commit d2348d0c00a57ce250c629d210406b3f457275bc
Author: weidu12123 <jsw_0816@qq.com>
Date:   Tue Oct 13 16:36:22 2026 +0800

    feat: initial commit of vps-switch core modules and desktop frontend

diff --git a/.cargo/config.toml b/.cargo/config.toml
new file mode 100644
index 0000000..5bdcffe
--- /dev/null
+++ b/.cargo/config.toml
@@ -0,0 +1,11 @@
+[source.crates-io]
+replace-with = "rsproxy-sparse"
+
+[source.rsproxy]
+registry = "https://rsproxy.cn/crates.io-index"
+
+[source.rsproxy-sparse]
+registry = "sparse+https://rsproxy.cn/index/"
+
+[net]
+git-fetch-with-cli = true
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..cdc5509
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,24 @@
+# Rust
+/target
+**/*.rs.bk
+
+# Tauri
+/src-tauri/target
+/src-tauri/gen
+
+# Node / 前端
+node_modules/
+/frontend/dist
+
+# 运行态与本地数据
+/data
+*.log
+.env
+.env.local
+.playwright-mcp/
+conpty.dll
+OpenConsole.exe
+
+# 系统
+.DS_Store
+Thumbs.db
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..1177beb
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,10 @@
+# vps-switch 项目守则
+
+每次在本仓库的工作都把这些当作不可协商：
+
+1. 不堆提示词。本项目零模型调用，这条自动成立；若将来引入，提示词改动必须罕见、最小、有理由。
+2. 不堆架构。架构不得替代、预答或冒充使用者（人或 agent）的判断；一份实现，两个调用方（UI / MCP），不做第二条路。
+3. 不对 agent 隐藏上下文。工具结果带完整 stdout / stderr / exitCode / 耗时与护栏判定（why + suggestion），失败就是失败。
+4. 概念数必须比 1Shell 少。新设计若引入比旧项目更多的名词、状态或层次，就是错的。不在 `docs/plan.md` 边界内的东西不进仓库；要加，先改边界那句话。
+
+把时间用在思考上，不需要用 commentary 汇报进度。
diff --git a/Cargo.lock b/Cargo.lock
new file mode 100644
index 0000000..38494db
--- /dev/null
+++ b/Cargo.lock
@@ -0,0 +1,5462 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common 0.1.7",
+ "generic-array 0.14.7",
+]
+
+[[package]]
+name = "aead"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99"
+dependencies = [
+ "crypto-common 0.2.2",
+ "inout 0.2.2",
+]
+
+[[package]]
+name = "aes"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+dependencies = [
+ "cfg-if",
+ "cipher 0.4.4",
+ "cpufeatures 0.2.17",
+]
+
+[[package]]
+name = "aes"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35f0f96ce78e38c3dc6d8948aa8163d06385be74000f3c7a95bf1eef35d3ea32"
+dependencies = [
+ "cipher 0.5.2",
+ "cpubits",
+ "cpufeatures 0.3.1",
+ "zeroize",
+]
+
+[[package]]
+name = "aes-gcm"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
+dependencies = [
+ "aead 0.5.2",
+ "aes 0.8.4",
+ "cipher 0.4.4",
+ "ctr 0.9.2",
+ "ghash 0.5.1",
+ "subtle",
+]
+
+[[package]]
+name = "aes-gcm"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f2b8006a0c83f52b62ba44a97b58bf76fe2f70a329e588f67f89691d93d498f"
+dependencies = [
+ "aead 0.6.1",
+ "aes 0.9.3",
+ "cipher 0.5.2",
+ "ctr 0.10.1",
+ "ctutils",
+ "ghash 0.6.0",
+ "zeroize",
+]
+
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "alacritty_terminal"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bda177466b9524d59f1b12f0dd30b68696788e9992a7e959021c4a0ed96fcf59"
+dependencies = [
+ "base64",
+ "bitflags 2.13.2",
+ "home",
+ "libc",
+ "log",
+ "miow",
+ "parking_lot",
+ "piper",
+ "polling",
+ "regex-automata",
+ "rustix",
+ "rustix-openpty",
+ "serde",
+ "signal-hook",
+ "unicode-width",
+ "vte",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
+[[package]]
+name = "argon2"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "134c52ddac6d63c576bef8168db10c83c49c26444ecbc68060fef078925a901c"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures 0.3.1",
+ "password-hash 0.6.1",
+]
+
+[[package]]
+name = "arrayvec"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
+
+[[package]]
+name = "async-trait"
+version = "0.1.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "atk"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "241b621213072e993be4f6f3a9e4b45f65b7e6faad43001be957184b7bb1824b"
+dependencies = [
+ "atk-sys",
+ "glib",
+ "libc",
+]
+
+[[package]]
+name = "atk-sys"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5e48b684b0ca77d2bbadeef17424c2ea3c897d44d566a1617e7e8f30614d086"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "axum"
+version = "0.7.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
+dependencies = [
+ "async-trait",
+ "axum-core",
+ "axum-macros",
+ "base64",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustversion",
+ "serde",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "sha1 0.10.7",
+ "sync_wrapper",
+ "tokio",
+ "tokio-tungstenite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "rustversion",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-macros"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57d123550fa8d071b7255cb0cc04dc302baa6c8c4a79f55701552684d8399bce"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "base16ct"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
+[[package]]
+name = "bcrypt-pbkdf"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "144e573728da132683b9488acd528274c790e07fc06ff81ee29f9d8f8b1041e0"
+dependencies = [
+ "blowfish",
+ "pbkdf2 0.13.0",
+ "sha2 0.11.1",
+]
+
+[[package]]
+name = "bit-set"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
+dependencies = [
+ "bit-vec 0.8.0",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+
+[[package]]
+name = "bit-vec"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "blake2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b5d4d889834ee8ecfc0f8426ad30faf7cdcb10f741a8e6d7224d95325479f6f"
+dependencies = [
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array 0.14.7",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array",
+ "zeroize",
+]
+
+[[package]]
+name = "block-padding"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "710f1dd022ef4e93f8a438b4ba958de7f64308434fa6a87104481645cc30068b"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "block2"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5"
+dependencies = [
+ "objc2",
+]
+
+[[package]]
+name = "blowfish"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62ce3946557b35e71d1bbe07ec385073ce9eda05043f95de134eb578fcf1a298"
+dependencies = [
+ "byteorder",
+ "cipher 0.5.2",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "cairo-rs"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ca26ef0159422fb77631dc9d17b102f253b876fe1586b03b803e63a309b4ee2"
+dependencies = [
+ "bitflags 2.13.2",
+ "cairo-sys-rs",
+ "glib",
+ "libc",
+ "once_cell",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "cairo-sys-rs"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "685c9fa8e590b8b3d678873528d83411db17242a73fccaed827770ea0fedda51"
+dependencies = [
+ "glib-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "cbc"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce2dc9ee5f88d11e0beb842c88b33c8a5cf0d1329c4b19494af42b07dbfe8896"
+dependencies = [
+ "cipher 0.5.2",
+]
+
+[[package]]
+name = "cc"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6651c9ed80effdc7db0ff72512157f901af5e3549e341e24b1dd4887d836d838"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cesu8"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
+
+[[package]]
+name = "cfg-expr"
+version = "0.15.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d067ad48b8650848b989a59a86c6c36a995d02d2bf778d45c3c5d57bc2718f02"
+dependencies = [
+ "smallvec",
+ "target-lexicon",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd16c4719339c4530435d38e511904438d07cce7950afa3718a84ac36c10e89e"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
+[[package]]
+name = "chacha20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+dependencies = [
+ "cfg-if",
+ "cipher 0.5.2",
+ "cpufeatures 0.3.1",
+ "rand_core 0.10.1",
+ "zeroize",
+]
+
+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "serde",
+ "wasm-bindgen",
+ "windows-link",
+]
+
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common 0.1.7",
+ "inout 0.1.4",
+]
+
+[[package]]
+name = "cipher"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
+dependencies = [
+ "block-buffer 0.12.1",
+ "crypto-common 0.2.2",
+ "inout 0.2.2",
+ "zeroize",
+]
+
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
+[[package]]
+name = "combine"
+version = "4.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfc320937d09e6de266b31b9afb480f197d7a861be86be7cb2ea7e5d1bfffc5e"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
+[[package]]
+name = "cookie"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a373e3602691c3cdea496d2f0ee5935151e6168fe87739483c463db1b2f2f87"
+dependencies = [
+ "time",
+ "version_check",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "core-graphics"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "064badf302c3194842cf2c5d61f56cc88e54a759313879cdf03abdd27d0c3b97"
+dependencies = [
+ "bitflags 2.13.2",
+ "core-foundation",
+ "core-graphics-types",
+ "foreign-types",
+ "libc",
+]
+
+[[package]]
+name = "core-graphics-types"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d44a101f213f6c4cdc1853d4b78aef6db6bdfa3468798cc1d9912f4735013eb"
+dependencies = [
+ "bitflags 2.13.2",
+ "core-foundation",
+ "libc",
+]
+
+[[package]]
+name = "cpubits"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98b0cc327b5bc766e7fda9c9260cc0fa81b43a8e240440422dff70788e3f9ef1"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"
+
+[[package]]
+name = "crypto-bigint"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a52aa3fcda4e6302a9f48734f234d35d4721b96f8fe07d073f07ce9df4f0271"
+dependencies = [
+ "cpubits",
+ "ctutils",
+ "getrandom 0.4.3",
+ "hybrid-array",
+ "num-traits",
+ "rand_core 0.10.1",
+ "serdect",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array 0.14.7",
+ "rand_core 0.6.4",
+ "typenum",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "getrandom 0.4.3",
+ "hybrid-array",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "crypto-primes"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3633a51a39c69ebbaa4feaa694bd83d241e4093901c84a0963b19d9bb3f0cf8f"
+dependencies = [
+ "crypto-bigint",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "cssparser"
+version = "0.37.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c9cdaae01d5ed7882b04d795e7f752f46ff52d2fa3b50a20d28c464510bba98"
+dependencies = [
+ "cssparser-macros",
+ "dtoa-short",
+ "itoa",
+ "phf",
+ "smallvec",
+]
+
+[[package]]
+name = "cssparser-macros"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d045de693cb712d0b22c6a64be5b953f67b3ce00ab5ad3dd5d8b441886ab8e1a"
+dependencies = [
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "ctr"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+dependencies = [
+ "cipher 0.4.4",
+]
+
+[[package]]
+name = "ctr"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baaca1c4b237092596f64d571e9db6ce4109c4ef9742e27590f1709594461f21"
+dependencies = [
+ "cipher 0.5.2",
+]
+
+[[package]]
+name = "ctutils"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574"
+dependencies = [
+ "cmov",
+ "subtle",
+]
+
+[[package]]
+name = "cursor-icon"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f27ae1dd37df86211c42e150270f82743308803d90a6f6e6651cd730d5e1732f"
+
+[[package]]
+name = "curve25519-dalek"
+version = "5.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5eed333089e2e1c1ac8c6c0398e5e2497b4c9926ca6d0365ed1e099afa5bc23"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+ "curve25519-dalek-derive",
+ "digest 0.11.3",
+ "fiat-crypto",
+ "rand_core 0.10.1",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "dashmap"
+version = "6.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6361d5c062261c78a176addb82d4c821ae42bed6089de0e12603cd25de2059c"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+ "hashbrown 0.14.5",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
+
+[[package]]
+name = "dbus"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ab69f03cc8c4340c9c8e315114e1658e6775a9b16a04357973aa21cec22b32e"
+dependencies = [
+ "libc",
+ "libdbus-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "delegate"
+version = "0.13.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "780eb241654bf097afb00fc5f054a09b687dad862e485fdcf8399bb056565370"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "der"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a878c850e9e421b20262e9b41f9c860e4785fa07541c266b62ff9d1ef998a80a"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+
+[[package]]
+name = "derive_more"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
+dependencies = [
+ "derive_more-impl",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "des"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "916a94e407b54f9034d71dd748234cd1e516ced6284009906ae246f177eafe5a"
+dependencies = [
+ "cipher 0.5.2",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer 0.10.4",
+ "crypto-common 0.1.7",
+ "subtle",
+]
+
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer 0.12.1",
+ "const-oid",
+ "crypto-common 0.2.2",
+ "ctutils",
+]
+
+[[package]]
+name = "dirs"
+version = "7.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d57d423b3c82e89b9a24ca3091fee61f456a26edbd28d26c65906f4bc1dcd8f"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
+dependencies = [
+ "libc",
+ "option-ext",
+ "redox_users",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "dispatch2"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2",
+ "libc",
+ "objc2",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "dlopen2"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e2c5bd4158e66d1e215c49b837e11d62f3267b30c92f1d171c4d3105e3dc4d4"
+dependencies = [
+ "dlopen2_derive",
+ "libc",
+ "once_cell",
+ "winapi",
+]
+
+[[package]]
+name = "dlopen2_derive"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fbbb781877580993a8707ec48672673ec7b81eeba04cfd2310bd28c08e47c8f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "dom_query"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fac5fca71e65e94cc718a6e2af65d6e0f9c6027751c2aa562fbb5087fda639bc"
+dependencies = [
+ "bit-set",
+ "cssparser",
+ "foldhash",
+ "html5ever",
+ "precomputed-hash",
+ "selectors",
+ "tendril",
+]
+
+[[package]]
+name = "downcast-rs"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"
+
+[[package]]
+name = "dpi"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
+
+[[package]]
+name = "dtoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
+
+[[package]]
+name = "dtoa-short"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87"
+dependencies = [
+ "dtoa",
+]
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "ecdsa"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0681a4fc24c767085329728d8dfba959af91228aa4610cca4f8ce317ba46ae0"
+dependencies = [
+ "der",
+ "digest 0.11.3",
+ "elliptic-curve",
+ "rfc6979",
+ "signature",
+ "spki",
+ "zeroize",
+]
+
+[[package]]
+name = "ed25519"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29fcf32e6c73d1079f83ab4d782de2d81620346a5f38c6237a86a22f8368980a"
+dependencies = [
+ "pkcs8",
+ "signature",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ebaa1a2bf1290ab3bfe5a7b771d050ebffab2711c19a81691c683a5144a25de"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "rand_core 0.10.1",
+ "serde",
+ "sha2 0.11.1",
+ "signature",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "elliptic-curve"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d65aa39b3a5c1c9c1b745c9a019234bb7a21b77abcb4f4d266d706e2d577d65"
+dependencies = [
+ "base16ct",
+ "crypto-bigint",
+ "crypto-common 0.2.2",
+ "digest 0.11.3",
+ "ff",
+ "group",
+ "hkdf",
+ "hybrid-array",
+ "pem-rfc7468",
+ "pkcs8",
+ "rand_core 0.10.1",
+ "sec1",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "enum_dispatch"
+version = "0.3.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa18ce2bc66555b3218614519ac839ddb759a7d6720732f979ef8d13be147ecd"
+dependencies = [
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "fallible-iterator"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
+
+[[package]]
+name = "fallible-streaming-iterator"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
+
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
+[[package]]
+name = "fdeflate"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
+dependencies = [
+ "simd-adler32",
+]
+
+[[package]]
+name = "ff"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1f686ab92a9fb0eaf188f6c6c87b89490baa6fdb0db4544ba4dc47f7942489f"
+dependencies = [
+ "rand_core 0.10.1",
+ "subtle",
+]
+
+[[package]]
+name = "fiat-crypto"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64cd1e32ddd350061ae6edb1b082d7c54915b5c672c389143b9a63403a109f24"
+
+[[package]]
+name = "field-offset"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38e2275cc4e4fc009b0669731a1e5ab7ebf11f469eaede2bab9309a5b4d6057f"
+dependencies = [
+ "memoffset",
+ "rustc_version",
+]
+
+[[package]]
+name = "filedescriptor"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e40758ed24c9b2eeb76c35fb0aebc66c626084edd827e07e1552279814c6682d"
+dependencies = [
+ "libc",
+ "thiserror 1.0.69",
+ "winapi",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
+
+[[package]]
+name = "flate2"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide 0.9.1",
+ "zlib-rs",
+]
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "foreign-types"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
+dependencies = [
+ "foreign-types-macros",
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-macros"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea5190182e6915eb873ddbc16e23b711b6eb1f9c00a0d0a3a91b5f6228475225"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa9a19cbb55df58761df49b23516a86d432839add4af60fc256da840f66ed35b"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futures"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
+
+[[package]]
+name = "futures-task"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
+
+[[package]]
+name = "futures-util"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "gdk"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9f245958c627ac99d8e529166f9823fb3b838d1d41fd2b297af3075093c2691"
+dependencies = [
+ "cairo-rs",
+ "gdk-pixbuf",
+ "gdk-sys",
+ "gio",
+ "glib",
+ "libc",
+ "pango",
+]
+
+[[package]]
+name = "gdk-pixbuf"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50e1f5f1b0bfb830d6ccc8066d18db35c487b1b2b1e8589b5dfe9f07e8defaec"
+dependencies = [
+ "gdk-pixbuf-sys",
+ "gio",
+ "glib",
+ "libc",
+ "once_cell",
+]
+
+[[package]]
+name = "gdk-pixbuf-sys"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9839ea644ed9c97a34d129ad56d38a25e6756f99f3a88e15cd39c20629caf7"
+dependencies = [
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "gdk-sys"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c2d13f38594ac1e66619e188c6d5a1adb98d11b2fcf7894fc416ad76aa2f3f7"
+dependencies = [
+ "cairo-sys-rs",
+ "gdk-pixbuf-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "pango-sys",
+ "pkg-config",
+ "system-deps",
+]
+
+[[package]]
+name = "gdkwayland-sys"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "140071d506d223f7572b9f09b5e155afbd77428cd5cc7af8f2694c41d98dfe69"
+dependencies = [
+ "gdk-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "pkg-config",
+ "system-deps",
+]
+
+[[package]]
+name = "gdkx11"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3caa00e14351bebbc8183b3c36690327eb77c49abc2268dd4bd36b856db3fbfe"
+dependencies = [
+ "gdk",
+ "gdkx11-sys",
+ "gio",
+ "glib",
+ "libc",
+ "x11",
+]
+
+[[package]]
+name = "gdkx11-sys"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2e7445fe01ac26f11601db260dd8608fe172514eb63b3b5e261ea6b0f4428d"
+dependencies = [
+ "gdk-sys",
+ "glib-sys",
+ "libc",
+ "system-deps",
+ "x11",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "generic-array"
+version = "1.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "337d46834ee672ab3e48caca2cb0c78cc174fb12b3a68d0d88f99a0519a5e36e"
+dependencies = [
+ "generic-array 0.14.7",
+ "rustversion",
+ "typenum",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi",
+ "rand_core 0.10.1",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "ghash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
+dependencies = [
+ "opaque-debug",
+ "polyval 0.6.2",
+]
+
+[[package]]
+name = "ghash"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2eecf2d5dc9b66b732b97707a0210906b1d30523eb773193ab777c0c84b3e8d5"
+dependencies = [
+ "polyval 0.7.3",
+ "zeroize",
+]
+
+[[package]]
+name = "gio"
+version = "0.18.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4fc8f532f87b79cbc51a79748f16a6828fb784be93145a322fa14d06d354c73"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "gio-sys",
+ "glib",
+ "libc",
+ "once_cell",
+ "pin-project-lite",
+ "smallvec",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "gio-sys"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37566df850baf5e4cb0dfb78af2e4b9898d817ed9263d1090a2df958c64737d2"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+ "winapi",
+]
+
+[[package]]
+name = "glib"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "233daaf6e83ae6a12a52055f568f9d7cf4671dabb78ff9560ab6da230ce00ee5"
+dependencies = [
+ "bitflags 2.13.2",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-task",
+ "futures-util",
+ "gio-sys",
+ "glib-macros",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "memchr",
+ "once_cell",
+ "smallvec",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "glib-macros"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bb0228f477c0900c880fd78c8759b95c7636dbd7842707f49e132378aa2acdc"
+dependencies = [
+ "heck 0.4.1",
+ "proc-macro-crate 2.0.2",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "glib-sys"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "063ce2eb6a8d0ea93d2bf8ba1957e78dbab6be1c2220dd3daca57d5a9d869898"
+dependencies = [
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "gloo-timers"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "482ce8a491a501da4cd806bd190275363d674f2845005c6ddbd5d3e1dd54495d"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "gobject-sys"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0850127b514d1c4a4654ead6dedadb18198999985908e6ffe4436f53c785ce44"
+dependencies = [
+ "glib-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "group"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fd1a1c7a5206c5b7a3f5a0d7ccd3ff85d0c8f5133d62a02680255b0004af5f4"
+dependencies = [
+ "ff",
+ "rand_core 0.10.1",
+ "subtle",
+]
+
+[[package]]
+name = "gtk"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd56fb197bfc42bd5d2751f4f017d44ff59fbb58140c6b49f9b3b2bdab08506a"
+dependencies = [
+ "atk",
+ "cairo-rs",
+ "field-offset",
+ "futures-channel",
+ "gdk",
+ "gdk-pixbuf",
+ "gio",
+ "glib",
+ "gtk-sys",
+ "gtk3-macros",
+ "libc",
+ "pango",
+ "pkg-config",
+]
+
+[[package]]
+name = "gtk-sys"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f29a1c21c59553eb7dd40e918be54dccd60c52b049b75119d5d96ce6b624414"
+dependencies = [
+ "atk-sys",
+ "cairo-sys-rs",
+ "gdk-pixbuf-sys",
+ "gdk-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "pango-sys",
+ "system-deps",
+]
+
+[[package]]
+name = "gtk3-macros"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ff3c5b21f14f0736fed6dcfc0bfb4225ebf5725f3c0209edeec181e4d73e9d"
+dependencies = [
+ "proc-macro-crate 1.3.1",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+dependencies = [
+ "ahash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "hashlink"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ba4ff7128dee98c7dc9794b6a411377e1404dba1c97deb8d1a55297bd25d8af"
+dependencies = [
+ "hashbrown 0.14.5",
+]
+
+[[package]]
+name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hermit-abi"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e17592d60ebacc7d5e169f4663c5f84f9161cc90328abcfe8456f41e4dfcb284"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hex-literal"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e712f64ec3850b98572bffac52e2c6f282b29fe6c5fa6d42334b30be438d95c1"
+
+[[package]]
+name = "hkdf"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4aaa26c720c68b866f2c96ef5c1264b3e6f473fe5d4ce61cd44bbe913e553018"
+dependencies = [
+ "hmac 0.13.0",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "hmac"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
+dependencies = [
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "home"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "html5ever"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46a1761807faccc9a19e86944bbf40610014066306f96edcdedc2fb714bcb7b8"
+dependencies = [
+ "log",
+ "markup5ever",
+]
+
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "http-range-header"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9171a2ea8a68358193d15dd5d70c1c10a2afc3e7e4c5bc92bc9f025cebd7359c"
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hybrid-array"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
+dependencies = [
+ "ctutils",
+ "subtle",
+ "typenum",
+ "zeroize",
+]
+
+[[package]]
+name = "hyper"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c3e324da4c95177d6291d4c8730197c0d1822f8a9766814a4a44fa5ab797c9c"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddc03d96684f9226b8a787cdb71488417b53ab5ea8fdb1dac946cb9431cc8bff"
+dependencies = [
+ "bytes",
+ "http",
+ "http-body",
+ "hyper",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
+
+[[package]]
+name = "icu_properties"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
+
+[[package]]
+name = "icu_provider"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+]
+
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "generic-array 0.14.7",
+]
+
+[[package]]
+name = "inout"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
+dependencies = [
+ "block-padding",
+ "hybrid-array",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "javascriptcore-rs"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca5671e9ffce8ffba57afc24070e906da7fc4b1ba66f2cabebf61bf2ea257fcc"
+dependencies = [
+ "bitflags 1.3.2",
+ "glib",
+ "javascriptcore-rs-sys",
+]
+
+[[package]]
+name = "javascriptcore-rs-sys"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af1be78d14ffa4b75b66df31840478fef72b51f8c2465d4ca7c194da9f7a5124"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "jni"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97"
+dependencies = [
+ "cesu8",
+ "cfg-if",
+ "combine",
+ "jni-sys 0.3.1",
+ "log",
+ "thiserror 1.0.69",
+ "walkdir",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41a652e1f9b6e0275df1f15b32661cf0d4b78d4d87ddec5e0c3c20f097433258"
+dependencies = [
+ "jni-sys 0.4.1",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7883d941dae510fb2d978fc3fe018c71c9e2892fd38854de3e8b92c2e5ad9cc5"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "keccak"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8f198d1db720e4940b5a493201d199d9f24f568f8f746bd13706243a2f71598"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+]
+
+[[package]]
+name = "kem"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01737161ba802849cfd486b5bd209d38ba4943494c249a8126005170c7621edd"
+dependencies = [
+ "crypto-common 0.2.2",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "keyboard-types"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fbe853b403ae61a04233030ae8a79d94975281ed9770a1f9e246732b534b28d"
+dependencies = [
+ "bitflags 2.13.2",
+ "serde",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb"
+
+[[package]]
+name = "libappindicator"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03589b9607c868cc7ae54c0b2a22c8dc03dd41692d48f2d7df73615c6a95dc0a"
+dependencies = [
+ "glib",
+ "gtk",
+ "gtk-sys",
+ "libappindicator-sys",
+ "log",
+]
+
+[[package]]
+name = "libappindicator-sys"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e9ec52138abedcc58dc17a7c6c0c00a2bdb4f3427c7f63fa97fd0d859155caf"
+dependencies = [
+ "gtk-sys",
+ "libloading",
+ "once_cell",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.190"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
+
+[[package]]
+name = "libdbus-sys"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "328c4789d42200f1eeec05bd86c9c13c7f091d2ba9a6ea35acdf51f31bc0f043"
+dependencies = [
+ "pkg-config",
+]
+
+[[package]]
+name = "libloading"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67380fd3b2fbe7527a606e18729d21c6f3951633d0500574c4dc22d2d638b9f"
+dependencies = [
+ "cfg-if",
+ "winapi",
+]
+
+[[package]]
+name = "libredox"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61ff90caf6077a803a240f62fdbe88645a890bbca49ef8174c3cb0404362171d"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
+
+[[package]]
+name = "markup5ever"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7122d987ec5f704ee56f6e5b41a7d93722e9aae27ae07cafa4036c4d3f9757de"
+dependencies = [
+ "log",
+ "tendril",
+ "web_atoms",
+]
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "matchit"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
+
+[[package]]
+name = "md5"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ebb8d8732c6a6df3d8f032a82911cfc747e00efb95cc46e8d0acd5b5b88570c"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "mime_guess"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "mio"
+version = "1.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1788edb87fdc09c7e26304471e2f5be8cdefb1b6930d6e3985fc02ff53bf86ee"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "miow"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "536bfad37a309d62069485248eeaba1e8d9853aaf951caaeaed0585a95346f08"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "ml-kem"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e15f3e5b957493873e396a66914e83e616b6afe335cdef7efe5c6e1216aba66"
+dependencies = [
+ "hybrid-array",
+ "kem",
+ "module-lattice",
+ "pkcs8",
+ "rand_core 0.10.1",
+ "sha3 0.11.0",
+]
+
+[[package]]
+name = "module-lattice"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c61b87c9683ab7cb1c6871d261ad5479b6b10ceb52c4352aaca3b5d35a8febe"
+dependencies = [
+ "ctutils",
+ "hybrid-array",
+ "num-traits",
+]
+
+[[package]]
+name = "muda"
+version = "0.21.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4340e89c178916e62879c5c36b7f699019369be413e496178a6983ce91b8bc03"
+dependencies = [
+ "crossbeam-channel",
+ "dpi",
+ "gtk",
+ "keyboard-types",
+ "libc",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+ "png",
+ "thiserror 2.0.21",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "ndk"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3f42e7bbe13d351b6bead8286a43aac9534b82bd3cc43e47037f012ebfd62d4"
+dependencies = [
+ "bitflags 2.13.2",
+ "jni-sys 0.3.1",
+ "log",
+ "ndk-sys",
+ "num_enum",
+ "raw-window-handle",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "ndk-context"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
+
+[[package]]
+name = "ndk-sys"
+version = "0.6.0+11769913"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee6cda3051665f1fb8d9e08fc35c96d5a244fb1be711a03b71118828afc9a873"
+dependencies = [
+ "jni-sys 0.3.1",
+]
+
+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
+
+[[package]]
+name = "nix"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
+dependencies = [
+ "bitflags 2.13.2",
+ "cfg-if",
+ "cfg_aliases 0.1.1",
+ "libc",
+]
+
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags 2.13.2",
+ "cfg-if",
+ "cfg_aliases 0.2.2",
+ "libc",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c89e69e7e0f03bea5ef08013795c25018e101932225a656383bd384495ecc367"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93e7820bc0a80a0238e650327316f929ba18d5be054b647490a3a6a339f3e7c0"
+dependencies = [
+ "num-integer",
+ "num-traits",
+ "rand 0.10.3",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
+[[package]]
+name = "num-integer"
+version = "0.1.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_enum"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d0bca838442ec211fa11de3a8b0e0e8f3a4522575b5c4c06ed722e005036f26"
+dependencies = [
+ "num_enum_derive",
+ "rustversion",
+]
+
+[[package]]
+name = "num_enum_derive"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8"
+dependencies = [
+ "proc-macro-crate 3.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "objc2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08849bbd4767dfae9457696856ae1c84fe4e0281bbe4a7abff2d0e06fb7981f8"
+dependencies = [
+ "objc2-encode",
+ "objc2-exception-helper",
+]
+
+[[package]]
+name = "objc2-app-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d49e936b501e5c5bf01fda3a9452ff86dc3ea98ad5f283e1455153142d97518c"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-cloud-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73ad74d880bb43877038da939b7427bba67e9dd42004a18b809ba7d87cee241c"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-core-data"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b402a653efbb5e82ce4df10683b6b28027616a2715e90009947d50b8dd298fa"
+dependencies = [
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-core-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
+dependencies = [
+ "bitflags 2.13.2",
+ "dispatch2",
+ "objc2",
+]
+
+[[package]]
+name = "objc2-core-graphics"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e022c9d066895efa1345f8e33e584b9f958da2fd4cd116792e15e07e4720a807"
+dependencies = [
+ "bitflags 2.13.2",
+ "dispatch2",
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-io-surface",
+]
+
+[[package]]
+name = "objc2-core-image"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5d563b38d2b97209f8e861173de434bd0214cf020e3423a52624cd1d989f006"
+dependencies = [
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-core-location"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca347214e24bc973fc025fd0d36ebb179ff30536ed1f80252706db19ee452009"
+dependencies = [
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-core-text"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cde0dfb48d25d2b4862161a4d5fcc0e3c24367869ad306b0c9ec0073bfed92d"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+]
+
+[[package]]
+name = "objc2-encode"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33"
+
+[[package]]
+name = "objc2-exception-helper"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7a1c5fbb72d7735b076bb47b578523aedc40f3c439bea6dfd595c089d79d98a"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "objc2-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2",
+ "objc2",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-io-surface"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "180788110936d59bab6bd83b6060ffdfffb3b922ba1396b312ae795e1de9d81d"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-quartz-core"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96c1358452b371bf9f104e21ec536d37a650eb10f7ee379fff67d2e08d537f1f"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-ui-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d87d638e33c06f577498cbcc50491496a3ed4246998a7fbba7ccb98b1e7eab22"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2",
+ "objc2",
+ "objc2-cloud-kit",
+ "objc2-core-data",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+ "objc2-core-image",
+ "objc2-core-location",
+ "objc2-core-text",
+ "objc2-foundation",
+ "objc2-quartz-core",
+ "objc2-user-notifications",
+]
+
+[[package]]
+name = "objc2-user-notifications"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9df9128cbbfef73cda168416ccf7f837b62737d748333bfe9ab71c245d76613e"
+dependencies = [
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-web-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2e5aaab980c433cf470df9d7af96a7b46a9d892d521a2cbbb2f8a4c16751e7f"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
+[[package]]
+name = "option-ext"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
+
+[[package]]
+name = "p256"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2c9239b2dbc807adbbe147e8cf72ea7450c3a0aabe62cb8e75ff4ec22e1f72a"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primefield",
+ "primeorder",
+ "sha2 0.11.1",
+]
+
+[[package]]
+name = "p384"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d17b851e6b3e378ab4ecb07fa2ed23f4d15f075735f8fec9fa1e7bdce5f8301f"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "fiat-crypto",
+ "primefield",
+ "primeorder",
+ "sha2 0.11.1",
+]
+
+[[package]]
+name = "p521"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ad64cc32c2dc466317c12ee5853e61f159f9eab1fe7efade0395dc2e7b43449"
+dependencies = [
+ "base16ct",
+ "ecdsa",
+ "elliptic-curve",
+ "primefield",
+ "primeorder",
+ "sha2 0.11.1",
+]
+
+[[package]]
+name = "pageant"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0786409b5aaa884655c9b4065681db0835db0cc185a6fb19fb17a5d38656866"
+dependencies = [
+ "base16ct",
+ "byteorder",
+ "bytes",
+ "delegate",
+ "futures",
+ "log",
+ "rand 0.10.3",
+ "sha2 0.11.1",
+ "thiserror 2.0.21",
+ "tokio",
+ "windows",
+ "windows-strings",
+]
+
+[[package]]
+name = "pango"
+version = "0.18.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ca27ec1eb0457ab26f3036ea52229edbdb74dee1edd29063f5b9b010e7ebee4"
+dependencies = [
+ "gio",
+ "glib",
+ "libc",
+ "once_cell",
+ "pango-sys",
+]
+
+[[package]]
+name = "pango-sys"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "436737e391a843e5933d6d9aa102cb126d501e815b83601365a948a518555dc5"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "password-hash"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aab41826031698d6ffcd9cff78ef56ef998e39dc7e5067cdfebe373842d4723b"
+dependencies = [
+ "phc",
+]
+
+[[package]]
+name = "pbkdf2"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
+dependencies = [
+ "digest 0.10.7",
+ "hmac 0.12.1",
+]
+
+[[package]]
+name = "pbkdf2"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112d82ceb8c5bf524d9af484d4e4970c9fd5a0cc15ba14ad93dccd28873b0629"
+dependencies = [
+ "digest 0.11.3",
+ "hmac 0.13.0",
+]
+
+[[package]]
+name = "pem-rfc7468"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9"
+dependencies = [
+ "base64ct",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "phc"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44dc769b75f93afdddd8c7fa12d685292ddeff1e66f7f0f3a234cf1818afe892"
+dependencies = [
+ "base64ct",
+ "ctutils",
+]
+
+[[package]]
+name = "phf"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+dependencies = [
+ "phf_macros",
+ "phf_shared",
+ "serde",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49aa7f9d80421bca176ca8dbfebe668cc7a2684708594ec9f3c0db0805d5d6e1"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+dependencies = [
+ "fastrand",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "piper"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c835479a4443ded371d6c535cbfd8d31ad92c5d23ae9770a61bc155e4992a3c1"
+dependencies = [
+ "atomic-waker",
+ "fastrand",
+ "futures-io",
+]
+
+[[package]]
+name = "pkcs1"
+version = "0.8.0-rc.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "986d2e952779af96ea048f160fd9194e1751b4faea78bcf3ceb456efe008088e"
+dependencies = [
+ "der",
+ "spki",
+]
+
+[[package]]
+name = "pkcs5"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63d440a804ec8d6fafbb6b84471e013286658d373248927692ab3366686220ca"
+dependencies = [
+ "aes 0.9.3",
+ "aes-gcm 0.11.1",
+ "cbc",
+ "der",
+ "pbkdf2 0.13.0",
+ "rand_core 0.10.1",
+ "scrypt 0.12.0",
+ "sha2 0.11.1",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
+dependencies = [
+ "der",
+ "pkcs5",
+ "rand_core 0.10.1",
+ "spki",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
+[[package]]
+name = "png"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
+dependencies = [
+ "bitflags 2.13.2",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide 0.8.9",
+]
+
+[[package]]
+name = "polling"
+version = "3.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d0e4f59085d47d8241c88ead0f274e8a0cb551f3625263c05eb8dd897c34218"
+dependencies = [
+ "cfg-if",
+ "concurrent-queue",
+ "hermit-abi",
+ "pin-project-lite",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "poly1305"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2d0073b297041425c7c3df6eb4792d598a15323fe63346852b092eca02904c"
+dependencies = [
+ "cpufeatures 0.3.1",
+ "universal-hash 0.6.1",
+ "zeroize",
+]
+
+[[package]]
+name = "polyval"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "opaque-debug",
+ "universal-hash 0.5.1",
+]
+
+[[package]]
+name = "polyval"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0fa31d631f2b2cb2a544d0aa321ce847a94764d701ca2becc411138b93d49cd"
+dependencies = [
+ "cpubits",
+ "cpufeatures 0.3.1",
+ "universal-hash 0.6.1",
+ "zeroize",
+]
+
+[[package]]
+name = "portable-pty"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4a596a2b3d2752d94f51fac2d4a96737b8705dddd311a32b9af47211f08671e"
+dependencies = [
+ "anyhow",
+ "bitflags 1.3.2",
+ "downcast-rs",
+ "filedescriptor",
+ "lazy_static",
+ "libc",
+ "log",
+ "nix 0.28.0",
+ "serial2",
+ "shared_library",
+ "shell-words",
+ "winapi",
+ "winreg",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a6394b9e965e73d0a289ee54f589087e2c676aedf60885baf52c76b771e4958"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
+[[package]]
+name = "primefield"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c555a6e4eb7d4e158fcb028c835c3b8642206ddc279b5c6b202ef9a8bdb592f4"
+dependencies = [
+ "crypto-bigint",
+ "crypto-common 0.2.2",
+ "ff",
+ "rand_core 0.10.1",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "primeorder"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c9f42978c78a00e3d68f69fc03e57a234debae69da4020a4fb588fcdcd07b06"
+dependencies = [
+ "elliptic-curve",
+ "once_cell",
+ "primefield",
+ "serdect",
+ "wnaf",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f4c021e1093a56626774e81216a4ce732a735e5bad4868a03f3ed65ca0c3919"
+dependencies = [
+ "once_cell",
+ "toml_edit 0.19.15",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b00f26d3400549137f92511a46ac1cd8ce37cb5598a96d382381458b992a5d24"
+dependencies = [
+ "toml_datetime 0.6.3",
+ "toml_edit 0.20.2",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
+dependencies = [
+ "toml_edit 0.25.17+spec-1.1.0",
+]
+
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "raw-window-handle"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20675572f6f24e9e76ef639bc5552774ed45f1c30e2951e1e99c59888861c539"
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags 2.13.2",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60dc65c0ff1a7ae1294b0c67b9f14baf70b644404010370171787bfac1038fc0"
+dependencies = [
+ "libredox",
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "rfc6979"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4a459cddafb3fe76b31fd8f1108007566c40301feb64dc7b54656eb7388172b"
+dependencies = [
+ "crypto-bigint",
+ "hmac 0.13.0",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rsa"
+version = "0.10.0-rc.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30b2aa4ba0d89f73d1e332df05be0eeab8840351c36ca5654341dfdb57bb3caf"
+dependencies = [
+ "const-oid",
+ "crypto-bigint",
+ "crypto-primes",
+ "digest 0.11.3",
+ "pkcs1",
+ "pkcs8",
+ "rand_core 0.10.1",
+ "sha2 0.11.1",
+ "signature",
+ "spki",
+ "zeroize",
+]
+
+[[package]]
+name = "rusqlite"
+version = "0.32.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7753b721174eb8ff87a9a0e799e2d7bc3749323e773db92e0984debb00019d6e"
+dependencies = [
+ "bitflags 2.13.2",
+ "fallible-iterator",
+ "fallible-streaming-iterator",
+ "hashlink",
+ "libsqlite3-sys",
+ "smallvec",
+]
+
+[[package]]
+name = "russh"
+version = "0.63.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "036204edbd199552a5b3832f63c60dcdf395dc44c7f06b4af1c0e8139cc11bce"
+dependencies = [
+ "aes 0.9.3",
+ "bitflags 2.13.2",
+ "block-padding",
+ "byteorder",
+ "bytes",
+ "cbc",
+ "cipher 0.5.2",
+ "crypto-bigint",
+ "ctr 0.10.1",
+ "curve25519-dalek",
+ "data-encoding",
+ "delegate",
+ "der",
+ "digest 0.11.3",
+ "ecdsa",
+ "ed25519-dalek",
+ "elliptic-curve",
+ "enum_dispatch",
+ "flate2",
+ "futures",
+ "generic-array 1.4.5",
+ "getrandom 0.4.3",
+ "ghash 0.6.0",
+ "hex-literal",
+ "hmac 0.13.0",
+ "inout 0.2.2",
+ "keccak",
+ "log",
+ "md5",
+ "ml-kem",
+ "module-lattice",
+ "num-bigint 0.5.1",
+ "p256",
+ "p384",
+ "p521",
+ "pageant",
+ "pbkdf2 0.13.0",
+ "pkcs1",
+ "pkcs5",
+ "pkcs8",
+ "polyval 0.7.3",
+ "rand 0.10.3",
+ "rand_core 0.10.1",
+ "ring",
+ "rsa",
+ "russh-cryptovec",
+ "russh-util",
+ "salsa20 0.11.0",
+ "scrypt 0.12.0",
+ "sec1",
+ "sha1 0.11.0",
+ "sha2 0.11.1",
+ "sha3 0.12.0",
+ "signature",
+ "spki",
+ "ssh-encoding",
+ "ssh-key",
+ "subtle",
+ "thiserror 2.0.21",
+ "tokio",
+ "typenum",
+ "universal-hash 0.6.1",
+ "yasna",
+ "zeroize",
+]
+
+[[package]]
+name = "russh-cryptovec"
+version = "0.62.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3aec6cb630dbe85d72ffd7bcd95f07e1bd69f9f270ee8adfa1afe443a6331438"
+dependencies = [
+ "log",
+ "nix 0.31.3",
+ "ssh-encoding",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "russh-sftp"
+version = "3.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bb17f72aba4314656b359ffba72c68dcbd70ed9e97497898b75498fe7198042"
+dependencies = [
+ "bitflags 2.13.2",
+ "bytes",
+ "chrono",
+ "dashmap",
+ "gloo-timers",
+ "log",
+ "serde",
+ "serde_bytes",
+ "thiserror 2.0.21",
+ "tokio",
+ "tokio-util",
+ "wasm-bindgen-futures",
+]
+
+[[package]]
+name = "russh-util"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "668424a5dde0bcb45b55ba7de8476b93831b4aa2fa6947e145f3b053e22c60b6"
+dependencies = [
+ "chrono",
+ "tokio",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+]
+
+[[package]]
+name = "rust-embed"
+version = "8.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19afa5b4b6a611de00bd1bdae6ae6f39084c9399f0679c3f52d8469cf335cc23"
+dependencies = [
+ "rust-embed-impl",
+ "rust-embed-utils",
+ "walkdir",
+]
+
+[[package]]
+name = "rust-embed-impl"
+version = "8.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0d8afda6374eac59e066abee06d265247ebbaf3006cf878e2879e8356e34053"
+dependencies = [
+ "mime_guess",
+ "proc-macro2",
+ "quote",
+ "rust-embed-utils",
+ "syn 2.0.119",
+ "walkdir",
+]
+
+[[package]]
+name = "rust-embed-utils"
+version = "8.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d84e8ba78bd384263e5922f084cbe1b081c3b7e69add59c8fb097b879ba968a"
+dependencies = [
+ "mime_guess",
+ "sha2 0.11.1",
+ "walkdir",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
+dependencies = [
+ "bitflags 2.13.2",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustix-openpty"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1de16c7c59892b870a6336f185dc10943517f1327447096bbb7bb32cd85e2393"
+dependencies = [
+ "errno",
+ "libc",
+ "rustix",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "salsa20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213"
+dependencies = [
+ "cipher 0.4.4",
+]
+
+[[package]]
+name = "salsa20"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f874456e72520ff1375a06c588eaf074b0f01f9e9e1aada45bd9b7954a6e42c"
+dependencies = [
+ "cfg-if",
+ "cipher 0.5.2",
+]
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "scrypt"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0516a385866c09368f0b5bcd1caff3366aace790fcd46e2bb032697bb172fd1f"
+dependencies = [
+ "password-hash 0.5.0",
+ "pbkdf2 0.12.2",
+ "salsa20 0.10.2",
+ "sha2 0.10.9",
+]
+
+[[package]]
+name = "scrypt"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d87af57419b594aa23fa95f09f0e06d80d84ba01c26148c43844cad6ff4485f0"
+dependencies = [
+ "cfg-if",
+ "pbkdf2 0.13.0",
+ "salsa20 0.11.0",
+ "sha2 0.11.1",
+]
+
+[[package]]
+name = "sec1"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d"
+dependencies = [
+ "base16ct",
+ "ctutils",
+ "der",
+ "hybrid-array",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "selectors"
+version = "0.38.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8adfa1c298912827b8a28b223b3b874357397ae706e6190acd9bf28cee99114d"
+dependencies = [
+ "bitflags 2.13.2",
+ "cssparser",
+ "derive_more",
+ "log",
+ "new_debug_unreachable",
+ "phf",
+ "phf_codegen",
+ "precomputed-hash",
+ "rustc-hash",
+ "servo_arc",
+ "smallvec",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_bytes"
+version = "0.11.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5d440709e79d88e51ac01c4b72fc6cb7314017bb7da9eeff678aa94c10e3ea8"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.154"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serdect"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66cf8fedced2fcf12406bcb34223dffb92eaf34908ede12fed414c82b7f00b3e"
+dependencies = [
+ "base16ct",
+ "serde",
+]
+
+[[package]]
+name = "serial2"
+version = "0.2.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b16809bc35793b19ce4e0c53924bc0dce3937f15487997cfdaed936004180730"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "servo_arc"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "170fb83ab34de17dc69aa7c67482b22218ddb85da56546f9bd6b929e32a05930"
+dependencies = [
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha1"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha2"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d7069beb7d6ac7b9acd1039986e73443f24234f41074da099d6f994ac9ad19"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "sha3"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be176f1a57ce4e3d31c1a166222d9768de5954f811601fb7ca06fc8203905ce1"
+dependencies = [
+ "digest 0.11.3",
+ "keccak",
+]
+
+[[package]]
+name = "sha3"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc9bad02c26382724b2d2692c6f179285e4b54eeecd7968f52a50059c3c11759"
+dependencies = [
+ "digest 0.11.3",
+ "keccak",
+ "sponge-cursor",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shared_library"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a9e7e0f2bfae24d8a5b5a66c5b257a83c7412304311512a0c054cd5e619da11"
+dependencies = [
+ "lazy_static",
+ "libc",
+]
+
+[[package]]
+name = "shell-words"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc6fe69c597f9c37bfeeeeeb33da3530379845f10be461a66d16d03eca2ded77"
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "signal-hook"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b29ffa27d3d59a049bb328258de100f8012848d1b08d444e08bbc02ac468435e"
+dependencies = [
+ "libc",
+ "signal-hook-registry",
+]
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "signature"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5"
+dependencies = [
+ "digest 0.11.3",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
+
+[[package]]
+name = "siphasher"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33f4fe9184a62d842c9ef383018f3306d8ba224fd9d836f56d7288308847c256"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.16.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b3dc8af474f516a851ff4bd12db780f948b9250ad37211e4eec0bccea54e01b"
+
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "soup3"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "471f924a40f31251afc77450e781cb26d55c0b650842efafc9c6cbd2f7cc4f9f"
+dependencies = [
+ "futures-channel",
+ "gio",
+ "glib",
+ "libc",
+ "soup3-sys",
+]
+
+[[package]]
+name = "soup3-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ebe8950a680a12f24f15ebe1bf70db7af98ad242d9db43596ad3108aab86c27"
+dependencies = [
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "spki"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ef958a98b9d5da290cfc78946e9f3e61e1e62a18db0d92cac0b83cc161491a9"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "sponge-cursor"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a0219bd7d979d58245a4f41f695e1ac9f8befdffadd7f61f1bae9e39abc6620"
+
+[[package]]
+name = "ssh-cipher"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d801accda99469cde6d73da741422610fdf6508a72d9a69d1b55cb241c720597"
+dependencies = [
+ "aead 0.6.1",
+ "aes 0.9.3",
+ "aes-gcm 0.11.1",
+ "chacha20",
+ "cipher 0.5.2",
+ "ctutils",
+ "des",
+ "poly1305",
+ "ssh-encoding",
+ "zeroize",
+]
+
+[[package]]
+name = "ssh-encoding"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b54d0ed0498daf3f78d82e00e28c8eec9d75a067c4cfbcc7a0f7d0f4077749e"
+dependencies = [
+ "base64ct",
+ "bytes",
+ "crypto-bigint",
+ "ctutils",
+ "digest 0.11.3",
+ "pem-rfc7468",
+ "zeroize",
+]
+
+[[package]]
+name = "ssh-key"
+version = "0.7.0-rc.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9a32fae177b74a22aa9c5b01bf7e68b33545be32d9e381e248058d2adc15ce3"
+dependencies = [
+ "argon2",
+ "bcrypt-pbkdf",
+ "ctutils",
+ "ed25519-dalek",
+ "hex",
+ "hmac 0.13.0",
+ "p256",
+ "p384",
+ "p521",
+ "rand_core 0.10.1",
+ "rsa",
+ "sec1",
+ "sha1 0.11.0",
+ "sha2 0.11.1",
+ "signature",
+ "ssh-cipher",
+ "ssh-encoding",
+ "zeroize",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "string_cache"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a18596f8c785a729f2819c0f6a7eae6ebeebdfffbfe4214ae6b087f690e31901"
+dependencies = [
+ "new_debug_unreachable",
+ "parking_lot",
+ "phf_shared",
+ "precomputed-hash",
+]
+
+[[package]]
+name = "string_cache_codegen"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "585635e46db231059f76c5849798146164652513eb9e8ab2685939dd90f29b69"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+
+[[package]]
+name = "synstructure"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "system-deps"
+version = "6.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3e535eb8dded36d55ec13eddacd30dec501792ff23a0b1682c38601b8cf2349"
+dependencies = [
+ "cfg-expr",
+ "heck 0.5.0",
+ "pkg-config",
+ "toml",
+ "version-compare",
+]
+
+[[package]]
+name = "tao"
+version = "0.37.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f37f381f4e048e6cdf038b5705f8cf14ad108279d46eb968140a7b291aba9400"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2",
+ "core-foundation",
+ "core-graphics",
+ "crossbeam-channel",
+ "dbus",
+ "dispatch2",
+ "dlopen2",
+ "dpi",
+ "gdkwayland-sys",
+ "gdkx11-sys",
+ "gtk",
+ "jni",
+ "libc",
+ "log",
+ "ndk",
+ "ndk-context",
+ "ndk-sys",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-foundation",
+ "objc2-ui-kit",
+ "parking_lot",
+ "percent-encoding",
+ "raw-window-handle",
+ "tao-macros",
+ "unicode-segmentation",
+ "url",
+ "windows",
+ "windows-core",
+ "windows-version",
+ "x11-dl",
+]
+
+[[package]]
+name = "tao-macros"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f7eeb6d99155545da6150a1795945f16ac9c178deb2a5f2e74d776107bd5849"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.12.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
+
+[[package]]
+name = "tendril"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fed54709c5b3a53d09bb1c113ea4f5ceafd1e772ddcb0030a82e1d56c087b08"
+dependencies = [
+ "new_debug_unreachable",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
+dependencies = [
+ "thiserror-impl 2.0.21",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "time"
+version = "0.3.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tokio"
+version = "1.53.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "parking_lot",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "tokio-tungstenite"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edc5f74e248dc973e0dbb7b74c7e0d6fcc301c694ff50049504004ef4d0cdcd9"
+dependencies = [
+ "futures-util",
+ "log",
+ "tokio",
+ "tungstenite",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e464cf451ba96ebfc6f9b6542f17ee8b8956e33f1e40d9690624e59d7a7f8a4b"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "toml"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "185d8ab0dfbb35cf1399a6344d8484209c088f75f8f68230da55d48d95d43e3d"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime 0.6.3",
+ "toml_edit 0.20.2",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cda73e2f1397b1262d6dfdcef8aafae14d1de7748d66822d3bfeeb6d03e5e4b"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.19.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
+dependencies = [
+ "indexmap",
+ "toml_datetime 0.6.3",
+ "winnow 0.5.40",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "396e4d48bbb2b7554c944bde63101b5ae446cff6ec4a24227428f15eb72ef338"
+dependencies = [
+ "indexmap",
+ "serde",
+ "serde_spanned",
+ "toml_datetime 0.6.3",
+ "winnow 0.5.40",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.25.17+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3641d5bbb5349a79e1020a242d251efbc546ad8048d133958323ce9c40a9c9c"
+dependencies = [
+ "indexmap",
+ "toml_datetime 1.1.2+spec-1.1.0",
+ "toml_parser",
+ "winnow 1.0.4",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.5+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
+dependencies = [
+ "winnow 1.0.4",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags 2.13.2",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "http-range-header",
+ "httpdate",
+ "mime",
+ "mime_guess",
+ "percent-encoding",
+ "pin-project-lite",
+ "tokio",
+ "tokio-util",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "tray-icon"
+version = "0.26.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f5cc5858ecf9574ddd8f0032a2ff7ffd6f7724d2b81e48b9374984b3fd6ddc9"
+dependencies = [
+ "crossbeam-channel",
+ "dirs",
+ "libappindicator",
+ "muda",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+ "objc2-foundation",
+ "once_cell",
+ "png",
+ "thiserror 2.0.21",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tungstenite"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18e5b8366ee7a95b16d32197d0b2604b43a0be89dc5fac9f8e96ccafbaedda8a"
+dependencies = [
+ "byteorder",
+ "bytes",
+ "data-encoding",
+ "http",
+ "httparse",
+ "log",
+ "rand 0.8.8",
+ "sha1 0.10.7",
+ "thiserror 1.0.69",
+ "utf-8",
+]
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicase"
+version = "2.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "357cc3acc6a036009fd6c973ed009037c732d60d0b4f6c673e9041497482a28f"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
+
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common 0.1.7",
+ "subtle",
+]
+
+[[package]]
+name = "universal-hash"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4987bdc12753382e0bec4a65c50738ffaabc998b9cdd1f952fb5f39b0048a96"
+dependencies = [
+ "crypto-common 0.2.2",
+ "ctutils",
+]
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "uuid"
+version = "1.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cc1186384beb7dd8eedea376413fd654937285ea6c9cfbb928dc3043ea4b606"
+dependencies = [
+ "getrandom 0.4.3",
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version-compare"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03c2856837ef78f57382f06b2b8563a2f512f7185d732608fd9176cb3b8edf0e"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "vps-switch"
+version = "0.1.0"
+dependencies = [
+ "aes-gcm 0.10.3",
+ "alacritty_terminal",
+ "anyhow",
+ "async-trait",
+ "axum",
+ "base64",
+ "bytes",
+ "chrono",
+ "futures",
+ "mime_guess",
+ "portable-pty",
+ "rand 0.8.8",
+ "rusqlite",
+ "russh",
+ "russh-sftp",
+ "rust-embed",
+ "scrypt 0.11.0",
+ "serde",
+ "serde_json",
+ "tao",
+ "tokio",
+ "tokio-util",
+ "tower-http",
+ "tracing",
+ "tracing-subscriber",
+ "tray-icon",
+ "uuid",
+ "wry",
+]
+
+[[package]]
+name = "vte"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5924018406ce0063cd67f8e008104968b74b563ee1b85dde3ed1f7cb87d3dbd"
+dependencies = [
+ "arrayvec",
+ "bitflags 2.13.2",
+ "cursor-icon",
+ "log",
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bb54f33acc68fd454578d9820b0bde1a1a3d17aa17bb7b6595806d02886d409"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3cbab34de2d982e9b48e18d216d04c4a6f641066ff19ffb699980f591ee3610e"
+dependencies = [
+ "js-sys",
+ "tokio",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e29d0c35b16e224a7eeb5cd2d25e3e1968fbd65604117b44d3b789d00ee8535"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f501a8bc3719dba86ef8ae4728879c08001bea749eb1333ac5b91e040e2a6b7"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23f0c9c52aa7cd7d77769a4cfe2a9adb1b331f489a41d912ce14513d5ab995c6"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "web_atoms"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba8b815c1b593dc0baf78dd0f4fc8fdb2de53198fb1163738093e9a311c33fb3"
+dependencies = [
+ "phf",
+ "phf_codegen",
+ "string_cache",
+ "string_cache_codegen",
+]
+
+[[package]]
+name = "webkit2gtk"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1027150013530fb2eaf806408df88461ae4815a45c541c8975e61d6f2fc4793"
+dependencies = [
+ "bitflags 1.3.2",
+ "cairo-rs",
+ "gdk",
+ "gdk-sys",
+ "gio",
+ "gio-sys",
+ "glib",
+ "glib-sys",
+ "gobject-sys",
+ "gtk",
+ "gtk-sys",
+ "javascriptcore-rs",
+ "libc",
+ "once_cell",
+ "soup3",
+ "webkit2gtk-sys",
+]
+
+[[package]]
+name = "webkit2gtk-sys"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "916a5f65c2ef0dfe12fff695960a2ec3d4565359fdbb2e9943c974e06c734ea5"
+dependencies = [
+ "bitflags 1.3.2",
+ "cairo-sys-rs",
+ "gdk-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "gtk-sys",
+ "javascriptcore-rs-sys",
+ "libc",
+ "pkg-config",
+ "soup3-sys",
+ "system-deps",
+]
+
+[[package]]
+name = "webview2-com"
+version = "0.39.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f89fca7a704cee10dcb3654c1dbb8941d1783132f1917358af75bec37a7d7e6"
+dependencies = [
+ "webview2-com-macros",
+ "webview2-com-sys",
+ "windows",
+ "windows-core",
+]
+
+[[package]]
+name = "webview2-com-macros"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67a921c1b6914c367b2b823cd4cde6f96beec77d30a939c8199bb377cf9b9b54"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "webview2-com-sys"
+version = "0.39.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3a07132775117d6065853d9d1178157b8c90e228de47129d6bce2c7edebedfb"
+dependencies = [
+ "thiserror 2.0.21",
+ "windows",
+ "windows-core",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "527fadee13e0c05939a6a05d5bd6eec6cd2e3dbd648b9f8e447c6518133d8580"
+dependencies = [
+ "windows-collections",
+ "windows-core",
+ "windows-future",
+ "windows-numerics",
+]
+
+[[package]]
+name = "windows-collections"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b2d95af1a8a14a3c7367e1ed4fc9c20e0a26e79551b1454d72583c97cc6610"
+dependencies = [
+ "windows-core",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-future"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1d6f90251fe18a279739e78025bd6ddc52a7e22f921070ccdc67dde84c605cb"
+dependencies = [
+ "windows-core",
+ "windows-link",
+ "windows-threading",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-numerics"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2e40844ac143cdb44aead537bbf727de9b044e107a0f1220392177d15b0f26"
+dependencies = [
+ "windows-core",
+ "windows-link",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets 0.42.2",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows-threading"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3949bd5b99cafdf1c7ca86b43ca564028dfe27d66958f2470940f73d86d75b37"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-version"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4060a1da109b9d0326b7262c8e12c84df67cc0dbc9e33cf49e01ccc2eb63631"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "winnow"
+version = "0.5.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f593a95398737aeed53e489c785df13f3618e41dbcd6718c6addbf1395aa6876"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winnow"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winreg"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80d0f4e272c85def139476380b12f9ac60926689dd2e01d4923222f40580869d"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "wnaf"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "795ca18b3fdb5e62bf982199278341ddcf7ebf7d32e25e212ad05d496e95f6fa"
+dependencies = [
+ "ff",
+ "group",
+ "hybrid-array",
+ "primefield",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+
+[[package]]
+name = "wry"
+version = "0.57.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a819957a01b3119af85e638a38d242af76dbc87d130dca67bfd0441072e21ff0"
+dependencies = [
+ "base64",
+ "block2",
+ "cookie",
+ "crossbeam-channel",
+ "dirs",
+ "dom_query",
+ "dpi",
+ "dunce",
+ "gdkx11",
+ "gtk",
+ "http",
+ "javascriptcore-rs",
+ "jni",
+ "libc",
+ "ndk",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+ "objc2-ui-kit",
+ "objc2-web-kit",
+ "once_cell",
+ "percent-encoding",
+ "raw-window-handle",
+ "sha2 0.10.9",
+ "soup3",
+ "tao-macros",
+ "thiserror 2.0.21",
+ "url",
+ "webkit2gtk",
+ "webkit2gtk-sys",
+ "webview2-com",
+ "windows",
+ "windows-core",
+ "windows-version",
+ "x11-dl",
+]
+
+[[package]]
+name = "x11"
+version = "2.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "502da5464ccd04011667b11c435cb992822c2c0dbde1770c988480d312a0db2e"
+dependencies = [
+ "libc",
+ "pkg-config",
+]
+
+[[package]]
+name = "x11-dl"
+version = "2.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38735924fedd5314a6e548792904ed8c6de6636285cb9fec04d5b1db85c1516f"
+dependencies = [
+ "libc",
+ "once_cell",
+ "pkg-config",
+]
+
+[[package]]
+name = "yasna"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5f6765e852b9b4dc8e2a76843e4d64d1cea8e79bcde0b6901aea8e7c7f08282"
+dependencies = [
+ "bit-vec 0.9.1",
+ "num-bigint 0.4.8",
+]
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.62"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86502bf56ac7c77571a32e2647bb2a15894565e981fb2a48d7bde2d91c965a9d"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.62"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5457206954b06561e2608c7e19cf58b1926586d999c246eebe4502f7e2039d1a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "zlib-rs"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b268e58e7c693d7c271f93ffc4ba3b380412554231c85bf61ca7af91042a4112"
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/Cargo.toml b/Cargo.toml
new file mode 100644
index 0000000..7c94419
--- /dev/null
+++ b/Cargo.toml
@@ -0,0 +1,41 @@
+[package]
+name = "vps-switch"
+version = "0.1.0"
+edition = "2021"
+description = "Lightweight VPS manager and MCP server"
+
+[dependencies]
+tokio = { version = "1.40", features = ["full"] }
+axum = { version = "0.7", features = ["ws", "macros"] }
+tower-http = { version = "0.6", features = ["fs", "cors"] }
+rusqlite = { version = "0.32", features = ["bundled"] }
+russh = { version = "0.63.0", default-features = false, features = ["flate2", "ring", "rsa", "legacy-ed25519-pkcs8-parser"] }
+russh-sftp = "3.0.1"
+alacritty_terminal = "0.26.0"
+portable-pty = "0.9.0"
+tokio-util = { version = "0.7", features = ["io"] }
+bytes = "1"
+rust-embed = { version = "8.13.0", features = ["debug-embed", "mime-guess"] }
+mime_guess = "2.0"
+serde = { version = "1.0", features = ["derive"] }
+
+[target.'cfg(windows)'.dependencies]
+wry = "0.57.0"
+tao = "0.37.1"
+tray-icon = "0.26.1"
+serde_json = "1.0"
+aes-gcm = "0.10"
+scrypt = { version = "0.11", default-features = false, features = ["std"] }
+rand = "0.8"
+base64 = "0.22"
+uuid = { version = "1.10", features = ["v4"] }
+chrono = { version = "0.4", features = ["serde"] }
+anyhow = "1.0"
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+futures = "0.3"
+async-trait = "0.1"
+
+[profile.dev.package."*"]
+opt-level = 2
+
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..fe39be0
--- /dev/null
+++ b/README.md
@@ -0,0 +1,5 @@
+# vps-switch
+
+一个轻量级 VPS 管理工具：先把 VPS 仓库、终端、文件浏览器、文件上传下载、探针五大核心板块做到极致，最后将这些现成链路加上护栏工具化为 MCP Server。
+
+范围、六大板块路线与技术栈见 [docs/plan.md](docs/plan.md)。不在那里的东西不进仓库。
diff --git a/docs/plan.md b/docs/plan.md
new file mode 100644
index 0000000..f744348
--- /dev/null
+++ b/docs/plan.md
@@ -0,0 +1,111 @@
+# vps-switch 计划
+
+> 2026-10-10 起，2026-10-13 按「先做好五大核心功能板块、最后将现成链路工具化为 MCP」重定主线。
+> vps-switch 是 1Shell（Node + Electron，冻结在 4.7.7）的全面重构与升级；旧项目在本项目可用之前照常运行，且随时作为实测对照。
+> 本文是"一页边界"：不在这里的东西不进仓库。要加，先改边界那句话。
+
+---
+
+## 边界
+
+**一个轻量级 VPS 管理工具：先把 VPS 仓库、终端、文件浏览器、文件上传下载、探针五大核心板块做到极致，最后将这些现成链路加上护栏工具化为 MCP Server。**
+
+设计准则：
+
+- 沿用 `AGENTS.md`：不堆提示词（本项目零模型调用）、不堆架构（一份底层实现，UI 与 MCP 共同复用）、不对 agent 隐藏上下文。
+- **概念数必须比 1Shell 少。** 不设内置 AI 聊天、不设协议 agent 入驻、不设技能/脚本库。
+- **先做好人用的本体，再做工具化。** MCP 不是另起炉灶的第二套系统，而是对前五个板块已验证底层链路的薄封装。
+
+---
+
+## 为什么要按这个路径重构
+
+直接调用并复盘正在运行的 1Shell（1 台 `local` + 29 台 VPS，共 30 个目标），它的核心问题很清楚：
+
+| 1Shell 的痛点 | 根源 | vps-switch 的解法 |
+|---|---|---|
+| **定位散乱、体积臃肿（80k 行）** | 第一次做项目时误打误撞，把内置 AI 对话、Claude/Codex 驻留面板、技能库、脚本库、工作负载全塞了进来 | 砍掉所有内置 AI 与多余概念，回归纯粹的轻量级 VPS 管理工具 + 外部 MCP 接口 |
+| **主机仓库信息滞后** | `osName` 等信息首次探测后成了死缓存（如 `lazy-gomami` 重装为 Ubuntu 后列表仍显示 Alpine 3.23） | SSH 连接建立时轻量静默刷新真实 OS/内核/架构信息，保持仓库数据鲜活 |
+| **终端总有小 bug** | Node 仅做字节透传，服务端无终端状态机；切页丢屏、UTF-8 多字节截断乱码、resize 错位、不知命令何时结束 | 参考 Pebrel 技术栈：Rust 侧 `alacritty_terminal::Term` 持有权威网格状态 + 字节环重连恢复 + 随包 Windows ConPTY + OSC 133/7 真实命令边界与 exit code + WebSocket 纯二进制帧 |
+| **文件上传下载困难（尤其 Agent 调用时）** | 传文件被拆成 `start/append/finish_file_upload` 等 9 个工具，逼大模型在上下文里手搓 base64 分块，慢且极易断 | 做独立的 Rust 流式传输引擎（接收 `本机路径 ↔ 远端路径`），内部自动流式分片、断点续传、SHA256 校验；UI 队列与 MCP 共用同一条链路 |
+| **探针过重、后台刷屏** | 塞了 Agentless / Go Agent / Relay 级联三种模式与复杂告警，40,826 次 SSH 轮询占了 76% 活动，告警刷出 1.1 万条 | 重做轻量探针：复用 SSH 连接或按需/低频采样（CPU、内存、磁盘、实时网速/流量、基础负载），打开面板时实时刷新，后台静默不折腾 |
+
+---
+
+## 六大板块与推进路线
+
+采用**一个板块一个板块做透**的节奏：每个板块先结合 1Shell 实际体验细化讨论，打磨好前端形态与 Rust 底层链路，验收通过后再进入下一板块。
+
+### 板块一：VPS 仓库（底座与前端形态定型）
+
+先把轻量级工具的**前端整体骨架与视觉形态**打磨定型，同时把底层主机管理与 SSH 连接池做扎实：
+
+- **主机模型（Host）**：支持本机（`local`）与远端 SSH 主机；字段涵盖地址、端口、用户名、认证方式（密码 / 私钥加密存储）、跳板机（`jump_host_id`）、分组/标签、置顶、排序、备注链接，以及连接时自动刷新的 `os` 信息（系统家族、发行版、内核、架构）。
+- **1Shell 一键导入**：直接读取并解密本机现有 1Shell 数据库里的 29 台 VPS，一键迁入，开发第一天起就能用真实机队测试。
+- **SSH 连接底座（`russh`）**：单主机连接池与多 channel 复用（终端、执行、SFTP、探针共用连接，支持跳板机透明穿透），并在真机队（OpenSSH 8.4 ~ 10.2、Alpine、Windows OpenSSH 9.5）上验通。
+- **前端打磨**：确定整个软件的导航布局、配色主题、主机列表/卡片视图、搜索与标签过滤、快速新建/编辑与连接测试交互。
+
+### 板块二：终端（参考 Pebrel 技术栈）
+
+**Rust 侧持有终端状态，前端只负责高速渲染。** 借鉴 Pebrel（Apache-2.0 的 `alacritty_terminal` 引擎，不抄 GPL 代码）的成熟终端工程实践：
+
+- **双解析器与状态保活**：每个终端 pane 在 Rust 守护进程中对应一个 `alacritty_terminal::Term`（持有网格与 scrollback）+ 有界字节环（默认 2 MiB）；同一份二进制字节流经 WebSocket 喂给前端 `xterm.js`（WebGL addon）。切页面、关窗口、闪断重连瞬间恢复现场。
+- **PTY 链路**：本机使用 `portable-pty` 并**随包携带 Windows Terminal 的 `conpty.dll` + `OpenConsole.exe`**（告别系统老旧 ConPTY bug）；远端复用板块一的 `russh` 连接打开 PTY channel。
+- **Shell Integration（OSC 133 / OSC 7）**：连接时静默注入 bash / zsh / fish / PowerShell 钩子，在 Rust 解析回调中精确截获每条命令的开始、结束、真实 `exit_code` 与当前工作目录 `cwd`。
+- **输入正确性**：支持 bracketed paste、按当前终端模式编码控制键与回车，杜绝粘贴多行直接误执行和乱码。
+- **多 Tab 与分屏树**：支持同一主机或跨主机多 Tab、任意方向分屏与拖拽调整占比，布局持久化。
+
+### 板块三：文件浏览器
+
+本机文件系统与远端 `russh-sftp` 复用同一套抽象接口：
+
+- **目录浏览与操作**：目录树/列表双视图、面包屑与路径直达、隐藏文件切换、权限/大小/修改时间展示、新建文件/文件夹、重命名、删除、修改权限。
+- **在线编辑**：集成 CodeMirror 6，支持语法高亮、搜索替换、保存直写远端（带可选备份），顺手改配置文件不必下载再上传。
+- **与终端联动**：支持跟随当前终端 `cwd`（由 OSC 7 提供）或在当前目录一键打开终端。
+
+### 板块四：文件上传下载
+
+把文件传输从普通读写里独立出来，做成一个真正的**高速流式传输引擎**：
+
+- **核心链路**：直接基于 `本机文件路径 ↔ 远端文件路径` 流式读写，不经过内存全量缓冲、不走 base64 编码。
+- **大文件与弱网保障**：内部自动按大小分块流式传输、支持断点续传、传输完成后校验大小与 SHA256、写临时文件再原子 rename（防止传一半搞坏线上文件）。
+- **传输队列 UI**：支持拖拽上传、批量上传下载、实时显示传输速率、进度百分比、剩余时间，支持暂停/继续/取消。
+- **为工具化铺路**：这套 Rust 传输函数做好后，板块六的 MCP 工具只需传 `{host, local_path, remote_path}` 即可直接调用，彻底消灭 1Shell 里让大模型手搓 9 个分片工具的顽疾。
+
+### 板块五：探针
+
+砍掉 1Shell 里繁琐的级联与告警轰炸，做一个**轻量、干净、好看的 VPS 状态看板**：
+
+- **核心指标**：在线状态与连接延迟、系统运行时长（Uptime）、CPU 使用率与负载（Load）、内存与 Swap、磁盘占用、实时上下行网速与累计流量、关键端口/进程概览。
+- **轻量采集机制**：优先复用已建立的 SSH 连接或采用极低开销的单次合并脚本采样；**按需高频、后台低频/静默**（人打开探针页或选中主机时实时刷新，平时不疯狂建连刷日志）。
+- **兼容 Linux 与 Windows**：Linux（Debian/Ubuntu/Alpine）读取 `/proc` 与系统指标，Windows（`yun-computer`）走轻量性能计数采集。
+
+### 板块六：工具化（MCP Server + 安全护栏）
+
+前五个板块全部打磨成熟后，**零重复建设**，直接把已有的底层链路封装为 MCP Server 暴露给外部 Agent（如 Claude Code）：
+
+- **链路直接复用**：
+  - 查主机 / 看状态 → 复用 **板块一（VPS 仓库）** + **板块五（探针）**
+  - 执行命令（同步等待或转后台任务，含 Windows PowerShell 编码与 CLIXML 处理）→ 复用 **板块一/二（SSH & 本机执行链路）**
+  - 列目录 / 读写改删文件 → 复用 **板块三（文件浏览器内核）**
+  - 上传 / 下载大文件 → 复用 **板块四（文件上传下载引擎）**，一次调用完成传输
+- **命令安全护栏与审批**：
+  - 针对 Agent 执行路径设置 TOML 规则护栏（红线 > 黑名单 > critical > 需审批 > 白名单 > 放行），每台主机可设独立安全挡位（`safe` / `standard` / `trusted`）。
+  - 拦截时返回清晰的 `why` + `suggestion`；需人工确认的命令进入 UI 审批队列，并在主机运行记录与审计中留痕。
+- **双传输支持**：`--mcp-stdio`（供本机 Claude Code 零配置直连）+ Streamable HTTP（带范围令牌）。
+
+---
+
+## 技术栈
+
+| 层 | 选型 | 备注 |
+|---|---|---|
+| 后端语言与运行时 | Rust + `tokio` | 单一常驻进程，轻量低内存 |
+| SSH / SFTP | `russh` 0.63 + `russh-sftp` | 纯 Rust，连接池 + 多 channel 复用 + 跳板机穿透 |
+| 终端引擎 | `alacritty_terminal`（Apache-2.0） | 借鉴 Pebrel：Rust 侧持有网格与 scrollback，解析回调截获 OSC 133/7 |
+| 本机 PTY | `portable-pty` + 随包 Windows Terminal `conpty.dll` / `OpenConsole.exe` | 解决 Windows 原生 ConPTY 兼容性与渲染 bug |
+| Web 服务与实时通信 | `axum` | REST API + 终端二进制 WebSocket + 状态/探针/传输进度 SSE |
+| 本地存储 | `rusqlite`（bundled） | 单文件 SQLite + 凭据加密存储 |
+| MCP 协议 | `rmcp`（≥ 1.4.0） | 板块六接入，支持 stdio 与 Streamable HTTP |
+| 桌面壳 | Tauri 2 | 桌面窗口与托盘 + headless 同一二进制双模式 |
+| 前端 | Vue 3 + TypeScript + Tailwind CSS + xterm.js（WebGL）+ CodeMirror 6 | 轻量、响应迅速、围绕五大板块打造精致 UI |
diff --git a/frontend/index.html b/frontend/index.html
new file mode 100644
index 0000000..9c25c72
--- /dev/null
+++ b/frontend/index.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
+    <title>VPS Switch</title>
+  </head>
+  <body class="bg-[#f4f5f7] text-zinc-900 antialiased selection:bg-zinc-900 selection:text-white">
+    <div id="app"></div>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
+</html>
diff --git a/frontend/package.json b/frontend/package.json
new file mode 100644
index 0000000..6961479
--- /dev/null
+++ b/frontend/package.json
@@ -0,0 +1,26 @@
+{
+  "name": "vps-switch-frontend",
+  "private": true,
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite --port 5173",
+    "build": "vite build",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "@xterm/addon-fit": "0.10.0",
+    "@xterm/addon-web-links": "0.11.0",
+    "@xterm/addon-webgl": "0.18.0",
+    "@xterm/xterm": "5.5.0",
+    "vue": "^3.5.13"
+  },
+  "devDependencies": {
+    "@vitejs/plugin-vue": "^5.2.1",
+    "autoprefixer": "^10.4.20",
+    "postcss": "^8.4.49",
+    "tailwindcss": "^3.4.17",
+    "typescript": "~5.6.2",
+    "vite": "^6.0.5"
+  }
+}
diff --git a/frontend/pnpm-lock.yaml b/frontend/pnpm-lock.yaml
new file mode 100644
index 0000000..915123e
--- /dev/null
+++ b/frontend/pnpm-lock.yaml
@@ -0,0 +1,1488 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    dependencies:
+      '@xterm/addon-fit':
+        specifier: 0.10.0
+        version: 0.10.0(@xterm/xterm@5.5.0)
+      '@xterm/addon-web-links':
+        specifier: 0.11.0
+        version: 0.11.0(@xterm/xterm@5.5.0)
+      '@xterm/addon-webgl':
+        specifier: 0.18.0
+        version: 0.18.0(@xterm/xterm@5.5.0)
+      '@xterm/xterm':
+        specifier: 5.5.0
+        version: 5.5.0
+      vue:
+        specifier: ^3.5.13
+        version: 3.5.43(typescript@5.6.3)
+    devDependencies:
+      '@vitejs/plugin-vue':
+        specifier: ^5.2.1
+        version: 5.2.4(vite@6.4.4(jiti@1.21.7))(vue@3.5.43(typescript@5.6.3))
+      autoprefixer:
+        specifier: ^10.4.20
+        version: 10.6.1(postcss@8.5.29)
+      postcss:
+        specifier: ^8.4.49
+        version: 8.5.29
+      tailwindcss:
+        specifier: ^3.4.17
+        version: 3.4.19
+      typescript:
+        specifier: ~5.6.2
+        version: 5.6.3
+      vite:
+        specifier: ^6.0.5
+        version: 6.4.4(jiti@1.21.7)
+
+packages:
+
+  '@alloc/quick-lru@5.3.0':
+    resolution: {integrity: sha512-U4+70Pc5ZS9osnCBCE5Jha/ciHM+Yp+CNMNC/7HvYbNRk1Ldd+f7qO65W5qfhu/TCv+/ozljlXXe9Nj8419DMA==}
+    engines: {node: '>=10'}
+
+  '@babel/helper-string-parser@7.29.7':
+    resolution: {integrity: sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-identifier@7.29.7':
+    resolution: {integrity: sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/parser@7.29.9':
+    resolution: {integrity: sha512-CjXrNHTnvqBVqHgdBysY3vk2T8tpJHb5/RMeHJBTyVa9xgugCB0CJTx/3oO8RV2QRQP391RWpB7D6hLjm8V9uA==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  '@babel/types@7.29.8':
+    resolution: {integrity: sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==}
+    engines: {node: '>=6.9.0'}
+
+  '@esbuild/aix-ppc64@0.25.12':
+    resolution: {integrity: sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
+  '@esbuild/android-arm64@0.25.12':
+    resolution: {integrity: sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
+  '@esbuild/android-arm@0.25.12':
+    resolution: {integrity: sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
+  '@esbuild/android-x64@0.25.12':
+    resolution: {integrity: sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
+  '@esbuild/darwin-arm64@0.25.12':
+    resolution: {integrity: sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@esbuild/darwin-x64@0.25.12':
+    resolution: {integrity: sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@esbuild/freebsd-arm64@0.25.12':
+    resolution: {integrity: sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-x64@0.25.12':
+    resolution: {integrity: sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@esbuild/linux-arm64@0.25.12':
+    resolution: {integrity: sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@esbuild/linux-arm@0.25.12':
+    resolution: {integrity: sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
+  '@esbuild/linux-ia32@0.25.12':
+    resolution: {integrity: sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
+  '@esbuild/linux-loong64@0.25.12':
+    resolution: {integrity: sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@esbuild/linux-mips64el@0.25.12':
+    resolution: {integrity: sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@esbuild/linux-ppc64@0.25.12':
+    resolution: {integrity: sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@esbuild/linux-riscv64@0.25.12':
+    resolution: {integrity: sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@esbuild/linux-s390x@0.25.12':
+    resolution: {integrity: sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@esbuild/linux-x64@0.25.12':
+    resolution: {integrity: sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/netbsd-arm64@0.25.12':
+    resolution: {integrity: sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-x64@0.25.12':
+    resolution: {integrity: sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/openbsd-arm64@0.25.12':
+    resolution: {integrity: sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-x64@0.25.12':
+    resolution: {integrity: sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openharmony-arm64@0.25.12':
+    resolution: {integrity: sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@esbuild/sunos-x64@0.25.12':
+    resolution: {integrity: sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@esbuild/win32-arm64@0.25.12':
+    resolution: {integrity: sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@esbuild/win32-ia32@0.25.12':
+    resolution: {integrity: sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@esbuild/win32-x64@0.25.12':
+    resolution: {integrity: sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
+  '@jridgewell/gen-mapping@0.3.13':
+    resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
+
+  '@jridgewell/resolve-uri@3.1.2':
+    resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==}
+    engines: {node: '>=6.0.0'}
+
+  '@jridgewell/sourcemap-codec@1.6.0':
+    resolution: {integrity: sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
+
+  '@napi-rs/lzma-linux-x64-gnu@1.5.1':
+    resolution: {integrity: sha512-oTXEIha4SsuXdTA4Iyskj0kpdx2yVXdhd75c2v3xGrHFfVMsbhTPZU/nMPL4sWKo4pBHm3aucLaqGlF696dTyQ==}
+    engines: {node: ^22.20 || ^24.12 || >=25}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@nodelib/fs.scandir@2.1.5':
+    resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.stat@2.0.5':
+    resolution: {integrity: sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.walk@1.2.8':
+    resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
+    engines: {node: '>= 8'}
+
+  '@rollup/rollup-android-arm-eabi@4.64.5':
+    resolution: {integrity: sha512-MrfgRQSpD5hkkRg6XI16B6EDLb+6+xp8xje6bpdSwkYw+qxrBKbUVrRAQu9h82UT+QumSIVQ8HXsXjPd2dlhqw==}
+    cpu: [arm]
+    os: [android]
+
+  '@rollup/rollup-android-arm64@4.64.5':
+    resolution: {integrity: sha512-+uu2p/R9Tzn8GpoQyX1pAo5dmKT1DhXevfaCzqzmPFhnLjHLWw7uWkaVGlxmhwYoRiYYhsGfRcD5cTBpL7rgSw==}
+    cpu: [arm64]
+    os: [android]
+
+  '@rollup/rollup-darwin-arm64@4.64.5':
+    resolution: {integrity: sha512-17dys+YEmzwzzFVHQAVDONg5FALXY9kd99HFEpfk4gJVHYxoh5bGea3D4t1fXXnwkTcOe25wPyd6nWS0I8IdLQ==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@rollup/rollup-darwin-x64@4.64.5':
+    resolution: {integrity: sha512-wg0zQEKkEvFZf1UaaX1UELOoPs//OSKUG7D+yITuqOsAvza7LvHTv5Wu4nmMfzNG7EYI2jp2PJC7Id6OETmsYQ==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@rollup/rollup-freebsd-arm64@4.64.5':
+    resolution: {integrity: sha512-CoJmWcpEMuwin+TZ/ev/H9uDyF/uxUKQSWXdmIPn/UBx/uGV9+4ebMp0FwnlhWR9PE1AdzYsKf3bZevhif38+A==}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@rollup/rollup-freebsd-x64@4.64.5':
+    resolution: {integrity: sha512-PxZnLAaTUAL5xG0W2BXLeYPKrK2b3LIASV2/e/Kf7PZvSLI1iAQIm9B9aJD+YyFIT7hc6qaMV3+OOO35R28LfA==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@rollup/rollup-linux-arm-gnueabihf@4.64.5':
+    resolution: {integrity: sha512-uPo3IvnONjhbFXwWgroBeFwOicuhT7ZwQrnzkzmOtBJzeQbkUJUE1SJDfDI31ijQ5+ZUIA6sPrdUMxTSnxUWAg==}
+    cpu: [arm]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-arm-musleabihf@4.64.5':
+    resolution: {integrity: sha512-ywI8Jyuc4LyHYTjC0mw4yA1ulvZBkHusdpWnoiEBsmBuHvSnt90btTBGCZ+s/2y+YNNfVAEKy33nPo5UI9zTmg==}
+    cpu: [arm]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-arm64-gnu@4.64.5':
+    resolution: {integrity: sha512-tmuXJoQ/3ovSr637aykZMdQteU/CB2APAz2CrvsbibuoHZi1BS1Db13cVViBdEARGwXCLn1DSJ8wsjoThLJPGA==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-arm64-musl@4.64.5':
+    resolution: {integrity: sha512-5FMjSYNcUOHx7oW8Qu9KB6jGPpvF/8sG7+BDHwU/Ihh1/6FMJ9ySmsFG4tJ1qbNRuP8OLzCBDso4sF0mQaLuFQ==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-loong64-gnu@4.64.5':
+    resolution: {integrity: sha512-K8ZJ+neLDbUkIrL8dqF/5LtuVCrKwo27kREgOlxjBEjlOXwHvDnHLU8Z/UKv/B49qi7e8hsSDOyoJwhwqhvX4w==}
+    cpu: [loong64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-loong64-musl@4.64.5':
+    resolution: {integrity: sha512-NlVxsq7PFPv0DBKGuNWRDKixQYQCjM53zl04mxEcKMBmJbCBIUm1JdPfIWDRHyOOFzzYPmLQzfeEwh4716ayQg==}
+    cpu: [loong64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-ppc64-gnu@4.64.5':
+    resolution: {integrity: sha512-ARhRHJYs5eCFet5azfrHD97vOkD8OzNW2RSMlvo5CcBqXaTOLfp0OHDtUQh7/K5AL5fUYoFp2fgC9KDg4vVYMQ==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-ppc64-musl@4.64.5':
+    resolution: {integrity: sha512-atSgreM5C7jpxd9aEXN+6vJ5wTd05iYw+S3FiQpw7VsoEl8B90llbq35ARON+GOHj5QlVQEq2vOKWCHTob/BSQ==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-riscv64-gnu@4.64.5':
+    resolution: {integrity: sha512-vmlmwBFGnjVWxSRoVabNkyYuscSmg52Pd0fM8jEbNT3Jmka4A6HcB84x4uAmuumznWfBVaxKOqU6jbEgomWKCA==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-riscv64-musl@4.64.5':
+    resolution: {integrity: sha512-hhJrP6S9WkbsbcHgUkvCBS5Cn8IdsG8XjlLZyxjnv9+NdoYfbbZE4TWJYr8apdaj1M5t5Y1id2StnEslxpNFyA==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-s390x-gnu@4.64.5':
+    resolution: {integrity: sha512-NNVCyN9pGrwFmQa4bf+Cnf5aVH3g6ZpnlOg1Cs/H9swIHT9bRixijfzUqyEIWm1WtiAuR1LJ+rJH6zpBm8kgQA==}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-x64-gnu@4.64.5':
+    resolution: {integrity: sha512-dR9nd6OKnvSS60Ifz/L7Mj5zzYyoqyRn2NwTuaOONKaa3xsVGXyp8YusMbvFyEOR94DxnwgcbgsFqkHd29ZSzQ==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-x64-musl@4.64.5':
+    resolution: {integrity: sha512-1tzsMjaqhsh3bAO6SJiJqh8hIr9sSPRd+i2vPPxJHod8/XYnf9TEnK0z/u3r1z1AkI347X0KbRSg9dWcxeGahw==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-openbsd-x64@4.64.5':
+    resolution: {integrity: sha512-01mWMQblKoXXsmk28KXtpbA96w7g/aOWUoV3AC16fdHdqkykGalqyyM+5u8M7uP5/MEMiiPv69Hv7iv/hEH/dA==}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@rollup/rollup-openharmony-arm64@4.64.5':
+    resolution: {integrity: sha512-trdnMPb/DNm4V/CgsaoGgr90HfQQ071wfK0KoIs4YpLvjBgVQGXhGabg2Z6nK4EcYNilrb9ZZPcsP6+zpJIdxQ==}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@rollup/rollup-win32-arm64-msvc@4.64.5':
+    resolution: {integrity: sha512-x2LxZlfdfsw99T6/qb9EqE/Qi84JWzibjyOJyhJsgFJy6CafaTiqIXCCnslCGrV5XWNh7fwrS3FbRENcuKnooA==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@rollup/rollup-win32-ia32-msvc@4.64.5':
+    resolution: {integrity: sha512-/Qd/9aDQIo0+jmItgBmPIs8195YVbDxRRApn47GyufgbutCDOh7eP5vSKKlI4QNFeaI+wKQAkSMsPnF3EuMpaA==}
+    cpu: [ia32]
+    os: [win32]
+
+  '@rollup/rollup-win32-x64-gnu@4.64.5':
+    resolution: {integrity: sha512-ngUJ/XvOWrqbd2IMsfXfh2xXFLTP3sY7sCKvxbGvYdBZ1KmXFd3ewDZ9n3/GNzAUgzRuhLT/UvJRivbNoAQRBw==}
+    cpu: [x64]
+    os: [win32]
+
+  '@rollup/rollup-win32-x64-msvc@4.64.5':
+    resolution: {integrity: sha512-IhV6ew/DuzUWwHaYmlh7MrPCV3lKFUq/amTEwysi4r/mwNPAEfAMh5dYWeTSPTeMy2pFHGMEWYtPkHzfX3tG5A==}
+    cpu: [x64]
+    os: [win32]
+
+  '@types/estree@1.0.9':
+    resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
+
+  '@vitejs/plugin-vue@5.2.4':
+    resolution: {integrity: sha512-7Yx/SXSOcQq5HiiV3orevHUFn+pmMB4cgbEkDYgnkUWb0WfeQ/wa2yFv6D5ICiCQOVpjA7vYDXrC7AGO8yjDHA==}
+    engines: {node: ^18.0.0 || >=20.0.0}
+    peerDependencies:
+      vite: ^5.0.0 || ^6.0.0
+      vue: ^3.2.25
+
+  '@vue/compiler-core@3.5.43':
+    resolution: {integrity: sha512-zdiLhnbe1QQqgDT8xZMpNmyqZ3qlI+/Q/FHQco57Kwl/b05HhCzN6eVGN9QU9rbga4CrS0H5SYY8VGHZCt/1Hg==}
+
+  '@vue/compiler-dom@3.5.43':
+    resolution: {integrity: sha512-PEZoAk3NQmsn/ejMzSOCyTYqwGqczrWm70PuhBKjjv1+TCoQAaO/zOqNwjV+honlNstT5ILxtc+8r8UUfj+iEQ==}
+
+  '@vue/compiler-sfc@3.5.43':
+    resolution: {integrity: sha512-FCbrG3XNCRl+js3huuKx4IVHBLTvMkJhVepjbxSPu1gn4yWLaYtGNQdjJGZaMytXB6qb76qQDDmDSLy/vkmleQ==}
+
+  '@vue/compiler-ssr@3.5.43':
+    resolution: {integrity: sha512-GF62orf7KiJX9RqrHNGrYBudsQGD0OhJ5nDs90O8UiDuS40+YMYomiXu6w6EuvtXuRDc3MSNis3EaaSKAVSWpg==}
+
+  '@vue/reactivity@3.5.43':
+    resolution: {integrity: sha512-G/c9GyOZNI2jVaaS6OX1EF1SSFSv7H0ERqNTl4+DTFMlZmB5eVAB53aLQNam/7NL2NPtaDD7RdVrzf8uJzMuOA==}
+
+  '@vue/runtime-core@3.5.43':
+    resolution: {integrity: sha512-hU6U6VnVhBGQDpvlnnDlIB8ZGJBiOcgk2lh/0InltHiz3D8oSkluvuvY+do1G2H3+udeKFsmaBlgVYP7gXQzEw==}
+
+  '@vue/runtime-dom@3.5.43':
+    resolution: {integrity: sha512-Bb2Jc0YjjJdMt1SJmb9b2L/IWd3I8lIT9x9eS/xvvP9CiVgna0ffua74xKRmt4/uSJ+0r4iN8ex1jrqkhQGWQw==}
+
+  '@vue/server-renderer@3.5.43':
+    resolution: {integrity: sha512-l2Ygjv9NehV94PSBxNWsAHC0j/eIIKbn92mBuWXAPGLnn6HfJ6MH5ubsd+Nk0YoZ5FRuxWI1P2VSoh+dbPQhCQ==}
+
+  '@vue/shared@3.5.43':
+    resolution: {integrity: sha512-uksS7YGMR5NZyr4JNq0Rp+QyLns0ueaz20KwzIPW9R0LH1Vnt4E+XUM29PNseEbf1www2gOuhuDi5AKOIXag9Q==}
+
+  '@xterm/addon-fit@0.10.0':
+    resolution: {integrity: sha512-UFYkDm4HUahf2lnEyHvio51TNGiLK66mqP2JoATy7hRZeXaGMRDr00JiSF7m63vR5WKATF605yEggJKsw0JpMQ==}
+    peerDependencies:
+      '@xterm/xterm': ^5.0.0
+
+  '@xterm/addon-web-links@0.11.0':
+    resolution: {integrity: sha512-nIHQ38pQI+a5kXnRaTgwqSHnX7KE6+4SVoceompgHL26unAxdfP6IPqUTSYPQgSwM56hsElfoNrrW5V7BUED/Q==}
+    peerDependencies:
+      '@xterm/xterm': ^5.0.0
+
+  '@xterm/addon-webgl@0.18.0':
+    resolution: {integrity: sha512-xCnfMBTI+/HKPdRnSOHaJDRqEpq2Ugy8LEj9GiY4J3zJObo3joylIFaMvzBwbYRg8zLtkO0KQaStCeSfoaI2/w==}
+    peerDependencies:
+      '@xterm/xterm': ^5.0.0
+
+  '@xterm/xterm@5.5.0':
+    resolution: {integrity: sha512-hqJHYaQb5OptNunnyAnkHyM8aCjZ1MEIDTQu1iIbbTD/xops91NB5yq1ZK/dC2JDbVWtF23zUtl9JE2NqwT87A==}
+
+  any-promise@1.3.0:
+    resolution: {integrity: sha512-7UvmKalWRt1wgjL1RrGxoSJW/0QZFIegpeGvZG9kjp8vrRu55XTHbwnqq2GpXm9uLbcuhxm3IqX9OB4MZR1b2A==}
+
+  anymatch@3.1.3:
+    resolution: {integrity: sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==}
+    engines: {node: '>= 8'}
+
+  arg@5.0.2:
+    resolution: {integrity: sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg==}
+
+  autoprefixer@10.6.1:
+    resolution: {integrity: sha512-cL1Qz6ADZhcEbny/8HPfe99J6HhNoYtpX2LFLIbhgGE7Q1hlQVkYFdetDN7Id3KiQxhDrHwzlHr/YQCnZ8+xSA==}
+    engines: {node: ^10 || ^12 || >=14}
+    hasBin: true
+    peerDependencies:
+      postcss: ^8.1.0
+
+  baseline-browser-mapping@2.11.28:
+    resolution: {integrity: sha512-br0LOmjJqr6Rt4AEkadbcNf67Zpo7EPwKsWbjnRrJIa1QYFHQBqM4C7F2WTbV8ahTEcg1Eo+Y0aWjjORInYFyA==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  binary-extensions@2.3.0:
+    resolution: {integrity: sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==}
+    engines: {node: '>=8'}
+
+  braces@3.0.3:
+    resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
+    engines: {node: '>=8'}
+
+  browserslist@4.29.3:
+    resolution: {integrity: sha512-1R4kiYKXGViqEN0CnoDrXc1StD9niAwu+j2dukWzrD4bJgsD4lDmEp0CRbc6E/vYJIfTHwPmwyaKtVSudICdPA==}
+    engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
+    hasBin: true
+
+  camelcase-css@2.0.1:
+    resolution: {integrity: sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==}
+    engines: {node: '>= 6'}
+
+  caniuse-lite@1.0.30001815:
+    resolution: {integrity: sha512-uDybUEyfgbyJJ93J1vikTylBX31AkdVYeVPeffMQpf8XN7hSfr0oZOn4VFOIMNvtU5+rHvC5Udg2TgtJKHm23Q==}
+
+  chokidar@3.6.0:
+    resolution: {integrity: sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==}
+    engines: {node: '>= 8.10.0'}
+
+  commander@4.1.1:
+    resolution: {integrity: sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==}
+    engines: {node: '>= 6'}
+
+  cssesc@3.0.0:
+    resolution: {integrity: sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==}
+    engines: {node: '>=4'}
+    hasBin: true
+
+  csstype@3.2.3:
+    resolution: {integrity: sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==}
+
+  didyoumean@1.2.2:
+    resolution: {integrity: sha512-gxtyfqMg7GKyhQmb056K7M3xszy/myH8w+B4RT+QXBQsvAOdc3XymqDDPHx1BgPgsdAA5SIifona89YtRATDzw==}
+
+  dlv@1.1.3:
+    resolution: {integrity: sha512-+HlytyjlPKnIG8XuRG8WvmBP8xs8P71y+SKKS6ZXWoEgLuePxtDoUEiH7WkdePWrQ5JBpE6aoVqfZfJUQkjXwA==}
+
+  electron-to-chromium@1.5.452:
+    resolution: {integrity: sha512-cVvk1YBSj6571VmV6hdJTqj94Y79xSu8cj6Y9t6ae4Y4431z8/7EJFvu3rVp90xhfuv9BpPKUmaLfTo4+FOGBg==}
+
+  entities@7.0.1:
+    resolution: {integrity: sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA==}
+    engines: {node: '>=0.12'}
+
+  es-errors@1.3.0:
+    resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
+    engines: {node: '>= 0.4'}
+
+  esbuild@0.25.12:
+    resolution: {integrity: sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  escalade@3.2.0:
+    resolution: {integrity: sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==}
+    engines: {node: '>=6'}
+
+  estree-walker@2.0.2:
+    resolution: {integrity: sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==}
+
+  fast-glob@3.3.3:
+    resolution: {integrity: sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==}
+    engines: {node: '>=8.6.0'}
+
+  fastq@1.20.3:
+    resolution: {integrity: sha512-XKv5nnLs6nLF71NgiKJLIZFLkPyIEuOselLG7ujZnGrRfQK8HpvY+WqKhAJUAdLomwVHErVS4LfxFlPq0/FTAw==}
+
+  fdir@6.5.0:
+    resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      picomatch: ^3 || ^4
+    peerDependenciesMeta:
+      picomatch:
+        optional: true
+
+  fill-range@7.1.1:
+    resolution: {integrity: sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==}
+    engines: {node: '>=8'}
+
+  fraction.js@5.3.4:
+    resolution: {integrity: sha512-1X1NTtiJphryn/uLQz3whtY6jK3fTqoE3ohKs0tT+Ujr1W59oopxmoEh7Lu5p6vBaPbgoM0bzveAW4Qi5RyWDQ==}
+
+  fsevents@2.3.3:
+    resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
+    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+    os: [darwin]
+
+  function-bind@1.1.2:
+    resolution: {integrity: sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
+
+  glob-parent@5.1.2:
+    resolution: {integrity: sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
+    engines: {node: '>= 6'}
+
+  glob-parent@6.0.2:
+    resolution: {integrity: sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==}
+    engines: {node: '>=10.13.0'}
+
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
+    engines: {node: '>= 0.4'}
+
+  is-binary-path@2.1.0:
+    resolution: {integrity: sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==}
+    engines: {node: '>=8'}
+
+  is-core-module@2.17.0:
+    resolution: {integrity: sha512-J/vG0zBCbIKOQFfufSwyXdMrsohyJIUNkrnmo6WZGzoM7tr/lsbfW5b2BvisL6zsyMzK9UxV9L6c7AoFbyXHOA==}
+    engines: {node: '>= 0.4'}
+
+  is-extglob@2.1.1:
+    resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
+    engines: {node: '>=0.10.0'}
+
+  is-glob@4.0.3:
+    resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
+    engines: {node: '>=0.10.0'}
+
+  is-number@7.0.0:
+    resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
+    engines: {node: '>=0.12.0'}
+
+  jiti@1.21.7:
+    resolution: {integrity: sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==}
+    hasBin: true
+
+  lilconfig@3.1.3:
+    resolution: {integrity: sha512-/vlFKAoH5Cgt3Ie+JLhRbwOsCQePABiU3tJ1egGvyQ+33R/vcwM2Zl2QR/LzjsBeItPt3oSVXapn+m4nQDvpzw==}
+    engines: {node: '>=14'}
+
+  lines-and-columns@1.2.4:
+    resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==}
+
+  magic-string@0.30.21:
+    resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
+
+  merge2@1.4.1:
+    resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
+    engines: {node: '>= 8'}
+
+  micromatch@4.0.8:
+    resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
+    engines: {node: '>=8.6'}
+
+  mz@2.7.0:
+    resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
+
+  nanoid@3.3.20:
+    resolution: {integrity: sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ==}
+    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
+    hasBin: true
+
+  node-releases@2.0.58:
+    resolution: {integrity: sha512-BdiKAgbfRlvfMq/XzO/AF9NPmaA8a+YpLAyAFTVFBj3gARrAIfWvNq7Q7NE4se3KgFu0KkrvQMxTS0XVnsGzHg==}
+    engines: {node: '>=18'}
+
+  normalize-path@3.0.0:
+    resolution: {integrity: sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==}
+    engines: {node: '>=0.10.0'}
+
+  object-assign@4.1.1:
+    resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
+    engines: {node: '>=0.10.0'}
+
+  object-hash@3.0.0:
+    resolution: {integrity: sha512-RSn9F68PjH9HqtltsSnqYC1XXoWe9Bju5+213R98cNGttag9q9yAOTzdbsqvIa7aNm5WffBZFpWYr2aWrklWAw==}
+    engines: {node: '>= 6'}
+
+  path-parse@1.0.7:
+    resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==}
+
+  picocolors@1.1.1:
+    resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
+
+  picomatch@2.3.2:
+    resolution: {integrity: sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==}
+    engines: {node: '>=8.6'}
+
+  picomatch@4.0.7:
+    resolution: {integrity: sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==}
+    engines: {node: '>=12'}
+
+  pirates@4.0.7:
+    resolution: {integrity: sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==}
+    engines: {node: '>= 6'}
+
+  postcss-import@15.1.0:
+    resolution: {integrity: sha512-hpr+J05B2FVYUAXHeK1YyI267J/dDDhMU6B6civm8hSY1jYJnBXxzKDKDswzJmtLHryrjhnDjqqp/49t8FALew==}
+    engines: {node: '>=14.0.0'}
+    peerDependencies:
+      postcss: ^8.0.0
+
+  postcss-js@4.1.0:
+    resolution: {integrity: sha512-oIAOTqgIo7q2EOwbhb8UalYePMvYoIeRY2YKntdpFQXNosSu3vLrniGgmH9OKs/qAkfoj5oB3le/7mINW1LCfw==}
+    engines: {node: ^12 || ^14 || >= 16}
+    peerDependencies:
+      postcss: ^8.4.21
+
+  postcss-load-config@6.0.1:
+    resolution: {integrity: sha512-oPtTM4oerL+UXmx+93ytZVN82RrlY/wPUV8IeDxFrzIjXOLF1pN+EmKPLbubvKHT2HC20xXsCAH2Z+CKV6Oz/g==}
+    engines: {node: '>= 18'}
+    peerDependencies:
+      jiti: '>=1.21.0'
+      postcss: '>=8.0.9'
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      jiti:
+        optional: true
+      postcss:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
+  postcss-nested@6.2.0:
+    resolution: {integrity: sha512-HQbt28KulC5AJzG+cZtj9kvKB93CFCdLvog1WFLf1D+xmMvPGlBstkpTEZfK5+AN9hfJocyBFCNiqyS48bpgzQ==}
+    engines: {node: '>=12.0'}
+    peerDependencies:
+      postcss: ^8.2.14
+
+  postcss-selector-parser@6.1.4:
+    resolution: {integrity: sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==}
+    engines: {node: '>=4'}
+
+  postcss-value-parser@4.2.0:
+    resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==}
+
+  postcss@8.5.29:
+    resolution: {integrity: sha512-49cGhUbXj8Qenv0iTMxA1cFBzxXoctpC9Ujd77t1WcbJIr6nF/eI7g/8MgxrYldFRuAXvja7xQRwavoW7kgrxQ==}
+    engines: {node: ^10 || ^12 || >=14}
+
+  queue-microtask@1.2.3:
+    resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
+
+  read-cache@1.0.2:
+    resolution: {integrity: sha512-/peqiBB/n07gQGLsWaHho3WfvUyRscw0gYTsEFMhrIe/nWLkYaf5SbKYjGYqtRV3aPwykJgF2VEMo1ac4bnsGA==}
+
+  readdirp@3.6.0:
+    resolution: {integrity: sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==}
+    engines: {node: '>=8.10.0'}
+
+  resolve@1.22.13:
+    resolution: {integrity: sha512-Dj/cW9zBV2aRj6XzCxuGIs3ESZKv02jixne3q6jFZYZ3/Tg09gHHviSMDL4kObh9pqSahdRHEnDoaP2gn8YLhA==}
+    engines: {node: '>= 0.4'}
+    hasBin: true
+
+  reusify@1.1.0:
+    resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
+    engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
+
+  rollup@4.64.5:
+    resolution: {integrity: sha512-EAP5ZHcz2ijbgCWwPkpI7zh6bfsri2Ez5FtCy2dCp1k62duXzfG7DLGGh7RU2QQXWwavT+u4qpvDF/TWOiiGTw==}
+    engines: {node: '>=18.0.0', npm: '>=8.0.0'}
+    hasBin: true
+
+  run-parallel@1.2.0:
+    resolution: {integrity: sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==}
+
+  source-map-js@1.2.2:
+    resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==}
+    engines: {node: '>=0.10.0'}
+
+  sucrase@3.35.1:
+    resolution: {integrity: sha512-DhuTmvZWux4H1UOnWMB3sk0sbaCVOoQZjv8u1rDoTV0HTdGem9hkAZtl4JZy8P2z4Bg0nT+YMeOFyVr4zcG5Tw==}
+    engines: {node: '>=16 || 14 >=14.17'}
+    hasBin: true
+
+  supports-preserve-symlinks-flag@1.0.0:
+    resolution: {integrity: sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==}
+    engines: {node: '>= 0.4'}
+
+  tailwindcss@3.4.19:
+    resolution: {integrity: sha512-3ofp+LL8E+pK/JuPLPggVAIaEuhvIz4qNcf3nA1Xn2o/7fb7s/TYpHhwGDv1ZU3PkBluUVaF8PyCHcm48cKLWQ==}
+    engines: {node: '>=14.0.0'}
+    hasBin: true
+
+  thenify-all@1.6.0:
+    resolution: {integrity: sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==}
+    engines: {node: '>=0.8'}
+
+  thenify@3.3.1:
+    resolution: {integrity: sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw==}
+
+  tinyglobby@0.2.17:
+    resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
+    engines: {node: '>=12.0.0'}
+
+  to-regex-range@5.0.1:
+    resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
+    engines: {node: '>=8.0'}
+
+  ts-interface-checker@0.1.13:
+    resolution: {integrity: sha512-Y/arvbn+rrz3JCKl9C4kVNfTfSm2/mEp5FSz5EsZSANGPSlQrpRI5M4PKF+mJnE52jOO90PnPSc3Ur3bTQw0gA==}
+
+  typescript@5.6.3:
+    resolution: {integrity: sha512-hjcS1mhfuyi4WW8IWtjP7brDrG2cuDZukyrYrSauoXGNgx0S7zceP07adYkJycEr56BOUTNPzbInooiN3fn1qw==}
+    engines: {node: '>=14.17'}
+    hasBin: true
+
+  update-browserslist-db@1.3.4:
+    resolution: {integrity: sha512-t8wonIOdQyOjtPd2VktlBu6QjTVTks6v8bSi7kd0r2Vll8TK1JYDZtRRdbmCHOAMphkZgrzK+L+vXK4pyZ8t4A==}
+    hasBin: true
+    peerDependencies:
+      browserslist: '>= 4.21.0'
+
+  util-deprecate@1.0.2:
+    resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
+
+  vite@6.4.4:
+    resolution: {integrity: sha512-xGjU/SyjeNyb0E4KxXBvYz/1C+3JXuujvf2hXNOtnlcE+58o5ajd9N2/n2VhkiJvpCP2qQasnUpx5PXNeI+p1Q==}
+    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
+    hasBin: true
+    peerDependencies:
+      '@types/node': ^18.0.0 || ^20.0.0 || >=22.0.0
+      jiti: '>=1.21.0'
+      less: '*'
+      lightningcss: ^1.21.0
+      sass: '*'
+      sass-embedded: '*'
+      stylus: '*'
+      sugarss: '*'
+      terser: ^5.16.0
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+      jiti:
+        optional: true
+      less:
+        optional: true
+      lightningcss:
+        optional: true
+      sass:
+        optional: true
+      sass-embedded:
+        optional: true
+      stylus:
+        optional: true
+      sugarss:
+        optional: true
+      terser:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
+  vue@3.5.43:
+    resolution: {integrity: sha512-o5qZoksdnjIKvW1srZ3ab7pcDNYAerBjRe54D0LBLfRdCYFrSgBHVXokMas35czQc0//lmx4/tuY4ZNQ+Rf2Ng==}
+    peerDependencies:
+      typescript: '*'
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
+snapshots:
+
+  '@alloc/quick-lru@5.3.0': {}
+
+  '@babel/helper-string-parser@7.29.7': {}
+
+  '@babel/helper-validator-identifier@7.29.7': {}
+
+  '@babel/parser@7.29.9':
+    dependencies:
+      '@babel/types': 7.29.8
+
+  '@babel/types@7.29.8':
+    dependencies:
+      '@babel/helper-string-parser': 7.29.7
+      '@babel/helper-validator-identifier': 7.29.7
+
+  '@esbuild/aix-ppc64@0.25.12':
+    optional: true
+
+  '@esbuild/android-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/android-arm@0.25.12':
+    optional: true
+
+  '@esbuild/android-x64@0.25.12':
+    optional: true
+
+  '@esbuild/darwin-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/darwin-x64@0.25.12':
+    optional: true
+
+  '@esbuild/freebsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/freebsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-arm@0.25.12':
+    optional: true
+
+  '@esbuild/linux-ia32@0.25.12':
+    optional: true
+
+  '@esbuild/linux-loong64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-mips64el@0.25.12':
+    optional: true
+
+  '@esbuild/linux-ppc64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-riscv64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-s390x@0.25.12':
+    optional: true
+
+  '@esbuild/linux-x64@0.25.12':
+    optional: true
+
+  '@esbuild/netbsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/netbsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/openbsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/openbsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/openharmony-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/sunos-x64@0.25.12':
+    optional: true
+
+  '@esbuild/win32-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/win32-ia32@0.25.12':
+    optional: true
+
+  '@esbuild/win32-x64@0.25.12':
+    optional: true
+
+  '@jridgewell/gen-mapping@0.3.13':
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.6.0
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/resolve-uri@3.1.2': {}
+
+  '@jridgewell/sourcemap-codec@1.6.0': {}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    dependencies:
+      '@jridgewell/resolve-uri': 3.1.2
+      '@jridgewell/sourcemap-codec': 1.6.0
+
+  '@napi-rs/lzma-linux-x64-gnu@1.5.1':
+    optional: true
+
+  '@nodelib/fs.scandir@2.1.5':
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      run-parallel: 1.2.0
+
+  '@nodelib/fs.stat@2.0.5': {}
+
+  '@nodelib/fs.walk@1.2.8':
+    dependencies:
+      '@nodelib/fs.scandir': 2.1.5
+      fastq: 1.20.3
+
+  '@rollup/rollup-android-arm-eabi@4.64.5':
+    optional: true
+
+  '@rollup/rollup-android-arm64@4.64.5':
+    optional: true
+
+  '@rollup/rollup-darwin-arm64@4.64.5':
+    optional: true
+
+  '@rollup/rollup-darwin-x64@4.64.5':
+    optional: true
+
+  '@rollup/rollup-freebsd-arm64@4.64.5':
+    optional: true
+
+  '@rollup/rollup-freebsd-x64@4.64.5':
+    optional: true
+
+  '@rollup/rollup-linux-arm-gnueabihf@4.64.5':
+    optional: true
+
+  '@rollup/rollup-linux-arm-musleabihf@4.64.5':
+    optional: true
+
+  '@rollup/rollup-linux-arm64-gnu@4.64.5':
+    optional: true
+
+  '@rollup/rollup-linux-arm64-musl@4.64.5':
+    optional: true
+
+  '@rollup/rollup-linux-loong64-gnu@4.64.5':
+    optional: true
+
+  '@rollup/rollup-linux-loong64-musl@4.64.5':
+    optional: true
+
+  '@rollup/rollup-linux-ppc64-gnu@4.64.5':
+    optional: true
+
+  '@rollup/rollup-linux-ppc64-musl@4.64.5':
+    optional: true
+
+  '@rollup/rollup-linux-riscv64-gnu@4.64.5':
+    optional: true
+
+  '@rollup/rollup-linux-riscv64-musl@4.64.5':
+    optional: true
+
+  '@rollup/rollup-linux-s390x-gnu@4.64.5':
+    optional: true
+
+  '@rollup/rollup-linux-x64-gnu@4.64.5':
+    optional: true
+
+  '@rollup/rollup-linux-x64-musl@4.64.5':
+    optional: true
+
+  '@rollup/rollup-openbsd-x64@4.64.5':
+    optional: true
+
+  '@rollup/rollup-openharmony-arm64@4.64.5':
+    optional: true
+
+  '@rollup/rollup-win32-arm64-msvc@4.64.5':
+    optional: true
+
+  '@rollup/rollup-win32-ia32-msvc@4.64.5':
+    optional: true
+
+  '@rollup/rollup-win32-x64-gnu@4.64.5':
+    optional: true
+
+  '@rollup/rollup-win32-x64-msvc@4.64.5':
+    optional: true
+
+  '@types/estree@1.0.9': {}
+
+  '@vitejs/plugin-vue@5.2.4(vite@6.4.4(jiti@1.21.7))(vue@3.5.43(typescript@5.6.3))':
+    dependencies:
+      vite: 6.4.4(jiti@1.21.7)
+      vue: 3.5.43(typescript@5.6.3)
+
+  '@vue/compiler-core@3.5.43':
+    dependencies:
+      '@babel/parser': 7.29.9
+      '@vue/shared': 3.5.43
+      entities: 7.0.1
+      estree-walker: 2.0.2
+      source-map-js: 1.2.2
+
+  '@vue/compiler-dom@3.5.43':
+    dependencies:
+      '@vue/compiler-core': 3.5.43
+      '@vue/shared': 3.5.43
+
+  '@vue/compiler-sfc@3.5.43':
+    dependencies:
+      '@babel/parser': 7.29.9
+      '@vue/compiler-core': 3.5.43
+      '@vue/compiler-dom': 3.5.43
+      '@vue/compiler-ssr': 3.5.43
+      '@vue/shared': 3.5.43
+      estree-walker: 2.0.2
+      magic-string: 0.30.21
+      postcss: 8.5.29
+      source-map-js: 1.2.2
+
+  '@vue/compiler-ssr@3.5.43':
+    dependencies:
+      '@vue/compiler-dom': 3.5.43
+      '@vue/shared': 3.5.43
+
+  '@vue/reactivity@3.5.43':
+    dependencies:
+      '@vue/shared': 3.5.43
+
+  '@vue/runtime-core@3.5.43':
+    dependencies:
+      '@vue/reactivity': 3.5.43
+      '@vue/shared': 3.5.43
+
+  '@vue/runtime-dom@3.5.43':
+    dependencies:
+      '@vue/reactivity': 3.5.43
+      '@vue/runtime-core': 3.5.43
+      '@vue/shared': 3.5.43
+      csstype: 3.2.3
+
+  '@vue/server-renderer@3.5.43':
+    dependencies:
+      '@vue/compiler-ssr': 3.5.43
+      '@vue/runtime-dom': 3.5.43
+      '@vue/shared': 3.5.43
+
+  '@vue/shared@3.5.43': {}
+
+  '@xterm/addon-fit@0.10.0(@xterm/xterm@5.5.0)':
+    dependencies:
+      '@xterm/xterm': 5.5.0
+
+  '@xterm/addon-web-links@0.11.0(@xterm/xterm@5.5.0)':
+    dependencies:
+      '@xterm/xterm': 5.5.0
+
+  '@xterm/addon-webgl@0.18.0(@xterm/xterm@5.5.0)':
+    dependencies:
+      '@xterm/xterm': 5.5.0
+
+  '@xterm/xterm@5.5.0': {}
+
+  any-promise@1.3.0: {}
+
+  anymatch@3.1.3:
+    dependencies:
+      normalize-path: 3.0.0
+      picomatch: 2.3.2
+
+  arg@5.0.2: {}
+
+  autoprefixer@10.6.1(postcss@8.5.29):
+    dependencies:
+      browserslist: 4.29.3
+      caniuse-lite: 1.0.30001815
+      fraction.js: 5.3.4
+      picocolors: 1.1.1
+      postcss: 8.5.29
+      postcss-value-parser: 4.2.0
+
+  baseline-browser-mapping@2.11.28: {}
+
+  binary-extensions@2.3.0: {}
+
+  braces@3.0.3:
+    dependencies:
+      fill-range: 7.1.1
+
+  browserslist@4.29.3:
+    dependencies:
+      baseline-browser-mapping: 2.11.28
+      caniuse-lite: 1.0.30001815
+      electron-to-chromium: 1.5.452
+      node-releases: 2.0.58
+      update-browserslist-db: 1.3.4(browserslist@4.29.3)
+
+  camelcase-css@2.0.1: {}
+
+  caniuse-lite@1.0.30001815: {}
+
+  chokidar@3.6.0:
+    dependencies:
+      anymatch: 3.1.3
+      braces: 3.0.3
+      glob-parent: 5.1.2
+      is-binary-path: 2.1.0
+      is-glob: 4.0.3
+      normalize-path: 3.0.0
+      readdirp: 3.6.0
+    optionalDependencies:
+      fsevents: 2.3.3
+
+  commander@4.1.1: {}
+
+  cssesc@3.0.0: {}
+
+  csstype@3.2.3: {}
+
+  didyoumean@1.2.2: {}
+
+  dlv@1.1.3: {}
+
+  electron-to-chromium@1.5.452: {}
+
+  entities@7.0.1: {}
+
+  es-errors@1.3.0: {}
+
+  esbuild@0.25.12:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.25.12
+      '@esbuild/android-arm': 0.25.12
+      '@esbuild/android-arm64': 0.25.12
+      '@esbuild/android-x64': 0.25.12
+      '@esbuild/darwin-arm64': 0.25.12
+      '@esbuild/darwin-x64': 0.25.12
+      '@esbuild/freebsd-arm64': 0.25.12
+      '@esbuild/freebsd-x64': 0.25.12
+      '@esbuild/linux-arm': 0.25.12
+      '@esbuild/linux-arm64': 0.25.12
+      '@esbuild/linux-ia32': 0.25.12
+      '@esbuild/linux-loong64': 0.25.12
+      '@esbuild/linux-mips64el': 0.25.12
+      '@esbuild/linux-ppc64': 0.25.12
+      '@esbuild/linux-riscv64': 0.25.12
+      '@esbuild/linux-s390x': 0.25.12
+      '@esbuild/linux-x64': 0.25.12
+      '@esbuild/netbsd-arm64': 0.25.12
+      '@esbuild/netbsd-x64': 0.25.12
+      '@esbuild/openbsd-arm64': 0.25.12
+      '@esbuild/openbsd-x64': 0.25.12
+      '@esbuild/openharmony-arm64': 0.25.12
+      '@esbuild/sunos-x64': 0.25.12
+      '@esbuild/win32-arm64': 0.25.12
+      '@esbuild/win32-ia32': 0.25.12
+      '@esbuild/win32-x64': 0.25.12
+
+  escalade@3.2.0: {}
+
+  estree-walker@2.0.2: {}
+
+  fast-glob@3.3.3:
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      '@nodelib/fs.walk': 1.2.8
+      glob-parent: 5.1.2
+      merge2: 1.4.1
+      micromatch: 4.0.8
+
+  fastq@1.20.3:
+    dependencies:
+      reusify: 1.1.0
+
+  fdir@6.5.0(picomatch@4.0.7):
+    optionalDependencies:
+      picomatch: 4.0.7
+
+  fill-range@7.1.1:
+    dependencies:
+      to-regex-range: 5.0.1
+
+  fraction.js@5.3.4: {}
+
+  fsevents@2.3.3:
+    optional: true
+
+  function-bind@1.1.2: {}
+
+  glob-parent@5.1.2:
+    dependencies:
+      is-glob: 4.0.3
+
+  glob-parent@6.0.2:
+    dependencies:
+      is-glob: 4.0.3
+
+  hasown@2.0.4:
+    dependencies:
+      function-bind: 1.1.2
+
+  is-binary-path@2.1.0:
+    dependencies:
+      binary-extensions: 2.3.0
+
+  is-core-module@2.17.0:
+    dependencies:
+      hasown: 2.0.4
+
+  is-extglob@2.1.1: {}
+
+  is-glob@4.0.3:
+    dependencies:
+      is-extglob: 2.1.1
+
+  is-number@7.0.0: {}
+
+  jiti@1.21.7: {}
+
+  lilconfig@3.1.3: {}
+
+  lines-and-columns@1.2.4: {}
+
+  magic-string@0.30.21:
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.6.0
+
+  merge2@1.4.1: {}
+
+  micromatch@4.0.8:
+    dependencies:
+      braces: 3.0.3
+      picomatch: 2.3.2
+
+  mz@2.7.0:
+    dependencies:
+      any-promise: 1.3.0
+      object-assign: 4.1.1
+      thenify-all: 1.6.0
+
+  nanoid@3.3.20: {}
+
+  node-releases@2.0.58: {}
+
+  normalize-path@3.0.0: {}
+
+  object-assign@4.1.1: {}
+
+  object-hash@3.0.0: {}
+
+  path-parse@1.0.7: {}
+
+  picocolors@1.1.1: {}
+
+  picomatch@2.3.2: {}
+
+  picomatch@4.0.7: {}
+
+  pirates@4.0.7: {}
+
+  postcss-import@15.1.0(postcss@8.5.29):
+    dependencies:
+      postcss: 8.5.29
+      postcss-value-parser: 4.2.0
+      read-cache: 1.0.2
+      resolve: 1.22.13
+
+  postcss-js@4.1.0(postcss@8.5.29):
+    dependencies:
+      camelcase-css: 2.0.1
+      postcss: 8.5.29
+
+  postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.29):
+    dependencies:
+      lilconfig: 3.1.3
+    optionalDependencies:
+      jiti: 1.21.7
+      postcss: 8.5.29
+
+  postcss-nested@6.2.0(postcss@8.5.29):
+    dependencies:
+      postcss: 8.5.29
+      postcss-selector-parser: 6.1.4
+
+  postcss-selector-parser@6.1.4:
+    dependencies:
+      cssesc: 3.0.0
+      util-deprecate: 1.0.2
+
+  postcss-value-parser@4.2.0: {}
+
+  postcss@8.5.29:
+    dependencies:
+      nanoid: 3.3.20
+      picocolors: 1.1.1
+      source-map-js: 1.2.2
+
+  queue-microtask@1.2.3: {}
+
+  read-cache@1.0.2: {}
+
+  readdirp@3.6.0:
+    dependencies:
+      picomatch: 2.3.2
+
+  resolve@1.22.13:
+    dependencies:
+      es-errors: 1.3.0
+      is-core-module: 2.17.0
+      path-parse: 1.0.7
+      supports-preserve-symlinks-flag: 1.0.0
+
+  reusify@1.1.0: {}
+
+  rollup@4.64.5:
+    dependencies:
+      '@types/estree': 1.0.9
+    optionalDependencies:
+      '@napi-rs/lzma-linux-x64-gnu': 1.5.1
+      '@rollup/rollup-android-arm-eabi': 4.64.5
+      '@rollup/rollup-android-arm64': 4.64.5
+      '@rollup/rollup-darwin-arm64': 4.64.5
+      '@rollup/rollup-darwin-x64': 4.64.5
+      '@rollup/rollup-freebsd-arm64': 4.64.5
+      '@rollup/rollup-freebsd-x64': 4.64.5
+      '@rollup/rollup-linux-arm-gnueabihf': 4.64.5
+      '@rollup/rollup-linux-arm-musleabihf': 4.64.5
+      '@rollup/rollup-linux-arm64-gnu': 4.64.5
+      '@rollup/rollup-linux-arm64-musl': 4.64.5
+      '@rollup/rollup-linux-loong64-gnu': 4.64.5
+      '@rollup/rollup-linux-loong64-musl': 4.64.5
+      '@rollup/rollup-linux-ppc64-gnu': 4.64.5
+      '@rollup/rollup-linux-ppc64-musl': 4.64.5
+      '@rollup/rollup-linux-riscv64-gnu': 4.64.5
+      '@rollup/rollup-linux-riscv64-musl': 4.64.5
+      '@rollup/rollup-linux-s390x-gnu': 4.64.5
+      '@rollup/rollup-linux-x64-gnu': 4.64.5
+      '@rollup/rollup-linux-x64-musl': 4.64.5
+      '@rollup/rollup-openbsd-x64': 4.64.5
+      '@rollup/rollup-openharmony-arm64': 4.64.5
+      '@rollup/rollup-win32-arm64-msvc': 4.64.5
+      '@rollup/rollup-win32-ia32-msvc': 4.64.5
+      '@rollup/rollup-win32-x64-gnu': 4.64.5
+      '@rollup/rollup-win32-x64-msvc': 4.64.5
+      fsevents: 2.3.3
+
+  run-parallel@1.2.0:
+    dependencies:
+      queue-microtask: 1.2.3
+
+  source-map-js@1.2.2: {}
+
+  sucrase@3.35.1:
+    dependencies:
+      '@jridgewell/gen-mapping': 0.3.13
+      commander: 4.1.1
+      lines-and-columns: 1.2.4
+      mz: 2.7.0
+      pirates: 4.0.7
+      tinyglobby: 0.2.17
+      ts-interface-checker: 0.1.13
+
+  supports-preserve-symlinks-flag@1.0.0: {}
+
+  tailwindcss@3.4.19:
+    dependencies:
+      '@alloc/quick-lru': 5.3.0
+      arg: 5.0.2
+      chokidar: 3.6.0
+      didyoumean: 1.2.2
+      dlv: 1.1.3
+      fast-glob: 3.3.3
+      glob-parent: 6.0.2
+      is-glob: 4.0.3
+      jiti: 1.21.7
+      lilconfig: 3.1.3
+      micromatch: 4.0.8
+      normalize-path: 3.0.0
+      object-hash: 3.0.0
+      picocolors: 1.1.1
+      postcss: 8.5.29
+      postcss-import: 15.1.0(postcss@8.5.29)
+      postcss-js: 4.1.0(postcss@8.5.29)
+      postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.29)
+      postcss-nested: 6.2.0(postcss@8.5.29)
+      postcss-selector-parser: 6.1.4
+      resolve: 1.22.13
+      sucrase: 3.35.1
+    transitivePeerDependencies:
+      - tsx
+      - yaml
+
+  thenify-all@1.6.0:
+    dependencies:
+      thenify: 3.3.1
+
+  thenify@3.3.1:
+    dependencies:
+      any-promise: 1.3.0
+
+  tinyglobby@0.2.17:
+    dependencies:
+      fdir: 6.5.0(picomatch@4.0.7)
+      picomatch: 4.0.7
+
+  to-regex-range@5.0.1:
+    dependencies:
+      is-number: 7.0.0
+
+  ts-interface-checker@0.1.13: {}
+
+  typescript@5.6.3: {}
+
+  update-browserslist-db@1.3.4(browserslist@4.29.3):
+    dependencies:
+      browserslist: 4.29.3
+      escalade: 3.2.0
+      picocolors: 1.1.1
+
+  util-deprecate@1.0.2: {}
+
+  vite@6.4.4(jiti@1.21.7):
+    dependencies:
+      esbuild: 0.25.12
+      fdir: 6.5.0(picomatch@4.0.7)
+      picomatch: 4.0.7
+      postcss: 8.5.29
+      rollup: 4.64.5
+      tinyglobby: 0.2.17
+    optionalDependencies:
+      fsevents: 2.3.3
+      jiti: 1.21.7
+
+  vue@3.5.43(typescript@5.6.3):
+    dependencies:
+      '@vue/compiler-dom': 3.5.43
+      '@vue/compiler-sfc': 3.5.43
+      '@vue/runtime-dom': 3.5.43
+      '@vue/server-renderer': 3.5.43
+      '@vue/shared': 3.5.43
+    optionalDependencies:
+      typescript: 5.6.3
diff --git a/frontend/pnpm-workspace.yaml b/frontend/pnpm-workspace.yaml
new file mode 100644
index 0000000..5ed0b5a
--- /dev/null
+++ b/frontend/pnpm-workspace.yaml
@@ -0,0 +1,2 @@
+allowBuilds:
+  esbuild: true
diff --git a/frontend/postcss.config.js b/frontend/postcss.config.js
new file mode 100644
index 0000000..2aa7205
--- /dev/null
+++ b/frontend/postcss.config.js
@@ -0,0 +1,6 @@
+export default {
+  plugins: {
+    tailwindcss: {},
+    autoprefixer: {},
+  },
+};
diff --git a/frontend/public/favicon.svg b/frontend/public/favicon.svg
new file mode 100644
index 0000000..6c34525
--- /dev/null
+++ b/frontend/public/favicon.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" fill="none">
+  <rect width="64" height="64" rx="16" fill="#18181B"/>
+  <rect x="2" y="2" width="60" height="60" rx="14" stroke="white" stroke-opacity="0.1" stroke-width="2"/>
+  <!-- 终端折线 > -->
+  <path d="M17 21L28 32L17 43" stroke="white" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"/>
+  <!-- Switch 轨道与高光橙色节点 -->
+  <rect x="33" y="25" width="16" height="14" rx="7" fill="#27272A" stroke="#52525B" stroke-width="2"/>
+  <circle cx="42" cy="32" r="4.5" fill="#F97316"/>
+</svg>
diff --git a/frontend/src/App.vue b/frontend/src/App.vue
new file mode 100644
index 0000000..1e32786
--- /dev/null
+++ b/frontend/src/App.vue
@@ -0,0 +1,1987 @@
+<script setup lang="ts">
+import { computed, onBeforeUnmount, onMounted, ref } from 'vue';
+import BrandLogo from './components/BrandLogo.vue';
+import OsBadge from './components/OsBadge.vue';
+import HostDetailDrawer from './components/HostDetailDrawer.vue';
+import HostModal from './components/HostModal.vue';
+import TerminalStage from './components/TerminalStage.vue';
+import FileBrowserPanel from './components/FileBrowserPanel.vue';
+import {
+  globalInspectionCache,
+  ROLE_META,
+  seedInspectionMap,
+  type HostRole,
+  type HostUpsertPayload,
+  type PaneMeta,
+  type PublicHost,
+} from './types';
+
+type CenterStageMode = 'terminal' | 'files' | null;
+type RightWingMode = 'detail' | 'files' | null;
+
+interface OpenSessionTab {
+  hostId: string;
+  mode: 'terminal' | 'files';
+  rightWing: RightWingMode;
+  splitDirection: 'row' | 'col';
+  panes: PaneMeta[];
+}
+
+// 顶层页面状态：'workspace'（仓库+终端+文件主工作台） | 'settings'（独立设置页，不做弹窗）
+const activePage = ref<'workspace' | 'settings'>('workspace');
+
+// 登录鉴权状态
+const authChecked = ref(false);
+const authEnabled = ref(false);
+const authenticated = ref(true);
+const loginUsername = ref('admin');
+const loginPassword = ref('');
+const loginError = ref('');
+const loginSubmitting = ref(false);
+
+const hosts = ref<PublicHost[]>([]);
+const loading = ref(false);
+const checkingAll = ref(false);
+const checkingIds = ref<Set<string>>(new Set());
+const creatingPane = ref(false);
+
+// 全局昼夜主题
+const isDark = ref(false);
+const terminalDark = ref(false);
+const toast = ref<{ text: string; kind: 'ok' | 'err' } | null>(null);
+
+// 仓库统一筛选器
+const searchQuery = ref('');
+const filterMenuOpen = ref(false);
+const statusFilter = ref<'all' | 'online' | 'offline'>('all');
+const favoriteOnly = ref(false);
+const roleFilter = ref<'all' | HostRole | 'archived'>('all');
+const tagFilter = ref<string>('');
+
+// 左上角已打开的多终端/文件会话标签列表
+const openTabs = ref<OpenSessionTab[]>([]);
+
+// 主舞台与最右栏各自对应的主机与模式
+const stageHostId = ref<string | null>(null);
+const centerStage = ref<CenterStageMode>(null);
+
+const detailHostId = ref<string | null>(null);
+const rightWing = ref<RightWingMode>(null);
+
+// 新增/编辑主机弹窗 与 删除确认弹窗
+const modalOpen = ref(false);
+const editingHost = ref<PublicHost | null>(null);
+const deletingHost = ref<PublicHost | null>(null);
+const searchInputRef = ref<HTMLInputElement | null>(null);
+
+// 独立设置页状态（MCP 开关、API Key、Web 登录账号密码）
+const mcpEnabled = ref(true);
+const mcpRequireApiKey = ref(false);
+const mcpApiKey = ref('');
+const showApiKey = ref(false);
+const configModePreview = ref<'remote' | 'stdio'>('remote');
+
+const settingAuthEnabled = ref(false);
+const settingAdminUsername = ref('admin');
+const settingAdminPassword = ref('');
+const hasAdminPassword = ref(false);
+const savingAuth = ref(false);
+const savingMcp = ref(false);
+
+const mcpStatus = ref<{
+  exePath: string;
+  port: number;
+  claudeCodePath: string;
+  claudeCodeSynced: boolean;
+  codexPath: string;
+  codexSynced: boolean;
+} | null>(null);
+
+// 拖拽排序
+const draggingId = ref<string | null>(null);
+const dragOverId = ref<string | null>(null);
+
+let toastTimer: ReturnType<typeof setTimeout> | null = null;
+function showToast(text: string, kind: 'ok' | 'err' = 'ok') {
+  toast.value = { text, kind };
+  if (toastTimer) clearTimeout(toastTimer);
+  toastTimer = setTimeout(() => {
+    toast.value = null;
+  }, 2800);
+}
+
+function applyTheme(dark: boolean) {
+  isDark.value = dark;
+  terminalDark.value = dark;
+  document.documentElement.classList.toggle('dark', dark);
+  try {
+    localStorage.setItem('vps-switch-theme', dark ? 'dark' : 'light');
+  } catch {
+    // ignore
+  }
+}
+
+function toggleTheme() {
+  applyTheme(!isDark.value);
+}
+
+function hostById(id: string): PublicHost | undefined {
+  return hosts.value.find((h) => h.id === id);
+}
+
+const stageHost = computed(
+  () => hosts.value.find((h) => h.id === stageHostId.value) || null
+);
+
+const activeSessionTab = computed(
+  () => openTabs.value.find((t) => t.hostId === stageHostId.value) || null
+);
+
+const rightWingHost = computed(
+  () =>
+    hosts.value.find((h) => h.id === detailHostId.value) ||
+    stageHost.value ||
+    null
+);
+
+const hasCenterStage = computed(
+  () => Boolean(stageHost.value && centerStage.value)
+);
+
+const allTags = computed<string[]>(() => {
+  const set = new Set<string>();
+  for (const h of hosts.value) {
+    if (h.archived && roleFilter.value !== 'archived') continue;
+    for (const t of h.tags) {
+      if (t.trim()) set.add(t.trim());
+    }
+  }
+  return Array.from(set).sort();
+});
+
+const hasActiveFilter = computed(
+  () =>
+    statusFilter.value !== 'all' ||
+    favoriteOnly.value ||
+    roleFilter.value !== 'all' ||
+    Boolean(tagFilter.value)
+);
+
+const activeFilterSummary = computed(() => {
+  const parts: string[] = [];
+  if (favoriteOnly.value) parts.push('★ 收藏');
+  if (statusFilter.value === 'online') parts.push('在线');
+  else if (statusFilter.value === 'offline') parts.push('离线');
+
+  if (roleFilter.value === 'archived') parts.push('归档');
+  else if (roleFilter.value !== 'all' && ROLE_META[roleFilter.value]) {
+    parts.push(ROLE_META[roleFilter.value].label);
+  }
+
+  if (tagFilter.value) parts.push(`#${tagFilter.value}`);
+  return parts.length ? `筛选 · ${parts.join(' · ')}` : '筛选';
+});
+
+function resetFilters() {
+  statusFilter.value = 'all';
+  favoriteOnly.value = false;
+  roleFilter.value = 'all';
+  tagFilter.value = '';
+}
+
+const filteredHosts = computed(() => {
+  const q = searchQuery.value.trim().toLowerCase();
+  return hosts.value.filter((h) => {
+    if (roleFilter.value === 'archived') {
+      if (!h.archived) return false;
+    } else {
+      if (h.archived) return false;
+      if (roleFilter.value !== 'all' && h.role !== roleFilter.value) return false;
+    }
+    if (favoriteOnly.value && !h.favorited) return false;
+    if (statusFilter.value === 'online' && h.status !== 'online') return false;
+    if (statusFilter.value === 'offline' && h.status !== 'offline') return false;
+    if (tagFilter.value && !h.tags.includes(tagFilter.value)) return false;
+    if (!q) return true;
+    const hay = [
+      h.name,
+      h.addr,
+      String(h.port),
+      h.username,
+      h.osInfo?.prettyName || '',
+      ...h.tags,
+    ]
+      .join(' ')
+      .toLowerCase();
+    return hay.includes(q);
+  });
+});
+
+const onlineCount = computed(
+  () => hosts.value.filter((h) => !h.archived && h.status === 'online').length
+);
+const offlineCount = computed(
+  () => hosts.value.filter((h) => !h.archived && h.status === 'offline').length
+);
+const favoriteCount = computed(
+  () => hosts.value.filter((h) => !h.archived && h.favorited).length
+);
+const totalActiveCount = computed(
+  () => hosts.value.filter((h) => !h.archived).length
+);
+
+const roleFilterOptions: Array<{ key: 'all' | HostRole | 'archived'; label: string }> = [
+  { key: 'all', label: '全部分类' },
+  { key: 'primary', label: '主力' },
+  { key: 'proxy', label: '代理' },
+  { key: 'test', label: '测试' },
+  { key: 'archived', label: '归档' },
+];
+
+// ==================== 登录鉴权与设置页逻辑 ====================
+
+async function checkAuthStatus() {
+  try {
+    const res = await fetch('/api/auth/status');
+    const data = await res.json();
+    authEnabled.value = Boolean(data.authEnabled);
+    authenticated.value = Boolean(data.authenticated);
+    if (data.username) {
+      loginUsername.value = data.username;
+    }
+  } catch {
+    authenticated.value = true;
+  } finally {
+    authChecked.value = true;
+  }
+}
+
+async function handleLoginSubmit() {
+  loginError.value = '';
+  loginSubmitting.value = true;
+  try {
+    const res = await fetch('/api/auth/login', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        username: loginUsername.value,
+        password: loginPassword.value,
+      }),
+    });
+    const data = await res.json();
+    if (!res.ok || !data.ok) {
+      loginError.value = data.error || '账号或密码错误';
+      return;
+    }
+    loginPassword.value = '';
+    authenticated.value = true;
+    await initAuthenticatedWorkspace();
+  } catch (e) {
+    loginError.value = (e as Error).message || '登录请求失败';
+  } finally {
+    loginSubmitting.value = false;
+  }
+}
+
+async function handleLogout() {
+  await fetch('/api/auth/logout', { method: 'POST' });
+  authenticated.value = false;
+  activePage.value = 'workspace';
+}
+
+async function loadSettings() {
+  try {
+    const res = await fetch('/api/settings');
+    if (res.status === 401) {
+      authenticated.value = false;
+      return;
+    }
+    const data = await res.json();
+    if (data.ok && data.settings) {
+      const s = data.settings;
+      mcpEnabled.value = Boolean(s.mcpEnabled);
+      mcpRequireApiKey.value = Boolean(s.mcpRequireApiKey);
+      mcpApiKey.value = s.mcpApiKey || '';
+      settingAuthEnabled.value = Boolean(s.authEnabled);
+      authEnabled.value = Boolean(s.authEnabled);
+      settingAdminUsername.value = s.adminUsername || 'admin';
+      hasAdminPassword.value = Boolean(s.hasAdminPassword);
+    }
+    if (data.cliSync) {
+      mcpStatus.value = data.cliSync;
+    }
+  } catch {
+    // ignore
+  }
+}
+
+async function saveMcpSettings(regenerateKey = false) {
+  savingMcp.value = true;
+  try {
+    const res = await fetch('/api/settings/mcp', {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        mcpEnabled: mcpEnabled.value,
+        mcpRequireApiKey: mcpRequireApiKey.value,
+        regenerateKey,
+      }),
+    });
+    const data = await res.json();
+    if (!data.ok) {
+      showToast(data.error || '保存 MCP 设置失败', 'err');
+      return;
+    }
+    mcpEnabled.value = Boolean(data.settings.mcpEnabled);
+    mcpRequireApiKey.value = Boolean(data.settings.mcpRequireApiKey);
+    mcpApiKey.value = data.settings.mcpApiKey || '';
+    showToast(regenerateKey ? '已生成新的 MCP API Key' : 'MCP 设置已保存');
+  } catch (e) {
+    showToast(`保存失败: ${(e as Error).message}`, 'err');
+  } finally {
+    savingMcp.value = false;
+  }
+}
+
+async function saveAuthSettings() {
+  savingAuth.value = true;
+  try {
+    const res = await fetch('/api/settings/auth', {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        authEnabled: settingAuthEnabled.value,
+        username: settingAdminUsername.value,
+        password: settingAdminPassword.value || undefined,
+      }),
+    });
+    const data = await res.json();
+    if (!data.ok) {
+      showToast(data.error || '保存登录设置失败', 'err');
+      return;
+    }
+    authEnabled.value = Boolean(data.settings.authEnabled);
+    settingAuthEnabled.value = Boolean(data.settings.authEnabled);
+    settingAdminUsername.value = data.settings.adminUsername;
+    hasAdminPassword.value = Boolean(data.settings.hasAdminPassword);
+    settingAdminPassword.value = '';
+    showToast('访问安全与登录设置已保存');
+  } catch (e) {
+    showToast(`保存失败: ${(e as Error).message}`, 'err');
+  } finally {
+    savingAuth.value = false;
+  }
+}
+
+async function triggerCliSync() {
+  try {
+    const res = await fetch('/api/mcp/status', { method: 'POST' });
+    const data = await res.json();
+    if (data.ok && data.status) {
+      mcpStatus.value = data.status;
+      showToast('已同步写入本机 Claude Code 与 Codex 配置文件');
+    }
+  } catch {
+    // ignore
+  }
+}
+
+const remoteHttpEndpoint = computed(() => {
+  return `${window.location.origin}/mcp`;
+});
+
+const displayedMcpConfigJson = computed(() => {
+  if (configModePreview.value === 'remote') {
+    const entry: Record<string, unknown> = {
+      type: 'http',
+      url: remoteHttpEndpoint.value,
+    };
+    if (mcpRequireApiKey.value && mcpApiKey.value) {
+      entry.headers = {
+        Authorization: `Bearer ${mcpApiKey.value}`,
+      };
+    }
+    return JSON.stringify(
+      {
+        mcpServers: {
+          'vps-switch': entry,
+        },
+      },
+      null,
+      2
+    );
+  }
+  return JSON.stringify(
+    {
+      mcpServers: {
+        'vps-switch': {
+          type: 'stdio',
+          command: mcpStatus.value?.exePath || 'vps-switch.exe',
+          args: ['--mcp-stdio'],
+        },
+      },
+    },
+    null,
+    2
+  );
+});
+
+function copyText(text: string, msg: string) {
+  void navigator.clipboard.writeText(text);
+  showToast(msg);
+}
+
+function openSettingsPage() {
+  if (activePage.value === 'settings') {
+    activePage.value = 'workspace';
+  } else {
+    activePage.value = 'settings';
+    void loadSettings();
+  }
+}
+
+// ==================== 工作台与实时事件 ====================
+
+let uiEventSource: EventSource | null = null;
+
+function subscribeUiEvents() {
+  if (uiEventSource) uiEventSource.close();
+  uiEventSource = new EventSource('/api/events');
+  uiEventSource.onmessage = (ev) => {
+    try {
+      const data = JSON.parse(ev.data);
+      if (data.type === 'revealTerminal' && data.hostId && data.pane) {
+        const pane = data.pane as PaneMeta;
+        let tab = openTabs.value.find((t) => t.hostId === data.hostId);
+        if (!tab) {
+          tab = {
+            hostId: data.hostId,
+            mode: 'terminal',
+            rightWing: null,
+            splitDirection: 'row',
+            panes: [pane],
+          };
+          openTabs.value.push(tab);
+        } else {
+          tab.mode = 'terminal';
+          if (!tab.panes.some((p) => p.id === pane.id)) {
+            tab.panes.push(pane);
+          }
+        }
+        activePage.value = 'workspace';
+        stageHostId.value = data.hostId;
+        centerStage.value = 'terminal';
+        detailHostId.value = data.hostId;
+        const hostName = hostById(data.hostId)?.name || data.hostId;
+        showToast(
+          data.reason
+            ? `Agent 唤起「${hostName}」终端: ${data.reason}`
+            : `Agent 已唤起「${hostName}」终端供你操作`
+        );
+      }
+    } catch {
+      // ignore
+    }
+  };
+}
+
+async function fetchHosts() {
+  loading.value = true;
+  try {
+    const res = await fetch('/api/hosts');
+    if (res.status === 401) {
+      authenticated.value = false;
+      return;
+    }
+    const data = await res.json();
+    if (data.ok && Array.isArray(data.hosts)) {
+      hosts.value = data.hosts;
+      seedInspectionMap(data.inspections);
+    }
+  } catch (e) {
+    showToast(`读取主机列表失败: ${(e as Error).message}`, 'err');
+  } finally {
+    loading.value = false;
+  }
+}
+
+async function restoreExistingTerminals() {
+  try {
+    const res = await fetch('/api/terminals');
+    if (!res.ok) return;
+    const data = await res.json();
+    if (!data.ok || !Array.isArray(data.panes)) return;
+    const byHost = new Map<string, PaneMeta[]>();
+    for (const p of data.panes as PaneMeta[]) {
+      if (p.exited) continue;
+      const list = byHost.get(p.hostId) || [];
+      list.push(p);
+      byHost.set(p.hostId, list);
+    }
+    for (const [hostId, panes] of byHost.entries()) {
+      let tab = openTabs.value.find((t) => t.hostId === hostId);
+      if (!tab) {
+        tab = {
+          hostId,
+          mode: 'terminal',
+          rightWing: null,
+          splitDirection: 'row',
+          panes,
+        };
+        openTabs.value.push(tab);
+      } else {
+        tab.panes = panes;
+      }
+    }
+  } catch {
+    // ignore
+  }
+}
+
+function replaceHostInList(updated: PublicHost) {
+  const idx = hosts.value.findIndex((h) => h.id === updated.id);
+  if (idx >= 0) {
+    hosts.value.splice(idx, 1, updated);
+  } else {
+    hosts.value.push(updated);
+  }
+}
+
+async function checkSingleHost(host: PublicHost) {
+  if (checkingIds.value.has(host.id)) return;
+  const next = new Set(checkingIds.value);
+  next.add(host.id);
+  checkingIds.value = next;
+  try {
+    const res = await fetch(`/api/hosts/${encodeURIComponent(host.id)}/check`, {
+      method: 'POST',
+    });
+    const data = await res.json();
+    if (data.ok && data.host) {
+      replaceHostInList(data.host);
+      if (data.inspection) {
+        globalInspectionCache.set(data.host.id, data.inspection);
+      }
+      if (data.host.status === 'online') {
+        showToast(`${data.host.name} 在线 (${data.host.latencyMs ?? 0} ms)`);
+      } else {
+        showToast(`${data.host.name} 离线`, 'err');
+      }
+    }
+  } catch (e) {
+    showToast(`检测失败: ${(e as Error).message}`, 'err');
+  } finally {
+    const after = new Set(checkingIds.value);
+    after.delete(host.id);
+    checkingIds.value = after;
+  }
+}
+
+async function checkAllHosts() {
+  if (checkingAll.value) return;
+  checkingAll.value = true;
+  showToast('正在并发探索全部主机在线状态与实时硬件快照...');
+  try {
+    const res = await fetch('/api/hosts/check-all', { method: 'POST' });
+    const data = await res.json();
+    if (data.ok && Array.isArray(data.hosts)) {
+      hosts.value = data.hosts;
+      seedInspectionMap(data.inspections);
+      const online = data.hosts.filter((h: PublicHost) => !h.archived && h.status === 'online').length;
+      showToast(`机队快照同步完成：${online} 台主机在线`);
+    }
+  } catch (e) {
+    showToast(`批量检测失败: ${(e as Error).message}`, 'err');
+  } finally {
+    checkingAll.value = false;
+  }
+}
+
+function syncCurrentTabState() {
+  if (!stageHostId.value) return;
+  const tab = openTabs.value.find((t) => t.hostId === stageHostId.value);
+  if (tab && centerStage.value) {
+    tab.mode = centerStage.value;
+    tab.rightWing = rightWing.value;
+  }
+}
+
+function switchToHomeView() {
+  activePage.value = 'workspace';
+  syncCurrentTabState();
+  centerStage.value = null;
+  stageHostId.value = null;
+  if (rightWing.value === 'files') {
+    rightWing.value = null;
+  }
+}
+
+async function ensureHostHasPane(tab: OpenSessionTab) {
+  if (tab.panes.length > 0) return;
+  await createPaneForTab(tab);
+}
+
+async function createPaneForTab(tab: OpenSessionTab, cwd?: string | null) {
+  if (creatingPane.value) return;
+  creatingPane.value = true;
+  try {
+    const res = await fetch('/api/terminals', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        hostId: tab.hostId,
+        cols: 100,
+        rows: 30,
+        cwd: cwd || undefined,
+      }),
+    });
+    const data = await res.json();
+    if (!data.ok || !data.pane) {
+      showToast(data.error || '启动终端失败', 'err');
+      return;
+    }
+    tab.panes.push(data.pane as PaneMeta);
+    const host = hostById(tab.hostId);
+    if (host && host.status !== 'online') {
+      host.status = 'online';
+    }
+  } catch (e) {
+    showToast(`启动终端失败: ${(e as Error).message}`, 'err');
+  } finally {
+    creatingPane.value = false;
+  }
+}
+
+async function activateSessionTab(tab: OpenSessionTab) {
+  activePage.value = 'workspace';
+  syncCurrentTabState();
+  stageHostId.value = tab.hostId;
+  centerStage.value = tab.mode;
+  detailHostId.value = tab.hostId;
+  rightWing.value = tab.rightWing;
+  if (tab.mode === 'terminal') {
+    await ensureHostHasPane(tab);
+  }
+}
+
+async function closeSessionTab(hostId: string) {
+  const idx = openTabs.value.findIndex((t) => t.hostId === hostId);
+  if (idx >= 0) {
+    const [removed] = openTabs.value.splice(idx, 1);
+    for (const p of removed.panes) {
+      void fetch(`/api/terminals/${encodeURIComponent(p.id)}`, { method: 'DELETE' });
+    }
+  }
+  if (stageHostId.value === hostId) {
+    const fallback = openTabs.value[openTabs.value.length - 1];
+    if (fallback) {
+      await activateSessionTab(fallback);
+    } else {
+      switchToHomeView();
+    }
+  }
+}
+
+function prewarmHostFiles(host: PublicHost) {
+  if (host.status === 'offline') return;
+  void fetch('/api/files/prewarm', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ hostId: host.id }),
+  });
+}
+
+function onCardClick(host: PublicHost) {
+  if (rightWing.value === 'detail' && detailHostId.value === host.id) {
+    rightWing.value = null;
+    detailHostId.value = null;
+  } else {
+    detailHostId.value = host.id;
+    rightWing.value = 'detail';
+    prewarmHostFiles(host);
+  }
+  syncCurrentTabState();
+}
+
+async function openTerminalStage(host: PublicHost) {
+  activePage.value = 'workspace';
+  prewarmHostFiles(host);
+  syncCurrentTabState();
+  let tab = openTabs.value.find((t) => t.hostId === host.id);
+  if (!tab) {
+    tab = {
+      hostId: host.id,
+      mode: 'terminal',
+      rightWing: rightWing.value === 'detail' && detailHostId.value === host.id ? 'detail' : null,
+      splitDirection: 'row',
+      panes: [],
+    };
+    openTabs.value.push(tab);
+  } else {
+    tab.mode = 'terminal';
+  }
+  stageHostId.value = host.id;
+  centerStage.value = 'terminal';
+  detailHostId.value = host.id;
+  rightWing.value = tab.rightWing;
+  await ensureHostHasPane(tab);
+}
+
+function openFilesStage(host: PublicHost) {
+  activePage.value = 'workspace';
+  syncCurrentTabState();
+  let tab = openTabs.value.find((t) => t.hostId === host.id);
+  if (!tab) {
+    tab = {
+      hostId: host.id,
+      mode: 'files',
+      rightWing: null,
+      splitDirection: 'row',
+      panes: [],
+    };
+    openTabs.value.push(tab);
+  } else {
+    tab.mode = 'files';
+    if (tab.rightWing === 'files') tab.rightWing = null;
+  }
+  stageHostId.value = host.id;
+  centerStage.value = 'files';
+  detailHostId.value = host.id;
+  if (rightWing.value === 'files') {
+    rightWing.value = null;
+  }
+}
+
+function toggleRightWing(mode: 'files' | 'detail') {
+  if (!stageHost.value) return;
+  if (rightWing.value === mode && detailHostId.value === stageHost.value.id) {
+    rightWing.value = null;
+  } else {
+    detailHostId.value = stageHost.value.id;
+    rightWing.value = mode;
+  }
+  syncCurrentTabState();
+}
+
+async function handleSplitTerminal(direction: 'row' | 'col') {
+  const tab = activeSessionTab.value;
+  if (!tab) return;
+  tab.splitDirection = direction;
+  const lastCwd = tab.panes[tab.panes.length - 1]?.cwd;
+  await createPaneForTab(tab, lastCwd);
+}
+
+async function handleClosePane(paneId: string) {
+  const tab = activeSessionTab.value;
+  if (!tab) return;
+  void fetch(`/api/terminals/${encodeURIComponent(paneId)}`, { method: 'DELETE' });
+  tab.panes = tab.panes.filter((p) => p.id !== paneId);
+  if (tab.panes.length === 0) {
+    await closeSessionTab(tab.hostId);
+  }
+}
+
+function handlePaneMetaUpdate(updated: PaneMeta) {
+  for (const tab of openTabs.value) {
+    const idx = tab.panes.findIndex((p) => p.id === updated.id);
+    if (idx >= 0) {
+      tab.panes.splice(idx, 1, updated);
+      break;
+    }
+  }
+}
+
+function openCreateModal() {
+  editingHost.value = null;
+  modalOpen.value = true;
+}
+
+function openEditModal(host: PublicHost) {
+  editingHost.value = host;
+  modalOpen.value = true;
+}
+
+async function handleModalSubmit(payload: HostUpsertPayload, editingId: string | null) {
+  try {
+    const url = editingId ? `/api/hosts/${encodeURIComponent(editingId)}` : '/api/hosts';
+    const method = editingId ? 'PUT' : 'POST';
+    const res = await fetch(url, {
+      method,
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(payload),
+    });
+    const data = await res.json();
+    if (!data.ok) {
+      showToast(data.error || '保存失败', 'err');
+      return;
+    }
+    modalOpen.value = false;
+    await fetchHosts();
+    if (data.host?.id) {
+      detailHostId.value = data.host.id;
+      rightWing.value = 'detail';
+    }
+    showToast(editingId ? '主机已更新' : '主机已创建');
+  } catch (e) {
+    showToast(`保存失败: ${(e as Error).message}`, 'err');
+  }
+}
+
+async function handlePatchMeta(host: PublicHost, patch: Record<string, unknown>) {
+  try {
+    const res = await fetch(`/api/hosts/${encodeURIComponent(host.id)}/meta`, {
+      method: 'PATCH',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(patch),
+    });
+    const data = await res.json();
+    if (data.ok && data.host) {
+      replaceHostInList(data.host);
+    }
+  } catch (e) {
+    showToast(`更新失败: ${(e as Error).message}`, 'err');
+  }
+}
+
+function handleDeleteHost(host: PublicHost) {
+  if (host.kind === 'local') return;
+  deletingHost.value = host;
+}
+
+async function confirmDeleteHost() {
+  const host = deletingHost.value;
+  if (!host) return;
+  deletingHost.value = null;
+  try {
+    const res = await fetch(`/api/hosts/${encodeURIComponent(host.id)}`, {
+      method: 'DELETE',
+    });
+    const data = await res.json();
+    if (data.ok) {
+      await closeSessionTab(host.id);
+      if (detailHostId.value === host.id) {
+        detailHostId.value = null;
+        rightWing.value = null;
+      }
+      await fetchHosts();
+      showToast(`已删除主机「${host.name}」`);
+    }
+  } catch (e) {
+    showToast(`删除失败: ${(e as Error).message}`, 'err');
+  }
+}
+
+function handleGlobalKeydown(e: KeyboardEvent) {
+  if ((e.ctrlKey || e.metaKey) && e.key.toLowerCase() === 'k') {
+    e.preventDefault();
+    if (activePage.value !== 'workspace') activePage.value = 'workspace';
+    searchInputRef.value?.focus();
+    searchInputRef.value?.select();
+  } else if (e.key === 'Escape') {
+    if (filterMenuOpen.value) filterMenuOpen.value = false;
+    else if (deletingHost.value) deletingHost.value = null;
+    else if (modalOpen.value) modalOpen.value = false;
+  }
+}
+
+function onDragStart(e: DragEvent, host: PublicHost) {
+  if (host.kind === 'local') return;
+  draggingId.value = host.id;
+  e.dataTransfer?.setData('text/plain', host.id);
+  if (e.dataTransfer) e.dataTransfer.effectAllowed = 'move';
+}
+
+function onDragOver(e: DragEvent, target: PublicHost) {
+  if (!draggingId.value || draggingId.value === target.id || target.kind === 'local') return;
+  e.preventDefault();
+  dragOverId.value = target.id;
+}
+
+async function onDrop(e: DragEvent, target: PublicHost) {
+  e.preventDefault();
+  const fromId = draggingId.value;
+  draggingId.value = null;
+  dragOverId.value = null;
+  if (!fromId || fromId === target.id || target.kind === 'local') return;
+
+  const currentIds = hosts.value.filter((h) => h.kind !== 'local').map((h) => h.id);
+  const fromIdx = currentIds.indexOf(fromId);
+  const toIdx = currentIds.indexOf(target.id);
+  if (fromIdx < 0 || toIdx < 0) return;
+
+  currentIds.splice(fromIdx, 1);
+  currentIds.splice(toIdx, 0, fromId);
+
+  try {
+    const res = await fetch('/api/hosts/reorder', {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ orderedIds: currentIds }),
+    });
+    const data = await res.json();
+    if (data.ok && Array.isArray(data.hosts)) {
+      hosts.value = data.hosts;
+    }
+  } catch {
+    // ignore
+  }
+}
+
+function onDragEnd() {
+  draggingId.value = null;
+  dragOverId.value = null;
+}
+
+async function initAuthenticatedWorkspace() {
+  await fetchHosts();
+  await restoreExistingTerminals();
+  await loadSettings();
+  subscribeUiEvents();
+}
+
+onMounted(async () => {
+  window.addEventListener('keydown', handleGlobalKeydown);
+  try {
+    const saved = localStorage.getItem('vps-switch-theme');
+    if (saved === 'dark') applyTheme(true);
+  } catch {
+    // ignore
+  }
+  await checkAuthStatus();
+  if (authenticated.value) {
+    await initAuthenticatedWorkspace();
+  }
+});
+
+onBeforeUnmount(() => {
+  window.removeEventListener('keydown', handleGlobalKeydown);
+  uiEventSource?.close();
+});
+</script>
+
+<template>
+  <!-- 1. 当启用了登录保护且未登录时：展示独立毛玻璃登录界面 -->
+  <div
+    v-if="authChecked && authEnabled && !authenticated"
+    class="flex h-full w-full items-center justify-center p-4 select-none text-zinc-900 dark:text-zinc-100"
+  >
+    <div
+      class="w-full max-w-sm rounded-3xl border border-zinc-200/85 bg-white/85 p-7 shadow-[0_8px_36px_rgba(0,0,0,0.06)] backdrop-blur-xl dark:border-zinc-800 dark:bg-zinc-900/88"
+    >
+      <div class="flex flex-col items-center text-center">
+        <BrandLogo size="lg" />
+        <h1 class="mt-3 text-base font-bold tracking-tight">VPS Switch</h1>
+        <p class="mt-1 text-xs text-zinc-400">请输入管理员账号与密码登录</p>
+      </div>
+
+      <form class="mt-6 space-y-3.5" @submit.prevent="handleLoginSubmit">
+        <div
+          v-if="loginError"
+          class="rounded-xl border border-red-200 bg-red-50 px-3 py-2 text-xs text-red-600 dark:border-red-900/60 dark:bg-red-950/40 dark:text-red-400"
+        >
+          {{ loginError }}
+        </div>
+
+        <div>
+          <label class="block text-xs font-medium text-zinc-600 dark:text-zinc-300">管理员账号</label>
+          <input
+            v-model="loginUsername"
+            type="text"
+            autocomplete="username"
+            class="mt-1 w-full rounded-xl border border-zinc-200 bg-zinc-50/70 px-3 py-2 text-xs outline-none transition focus:border-zinc-400 focus:bg-white dark:border-zinc-700 dark:bg-zinc-800 dark:focus:border-zinc-500"
+          />
+        </div>
+
+        <div>
+          <label class="block text-xs font-medium text-zinc-600 dark:text-zinc-300">密码</label>
+          <input
+            v-model="loginPassword"
+            type="password"
+            autocomplete="current-password"
+            placeholder="输入登录密码"
+            autofocus
+            class="mt-1 w-full rounded-xl border border-zinc-200 bg-zinc-50/70 px-3 py-2 text-xs outline-none transition focus:border-zinc-400 focus:bg-white dark:border-zinc-700 dark:bg-zinc-800 dark:focus:border-zinc-500"
+          />
+        </div>
+
+        <button
+          type="submit"
+          :disabled="loginSubmitting"
+          class="mt-2 w-full rounded-xl bg-zinc-900 py-2.5 text-xs font-semibold text-white shadow-sm transition hover:bg-zinc-800 disabled:opacity-50 dark:bg-zinc-100 dark:text-zinc-900 dark:hover:bg-white"
+        >
+          {{ loginSubmitting ? '正在验证...' : '登录' }}
+        </button>
+      </form>
+    </div>
+  </div>
+
+  <!-- 2. 已认证主应用 -->
+  <div
+    v-else-if="authChecked"
+    class="flex h-full w-full flex-col overflow-hidden select-none text-zinc-900 dark:text-zinc-100"
+    @click="filterMenuOpen = false"
+  >
+    <!-- 顶部栏 -->
+    <header
+      class="relative z-30 flex h-13 shrink-0 items-center justify-between gap-3 border-b border-zinc-200/75 bg-white/75 px-4 py-2 backdrop-blur-xl dark:border-zinc-800/80 dark:bg-zinc-900/75"
+    >
+      <!-- 左上角：品牌 + ⌂ 仓库按钮 + 已打开的多终端会话标签页 -->
+      <div class="flex min-w-0 flex-1 items-center gap-1.5 overflow-x-auto pr-2">
+        <div class="mr-1 flex shrink-0 items-center gap-2 pr-1">
+          <BrandLogo size="sm" />
+          <span class="text-sm font-bold tracking-tight text-zinc-900 dark:text-zinc-100">VPS Switch</span>
+        </div>
+
+        <!-- ⌂ 仓库 (Home) 按钮 -->
+        <button
+          type="button"
+          class="inline-flex shrink-0 items-center gap-1.5 rounded-xl px-3 py-1.5 text-xs font-medium transition"
+          :class="
+            activePage === 'workspace' && !hasCenterStage
+              ? 'border border-zinc-200/90 bg-white text-zinc-900 shadow-sm dark:border-zinc-700 dark:bg-zinc-800 dark:text-zinc-100'
+              : 'text-zinc-500 hover:bg-white/60 hover:text-zinc-900 dark:text-zinc-400 dark:hover:bg-zinc-800/60 dark:hover:text-zinc-100'
+          "
+          title="回到全宽仓库视图"
+          @click="switchToHomeView"
+        >
+          <svg class="h-3.5 w-3.5" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+            <path d="M3 10.5L12 3l9 7.5V20a1 1 0 0 1-1 1h-5.5v-6h-5v6H4a1 1 0 0 1-1-1v-9.5z" />
+          </svg>
+          <span>仓库</span>
+          <span class="rounded-full bg-zinc-100 px-1.5 py-0.2 font-mono text-[10px] text-zinc-500 dark:bg-zinc-700 dark:text-zinc-300">
+            {{ onlineCount }}/{{ totalActiveCount }}
+          </span>
+        </button>
+
+        <!-- 左上角已打开的终端/文件会话标签页 -->
+        <div
+          v-for="tab in openTabs"
+          :key="tab.hostId"
+          class="group inline-flex shrink-0 items-center gap-2 rounded-xl px-3 py-1.5 text-xs font-medium transition cursor-pointer"
+          :class="
+            activePage === 'workspace' && hasCenterStage && stageHostId === tab.hostId
+              ? 'border border-zinc-200/90 bg-white text-zinc-900 shadow-sm dark:border-zinc-700 dark:bg-zinc-800 dark:text-zinc-100'
+              : 'border border-transparent bg-zinc-100/60 text-zinc-600 hover:bg-white/80 hover:text-zinc-900 dark:bg-zinc-800/40 dark:text-zinc-400 dark:hover:bg-zinc-800 dark:hover:text-zinc-100'
+          "
+          @click="activateSessionTab(tab)"
+        >
+          <span
+            class="h-2 w-2 shrink-0 rounded-full"
+            :class="{
+              'bg-emerald-500': hostById(tab.hostId)?.status === 'online',
+              'bg-red-500': hostById(tab.hostId)?.status === 'offline',
+              'bg-zinc-300 dark:bg-zinc-600': !hostById(tab.hostId) || hostById(tab.hostId)?.status === 'unknown',
+            }"
+          />
+          <span class="max-w-[128px] truncate">{{ hostById(tab.hostId)?.name || tab.hostId }}</span>
+          <span
+            v-if="tab.panes.length > 1"
+            class="rounded bg-zinc-100 px-1 py-0.2 font-mono text-[10px] text-zinc-500 dark:bg-zinc-700 dark:text-zinc-300"
+          >
+            ×{{ tab.panes.length }}
+          </span>
+          <button
+            type="button"
+            class="rounded p-0.5 text-zinc-400 transition hover:bg-zinc-200/70 hover:text-zinc-800 dark:hover:bg-zinc-700 dark:hover:text-zinc-200"
+            title="关闭该会话"
+            @click.stop="closeSessionTab(tab.hostId)"
+          >
+            ×
+          </button>
+        </div>
+      </div>
+
+      <!-- 右上角 -->
+      <div class="flex shrink-0 items-center gap-2">
+        <template v-if="activePage === 'workspace'">
+          <!-- 搜索框 -->
+          <div class="relative hidden sm:block">
+            <svg
+              class="pointer-events-none absolute left-2.5 top-1/2 h-3.5 w-3.5 -translate-y-1/2 text-zinc-400"
+              viewBox="0 0 24 24"
+              fill="none"
+              stroke="currentColor"
+              stroke-width="2"
+            >
+              <circle cx="11" cy="11" r="7" />
+              <path d="M20 20l-3.5-3.5" />
+            </svg>
+            <input
+              ref="searchInputRef"
+              v-model="searchQuery"
+              type="text"
+              placeholder="搜索名称 / IP / 标签 (Ctrl+K)"
+              class="w-44 rounded-full border border-zinc-200/80 bg-white/85 py-1.5 pl-8 pr-3 text-xs text-zinc-800 outline-none transition focus:w-56 focus:border-zinc-300 focus:bg-white dark:border-zinc-700/80 dark:bg-zinc-800/85 dark:text-zinc-100 dark:focus:border-zinc-600 dark:focus:bg-zinc-800"
+            />
+          </div>
+
+          <!-- 统一筛选按钮 -->
+          <div class="relative" @click.stop>
+            <button
+              type="button"
+              class="inline-flex items-center gap-1.5 rounded-full border px-3 py-1.5 text-xs font-medium transition"
+              :class="
+                hasActiveFilter
+                  ? 'border-zinc-900 bg-zinc-900 text-white shadow-sm dark:border-zinc-100 dark:bg-zinc-100 dark:text-zinc-900'
+                  : 'border-zinc-200/80 bg-white/85 text-zinc-700 hover:bg-white dark:border-zinc-700/80 dark:bg-zinc-800/85 dark:text-zinc-200 dark:hover:bg-zinc-800'
+              "
+              @click="filterMenuOpen = !filterMenuOpen"
+            >
+              <svg class="h-3.5 w-3.5" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                <polygon points="22 3 2 3 10 12.46 10 19 14 21 14 12.46 22 3" />
+              </svg>
+              <span>{{ activeFilterSummary }}</span>
+              <span
+                v-if="hasActiveFilter"
+                class="ml-0.5 rounded-full px-1 hover:bg-white/20 dark:hover:bg-black/20"
+                title="重置筛选"
+                @click.stop="resetFilters"
+              >
+                ×
+              </span>
+            </button>
+
+            <div
+              v-if="filterMenuOpen"
+              class="absolute right-0 top-full mt-2 w-64 rounded-2xl border border-zinc-200/90 bg-white/95 p-3.5 shadow-xl backdrop-blur-xl dark:border-zinc-700/90 dark:bg-zinc-900/95"
+            >
+              <div>
+                <div class="flex items-center justify-between text-[11px] font-semibold text-zinc-400">
+                  <span>在线状态</span>
+                  <button
+                    v-if="hasActiveFilter"
+                    type="button"
+                    class="text-[11px] font-normal text-zinc-500 hover:text-zinc-900 dark:hover:text-zinc-200"
+                    @click="resetFilters"
+                  >
+                    重置全部
+                  </button>
+                </div>
+                <div class="mt-1.5 grid grid-cols-3 gap-1">
+                  <button
+                    type="button"
+                    class="rounded-xl px-2 py-1.5 text-xs font-medium transition"
+                    :class="
+                      statusFilter === 'all'
+                        ? 'bg-zinc-900 text-white dark:bg-zinc-100 dark:text-zinc-900'
+                        : 'bg-zinc-100 text-zinc-600 hover:bg-zinc-200/70 dark:bg-zinc-800 dark:text-zinc-300'
+                    "
+                    @click="statusFilter = 'all'"
+                  >
+                    全部
+                  </button>
+                  <button
+                    type="button"
+                    class="inline-flex items-center justify-center gap-1 rounded-xl px-2 py-1.5 text-xs font-medium transition"
+                    :class="
+                      statusFilter === 'online'
+                        ? 'bg-zinc-900 text-white dark:bg-zinc-100 dark:text-zinc-900'
+                        : 'bg-zinc-100 text-zinc-600 hover:bg-zinc-200/70 dark:bg-zinc-800 dark:text-zinc-300'
+                    "
+                    @click="statusFilter = 'online'"
+                  >
+                    <span class="h-2 w-2 rounded-full bg-emerald-500" />
+                    <span>在线 ({{ onlineCount }})</span>
+                  </button>
+                  <button
+                    type="button"
+                    class="inline-flex items-center justify-center gap-1 rounded-xl px-2 py-1.5 text-xs font-medium transition"
+                    :class="
+                      statusFilter === 'offline'
+                        ? 'bg-zinc-900 text-white dark:bg-zinc-100 dark:text-zinc-900'
+                        : 'bg-zinc-100 text-zinc-600 hover:bg-zinc-200/70 dark:bg-zinc-800 dark:text-zinc-300'
+                    "
+                    @click="statusFilter = 'offline'"
+                  >
+                    <span class="h-2 w-2 rounded-full bg-red-500" />
+                    <span>离线 ({{ offlineCount }})</span>
+                  </button>
+                </div>
+              </div>
+
+              <div class="mt-3 border-t border-zinc-100 pt-3 dark:border-zinc-800">
+                <div class="text-[11px] font-semibold text-zinc-400">收藏与分类</div>
+                <div class="mt-1.5 flex flex-wrap gap-1">
+                  <button
+                    type="button"
+                    class="inline-flex items-center gap-1 rounded-xl px-2.5 py-1 text-xs font-medium transition"
+                    :class="
+                      favoriteOnly
+                        ? 'bg-amber-500 text-white shadow-sm'
+                        : 'bg-zinc-100 text-zinc-600 hover:bg-zinc-200/70 dark:bg-zinc-800 dark:text-zinc-300'
+                    "
+                    @click="favoriteOnly = !favoriteOnly"
+                  >
+                    <span>★ 收藏 ({{ favoriteCount }})</span>
+                  </button>
+                  <button
+                    v-for="opt in roleFilterOptions"
+                    :key="opt.key"
+                    type="button"
+                    class="rounded-xl px-2.5 py-1 text-xs font-medium transition"
+                    :class="
+                      roleFilter === opt.key
+                        ? 'bg-zinc-900 text-white dark:bg-zinc-100 dark:text-zinc-900'
+                        : 'bg-zinc-100 text-zinc-600 hover:bg-zinc-200/70 dark:bg-zinc-800 dark:text-zinc-300'
+                    "
+                    @click="roleFilter = opt.key"
+                  >
+                    {{ opt.label }}
+                  </button>
+                </div>
+              </div>
+
+              <div v-if="allTags.length" class="mt-3 border-t border-zinc-100 pt-3 dark:border-zinc-800">
+                <div class="text-[11px] font-semibold text-zinc-400">标签</div>
+                <div class="mt-1.5 flex max-h-28 flex-wrap gap-1 overflow-y-auto">
+                  <button
+                    v-for="t in allTags"
+                    :key="t"
+                    type="button"
+                    class="rounded-lg px-2 py-0.5 text-[11px] font-medium transition"
+                    :class="
+                      tagFilter === t
+                        ? 'bg-zinc-900 text-white dark:bg-zinc-100 dark:text-zinc-900'
+                        : 'bg-zinc-100 text-zinc-600 hover:bg-zinc-200/70 dark:bg-zinc-800 dark:text-zinc-300'
+                    "
+                    @click="tagFilter = tagFilter === t ? '' : t"
+                  >
+                    #{{ t }}
+                  </button>
+                </div>
+              </div>
+            </div>
+          </div>
+
+          <!-- 检测在线按钮 -->
+          <button
+            type="button"
+            class="inline-flex items-center gap-1 rounded-full border border-zinc-200/80 bg-white/85 px-3 py-1.5 text-xs font-medium text-zinc-700 transition hover:bg-white disabled:opacity-50 dark:border-zinc-700/80 dark:bg-zinc-800/85 dark:text-zinc-200 dark:hover:bg-zinc-800"
+            :disabled="checkingAll"
+            title="并发检测全部 VPS 在线状态并刷新硬件快照"
+            @click="checkAllHosts"
+          >
+            <svg
+              class="h-3.5 w-3.5"
+              :class="{ 'animate-spin': checkingAll }"
+              viewBox="0 0 24 24"
+              fill="none"
+              stroke="currentColor"
+              stroke-width="2"
+            >
+              <path d="M21 12a9 9 0 1 1-3-6.7" />
+              <path d="M21 3v6h-6" />
+            </svg>
+            <span>{{ checkingAll ? '检测中' : '检测在线' }}</span>
+          </button>
+        </template>
+
+        <!-- 昼夜主题切换按钮 -->
+        <button
+          type="button"
+          class="flex h-8 w-8 items-center justify-center rounded-full border border-zinc-200/80 bg-white/85 text-zinc-600 transition hover:bg-white hover:text-zinc-900 dark:border-zinc-700/80 dark:bg-zinc-800/85 dark:text-zinc-300 dark:hover:bg-zinc-800 dark:hover:text-white"
+          :title="isDark ? '切换为日间白色毛玻璃' : '切换为夜间深色毛玻璃'"
+          @click="toggleTheme"
+        >
+          <svg v-if="isDark" class="h-4 w-4" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+            <circle cx="12" cy="12" r="4" />
+            <path d="M12 2v2M12 20v2M4.93 4.93l1.41 1.41M17.66 17.66l1.41 1.41M2 12h2M20 12h2M4.93 19.07l1.41-1.41M17.66 6.34l1.41-1.41" />
+          </svg>
+          <svg v-else class="h-4 w-4" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+            <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z" />
+          </svg>
+        </button>
+
+        <!-- 独立设置页入口按钮 -->
+        <button
+          type="button"
+          class="flex h-8 w-8 items-center justify-center rounded-full border transition"
+          :class="
+            activePage === 'settings'
+              ? 'border-zinc-900 bg-zinc-900 text-white shadow-sm dark:border-zinc-100 dark:bg-zinc-100 dark:text-zinc-900'
+              : 'border-zinc-200/80 bg-white/85 text-zinc-600 hover:bg-white hover:text-zinc-900 dark:border-zinc-700/80 dark:bg-zinc-800/85 dark:text-zinc-300 dark:hover:bg-zinc-800 dark:hover:text-white'
+          "
+          title="进入设置页（MCP Server / API Key / 登录安全）"
+          @click="openSettingsPage"
+        >
+          <svg class="h-4 w-4" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+            <circle cx="12" cy="12" r="3" />
+            <path d="M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 1 1-2.83 2.83l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-4 0v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 1 1-2.83-2.83l.06-.06a1.65 1.65 0 0 0 .33-1.82 1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1 0-4h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 1 1 2.83-2.83l.06.06a1.65 1.65 0 0 0 1.82.33H9a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 4 0v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 1 1 2.83 2.83l-.06.06a1.65 1.65 0 0 0-.33 1.82V9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 0 4h-.09a1.65 1.65 0 0 0-1.51 1z" />
+          </svg>
+        </button>
+
+        <!-- 新增 VPS 橙色加号 -->
+        <button
+          type="button"
+          class="flex h-8 w-8 items-center justify-center rounded-full bg-orange-500 text-white shadow-sm transition hover:bg-orange-600 active:scale-95"
+          title="新增 VPS"
+          @click="openCreateModal"
+        >
+          <svg class="h-4 w-4" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5">
+            <path d="M12 5v14M5 12h14" />
+          </svg>
+        </button>
+      </div>
+    </header>
+
+    <!-- 页面 A：独立设置页面（非弹窗，直接全页展示 MCP 开关、API Key、登录账号密码与外观） -->
+    <main
+      v-if="activePage === 'settings'"
+      class="flex-1 overflow-y-auto p-5"
+    >
+      <div class="mx-auto max-w-4xl space-y-4">
+        <!-- 顶部返回条 -->
+        <div class="flex items-center justify-between">
+          <div>
+            <h2 class="text-base font-bold">系统设置</h2>
+            <p class="text-xs text-zinc-400">管理 MCP Server 远程/本机接入、API Key 与 Web 访问安全</p>
+          </div>
+          <div class="flex items-center gap-2">
+            <button
+              v-if="authEnabled"
+              type="button"
+              class="rounded-xl border border-red-200/80 bg-white px-3 py-1.5 text-xs font-medium text-red-600 hover:bg-red-50 dark:border-red-900/50 dark:bg-zinc-900 dark:text-red-400"
+              @click="handleLogout"
+            >
+              退出登录
+            </button>
+            <button
+              type="button"
+              class="rounded-xl border border-zinc-200/80 bg-white px-3.5 py-1.5 text-xs font-medium text-zinc-700 hover:bg-zinc-50 dark:border-zinc-700 dark:bg-zinc-800 dark:text-zinc-200"
+              @click="activePage = 'workspace'"
+            >
+              返回仓库
+            </button>
+          </div>
+        </div>
+
+        <!-- 板块 1：MCP Server 开关与 API Key -->
+        <section
+          class="space-y-4 rounded-2xl border border-zinc-200/80 bg-white/85 p-5 shadow-[0_2px_12px_rgba(0,0,0,0.02)] backdrop-blur-xl dark:border-zinc-800 dark:bg-zinc-900/85"
+        >
+          <div class="flex items-center justify-between border-b border-zinc-100 pb-3.5 dark:border-zinc-800">
+            <div class="flex items-center gap-2.5">
+              <span
+                class="h-2.5 w-2.5 rounded-full"
+                :class="mcpEnabled ? 'bg-emerald-500 shadow-[0_0_8px_rgba(16,185,129,0.6)]' : 'bg-zinc-300 dark:bg-zinc-600'"
+              />
+              <div>
+                <h3 class="text-sm font-semibold">MCP Server 服务与 API Key</h3>
+                <p class="text-xs text-zinc-400">
+                  支持本机 Stdio 自动接入，或部署在 VPS 上通过 HTTP + API Key 供远程调用
+                </p>
+              </div>
+            </div>
+
+            <!-- MCP 总开关 -->
+            <label class="inline-flex items-center gap-2 cursor-pointer">
+              <span class="text-xs font-medium text-zinc-600 dark:text-zinc-300">
+                {{ mcpEnabled ? '已启用' : '已关闭' }}
+              </span>
+              <input
+                v-model="mcpEnabled"
+                type="checkbox"
+                class="h-4 w-4 rounded border-zinc-300 text-zinc-900"
+                @change="saveMcpSettings(false)"
+              />
+            </label>
+          </div>
+
+          <!-- API Key 鉴权开关与密钥框 -->
+          <div class="grid gap-3 md:grid-cols-2">
+            <div class="flex items-center justify-between rounded-xl border border-zinc-200/70 bg-zinc-50/60 p-3.5 dark:border-zinc-800 dark:bg-zinc-800/40">
+              <div>
+                <div class="text-xs font-semibold">远程 HTTP 要求 API Key 鉴权</div>
+                <div class="mt-0.5 text-[11px] text-zinc-400">
+                  部署在公网 VPS 时请开启，拒绝未携带有效 API Key 的外部请求
+                </div>
+              </div>
+              <input
+                v-model="mcpRequireApiKey"
+                type="checkbox"
+                class="h-4 w-4 shrink-0 rounded border-zinc-300 text-zinc-900 cursor-pointer"
+                @change="saveMcpSettings(false)"
+              />
+            </div>
+
+            <div class="flex flex-col justify-between rounded-xl border border-zinc-200/70 bg-zinc-50/60 p-3.5 dark:border-zinc-800 dark:bg-zinc-800/40">
+              <div class="flex items-center justify-between text-xs">
+                <span class="font-semibold">MCP API Key</span>
+                <div class="flex items-center gap-2">
+                  <button
+                    type="button"
+                    class="text-[11px] text-zinc-500 hover:text-zinc-900 dark:hover:text-zinc-200"
+                    @click="showApiKey = !showApiKey"
+                  >
+                    {{ showApiKey ? '隐藏' : '显示' }}
+                  </button>
+                  <button
+                    type="button"
+                    class="text-[11px] text-zinc-500 hover:text-zinc-900 dark:hover:text-zinc-200"
+                    @click="copyText(mcpApiKey, '已复制 MCP API Key')"
+                  >
+                    复制
+                  </button>
+                  <button
+                    type="button"
+                    class="text-[11px] text-orange-600 hover:text-orange-700"
+                    :disabled="savingMcp"
+                    @click="saveMcpSettings(true)"
+                  >
+                    重置密钥
+                  </button>
+                </div>
+              </div>
+              <div class="mt-1.5 truncate rounded-lg border border-zinc-200/80 bg-white px-2.5 py-1.5 font-mono text-xs text-zinc-800 dark:border-zinc-700 dark:bg-zinc-900 dark:text-zinc-200">
+                {{ showApiKey ? mcpApiKey : mcpApiKey.replace(/^(.{9}).*(.{4})$/, '$1••••••••••••••••$2') }}
+              </div>
+            </div>
+          </div>
+
+          <!-- 本机 CLI 自动写入状态 -->
+          <div class="rounded-xl border border-zinc-200/70 bg-zinc-50/40 p-3.5 dark:border-zinc-800 dark:bg-zinc-800/30">
+            <div class="flex items-center justify-between">
+              <span class="text-xs font-semibold">本机 Claude Code / Codex 自动写入状态</span>
+              <button
+                type="button"
+                class="rounded-lg border border-zinc-200 bg-white px-2.5 py-1 text-[11px] font-medium text-zinc-700 hover:bg-zinc-50 dark:border-zinc-700 dark:bg-zinc-800 dark:text-zinc-200"
+                @click="triggerCliSync"
+              >
+                立即同步到本机 CLI
+              </button>
+            </div>
+            <div class="mt-2.5 grid grid-cols-2 gap-2.5 text-xs">
+              <div class="flex items-center justify-between rounded-lg border border-zinc-200/60 bg-white px-3 py-2 dark:border-zinc-800 dark:bg-zinc-900">
+                <div>
+                  <div class="font-semibold">Claude Code</div>
+                  <div class="font-mono text-[10px] text-zinc-400">~/.claude.json</div>
+                </div>
+                <span
+                  class="rounded px-2 py-0.5 text-[10px] font-medium"
+                  :class="
+                    mcpStatus?.claudeCodeSynced
+                      ? 'bg-emerald-50 text-emerald-700 dark:bg-emerald-950/60 dark:text-emerald-400'
+                      : 'bg-zinc-100 text-zinc-500'
+                  "
+                >
+                  {{ mcpStatus?.claudeCodeSynced ? '✓ 已自动写入' : '未检测到' }}
+                </span>
+              </div>
+              <div class="flex items-center justify-between rounded-lg border border-zinc-200/60 bg-white px-3 py-2 dark:border-zinc-800 dark:bg-zinc-900">
+                <div>
+                  <div class="font-semibold">Codex CLI</div>
+                  <div class="font-mono text-[10px] text-zinc-400">~/.codex/config.toml</div>
+                </div>
+                <span
+                  class="rounded px-2 py-0.5 text-[10px] font-medium"
+                  :class="
+                    mcpStatus?.codexSynced
+                      ? 'bg-emerald-50 text-emerald-700 dark:bg-emerald-950/60 dark:text-emerald-400'
+                      : 'bg-zinc-100 text-zinc-500'
+                  "
+                >
+                  {{ mcpStatus?.codexSynced ? '✓ 已自动写入' : '未检测到' }}
+                </span>
+              </div>
+            </div>
+          </div>
+
+          <!-- 接入配置 JSON 预览（支持切换「远程 HTTP + API Key」与「本机 Stdio」） -->
+          <div>
+            <div class="mb-2 flex items-center justify-between">
+              <div class="flex items-center gap-2">
+                <span class="text-xs font-semibold">客户端接入配置预览</span>
+                <div class="flex rounded-lg bg-zinc-100 p-0.5 text-[11px] dark:bg-zinc-800">
+                  <button
+                    type="button"
+                    class="rounded-md px-2.5 py-0.5 font-medium transition"
+                    :class="
+                      configModePreview === 'remote'
+                        ? 'bg-white text-zinc-900 shadow-sm dark:bg-zinc-700 dark:text-zinc-100'
+                        : 'text-zinc-500'
+                    "
+                    @click="configModePreview = 'remote'"
+                  >
+                    远程 HTTP + API Key
+                  </button>
+                  <button
+                    type="button"
+                    class="rounded-md px-2.5 py-0.5 font-medium transition"
+                    :class="
+                      configModePreview === 'stdio'
+                        ? 'bg-white text-zinc-900 shadow-sm dark:bg-zinc-700 dark:text-zinc-100'
+                        : 'text-zinc-500'
+                    "
+                    @click="configModePreview = 'stdio'"
+                  >
+                    本机 Stdio
+                  </button>
+                </div>
+              </div>
+              <button
+                type="button"
+                class="rounded-lg bg-zinc-900 px-3 py-1 text-[11px] font-medium text-white hover:bg-zinc-800 dark:bg-zinc-100 dark:text-zinc-900"
+                @click="copyText(displayedMcpConfigJson, '已复制 MCP 配置 JSON')"
+              >
+                复制配置 JSON
+              </button>
+            </div>
+            <pre
+              class="overflow-x-auto rounded-xl border border-zinc-200/80 bg-zinc-950 p-3.5 font-mono text-[11px] leading-relaxed text-zinc-200 dark:border-zinc-800"
+            >{{ displayedMcpConfigJson }}</pre>
+          </div>
+        </section>
+
+        <!-- 板块 2：Web 登录安全与账号密码 -->
+        <section
+          class="space-y-4 rounded-2xl border border-zinc-200/80 bg-white/85 p-5 shadow-[0_2px_12px_rgba(0,0,0,0.02)] backdrop-blur-xl dark:border-zinc-800 dark:bg-zinc-900/85"
+        >
+          <div class="flex items-center justify-between border-b border-zinc-100 pb-3.5 dark:border-zinc-800">
+            <div>
+              <h3 class="text-sm font-semibold">Web 登录鉴权与账号密码</h3>
+              <p class="text-xs text-zinc-400">
+                本机运行可保持关闭免登录直进；部署在 VPS 公网环境时请开启登录保护
+              </p>
+            </div>
+            <label class="inline-flex items-center gap-2 cursor-pointer">
+              <span class="text-xs font-medium text-zinc-600 dark:text-zinc-300">
+                {{ settingAuthEnabled ? '需要密码登录' : '本机免登录' }}
+              </span>
+              <input
+                v-model="settingAuthEnabled"
+                type="checkbox"
+                class="h-4 w-4 rounded border-zinc-300 text-zinc-900"
+              />
+            </label>
+          </div>
+
+          <form class="grid gap-3 sm:grid-cols-[1fr_1fr_auto] sm:items-end" @submit.prevent="saveAuthSettings">
+            <div>
+              <label class="block text-xs font-medium text-zinc-600 dark:text-zinc-300">管理员账号</label>
+              <input
+                v-model="settingAdminUsername"
+                type="text"
+                placeholder="admin"
+                class="mt-1 w-full rounded-xl border border-zinc-200 bg-zinc-50/70 px-3 py-2 text-xs outline-none focus:border-zinc-400 focus:bg-white dark:border-zinc-700 dark:bg-zinc-800"
+              />
+            </div>
+            <div>
+              <label class="block text-xs font-medium text-zinc-600 dark:text-zinc-300">
+                管理员密码
+                <span v-if="hasAdminPassword" class="text-zinc-400">（已设置，留空保持不变）</span>
+              </label>
+              <input
+                v-model="settingAdminPassword"
+                type="password"
+                placeholder="设置或修改登录密码"
+                class="mt-1 w-full rounded-xl border border-zinc-200 bg-zinc-50/70 px-3 py-2 text-xs outline-none focus:border-zinc-400 focus:bg-white dark:border-zinc-700 dark:bg-zinc-800"
+              />
+            </div>
+            <button
+              type="submit"
+              :disabled="savingAuth"
+              class="rounded-xl bg-zinc-900 px-4 py-2 text-xs font-medium text-white transition hover:bg-zinc-800 disabled:opacity-50 dark:bg-zinc-100 dark:text-zinc-900"
+            >
+              {{ savingAuth ? '保存中...' : '保存登录设置' }}
+            </button>
+          </form>
+        </section>
+
+        <!-- 板块 3：外观与终端偏好 -->
+        <section
+          class="grid gap-3 rounded-2xl border border-zinc-200/80 bg-white/85 p-5 shadow-[0_2px_12px_rgba(0,0,0,0.02)] backdrop-blur-xl sm:grid-cols-2 dark:border-zinc-800 dark:bg-zinc-900/85"
+        >
+          <div class="flex items-center justify-between rounded-xl border border-zinc-200/70 bg-zinc-50/60 p-3.5 dark:border-zinc-800 dark:bg-zinc-800/40">
+            <div>
+              <div class="text-xs font-semibold">界面昼夜主题</div>
+              <div class="mt-0.5 text-[11px] text-zinc-400">日间白色毛玻璃 / 夜间深空黑毛玻璃</div>
+            </div>
+            <div class="flex rounded-xl bg-zinc-200/70 p-0.5 text-xs dark:bg-zinc-800">
+              <button
+                type="button"
+                class="rounded-lg px-2.5 py-1 font-medium transition"
+                :class="!isDark ? 'bg-white text-zinc-900 shadow-sm' : 'text-zinc-500'"
+                @click="applyTheme(false)"
+              >
+                ☀ 日间
+              </button>
+              <button
+                type="button"
+                class="rounded-lg px-2.5 py-1 font-medium transition"
+                :class="isDark ? 'bg-zinc-700 text-white shadow-sm' : 'text-zinc-500'"
+                @click="applyTheme(true)"
+              >
+                ☾ 夜间
+              </button>
+            </div>
+          </div>
+
+          <div class="flex items-center justify-between rounded-xl border border-zinc-200/70 bg-zinc-50/60 p-3.5 dark:border-zinc-800 dark:bg-zinc-800/40">
+            <div>
+              <div class="text-xs font-semibold">终端画布配色</div>
+              <div class="mt-0.5 text-[11px] text-zinc-400">独立切换终端区域的白底或黑底</div>
+            </div>
+            <div class="flex rounded-xl bg-zinc-200/70 p-0.5 text-xs dark:bg-zinc-800">
+              <button
+                type="button"
+                class="rounded-lg px-2.5 py-1 font-medium transition"
+                :class="!terminalDark ? 'bg-white text-zinc-900 shadow-sm' : 'text-zinc-500'"
+                @click="terminalDark = false"
+              >
+                白底
+              </button>
+              <button
+                type="button"
+                class="rounded-lg px-2.5 py-1 font-medium transition"
+                :class="terminalDark ? 'bg-zinc-700 text-white shadow-sm' : 'text-zinc-500'"
+                @click="terminalDark = true"
+              >
+                黑底
+              </button>
+            </div>
+          </div>
+        </section>
+      </div>
+    </main>
+
+    <!-- 页面 B：主工作台画布（仓库 + 终端/文件 + 右侧等宽栏） -->
+    <main v-show="activePage === 'workspace'" class="flex min-h-0 flex-1 items-stretch justify-center overflow-hidden p-4">
+      <div
+        class="flex h-full min-h-0 w-full items-stretch justify-center transition-all duration-300 ease-[cubic-bezier(0.22,1,0.36,1)]"
+        :class="hasCenterStage ? 'max-w-full' : 'max-w-6xl'"
+      >
+        <!-- 左栏：VPS 仓库 -->
+        <section
+          class="flex h-full min-h-0 flex-col overflow-hidden transition-all duration-300 ease-[cubic-bezier(0.22,1,0.36,1)]"
+          :class="hasCenterStage ? 'w-[336px] shrink-0' : 'min-w-0 flex-1'"
+        >
+          <div class="flex-1 space-y-2 overflow-y-auto pr-1">
+            <div
+              v-for="host in filteredHosts"
+              :key="host.id"
+              :draggable="host.kind !== 'local'"
+              class="group relative flex items-center justify-between gap-3 rounded-2xl border px-4 py-3.5 transition-all duration-200 cursor-pointer backdrop-blur-xl"
+              :class="[
+                stageHostId === host.id || (rightWing === 'detail' && detailHostId === host.id)
+                  ? 'border-zinc-900/25 bg-white shadow-[0_4px_20px_rgba(0,0,0,0.05)] ring-1 ring-zinc-900/10 dark:border-zinc-600 dark:bg-zinc-900 dark:ring-zinc-700'
+                  : 'border-zinc-200/80 bg-white/82 shadow-[0_1px_4px_rgba(0,0,0,0.02)] hover:border-zinc-300 hover:bg-white/95 dark:border-zinc-800/90 dark:bg-zinc-900/75 dark:hover:border-zinc-700 dark:hover:bg-zinc-900',
+                dragOverId === host.id ? 'border-dashed border-orange-400' : '',
+              ]"
+              @click="onCardClick(host)"
+              @dragstart="onDragStart($event, host)"
+              @dragover="onDragOver($event, host)"
+              @drop="onDrop($event, host)"
+              @dragend="onDragEnd"
+            >
+              <!-- 左半部 -->
+              <div class="flex min-w-0 items-center gap-3">
+                <span
+                  v-if="!hasCenterStage"
+                  class="flex h-6 w-3.5 shrink-0 items-center justify-center text-zinc-300 transition group-hover:text-zinc-400 dark:text-zinc-600 dark:group-hover:text-zinc-500"
+                  :class="host.kind === 'local' ? 'opacity-20 cursor-default' : 'cursor-grab'"
+                >
+                  <svg class="h-4 w-4" viewBox="0 0 24 24" fill="currentColor">
+                    <circle cx="9" cy="6" r="1.4" />
+                    <circle cx="15" cy="6" r="1.4" />
+                    <circle cx="9" cy="12" r="1.4" />
+                    <circle cx="15" cy="12" r="1.4" />
+                    <circle cx="9" cy="18" r="1.4" />
+                    <circle cx="15" cy="18" r="1.4" />
+                  </svg>
+                </span>
+
+                <OsBadge :os-info="host.osInfo" :kind="host.kind" :name="host.name" :size="hasCenterStage ? 'sm' : 'md'" />
+
+                <div class="min-w-0">
+                  <div class="flex items-center gap-2">
+                    <span
+                      class="h-2.5 w-2.5 shrink-0 rounded-full transition"
+                      :class="{
+                        'animate-pulse bg-amber-400': checkingIds.has(host.id),
+                        'bg-emerald-500 shadow-[0_0_8px_rgba(16,185,129,0.55)]':
+                          !checkingIds.has(host.id) && host.status === 'online',
+                        'bg-red-500 shadow-[0_0_8px_rgba(239,68,68,0.45)]':
+                          !checkingIds.has(host.id) && host.status === 'offline',
+                        'bg-zinc-300 dark:bg-zinc-600':
+                          !checkingIds.has(host.id) && host.status === 'unknown',
+                      }"
+                    />
+                    <span class="truncate text-sm font-semibold text-zinc-900 dark:text-zinc-100">
+                      {{ host.name }}
+                    </span>
+                    <span
+                      v-if="!hasCenterStage && host.pinned && host.kind !== 'local'"
+                      class="rounded-md bg-zinc-100 px-1.5 py-0.5 text-[10px] font-medium text-zinc-600 dark:bg-zinc-800 dark:text-zinc-300"
+                    >
+                      置顶
+                    </span>
+                    <span
+                      v-if="!hasCenterStage && host.role && ROLE_META[host.role]"
+                      class="rounded-md border border-zinc-200/80 bg-zinc-50 px-1.5 py-0.5 text-[10px] font-medium text-zinc-500 dark:border-zinc-700 dark:bg-zinc-800 dark:text-zinc-400"
+                    >
+                      {{ ROLE_META[host.role].label }}
+                    </span>
+                  </div>
+                  <div class="mt-0.5 flex items-center gap-2 truncate font-mono text-[11px] text-zinc-400 dark:text-zinc-500">
+                    <span class="truncate">
+                      {{
+                        host.kind === 'local'
+                          ? `${host.username}@127.0.0.1`
+                          : `${host.username}@${host.addr}:${host.port}`
+                      }}
+                    </span>
+                    <span v-if="!hasCenterStage && host.jumpHostName" class="text-[11px] text-zinc-400 dark:text-zinc-500">
+                      via {{ host.jumpHostName }}
+                    </span>
+                  </div>
+                </div>
+              </div>
+
+              <!-- 右半部：卡片上的快捷按钮 -->
+              <div class="flex shrink-0 items-center gap-1.5" @click.stop>
+                <button
+                  type="button"
+                  class="rounded-xl border px-2.5 py-1 text-xs font-medium transition"
+                  :class="
+                    stageHostId === host.id && centerStage === 'terminal'
+                      ? 'border-zinc-900 bg-zinc-900 text-white shadow-sm dark:border-zinc-100 dark:bg-zinc-100 dark:text-zinc-900'
+                      : 'border-zinc-200/80 bg-white text-zinc-700 hover:border-zinc-300 hover:bg-zinc-900 hover:text-white dark:border-zinc-700 dark:bg-zinc-800 dark:text-zinc-200 dark:hover:bg-zinc-100 dark:hover:text-zinc-900'
+                  "
+                  @click="openTerminalStage(host)"
+                >
+                  终端
+                </button>
+                <button
+                  type="button"
+                  class="rounded-xl border px-2.5 py-1 text-xs font-medium transition"
+                  :class="
+                    stageHostId === host.id && centerStage === 'files'
+                      ? 'border-zinc-900 bg-zinc-900 text-white shadow-sm dark:border-zinc-100 dark:bg-zinc-100 dark:text-zinc-900'
+                      : 'border-zinc-200/80 bg-white text-zinc-700 hover:border-zinc-300 hover:bg-zinc-100 dark:border-zinc-700 dark:bg-zinc-800 dark:text-zinc-200 dark:hover:bg-zinc-700'
+                  "
+                  @click="openFilesStage(host)"
+                >
+                  文件
+                </button>
+                <!-- 收藏按钮（五角星图标 ★） -->
+                <button
+                  v-if="!hasCenterStage"
+                  type="button"
+                  class="rounded-xl p-1.5 transition hover:bg-zinc-100 dark:hover:bg-zinc-800"
+                  :class="
+                    host.favorited
+                      ? 'text-amber-500 hover:text-amber-600'
+                      : 'text-zinc-400 hover:text-zinc-800 dark:hover:text-zinc-200'
+                  "
+                  :title="host.favorited ? '取消收藏' : '收藏主机'"
+                  @click="handlePatchMeta(host, { favorited: !host.favorited })"
+                >
+                  <svg
+                    class="h-4 w-4"
+                    :class="host.favorited ? 'fill-amber-400 text-amber-500' : 'fill-none'"
+                    viewBox="0 0 24 24"
+                    stroke="currentColor"
+                    stroke-width="1.8"
+                  >
+                    <path d="M12 2l3.09 6.26L22 9.27l-5 4.87 1.18 6.88L12 17.77l-6.18 3.25L7 14.14 2 9.27l6.91-1.01L12 2z" />
+                  </svg>
+                </button>
+                <!-- 置顶按钮（顶部横线 + 向上箭头图标 ⤒） -->
+                <button
+                  v-if="!hasCenterStage && host.kind !== 'local'"
+                  type="button"
+                  class="rounded-xl p-1.5 transition hover:bg-zinc-100 dark:hover:bg-zinc-800"
+                  :class="
+                    host.pinned
+                      ? 'bg-zinc-100 text-zinc-900 dark:bg-zinc-800 dark:text-zinc-100'
+                      : 'text-zinc-400 hover:text-zinc-800 dark:hover:text-zinc-200'
+                  "
+                  :title="host.pinned ? '取消置顶' : '置顶到列表顶部'"
+                  @click="handlePatchMeta(host, { pinned: !host.pinned })"
+                >
+                  <svg
+                    class="h-4 w-4"
+                    viewBox="0 0 24 24"
+                    fill="none"
+                    stroke="currentColor"
+                    stroke-width="2"
+                    stroke-linecap="round"
+                    stroke-linejoin="round"
+                  >
+                    <line x1="5" y1="4" x2="19" y2="4" />
+                    <line x1="12" y1="9" x2="12" y2="20" />
+                    <polyline points="7 14 12 9 17 14" />
+                  </svg>
+                </button>
+                <button
+                  v-if="!hasCenterStage"
+                  type="button"
+                  class="rounded-xl p-1.5 text-zinc-400 transition hover:bg-zinc-100 hover:text-zinc-800 dark:hover:bg-zinc-800 dark:hover:text-zinc-200"
+                  title="编辑主机"
+                  @click="openEditModal(host)"
+                >
+                  <svg class="h-4 w-4" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8">
+                    <path d="M12 20h9" />
+                    <path d="M16.5 3.5a2.12 2.12 0 0 1 3 3L7 19l-4 1 1-4L16.5 3.5z" />
+                  </svg>
+                </button>
+              </div>
+            </div>
+
+            <div
+              v-if="!loading && !filteredHosts.length"
+              class="rounded-2xl border border-dashed border-zinc-300/80 bg-white/60 p-10 text-center text-xs text-zinc-400 dark:border-zinc-800 dark:bg-zinc-900/40"
+            >
+              没有匹配的 VPS 主机
+            </div>
+          </div>
+        </section>
+
+        <!-- 中栏：主舞台 -->
+        <div
+          class="overflow-hidden transition-all duration-300 ease-[cubic-bezier(0.22,1,0.36,1)]"
+          :class="
+            hasCenterStage
+              ? 'ml-3.5 min-w-0 flex-1 opacity-100'
+              : 'ml-0 w-0 flex-none opacity-0 pointer-events-none'
+          "
+        >
+          <template v-for="tab in openTabs" :key="tab.hostId">
+            <div
+              v-if="hostById(tab.hostId)"
+              v-show="centerStage === 'terminal' && stageHostId === tab.hostId"
+              class="h-full w-full"
+            >
+              <TerminalStage
+                :host="hostById(tab.hostId)!"
+                :panes="tab.panes"
+                :split-direction="tab.splitDirection"
+                :dark="terminalDark"
+                :right-wing="detailHostId === tab.hostId ? rightWing : null"
+                :creating="creatingPane"
+                @split="handleSplitTerminal"
+                @close-pane="handleClosePane"
+                @toggle-dark="terminalDark = !terminalDark"
+                @toggle-right-wing="toggleRightWing"
+                @collapse-stage="switchToHomeView"
+                @meta-update="handlePaneMetaUpdate"
+              />
+            </div>
+          </template>
+
+          <FileBrowserPanel
+            v-if="stageHost && centerStage === 'files'"
+            :host="stageHost"
+            :compact="false"
+            :terminal-cwd="activeSessionTab?.panes[activeSessionTab.panes.length - 1]?.cwd"
+            :right-wing="detailHostId === stageHost.id ? rightWing : null"
+            @close="switchToHomeView"
+            @toggle-detail="toggleRightWing('detail')"
+            @toast="showToast"
+          />
+        </div>
+
+        <!-- 最右栏：与左栏完全等宽（336px）的辅助栏 -->
+        <div
+          class="shrink-0 overflow-hidden transition-all duration-300 ease-[cubic-bezier(0.22,1,0.36,1)]"
+          :class="
+            rightWing && rightWingHost
+              ? 'ml-3.5 w-[336px] opacity-100'
+              : 'ml-0 w-0 opacity-0 pointer-events-none'
+          "
+        >
+          <div class="h-full w-[336px]">
+            <HostDetailDrawer
+              v-if="rightWing === 'detail' && rightWingHost"
+              :host="rightWingHost"
+              :checking="checkingIds.has(rightWingHost.id)"
+              @close="rightWing = null"
+              @check="checkSingleHost"
+              @edit="openEditModal"
+              @delete="handleDeleteHost"
+              @open-terminal="openTerminalStage"
+              @open-files="openFilesStage"
+              @patch-meta="handlePatchMeta"
+              @host-updated="replaceHostInList"
+            />
+
+            <FileBrowserPanel
+              v-else-if="rightWing === 'files' && rightWingHost"
+              :host="rightWingHost"
+              :compact="true"
+              :terminal-cwd="activeSessionTab?.panes[activeSessionTab.panes.length - 1]?.cwd"
+              @close="rightWing = null"
+              @expand-full="openFilesStage(rightWingHost)"
+              @toast="showToast"
+            />
+          </div>
+        </div>
+      </div>
+    </main>
+
+    <!-- 新增 / 编辑主机弹窗 -->
+    <HostModal
+      :open="modalOpen"
+      :editing="editingHost"
+      :ssh-hosts="hosts"
+      @close="modalOpen = false"
+      @submit="handleModalSubmit"
+    />
+
+    <!-- 删除主机确认弹窗（替代原生 window.confirm） -->
+    <Teleport to="body">
+      <div
+        v-if="deletingHost"
+        class="fixed inset-0 z-50 flex items-center justify-center bg-zinc-900/25 p-4 backdrop-blur-sm"
+        @click.self="deletingHost = null"
+      >
+        <div
+          class="w-full max-w-sm rounded-2xl border border-zinc-200/90 bg-white/95 p-5 shadow-2xl backdrop-blur-xl dark:border-zinc-800 dark:bg-zinc-900/95 dark:text-zinc-100"
+        >
+          <h3 class="text-sm font-semibold">确认删除 VPS 主机</h3>
+          <p class="mt-2 text-xs leading-relaxed text-zinc-500 dark:text-zinc-400">
+            确定从仓库中删除「<strong class="text-zinc-900 dark:text-zinc-100">{{ deletingHost.name }}</strong>」({{ deletingHost.addr }}) 吗？此操作不可撤销。
+          </p>
+          <div class="mt-4 flex justify-end gap-2">
+            <button
+              type="button"
+              class="rounded-xl border border-zinc-200 bg-white px-3.5 py-1.5 text-xs font-medium text-zinc-700 hover:bg-zinc-50 dark:border-zinc-700 dark:bg-zinc-800 dark:text-zinc-200"
+              @click="deletingHost = null"
+            >
+              取消
+            </button>
+            <button
+              type="button"
+              class="rounded-xl bg-red-600 px-3.5 py-1.5 text-xs font-medium text-white hover:bg-red-700"
+              @click="confirmDeleteHost"
+            >
+              确认删除
+            </button>
+          </div>
+        </div>
+      </div>
+    </Teleport>
+
+    <!-- 轻量底部 Toast -->
+    <Transition
+      enter-active-class="transition duration-150 ease-out"
+      enter-from-class="opacity-0 -translate-y-2"
+      enter-to-class="opacity-100 translate-y-0"
+      leave-active-class="transition duration-150 ease-in"
+      leave-from-class="opacity-100 translate-y-0"
+      leave-to-class="opacity-0 -translate-y-2"
+    >
+      <div
+        v-if="toast"
+        class="fixed bottom-5 right-5 z-50 rounded-xl border px-3.5 py-2 text-xs font-medium shadow-lg backdrop-blur-xl"
+        :class="
+          toast.kind === 'err'
+            ? 'border-red-200 bg-white/95 text-red-700 dark:border-red-900 dark:bg-zinc-900/95 dark:text-red-400'
+            : 'border-zinc-200 bg-zinc-900/90 text-white dark:border-zinc-700 dark:bg-zinc-100/95 dark:text-zinc-900'
+        "
+      >
+        {{ toast.text }}
+      </div>
+    </Transition>
+  </div>
+</template>
diff --git a/frontend/src/components/BrandLogo.vue b/frontend/src/components/BrandLogo.vue
new file mode 100644
index 0000000..70e7ac5
--- /dev/null
+++ b/frontend/src/components/BrandLogo.vue
@@ -0,0 +1,44 @@
+<script setup lang="ts">
+defineProps<{
+  size?: 'sm' | 'md' | 'lg';
+}>();
+</script>
+
+<template>
+  <div
+    class=" relative inline-flex shrink-0 items-center justify-center overflow-hidden bg-zinc-900 shadow-[0_2px_8px_rgba(24,24,27,0.18)] ring-1 ring-black/5 dark:bg-zinc-100 dark:ring-white/10"
+    :class="{
+      'h-7 w-7 rounded-lg': !size || size === 'sm',
+      'h-9 w-9 rounded-xl': size === 'md',
+      'h-12 w-12 rounded-2xl': size === 'lg',
+    }"
+  >
+    <svg
+      class="h-[72%] w-[72%]"
+      viewBox="0 0 40 40"
+      fill="none"
+      xmlns="http://www.w3.org/2000/svg"
+    >
+      <!-- 左侧终端命令符 > -->
+      <path
+        d="M8.5 12.5L16.5 20L8.5 27.5"
+        class="stroke-white dark:stroke-zinc-900"
+        stroke-width="3.4"
+        stroke-linecap="round"
+        stroke-linejoin="round"
+      />
+      <!-- 右侧 Switch 胶囊拨杆轨道 -->
+      <rect
+        x="19.5"
+        y="14.5"
+        width="13"
+        height="11"
+        rx="5.5"
+        class="stroke-white/35 fill-white/10 dark:stroke-zinc-900/35 dark:fill-zinc-900/10"
+        stroke-width="2"
+      />
+      <!-- 激活态活力橙圆点（呼应右上角 + 与 Switch 概念） -->
+      <circle cx="27" cy="20" r="3.4" fill="#F97316" />
+    </svg>
+  </div>
+</template>
diff --git a/frontend/src/components/FileBrowserPanel.vue b/frontend/src/components/FileBrowserPanel.vue
new file mode 100644
index 0000000..e3e2dd5
--- /dev/null
+++ b/frontend/src/components/FileBrowserPanel.vue
@@ -0,0 +1,1244 @@
+<script setup lang="ts">
+import { computed, nextTick, onBeforeUnmount, onMounted, ref, watch } from 'vue';
+import type { FileEntry, PublicHost, TransferTask } from '../types';
+
+interface DirCacheItem {
+  path: string;
+  parent: string | null;
+  items: FileEntry[];
+  ts: number;
+}
+
+interface BreadcrumbSegment {
+  label: string;
+  path: string;
+}
+
+const ARCHIVE_SUFFIXES = [
+  '.tar.gz',
+  '.tgz',
+  '.tar.xz',
+  '.txz',
+  '.tar.bz2',
+  '.tbz2',
+  '.tar',
+  '.zip',
+  '.gz',
+];
+
+function isArchiveFile(item: FileEntry): boolean {
+  if (item.isDir) return false;
+  const lower = item.name.toLowerCase();
+  return ARCHIVE_SUFFIXES.some((s) => lower.endsWith(s));
+}
+
+// 全局内存目录缓存
+const globalDirCache = new Map<string, DirCacheItem>();
+const inflightPrefetch = new Set<string>();
+
+function makeCacheKey(hostId: string, path: string): string {
+  return `${hostId}::${path || '~'}`;
+}
+
+const props = defineProps<{
+  host: PublicHost;
+  compact?: boolean;
+  terminalCwd?: string | null;
+  rightWing?: 'detail' | 'files' | null;
+}>();
+
+const emit = defineEmits<{
+  close: [];
+  expandFull: [];
+  toggleDetail: [];
+  toast: [text: string, kind?: 'ok' | 'err'];
+}>();
+
+const currentPath = ref('');
+const pathInput = ref('');
+const editingPath = ref(false);
+const pathInputEl = ref<HTMLInputElement | null>(null);
+const parentPath = ref<string | null>(null);
+const items = ref<FileEntry[]>([]);
+const loading = ref(false);
+const busyActionPath = ref<string | null>(null);
+const highlightedPath = ref<string | null>(null);
+const listContainerRef = ref<HTMLDivElement | null>(null);
+const search = ref('');
+const showHidden = ref(true);
+const dragActive = ref(false);
+const fileInputRef = ref<HTMLInputElement | null>(null);
+
+let navSeq = 0;
+let activeAbort: AbortController | null = null;
+let hoverTimer: ReturnType<typeof setTimeout> | null = null;
+let highlightTimer: ReturnType<typeof setTimeout> | null = null;
+
+function focusAndHighlightItem(targetPath: string | null | undefined) {
+  if (!targetPath) return;
+  const norm = targetPath.replace(/\\/g, '/');
+  highlightedPath.value = norm;
+  if (highlightTimer) clearTimeout(highlightTimer);
+  highlightTimer = setTimeout(() => {
+    if (highlightedPath.value === norm) {
+      highlightedPath.value = null;
+    }
+  }, 4000);
+
+  void nextTick(() => {
+    const container = listContainerRef.value;
+    if (!container) return;
+    const rows = container.querySelectorAll<HTMLElement>('[data-entry-path]');
+    for (const el of rows) {
+      if (el.dataset.entryPath === norm) {
+        el.scrollIntoView({ behavior: 'smooth', block: 'nearest' });
+        break;
+      }
+    }
+  });
+}
+
+// 在线文件编辑状态
+const editorOpen = ref(false);
+const editorPath = ref('');
+const editorName = ref('');
+const editorContent = ref('');
+const editorLoading = ref(false);
+const editorSaving = ref(false);
+
+// 新建/重命名/删除确认条
+const inlinePrompt = ref<{
+  kind: 'mkdir' | 'touch' | 'rename' | 'delete';
+  title: string;
+  value: string;
+  target?: FileEntry;
+} | null>(null);
+
+// 实时传输队列
+const transfers = ref<TransferTask[]>([]);
+let pollTimer: ReturnType<typeof setInterval> | null = null;
+
+// 可点击的面包屑分段：如 /root/123 -> [/] [root] [123]；本机 Windows -> [此电脑] [E:] [1shell4.7]
+const breadcrumbs = computed<BreadcrumbSegment[]>(() => {
+  const p = currentPath.value.trim();
+  const isLocalWin = props.host.kind === 'local';
+
+  if (isLocalWin) {
+    const crumbs: BreadcrumbSegment[] = [{ label: '此电脑', path: 'drives' }];
+    if (!p || p === 'drives') return crumbs;
+    const norm = p.replace(/\\/g, '/').replace(/\/+$/, '');
+    const parts = norm.split('/').filter(Boolean);
+    let acc = '';
+    for (let i = 0; i < parts.length; i++) {
+      const seg = parts[i];
+      if (i === 0 && seg.endsWith(':')) {
+        acc = `${seg}/`;
+        crumbs.push({ label: seg, path: acc });
+      } else {
+        acc = acc.endsWith('/') ? `${acc}${seg}` : `${acc}/${seg}`;
+        crumbs.push({ label: seg, path: acc });
+      }
+    }
+    return crumbs;
+  }
+
+  // Linux / POSIX 路径
+  const crumbs: BreadcrumbSegment[] = [{ label: '/', path: '/' }];
+  if (!p || p === '/') return crumbs;
+  const parts = p.split('/').filter(Boolean);
+  let acc = '';
+  for (const seg of parts) {
+    acc = `${acc}/${seg}`;
+    crumbs.push({ label: seg, path: acc });
+  }
+  return crumbs;
+});
+
+const visibleItems = computed(() => {
+  const q = search.value.trim().toLowerCase();
+  return items.value.filter((item) => {
+    if (!showHidden.value && item.name.startsWith('.')) return false;
+    if (!q) return true;
+    return item.name.toLowerCase().includes(q);
+  });
+});
+
+function formatBytes(bytes: number): string {
+  if (!bytes || bytes <= 0) return '0 B';
+  const units = ['B', 'KB', 'MB', 'GB', 'TB'];
+  const i = Math.min(Math.floor(Math.log(bytes) / Math.log(1024)), units.length - 1);
+  const val = bytes / Math.pow(1024, i);
+  return `${val >= 100 || i === 0 ? val.toFixed(0) : val.toFixed(1)} ${units[i]}`;
+}
+
+function formatSpeed(bps: number): string {
+  if (!bps || bps <= 0) return '计算中...';
+  return `${formatBytes(bps)}/s`;
+}
+
+function formatTime(ms: number): string {
+  if (!ms) return '';
+  const d = new Date(ms);
+  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')} ${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}`;
+}
+
+function joinPath(dir: string, name: string): string {
+  const cleanDir = dir.replace(/\/+$/, '');
+  if (!cleanDir || cleanDir === '/') return `/${name}`;
+  return `${cleanDir}/${name}`;
+}
+
+function computeOptimisticParent(p: string): string | null {
+  if (!p || p === '/' || p === 'drives') return null;
+  if (/^[A-Za-z]:\/?$/.test(p)) return 'drives';
+  const idx = p.lastIndexOf('/');
+  if (idx < 0) return null;
+  if (idx === 0) return '/';
+  const sub = p.slice(0, idx);
+  return /^[A-Za-z]:$/.test(sub) ? `${sub}/` : sub;
+}
+
+function storeDirCache(hostId: string, requestedPath: string, data: DirCacheItem) {
+  globalDirCache.set(makeCacheKey(hostId, data.path), data);
+  if (requestedPath !== data.path) {
+    globalDirCache.set(makeCacheKey(hostId, requestedPath), data);
+  }
+}
+
+async function prefetchDir(targetPath: string | null | undefined) {
+  if (!targetPath) return;
+  const hostId = props.host.id;
+  const key = makeCacheKey(hostId, targetPath);
+  const existing = globalDirCache.get(key);
+  if (existing && Date.now() - existing.ts < 30_000) return;
+  if (inflightPrefetch.has(key)) return;
+
+  inflightPrefetch.add(key);
+  try {
+    const url = `/api/files/list?hostId=${encodeURIComponent(hostId)}&path=${encodeURIComponent(targetPath)}`;
+    const res = await fetch(url);
+    const data = await res.json();
+    if (data.ok) {
+      storeDirCache(hostId, targetPath, {
+        path: data.path,
+        parent: data.parent || null,
+        items: data.items || [],
+        ts: Date.now(),
+      });
+    }
+  } catch {
+    // ignore
+  } finally {
+    inflightPrefetch.delete(key);
+  }
+}
+
+function onRowMouseEnter(item: FileEntry) {
+  if (!item.isDir) return;
+  if (hoverTimer) clearTimeout(hoverTimer);
+  hoverTimer = setTimeout(() => {
+    void prefetchDir(item.path);
+  }, 45);
+}
+
+function onRowMouseLeave() {
+  if (hoverTimer) {
+    clearTimeout(hoverTimer);
+    hoverTimer = null;
+  }
+}
+
+function invalidateCache(hostId: string, path: string) {
+  globalDirCache.delete(makeCacheKey(hostId, path));
+}
+
+async function startEditPath() {
+  pathInput.value = currentPath.value === 'drives' ? '' : currentPath.value;
+  editingPath.value = true;
+  await nextTick();
+  pathInputEl.value?.focus();
+  pathInputEl.value?.select();
+}
+
+function submitPathInput() {
+  editingPath.value = false;
+  const target = pathInput.value.trim();
+  if (target && target !== currentPath.value) {
+    void loadDir(target);
+  }
+}
+
+async function loadDir(
+  targetPath?: string,
+  opts: { forceRefresh?: boolean; silentKeepList?: boolean } = {}
+) {
+  const hostId = props.host.id;
+  const reqPath = (targetPath !== undefined ? targetPath : currentPath.value).trim();
+  const isSameDir = reqPath === currentPath.value && items.value.length > 0;
+  const seq = ++navSeq;
+
+  if (activeAbort) {
+    activeAbort.abort();
+    activeAbort = null;
+  }
+
+  editingPath.value = false;
+  if (!isSameDir) {
+    search.value = '';
+    highlightedPath.value = null;
+  }
+  inlinePrompt.value = null;
+
+  if (reqPath && !isSameDir) {
+    currentPath.value = reqPath;
+    pathInput.value = reqPath;
+    parentPath.value = computeOptimisticParent(reqPath);
+  }
+
+  const cached = !opts.forceRefresh ? globalDirCache.get(makeCacheKey(hostId, reqPath)) : undefined;
+  if (cached) {
+    currentPath.value = cached.path;
+    pathInput.value = cached.path;
+    parentPath.value = cached.parent;
+    items.value = cached.items;
+    loading.value = false;
+    if (Date.now() - cached.ts < 15_000) {
+      if (cached.parent) void prefetchDir(cached.parent);
+      return;
+    }
+  } else if (!isSameDir && !opts.silentKeepList) {
+    // 只有跨目录跳转且无缓存时才清空显示骨架屏；同目录刷新（如压缩/解压/新建/改名后）保持原列表原地无感更新，绝不闪屏！
+    items.value = [];
+    loading.value = true;
+  } else {
+    loading.value = true;
+  }
+
+  const controller = new AbortController();
+  activeAbort = controller;
+
+  try {
+    const refreshParam = opts.forceRefresh ? '&refresh=true' : '';
+    const url = `/api/files/list?hostId=${encodeURIComponent(hostId)}&path=${encodeURIComponent(reqPath)}${refreshParam}`;
+    const res = await fetch(url, { signal: controller.signal });
+    const data = await res.json();
+    if (seq !== navSeq) return;
+
+    if (!data.ok) {
+      emit('toast', data.error || '读取目录失败', 'err');
+      loading.value = false;
+      return;
+    }
+
+    const entry: DirCacheItem = {
+      path: data.path,
+      parent: data.parent || null,
+      items: data.items || [],
+      ts: Date.now(),
+    };
+    storeDirCache(hostId, reqPath, entry);
+
+    currentPath.value = entry.path;
+    pathInput.value = entry.path;
+    parentPath.value = entry.parent;
+    items.value = entry.items;
+    loading.value = false;
+
+    if (entry.parent) {
+      void prefetchDir(entry.parent);
+    }
+  } catch (e) {
+    if ((e as Error).name === 'AbortError') return;
+    if (seq !== navSeq) return;
+    loading.value = false;
+    emit('toast', `读取目录失败: ${(e as Error).message}`, 'err');
+  }
+}
+
+// 压缩文件或文件夹
+async function handleCompress(item: FileEntry) {
+  if (busyActionPath.value) return;
+  busyActionPath.value = item.path;
+  emit('toast', `正在压缩 ${item.name}...`);
+  try {
+    const res = await fetch('/api/files/compress', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        hostId: props.host.id,
+        path: item.path,
+      }),
+    });
+    const data = await res.json();
+    if (!data.ok) {
+      emit('toast', data.error || '压缩失败', 'err');
+      return;
+    }
+    invalidateCache(props.host.id, currentPath.value);
+    await loadDir(currentPath.value, { forceRefresh: true, silentKeepList: true });
+    focusAndHighlightItem(data.path);
+    emit('toast', `已压缩生成 ${data.path.split('/').pop()}`);
+  } catch (e) {
+    emit('toast', `压缩失败: ${(e as Error).message}`, 'err');
+  } finally {
+    busyActionPath.value = null;
+  }
+}
+
+// 解压归档文件
+async function handleExtract(item: FileEntry) {
+  if (busyActionPath.value) return;
+  busyActionPath.value = item.path;
+  emit('toast', `正在解压 ${item.name}...`);
+  try {
+    const res = await fetch('/api/files/extract', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        hostId: props.host.id,
+        path: item.path,
+      }),
+    });
+    const data = await res.json();
+    if (!data.ok) {
+      emit('toast', data.error || '解压失败', 'err');
+      return;
+    }
+    invalidateCache(props.host.id, currentPath.value);
+    await loadDir(currentPath.value, { forceRefresh: true, silentKeepList: true });
+    focusAndHighlightItem(data.path);
+    emit('toast', `已解压至 ${data.path.split('/').pop()}`);
+  } catch (e) {
+    emit('toast', `解压失败: ${(e as Error).message}`, 'err');
+  } finally {
+    busyActionPath.value = null;
+  }
+}
+
+async function fetchTransfers() {
+  try {
+    const res = await fetch(`/api/transfers?hostId=${encodeURIComponent(props.host.id)}`);
+    const data = await res.json();
+    if (data.ok && Array.isArray(data.tasks)) {
+      transfers.value = data.tasks;
+      const hasRunning = data.tasks.some((t: TransferTask) => t.state === 'running');
+      if (!hasRunning && pollTimer) {
+        clearInterval(pollTimer);
+        pollTimer = null;
+      }
+    }
+  } catch {
+    // ignore
+  }
+}
+
+function ensureTransferPolling() {
+  void fetchTransfers();
+  if (pollTimer) return;
+  pollTimer = setInterval(() => {
+    void fetchTransfers();
+  }, 350);
+}
+
+async function clearCompletedTransfers() {
+  await fetch('/api/transfers', { method: 'DELETE' });
+  await fetchTransfers();
+}
+
+function onEntryClick(item: FileEntry) {
+  if (item.isDir) {
+    void loadDir(item.path);
+  } else {
+    void openFileEditor(item);
+  }
+}
+
+async function openFileEditor(item: FileEntry) {
+  editorOpen.value = true;
+  editorPath.value = item.path;
+  editorName.value = item.name;
+  editorContent.value = '';
+  editorLoading.value = true;
+  try {
+    const url = `/api/files/read?hostId=${encodeURIComponent(props.host.id)}&path=${encodeURIComponent(item.path)}`;
+    const res = await fetch(url);
+    const data = await res.json();
+    if (!data.ok) {
+      emit('toast', data.error || '打开文件失败', 'err');
+      editorOpen.value = false;
+      return;
+    }
+    editorContent.value = data.content || '';
+  } catch (e) {
+    emit('toast', `读取文件失败: ${(e as Error).message}`, 'err');
+    editorOpen.value = false;
+  } finally {
+    editorLoading.value = false;
+  }
+}
+
+async function saveFileEditor() {
+  if (!editorPath.value || editorSaving.value) return;
+  editorSaving.value = true;
+  try {
+    const res = await fetch('/api/files/write', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        hostId: props.host.id,
+        path: editorPath.value,
+        content: editorContent.value,
+      }),
+    });
+    const data = await res.json();
+    if (!data.ok) {
+      emit('toast', data.error || '保存失败', 'err');
+      return;
+    }
+    emit('toast', `已保存 ${editorName.value}`);
+    invalidateCache(props.host.id, currentPath.value);
+    void loadDir(currentPath.value, { forceRefresh: true });
+  } catch (e) {
+    emit('toast', `保存失败: ${(e as Error).message}`, 'err');
+  } finally {
+    editorSaving.value = false;
+  }
+}
+
+function triggerDownload(item: FileEntry) {
+  if (item.isDir) return;
+  ensureTransferPolling();
+  const url = `/api/files/download?hostId=${encodeURIComponent(props.host.id)}&path=${encodeURIComponent(item.path)}`;
+  const a = document.createElement('a');
+  a.href = url;
+  a.download = item.name;
+  document.body.appendChild(a);
+  a.click();
+  document.body.removeChild(a);
+}
+
+function copyEntryPath(path: string) {
+  void navigator.clipboard.writeText(path);
+  emit('toast', `已复制路径: ${path}`);
+}
+
+function triggerUploadPicker() {
+  fileInputRef.value?.click();
+}
+
+async function uploadFiles(fileList: FileList | File[]) {
+  const arr = Array.from(fileList);
+  if (!arr.length || !currentPath.value || currentPath.value === 'drives') return;
+  ensureTransferPolling();
+
+  for (const file of arr) {
+    const q = new URLSearchParams({
+      hostId: props.host.id,
+      dirPath: currentPath.value,
+      filename: file.name,
+      size: String(file.size),
+    });
+    try {
+      const res = await fetch(`/api/files/upload?${q.toString()}`, {
+        method: 'POST',
+        body: file,
+      });
+      const data = await res.json();
+      if (!data.ok) {
+        emit('toast', `${file.name} 上传失败: ${data.error}`, 'err');
+      } else {
+        emit('toast', `${file.name} 上传完成`);
+      }
+    } catch (e) {
+      emit('toast', `${file.name} 上传失败: ${(e as Error).message}`, 'err');
+    }
+  }
+  invalidateCache(props.host.id, currentPath.value);
+  await fetchTransfers();
+  await loadDir(currentPath.value, { forceRefresh: true });
+}
+
+function onFileInputChange(e: Event) {
+  const input = e.target as HTMLInputElement;
+  if (input.files && input.files.length) {
+    void uploadFiles(input.files);
+    input.value = '';
+  }
+}
+
+function onDropFiles(e: DragEvent) {
+  e.preventDefault();
+  dragActive.value = false;
+  if (e.dataTransfer?.files?.length) {
+    void uploadFiles(e.dataTransfer.files);
+  }
+}
+
+function openInlineAction(
+  kind: 'mkdir' | 'touch' | 'rename' | 'delete',
+  target?: FileEntry
+) {
+  if (kind === 'mkdir') {
+    inlinePrompt.value = { kind, title: '新建文件夹名称', value: '' };
+  } else if (kind === 'touch') {
+    inlinePrompt.value = { kind, title: '新建文件名称', value: '' };
+  } else if (kind === 'rename' && target) {
+    inlinePrompt.value = { kind, title: `重命名 ${target.name}`, value: target.name, target };
+  } else if (kind === 'delete' && target) {
+    inlinePrompt.value = {
+      kind,
+      title: `确认删除${target.isDir ? '目录' : '文件'}「${target.name}」？`,
+      value: target.name,
+      target,
+    };
+  }
+}
+
+async function submitInlineAction() {
+  const act = inlinePrompt.value;
+  if (!act) return;
+  const val = act.value.trim();
+
+  let highlightTarget: string | null = null;
+  try {
+    if (act.kind === 'mkdir') {
+      if (!val) return;
+      const target = joinPath(currentPath.value, val);
+      const res = await fetch('/api/files/mkdir', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          hostId: props.host.id,
+          path: target,
+        }),
+      });
+      const data = await res.json();
+      if (!data.ok) throw new Error(data.error);
+      highlightTarget = target;
+      emit('toast', `已创建目录 ${val}`);
+    } else if (act.kind === 'touch') {
+      if (!val) return;
+      const newPath = joinPath(currentPath.value, val);
+      const res = await fetch('/api/files/write', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          hostId: props.host.id,
+          path: newPath,
+          content: '',
+        }),
+      });
+      const data = await res.json();
+      if (!data.ok) throw new Error(data.error);
+      highlightTarget = newPath;
+      emit('toast', `已创建文件 ${val}`);
+    } else if (act.kind === 'rename' && act.target) {
+      if (!val || val === act.target.name) {
+        inlinePrompt.value = null;
+        return;
+      }
+      const newPath = joinPath(currentPath.value, val);
+      const res = await fetch('/api/files/rename', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          hostId: props.host.id,
+          oldPath: act.target.path,
+          newPath,
+        }),
+      });
+      const data = await res.json();
+      if (!data.ok) throw new Error(data.error);
+      highlightTarget = newPath;
+      emit('toast', `已重命名为 ${val}`);
+    } else if (act.kind === 'delete' && act.target) {
+      const res = await fetch('/api/files/remove', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          hostId: props.host.id,
+          path: act.target.path,
+          isDir: act.target.isDir,
+        }),
+      });
+      const data = await res.json();
+      if (!data.ok) throw new Error(data.error);
+      if (editorPath.value === act.target.path) {
+        editorOpen.value = false;
+      }
+      emit('toast', `已删除 ${act.target.name}`);
+    }
+    inlinePrompt.value = null;
+    invalidateCache(props.host.id, currentPath.value);
+    await loadDir(currentPath.value, { forceRefresh: true, silentKeepList: true });
+    if (highlightTarget) {
+      focusAndHighlightItem(highlightTarget);
+    }
+  } catch (e) {
+    emit('toast', (e as Error).message || '操作失败', 'err');
+  }
+}
+
+watch(
+  () => props.host.id,
+  () => {
+    editorOpen.value = false;
+    items.value = [];
+    currentPath.value = props.terminalCwd || '';
+    pathInput.value = currentPath.value;
+    void loadDir(currentPath.value);
+    void fetchTransfers();
+  }
+);
+
+onMounted(() => {
+  currentPath.value = props.terminalCwd || '';
+  pathInput.value = currentPath.value;
+  void loadDir(currentPath.value);
+  void fetchTransfers();
+});
+
+onBeforeUnmount(() => {
+  if (activeAbort) activeAbort.abort();
+  if (hoverTimer) clearTimeout(hoverTimer);
+  if (pollTimer) {
+    clearInterval(pollTimer);
+    pollTimer = null;
+  }
+});
+</script>
+
+<template>
+  <section
+    class="relative flex h-full w-full flex-col overflow-hidden rounded-2xl border border-zinc-200/80 bg-white/90 shadow-[0_4px_20px_rgba(0,0,0,0.03)] backdrop-blur-xl dark:border-zinc-800 dark:bg-zinc-900/90 [&_div.bg-white]:dark:bg-zinc-900 [&_input.bg-white]:dark:bg-zinc-800 [&_input.bg-white]:dark:border-zinc-700 [&_input.bg-white]:dark:text-zinc-100 [&_button.bg-white]:dark:bg-zinc-800 [&_button.bg-white]:dark:border-zinc-700 [&_button.bg-white]:dark:text-zinc-200 [&_span.text-zinc-800]:dark:text-zinc-200 [&_span.text-zinc-900]:dark:text-zinc-100"
+    @dragover.prevent="dragActive = true"
+    @dragleave.self="dragActive = false"
+    @drop="onDropFiles"
+  >
+    <input
+      ref="fileInputRef"
+      type="file"
+      multiple
+      class="hidden"
+      @change="onFileInputChange"
+    />
+
+    <!-- 拖拽上传高亮遮罩 -->
+    <div
+      v-if="dragActive"
+      class="pointer-events-none absolute inset-2 z-40 flex flex-col items-center justify-center rounded-xl border-2 border-dashed border-zinc-900/40 bg-white/90 backdrop-blur-sm"
+    >
+      <p class="text-sm font-semibold text-zinc-900">松开鼠标直接满速上传至当前目录</p>
+      <p class="mt-1 font-mono text-xs text-zinc-500">{{ currentPath }}</p>
+    </div>
+
+    <!-- 顶部栏 -->
+    <div class="flex shrink-0 items-center justify-between gap-2 border-b border-zinc-100 px-3.5 py-2.5">
+      <div class="flex min-w-0 items-center gap-2">
+        <svg class="h-4 w-4 shrink-0 text-zinc-700" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+          <path d="M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v8a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V7z" />
+        </svg>
+        <span class="truncate text-sm font-semibold text-zinc-900">
+          {{ compact ? `${host.name} · 文件` : `${host.name} · 文件管理器` }}
+        </span>
+      </div>
+
+      <div class="flex shrink-0 items-center gap-1">
+        <button
+          v-if="terminalCwd && terminalCwd !== currentPath"
+          type="button"
+          class="rounded-lg border border-zinc-200/80 bg-zinc-50 px-2 py-1 text-[11px] font-medium text-zinc-600 hover:bg-zinc-100 hover:text-zinc-900"
+          :title="`跳转到终端当前目录: ${terminalCwd}`"
+          @click="loadDir(terminalCwd)"
+        >
+          同步终端目录
+        </button>
+        <button
+          v-if="compact"
+          type="button"
+          class="rounded-lg px-2 py-1 text-xs font-medium text-zinc-600 hover:bg-zinc-100 hover:text-zinc-900"
+          title="在主舞台全宽展开文件浏览器"
+          @click="emit('expandFull')"
+        >
+          全屏展开
+        </button>
+        <button
+          v-if="!compact"
+          type="button"
+          class="inline-flex items-center gap-1.5 rounded-xl border px-2.5 py-1 text-xs font-medium transition"
+          :class="
+            rightWing === 'detail'
+              ? 'border-zinc-900 bg-zinc-900 text-white shadow-sm'
+              : 'border-zinc-200/80 bg-white text-zinc-600 hover:bg-zinc-100 hover:text-zinc-900'
+          "
+          @click="emit('toggleDetail')"
+        >
+          <span>详情图表</span>
+        </button>
+        <button
+          type="button"
+          class="rounded-lg p-1 text-zinc-400 hover:bg-zinc-100 hover:text-zinc-700"
+          @click="emit('close')"
+        >
+          ✕
+        </button>
+      </div>
+    </div>
+
+    <!-- 工具条：上级按钮 + 刷新 + 可点击面包屑路径栏 + 上传 -->
+    <div class="flex shrink-0 flex-col gap-2 border-b border-zinc-100 bg-zinc-50/50 px-3 py-2">
+      <div class="flex items-center gap-1.5">
+        <button
+          type="button"
+          class="rounded-lg border border-zinc-200/80 bg-white p-1.5 text-zinc-600 hover:bg-zinc-100 disabled:opacity-40"
+          :disabled="!parentPath"
+          title="返回上级目录"
+          @mouseenter="prefetchDir(parentPath)"
+          @click="parentPath && loadDir(parentPath)"
+        >
+          <svg class="h-3.5 w-3.5" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+            <path d="M18 15l-6-6-6 6" />
+          </svg>
+        </button>
+        <button
+          type="button"
+          class="rounded-lg border border-zinc-200/80 bg-white p-1.5 text-zinc-600 hover:bg-zinc-100"
+          title="强制刷新当前目录"
+          @click="loadDir(currentPath, { forceRefresh: true })"
+        >
+          <svg
+            class="h-3.5 w-3.5"
+            :class="{ 'animate-spin': loading }"
+            viewBox="0 0 24 24"
+            fill="none"
+            stroke="currentColor"
+            stroke-width="2"
+          >
+            <path d="M21 12a9 9 0 1 1-3-6.7" />
+            <path d="M21 3v6h-6" />
+          </svg>
+        </button>
+
+        <!-- 可点击的面包屑路径栏（如 / › root › 123，点任意一级直接跳转；点右侧空白处切换为手输路径） -->
+        <form
+          v-if="editingPath"
+          class="min-w-0 flex-1"
+          @submit.prevent="submitPathInput"
+        >
+          <input
+            ref="pathInputEl"
+            v-model="pathInput"
+            type="text"
+            class="w-full rounded-lg border border-zinc-400 bg-white px-2.5 py-1 font-mono text-xs text-zinc-900 outline-none"
+            placeholder="输入完整路径回车跳转..."
+            @blur="editingPath = false"
+            @keydown.esc.stop="editingPath = false"
+          />
+        </form>
+        <div
+          v-else
+          class="flex min-w-0 flex-1 items-center gap-0.5 overflow-x-auto rounded-lg border border-zinc-200/80 bg-white px-2 py-1 font-mono text-xs text-zinc-700 cursor-text"
+          title="点击路径分段直接跳转，点击空白处手动输入路径"
+          @click.self="startEditPath"
+        >
+          <template v-for="(crumb, idx) in breadcrumbs" :key="crumb.path">
+            <span v-if="idx > 0" class="px-0.5 text-zinc-300 select-none">/</span>
+            <button
+              type="button"
+              class="shrink-0 rounded px-1 py-0.2 transition hover:bg-zinc-100 hover:text-zinc-950"
+              :class="idx === breadcrumbs.length - 1 ? 'font-semibold text-zinc-900' : 'text-zinc-600'"
+              @mouseenter="prefetchDir(crumb.path)"
+              @click.stop="loadDir(crumb.path)"
+            >
+              {{ crumb.label }}
+            </button>
+          </template>
+          <span class="min-w-[16px] flex-1 self-stretch" @click="startEditPath" />
+        </div>
+
+        <button
+          v-if="currentPath !== 'drives'"
+          type="button"
+          class="inline-flex shrink-0 items-center gap-1 rounded-lg bg-zinc-900 px-2.5 py-1 text-xs font-medium text-white shadow-sm hover:bg-zinc-800"
+          title="选择文件上传（或直接拖拽文件到此面板）"
+          @click="triggerUploadPicker"
+        >
+          <svg class="h-3.5 w-3.5" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+            <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" />
+            <polyline points="17 8 12 3 7 8" />
+            <line x1="12" y1="3" x2="12" y2="15" />
+          </svg>
+          <span v-if="!compact">上传</span>
+        </button>
+      </div>
+
+      <div v-if="currentPath !== 'drives'" class="flex items-center gap-1.5">
+        <div class="relative min-w-0 flex-1">
+          <input
+            v-model="search"
+            type="text"
+            placeholder="过滤当前目录文件..."
+            class="w-full rounded-lg border border-zinc-200/70 bg-white px-2.5 py-1 text-xs text-zinc-800 outline-none focus:border-zinc-400"
+          />
+        </div>
+        <button
+          type="button"
+          class="rounded-lg border border-zinc-200/80 bg-white px-2 py-1 text-[11px] font-medium text-zinc-600 hover:bg-zinc-100"
+          @click="openInlineAction('mkdir')"
+        >
+          +目录
+        </button>
+        <button
+          type="button"
+          class="rounded-lg border border-zinc-200/80 bg-white px-2 py-1 text-[11px] font-medium text-zinc-600 hover:bg-zinc-100"
+          @click="openInlineAction('touch')"
+        >
+          +文件
+        </button>
+        <button
+          type="button"
+          class="rounded-lg border px-2 py-1 text-[11px] font-medium transition"
+          :class="
+            showHidden
+              ? 'border-zinc-300 bg-zinc-200/70 text-zinc-900'
+              : 'border-zinc-200/80 bg-white text-zinc-400'
+          "
+          @click="showHidden = !showHidden"
+        >
+          .*
+        </button>
+      </div>
+
+      <!-- 行内新建 / 重命名 / 删除确认条 -->
+      <form
+        v-if="inlinePrompt"
+        class="flex items-center gap-1.5 rounded-xl border border-zinc-300 bg-white p-2 shadow-sm"
+        @submit.prevent="submitInlineAction"
+      >
+        <span class="shrink-0 text-xs font-medium text-zinc-700">{{ inlinePrompt.title }}</span>
+        <input
+          v-if="inlinePrompt.kind !== 'delete'"
+          v-model="inlinePrompt.value"
+          type="text"
+          autofocus
+          class="min-w-0 flex-1 rounded-lg border border-zinc-200 px-2 py-1 font-mono text-xs outline-none focus:border-zinc-400"
+        />
+        <div class="ml-auto flex shrink-0 items-center gap-1">
+          <button
+            type="submit"
+            class="rounded-lg px-2.5 py-1 text-xs font-medium text-white"
+            :class="inlinePrompt.kind === 'delete' ? 'bg-red-600 hover:bg-red-700' : 'bg-zinc-900 hover:bg-zinc-800'"
+          >
+            确认
+          </button>
+          <button
+            type="button"
+            class="rounded-lg px-2 py-1 text-xs text-zinc-500 hover:bg-zinc-100"
+            @click="inlinePrompt = null"
+          >
+            取消
+          </button>
+        </div>
+      </form>
+    </div>
+
+    <!-- 主体区：文件列表 + 内联编辑器 -->
+    <div class="flex min-h-0 flex-1 divide-zinc-100 overflow-hidden" :class="!compact && editorOpen ? 'divide-x' : ''">
+      <!-- 文件列表 -->
+      <div
+        ref="listContainerRef"
+        v-show="!(compact && editorOpen)"
+        class="flex min-h-0 flex-1 flex-col overflow-y-auto px-2 py-1.5"
+      >
+        <!-- 加载中骨架屏 -->
+        <div v-if="loading && !items.length" class="space-y-1.5 p-2">
+          <div
+            v-for="n in 8"
+            :key="n"
+            class="flex items-center justify-between rounded-xl px-2.5 py-2"
+          >
+            <div class="flex items-center gap-2.5">
+              <div class="h-4 w-4 animate-pulse rounded bg-zinc-200/80" />
+              <div class="h-3.5 w-36 animate-pulse rounded bg-zinc-200/70" />
+            </div>
+            <div class="h-3 w-12 animate-pulse rounded bg-zinc-100" />
+          </div>
+        </div>
+
+        <template v-else>
+          <!-- 顶部第一行固定：.. / ... 返回上一级目录（包括从 /root 回到 /，从 C:/ 回到 此电脑盘符列表） -->
+          <div
+            v-if="parentPath"
+            class="group flex items-center justify-between gap-2 rounded-xl px-2.5 py-1.5 text-xs font-medium text-zinc-600 transition cursor-pointer hover:bg-zinc-100/80 hover:text-zinc-900"
+            @mouseenter="prefetchDir(parentPath)"
+            @click="loadDir(parentPath)"
+          >
+            <div class="flex items-center gap-2">
+              <svg
+                class="h-4 w-4 shrink-0 text-zinc-500"
+                viewBox="0 0 24 24"
+                fill="none"
+                stroke="currentColor"
+                stroke-width="2"
+              >
+                <path d="M9 14l-4-4 4-4" />
+                <path d="M5 10h11a4 4 0 1 1 0 8h-1" />
+              </svg>
+              <span class="font-mono font-semibold">..</span>
+              <span class="text-[11px] text-zinc-400">
+                {{ parentPath === 'drives' ? '（返回此电脑盘符列表）' : `（上级: ${parentPath}）` }}
+              </span>
+            </div>
+          </div>
+
+          <!-- 目录与文件条目 -->
+          <div
+            v-for="item in visibleItems"
+            :key="item.path"
+            :data-entry-path="item.path"
+            class="group flex items-center justify-between gap-2 rounded-xl px-2.5 py-1.5 text-xs transition-all duration-300 cursor-pointer"
+            :class="[
+              highlightedPath === item.path
+                ? 'bg-emerald-50/90 ring-1 ring-emerald-400/70 shadow-sm'
+                : editorPath === item.path && editorOpen
+                  ? 'bg-zinc-100 font-medium'
+                  : 'hover:bg-zinc-100/80',
+            ]"
+            @mouseenter="onRowMouseEnter(item)"
+            @mouseleave="onRowMouseLeave"
+            @click="onEntryClick(item)"
+          >
+            <div class="flex min-w-0 items-center gap-2">
+              <!-- 文件夹图标 -->
+              <svg
+                v-if="item.isDir"
+                class="h-4 w-4 shrink-0 text-zinc-700"
+                viewBox="0 0 24 24"
+                fill="none"
+                stroke="currentColor"
+                stroke-width="1.8"
+              >
+                <path d="M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v8a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V7z" />
+              </svg>
+              <!-- 压缩包图标 -->
+              <svg
+                v-else-if="isArchiveFile(item)"
+                class="h-4 w-4 shrink-0 text-amber-600"
+                viewBox="0 0 24 24"
+                fill="none"
+                stroke="currentColor"
+                stroke-width="1.8"
+              >
+                <path d="M21 8v13H3V8" />
+                <path d="M1 3h22v5H1z" />
+                <path d="M10 12h4" />
+              </svg>
+              <!-- 普通文件图标 -->
+              <svg
+                v-else
+                class="h-4 w-4 shrink-0 text-zinc-400"
+                viewBox="0 0 24 24"
+                fill="none"
+                stroke="currentColor"
+                stroke-width="1.8"
+              >
+                <path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z" />
+                <polyline points="14 2 14 8 20 8" />
+              </svg>
+
+              <span class="truncate text-zinc-800">{{ item.name }}</span>
+              <span
+                v-if="highlightedPath === item.path"
+                class="shrink-0 rounded-md bg-emerald-500 px-1.5 py-0.2 text-[10px] font-medium text-white"
+              >
+                新生成
+              </span>
+              <span
+                v-else-if="busyActionPath === item.path"
+                class="shrink-0 rounded-md bg-zinc-900 px-1.5 py-0.2 text-[10px] font-medium text-white animate-pulse"
+              >
+                处理中...
+              </span>
+            </div>
+
+            <!-- 右侧：文件大小/修改时间 与 悬停动作（下载 / 解压 / 压缩 / 改名 / 删除） -->
+            <div v-if="currentPath !== 'drives'" class="flex shrink-0 items-center gap-2" @click.stop>
+              <span v-if="!item.isDir" class="font-mono text-[11px] text-zinc-400 group-hover:hidden">
+                {{ formatBytes(item.size) }}
+              </span>
+              <span v-if="!compact && item.mtime" class="hidden lg:inline font-mono text-[11px] text-zinc-300 group-hover:hidden">
+                {{ formatTime(item.mtime) }}
+              </span>
+
+              <div class="hidden items-center gap-1 group-hover:flex">
+                <button
+                  v-if="isArchiveFile(item)"
+                  type="button"
+                  class="rounded-md bg-amber-500 px-1.5 py-0.5 text-[11px] font-medium text-white shadow-sm hover:bg-amber-600 disabled:opacity-50"
+                  :disabled="busyActionPath === item.path"
+                  title="解压到当前目录"
+                  @click="handleExtract(item)"
+                >
+                  解压
+                </button>
+                <button
+                  v-if="!item.isDir"
+                  type="button"
+                  class="rounded-md bg-white px-1.5 py-0.5 text-[11px] font-medium text-zinc-700 shadow-sm ring-1 ring-zinc-200 hover:bg-zinc-900 hover:text-white"
+                  title="满速流式下载"
+                  @click="triggerDownload(item)"
+                >
+                  下载
+                </button>
+                <button
+                  type="button"
+                  class="rounded-md bg-white px-1.5 py-0.5 text-[11px] text-zinc-600 shadow-sm ring-1 ring-zinc-200 hover:text-zinc-900 disabled:opacity-50"
+                  :disabled="busyActionPath === item.path"
+                  title="打包压缩"
+                  @click="handleCompress(item)"
+                >
+                  压缩
+                </button>
+                <button
+                  type="button"
+                  class="rounded-md bg-white px-1.5 py-0.5 text-[11px] text-zinc-600 shadow-sm ring-1 ring-zinc-200 hover:text-zinc-900"
+                  title="复制完整路径"
+                  @click="copyEntryPath(item.path)"
+                >
+                  路径
+                </button>
+                <button
+                  type="button"
+                  class="rounded-md bg-white px-1.5 py-0.5 text-[11px] text-zinc-600 shadow-sm ring-1 ring-zinc-200 hover:text-zinc-900"
+                  title="重命名"
+                  @click="openInlineAction('rename', item)"
+                >
+                  改名
+                </button>
+                <button
+                  type="button"
+                  class="rounded-md bg-white px-1.5 py-0.5 text-[11px] text-red-600 shadow-sm ring-1 ring-zinc-200 hover:bg-red-50"
+                  title="删除"
+                  @click="openInlineAction('delete', item)"
+                >
+                  删除
+                </button>
+              </div>
+            </div>
+          </div>
+
+          <div
+            v-if="!loading && !visibleItems.length"
+            class="flex flex-1 items-center justify-center py-10 text-xs text-zinc-400"
+          >
+            当前目录为空
+          </div>
+        </template>
+      </div>
+
+      <!-- 在线文本编辑器面板 -->
+      <div
+        v-if="editorOpen"
+        class="flex min-h-0 flex-1 flex-col overflow-hidden bg-white"
+      >
+        <div class="flex items-center justify-between border-b border-zinc-100 bg-zinc-50/70 px-3 py-2">
+          <div class="min-w-0">
+            <p class="truncate font-mono text-xs font-semibold text-zinc-800">{{ editorName }}</p>
+            <p class="truncate font-mono text-[10px] text-zinc-400">{{ editorPath }}</p>
+          </div>
+          <div class="flex shrink-0 items-center gap-1.5">
+            <button
+              type="button"
+              class="rounded-lg bg-zinc-900 px-3 py-1 text-xs font-medium text-white hover:bg-zinc-800 disabled:opacity-50"
+              :disabled="editorSaving || editorLoading"
+              @click="saveFileEditor"
+            >
+              {{ editorSaving ? '保存中...' : '保存 (Ctrl+S)' }}
+            </button>
+            <button
+              type="button"
+              class="rounded-lg px-2 py-1 text-xs text-zinc-500 hover:bg-zinc-100"
+              @click="editorOpen = false"
+            >
+              关闭
+            </button>
+          </div>
+        </div>
+        <div v-if="editorLoading" class="flex flex-1 items-center justify-center text-xs text-zinc-400">
+          正在读取文件内容...
+        </div>
+        <textarea
+          v-else
+          v-model="editorContent"
+          spellcheck="false"
+          class="h-full w-full flex-1 resize-none bg-white p-3 font-mono text-xs leading-relaxed text-zinc-800 outline-none dark:bg-zinc-950 dark:text-zinc-100"
+          @keydown.ctrl.s.prevent="saveFileEditor"
+          @keydown.meta.s.prevent="saveFileEditor"
+        />
+      </div>
+    </div>
+
+    <!-- 底部：高速传输队列面板 -->
+    <div
+      v-if="transfers.length"
+      class="shrink-0 border-t border-zinc-200/80 bg-zinc-50/90 px-3 py-2"
+    >
+      <div class="mb-1.5 flex items-center justify-between text-[11px]">
+        <span class="font-semibold text-zinc-600">
+          传输队列 ({{ transfers.length }})
+        </span>
+        <button
+          type="button"
+          class="text-zinc-400 hover:text-zinc-700"
+          @click="clearCompletedTransfers"
+        >
+          清理已完成
+        </button>
+      </div>
+      <div class="max-h-32 space-y-1.5 overflow-y-auto">
+        <div
+          v-for="t in transfers.slice(0, 6)"
+          :key="t.id"
+          class="rounded-xl border border-zinc-200/80 bg-white px-2.5 py-1.5 text-[11px]"
+        >
+          <div class="flex items-center justify-between gap-2">
+            <span class="truncate font-medium text-zinc-800">
+              {{ t.direction === 'upload' ? '⬆' : '⬇' }} {{ t.filename }}
+            </span>
+            <span class="shrink-0 font-mono text-[10px] text-zinc-500">
+              <template v-if="t.state === 'running'">
+                {{ formatSpeed(t.speedBps) }} · {{ formatBytes(t.transferredBytes) }} / {{ formatBytes(t.totalBytes) }}
+              </template>
+              <template v-else-if="t.state === 'completed'">
+                <span class="text-emerald-600">✓ 完成 ({{ formatSpeed(t.speedBps) }})</span>
+              </template>
+              <template v-else>
+                <span class="text-red-600" :title="t.error || ''">✗ 失败</span>
+              </template>
+            </span>
+          </div>
+          <div class="mt-1 h-1 w-full overflow-hidden rounded-full bg-zinc-100">
+            <div
+              class="h-full rounded-full transition-all duration-200"
+              :class="
+                t.state === 'failed'
+                  ? 'bg-red-500'
+                  : t.state === 'completed'
+                    ? 'bg-emerald-500'
+                    : 'bg-zinc-900'
+              "
+              :style="{
+                width:
+                  t.totalBytes > 0
+                    ? `${Math.min(100, Math.round((t.transferredBytes * 100) / t.totalBytes))}%`
+                    : t.state === 'completed'
+                      ? '100%'
+                      : '30%',
+              }"
+            />
+          </div>
+        </div>
+      </div>
+    </div>
+  </section>
+</template>
diff --git a/frontend/src/components/HostDetailDrawer.vue b/frontend/src/components/HostDetailDrawer.vue
new file mode 100644
index 0000000..65f987e
--- /dev/null
+++ b/frontend/src/components/HostDetailDrawer.vue
@@ -0,0 +1,663 @@
+<script setup lang="ts">
+import { computed, onBeforeUnmount, onMounted, ref, watch } from 'vue';
+import OsBadge from './OsBadge.vue';
+import {
+  globalInspectionCache as inspectionCache,
+  ROLE_META,
+  type DiskUsageItem,
+  type HostInspection,
+  type HostRole,
+  type PublicHost,
+} from '../types';
+
+const netHistoryCache = new Map<string, Array<{ rx: number; tx: number }>>();
+
+const props = defineProps<{
+  host: PublicHost;
+  checking: boolean;
+}>();
+
+const emit = defineEmits<{
+  close: [];
+  check: [host: PublicHost];
+  edit: [host: PublicHost];
+  delete: [host: PublicHost];
+  openTerminal: [host: PublicHost];
+  openFiles: [host: PublicHost];
+  patchMeta: [host: PublicHost, patch: Record<string, unknown>];
+  hostUpdated: [host: PublicHost];
+}>();
+
+const tagInput = ref('');
+const snap = ref<HostInspection | null>(null);
+const inspecting = ref(false);
+const inspectErr = ref<string | null>(null);
+const netBars = ref<Array<{ rx: number; tx: number }>>([]);
+
+let inspectTimer: ReturnType<typeof setInterval> | null = null;
+let reqSeq = 0;
+
+const osPretty = computed(() => {
+  return (
+    props.host.osInfo?.prettyName ||
+    props.host.osInfo?.distroId ||
+    props.host.osInfo?.os ||
+    '正在探测系统...'
+  );
+});
+
+const cpuLabel = computed(() => {
+  return (
+    snap.value?.cpuModel ||
+    props.host.osInfo?.cpuModel ||
+    props.host.osInfo?.arch ||
+    '正在探测处理器型号...'
+  );
+});
+
+const memUsedPct = computed(() => {
+  if (!snap.value || !snap.value.memTotalBytes) return 0;
+  return Math.min(100, Math.round((snap.value.memUsedBytes * 100) / snap.value.memTotalBytes));
+});
+
+const memCachePct = computed(() => {
+  if (!snap.value || !snap.value.memTotalBytes) return 0;
+  const raw = Math.round((snap.value.memCachedBytes * 100) / snap.value.memTotalBytes);
+  return Math.min(100 - memUsedPct.value, Math.max(0, raw));
+});
+
+const swapUsedPct = computed(() => {
+  if (!snap.value || !snap.value.swapTotalBytes) return 0;
+  return Math.min(100, Math.round((snap.value.swapUsedBytes * 100) / snap.value.swapTotalBytes));
+});
+
+const diskList = computed<DiskUsageItem[]>(() => {
+  if (!snap.value) return [];
+  if (snap.value.disks && snap.value.disks.length > 0) {
+    return snap.value.disks;
+  }
+  if (snap.value.diskTotalBytes > 0) {
+    return [
+      {
+        mount: snap.value.diskMount || '/',
+        totalBytes: snap.value.diskTotalBytes,
+        usedBytes: snap.value.diskUsedBytes,
+      },
+    ];
+  }
+  return [];
+});
+
+// SVG 圆环周长 (r = 22 -> 2 * pi * 22 ≈ 138.2)
+const RING_CIRC = 138.2;
+const cpuRingOffset = computed(() => {
+  const pct = Math.min(100, Math.max(0, snap.value?.cpuUsagePct || 0));
+  return RING_CIRC - (RING_CIRC * pct) / 100;
+});
+
+function diskPct(d: DiskUsageItem): number {
+  if (!d.totalBytes) return 0;
+  return Math.min(100, Math.round((d.usedBytes * 100) / d.totalBytes));
+}
+
+const normalizedBars = computed(() => {
+  const list = netBars.value;
+  if (!list.length) {
+    return Array.from({ length: 20 }, () => ({ rxH: 8, txH: 6 }));
+  }
+  const maxVal = Math.max(1024, ...list.map((b) => Math.max(b.rx, b.tx)));
+  const padded = [
+    ...Array.from({ length: Math.max(0, 20 - list.length) }, () => ({ rx: 0, tx: 0 })),
+    ...list.slice(-20),
+  ];
+  return padded.map((b) => ({
+    rxH: Math.max(6, Math.round((b.rx / maxVal) * 100)),
+    txH: Math.max(6, Math.round((b.tx / maxVal) * 100)),
+  }));
+});
+
+function formatBytes(bytes: number): string {
+  if (!bytes || bytes <= 0) return '0 B';
+  const units = ['B', 'KB', 'MB', 'GB', 'TB'];
+  const i = Math.min(Math.floor(Math.log(bytes) / Math.log(1024)), units.length - 1);
+  const val = bytes / Math.pow(1024, i);
+  return `${val >= 100 || i === 0 ? val.toFixed(0) : val.toFixed(1)} ${units[i]}`;
+}
+
+function formatRate(bps: number): string {
+  if (!bps || bps <= 0) return '0 B/s';
+  return `${formatBytes(bps)}/s`;
+}
+
+function formatUptime(secs: number): string {
+  if (!secs || secs <= 0) return '--';
+  const d = Math.floor(secs / 86400);
+  const h = Math.floor((secs % 86400) / 3600);
+  const m = Math.floor((secs % 3600) / 60);
+  if (d > 0) return `${d}天 ${h}小时`;
+  if (h > 0) return `${h}小时 ${m}分`;
+  return `${m}分钟`;
+}
+
+async function runInspectOnce(hostId: string) {
+  const seq = ++reqSeq;
+  inspecting.value = true;
+  try {
+    const res = await fetch(`/api/hosts/${encodeURIComponent(hostId)}/inspect`);
+    const data = await res.json();
+    if (seq !== reqSeq || props.host.id !== hostId) return;
+    if (!data.ok || !data.inspection) {
+      inspectErr.value = data.error || '探索采集失败';
+      return;
+    }
+    inspectErr.value = null;
+    const ins = data.inspection as HostInspection;
+    snap.value = ins;
+    inspectionCache.set(hostId, ins);
+
+    const hist = netHistoryCache.get(hostId) || [];
+    hist.push({ rx: ins.netRxBps, tx: ins.netTxBps });
+    if (hist.length > 20) hist.shift();
+    netHistoryCache.set(hostId, hist);
+    netBars.value = [...hist];
+
+    if (data.host) {
+      emit('hostUpdated', data.host as PublicHost);
+    }
+  } catch (e) {
+    if (seq === reqSeq) {
+      inspectErr.value = (e as Error).message;
+    }
+  } finally {
+    if (seq === reqSeq) {
+      inspecting.value = false;
+    }
+  }
+}
+
+function startLiveInspection(hostId: string) {
+  stopLiveInspection();
+  snap.value = inspectionCache.get(hostId) || null;
+  netBars.value = [...(netHistoryCache.get(hostId) || [])];
+  inspectErr.value = null;
+
+  void runInspectOnce(hostId);
+
+  inspectTimer = setInterval(() => {
+    if (!inspecting.value && props.host.id === hostId) {
+      void runInspectOnce(hostId);
+    }
+  }, 2800);
+}
+
+function stopLiveInspection() {
+  if (inspectTimer) {
+    clearInterval(inspectTimer);
+    inspectTimer = null;
+  }
+}
+
+const roles: Array<{ key: HostRole | ''; label: string }> = [
+  { key: '', label: '未标记' },
+  { key: 'primary', label: ROLE_META.primary.label },
+  { key: 'proxy', label: ROLE_META.proxy.label },
+  { key: 'test', label: ROLE_META.test.label },
+  { key: 'archive', label: ROLE_META.archive.label },
+];
+
+function addTag() {
+  const raw = tagInput.value.trim();
+  if (!raw) return;
+  const parts = raw
+    .split(/[\s,，、]+/)
+    .map((s) => s.trim())
+    .filter(Boolean);
+  const next = Array.from(new Set([...props.host.tags, ...parts]));
+  tagInput.value = '';
+  emit('patchMeta', props.host, { tags: next });
+}
+
+function removeTag(tag: string) {
+  emit(
+    'patchMeta',
+    props.host,
+    { tags: props.host.tags.filter((t) => t !== tag) }
+  );
+}
+
+function setRole(role: HostRole | '') {
+  emit('patchMeta', props.host, { role: role || null });
+}
+
+watch(
+  () => props.host.id,
+  (newId) => {
+    startLiveInspection(newId);
+  }
+);
+
+onMounted(() => {
+  startLiveInspection(props.host.id);
+});
+
+onBeforeUnmount(() => {
+  stopLiveInspection();
+});
+</script>
+
+<template>
+  <aside
+    class="flex h-full w-full shrink-0 flex-col overflow-hidden rounded-2xl border border-zinc-200/80 bg-white/88 shadow-[0_4px_20px_rgba(0,0,0,0.03)] backdrop-blur-xl dark:border-zinc-800 dark:bg-zinc-900/88"
+  >
+    <!-- 顶部栏 -->
+    <div class="flex items-center justify-between border-b border-zinc-100 px-4 py-3 dark:border-zinc-800">
+      <div class="flex min-w-0 items-center gap-2">
+        <span
+          class="h-2.5 w-2.5 shrink-0 rounded-full"
+          :class="{
+            'bg-emerald-500 shadow-[0_0_8px_rgba(16,185,129,0.55)]': host.status === 'online',
+            'bg-red-500 shadow-[0_0_8px_rgba(239,68,68,0.45)]': host.status === 'offline',
+            'bg-zinc-300 dark:bg-zinc-600': host.status === 'unknown',
+          }"
+        />
+        <h3 class="truncate text-sm font-semibold text-zinc-900 dark:text-zinc-100">{{ host.name }}</h3>
+        <span
+          v-if="inspecting"
+          class="h-1.5 w-1.5 animate-ping rounded-full bg-zinc-400"
+          title="正在实时采样内核计数..."
+        />
+      </div>
+      <div class="flex items-center gap-1">
+        <button
+          type="button"
+          class="rounded-lg px-2 py-1 text-xs font-medium text-zinc-600 transition hover:bg-zinc-100 hover:text-zinc-900 dark:text-zinc-400 dark:hover:bg-zinc-800 dark:hover:text-zinc-100"
+          :disabled="inspecting"
+          @click="runInspectOnce(host.id)"
+        >
+          刷新
+        </button>
+        <button
+          type="button"
+          class="rounded-lg p-1 text-zinc-400 transition hover:bg-zinc-100 hover:text-zinc-700 dark:hover:bg-zinc-800 dark:hover:text-zinc-200"
+          title="收起详情"
+          @click="emit('close')"
+        >
+          <svg class="h-4 w-4" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+            <path d="M18 6L6 18M6 6l12 12" />
+          </svg>
+        </button>
+      </div>
+    </div>
+
+    <!-- 主内容滚动区 -->
+    <div class="flex-1 space-y-2.5 overflow-y-auto p-3.5">
+      <!-- 1. 环境底座铭牌 -->
+      <div class="rounded-xl border border-zinc-200/80 bg-white p-3 shadow-[0_1px_2px_rgba(0,0,0,0.02)] dark:border-zinc-800 dark:bg-zinc-900/90">
+        <div class="flex items-start gap-2.5">
+          <OsBadge :os-info="host.osInfo" :kind="host.kind" :name="host.name" />
+          <div class="min-w-0 flex-1">
+            <div class="flex items-center justify-between gap-1">
+              <span class="truncate text-xs font-semibold text-zinc-900 dark:text-zinc-100" :title="osPretty">
+                {{ osPretty }}
+              </span>
+              <span
+                v-if="snap?.tcpCc"
+                class="shrink-0 rounded-md px-1.5 py-0.5 font-mono text-[10px] font-semibold uppercase"
+                :class="
+                  snap.tcpCc.toLowerCase().includes('bbr')
+                    ? 'bg-emerald-50 text-emerald-700 ring-1 ring-emerald-500/20 dark:bg-emerald-950/60 dark:text-emerald-400'
+                    : 'bg-zinc-100 text-zinc-600 dark:bg-zinc-800 dark:text-zinc-300'
+                "
+              >
+                {{ snap.tcpCc }}
+              </span>
+            </div>
+            <p class="mt-0.5 truncate font-mono text-[11px] text-zinc-500 dark:text-zinc-400" :title="cpuLabel">
+              {{ cpuLabel }}
+            </p>
+          </div>
+        </div>
+
+        <div class="mt-2.5 grid grid-cols-3 divide-x divide-zinc-100 border-t border-zinc-100 pt-2 text-center dark:divide-zinc-800 dark:border-zinc-800">
+          <div>
+            <div class="text-[10px] text-zinc-400">运行时间</div>
+            <div class="mt-0.5 font-mono text-[11px] font-semibold text-zinc-800 dark:text-zinc-200">
+              {{ snap ? formatUptime(snap.uptimeSeconds) : '--' }}
+            </div>
+          </div>
+          <div>
+            <div class="text-[10px] text-zinc-400">内核 / 架构</div>
+            <div class="mt-0.5 truncate px-1 font-mono text-[11px] font-semibold text-zinc-800 dark:text-zinc-200" :title="host.osInfo?.kernel || ''">
+              {{ (host.osInfo?.kernel || host.osInfo?.arch || '--').split('-')[0] }}
+            </div>
+          </div>
+          <div>
+            <div class="text-[10px] text-zinc-400">SSH 响应</div>
+            <div class="mt-0.5 font-mono text-[11px] font-semibold text-zinc-800 dark:text-zinc-200">
+              {{ host.latencyMs != null ? `${host.latencyMs} ms` : '--' }}
+            </div>
+          </div>
+        </div>
+      </div>
+
+      <!-- 若探索报错 -->
+      <div
+        v-if="inspectErr && !snap"
+        class="rounded-xl border border-red-200/80 bg-red-50/70 px-3 py-2 text-[11px] leading-relaxed text-red-700 dark:border-red-900/60 dark:bg-red-950/40 dark:text-red-400"
+      >
+        {{ inspectErr }}
+      </div>
+
+      <!-- 2. CPU 算力与负载 -->
+      <div class="rounded-xl border border-zinc-200/80 bg-white p-3.5 shadow-[0_1px_2px_rgba(0,0,0,0.02)] dark:border-zinc-800 dark:bg-zinc-900/90">
+        <div class="flex items-center justify-between">
+          <div class="flex items-center gap-2">
+            <span class="text-[11px] font-semibold text-zinc-500 dark:text-zinc-400">CPU 算力与负载</span>
+            <span class="rounded bg-zinc-100 px-1.5 py-0.2 font-mono text-[10px] text-zinc-600 dark:bg-zinc-800 dark:text-zinc-300">
+              {{ snap?.cpuCores || host.osInfo?.cpuCores || 1 }} 核
+            </span>
+          </div>
+          <span
+            v-if="snap"
+            class="rounded px-1.5 py-0.2 font-mono text-[10px] font-medium"
+            :class="
+              snap.cpuStealPct >= 5
+                ? 'bg-orange-100 text-orange-700 dark:bg-orange-950/60 dark:text-orange-400'
+                : 'bg-zinc-100 text-zinc-500 dark:bg-zinc-800 dark:text-zinc-400'
+            "
+            title="宿主机邻居争抢/超售被偷走的 CPU 时间占比 (Steal)"
+          >
+            超售 Steal {{ snap.cpuStealPct.toFixed(1) }}%
+          </span>
+        </div>
+
+        <div class="mt-2.5 flex items-center gap-3.5">
+          <!-- 左侧 52px 圆环（自适应亮暗主题颜色） -->
+          <div class="relative flex h-[52px] w-[52px] shrink-0 items-center justify-center">
+            <svg class="h-[52px] w-[52px] -rotate-90" viewBox="0 0 52 52">
+              <circle
+                cx="26"
+                cy="26"
+                r="22"
+                fill="none"
+                class="stroke-zinc-100 dark:stroke-zinc-800"
+                stroke-width="4.5"
+              />
+              <circle
+                cx="26"
+                cy="26"
+                r="22"
+                fill="none"
+                :class="
+                  (snap?.cpuUsagePct || 0) > 80
+                    ? 'stroke-orange-500'
+                    : 'stroke-zinc-900 dark:stroke-zinc-100'
+                "
+                stroke-width="4.5"
+                stroke-linecap="round"
+                :stroke-dasharray="RING_CIRC"
+                :stroke-dashoffset="cpuRingOffset"
+                class="transition-all duration-500"
+              />
+            </svg>
+            <span class="font-mono text-xs font-bold text-zinc-900 dark:text-zinc-100">
+              {{ snap ? `${snap.cpuUsagePct.toFixed(1)}%` : '--' }}
+            </span>
+          </div>
+
+          <!-- 右侧宽敞指标矩阵 -->
+          <div class="grid min-w-0 flex-1 grid-cols-2 gap-x-3 gap-y-1.5 rounded-lg bg-zinc-50/80 px-3 py-2 text-[11px] dark:bg-zinc-800/50">
+            <div class="flex items-center justify-between">
+              <span class="text-zinc-400">1分负载</span>
+              <span class="font-mono font-semibold text-zinc-800 dark:text-zinc-200">{{ snap ? snap.load1.toFixed(2) : '--' }}</span>
+            </div>
+            <div class="flex items-center justify-between">
+              <span class="text-zinc-400">5分负载</span>
+              <span class="font-mono font-medium text-zinc-700 dark:text-zinc-300">{{ snap ? snap.load5.toFixed(2) : '--' }}</span>
+            </div>
+            <div class="flex items-center justify-between">
+              <span class="text-zinc-400">15分负载</span>
+              <span class="font-mono font-medium text-zinc-700 dark:text-zinc-300">{{ snap ? snap.load15.toFixed(2) : '--' }}</span>
+            </div>
+            <div class="flex items-center justify-between">
+              <span class="text-zinc-400">IOWait</span>
+              <span class="font-mono font-medium text-zinc-700 dark:text-zinc-300">{{ snap ? `${snap.cpuIowaitPct.toFixed(1)}%` : '--' }}</span>
+            </div>
+          </div>
+        </div>
+      </div>
+
+      <!-- 3. 内存与 Swap 解剖 -->
+      <div class="rounded-xl border border-zinc-200/80 bg-white p-3.5 shadow-[0_1px_2px_rgba(0,0,0,0.02)] dark:border-zinc-800 dark:bg-zinc-900/90">
+        <div class="flex items-center justify-between text-xs">
+          <span class="text-[11px] font-semibold text-zinc-500 dark:text-zinc-400">内存结构 (RAM & Swap)</span>
+          <span class="font-mono text-[11px] font-semibold text-zinc-900 dark:text-zinc-100">
+            {{ snap ? `${formatBytes(snap.memUsedBytes)} / ${formatBytes(snap.memTotalBytes)}` : '-- / --' }}
+          </span>
+        </div>
+
+        <div class="mt-2 flex h-2 w-full overflow-hidden rounded-full bg-zinc-100 dark:bg-zinc-800">
+          <div
+            class="h-full bg-zinc-900 transition-all duration-500 dark:bg-zinc-100"
+            :style="{ width: `${memUsedPct}%` }"
+            title="应用真实占用 (MemTotal - MemAvailable)"
+          />
+          <div
+            class="h-full bg-zinc-300 transition-all duration-500 dark:bg-zinc-600"
+            :style="{ width: `${memCachePct}%` }"
+            title="内核 Buffers/Cached（需要时可随时释放）"
+          />
+        </div>
+
+        <div class="mt-2 flex items-center justify-between text-[11px] text-zinc-500 dark:text-zinc-400">
+          <div class="flex items-center gap-3">
+            <span class="inline-flex items-center gap-1">
+              <span class="h-2 w-2 rounded-sm bg-zinc-900 dark:bg-zinc-100" />
+              实占 {{ memUsedPct }}%
+            </span>
+            <span v-if="snap && snap.memCachedBytes > 0" class="inline-flex items-center gap-1">
+              <span class="h-2 w-2 rounded-sm bg-zinc-300 dark:bg-zinc-600" />
+              缓存 {{ formatBytes(snap.memCachedBytes) }}
+            </span>
+          </div>
+          <span class="font-mono text-[10px] text-zinc-400">
+            Swap:
+            <template v-if="snap && snap.swapTotalBytes > 0">
+              {{ formatBytes(snap.swapUsedBytes) }} / {{ formatBytes(snap.swapTotalBytes) }} ({{ swapUsedPct }}%)
+            </template>
+            <template v-else>未开启</template>
+          </span>
+        </div>
+      </div>
+
+      <!-- 4. 磁盘存储 -->
+      <div class="rounded-xl border border-zinc-200/80 bg-white p-3.5 shadow-[0_1px_2px_rgba(0,0,0,0.02)] dark:border-zinc-800 dark:bg-zinc-900/90">
+        <div class="flex items-center justify-between">
+          <span class="text-[11px] font-semibold text-zinc-500 dark:text-zinc-400">磁盘存储</span>
+          <span v-if="diskList.length === 1" class="font-mono text-[11px] font-semibold text-zinc-900 dark:text-zinc-100">
+            {{ formatBytes(diskList[0].usedBytes) }} / {{ formatBytes(diskList[0].totalBytes) }}
+          </span>
+          <span v-else class="font-mono text-[10px] text-zinc-400">
+            {{ diskList.length }} 个挂载分区
+          </span>
+        </div>
+
+        <div v-if="diskList.length" class="mt-2.5 space-y-2.5">
+          <div v-for="d in diskList" :key="d.mount" class="space-y-1.5">
+            <div class="flex items-center justify-between font-mono text-[11px]">
+              <span class="font-semibold text-zinc-800 dark:text-zinc-200">{{ d.mount }}</span>
+              <span class="text-zinc-500 dark:text-zinc-400">
+                {{ formatBytes(d.usedBytes) }} / {{ formatBytes(d.totalBytes) }}
+                <span class="ml-1 font-semibold text-zinc-900 dark:text-zinc-100">({{ diskPct(d) }}%)</span>
+              </span>
+            </div>
+            <div class="h-2 w-full overflow-hidden rounded-full bg-zinc-100 dark:bg-zinc-800">
+              <div
+                class="h-full rounded-full transition-all duration-500"
+                :class="diskPct(d) > 85 ? 'bg-red-500' : 'bg-zinc-900 dark:bg-zinc-100'"
+                :style="{ width: `${diskPct(d)}%` }"
+              />
+            </div>
+          </div>
+        </div>
+        <div v-else class="mt-2 text-xs text-zinc-400">正在探测磁盘容量...</div>
+      </div>
+
+      <!-- 5. 唯一外网主网卡实时脉冲谱 -->
+      <div class="rounded-xl border border-zinc-200/80 bg-white p-3.5 shadow-[0_1px_2px_rgba(0,0,0,0.02)] dark:border-zinc-800 dark:bg-zinc-900/90">
+        <div class="flex items-center justify-between">
+          <div class="flex items-center gap-1.5">
+            <span class="text-[11px] font-semibold text-zinc-500 dark:text-zinc-400">网络吞吐</span>
+            <span class="rounded bg-zinc-100 px-1.5 py-0.2 font-mono text-[10px] font-medium text-zinc-600 dark:bg-zinc-800 dark:text-zinc-300">
+              {{ snap?.netIface || 'eth0' }}
+            </span>
+          </div>
+          <div class="flex items-center gap-2.5 font-mono text-[11px]">
+            <span class="font-semibold text-emerald-600 dark:text-emerald-400">
+              ↓ {{ snap ? formatRate(snap.netRxBps) : '0 B/s' }}
+            </span>
+            <span class="font-semibold text-zinc-800 dark:text-zinc-200">
+              ↑ {{ snap ? formatRate(snap.netTxBps) : '0 B/s' }}
+            </span>
+          </div>
+        </div>
+
+        <div class="mt-2.5 flex h-12 items-end gap-1 rounded-lg bg-zinc-50/80 px-2 py-1.5 dark:bg-zinc-800/50">
+          <div
+            v-for="(bar, idx) in normalizedBars"
+            :key="idx"
+            class="flex h-full flex-1 flex-col justify-end gap-0.5"
+          >
+            <div
+              class="w-full rounded-sm bg-zinc-800/75 transition-all duration-300 dark:bg-zinc-300/75"
+              :style="{ height: `${Math.max(8, Math.round(bar.txH * 0.45))}%` }"
+            />
+            <div
+              class="w-full rounded-sm bg-emerald-500/85 transition-all duration-300"
+              :style="{ height: `${Math.max(8, Math.round(bar.rxH * 0.55))}%` }"
+            />
+          </div>
+        </div>
+
+        <div class="mt-2 flex items-center justify-between border-t border-zinc-100 pt-2 font-mono text-[10px] text-zinc-400 dark:border-zinc-800">
+          <span>累计下行: <strong class="text-zinc-700 dark:text-zinc-200">{{ snap ? formatBytes(snap.netRxBytesTotal) : '--' }}</strong></span>
+          <span>累计上行: <strong class="text-zinc-700 dark:text-zinc-200">{{ snap ? formatBytes(snap.netTxBytesTotal) : '--' }}</strong></span>
+        </div>
+      </div>
+
+      <!-- 6. 角色、标签与快捷链接 -->
+      <div class="space-y-3 rounded-xl border border-zinc-200/80 bg-white p-3.5 shadow-[0_1px_2px_rgba(0,0,0,0.02)] dark:border-zinc-800 dark:bg-zinc-900/90">
+        <div class="flex items-center justify-between">
+          <span class="text-[11px] font-semibold text-zinc-500 dark:text-zinc-400">角色分类</span>
+          <span v-if="host.jumpHostName" class="rounded-md bg-zinc-100 px-1.5 py-0.5 text-[11px] text-zinc-600 dark:bg-zinc-800 dark:text-zinc-300">
+            跳板: {{ host.jumpHostName }}
+          </span>
+        </div>
+        <div class="flex flex-wrap gap-1">
+          <button
+            v-for="r in roles"
+            :key="r.key"
+            type="button"
+            class="rounded-lg px-2 py-1 text-[11px] font-medium transition"
+            :class="
+              (host.role || '') === r.key
+                ? 'bg-zinc-900 text-white dark:bg-zinc-100 dark:text-zinc-900'
+                : 'bg-zinc-100 text-zinc-600 hover:bg-zinc-200/70 dark:bg-zinc-800 dark:text-zinc-300 dark:hover:bg-zinc-700'
+            "
+            @click="setRole(r.key)"
+          >
+            {{ r.label }}
+          </button>
+        </div>
+
+        <div class="pt-1">
+          <div class="text-[11px] font-semibold text-zinc-500 dark:text-zinc-400">标签</div>
+          <div class="mt-1.5 flex flex-wrap gap-1.5">
+            <span
+              v-for="tag in host.tags"
+              :key="tag"
+              class="inline-flex items-center gap-1 rounded-md border border-zinc-200 bg-zinc-50 px-2 py-0.5 text-[11px] text-zinc-700 dark:border-zinc-700 dark:bg-zinc-800 dark:text-zinc-300"
+            >
+              #{{ tag }}
+              <button
+                type="button"
+                class="text-zinc-400 hover:text-zinc-800 dark:hover:text-zinc-100"
+                @click="removeTag(tag)"
+              >
+                ×
+              </button>
+            </span>
+          </div>
+          <form class="mt-2 flex gap-1.5" @submit.prevent="addTag">
+            <input
+              v-model="tagInput"
+              type="text"
+              placeholder="添加标签（回车保存）"
+              class="min-w-0 flex-1 rounded-lg border border-zinc-200 bg-zinc-50/70 px-2.5 py-1 text-xs text-zinc-800 outline-none focus:border-zinc-400 focus:bg-white dark:border-zinc-700 dark:bg-zinc-800 dark:text-zinc-100"
+            />
+            <button
+              type="submit"
+              class="rounded-lg border border-zinc-200 bg-white px-2.5 py-1 text-xs font-medium text-zinc-700 hover:bg-zinc-50 dark:border-zinc-700 dark:bg-zinc-800 dark:text-zinc-200"
+            >
+              添加
+            </button>
+          </form>
+        </div>
+
+        <div v-if="host.links.length" class="pt-1">
+          <div class="text-[11px] font-semibold text-zinc-500 dark:text-zinc-400">快捷链接</div>
+          <div class="mt-1.5 space-y-1">
+            <a
+              v-for="link in host.links"
+              :key="link.id || link.url"
+              :href="link.url"
+              target="_blank"
+              rel="noreferrer"
+              class="flex items-center justify-between rounded-lg border border-zinc-200/70 bg-zinc-50/60 px-2.5 py-1.5 text-xs text-zinc-700 transition hover:border-zinc-300 hover:bg-white dark:border-zinc-700 dark:bg-zinc-800/60 dark:text-zinc-200 dark:hover:bg-zinc-800"
+            >
+              <span class="truncate font-medium">{{ link.name }}</span>
+              <span class="ml-2 truncate font-mono text-[10px] text-zinc-400">{{ link.url }}</span>
+            </a>
+          </div>
+        </div>
+      </div>
+    </div>
+
+    <!-- 底部操作栏 -->
+    <div class="flex items-center justify-between border-t border-zinc-100 bg-zinc-50/60 px-3.5 py-2.5 dark:border-zinc-800 dark:bg-zinc-900/60">
+      <div class="flex items-center gap-1.5">
+        <button
+          type="button"
+          class="rounded-lg bg-zinc-900 px-3 py-1.5 text-xs font-medium text-white transition hover:bg-zinc-800 dark:bg-zinc-100 dark:text-zinc-900 dark:hover:bg-white"
+          @click="emit('openTerminal', host)"
+        >
+          打开终端
+        </button>
+        <button
+          type="button"
+          class="rounded-lg border border-zinc-200 bg-white px-3 py-1.5 text-xs font-medium text-zinc-700 transition hover:bg-zinc-100 dark:border-zinc-700 dark:bg-zinc-800 dark:text-zinc-200 dark:hover:bg-zinc-700"
+          @click="emit('openFiles', host)"
+        >
+          文件浏览
+        </button>
+      </div>
+      <div class="flex items-center gap-1">
+        <button
+          type="button"
+          class="rounded-lg px-2.5 py-1.5 text-xs font-medium text-zinc-600 hover:bg-zinc-200/60 dark:text-zinc-400 dark:hover:bg-zinc-800"
+          @click="emit('edit', host)"
+        >
+          编辑
+        </button>
+        <button
+          v-if="host.kind !== 'local'"
+          type="button"
+          class="rounded-lg px-2 py-1.5 text-xs font-medium text-red-600 hover:bg-red-50 dark:text-red-400 dark:hover:bg-red-950/40"
+          @click="emit('delete', host)"
+        >
+          删除
+        </button>
+      </div>
+    </div>
+  </aside>
+</template>
diff --git a/frontend/src/components/HostModal.vue b/frontend/src/components/HostModal.vue
new file mode 100644
index 0000000..e3175ed
--- /dev/null
+++ b/frontend/src/components/HostModal.vue
@@ -0,0 +1,389 @@
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue';
+import { ROLE_META, type HostLink, type HostRole, type HostUpsertPayload, type PublicHost } from '../types';
+
+const props = defineProps<{
+  open: boolean;
+  editing: PublicHost | null;
+  sshHosts: PublicHost[];
+}>();
+
+const emit = defineEmits<{
+  close: [];
+  submit: [payload: HostUpsertPayload, editingId: string | null];
+}>();
+
+const name = ref('');
+const addr = ref('');
+const port = ref(22);
+const username = ref('root');
+const authType = ref<'password' | 'privateKey'>('password');
+const password = ref('');
+const privateKey = ref('');
+const passphrase = ref('');
+const jumpHostId = ref('');
+const role = ref<HostRole | ''>('');
+const tagsText = ref('');
+const pinned = ref(false);
+const archived = ref(false);
+const links = ref<HostLink[]>([]);
+const errorMsg = ref('');
+
+const isEditing = computed(() => Boolean(props.editing?.id));
+const isLocal = computed(() => props.editing?.kind === 'local');
+
+const jumpCandidates = computed(() =>
+  props.sshHosts.filter((h) => h.kind === 'ssh' && h.id !== props.editing?.id)
+);
+
+const roleOptions: Array<{ value: HostRole | ''; label: string }> = [
+  { value: '', label: '未标记' },
+  { value: 'primary', label: ROLE_META.primary.label },
+  { value: 'proxy', label: ROLE_META.proxy.label },
+  { value: 'test', label: ROLE_META.test.label },
+  { value: 'archive', label: ROLE_META.archive.label },
+];
+
+watch(
+  () => [props.open, props.editing] as const,
+  ([open, host]) => {
+    if (!open) return;
+    errorMsg.value = '';
+    if (host) {
+      name.value = host.name;
+      addr.value = host.addr;
+      port.value = host.port || 22;
+      username.value = host.username || 'root';
+      authType.value = host.authType === 'privateKey' ? 'privateKey' : 'password';
+      jumpHostId.value = host.jumpHostId || '';
+      role.value = (host.role as HostRole) || '';
+      tagsText.value = host.tags.join(', ');
+      pinned.value = host.pinned;
+      archived.value = host.archived;
+      links.value = host.links.length
+        ? host.links.map((l) => ({ ...l }))
+        : [{ id: '', name: '', url: '', description: '' }];
+    } else {
+      name.value = '';
+      addr.value = '';
+      port.value = 22;
+      username.value = 'root';
+      authType.value = 'password';
+      jumpHostId.value = '';
+      role.value = '';
+      tagsText.value = '';
+      pinned.value = false;
+      archived.value = false;
+      links.value = [{ id: '', name: '', url: '', description: '' }];
+    }
+    password.value = '';
+    privateKey.value = '';
+    passphrase.value = '';
+  },
+  { immediate: true }
+);
+
+function addLinkRow() {
+  links.value.push({ id: '', name: '', url: '', description: '' });
+}
+
+function removeLinkRow(idx: number) {
+  links.value.splice(idx, 1);
+  if (!links.value.length) {
+    links.value.push({ id: '', name: '', url: '', description: '' });
+  }
+}
+
+function handleSubmit() {
+  errorMsg.value = '';
+  if (!name.value.trim()) {
+    errorMsg.value = '请填写主机名称';
+    return;
+  }
+  if (!isLocal.value && !addr.value.trim()) {
+    errorMsg.value = '请填写主机 IP 或域名';
+    return;
+  }
+
+  const parsedTags = tagsText.value
+    .split(/[\s,，、]+/)
+    .map((s) => s.trim())
+    .filter(Boolean);
+
+  const validLinks = links.value
+    .filter((l) => l.name.trim() && l.url.trim())
+    .map((l) => ({
+      id: l.id || '',
+      name: l.name.trim(),
+      url: l.url.trim(),
+      description: l.description.trim(),
+    }));
+
+  const payload: HostUpsertPayload = {
+    name: name.value.trim(),
+    addr: isLocal.value ? '127.0.0.1' : addr.value.trim(),
+    port: Number(port.value) || 22,
+    username: username.value.trim() || 'root',
+    authType: authType.value,
+    jumpHostId: jumpHostId.value || null,
+    role: role.value || null,
+    tags: parsedTags,
+    links: validLinks,
+    pinned: pinned.value,
+    archived: archived.value,
+  };
+
+  if (password.value) payload.password = password.value;
+  if (privateKey.value.trim()) payload.privateKey = privateKey.value;
+  if (passphrase.value) payload.passphrase = passphrase.value;
+
+  emit('submit', payload, props.editing?.id || null);
+}
+</script>
+
+<template>
+  <Teleport to="body">
+    <div
+      v-if="open"
+      class="fixed inset-0 z-50 flex items-center justify-center bg-zinc-900/20 p-4 backdrop-blur-sm"
+      @click.self="emit('close')"
+    >
+      <div
+        class="flex max-h-[88vh] w-full max-w-lg flex-col overflow-hidden rounded-2xl border border-zinc-200/90 bg-white/95 shadow-2xl backdrop-blur-xl dark:border-zinc-800 dark:bg-zinc-900/95 dark:text-zinc-100 [&_input]:dark:bg-zinc-800 [&_input]:dark:border-zinc-700 [&_input]:dark:text-zinc-100 [&_select]:dark:bg-zinc-800 [&_select]:dark:border-zinc-700 [&_select]:dark:text-zinc-100 [&_textarea]:dark:bg-zinc-800 [&_textarea]:dark:border-zinc-700 [&_textarea]:dark:text-zinc-100 [&_label]:dark:text-zinc-300"
+      >
+        <div class="flex items-center justify-between border-b border-zinc-100 px-5 py-3.5 dark:border-zinc-800">
+          <h3 class="text-sm font-semibold text-zinc-900 dark:text-zinc-100">
+            {{ isEditing ? `编辑主机 · ${editing?.name}` : '新增 VPS 主机' }}
+          </h3>
+          <button
+            type="button"
+            class="rounded-lg p-1 text-zinc-400 hover:bg-zinc-100 hover:text-zinc-700"
+            @click="emit('close')"
+          >
+            ✕
+          </button>
+        </div>
+
+        <form class="flex-1 space-y-3.5 overflow-y-auto px-5 py-4" @submit.prevent="handleSubmit">
+          <div
+            v-if="errorMsg"
+            class="rounded-xl border border-red-200 bg-red-50 px-3 py-2 text-xs text-red-700"
+          >
+            {{ errorMsg }}
+          </div>
+
+          <div class="grid grid-cols-2 gap-3">
+            <div>
+              <label class="block text-xs font-medium text-zinc-600">主机名称</label>
+              <input
+                v-model="name"
+                type="text"
+                placeholder="如 lazy-jp / 主力机"
+                class="mt-1 w-full rounded-xl border border-zinc-200 bg-zinc-50/60 px-3 py-2 text-xs text-zinc-900 outline-none focus:border-zinc-400 focus:bg-white"
+              />
+            </div>
+            <div>
+              <label class="block text-xs font-medium text-zinc-600">角色分类</label>
+              <select
+                v-model="role"
+                class="mt-1 w-full rounded-xl border border-zinc-200 bg-zinc-50/60 px-3 py-2 text-xs text-zinc-900 outline-none focus:border-zinc-400 focus:bg-white"
+              >
+                <option v-for="r in roleOptions" :key="r.value" :value="r.value">
+                  {{ r.label }}
+                </option>
+              </select>
+            </div>
+          </div>
+
+          <template v-if="!isLocal">
+            <div class="grid grid-cols-[1fr_96px_110px] gap-2.5">
+              <div>
+                <label class="block text-xs font-medium text-zinc-600">IP / 域名</label>
+                <input
+                  v-model="addr"
+                  type="text"
+                  placeholder="1.2.3.4 或 example.com"
+                  class="mt-1 w-full rounded-xl border border-zinc-200 bg-zinc-50/60 px-3 py-2 font-mono text-xs text-zinc-900 outline-none focus:border-zinc-400 focus:bg-white"
+                />
+              </div>
+              <div>
+                <label class="block text-xs font-medium text-zinc-600">端口</label>
+                <input
+                  v-model.number="port"
+                  type="number"
+                  min="1"
+                  max="65535"
+                  class="mt-1 w-full rounded-xl border border-zinc-200 bg-zinc-50/60 px-3 py-2 font-mono text-xs text-zinc-900 outline-none focus:border-zinc-400 focus:bg-white"
+                />
+              </div>
+              <div>
+                <label class="block text-xs font-medium text-zinc-600">用户名</label>
+                <input
+                  v-model="username"
+                  type="text"
+                  placeholder="root"
+                  class="mt-1 w-full rounded-xl border border-zinc-200 bg-zinc-50/60 px-3 py-2 font-mono text-xs text-zinc-900 outline-none focus:border-zinc-400 focus:bg-white"
+                />
+              </div>
+            </div>
+
+            <div class="grid grid-cols-2 gap-3">
+              <div>
+                <label class="block text-xs font-medium text-zinc-600">认证方式</label>
+                <div class="mt-1 grid grid-cols-2 gap-1 rounded-xl bg-zinc-100 p-1">
+                  <button
+                    type="button"
+                    class="rounded-lg py-1.5 text-xs font-medium transition"
+                    :class="authType === 'password' ? 'bg-white text-zinc-900 shadow-sm' : 'text-zinc-500'"
+                    @click="authType = 'password'"
+                  >
+                    密码
+                  </button>
+                  <button
+                    type="button"
+                    class="rounded-lg py-1.5 text-xs font-medium transition"
+                    :class="authType === 'privateKey' ? 'bg-white text-zinc-900 shadow-sm' : 'text-zinc-500'"
+                    @click="authType = 'privateKey'"
+                  >
+                    SSH 私钥
+                  </button>
+                </div>
+              </div>
+              <div>
+                <label class="block text-xs font-medium text-zinc-600">跳板机（可选）</label>
+                <select
+                  v-model="jumpHostId"
+                  class="mt-1 w-full rounded-xl border border-zinc-200 bg-zinc-50/60 px-3 py-2 text-xs text-zinc-900 outline-none focus:border-zinc-400 focus:bg-white"
+                >
+                  <option value="">直连（不使用跳板）</option>
+                  <option v-for="j in jumpCandidates" :key="j.id" :value="j.id">
+                    {{ j.name }} ({{ j.addr }}:{{ j.port }})
+                  </option>
+                </select>
+              </div>
+            </div>
+
+            <div v-if="authType === 'password'">
+              <label class="block text-xs font-medium text-zinc-600">
+                SSH 密码
+                <span v-if="isEditing && editing?.hasPassword" class="text-zinc-400">
+                  （已保存加密密码，留空则保持不变）
+                </span>
+              </label>
+              <input
+                v-model="password"
+                type="password"
+                placeholder="输入 SSH 密码"
+                class="mt-1 w-full rounded-xl border border-zinc-200 bg-zinc-50/60 px-3 py-2 font-mono text-xs text-zinc-900 outline-none focus:border-zinc-400 focus:bg-white"
+              />
+            </div>
+
+            <div v-else class="space-y-2.5">
+              <div>
+                <label class="block text-xs font-medium text-zinc-600">
+                  SSH 私钥 (PEM / OpenSSH)
+                  <span v-if="isEditing && editing?.hasPrivateKey" class="text-zinc-400">
+                    （已保存加密私钥，留空则保持不变）
+                  </span>
+                </label>
+                <textarea
+                  v-model="privateKey"
+                  rows="3"
+                  placeholder="-----BEGIN OPENSSH PRIVATE KEY-----"
+                  class="mt-1 w-full rounded-xl border border-zinc-200 bg-zinc-50/60 px-3 py-2 font-mono text-xs text-zinc-900 outline-none focus:border-zinc-400 focus:bg-white"
+                />
+              </div>
+              <div>
+                <label class="block text-xs font-medium text-zinc-600">私钥口令 Passphrase（可选）</label>
+                <input
+                  v-model="passphrase"
+                  type="password"
+                  placeholder="无口令可留空"
+                  class="mt-1 w-full rounded-xl border border-zinc-200 bg-zinc-50/60 px-3 py-2 font-mono text-xs text-zinc-900 outline-none focus:border-zinc-400 focus:bg-white"
+                />
+              </div>
+            </div>
+          </template>
+
+          <div>
+            <label class="block text-xs font-medium text-zinc-600">标签（逗号或空格分隔）</label>
+            <input
+              v-model="tagsText"
+              type="text"
+              placeholder="如 hk, bgp, docker"
+              class="mt-1 w-full rounded-xl border border-zinc-200 bg-zinc-50/60 px-3 py-2 text-xs text-zinc-900 outline-none focus:border-zinc-400 focus:bg-white"
+            />
+          </div>
+
+          <div>
+            <div class="flex items-center justify-between">
+              <label class="text-xs font-medium text-zinc-600">快捷链接（商家后台 / 面板）</label>
+              <button
+                type="button"
+                class="text-xs font-medium text-zinc-600 hover:text-zinc-900"
+                @click="addLinkRow"
+              >
+                + 添加一行
+              </button>
+            </div>
+            <div class="mt-1.5 space-y-1.5">
+              <div
+                v-for="(link, idx) in links"
+                :key="idx"
+                class="grid grid-cols-[110px_1fr_28px] gap-1.5"
+              >
+                <input
+                  v-model="link.name"
+                  type="text"
+                  placeholder="名称"
+                  class="rounded-lg border border-zinc-200 bg-zinc-50/60 px-2.5 py-1.5 text-xs outline-none focus:border-zinc-400 focus:bg-white"
+                />
+                <input
+                  v-model="link.url"
+                  type="text"
+                  placeholder="https://..."
+                  class="rounded-lg border border-zinc-200 bg-zinc-50/60 px-2.5 py-1.5 font-mono text-xs outline-none focus:border-zinc-400 focus:bg-white"
+                />
+                <button
+                  type="button"
+                  class="rounded-lg text-zinc-400 hover:bg-zinc-100 hover:text-zinc-700"
+                  @click="removeLinkRow(idx)"
+                >
+                  ×
+                </button>
+              </div>
+            </div>
+          </div>
+
+          <div v-if="!isLocal" class="flex items-center gap-5 pt-1">
+            <label class="inline-flex items-center gap-2 text-xs text-zinc-700">
+              <input v-model="pinned" type="checkbox" class="rounded border-zinc-300 text-zinc-900" />
+              置顶显示
+            </label>
+            <label class="inline-flex items-center gap-2 text-xs text-zinc-700">
+              <input v-model="archived" type="checkbox" class="rounded border-zinc-300 text-zinc-900" />
+              归档隐藏
+            </label>
+          </div>
+        </form>
+
+        <div class="flex items-center justify-end gap-2 border-t border-zinc-100 bg-zinc-50/60 px-5 py-3">
+          <button
+            type="button"
+            class="rounded-xl border border-zinc-200 bg-white px-4 py-1.5 text-xs font-medium text-zinc-700 hover:bg-zinc-50"
+            @click="emit('close')"
+          >
+            取消
+          </button>
+          <button
+            type="button"
+            class="rounded-xl bg-zinc-900 px-4 py-1.5 text-xs font-medium text-white hover:bg-zinc-800"
+            @click="handleSubmit"
+          >
+            保存
+          </button>
+        </div>
+      </div>
+    </div>
+  </Teleport>
+</template>
diff --git a/frontend/src/components/OsBadge.vue b/frontend/src/components/OsBadge.vue
new file mode 100644
index 0000000..3fd276f
--- /dev/null
+++ b/frontend/src/components/OsBadge.vue
@@ -0,0 +1,65 @@
+<script setup lang="ts">
+import { computed } from 'vue';
+import type { OsInfo } from '../types';
+
+const props = defineProps<{
+  osInfo?: OsInfo | null;
+  kind?: 'local' | 'ssh';
+  name?: string;
+  size?: 'sm' | 'md';
+}>();
+
+const distro = computed(() => {
+  const id = (props.osInfo?.distroId || '').toLowerCase();
+  const pretty = (props.osInfo?.prettyName || '').toLowerCase();
+  const os = (props.osInfo?.os || '').toLowerCase();
+  if (os.includes('win') || id.includes('win') || pretty.includes('windows')) return 'windows';
+  if (id.includes('ubuntu') || pretty.includes('ubuntu')) return 'ubuntu';
+  if (id.includes('debian') || pretty.includes('debian')) return 'debian';
+  if (id.includes('alpine') || pretty.includes('alpine')) return 'alpine';
+  return 'linux';
+});
+
+const label = computed(() => {
+  switch (distro.value) {
+    case 'ubuntu':
+      return 'UB';
+    case 'debian':
+      return 'DB';
+    case 'alpine':
+      return 'AL';
+    case 'windows':
+      return 'WN';
+    default:
+      return (props.name || 'VP').slice(0, 2).toUpperCase();
+  }
+});
+</script>
+
+<template>
+  <div
+    class="inline-flex shrink-0 items-center justify-center rounded-full border border-zinc-200/80 bg-zinc-100/90 font-semibold tracking-tight text-zinc-700 select-none dark:border-zinc-700/80 dark:bg-zinc-800/90 dark:text-zinc-200"
+    :class="size === 'sm' ? 'h-6 w-6 text-[10px]' : 'h-10 w-10 text-xs'"
+  >
+    <!-- Ubuntu -->
+    <svg v-if="distro === 'ubuntu'" class="h-4 w-4 text-orange-600" viewBox="0 0 24 24" fill="currentColor">
+      <circle cx="12" cy="12" r="4.2" fill="none" stroke="currentColor" stroke-width="2" />
+      <circle cx="19" cy="12" r="1.8" />
+      <circle cx="8.5" cy="5.8" r="1.8" />
+      <circle cx="8.5" cy="18.2" r="1.8" />
+    </svg>
+    <!-- Debian -->
+    <svg v-else-if="distro === 'debian'" class="h-4 w-4 text-rose-600" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round">
+      <path d="M12 15a3 3 0 1 0-3-3c0 3 2.5 5.5 6 5.5 4 0 6-3 6-6.5C21 6.5 17 3 12 3S3 6.8 3 12c0 5 4 9 9 9" />
+    </svg>
+    <!-- Alpine -->
+    <svg v-else-if="distro === 'alpine'" class="h-4 w-4 text-zinc-700 dark:text-zinc-300" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linejoin="round">
+      <path d="M3 18L9.5 7l4.5 7.5L16.5 11 21 18H3z" />
+    </svg>
+    <!-- Windows -->
+    <svg v-else-if="distro === 'windows'" class="h-3.5 w-3.5 text-zinc-700 dark:text-zinc-300" viewBox="0 0 24 24" fill="currentColor">
+      <path d="M3 3h8.5v8.5H3V3zm9.5 0H21v8.5h-8.5V3zM3 12.5h8.5V21H3v-8.5zm9.5 0H21V21h-8.5v-8.5z" />
+    </svg>
+    <span v-else>{{ label }}</span>
+  </div>
+</template>
diff --git a/frontend/src/components/TerminalPaneView.vue b/frontend/src/components/TerminalPaneView.vue
new file mode 100644
index 0000000..c154576
--- /dev/null
+++ b/frontend/src/components/TerminalPaneView.vue
@@ -0,0 +1,302 @@
+<script setup lang="ts">
+import { onBeforeUnmount, onMounted, ref, watch } from 'vue';
+import { Terminal, type ITheme } from '@xterm/xterm';
+import { FitAddon } from '@xterm/addon-fit';
+import { WebglAddon } from '@xterm/addon-webgl';
+import { WebLinksAddon } from '@xterm/addon-web-links';
+import '@xterm/xterm/css/xterm.css';
+import type { PaneMeta } from '../types';
+
+const props = defineProps<{
+  paneId: string;
+  dark: boolean;
+  focused: boolean;
+  showClose?: boolean;
+}>();
+
+const emit = defineEmits<{
+  focus: [];
+  closePane: [paneId: string];
+  metaUpdate: [meta: PaneMeta];
+}>();
+
+const containerRef = ref<HTMLDivElement | null>(null);
+const connected = ref(false);
+const exited = ref(false);
+
+let term: Terminal | null = null;
+let fitAddon: FitAddon | null = null;
+let ws: WebSocket | null = null;
+let resizeObserver: ResizeObserver | null = null;
+let fitRaf: number | null = null;
+let replayingDepth = 0;
+const textEncoder = new TextEncoder();
+
+// 拦截 xterm.js 自动发出的设备属性应答（如 DA1 \x1b[?1;2c、DA2 \x1b[>0;276;0c），防止在 Shell 提示符上打出 [?1;2c
+const AUTO_TERMINAL_RESPONSE_RE = /^\x1b\[[?>=][0-9;]*c$/;
+
+// 清爽高对比白底主题（严格参考图 4 Reflex 白底终端）
+const LIGHT_THEME: ITheme = {
+  background: '#ffffff',
+  foreground: '#18181b',
+  cursor: '#18181b',
+  cursorAccent: '#ffffff',
+  selectionBackground: 'rgba(24, 24, 27, 0.14)',
+  selectionForeground: '#18181b',
+  black: '#18181b',
+  red: '#dc2626',
+  green: '#16a34a',
+  yellow: '#ca8a04',
+  blue: '#2563eb',
+  magenta: '#9333ea',
+  cyan: '#0891b2',
+  white: '#e4e4e7',
+  brightBlack: '#71717a',
+  brightRed: '#ef4444',
+  brightGreen: '#22c55e',
+  brightYellow: '#eab308',
+  brightBlue: '#3b82f6',
+  brightMagenta: '#a855f7',
+  brightCyan: '#06b6d4',
+  brightWhite: '#fafafa',
+};
+
+// 经典深色终端主题（供一键切换）
+const DARK_THEME: ITheme = {
+  background: '#0c0d10',
+  foreground: '#e4e4e7',
+  cursor: '#f4f4f5',
+  cursorAccent: '#0c0d10',
+  selectionBackground: 'rgba(255, 255, 255, 0.18)',
+  black: '#27272a',
+  red: '#f87171',
+  green: '#4ade80',
+  yellow: '#facc15',
+  blue: '#60a5fa',
+  magenta: '#c084fc',
+  cyan: '#22d3ee',
+  white: '#e4e4e7',
+  brightBlack: '#71717a',
+  brightRed: '#fca5a5',
+  brightGreen: '#86efac',
+  brightYellow: '#fde047',
+  brightBlue: '#93c5fd',
+  brightMagenta: '#d8b4fe',
+  brightCyan: '#67e8f9',
+  brightWhite: '#ffffff',
+};
+
+function sendBinaryInput(data: string) {
+  if (!ws || ws.readyState !== WebSocket.OPEN) return;
+  const bytes = textEncoder.encode(data);
+  const frame = new Uint8Array(1 + bytes.length);
+  frame[0] = 0x01;
+  frame.set(bytes, 1);
+  ws.send(frame);
+}
+
+function sendControl(payload: Record<string, unknown>) {
+  if (!ws || ws.readyState !== WebSocket.OPEN) return;
+  ws.send(JSON.stringify(payload));
+}
+
+function scheduleFit() {
+  if (fitRaf != null) cancelAnimationFrame(fitRaf);
+  fitRaf = requestAnimationFrame(() => {
+    fitRaf = null;
+    if (!term || !fitAddon || !containerRef.value) return;
+    if (containerRef.value.clientWidth < 40 || containerRef.value.clientHeight < 40) return;
+    try {
+      fitAddon.fit();
+      if (term.cols >= 2 && term.rows >= 1) {
+        sendControl({
+          type: 'resize',
+          cols: term.cols,
+          rows: term.rows,
+        });
+      }
+    } catch {
+      // ignore transient layout errors
+    }
+  });
+}
+
+function connectWebSocket() {
+  const proto = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
+  const url = `${proto}//${window.location.host}/api/ws/terminal/${encodeURIComponent(props.paneId)}`;
+  ws = new WebSocket(url);
+  ws.binaryType = 'arraybuffer';
+
+  ws.onopen = () => {
+    connected.value = true;
+    scheduleFit();
+  };
+
+  ws.onmessage = (ev) => {
+    if (ev.data instanceof ArrayBuffer) {
+      const view = new Uint8Array(ev.data);
+      if (view.length > 1 && view[0] === 0x00) {
+        // 实时输出帧
+        term?.write(view.subarray(1));
+      } else if (view.length > 1 && view[0] === 0x02) {
+        // 历史字节环回放帧：写入期间静默屏蔽所有 xterm 自动应答
+        if (term) {
+          replayingDepth += 1;
+          term.write(view.subarray(1), () => {
+            replayingDepth = Math.max(0, replayingDepth - 1);
+          });
+        }
+      }
+      return;
+    }
+    if (typeof ev.data === 'string') {
+      try {
+        const msg = JSON.parse(ev.data);
+        if (msg.type === 'meta' && msg.pane) {
+          exited.value = Boolean(msg.pane.exited);
+          emit('metaUpdate', msg.pane as PaneMeta);
+        }
+      } catch {
+        // ignore
+      }
+    }
+  };
+
+  ws.onclose = () => {
+    connected.value = false;
+  };
+}
+
+watch(
+  () => props.dark,
+  (isDark) => {
+    if (term) {
+      term.options.theme = isDark ? DARK_THEME : LIGHT_THEME;
+    }
+  }
+);
+
+onMounted(() => {
+  if (!containerRef.value) return;
+
+  term = new Terminal({
+    cursorBlink: true,
+    cursorStyle: 'block',
+    fontFamily: '"JetBrains Mono", "Cascadia Mono", Consolas, "PingFang SC", "Microsoft YaHei", monospace',
+    fontSize: 13.5,
+    lineHeight: 1.32,
+    scrollback: 5000,
+    allowProposedApi: true,
+    theme: props.dark ? DARK_THEME : LIGHT_THEME,
+  });
+
+  fitAddon = new FitAddon();
+  term.loadAddon(fitAddon);
+  term.loadAddon(new WebLinksAddon());
+
+  term.open(containerRef.value);
+
+  try {
+    const webgl = new WebglAddon();
+    webgl.onContextLoss(() => {
+      webgl.dispose();
+    });
+    term.loadAddon(webgl);
+  } catch {
+    // WebGL 不可用时自动退回 Canvas 渲染
+  }
+
+  // 智能快捷键：有选区时 Ctrl+C 复制；Ctrl+V 走安全 bracketed paste
+  term.attachCustomKeyEventHandler((e: KeyboardEvent) => {
+    if (e.type !== 'keydown') return true;
+    if ((e.ctrlKey || e.metaKey) && e.key.toLowerCase() === 'c' && !e.shiftKey && !e.altKey) {
+      const sel = term?.getSelection();
+      if (sel) {
+        void navigator.clipboard.writeText(sel);
+        term?.clearSelection();
+        return false;
+      }
+    }
+    if ((e.ctrlKey || e.metaKey) && e.key.toLowerCase() === 'v' && !e.shiftKey && !e.altKey) {
+      e.preventDefault();
+      void navigator.clipboard.readText().then((txt) => {
+        if (txt) sendControl({ type: 'paste', text: txt });
+      });
+      return false;
+    }
+    return true;
+  });
+
+  term.onData((data) => {
+    if (replayingDepth > 0) return;
+    if (AUTO_TERMINAL_RESPONSE_RE.test(data)) return;
+    sendBinaryInput(data);
+  });
+
+  resizeObserver = new ResizeObserver(() => {
+    scheduleFit();
+  });
+  resizeObserver.observe(containerRef.value);
+
+  connectWebSocket();
+  term.focus();
+});
+
+onBeforeUnmount(() => {
+  if (fitRaf != null) cancelAnimationFrame(fitRaf);
+  resizeObserver?.disconnect();
+  if (ws) {
+    ws.onclose = null;
+    ws.close();
+    ws = null;
+  }
+  term?.dispose();
+  term = null;
+});
+</script>
+
+<template>
+  <div
+    class="group/pane relative flex h-full w-full min-h-0 min-w-0 flex-col overflow-hidden transition-colors"
+    :class="[
+      dark ? 'bg-[#0c0d10]' : 'bg-white',
+      focused ? 'ring-1 ring-inset ring-zinc-900/10' : '',
+    ]"
+    @mousedown="emit('focus')"
+  >
+    <!-- 分屏时的右上角悬浮关闭小按钮 -->
+    <button
+      v-if="showClose"
+      type="button"
+      class="absolute right-2.5 top-2 z-20 hidden rounded-lg border px-1.5 py-0.5 text-[11px] opacity-80 transition group-hover/pane:inline-flex"
+      :class="
+        dark
+          ? 'border-zinc-700 bg-zinc-800 text-zinc-300 hover:bg-zinc-700'
+          : 'border-zinc-200 bg-white/90 text-zinc-500 hover:bg-zinc-100 hover:text-zinc-900'
+      "
+      title="关闭此分屏"
+      @click.stop="emit('closePane', paneId)"
+    >
+      关闭分屏 ✕
+    </button>
+
+    <!-- xterm 挂载容器 -->
+    <div ref="containerRef" class="h-full w-full flex-1 overflow-hidden px-3 py-2" />
+
+    <!-- 会话已退出提示条 -->
+    <div
+      v-if="exited"
+      class="flex items-center justify-between border-t border-zinc-200/80 bg-zinc-50 px-3 py-1.5 text-xs text-zinc-500"
+    >
+      <span>终端进程已退出</span>
+      <button
+        v-if="showClose"
+        type="button"
+        class="rounded-md bg-zinc-900 px-2 py-0.5 text-white"
+        @click="emit('closePane', paneId)"
+      >
+        移除面板
+      </button>
+    </div>
+  </div>
+</template>
diff --git a/frontend/src/components/TerminalStage.vue b/frontend/src/components/TerminalStage.vue
new file mode 100644
index 0000000..1c7fafb
--- /dev/null
+++ b/frontend/src/components/TerminalStage.vue
@@ -0,0 +1,201 @@
+<script setup lang="ts">
+import { computed, ref } from 'vue';
+import TerminalPaneView from './TerminalPaneView.vue';
+import type { PaneMeta, PublicHost } from '../types';
+
+const props = defineProps<{
+  host: PublicHost;
+  panes: PaneMeta[];
+  splitDirection: 'row' | 'col';
+  dark: boolean;
+  rightWing: 'detail' | 'files' | null;
+  creating: boolean;
+}>();
+
+const emit = defineEmits<{
+  split: [direction: 'row' | 'col'];
+  closePane: [paneId: string];
+  toggleDark: [];
+  toggleRightWing: [mode: 'files' | 'detail'];
+  collapseStage: [];
+  metaUpdate: [meta: PaneMeta];
+}>();
+
+const focusedPaneId = ref<string | null>(null);
+
+const activePane = computed(() => {
+  return (
+    props.panes.find((p) => p.id === focusedPaneId.value) ||
+    props.panes[props.panes.length - 1] ||
+    null
+  );
+});
+</script>
+
+<template>
+  <section
+    class="flex h-full w-full min-w-[420px] flex-col overflow-hidden rounded-2xl border border-zinc-200/80 bg-white/95 shadow-[0_4px_24px_rgba(0,0,0,0.04)] backdrop-blur-xl dark:border-zinc-800 dark:bg-zinc-900/95"
+  >
+    <!-- 舞台顶栏：主机状态 + OSC 7 实时目录 + OSC 133 命令状态 + 分屏/黑白底/右侧等宽栏开关 -->
+    <div class="flex shrink-0 items-center justify-between gap-2 border-b border-zinc-100 px-4 py-2.5 dark:border-zinc-800">
+      <!-- 左侧信息 -->
+      <div class="flex min-w-0 items-center gap-2">
+        <span
+          class="h-2.5 w-2.5 shrink-0 rounded-full"
+          :class="host.status === 'online' ? 'bg-emerald-500 shadow-[0_0_8px_rgba(16,185,129,0.5)]' : 'bg-zinc-300 dark:bg-zinc-600'"
+        />
+        <span class="truncate text-sm font-semibold text-zinc-900 dark:text-zinc-100">
+          {{ host.name }}
+        </span>
+        <span class="hidden sm:inline font-mono text-xs text-zinc-400">
+          {{ host.kind === 'local' ? 'PowerShell (ConPTY)' : `${host.username}@${host.addr}:${host.port}` }}
+        </span>
+
+        <!-- OSC 7 实时工作目录胶囊 -->
+        <span
+          v-if="activePane?.cwd"
+          class="inline-flex max-w-[200px] items-center gap-1 truncate rounded-lg border border-zinc-200/80 bg-zinc-50 px-2 py-0.5 font-mono text-[11px] text-zinc-600 dark:border-zinc-700 dark:bg-zinc-800 dark:text-zinc-300"
+          :title="`当前目录: ${activePane.cwd}`"
+        >
+          <svg class="h-3 w-3 shrink-0 text-zinc-400" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+            <path d="M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v8a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V7z" />
+          </svg>
+          <span class="truncate">{{ activePane.cwd }}</span>
+        </span>
+
+        <!-- OSC 133 实时命令运行态与真实 Exit Code -->
+        <span
+          v-if="activePane?.running"
+          class="inline-flex items-center gap-1 rounded-lg bg-amber-50 px-2 py-0.5 text-[11px] font-medium text-amber-700 dark:bg-amber-950/60 dark:text-amber-400"
+        >
+          <span class="h-1.5 w-1.5 animate-ping rounded-full bg-amber-500" />
+          运行中
+        </span>
+        <span
+          v-else-if="activePane?.lastExitCode != null"
+          class="inline-flex items-center rounded-lg px-1.5 py-0.5 font-mono text-[10px] font-medium"
+          :class="
+            activePane.lastExitCode === 0
+              ? 'bg-emerald-50 text-emerald-700 dark:bg-emerald-950/60 dark:text-emerald-400'
+              : 'bg-red-50 text-red-600 dark:bg-red-950/60 dark:text-red-400'
+          "
+          :title="`上一条命令退出码: ${activePane.lastExitCode}`"
+        >
+          {{ activePane.lastExitCode === 0 ? '✓ 0' : `✗ ${activePane.lastExitCode}` }}
+        </span>
+      </div>
+
+      <!-- 右侧工具条：分屏 + 主题 + 右侧等宽栏（文件管理 / 详情图表） + 收起 -->
+      <div class="flex shrink-0 items-center gap-1.5">
+        <!-- 左右分屏 / 上下分屏 -->
+        <div class="flex items-center rounded-xl border border-zinc-200/80 bg-zinc-50/80 p-0.5 dark:border-zinc-700 dark:bg-zinc-800">
+          <button
+            type="button"
+            class="rounded-lg px-2 py-1 text-[11px] font-medium text-zinc-600 transition hover:bg-white hover:text-zinc-900 hover:shadow-sm disabled:opacity-40 dark:text-zinc-300 dark:hover:bg-zinc-700 dark:hover:text-white"
+            :disabled="creating"
+            title="向右分屏（复用当前 SSH 连接）"
+            @click="emit('split', 'row')"
+          >
+            左右分屏
+          </button>
+          <button
+            type="button"
+            class="rounded-lg px-2 py-1 text-[11px] font-medium text-zinc-600 transition hover:bg-white hover:text-zinc-900 hover:shadow-sm disabled:opacity-40 dark:text-zinc-300 dark:hover:bg-zinc-700 dark:hover:text-white"
+            :disabled="creating"
+            title="向下分屏（复用当前 SSH 连接）"
+            @click="emit('split', 'col')"
+          >
+            上下分屏
+          </button>
+        </div>
+
+        <!-- 白底 / 黑底一键切换 -->
+        <button
+          type="button"
+          class="rounded-xl border border-zinc-200/80 bg-white px-2.5 py-1 text-xs font-medium text-zinc-600 transition hover:bg-zinc-100 hover:text-zinc-900 dark:border-zinc-700 dark:bg-zinc-800 dark:text-zinc-300 dark:hover:bg-zinc-700"
+          :title="dark ? '切换为清爽白底终端' : '切换为深色黑底终端'"
+          @click="emit('toggleDark')"
+        >
+          {{ dark ? '白底' : '黑底' }}
+        </button>
+
+        <!-- 在最右栏展开与左栏等宽(336px)的「文件管理」 -->
+        <button
+          type="button"
+          class="inline-flex items-center gap-1.5 rounded-xl border px-2.5 py-1 text-xs font-medium transition"
+          :class="
+            rightWing === 'files'
+              ? 'border-zinc-900 bg-zinc-900 text-white shadow-sm dark:border-zinc-100 dark:bg-zinc-100 dark:text-zinc-900'
+              : 'border-zinc-200/80 bg-white text-zinc-600 hover:bg-zinc-100 hover:text-zinc-900 dark:border-zinc-700 dark:bg-zinc-800 dark:text-zinc-300 dark:hover:bg-zinc-700'
+          "
+          title="在右侧等宽栏展开文件管理"
+          @click="emit('toggleRightWing', 'files')"
+        >
+          <svg class="h-3.5 w-3.5" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+            <path d="M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v8a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V7z" />
+          </svg>
+          <span>文件管理</span>
+        </button>
+
+        <!-- 在最右栏展开与左栏等宽(336px)的「详情图表」 -->
+        <button
+          type="button"
+          class="inline-flex items-center gap-1.5 rounded-xl border px-2.5 py-1 text-xs font-medium transition"
+          :class="
+            rightWing === 'detail'
+              ? 'border-zinc-900 bg-zinc-900 text-white shadow-sm dark:border-zinc-100 dark:bg-zinc-100 dark:text-zinc-900'
+              : 'border-zinc-200/80 bg-white text-zinc-600 hover:bg-zinc-100 hover:text-zinc-900 dark:border-zinc-700 dark:bg-zinc-800 dark:text-zinc-300 dark:hover:bg-zinc-700'
+          "
+          title="在右侧等宽栏展开详情图表"
+          @click="emit('toggleRightWing', 'detail')"
+        >
+          <svg class="h-3.5 w-3.5" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+            <path d="M18 20V10M12 20V4M6 20v-6" />
+          </svg>
+          <span>详情图表</span>
+        </button>
+
+        <button
+          type="button"
+          class="ml-0.5 rounded-lg p-1 text-zinc-400 transition hover:bg-zinc-100 hover:text-zinc-800 dark:hover:bg-zinc-800 dark:hover:text-zinc-200"
+          title="收起舞台回到仓库（终端后台保活，可从左上角标签秒切回）"
+          @click="emit('collapseStage')"
+        >
+          ✕
+        </button>
+      </div>
+    </div>
+
+    <!-- 终端分屏画布区 -->
+    <div
+      v-if="panes.length"
+      class="flex min-h-0 flex-1 divide-zinc-200/80 overflow-hidden"
+      :class="splitDirection === 'col' ? 'flex-col divide-y' : 'flex-row divide-x'"
+    >
+      <div
+        v-for="pane in panes"
+        :key="pane.id"
+        class="min-h-0 min-w-0 flex-1 overflow-hidden"
+      >
+        <TerminalPaneView
+          :pane-id="pane.id"
+          :dark="dark"
+          :focused="focusedPaneId === pane.id || panes.length === 1"
+          :show-close="panes.length > 1"
+          @focus="focusedPaneId = pane.id"
+          @close-pane="emit('closePane', $event)"
+          @meta-update="emit('metaUpdate', $event)"
+        />
+      </div>
+    </div>
+
+    <!-- 正在握手建立连接时的加载态 -->
+    <div
+      v-else
+      class="flex flex-1 flex-col items-center justify-center gap-2 text-xs text-zinc-400"
+    >
+      <div class="h-5 w-5 animate-spin rounded-full border-2 border-zinc-300 border-t-zinc-800" />
+      <span>正在连接 {{ host.name }} 终端...</span>
+    </div>
+  </section>
+</template>
diff --git a/frontend/src/main.ts b/frontend/src/main.ts
new file mode 100644
index 0000000..8dd6bc1
--- /dev/null
+++ b/frontend/src/main.ts
@@ -0,0 +1,5 @@
+import { createApp } from 'vue';
+import App from './App.vue';
+import './style.css';
+
+createApp(App).mount('#app');
diff --git a/frontend/src/style.css b/frontend/src/style.css
new file mode 100644
index 0000000..59ad8a9
--- /dev/null
+++ b/frontend/src/style.css
@@ -0,0 +1,43 @@
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+@layer base {
+  html,
+  body,
+  #app {
+    height: 100%;
+    margin: 0;
+    overflow: hidden;
+    background: radial-gradient(120% 120% at 50% 0%, #f9fafb 0%, #f1f3f6 100%);
+    transition: background 0.2s ease, color 0.2s ease;
+  }
+
+  html.dark,
+  html.dark body,
+  html.dark #app {
+    background: radial-gradient(120% 120% at 50% 0%, #111215 0%, #090a0c 100%);
+    color: #f4f4f5;
+  }
+}
+
+::-webkit-scrollbar {
+  width: 6px;
+  height: 6px;
+}
+::-webkit-scrollbar-track {
+  background: transparent;
+}
+::-webkit-scrollbar-thumb {
+  background: rgba(24, 24, 27, 0.14);
+  border-radius: 9999px;
+}
+::-webkit-scrollbar-thumb:hover {
+  background: rgba(24, 24, 27, 0.26);
+}
+html.dark ::-webkit-scrollbar-thumb {
+  background: rgba(255, 255, 255, 0.14);
+}
+html.dark ::-webkit-scrollbar-thumb:hover {
+  background: rgba(255, 255, 255, 0.26);
+}
diff --git a/frontend/src/types.ts b/frontend/src/types.ts
new file mode 100644
index 0000000..2104c70
--- /dev/null
+++ b/frontend/src/types.ts
@@ -0,0 +1,161 @@
+export interface HostLink {
+  id: string;
+  name: string;
+  url: string;
+  description: string;
+}
+
+export interface OsInfo {
+  os?: string | null;
+  distroId?: string | null;
+  versionId?: string | null;
+  prettyName?: string | null;
+  arch?: string | null;
+  kernel?: string | null;
+  cpuModel?: string | null;
+  cpuCores?: number | null;
+  detectedAt?: string | null;
+}
+
+export type HostRole = 'primary' | 'proxy' | 'test' | 'archive';
+
+export interface PublicHost {
+  id: string;
+  name: string;
+  kind: 'local' | 'ssh';
+  addr: string;
+  port: number;
+  username: string;
+  authType: 'local' | 'password' | 'privateKey';
+  hasPassword: boolean;
+  hasPrivateKey: boolean;
+  hasPassphrase: boolean;
+  jumpHostId?: string | null;
+  jumpHostName?: string | null;
+  role?: HostRole | null;
+  tags: string[];
+  links: HostLink[];
+  osInfo?: OsInfo | null;
+  pinned: boolean;
+  favorited?: boolean;
+  archived: boolean;
+  sortOrder: number;
+  status: 'online' | 'offline' | 'unknown';
+  latencyMs?: number | null;
+  lastConnectedAt?: string | null;
+  lastError?: string | null;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface HostUpsertPayload {
+  name: string;
+  addr: string;
+  port: number;
+  username: string;
+  authType: 'password' | 'privateKey';
+  password?: string;
+  privateKey?: string;
+  passphrase?: string;
+  jumpHostId?: string | null;
+  role?: string | null;
+  tags: string[];
+  links: HostLink[];
+  pinned: boolean;
+  archived: boolean;
+}
+
+export const ROLE_META: Record<HostRole, { label: string }> = {
+  primary: { label: '主力' },
+  proxy: { label: '代理' },
+  test: { label: '测试' },
+  archive: { label: '归档' },
+};
+
+export interface PaneMeta {
+  id: string;
+  hostId: string;
+  cols: number;
+  rows: number;
+  cwd?: string | null;
+  title?: string | null;
+  running: boolean;
+  lastExitCode?: number | null;
+  bracketedPaste: boolean;
+  exited: boolean;
+}
+
+export interface FileEntry {
+  name: string;
+  path: string;
+  isDir: boolean;
+  size: number;
+  mtime: number;
+  permissions?: number | null;
+}
+
+export interface TransferTask {
+  id: string;
+  hostId: string;
+  hostName: string;
+  direction: 'upload' | 'download';
+  filename: string;
+  localPath?: string | null;
+  remotePath: string;
+  totalBytes: number;
+  transferredBytes: number;
+  speedBps: number;
+  state: 'running' | 'completed' | 'failed';
+  error?: string | null;
+  startedAt: string;
+  endedAt?: string | null;
+}
+
+export interface DiskUsageItem {
+  mount: string;
+  totalBytes: number;
+  usedBytes: number;
+}
+
+export interface HostInspection {
+  hostId: string;
+  sampledAt: string;
+  uptimeSeconds: number;
+  load1: number;
+  load5: number;
+  load15: number;
+  tcpCc?: string | null;
+  cpuModel?: string | null;
+  cpuCores: number;
+  cpuUsagePct: number;
+  cpuIowaitPct: number;
+  cpuStealPct: number;
+  memTotalBytes: number;
+  memUsedBytes: number;
+  memCachedBytes: number;
+  swapTotalBytes: number;
+  swapUsedBytes: number;
+  diskMount: string;
+  diskTotalBytes: number;
+  diskUsedBytes: number;
+  disks: DiskUsageItem[];
+  netIface: string;
+  netRxBytesTotal: number;
+  netTxBytesTotal: number;
+  netRxBps: number;
+  netTxBps: number;
+}
+
+export const globalInspectionCache = new Map<string, HostInspection>();
+export function seedInspectionMap(map: Record<string, HostInspection> | undefined | null) {
+  if (!map || typeof map !== 'object') return;
+  for (const [k, v] of Object.entries(map)) {
+    if (v && typeof v === 'object') {
+      globalInspectionCache.set(k, v);
+    }
+  }
+}
+
+
+
+
diff --git a/frontend/tailwind.config.js b/frontend/tailwind.config.js
new file mode 100644
index 0000000..3cb93ad
--- /dev/null
+++ b/frontend/tailwind.config.js
@@ -0,0 +1,26 @@
+/** @type {import('tailwindcss').Config} */
+export default {
+  darkMode: 'class',
+  content: ['./index.html', './src/**/*.{vue,js,ts,jsx,tsx}'],
+  theme: {
+    extend: {
+      fontFamily: {
+        sans: [
+          'Inter',
+          '-apple-system',
+          'BlinkMacSystemFont',
+          '"PingFang SC"',
+          '"Microsoft YaHei"',
+          'sans-serif',
+        ],
+        mono: [
+          '"JetBrains Mono"',
+          '"Cascadia Mono"',
+          'Consolas',
+          'monospace',
+        ],
+      },
+    },
+  },
+  plugins: [],
+};
diff --git a/frontend/tsconfig.json b/frontend/tsconfig.json
new file mode 100644
index 0000000..65f6a65
--- /dev/null
+++ b/frontend/tsconfig.json
@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "useDefineForClassFields": true,
+    "module": "ESNext",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "skipLibCheck": true,
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "isolatedModules": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+    "jsx": "preserve",
+    "strict": true
+  },
+  "include": ["src/**/*.ts", "src/**/*.tsx", "src/**/*.vue"]
+}
diff --git a/frontend/vite.config.ts b/frontend/vite.config.ts
new file mode 100644
index 0000000..46bc831
--- /dev/null
+++ b/frontend/vite.config.ts
@@ -0,0 +1,26 @@
+import { defineConfig } from 'vite';
+import vue from '@vitejs/plugin-vue';
+
+export default defineConfig({
+  plugins: [vue()],
+  server: {
+    port: 5173,
+    proxy: {
+      '/api': {
+        target: 'http://127.0.0.1:18800',
+        changeOrigin: true,
+      },
+    },
+  },
+  build: {
+    outDir: 'dist',
+    emptyOutDir: true,
+    rollupOptions: {
+      output: {
+        manualChunks: {
+          xterm: ['@xterm/xterm', '@xterm/addon-fit', '@xterm/addon-webgl', '@xterm/addon-web-links'],
+        },
+      },
+    },
+  },
+});
diff --git a/src/api.rs b/src/api.rs
new file mode 100644
index 0000000..5d3b54b
--- /dev/null
+++ b/src/api.rs
@@ -0,0 +1,1305 @@
+use crate::{
+    db::Database,
+    files::{
+        self, join_remote_path, TransferManager,
+    },
+    inspector::InspectorEngine,
+    mcp::{handle_mcp_request, sync_cli_mcp_configs, ExecTaskManager, JsonRpcRequest},
+    models::{HostMetaPatch, HostUpsertPayload, ReorderPayload, LOCAL_HOST_ID},
+    ssh::SshPool,
+    terminal::{PaneBroadcast, PaneCommand, PaneHandle, TerminalManager},
+};
+use axum::{
+    body::Body,
+    extract::{
+        ws::{Message, WebSocket, WebSocketUpgrade},
+        DefaultBodyLimit, Path, Query, Request, State,
+    },
+    http::{header, HeaderMap, StatusCode},
+    middleware::{self, Next},
+    response::{
+        sse::{Event as SseEvent, KeepAlive, Sse},
+        IntoResponse, Response,
+    },
+    routing::{delete, get, patch, post, put},
+    Json, Router,
+};
+use futures::{
+    sink::SinkExt,
+    stream::{self, StreamExt},
+    TryStreamExt,
+};
+use serde::Deserialize;
+use serde_json::json;
+use std::{
+    collections::HashSet,
+    sync::{Arc, Mutex},
+    time::Instant,
+};
+use tokio::io::AsyncReadExt;
+use tokio_util::io::StreamReader;
+use uuid::Uuid;
+
+pub struct AppState {
+    pub db: Arc<Database>,
+    pub ssh_pool: Arc<SshPool>,
+    pub terminals: Arc<TerminalManager>,
+    pub transfers: Arc<TransferManager>,
+    pub inspector: Arc<InspectorEngine>,
+    pub exec_tasks: Arc<ExecTaskManager>,
+    pub sessions: Mutex<HashSet<String>>,
+    pub port: u16,
+}
+
+pub fn build_api_router(state: Arc<AppState>) -> Router {
+    let protected_api = Router::new()
+        .route("/api/mcp/status", get(api_mcp_status).post(api_mcp_sync))
+        .route("/api/settings", get(api_get_settings))
+        .route("/api/settings/auth", put(api_update_auth_settings))
+        .route("/api/settings/mcp", put(api_update_mcp_settings))
+        .route("/api/events", get(api_sse_events))
+        .route("/api/hosts", get(list_hosts).post(create_host))
+        .route("/api/hosts/reorder", put(reorder_hosts))
+        .route("/api/hosts/import-1shell", post(import_from_1shell))
+        .route("/api/hosts/check-all", post(check_all_hosts))
+        .route("/api/hosts/:id", put(update_host).delete(delete_host))
+        .route("/api/hosts/:id/meta", patch(patch_host_meta))
+        .route("/api/hosts/:id/check", post(check_single_host))
+        .route("/api/hosts/:id/inspect", get(inspect_single_host))
+        .route("/api/terminals", get(list_terminals).post(create_terminal))
+        .route("/api/terminals/:pane_id", delete(close_terminal))
+        .route("/api/ws/terminal/:pane_id", get(ws_terminal_handler))
+        .route("/api/files/list", get(api_list_dir))
+        .route("/api/files/prewarm", post(api_prewarm_files))
+        .route("/api/files/read", get(api_read_file))
+        .route("/api/files/write", post(api_write_file))
+        .route("/api/files/mkdir", post(api_mkdir))
+        .route("/api/files/rename", post(api_rename_item))
+        .route("/api/files/remove", post(api_remove_item))
+        .route("/api/files/compress", post(api_compress_item))
+        .route("/api/files/extract", post(api_extract_item))
+        .route(
+            "/api/files/upload",
+            post(api_stream_upload).layer(DefaultBodyLimit::disable()),
+        )
+        .route("/api/files/download", get(api_stream_download))
+        .route(
+            "/api/transfers",
+            get(api_list_transfers)
+                .post(api_create_local_remote_transfer)
+                .delete(api_clear_transfers),
+        )
+        .route_layer(middleware::from_fn_with_state(
+            state.clone(),
+            require_web_auth,
+        ));
+
+    Router::new()
+        .route("/mcp", post(api_mcp_rpc))
+        .route("/api/mcp", post(api_mcp_rpc))
+        .route("/api/window/show", post(api_show_window))
+        .route("/api/auth/status", get(api_auth_status))
+        .route("/api/auth/login", post(api_auth_login))
+        .route("/api/auth/logout", post(api_auth_logout))
+        .merge(protected_api)
+        .with_state(state)
+}
+
+async fn api_show_window(State(state): State<Arc<AppState>>) -> impl IntoResponse {
+    state.terminals.notify_show_main_window();
+    (StatusCode::OK, Json(json!({ "ok": true })))
+}
+
+fn err_response(status: StatusCode, msg: impl ToString) -> impl IntoResponse {
+    (
+        status,
+        Json(json!({
+            "ok": false,
+            "error": msg.to_string(),
+        })),
+    )
+}
+
+async fn list_hosts(State(state): State<Arc<AppState>>) -> impl IntoResponse {
+    match state.db.list_public_hosts() {
+        Ok(hosts) => (
+            StatusCode::OK,
+            Json(json!({
+                "ok": true,
+                "hosts": hosts,
+                "inspections": state.inspector.get_all_cached(),
+            })),
+        )
+            .into_response(),
+        Err(e) => err_response(StatusCode::INTERNAL_SERVER_ERROR, e).into_response(),
+    }
+}
+
+async fn create_host(
+    State(state): State<Arc<AppState>>,
+    Json(payload): Json<HostUpsertPayload>,
+) -> impl IntoResponse {
+    match state.db.create_host(payload) {
+        Ok(host) => (
+            StatusCode::OK,
+            Json(json!({
+                "ok": true,
+                "host": host,
+            })),
+        )
+            .into_response(),
+        Err(e) => err_response(StatusCode::BAD_REQUEST, e).into_response(),
+    }
+}
+
+async fn update_host(
+    State(state): State<Arc<AppState>>,
+    Path(id): Path<String>,
+    Json(payload): Json<HostUpsertPayload>,
+) -> impl IntoResponse {
+    state.ssh_pool.invalidate_host(&id).await;
+    match state.db.update_host(&id, payload) {
+        Ok(host) => (
+            StatusCode::OK,
+            Json(json!({
+                "ok": true,
+                "host": host,
+            })),
+        )
+            .into_response(),
+        Err(e) => err_response(StatusCode::BAD_REQUEST, e).into_response(),
+    }
+}
+
+async fn patch_host_meta(
+    State(state): State<Arc<AppState>>,
+    Path(id): Path<String>,
+    Json(patch): Json<HostMetaPatch>,
+) -> impl IntoResponse {
+    match state.db.patch_meta(&id, patch) {
+        Ok(host) => (
+            StatusCode::OK,
+            Json(json!({
+                "ok": true,
+                "host": host,
+            })),
+        )
+            .into_response(),
+        Err(e) => err_response(StatusCode::BAD_REQUEST, e).into_response(),
+    }
+}
+
+async fn reorder_hosts(
+    State(state): State<Arc<AppState>>,
+    Json(payload): Json<ReorderPayload>,
+) -> impl IntoResponse {
+    match state.db.reorder(&payload.ordered_ids) {
+        Ok(()) => match state.db.list_public_hosts() {
+            Ok(hosts) => (
+                StatusCode::OK,
+                Json(json!({
+                    "ok": true,
+                    "hosts": hosts,
+                })),
+            )
+                .into_response(),
+            Err(e) => err_response(StatusCode::INTERNAL_SERVER_ERROR, e).into_response(),
+        },
+        Err(e) => err_response(StatusCode::BAD_REQUEST, e).into_response(),
+    }
+}
+
+async fn delete_host(
+    State(state): State<Arc<AppState>>,
+    Path(id): Path<String>,
+) -> impl IntoResponse {
+    state.ssh_pool.invalidate_host(&id).await;
+    match state.db.delete_host(&id) {
+        Ok(()) => (StatusCode::OK, Json(json!({ "ok": true }))).into_response(),
+        Err(e) => err_response(StatusCode::BAD_REQUEST, e).into_response(),
+    }
+}
+
+async fn import_from_1shell(State(state): State<Arc<AppState>>) -> impl IntoResponse {
+    match state.db.import_from_1shell() {
+        Ok(imported) => match state.db.list_public_hosts() {
+            Ok(hosts) => (
+                StatusCode::OK,
+                Json(json!({
+                    "ok": true,
+                    "imported": imported,
+                    "hosts": hosts,
+                })),
+            )
+                .into_response(),
+            Err(e) => err_response(StatusCode::INTERNAL_SERVER_ERROR, e).into_response(),
+        },
+        Err(e) => err_response(StatusCode::BAD_REQUEST, e).into_response(),
+    }
+}
+
+async fn check_single_host(
+    State(state): State<Arc<AppState>>,
+    Path(id): Path<String>,
+) -> impl IntoResponse {
+    let inspection = state
+        .inspector
+        .inspect_host(&state.ssh_pool, &state.db, &id)
+        .await
+        .ok();
+    match state.db.get_public_host(&id) {
+        Ok(Some(host)) => (
+            StatusCode::OK,
+            Json(json!({
+                "ok": true,
+                "host": host,
+                "inspection": inspection,
+            })),
+        )
+            .into_response(),
+        Ok(None) => err_response(StatusCode::NOT_FOUND, "主机不存在").into_response(),
+        Err(e) => err_response(StatusCode::INTERNAL_SERVER_ERROR, e).into_response(),
+    }
+}
+
+async fn inspect_single_host(
+    State(state): State<Arc<AppState>>,
+    Path(id): Path<String>,
+) -> impl IntoResponse {
+    match state
+        .inspector
+        .inspect_host(&state.ssh_pool, &state.db, &id)
+        .await
+    {
+        Ok(inspection) => {
+            let host = state.db.get_public_host(&id).ok().flatten();
+            (
+                StatusCode::OK,
+                Json(json!({
+                    "ok": true,
+                    "inspection": inspection,
+                    "host": host,
+                })),
+            )
+                .into_response()
+        }
+        Err(e) => err_response(StatusCode::BAD_REQUEST, format!("{e:#}")).into_response(),
+    }
+}
+
+async fn check_all_hosts(State(state): State<Arc<AppState>>) -> impl IntoResponse {
+    let records = match state.db.list_records() {
+        Ok(r) => r,
+        Err(e) => return err_response(StatusCode::INTERNAL_SERVER_ERROR, e).into_response(),
+    };
+
+    let active_hosts: Vec<_> = records.into_iter().filter(|r| !r.archived).collect();
+
+    let db = state.db.clone();
+    let pool = state.ssh_pool.clone();
+    let inspector = state.inspector.clone();
+    stream::iter(active_hosts)
+        .for_each_concurrent(8, |record| {
+            let db = db.clone();
+            let pool = pool.clone();
+            let inspector = inspector.clone();
+            async move {
+                let _ = inspector.inspect_host(&pool, &db, &record.id).await;
+            }
+        })
+        .await;
+
+    match state.db.list_public_hosts() {
+        Ok(hosts) => (
+            StatusCode::OK,
+            Json(json!({
+                "ok": true,
+                "hosts": hosts,
+                "inspections": state.inspector.get_all_cached(),
+            })),
+        )
+            .into_response(),
+        Err(e) => err_response(StatusCode::INTERNAL_SERVER_ERROR, e).into_response(),
+    }
+}
+
+// ==================== 板块二：终端 API 与二进制 WebSocket ====================
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct ListTerminalsQuery {
+    host_id: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct CreateTerminalPayload {
+    host_id: String,
+    #[serde(default = "default_cols")]
+    cols: u16,
+    #[serde(default = "default_rows")]
+    rows: u16,
+    cwd: Option<String>,
+}
+
+fn default_cols() -> u16 {
+    100
+}
+fn default_rows() -> u16 {
+    30
+}
+
+async fn list_terminals(
+    State(state): State<Arc<AppState>>,
+    Query(query): Query<ListTerminalsQuery>,
+) -> impl IntoResponse {
+    let panes = state
+        .terminals
+        .list_panes(query.host_id.as_deref(), false);
+    (
+        StatusCode::OK,
+        Json(json!({
+            "ok": true,
+            "panes": panes,
+        })),
+    )
+}
+
+async fn create_terminal(
+    State(state): State<Arc<AppState>>,
+    Json(payload): Json<CreateTerminalPayload>,
+) -> impl IntoResponse {
+    match state
+        .terminals
+        .create_pane(
+            &state.ssh_pool,
+            &state.db,
+            &payload.host_id,
+            payload.cols,
+            payload.rows,
+            payload.cwd,
+            false,
+        )
+        .await
+    {
+        Ok(pane) => (
+            StatusCode::OK,
+            Json(json!({
+                "ok": true,
+                "pane": pane,
+            })),
+        )
+            .into_response(),
+        Err(e) => err_response(StatusCode::BAD_REQUEST, format!("{e:#}")).into_response(),
+    }
+}
+
+async fn close_terminal(
+    State(state): State<Arc<AppState>>,
+    Path(pane_id): Path<String>,
+) -> impl IntoResponse {
+    let closed = state.terminals.close_pane(&pane_id);
+    (
+        StatusCode::OK,
+        Json(json!({
+            "ok": true,
+            "closed": closed,
+        })),
+    )
+}
+
+async fn ws_terminal_handler(
+    ws: WebSocketUpgrade,
+    State(state): State<Arc<AppState>>,
+    Path(pane_id): Path<String>,
+) -> impl IntoResponse {
+    let Some(pane) = state.terminals.get_pane(&pane_id) else {
+        return err_response(StatusCode::NOT_FOUND, "终端 Pane 不存在或已关闭").into_response();
+    };
+    ws.on_upgrade(move |socket| handle_terminal_ws(socket, pane))
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(tag = "type", rename_all = "camelCase")]
+enum WsClientControl {
+    Resize { cols: u16, rows: u16 },
+    Paste { text: String },
+}
+
+async fn handle_terminal_ws(socket: WebSocket, pane: Arc<PaneHandle>) {
+    let (mut ws_tx, mut ws_rx) = socket.split();
+    let mut bcast_rx = pane.broadcast_tx.subscribe();
+
+    let replay = pane.replay_bytes();
+    if !replay.is_empty() {
+        let mut frame = Vec::with_capacity(1 + replay.len());
+        frame.push(0x02);
+        frame.extend_from_slice(&replay);
+        if ws_tx.send(Message::Binary(frame)).await.is_err() {
+            return;
+        }
+    }
+
+    let meta_msg = json!({
+        "type": "meta",
+        "pane": pane.snapshot_meta(),
+    })
+    .to_string();
+    if ws_tx.send(Message::Text(meta_msg)).await.is_err() {
+        return;
+    }
+
+    loop {
+        tokio::select! {
+            bcast = bcast_rx.recv() => {
+                match bcast {
+                    Ok(PaneBroadcast::Output(chunk)) => {
+                        let mut frame = Vec::with_capacity(1 + chunk.len());
+                        frame.push(0x00);
+                        frame.extend_from_slice(&chunk);
+                        if ws_tx.send(Message::Binary(frame)).await.is_err() {
+                            break;
+                        }
+                    }
+                    Ok(PaneBroadcast::Meta(meta)) => {
+                        let text = json!({
+                            "type": "meta",
+                            "pane": meta,
+                        }).to_string();
+                        if ws_tx.send(Message::Text(text)).await.is_err() {
+                            break;
+                        }
+                    }
+                    Err(tokio::sync::broadcast::error::RecvError::Lagged(_)) => {
+                        let snapshot = pane.replay_bytes();
+                        let mut frame = Vec::with_capacity(1 + snapshot.len());
+                        frame.push(0x02);
+                        frame.extend_from_slice(&snapshot);
+                        if ws_tx.send(Message::Binary(frame)).await.is_err() {
+                            break;
+                        }
+                    }
+                    Err(tokio::sync::broadcast::error::RecvError::Closed) => break,
+                }
+            }
+            incoming = ws_rx.next() => {
+                match incoming {
+                    Some(Ok(Message::Binary(data))) => {
+                        if data.first() == Some(&0x01) && data.len() > 1 {
+                            let _ = pane.cmd_tx.send(PaneCommand::Input(data[1..].to_vec()));
+                        } else if !data.is_empty() {
+                            let _ = pane.cmd_tx.send(PaneCommand::Input(data));
+                        }
+                    }
+                    Some(Ok(Message::Text(text))) => {
+                        if let Ok(ctrl) = serde_json::from_str::<WsClientControl>(&text) {
+                            match ctrl {
+                                WsClientControl::Resize { cols, rows } => {
+                                    let _ = pane.cmd_tx.send(PaneCommand::Resize(cols, rows));
+                                }
+                                WsClientControl::Paste { text } => {
+                                    let _ = pane.cmd_tx.send(PaneCommand::Paste(text));
+                                }
+                            }
+                        }
+                    }
+                    Some(Ok(Message::Close(_))) | Some(Err(_)) | None => break,
+                    _ => {}
+                }
+            }
+        }
+    }
+}
+
+// ==================== 板块三 & 四：文件浏览与满速流式传输 API ====================
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct FileQuery {
+    host_id: String,
+    path: Option<String>,
+    #[serde(default)]
+    refresh: bool,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct PrewarmPayload {
+    host_id: String,
+    cwd: Option<String>,
+}
+
+async fn api_prewarm_files(
+    State(state): State<Arc<AppState>>,
+    Json(p): Json<PrewarmPayload>,
+) -> impl IntoResponse {
+    let pool = state.ssh_pool.clone();
+    let db = state.db.clone();
+    let host_id = p.host_id.clone();
+    let cwd = p.cwd.clone();
+    tokio::spawn(async move {
+        if let Ok(listing) = files::list_dir(&pool, &db, &host_id, cwd.as_deref(), false).await {
+            if let Some(ref parent) = listing.parent {
+                let _ = files::list_dir(&pool, &db, &host_id, Some(parent), false).await;
+            }
+        }
+    });
+    (StatusCode::OK, Json(json!({ "ok": true })))
+}
+
+async fn api_list_dir(
+    State(state): State<Arc<AppState>>,
+    Query(q): Query<FileQuery>,
+) -> impl IntoResponse {
+    match files::list_dir(
+        &state.ssh_pool,
+        &state.db,
+        &q.host_id,
+        q.path.as_deref(),
+        q.refresh,
+    )
+    .await
+    {
+        Ok(listing) => {
+            // 后台自动预热上级目录与前 6 个子目录，让后续点击子目录或返回上级 0ms 瞬开
+            if q.host_id != LOCAL_HOST_ID {
+                let pool = state.ssh_pool.clone();
+                let db = state.db.clone();
+                let host_id = q.host_id.clone();
+                let parent = listing.parent.clone();
+                let subdirs: Vec<String> = listing
+                    .items
+                    .iter()
+                    .filter(|i| i.is_dir && !i.name.starts_with('.'))
+                    .take(6)
+                    .map(|i| i.path.clone())
+                    .collect();
+                tokio::spawn(async move {
+                    if let Some(p) = parent {
+                        let _ = files::list_dir(&pool, &db, &host_id, Some(&p), false).await;
+                    }
+                    for sub in subdirs {
+                        let _ = files::list_dir(&pool, &db, &host_id, Some(&sub), false).await;
+                    }
+                });
+            }
+
+            (
+                StatusCode::OK,
+                Json(json!({
+                    "ok": true,
+                    "path": listing.path,
+                    "parent": listing.parent,
+                    "items": listing.items,
+                })),
+            )
+                .into_response()
+        }
+        Err(e) => err_response(StatusCode::BAD_REQUEST, format!("{e:#}")).into_response(),
+    }
+}
+
+async fn api_read_file(
+    State(state): State<Arc<AppState>>,
+    Query(q): Query<FileQuery>,
+) -> impl IntoResponse {
+    let Some(path) = q.path.as_deref().filter(|s| !s.trim().is_empty()) else {
+        return err_response(StatusCode::BAD_REQUEST, "缺少文件路径").into_response();
+    };
+    match files::read_text_file(&state.ssh_pool, &state.db, &q.host_id, path).await {
+        Ok(res) => (
+            StatusCode::OK,
+            Json(json!({
+                "ok": true,
+                "path": res.path,
+                "content": res.content,
+                "size": res.size,
+            })),
+        )
+            .into_response(),
+        Err(e) => err_response(StatusCode::BAD_REQUEST, format!("{e:#}")).into_response(),
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct WriteFilePayload {
+    host_id: String,
+    path: String,
+    content: String,
+}
+
+async fn api_write_file(
+    State(state): State<Arc<AppState>>,
+    Json(p): Json<WriteFilePayload>,
+) -> impl IntoResponse {
+    match files::write_text_file(&state.ssh_pool, &state.db, &p.host_id, &p.path, &p.content).await
+    {
+        Ok(size) => (
+            StatusCode::OK,
+            Json(json!({
+                "ok": true,
+                "path": p.path,
+                "size": size,
+            })),
+        )
+            .into_response(),
+        Err(e) => err_response(StatusCode::BAD_REQUEST, format!("{e:#}")).into_response(),
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct MkdirPayload {
+    host_id: String,
+    path: String,
+}
+
+async fn api_mkdir(
+    State(state): State<Arc<AppState>>,
+    Json(p): Json<MkdirPayload>,
+) -> impl IntoResponse {
+    match files::create_dir(&state.ssh_pool, &state.db, &p.host_id, &p.path).await {
+        Ok(()) => (StatusCode::OK, Json(json!({ "ok": true }))).into_response(),
+        Err(e) => err_response(StatusCode::BAD_REQUEST, format!("{e:#}")).into_response(),
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct RenamePayload {
+    host_id: String,
+    old_path: String,
+    new_path: String,
+}
+
+async fn api_rename_item(
+    State(state): State<Arc<AppState>>,
+    Json(p): Json<RenamePayload>,
+) -> impl IntoResponse {
+    match files::rename_item(&state.ssh_pool, &state.db, &p.host_id, &p.old_path, &p.new_path).await
+    {
+        Ok(()) => (StatusCode::OK, Json(json!({ "ok": true }))).into_response(),
+        Err(e) => err_response(StatusCode::BAD_REQUEST, format!("{e:#}")).into_response(),
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct RemovePayload {
+    host_id: String,
+    path: String,
+    #[serde(default)]
+    is_dir: bool,
+}
+
+async fn api_remove_item(
+    State(state): State<Arc<AppState>>,
+    Json(p): Json<RemovePayload>,
+) -> impl IntoResponse {
+    match files::remove_item(&state.ssh_pool, &state.db, &p.host_id, &p.path, p.is_dir).await {
+        Ok(()) => (StatusCode::OK, Json(json!({ "ok": true }))).into_response(),
+        Err(e) => err_response(StatusCode::BAD_REQUEST, format!("{e:#}")).into_response(),
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct ArchiveActionPayload {
+    host_id: String,
+    path: String,
+}
+
+async fn api_compress_item(
+    State(state): State<Arc<AppState>>,
+    Json(p): Json<ArchiveActionPayload>,
+) -> impl IntoResponse {
+    match files::compress_item(&state.ssh_pool, &state.db, &p.host_id, &p.path).await {
+        Ok(archive_path) => (
+            StatusCode::OK,
+            Json(json!({
+                "ok": true,
+                "path": archive_path,
+            })),
+        )
+            .into_response(),
+        Err(e) => err_response(StatusCode::BAD_REQUEST, format!("{e:#}")).into_response(),
+    }
+}
+
+async fn api_extract_item(
+    State(state): State<Arc<AppState>>,
+    Json(p): Json<ArchiveActionPayload>,
+) -> impl IntoResponse {
+    match files::extract_item(&state.ssh_pool, &state.db, &p.host_id, &p.path).await {
+        Ok(out_dir) => (
+            StatusCode::OK,
+            Json(json!({
+                "ok": true,
+                "path": out_dir,
+            })),
+        )
+            .into_response(),
+        Err(e) => err_response(StatusCode::BAD_REQUEST, format!("{e:#}")).into_response(),
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct UploadQuery {
+    host_id: String,
+    dir_path: String,
+    filename: String,
+    #[serde(default)]
+    size: u64,
+}
+
+/// 浏览器直传：纯二进制 Body 流直写 SFTP 64 路并发流水线（零 multipart 解析损耗）
+async fn api_stream_upload(
+    State(state): State<Arc<AppState>>,
+    Query(q): Query<UploadQuery>,
+    body: Body,
+) -> impl IntoResponse {
+    let host_name = state
+        .db
+        .get_record(&q.host_id)
+        .ok()
+        .flatten()
+        .map(|h| h.name)
+        .unwrap_or_else(|| q.host_id.clone());
+
+    let remote_target = join_remote_path(&q.dir_path, &q.filename);
+    let task_id = state.transfers.create_task(
+        &q.host_id,
+        &host_name,
+        "upload",
+        &q.filename,
+        None,
+        &remote_target,
+        q.size,
+    );
+
+    let byte_stream = body
+        .into_data_stream()
+        .map_err(|err| std::io::Error::other(err.to_string()));
+    let reader = StreamReader::new(byte_stream);
+
+    match files::stream_upload_to_host(
+        &state.ssh_pool,
+        &state.db,
+        &state.transfers,
+        &task_id,
+        &q.host_id,
+        &q.dir_path,
+        &q.filename,
+        q.size,
+        reader,
+    )
+    .await
+    {
+        Ok(final_path) => (
+            StatusCode::OK,
+            Json(json!({
+                "ok": true,
+                "taskId": task_id,
+                "path": final_path,
+            })),
+        )
+            .into_response(),
+        Err(e) => err_response(StatusCode::BAD_REQUEST, format!("{e:#}")).into_response(),
+    }
+}
+
+/// 浏览器高速流式下载：直接把 64 路并发 SFTP 预读流作为 HTTP 响应输出，同时实时更新传输队列速率
+async fn api_stream_download(
+    State(state): State<Arc<AppState>>,
+    Query(q): Query<FileQuery>,
+) -> Response {
+    let Some(file_path) = q.path.filter(|s| !s.trim().is_empty()) else {
+        return err_response(StatusCode::BAD_REQUEST, "缺少下载路径").into_response();
+    };
+
+    let host_name = state
+        .db
+        .get_record(&q.host_id)
+        .ok()
+        .flatten()
+        .map(|h| h.name)
+        .unwrap_or_else(|| q.host_id.clone());
+
+    let filename = file_path
+        .rsplit(['/', '\\'])
+        .next()
+        .unwrap_or("download.bin")
+        .to_string();
+
+    if q.host_id == LOCAL_HOST_ID {
+        let meta = match tokio::fs::metadata(&file_path).await {
+            Ok(m) => m,
+            Err(e) => return err_response(StatusCode::NOT_FOUND, e).into_response(),
+        };
+        let file = match tokio::fs::File::open(&file_path).await {
+            Ok(f) => f,
+            Err(e) => return err_response(StatusCode::INTERNAL_SERVER_ERROR, e).into_response(),
+        };
+        let stream = tokio_util::io::ReaderStream::with_capacity(file, 512 * 1024);
+        return build_download_response(&filename, meta.len(), Body::from_stream(stream));
+    }
+
+    let sftp = match state.ssh_pool.get_or_open_sftp(&state.db, &q.host_id).await {
+        Ok(s) => s,
+        Err(e) => return err_response(StatusCode::BAD_REQUEST, format!("{e:#}")).into_response(),
+    };
+
+    let meta = match sftp.metadata(&file_path).await {
+        Ok(m) => m,
+        Err(e) => return err_response(StatusCode::NOT_FOUND, format!("{e:#}")).into_response(),
+    };
+    if meta.is_dir() {
+        return err_response(StatusCode::BAD_REQUEST, "不能直接下载文件夹").into_response();
+    }
+    let total_size = meta.size.unwrap_or(0);
+
+    let remote_file = match sftp.open(&file_path).await {
+        Ok(f) => f,
+        Err(e) => return err_response(StatusCode::BAD_REQUEST, format!("{e:#}")).into_response(),
+    };
+
+    let task_id = state.transfers.create_task(
+        &q.host_id,
+        &host_name,
+        "download",
+        &filename,
+        None,
+        &file_path,
+        total_size,
+    );
+
+    let transfers = state.transfers.clone();
+    let started = Instant::now();
+
+    let stream = futures::stream::unfold(
+        (remote_file, 0u64, task_id, transfers, false),
+        move |(mut rfile, mut transferred, tid, tm, done)| async move {
+            if done {
+                return None;
+            }
+            let mut buf = vec![0u8; 512 * 1024];
+            match rfile.read(&mut buf).await {
+                Ok(0) => {
+                    let _ = rfile.close().await;
+                    tm.finish_task(&tid, transferred, started.elapsed().as_secs_f64());
+                    None
+                }
+                Ok(n) => {
+                    buf.truncate(n);
+                    transferred += n as u64;
+                    tm.update_progress(
+                        &tid,
+                        transferred,
+                        total_size,
+                        started.elapsed().as_secs_f64(),
+                    );
+                    Some((
+                        Ok::<bytes::Bytes, std::io::Error>(bytes::Bytes::from(buf)),
+                        (rfile, transferred, tid, tm, false),
+                    ))
+                }
+                Err(err) => {
+                    tm.fail_task(&tid, &err);
+                    Some((Err(err), (rfile, transferred, tid, tm, true)))
+                }
+            }
+        },
+    );
+
+    build_download_response(&filename, total_size, Body::from_stream(stream))
+}
+
+fn build_download_response(filename: &str, size: u64, body: Body) -> Response {
+    let safe_ascii: String = filename
+        .chars()
+        .map(|c| if c.is_ascii_alphanumeric() || c == '.' || c == '-' || c == '_' { c } else { '_' })
+        .collect();
+    let disposition = format!("attachment; filename=\"{safe_ascii}\"");
+    Response::builder()
+        .status(StatusCode::OK)
+        .header(header::CONTENT_TYPE, "application/octet-stream")
+        .header(header::CONTENT_LENGTH, size.to_string())
+        .header(header::CONTENT_DISPOSITION, disposition)
+        .body(body)
+        .unwrap()
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct ListTransfersQuery {
+    host_id: Option<String>,
+}
+
+async fn api_list_transfers(
+    State(state): State<Arc<AppState>>,
+    Query(q): Query<ListTransfersQuery>,
+) -> impl IntoResponse {
+    let tasks = state.transfers.list_tasks(q.host_id.as_deref());
+    (
+        StatusCode::OK,
+        Json(json!({
+            "ok": true,
+            "tasks": tasks,
+        })),
+    )
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct LocalRemoteTransferPayload {
+    host_id: String,
+    direction: String, // "upload" | "download"
+    local_path: String,
+    remote_path: String,
+}
+
+async fn api_create_local_remote_transfer(
+    State(state): State<Arc<AppState>>,
+    Json(p): Json<LocalRemoteTransferPayload>,
+) -> impl IntoResponse {
+    match files::transfer_local_remote_file(
+        &state.ssh_pool,
+        &state.db,
+        &state.transfers,
+        &p.host_id,
+        &p.direction,
+        &p.local_path,
+        &p.remote_path,
+    )
+    .await
+    {
+        Ok(task) => (
+            StatusCode::OK,
+            Json(json!({
+                "ok": true,
+                "task": task,
+            })),
+        )
+            .into_response(),
+        Err(e) => err_response(StatusCode::BAD_REQUEST, format!("{e:#}")).into_response(),
+    }
+}
+
+async fn api_clear_transfers(State(state): State<Arc<AppState>>) -> impl IntoResponse {
+    state.transfers.clear_finished();
+    (StatusCode::OK, Json(json!({ "ok": true })))
+}
+
+// ==================== 登录鉴权、设置页与 MCP JSON-RPC 2.0 端点 ====================
+
+const SESSION_COOKIE_NAME: &str = "vps_switch_session";
+
+fn extract_session_token(headers: &HeaderMap) -> Option<String> {
+    if let Some(auth) = headers.get(header::AUTHORIZATION).and_then(|v| v.to_str().ok()) {
+        if let Some(tok) = auth.strip_prefix("Bearer ") {
+            if !tok.trim().is_empty() {
+                return Some(tok.trim().to_string());
+            }
+        }
+    }
+    if let Some(cookie_hdr) = headers.get(header::COOKIE).and_then(|v| v.to_str().ok()) {
+        for part in cookie_hdr.split(';') {
+            let trimmed = part.trim();
+            if let Some(val) = trimmed.strip_prefix(&format!("{SESSION_COOKIE_NAME}=")) {
+                if !val.trim().is_empty() {
+                    return Some(val.trim().to_string());
+                }
+            }
+        }
+    }
+    None
+}
+
+fn is_request_authenticated(state: &AppState, headers: &HeaderMap) -> bool {
+    let auth_enabled = state
+        .db
+        .get_setting("auth_enabled")
+        .ok()
+        .flatten()
+        .map(|v| v == "true")
+        .unwrap_or(false);
+    if !auth_enabled {
+        return true;
+    }
+    let Some(token) = extract_session_token(headers) else {
+        return false;
+    };
+    state.sessions.lock().unwrap().contains(&token)
+}
+
+async fn require_web_auth(
+    State(state): State<Arc<AppState>>,
+    req: Request,
+    next: Next,
+) -> Response {
+    if !is_request_authenticated(&state, req.headers()) {
+        return err_response(StatusCode::UNAUTHORIZED, "请先登录").into_response();
+    }
+    next.run(req).await
+}
+
+async fn api_auth_status(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+) -> impl IntoResponse {
+    let settings = state.db.get_app_settings().ok();
+    let auth_enabled = settings.as_ref().map(|s| s.auth_enabled).unwrap_or(false);
+    let username = settings
+        .as_ref()
+        .map(|s| s.admin_username.clone())
+        .unwrap_or_else(|| "admin".to_string());
+    let authenticated = is_request_authenticated(&state, &headers);
+    (
+        StatusCode::OK,
+        Json(json!({
+            "ok": true,
+            "authEnabled": auth_enabled,
+            "authenticated": authenticated,
+            "username": username,
+        })),
+    )
+}
+
+#[derive(Debug, Deserialize)]
+struct LoginPayload {
+    username: String,
+    password: String,
+}
+
+async fn api_auth_login(
+    State(state): State<Arc<AppState>>,
+    Json(p): Json<LoginPayload>,
+) -> Response {
+    match state
+        .db
+        .verify_admin_credentials(&p.username, &p.password)
+    {
+        Ok(true) => {
+            let token = format!("sess_{}{}", Uuid::new_v4().simple(), Uuid::new_v4().simple());
+            state.sessions.lock().unwrap().insert(token.clone());
+            let cookie = format!(
+                "{SESSION_COOKIE_NAME}={token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=2592000"
+            );
+            Response::builder()
+                .status(StatusCode::OK)
+                .header(header::CONTENT_TYPE, "application/json")
+                .header(header::SET_COOKIE, cookie)
+                .body(Body::from(
+                    json!({
+                        "ok": true,
+                        "token": token,
+                        "username": p.username.trim(),
+                    })
+                    .to_string(),
+                ))
+                .unwrap()
+        }
+        Ok(false) => err_response(StatusCode::UNAUTHORIZED, "账号或密码错误").into_response(),
+        Err(e) => err_response(StatusCode::INTERNAL_SERVER_ERROR, e).into_response(),
+    }
+}
+
+async fn api_auth_logout(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+) -> Response {
+    if let Some(tok) = extract_session_token(&headers) {
+        state.sessions.lock().unwrap().remove(&tok);
+    }
+    let clear_cookie = format!("{SESSION_COOKIE_NAME}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0");
+    Response::builder()
+        .status(StatusCode::OK)
+        .header(header::CONTENT_TYPE, "application/json")
+        .header(header::SET_COOKIE, clear_cookie)
+        .body(Body::from(json!({ "ok": true }).to_string()))
+        .unwrap()
+}
+
+async fn api_get_settings(State(state): State<Arc<AppState>>) -> impl IntoResponse {
+    match state.db.get_app_settings() {
+        Ok(settings) => {
+            let cli_sync = sync_cli_mcp_configs(state.port);
+            (
+                StatusCode::OK,
+                Json(json!({
+                    "ok": true,
+                    "settings": settings,
+                    "cliSync": cli_sync,
+                })),
+            )
+                .into_response()
+        }
+        Err(e) => err_response(StatusCode::INTERNAL_SERVER_ERROR, e).into_response(),
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct UpdateAuthSettingsPayload {
+    auth_enabled: bool,
+    username: String,
+    password: Option<String>,
+}
+
+async fn api_update_auth_settings(
+    State(state): State<Arc<AppState>>,
+    Json(p): Json<UpdateAuthSettingsPayload>,
+) -> Response {
+    match state
+        .db
+        .update_auth_settings(p.auth_enabled, &p.username, p.password.as_deref())
+    {
+        Ok(settings) => {
+            // 若刚开启了登录保护，自动为当前管理员签发会话 Cookie，避免改完设置立刻被踢出
+            let token = format!("sess_{}{}", Uuid::new_v4().simple(), Uuid::new_v4().simple());
+            state.sessions.lock().unwrap().insert(token.clone());
+            let cookie = format!(
+                "{SESSION_COOKIE_NAME}={token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=2592000"
+            );
+            Response::builder()
+                .status(StatusCode::OK)
+                .header(header::CONTENT_TYPE, "application/json")
+                .header(header::SET_COOKIE, cookie)
+                .body(Body::from(
+                    json!({
+                        "ok": true,
+                        "settings": settings,
+                    })
+                    .to_string(),
+                ))
+                .unwrap()
+        }
+        Err(e) => err_response(StatusCode::BAD_REQUEST, e).into_response(),
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct UpdateMcpSettingsPayload {
+    mcp_enabled: bool,
+    mcp_require_api_key: bool,
+    #[serde(default)]
+    regenerate_key: bool,
+}
+
+async fn api_update_mcp_settings(
+    State(state): State<Arc<AppState>>,
+    Json(p): Json<UpdateMcpSettingsPayload>,
+) -> impl IntoResponse {
+    match state.db.update_mcp_settings(
+        p.mcp_enabled,
+        p.mcp_require_api_key,
+        p.regenerate_key,
+    ) {
+        Ok(settings) => (
+            StatusCode::OK,
+            Json(json!({
+                "ok": true,
+                "settings": settings,
+            })),
+        )
+            .into_response(),
+        Err(e) => err_response(StatusCode::BAD_REQUEST, e).into_response(),
+    }
+}
+
+fn extract_mcp_api_key(headers: &HeaderMap) -> Option<String> {
+    if let Some(auth) = headers.get(header::AUTHORIZATION).and_then(|v| v.to_str().ok()) {
+        if let Some(k) = auth.strip_prefix("Bearer ") {
+            if !k.trim().is_empty() {
+                return Some(k.trim().to_string());
+            }
+        }
+    }
+    if let Some(k) = headers.get("x-api-key").and_then(|v| v.to_str().ok()) {
+        if !k.trim().is_empty() {
+            return Some(k.trim().to_string());
+        }
+    }
+    None
+}
+
+async fn api_mcp_rpc(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+    Json(req): Json<JsonRpcRequest>,
+) -> Response {
+    let Ok(settings) = state.db.get_app_settings() else {
+        return err_response(StatusCode::INTERNAL_SERVER_ERROR, "读取设置失败").into_response();
+    };
+
+    if !settings.mcp_enabled {
+        return err_response(StatusCode::FORBIDDEN, "MCP Server 当前已在设置中关闭").into_response();
+    }
+
+    // 本机 --mcp-stdio 内部桥接请求带 x-vps-switch-stdio: 1；其余外部 HTTP 请求若开启了 API Key 校验则必须匹配
+    let is_local_stdio = headers
+        .get("x-vps-switch-stdio")
+        .and_then(|v| v.to_str().ok())
+        == Some("1");
+    if settings.mcp_require_api_key && !is_local_stdio {
+        let provided = extract_mcp_api_key(&headers);
+        if provided.as_deref() != Some(settings.mcp_api_key.as_str()) {
+            return err_response(
+                StatusCode::UNAUTHORIZED,
+                "MCP API Key 无效或缺失（请在 Authorization: Bearer <API_KEY> 或 X-API-Key 请求头中提供）",
+            )
+            .into_response();
+        }
+    }
+
+    match handle_mcp_request(&state, &state.exec_tasks, req).await {
+        Some(val) => (StatusCode::OK, Json(val)).into_response(),
+        None => StatusCode::ACCEPTED.into_response(),
+    }
+}
+
+async fn api_mcp_status(State(state): State<Arc<AppState>>) -> impl IntoResponse {
+    let status = sync_cli_mcp_configs(state.port);
+    (
+        StatusCode::OK,
+        Json(json!({
+            "ok": true,
+            "status": status,
+        })),
+    )
+}
+
+async fn api_mcp_sync(State(state): State<Arc<AppState>>) -> impl IntoResponse {
+    let status = sync_cli_mcp_configs(state.port);
+    (
+        StatusCode::OK,
+        Json(json!({
+            "ok": true,
+            "status": status,
+        })),
+    )
+}
+
+async fn api_sse_events(State(state): State<Arc<AppState>>) -> impl IntoResponse {
+    let rx = state.terminals.subscribe_ui_events();
+    let stream = futures::stream::unfold(rx, |mut rx| async move {
+        loop {
+            match rx.recv().await {
+                Ok(ev) => {
+                    let payload = serde_json::to_string(&ev).unwrap_or_default();
+                    return Some((
+                        Ok::<SseEvent, std::convert::Infallible>(SseEvent::default().data(payload)),
+                        rx,
+                    ));
+                }
+                Err(tokio::sync::broadcast::error::RecvError::Lagged(_)) => continue,
+                Err(tokio::sync::broadcast::error::RecvError::Closed) => return None,
+            }
+        }
+    });
+    Sse::new(stream).keep_alive(KeepAlive::new().interval(std::time::Duration::from_secs(15)))
+}
+
diff --git a/src/crypto.rs b/src/crypto.rs
new file mode 100644
index 0000000..6816090
--- /dev/null
+++ b/src/crypto.rs
@@ -0,0 +1,140 @@
+use aes_gcm::{
+    aead::{Aead, KeyInit},
+    Aes256Gcm, Key, Nonce,
+};
+use anyhow::{anyhow, Context, Result};
+use base64::{engine::general_purpose::STANDARD as B64, Engine as _};
+use rand::RngCore;
+use scrypt::{scrypt, Params as ScryptParams};
+use serde::{Deserialize, Serialize};
+use std::{fs, path::Path};
+
+const ONESHELL_FALLBACK_SECRET: &str = "change-me-before-production";
+const ONESHELL_LEGACY_SALT: &[u8] = b"ai-web-terminal";
+
+#[derive(Clone)]
+pub struct MasterKey {
+    key: [u8; 32],
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+struct EncryptedBlob {
+    iv: String,
+    value: String,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct OneShellCipherPayload {
+    pub salt: Option<String>,
+    pub iv: Option<String>,
+    pub tag: Option<String>,
+    pub value: Option<String>,
+}
+
+impl MasterKey {
+    pub fn load_or_create(data_dir: &Path) -> Result<Self> {
+        fs::create_dir_all(data_dir)?;
+        let key_path = data_dir.join("secret.key");
+        if key_path.exists() {
+            let raw = fs::read_to_string(&key_path).context("读取 secret.key 失败")?;
+            let decoded = B64
+                .decode(raw.trim())
+                .context("解码 secret.key base64 失败")?;
+            if decoded.len() == 32 {
+                let mut key = [0u8; 32];
+                key.copy_from_slice(&decoded);
+                return Ok(Self { key });
+            }
+        }
+
+        let mut key = [0u8; 32];
+        rand::thread_rng().fill_bytes(&mut key);
+        fs::write(&key_path, B64.encode(key)).context("写入 secret.key 失败")?;
+        Ok(Self { key })
+    }
+
+    pub fn encrypt(&self, plaintext: &str) -> Result<Option<String>> {
+        if plaintext.is_empty() {
+            return Ok(None);
+        }
+        let cipher = Aes256Gcm::new(Key::<Aes256Gcm>::from_slice(&self.key));
+        let mut iv = [0u8; 12];
+        rand::thread_rng().fill_bytes(&mut iv);
+        let nonce = Nonce::from_slice(&iv);
+        let ciphertext = cipher
+            .encrypt(nonce, plaintext.as_bytes())
+            .map_err(|_| anyhow!("AES-GCM 加密失败"))?;
+        let blob = EncryptedBlob {
+            iv: B64.encode(iv),
+            value: B64.encode(ciphertext),
+        };
+        Ok(Some(serde_json::to_string(&blob)?))
+    }
+
+    pub fn decrypt(&self, blob_json: Option<&str>) -> Result<Option<String>> {
+        let Some(raw) = blob_json.filter(|s| !s.trim().is_empty()) else {
+            return Ok(None);
+        };
+        let blob: EncryptedBlob = serde_json::from_str(raw).context("解析加密凭据 JSON 失败")?;
+        let iv = B64.decode(blob.iv).context("解码 IV 失败")?;
+        let ciphertext = B64.decode(blob.value).context("解码密文失败")?;
+        if iv.len() != 12 {
+            return Err(anyhow!("无效的 IV 长度"));
+        }
+        let cipher = Aes256Gcm::new(Key::<Aes256Gcm>::from_slice(&self.key));
+        let plaintext = cipher
+            .decrypt(Nonce::from_slice(&iv), ciphertext.as_ref())
+            .map_err(|_| anyhow!("凭据解密失败"))?;
+        Ok(Some(String::from_utf8(plaintext)?))
+    }
+}
+
+/// 解密旧版 1Shell 的 AES-256-GCM 凭据 ({ salt, iv, tag, value })
+pub fn decrypt_1shell_payload(
+    payload: &OneShellCipherPayload,
+    custom_secret: Option<&str>,
+) -> Result<Option<String>> {
+    let Some(value_b64) = payload.value.as_deref().filter(|s| !s.is_empty()) else {
+        return Ok(None);
+    };
+    let iv_b64 = payload
+        .iv
+        .as_deref()
+        .ok_or_else(|| anyhow!("1Shell 凭据缺少 iv"))?;
+    let tag_b64 = payload
+        .tag
+        .as_deref()
+        .ok_or_else(|| anyhow!("1Shell 凭据缺少 tag"))?;
+
+    let salt_bytes = match payload.salt.as_deref().filter(|s| !s.is_empty()) {
+        Some(s) => B64.decode(s).context("解码 1Shell salt 失败")?,
+        None => ONESHELL_LEGACY_SALT.to_vec(),
+    };
+    let iv = B64.decode(iv_b64).context("解码 1Shell iv 失败")?;
+    let tag = B64.decode(tag_b64).context("解码 1Shell tag 失败")?;
+    let mut ciphertext = B64.decode(value_b64).context("解码 1Shell value 失败")?;
+
+    if iv.len() != 12 || tag.len() != 16 {
+        return Err(anyhow!("1Shell 凭据 iv/tag 长度异常"));
+    }
+
+    let secret = custom_secret
+        .filter(|s| !s.is_empty())
+        .unwrap_or(ONESHELL_FALLBACK_SECRET);
+
+    // Node crypto.scryptSync 默认参数: N=16384 (log_n=14), r=8, p=1, keylen=32
+    let params = ScryptParams::new(14, 8, 1, 32).map_err(|_| anyhow!("无效的 scrypt 参数"))?;
+    let mut derived_key = [0u8; 32];
+    scrypt(secret.as_bytes(), &salt_bytes, &params, &mut derived_key)
+        .map_err(|_| anyhow!("scrypt 派生密钥失败"))?;
+
+    // aes-gcm crate 的密文末尾直接拼接 16 字节 auth tag
+    ciphertext.extend_from_slice(&tag);
+
+    let cipher = Aes256Gcm::new(Key::<Aes256Gcm>::from_slice(&derived_key));
+    let plaintext = cipher
+        .decrypt(Nonce::from_slice(&iv), ciphertext.as_ref())
+        .map_err(|_| anyhow!("1Shell 凭据解密校验失败"))?;
+
+    Ok(Some(String::from_utf8(plaintext)?))
+}
diff --git a/src/db.rs b/src/db.rs
new file mode 100644
index 0000000..90c0271
--- /dev/null
+++ b/src/db.rs
@@ -0,0 +1,985 @@
+use crate::{
+    crypto::{decrypt_1shell_payload, MasterKey, OneShellCipherPayload},
+    models::{
+        HostLink, HostMetaPatch, HostRecord, HostUpsertPayload, OsInfo, PublicHost, LOCAL_HOST_ID,
+    },
+};
+use anyhow::{anyhow, Context, Result};
+use chrono::Utc;
+use rusqlite::{params, Connection, OpenFlags, OptionalExtension};
+use serde::Deserialize;
+use std::{
+    collections::HashMap,
+    fs,
+    path::{Path, PathBuf},
+    sync::Mutex,
+};
+use uuid::Uuid;
+
+pub struct Database {
+    conn: Mutex<Connection>,
+    master_key: MasterKey,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct LegacyOneShellHost {
+    id: String,
+    #[serde(default)]
+    name: String,
+    #[serde(rename = "type", default)]
+    kind: String,
+    #[serde(default)]
+    host: String,
+    #[serde(default)]
+    port: Option<u16>,
+    #[serde(default)]
+    username: String,
+    #[serde(default)]
+    auth_type: String,
+    #[serde(default)]
+    proxy_host_id: Option<String>,
+    #[serde(default)]
+    links: Vec<HostLink>,
+    #[serde(default)]
+    os_info: Option<OsInfo>,
+    #[serde(default)]
+    encrypted_password: Option<OneShellCipherPayload>,
+    #[serde(default)]
+    encrypted_private_key: Option<OneShellCipherPayload>,
+    #[serde(default)]
+    encrypted_passphrase: Option<OneShellCipherPayload>,
+    #[serde(default)]
+    created_at: Option<String>,
+    #[serde(default)]
+    updated_at: Option<String>,
+}
+
+struct LegacyPref {
+    repository_order: i64,
+    console_order: i64,
+    pinned: bool,
+    role: Option<String>,
+    tags: Vec<String>,
+    archived: bool,
+}
+
+impl Database {
+    pub fn open(data_dir: &Path, master_key: MasterKey) -> Result<Self> {
+        fs::create_dir_all(data_dir)?;
+        let db_path = data_dir.join("vps-switch.db");
+        let conn = Connection::open(&db_path).context("打开 vps-switch.db 失败")?;
+        conn.execute_batch(
+            "PRAGMA journal_mode = WAL;
+             PRAGMA synchronous = NORMAL;
+             PRAGMA foreign_keys = ON;
+             CREATE TABLE IF NOT EXISTS hosts (
+                 id TEXT PRIMARY KEY,
+                 name TEXT NOT NULL,
+                 kind TEXT NOT NULL DEFAULT 'ssh',
+                 addr TEXT NOT NULL DEFAULT '',
+                 port INTEGER NOT NULL DEFAULT 22,
+                 username TEXT NOT NULL DEFAULT 'root',
+                 auth_type TEXT NOT NULL DEFAULT 'password',
+                 encrypted_password TEXT,
+                 encrypted_private_key TEXT,
+                 encrypted_passphrase TEXT,
+                 jump_host_id TEXT,
+                 role TEXT,
+                 tags_json TEXT NOT NULL DEFAULT '[]',
+                 links_json TEXT NOT NULL DEFAULT '[]',
+                 os_json TEXT,
+                 pinned INTEGER NOT NULL DEFAULT 0,
+                 favorited INTEGER NOT NULL DEFAULT 0,
+                 archived INTEGER NOT NULL DEFAULT 0,
+                 sort_order INTEGER NOT NULL DEFAULT 0,
+                 status TEXT NOT NULL DEFAULT 'unknown',
+                 latency_ms INTEGER,
+                 last_connected_at TEXT,
+                 last_error TEXT,
+                 created_at TEXT NOT NULL,
+                 updated_at TEXT NOT NULL
+             );
+             CREATE TABLE IF NOT EXISTS settings (
+                 key TEXT PRIMARY KEY,
+                 value TEXT NOT NULL
+             );",
+        )?;
+        // 兼容升级已有数据库：安全添加 favorited 列
+        let _ = conn.execute(
+            "ALTER TABLE hosts ADD COLUMN favorited INTEGER NOT NULL DEFAULT 0",
+            [],
+        );
+
+        let db = Self {
+            conn: Mutex::new(conn),
+            master_key,
+        };
+        db.ensure_local_host()?;
+        db.ensure_default_settings()?;
+        Ok(db)
+    }
+
+    pub fn master_key(&self) -> &MasterKey {
+        &self.master_key
+    }
+
+    fn ensure_local_host(&self) -> Result<()> {
+        let conn = self.conn.lock().map_err(|_| anyhow!("数据库锁异常"))?;
+        let exists: Option<String> = conn
+            .query_row(
+                "SELECT id FROM hosts WHERE id = ?1",
+                params![LOCAL_HOST_ID],
+                |row| row.get(0),
+            )
+            .optional()?;
+
+        if exists.is_none() {
+            let now = Utc::now().to_rfc3339();
+            let username = std::env::var("USERNAME")
+                .or_else(|_| std::env::var("USER"))
+                .unwrap_or_else(|_| "local".to_string());
+            let os_info = OsInfo {
+                os: Some("windows".to_string()),
+                distro_id: Some("windows".to_string()),
+                version_id: Some("11".to_string()),
+                pretty_name: Some("Windows 11 Local".to_string()),
+                arch: Some(std::env::consts::ARCH.to_string()),
+                kernel: None,
+                cpu_model: None,
+                cpu_cores: std::thread::available_parallelism()
+                    .ok()
+                    .map(|n| n.get() as u32),
+                detected_at: Some(now.clone()),
+            };
+            conn.execute(
+                "INSERT INTO hosts (
+                    id, name, kind, addr, port, username, auth_type,
+                    role, tags_json, links_json, os_json,
+                    pinned, archived, sort_order, status, latency_ms,
+                    last_connected_at, created_at, updated_at
+                ) VALUES (?1, ?2, 'local', '127.0.0.1', 0, ?3, 'local',
+                    'primary', '[]', '[]', ?4,
+                    1, 0, -1, 'online', 0,
+                    ?5, ?5, ?5)",
+                params![
+                    LOCAL_HOST_ID,
+                    "本机",
+                    username,
+                    serde_json::to_string(&os_info)?,
+                    now
+                ],
+            )?;
+        }
+        Ok(())
+    }
+
+    pub fn count_ssh_hosts(&self) -> Result<usize> {
+        let conn = self.conn.lock().map_err(|_| anyhow!("数据库锁异常"))?;
+        let count: i64 = conn.query_row(
+            "SELECT COUNT(*) FROM hosts WHERE kind = 'ssh'",
+            [],
+            |row| row.get(0),
+        )?;
+        Ok(count as usize)
+    }
+
+    fn row_to_record(row: &rusqlite::Row<'_>) -> rusqlite::Result<HostRecord> {
+        let tags_raw: String = row.get("tags_json")?;
+        let links_raw: String = row.get("links_json")?;
+        let os_raw: Option<String> = row.get("os_json")?;
+
+        let tags: Vec<String> = serde_json::from_str(&tags_raw).unwrap_or_default();
+        let links: Vec<HostLink> = serde_json::from_str(&links_raw).unwrap_or_default();
+        let os_info: Option<OsInfo> = os_raw
+            .as_deref()
+            .and_then(|s| serde_json::from_str(s).ok());
+
+        Ok(HostRecord {
+            id: row.get("id")?,
+            name: row.get("name")?,
+            kind: row.get("kind")?,
+            addr: row.get("addr")?,
+            port: row.get::<_, i64>("port")? as u16,
+            username: row.get("username")?,
+            auth_type: row.get("auth_type")?,
+            encrypted_password: row.get("encrypted_password")?,
+            encrypted_private_key: row.get("encrypted_private_key")?,
+            encrypted_passphrase: row.get("encrypted_passphrase")?,
+            jump_host_id: row.get("jump_host_id")?,
+            role: row.get("role")?,
+            tags,
+            links,
+            os_info,
+            pinned: row.get::<_, i64>("pinned")? != 0,
+            favorited: row.get::<_, i64>("favorited").unwrap_or(0) != 0,
+            archived: row.get::<_, i64>("archived")? != 0,
+            sort_order: row.get("sort_order")?,
+            status: row.get("status")?,
+            latency_ms: row.get("latency_ms")?,
+            last_connected_at: row.get("last_connected_at")?,
+            last_error: row.get("last_error")?,
+            created_at: row.get("created_at")?,
+            updated_at: row.get("updated_at")?,
+        })
+    }
+
+    pub fn list_records(&self) -> Result<Vec<HostRecord>> {
+        let conn = self.conn.lock().map_err(|_| anyhow!("数据库锁异常"))?;
+        let mut stmt = conn.prepare(
+            "SELECT * FROM hosts
+             ORDER BY
+               CASE WHEN id = 'local' THEN 0 ELSE 1 END ASC,
+               pinned DESC,
+               sort_order ASC,
+               name COLLATE NOCASE ASC",
+        )?;
+        let rows = stmt.query_map([], Self::row_to_record)?;
+        let mut out = Vec::new();
+        for r in rows {
+            out.push(r?);
+        }
+        Ok(out)
+    }
+
+    pub fn list_public_hosts(&self) -> Result<Vec<PublicHost>> {
+        let records = self.list_records()?;
+        let name_map: HashMap<String, String> = records
+            .iter()
+            .map(|r| (r.id.clone(), r.name.clone()))
+            .collect();
+
+        Ok(records
+            .into_iter()
+            .map(|r| {
+                let jump_host_name = r
+                    .jump_host_id
+                    .as_ref()
+                    .and_then(|jid| name_map.get(jid).cloned());
+                Self::to_public(r, jump_host_name)
+            })
+            .collect())
+    }
+
+    pub fn get_record(&self, id: &str) -> Result<Option<HostRecord>> {
+        let conn = self.conn.lock().map_err(|_| anyhow!("数据库锁异常"))?;
+        conn.query_row("SELECT * FROM hosts WHERE id = ?1", params![id], Self::row_to_record)
+            .optional()
+            .map_err(Into::into)
+    }
+
+    pub fn get_public_host(&self, id: &str) -> Result<Option<PublicHost>> {
+        let Some(rec) = self.get_record(id)? else {
+            return Ok(None);
+        };
+        let jump_name = match rec.jump_host_id.as_deref() {
+            Some(jid) => self.get_record(jid)?.map(|j| j.name),
+            None => None,
+        };
+        Ok(Some(Self::to_public(rec, jump_name)))
+    }
+
+    fn to_public(r: HostRecord, jump_host_name: Option<String>) -> PublicHost {
+        PublicHost {
+            id: r.id,
+            name: r.name,
+            kind: r.kind,
+            addr: r.addr,
+            port: r.port,
+            username: r.username,
+            auth_type: r.auth_type,
+            has_password: r.encrypted_password.is_some(),
+            has_private_key: r.encrypted_private_key.is_some(),
+            has_passphrase: r.encrypted_passphrase.is_some(),
+            jump_host_id: r.jump_host_id,
+            jump_host_name,
+            role: r.role,
+            tags: r.tags,
+            links: r.links,
+            os_info: r.os_info,
+            pinned: r.pinned,
+            favorited: r.favorited,
+            archived: r.archived,
+            sort_order: r.sort_order,
+            status: r.status,
+            latency_ms: r.latency_ms,
+            last_connected_at: r.last_connected_at,
+            last_error: r.last_error,
+            created_at: r.created_at,
+            updated_at: r.updated_at,
+        }
+    }
+
+    pub fn create_host(&self, payload: HostUpsertPayload) -> Result<PublicHost> {
+        let name = payload.name.trim().to_string();
+        let addr = payload.addr.trim().to_string();
+        if name.is_empty() || addr.is_empty() {
+            return Err(anyhow!("主机名称与地址不能为空"));
+        }
+
+        let id = format!("host_{}", Uuid::new_v4());
+        let now = Utc::now().to_rfc3339();
+        let enc_pwd = match payload.password.as_deref() {
+            Some(p) if !p.is_empty() => self.master_key.encrypt(p)?,
+            _ => None,
+        };
+        let enc_key = match payload.private_key.as_deref() {
+            Some(k) if !k.trim().is_empty() => self.master_key.encrypt(k)?,
+            _ => None,
+        };
+        let enc_pass = match payload.passphrase.as_deref() {
+            Some(p) if !p.is_empty() => self.master_key.encrypt(p)?,
+            _ => None,
+        };
+
+        let links = normalize_links(payload.links);
+        let tags = normalize_tags(payload.tags);
+        let jump_id = payload
+            .jump_host_id
+            .map(|s| s.trim().to_string())
+            .filter(|s| !s.is_empty());
+        let role = payload
+            .role
+            .map(|s| s.trim().to_string())
+            .filter(|s| !s.is_empty());
+
+        {
+            let conn = self.conn.lock().map_err(|_| anyhow!("数据库锁异常"))?;
+            let max_order: i64 = conn
+                .query_row("SELECT COALESCE(MAX(sort_order), 0) FROM hosts", [], |r| {
+                    r.get(0)
+                })
+                .unwrap_or(0);
+
+            conn.execute(
+                "INSERT INTO hosts (
+                    id, name, kind, addr, port, username, auth_type,
+                    encrypted_password, encrypted_private_key, encrypted_passphrase,
+                    jump_host_id, role, tags_json, links_json,
+                    pinned, archived, sort_order, status, created_at, updated_at
+                ) VALUES (?1, ?2, 'ssh', ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, ?16, 'unknown', ?17, ?17)",
+                params![
+                    id,
+                    name,
+                    addr,
+                    payload.port as i64,
+                    payload.username.trim(),
+                    payload.auth_type,
+                    enc_pwd,
+                    enc_key,
+                    enc_pass,
+                    jump_id,
+                    role,
+                    serde_json::to_string(&tags)?,
+                    serde_json::to_string(&links)?,
+                    if payload.pinned { 1 } else { 0 },
+                    if payload.archived { 1 } else { 0 },
+                    max_order + 1,
+                    now
+                ],
+            )?;
+        }
+
+        self.get_public_host(&id)?
+            .ok_or_else(|| anyhow!("创建主机后读取失败"))
+    }
+
+    pub fn update_host(&self, id: &str, payload: HostUpsertPayload) -> Result<PublicHost> {
+        let existing = self
+            .get_record(id)?
+            .ok_or_else(|| anyhow!("主机不存在: {id}"))?;
+
+        let now = Utc::now().to_rfc3339();
+        let links = normalize_links(payload.links);
+        let tags = normalize_tags(payload.tags);
+        let role = payload
+            .role
+            .map(|s| s.trim().to_string())
+            .filter(|s| !s.is_empty());
+
+        if existing.kind == "local" {
+            let conn = self.conn.lock().map_err(|_| anyhow!("数据库锁异常"))?;
+            conn.execute(
+                "UPDATE hosts SET name = ?1, role = ?2, tags_json = ?3, links_json = ?4, updated_at = ?5 WHERE id = ?6",
+                params![
+                    if payload.name.trim().is_empty() {
+                        &existing.name
+                    } else {
+                        payload.name.trim()
+                    },
+                    role,
+                    serde_json::to_string(&tags)?,
+                    serde_json::to_string(&links)?,
+                    now,
+                    id
+                ],
+            )?;
+            return self
+                .get_public_host(id)?
+                .ok_or_else(|| anyhow!("更新本机后读取失败"));
+        }
+
+        let enc_pwd = match payload.password.as_deref() {
+            Some(p) if !p.is_empty() => self.master_key.encrypt(p)?,
+            _ => existing.encrypted_password,
+        };
+        let enc_key = match payload.private_key.as_deref() {
+            Some(k) if !k.trim().is_empty() => self.master_key.encrypt(k)?,
+            _ => existing.encrypted_private_key,
+        };
+        let enc_pass = match payload.passphrase.as_deref() {
+            Some(p) if !p.is_empty() => self.master_key.encrypt(p)?,
+            _ => existing.encrypted_passphrase,
+        };
+        let jump_id = payload
+            .jump_host_id
+            .map(|s| s.trim().to_string())
+            .filter(|s| !s.is_empty() && s != id);
+
+        {
+            let conn = self.conn.lock().map_err(|_| anyhow!("数据库锁异常"))?;
+            conn.execute(
+                "UPDATE hosts SET
+                    name = ?1, addr = ?2, port = ?3, username = ?4, auth_type = ?5,
+                    encrypted_password = ?6, encrypted_private_key = ?7, encrypted_passphrase = ?8,
+                    jump_host_id = ?9, role = ?10, tags_json = ?11, links_json = ?12,
+                    pinned = ?13, archived = ?14, updated_at = ?15
+                 WHERE id = ?16",
+                params![
+                    payload.name.trim(),
+                    payload.addr.trim(),
+                    payload.port as i64,
+                    payload.username.trim(),
+                    payload.auth_type,
+                    enc_pwd,
+                    enc_key,
+                    enc_pass,
+                    jump_id,
+                    role,
+                    serde_json::to_string(&tags)?,
+                    serde_json::to_string(&links)?,
+                    if payload.pinned { 1 } else { 0 },
+                    if payload.archived { 1 } else { 0 },
+                    now,
+                    id
+                ],
+            )?;
+        }
+
+        self.get_public_host(id)?
+            .ok_or_else(|| anyhow!("更新主机后读取失败"))
+    }
+
+    pub fn patch_meta(&self, id: &str, patch: HostMetaPatch) -> Result<PublicHost> {
+        let existing = self
+            .get_record(id)?
+            .ok_or_else(|| anyhow!("主机不存在: {id}"))?;
+        let now = Utc::now().to_rfc3339();
+        let pinned = patch.pinned.unwrap_or(existing.pinned);
+        let favorited = patch.favorited.unwrap_or(existing.favorited);
+        let archived = patch.archived.unwrap_or(existing.archived);
+        let role = match patch.role {
+            Some(r) => {
+                let t = r.trim().to_string();
+                if t.is_empty() {
+                    None
+                } else {
+                    Some(t)
+                }
+            }
+            None => existing.role,
+        };
+        let tags = patch.tags.map(normalize_tags).unwrap_or(existing.tags);
+        let links = patch.links.map(normalize_links).unwrap_or(existing.links);
+
+        {
+            let conn = self.conn.lock().map_err(|_| anyhow!("数据库锁异常"))?;
+            conn.execute(
+                "UPDATE hosts SET pinned = ?1, favorited = ?2, archived = ?3, role = ?4, tags_json = ?5, links_json = ?6, updated_at = ?7 WHERE id = ?8",
+                params![
+                    if pinned { 1 } else { 0 },
+                    if favorited { 1 } else { 0 },
+                    if archived { 1 } else { 0 },
+                    role,
+                    serde_json::to_string(&tags)?,
+                    serde_json::to_string(&links)?,
+                    now,
+                    id
+                ],
+            )?;
+        }
+
+        self.get_public_host(id)?
+            .ok_or_else(|| anyhow!("更新元数据后读取失败"))
+    }
+
+    pub fn reorder(&self, ordered_ids: &[String]) -> Result<()> {
+        let mut conn = self.conn.lock().map_err(|_| anyhow!("数据库锁异常"))?;
+        let tx = conn.transaction()?;
+        for (idx, id) in ordered_ids.iter().enumerate() {
+            if id == LOCAL_HOST_ID {
+                continue;
+            }
+            tx.execute(
+                "UPDATE hosts SET sort_order = ?1 WHERE id = ?2",
+                params![idx as i64, id],
+            )?;
+        }
+        tx.commit()?;
+        Ok(())
+    }
+
+    pub fn delete_host(&self, id: &str) -> Result<()> {
+        if id == LOCAL_HOST_ID {
+            return Err(anyhow!("本机节点不能删除"));
+        }
+        let conn = self.conn.lock().map_err(|_| anyhow!("数据库锁异常"))?;
+        conn.execute(
+            "UPDATE hosts SET jump_host_id = NULL WHERE jump_host_id = ?1",
+            params![id],
+        )?;
+        conn.execute("DELETE FROM hosts WHERE id = ?1", params![id])?;
+        Ok(())
+    }
+
+    pub fn update_check_result(
+        &self,
+        id: &str,
+        online: bool,
+        latency_ms: Option<i64>,
+        os_info: Option<OsInfo>,
+        error: Option<String>,
+    ) -> Result<PublicHost> {
+        let existing = self
+            .get_record(id)?
+            .ok_or_else(|| anyhow!("主机不存在: {id}"))?;
+        let now = Utc::now().to_rfc3339();
+        let status = if online { "online" } else { "offline" };
+        let merged_os = os_info.or(existing.os_info);
+        let last_connected = if online {
+            Some(now.clone())
+        } else {
+            existing.last_connected_at
+        };
+
+        {
+            let conn = self.conn.lock().map_err(|_| anyhow!("数据库锁异常"))?;
+            conn.execute(
+                "UPDATE hosts SET
+                    status = ?1,
+                    latency_ms = ?2,
+                    os_json = ?3,
+                    last_connected_at = ?4,
+                    last_error = ?5,
+                    updated_at = ?6
+                 WHERE id = ?7",
+                params![
+                    status,
+                    latency_ms,
+                    merged_os
+                        .as_ref()
+                        .and_then(|o| serde_json::to_string(o).ok()),
+                    last_connected,
+                    error,
+                    now,
+                    id
+                ],
+            )?;
+        }
+
+        self.get_public_host(id)?
+            .ok_or_else(|| anyhow!("更新检测结果后读取失败"))
+    }
+
+    /// 从本机旧版 1Shell (%APPDATA%\1Shell\data\1shell.db) 导入全部主机与偏好
+    pub fn import_from_1shell(&self) -> Result<usize> {
+        let db_path = find_1shell_db_path()
+            .ok_or_else(|| anyhow!("未找到本机 1Shell 数据库 (%APPDATA%\\1Shell\\data\\1shell.db)"))?;
+
+        let src_conn = Connection::open_with_flags(&db_path, OpenFlags::SQLITE_OPEN_READ_ONLY)
+            .with_context(|| format!("只读打开 1Shell 数据库失败: {}", db_path.display()))?;
+
+        let mut prefs: HashMap<String, LegacyPref> = HashMap::new();
+        if let Ok(mut pref_stmt) = src_conn.prepare(
+            "SELECT host_id, repository_order, console_order, pinned, role, tags_json, archived FROM host_preferences",
+        ) {
+            if let Ok(rows) = pref_stmt.query_map([], |row| {
+                let host_id: String = row.get(0)?;
+                let repo_order: i64 = row.get::<_, Option<i64>>(1)?.unwrap_or(0);
+                let console_order: i64 = row.get::<_, Option<i64>>(2)?.unwrap_or(0);
+                let pinned: bool = row.get::<_, Option<i64>>(3)?.unwrap_or(0) != 0;
+                let role: Option<String> = row.get(4)?;
+                let tags_raw: Option<String> = row.get(5)?;
+                let archived: bool = row.get::<_, Option<i64>>(6)?.unwrap_or(0) != 0;
+                let tags: Vec<String> = tags_raw
+                    .as_deref()
+                    .and_then(|s| serde_json::from_str(s).ok())
+                    .unwrap_or_default();
+                Ok((
+                    host_id,
+                    LegacyPref {
+                        repository_order: repo_order,
+                        console_order,
+                        pinned,
+                        role,
+                        tags,
+                        archived,
+                    },
+                ))
+            }) {
+                for item in rows.flatten() {
+                    prefs.insert(item.0, item.1);
+                }
+            }
+        }
+
+        let mut stmt = src_conn.prepare("SELECT data FROM hosts ORDER BY created_at ASC")?;
+        let raw_rows: Vec<String> = stmt
+            .query_map([], |r| r.get::<_, String>(0))?
+            .collect::<std::result::Result<Vec<_>, _>>()?;
+
+        let mut imported = 0usize;
+        let now = Utc::now().to_rfc3339();
+        let mut conn = self.conn.lock().map_err(|_| anyhow!("数据库锁异常"))?;
+        let tx = conn.transaction()?;
+
+        for (idx, raw) in raw_rows.into_iter().enumerate() {
+            let Ok(legacy) = serde_json::from_str::<LegacyOneShellHost>(&raw) else {
+                continue;
+            };
+            if legacy.id == LOCAL_HOST_ID || legacy.kind == "local" {
+                continue;
+            }
+
+            let plain_pwd = legacy
+                .encrypted_password
+                .as_ref()
+                .and_then(|p| decrypt_1shell_payload(p, None).ok().flatten());
+            let plain_key = legacy
+                .encrypted_private_key
+                .as_ref()
+                .and_then(|p| decrypt_1shell_payload(p, None).ok().flatten());
+            let plain_pass = legacy
+                .encrypted_passphrase
+                .as_ref()
+                .and_then(|p| decrypt_1shell_payload(p, None).ok().flatten());
+
+            let enc_pwd = match plain_pwd.as_deref() {
+                Some(s) => self.master_key.encrypt(s)?,
+                None => None,
+            };
+            let enc_key = match plain_key.as_deref() {
+                Some(s) => self.master_key.encrypt(s)?,
+                None => None,
+            };
+            let enc_pass = match plain_pass.as_deref() {
+                Some(s) => self.master_key.encrypt(s)?,
+                None => None,
+            };
+
+            let pref = prefs.get(&legacy.id);
+            let sort_order = pref
+                .map(|p| {
+                    if p.repository_order > 0 {
+                        p.repository_order
+                    } else if p.console_order > 0 {
+                        p.console_order
+                    } else {
+                        idx as i64
+                    }
+                })
+                .unwrap_or(idx as i64);
+            let pinned = pref.map(|p| p.pinned).unwrap_or(false);
+            let archived = pref.map(|p| p.archived).unwrap_or(false);
+            let role = pref.and_then(|p| p.role.clone());
+            let tags = pref.map(|p| p.tags.clone()).unwrap_or_default();
+            let links = normalize_links(legacy.links);
+            let os_json = legacy
+                .os_info
+                .as_ref()
+                .and_then(|o| serde_json::to_string(o).ok());
+            let created_at = legacy.created_at.unwrap_or_else(|| now.clone());
+            let updated_at = legacy.updated_at.unwrap_or_else(|| now.clone());
+
+            tx.execute(
+                "INSERT INTO hosts (
+                    id, name, kind, addr, port, username, auth_type,
+                    encrypted_password, encrypted_private_key, encrypted_passphrase,
+                    jump_host_id, role, tags_json, links_json, os_json,
+                    pinned, archived, sort_order, status, created_at, updated_at
+                ) VALUES (?1, ?2, 'ssh', ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, ?16, ?17, 'unknown', ?18, ?19)
+                ON CONFLICT(id) DO UPDATE SET
+                    name = excluded.name,
+                    addr = excluded.addr,
+                    port = excluded.port,
+                    username = excluded.username,
+                    auth_type = excluded.auth_type,
+                    encrypted_password = COALESCE(excluded.encrypted_password, hosts.encrypted_password),
+                    encrypted_private_key = COALESCE(excluded.encrypted_private_key, hosts.encrypted_private_key),
+                    encrypted_passphrase = COALESCE(excluded.encrypted_passphrase, hosts.encrypted_passphrase),
+                    jump_host_id = excluded.jump_host_id,
+                    role = COALESCE(hosts.role, excluded.role),
+                    os_json = COALESCE(hosts.os_json, excluded.os_json),
+                    updated_at = excluded.updated_at",
+                params![
+                    legacy.id,
+                    legacy.name,
+                    legacy.host,
+                    legacy.port.unwrap_or(22) as i64,
+                    if legacy.username.is_empty() {
+                        "root".to_string()
+                    } else {
+                        legacy.username
+                    },
+                    if legacy.auth_type.is_empty() {
+                        "password".to_string()
+                    } else {
+                        legacy.auth_type
+                    },
+                    enc_pwd,
+                    enc_key,
+                    enc_pass,
+                    legacy.proxy_host_id.filter(|s| !s.is_empty()),
+                    role,
+                    serde_json::to_string(&tags)?,
+                    serde_json::to_string(&links)?,
+                    os_json,
+                    if pinned { 1 } else { 0 },
+                    if archived { 1 } else { 0 },
+                    sort_order,
+                    created_at,
+                    updated_at
+                ],
+            )?;
+
+            imported += 1;
+        }
+
+        tx.commit()?;
+        Ok(imported)
+    }
+
+    // ==================== 系统设置、Web 登录鉴权与 MCP API Key ====================
+
+    fn ensure_default_settings(&self) -> Result<()> {
+        let conn = self.conn.lock().map_err(|_| anyhow!("数据库锁异常"))?;
+        let has_key: Option<String> = conn
+            .query_row(
+                "SELECT value FROM settings WHERE key = 'mcp_api_key'",
+                [],
+                |r| r.get(0),
+            )
+            .optional()?;
+
+        if has_key.is_none() {
+            let api_key = generate_api_key();
+            conn.execute(
+                "INSERT OR IGNORE INTO settings (key, value) VALUES ('mcp_api_key', ?1)",
+                params![api_key],
+            )?;
+            conn.execute(
+                "INSERT OR IGNORE INTO settings (key, value) VALUES ('mcp_enabled', 'true')",
+                [],
+            )?;
+            conn.execute(
+                "INSERT OR IGNORE INTO settings (key, value) VALUES ('mcp_require_api_key', 'false')",
+                [],
+            )?;
+            conn.execute(
+                "INSERT OR IGNORE INTO settings (key, value) VALUES ('auth_enabled', 'false')",
+                [],
+            )?;
+            conn.execute(
+                "INSERT OR IGNORE INTO settings (key, value) VALUES ('admin_username', 'admin')",
+                [],
+            )?;
+        }
+        Ok(())
+    }
+
+    pub fn get_setting(&self, key: &str) -> Result<Option<String>> {
+        let conn = self.conn.lock().map_err(|_| anyhow!("数据库锁异常"))?;
+        conn.query_row(
+            "SELECT value FROM settings WHERE key = ?1",
+            params![key],
+            |r| r.get(0),
+        )
+        .optional()
+        .map_err(Into::into)
+    }
+
+    pub fn set_setting(&self, key: &str, value: &str) -> Result<()> {
+        let conn = self.conn.lock().map_err(|_| anyhow!("数据库锁异常"))?;
+        conn.execute(
+            "INSERT INTO settings (key, value) VALUES (?1, ?2)
+             ON CONFLICT(key) DO UPDATE SET value = excluded.value",
+            params![key, value],
+        )?;
+        Ok(())
+    }
+
+    pub fn get_app_settings(&self) -> Result<AppSettings> {
+        let auth_enabled = self
+            .get_setting("auth_enabled")?
+            .map(|v| v == "true")
+            .unwrap_or(false);
+        let admin_username = self
+            .get_setting("admin_username")?
+            .filter(|s| !s.is_empty())
+            .unwrap_or_else(|| "admin".to_string());
+        let has_admin_password = self
+            .get_setting("admin_password_enc")?
+            .filter(|s| !s.is_empty())
+            .is_some();
+        let mcp_enabled = self
+            .get_setting("mcp_enabled")?
+            .map(|v| v != "false")
+            .unwrap_or(true);
+        let mcp_require_api_key = self
+            .get_setting("mcp_require_api_key")?
+            .map(|v| v == "true")
+            .unwrap_or(false);
+        let mcp_api_key = match self.get_setting("mcp_api_key")? {
+            Some(k) if !k.is_empty() => k,
+            _ => {
+                let k = generate_api_key();
+                self.set_setting("mcp_api_key", &k)?;
+                k
+            }
+        };
+
+        Ok(AppSettings {
+            auth_enabled,
+            admin_username,
+            has_admin_password,
+            mcp_enabled,
+            mcp_require_api_key,
+            mcp_api_key,
+        })
+    }
+
+    pub fn update_auth_settings(
+        &self,
+        auth_enabled: bool,
+        username: &str,
+        new_password: Option<&str>,
+    ) -> Result<AppSettings> {
+        let clean_user = username.trim();
+        if clean_user.is_empty() {
+            return Err(anyhow!("管理员账号不能为空"));
+        }
+
+        if let Some(pwd) = new_password.filter(|s| !s.is_empty()) {
+            if let Some(enc) = self.master_key.encrypt(pwd)? {
+                self.set_setting("admin_password_enc", &enc)?;
+            }
+        }
+
+        if auth_enabled {
+            let has_pwd = self
+                .get_setting("admin_password_enc")?
+                .filter(|s| !s.is_empty())
+                .is_some();
+            if !has_pwd {
+                return Err(anyhow!("开启登录保护前请先设置管理员密码"));
+            }
+        }
+
+        self.set_setting("admin_username", clean_user)?;
+        self.set_setting("auth_enabled", if auth_enabled { "true" } else { "false" })?;
+        self.get_app_settings()
+    }
+
+    pub fn verify_admin_credentials(&self, username: &str, password: &str) -> Result<bool> {
+        let expected_user = self
+            .get_setting("admin_username")?
+            .unwrap_or_else(|| "admin".to_string());
+        if username.trim() != expected_user {
+            return Ok(false);
+        }
+        let enc = self.get_setting("admin_password_enc")?;
+        let Some(stored_pwd) = self.master_key.decrypt(enc.as_deref())? else {
+            return Ok(false);
+        };
+        Ok(stored_pwd == password)
+    }
+
+    pub fn update_mcp_settings(
+        &self,
+        mcp_enabled: bool,
+        mcp_require_api_key: bool,
+        regenerate_key: bool,
+    ) -> Result<AppSettings> {
+        self.set_setting("mcp_enabled", if mcp_enabled { "true" } else { "false" })?;
+        self.set_setting(
+            "mcp_require_api_key",
+            if mcp_require_api_key { "true" } else { "false" },
+        )?;
+        if regenerate_key {
+            let new_key = generate_api_key();
+            self.set_setting("mcp_api_key", &new_key)?;
+        }
+        self.get_app_settings()
+    }
+}
+
+#[derive(Debug, Clone, serde::Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AppSettings {
+    pub auth_enabled: bool,
+    pub admin_username: String,
+    pub has_admin_password: bool,
+    pub mcp_enabled: bool,
+    pub mcp_require_api_key: bool,
+    pub mcp_api_key: String,
+}
+
+fn generate_api_key() -> String {
+    format!(
+        "vpsk_{}{}",
+        Uuid::new_v4().simple(),
+        &Uuid::new_v4().simple().to_string()[..12]
+    )
+}
+
+fn find_1shell_db_path() -> Option<PathBuf> {
+    if let Ok(appdata) = std::env::var("APPDATA") {
+        let candidate = PathBuf::from(appdata).join("1Shell").join("data").join("1shell.db");
+        if candidate.exists() {
+            return Some(candidate);
+        }
+    }
+    let fallback = PathBuf::from(r"E:\1shell4.7\1shell-4.7\data\1shell.db");
+    if fallback.exists() {
+        return Some(fallback);
+    }
+    None
+}
+
+fn normalize_links(links: Vec<HostLink>) -> Vec<HostLink> {
+    links
+        .into_iter()
+        .filter(|l| !l.name.trim().is_empty() && !l.url.trim().is_empty())
+        .map(|l| HostLink {
+            id: if l.id.trim().is_empty() {
+                format!("link_{}", Uuid::new_v4())
+            } else {
+                l.id.trim().to_string()
+            },
+            name: l.name.trim().to_string(),
+            url: l.url.trim().to_string(),
+            description: l.description.trim().to_string(),
+        })
+        .collect()
+}
+
+fn normalize_tags(tags: Vec<String>) -> Vec<String> {
+    let mut out = Vec::new();
+    for t in tags {
+        let trimmed = t.trim().to_string();
+        if !trimmed.is_empty() && !out.contains(&trimmed) {
+            out.push(trimmed);
+        }
+    }
+    out
+}
diff --git a/src/desktop.rs b/src/desktop.rs
new file mode 100644
index 0000000..178b662
--- /dev/null
+++ b/src/desktop.rs
@@ -0,0 +1,265 @@
+#![cfg(windows)]
+
+use crate::{api::AppState, terminal::UiEvent};
+use anyhow::Result;
+use std::sync::Arc;
+use tao::{
+    dpi::{LogicalSize, Size},
+    event::{Event, StartCause, WindowEvent},
+    event_loop::{ControlFlow, EventLoopBuilder},
+    window::{Icon as WindowIcon, WindowBuilder},
+};
+use tray_icon::{
+    menu::{Menu, MenuEvent, MenuItem, PredefinedMenuItem},
+    Icon as TrayIconImage, MouseButton, MouseButtonState, TrayIconBuilder, TrayIconEvent,
+};
+use wry::WebViewBuilder;
+
+#[derive(Debug, Clone)]
+pub enum DesktopUserEvent {
+    TrayIcon(TrayIconEvent),
+    TrayMenu(MenuEvent),
+    ShowWindow,
+}
+
+const MENU_ID_SHOW: &str = "app:show";
+const MENU_ID_QUIT: &str = "app:quit";
+const MENU_HOST_PREFIX: &str = "host:";
+
+/// 纯代码光栅化生成 64x64 高清抗锯齿 VPS Switch 图标（深色圆角矩形 + 白色 > 终端符 + 活力橙圆点）
+pub fn render_brand_icon_rgba(size: u32) -> Vec<u8> {
+    let mut buf = vec![0u8; (size * size * 4) as usize];
+    let s = size as f32;
+
+    for y in 0..size {
+        for x in 0..size {
+            let fx = (x as f32 + 0.5) / s * 64.0;
+            let fy = (y as f32 + 0.5) / s * 64.0;
+
+            // 1. 圆角方块底 (64x64, rx=15)
+            let bg_dist = sd_rounded_box(fx - 32.0, fy - 32.0, 29.0, 29.0, 14.0);
+            if bg_dist > 1.0 {
+                continue;
+            }
+            let bg_alpha = (0.5 - bg_dist).clamp(0.0, 1.0);
+
+            let mut r = 24.0;
+            let mut g = 24.0;
+            let mut b = 27.0;
+
+            // 2. 左侧白色终端折线 > : (16, 20) -> (28, 32) -> (16, 44)
+            let d_seg1 = sd_segment(fx, fy, 16.0, 20.0, 27.5, 32.0) - 2.7;
+            let d_seg2 = sd_segment(fx, fy, 27.5, 32.0, 16.0, 44.0) - 2.7;
+            let d_chevron = d_seg1.min(d_seg2);
+            if d_chevron < 0.8 {
+                let w = (0.5 - d_chevron).clamp(0.0, 1.0);
+                r = r * (1.0 - w) + 250.0 * w;
+                g = g * (1.0 - w) + 250.0 * w;
+                b = b * (1.0 - w) + 250.0 * w;
+            }
+
+            // 3. 右侧活力橙 Switch 节点圆 (cx=43, cy=32, r=6.8)
+            let d_dot = ((fx - 43.0).powi(2) + (fy - 32.0).powi(2)).sqrt() - 6.8;
+            if d_dot < 0.8 {
+                let w = (0.5 - d_dot).clamp(0.0, 1.0);
+                r = r * (1.0 - w) + 249.0 * w;
+                g = g * (1.0 - w) + 115.0 * w;
+                b = b * (1.0 - w) + 22.0 * w;
+            }
+
+            let idx = ((y * size + x) * 4) as usize;
+            buf[idx] = r as u8;
+            buf[idx + 1] = g as u8;
+            buf[idx + 2] = b as u8;
+            buf[idx + 3] = (bg_alpha * 255.0) as u8;
+        }
+    }
+    buf
+}
+
+fn sd_rounded_box(px: f32, py: f32, bx: f32, by: f32, r: f32) -> f32 {
+    let qx = px.abs() - bx + r;
+    let qy = py.abs() - by + r;
+    (qx.max(0.0).powi(2) + qy.max(0.0).powi(2)).sqrt() + qx.max(qy).min(0.0) - r
+}
+
+fn sd_segment(px: f32, py: f32, ax: f32, ay: f32, bx: f32, by: f32) -> f32 {
+    let pax = px - ax;
+    let pay = py - ay;
+    let bax = bx - ax;
+    let bay = by - ay;
+    let h = ((pax * bax + pay * bay) / (bax * bax + bay * bay)).clamp(0.0, 1.0);
+    ((pax - bax * h).powi(2) + (pay - bay * h).powi(2)).sqrt()
+}
+
+fn build_tray_menu(state: &Arc<AppState>) -> Result<Menu> {
+    let menu = Menu::new();
+    let show_item = MenuItem::with_id(MENU_ID_SHOW, "打开 VPS Switch 主界面", true, None);
+    menu.append(&show_item)?;
+    menu.append(&PredefinedMenuItem::separator())?;
+
+    if let Ok(hosts) = state.db.list_public_hosts() {
+        let mut active: Vec<_> = hosts.into_iter().filter(|h| !h.archived).collect();
+        // 优先排：本机 -> 收藏 -> 置顶 -> 在线
+        active.sort_by(|a, b| {
+            (a.kind != "local")
+                .cmp(&(b.kind != "local"))
+                .then_with(|| b.favorited.cmp(&a.favorited))
+                .then_with(|| b.pinned.cmp(&a.pinned))
+                .then_with(|| (a.status != "online").cmp(&(b.status != "online")))
+        });
+
+        for h in active.into_iter().take(28) {
+            let prefix = if h.favorited {
+                "★ "
+            } else if h.status == "online" {
+                "● "
+            } else {
+                "○ "
+            };
+            let label = if h.kind == "local" {
+                format!("{prefix}{} (PowerShell)", h.name)
+            } else {
+                format!("{prefix}{} ({})", h.name, h.addr)
+            };
+            let item = MenuItem::with_id(
+                format!("{MENU_HOST_PREFIX}{}", h.id),
+                label,
+                true,
+                None,
+            );
+            let _ = menu.append(&item);
+        }
+        menu.append(&PredefinedMenuItem::separator())?;
+    }
+
+    let quit_item = MenuItem::with_id(MENU_ID_QUIT, "退出 VPS Switch", true, None);
+    menu.append(&quit_item)?;
+    Ok(menu)
+}
+
+pub fn run_desktop_window(
+    state: Arc<AppState>,
+    rt_handle: tokio::runtime::Handle,
+    port: u16,
+) -> Result<()> {
+    let event_loop = EventLoopBuilder::<DesktopUserEvent>::with_user_event().build();
+    let proxy = event_loop.create_proxy();
+
+    // 注册外部单实例唤醒回调（当用户第二次双击 vps-switch.exe 时直接唤醒当前窗口）
+    {
+        let proxy_show = proxy.clone();
+        let mut rx = state.terminals.subscribe_ui_events();
+        rt_handle.spawn(async move {
+            while let Ok(ev) = rx.recv().await {
+                match ev {
+                    UiEvent::RevealTerminal { .. } | UiEvent::ShowMainWindow => {
+                        let _ = proxy_show.send_event(DesktopUserEvent::ShowWindow);
+                    }
+                }
+            }
+        });
+    }
+
+    let rgba64 = render_brand_icon_rgba(64);
+    let win_icon = WindowIcon::from_rgba(rgba64.clone(), 64, 64).ok();
+    let tray_icon_img = TrayIconImage::from_rgba(rgba64, 64, 64)?;
+
+    let window = WindowBuilder::new()
+        .with_title("VPS Switch")
+        .with_inner_size(Size::Logical(LogicalSize::new(1280.0, 800.0)))
+        .with_min_inner_size(Size::Logical(LogicalSize::new(920.0, 600.0)))
+        .with_window_icon(win_icon)
+        .build(&event_loop)?;
+
+    let url = format!("http://127.0.0.1:{port}");
+    let _webview = WebViewBuilder::new()
+        .with_url(&url)
+        .build(&window)?;
+
+    // 系统托盘事件转发到主事件循环
+    let proxy_tray = proxy.clone();
+    TrayIconEvent::set_event_handler(Some(move |event| {
+        let _ = proxy_tray.send_event(DesktopUserEvent::TrayIcon(event));
+    }));
+
+    let proxy_menu = proxy.clone();
+    MenuEvent::set_event_handler(Some(move |event| {
+        let _ = proxy_menu.send_event(DesktopUserEvent::TrayMenu(event));
+    }));
+
+    let mut tray_icon = None;
+
+    event_loop.run(move |event, _, control_flow| {
+        *control_flow = ControlFlow::Wait;
+
+        match event {
+            Event::NewEvents(StartCause::Init) => {
+                if let Ok(menu) = build_tray_menu(&state) {
+                    tray_icon = TrayIconBuilder::new()
+                        .with_menu(Box::new(menu))
+                        .with_menu_on_left_click(false)
+                        .with_tooltip("VPS Switch · 右键快速连接 VPS 终端")
+                        .with_icon(tray_icon_img.clone())
+                        .build()
+                        .ok();
+                }
+            }
+            Event::WindowEvent {
+                event: WindowEvent::CloseRequested,
+                ..
+            } => {
+                // 点击右上角 × 最小化驻留到系统托盘，保持后台 MCP Server 与已打开的终端不断连
+                window.set_visible(false);
+            }
+            Event::UserEvent(DesktopUserEvent::ShowWindow) => {
+                window.set_visible(true);
+                window.set_minimized(false);
+                window.set_focus();
+            }
+            Event::UserEvent(DesktopUserEvent::TrayIcon(tray_ev)) => {
+                if let TrayIconEvent::Click {
+                    button: MouseButton::Left,
+                    button_state: MouseButtonState::Up,
+                    ..
+                } = tray_ev
+                {
+                    window.set_visible(true);
+                    window.set_minimized(false);
+                    window.set_focus();
+                }
+            }
+            Event::UserEvent(DesktopUserEvent::TrayMenu(menu_ev)) => {
+                let id_str = menu_ev.id.0.as_str();
+                if id_str == MENU_ID_SHOW {
+                    window.set_visible(true);
+                    window.set_minimized(false);
+                    window.set_focus();
+                } else if id_str == MENU_ID_QUIT {
+                    let _ = tray_icon.take();
+                    *control_flow = ControlFlow::Exit;
+                } else if let Some(host_id) = id_str.strip_prefix(MENU_HOST_PREFIX) {
+                    // 托盘右键点选某台 VPS：立即唤醒主窗口并在界面上直接打开该主机的终端！
+                    window.set_visible(true);
+                    window.set_minimized(false);
+                    window.set_focus();
+
+                    let st = state.clone();
+                    let hid = host_id.to_string();
+                    rt_handle.spawn(async move {
+                        if let Some(existing) = st.terminals.find_active_pane_for_host(&hid) {
+                            st.terminals.reveal_pane_in_ui(&existing.id, None);
+                        } else if let Ok(created) = st
+                            .terminals
+                            .create_pane(&st.ssh_pool, &st.db, &hid, 100, 30, None, false)
+                            .await
+                        {
+                            st.terminals.reveal_pane_in_ui(&created.id, None);
+                        }
+                    });
+                }
+            }
+            _ => {}
+        }
+    });
+}
diff --git a/src/files.rs b/src/files.rs
new file mode 100644
index 0000000..0596418
--- /dev/null
+++ b/src/files.rs
@@ -0,0 +1,1061 @@
+use crate::{
+    db::Database,
+    models::LOCAL_HOST_ID,
+    ssh::SshPool,
+};
+use anyhow::{anyhow, Context, Result};
+use chrono::Utc;
+use russh_sftp::{client::SftpSession, protocol::OpenFlags};
+use serde::{Deserialize, Serialize};
+use std::{
+    collections::HashMap,
+    path::{Path, PathBuf},
+    sync::Mutex,
+    time::{Instant, UNIX_EPOCH},
+};
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use uuid::Uuid;
+
+const MAX_TEXT_PREVIEW_BYTES: u64 = 8 * 1024 * 1024;
+/// 流式读写块大小：1 MiB（喂给 russh-sftp 内部自动切分为 64 路 255KiB 并发流水线）
+const STREAM_BUF_SIZE: usize = 1024 * 1024;
+/// 失速看门狗超时：若连续 12 秒没有任何新字节推进，立即判定链路僵死并强制中断，防止拖死 Agent
+const STALL_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(12);
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct FileEntry {
+    pub name: String,
+    pub path: String,
+    pub is_dir: bool,
+    pub size: u64,
+    pub mtime: i64,
+    pub permissions: Option<u32>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DirListing {
+    pub path: String,
+    pub parent: Option<String>,
+    pub items: Vec<FileEntry>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct FileReadResult {
+    pub path: String,
+    pub content: String,
+    pub size: u64,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct TransferTask {
+    pub id: String,
+    pub host_id: String,
+    pub host_name: String,
+    pub direction: String, // "upload" | "download"
+    pub filename: String,
+    pub local_path: Option<String>,
+    pub remote_path: String,
+    pub total_bytes: u64,
+    pub transferred_bytes: u64,
+    pub speed_bps: u64,
+    pub state: String, // "running" | "completed" | "failed"
+    pub error: Option<String>,
+    pub started_at: String,
+    pub ended_at: Option<String>,
+}
+
+/// 统一传输队列管理器（Web UI 与未来板块六 MCP 工具共用同一套传输状态与引擎）
+#[derive(Default)]
+pub struct TransferManager {
+    tasks: Mutex<HashMap<String, TransferTask>>,
+    order: Mutex<Vec<String>>,
+}
+
+impl TransferManager {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn create_task(
+        &self,
+        host_id: &str,
+        host_name: &str,
+        direction: &str,
+        filename: &str,
+        local_path: Option<String>,
+        remote_path: &str,
+        total_bytes: u64,
+    ) -> String {
+        let id = format!("tr_{}", Uuid::new_v4());
+        let task = TransferTask {
+            id: id.clone(),
+            host_id: host_id.to_string(),
+            host_name: host_name.to_string(),
+            direction: direction.to_string(),
+            filename: filename.to_string(),
+            local_path,
+            remote_path: remote_path.to_string(),
+            total_bytes,
+            transferred_bytes: 0,
+            speed_bps: 0,
+            state: "running".to_string(),
+            error: None,
+            started_at: Utc::now().to_rfc3339(),
+            ended_at: None,
+        };
+        self.tasks.lock().unwrap().insert(id.clone(), task);
+        let mut ord = self.order.lock().unwrap();
+        ord.insert(0, id.clone());
+        if ord.len() > 100 {
+            if let Some(old_id) = ord.pop() {
+                self.tasks.lock().unwrap().remove(&old_id);
+            }
+        }
+        id
+    }
+
+    pub fn update_progress(&self, id: &str, transferred: u64, total: u64, elapsed_secs: f64) {
+        if let Some(task) = self.tasks.lock().unwrap().get_mut(id) {
+            task.transferred_bytes = transferred;
+            if total > 0 {
+                task.total_bytes = total;
+            }
+            if elapsed_secs > 0.05 {
+                task.speed_bps = (transferred as f64 / elapsed_secs) as u64;
+            }
+        }
+    }
+
+    pub fn finish_task(&self, id: &str, final_bytes: u64, elapsed_secs: f64) {
+        if let Some(task) = self.tasks.lock().unwrap().get_mut(id) {
+            task.transferred_bytes = final_bytes;
+            if task.total_bytes == 0 {
+                task.total_bytes = final_bytes;
+            }
+            if elapsed_secs > 0.01 {
+                task.speed_bps = (final_bytes as f64 / elapsed_secs) as u64;
+            }
+            task.state = "completed".to_string();
+            task.ended_at = Some(Utc::now().to_rfc3339());
+        }
+    }
+
+    pub fn fail_task(&self, id: &str, err_msg: impl ToString) {
+        if let Some(task) = self.tasks.lock().unwrap().get_mut(id) {
+            task.state = "failed".to_string();
+            task.error = Some(err_msg.to_string());
+            task.ended_at = Some(Utc::now().to_rfc3339());
+        }
+    }
+
+    pub fn list_tasks(&self, host_id: Option<&str>) -> Vec<TransferTask> {
+        let ord = self.order.lock().unwrap().clone();
+        let map = self.tasks.lock().unwrap();
+        ord.into_iter()
+            .filter_map(|id| map.get(&id).cloned())
+            .filter(|t| host_id.map(|h| t.host_id == h).unwrap_or(true))
+            .collect()
+    }
+
+    pub fn clear_finished(&self) {
+        let mut map = self.tasks.lock().unwrap();
+        let mut ord = self.order.lock().unwrap();
+        map.retain(|_, t| t.state == "running");
+        ord.retain(|id| map.contains_key(id));
+    }
+}
+
+// ==================== 统一目录浏览与文件操作（本机 + 远端 SFTP） ====================
+
+pub async fn list_dir(
+    pool: &SshPool,
+    db: &Database,
+    host_id: &str,
+    dir_path: Option<&str>,
+    force_refresh: bool,
+) -> Result<DirListing> {
+    if host_id == LOCAL_HOST_ID {
+        return list_local_dir(dir_path).await;
+    }
+
+    let req_key = dir_path.unwrap_or("").trim();
+    if !force_refresh {
+        if let Some(cached) = pool
+            .get_cached_dir(host_id, req_key, std::time::Duration::from_secs(45))
+            .await
+        {
+            return Ok(cached);
+        }
+    }
+
+    let res = match list_remote_dir_once(pool, db, host_id, dir_path).await {
+        Ok(r) => r,
+        Err(_) => {
+            pool.invalidate_sftp(host_id).await;
+            list_remote_dir_once(pool, db, host_id, dir_path).await?
+        }
+    };
+    pool.put_cached_dir(host_id, req_key, &res).await;
+    Ok(res)
+}
+
+async fn list_local_dir(dir_path: Option<&str>) -> Result<DirListing> {
+    let raw = dir_path.unwrap_or("").trim();
+
+    // Windows 顶层虚拟根目录 "drives"（此电脑）：列出 C:/ D:/ E:/ 等全部可用盘符
+    if raw.eq_ignore_ascii_case("drives") || raw == "/" || raw == "\\" {
+        let mut drives = Vec::new();
+        for letter in b'A'..=b'Z' {
+            let drive_str = format!("{}:/", letter as char);
+            let p = PathBuf::from(&drive_str);
+            if tokio::fs::metadata(&p).await.is_ok() {
+                drives.push(FileEntry {
+                    name: format!("本地磁盘 ({}:)", letter as char),
+                    path: drive_str,
+                    is_dir: true,
+                    size: 0,
+                    mtime: 0,
+                    permissions: None,
+                });
+            }
+        }
+        return Ok(DirListing {
+            path: "drives".to_string(),
+            parent: None,
+            items: drives,
+        });
+    }
+
+    let target: PathBuf = if raw.is_empty() || raw == "~" {
+        std::env::var("USERPROFILE")
+            .or_else(|_| std::env::var("HOME"))
+            .map(PathBuf::from)
+            .unwrap_or_else(|_| PathBuf::from("C:/"))
+    } else if raw.len() == 2 && raw.as_bytes()[1] == b':' {
+        PathBuf::from(format!("{raw}/"))
+    } else {
+        PathBuf::from(raw)
+    };
+
+    let canonical = tokio::fs::canonicalize(&target).await.unwrap_or(target);
+    let clean_path = strip_verbatim_prefix(&canonical);
+
+    let mut rd = tokio::fs::read_dir(&clean_path)
+        .await
+        .with_context(|| format!("读取本机目录失败: {}", clean_path.display()))?;
+
+    let mut items = Vec::new();
+    while let Some(entry) = rd.next_entry().await? {
+        let name = entry.file_name().to_string_lossy().to_string();
+        let full = entry.path();
+        let meta = tokio::fs::metadata(&full).await.ok();
+        let is_dir = meta.as_ref().map(|m| m.is_dir()).unwrap_or(false);
+        let size = meta.as_ref().map(|m| m.len()).unwrap_or(0);
+        let mtime = meta
+            .as_ref()
+            .and_then(|m| m.modified().ok())
+            .and_then(|t| t.duration_since(UNIX_EPOCH).ok())
+            .map(|d| d.as_millis() as i64)
+            .unwrap_or(0);
+
+        items.push(FileEntry {
+            name,
+            path: full.to_string_lossy().replace('\\', "/"),
+            is_dir,
+            size,
+            mtime,
+            permissions: None,
+        });
+    }
+
+    sort_file_entries(&mut items);
+
+    let norm_path = clean_path.to_string_lossy().replace('\\', "/");
+    // 若当前已经是某个盘符根目录（如 C:/ 或 D:/），其 parent 指向 "drives"（此电脑盘符列表）
+    let is_drive_root = norm_path.len() <= 3 && norm_path.ends_with(":/");
+    let parent = if is_drive_root {
+        Some("drives".to_string())
+    } else {
+        clean_path
+            .parent()
+            .map(|p| p.to_string_lossy().replace('\\', "/"))
+            .filter(|p| !p.is_empty() && p != &norm_path)
+            .or_else(|| Some("drives".to_string()))
+    };
+
+    Ok(DirListing {
+        path: norm_path,
+        parent,
+        items,
+    })
+}
+
+fn strip_verbatim_prefix(p: &Path) -> PathBuf {
+    let s = p.to_string_lossy();
+    if let Some(stripped) = s.strip_prefix(r"\\?\") {
+        PathBuf::from(stripped)
+    } else {
+        p.to_path_buf()
+    }
+}
+
+async fn list_remote_dir_once(
+    pool: &SshPool,
+    db: &Database,
+    host_id: &str,
+    dir_path: Option<&str>,
+) -> Result<DirListing> {
+    let sftp = pool.get_or_open_sftp(db, host_id).await?;
+    let raw = dir_path.unwrap_or("").trim();
+
+    let resolved = if raw.is_empty() || raw == "~" || raw == "." {
+        pool.get_home_dir(&sftp, host_id).await
+    } else if let Some(rest) = raw.strip_prefix("~/") {
+        let home = pool.get_home_dir(&sftp, host_id).await;
+        join_remote_path(&home, rest)
+    } else if raw.len() > 1 {
+        raw.trim_end_matches('/').to_string()
+    } else {
+        raw.to_string()
+    };
+
+    let read_dir = sftp
+        .read_dir(&resolved)
+        .await
+        .with_context(|| format!("SFTP 读取目录失败: {resolved}"))?;
+
+    let mut items = Vec::new();
+    for entry in read_dir {
+        let name = entry.file_name();
+        let meta = entry.metadata();
+        let is_dir = meta.is_dir();
+        let size = meta.size.unwrap_or(0);
+        let mtime = meta.mtime.map(|m| (m as i64) * 1000).unwrap_or(0);
+        let permissions = meta.permissions;
+        let item_path = join_remote_path(&resolved, &name);
+
+        items.push(FileEntry {
+            name,
+            path: item_path,
+            is_dir,
+            size,
+            mtime,
+            permissions,
+        });
+    }
+
+    sort_file_entries(&mut items);
+
+    let parent = if resolved == "/" {
+        None
+    } else {
+        match resolved.rfind('/') {
+            Some(0) => Some("/".to_string()),
+            Some(idx) => Some(resolved[..idx].to_string()),
+            None => None,
+        }
+    };
+
+    Ok(DirListing {
+        path: resolved,
+        parent,
+        items,
+    })
+}
+
+fn sort_file_entries(items: &mut [FileEntry]) {
+    items.sort_by(|a, b| {
+        b.is_dir
+            .cmp(&a.is_dir)
+            .then_with(|| a.name.to_lowercase().cmp(&b.name.to_lowercase()))
+    });
+}
+
+pub fn join_remote_path(dir: &str, name: &str) -> String {
+    let clean_dir = dir.trim_end_matches('/');
+    let clean_name = name.trim_start_matches('/');
+    if clean_dir.is_empty() || clean_dir == "/" {
+        format!("/{clean_name}")
+    } else {
+        format!("{clean_dir}/{clean_name}")
+    }
+}
+
+pub async fn read_text_file(
+    pool: &SshPool,
+    db: &Database,
+    host_id: &str,
+    file_path: &str,
+) -> Result<FileReadResult> {
+    if host_id == LOCAL_HOST_ID {
+        let meta = tokio::fs::metadata(file_path).await?;
+        if meta.len() > MAX_TEXT_PREVIEW_BYTES {
+            return Err(anyhow!("文件过大 ({} MB)，超过在线编辑上限 8 MB", meta.len() / 1024 / 1024));
+        }
+        let bytes = tokio::fs::read(file_path).await?;
+        let content = String::from_utf8(bytes).context("该文件不是有效的 UTF-8 文本文件")?;
+        return Ok(FileReadResult {
+            path: file_path.to_string(),
+            content,
+            size: meta.len(),
+        });
+    }
+
+    let sftp = pool.get_or_open_sftp(db, host_id).await?;
+    let meta = sftp
+        .metadata(file_path)
+        .await
+        .with_context(|| format!("读取远端文件属性失败: {file_path}"))?;
+    let size = meta.size.unwrap_or(0);
+    if size > MAX_TEXT_PREVIEW_BYTES {
+        return Err(anyhow!(
+            "文件过大 ({:.1} MB)，超过在线编辑上限 8 MB，请直接下载",
+            size as f64 / 1024.0 / 1024.0
+        ));
+    }
+    let bytes = sftp
+        .read(file_path)
+        .await
+        .with_context(|| format!("读取远端文件失败: {file_path}"))?;
+    let content = String::from_utf8(bytes).context("该文件不是有效的 UTF-8 文本文件")?;
+    Ok(FileReadResult {
+        path: file_path.to_string(),
+        content,
+        size,
+    })
+}
+
+pub async fn write_text_file(
+    pool: &SshPool,
+    db: &Database,
+    host_id: &str,
+    file_path: &str,
+    content: &str,
+) -> Result<u64> {
+    let bytes = content.as_bytes();
+    if host_id == LOCAL_HOST_ID {
+        tokio::fs::write(file_path, bytes).await?;
+        return Ok(bytes.len() as u64);
+    }
+
+    let sftp = pool.get_or_open_sftp(db, host_id).await?;
+    let mut file = sftp
+        .create(file_path)
+        .await
+        .with_context(|| format!("打开远端文件写入失败: {file_path}"))?;
+    file.write_all(bytes).await?;
+    file.close().await?;
+    pool.invalidate_dir_cache(host_id).await;
+    Ok(bytes.len() as u64)
+}
+
+pub async fn create_dir(
+    pool: &SshPool,
+    db: &Database,
+    host_id: &str,
+    dir_path: &str,
+) -> Result<()> {
+    if host_id == LOCAL_HOST_ID {
+        tokio::fs::create_dir_all(dir_path).await?;
+        return Ok(());
+    }
+    let sftp = pool.get_or_open_sftp(db, host_id).await?;
+    sftp.create_dir(dir_path)
+        .await
+        .with_context(|| format!("创建远端目录失败: {dir_path}"))?;
+    pool.invalidate_dir_cache(host_id).await;
+    Ok(())
+}
+
+pub async fn rename_item(
+    pool: &SshPool,
+    db: &Database,
+    host_id: &str,
+    old_path: &str,
+    new_path: &str,
+) -> Result<()> {
+    if host_id == LOCAL_HOST_ID {
+        tokio::fs::rename(old_path, new_path).await?;
+        return Ok(());
+    }
+    let sftp = pool.get_or_open_sftp(db, host_id).await?;
+    // 若目标已存在，先删除旧目标再 rename
+    if sftp.try_exists(new_path).await.unwrap_or(false) {
+        let _ = sftp.remove_file(new_path).await;
+    }
+    sftp.rename(old_path, new_path)
+        .await
+        .with_context(|| format!("重命名失败: {old_path} -> {new_path}"))?;
+    pool.invalidate_dir_cache(host_id).await;
+    Ok(())
+}
+
+pub async fn remove_item(
+    pool: &SshPool,
+    db: &Database,
+    host_id: &str,
+    target_path: &str,
+    is_dir: bool,
+) -> Result<()> {
+    if target_path == "/" || target_path.trim().is_empty() {
+        return Err(anyhow!("禁止删除根目录"));
+    }
+    if host_id == LOCAL_HOST_ID {
+        if is_dir {
+            tokio::fs::remove_dir_all(target_path).await?;
+        } else {
+            tokio::fs::remove_file(target_path).await?;
+        }
+        return Ok(());
+    }
+
+    let sftp = pool.get_or_open_sftp(db, host_id).await?;
+    if is_dir {
+        remove_remote_dir_recursive(&sftp, target_path).await?;
+    } else {
+        sftp.remove_file(target_path)
+            .await
+            .with_context(|| format!("删除远端文件失败: {target_path}"))?;
+    }
+    pool.invalidate_dir_cache(host_id).await;
+    Ok(())
+}
+
+async fn remove_remote_dir_recursive(sftp: &SftpSession, dir_path: &str) -> Result<()> {
+    let mut stack = vec![dir_path.to_string()];
+    let mut dirs_to_remove = Vec::new();
+
+    while let Some(curr) = stack.pop() {
+        let entries = sftp.read_dir(&curr).await?;
+        dirs_to_remove.push(curr.clone());
+        for entry in entries {
+            let sub_path = join_remote_path(&curr, &entry.file_name());
+            if entry.metadata().is_dir() {
+                stack.push(sub_path);
+            } else {
+                sftp.remove_file(&sub_path).await?;
+            }
+        }
+    }
+
+    for dir in dirs_to_remove.into_iter().rev() {
+        sftp.remove_dir(&dir).await?;
+    }
+    Ok(())
+}
+
+// ==================== 压缩与解压（复用 SshPool 连接 / 本机命令） ====================
+
+fn shell_quote(val: &str) -> String {
+    format!("'{}'", val.replace('\'', r"'\''"))
+}
+
+fn detect_archive_kind(path: &str) -> Option<(&'static str, &'static str)> {
+    let lower = path.to_lowercase();
+    for (suffix, kind) in [
+        (".tar.gz", "tar.gz"),
+        (".tgz", "tar.gz"),
+        (".tar.xz", "tar.xz"),
+        (".txz", "tar.xz"),
+        (".tar.bz2", "tar.bz2"),
+        (".tbz2", "tar.bz2"),
+        (".tar", "tar"),
+        (".zip", "zip"),
+        (".gz", "gz"),
+    ] {
+        if lower.ends_with(suffix) {
+            return Some((suffix, kind));
+        }
+    }
+    None
+}
+
+async fn run_ssh_exec_checked(pool: &SshPool, db: &Database, host_id: &str, cmd: &str) -> Result<String> {
+    let (_rec, mut channel) = crate::ssh::open_host_channel(pool, db, host_id).await?;
+    channel.exec(true, cmd).await?;
+    let mut stdout = Vec::new();
+    let mut stderr = Vec::new();
+    let mut exit_code: Option<u32> = None;
+
+    while let Some(msg) = channel.wait().await {
+        match msg {
+            russh::ChannelMsg::Data { data } => stdout.extend_from_slice(&data),
+            russh::ChannelMsg::ExtendedData { data, .. } => stderr.extend_from_slice(&data),
+            russh::ChannelMsg::ExitStatus { exit_status } => exit_code = Some(exit_status),
+            russh::ChannelMsg::Eof | russh::ChannelMsg::Close => break,
+            _ => {}
+        }
+    }
+
+    let out_str = String::from_utf8_lossy(&stdout).trim().to_string();
+    let err_str = String::from_utf8_lossy(&stderr).trim().to_string();
+    if exit_code.unwrap_or(0) != 0 {
+        let msg = if !err_str.is_empty() {
+            err_str
+        } else if !out_str.is_empty() {
+            out_str
+        } else {
+            format!("exit code {}", exit_code.unwrap_or(1))
+        };
+        return Err(anyhow!(msg));
+    }
+    Ok(out_str)
+}
+
+pub async fn compress_item(
+    pool: &SshPool,
+    db: &Database,
+    host_id: &str,
+    target_path: &str,
+) -> Result<String> {
+    let clean = target_path.trim_end_matches(['/', '\\']);
+    if clean.is_empty() || clean == "/" || clean == "drives" {
+        return Err(anyhow!("不能直接压缩根目录"));
+    }
+
+    if host_id == LOCAL_HOST_ID {
+        let p = PathBuf::from(clean);
+        let parent = p.parent().ok_or_else(|| anyhow!("无效路径"))?;
+        let base = p.file_name().and_then(|s| s.to_str()).ok_or_else(|| anyhow!("无效文件名"))?;
+        let mut out_name = format!("{base}.zip");
+        let mut out_path = parent.join(&out_name);
+        if tokio::fs::metadata(&out_path).await.is_ok() {
+            out_name = format!("{base}-{}.zip", Uuid::new_v4().simple());
+            out_path = parent.join(&out_name);
+        }
+        let status = tokio::process::Command::new("tar.exe")
+            .args(["-a", "-cf", &out_name, "--", base])
+            .current_dir(parent)
+            .output()
+            .await
+            .context("调用本机 tar.exe 压缩失败")?;
+        if !status.status.success() {
+            return Err(anyhow!(
+                "压缩失败: {}",
+                String::from_utf8_lossy(&status.stderr).trim()
+            ));
+        }
+        return Ok(out_path.to_string_lossy().replace('\\', "/"));
+    }
+
+    let (dir, base) = match clean.rfind('/') {
+        Some(0) => ("/", &clean[1..]),
+        Some(idx) => (&clean[..idx], &clean[idx + 1..]),
+        None => (".", clean),
+    };
+    let archive_name = format!("{base}.tar.gz");
+    let archive_full = join_remote_path(dir, &archive_name);
+
+    let cmd = format!(
+        "set -eu; cd {}; out={}; if [ -e \"$out\" ]; then out={}; fi; tar -czf \"$out\" -- {}; printf '%s\\n' \"$out\"",
+        shell_quote(dir),
+        shell_quote(&archive_name),
+        shell_quote(&format!("{base}-{}.tar.gz", &Uuid::new_v4().simple().to_string()[..6])),
+        shell_quote(base),
+    );
+    let out = run_ssh_exec_checked(pool, db, host_id, &cmd).await?;
+    pool.invalidate_dir_cache(host_id).await;
+    Ok(if out.is_empty() {
+        archive_full
+    } else {
+        join_remote_path(dir, &out)
+    })
+}
+
+pub async fn extract_item(
+    pool: &SshPool,
+    db: &Database,
+    host_id: &str,
+    archive_path: &str,
+) -> Result<String> {
+    let (suffix, kind) = detect_archive_kind(archive_path)
+        .ok_or_else(|| anyhow!("不支持的压缩包格式（支持 .tar.gz / .tgz / .tar.xz / .tar.bz2 / .tar / .zip / .gz）"))?;
+
+    if host_id == LOCAL_HOST_ID {
+        let p = PathBuf::from(archive_path);
+        let parent = p.parent().ok_or_else(|| anyhow!("无效路径"))?;
+        let fname = p.file_name().and_then(|s| s.to_str()).ok_or_else(|| anyhow!("无效文件名"))?;
+        let stem = fname[..fname.len() - suffix.len()].trim();
+        let folder_name = if stem.is_empty() { "extracted" } else { stem };
+        let mut out_dir = parent.join(folder_name);
+        if tokio::fs::metadata(&out_dir).await.is_ok() {
+            out_dir = parent.join(format!("{folder_name}.extracted"));
+        }
+        tokio::fs::create_dir_all(&out_dir).await?;
+        let status = tokio::process::Command::new("tar.exe")
+            .args(["-xf", archive_path, "-C", &out_dir.to_string_lossy()])
+            .output()
+            .await
+            .context("调用本机 tar.exe 解压失败")?;
+        if !status.status.success() {
+            return Err(anyhow!(
+                "解压失败: {}",
+                String::from_utf8_lossy(&status.stderr).trim()
+            ));
+        }
+        return Ok(out_dir.to_string_lossy().replace('\\', "/"));
+    }
+
+    let (dir, fname) = match archive_path.rfind('/') {
+        Some(0) => ("/", &archive_path[1..]),
+        Some(idx) => (&archive_path[..idx], &archive_path[idx + 1..]),
+        None => (".", archive_path),
+    };
+    let stem = fname[..fname.len() - suffix.len()].trim();
+    let folder_name = if stem.is_empty() { "extracted" } else { stem };
+    let out_dir = join_remote_path(dir, folder_name);
+    let fallback_dir = join_remote_path(dir, &format!("{folder_name}.extracted"));
+
+    let extract_cmd = match kind {
+        "tar.gz" => "tar -xzf \"$arch\" -C \"$dest\"".to_string(),
+        "tar.xz" => "tar -xJf \"$arch\" -C \"$dest\"".to_string(),
+        "tar.bz2" => "tar -xjf \"$arch\" -C \"$dest\"".to_string(),
+        "tar" => "tar -xf \"$arch\" -C \"$dest\"".to_string(),
+        "zip" => "unzip -q \"$arch\" -d \"$dest\"".to_string(),
+        "gz" => format!("gzip -dc \"$arch\" > \"$dest\"/{}", shell_quote(folder_name)),
+        _ => return Err(anyhow!("不支持的归档类型")),
+    };
+
+    let cmd = format!(
+        "set -eu; arch={}; dest={}; if [ -e \"$dest\" ]; then dest={}; fi; mkdir -p -- \"$dest\"; {}; printf '%s\\n' \"$dest\"",
+        shell_quote(archive_path),
+        shell_quote(&out_dir),
+        shell_quote(&fallback_dir),
+        extract_cmd,
+    );
+    let out = run_ssh_exec_checked(pool, db, host_id, &cmd).await?;
+    pool.invalidate_dir_cache(host_id).await;
+    Ok(if out.is_empty() { out_dir } else { out })
+}
+
+// ==================== 板块四：满速流式传输核心（UI 与未来 MCP 共用） ====================
+
+/// 从任意异步流（如 HTTP 上传流或本机文件流）高速写入目标主机，
+/// 写 `.part` 临时文件并在完成后原子改名，全程实时刷新速率与进度。
+pub async fn stream_upload_to_host<R>(
+    pool: &SshPool,
+    db: &Database,
+    transfers: &TransferManager,
+    task_id: &str,
+    host_id: &str,
+    remote_dir: &str,
+    filename: &str,
+    expected_size: u64,
+    mut reader: R,
+) -> Result<String>
+where
+    R: tokio::io::AsyncRead + Unpin,
+{
+    let safe_name = Path::new(filename)
+        .file_name()
+        .and_then(|s| s.to_str())
+        .ok_or_else(|| anyhow!("无效的文件名"))?;
+    let final_path = join_remote_path(remote_dir, safe_name);
+    let temp_path = format!("{final_path}.vps-part-{}", Uuid::new_v4().simple());
+    let started = Instant::now();
+
+    if host_id == LOCAL_HOST_ID {
+        let local_final = PathBuf::from(remote_dir).join(safe_name);
+        let local_temp = PathBuf::from(remote_dir).join(format!(".{safe_name}.vps-part"));
+        let mut out_file = tokio::fs::File::create(&local_temp).await?;
+        let mut buf = vec![0u8; STREAM_BUF_SIZE];
+        let mut transferred = 0u64;
+        loop {
+            let n = reader.read(&mut buf).await?;
+            if n == 0 {
+                break;
+            }
+            out_file.write_all(&buf[..n]).await?;
+            transferred += n as u64;
+            transfers.update_progress(
+                task_id,
+                transferred,
+                expected_size,
+                started.elapsed().as_secs_f64(),
+            );
+        }
+        out_file.flush().await?;
+        drop(out_file);
+        tokio::fs::rename(&local_temp, &local_final).await?;
+        transfers.finish_task(task_id, transferred, started.elapsed().as_secs_f64());
+        return Ok(local_final.to_string_lossy().replace('\\', "/"));
+    }
+
+    let sftp = pool.get_or_open_sftp(db, host_id).await?;
+    let mut remote_file = sftp
+        .open_with_flags(
+            &temp_path,
+            OpenFlags::CREATE | OpenFlags::TRUNCATE | OpenFlags::WRITE,
+        )
+        .await
+        .with_context(|| format!("创建远端临时文件失败: {temp_path}"))?;
+
+    let mut buf = vec![0u8; STREAM_BUF_SIZE];
+    let mut transferred = 0u64;
+    let write_res: Result<()> = async {
+        loop {
+            let n = tokio::time::timeout(STALL_TIMEOUT, reader.read(&mut buf))
+                .await
+                .map_err(|_| anyhow!("上传读取失速超时 (连续 12 秒无数据推进)"))??;
+            if n == 0 {
+                break;
+            }
+            tokio::time::timeout(STALL_TIMEOUT, remote_file.write_all(&buf[..n]))
+                .await
+                .map_err(|_| anyhow!("远端写入失速超时 (连续 12 秒无数据推进)"))??;
+            transferred += n as u64;
+            transfers.update_progress(
+                task_id,
+                transferred,
+                expected_size,
+                started.elapsed().as_secs_f64(),
+            );
+        }
+        tokio::time::timeout(STALL_TIMEOUT, remote_file.close())
+            .await
+            .map_err(|_| anyhow!("关闭远端文件句柄失速超时"))??;
+        Ok(())
+    }
+    .await;
+
+    if let Err(err) = write_res {
+        let _ = sftp.remove_file(&temp_path).await;
+        transfers.fail_task(task_id, &err);
+        return Err(err);
+    }
+
+    // 原子替换目标文件
+    if sftp.try_exists(&final_path).await.unwrap_or(false) {
+        let _ = sftp.remove_file(&final_path).await;
+    }
+    if let Err(err) = sftp.rename(&temp_path, &final_path).await {
+        let _ = sftp.remove_file(&temp_path).await;
+        transfers.fail_task(task_id, &err);
+        return Err(err.into());
+    }
+
+    transfers.finish_task(task_id, transferred, started.elapsed().as_secs_f64());
+    pool.invalidate_dir_cache(host_id).await;
+    Ok(final_path)
+}
+
+/// 本机路径 ↔ 远端路径 直接高速传输（桌面端直传 & 未来板块六 MCP `file.put` / `file.get` 直接调用此函数）
+pub async fn transfer_local_remote_file(
+    pool: &SshPool,
+    db: &Database,
+    transfers: &TransferManager,
+    host_id: &str,
+    direction: &str, // "upload" | "download"
+    local_path: &str,
+    remote_path: &str,
+) -> Result<TransferTask> {
+    let host = db
+        .get_record(host_id)?
+        .ok_or_else(|| anyhow!("主机不存在: {host_id}"))?;
+
+    if direction == "upload" {
+        let meta = tokio::fs::metadata(local_path)
+            .await
+            .with_context(|| format!("读取本机文件失败: {local_path}"))?;
+        let filename = Path::new(local_path)
+            .file_name()
+            .and_then(|s| s.to_str())
+            .unwrap_or("upload.bin")
+            .to_string();
+        let remote_dir = if remote_path.ends_with('/') {
+            remote_path.trim_end_matches('/').to_string()
+        } else {
+            match remote_path.rfind('/') {
+                Some(0) => "/".to_string(),
+                Some(idx) => remote_path[..idx].to_string(),
+                None => ".".to_string(),
+            }
+        };
+        let target_name = if remote_path.ends_with('/') {
+            filename.clone()
+        } else {
+            remote_path
+                .rsplit('/')
+                .next()
+                .filter(|s| !s.is_empty())
+                .unwrap_or(&filename)
+                .to_string()
+        };
+
+        let task_id = transfers.create_task(
+            host_id,
+            &host.name,
+            "upload",
+            &target_name,
+            Some(local_path.to_string()),
+            &join_remote_path(&remote_dir, &target_name),
+            meta.len(),
+        );
+        let file = tokio::fs::File::open(local_path).await?;
+        stream_upload_to_host(
+            pool,
+            db,
+            transfers,
+            &task_id,
+            host_id,
+            &remote_dir,
+            &target_name,
+            meta.len(),
+            file,
+        )
+        .await?;
+
+        transfers
+            .list_tasks(None)
+            .into_iter()
+            .find(|t| t.id == task_id)
+            .ok_or_else(|| anyhow!("读取传输任务状态失败"))
+    } else {
+        let sftp = pool.get_or_open_sftp(db, host_id).await?;
+        let meta = sftp
+            .metadata(remote_path)
+            .await
+            .with_context(|| format!("远端文件不存在: {remote_path}"))?;
+        let total = meta.size.unwrap_or(0);
+        let filename = remote_path
+            .rsplit('/')
+            .next()
+            .unwrap_or("download.bin")
+            .to_string();
+
+        let task_id = transfers.create_task(
+            host_id,
+            &host.name,
+            "download",
+            &filename,
+            Some(local_path.to_string()),
+            remote_path,
+            total,
+        );
+        let started = Instant::now();
+        let mut remote_file = sftp.open(remote_path).await?;
+        let temp_local = format!("{local_path}.vps-part");
+        let mut out_file = tokio::fs::File::create(&temp_local).await?;
+        let mut buf = vec![0u8; STREAM_BUF_SIZE];
+        let mut transferred = 0u64;
+
+        let res: Result<()> = async {
+            loop {
+                let n = tokio::time::timeout(STALL_TIMEOUT, remote_file.read(&mut buf))
+                    .await
+                    .map_err(|_| anyhow!("下载读取失速超时 (连续 12 秒无数据推进)"))??;
+                if n == 0 {
+                    break;
+                }
+                out_file.write_all(&buf[..n]).await?;
+                transferred += n as u64;
+                transfers.update_progress(
+                    &task_id,
+                    transferred,
+                    total,
+                    started.elapsed().as_secs_f64(),
+                );
+            }
+            out_file.flush().await?;
+            let _ = tokio::time::timeout(STALL_TIMEOUT, remote_file.close()).await;
+            Ok(())
+        }
+        .await;
+
+        if let Err(err) = res {
+            let _ = tokio::fs::remove_file(&temp_local).await;
+            transfers.fail_task(&task_id, &err);
+            return Err(err);
+        }
+
+        tokio::fs::rename(&temp_local, local_path).await?;
+        transfers.finish_task(&task_id, transferred, started.elapsed().as_secs_f64());
+
+        transfers
+            .list_tasks(None)
+            .into_iter()
+            .find(|t| t.id == task_id)
+            .ok_or_else(|| anyhow!("读取传输任务状态失败"))
+    }
+}
+
+/// 跨 VPS 直接流式对传（VPS A ──内存流──▶ VPS B，不落本机磁盘）
+pub async fn transfer_remote_to_remote(
+    pool: &SshPool,
+    db: &Database,
+    transfers: &TransferManager,
+    src_host_id: &str,
+    src_path: &str,
+    dst_host_id: &str,
+    dst_path: &str,
+) -> Result<TransferTask> {
+    let src_host = db
+        .get_record(src_host_id)?
+        .ok_or_else(|| anyhow!("源主机不存在: {src_host_id}"))?;
+    let dst_host = db
+        .get_record(dst_host_id)?
+        .ok_or_else(|| anyhow!("目标主机不存在: {dst_host_id}"))?;
+
+    let src_sftp = pool.get_or_open_sftp(db, src_host_id).await?;
+    let meta = src_sftp
+        .metadata(src_path)
+        .await
+        .with_context(|| format!("源主机文件不存在: {src_path}"))?;
+    let total = meta.size.unwrap_or(0);
+    let src_filename = src_path
+        .rsplit('/')
+        .next()
+        .unwrap_or("transfer.bin")
+        .to_string();
+
+    let (dst_dir, dst_name) = if dst_path.ends_with('/') {
+        (
+            dst_path.trim_end_matches('/').to_string(),
+            src_filename.clone(),
+        )
+    } else {
+        match dst_path.rfind('/') {
+            Some(0) => ("/".to_string(), dst_path[1..].to_string()),
+            Some(idx) => (
+                dst_path[..idx].to_string(),
+                dst_path[idx + 1..].to_string(),
+            ),
+            None => (".".to_string(), dst_path.to_string()),
+        }
+    };
+
+    let label = format!("{} -> {}", src_host.name, dst_host.name);
+    let task_id = transfers.create_task(
+        dst_host_id,
+        &label,
+        "upload",
+        &dst_name,
+        Some(format!("{}:{src_path}", src_host.name)),
+        &join_remote_path(&dst_dir, &dst_name),
+        total,
+    );
+
+    let src_file = src_sftp.open(src_path).await?;
+    stream_upload_to_host(
+        pool,
+        db,
+        transfers,
+        &task_id,
+        dst_host_id,
+        &dst_dir,
+        &dst_name,
+        total,
+        src_file,
+    )
+    .await?;
+
+    transfers
+        .list_tasks(None)
+        .into_iter()
+        .find(|t| t.id == task_id)
+        .ok_or_else(|| anyhow!("读取跨主机传输任务状态失败"))
+}
diff --git a/src/inspector.rs b/src/inspector.rs
new file mode 100644
index 0000000..d64b723
--- /dev/null
+++ b/src/inspector.rs
@@ -0,0 +1,609 @@
+use crate::{
+    db::Database,
+    models::{OsInfo, LOCAL_HOST_ID},
+    ssh::{exec_short_command, SshPool},
+};
+use anyhow::{anyhow, Result};
+use chrono::Utc;
+use serde::{Deserialize, Serialize};
+use std::{
+    collections::HashMap,
+    sync::Mutex,
+    time::Instant,
+};
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DiskUsageItem {
+    pub mount: String,
+    pub total_bytes: u64,
+    pub used_bytes: u64,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct HostInspection {
+    pub host_id: String,
+    pub sampled_at: String,
+    pub uptime_seconds: u64,
+    pub load_1: f64,
+    pub load_5: f64,
+    pub load_15: f64,
+    pub tcp_cc: Option<String>,
+    pub cpu_model: Option<String>,
+    pub cpu_cores: u32,
+    pub cpu_usage_pct: f64,
+    pub cpu_iowait_pct: f64,
+    pub cpu_steal_pct: f64,
+    pub mem_total_bytes: u64,
+    pub mem_used_bytes: u64,
+    pub mem_cached_bytes: u64,
+    pub swap_total_bytes: u64,
+    pub swap_used_bytes: u64,
+    pub disk_mount: String,
+    pub disk_total_bytes: u64,
+    pub disk_used_bytes: u64,
+    pub disks: Vec<DiskUsageItem>,
+    pub net_iface: String,
+    pub net_rx_bytes_total: u64,
+    pub net_tx_bytes_total: u64,
+    pub net_rx_bps: u64,
+    pub net_tx_bps: u64,
+}
+
+#[derive(Clone, Copy)]
+struct CpuTicks {
+    user: u64,
+    nice: u64,
+    system: u64,
+    idle: u64,
+    iowait: u64,
+    irq: u64,
+    softirq: u64,
+    steal: u64,
+}
+
+impl CpuTicks {
+    fn total(&self) -> u64 {
+        self.user
+            + self.nice
+            + self.system
+            + self.idle
+            + self.iowait
+            + self.irq
+            + self.softirq
+            + self.steal
+    }
+
+    fn idle_all(&self) -> u64 {
+        self.idle + self.iowait
+    }
+}
+
+struct PrevHostSample {
+    at: Instant,
+    cpu: CpuTicks,
+    net_iface: String,
+    net_rx: u64,
+    net_tx: u64,
+    last_cpu_pct: f64,
+    last_iowait_pct: f64,
+    last_steal_pct: f64,
+}
+
+#[derive(Default)]
+pub struct InspectorEngine {
+    prev_samples: Mutex<HashMap<String, PrevHostSample>>,
+    latest_snapshots: Mutex<HashMap<String, HostInspection>>,
+}
+
+/// 纯内核虚拟文件读取脚本：
+/// 1. 开头先用纯 shell builtin `read < /proc/stat` 取样 CPU1，在读取其他内核文件后再取 CPU2，
+///    保证即使首次点开也能通过真实 `/proc/stat` 差分算出准确 CPU%，绝不用容器里失真的 loadavg 估算；
+/// 2. 磁盘统一使用 POSIX 标准 `df -Pk`（1024-byte blocks，兼容 Alpine BusyBox 与所有发行版）。
+const LINUX_INSPECT_SCRIPT: &str = r#"export LC_ALL=C
+read -r _ u1 n1 s1 i1 w1 q1 sq1 st1 _ < /proc/stat 2>/dev/null
+CPU1="$u1 $n1 $s1 $i1 $w1 $q1 $sq1 $st1"
+read -r UP _ < /proc/uptime 2>/dev/null || UP=0
+read -r L1 L5 L15 _ < /proc/loadavg 2>/dev/null || { L1=0; L5=0; L15=0; }
+CC=$(cat /proc/sys/net/ipv4/tcp_congestion_control 2>/dev/null || echo "")
+IFACE=$(awk '$2 == "00000000" {print $1; exit}' /proc/net/route 2>/dev/null)
+if [ -z "$IFACE" ]; then
+  IFACE=$(awk -F: 'NR>2 {gsub(/^[ \t]+/,"",$1); if ($1 !~ /^(lo|docker|veth|br-|tun|tap|wg|tailscale|flannel|cni|virbr)/) {print $1; exit}}' /proc/net/dev 2>/dev/null)
+fi
+NET=$(awk -F'[: ]+' -v dev="$IFACE" '$0 ~ "^[ \t]*"dev":" {
+  for(i=1;i<=NF;i++) if($i == dev) { print $(i+1), $(i+9); exit }
+}' /proc/net/dev 2>/dev/null)
+MEM=$(awk '
+  /^MemTotal:/ {mt=$2}
+  /^MemFree:/ {mf=$2}
+  /^MemAvailable:/ {ma=$2}
+  /^Buffers:/ {buf=$2}
+  /^Cached:/ {ca=$2}
+  /^SReclaimable:/ {sr=$2}
+  /^SwapTotal:/ {st=$2}
+  /^SwapFree:/ {sf=$2}
+  END {
+    avail = (ma > 0) ? ma : (mf + buf + ca);
+    used = (mt > avail) ? (mt - avail) : 0;
+    cache = buf + ca + sr;
+    sw_used = (st > sf) ? (st - sf) : 0;
+    printf "%d %d %d %d %d", mt*1024, used*1024, cache*1024, st*1024, sw_used*1024
+  }
+' /proc/meminfo 2>/dev/null)
+DISKS=$(df -Pk 2>/dev/null | awk 'NR>1 && $1 !~ /^(tmpfs|devtmpfs|udev|none|shm|overlay)$/ && $6 !~ /^\/(dev|proc|sys|run|boot\/efi)/ {printf "%s:%d:%d|", $6, $2*1024, $3*1024}')
+if [ -z "$DISKS" ]; then
+  DISKS=$(df -Pk / 2>/dev/null | awk 'NR==2 {printf "%s:%d:%d|", $6, $2*1024, $3*1024}')
+fi
+MODEL=$(awk -F: '/model name|Model name/ {gsub(/^[ \t]+/,"",$2); print $2; exit}' /proc/cpuinfo 2>/dev/null)
+CORES=$(grep -c '^processor' /proc/cpuinfo 2>/dev/null || echo 1)
+if [ -f /etc/os-release ]; then . /etc/os-release; fi
+UNAME_R=$(uname -r 2>/dev/null)
+UNAME_M=$(uname -m 2>/dev/null)
+sleep 0.12 2>/dev/null || true
+read -r _ u2 n2 s2 i2 w2 q2 sq2 st2 _ < /proc/stat 2>/dev/null
+CPU2="$u2 $n2 $s2 $i2 $w2 $q2 $sq2 $st2"
+printf "UP=%s\nLOAD=%s %s %s\nCC=%s\nCPU1=%s\nCPU2=%s\nIFACE=%s\nNET=%s\nMEM=%s\nDISKS=%s\nMODEL=%s\nCORES=%s\nOS_ID=%s\nOS_VER=%s\nOS_PRETTY=%s\nKERNEL=%s\nARCH=%s\n" \
+  "$UP" "$L1" "$L5" "$L15" "$CC" "$CPU1" "$CPU2" "$IFACE" "$NET" "$MEM" "$DISKS" "$MODEL" "$CORES" "${ID:-linux}" "${VERSION_ID:-}" "${PRETTY_NAME:-Linux}" "$UNAME_R" "$UNAME_M"
+"#;
+
+impl InspectorEngine {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn get_all_cached(&self) -> HashMap<String, HostInspection> {
+        self.latest_snapshots.lock().unwrap().clone()
+    }
+
+    pub async fn inspect_host(
+        &self,
+        pool: &SshPool,
+        db: &Database,
+        host_id: &str,
+    ) -> Result<HostInspection> {
+        if host_id == LOCAL_HOST_ID {
+            let ins = self.inspect_local_windows().await?;
+            self.latest_snapshots
+                .lock()
+                .unwrap()
+                .insert(host_id.to_string(), ins.clone());
+            return Ok(ins);
+        }
+
+        let record = db
+            .get_record(host_id)?
+            .ok_or_else(|| anyhow!("主机不存在: {host_id}"))?;
+        let jump = match record.jump_host_id.as_deref() {
+            Some(jid) => db.get_record(jid)?,
+            None => None,
+        };
+
+        let started = Instant::now();
+        let session = match pool
+            .get_or_connect(&record, jump.as_ref(), db.master_key())
+            .await
+        {
+            Ok(s) => s,
+            Err(err) => {
+                let _ = db.update_check_result(
+                    host_id,
+                    false,
+                    None,
+                    None,
+                    Some(format!("{err:#}")),
+                );
+                return Err(err);
+            }
+        };
+
+        let raw = match exec_short_command(&session, LINUX_INSPECT_SCRIPT).await {
+            Ok(r) => r,
+            Err(err) => {
+                pool.invalidate_host(host_id).await;
+                let _ = db.update_check_result(
+                    host_id,
+                    false,
+                    None,
+                    None,
+                    Some(format!("{err:#}")),
+                );
+                return Err(err);
+            }
+        };
+        let latency_ms = started.elapsed().as_millis() as i64;
+
+        let (inspection, os_info) = self.parse_linux_inspection(host_id, &raw)?;
+        let _ = db.update_check_result(host_id, true, Some(latency_ms), Some(os_info), None);
+        self.latest_snapshots
+            .lock()
+            .unwrap()
+            .insert(host_id.to_string(), inspection.clone());
+
+        Ok(inspection)
+    }
+
+    fn parse_linux_inspection(
+        &self,
+        host_id: &str,
+        raw: &str,
+    ) -> Result<(HostInspection, OsInfo)> {
+        let mut map = HashMap::new();
+        for line in raw.lines() {
+            if let Some((k, v)) = line.split_once('=') {
+                map.insert(k.trim(), v.trim());
+            }
+        }
+
+        let uptime_seconds = map
+            .get("UP")
+            .and_then(|s| s.split('.').next())
+            .and_then(|s| s.parse::<u64>().ok())
+            .unwrap_or(0);
+
+        let mut load_parts = map
+            .get("LOAD")
+            .copied()
+            .unwrap_or("0 0 0")
+            .split_whitespace();
+        let load_1 = load_parts.next().and_then(|s| s.parse().ok()).unwrap_or(0.0);
+        let load_5 = load_parts.next().and_then(|s| s.parse().ok()).unwrap_or(0.0);
+        let load_15 = load_parts.next().and_then(|s| s.parse().ok()).unwrap_or(0.0);
+
+        let tcp_cc = map
+            .get("CC")
+            .map(|s| s.to_string())
+            .filter(|s| !s.is_empty());
+
+        let cpu1 = parse_cpu_ticks(map.get("CPU1").copied().unwrap_or(""));
+        let cpu2 = parse_cpu_ticks(map.get("CPU2").copied().unwrap_or(""));
+
+        let net_iface = map
+            .get("IFACE")
+            .copied()
+            .filter(|s| !s.is_empty())
+            .unwrap_or("eth0")
+            .to_string();
+
+        let mut net_parts = map.get("NET").copied().unwrap_or("0 0").split_whitespace();
+        let net_rx = net_parts.next().and_then(|s| s.parse::<u64>().ok()).unwrap_or(0);
+        let net_tx = net_parts.next().and_then(|s| s.parse::<u64>().ok()).unwrap_or(0);
+
+        let mut mem_parts = map
+            .get("MEM")
+            .copied()
+            .unwrap_or("0 0 0 0 0")
+            .split_whitespace();
+        let mem_total_bytes = mem_parts.next().and_then(|s| s.parse().ok()).unwrap_or(0);
+        let mem_used_bytes = mem_parts.next().and_then(|s| s.parse().ok()).unwrap_or(0);
+        let mem_cached_bytes = mem_parts.next().and_then(|s| s.parse().ok()).unwrap_or(0);
+        let swap_total_bytes = mem_parts.next().and_then(|s| s.parse().ok()).unwrap_or(0);
+        let swap_used_bytes = mem_parts.next().and_then(|s| s.parse().ok()).unwrap_or(0);
+
+        let mut disks = Vec::new();
+        let mut seen_mounts = std::collections::HashSet::new();
+        for item in map.get("DISKS").copied().unwrap_or("").split('|') {
+            if item.trim().is_empty() {
+                continue;
+            }
+            let mut p = item.split(':');
+            if let (Some(mount), Some(tot), Some(used)) = (
+                p.next(),
+                p.next().and_then(|s| s.parse::<u64>().ok()),
+                p.next().and_then(|s| s.parse::<u64>().ok()),
+            ) {
+                if tot > 0 && seen_mounts.insert(mount.to_string()) {
+                    disks.push(DiskUsageItem {
+                        mount: mount.to_string(),
+                        total_bytes: tot,
+                        used_bytes: used,
+                    });
+                }
+            }
+        }
+        disks.sort_by(|a, b| {
+            (a.mount != "/")
+                .cmp(&(b.mount != "/"))
+                .then_with(|| a.mount.cmp(&b.mount))
+        });
+
+        let primary_disk = disks.first().cloned().unwrap_or(DiskUsageItem {
+            mount: "/".to_string(),
+            total_bytes: 0,
+            used_bytes: 0,
+        });
+
+        let cpu_model = map
+            .get("MODEL")
+            .copied()
+            .filter(|s| !s.is_empty())
+            .map(str::to_string);
+        let cpu_cores = map
+            .get("CORES")
+            .and_then(|s| s.parse::<u32>().ok())
+            .unwrap_or(1)
+            .max(1);
+
+        let now_inst = Instant::now();
+        let (cpu_usage_pct, cpu_iowait_pct, cpu_steal_pct, net_rx_bps, net_tx_bps) = {
+            let mut guard = self.prev_samples.lock().unwrap();
+            if let Some(prev) = guard.get(host_id) {
+                let elapsed = now_inst.duration_since(prev.at).as_secs_f64();
+                // 若距离上次采样在 15 秒内，直接用跨周期的精确硬件计数差值；否则使用本次脚本内 CPU1->CPU2 的差值
+                let base_cpu = if elapsed <= 15.0 { prev.cpu } else { cpu1 };
+                let (cpu_pct, iowait_pct, steal_pct) = compute_cpu_diff(&base_cpu, &cpu2)
+                    .unwrap_or((prev.last_cpu_pct, prev.last_iowait_pct, prev.last_steal_pct));
+
+                let (rx_bps, tx_bps) = if elapsed > 0.2 && elapsed <= 15.0 && prev.net_iface == net_iface {
+                    let drx = net_rx.saturating_sub(prev.net_rx);
+                    let dtx = net_tx.saturating_sub(prev.net_tx);
+                    ((drx as f64 / elapsed) as u64, (dtx as f64 / elapsed) as u64)
+                } else {
+                    (0, 0)
+                };
+
+                guard.insert(
+                    host_id.to_string(),
+                    PrevHostSample {
+                        at: now_inst,
+                        cpu: cpu2,
+                        net_iface: net_iface.clone(),
+                        net_rx,
+                        net_tx,
+                        last_cpu_pct: cpu_pct,
+                        last_iowait_pct: iowait_pct,
+                        last_steal_pct: steal_pct,
+                    },
+                );
+
+                (cpu_pct, iowait_pct, steal_pct, rx_bps, tx_bps)
+            } else {
+                // 首次采样：直接用脚本内 CPU1 -> CPU2 的真实 /proc/stat 差值，绝不用 loadavg 瞎猜！
+                let (cpu_pct, iowait_pct, steal_pct) =
+                    compute_cpu_diff(&cpu1, &cpu2).unwrap_or((0.0, 0.0, 0.0));
+                guard.insert(
+                    host_id.to_string(),
+                    PrevHostSample {
+                        at: now_inst,
+                        cpu: cpu2,
+                        net_iface: net_iface.clone(),
+                        net_rx,
+                        net_tx,
+                        last_cpu_pct: cpu_pct,
+                        last_iowait_pct: iowait_pct,
+                        last_steal_pct: steal_pct,
+                    },
+                );
+                (cpu_pct, iowait_pct, steal_pct, 0, 0)
+            }
+        };
+
+        let now_iso = Utc::now().to_rfc3339();
+        let os_info = OsInfo {
+            os: Some("linux".to_string()),
+            distro_id: map.get("OS_ID").map(|s| s.to_lowercase()),
+            version_id: map.get("OS_VER").filter(|s| !s.is_empty()).map(|s| s.to_string()),
+            pretty_name: map.get("OS_PRETTY").filter(|s| !s.is_empty()).map(|s| s.to_string()),
+            arch: map.get("ARCH").filter(|s| !s.is_empty()).map(|s| s.to_string()),
+            kernel: map.get("KERNEL").filter(|s| !s.is_empty()).map(|s| s.to_string()),
+            cpu_model: cpu_model.clone(),
+            cpu_cores: Some(cpu_cores),
+            detected_at: Some(now_iso.clone()),
+        };
+
+        let inspection = HostInspection {
+            host_id: host_id.to_string(),
+            sampled_at: now_iso,
+            uptime_seconds,
+            load_1,
+            load_5,
+            load_15,
+            tcp_cc,
+            cpu_model,
+            cpu_cores,
+            cpu_usage_pct: (cpu_usage_pct * 10.0).round() / 10.0,
+            cpu_iowait_pct: (cpu_iowait_pct * 10.0).round() / 10.0,
+            cpu_steal_pct: (cpu_steal_pct * 10.0).round() / 10.0,
+            mem_total_bytes,
+            mem_used_bytes,
+            mem_cached_bytes,
+            swap_total_bytes,
+            swap_used_bytes,
+            disk_mount: primary_disk.mount,
+            disk_total_bytes: primary_disk.total_bytes,
+            disk_used_bytes: primary_disk.used_bytes,
+            disks,
+            net_iface,
+            net_rx_bytes_total: net_rx,
+            net_tx_bytes_total: net_tx,
+            net_rx_bps,
+            net_tx_bps,
+        };
+
+        Ok((inspection, os_info))
+    }
+
+    async fn inspect_local_windows(&self) -> Result<HostInspection> {
+        let ps_script = r#"
+$os = Get-CimInstance Win32_OperatingSystem
+$cpu = Get-CimInstance Win32_Processor | Select-Object -First 1
+$disks = Get-CimInstance Win32_LogicalDisk -Filter "DriveType=3" | ForEach-Object { "$($_.DeviceID)/:$($_.Size):$($_.Size - $_.FreeSpace)" }
+$net = Get-NetAdapterStatistics | Where-Object { $_.ReceivedBytes -gt 0 } | Sort-Object ReceivedBytes -Descending | Select-Object -First 1
+$up = [int]((Get-Date) - $os.LastBootUpTime).TotalSeconds
+$mt = [uint64]$os.TotalVisibleMemorySize * 1024
+$mf = [uint64]$os.FreePhysicalMemory * 1024
+$mu = if ($mt -gt $mf) { $mt - $mf } else { 0 }
+Write-Output "UP=$up"
+Write-Output "CPU_PCT=$($cpu.LoadPercentage)"
+Write-Output "CPU_NAME=$($cpu.Name)"
+Write-Output "CORES=$([Environment]::ProcessorCount)"
+Write-Output "MEM=$mt $mu"
+Write-Output "DISKS=$($disks -join '|')"
+Write-Output "NET=$($net.Name)|$($net.ReceivedBytes)|$($net.SentBytes)"
+"#;
+        let out = tokio::process::Command::new("powershell.exe")
+            .args(["-NoProfile", "-NonInteractive", "-Command", ps_script])
+            .output()
+            .await?;
+        let text = String::from_utf8_lossy(&out.stdout);
+        let mut map = HashMap::new();
+        for line in text.lines() {
+            if let Some((k, v)) = line.split_once('=') {
+                map.insert(k.trim(), v.trim());
+            }
+        }
+
+        let uptime_seconds = map.get("UP").and_then(|s| s.parse().ok()).unwrap_or(0);
+        let cpu_usage_pct = map.get("CPU_PCT").and_then(|s| s.parse().ok()).unwrap_or(0.0);
+        let cpu_model = map.get("CPU_NAME").map(|s| s.to_string());
+        let cpu_cores = map.get("CORES").and_then(|s| s.parse().ok()).unwrap_or(8);
+
+        let mut mem_it = map.get("MEM").copied().unwrap_or("0 0").split_whitespace();
+        let mem_total_bytes = mem_it.next().and_then(|s| s.parse().ok()).unwrap_or(0);
+        let mem_used_bytes = mem_it.next().and_then(|s| s.parse().ok()).unwrap_or(0);
+
+        let mut disks = Vec::new();
+        for item in map.get("DISKS").copied().unwrap_or("").split('|') {
+            if item.trim().is_empty() {
+                continue;
+            }
+            let mut p = item.split(':');
+            // Windows mount has C:/ so first two parts are "C" and "/"
+            let parts: Vec<&str> = item.split(':').collect();
+            if parts.len() >= 4 {
+                let mount = format!("{}:{}", parts[0], parts[1]);
+                let tot = parts[2].parse::<u64>().unwrap_or(0);
+                let used = parts[3].parse::<u64>().unwrap_or(0);
+                if tot > 0 {
+                    disks.push(DiskUsageItem {
+                        mount,
+                        total_bytes: tot,
+                        used_bytes: used,
+                    });
+                }
+            } else if let (Some(m), Some(tot), Some(used)) = (
+                p.next(),
+                p.next().and_then(|s| s.parse::<u64>().ok()),
+                p.next().and_then(|s| s.parse::<u64>().ok()),
+            ) {
+                if tot > 0 {
+                    disks.push(DiskUsageItem {
+                        mount: m.to_string(),
+                        total_bytes: tot,
+                        used_bytes: used,
+                    });
+                }
+            }
+        }
+        let primary_disk = disks.first().cloned().unwrap_or(DiskUsageItem {
+            mount: "C:/".to_string(),
+            total_bytes: 0,
+            used_bytes: 0,
+        });
+
+        let mut net_it = map.get("NET").copied().unwrap_or("Ethernet|0|0").split('|');
+        let net_iface = net_it.next().unwrap_or("Ethernet").to_string();
+        let net_rx: u64 = net_it.next().and_then(|s| s.parse().ok()).unwrap_or(0);
+        let net_tx: u64 = net_it.next().and_then(|s| s.parse().ok()).unwrap_or(0);
+
+        let now_inst = Instant::now();
+        let (net_rx_bps, net_tx_bps) = {
+            let mut guard = self.prev_samples.lock().unwrap();
+            let rates = if let Some(prev) = guard.get(LOCAL_HOST_ID) {
+                let elapsed = now_inst.duration_since(prev.at).as_secs_f64();
+                if elapsed > 0.2 {
+                    (
+                        (net_rx.saturating_sub(prev.net_rx) as f64 / elapsed) as u64,
+                        (net_tx.saturating_sub(prev.net_tx) as f64 / elapsed) as u64,
+                    )
+                } else {
+                    (0, 0)
+                }
+            } else {
+                (0, 0)
+            };
+            guard.insert(
+                LOCAL_HOST_ID.to_string(),
+                PrevHostSample {
+                    at: now_inst,
+                    cpu: CpuTicks {
+                        user: 0,
+                        nice: 0,
+                        system: 0,
+                        idle: 0,
+                        iowait: 0,
+                        irq: 0,
+                        softirq: 0,
+                        steal: 0,
+                    },
+                    net_iface: net_iface.clone(),
+                    net_rx,
+                    net_tx,
+                    last_cpu_pct: cpu_usage_pct,
+                    last_iowait_pct: 0.0,
+                    last_steal_pct: 0.0,
+                },
+            );
+            rates
+        };
+
+        Ok(HostInspection {
+            host_id: LOCAL_HOST_ID.to_string(),
+            sampled_at: Utc::now().to_rfc3339(),
+            uptime_seconds,
+            load_1: 0.0,
+            load_5: 0.0,
+            load_15: 0.0,
+            tcp_cc: None,
+            cpu_model,
+            cpu_cores,
+            cpu_usage_pct,
+            cpu_iowait_pct: 0.0,
+            cpu_steal_pct: 0.0,
+            mem_total_bytes,
+            mem_used_bytes,
+            mem_cached_bytes: 0,
+            swap_total_bytes: 0,
+            swap_used_bytes: 0,
+            disk_mount: primary_disk.mount,
+            disk_total_bytes: primary_disk.total_bytes,
+            disk_used_bytes: primary_disk.used_bytes,
+            disks,
+            net_iface,
+            net_rx_bytes_total: net_rx,
+            net_tx_bytes_total: net_tx,
+            net_rx_bps,
+            net_tx_bps,
+        })
+    }
+}
+
+fn compute_cpu_diff(a: &CpuTicks, b: &CpuTicks) -> Option<(f64, f64, f64)> {
+    let total_delta = b.total().saturating_sub(a.total());
+    if total_delta == 0 {
+        return None;
+    }
+    let idle_delta = b.idle_all().saturating_sub(a.idle_all());
+    let busy_delta = total_delta.saturating_sub(idle_delta);
+    let io_delta = b.iowait.saturating_sub(a.iowait);
+    let st_delta = b.steal.saturating_sub(a.steal);
+    Some((
+        ((busy_delta as f64 / total_delta as f64) * 100.0).clamp(0.0, 100.0),
+        ((io_delta as f64 / total_delta as f64) * 100.0).clamp(0.0, 100.0),
+        ((st_delta as f64 / total_delta as f64) * 100.0).clamp(0.0, 100.0),
+    ))
+}
+
+fn parse_cpu_ticks(s: &str) -> CpuTicks {
+    let mut it = s.split_whitespace().filter_map(|x| x.parse::<u64>().ok());
+    CpuTicks {
+        user: it.next().unwrap_or(0),
+        nice: it.next().unwrap_or(0),
+        system: it.next().unwrap_or(0),
+        idle: it.next().unwrap_or(0),
+        iowait: it.next().unwrap_or(0),
+        irq: it.next().unwrap_or(0),
+        softirq: it.next().unwrap_or(0),
+        steal: it.next().unwrap_or(0),
+    }
+}
diff --git a/src/main.rs b/src/main.rs
new file mode 100644
index 0000000..4f65e1b
--- /dev/null
+++ b/src/main.rs
@@ -0,0 +1,233 @@
+#![cfg_attr(
+    all(windows, not(debug_assertions)),
+    windows_subsystem = "windows"
+)]
+
+mod api;
+mod crypto;
+mod db;
+#[cfg(windows)]
+mod desktop;
+mod files;
+mod inspector;
+mod mcp;
+mod models;
+mod ssh;
+mod terminal;
+
+use anyhow::Result;
+use api::{build_api_router, AppState};
+use axum::{
+    body::Body,
+    http::{header, StatusCode, Uri},
+    response::{IntoResponse, Response},
+};
+use crypto::MasterKey;
+use db::Database;
+use files::TransferManager;
+use inspector::InspectorEngine;
+use mcp::{run_stdio_bridge, sync_cli_mcp_configs, ExecTaskManager};
+use rust_embed::RustEmbed;
+use ssh::SshPool;
+use std::{net::SocketAddr, path::PathBuf, sync::Arc, time::Duration};
+use terminal::TerminalManager;
+use tower_http::cors::{Any, CorsLayer};
+use tracing::info;
+
+#[derive(RustEmbed)]
+#[folder = "frontend/dist/"]
+struct EmbeddedFrontend;
+
+fn resolve_data_dir() -> PathBuf {
+    let cwd_data = PathBuf::from("data");
+    if cwd_data.join("vps-switch.db").exists() {
+        return cwd_data;
+    }
+    if let Ok(exe) = std::env::current_exe() {
+        if let Some(dir) = exe.parent() {
+            let exe_data = dir.join("data");
+            if exe_data.join("vps-switch.db").exists() {
+                return exe_data;
+            }
+        }
+    }
+    if let Ok(appdata) = std::env::var("APPDATA") {
+        return PathBuf::from(appdata).join("vps-switch").join("data");
+    }
+    cwd_data
+}
+
+/// 静态前端资源服务：优先读本机 frontend/dist（方便开发热更新），不存在时直接走二进制内嵌的 EmbeddedFrontend（单文件打包免外部依赖）
+async fn serve_frontend_asset(uri: Uri) -> Response {
+    let raw_path = uri.path().trim_start_matches('/');
+    let rel_path = if raw_path.is_empty() {
+        "index.html"
+    } else {
+        raw_path
+    };
+
+    let disk_candidate = PathBuf::from("frontend/dist").join(rel_path);
+    if let Ok(bytes) = tokio::fs::read(&disk_candidate).await {
+        let mime = mime_guess::from_path(rel_path).first_or_octet_stream();
+        return Response::builder()
+            .status(StatusCode::OK)
+            .header(header::CONTENT_TYPE, mime.as_ref())
+            .body(Body::from(bytes))
+            .unwrap();
+    }
+
+    if let Some(content) = EmbeddedFrontend::get(rel_path) {
+        let mime = mime_guess::from_path(rel_path).first_or_octet_stream();
+        return Response::builder()
+            .status(StatusCode::OK)
+            .header(header::CONTENT_TYPE, mime.as_ref())
+            .body(Body::from(content.data.into_owned()))
+            .unwrap();
+    }
+
+    if let Some(index) = EmbeddedFrontend::get("index.html") {
+        return Response::builder()
+            .status(StatusCode::OK)
+            .header(header::CONTENT_TYPE, "text/html; charset=utf-8")
+            .body(Body::from(index.data.into_owned()))
+            .unwrap();
+    }
+
+    (StatusCode::NOT_FOUND, "Not Found").into_response()
+}
+
+fn try_wakeup_existing_instance(port: u16) -> bool {
+    use std::io::{Read, Write};
+    let addr: SocketAddr = ([127, 0, 0, 1], port).into();
+    let Ok(mut stream) = std::net::TcpStream::connect_timeout(&addr, Duration::from_millis(120)) else {
+        return false;
+    };
+    let req = format!(
+        "POST /api/window/show HTTP/1.1\r\nHost: 127.0.0.1:{port}\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
+    );
+    if stream.write_all(req.as_bytes()).is_err() {
+        return false;
+    }
+    let mut buf = [0u8; 128];
+    let _ = stream.read(&mut buf);
+    true
+}
+
+fn main() -> Result<()> {
+    let args: Vec<String> = std::env::args().collect();
+    let is_mcp_stdio = args.iter().any(|a| a == "--mcp-stdio" || a == "mcp");
+    let is_headless = args.iter().any(|a| a == "--headless" || a == "--server");
+
+    let port: u16 = std::env::var("PORT")
+        .ok()
+        .and_then(|s| s.parse().ok())
+        .unwrap_or(18800);
+
+    // 桌面模式下若已有实例在运行，直接唤醒已有主窗口并退出
+    #[cfg(windows)]
+    if !is_mcp_stdio && !is_headless && try_wakeup_existing_instance(port) {
+        return Ok(());
+    }
+
+    if !is_mcp_stdio {
+        tracing_subscriber::fmt()
+            .with_env_filter(
+                tracing_subscriber::EnvFilter::try_from_default_env()
+                    .unwrap_or_else(|_| "vps_switch=info,tower_http=warn".into()),
+            )
+            .init();
+    }
+
+    let rt = tokio::runtime::Builder::new_multi_thread()
+        .enable_all()
+        .build()?;
+
+    let data_dir = resolve_data_dir();
+    let master_key = MasterKey::load_or_create(&data_dir)?;
+    let db = Arc::new(Database::open(&data_dir, master_key)?);
+
+    if db.count_ssh_hosts().unwrap_or(0) == 0 {
+        match db.import_from_1shell() {
+            Ok(n) if n > 0 && !is_mcp_stdio => info!("已自动从 1Shell 导入 {n} 台 VPS 主机"),
+            _ => {}
+        }
+    }
+
+    let exec_tasks = Arc::new(ExecTaskManager::new());
+    let state = Arc::new(AppState {
+        db,
+        ssh_pool: Arc::new(SshPool::new()),
+        terminals: Arc::new(TerminalManager::new()),
+        transfers: Arc::new(TransferManager::new()),
+        inspector: Arc::new(InspectorEngine::new()),
+        exec_tasks: exec_tasks.clone(),
+        sessions: std::sync::Mutex::new(std::collections::HashSet::new()),
+        port,
+    });
+
+    if is_mcp_stdio {
+        return rt.block_on(run_stdio_bridge(state, exec_tasks, port));
+    }
+
+    let sync_status = sync_cli_mcp_configs(port);
+    info!(
+        "MCP 自动配置同步: Claude Code={}, Codex={}",
+        sync_status.claude_code_synced, sync_status.codex_synced
+    );
+
+    // 启动时后台并发执行全机队快照预热
+    {
+        let bg_state = state.clone();
+        rt.spawn(async move {
+            use futures::stream::{self, StreamExt};
+            if let Ok(records) = bg_state.db.list_records() {
+                let active: Vec<_> = records.into_iter().filter(|r| !r.archived).collect();
+                stream::iter(active)
+                    .for_each_concurrent(8, |rec| {
+                        let st = bg_state.clone();
+                        async move {
+                            let _ = st
+                                .inspector
+                                .inspect_host(&st.ssh_pool, &st.db, &rec.id)
+                                .await;
+                        }
+                    })
+                    .await;
+            }
+        });
+    }
+
+    let bind_ip: std::net::IpAddr = std::env::var("HOST")
+        .ok()
+        .and_then(|s| s.parse().ok())
+        .unwrap_or_else(|| std::net::IpAddr::V4(std::net::Ipv4Addr::new(127, 0, 0, 1)));
+    let addr = SocketAddr::new(bind_ip, port);
+
+    let cors = CorsLayer::new()
+        .allow_origin(Any)
+        .allow_methods(Any)
+        .allow_headers(Any);
+
+    let app = build_api_router(state.clone())
+        .fallback(serve_frontend_asset)
+        .layer(cors);
+
+    #[cfg(windows)]
+    if !is_headless {
+        let rt_handle = rt.handle().clone();
+        rt.spawn(async move {
+            if let Ok(listener) = tokio::net::TcpListener::bind(addr).await {
+                info!("vps-switch desktop server listening on http://{addr}");
+                let _ = axum::serve(listener, app).await;
+            }
+        });
+        return desktop::run_desktop_window(state, rt_handle, port);
+    }
+
+    rt.block_on(async move {
+        let listener = tokio::net::TcpListener::bind(addr).await?;
+        info!("vps-switch headless server listening on http://{addr}");
+        axum::serve(listener, app).await?;
+        Ok::<(), anyhow::Error>(())
+    })
+}
diff --git a/src/mcp.rs b/src/mcp.rs
new file mode 100644
index 0000000..c1ea4da
--- /dev/null
+++ b/src/mcp.rs
@@ -0,0 +1,1475 @@
+use crate::{
+    api::AppState,
+    db::Database,
+    files,
+    models::{HostRecord, LOCAL_HOST_ID},
+    ssh::open_host_channel,
+    terminal::looks_like_interactive_prompt,
+};
+use anyhow::{anyhow, Result};
+use chrono::Utc;
+use futures::stream::{self, StreamExt};
+use russh::ChannelMsg;
+use serde::{Deserialize, Serialize};
+use serde_json::{json, Value};
+use std::{
+    collections::HashMap,
+    sync::{Arc, Mutex},
+    time::{Duration, Instant},
+};
+use tokio::{io::AsyncBufReadExt, sync::oneshot};
+use uuid::Uuid;
+
+/// 按名称、别名、IP 或 ID 解析主机（彻底告别逼 Agent 查 UUID 编号的痛点）
+pub fn resolve_host(db: &Database, query: &str) -> Result<HostRecord> {
+    let q = query.trim();
+    if q.is_empty() {
+        return Err(anyhow!("host 参数不能为空"));
+    }
+    let records = db.list_records()?;
+    let lower = q.to_lowercase();
+
+    if lower == "local" || lower == "本机" || lower == "localhost" || lower == "127.0.0.1" {
+        if let Some(loc) = records.iter().find(|r| r.id == LOCAL_HOST_ID) {
+            return Ok(loc.clone());
+        }
+    }
+
+    // 1. 精确匹配 name（大小写不敏感）或 id
+    if let Some(exact) = records
+        .iter()
+        .find(|r| r.name.eq_ignore_ascii_case(q) || r.id.eq_ignore_ascii_case(q))
+    {
+        return Ok(exact.clone());
+    }
+
+    // 2. 精确匹配 IP / 域名
+    if let Some(by_addr) = records.iter().find(|r| r.addr.eq_ignore_ascii_case(q)) {
+        return Ok(by_addr.clone());
+    }
+
+    // 3. 唯一子串匹配 name
+    let partial: Vec<_> = records
+        .iter()
+        .filter(|r| r.name.to_lowercase().contains(&lower))
+        .collect();
+    if partial.len() == 1 {
+        return Ok(partial[0].clone());
+    }
+
+    let available: Vec<String> = records
+        .iter()
+        .filter(|r| !r.archived)
+        .map(|r| r.name.clone())
+        .collect();
+    Err(anyhow!(
+        "未找到主机「{}」。可用主机名: {}",
+        q,
+        available.join(", ")
+    ))
+}
+
+// ==================== 后台长耗时命令管理器 (ExecTaskManager) ====================
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ExecTaskSnapshot {
+    pub id: String,
+    pub host_id: String,
+    pub host_name: String,
+    pub command: String,
+    pub state: String, // "running" | "completed" | "failed" | "interactive_stall" | "cancelled"
+    pub exit_code: Option<i32>,
+    pub duration_ms: u64,
+    pub stdout: String,
+    pub stderr: String,
+    pub hint: Option<String>,
+    pub started_at: String,
+}
+
+struct ExecTaskInner {
+    id: String,
+    host_id: String,
+    host_name: String,
+    command: String,
+    state: String,
+    exit_code: Option<i32>,
+    started_inst: Instant,
+    ended_ms: Option<u64>,
+    stdout: Vec<u8>,
+    stderr: Vec<u8>,
+    last_output_inst: Instant,
+    hint: Option<String>,
+    started_at: String,
+    cancel_tx: Option<oneshot::Sender<()>>,
+}
+
+impl ExecTaskInner {
+    fn snapshot(&self) -> ExecTaskSnapshot {
+        let dur = self
+            .ended_ms
+            .unwrap_or_else(|| self.started_inst.elapsed().as_millis() as u64);
+        ExecTaskSnapshot {
+            id: self.id.clone(),
+            host_id: self.host_id.clone(),
+            host_name: self.host_name.clone(),
+            command: self.command.clone(),
+            state: self.state.clone(),
+            exit_code: self.exit_code,
+            duration_ms: dur,
+            stdout: String::from_utf8_lossy(&self.stdout).to_string(),
+            stderr: String::from_utf8_lossy(&self.stderr).to_string(),
+            hint: self.hint.clone(),
+            started_at: self.started_at.clone(),
+        }
+    }
+}
+
+#[derive(Default)]
+pub struct ExecTaskManager {
+    tasks: Mutex<HashMap<String, Arc<Mutex<ExecTaskInner>>>>,
+}
+
+impl ExecTaskManager {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn get_task(&self, task_id: &str) -> Option<ExecTaskSnapshot> {
+        let map = self.tasks.lock().unwrap();
+        map.get(task_id).map(|t| t.lock().unwrap().snapshot())
+    }
+
+    pub fn list_tasks(&self) -> Vec<ExecTaskSnapshot> {
+        let map = self.tasks.lock().unwrap();
+        map.values().map(|t| t.lock().unwrap().snapshot()).collect()
+    }
+
+    pub fn cancel_task(&self, task_id: &str) -> Option<ExecTaskSnapshot> {
+        let arc = self.tasks.lock().unwrap().get(task_id).cloned()?;
+        let mut g = arc.lock().unwrap();
+        if let Some(tx) = g.cancel_tx.take() {
+            let _ = tx.send(());
+        }
+        if g.state == "running" {
+            g.state = "cancelled".to_string();
+            g.ended_ms = Some(g.started_inst.elapsed().as_millis() as u64);
+        }
+        Some(g.snapshot())
+    }
+
+    pub async fn exec_with_wait(
+        &self,
+        state: &Arc<AppState>,
+        host: &HostRecord,
+        command: &str,
+        wait_seconds: u64,
+    ) -> Result<ExecTaskSnapshot> {
+        let task_id = format!("exec_{}", Uuid::new_v4());
+        let (cancel_tx, mut cancel_rx) = oneshot::channel::<()>();
+
+        let inner = Arc::new(Mutex::new(ExecTaskInner {
+            id: task_id.clone(),
+            host_id: host.id.clone(),
+            host_name: host.name.clone(),
+            command: command.to_string(),
+            state: "running".to_string(),
+            exit_code: None,
+            started_inst: Instant::now(),
+            ended_ms: None,
+            stdout: Vec::new(),
+            stderr: Vec::new(),
+            last_output_inst: Instant::now(),
+            hint: None,
+            started_at: Utc::now().to_rfc3339(),
+            cancel_tx: Some(cancel_tx),
+        }));
+
+        self.tasks
+            .lock()
+            .unwrap()
+            .insert(task_id.clone(), inner.clone());
+
+        let st = state.clone();
+        let host_clone = host.clone();
+        let cmd_str = command.to_string();
+        let inner_bg = inner.clone();
+
+        tokio::spawn(async move {
+            if host_clone.id == LOCAL_HOST_ID {
+                run_local_exec_task(inner_bg, &cmd_str, &mut cancel_rx).await;
+            } else {
+                run_ssh_exec_task(&st, &host_clone, inner_bg, &cmd_str, &mut cancel_rx).await;
+            }
+        });
+
+        let wait_dur = Duration::from_secs(wait_seconds.clamp(1, 120));
+        let deadline = Instant::now() + wait_dur;
+
+        loop {
+            tokio::time::sleep(Duration::from_millis(70)).await;
+            {
+                let mut g = inner.lock().unwrap();
+                if g.state != "running" {
+                    return Ok(g.snapshot());
+                }
+
+                // 交互式提问早退保护：若命令输出末尾停在 [Y/n] / password: 等提问且静默超过 2 秒，立即中断提醒 Agent
+                if g.last_output_inst.elapsed() >= Duration::from_millis(2000)
+                    && (!g.stdout.is_empty() || !g.stderr.is_empty())
+                {
+                    let combined = format!(
+                        "{}\n{}",
+                        String::from_utf8_lossy(&g.stdout),
+                        String::from_utf8_lossy(&g.stderr)
+                    );
+                    if let Some(last_line) = combined.lines().rev().find(|l| !l.trim().is_empty()) {
+                        if looks_like_interactive_prompt(last_line) {
+                            if let Some(tx) = g.cancel_tx.take() {
+                                let _ = tx.send(());
+                            }
+                            g.state = "interactive_stall".to_string();
+                            g.ended_ms = Some(g.started_inst.elapsed().as_millis() as u64);
+                            g.hint = Some(format!(
+                                "检测到命令停在交互式提问: 「{}」。非交互通道无法输入；请加 -y / DEBIAN_FRONTEND=noninteractive 参数，或改用 vps_terminal 工具（默认无头自动回复 y，遇到隐私密码可设 reveal_ui: true 让用户输入）。",
+                                last_line.trim()
+                            ));
+                            return Ok(g.snapshot());
+                        }
+                    }
+                }
+            }
+
+            if Instant::now() >= deadline {
+                let mut g = inner.lock().unwrap();
+                if g.state == "running" {
+                    g.hint = Some(format!(
+                        "命令运行超过 {} 秒尚未结束，已自动转入后台运行。请使用 vps_task(task_id: \"{}\") 查询后续输出或终止。",
+                        wait_seconds, g.id
+                    ));
+                }
+                return Ok(g.snapshot());
+            }
+        }
+    }
+}
+
+async fn run_local_exec_task(
+    inner: Arc<Mutex<ExecTaskInner>>,
+    cmd: &str,
+    cancel_rx: &mut oneshot::Receiver<()>,
+) {
+    use tokio::io::AsyncReadExt;
+    let mut child = match tokio::process::Command::new("powershell.exe")
+        .args(["-NoProfile", "-NonInteractive", "-Command", cmd])
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped())
+        .spawn()
+    {
+        Ok(c) => c,
+        Err(e) => {
+            let mut g = inner.lock().unwrap();
+            g.state = "failed".to_string();
+            g.stderr
+                .extend_from_slice(format!("启动本机 PowerShell 失败: {e}").as_bytes());
+            g.ended_ms = Some(g.started_inst.elapsed().as_millis() as u64);
+            return;
+        }
+    };
+
+    let mut stdout = child.stdout.take().unwrap();
+    let mut stderr = child.stderr.take().unwrap();
+    let mut out_buf = [0u8; 4096];
+    let mut err_buf = [0u8; 4096];
+    let mut out_eof = false;
+    let mut err_eof = false;
+
+    loop {
+        if out_eof && err_eof {
+            break;
+        }
+        tokio::select! {
+            _ = &mut *cancel_rx => {
+                let _ = child.kill().await;
+                return;
+            }
+            res = stdout.read(&mut out_buf), if !out_eof => {
+                match res {
+                    Ok(0) | Err(_) => out_eof = true,
+                    Ok(n) => {
+                        let mut g = inner.lock().unwrap();
+                        g.stdout.extend_from_slice(&out_buf[..n]);
+                        g.last_output_inst = Instant::now();
+                    }
+                }
+            }
+            res = stderr.read(&mut err_buf), if !err_eof => {
+                match res {
+                    Ok(0) | Err(_) => err_eof = true,
+                    Ok(n) => {
+                        let mut g = inner.lock().unwrap();
+                        g.stderr.extend_from_slice(&err_buf[..n]);
+                        g.last_output_inst = Instant::now();
+                    }
+                }
+            }
+        }
+    }
+
+    let code = child.wait().await.ok().and_then(|s| s.code()).unwrap_or(-1);
+    let mut g = inner.lock().unwrap();
+    g.exit_code = Some(code);
+    g.state = if code == 0 {
+        "completed".to_string()
+    } else {
+        "failed".to_string()
+    };
+    g.ended_ms = Some(g.started_inst.elapsed().as_millis() as u64);
+}
+
+async fn run_ssh_exec_task(
+    state: &Arc<AppState>,
+    host: &HostRecord,
+    inner: Arc<Mutex<ExecTaskInner>>,
+    cmd: &str,
+    cancel_rx: &mut oneshot::Receiver<()>,
+) {
+    let mut channel = match open_host_channel(&state.ssh_pool, &state.db, &host.id).await {
+        Ok((_, ch)) => ch,
+        Err(e) => {
+            let mut g = inner.lock().unwrap();
+            g.state = "failed".to_string();
+            g.stderr
+                .extend_from_slice(format!("SSH 连接失败: {e:#}").as_bytes());
+            g.ended_ms = Some(g.started_inst.elapsed().as_millis() as u64);
+            return;
+        }
+    };
+
+    if let Err(e) = channel.exec(true, cmd).await {
+        let mut g = inner.lock().unwrap();
+        g.state = "failed".to_string();
+        g.stderr
+            .extend_from_slice(format!("发送 exec 请求失败: {e}").as_bytes());
+        g.ended_ms = Some(g.started_inst.elapsed().as_millis() as u64);
+        return;
+    }
+
+    let mut exit_code: Option<i32> = None;
+    loop {
+        tokio::select! {
+            _ = &mut *cancel_rx => {
+                let _ = channel.close().await;
+                return;
+            }
+            msg_opt = channel.wait() => {
+                match msg_opt {
+                    Some(ChannelMsg::Data { data }) => {
+                        let mut g = inner.lock().unwrap();
+                        g.stdout.extend_from_slice(&data);
+                        g.last_output_inst = Instant::now();
+                    }
+                    Some(ChannelMsg::ExtendedData { data, .. }) => {
+                        let mut g = inner.lock().unwrap();
+                        g.stderr.extend_from_slice(&data);
+                        g.last_output_inst = Instant::now();
+                    }
+                    Some(ChannelMsg::ExitStatus { exit_status }) => {
+                        exit_code = Some(exit_status as i32);
+                    }
+                    Some(ChannelMsg::Eof) | Some(ChannelMsg::Close) | None => break,
+                    _ => {}
+                }
+            }
+        }
+    }
+
+    let mut g = inner.lock().unwrap();
+    if g.state == "running" {
+        let code = exit_code.unwrap_or(0);
+        g.exit_code = Some(code);
+        g.state = if code == 0 {
+            "completed".to_string()
+        } else {
+            "failed".to_string()
+        };
+        g.ended_ms = Some(g.started_inst.elapsed().as_millis() as u64);
+    }
+}
+
+// ==================== MCP JSON-RPC 2.0 协议与 7 大精锐工具定义 ====================
+
+#[derive(Debug, Deserialize)]
+pub struct JsonRpcRequest {
+    #[allow(dead_code)]
+    pub jsonrpc: Option<String>,
+    pub id: Option<Value>,
+    pub method: String,
+    #[serde(default)]
+    pub params: Value,
+}
+
+pub fn mcp_tool_definitions() -> Value {
+    json!([
+        {
+            "name": "vps_list",
+            "description": "列出所有托管的 VPS 与本机（直接以主机名标识，无需查 UUID），同时返回每台主机的在线状态、延迟以及已缓存的探针硬件概览（CPU%、Steal% 超售率、内存已用/总量、磁盘已用/总量、BBR 状态）。",
+            "inputSchema": {
+                "type": "object",
+                "properties": {
+                    "refresh": {
+                        "type": "boolean",
+                        "description": "是否先并发实时刷新全机队探针快照（默认 false 直接秒回内存缓存）"
+                    },
+                    "role": {
+                        "type": "string",
+                        "description": "按角色过滤（primary/project/proxy/relay/test/archive）"
+                    },
+                    "search": {
+                        "type": "string",
+                        "description": "按主机名称、IP 或标签搜索"
+                    }
+                }
+            }
+        },
+        {
+            "name": "vps_inspect",
+            "description": "对一台或多台 VPS 立即触发实时深度探索（纯内核计数差分），返回精确 CPU%、Steal% 超售率、1/5/15 分钟负载、内存与缓存解剖、全部挂载磁盘容量、主物理网卡实时上下行速率与累计总流量。",
+            "inputSchema": {
+                "type": "object",
+                "properties": {
+                    "host": {
+                        "type": "string",
+                        "description": "目标主机名（如 'vip-hk'、'lazy-gomami'、'本机'）或 IP"
+                    },
+                    "hosts": {
+                        "type": "array",
+                        "items": { "type": "string" },
+                        "description": "批量并发探索多台主机名列表"
+                    }
+                }
+            }
+        },
+        {
+            "name": "vps_exec",
+            "description": "在一台或多台 VPS 上并发执行非交互式命令（直接传主机名如 'vip-hk'）。若在 wait_seconds 内完成则同步返回 stdout/stderr/exitCode；若超时未完则自动转入后台并返回 taskId；若检测到命令卡在 [Y/n] 等交互提问超过 2 秒会自动早退提醒改用 vps_terminal。",
+            "inputSchema": {
+                "type": "object",
+                "properties": {
+                    "host": {
+                        "type": "string",
+                        "description": "单台目标主机名（如 'vip-hk'、'lazy-gomami'、'本机'）或 IP"
+                    },
+                    "hosts": {
+                        "type": "array",
+                        "items": { "type": "string" },
+                        "description": "多台目标主机名数组（将并发在所有指定主机上同时执行该命令）"
+                    },
+                    "command": {
+                        "type": "string",
+                        "description": "要执行的命令"
+                    },
+                    "wait_seconds": {
+                        "type": "integer",
+                        "description": "同步等待秒数（默认 25，上限 120）；超时后任务继续在后台运行并返回 taskId"
+                    }
+                },
+                "required": ["command"]
+            }
+        },
+        {
+            "name": "vps_terminal",
+            "description": "有状态 PTY 交互式终端工具（基于 Rust alacritty_terminal 真实二维屏幕网格）。默认无头运行（reveal_ui: false），专门用于运行需要交互确认（如输入 yes/[Y/n]、选择安装菜单）的脚本——当脚本停下等待输入时会立即返回 state='waiting_input' 及光标所在行文字，你可以继续调用 send 发送 'y'。当遇到需要用户亲自输入隐私密码（如数据库密码、sudo密码、密钥口令）或人工接手时，设置 reveal_ui=true 或调用 action='reveal'，即可像 Playwright 一样直接将终端弹窗展现在用户界面上。",
+            "inputSchema": {
+                "type": "object",
+                "properties": {
+                    "host": {
+                        "type": "string",
+                        "description": "目标主机名（如 'vip-hk'、'lazy-gomami'、'本机'）"
+                    },
+                    "action": {
+                        "type": "string",
+                        "enum": ["send", "key", "read", "reveal", "close"],
+                        "description": "动作：send(发送命令或交互回答如 'y') / key(发送控制键如 'ctrl+c','enter') / read(读取当前屏幕网格) / reveal(在用户界面唤起并展示该终端供用户输密码或接手) / close(关闭终端)"
+                    },
+                    "input": {
+                        "type": "string",
+                        "description": "action='send' 时要输入的命令或回答文本（默认自动附带回车），或 action='key' 时的按键名（ctrl+c / ctrl+d / ctrl+z / enter / esc / tab / up / down）"
+                    },
+                    "submit": {
+                        "type": "boolean",
+                        "description": "action='send' 时是否在末尾自动发送回车（默认 true）"
+                    },
+                    "reveal_ui": {
+                        "type": "boolean",
+                        "description": "是否将该终端在用户前端界面自动弹出展示（默认 false 无头运行不打扰用户；需要用户亲自输密码或观察时设为 true）"
+                    },
+                    "reason": {
+                        "type": "string",
+                        "description": "唤起界面终端时展示给用户的提示原因（如 '请在终端中输入 MySQL root 密码'）"
+                    },
+                    "wait_ms": {
+                        "type": "integer",
+                        "description": "发送输入后等待屏幕稳定或提问出现的毫秒数（默认 6000）"
+                    },
+                    "lines": {
+                        "type": "integer",
+                        "description": "返回的终端屏幕尾部行数（默认 35）"
+                    },
+                    "pane_id": {
+                        "type": "string",
+                        "description": "可选的指定 paneId（不传则自动复用或创建该主机的主终端）"
+                    }
+                },
+                "required": ["host", "action"]
+            }
+        },
+        {
+            "name": "vps_fs",
+            "description": "统一本机与远端 SFTP 文件系统操作：列目录(list)、读文本文件(read)、写文本/配置文件(write)、新建目录(mkdir)、重命名(rename)、删除(remove)、打包压缩(compress)、解压归档(extract)。",
+            "inputSchema": {
+                "type": "object",
+                "properties": {
+                    "host": {
+                        "type": "string",
+                        "description": "目标主机名（如 'vip-hk'、'本机'）"
+                    },
+                    "action": {
+                        "type": "string",
+                        "enum": ["list", "read", "write", "mkdir", "rename", "remove", "compress", "extract"],
+                        "description": "文件操作类型"
+                    },
+                    "path": {
+                        "type": "string",
+                        "description": "目标文件或目录路径"
+                    },
+                    "new_path": {
+                        "type": "string",
+                        "description": "action='rename' 时的目标新路径"
+                    },
+                    "content": {
+                        "type": "string",
+                        "description": "action='write' 时写入的完整 UTF-8 文本内容"
+                    },
+                    "is_dir": {
+                        "type": "boolean",
+                        "description": "action='remove' 时是否为目录"
+                    }
+                },
+                "required": ["host", "action", "path"]
+            }
+        },
+        {
+            "name": "vps_transfer",
+            "description": "满速流式文件传输引擎（16MiB 通道窗口 + 64 路并发 SFTP 流水线 + 12 秒无推进失速看门狗）。支持三种方向：upload（本机路径 -> 远端路径）、download（远端路径 -> 本机路径）、cross（源 VPS 路径 -> 目标 VPS 路径，内存直传不落本机硬盘）。无需分片或 base64，一次调用直接完成。",
+            "inputSchema": {
+                "type": "object",
+                "properties": {
+                    "direction": {
+                        "type": "string",
+                        "enum": ["upload", "download", "cross"],
+                        "description": "upload(本机上传到VPS) / download(从VPS下载到本机) / cross(从一台VPS直接传到另一台VPS)"
+                    },
+                    "host": {
+                        "type": "string",
+                        "description": "upload 或 download 时的目标 VPS 主机名"
+                    },
+                    "local_path": {
+                        "type": "string",
+                        "description": "upload 或 download 时的本机文件完整路径"
+                    },
+                    "remote_path": {
+                        "type": "string",
+                        "description": "upload 或 download 时的远端 VPS 文件或目录路径"
+                    },
+                    "source_host": {
+                        "type": "string",
+                        "description": "direction='cross' 时的源 VPS 主机名"
+                    },
+                    "source_path": {
+                        "type": "string",
+                        "description": "direction='cross' 时的源 VPS 文件路径"
+                    },
+                    "target_host": {
+                        "type": "string",
+                        "description": "direction='cross' 时的目标 VPS 主机名"
+                    },
+                    "target_path": {
+                        "type": "string",
+                        "description": "direction='cross' 时的目标 VPS 文件或目录路径"
+                    },
+                    "wait_seconds": {
+                        "type": "integer",
+                        "description": "同步等待秒数（默认 25）；超大文件若超时未传完则转入后台并返回 transferId"
+                    }
+                },
+                "required": ["direction"]
+            }
+        },
+        {
+            "name": "vps_task",
+            "description": "查询或取消正在后台运行的命令任务（exec_...）或大文件传输任务（tr_...）。",
+            "inputSchema": {
+                "type": "object",
+                "properties": {
+                    "action": {
+                        "type": "string",
+                        "enum": ["get", "list", "cancel"],
+                        "description": "get(查询单个任务) / list(列出所有任务) / cancel(取消运行中的命令任务)"
+                    },
+                    "task_id": {
+                        "type": "string",
+                        "description": "exec_... 或 tr_... 任务 ID"
+                    }
+                },
+                "required": ["action"]
+            }
+        }
+    ])
+}
+
+pub async fn handle_mcp_request(
+    state: &Arc<AppState>,
+    exec_tasks: &Arc<ExecTaskManager>,
+    req: JsonRpcRequest,
+) -> Option<Value> {
+    let id = req.id.clone();
+    match req.method.as_str() {
+        "notifications/initialized" | "notifications/cancelled" => None,
+        "initialize" => Some(json!({
+            "jsonrpc": "2.0",
+            "id": id,
+            "result": {
+                "protocolVersion": "2024-11-05",
+                "capabilities": {
+                    "tools": {}
+                },
+                "serverInfo": {
+                    "name": "vps-switch",
+                    "version": "0.1.0"
+                }
+            }
+        })),
+        "ping" => Some(json!({
+            "jsonrpc": "2.0",
+            "id": id,
+            "result": {}
+        })),
+        "tools/list" => Some(json!({
+            "jsonrpc": "2.0",
+            "id": id,
+            "result": {
+                "tools": mcp_tool_definitions()
+            }
+        })),
+        "tools/call" => {
+            let tool_name = req
+                .params
+                .get("name")
+                .and_then(|v| v.as_str())
+                .unwrap_or("");
+            let args = req
+                .params
+                .get("arguments")
+                .cloned()
+                .unwrap_or_else(|| json!({}));
+
+            match dispatch_tool_call(state, exec_tasks, tool_name, args).await {
+                Ok(val) => {
+                    let text = serde_json::to_string_pretty(&val).unwrap_or_default();
+                    Some(json!({
+                        "jsonrpc": "2.0",
+                        "id": id,
+                        "result": {
+                            "content": [{ "type": "text", "text": text }],
+                            "isError": false
+                        }
+                    }))
+                }
+                Err(err) => {
+                    let text = json!({
+                        "ok": false,
+                        "error": format!("{err:#}")
+                    })
+                    .to_string();
+                    Some(json!({
+                        "jsonrpc": "2.0",
+                        "id": id,
+                        "result": {
+                            "content": [{ "type": "text", "text": text }],
+                            "isError": true
+                        }
+                    }))
+                }
+            }
+        }
+        _ => Some(json!({
+            "jsonrpc": "2.0",
+            "id": id,
+            "error": {
+                "code": -32601,
+                "message": format!("Method not found: {}", req.method)
+            }
+        })),
+    }
+}
+
+async fn dispatch_tool_call(
+    state: &Arc<AppState>,
+    exec_tasks: &Arc<ExecTaskManager>,
+    name: &str,
+    args: Value,
+) -> Result<Value> {
+    match name {
+        "vps_list" => tool_vps_list(state, args).await,
+        "vps_inspect" => tool_vps_inspect(state, args).await,
+        "vps_exec" => tool_vps_exec(state, exec_tasks, args).await,
+        "vps_terminal" => tool_vps_terminal(state, args).await,
+        "vps_fs" => tool_vps_fs(state, args).await,
+        "vps_transfer" => tool_vps_transfer(state, args).await,
+        "vps_task" => tool_vps_task(state, exec_tasks, args).await,
+        _ => Err(anyhow!("未知的 MCP 工具: {name}")),
+    }
+}
+
+async fn tool_vps_list(state: &Arc<AppState>, args: Value) -> Result<Value> {
+    let refresh = args.get("refresh").and_then(|v| v.as_bool()).unwrap_or(false);
+    let role_filter = args.get("role").and_then(|v| v.as_str()).unwrap_or("").trim();
+    let search_q = args
+        .get("search")
+        .and_then(|v| v.as_str())
+        .unwrap_or("")
+        .trim()
+        .to_lowercase();
+
+    if refresh {
+        let records = state.db.list_records()?;
+        let active: Vec<_> = records.into_iter().filter(|r| !r.archived).collect();
+        stream::iter(active)
+            .for_each_concurrent(8, |rec| {
+                let st = state.clone();
+                async move {
+                    let _ = st
+                        .inspector
+                        .inspect_host(&st.ssh_pool, &st.db, &rec.id)
+                        .await;
+                }
+            })
+            .await;
+    }
+
+    let hosts = state.db.list_public_hosts()?;
+    let snaps = state.inspector.get_all_cached();
+
+    let mut out = Vec::new();
+    for h in hosts {
+        if h.archived {
+            continue;
+        }
+        if !role_filter.is_empty() && h.role.as_deref() != Some(role_filter) {
+            continue;
+        }
+        if !search_q.is_empty() {
+            let hay = format!(
+                "{} {} {} {}",
+                h.name,
+                h.addr,
+                h.os_info
+                    .as_ref()
+                    .and_then(|o| o.pretty_name.as_deref())
+                    .unwrap_or(""),
+                h.tags.join(" ")
+            )
+            .to_lowercase();
+            if !hay.contains(&search_q) {
+                continue;
+            }
+        }
+
+        let snap = snaps.get(&h.id);
+        out.push(json!({
+            "name": h.name,
+            "status": h.status,
+            "latencyMs": h.latency_ms,
+            "address": if h.kind == "local" { "127.0.0.1".to_string() } else { format!("{}:{}", h.addr, h.port) },
+            "username": h.username,
+            "os": h.os_info.as_ref().and_then(|o| o.pretty_name.clone()),
+            "role": h.role,
+            "tags": h.tags,
+            "viaJump": h.jump_host_name,
+            "metrics": snap.map(|s| json!({
+                "cpuUsagePct": s.cpu_usage_pct,
+                "cpuStealPct": s.cpu_steal_pct,
+                "load1": s.load_1,
+                "memUsedMB": s.mem_used_bytes / 1024 / 1024,
+                "memTotalMB": s.mem_total_bytes / 1024 / 1024,
+                "diskUsedGB": ((s.disk_used_bytes as f64 / 1073741824.0) * 10.0).round() / 10.0,
+                "diskTotalGB": ((s.disk_total_bytes as f64 / 1073741824.0) * 10.0).round() / 10.0,
+                "tcpCc": s.tcp_cc,
+            })),
+        }));
+    }
+
+    Ok(json!({
+        "ok": true,
+        "note": "所有工具均支持直接传 name（如 'vip-hk'、'lazy-gomami'、'本机'）定位主机，无需使用内部 ID。",
+        "total": out.len(),
+        "hosts": out,
+    }))
+}
+
+async fn tool_vps_inspect(state: &Arc<AppState>, args: Value) -> Result<Value> {
+    let mut target_queries: Vec<String> = Vec::new();
+    if let Some(h) = args.get("host").and_then(|v| v.as_str()) {
+        if !h.trim().is_empty() {
+            target_queries.push(h.trim().to_string());
+        }
+    }
+    if let Some(arr) = args.get("hosts").and_then(|v| v.as_array()) {
+        for item in arr {
+            if let Some(s) = item.as_str() {
+                if !s.trim().is_empty() {
+                    target_queries.push(s.trim().to_string());
+                }
+            }
+        }
+    }
+    if target_queries.is_empty() {
+        return Err(anyhow!("请提供 host 或 hosts 参数"));
+    }
+
+    let mut resolved = Vec::new();
+    for q in target_queries {
+        resolved.push(resolve_host(&state.db, &q)?);
+    }
+
+    let results: Vec<Value> = stream::iter(resolved)
+        .map(|rec| {
+            let st = state.clone();
+            async move {
+                match st
+                    .inspector
+                    .inspect_host(&st.ssh_pool, &st.db, &rec.id)
+                    .await
+                {
+                    Ok(ins) => json!({
+                        "host": rec.name,
+                        "ok": true,
+                        "inspection": ins,
+                    }),
+                    Err(e) => json!({
+                        "host": rec.name,
+                        "ok": false,
+                        "error": format!("{e:#}"),
+                    }),
+                }
+            }
+        })
+        .buffer_unordered(8)
+        .collect()
+        .await;
+
+    Ok(json!({
+        "ok": true,
+        "results": results,
+    }))
+}
+
+async fn tool_vps_exec(
+    state: &Arc<AppState>,
+    exec_tasks: &Arc<ExecTaskManager>,
+    args: Value,
+) -> Result<Value> {
+    let command = args
+        .get("command")
+        .and_then(|v| v.as_str())
+        .filter(|s| !s.trim().is_empty())
+        .ok_or_else(|| anyhow!("command 参数不能为空"))?
+        .to_string();
+    let wait_seconds = args
+        .get("wait_seconds")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(25);
+
+    let mut host_queries = Vec::new();
+    if let Some(h) = args.get("host").and_then(|v| v.as_str()) {
+        if !h.trim().is_empty() {
+            host_queries.push(h.trim().to_string());
+        }
+    }
+    if let Some(arr) = args.get("hosts").and_then(|v| v.as_array()) {
+        for item in arr {
+            if let Some(s) = item.as_str() {
+                if !s.trim().is_empty() {
+                    host_queries.push(s.trim().to_string());
+                }
+            }
+        }
+    }
+    if host_queries.is_empty() {
+        return Err(anyhow!("请提供 host 或 hosts 参数（直接传主机名，如 'vip-hk'）"));
+    }
+
+    let mut targets = Vec::new();
+    for q in host_queries {
+        targets.push(resolve_host(&state.db, &q)?);
+    }
+
+    if targets.len() == 1 {
+        let snap = exec_tasks
+            .exec_with_wait(state, &targets[0], &command, wait_seconds)
+            .await?;
+        return Ok(json!({
+            "ok": snap.state == "completed" || snap.state == "running",
+            "result": snap,
+        }));
+    }
+
+    let results: Vec<ExecTaskSnapshot> = stream::iter(targets)
+        .map(|rec| {
+            let st = state.clone();
+            let et = exec_tasks.clone();
+            let cmd = command.clone();
+            async move {
+                et.exec_with_wait(&st, &rec, &cmd, wait_seconds)
+                    .await
+                    .unwrap_or_else(|e| ExecTaskSnapshot {
+                        id: String::new(),
+                        host_id: rec.id,
+                        host_name: rec.name,
+                        command: cmd,
+                        state: "failed".to_string(),
+                        exit_code: Some(-1),
+                        duration_ms: 0,
+                        stdout: String::new(),
+                        stderr: format!("{e:#}"),
+                        hint: None,
+                        started_at: Utc::now().to_rfc3339(),
+                    })
+            }
+        })
+        .buffer_unordered(8)
+        .collect()
+        .await;
+
+    Ok(json!({
+        "ok": true,
+        "results": results,
+    }))
+}
+
+async fn tool_vps_terminal(state: &Arc<AppState>, args: Value) -> Result<Value> {
+    let host_q = args
+        .get("host")
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| anyhow!("缺少 host 参数"))?;
+    let host = resolve_host(&state.db, host_q)?;
+
+    let action = args
+        .get("action")
+        .and_then(|v| v.as_str())
+        .unwrap_or("read");
+    let reveal_ui = args
+        .get("reveal_ui")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(action == "reveal");
+    let reason = args
+        .get("reason")
+        .and_then(|v| v.as_str())
+        .map(str::to_string);
+    let max_lines = args.get("lines").and_then(|v| v.as_u64()).unwrap_or(35) as usize;
+    let wait_ms = args.get("wait_ms").and_then(|v| v.as_u64()).unwrap_or(6000);
+
+    let pane_id_arg = args.get("pane_id").and_then(|v| v.as_str());
+
+    if action == "close" {
+        if let Some(pid) = pane_id_arg {
+            state.terminals.close_pane(pid);
+        } else if let Some(pane) = state.terminals.find_active_pane_for_host(&host.id) {
+            state.terminals.close_pane(&pane.id);
+        }
+        return Ok(json!({ "ok": true, "host": host.name, "closed": true }));
+    }
+
+    // 查找或自动创建该主机的终端会话（默认 headless=true 无头运行，除非 reveal_ui=true）
+    let pane = if let Some(pid) = pane_id_arg {
+        state
+            .terminals
+            .get_pane(pid)
+            .ok_or_else(|| anyhow!("指定的终端 pane 不存在: {pid}"))?
+    } else if let Some(existing) = state.terminals.find_active_pane_for_host(&host.id) {
+        existing
+    } else {
+        let created = state
+            .terminals
+            .create_pane(
+                &state.ssh_pool,
+                &state.db,
+                &host.id,
+                100,
+                30,
+                None,
+                !reveal_ui,
+            )
+            .await?;
+        let handle = state
+            .terminals
+            .get_pane(&created.id)
+            .ok_or_else(|| anyhow!("创建终端后获取句柄失败"))?;
+        // 等待远端初始 shell 提示符就绪
+        tokio::time::sleep(Duration::from_millis(450)).await;
+        handle
+    };
+
+    if reveal_ui {
+        state.terminals.reveal_pane_in_ui(&pane.id, reason.clone());
+    }
+
+    let snap = match action {
+        "reveal" | "read" => pane.read_screen_snapshot(max_lines),
+        "send" => {
+            let input = args.get("input").and_then(|v| v.as_str()).unwrap_or("");
+            let submit = args.get("submit").and_then(|v| v.as_bool()).unwrap_or(true);
+            let mut bytes = input.as_bytes().to_vec();
+            if submit {
+                bytes.push(b'\r');
+            }
+            pane.send_and_wait(bytes, max_lines, wait_ms).await
+        }
+        "key" => {
+            let key_name = args
+                .get("input")
+                .and_then(|v| v.as_str())
+                .unwrap_or("enter")
+                .to_lowercase();
+            let bytes: Vec<u8> = match key_name.as_str() {
+                "ctrl+c" | "c-c" | "sigint" => vec![0x03],
+                "ctrl+d" | "c-d" | "eof" => vec![0x04],
+                "ctrl+z" | "c-z" => vec![0x1a],
+                "ctrl+l" | "c-l" => vec![0x0c],
+                "enter" | "return" => vec![b'\r'],
+                "esc" | "escape" => vec![0x1b],
+                "tab" => vec![b'\t'],
+                "space" => vec![b' '],
+                "up" => b"\x1b[A".to_vec(),
+                "down" => b"\x1b[B".to_vec(),
+                "right" => b"\x1b[C".to_vec(),
+                "left" => b"\x1b[D".to_vec(),
+                other => other.as_bytes().to_vec(),
+            };
+            pane.send_and_wait(bytes, max_lines, wait_ms).await
+        }
+        other => return Err(anyhow!("未知的 vps_terminal action: {other}")),
+    };
+
+    Ok(json!({
+        "ok": true,
+        "host": host.name,
+        "revealedInUi": !snap.headless,
+        "terminal": snap,
+    }))
+}
+
+async fn tool_vps_fs(state: &Arc<AppState>, args: Value) -> Result<Value> {
+    let host_q = args
+        .get("host")
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| anyhow!("缺少 host 参数"))?;
+    let host = resolve_host(&state.db, host_q)?;
+    let action = args
+        .get("action")
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| anyhow!("缺少 action 参数"))?;
+    let path = args.get("path").and_then(|v| v.as_str()).unwrap_or("");
+
+    match action {
+        "list" => {
+            let listing = files::list_dir(&state.ssh_pool, &state.db, &host.id, Some(path), false).await?;
+            Ok(json!({
+                "ok": true,
+                "host": host.name,
+                "path": listing.path,
+                "parent": listing.parent,
+                "items": listing.items,
+            }))
+        }
+        "read" => {
+            let res = files::read_text_file(&state.ssh_pool, &state.db, &host.id, path).await?;
+            Ok(json!({
+                "ok": true,
+                "host": host.name,
+                "path": res.path,
+                "size": res.size,
+                "content": res.content,
+            }))
+        }
+        "write" => {
+            let content = args
+                .get("content")
+                .and_then(|v| v.as_str())
+                .ok_or_else(|| anyhow!("write 操作需要 content 参数"))?;
+            let size =
+                files::write_text_file(&state.ssh_pool, &state.db, &host.id, path, content).await?;
+            Ok(json!({
+                "ok": true,
+                "host": host.name,
+                "path": path,
+                "size": size,
+            }))
+        }
+        "mkdir" => {
+            files::create_dir(&state.ssh_pool, &state.db, &host.id, path).await?;
+            Ok(json!({ "ok": true, "host": host.name, "path": path }))
+        }
+        "rename" => {
+            let new_path = args
+                .get("new_path")
+                .and_then(|v| v.as_str())
+                .ok_or_else(|| anyhow!("rename 操作需要 new_path 参数"))?;
+            files::rename_item(&state.ssh_pool, &state.db, &host.id, path, new_path).await?;
+            Ok(json!({ "ok": true, "host": host.name, "oldPath": path, "newPath": new_path }))
+        }
+        "remove" => {
+            let is_dir = args.get("is_dir").and_then(|v| v.as_bool()).unwrap_or(false);
+            files::remove_item(&state.ssh_pool, &state.db, &host.id, path, is_dir).await?;
+            Ok(json!({ "ok": true, "host": host.name, "removed": path }))
+        }
+        "compress" => {
+            let out = files::compress_item(&state.ssh_pool, &state.db, &host.id, path).await?;
+            Ok(json!({ "ok": true, "host": host.name, "archivePath": out }))
+        }
+        "extract" => {
+            let out = files::extract_item(&state.ssh_pool, &state.db, &host.id, path).await?;
+            Ok(json!({ "ok": true, "host": host.name, "extractedPath": out }))
+        }
+        other => Err(anyhow!("未知的 vps_fs action: {other}")),
+    }
+}
+
+async fn tool_vps_transfer(state: &Arc<AppState>, args: Value) -> Result<Value> {
+    let direction = args
+        .get("direction")
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| anyhow!("缺少 direction 参数 (upload | download | cross)"))?;
+    let wait_seconds = args
+        .get("wait_seconds")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(25)
+        .clamp(2, 120);
+
+    if direction == "cross" {
+        let src_q = args
+            .get("source_host")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow!("cross 模式需要 source_host"))?;
+        let dst_q = args
+            .get("target_host")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow!("cross 模式需要 target_host"))?;
+        let src_path = args
+            .get("source_path")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow!("cross 模式需要 source_path"))?
+            .to_string();
+        let dst_path = args
+            .get("target_path")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow!("cross 模式需要 target_path"))?
+            .to_string();
+
+        let src_host = resolve_host(&state.db, src_q)?;
+        let dst_host = resolve_host(&state.db, dst_q)?;
+        let st = state.clone();
+
+        let fut = files::transfer_remote_to_remote(
+            &st.ssh_pool,
+            &st.db,
+            &st.transfers,
+            &src_host.id,
+            &src_path,
+            &dst_host.id,
+            &dst_path,
+        );
+        match tokio::time::timeout(Duration::from_secs(wait_seconds), fut).await {
+            Ok(res) => {
+                let task = res?;
+                return Ok(json!({ "ok": true, "transfer": task }));
+            }
+            Err(_) => {
+                let latest = state.transfers.list_tasks(Some(&dst_host.id));
+                return Ok(json!({
+                    "ok": true,
+                    "state": "running_in_background",
+                    "transfer": latest.first(),
+                    "hint": "大文件仍在高速传输中，可用 vps_task 查询实时进度与速率。"
+                }));
+            }
+        }
+    }
+
+    let host_q = args
+        .get("host")
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| anyhow!("缺少 host 参数"))?;
+    let host = resolve_host(&state.db, host_q)?;
+    let local_path = args
+        .get("local_path")
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| anyhow!("缺少 local_path 参数"))?
+        .to_string();
+    let remote_path = args
+        .get("remote_path")
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| anyhow!("缺少 remote_path 参数"))?
+        .to_string();
+
+    let st = state.clone();
+    let dir_str = direction.to_string();
+    let hid = host.id.clone();
+    let handle = tokio::spawn(async move {
+        files::transfer_local_remote_file(
+            &st.ssh_pool,
+            &st.db,
+            &st.transfers,
+            &hid,
+            &dir_str,
+            &local_path,
+            &remote_path,
+        )
+        .await
+    });
+
+    match tokio::time::timeout(Duration::from_secs(wait_seconds), handle).await {
+        Ok(join_res) => {
+            let task = join_res??;
+            Ok(json!({
+                "ok": true,
+                "host": host.name,
+                "transfer": task,
+            }))
+        }
+        Err(_) => {
+            let latest = state.transfers.list_tasks(Some(&host.id));
+            Ok(json!({
+                "ok": true,
+                "host": host.name,
+                "state": "running_in_background",
+                "transfer": latest.first(),
+                "hint": "大文件仍在后台满速传输中，请用 vps_task 查询进度（若连续 12 秒无字节推进将由看门狗自动中断报错）。"
+            }))
+        }
+    }
+}
+
+async fn tool_vps_task(
+    state: &Arc<AppState>,
+    exec_tasks: &Arc<ExecTaskManager>,
+    args: Value,
+) -> Result<Value> {
+    let action = args.get("action").and_then(|v| v.as_str()).unwrap_or("list");
+    let task_id = args.get("task_id").and_then(|v| v.as_str()).unwrap_or("");
+
+    match action {
+        "get" => {
+            if task_id.starts_with("exec_") {
+                let t = exec_tasks
+                    .get_task(task_id)
+                    .ok_or_else(|| anyhow!("未找到命令任务: {task_id}"))?;
+                Ok(json!({ "ok": true, "task": t }))
+            } else {
+                let t = state
+                    .transfers
+                    .list_tasks(None)
+                    .into_iter()
+                    .find(|x| x.id == task_id)
+                    .ok_or_else(|| anyhow!("未找到传输任务: {task_id}"))?;
+                Ok(json!({ "ok": true, "transfer": t }))
+            }
+        }
+        "cancel" => {
+            let t = exec_tasks
+                .cancel_task(task_id)
+                .ok_or_else(|| anyhow!("未找到可取消的命令任务: {task_id}"))?;
+            Ok(json!({ "ok": true, "task": t }))
+        }
+        _ => Ok(json!({
+            "ok": true,
+            "execTasks": exec_tasks.list_tasks(),
+            "transfers": state.transfers.list_tasks(None),
+        })),
+    }
+}
+
+/// `--mcp-stdio` 本地模式：若 127.0.0.1:3302 主进程正在运行则直接桥接过去（与桌面 UI 共享连接池、探针缓存和终端唤起事件），
+/// 若主进程未运行则在当前进程内直接处理。
+pub async fn run_stdio_bridge(state: Arc<AppState>, exec_tasks: Arc<ExecTaskManager>, port: u16) -> Result<()> {
+    let stdin = tokio::io::stdin();
+    let mut lines = tokio::io::BufReader::new(stdin).lines();
+
+    while let Some(line) = lines.next_line().await? {
+        let trimmed = line.trim();
+        if trimmed.is_empty() {
+            continue;
+        }
+        let Ok(req) = serde_json::from_str::<JsonRpcRequest>(trimmed) else {
+            continue;
+        };
+
+        // 优先尝试转发给已运行的常驻 UI 主进程（以便共享 SshPool 与 UI 终端弹窗联动）
+        if let Some(resp_str) = try_forward_to_daemon(port, trimmed).await {
+            if !resp_str.trim().is_empty() {
+                println!("{}", resp_str.trim());
+            }
+            continue;
+        }
+
+        if let Some(resp) = handle_mcp_request(&state, &exec_tasks, req).await {
+            println!("{}", serde_json::to_string(&resp)?);
+        }
+    }
+    Ok(())
+}
+
+async fn try_forward_to_daemon(port: u16, raw_json: &str) -> Option<String> {
+    use tokio::io::{AsyncReadExt, AsyncWriteExt};
+    let addr = format!("127.0.0.1:{port}");
+    let mut stream = tokio::time::timeout(
+        Duration::from_millis(80),
+        tokio::net::TcpStream::connect(&addr),
+    )
+    .await
+    .ok()?
+    .ok()?;
+
+    let req_bytes = format!(
+        "POST /mcp HTTP/1.1\r\nHost: 127.0.0.1:{port}\r\nContent-Type: application/json\r\nx-vps-switch-stdio: 1\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
+        raw_json.len(),
+        raw_json
+    );
+    stream.write_all(req_bytes.as_bytes()).await.ok()?;
+    let mut resp = Vec::new();
+    stream.read_to_end(&mut resp).await.ok()?;
+    let resp_str = String::from_utf8_lossy(&resp);
+    let (_, body) = resp_str.split_once("\r\n\r\n")?;
+    Some(body.trim().to_string())
+}
+
+// ==================== 自动写入 Claude Code (~/.claude.json) 与 Codex (~/.codex/config.toml) ====================
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CliSyncStatus {
+    pub exe_path: String,
+    pub port: u16,
+    pub claude_code_path: String,
+    pub claude_code_synced: bool,
+    pub codex_path: String,
+    pub codex_synced: bool,
+}
+
+fn user_home_dir() -> Option<std::path::PathBuf> {
+    std::env::var("USERPROFILE")
+        .or_else(|_| std::env::var("HOME"))
+        .ok()
+        .map(std::path::PathBuf::from)
+}
+
+pub fn sync_cli_mcp_configs(port: u16) -> CliSyncStatus {
+    let exe_path = std::env::current_exe()
+        .ok()
+        .map(|p| {
+            let s = p.to_string_lossy().to_string();
+            s.strip_prefix(r"\\?\").unwrap_or(&s).to_string()
+        })
+        .unwrap_or_else(|| "vps-switch".to_string());
+
+    let home = user_home_dir().unwrap_or_else(|| std::path::PathBuf::from("."));
+    let claude_path = home.join(".claude.json");
+    let codex_path = home.join(".codex").join("config.toml");
+
+    let claude_ok = sync_claude_json(&claude_path, &exe_path).unwrap_or(false);
+    let codex_ok = sync_codex_toml(&codex_path, &exe_path).unwrap_or(false);
+
+    CliSyncStatus {
+        exe_path,
+        port,
+        claude_code_path: claude_path.to_string_lossy().to_string(),
+        claude_code_synced: claude_ok,
+        codex_path: codex_path.to_string_lossy().to_string(),
+        codex_synced: codex_ok,
+    }
+}
+
+fn sync_claude_json(claude_path: &std::path::Path, exe_path: &str) -> Result<bool> {
+    if !claude_path.exists() {
+        return Ok(false);
+    }
+    let raw = std::fs::read_to_string(claude_path)?;
+    let mut root: Value = serde_json::from_str(&raw)?;
+    let Some(obj) = root.as_object_mut() else {
+        return Ok(false);
+    };
+
+    let desired = json!({
+        "type": "stdio",
+        "command": exe_path,
+        "args": ["--mcp-stdio"]
+    });
+
+    let mcp_servers = obj
+        .entry("mcpServers")
+        .or_insert_with(|| json!({}));
+    if let Some(servers_obj) = mcp_servers.as_object_mut() {
+        if servers_obj.get("vps-switch") == Some(&desired) {
+            return Ok(true);
+        }
+        servers_obj.insert("vps-switch".to_string(), desired);
+    }
+
+    let tmp_path = claude_path.with_extension("json.vps-switch-tmp");
+    std::fs::write(&tmp_path, serde_json::to_string_pretty(&root)?)?;
+    std::fs::rename(&tmp_path, claude_path)?;
+    Ok(true)
+}
+
+fn sync_codex_toml(codex_path: &std::path::Path, exe_path: &str) -> Result<bool> {
+    if !codex_path.exists() {
+        return Ok(false);
+    }
+    let raw = std::fs::read_to_string(codex_path)?;
+    let posix_exe = exe_path.replace('\\', "/");
+    let desired_block = format!(
+        "[mcp_servers.vps-switch]\ncommand = \"{}\"\nargs = [\"--mcp-stdio\"]",
+        posix_exe
+    );
+
+    if raw.contains(&desired_block) {
+        return Ok(true);
+    }
+
+    let updated = if let Some(start_idx) = raw.find("[mcp_servers.vps-switch]") {
+        let after_header = start_idx + "[mcp_servers.vps-switch]".len();
+        let next_section_rel = raw[after_header..].find("\n[");
+        match next_section_rel {
+            Some(rel) => {
+                let end_idx = after_header + rel;
+                format!("{}{}{}", &raw[..start_idx], desired_block, &raw[end_idx..])
+            }
+            None => format!("{}{}\n", &raw[..start_idx], desired_block),
+        }
+    } else {
+        let mut s = raw;
+        if !s.ends_with('\n') {
+            s.push('\n');
+        }
+        s.push('\n');
+        s.push_str(&desired_block);
+        s.push('\n');
+        s
+    };
+
+    let tmp_path = codex_path.with_extension("toml.vps-switch-tmp");
+    std::fs::write(&tmp_path, updated)?;
+    std::fs::rename(&tmp_path, codex_path)?;
+    Ok(true)
+}
diff --git a/src/models.rs b/src/models.rs
new file mode 100644
index 0000000..52437a5
--- /dev/null
+++ b/src/models.rs
@@ -0,0 +1,144 @@
+use serde::{Deserialize, Serialize};
+
+pub const LOCAL_HOST_ID: &str = "local";
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct HostLink {
+    #[serde(default)]
+    pub id: String,
+    pub name: String,
+    pub url: String,
+    #[serde(default)]
+    pub description: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct OsInfo {
+    pub os: Option<String>,
+    pub distro_id: Option<String>,
+    pub version_id: Option<String>,
+    pub pretty_name: Option<String>,
+    pub arch: Option<String>,
+    pub kernel: Option<String>,
+    pub cpu_model: Option<String>,
+    pub cpu_cores: Option<u32>,
+    pub detected_at: Option<String>,
+}
+
+#[derive(Debug, Clone)]
+pub struct HostRecord {
+    pub id: String,
+    pub name: String,
+    pub kind: String, // "local" | "ssh"
+    pub addr: String,
+    pub port: u16,
+    pub username: String,
+    pub auth_type: String, // "local" | "password" | "privateKey"
+    pub encrypted_password: Option<String>,
+    pub encrypted_private_key: Option<String>,
+    pub encrypted_passphrase: Option<String>,
+    pub jump_host_id: Option<String>,
+    pub role: Option<String>,
+    pub tags: Vec<String>,
+    pub links: Vec<HostLink>,
+    pub os_info: Option<OsInfo>,
+    pub pinned: bool,
+    pub favorited: bool,
+    pub archived: bool,
+    pub sort_order: i64,
+    pub status: String, // "online" | "offline" | "unknown"
+    pub latency_ms: Option<i64>,
+    pub last_connected_at: Option<String>,
+    pub last_error: Option<String>,
+    pub created_at: String,
+    pub updated_at: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PublicHost {
+    pub id: String,
+    pub name: String,
+    pub kind: String,
+    pub addr: String,
+    pub port: u16,
+    pub username: String,
+    pub auth_type: String,
+    pub has_password: bool,
+    pub has_private_key: bool,
+    pub has_passphrase: bool,
+    pub jump_host_id: Option<String>,
+    pub jump_host_name: Option<String>,
+    pub role: Option<String>,
+    pub tags: Vec<String>,
+    pub links: Vec<HostLink>,
+    pub os_info: Option<OsInfo>,
+    pub pinned: bool,
+    pub favorited: bool,
+    pub archived: bool,
+    pub sort_order: i64,
+    pub status: String,
+    pub latency_ms: Option<i64>,
+    pub last_connected_at: Option<String>,
+    pub last_error: Option<String>,
+    pub created_at: String,
+    pub updated_at: String,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct HostUpsertPayload {
+    pub name: String,
+    #[serde(default)]
+    pub addr: String,
+    #[serde(default = "default_port")]
+    pub port: u16,
+    #[serde(default = "default_username")]
+    pub username: String,
+    #[serde(default = "default_auth_type")]
+    pub auth_type: String,
+    pub password: Option<String>,
+    pub private_key: Option<String>,
+    pub passphrase: Option<String>,
+    pub jump_host_id: Option<String>,
+    pub role: Option<String>,
+    #[serde(default)]
+    pub tags: Vec<String>,
+    #[serde(default)]
+    pub links: Vec<HostLink>,
+    #[serde(default)]
+    pub pinned: bool,
+    #[serde(default)]
+    pub favorited: bool,
+    #[serde(default)]
+    pub archived: bool,
+}
+
+fn default_port() -> u16 {
+    22
+}
+fn default_username() -> String {
+    "root".to_string()
+}
+fn default_auth_type() -> String {
+    "password".to_string()
+}
+
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct HostMetaPatch {
+    pub pinned: Option<bool>,
+    pub favorited: Option<bool>,
+    pub archived: Option<bool>,
+    pub role: Option<String>,
+    pub tags: Option<Vec<String>>,
+    pub links: Option<Vec<HostLink>>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ReorderPayload {
+    pub ordered_ids: Vec<String>,
+}
diff --git a/src/ssh.rs b/src/ssh.rs
new file mode 100644
index 0000000..99f3307
--- /dev/null
+++ b/src/ssh.rs
@@ -0,0 +1,367 @@
+use crate::{
+    crypto::MasterKey,
+    db::Database,
+    models::HostRecord,
+};
+use anyhow::{anyhow, Context, Result};
+use russh::{
+    client::{self, AuthResult, Config, Handle, KeyboardInteractiveAuthResponse, Msg},
+    keys::{decode_secret_key, key::PrivateKeyWithHashAlg, PublicKeyOrCertificate},
+    Channel, ChannelMsg,
+};
+use russh_sftp::client::{Config as SftpConfig, SftpSession};
+use std::{
+    collections::HashMap,
+    sync::Arc,
+    time::{Duration, Instant},
+};
+use tokio::sync::Mutex;
+
+pub struct SshClientHandler;
+
+impl client::Handler for SshClientHandler {
+    type Error = russh::Error;
+
+    async fn check_server_key(
+        &mut self,
+        _server_public_key: &PublicKeyOrCertificate,
+    ) -> std::result::Result<bool, Self::Error> {
+        Ok(true)
+    }
+}
+
+/// 单主机 SSH 与 SFTP 连接池：
+/// - 终端、执行、SFTP 文件浏览、高速上传下载、探针全部共用同一条底层 SSH 连接；
+/// - 通道窗口拉大到 16 MiB + SFTP 64 路并发流水线（255 KiB 大包），彻底跑满跨境高 RTT 带宽。
+#[derive(Default)]
+pub struct SshPool {
+    sessions: Mutex<HashMap<String, Arc<Handle<SshClientHandler>>>>,
+    sftps: Mutex<HashMap<String, Arc<SftpSession>>>,
+    home_dirs: Mutex<HashMap<String, String>>,
+    dir_cache: Mutex<HashMap<(String, String), (Instant, crate::files::DirListing)>>,
+}
+
+impl SshPool {
+    pub fn new() -> Self {
+        Self {
+            sessions: Mutex::new(HashMap::new()),
+            sftps: Mutex::new(HashMap::new()),
+            home_dirs: Mutex::new(HashMap::new()),
+            dir_cache: Mutex::new(HashMap::new()),
+        }
+    }
+
+    pub async fn get_cached_dir(
+        &self,
+        host_id: &str,
+        path: &str,
+        max_age: Duration,
+    ) -> Option<crate::files::DirListing> {
+        let guard = self.dir_cache.lock().await;
+        guard
+            .get(&(host_id.to_string(), path.to_string()))
+            .and_then(|(ts, listing)| {
+                if ts.elapsed() <= max_age {
+                    Some(listing.clone())
+                } else {
+                    None
+                }
+            })
+    }
+
+    pub async fn put_cached_dir(
+        &self,
+        host_id: &str,
+        req_path: &str,
+        listing: &crate::files::DirListing,
+    ) {
+        let mut guard = self.dir_cache.lock().await;
+        let now = Instant::now();
+        guard.insert(
+            (host_id.to_string(), listing.path.clone()),
+            (now, listing.clone()),
+        );
+        if req_path != listing.path {
+            guard.insert(
+                (host_id.to_string(), req_path.to_string()),
+                (now, listing.clone()),
+            );
+        }
+    }
+
+    pub async fn invalidate_dir_cache(&self, host_id: &str) {
+        let mut guard = self.dir_cache.lock().await;
+        guard.retain(|(h, _), _| h != host_id);
+    }
+
+    pub async fn get_home_dir(&self, sftp: &SftpSession, host_id: &str) -> String {
+        {
+            let guard = self.home_dirs.lock().await;
+            if let Some(h) = guard.get(host_id) {
+                return h.clone();
+            }
+        }
+        let resolved = sftp
+            .canonicalize(".")
+            .await
+            .unwrap_or_else(|_| "/root".to_string());
+        self.home_dirs
+            .lock()
+            .await
+            .insert(host_id.to_string(), resolved.clone());
+        resolved
+    }
+
+    pub async fn get_or_connect(
+        &self,
+        host: &HostRecord,
+        jump_host: Option<&HostRecord>,
+        master_key: &MasterKey,
+    ) -> Result<Arc<Handle<SshClientHandler>>> {
+        {
+            let guard = self.sessions.lock().await;
+            if let Some(existing) = guard.get(&host.id) {
+                if !existing.is_closed() {
+                    return Ok(existing.clone());
+                }
+            }
+        }
+
+        let handle = connect_single_or_jump(host, jump_host, master_key).await?;
+        let arc_handle = Arc::new(handle);
+        {
+            let mut guard = self.sessions.lock().await;
+            guard.insert(host.id.clone(), arc_handle.clone());
+        }
+        Ok(arc_handle)
+    }
+
+    pub async fn open_session_channel(
+        &self,
+        host: &HostRecord,
+        jump_host: Option<&HostRecord>,
+        master_key: &MasterKey,
+    ) -> Result<Channel<Msg>> {
+        let handle = self.get_or_connect(host, jump_host, master_key).await?;
+        match handle.channel_open_session().await {
+            Ok(ch) => Ok(ch),
+            Err(_) => {
+                self.invalidate_host(&host.id).await;
+                let fresh = self.get_or_connect(host, jump_host, master_key).await?;
+                fresh
+                    .channel_open_session()
+                    .await
+                    .context("打开 SSH 会话通道失败")
+            }
+        }
+    }
+
+    pub async fn invalidate_host(&self, host_id: &str) {
+        self.sftps.lock().await.remove(host_id);
+        self.sessions.lock().await.remove(host_id);
+    }
+
+    pub async fn invalidate_sftp(&self, host_id: &str) {
+        self.sftps.lock().await.remove(host_id);
+    }
+
+    pub async fn get_or_open_sftp(
+        &self,
+        db: &Database,
+        host_id: &str,
+    ) -> Result<Arc<SftpSession>> {
+        {
+            let guard = self.sftps.lock().await;
+            if let Some(existing) = guard.get(host_id) {
+                return Ok(existing.clone());
+            }
+        }
+
+        let (_record, channel) = open_host_channel(self, db, host_id).await?;
+        channel
+            .request_subsystem(true, "sftp")
+            .await
+            .context("请求 SFTP 子系统失败")?;
+
+        // 高速调优：利用 OpenSSH limits@openssh.com (255KiB 单包) + 64 并发读写流水线 (16 MiB 在途窗口)
+        let sftp_cfg = SftpConfig {
+            max_packet_len: 1024 * 1024,
+            max_concurrent_reads: 64,
+            max_concurrent_writes: 64,
+            max_write_packet_len: 261_120,
+            request_timeout_secs: 60,
+        };
+
+        let sftp = SftpSession::new_with_config(channel.into_stream(), sftp_cfg)
+            .await
+            .context("初始化 SFTP 会话失败")?;
+        let arc_sftp = Arc::new(sftp);
+        {
+            let mut guard = self.sftps.lock().await;
+            guard.insert(host_id.to_string(), arc_sftp.clone());
+        }
+        Ok(arc_sftp)
+    }
+}
+
+async fn authenticate_session(
+    session: &mut Handle<SshClientHandler>,
+    host: &HostRecord,
+    master_key: &MasterKey,
+) -> Result<()> {
+    let user = if host.username.trim().is_empty() {
+        "root"
+    } else {
+        host.username.trim()
+    };
+
+    if host.auth_type == "privateKey" {
+        let key_pem = master_key
+            .decrypt(host.encrypted_private_key.as_deref())?
+            .ok_or_else(|| anyhow!("该主机未配置私钥"))?;
+        let passphrase = master_key.decrypt(host.encrypted_passphrase.as_deref())?;
+        let key_pair =
+            decode_secret_key(&key_pem, passphrase.as_deref()).context("解析 SSH 私钥失败")?;
+        let best_hash = session.best_supported_rsa_hash().await?.flatten();
+        let key_with_alg = PrivateKeyWithHashAlg::new(Arc::new(key_pair), best_hash);
+        match session.authenticate_publickey(user, key_with_alg).await? {
+            AuthResult::Success => return Ok(()),
+            AuthResult::Failure { .. } => return Err(anyhow!("SSH 私钥认证被服务器拒绝")),
+        }
+    }
+
+    let password = master_key
+        .decrypt(host.encrypted_password.as_deref())?
+        .ok_or_else(|| anyhow!("该主机未配置密码"))?;
+
+    match session.authenticate_password(user, &password).await? {
+        AuthResult::Success => return Ok(()),
+        AuthResult::Failure { .. } => {}
+    }
+
+    let mut ki = session
+        .authenticate_keyboard_interactive_start(user, None::<String>)
+        .await?;
+    for _ in 0..3 {
+        match ki {
+            KeyboardInteractiveAuthResponse::Success => return Ok(()),
+            KeyboardInteractiveAuthResponse::Failure { .. } => {
+                return Err(anyhow!("SSH 密码认证失败"));
+            }
+            KeyboardInteractiveAuthResponse::InfoRequest { prompts, .. } => {
+                let responses = prompts.iter().map(|_| password.clone()).collect();
+                ki = session
+                    .authenticate_keyboard_interactive_respond(responses)
+                    .await?;
+            }
+        }
+    }
+
+    Err(anyhow!("SSH 认证未通过"))
+}
+
+pub async fn connect_single_or_jump(
+    host: &HostRecord,
+    jump_host: Option<&HostRecord>,
+    master_key: &MasterKey,
+) -> Result<Handle<SshClientHandler>> {
+    let mut cfg = Config::default();
+    // 关键性能优化：将 SSH Channel 窗口从默认 2MiB 提升至 16MiB，单包上限拉满 65535，
+    // 彻底消除跨境高 RTT 线路上传下载时等待 SSH_MSG_CHANNEL_WINDOW_ADJUST 造成的断流限速
+    cfg.window_size = 16 * 1024 * 1024;
+    cfg.maximum_packet_size = 65535;
+    cfg.channel_buffer_size = 1024;
+    cfg.inactivity_timeout = Some(Duration::from_secs(3600));
+    cfg.keepalive_interval = Some(Duration::from_secs(25));
+    cfg.nodelay = true;
+    let config = Arc::new(cfg);
+
+    if let Some(jump) = jump_host {
+        let jump_addr = format!("{}:{}", jump.addr.trim(), jump.port);
+        let mut jump_session = tokio::time::timeout(
+            Duration::from_secs(10),
+            client::connect(config.clone(), jump_addr.as_str(), SshClientHandler),
+        )
+        .await
+        .context("连接跳板机超时")?
+        .context("连接跳板机失败")?;
+
+        authenticate_session(&mut jump_session, jump, master_key)
+            .await
+            .context("跳板机认证失败")?;
+
+        let direct_channel = tokio::time::timeout(
+            Duration::from_secs(10),
+            jump_session.channel_open_direct_tcpip(
+                host.addr.trim(),
+                host.port as u32,
+                "127.0.0.1",
+                0,
+            ),
+        )
+        .await
+        .context("通过跳板机建立隧道超时")?
+        .context("通过跳板机建立隧道失败")?;
+
+        let stream = direct_channel.into_stream();
+        let mut target_session = tokio::time::timeout(
+            Duration::from_secs(10),
+            client::connect_stream(config, stream, SshClientHandler),
+        )
+        .await
+        .context("目标主机 SSH 握手超时")?
+        .context("目标主机 SSH 握手失败")?;
+
+        authenticate_session(&mut target_session, host, master_key).await?;
+        Ok(target_session)
+    } else {
+        let addr = format!("{}:{}", host.addr.trim(), host.port);
+        let mut session = tokio::time::timeout(
+            Duration::from_secs(8),
+            client::connect(config, addr.as_str(), SshClientHandler),
+        )
+        .await
+        .context("SSH 连接超时")?
+        .context("SSH 连接失败")?;
+
+        authenticate_session(&mut session, host, master_key).await?;
+        Ok(session)
+    }
+}
+
+pub async fn exec_short_command(session: &Handle<SshClientHandler>, cmd: &str) -> Result<String> {
+    let mut channel = session.channel_open_session().await?;
+    channel.exec(true, cmd).await?;
+    let mut out = Vec::new();
+    let collect = async {
+        while let Some(msg) = channel.wait().await {
+            match msg {
+                ChannelMsg::Data { data } => out.extend_from_slice(&data),
+                ChannelMsg::ExtendedData { data, .. } => out.extend_from_slice(&data),
+                ChannelMsg::Eof | ChannelMsg::Close => break,
+                _ => {}
+            }
+        }
+    };
+    let _ = tokio::time::timeout(Duration::from_secs(5), collect).await;
+    Ok(String::from_utf8_lossy(&out).trim().to_string())
+}
+
+pub async fn open_host_channel(
+    pool: &SshPool,
+    db: &Database,
+    host_id: &str,
+) -> Result<(HostRecord, Channel<Msg>)> {
+    let record = db
+        .get_record(host_id)?
+        .ok_or_else(|| anyhow!("主机不存在: {host_id}"))?;
+    let jump = match record.jump_host_id.as_deref() {
+        Some(jid) => db.get_record(jid)?,
+        None => None,
+    };
+    let channel = pool
+        .open_session_channel(&record, jump.as_ref(), db.master_key())
+        .await?;
+    let _ = db.update_check_result(&record.id, true, None, None, None);
+    Ok((record, channel))
+}
diff --git a/src/terminal.rs b/src/terminal.rs
new file mode 100644
index 0000000..8506260
--- /dev/null
+++ b/src/terminal.rs
@@ -0,0 +1,978 @@
+use crate::{
+    db::Database,
+    models::LOCAL_HOST_ID,
+    ssh::{open_host_channel, SshPool},
+};
+use alacritty_terminal::{
+    event::VoidListener,
+    grid::Dimensions,
+    index::{Column, Line, Point},
+    term::{Config as TermConfig, Term, TermMode},
+    vte::ansi::Processor,
+};
+use anyhow::{Context, Result};
+use portable_pty::{native_pty_system, CommandBuilder, PtySize};
+use russh::ChannelMsg;
+use serde::{Deserialize, Serialize};
+use std::{
+    collections::{HashMap, VecDeque},
+    io::{Read, Write},
+    sync::{Arc, Mutex},
+    time::{Duration, Instant},
+};
+use tokio::sync::{broadcast, mpsc};
+use uuid::Uuid;
+
+const RING_BUFFER_CAPACITY: usize = 2 * 1024 * 1024;
+
+#[derive(Clone, Copy)]
+struct TermDimensions {
+    cols: usize,
+    lines: usize,
+}
+
+impl Dimensions for TermDimensions {
+    fn total_lines(&self) -> usize {
+        self.lines
+    }
+    fn screen_lines(&self) -> usize {
+        self.lines
+    }
+    fn columns(&self) -> usize {
+        self.cols
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PaneMeta {
+    pub id: String,
+    pub host_id: String,
+    pub cols: u16,
+    pub rows: u16,
+    pub cwd: Option<String>,
+    pub title: Option<String>,
+    pub running: bool,
+    pub last_exit_code: Option<i32>,
+    pub bracketed_paste: bool,
+    pub headless: bool,
+    pub exited: bool,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ScreenSnapshot {
+    pub pane_id: String,
+    pub host_id: String,
+    pub state: String, // "idle" | "waiting_input" | "running" | "exited"
+    pub cursor_line: String,
+    pub screen: String,
+    pub cwd: Option<String>,
+    pub last_exit_code: Option<i32>,
+    pub headless: bool,
+    pub exited: bool,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "camelCase")]
+pub enum UiEvent {
+    RevealTerminal {
+        host_id: String,
+        pane: PaneMeta,
+        reason: Option<String>,
+    },
+    ShowMainWindow,
+}
+
+#[derive(Clone)]
+pub enum PaneBroadcast {
+    Output(Vec<u8>),
+    Meta(PaneMeta),
+}
+
+pub enum PaneCommand {
+    Input(Vec<u8>),
+    Paste(String),
+    Resize(u16, u16),
+    Close,
+}
+
+pub struct PaneInternalState {
+    pub term: Term<VoidListener>,
+    pub processor: Processor,
+    pub ring_buffer: VecDeque<u8>,
+    pub cols: u16,
+    pub rows: u16,
+    pub cwd: Option<String>,
+    pub title: Option<String>,
+    pub running: bool,
+    pub last_exit_code: Option<i32>,
+    pub headless: bool,
+    pub exited: bool,
+    pub output_seq: u64,
+    pub last_output_at: Instant,
+    osc_tail: Vec<u8>,
+}
+
+impl PaneInternalState {
+    fn new(cols: u16, rows: u16, initial_cwd: Option<String>, headless: bool) -> Self {
+        let dims = TermDimensions {
+            cols: cols.max(2) as usize,
+            lines: rows.max(1) as usize,
+        };
+        let term = Term::new(TermConfig::default(), &dims, VoidListener);
+        Self {
+            term,
+            processor: Processor::new(),
+            ring_buffer: VecDeque::with_capacity(64 * 1024),
+            cols,
+            rows,
+            cwd: initial_cwd,
+            title: None,
+            running: false,
+            last_exit_code: None,
+            headless,
+            exited: false,
+            output_seq: 0,
+            last_output_at: Instant::now(),
+            osc_tail: Vec::new(),
+        }
+    }
+
+    pub fn feed_bytes(&mut self, data: &[u8]) -> bool {
+        self.processor.advance(&mut self.term, data);
+        self.output_seq = self.output_seq.wrapping_add(1);
+        self.last_output_at = Instant::now();
+
+        let clean_for_replay = strip_terminal_queries(data);
+        if clean_for_replay.len() >= RING_BUFFER_CAPACITY {
+            self.ring_buffer.clear();
+            let start = clean_for_replay.len() - RING_BUFFER_CAPACITY;
+            self.ring_buffer.extend(&clean_for_replay[start..]);
+        } else if !clean_for_replay.is_empty() {
+            let overflow = (self.ring_buffer.len() + clean_for_replay.len())
+                .saturating_sub(RING_BUFFER_CAPACITY);
+            if overflow > 0 {
+                self.ring_buffer.drain(..overflow);
+            }
+            self.ring_buffer.extend(&clean_for_replay);
+        }
+
+        self.scan_osc_sequences(data)
+    }
+
+    pub fn resize(&mut self, cols: u16, rows: u16) {
+        self.cols = cols.max(2);
+        self.rows = rows.max(1);
+        let dims = TermDimensions {
+            cols: self.cols as usize,
+            lines: self.rows as usize,
+        };
+        self.term.resize(dims);
+    }
+
+    pub fn bracketed_paste_enabled(&self) -> bool {
+        self.term.mode().contains(TermMode::BRACKETED_PASTE)
+    }
+
+    /// 直接从 alacritty_terminal::Term 二维屏幕网格读取最后 max_lines 行与光标所在行（零 ANSI 噪音）
+    pub fn read_screen_grid(&self, max_lines: usize) -> (String, String) {
+        let bottom = self.term.bottommost_line();
+        let top = self.term.topmost_line();
+        let last_col = self.term.last_column();
+        let cursor_pt = self.term.grid().cursor.point;
+
+        let cursor_line = self
+            .term
+            .bounds_to_string(
+                Point::new(cursor_pt.line, Column(0)),
+                Point::new(cursor_pt.line, last_col),
+            )
+            .trim_end()
+            .to_string();
+
+        let requested = max_lines.clamp(5, 200) as i32;
+        let start_line = std::cmp::max(top, Line(bottom.0 - requested + 1));
+        let raw_screen = self.term.bounds_to_string(
+            Point::new(start_line, Column(0)),
+            Point::new(bottom, last_col),
+        );
+
+        let lines: Vec<&str> = raw_screen.lines().collect();
+        let mut last_non_empty = lines.len();
+        while last_non_empty > 0 && lines[last_non_empty - 1].trim().is_empty() {
+            last_non_empty -= 1;
+        }
+        let trimmed_screen = lines[..last_non_empty].join("\n");
+        (trimmed_screen, cursor_line)
+    }
+
+    fn scan_osc_sequences(&mut self, chunk: &[u8]) -> bool {
+        let mut changed = false;
+        self.osc_tail.extend_from_slice(chunk);
+        if self.osc_tail.len() > 4096 {
+            let keep = 1024;
+            let drain_len = self.osc_tail.len() - keep;
+            self.osc_tail.drain(..drain_len);
+        }
+
+        let mut idx = 0;
+        let mut consumed = 0;
+        while idx + 2 <= self.osc_tail.len() {
+            if self.osc_tail[idx] == 0x1b && self.osc_tail[idx + 1] == b']' {
+                let start = idx + 2;
+                let mut end = None;
+                let mut next_pos = start;
+                while next_pos < self.osc_tail.len() {
+                    if self.osc_tail[next_pos] == 0x07 {
+                        end = Some((next_pos, next_pos + 1));
+                        break;
+                    }
+                    if next_pos + 1 < self.osc_tail.len()
+                        && self.osc_tail[next_pos] == 0x1b
+                        && self.osc_tail[next_pos + 1] == b'\\'
+                    {
+                        end = Some((next_pos, next_pos + 2));
+                        break;
+                    }
+                    next_pos += 1;
+                }
+
+                if let Some((payload_end, after_end)) = end {
+                    let osc_owned = std::str::from_utf8(&self.osc_tail[start..payload_end])
+                        .ok()
+                        .map(str::to_owned);
+                    if let Some(osc_str) = osc_owned {
+                        if self.handle_osc_payload(&osc_str) {
+                            changed = true;
+                        }
+                    }
+                    consumed = after_end;
+                    idx = after_end;
+                } else {
+                    break;
+                }
+            } else {
+                idx += 1;
+            }
+        }
+
+        if consumed > 0 {
+            self.osc_tail.drain(..consumed);
+        } else if let Some(esc_pos) = self.osc_tail.iter().rposition(|&b| b == 0x1b) {
+            if esc_pos > 0 {
+                self.osc_tail.drain(..esc_pos);
+            }
+        } else {
+            self.osc_tail.clear();
+        }
+
+        changed
+    }
+
+    fn handle_osc_payload(&mut self, osc: &str) -> bool {
+        if let Some(rest) = osc.strip_prefix("7;") {
+            if let Some(path_part) = rest.strip_prefix("file://") {
+                if let Some(slash_idx) = path_part.find('/') {
+                    let raw_path = &path_part[slash_idx..];
+                    let decoded = percent_decode(raw_path);
+                    let clean = if decoded.len() >= 3
+                        && decoded.starts_with('/')
+                        && decoded.as_bytes()[2] == b':'
+                    {
+                        decoded[1..].to_string()
+                    } else {
+                        decoded
+                    };
+                    if !clean.is_empty() && self.cwd.as_deref() != Some(&clean) {
+                        self.cwd = Some(clean);
+                        return true;
+                    }
+                }
+            }
+        }
+
+        if let Some(rest) = osc.strip_prefix("133;") {
+            if rest.starts_with('A') {
+                if self.running {
+                    self.running = false;
+                    return true;
+                }
+            } else if rest.starts_with('C') {
+                if !self.running {
+                    self.running = true;
+                    return true;
+                }
+            } else if let Some(done_rest) = rest.strip_prefix('D') {
+                let code = done_rest
+                    .strip_prefix(';')
+                    .and_then(|s| s.split(';').next())
+                    .and_then(|s| s.trim().parse::<i32>().ok());
+                let prev_running = self.running;
+                let prev_code = self.last_exit_code;
+                self.running = false;
+                if code.is_some() {
+                    self.last_exit_code = code;
+                }
+                return prev_running || prev_code != self.last_exit_code;
+            }
+        }
+
+        if let Some(title) = osc.strip_prefix("0;").or_else(|| osc.strip_prefix("2;")) {
+            let trimmed = title.trim();
+            if !trimmed.is_empty() {
+                let mut changed = false;
+                if self.title.as_deref() != Some(trimmed) {
+                    self.title = Some(trimmed.to_string());
+                    changed = true;
+                }
+                if let Some((_, dir_part)) = trimmed.split_once(": ") {
+                    let dir = dir_part.trim();
+                    if (dir.starts_with('/') || dir.starts_with('~'))
+                        && self.cwd.as_deref() != Some(dir)
+                    {
+                        self.cwd = Some(dir.to_string());
+                        changed = true;
+                    }
+                }
+                if self.running {
+                    self.running = false;
+                    changed = true;
+                }
+                return changed;
+            }
+        }
+
+        false
+    }
+}
+
+fn percent_decode(input: &str) -> String {
+    let bytes = input.as_bytes();
+    let mut out = Vec::with_capacity(bytes.len());
+    let mut i = 0;
+    while i < bytes.len() {
+        if bytes[i] == b'%' && i + 2 < bytes.len() {
+            if let (Some(h), Some(l)) = (
+                (bytes[i + 1] as char).to_digit(16),
+                (bytes[i + 2] as char).to_digit(16),
+            ) {
+                out.push(((h << 4) | l) as u8);
+                i += 3;
+                continue;
+            }
+        }
+        out.push(bytes[i]);
+        i += 1;
+    }
+    String::from_utf8_lossy(&out).to_string()
+}
+
+fn strip_terminal_queries(data: &[u8]) -> Vec<u8> {
+    const QUERIES: &[&[u8]] = &[
+        b"\x1b[c",
+        b"\x1b[0c",
+        b"\x1b[>c",
+        b"\x1b[>0c",
+        b"\x1b[=c",
+        b"\x1b[=0c",
+        b"\x1b[5n",
+        b"\x1b[6n",
+        b"\x1b[?6n",
+    ];
+    let mut out = Vec::with_capacity(data.len());
+    let mut i = 0;
+    'outer: while i < data.len() {
+        if data[i] == 0x1b {
+            for q in QUERIES {
+                if data[i..].starts_with(q) {
+                    i += q.len();
+                    continue 'outer;
+                }
+            }
+        }
+        out.push(data[i]);
+        i += 1;
+    }
+    out
+}
+
+pub fn looks_like_interactive_prompt(line: &str) -> bool {
+    let lower = line.trim().to_lowercase();
+    if lower.is_empty() {
+        return false;
+    }
+    let patterns = [
+        "[y/n]",
+        "[yes/no]",
+        "(y/n)",
+        "(yes/no",
+        "continue?",
+        "proceed?",
+        "password:",
+        "password for",
+        "passphrase",
+        "enter ",
+        "press enter",
+        "overwrite",
+        "are you sure",
+        "请确认",
+        "请输入",
+    ];
+    if patterns.iter().any(|p| lower.contains(p)) {
+        return true;
+    }
+    (lower.ends_with('?') || lower.ends_with(':')) && !looks_like_shell_prompt(line)
+}
+
+pub fn looks_like_shell_prompt(line: &str) -> bool {
+    let t = line.trim();
+    if t.is_empty() {
+        return false;
+    }
+    if t.starts_with("PS ") && t.ends_with('>') {
+        return true;
+    }
+    if (t.contains('@') || t.starts_with('[') || t.contains(":~") || t.contains(":/"))
+        && (t.ends_with('#') || t.ends_with('$') || t.ends_with('%'))
+    {
+        return true;
+    }
+    t.ends_with(":~#") || t.ends_with(":~$") || t == "#" || t == "$"
+}
+
+pub struct PaneHandle {
+    pub id: String,
+    pub host_id: String,
+    pub state: Arc<Mutex<PaneInternalState>>,
+    pub cmd_tx: mpsc::UnboundedSender<PaneCommand>,
+    pub broadcast_tx: broadcast::Sender<PaneBroadcast>,
+}
+
+impl PaneHandle {
+    pub fn snapshot_meta(&self) -> PaneMeta {
+        let guard = self.state.lock().unwrap();
+        PaneMeta {
+            id: self.id.clone(),
+            host_id: self.host_id.clone(),
+            cols: guard.cols,
+            rows: guard.rows,
+            cwd: guard.cwd.clone(),
+            title: guard.title.clone(),
+            running: guard.running,
+            last_exit_code: guard.last_exit_code,
+            bracketed_paste: guard.bracketed_paste_enabled(),
+            headless: guard.headless,
+            exited: guard.exited,
+        }
+    }
+
+    pub fn replay_bytes(&self) -> Vec<u8> {
+        let guard = self.state.lock().unwrap();
+        let (a, b) = guard.ring_buffer.as_slices();
+        let mut out = Vec::with_capacity(a.len() + b.len());
+        out.extend_from_slice(a);
+        out.extend_from_slice(b);
+        out
+    }
+
+    pub fn read_screen_snapshot(&self, lines: usize) -> ScreenSnapshot {
+        let guard = self.state.lock().unwrap();
+        let (screen, cursor_line) = guard.read_screen_grid(lines);
+        let state_str = if guard.exited {
+            "exited"
+        } else if looks_like_interactive_prompt(&cursor_line) {
+            "waiting_input"
+        } else if looks_like_shell_prompt(&cursor_line) || !guard.running {
+            "idle"
+        } else {
+            "running"
+        };
+        ScreenSnapshot {
+            pane_id: self.id.clone(),
+            host_id: self.host_id.clone(),
+            state: state_str.to_string(),
+            cursor_line,
+            screen,
+            cwd: guard.cwd.clone(),
+            last_exit_code: guard.last_exit_code,
+            headless: guard.headless,
+            exited: guard.exited,
+        }
+    }
+
+    /// 向 PTY 发送输入并智能等待：
+    /// - 若命令执行完毕回到提示符，立即返回 `idle`；
+    /// - 若脚本中途停在 `[Y/n]` / `yes/no` / `password:` 等交互提问超过 600ms，立即返回 `waiting_input`（绝不卡死！）。
+    pub async fn send_and_wait(
+        &self,
+        bytes: Vec<u8>,
+        max_lines: usize,
+        wait_ms: u64,
+    ) -> ScreenSnapshot {
+        let seq_before = self.state.lock().unwrap().output_seq;
+        let _ = self.cmd_tx.send(PaneCommand::Input(bytes));
+
+        let deadline = Instant::now() + Duration::from_millis(wait_ms.clamp(200, 60_000));
+        loop {
+            tokio::time::sleep(Duration::from_millis(80)).await;
+            let (exited, seq_now, quiet_ms, running, cursor_line) = {
+                let g = self.state.lock().unwrap();
+                let (_, cl) = g.read_screen_grid(5);
+                (
+                    g.exited,
+                    g.output_seq,
+                    g.last_output_at.elapsed().as_millis() as u64,
+                    g.running,
+                    cl,
+                )
+            };
+
+            if exited {
+                break;
+            }
+            if seq_now > seq_before {
+                if looks_like_interactive_prompt(&cursor_line) && quiet_ms >= 550 {
+                    break;
+                }
+                if (!running || looks_like_shell_prompt(&cursor_line)) && quiet_ms >= 350 {
+                    break;
+                }
+            }
+            if Instant::now() >= deadline {
+                break;
+            }
+        }
+
+        self.read_screen_snapshot(max_lines)
+    }
+}
+
+pub struct TerminalManager {
+    panes: Mutex<HashMap<String, Arc<PaneHandle>>>,
+    ui_events_tx: broadcast::Sender<UiEvent>,
+}
+
+impl Default for TerminalManager {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl TerminalManager {
+    pub fn new() -> Self {
+        let (ui_events_tx, _) = broadcast::channel(128);
+        Self {
+            panes: Mutex::new(HashMap::new()),
+            ui_events_tx,
+        }
+    }
+
+    pub fn subscribe_ui_events(&self) -> broadcast::Receiver<UiEvent> {
+        self.ui_events_tx.subscribe()
+    }
+
+    pub fn notify_show_main_window(&self) {
+        let _ = self.ui_events_tx.send(UiEvent::ShowMainWindow);
+    }
+
+    pub fn list_panes(&self, host_id_filter: Option<&str>, include_headless: bool) -> Vec<PaneMeta> {
+        let guard = self.panes.lock().unwrap();
+        guard
+            .values()
+            .filter(|p| host_id_filter.map(|h| p.host_id == h).unwrap_or(true))
+            .map(|p| p.snapshot_meta())
+            .filter(|m| include_headless || !m.headless)
+            .collect()
+    }
+
+    pub fn get_pane(&self, pane_id: &str) -> Option<Arc<PaneHandle>> {
+        let guard = self.panes.lock().unwrap();
+        guard.get(pane_id).cloned()
+    }
+
+    pub fn find_active_pane_for_host(&self, host_id: &str) -> Option<Arc<PaneHandle>> {
+        let guard = self.panes.lock().unwrap();
+        guard
+            .values()
+            .find(|p| p.host_id == host_id && !p.state.lock().unwrap().exited)
+            .cloned()
+    }
+
+    /// 将一个无头终端（或已存在的终端）唤起到前端界面，供用户亲自输入隐私密码或手动操作
+    pub fn reveal_pane_in_ui(&self, pane_id: &str, reason: Option<String>) -> Option<PaneMeta> {
+        let pane = self.get_pane(pane_id)?;
+        {
+            let mut g = pane.state.lock().unwrap();
+            g.headless = false;
+        }
+        let meta = pane.snapshot_meta();
+        let _ = self.ui_events_tx.send(UiEvent::RevealTerminal {
+            host_id: pane.host_id.clone(),
+            pane: meta.clone(),
+            reason,
+        });
+        Some(meta)
+    }
+
+    pub fn close_pane(&self, pane_id: &str) -> bool {
+        let removed = {
+            let mut guard = self.panes.lock().unwrap();
+            guard.remove(pane_id)
+        };
+        if let Some(pane) = removed {
+            let _ = pane.cmd_tx.send(PaneCommand::Close);
+            true
+        } else {
+            false
+        }
+    }
+
+    pub async fn create_pane(
+        &self,
+        pool: &SshPool,
+        db: &Database,
+        host_id: &str,
+        cols: u16,
+        rows: u16,
+        initial_cwd: Option<String>,
+        headless: bool,
+    ) -> Result<PaneMeta> {
+        let cols = cols.clamp(20, 500);
+        let rows = rows.clamp(5, 200);
+        let pane_id = format!("pane_{}", Uuid::new_v4());
+
+        let handle = if host_id == LOCAL_HOST_ID {
+            spawn_local_conpty_pane(
+                pane_id.clone(),
+                host_id.to_string(),
+                cols,
+                rows,
+                initial_cwd,
+                headless,
+            )?
+        } else {
+            spawn_ssh_pty_pane(
+                pool,
+                db,
+                pane_id.clone(),
+                host_id.to_string(),
+                cols,
+                rows,
+                initial_cwd,
+                headless,
+            )
+            .await?
+        };
+
+        let meta = handle.snapshot_meta();
+        {
+            let mut guard = self.panes.lock().unwrap();
+            guard.insert(pane_id, handle);
+        }
+        Ok(meta)
+    }
+}
+
+fn build_meta_from_guard(pane_id: &str, host_id: &str, guard: &PaneInternalState) -> PaneMeta {
+    PaneMeta {
+        id: pane_id.to_string(),
+        host_id: host_id.to_string(),
+        cols: guard.cols,
+        rows: guard.rows,
+        cwd: guard.cwd.clone(),
+        title: guard.title.clone(),
+        running: guard.running,
+        last_exit_code: guard.last_exit_code,
+        bracketed_paste: guard.bracketed_paste_enabled(),
+        headless: guard.headless,
+        exited: guard.exited,
+    }
+}
+
+fn spawn_local_conpty_pane(
+    pane_id: String,
+    host_id: String,
+    cols: u16,
+    rows: u16,
+    initial_cwd: Option<String>,
+    headless: bool,
+) -> Result<Arc<PaneHandle>> {
+    let pty_system = native_pty_system();
+    let pair = pty_system
+        .openpty(PtySize {
+            rows,
+            cols,
+            pixel_width: 0,
+            pixel_height: 0,
+        })
+        .context("创建本机 ConPTY 失败")?;
+
+    let mut cmd = CommandBuilder::new("powershell.exe");
+    let init_hook = r#"$global:__vps_orig_prompt = $function:prompt; function global:prompt { $ec = if ($?) { 0 } else { if ($LASTEXITCODE) { $LASTEXITCODE } else { 1 } }; $p = ($executionContext.SessionState.Path.CurrentLocation.Path -replace '\\','/'); [Console]::Write("$([char]27)]133;D;$ec$([char]7)$([char]27)]7;file://localhost/$p$([char]7)$([char]27)]133;A$([char]7)"); & $global:__vps_orig_prompt }"#;
+    cmd.args(["-NoLogo", "-NoExit", "-Command", init_hook]);
+    cmd.env("TERM", "xterm-256color");
+    cmd.env("TERM_PROGRAM", "vps-switch");
+
+    if let Some(ref cwd) = initial_cwd {
+        cmd.cwd(cwd);
+    } else if let Ok(home) = std::env::var("USERPROFILE") {
+        cmd.cwd(home);
+    }
+
+    let mut child = pair
+        .slave
+        .spawn_command(cmd)
+        .context("启动本机 PowerShell 失败")?;
+    drop(pair.slave);
+
+    let mut reader = pair
+        .master
+        .try_clone_reader()
+        .context("克隆 PTY reader 失败")?;
+    let mut writer = pair.master.take_writer().context("获取 PTY writer 失败")?;
+    let master = pair.master;
+
+    let state = Arc::new(Mutex::new(PaneInternalState::new(
+        cols,
+        rows,
+        initial_cwd,
+        headless,
+    )));
+    let (cmd_tx, mut cmd_rx) = mpsc::unbounded_channel::<PaneCommand>();
+    let (broadcast_tx, _) = broadcast::channel::<PaneBroadcast>(512);
+
+    let handle = Arc::new(PaneHandle {
+        id: pane_id.clone(),
+        host_id: host_id.clone(),
+        state: state.clone(),
+        cmd_tx,
+        broadcast_tx: broadcast_tx.clone(),
+    });
+
+    let state_read = state.clone();
+    let bcast_read = broadcast_tx.clone();
+    let pid_read = pane_id.clone();
+    let hid_read = host_id.clone();
+    std::thread::spawn(move || {
+        let mut buf = [0u8; 8192];
+        loop {
+            match reader.read(&mut buf) {
+                Ok(0) | Err(_) => break,
+                Ok(n) => {
+                    let chunk = buf[..n].to_vec();
+                    let meta_opt = {
+                        let mut guard = state_read.lock().unwrap();
+                        let changed = guard.feed_bytes(&chunk);
+                        if changed {
+                            Some(build_meta_from_guard(&pid_read, &hid_read, &guard))
+                        } else {
+                            None
+                        }
+                    };
+                    let _ = bcast_read.send(PaneBroadcast::Output(chunk));
+                    if let Some(m) = meta_opt {
+                        let _ = bcast_read.send(PaneBroadcast::Meta(m));
+                    }
+                }
+            }
+        }
+
+        let final_meta = {
+            let mut guard = state_read.lock().unwrap();
+            guard.exited = true;
+            guard.running = false;
+            build_meta_from_guard(&pid_read, &hid_read, &guard)
+        };
+        let _ = bcast_read.send(PaneBroadcast::Meta(final_meta));
+    });
+
+    let state_cmd = state.clone();
+    let bcast_cmd = broadcast_tx.clone();
+    tokio::spawn(async move {
+        while let Some(cmd) = cmd_rx.recv().await {
+            match cmd {
+                PaneCommand::Input(bytes) => {
+                    if bytes.contains(&b'\r') || bytes.contains(&b'\n') {
+                        let mut guard = state_cmd.lock().unwrap();
+                        guard.running = true;
+                    }
+                    let _ = writer.write_all(&bytes);
+                    let _ = writer.flush();
+                }
+                PaneCommand::Paste(text) => {
+                    let payload = encode_safe_paste(&state_cmd, &text);
+                    let _ = writer.write_all(&payload);
+                    let _ = writer.flush();
+                }
+                PaneCommand::Resize(c, r) => {
+                    let meta = {
+                        let mut guard = state_cmd.lock().unwrap();
+                        guard.resize(c, r);
+                        build_meta_from_guard(&pane_id, &host_id, &guard)
+                    };
+                    let _ = master.resize(PtySize {
+                        rows: r.max(1),
+                        cols: c.max(2),
+                        pixel_width: 0,
+                        pixel_height: 0,
+                    });
+                    let _ = bcast_cmd.send(PaneBroadcast::Meta(meta));
+                }
+                PaneCommand::Close => {
+                    let _ = child.kill();
+                    break;
+                }
+            }
+        }
+    });
+
+    Ok(handle)
+}
+
+async fn spawn_ssh_pty_pane(
+    pool: &SshPool,
+    db: &Database,
+    pane_id: String,
+    host_id: String,
+    cols: u16,
+    rows: u16,
+    initial_cwd: Option<String>,
+    headless: bool,
+) -> Result<Arc<PaneHandle>> {
+    let (_record, mut channel) = open_host_channel(pool, db, &host_id).await?;
+
+    channel
+        .request_pty(
+            false,
+            "xterm-256color",
+            cols as u32,
+            rows as u32,
+            0,
+            0,
+            &[],
+        )
+        .await
+        .context("请求 SSH PTY 失败")?;
+
+    channel
+        .request_shell(true)
+        .await
+        .context("启动远端 Shell 失败")?;
+
+    let state = Arc::new(Mutex::new(PaneInternalState::new(
+        cols,
+        rows,
+        initial_cwd.or_else(|| Some("~".to_string())),
+        headless,
+    )));
+    let (cmd_tx, mut cmd_rx) = mpsc::unbounded_channel::<PaneCommand>();
+    let (broadcast_tx, _) = broadcast::channel::<PaneBroadcast>(512);
+
+    let handle = Arc::new(PaneHandle {
+        id: pane_id.clone(),
+        host_id: host_id.clone(),
+        state: state.clone(),
+        cmd_tx,
+        broadcast_tx: broadcast_tx.clone(),
+    });
+
+    let state_loop = state.clone();
+    let bcast_loop = broadcast_tx.clone();
+    let pid_loop = pane_id.clone();
+    let hid_loop = host_id.clone();
+
+    tokio::spawn(async move {
+        loop {
+            tokio::select! {
+                msg_opt = channel.wait() => {
+                    match msg_opt {
+                        Some(ChannelMsg::Data { data }) | Some(ChannelMsg::ExtendedData { data, .. }) => {
+                            let chunk = data.to_vec();
+                            let meta_opt = {
+                                let mut guard = state_loop.lock().unwrap();
+                                let changed = guard.feed_bytes(&chunk);
+                                if changed {
+                                    Some(build_meta_from_guard(&pid_loop, &hid_loop, &guard))
+                                } else {
+                                    None
+                                }
+                            };
+                            let _ = bcast_loop.send(PaneBroadcast::Output(chunk));
+                            if let Some(m) = meta_opt {
+                                let _ = bcast_loop.send(PaneBroadcast::Meta(m));
+                            }
+                        }
+                        Some(ChannelMsg::ExitStatus { exit_status }) => {
+                            let mut guard = state_loop.lock().unwrap();
+                            guard.last_exit_code = Some(exit_status as i32);
+                        }
+                        Some(ChannelMsg::Eof) | Some(ChannelMsg::Close) | None => {
+                            break;
+                        }
+                        _ => {}
+                    }
+                }
+                cmd_opt = cmd_rx.recv() => {
+                    match cmd_opt {
+                        Some(PaneCommand::Input(bytes)) => {
+                            if bytes.contains(&b'\r') || bytes.contains(&b'\n') {
+                                let mut guard = state_loop.lock().unwrap();
+                                guard.running = true;
+                            }
+                            if channel.data(&bytes[..]).await.is_err() {
+                                break;
+                            }
+                        }
+                        Some(PaneCommand::Paste(text)) => {
+                            let payload = encode_safe_paste(&state_loop, &text);
+                            if channel.data(&payload[..]).await.is_err() {
+                                break;
+                            }
+                        }
+                        Some(PaneCommand::Resize(c, r)) => {
+                            let meta = {
+                                let mut guard = state_loop.lock().unwrap();
+                                guard.resize(c, r);
+                                build_meta_from_guard(&pid_loop, &hid_loop, &guard)
+                            };
+                            let _ = channel.window_change(c.max(2) as u32, r.max(1) as u32, 0, 0).await;
+                            let _ = bcast_loop.send(PaneBroadcast::Meta(meta));
+                        }
+                        Some(PaneCommand::Close) | None => {
+                            let _ = channel.close().await;
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+
+        let final_meta = {
+            let mut guard = state_loop.lock().unwrap();
+            guard.exited = true;
+            guard.running = false;
+            build_meta_from_guard(&pid_loop, &hid_loop, &guard)
+        };
+        let _ = bcast_loop.send(PaneBroadcast::Meta(final_meta));
+    });
+
+    Ok(handle)
+}
+
+fn encode_safe_paste(state: &Arc<Mutex<PaneInternalState>>, text: &str) -> Vec<u8> {
+    let bracketed = state.lock().unwrap().bracketed_paste_enabled();
+    let sanitized: String = text
+        .chars()
+        .filter(|&c| c != '\x1b' && c != '\0')
+        .collect();
+    if bracketed {
+        let mut out = Vec::with_capacity(sanitized.len() + 12);
+        out.extend_from_slice(b"\x1b[200~");
+        out.extend_from_slice(sanitized.as_bytes());
+        out.extend_from_slice(b"\x1b[201~");
+        out
+    } else {
+        sanitized.into_bytes()
+    }
+}