v *BaseVisitor) Close() {
 		v.plugin.Close()
 	}
 }
-
-func (v *BaseVisitor) dialRawVisitorConn(cfg *v1.VisitorBaseConfig) (net.Conn, error) {
-	visitorConn, err := v.helper.ConnectServer()
-	if err != nil {
-		return nil, fmt.Errorf("connect to server error: %v", err)
-	}
-
-	now := time.Now().Unix()
-	targetProxyName := naming.BuildTargetServerProxyName(v.clientCfg.User, cfg.ServerUser, cfg.ServerName)
-	newVisitorConnMsg := &msg.NewVisitorConn{
-		RunID:          v.helper.RunID(),
-		ProxyName:      targetProxyName,
-		SignKey:        util.GetAuthKey(cfg.SecretKey, now),
-		Timestamp:      now,
-		UseEncryption:  cfg.Transport.UseEncryption,
-		UseCompression: cfg.Transport.UseCompression,
-	}
-	err = visitorConn.WriteMsg(newVisitorConnMsg)
-	if err != nil {
-		visitorConn.Close()
-		return nil, fmt.Errorf("send newVisitorConnMsg to server error: %v", err)
-	}
-
-	_ = visitorConn.SetReadDeadline(time.Now().Add(10 * time.Second))
-	var newVisitorConnRespMsg msg.NewVisitorConnResp
-	err = visitorConn.ReadMsgInto(&newVisitorConnRespMsg)
-	if err != nil {
-		visitorConn.Close()
-		return nil, fmt.Errorf("read newVisitorConnRespMsg error: %v", err)
-	}
-	_ = visitorConn.SetReadDeadline(time.Time{})
-
-	if newVisitorConnRespMsg.Error != "" {
-		visitorConn.Close()
-		return nil, fmt.Errorf("start new visitor connection error: %s", newVisitorConnRespMsg.Error)
-	}
-	return visitorConn, nil
-}
-
-func wrapVisitorConn(conn io.ReadWriteCloser, cfg *v1.VisitorBaseConfig) (io.ReadWriteCloser, func(), error) {
-	rwc := conn
-	if cfg.Transport.UseEncryption {
-		var err error
-		rwc, err = libio.WithEncryption(rwc, []byte(cfg.SecretKey))
-		if err != nil {
-			return nil, func() {}, fmt.Errorf("create encryption stream error: %v", err)
-		}
-	}
-	recycleFn := func() {}
-	if cfg.Transport.UseCompression {
-		rwc, recycleFn = libio.WithCompressionFromPool(rwc)
-	}
-	return rwc, recycleFn, nil
-}
@@ -25,7 +25,6 @@ import (
 	"github.com/samber/lo"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/msg"
 	"github.com/fatedier/frp/pkg/transport"
 	"github.com/fatedier/frp/pkg/util/xlog"
 	"github.com/fatedier/frp/pkg/vnet"
@@ -50,15 +49,10 @@ func NewManager(
 	ctx context.Context,
 	runID string,
 	clientCfg *v1.ClientCommonConfig,
-	connectServer func() (*msg.Conn, error),
+	connectServer func() (net.Conn, error),
 	msgTransporter transport.MessageTransporter,
 	vnetController *vnet.Controller,
-	udpPacketCodecs ...string,
 ) *Manager {
-	udpPacketCodec := ""
-	if len(udpPacketCodecs) > 0 {
-		udpPacketCodec = udpPacketCodecs[0]
-	}
 	m := &Manager{
 		clientCfg:     clientCfg,
 		cfgs:          make(map[string]v1.VisitorConfigurer),
@@ -73,7 +67,6 @@ func NewManager(
 		vnetController:  vnetController,
 		transferConnFn:  m.TransferConn,
 		runID:           runID,
-		udpPacketCodec:  udpPacketCodec,
 	}
 	return m
 }
@@ -198,23 +191,15 @@ func (vm *Manager) TransferConn(name string, conn net.Conn) error {
 	return v.AcceptConn(conn)
 }

-func (vm *Manager) GetVisitorCfg(name string) (v1.VisitorConfigurer, bool) {
-	vm.mu.RLock()
-	defer vm.mu.RUnlock()
-	cfg, ok := vm.cfgs[name]
-	return cfg, ok
-}
-
 type visitorHelperImpl struct {
-	connectServerFn func() (*msg.Conn, error)
+	connectServerFn func() (net.Conn, error)
 	msgTransporter  transport.MessageTransporter
 	vnetController  *vnet.Controller
 	transferConnFn  func(name string, conn net.Conn) error
 	runID           string
-	udpPacketCodec  string
 }

-func (v *visitorHelperImpl) ConnectServer() (*msg.Conn, error) {
+func (v *visitorHelperImpl) ConnectServer() (net.Conn, error) {
 	return v.connectServerFn()
 }

@@ -233,7 +218,3 @@ func (v *visitorHelperImpl) VNetController() *vnet.Controller {
 func (v *visitorHelperImpl) RunID() string {
 	return v.runID
 }
-
-func (v *visitorHelperImpl) UDPPacketCodec() string {
-	return v.udpPacketCodec
-}
@@ -25,7 +25,7 @@ import (
 	"time"

 	libio "github.com/fatedier/golib/io"
-	fmux "github.com/fatedier/yamux"
+	fmux "github.com/hashicorp/yamux"
 	quic "github.com/quic-go/quic-go"
 	"golang.org/x/time/rate"

@@ -65,10 +65,10 @@ func (sv *XTCPVisitor) Run() (err error) {
 		if err != nil {
 			return
 		}
-		go sv.acceptLoop(sv.l, "xtcp local", sv.handleConn)
+		go sv.worker()
 	}

-	go sv.acceptLoop(sv.internalLn, "xtcp internal", sv.handleConn)
+	go sv.internalConnWorker()
 	go sv.processTunnelStartEvents()
 	if sv.cfg.KeepTunnelOpen {
 		sv.retryLimiter = rate.NewLimiter(rate.Every(time.Hour/time.Duration(sv.cfg.MaxRetriesAnHour)), sv.cfg.MaxRetriesAnHour)
@@ -93,6 +93,30 @@ func (sv *XTCPVisitor) Close() {
 	}
 }

+func (sv *XTCPVisitor) worker() {
+	xl := xlog.FromContextSafe(sv.ctx)
+	for {
+		conn, err := sv.l.Accept()
+		if err != nil {
+			xl.Warnf("xtcp local listener closed")
+			return
+		}
+		go sv.handleConn(conn)
+	}
+}
+
+func (sv *XTCPVisitor) internalConnWorker() {
+	xl := xlog.FromContextSafe(sv.ctx)
+	for {
+		conn, err := sv.internalLn.Accept()
+		if err != nil {
+			xl.Warnf("xtcp internal listener closed")
+			return
+		}
+		go sv.handleConn(conn)
+	}
+}
+
 func (sv *XTCPVisitor) processTunnelStartEvents() {
 	for {
 		select {
@@ -182,14 +206,20 @@ func (sv *XTCPVisitor) handleConn(userConn net.Conn) {
 		return
 	}

-	muxConnRWCloser, recycleFn, err := wrapVisitorConn(tunnelConn, sv.cfg.GetBaseConfig())
+	var muxConnRWCloser io.ReadWriteCloser = tunnelConn
+	if sv.cfg.Transport.UseEncryption {
+		muxConnRWCloser, err = libio.WithEncryption(muxConnRWCloser, []byte(sv.cfg.SecretKey))
 		if err != nil {
-		xl.Errorf("%v", err)
-		tunnelConn.Close()
+			xl.Errorf("create encryption stream error: %v", err)
 			tunnelErr = err
 			return
 		}
+	}
+	if sv.cfg.Transport.UseCompression {
+		var recycleFn func()
+		muxConnRWCloser, recycleFn = libio.WithCompressionFromPool(muxConnRWCloser)
 		defer recycleFn()
+	}

 	_, _, errs := libio.Join(userConn, muxConnRWCloser)
 	xl.Debugf("join connections closed")
@@ -343,7 +373,6 @@ func (ks *KCPTunnelSession) Init(listenConn *net.UDPConn, raddr *net.UDPAddr) er
 	}
 	remote, err := netpkg.NewKCPConnFromUDP(lConn, true, raddr.String())
 	if err != nil {
-		lConn.Close()
 		return fmt.Errorf("create kcp connection from udp connection error: %v", err)
 	}

@@ -47,7 +47,7 @@ var natholeDiscoveryCmd = &cobra.Command{
 	Use:   "discover",
 	Short: "Discover nathole information from stun server",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		// ignore error here, because we can use command line parameters
+		// ignore error here, because we can use command line pameters
 		cfg, _, _, _, err := config.LoadClientConfig(cfgFile, strictConfigMode)
 		if err != nil {
 			cfg = &v1.ClientCommonConfig{}
@@ -33,6 +33,7 @@ import (
 	"github.com/fatedier/frp/pkg/config/source"
 	v1 "github.com/fatedier/frp/pkg/config/v1"
 	"github.com/fatedier/frp/pkg/config/v1/validation"
+	"github.com/fatedier/frp/pkg/policy/featuregate"
 	"github.com/fatedier/frp/pkg/policy/security"
 	"github.com/fatedier/frp/pkg/util/log"
 	"github.com/fatedier/frp/pkg/util/version"
@@ -130,6 +131,12 @@ func runClient(cfgFilePath string, unsafeFeatures *security.UnsafeFeatures) erro
 			"please use yaml/json/toml format instead!\n")
 	}

+	if len(result.Common.FeatureGates) > 0 {
+		if err := featuregate.SetFromMap(result.Common.FeatureGates); err != nil {
+			return err
+		}
+	}
+
 	return runClientWithAggregator(result, unsafeFeatures, cfgFilePath)
 }

@@ -29,18 +29,6 @@ func init() {
 	rootCmd.AddCommand(verifyCmd)
 }

-func verifyClientConfig(
-	configFile string,
-	strict bool,
-	unsafeFeatures *security.UnsafeFeatures,
-) (validation.Warning, error) {
-	cliCfg, proxyCfgs, visitorCfgs, _, err := config.LoadClientConfig(configFile, strict)
-	if err != nil {
-		return nil, err
-	}
-	return validation.ValidateAllClientConfig(cliCfg, proxyCfgs, visitorCfgs, unsafeFeatures)
-}
-
 var verifyCmd = &cobra.Command{
 	Use:   "verify",
 	Short: "Verify that the configures is valid",
@@ -50,8 +38,13 @@ var verifyCmd = &cobra.Command{
 			return nil
 		}

+		cliCfg, proxyCfgs, visitorCfgs, _, err := config.LoadClientConfig(cfgFile, strictConfigMode)
+		if err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
 		unsafeFeatures := security.NewUnsafeFeatures(allowUnsafe)
-		warning, err := verifyClientConfig(cfgFile, strictConfigMode, unsafeFeatures)
+		warning, err := validation.ValidateAllClientConfig(cliCfg, proxyCfgs, visitorCfgs, unsafeFeatures)
 		if warning != nil {
 			fmt.Printf("WARNING: %v\n", warning)
 		}
@@ -1,67 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package sub
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/fatedier/frp/pkg/policy/security"
-)
-
-func TestVerifyClientConfigFeatureGates(t *testing.T) {
-	tests := []struct {
-		name    string
-		content string
-		wantErr string
-	}{
-		{
-			name: "VirtualNet enabled",
-			content: `featureGates = { VirtualNet = true }
-virtualNet.address = "100.86.0.4/24"
-`,
-		},
-		{
-			name: "VirtualNet disabled",
-			content: `featureGates = { VirtualNet = false }
-virtualNet.address = "100.86.0.4/24"
-`,
-			wantErr: "VirtualNet feature is not enabled",
-		},
-		{
-			name:    "unknown feature gate",
-			content: `featureGates = { UnknownFeature = true }`,
-			wantErr: "unrecognized feature gate: UnknownFeature",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			configFile := filepath.Join(t.TempDir(), "frpc.toml")
-			require.NoError(t, os.WriteFile(configFile, []byte(tc.content), 0o600))
-
-			warning, err := verifyClientConfig(configFile, true, security.NewUnsafeFeatures(nil))
-			require.NoError(t, warning)
-			if tc.wantErr == "" {
-				require.NoError(t, err)
-				return
-			}
-			require.ErrorContains(t, err, tc.wantErr)
-		})
-	}
-}
@@ -103,10 +103,6 @@ transport.poolCount = 5
 # supports tcp, kcp, quic, websocket and wss now, default is tcp
 transport.protocol = "tcp"

-# FRP wire protocol used inside the selected transport.
-# supports v1 and v2, default is v1. v2 requires frps support and must be enabled explicitly.
-# transport.wireProtocol = "v1"
-
 # set client binding ip when connect server, default is empty.
 # only when protocol = tcp or websocket, the value will be used.
 transport.connectServerLocalIP = "0.0.0.0"
@@ -1,124 +0,0 @@
-# Release Process
-
-## 1. Update Release Notes
-
-Edit `Release.md` in the project root with the changes for this version:
-
-```markdown
-## Features
-* ...
-
-## Improvements
-* ...
-
-## Fixes
-* ...
-```
-
-This file is used by GoReleaser as the GitHub Release body.
-
-## 2. Bump Version
-
-Update the version string in `pkg/util/version/version.go`:
-
-```go
-var version = "0.X.0"
-```
-
-Commit and push to `dev`:
-
-```bash
-git add pkg/util/version/version.go Release.md
-git commit -m "bump version to vX.Y.Z"
-git push origin dev
-```
-
-## 3. Pre-release Validation
-
-Run the standard e2e suite locally:
-
-```bash
-make e2e
-```
-
-For releases that touch compatibility-sensitive areas such as login, control
-connections, work connections, visitors, transport, or wire protocol handling,
-also run the manual compatibility e2e suite:
-
-```bash
-make e2e-compatibility
-make e2e-compatibility-floor
-```
-
-`make e2e-compatibility` builds the current `frps` and `frpc`, resolves the
-recent stable release baselines from GitHub, downloads or reuses their binaries,
-and tests current binaries against those historical releases. The default number
-of recent baselines is controlled by `FRP_COMPAT_BASELINE_COUNT` in the
-`Makefile`.
-
-Downloaded release binaries are cached under:
-
-```text
-.cache/e2e-compat/<version>/<os>_<arch>/
-```
-
-For a release validation run that must be exactly reproducible, pass an explicit
-baseline matrix instead of using the floating recent-release list:
-
-```bash
-FRP_COMPAT_BASELINE_VERSIONS="0.X.0 0.Y.0" make e2e-compatibility
-```
-
-Use `make e2e-compatibility-smoke` for a quick single-baseline check while
-iterating locally. If GitHub release metadata requests are rate-limited, set
-`GITHUB_TOKEN` or use `FRP_COMPAT_BASELINE_VERSIONS`.
-
-The compatibility floor is a support-policy decision, not a value that should
-change every release. Update `FRP_COMPAT_FLOOR_VERSION` only when the declared
-compatibility window changes.
-
-## 4. Merge dev → master
-
-Create a PR from `dev` to `master`:
-
-```bash
-gh pr create --base master --head dev --title "bump version"
-```
-
-Wait for CI to pass, then merge using **merge commit** (not squash).
-
-## 5. Tag the Release
-
-```bash
-git checkout master
-git pull origin master
-git tag -a vX.Y.Z -m "bump version"
-git push origin vX.Y.Z
-```
-
-## 6. Trigger GoReleaser
-
-Manually trigger the `goreleaser` workflow in GitHub Actions:
-
-```bash
-gh workflow run goreleaser --ref master
-```
-
-GoReleaser will:
-1. Run `package.sh` to cross-compile all platforms and create archives
-2. Create a GitHub Release with all packages, using `Release.md` as release notes
-
-## Key Files
-
-| File | Purpose |
-|------|---------|
-| `pkg/util/version/version.go` | Version string |
-| `Release.md` | Release notes (read by GoReleaser) |
-| `.goreleaser.yml` | GoReleaser config |
-| `package.sh` | Cross-compile and packaging script |
-| `.github/workflows/goreleaser.yml` | GitHub Actions workflow (manual trigger) |
-
-## Versioning
-
- Minor release: `v0.X.0`
- Patch release: `v0.X.Y` (e.g., `v0.62.1`)
@@ -1,38 +0,0 @@
-# Deprecations
-
-This document tracks deprecated features and APIs that are still shipped but scheduled for removal. Maintainers should review this list before each release to decide whether any items are due for removal.
-
-For the version compatibility policy that bounds these support windows, see the latest `Release.md`.
-
-## Active
-
-### Wire protocol v1
-
- **Deprecated since:** v0.70.0 (planned, when v2 becomes the default).
- **Removal target:** v0.78.0 or later. v0.69.0 (the last release where v1 is the default) is supported until v0.78.0 is released, so v0.77.0 is the last release that must keep v1 support.
- **Replacement:** wire protocol v2 (`transport.wireProtocol = "v2"` in frpc).
- **Code references:** v1 message types and codec under `pkg/msg/` and the protocol negotiation path in `client/` and `server/`.
- **Notes:** Removing v1 will also drop compatibility with any frpc/frps that does not negotiate v2.
-
-### INI configuration format
-
- **Deprecated since:** predates this document; startup warning has been in place for several releases.
- **Removal target:** TBD.
- **Replacement:** YAML / JSON / TOML.
- **Code references:**
-  - `cmd/frpc/sub/root.go` — frpc startup warning.
-  - `cmd/frps/root.go` — frps startup warning.
-  - `pkg/config/legacy/` — legacy INI parser; remove together with the warnings.
-
-### Visitor connections without `runID`
-
- **Deprecated since:** v0.50.0 (when `runID` was introduced).
- **Removal target:** TBD.
- **Replacement:** require `runID` on every visitor connection.
- **Code references:**
-  - `server/service.go` — `RegisterVisitorConn` still accepts empty `runID` for backward compatibility.
- **Notes:** Removal will break frpc clients released before v0.50.0. Schedule for a release where dropping pre-v0.50.0 frpc is acceptable.
-
-## Removed
-
-_None yet._
@@ -1,16 +1,11 @@
 FROM node:22 AS web-builder

-WORKDIR /web
-COPY web/package.json web/package-lock.json ./
-COPY web/shared/package.json ./shared/package.json
-COPY web/frpc/package.json ./frpc/package.json
-COPY web/frps/package.json ./frps/package.json
-RUN npm ci
-COPY web/shared/ ./shared/
-COPY web/frpc/ ./frpc/
-RUN npm run build --workspace frpc
+WORKDIR /web/frpc
+COPY web/frpc/ ./
+RUN npm install
+RUN npm run build

-FROM golang:1.26 AS building
+FROM golang:1.25 AS building

 COPY . /building
 COPY --from=web-builder /web/frpc/dist /building/web/frpc/dist
@@ -1,16 +1,11 @@
 FROM node:22 AS web-builder

-WORKDIR /web
-COPY web/package.json web/package-lock.json ./
-COPY web/shared/package.json ./shared/package.json
-COPY web/frpc/package.json ./frpc/package.json
-COPY web/frps/package.json ./frps/package.json
-RUN npm ci
-COPY web/shared/ ./shared/
-COPY web/frps/ ./frps/
-RUN npm run build --workspace frps
+WORKDIR /web/frps
+COPY web/frps/ ./
+RUN npm install
+RUN npm run build

-FROM golang:1.26 AS building
+FROM golang:1.25 AS building

 COPY . /building
 COPY --from=web-builder /web/frps/dist /building/web/frps/dist
@@ -1,49 +1,48 @@
 module github.com/fatedier/frp

-go 1.26.0
+go 1.25.0

 require (
 	github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5
-	github.com/coreos/go-oidc/v3 v3.18.0
-	github.com/fatedier/golib v0.8.2
-	github.com/fatedier/yamux v0.2.0
+	github.com/coreos/go-oidc/v3 v3.14.1
+	github.com/fatedier/golib v0.5.1
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.1
 	github.com/gorilla/websocket v1.5.0
+	github.com/hashicorp/yamux v0.1.1
 	github.com/onsi/ginkgo/v2 v2.23.4
 	github.com/onsi/gomega v1.36.3
 	github.com/pelletier/go-toml/v2 v2.2.0
-	github.com/pires/go-proxyproto v0.15.0
+	github.com/pion/stun/v2 v2.0.0
+	github.com/pires/go-proxyproto v0.7.0
 	github.com/prometheus/client_golang v1.19.1
-	github.com/quic-go/quic-go v0.60.0
+	github.com/quic-go/quic-go v0.55.0
 	github.com/rodaine/table v1.2.0
 	github.com/samber/lo v1.47.0
 	github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8
 	github.com/spf13/cobra v1.8.0
 	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.11.1
+	github.com/stretchr/testify v1.10.0
 	github.com/tidwall/gjson v1.17.1
 	github.com/vishvananda/netlink v1.3.0
 	github.com/xtaci/kcp-go/v5 v5.6.13
-	golang.org/x/crypto v0.56.0
-	golang.org/x/net v0.57.0
-	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sync v0.22.0
-	golang.org/x/sys v0.47.0
-	golang.org/x/time v0.10.0
+	golang.org/x/crypto v0.41.0
+	golang.org/x/net v0.43.0
+	golang.org/x/oauth2 v0.28.0
+	golang.org/x/sync v0.16.0
+	golang.org/x/time v0.5.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	gopkg.in/ini.v1 v1.67.0
 	k8s.io/apimachinery v0.28.8
 	k8s.io/client-go v0.28.8
-	k8s.io/utils v0.0.0-20230406110748-d93618cff8a2
 )

 require (
-	github.com/Azure/go-ntlmssp v0.1.1 // indirect
+	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
+	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
@@ -52,6 +51,10 @@ require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.6 // indirect
 	github.com/klauspost/reedsolomon v1.12.0 // indirect
+	github.com/pion/dtls/v2 v2.2.7 // indirect
+	github.com/pion/logging v0.2.2 // indirect
+	github.com/pion/transport/v2 v2.2.1 // indirect
+	github.com/pion/transport/v3 v3.0.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.5.0 // indirect
@@ -64,12 +67,18 @@ require (
 	github.com/tjfoc/gmsm v1.4.1 // indirect
 	github.com/vishvananda/netns v0.0.4 // indirect
 	go.uber.org/automaxprocs v1.6.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
-	golang.org/x/tools v0.48.0 // indirect
+	golang.org/x/mod v0.27.0 // indirect
+	golang.org/x/sys v0.35.0 // indirect
+	golang.org/x/text v0.28.0 // indirect
+	golang.org/x/tools v0.36.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/yaml v1.3.0 // indirect
 )
+
+// TODO(fatedier): Temporary use the modified version, update to the official version after merging into the official repository.
+replace github.com/hashicorp/yamux => github.com/fatedier/yamux v0.0.0-20250825093530-d0154be01cd6
@@ -1,6 +1,6 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-github.com/Azure/go-ntlmssp v0.1.1 h1:l+FM/EEMb0U9QZE7mKNEDw5Mu3mFiaa2GKOoTSsNDPw=
-github.com/Azure/go-ntlmssp v0.1.1/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
@@ -11,8 +11,8 @@ github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/coreos/go-oidc/v3 v3.18.0 h1:V9orjXynvu5wiC9SemFTWnG4F45v403aIcjWo0d41+A=
-github.com/coreos/go-oidc/v3 v3.18.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=
+github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
+github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
 github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -20,12 +20,12 @@ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/fatedier/golib v0.8.2 h1:02n2Dg7KJ7rR7p7n4/6hBUjaLQf2J7EiHYZQsgGTvww=
-github.com/fatedier/golib v0.8.2/go.mod h1:ArUGvPg2cOw/py2RAuBt46nNZH2VQ5Z70p109MAZpJw=
-github.com/fatedier/yamux v0.2.0 h1:H+2A9iBVh7aJlEOc1Ws1FXWOaecBf2nRv9zpFMPUWg8=
-github.com/fatedier/yamux v0.2.0/go.mod h1:d4FtRDrC9sHvRpiDL6J5EnfjLhqzZZplHe5yToSn2Ac=
-github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
-github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/fatedier/golib v0.5.1 h1:hcKAnaw5mdI/1KWRGejxR+i1Hn/NvbY5UsMKDr7o13M=
+github.com/fatedier/golib v0.5.1/go.mod h1:W6kIYkIFxHsTzbgqg5piCxIiDo4LzwgTY6R5W8l9NFQ=
+github.com/fatedier/yamux v0.0.0-20250825093530-d0154be01cd6 h1:u92UUy6FURPmNsMBUuongRWC0rBqN6gd01Dzu+D21NE=
+github.com/fatedier/yamux v0.0.0-20250825093530-d0154be01cd6/go.mod h1:c5/tk6G0dSpXGzJN7Wk1OEie8grdSJAmeawId9Zvd34=
+github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
+github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
@@ -78,8 +78,18 @@ github.com/onsi/gomega v1.36.3 h1:hID7cr8t3Wp26+cYnfcjR6HpJ00fdogN6dqZ1t6IylU=
 github.com/onsi/gomega v1.36.3/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
 github.com/pelletier/go-toml/v2 v2.2.0 h1:QLgLl2yMN7N+ruc31VynXs1vhMZa7CeHHejIeBAsoHo=
 github.com/pelletier/go-toml/v2 v2.2.0/go.mod h1:1t835xjRzz80PqgE6HHgN2JOsmgYu/h4qDAS4n929Rs=
-github.com/pires/go-proxyproto v0.15.0 h1:dTshmNbFm/D+0+sbrxUuddPOZ5Y0B7c5NhtsBkm6LqI=
-github.com/pires/go-proxyproto v0.15.0/go.mod h1:OXsCrKwrK2tXS9YrI5tkHx5xaQlO8FH3lFW76orFh24=
+github.com/pion/dtls/v2 v2.2.7 h1:cSUBsETxepsCSFSxC3mc/aDo14qQLMSL+O6IjG28yV8=
+github.com/pion/dtls/v2 v2.2.7/go.mod h1:8WiMkebSHFD0T+dIU+UeBaoV7kDhOW5oDCzZ7WZ/F9s=
+github.com/pion/logging v0.2.2 h1:M9+AIj/+pxNsDfAT64+MAVgJO0rsyLnoJKCqf//DoeY=
+github.com/pion/logging v0.2.2/go.mod h1:k0/tDVsRCX2Mb2ZEmTqNa7CWsQPc+YYCB7Q+5pahoms=
+github.com/pion/stun/v2 v2.0.0 h1:A5+wXKLAypxQri59+tmQKVs7+l6mMM+3d+eER9ifRU0=
+github.com/pion/stun/v2 v2.0.0/go.mod h1:22qRSh08fSEttYUmJZGlriq9+03jtVmXNODgLccj8GQ=
+github.com/pion/transport/v2 v2.2.1 h1:7qYnCBlpgSJNYMbLCKuSY9KbQdBFoETvPNETv0y4N7c=
+github.com/pion/transport/v2 v2.2.1/go.mod h1:cXXWavvCnFF6McHTft3DWS9iic2Mftcz1Aq29pGcU5g=
+github.com/pion/transport/v3 v3.0.1 h1:gDTlPJwROfSfz6QfSi0ZmeCSkFcnWWiiR9ES0ouANiM=
+github.com/pion/transport/v3 v3.0.1/go.mod h1:UY7kiITrlMv7/IKgd5eTUcaahZx5oUN3l9SzK5f5xE0=
+github.com/pires/go-proxyproto v0.7.0 h1:IukmRewDQFWC7kfnb66CSomk2q/seBuilHBYFwyq0Hs=
+github.com/pires/go-proxyproto v0.7.0/go.mod h1:Vz/1JPY/OACxWGQNIRY2BeyDmpoaWmEP40O9LbuiFR4=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -95,10 +105,8 @@ github.com/prometheus/common v0.48.0 h1:QO8U2CdOzSn1BBsmXJXduaaW+dY/5QLjfB8svtSz
 github.com/prometheus/common v0.48.0/go.mod h1:0/KsvlIEfPQCQ5I2iNSAWKPZziNCvRs5EC6ILDTlAPc=
 github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
 github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
-github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4TzM7MFjy0=
-github.com/quic-go/go-ossfuzz-seeds v0.1.0/go.mod h1:3IOHRbJIc+L6YKMwfDtJAM9Vj9k0YY4muhuyUYk5tbk=
-github.com/quic-go/quic-go v0.60.0 h1:xcQioE8OM66UQLeUMHltK1CCcOu3JbVB4JAQdDQSB+0=
-github.com/quic-go/quic-go v0.60.0/go.mod h1:wpKpjmPpftl30sL6pFh7REVpjbcCVy4zt2vDyK1TuJk=
+github.com/quic-go/quic-go v0.55.0 h1:zccPQIqYCXDt5NmcEabyYvOnomjs8Tlwl7tISjJh9Mk=
+github.com/quic-go/quic-go v0.55.0/go.mod h1:DR51ilwU1uE164KuWXhinFcKWGlEjzys2l8zUl5Ss1U=
 github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rodaine/table v1.2.0 h1:38HEnwK4mKSHQJIkavVj+bst1TEY7j9zhLMWu4QJrMA=
@@ -120,10 +128,11 @@ github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpE
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/templexxx/cpu v0.1.1 h1:isxHaxBXpYFWnk2DReuKkigaZyrjs2+9ypIdGP4h+HI=
 github.com/templexxx/cpu v0.1.1/go.mod h1:w7Tb+7qgcAlIyX4NhLuDKt78AHA5SzPmq0Wj6HiEnnk=
 github.com/templexxx/xorsimd v0.4.3 h1:9AQTFHd7Bhk3dIT7Al2XeBX5DWOvsUPZCuhyAtNbHjU=
@@ -144,6 +153,7 @@ github.com/xtaci/kcp-go/v5 v5.6.13 h1:FEjtz9+D4p8t2x4WjciGt/jsIuhlWjjgPCCWjrVR4H
 github.com/xtaci/kcp-go/v5 v5.6.13/go.mod h1:75S1AKYYzNUSXIv30h+jPKJYZUwqpfvLshu63nCNSOM=
 github.com/xtaci/lossyconn v0.0.0-20200209145036-adba10fffc37 h1:EWU6Pktpas0n8lLQwDsRyZfmkPeRbdgPtW609es+/9E=
 github.com/xtaci/lossyconn v0.0.0-20200209145036-adba10fffc37/go.mod h1:HpMP7DB2CyokmAh4lp0EQnnWhmycP/TvwBGzvuie+H0=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
 go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
@@ -151,52 +161,89 @@ go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201012173705-84dcc777aaee/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
-golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE=
+golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
+golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
+golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
+golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201010224723-4f7140c49acb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
+golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
+golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/oauth2 v0.28.0 h1:CrgCKl8PPAVtLnU3c+EDw6x11699EWlsDeWNWKdIOkc=
+golang.org/x/oauth2 v0.28.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
+golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
+golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-golang.org/x/time v0.10.0 h1:3usCWA8tQn0L8+hFJQNgzpWbd89begxN66o1Ojdn5L4=
-golang.org/x/time v0.10.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
+golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
-golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
@@ -1,162 +0,0 @@
-#!/bin/sh
-
-set -eu
-
-SCRIPT=$(readlink -f "$0")
-ROOT=$(unset CDPATH && cd "$(dirname "$SCRIPT")/.." && pwd)
-
-if ! command -v ginkgo >/dev/null 2>&1; then
-    echo "ginkgo not found, try to install..."
-    go install github.com/onsi/ginkgo/v2/ginkgo@v2.23.4
-fi
-
-debug=false
-if [ "x${DEBUG:-}" = "xtrue" ]; then
-    debug=true
-fi
-logLevel=debug
-if [ "${LOG_LEVEL:-}" ]; then
-    logLevel="${LOG_LEVEL}"
-fi
-
-currentFrpsPath=${CURRENT_FRPS_PATH:-${ROOT}/bin/frps}
-currentFrpcPath=${CURRENT_FRPC_PATH:-${ROOT}/bin/frpc}
-baselineCount=${FRP_COMPAT_BASELINE_COUNT:-8}
-targetOS=${TARGET_OS:-$(go env GOOS)}
-targetArch=${TARGET_ARCH:-$(go env GOARCH)}
-targetPlatform="${targetOS}_${targetArch}"
-cacheRoot=${FRP_COMPAT_CACHE_DIR:-${ROOT}/.cache/e2e-compat}
-
-check_file() {
-    if [ ! -f "$2" ]; then
-        echo "$1 not found: $2"
-        exit 1
-    fi
-}
-
-check_file "current frps" "${currentFrpsPath}"
-check_file "current frpc" "${currentFrpcPath}"
-
-run_current_current=true
-
-run_compatibility() {
-    baselineVersion=$1
-    baselineFrpsPath=$2
-    baselineFrpcPath=$3
-
-    check_file "baseline frps" "${baselineFrpsPath}"
-    check_file "baseline frpc" "${baselineFrpcPath}"
-
-    echo "Running compatibility e2e with baseline ${baselineVersion}"
-    ginkgo -nodes=1 --poll-progress-after=60s "${ROOT}/test/e2e/compatibility" -- \
-        -current-frps-path="${currentFrpsPath}" \
-        -current-frpc-path="${currentFrpcPath}" \
-        -baseline-frps-path="${baselineFrpsPath}" \
-        -baseline-frpc-path="${baselineFrpcPath}" \
-        -baseline-version="${baselineVersion}" \
-        -run-current-current="${run_current_current}" \
-        -log-level="${logLevel}" \
-        -debug="${debug}"
-    run_current_current=false
-}
-
-github_api_curl() {
-    if [ "${GITHUB_TOKEN:-}" ]; then
-        curl -fsSL \
-            -H "Accept: application/vnd.github+json" \
-            -H "Authorization: Bearer ${GITHUB_TOKEN}" \
-            "$1"
-    else
-        curl -fsSL "$1"
-    fi
-}
-
-resolve_versions() {
-    if [ "${FRP_COMPAT_BASELINE_VERSIONS:-}" ]; then
-        printf "%s\n" "${FRP_COMPAT_BASELINE_VERSIONS}"
-        return
-    fi
-
-    case "${baselineCount}" in
-        '' | *[!0-9]*)
-            echo "FRP_COMPAT_BASELINE_COUNT must be a positive integer: ${baselineCount}" >&2
-            exit 1
-            ;;
-    esac
-    if [ "${baselineCount}" -eq 0 ]; then
-        echo "FRP_COMPAT_BASELINE_COUNT must be greater than 0" >&2
-        exit 1
-    fi
-    if [ "${baselineCount}" -gt 100 ]; then
-        echo "FRP_COMPAT_BASELINE_COUNT must be less than or equal to 100" >&2
-        exit 1
-    fi
-
-    releaseURL="https://api.github.com/repos/fatedier/frp/releases?per_page=100"
-    resolvedVersions=""
-    if releases=$(github_api_curl "${releaseURL}" 2>/dev/null); then
-        resolvedVersions=$(printf "%s\n" "${releases}" |
-            sed -n 's/.*"tag_name":[[:space:]]*"v\([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\)".*/\1/p' |
-            awk '!seen[$0]++' |
-            head -n "${baselineCount}" |
-            tr '\n' ' ' |
-            sed 's/[[:space:]]*$//')
-    else
-        echo "Failed to fetch release metadata from GitHub API, falling back to GitHub releases page." >&2
-    fi
-
-    if [ -z "${resolvedVersions}" ]; then
-        releasesPageURL="https://github.com/fatedier/frp/releases"
-        if ! releases=$(curl -fsSL "${releasesPageURL}"); then
-            echo "Failed to fetch release metadata from GitHub: ${releasesPageURL}" >&2
-            echo "Set FRP_COMPAT_BASELINE_VERSIONS to run with explicit baseline versions." >&2
-            exit 1
-        fi
-        resolvedVersions=$(printf "%s\n" "${releases}" |
-            grep -o 'releases/tag/v[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"' |
-            sed 's#.*/v##; s/"$//' |
-            awk '!seen[$0]++' |
-            head -n "${baselineCount}" |
-            tr '\n' ' ' |
-            sed 's/[[:space:]]*$//')
-    fi
-
-    set -- ${resolvedVersions}
-    if [ "$#" -lt "${baselineCount}" ]; then
-        echo "Only resolved $# stable release versions from GitHub, expected ${baselineCount}." >&2
-        echo "Set FRP_COMPAT_BASELINE_VERSIONS to run with explicit baseline versions." >&2
-        exit 1
-    fi
-
-    printf "%s\n" "${resolvedVersions}"
-}
-
-if [ "${BASELINE_FRPS_PATH:-}" ] || [ "${BASELINE_FRPC_PATH:-}" ]; then
-    if [ -z "${BASELINE_FRPS_PATH:-}" ] || [ -z "${BASELINE_FRPC_PATH:-}" ]; then
-        echo "BASELINE_FRPS_PATH and BASELINE_FRPC_PATH must be set together"
-        exit 1
-    fi
-    run_compatibility "${FRP_COMPAT_BASELINE_VERSION:-custom}" "${BASELINE_FRPS_PATH}" "${BASELINE_FRPC_PATH}"
-    exit 0
-fi
-
-versions=$(resolve_versions)
-echo "Compatibility baseline versions: ${versions}"
-
-mkdir -p "${cacheRoot}"
-for version in ${versions}; do
-    baselineDir="${cacheRoot}/${version}/${targetPlatform}"
-    if [ ! -f "${baselineDir}/frps" ] || [ ! -f "${baselineDir}/frpc" ]; then
-        tmpDir="${cacheRoot}/.download-${version}-${targetPlatform}"
-        rm -rf "${tmpDir}"
-        (
-            cd "${cacheRoot}"
-            FRP_VERSION="${version}" TARGET_DIRNAME="$(basename "${tmpDir}")" "${ROOT}/hack/download.sh"
-        )
-        mkdir -p "$(dirname "${baselineDir}")"
-        rm -rf "${baselineDir}"
-        mv "${tmpDir}" "${baselineDir}"
-    fi
-
-    run_compatibility "${version}" "${baselineDir}/frps" "${baselineDir}/frpc"
-done
@@ -23,14 +23,12 @@ import (
 	"net/url"
 	"os"
 	"slices"
-	"sync"

 	"github.com/coreos/go-oidc/v3/oidc"
 	"golang.org/x/oauth2"
 	"golang.org/x/oauth2/clientcredentials"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/config/v1/validation"
 	"github.com/fatedier/frp/pkg/msg"
 )

@@ -76,64 +74,14 @@ func createOIDCHTTPClient(trustedCAFile string, insecureSkipVerify bool, proxyUR
 	return &http.Client{Transport: transport}, nil
 }

-// nonCachingTokenSource wraps a clientcredentials.Config to fetch a fresh
-// token on every call. This is used as a fallback when the OIDC provider
-// does not return expires_in, which would cause a caching TokenSource to
-// hold onto a stale token forever.
-type nonCachingTokenSource struct {
-	cfg *clientcredentials.Config
-	ctx context.Context
-}
-
-func (s *nonCachingTokenSource) Token() (*oauth2.Token, error) {
-	return s.cfg.Token(s.ctx)
-}
-
-// oidcTokenSource wraps a caching oauth2.TokenSource and, on the first
-// successful Token() call, checks whether the provider returns an expiry.
-// If not, it permanently switches to nonCachingTokenSource so that a fresh
-// token is fetched every time.  This avoids an eager network call at
-// construction time, letting the login retry loop handle transient IdP
-// outages.
-type oidcTokenSource struct {
-	mu          sync.Mutex
-	initialized bool
-	source      oauth2.TokenSource
-	fallbackCfg *clientcredentials.Config
-	fallbackCtx context.Context
-}
-
-func (s *oidcTokenSource) Token() (*oauth2.Token, error) {
-	s.mu.Lock()
-	if !s.initialized {
-		token, err := s.source.Token()
-		if err != nil {
-			s.mu.Unlock()
-			return nil, err
-		}
-		if token.Expiry.IsZero() {
-			s.source = &nonCachingTokenSource{cfg: s.fallbackCfg, ctx: s.fallbackCtx}
-		}
-		s.initialized = true
-		s.mu.Unlock()
-		return token, nil
-	}
-	source := s.source
-	s.mu.Unlock()
-	return source.Token()
-}
-
 type OidcAuthProvider struct {
 	additionalAuthScopes []v1.AuthScope

-	tokenSource oauth2.TokenSource
+	tokenGenerator *clientcredentials.Config
+	httpClient     *http.Client
 }

 func NewOidcAuthSetter(additionalAuthScopes []v1.AuthScope, cfg v1.AuthOIDCClientConfig) (*OidcAuthProvider, error) {
-	if err := validation.ValidateOIDCClientCredentialsConfig(&cfg); err != nil {
-		return nil, err
-	}
-
 	eps := make(map[string][]string)
 	for k, v := range cfg.AdditionalEndpointParams {
 		eps[k] = []string{v}
@@ -151,42 +99,30 @@ func NewOidcAuthSetter(additionalAuthScopes []v1.AuthScope, cfg v1.AuthOIDCClien
 		EndpointParams: eps,
 	}

-	// Build the context that TokenSource will use for all future HTTP requests.
-	// context.Background() is appropriate here because the token source is
-	// long-lived and outlives any single request.
-	ctx := context.Background()
+	// Create custom HTTP client if needed
+	var httpClient *http.Client
 	if cfg.TrustedCaFile != "" || cfg.InsecureSkipVerify || cfg.ProxyURL != "" {
-		httpClient, err := createOIDCHTTPClient(cfg.TrustedCaFile, cfg.InsecureSkipVerify, cfg.ProxyURL)
+		var err error
+		httpClient, err = createOIDCHTTPClient(cfg.TrustedCaFile, cfg.InsecureSkipVerify, cfg.ProxyURL)
 		if err != nil {
 			return nil, fmt.Errorf("failed to create OIDC HTTP client: %w", err)
 		}
-		ctx = context.WithValue(ctx, oauth2.HTTPClient, httpClient)
 	}

-	// Create a persistent TokenSource that caches the token and refreshes
-	// it before expiry. This avoids making a new HTTP request to the OIDC
-	// provider on every heartbeat/ping.
-	//
-	// We wrap it in an oidcTokenSource so that the first Token() call
-	// (deferred to SetLogin inside the login retry loop) probes whether the
-	// provider returns expires_in.  If not, it switches to a non-caching
-	// source.  This avoids an eager network call at construction time, which
-	// would prevent loopLoginUntilSuccess from retrying on transient IdP
-	// outages.
-	cachingSource := tokenGenerator.TokenSource(ctx)
-
 	return &OidcAuthProvider{
 		additionalAuthScopes: additionalAuthScopes,
-		tokenSource: &oidcTokenSource{
-			source:      cachingSource,
-			fallbackCfg: tokenGenerator,
-			fallbackCtx: ctx,
-		},
+		tokenGenerator:       tokenGenerator,
+		httpClient:           httpClient,
 	}, nil
 }

 func (auth *OidcAuthProvider) generateAccessToken() (accessToken string, err error) {
-	tokenObj, err := auth.tokenSource.Token()
+	ctx := context.Background()
+	if auth.httpClient != nil {
+		ctx = context.WithValue(ctx, oauth2.HTTPClient, auth.httpClient)
+	}
+
+	tokenObj, err := auth.tokenGenerator.Token(ctx)
 	if err != nil {
 		return "", fmt.Errorf("couldn't generate OIDC token for login: %v", err)
 	}
@@ -269,8 +205,7 @@ type OidcAuthConsumer struct {
 	additionalAuthScopes []v1.AuthScope

 	verifier          TokenVerifier
-	mu                sync.RWMutex
-	subjectsFromLogin map[string]struct{}
+	subjectsFromLogin []string
 }

 func NewTokenVerifier(cfg v1.AuthOIDCServerConfig) TokenVerifier {
@@ -291,7 +226,7 @@ func NewOidcAuthVerifier(additionalAuthScopes []v1.AuthScope, verifier TokenVeri
 	return &OidcAuthConsumer{
 		additionalAuthScopes: additionalAuthScopes,
 		verifier:             verifier,
-		subjectsFromLogin:    make(map[string]struct{}),
+		subjectsFromLogin:    []string{},
 	}
 }

@@ -300,9 +235,9 @@ func (auth *OidcAuthConsumer) VerifyLogin(loginMsg *msg.Login) (err error) {
 	if err != nil {
 		return fmt.Errorf("invalid OIDC token in login: %v", err)
 	}
-	auth.mu.Lock()
-	auth.subjectsFromLogin[token.Subject] = struct{}{}
-	auth.mu.Unlock()
+	if !slices.Contains(auth.subjectsFromLogin, token.Subject) {
+		auth.subjectsFromLogin = append(auth.subjectsFromLogin, token.Subject)
+	}
 	return nil
 }

@@ -311,13 +246,11 @@ func (auth *OidcAuthConsumer) verifyPostLoginToken(privilegeKey string) (err err
 	if err != nil {
 		return fmt.Errorf("invalid OIDC token in ping: %v", err)
 	}
-	auth.mu.RLock()
-	_, ok := auth.subjectsFromLogin[token.Subject]
-	auth.mu.RUnlock()
-	if !ok {
+	if !slices.Contains(auth.subjectsFromLogin, token.Subject) {
 		return fmt.Errorf("received different OIDC subject in login and ping. "+
+			"original subjects: %s, "+
 			"new subject: %s",
-			token.Subject)
+			auth.subjectsFromLogin, token.Subject)
 	}
 	return nil
 }
@@ -2,10 +2,6 @@ package auth_test

 import (
 	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"sync/atomic"
 	"testing"
 	"time"

@@ -66,188 +62,3 @@ func TestPingAfterLoginWithDifferentSubjectFails(t *testing.T) {
 	r.Error(err)
 	r.Contains(err.Error(), "received different OIDC subject in login and ping")
 }
-
-func TestOidcAuthProviderFallsBackWhenNoExpiry(t *testing.T) {
-	r := require.New(t)
-
-	var requestCount atomic.Int32
-	tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		requestCount.Add(1)
-		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(map[string]any{ //nolint:gosec // test-only dummy token response
-			"access_token": "fresh-test-token",
-			"token_type":   "Bearer",
-		})
-	}))
-	defer tokenServer.Close()
-
-	provider, err := auth.NewOidcAuthSetter(
-		[]v1.AuthScope{v1.AuthScopeHeartBeats},
-		v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			ClientSecret:     "test-secret",
-			TokenEndpointURL: tokenServer.URL,
-		},
-	)
-	r.NoError(err)
-
-	// Constructor no longer fetches a token eagerly.
-	// The first SetLogin triggers the adaptive probe.
-	r.Equal(int32(0), requestCount.Load())
-
-	loginMsg := &msg.Login{}
-	err = provider.SetLogin(loginMsg)
-	r.NoError(err)
-	r.Equal("fresh-test-token", loginMsg.PrivilegeKey)
-
-	for range 3 {
-		pingMsg := &msg.Ping{}
-		err = provider.SetPing(pingMsg)
-		r.NoError(err)
-		r.Equal("fresh-test-token", pingMsg.PrivilegeKey)
-	}
-
-	// 1 probe (login) + 3 pings = 4 requests (probe doubles as the login token fetch)
-	r.Equal(int32(4), requestCount.Load(), "each call should fetch a fresh token when expires_in is missing")
-}
-
-func TestOidcAuthProviderCachesToken(t *testing.T) {
-	r := require.New(t)
-
-	var requestCount atomic.Int32
-	tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		requestCount.Add(1)
-		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(map[string]any{ //nolint:gosec // test-only dummy token response
-			"access_token": "cached-test-token",
-			"token_type":   "Bearer",
-			"expires_in":   3600,
-		})
-	}))
-	defer tokenServer.Close()
-
-	provider, err := auth.NewOidcAuthSetter(
-		[]v1.AuthScope{v1.AuthScopeHeartBeats},
-		v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			ClientSecret:     "test-secret",
-			TokenEndpointURL: tokenServer.URL,
-		},
-	)
-	r.NoError(err)
-
-	// Constructor no longer fetches eagerly; first SetLogin triggers the probe.
-	r.Equal(int32(0), requestCount.Load())
-
-	// SetLogin triggers the adaptive probe and caches the token.
-	loginMsg := &msg.Login{}
-	err = provider.SetLogin(loginMsg)
-	r.NoError(err)
-	r.Equal("cached-test-token", loginMsg.PrivilegeKey)
-	r.Equal(int32(1), requestCount.Load())
-
-	// Subsequent calls should also reuse the cached token
-	for range 5 {
-		pingMsg := &msg.Ping{}
-		err = provider.SetPing(pingMsg)
-		r.NoError(err)
-		r.Equal("cached-test-token", pingMsg.PrivilegeKey)
-	}
-	r.Equal(int32(1), requestCount.Load(), "token endpoint should only be called once; cached token should be reused")
-}
-
-func TestOidcAuthProviderRetriesOnInitialFailure(t *testing.T) {
-	r := require.New(t)
-
-	var requestCount atomic.Int32
-	tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		n := requestCount.Add(1)
-		// The oauth2 library retries once internally, so we need two
-		// consecutive failures to surface an error to the caller.
-		if n <= 2 {
-			w.Header().Set("Content-Type", "application/json")
-			w.WriteHeader(http.StatusBadRequest)
-			_ = json.NewEncoder(w).Encode(map[string]any{
-				"error":             "temporarily_unavailable",
-				"error_description": "service is starting up",
-			})
-			return
-		}
-		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(map[string]any{ //nolint:gosec // test-only dummy token response
-			"access_token": "retry-test-token",
-			"token_type":   "Bearer",
-			"expires_in":   3600,
-		})
-	}))
-	defer tokenServer.Close()
-
-	// Constructor succeeds even though the IdP is "down".
-	provider, err := auth.NewOidcAuthSetter(
-		[]v1.AuthScope{v1.AuthScopeHeartBeats},
-		v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			ClientSecret:     "test-secret",
-			TokenEndpointURL: tokenServer.URL,
-		},
-	)
-	r.NoError(err)
-	r.Equal(int32(0), requestCount.Load())
-
-	// First SetLogin hits the IdP, which returns an error (after internal retry).
-	loginMsg := &msg.Login{}
-	err = provider.SetLogin(loginMsg)
-	r.Error(err)
-	r.Equal(int32(2), requestCount.Load())
-
-	// Second SetLogin retries and succeeds.
-	err = provider.SetLogin(loginMsg)
-	r.NoError(err)
-	r.Equal("retry-test-token", loginMsg.PrivilegeKey)
-	r.Equal(int32(3), requestCount.Load())
-
-	// Subsequent calls use cached token.
-	pingMsg := &msg.Ping{}
-	err = provider.SetPing(pingMsg)
-	r.NoError(err)
-	r.Equal("retry-test-token", pingMsg.PrivilegeKey)
-	r.Equal(int32(3), requestCount.Load())
-}
-
-func TestNewOidcAuthSetterRejectsInvalidStaticConfig(t *testing.T) {
-	r := require.New(t)
-	tokenServer := httptest.NewServer(http.NotFoundHandler())
-	defer tokenServer.Close()
-
-	_, err := auth.NewOidcAuthSetter(nil, v1.AuthOIDCClientConfig{
-		ClientID:         "test-client",
-		TokenEndpointURL: "://bad",
-	})
-	r.Error(err)
-	r.Contains(err.Error(), "auth.oidc.tokenEndpointURL")
-
-	_, err = auth.NewOidcAuthSetter(nil, v1.AuthOIDCClientConfig{
-		TokenEndpointURL: tokenServer.URL,
-	})
-	r.Error(err)
-	r.Contains(err.Error(), "auth.oidc.clientID is required")
-
-	_, err = auth.NewOidcAuthSetter(nil, v1.AuthOIDCClientConfig{
-		ClientID:         "test-client",
-		TokenEndpointURL: tokenServer.URL,
-		AdditionalEndpointParams: map[string]string{
-			"scope": "profile",
-		},
-	})
-	r.Error(err)
-	r.Contains(err.Error(), "auth.oidc.additionalEndpointParams.scope is not allowed; use auth.oidc.scope instead")
-
-	_, err = auth.NewOidcAuthSetter(nil, v1.AuthOIDCClientConfig{
-		ClientID:                 "test-client",
-		TokenEndpointURL:         tokenServer.URL,
-		Audience:                 "api",
-		AdditionalEndpointParams: map[string]string{"audience": "override"},
-	})
-	r.Error(err)
-	r.Contains(err.Error(), "cannot specify both auth.oidc.audience and auth.oidc.additionalEndpointParams.audience")
-}
@@ -17,6 +17,8 @@ package legacy
 import (
 	"strings"

+	"github.com/samber/lo"
+
 	"github.com/fatedier/frp/pkg/config/types"
 	v1 "github.com/fatedier/frp/pkg/config/v1"
 )
@@ -47,7 +49,7 @@ func Convert_ClientCommonConf_To_v1(conf *ClientCommonConf) *v1.ClientCommonConf
 	out.Transport.ConnectServerLocalIP = conf.ConnectServerLocalIP
 	out.Transport.ProxyURL = conf.HTTPProxy
 	out.Transport.PoolCount = conf.PoolCount
-	out.Transport.TCPMux = new(conf.TCPMux)
+	out.Transport.TCPMux = lo.ToPtr(conf.TCPMux)
 	out.Transport.TCPMuxKeepaliveInterval = conf.TCPMuxKeepaliveInterval
 	out.Transport.Protocol = conf.Protocol
 	out.Transport.HeartbeatInterval = conf.HeartbeatInterval
@@ -55,8 +57,8 @@ func Convert_ClientCommonConf_To_v1(conf *ClientCommonConf) *v1.ClientCommonConf
 	out.Transport.QUIC.KeepalivePeriod = conf.QUICKeepalivePeriod
 	out.Transport.QUIC.MaxIdleTimeout = conf.QUICMaxIdleTimeout
 	out.Transport.QUIC.MaxIncomingStreams = conf.QUICMaxIncomingStreams
-	out.Transport.TLS.Enable = new(conf.TLSEnable)
-	out.Transport.TLS.DisableCustomTLSFirstByte = new(conf.DisableCustomTLSFirstByte)
+	out.Transport.TLS.Enable = lo.ToPtr(conf.TLSEnable)
+	out.Transport.TLS.DisableCustomTLSFirstByte = lo.ToPtr(conf.DisableCustomTLSFirstByte)
 	out.Transport.TLS.CertFile = conf.TLSCertFile
 	out.Transport.TLS.KeyFile = conf.TLSKeyFile
 	out.Transport.TLS.TrustedCaFile = conf.TLSTrustedCaFile
@@ -75,7 +77,7 @@ func Convert_ClientCommonConf_To_v1(conf *ClientCommonConf) *v1.ClientCommonConf
 	out.WebServer.PprofEnable = conf.PprofEnable

 	out.DNSServer = conf.DNSServer
-	out.LoginFailExit = new(conf.LoginFailExit)
+	out.LoginFailExit = lo.ToPtr(conf.LoginFailExit)
 	out.Start = conf.Start
 	out.UDPPacketSize = conf.UDPPacketSize
 	out.Metadatas = conf.Metas
@@ -132,14 +134,14 @@ func Convert_ServerCommonConf_To_v1(conf *ServerCommonConf) *v1.ServerConfig {
 	out.Log.MaxDays = conf.LogMaxDays
 	out.Log.DisablePrintColor = conf.DisableLogColor

-	out.DetailedErrorsToClient = new(conf.DetailedErrorsToClient)
+	out.DetailedErrorsToClient = lo.ToPtr(conf.DetailedErrorsToClient)
 	out.SubDomainHost = conf.SubDomainHost
 	out.Custom404Page = conf.Custom404Page
 	out.UserConnTimeout = conf.UserConnTimeout
 	out.UDPPacketSize = conf.UDPPacketSize
 	out.NatHoleAnalysisDataReserveHours = conf.NatHoleAnalysisDataReserveHours

-	out.Transport.TCPMux = new(conf.TCPMux)
+	out.Transport.TCPMux = lo.ToPtr(conf.TCPMux)
 	out.Transport.TCPMuxKeepaliveInterval = conf.TCPMuxKeepaliveInterval
 	out.Transport.TCPKeepAlive = conf.TCPKeepAlive
 	out.Transport.MaxPoolCount = conf.MaxPoolCount
@@ -169,15 +171,16 @@ func Convert_ServerCommonConf_To_v1(conf *ServerCommonConf) *v1.ServerConfig {
 func transformHeadersFromPluginParams(params map[string]string) v1.HeaderOperations {
 	out := v1.HeaderOperations{}
 	for k, v := range params {
-		k, ok := strings.CutPrefix(k, "plugin_header_")
-		if !ok || k == "" {
+		if !strings.HasPrefix(k, "plugin_header_") {
 			continue
 		}
+		if k = strings.TrimPrefix(k, "plugin_header_"); k != "" {
 			if out.Set == nil {
 				out.Set = make(map[string]string)
 			}
 			out.Set[k] = v
 		}
+	}
 	return out
 }

@@ -39,14 +39,14 @@ const (
 // Proxy
 var (
 	proxyConfTypeMap = map[ProxyType]reflect.Type{
-		ProxyTypeTCP:    reflect.TypeFor[TCPProxyConf](),
-		ProxyTypeUDP:    reflect.TypeFor[UDPProxyConf](),
-		ProxyTypeTCPMUX: reflect.TypeFor[TCPMuxProxyConf](),
-		ProxyTypeHTTP:   reflect.TypeFor[HTTPProxyConf](),
-		ProxyTypeHTTPS:  reflect.TypeFor[HTTPSProxyConf](),
-		ProxyTypeSTCP:   reflect.TypeFor[STCPProxyConf](),
-		ProxyTypeXTCP:   reflect.TypeFor[XTCPProxyConf](),
-		ProxyTypeSUDP:   reflect.TypeFor[SUDPProxyConf](),
+		ProxyTypeTCP:    reflect.TypeOf(TCPProxyConf{}),
+		ProxyTypeUDP:    reflect.TypeOf(UDPProxyConf{}),
+		ProxyTypeTCPMUX: reflect.TypeOf(TCPMuxProxyConf{}),
+		ProxyTypeHTTP:   reflect.TypeOf(HTTPProxyConf{}),
+		ProxyTypeHTTPS:  reflect.TypeOf(HTTPSProxyConf{}),
+		ProxyTypeSTCP:   reflect.TypeOf(STCPProxyConf{}),
+		ProxyTypeXTCP:   reflect.TypeOf(XTCPProxyConf{}),
+		ProxyTypeSUDP:   reflect.TypeOf(SUDPProxyConf{}),
 	}
 )

@@ -22,8 +22,8 @@ func GetMapWithoutPrefix(set map[string]string, prefix string) map[string]string
 	m := make(map[string]string)

 	for key, value := range set {
-		if trimmed, ok := strings.CutPrefix(key, prefix); ok {
-			m[trimmed] = value
+		if strings.HasPrefix(key, prefix) {
+			m[strings.TrimPrefix(key, prefix)] = value
 		}
 	}

@@ -32,9 +32,9 @@ const (
 // Visitor
 var (
 	visitorConfTypeMap = map[VisitorType]reflect.Type{
-		VisitorTypeSTCP: reflect.TypeFor[STCPVisitorConf](),
-		VisitorTypeXTCP: reflect.TypeFor[XTCPVisitorConf](),
-		VisitorTypeSUDP: reflect.TypeFor[SUDPVisitorConf](),
+		VisitorTypeSTCP: reflect.TypeOf(STCPVisitorConf{}),
+		VisitorTypeXTCP: reflect.TypeOf(XTCPVisitorConf{}),
+		VisitorTypeSUDP: reflect.TypeOf(SUDPVisitorConf{}),
 	}
 )

@@ -394,10 +394,6 @@ func LoadClientConfigResult(path string, strict bool) (*ClientConfigLoadResult,
 		}
 	}

-	if err := validateNoDuplicateNames(result.Proxies, result.Visitors); err != nil {
-		return nil, err
-	}
-
 	return result, nil
 }

@@ -421,31 +417,6 @@ func LoadClientConfig(path string, strict bool) (
 	return result.Common, proxyCfgs, visitorCfgs, result.IsLegacyFormat, nil
 }

-// validateNoDuplicateNames rejects proxies or visitors that share a name. They are
-// keyed by name in the config sources, so a duplicate would otherwise be silently
-// overwritten and never started, with no error or log.
-func validateNoDuplicateNames(proxies []v1.ProxyConfigurer, visitors []v1.VisitorConfigurer) error {
-	proxyNames := make(map[string]struct{}, len(proxies))
-	for _, p := range proxies {
-		name := p.GetBaseConfig().Name
-		if _, ok := proxyNames[name]; ok {
-			return fmt.Errorf("proxy name [%s] is duplicated", name)
-		}
-		proxyNames[name] = struct{}{}
-	}
-
-	visitorNames := make(map[string]struct{}, len(visitors))
-	for _, v := range visitors {
-		name := v.GetBaseConfig().Name
-		if _, ok := visitorNames[name]; ok {
-			return fmt.Errorf("visitor name [%s] is duplicated", name)
-		}
-		visitorNames[name] = struct{}{}
-	}
-
-	return nil
-}
-
 func CompleteProxyConfigurers(proxies []v1.ProxyConfigurer) []v1.ProxyConfigurer {
 	proxyCfgs := proxies
 	for _, c := range proxyCfgs {
@@ -17,8 +17,6 @@ package config
 import (
 	"encoding/json"
 	"fmt"
-	"os"
-	"path/filepath"
 	"strings"
 	"testing"

@@ -464,111 +462,6 @@ func TestFilterClientConfigurers_FilterByStartAndEnabled(t *testing.T) {
 	require.Equal("keep", proxies[0].GetBaseConfig().Name)
 }

-func TestLoadClientConfigResult_DuplicateNames(t *testing.T) {
-	tests := []struct {
-		name      string
-		content   string
-		errSubstr string
-	}{
-		{
-			name: "duplicate proxy names",
-			content: `
-serverAddr = "127.0.0.1"
-serverPort = 7000
-
-[[proxies]]
-name = "dup"
-type = "tcp"
-localPort = 22
-remotePort = 6000
-
-[[proxies]]
-name = "dup"
-type = "tcp"
-localPort = 3306
-remotePort = 6001
-`,
-			errSubstr: "proxy name [dup] is duplicated",
-		},
-		{
-			name: "duplicate visitor names",
-			content: `
-serverAddr = "127.0.0.1"
-serverPort = 7000
-
-[[visitors]]
-name = "dup"
-type = "stcp"
-serverName = "a"
-secretKey = "secret"
-bindPort = 9001
-
-[[visitors]]
-name = "dup"
-type = "stcp"
-serverName = "b"
-secretKey = "secret"
-bindPort = 9002
-`,
-			errSubstr: "visitor name [dup] is duplicated",
-		},
-		{
-			name: "unique names",
-			content: `
-serverAddr = "127.0.0.1"
-serverPort = 7000
-
-[[proxies]]
-name = "p1"
-type = "tcp"
-localPort = 22
-remotePort = 6000
-
-[[proxies]]
-name = "p2"
-type = "tcp"
-localPort = 3306
-remotePort = 6001
-`,
-		},
-		{
-			name: "same name across proxy and visitor",
-			content: `
-serverAddr = "127.0.0.1"
-serverPort = 7000
-
-[[proxies]]
-name = "same"
-type = "tcp"
-localPort = 22
-remotePort = 6000
-
-[[visitors]]
-name = "same"
-type = "stcp"
-serverName = "a"
-secretKey = "secret"
-bindPort = 9001
-`,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			require := require.New(t)
-			path := filepath.Join(t.TempDir(), "frpc.toml")
-			require.NoError(os.WriteFile(path, []byte(tc.content), 0o600))
-
-			_, err := LoadClientConfigResult(path, false)
-			if tc.errSubstr == "" {
-				require.NoError(err)
-			} else {
-				require.ErrorContains(err, tc.errSubstr)
-			}
-		})
-	}
-}
-
 // TestYAMLEdgeCases tests edge cases for YAML parsing, including non-map types
 func TestYAMLEdgeCases(t *testing.T) {
 	require := require.New(t)
@@ -15,11 +15,9 @@
 package source

 import (
-	"cmp"
 	"errors"
 	"fmt"
-	"maps"
-	"slices"
+	"sort"
 	"sync"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
@@ -99,11 +97,21 @@ func (a *Aggregator) mapsToSortedSlices(
 	proxyMap map[string]v1.ProxyConfigurer,
 	visitorMap map[string]v1.VisitorConfigurer,
 ) ([]v1.ProxyConfigurer, []v1.VisitorConfigurer) {
-	proxies := slices.SortedFunc(maps.Values(proxyMap), func(x, y v1.ProxyConfigurer) int {
-		return cmp.Compare(x.GetBaseConfig().Name, y.GetBaseConfig().Name)
+	proxies := make([]v1.ProxyConfigurer, 0, len(proxyMap))
+	for _, p := range proxyMap {
+		proxies = append(proxies, p)
+	}
+	sort.Slice(proxies, func(i, j int) bool {
+		return proxies[i].GetBaseConfig().Name < proxies[j].GetBaseConfig().Name
 	})
-	visitors := slices.SortedFunc(maps.Values(visitorMap), func(x, y v1.VisitorConfigurer) int {
-		return cmp.Compare(x.GetBaseConfig().Name, y.GetBaseConfig().Name)
+
+	visitors := make([]v1.VisitorConfigurer, 0, len(visitorMap))
+	for _, v := range visitorMap {
+		visitors = append(visitors, v)
+	}
+	sort.Slice(visitors, func(i, j int) bool {
+		return visitors[i].GetBaseConfig().Name < visitors[j].GetBaseConfig().Name
 	})
+
 	return proxies, visitors
 }
@@ -196,27 +196,6 @@ func TestAggregator_VisitorMerge(t *testing.T) {
 	require.Len(visitors, 2)
 }

-func TestAggregator_Load_ReturnsSortedByName(t *testing.T) {
-	require := require.New(t)
-
-	agg := newTestAggregator(t, nil)
-	err := agg.ConfigSource().ReplaceAll(
-		[]v1.ProxyConfigurer{mockProxy("charlie"), mockProxy("alice"), mockProxy("bob")},
-		[]v1.VisitorConfigurer{mockVisitor("zulu"), mockVisitor("alpha")},
-	)
-	require.NoError(err)
-
-	proxies, visitors, err := agg.Load()
-	require.NoError(err)
-	require.Len(proxies, 3)
-	require.Equal("alice", proxies[0].GetBaseConfig().Name)
-	require.Equal("bob", proxies[1].GetBaseConfig().Name)
-	require.Equal("charlie", proxies[2].GetBaseConfig().Name)
-	require.Len(visitors, 2)
-	require.Equal("alpha", visitors[0].GetBaseConfig().Name)
-	require.Equal("zulu", visitors[1].GetBaseConfig().Name)
-}
-
 func TestAggregator_Load_ReturnsDefensiveCopies(t *testing.T) {
 	require := require.New(t)

@@ -14,7 +14,11 @@

 package source

-import v1 "github.com/fatedier/frp/pkg/config/v1"
+import (
+	"fmt"
+
+	v1 "github.com/fatedier/frp/pkg/config/v1"
+)

 // ConfigSource implements Source for in-memory configuration.
 // All operations are thread-safe.
@@ -35,17 +39,23 @@ func (s *ConfigSource) ReplaceAll(proxies []v1.ProxyConfigurer, visitors []v1.Vi

 	nextProxies := make(map[string]v1.ProxyConfigurer, len(proxies))
 	for _, p := range proxies {
-		name, err := validateProxyName(p)
-		if err != nil {
-			return err
+		if p == nil {
+			return fmt.Errorf("proxy cannot be nil")
+		}
+		name := p.GetBaseConfig().Name
+		if name == "" {
+			return fmt.Errorf("proxy name cannot be empty")
 		}
 		nextProxies[name] = p
 	}
 	nextVisitors := make(map[string]v1.VisitorConfigurer, len(visitors))
 	for _, v := range visitors {
-		name, err := validateVisitorName(v)
-		if err != nil {
-			return err
+		if v == nil {
+			return fmt.Errorf("visitor cannot be nil")
+		}
+		name := v.GetBaseConfig().Name
+		if name == "" {
+			return fmt.Errorf("visitor name cannot be empty")
 		}
 		nextVisitors[name] = v
 	}
@@ -43,11 +43,6 @@ var (
 	ErrNotFound      = errors.New("not found")
 )

-const (
-	storeKindProxy   = "proxy"
-	storeKindVisitor = "visitor"
-)
-
 func NewStoreSource(cfg StoreSourceConfig) (*StoreSource, error) {
 	if cfg.Path == "" {
 		return nil, fmt.Errorf("path is required")
@@ -177,111 +172,79 @@ func (s *StoreSource) saveToFileUnlocked() error {
 	return nil
 }

-func (s *StoreSource) persistOrRollbackUnlocked(rollback func()) error {
+func (s *StoreSource) AddProxy(proxy v1.ProxyConfigurer) error {
+	if proxy == nil {
+		return fmt.Errorf("proxy cannot be nil")
+	}
+
+	name := proxy.GetBaseConfig().Name
+	if name == "" {
+		return fmt.Errorf("proxy name cannot be empty")
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if _, exists := s.proxies[name]; exists {
+		return fmt.Errorf("%w: proxy %q", ErrAlreadyExists, name)
+	}
+
+	s.proxies[name] = proxy
+
 	if err := s.saveToFileUnlocked(); err != nil {
-		rollback()
+		delete(s.proxies, name)
 		return fmt.Errorf("failed to persist: %w", err)
 	}
 	return nil
 }

-// Store map selectors return the target map for generic helpers.
-func proxyStoreEntries(s *StoreSource) map[string]v1.ProxyConfigurer {
-	return s.proxies
-}
-
-func visitorStoreEntries(s *StoreSource) map[string]v1.VisitorConfigurer {
-	return s.visitors
-}
-
-// Store entry helpers share mutation, persistence, and rollback for proxy and visitor maps.
-// T is intentionally limited by callers to v1.ProxyConfigurer or v1.VisitorConfigurer.
-func addStoreEntry[T any](
-	s *StoreSource,
-	entriesFn func(*StoreSource) map[string]T,
-	kind string,
-	name string,
-	value T,
-) error {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	entries := entriesFn(s)
-	if _, exists := entries[name]; exists {
-		return fmt.Errorf("%w: %s %q", ErrAlreadyExists, kind, name)
-	}
-
-	entries[name] = value
-	return s.persistOrRollbackUnlocked(func() {
-		delete(entries, name)
-	})
-}
-
-func updateStoreEntry[T any](
-	s *StoreSource,
-	entriesFn func(*StoreSource) map[string]T,
-	kind string,
-	name string,
-	value T,
-) error {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	entries := entriesFn(s)
-	old, exists := entries[name]
-	if !exists {
-		return fmt.Errorf("%w: %s %q", ErrNotFound, kind, name)
-	}
-
-	entries[name] = value
-	return s.persistOrRollbackUnlocked(func() {
-		entries[name] = old
-	})
-}
-
-func removeStoreEntry[T any](
-	s *StoreSource,
-	entriesFn func(*StoreSource) map[string]T,
-	kind string,
-	name string,
-) error {
-	if name == "" {
-		return fmt.Errorf("%s name cannot be empty", kind)
-	}
-
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	entries := entriesFn(s)
-	old, exists := entries[name]
-	if !exists {
-		return fmt.Errorf("%w: %s %q", ErrNotFound, kind, name)
-	}
-
-	delete(entries, name)
-	return s.persistOrRollbackUnlocked(func() {
-		entries[name] = old
-	})
-}
-
-func (s *StoreSource) AddProxy(proxy v1.ProxyConfigurer) error {
-	name, err := validateProxyName(proxy)
-	if err != nil {
-		return err
-	}
-	return addStoreEntry(s, proxyStoreEntries, storeKindProxy, name, proxy)
-}
-
 func (s *StoreSource) UpdateProxy(proxy v1.ProxyConfigurer) error {
-	name, err := validateProxyName(proxy)
-	if err != nil {
-		return err
+	if proxy == nil {
+		return fmt.Errorf("proxy cannot be nil")
 	}
-	return updateStoreEntry(s, proxyStoreEntries, storeKindProxy, name, proxy)
+
+	name := proxy.GetBaseConfig().Name
+	if name == "" {
+		return fmt.Errorf("proxy name cannot be empty")
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	oldProxy, exists := s.proxies[name]
+	if !exists {
+		return fmt.Errorf("%w: proxy %q", ErrNotFound, name)
+	}
+
+	s.proxies[name] = proxy
+
+	if err := s.saveToFileUnlocked(); err != nil {
+		s.proxies[name] = oldProxy
+		return fmt.Errorf("failed to persist: %w", err)
+	}
+	return nil
 }

 func (s *StoreSource) RemoveProxy(name string) error {
-	return removeStoreEntry(s, proxyStoreEntries, storeKindProxy, name)
+	if name == "" {
+		return fmt.Errorf("proxy name cannot be empty")
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	oldProxy, exists := s.proxies[name]
+	if !exists {
+		return fmt.Errorf("%w: proxy %q", ErrNotFound, name)
+	}
+
+	delete(s.proxies, name)
+
+	if err := s.saveToFileUnlocked(); err != nil {
+		s.proxies[name] = oldProxy
+		return fmt.Errorf("failed to persist: %w", err)
+	}
+	return nil
 }

 func (s *StoreSource) GetProxy(name string) v1.ProxyConfigurer {
@@ -296,23 +259,78 @@ func (s *StoreSource) GetProxy(name string) v1.ProxyConfigurer {
 }

 func (s *StoreSource) AddVisitor(visitor v1.VisitorConfigurer) error {
-	name, err := validateVisitorName(visitor)
-	if err != nil {
-		return err
+	if visitor == nil {
+		return fmt.Errorf("visitor cannot be nil")
 	}
-	return addStoreEntry(s, visitorStoreEntries, storeKindVisitor, name, visitor)
+
+	name := visitor.GetBaseConfig().Name
+	if name == "" {
+		return fmt.Errorf("visitor name cannot be empty")
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if _, exists := s.visitors[name]; exists {
+		return fmt.Errorf("%w: visitor %q", ErrAlreadyExists, name)
+	}
+
+	s.visitors[name] = visitor
+
+	if err := s.saveToFileUnlocked(); err != nil {
+		delete(s.visitors, name)
+		return fmt.Errorf("failed to persist: %w", err)
+	}
+	return nil
 }

 func (s *StoreSource) UpdateVisitor(visitor v1.VisitorConfigurer) error {
-	name, err := validateVisitorName(visitor)
-	if err != nil {
-		return err
+	if visitor == nil {
+		return fmt.Errorf("visitor cannot be nil")
 	}
-	return updateStoreEntry(s, visitorStoreEntries, storeKindVisitor, name, visitor)
+
+	name := visitor.GetBaseConfig().Name
+	if name == "" {
+		return fmt.Errorf("visitor name cannot be empty")
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	oldVisitor, exists := s.visitors[name]
+	if !exists {
+		return fmt.Errorf("%w: visitor %q", ErrNotFound, name)
+	}
+
+	s.visitors[name] = visitor
+
+	if err := s.saveToFileUnlocked(); err != nil {
+		s.visitors[name] = oldVisitor
+		return fmt.Errorf("failed to persist: %w", err)
+	}
+	return nil
 }

 func (s *StoreSource) RemoveVisitor(name string) error {
-	return removeStoreEntry(s, visitorStoreEntries, storeKindVisitor, name)
+	if name == "" {
+		return fmt.Errorf("visitor name cannot be empty")
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	oldVisitor, exists := s.visitors[name]
+	if !exists {
+		return fmt.Errorf("%w: visitor %q", ErrNotFound, name)
+	}
+
+	delete(s.visitors, name)
+
+	if err := s.saveToFileUnlocked(); err != nil {
+		s.visitors[name] = oldVisitor
+		return fmt.Errorf("failed to persist: %w", err)
+	}
+	return nil
 }

 func (s *StoreSource) GetVisitor(name string) v1.VisitorConfigurer {
@@ -17,7 +17,6 @@ package source
 import (
 	"os"
 	"path/filepath"
-	"runtime"
 	"testing"

 	"github.com/stretchr/testify/require"
@@ -60,101 +59,6 @@ func TestStoreSource_AddProxyAndVisitor_DoesNotApplyRuntimeDefaults(t *testing.T
 	require.Empty(gotVisitor.(*v1.XTCPVisitorConfig).Protocol)
 }

-func TestStoreSource_UpdateAndRemoveProxyAndVisitor(t *testing.T) {
-	require := require.New(t)
-
-	storeSource := newTestStoreSource(t)
-
-	proxyCfg := mockProxy("proxy1")
-	visitorCfg := mockVisitor("visitor1")
-
-	require.NoError(storeSource.AddProxy(proxyCfg))
-	require.NoError(storeSource.AddVisitor(visitorCfg))
-	require.ErrorIs(storeSource.AddProxy(proxyCfg), ErrAlreadyExists)
-	require.ErrorIs(storeSource.AddVisitor(visitorCfg), ErrAlreadyExists)
-	require.ErrorContains(storeSource.RemoveProxy(""), "proxy name cannot be empty")
-	require.ErrorContains(storeSource.RemoveVisitor(""), "visitor name cannot be empty")
-
-	updatedProxy := mockProxy("proxy1").(*v1.TCPProxyConfig)
-	updatedProxy.RemotePort = 19090
-	require.NoError(storeSource.UpdateProxy(updatedProxy))
-	require.Equal(19090, storeSource.GetProxy("proxy1").(*v1.TCPProxyConfig).RemotePort)
-
-	updatedVisitor := mockVisitor("visitor1").(*v1.STCPVisitorConfig)
-	updatedVisitor.ServerName = "updated-server"
-	require.NoError(storeSource.UpdateVisitor(updatedVisitor))
-	require.Equal("updated-server", storeSource.GetVisitor("visitor1").(*v1.STCPVisitorConfig).ServerName)
-
-	require.NoError(storeSource.RemoveProxy("proxy1"))
-	require.Nil(storeSource.GetProxy("proxy1"))
-	require.ErrorIs(storeSource.RemoveProxy("proxy1"), ErrNotFound)
-
-	require.NoError(storeSource.RemoveVisitor("visitor1"))
-	require.Nil(storeSource.GetVisitor("visitor1"))
-	require.ErrorIs(storeSource.RemoveVisitor("visitor1"), ErrNotFound)
-
-	require.ErrorIs(storeSource.UpdateProxy(updatedProxy), ErrNotFound)
-	require.ErrorIs(storeSource.UpdateVisitor(updatedVisitor), ErrNotFound)
-}
-
-func TestStoreSource_MutationRollsBackOnPersistFailure(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("chmod does not make directories unwritable on Windows")
-	}
-	if os.Getuid() == 0 {
-		t.Skip("chmod does not block writes for uid 0")
-	}
-
-	require := require.New(t)
-
-	dir := t.TempDir()
-	path := filepath.Join(dir, "store.json")
-	storeSource, err := NewStoreSource(StoreSourceConfig{Path: path})
-	require.NoError(err)
-
-	proxyCfg := mockProxy("proxy1")
-	visitorCfg := mockVisitor("visitor1")
-	originalRemotePort := proxyCfg.(*v1.TCPProxyConfig).RemotePort
-	originalServerName := visitorCfg.(*v1.STCPVisitorConfig).ServerName
-	require.NoError(storeSource.AddProxy(proxyCfg))
-	require.NoError(storeSource.AddVisitor(visitorCfg))
-
-	require.NoError(os.Chmod(dir, 0o500))
-	t.Cleanup(func() {
-		_ = os.Chmod(dir, 0o700)
-	})
-
-	requirePersistError := func(err error) {
-		t.Helper()
-		require.Error(err)
-		require.ErrorContains(err, "failed to persist")
-		require.NotErrorIs(err, ErrAlreadyExists)
-		require.NotErrorIs(err, ErrNotFound)
-	}
-
-	requirePersistError(storeSource.AddProxy(mockProxy("proxy2")))
-	require.Nil(storeSource.GetProxy("proxy2"))
-
-	updatedProxy := mockProxy("proxy1").(*v1.TCPProxyConfig)
-	updatedProxy.RemotePort = 19090
-	requirePersistError(storeSource.UpdateProxy(updatedProxy))
-	require.Equal(originalRemotePort, storeSource.GetProxy("proxy1").(*v1.TCPProxyConfig).RemotePort)
-
-	requirePersistError(storeSource.RemoveProxy("proxy1"))
-	require.NotNil(storeSource.GetProxy("proxy1"))
-
-	requirePersistError(storeSource.AddVisitor(mockVisitor("visitor2")))
-	require.Nil(storeSource.GetVisitor("visitor2"))
-
-	updatedVisitor := mockVisitor("visitor1").(*v1.STCPVisitorConfig)
-	updatedVisitor.ServerName = "updated-server"
-	requirePersistError(storeSource.UpdateVisitor(updatedVisitor))
-	require.Equal(originalServerName, storeSource.GetVisitor("visitor1").(*v1.STCPVisitorConfig).ServerName)
-
-	requirePersistError(storeSource.RemoveVisitor("visitor1"))
-	require.NotNil(storeSource.GetVisitor("visitor1"))
-}
-
 func TestStoreSource_LoadFromFile_DoesNotApplyRuntimeDefaults(t *testing.T) {
 	require := require.New(t)

@@ -1,43 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package source
-
-import (
-	"fmt"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-)
-
-func validateProxyName(proxy v1.ProxyConfigurer) (string, error) {
-	if proxy == nil {
-		return "", fmt.Errorf("proxy cannot be nil")
-	}
-	name := proxy.GetBaseConfig().Name
-	if name == "" {
-		return "", fmt.Errorf("proxy name cannot be empty")
-	}
-	return name, nil
-}
-
-func validateVisitorName(visitor v1.VisitorConfigurer) (string, error) {
-	if visitor == nil {
-		return "", fmt.Errorf("visitor cannot be nil")
-	}
-	name := visitor.GetBaseConfig().Name
-	if name == "" {
-		return "", fmt.Errorf("visitor name cannot be empty")
-	}
-	return name, nil
-}
@@ -38,7 +38,7 @@ func parseNumberRangePair(firstRangeStr, secondRangeStr string) ([]NumberPair, e
 		return nil, fmt.Errorf("first and second range numbers are not in pairs")
 	}
 	pairs := make([]NumberPair, 0, len(firstRangeNumbers))
-	for i := range firstRangeNumbers {
+	for i := 0; i < len(firstRangeNumbers); i++ {
 		pairs = append(pairs, NumberPair{
 			First:  firstRangeNumbers[i],
 			Second: secondRangeNumbers[i],
@@ -70,18 +70,24 @@ func (q *BandwidthQuantity) UnmarshalString(s string) error {
 		f    float64
 		err  error
 	)
-	if fstr, ok := strings.CutSuffix(s, "MB"); ok {
+	switch {
+	case strings.HasSuffix(s, "MB"):
 		base = MB
+		fstr := strings.TrimSuffix(s, "MB")
 		f, err = strconv.ParseFloat(fstr, 64)
-	} else if fstr, ok := strings.CutSuffix(s, "KB"); ok {
-		base = KB
-		f, err = strconv.ParseFloat(fstr, 64)
-	} else {
-		return errors.New("unit not support")
-	}
 		if err != nil {
 			return err
 		}
+	case strings.HasSuffix(s, "KB"):
+		base = KB
+		fstr := strings.TrimSuffix(s, "KB")
+		f, err = strconv.ParseFloat(fstr, 64)
+		if err != nil {
+			return err
+		}
+	default:
+		return errors.New("unit not support")
+	}

 	q.s = s
 	q.i = int64(f * float64(base))
@@ -137,8 +143,8 @@ func (p PortsRangeSlice) String() string {
 func NewPortsRangeSliceFromString(str string) ([]PortsRange, error) {
 	str = strings.TrimSpace(str)
 	out := []PortsRange{}
-	numRanges := strings.SplitSeq(str, ",")
-	for numRangeStr := range numRanges {
+	numRanges := strings.Split(str, ",")
+	for _, numRangeStr := range numRanges {
 		// 1000-2000 or 2001
 		numArray := strings.Split(numRangeStr, "-")
 		// length: only 1 or 2 is correct
@@ -39,31 +39,6 @@ func TestBandwidthQuantity(t *testing.T) {
 	require.Equal(`{"b":"1KB","int":5}`, string(buf))
 }

-func TestBandwidthQuantity_MB(t *testing.T) {
-	require := require.New(t)
-
-	var w Wrap
-	err := json.Unmarshal([]byte(`{"b":"2MB","int":1}`), &w)
-	require.NoError(err)
-	require.EqualValues(2*MB, w.B.Bytes())
-
-	buf, err := json.Marshal(&w)
-	require.NoError(err)
-	require.Equal(`{"b":"2MB","int":1}`, string(buf))
-}
-
-func TestBandwidthQuantity_InvalidUnit(t *testing.T) {
-	var w Wrap
-	err := json.Unmarshal([]byte(`{"b":"1GB","int":1}`), &w)
-	require.Error(t, err)
-}
-
-func TestBandwidthQuantity_InvalidNumber(t *testing.T) {
-	var w Wrap
-	err := json.Unmarshal([]byte(`{"b":"abcKB","int":1}`), &w)
-	require.Error(t, err)
-}
-
 func TestPortsRangeSlice2String(t *testing.T) {
 	require := require.New(t)

@@ -85,7 +85,7 @@ type ClientCommonConfig struct {
 func (c *ClientCommonConfig) Complete() error {
 	c.ServerAddr = util.EmptyOr(c.ServerAddr, "0.0.0.0")
 	c.ServerPort = util.EmptyOr(c.ServerPort, 7000)
-	c.LoginFailExit = util.EmptyOr(c.LoginFailExit, new(true))
+	c.LoginFailExit = util.EmptyOr(c.LoginFailExit, lo.ToPtr(true))
 	c.NatHoleSTUNServer = util.EmptyOr(c.NatHoleSTUNServer, "stun.easyvoip.com:3478")

 	if err := c.Auth.Complete(); err != nil {
@@ -104,9 +104,6 @@ type ClientTransportConfig struct {
 	// Valid values are "tcp", "kcp", "quic", "websocket" and "wss". By default, this value
 	// is "tcp".
 	Protocol string `json:"protocol,omitempty"`
-	// WireProtocol specifies the frpc/frps internal wire protocol version.
-	// Valid values are "v1" and "v2". By default, this value is "v1".
-	WireProtocol string `json:"wireProtocol,omitempty"`
 	// The maximum amount of time a dial to server will wait for a connect to complete.
 	DialServerTimeout int64 `json:"dialServerTimeout,omitempty"`
 	// DialServerKeepAlive specifies the interval between keep-alive probes for an active network connection between frpc and frps.
@@ -146,12 +143,11 @@ type ClientTransportConfig struct {

 func (c *ClientTransportConfig) Complete() {
 	c.Protocol = util.EmptyOr(c.Protocol, "tcp")
-	c.WireProtocol = util.EmptyOr(c.WireProtocol, "v1")
 	c.DialServerTimeout = util.EmptyOr(c.DialServerTimeout, 10)
 	c.DialServerKeepAlive = util.EmptyOr(c.DialServerKeepAlive, 7200)
 	c.ProxyURL = util.EmptyOr(c.ProxyURL, os.Getenv("http_proxy"))
 	c.PoolCount = util.EmptyOr(c.PoolCount, 1)
-	c.TCPMux = util.EmptyOr(c.TCPMux, new(true))
+	c.TCPMux = util.EmptyOr(c.TCPMux, lo.ToPtr(true))
 	c.TCPMuxKeepaliveInterval = util.EmptyOr(c.TCPMuxKeepaliveInterval, 30)
 	if lo.FromPtr(c.TCPMux) {
 		// If TCPMux is enabled, heartbeat of application layer is unnecessary because we can rely on heartbeat in tcpmux.
@@ -180,8 +176,8 @@ type TLSClientConfig struct {
 }

 func (c *TLSClientConfig) Complete() {
-	c.Enable = util.EmptyOr(c.Enable, new(true))
-	c.DisableCustomTLSFirstByte = util.EmptyOr(c.DisableCustomTLSFirstByte, new(true))
+	c.Enable = util.EmptyOr(c.Enable, lo.ToPtr(true))
+	c.DisableCustomTLSFirstByte = util.EmptyOr(c.DisableCustomTLSFirstByte, lo.ToPtr(true))
 }

 type AuthClientConfig struct {
@@ -29,7 +29,6 @@ func TestClientConfigComplete(t *testing.T) {

 	require.EqualValues("token", c.Auth.Method)
 	require.Equal(true, lo.FromPtr(c.Transport.TCPMux))
-	require.Equal("v1", c.Transport.WireProtocol)
 	require.Equal(true, lo.FromPtr(c.LoginFailExit))
 	require.Equal(true, lo.FromPtr(c.Transport.TLS.Enable))
 	require.Equal(true, lo.FromPtr(c.Transport.TLS.DisableCustomTLSFirstByte))
@@ -239,14 +239,14 @@ const (
 )

 var proxyConfigTypeMap = map[ProxyType]reflect.Type{
-	ProxyTypeTCP:    reflect.TypeFor[TCPProxyConfig](),
-	ProxyTypeUDP:    reflect.TypeFor[UDPProxyConfig](),
-	ProxyTypeHTTP:   reflect.TypeFor[HTTPProxyConfig](),
-	ProxyTypeHTTPS:  reflect.TypeFor[HTTPSProxyConfig](),
-	ProxyTypeTCPMUX: reflect.TypeFor[TCPMuxProxyConfig](),
-	ProxyTypeSTCP:   reflect.TypeFor[STCPProxyConfig](),
-	ProxyTypeXTCP:   reflect.TypeFor[XTCPProxyConfig](),
-	ProxyTypeSUDP:   reflect.TypeFor[SUDPProxyConfig](),
+	ProxyTypeTCP:    reflect.TypeOf(TCPProxyConfig{}),
+	ProxyTypeUDP:    reflect.TypeOf(UDPProxyConfig{}),
+	ProxyTypeHTTP:   reflect.TypeOf(HTTPProxyConfig{}),
+	ProxyTypeHTTPS:  reflect.TypeOf(HTTPSProxyConfig{}),
+	ProxyTypeTCPMUX: reflect.TypeOf(TCPMuxProxyConfig{}),
+	ProxyTypeSTCP:   reflect.TypeOf(STCPProxyConfig{}),
+	ProxyTypeXTCP:   reflect.TypeOf(XTCPProxyConfig{}),
+	ProxyTypeSUDP:   reflect.TypeOf(SUDPProxyConfig{}),
 }

 func NewProxyConfigurerByType(proxyType ProxyType) ProxyConfigurer {
@@ -17,6 +17,8 @@ package v1
 import (
 	"reflect"

+	"github.com/samber/lo"
+
 	"github.com/fatedier/frp/pkg/util/jsonx"
 	"github.com/fatedier/frp/pkg/util/util"
 )
@@ -35,16 +37,16 @@ const (
 )

 var clientPluginOptionsTypeMap = map[string]reflect.Type{
-	PluginHTTP2HTTPS:       reflect.TypeFor[HTTP2HTTPSPluginOptions](),
-	PluginHTTPProxy:        reflect.TypeFor[HTTPProxyPluginOptions](),
-	PluginHTTPS2HTTP:       reflect.TypeFor[HTTPS2HTTPPluginOptions](),
-	PluginHTTPS2HTTPS:      reflect.TypeFor[HTTPS2HTTPSPluginOptions](),
-	PluginHTTP2HTTP:        reflect.TypeFor[HTTP2HTTPPluginOptions](),
-	PluginSocks5:           reflect.TypeFor[Socks5PluginOptions](),
-	PluginStaticFile:       reflect.TypeFor[StaticFilePluginOptions](),
-	PluginUnixDomainSocket: reflect.TypeFor[UnixDomainSocketPluginOptions](),
-	PluginTLS2Raw:          reflect.TypeFor[TLS2RawPluginOptions](),
-	PluginVirtualNet:       reflect.TypeFor[VirtualNetPluginOptions](),
+	PluginHTTP2HTTPS:       reflect.TypeOf(HTTP2HTTPSPluginOptions{}),
+	PluginHTTPProxy:        reflect.TypeOf(HTTPProxyPluginOptions{}),
+	PluginHTTPS2HTTP:       reflect.TypeOf(HTTPS2HTTPPluginOptions{}),
+	PluginHTTPS2HTTPS:      reflect.TypeOf(HTTPS2HTTPSPluginOptions{}),
+	PluginHTTP2HTTP:        reflect.TypeOf(HTTP2HTTPPluginOptions{}),
+	PluginSocks5:           reflect.TypeOf(Socks5PluginOptions{}),
+	PluginStaticFile:       reflect.TypeOf(StaticFilePluginOptions{}),
+	PluginUnixDomainSocket: reflect.TypeOf(UnixDomainSocketPluginOptions{}),
+	PluginTLS2Raw:          reflect.TypeOf(TLS2RawPluginOptions{}),
+	PluginVirtualNet:       reflect.TypeOf(VirtualNetPluginOptions{}),
 }

 type ClientPluginOptions interface {
@@ -123,7 +125,7 @@ type HTTPS2HTTPPluginOptions struct {
 }

 func (o *HTTPS2HTTPPluginOptions) Complete() {
-	o.EnableHTTP2 = util.EmptyOr(o.EnableHTTP2, new(true))
+	o.EnableHTTP2 = util.EmptyOr(o.EnableHTTP2, lo.ToPtr(true))
 }

 func (o *HTTPS2HTTPPluginOptions) Clone() ClientPluginOptions {
@@ -147,7 +149,7 @@ type HTTPS2HTTPSPluginOptions struct {
 }

 func (o *HTTPS2HTTPSPluginOptions) Complete() {
-	o.EnableHTTP2 = util.EmptyOr(o.EnableHTTP2, new(true))
+	o.EnableHTTP2 = util.EmptyOr(o.EnableHTTP2, lo.ToPtr(true))
 }

 func (o *HTTPS2HTTPSPluginOptions) Clone() ClientPluginOptions {
@@ -118,7 +118,7 @@ func (c *ServerConfig) Complete() error {
 	}

 	c.VhostHTTPTimeout = util.EmptyOr(c.VhostHTTPTimeout, 60)
-	c.DetailedErrorsToClient = util.EmptyOr(c.DetailedErrorsToClient, new(true))
+	c.DetailedErrorsToClient = util.EmptyOr(c.DetailedErrorsToClient, lo.ToPtr(true))
 	c.UserConnTimeout = util.EmptyOr(c.UserConnTimeout, 10)
 	c.UDPPacketSize = util.EmptyOr(c.UDPPacketSize, 1500)
 	c.NatHoleAnalysisDataReserveHours = util.EmptyOr(c.NatHoleAnalysisDataReserveHours, 7*24)
@@ -167,7 +167,7 @@ type ServerTransportConfig struct {
 	// If negative, keep-alive probes are disabled.
 	TCPKeepAlive int64 `json:"tcpKeepalive,omitempty"`
 	// MaxPoolCount specifies the maximum pool size for each proxy. By default,
-	// this value is 5. Negative values are invalid.
+	// this value is 5.
 	MaxPoolCount int64 `json:"maxPoolCount,omitempty"`
 	// HeartBeatTimeout specifies the maximum time to wait for a heartbeat
 	// before terminating the connection. It is not recommended to change this
@@ -180,7 +180,7 @@ type ServerTransportConfig struct {
 }

 func (c *ServerTransportConfig) Complete() {
-	c.TCPMux = util.EmptyOr(c.TCPMux, new(true))
+	c.TCPMux = util.EmptyOr(c.TCPMux, lo.ToPtr(true))
 	c.TCPMuxKeepaliveInterval = util.EmptyOr(c.TCPMuxKeepaliveInterval, 30)
 	c.TCPKeepAlive = util.EmptyOr(c.TCPKeepAlive, 7200)
 	c.MaxPoolCount = util.EmptyOr(c.MaxPoolCount, 5)
@@ -1,43 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package validation
-
-import (
-	"fmt"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/policy/security"
-)
-
-func (v *ConfigValidator) validateAuthTokenSource(token string, tokenSource *v1.ValueSource) error {
-	var errs error
-	// Preserve the previous client/server validation order for joined errors.
-	if token != "" && tokenSource != nil {
-		errs = AppendError(errs, fmt.Errorf("cannot specify both auth.token and auth.tokenSource"))
-	}
-	if tokenSource == nil {
-		return errs
-	}
-
-	if tokenSource.Type == "exec" {
-		if err := v.ValidateUnsafeFeature(security.TokenSourceExec); err != nil {
-			errs = AppendError(errs, err)
-		}
-	}
-	if err := tokenSource.Validate(); err != nil {
-		errs = AppendError(errs, fmt.Errorf("invalid auth.tokenSource: %v", err))
-	}
-	return errs
-}
@@ -1,228 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package validation
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/policy/security"
-)
-
-const (
-	tokenSourceConflictErr = "cannot specify both auth.token and auth.tokenSource"
-	tokenSourceExecErr     = "unsafe feature \"TokenSourceExec\" is not enabled. To enable it, ensure it is allowed in the configuration or command line flags"
-	invalidFileSourceErr   = "invalid auth.tokenSource: file configuration is required when type is 'file'"
-	unsupportedSourceErr   = "invalid auth.tokenSource: unsupported value source type: env (only 'file' and 'exec' are supported)"
-)
-
-func TestValidateAuthTokenSource(t *testing.T) {
-	for _, tc := range authTokenSourceTestCases() {
-		t.Run(tc.name, func(t *testing.T) {
-			validator := newAuthTokenSourceValidator(tc.unsafeAllowed)
-			err := validator.validateAuthTokenSource(tc.token, tc.tokenSource())
-			requireValidationErrors(t, err, tc.wantErrs)
-		})
-	}
-}
-
-func TestValidateClientAuthTokenSource(t *testing.T) {
-	for _, tc := range authTokenSourceTestCases() {
-		t.Run(tc.name, func(t *testing.T) {
-			auth := v1.AuthClientConfig{
-				Method:      v1.AuthMethodToken,
-				Token:       tc.token,
-				TokenSource: tc.tokenSource(),
-			}
-			validator := newAuthTokenSourceValidator(tc.unsafeAllowed)
-			_, err := validator.ValidateClientCommonConfig(validClientConfigWithAuth(auth))
-			requireValidationErrors(t, err, tc.wantErrs)
-		})
-	}
-}
-
-func TestValidateServerAuthTokenSource(t *testing.T) {
-	for _, tc := range authTokenSourceTestCases() {
-		t.Run(tc.name, func(t *testing.T) {
-			auth := v1.AuthServerConfig{
-				Method:      v1.AuthMethodToken,
-				Token:       tc.token,
-				TokenSource: tc.tokenSource(),
-			}
-			validator := newAuthTokenSourceValidator(tc.unsafeAllowed)
-			_, err := validator.ValidateServerConfig(validServerConfigWithAuth(auth))
-			requireValidationErrors(t, err, tc.wantErrs)
-		})
-	}
-}
-
-type authTokenSourceTestCase struct {
-	name          string
-	token         string
-	tokenSource   func() *v1.ValueSource
-	unsafeAllowed bool
-	wantErrs      []string
-}
-
-func authTokenSourceTestCases() []authTokenSourceTestCase {
-	return []authTokenSourceTestCase{
-		{
-			name:        "empty token config",
-			tokenSource: nilTokenSource,
-		},
-		{
-			name:        "valid file tokenSource",
-			tokenSource: validFileTokenSource,
-		},
-		{
-			name:        "literal token without tokenSource",
-			token:       "token",
-			tokenSource: nilTokenSource,
-		},
-		{
-			name:        "literal token conflicts with file tokenSource",
-			token:       "token",
-			tokenSource: validFileTokenSource,
-			wantErrs:    []string{tokenSourceConflictErr},
-		},
-		{
-			name:        "exec tokenSource requires unsafe feature",
-			tokenSource: validExecTokenSource,
-			wantErrs:    []string{tokenSourceExecErr},
-		},
-		{
-			name:          "exec tokenSource with unsafe feature allowed",
-			tokenSource:   validExecTokenSource,
-			unsafeAllowed: true,
-		},
-		{
-			name:        "literal token conflicts with exec tokenSource and unsafe feature disabled",
-			token:       "token",
-			tokenSource: validExecTokenSource,
-			wantErrs: []string{
-				tokenSourceConflictErr,
-				tokenSourceExecErr,
-			},
-		},
-		{
-			name:          "literal token conflicts with exec tokenSource and unsafe feature allowed",
-			token:         "token",
-			tokenSource:   validExecTokenSource,
-			unsafeAllowed: true,
-			wantErrs:      []string{tokenSourceConflictErr},
-		},
-		{
-			name:        "invalid file tokenSource is wrapped",
-			tokenSource: invalidFileTokenSource,
-			wantErrs:    []string{invalidFileSourceErr},
-		},
-		{
-			name:        "unsupported tokenSource type is wrapped",
-			tokenSource: unsupportedTokenSource,
-			wantErrs:    []string{unsupportedSourceErr},
-		},
-	}
-}
-
-func newAuthTokenSourceValidator(unsafeAllowed bool) *ConfigValidator {
-	if !unsafeAllowed {
-		return NewConfigValidator(nil)
-	}
-	return NewConfigValidator(security.NewUnsafeFeatures([]string{security.TokenSourceExec}))
-}
-
-func requireValidationErrors(t *testing.T, err error, wantErrs []string) {
-	t.Helper()
-	if len(wantErrs) == 0 {
-		require.NoError(t, err)
-		return
-	}
-	require.Error(t, err)
-	// Client/server validators may wrap joined errors in another join layer; compare leaf errors.
-	gotErrs := unwrapValidationErrors(err)
-	require.Len(t, gotErrs, len(wantErrs))
-	for i, wantErr := range wantErrs {
-		require.EqualError(t, gotErrs[i], wantErr)
-	}
-}
-
-func unwrapValidationErrors(err error) []error {
-	type joinedError interface {
-		Unwrap() []error
-	}
-	joined, ok := err.(joinedError)
-	if !ok {
-		return []error{err}
-	}
-
-	var errs []error
-	for _, err := range joined.Unwrap() {
-		errs = append(errs, unwrapValidationErrors(err)...)
-	}
-	return errs
-}
-
-// nilTokenSource keeps the shared table shape uniform for cases without a tokenSource.
-func nilTokenSource() *v1.ValueSource {
-	return nil
-}
-
-func validFileTokenSource() *v1.ValueSource {
-	return &v1.ValueSource{
-		Type: "file",
-		File: &v1.FileSource{Path: "token.txt"},
-	}
-}
-
-func validExecTokenSource() *v1.ValueSource {
-	return &v1.ValueSource{
-		Type: "exec",
-		Exec: &v1.ExecSource{Command: "print-token"},
-	}
-}
-
-func invalidFileTokenSource() *v1.ValueSource {
-	return &v1.ValueSource{
-		Type: "file",
-	}
-}
-
-func unsupportedTokenSource() *v1.ValueSource {
-	return &v1.ValueSource{Type: "env"}
-}
-
-func validClientConfigWithAuth(auth v1.AuthClientConfig) *v1.ClientCommonConfig {
-	return &v1.ClientCommonConfig{
-		Auth: auth,
-		Log: v1.LogConfig{
-			Level: "info",
-		},
-		Transport: v1.ClientTransportConfig{
-			Protocol:     "tcp",
-			WireProtocol: "v1",
-		},
-	}
-}
-
-func validServerConfigWithAuth(auth v1.AuthServerConfig) *v1.ServerConfig {
-	return &v1.ServerConfig{
-		Auth: auth,
-		Log: v1.LogConfig{
-			Level: "info",
-		},
-	}
-}
@@ -51,51 +51,14 @@ func (v *ConfigValidator) ValidateClientCommonConfig(c *v1.ClientCommonConfig) (
 }

 func validateFeatureGates(c *v1.ClientCommonConfig) (Warning, error) {
-	gates := featuregate.NewFeatureGate()
-	if err := gates.SetFromMap(c.FeatureGates); err != nil {
-		return nil, err
-	}
-
 	if c.VirtualNet.Address != "" {
-		if !gates.Enabled(featuregate.VirtualNet) {
+		if !featuregate.Enabled(featuregate.VirtualNet) {
 			return nil, fmt.Errorf("VirtualNet feature is not enabled; enable it by setting the appropriate feature gate flag")
 		}
 	}
 	return nil, nil
 }

-// ClientConfigRequirements describes runtime capabilities needed by a client configuration.
-type ClientConfigRequirements struct {
-	VirtualNet bool
-}
-
-// GetClientConfigRequirements returns the runtime capabilities needed by a client configuration.
-func GetClientConfigRequirements(
-	common *v1.ClientCommonConfig,
-	proxyCfgs []v1.ProxyConfigurer,
-	visitorCfgs []v1.VisitorConfigurer,
-) ClientConfigRequirements {
-	requirements := ClientConfigRequirements{}
-	if common != nil && common.VirtualNet.Address != "" {
-		requirements.VirtualNet = true
-	}
-	for _, cfg := range proxyCfgs {
-		if cfg.GetBaseConfig().Plugin.Type == v1.PluginVirtualNet {
-			requirements.VirtualNet = true
-			break
-		}
-	}
-	if !requirements.VirtualNet {
-		for _, cfg := range visitorCfgs {
-			if cfg.GetBaseConfig().Plugin.Type == v1.VisitorPluginVirtualNet {
-				requirements.VirtualNet = true
-				break
-			}
-		}
-	}
-	return requirements
-}
-
 func (v *ConfigValidator) validateAuthConfig(c *v1.AuthClientConfig) (Warning, error) {
 	var errs error
 	if !slices.Contains(SupportedAuthMethods, c.Method) {
@@ -105,16 +68,26 @@ func (v *ConfigValidator) validateAuthConfig(c *v1.AuthClientConfig) (Warning, e
 		errs = AppendError(errs, fmt.Errorf("invalid auth additional scopes, optional values are %v", SupportedAuthAdditionalScopes))
 	}

-	errs = AppendError(errs, v.validateAuthTokenSource(c.Token, c.TokenSource))
+	// Validate token/tokenSource mutual exclusivity
+	if c.Token != "" && c.TokenSource != nil {
+		errs = AppendError(errs, fmt.Errorf("cannot specify both auth.token and auth.tokenSource"))
+	}
+
+	// Validate tokenSource if specified
+	if c.TokenSource != nil {
+		if c.TokenSource.Type == "exec" {
+			if err := v.ValidateUnsafeFeature(security.TokenSourceExec); err != nil {
+				errs = AppendError(errs, err)
+			}
+		}
+		if err := c.TokenSource.Validate(); err != nil {
+			errs = AppendError(errs, fmt.Errorf("invalid auth.tokenSource: %v", err))
+		}
+	}

 	if err := v.validateOIDCConfig(&c.OIDC); err != nil {
 		errs = AppendError(errs, err)
 	}
-	if c.Method == v1.AuthMethodOIDC && c.OIDC.TokenSource == nil {
-		if err := ValidateOIDCClientCredentialsConfig(&c.OIDC); err != nil {
-			errs = AppendError(errs, err)
-		}
-	}
 	return nil, errs
 }

@@ -168,9 +141,6 @@ func validateTransportConfig(c *v1.ClientTransportConfig) (Warning, error) {
 	if !slices.Contains(SupportedTransportProtocols, c.Protocol) {
 		errs = AppendError(errs, fmt.Errorf("invalid transport.protocol, optional values are %v", SupportedTransportProtocols))
 	}
-	if !slices.Contains(SupportedWireProtocols, c.WireProtocol) {
-		errs = AppendError(errs, fmt.Errorf("invalid transport.wireProtocol, optional values are %v", SupportedWireProtocols))
-	}
 	return warnings, errs
 }

@@ -1,140 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package validation
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/policy/featuregate"
-	"github.com/fatedier/frp/pkg/policy/security"
-)
-
-func validateClientFeatureGates(t *testing.T, gates map[string]bool, virtualNetAddress string) error {
-	t.Helper()
-
-	cfg := &v1.ClientCommonConfig{
-		FeatureGates: gates,
-		VirtualNet: v1.VirtualNetConfig{
-			Address: virtualNetAddress,
-		},
-	}
-	require.NoError(t, cfg.Complete())
-
-	_, err := NewConfigValidator(security.NewUnsafeFeatures(nil)).ValidateClientCommonConfig(cfg)
-	return err
-}
-
-func TestValidateClientFeatureGates(t *testing.T) {
-	tests := []struct {
-		name              string
-		featureGates      map[string]bool
-		virtualNetAddress string
-		wantErr           string
-	}{
-		{
-			name:              "VirtualNet enabled",
-			featureGates:      map[string]bool{"VirtualNet": true},
-			virtualNetAddress: "100.86.0.4/24",
-		},
-		{
-			name:              "VirtualNet explicitly disabled",
-			featureGates:      map[string]bool{"VirtualNet": false},
-			virtualNetAddress: "100.86.0.4/24",
-			wantErr:           "VirtualNet feature is not enabled",
-		},
-		{
-			name:              "VirtualNet disabled by default",
-			virtualNetAddress: "100.86.0.4/24",
-			wantErr:           "VirtualNet feature is not enabled",
-		},
-		{
-			name:         "unknown feature gate",
-			featureGates: map[string]bool{"UnknownFeature": true},
-			wantErr:      "unrecognized feature gate: UnknownFeature",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			err := validateClientFeatureGates(t, tc.featureGates, tc.virtualNetAddress)
-			if tc.wantErr == "" {
-				require.NoError(t, err)
-				return
-			}
-			require.ErrorContains(t, err, tc.wantErr)
-		})
-	}
-}
-
-func TestGetClientConfigRequirements(t *testing.T) {
-	virtualNetProxy := &v1.STCPProxyConfig{
-		ProxyBaseConfig: v1.ProxyBaseConfig{
-			ProxyBackend: v1.ProxyBackend{
-				Plugin: v1.TypedClientPluginOptions{Type: v1.PluginVirtualNet},
-			},
-		},
-	}
-	virtualNetVisitor := &v1.STCPVisitorConfig{
-		VisitorBaseConfig: v1.VisitorBaseConfig{
-			Plugin: v1.TypedVisitorPluginOptions{Type: v1.VisitorPluginVirtualNet},
-		},
-	}
-
-	tests := []struct {
-		name     string
-		common   *v1.ClientCommonConfig
-		proxies  []v1.ProxyConfigurer
-		visitors []v1.VisitorConfigurer
-		wantVNet bool
-	}{
-		{name: "no requirements"},
-		{
-			name:     "common VirtualNet address",
-			common:   &v1.ClientCommonConfig{VirtualNet: v1.VirtualNetConfig{Address: "100.86.0.4/24"}},
-			wantVNet: true,
-		},
-		{name: "VirtualNet proxy", proxies: []v1.ProxyConfigurer{virtualNetProxy}, wantVNet: true},
-		{name: "VirtualNet visitor", visitors: []v1.VisitorConfigurer{virtualNetVisitor}, wantVNet: true},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got := GetClientConfigRequirements(tc.common, tc.proxies, tc.visitors)
-			require.Equal(t, tc.wantVNet, got.VirtualNet)
-		})
-	}
-}
-
-func TestValidateClientFeatureGatesAreConfigScoped(t *testing.T) {
-	defaultGatesBefore := featuregate.DefaultFeatureGates.String()
-
-	require.NoError(t, validateClientFeatureGates(
-		t,
-		map[string]bool{"VirtualNet": true},
-		"100.86.0.4/24",
-	))
-	require.Equal(t, defaultGatesBefore, featuregate.DefaultFeatureGates.String())
-
-	err := validateClientFeatureGates(
-		t,
-		map[string]bool{"VirtualNet": false},
-		"100.86.0.4/24",
-	)
-	require.ErrorContains(t, err, "VirtualNet feature is not enabled")
-	require.Equal(t, defaultGatesBefore, featuregate.DefaultFeatureGates.String())
-}
@@ -1,48 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package validation
-
-import (
-	"fmt"
-	"unicode"
-	"unicode/utf8"
-)
-
-const (
-	// MaxRunIDLength is the maximum number of bytes accepted for a control run ID.
-	MaxRunIDLength = 64
-)
-
-func validateIdentifier(value, kind string, maxLength int) error {
-	if value == "" {
-		return fmt.Errorf("%s cannot be empty", kind)
-	}
-	if len(value) > maxLength {
-		return fmt.Errorf("%s is too long: length %d exceeds maximum %d", kind, len(value), maxLength)
-	}
-	if !utf8.ValidString(value) {
-		return fmt.Errorf("%s must be valid UTF-8", kind)
-	}
-	for _, r := range value {
-		if !unicode.IsPrint(r) {
-			return fmt.Errorf("%s contains non-printable character", kind)
-		}
-	}
-	return nil
-}
-
-func ValidateRunID(runID string) error {
-	return validateIdentifier(runID, "run id", MaxRunIDLength)
-}
@@ -1,48 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package validation
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestValidateIdentifiers(t *testing.T) {
-	tests := []struct {
-		name      string
-		validate  func(string) error
-		value     string
-		wantError string
-	}{
-		{name: "run id accepts printable values", validate: ValidateRunID, value: "run-%1000s-中文"},
-		{name: "run id rejects empty", validate: ValidateRunID, wantError: "cannot be empty"},
-		{name: "run id rejects control character", validate: ValidateRunID, value: "run\nforged", wantError: "non-printable"},
-		{name: "run id rejects invalid utf8", validate: ValidateRunID, value: string([]byte{0xff}), wantError: "valid UTF-8"},
-		{name: "run id rejects excessive length", validate: ValidateRunID, value: strings.Repeat("a", MaxRunIDLength+1), wantError: "too long"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := tt.validate(tt.value)
-			if tt.wantError == "" {
-				require.NoError(t, err)
-				return
-			}
-			require.ErrorContains(t, err, tt.wantError)
-		})
-	}
-}
@@ -1,57 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package validation
-
-import (
-	"errors"
-	"net/url"
-	"strings"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-)
-
-func ValidateOIDCClientCredentialsConfig(c *v1.AuthOIDCClientConfig) error {
-	var errs []string
-
-	if c.ClientID == "" {
-		errs = append(errs, "auth.oidc.clientID is required")
-	}
-
-	if c.TokenEndpointURL == "" {
-		errs = append(errs, "auth.oidc.tokenEndpointURL is required")
-	} else {
-		tokenURL, err := url.Parse(c.TokenEndpointURL)
-		if err != nil || !tokenURL.IsAbs() || tokenURL.Host == "" {
-			errs = append(errs, "auth.oidc.tokenEndpointURL must be an absolute http or https URL")
-		} else if tokenURL.Scheme != "http" && tokenURL.Scheme != "https" {
-			errs = append(errs, "auth.oidc.tokenEndpointURL must use http or https")
-		}
-	}
-
-	if _, ok := c.AdditionalEndpointParams["scope"]; ok {
-		errs = append(errs, "auth.oidc.additionalEndpointParams.scope is not allowed; use auth.oidc.scope instead")
-	}
-
-	if c.Audience != "" {
-		if _, ok := c.AdditionalEndpointParams["audience"]; ok {
-			errs = append(errs, "cannot specify both auth.oidc.audience and auth.oidc.additionalEndpointParams.audience")
-		}
-	}
-
-	if len(errs) == 0 {
-		return nil
-	}
-	return errors.New(strings.Join(errs, "; "))
-}
@@ -1,78 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package validation
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-)
-
-func TestValidateOIDCClientCredentialsConfig(t *testing.T) {
-	tokenServer := httptest.NewServer(http.NotFoundHandler())
-	defer tokenServer.Close()
-
-	t.Run("valid", func(t *testing.T) {
-		require.NoError(t, ValidateOIDCClientCredentialsConfig(&v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			TokenEndpointURL: tokenServer.URL,
-			AdditionalEndpointParams: map[string]string{
-				"resource": "api",
-			},
-		}))
-	})
-
-	t.Run("invalid token endpoint url", func(t *testing.T) {
-		err := ValidateOIDCClientCredentialsConfig(&v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			TokenEndpointURL: "://bad",
-		})
-		require.ErrorContains(t, err, "auth.oidc.tokenEndpointURL")
-	})
-
-	t.Run("missing client id", func(t *testing.T) {
-		err := ValidateOIDCClientCredentialsConfig(&v1.AuthOIDCClientConfig{
-			TokenEndpointURL: tokenServer.URL,
-		})
-		require.ErrorContains(t, err, "auth.oidc.clientID is required")
-	})
-
-	t.Run("scope endpoint param is not allowed", func(t *testing.T) {
-		err := ValidateOIDCClientCredentialsConfig(&v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			TokenEndpointURL: tokenServer.URL,
-			AdditionalEndpointParams: map[string]string{
-				"scope": "email",
-			},
-		})
-		require.ErrorContains(t, err, "auth.oidc.additionalEndpointParams.scope is not allowed; use auth.oidc.scope instead")
-	})
-
-	t.Run("audience conflict", func(t *testing.T) {
-		err := ValidateOIDCClientCredentialsConfig(&v1.AuthOIDCClientConfig{
-			ClientID:         "test-client",
-			TokenEndpointURL: tokenServer.URL,
-			Audience:         "api",
-			AdditionalEndpointParams: map[string]string{
-				"audience": "override",
-			},
-		})
-		require.ErrorContains(t, err, "cannot specify both auth.oidc.audience and auth.oidc.additionalEndpointParams.audience")
-	})
-}
@@ -79,11 +79,9 @@ func validateDomainConfigForClient(c *v1.DomainConfig) error {
 }

 func validateDomainConfigForServer(c *v1.DomainConfig, s *v1.ServerConfig) error {
-	subDomainHost := strings.ToLower(s.SubDomainHost)
 	for _, domain := range c.CustomDomains {
-		canonicalDomain := strings.ToLower(domain)
-		if subDomainHost != "" && len(strings.Split(subDomainHost, ".")) < len(strings.Split(canonicalDomain, ".")) {
-			if strings.HasSuffix(canonicalDomain, "."+subDomainHost) {
+		if s.SubDomainHost != "" && len(strings.Split(s.SubDomainHost, ".")) < len(strings.Split(domain, ".")) {
+			if strings.HasSuffix(domain, "."+s.SubDomainHost) {
 				return fmt.Errorf("custom domain [%s] should not belong to subdomain host [%s]", domain, s.SubDomainHost)
 			}
 		}
@@ -1,76 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package validation
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-)
-
-func TestValidateDomainConfigForServerRejectsSubdomainHostCaseInsensitively(t *testing.T) {
-	tests := []struct {
-		name          string
-		subDomainHost string
-		customDomain  string
-		wantErr       bool
-	}{
-		{
-			name:          "lowercase subdomain",
-			subDomainHost: "frp.example.com",
-			customDomain:  "victim.frp.example.com",
-			wantErr:       true,
-		},
-		{
-			name:          "mixed case custom domain",
-			subDomainHost: "frp.example.com",
-			customDomain:  "victim.FRP.example.com",
-			wantErr:       true,
-		},
-		{
-			name:          "mixed case wildcard domain",
-			subDomainHost: "frp.example.com",
-			customDomain:  "*.FRP.example.com",
-			wantErr:       true,
-		},
-		{
-			name:          "mixed case subdomain host",
-			subDomainHost: "FRP.Example.Com",
-			customDomain:  "victim.frp.example.com",
-			wantErr:       true,
-		},
-		{
-			name:          "external domain",
-			subDomainHost: "frp.example.com",
-			customDomain:  "victim.example.net",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := validateDomainConfigForServer(
-				&v1.DomainConfig{CustomDomains: []string{tt.customDomain}},
-				&v1.ServerConfig{SubDomainHost: tt.subDomainHost},
-			)
-			if tt.wantErr {
-				require.ErrorContains(t, err, "should not belong to subdomain host")
-				return
-			}
-			require.NoError(t, err)
-		})
-	}
-}
@@ -21,6 +21,7 @@ import (
 	"github.com/samber/lo"

 	v1 "github.com/fatedier/frp/pkg/config/v1"
+	"github.com/fatedier/frp/pkg/policy/security"
 )

 func (v *ConfigValidator) ValidateServerConfig(c *v1.ServerConfig) (Warning, error) {
@@ -35,7 +36,22 @@ func (v *ConfigValidator) ValidateServerConfig(c *v1.ServerConfig) (Warning, err
 		errs = AppendError(errs, fmt.Errorf("invalid auth additional scopes, optional values are %v", SupportedAuthAdditionalScopes))
 	}

-	errs = AppendError(errs, v.validateAuthTokenSource(c.Auth.Token, c.Auth.TokenSource))
+	// Validate token/tokenSource mutual exclusivity
+	if c.Auth.Token != "" && c.Auth.TokenSource != nil {
+		errs = AppendError(errs, fmt.Errorf("cannot specify both auth.token and auth.tokenSource"))
+	}
+
+	// Validate tokenSource if specified
+	if c.Auth.TokenSource != nil {
+		if c.Auth.TokenSource.Type == "exec" {
+			if err := v.ValidateUnsafeFeature(security.TokenSourceExec); err != nil {
+				errs = AppendError(errs, err)
+			}
+		}
+		if err := c.Auth.TokenSource.Validate(); err != nil {
+			errs = AppendError(errs, fmt.Errorf("invalid auth.tokenSource: %v", err))
+		}
+	}

 	if err := validateLogConfig(&c.Log); err != nil {
 		errs = AppendError(errs, err)
@@ -51,9 +67,6 @@ func (v *ConfigValidator) ValidateServerConfig(c *v1.ServerConfig) (Warning, err
 	errs = AppendError(errs, ValidatePort(c.VhostHTTPPort, "vhostHTTPPort"))
 	errs = AppendError(errs, ValidatePort(c.VhostHTTPSPort, "vhostHTTPSPort"))
 	errs = AppendError(errs, ValidatePort(c.TCPMuxHTTPConnectPort, "tcpMuxHTTPConnectPort"))
-	if c.Transport.MaxPoolCount < 0 {
-		errs = AppendError(errs, fmt.Errorf("invalid transport.maxPoolCount, must be non-negative"))
-	}

 	for _, p := range c.HTTPPlugins {
 		if !lo.Every(SupportedHTTPPluginOps, p.Ops) {
@@ -1,51 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package validation
-
-import (
-	"math"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-)
-
-func TestValidateServerConfigMaxPoolCount(t *testing.T) {
-	for _, tc := range []struct {
-		name         string
-		maxPoolCount int64
-		wantErr      bool
-	}{
-		{name: "negative", maxPoolCount: -1, wantErr: true},
-		{name: "zero", maxPoolCount: 0},
-		{name: "positive", maxPoolCount: 5},
-		{name: "maximum int64", maxPoolCount: math.MaxInt64},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			cfg := validServerConfigWithAuth(v1.AuthServerConfig{Method: v1.AuthMethodToken})
-			cfg.Transport.MaxPoolCount = tc.maxPoolCount
-			require.NoError(t, cfg.Complete())
-
-			_, err := NewConfigValidator(nil).ValidateServerConfig(cfg)
-			if tc.wantErr {
-				require.ErrorContains(t, err, "invalid transport.maxPoolCount")
-				require.ErrorContains(t, err, "must be non-negative")
-				return
-			}
-			require.NoError(t, err)
-		})
-	}
-}
@@ -29,10 +29,6 @@ var (
 		"websocket",
 		"wss",
 	}
-	SupportedWireProtocols = []string{
-		"v1",
-		"v2",
-	}

 	SupportedAuthMethods = []v1.AuthMethod{
 		"token",
@@ -79,9 +79,9 @@ const (
 )

 var visitorConfigTypeMap = map[VisitorType]reflect.Type{
-	VisitorTypeSTCP: reflect.TypeFor[STCPVisitorConfig](),
-	VisitorTypeXTCP: reflect.TypeFor[XTCPVisitorConfig](),
-	VisitorTypeSUDP: reflect.TypeFor[SUDPVisitorConfig](),
+	VisitorTypeSTCP: reflect.TypeOf(STCPVisitorConfig{}),
+	VisitorTypeXTCP: reflect.TypeOf(XTCPVisitorConfig{}),
+	VisitorTypeSUDP: reflect.TypeOf(SUDPVisitorConfig{}),
 }

 type TypedVisitorConfig struct {
@@ -25,7 +25,7 @@ const (
 )

 var visitorPluginOptionsTypeMap = map[string]reflect.Type{
-	VisitorPluginVirtualNet: reflect.TypeFor[VirtualNetVisitorPluginOptions](),
+	VisitorPluginVirtualNet: reflect.TypeOf(VirtualNetVisitorPluginOptions{}),
 }

 type VisitorPluginOptions interface {
@@ -18,8 +18,6 @@ import (
 	"sync"
 	"time"

-	"k8s.io/utils/clock"
-
 	"github.com/fatedier/frp/pkg/util/log"
 	"github.com/fatedier/frp/pkg/util/metric"
 	server "github.com/fatedier/frp/server/metrics"
@@ -40,20 +38,11 @@ func init() {

 type serverMetrics struct {
 	info *ServerStatistics
-	clock clock.WithTicker
 	mu   sync.Mutex
 }

 func newServerMetrics() *serverMetrics {
-	return newServerMetricsWithClock(clock.RealClock{})
-}
-
-func newServerMetricsWithClock(clk clock.WithTicker) *serverMetrics {
-	if clk == nil {
-		clk = clock.RealClock{}
-	}
 	return &serverMetrics{
-		clock: clk,
 		info: &ServerStatistics{
 			TotalTrafficIn:  metric.NewDateCounter(ReserveDays),
 			TotalTrafficOut: metric.NewDateCounter(ReserveDays),
@@ -68,23 +57,14 @@ func newServerMetricsWithClock(clk clock.WithTicker) *serverMetrics {
 }

 func (m *serverMetrics) run() {
-	go m.runUntil(nil)
-}
-
-func (m *serverMetrics) runUntil(stopCh <-chan struct{}) {
-	ticker := m.clock.NewTicker(12 * time.Hour)
-	defer ticker.Stop()
-
+	go func() {
 		for {
-		select {
-		case <-ticker.C():
-			start := m.clock.Now()
+			time.Sleep(12 * time.Hour)
+			start := time.Now()
 			count, total := m.clearUselessInfo(time.Duration(7*24) * time.Hour)
-			log.Debugf("clear useless proxy statistics data count %d/%d, cost %v", count, total, m.clock.Since(start))
-		case <-stopCh:
-			return
-		}
+			log.Debugf("clear useless proxy statistics data count %d/%d, cost %v", count, total, time.Since(start))
 		}
+	}()
 }

 func (m *serverMetrics) clearUselessInfo(continuousOfflineDuration time.Duration) (int, int) {
@@ -95,7 +75,9 @@ func (m *serverMetrics) clearUselessInfo(continuousOfflineDuration time.Duration
 	defer m.mu.Unlock()
 	total = len(m.info.ProxyStatistics)
 	for name, data := range m.info.ProxyStatistics {
-		if m.shouldClearProxyStats(data, continuousOfflineDuration) {
+		if !data.LastCloseTime.IsZero() &&
+			data.LastStartTime.Before(data.LastCloseTime) &&
+			time.Since(data.LastCloseTime) > continuousOfflineDuration {
 			delete(m.info.ProxyStatistics, name)
 			count++
 			log.Tracef("clear proxy [%s]'s statistics data, lastCloseTime: [%s]", name, data.LastCloseTime.String())
@@ -104,20 +86,10 @@ func (m *serverMetrics) clearUselessInfo(continuousOfflineDuration time.Duration
 	return count, total
 }

-func (m *serverMetrics) shouldClearProxyStats(data *ProxyStatistics, continuousOfflineDuration time.Duration) bool {
-	return !data.LastCloseTime.IsZero() &&
-		data.LastStartTime.Before(data.LastCloseTime) &&
-		m.clock.Since(data.LastCloseTime) > continuousOfflineDuration
-}
-
 func (m *serverMetrics) ClearOfflineProxies() (int, int) {
 	return m.clearUselessInfo(0)
 }

-func (m *serverMetrics) PruneOfflineProxies() (int, int) {
-	return m.clearUselessInfo(0)
-}
-
 func (m *serverMetrics) NewClient() {
 	m.info.ClientCounts.Inc(1)
 }
@@ -149,7 +121,7 @@ func (m *serverMetrics) NewProxy(name string, proxyType string, user string, cli
 	}
 	proxyStats.User = user
 	proxyStats.ClientID = clientID
-	proxyStats.LastStartTime = m.clock.Now()
+	proxyStats.LastStartTime = time.Now()
 }

 func (m *serverMetrics) CloseProxy(name string, proxyType string) {
@@ -159,7 +131,7 @@ func (m *serverMetrics) CloseProxy(name string, proxyType string) {
 		counter.Dec(1)
 	}
 	if proxyStats, ok := m.info.ProxyStatistics[name]; ok {
-		proxyStats.LastCloseTime = m.clock.Now()
+		proxyStats.LastCloseTime = time.Now()
 	}
 }

@@ -171,6 +143,7 @@ func (m *serverMetrics) OpenConnection(name string, _ string) {
 	proxyStats, ok := m.info.ProxyStatistics[name]
 	if ok {
 		proxyStats.CurConns.Inc(1)
+		m.info.ProxyStatistics[name] = proxyStats
 	}
 }

@@ -182,6 +155,7 @@ func (m *serverMetrics) CloseConnection(name string, _ string) {
 	proxyStats, ok := m.info.ProxyStatistics[name]
 	if ok {
 		proxyStats.CurConns.Dec(1)
+		m.info.ProxyStatistics[name] = proxyStats
 	}
 }

@@ -194,6 +168,7 @@ func (m *serverMetrics) AddTrafficIn(name string, _ string, trafficBytes int64)
 	proxyStats, ok := m.info.ProxyStatistics[name]
 	if ok {
 		proxyStats.TrafficIn.Inc(trafficBytes)
+		m.info.ProxyStatistics[name] = proxyStats
 	}
 }

@@ -206,6 +181,7 @@ func (m *serverMetrics) AddTrafficOut(name string, _ string, trafficBytes int64)
 	proxyStats, ok := m.info.ProxyStatistics[name]
 	if ok {
 		proxyStats.TrafficOut.Inc(trafficBytes)
+		m.info.ProxyStatistics[name] = proxyStats
 	}
 }

@@ -227,7 +203,16 @@ func (m *serverMetrics) GetServer() *ServerStats {
 	return s
 }

-func toProxyStats(name string, proxyStats *ProxyStatistics) *ProxyStats {
+func (m *serverMetrics) GetProxiesByType(proxyType string) []*ProxyStats {
+	res := make([]*ProxyStats, 0)
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	for name, proxyStats := range m.info.ProxyStatistics {
+		if proxyStats.ProxyType != proxyType {
+			continue
+		}
+
 		ps := &ProxyStats{
 			Name:            name,
 			Type:            proxyStats.ProxyType,
@@ -239,25 +224,11 @@ func toProxyStats(name string, proxyStats *ProxyStatistics) *ProxyStats {
 		}
 		if !proxyStats.LastStartTime.IsZero() {
 			ps.LastStartTime = proxyStats.LastStartTime.Format("01-02 15:04:05")
-		ps.LastStartAt = proxyStats.LastStartTime.Unix()
 		}
 		if !proxyStats.LastCloseTime.IsZero() {
 			ps.LastCloseTime = proxyStats.LastCloseTime.Format("01-02 15:04:05")
-		ps.LastCloseAt = proxyStats.LastCloseTime.Unix()
 		}
-	return ps
-}
-
-func (m *serverMetrics) GetProxiesByType(proxyType string) []*ProxyStats {
-	res := make([]*ProxyStats, 0)
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	for name, proxyStats := range m.info.ProxyStatistics {
-		if proxyStats.ProxyType != proxyType {
-			continue
-		}
-		res = append(res, toProxyStats(name, proxyStats))
+		res = append(res, ps)
 	}
 	return res
 }
@@ -266,9 +237,31 @@ func (m *serverMetrics) GetProxiesByTypeAndName(proxyType string, proxyName stri
 	m.mu.Lock()
 	defer m.mu.Unlock()

-	proxyStats, ok := m.info.ProxyStatistics[proxyName]
-	if ok && proxyStats.ProxyType == proxyType {
-		res = toProxyStats(proxyName, proxyStats)
+	for name, proxyStats := range m.info.ProxyStatistics {
+		if proxyStats.ProxyType != proxyType {
+			continue
+		}
+
+		if name != proxyName {
+			continue
+		}
+
+		res = &ProxyStats{
+			Name:            name,
+			Type:            proxyStats.ProxyType,
+			User:            proxyStats.User,
+			ClientID:        proxyStats.ClientID,
+			TodayTrafficIn:  proxyStats.TrafficIn.TodayCount(),
+			TodayTrafficOut: proxyStats.TrafficOut.TodayCount(),
+			CurConns:        int64(proxyStats.CurConns.Count()),
+		}
+		if !proxyStats.LastStartTime.IsZero() {
+			res.LastStartTime = proxyStats.LastStartTime.Format("01-02 15:04:05")
+		}
+		if !proxyStats.LastCloseTime.IsZero() {
+			res.LastCloseTime = proxyStats.LastCloseTime.Format("01-02 15:04:05")
+		}
+		break
 	}
 	return
 }
@@ -279,7 +272,21 @@ func (m *serverMetrics) GetProxyByName(proxyName string) (res *ProxyStats) {

 	proxyStats, ok := m.info.ProxyStatistics[proxyName]
 	if ok {
-		res = toProxyStats(proxyName, proxyStats)
+		res = &ProxyStats{
+			Name:            proxyName,
+			Type:            proxyStats.ProxyType,
+			User:            proxyStats.User,
+			ClientID:        proxyStats.ClientID,
+			TodayTrafficIn:  proxyStats.TrafficIn.TodayCount(),
+			TodayTrafficOut: proxyStats.TrafficOut.TodayCount(),
+			CurConns:        int64(proxyStats.CurConns.Count()),
+		}
+		if !proxyStats.LastStartTime.IsZero() {
+			res.LastStartTime = proxyStats.LastStartTime.Format("01-02 15:04:05")
+		}
+		if !proxyStats.LastCloseTime.IsZero() {
+			res.LastCloseTime = proxyStats.LastCloseTime.Format("01-02 15:04:05")
+		}
 	}
 	return
 }
@@ -1,153 +0,0 @@
-package mem
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	clocktesting "k8s.io/utils/clock/testing"
-)
-
-func TestServerMetricsUsesClockForProxyTimestamps(t *testing.T) {
-	require := require.New(t)
-
-	start := time.Date(2026, time.May, 8, 12, 30, 0, 0, time.UTC)
-	clk := clocktesting.NewFakeClock(start)
-	metrics := newServerMetricsWithClock(clk)
-
-	metrics.NewProxy("proxy", "tcp", "user", "client-id")
-	require.Equal(start, metrics.info.ProxyStatistics["proxy"].LastStartTime)
-
-	closedAt := start.Add(time.Minute)
-	clk.SetTime(closedAt)
-	metrics.CloseProxy("proxy", "tcp")
-	require.Equal(closedAt, metrics.info.ProxyStatistics["proxy"].LastCloseTime)
-
-	stats := metrics.GetProxyByName("proxy")
-	require.Equal(start.Format("01-02 15:04:05"), stats.LastStartTime)
-	require.Equal(closedAt.Format("01-02 15:04:05"), stats.LastCloseTime)
-	require.Equal(start.Unix(), stats.LastStartAt)
-	require.Equal(closedAt.Unix(), stats.LastCloseAt)
-}
-
-func TestServerMetricsClearUselessInfoUsesClock(t *testing.T) {
-	require := require.New(t)
-
-	start := time.Date(2026, time.May, 8, 12, 30, 0, 0, time.UTC)
-	clk := clocktesting.NewFakeClock(start.Add(25 * time.Hour))
-	metrics := newServerMetricsWithClock(clk)
-	metrics.info.ProxyStatistics["proxy"] = &ProxyStatistics{
-		Name:          "proxy",
-		LastStartTime: start.Add(-time.Hour),
-		LastCloseTime: start,
-	}
-
-	count, total := metrics.clearUselessInfo(24 * time.Hour)
-
-	require.Equal(1, count)
-	require.Equal(1, total)
-	require.Empty(metrics.info.ProxyStatistics)
-}
-
-func TestServerMetricsClearOfflineProxiesPreservesLegacyTotal(t *testing.T) {
-	require := require.New(t)
-
-	start := time.Date(2026, time.May, 8, 12, 30, 0, 0, time.UTC)
-	clk := clocktesting.NewFakeClock(start.Add(time.Minute))
-	metrics := newServerMetricsWithClock(clk)
-	metrics.info.ProxyStatistics["offline"] = &ProxyStatistics{
-		Name:          "offline",
-		LastStartTime: start.Add(-time.Hour),
-		LastCloseTime: start,
-	}
-	metrics.info.ProxyStatistics["online"] = &ProxyStatistics{
-		Name:          "online",
-		LastStartTime: start,
-	}
-
-	cleared, total := metrics.ClearOfflineProxies()
-
-	require.Equal(1, cleared)
-	require.Equal(2, total)
-	require.False(metrics.hasProxyStatistics("offline"))
-	require.True(metrics.hasProxyStatistics("online"))
-}
-
-func TestServerMetricsPruneOfflineProxiesReportsTotalStats(t *testing.T) {
-	require := require.New(t)
-
-	start := time.Date(2026, time.May, 8, 12, 30, 0, 0, time.UTC)
-	clk := clocktesting.NewFakeClock(start.Add(time.Minute))
-	metrics := newServerMetricsWithClock(clk)
-	metrics.info.ProxyStatistics["offline"] = &ProxyStatistics{
-		Name:          "offline",
-		LastStartTime: start.Add(-time.Hour),
-		LastCloseTime: start,
-	}
-	metrics.info.ProxyStatistics["online"] = &ProxyStatistics{
-		Name:          "online",
-		LastStartTime: start,
-	}
-	metrics.info.ProxyStatistics["restarted"] = &ProxyStatistics{
-		Name:          "restarted",
-		LastStartTime: start.Add(30 * time.Second),
-		LastCloseTime: start,
-	}
-	metrics.info.ProxyStatistics["same-time"] = &ProxyStatistics{
-		Name:          "same-time",
-		LastStartTime: start,
-		LastCloseTime: start,
-	}
-
-	cleared, total := metrics.PruneOfflineProxies()
-
-	require.Equal(1, cleared)
-	require.Equal(4, total)
-	require.False(metrics.hasProxyStatistics("offline"))
-	require.True(metrics.hasProxyStatistics("online"))
-	require.True(metrics.hasProxyStatistics("restarted"))
-	require.True(metrics.hasProxyStatistics("same-time"))
-
-	cleared, total = metrics.PruneOfflineProxies()
-	require.Equal(0, cleared)
-	require.Equal(3, total)
-}
-
-func TestServerMetricsRunUsesClockTicker(t *testing.T) {
-	require := require.New(t)
-
-	start := time.Date(2026, time.May, 8, 12, 30, 0, 0, time.UTC)
-	clk := clocktesting.NewFakeClock(start)
-	metrics := newServerMetricsWithClock(clk)
-	metrics.info.ProxyStatistics["proxy"] = &ProxyStatistics{
-		Name:          "proxy",
-		LastStartTime: start.Add(-time.Hour),
-		LastCloseTime: start,
-	}
-
-	stopCh := make(chan struct{})
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		metrics.runUntil(stopCh)
-	}()
-	t.Cleanup(func() {
-		close(stopCh)
-		<-done
-	})
-
-	require.Eventually(clk.HasWaiters, time.Second, time.Millisecond)
-	clk.Step(8 * 24 * time.Hour)
-
-	require.Eventually(func() bool {
-		return !metrics.hasProxyStatistics("proxy")
-	}, time.Second, time.Millisecond)
-}
-
-func (m *serverMetrics) hasProxyStatistics(name string) bool {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	_, ok := m.info.ProxyStatistics[name]
-	return ok
-}
@@ -41,8 +41,6 @@ type ProxyStats struct {
 	TodayTrafficOut int64
 	LastStartTime   string
 	LastCloseTime   string
-	LastStartAt     int64
-	LastCloseAt     int64
 	CurConns        int64
 }

@@ -87,5 +85,4 @@ type Collector interface {
 	GetProxyByName(proxyName string) *ProxyStats
 	GetProxyTraffic(name string) *ProxyTrafficInfo
 	ClearOfflineProxies() (int, int)
-	PruneOfflineProxies() (int, int)
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
copilot-swe-agent[bot]	7993225be1	Initial plan	2026-03-05 17:33:24 +00:00
fatedier	17b27d8d96	pkg/msg: change UDPPacket.Content from string to []byte to avoid redundant base64 encode/decode	2026-03-06 01:25:52 +08:00