feat: Add support for Windows ARM64 architecture in build workflows and scripts

- Introduced SettingsActivity to manage server address and token settings.
- Integrated LogStore for logging status updates and messages.
- Updated MainActivity to navigate to SettingsActivity and handle configuration.
- Modified UI in activity_main.xml and activity_settings.xml for improved user experience.
- Adjusted color scheme in colors.xml for better visibility and aesthetics.
- Enhanced string resources in strings.xml for clarity and consistency.
- Refactored notification handling in NotificationHelper.kt to use status labels.
- Updated TunnelService to log status changes and messages.

.gitea/workflows/Create Release.yml

@@ -64,6 +64,20 @@ jobs:
           cache: 'npm'
           cache-dependency-path: web/package-lock.json
 
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: Setup Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v4
+        with:
+          gradle-version: '8.7'
+
       - name: Build frontend
         run: |
           cd web
@@ -75,6 +89,17 @@ jobs:
           echo "Frontend build completed"
           ls -la internal/server/app/dist/
 
+      - name: Build Android release APK
+        run: |
+          cd android
+          gradle --no-daemon assembleRelease
+          cd ..
+          mkdir -p dist
+          cp android/app/build/outputs/apk/release/app-release-unsigned.apk \
+            "dist/gotunnel-android-${{ inputs.version }}-release-unsigned.apk"
+          echo "Android APK build completed"
+          ls -lah dist/gotunnel-android-${{ inputs.version }}-release-unsigned.apk
+
       - name: Build all platforms
         run: |
           mkdir -p dist
@@ -182,6 +207,7 @@ jobs:
             echo "- **Linux (amd64/arm64)**: \`.tar.gz\` files" >> release_notes.md
             echo "- **macOS (amd64/arm64)**: \`.tar.gz\` files" >> release_notes.md
             echo "- **Windows (amd64)**: \`.zip\` files" >> release_notes.md
+            echo "- **Android**: unsigned \`.apk\` file" >> release_notes.md
             echo "" >> release_notes.md
             echo "Verify downloads with \`SHA256SUMS\`" >> release_notes.md
           fi
@@ -197,6 +223,7 @@ jobs:
           files: |-
             dist/*.tar.gz
             dist/*.zip
+            dist/*.apk
             dist/SHA256SUMS
           draft: ${{ inputs.draft }}
           prerelease: ${{ inputs.prerelease }}

.gitea/workflows/build.yaml

@@ -40,6 +40,37 @@ jobs:
           path: web/dist
           retention-days: 1
 
+  build-android-apk:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: Setup Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v4
+        with:
+          gradle-version: '8.7'
+
+      - name: Build Android debug APK
+        working-directory: android
+        run: gradle --no-daemon assembleDebug
+
+      - name: Upload Android APK
+        uses: actions/upload-artifact@v3
+        with:
+          name: gotunnel-android-debug-apk
+          path: android/app/build/outputs/apk/debug/app-debug.apk
+          retention-days: 7
+
   build-binaries:
     needs: build-frontend
     runs-on: golang

.github/workflows/build.yml

@@ -41,6 +41,38 @@ jobs:
           path: web/dist
           retention-days: 1
 
+  android-apk:
+    name: Build Android debug APK
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: Setup Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v4
+        with:
+          gradle-version: '8.7'
+
+      - name: Build debug APK
+        working-directory: android
+        run: gradle --no-daemon assembleDebug
+
+      - name: Upload Android APK artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: gotunnel-android-debug-apk
+          path: android/app/build/outputs/apk/debug/app-debug.apk
+          retention-days: 7
+
   build:
     name: Build ${{ matrix.goos }}/${{ matrix.goarch }}
     needs: frontend
@@ -58,6 +90,9 @@ jobs:
           - runner: windows-latest
             goos: windows
             goarch: amd64
+          - runner: windows-latest
+            goos: windows
+            goarch: arm64
           - runner: macos-latest
             goos: darwin
             goarch: amd64

.github/workflows/release.yml

@@ -50,6 +50,60 @@ jobs:
           path: web/dist
           retention-days: 1
 
+  android-apk:
+    name: Package Android release APK
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Resolve release metadata
+        id: meta
+        shell: bash
+        run: |
+          if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ]; then
+            TAG="${{ github.event.inputs.tag }}"
+          else
+            TAG="${GITHUB_REF_NAME}"
+          fi
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: Setup Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v4
+        with:
+          gradle-version: '8.7'
+
+      - name: Build release APK
+        working-directory: android
+        run: gradle --no-daemon assembleRelease
+
+      - name: Package Android release asset
+        id: package
+        shell: bash
+        run: |
+          mkdir -p dist/out
+          ARCHIVE="gotunnel-android-${{ steps.meta.outputs.tag }}-release-unsigned.apk"
+          cp android/app/build/outputs/apk/release/app-release-unsigned.apk "dist/out/${ARCHIVE}"
+          echo "archive=dist/out/${ARCHIVE}" >> "$GITHUB_OUTPUT"
+
+      - name: Upload Android release artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-android-apk
+          path: ${{ steps.package.outputs.archive }}
+          retention-days: 1
+
   build-assets:
     name: Package ${{ matrix.component }} ${{ matrix.goos }}/${{ matrix.goarch }}
     needs: frontend
@@ -98,6 +152,14 @@ jobs:
             goos: windows
             goarch: amd64
             archive_ext: zip
+          - component: server
+            goos: windows
+            goarch: arm64
+            archive_ext: zip
+          - component: client
+            goos: windows
+            goarch: arm64
+            archive_ext: zip
 
     steps:
       - name: Checkout code
@@ -176,7 +238,9 @@ jobs:
 
   publish:
     name: Publish release
-    needs: build-assets
+    needs:
+      - build-assets
+      - android-apk
     runs-on: ubuntu-latest
     steps:
       - name: Download packaged assets

AGENTS.md

@@ -59,7 +59,7 @@ pkg/
   ├── relay/         # Bidirectional data relay (32KB buffers)
   ├── auth/          # JWT authentication
   ├── utils/         # Port availability checking
-  ├── version/       # Version info and update checking (Gitea API)
+  ├── version/       # Version info and update checking (GitHub Releases API)
   └── update/        # Shared update logic (download, extract tar.gz/zip)
 web/                 # Vue 3 + TypeScript frontend (Vite + naive-ui)
 scripts/             # Build scripts (build.sh, build.ps1)
@@ -106,7 +106,7 @@ The server provides Swagger-documented REST APIs at `/api/`.
 
 ## Update System
 
-Both server and client support self-update from Gitea releases.
+Both server and client support self-update from GitHub releases.
 
 - Release assets are compressed archives (`.tar.gz` for Linux/Mac, `.zip` for Windows)
 - The `pkg/update/` package handles download, extraction, and binary replacement

CLAUDE.md

@@ -59,7 +59,7 @@ pkg/
   ├── relay/         # Bidirectional data relay (32KB buffers)
   ├── auth/          # JWT authentication
   ├── utils/         # Port availability checking
-  ├── version/       # Version info and update checking (Gitea API)
+  ├── version/       # Version info and update checking (GitHub Releases API)
   └── update/        # Shared update logic (download, extract tar.gz/zip)
 web/                 # Vue 3 + TypeScript frontend (Vite + naive-ui)
 scripts/             # Build scripts (build.sh, build.ps1)
@@ -106,7 +106,7 @@ The server provides Swagger-documented REST APIs at `/api/`.
 
 ## Update System
 
-Both server and client support self-update from Gitea releases.
+Both server and client support self-update from GitHub releases.
 
 - Release assets are compressed archives (`.tar.gz` for Linux/Mac, `.zip` for Windows)
 - The `pkg/update/` package handles download, extraction, and binary replacement

Makefile

@@ -1,16 +1,13 @@
 # GoTunnel Makefile
 
-.PHONY: all build-frontend sync-frontend build-server build-client clean help
+.PHONY: all build-frontend sync-frontend sync-only build-server build-client build-all-platforms build-current-platform build-android clean help
 
-# 默认目标
+all: build-frontend sync-frontend build-current-platform
-all: build-frontend sync-frontend build-server build-client
 
-# 构建前端
 build-frontend:
 	@echo "Building frontend..."
 	cd web && npm ci && npm run build
 
-# 同步前端到 embed 目录
 sync-frontend:
 	@echo "Syncing frontend to embed directory..."
 ifeq ($(OS),Windows_NT)
@@ -21,7 +18,6 @@ else
 	cp -r web/dist internal/server/app/dist
 endif
 
-# 仅同步（不重新构建前端）
 sync-only:
 	@echo "Syncing existing frontend build..."
 ifeq ($(OS),Windows_NT)
@@ -32,33 +28,38 @@ else
 	cp -r web/dist internal/server/app/dist
 endif
 
-# 构建服务端（当前平台）
 build-server:
-	@echo "Building server..."
+	@echo "Building server for current platform..."
-	go build -ldflags="-s -w" -o gotunnel-server ./cmd/server
+	go build -buildvcs=false -trimpath -ldflags="-s -w" -o gotunnel-server ./cmd/server
 
-# 构建客户端（当前平台）
 build-client:
-	@echo "Building client..."
+	@echo "Building client for current platform..."
-	go build -ldflags="-s -w" -o gotunnel-client ./cmd/client
+	go build -buildvcs=false -trimpath -ldflags="-s -w" -o gotunnel-client ./cmd/client
 
-# 构建 Linux ARM64 服务端
+build-current-platform:
-build-server-linux-arm64: sync-only
+	@echo "Building current platform binaries..."
-	@echo "Building server for Linux ARM64..."
+ifeq ($(OS),Windows_NT)
-	GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build -ldflags="-s -w" -o gotunnel-server-linux-arm64 ./cmd/server
+	powershell -ExecutionPolicy Bypass -File scripts/build.ps1 current
+else
+	./scripts/build.sh current
+endif
 
-# 构建 Linux AMD64 服务端
+build-all-platforms:
-build-server-linux-amd64: sync-only
+	@echo "Building all desktop platform binaries..."
-	@echo "Building server for Linux AMD64..."
+ifeq ($(OS),Windows_NT)
-	GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags="-s -w" -o gotunnel-server-linux-amd64 ./cmd/server
+	powershell -ExecutionPolicy Bypass -File scripts/build.ps1 all -NoUPX
+else
+	./scripts/build.sh all
+endif
 
-# 完整构建（包含前端）
+build-android:
-full-build: build-frontend sync-frontend build-server build-client
+	@echo "Android build placeholder..."
+ifeq ($(OS),Windows_NT)
+	powershell -ExecutionPolicy Bypass -File scripts/build.ps1 android
+else
+	./scripts/build.sh android
+endif
 
-# 开发模式：快速构建（假设前端已构建）
-dev-build: sync-only build-server
-
-# 清理构建产物
 clean:
 	@echo "Cleaning..."
 ifeq ($(OS),Windows_NT)
@@ -68,21 +69,21 @@ ifeq ($(OS),Windows_NT)
 	if exist gotunnel-client.exe del gotunnel-client.exe
 	if exist gotunnel-server-* del gotunnel-server-*
 	if exist gotunnel-client-* del gotunnel-client-*
+	if exist build rmdir /s /q build
 else
 	rm -f gotunnel-server gotunnel-client gotunnel-server-* gotunnel-client-*
+	rm -rf build
 endif
 
-# 帮助
 help:
 	@echo "Available targets:"
-	@echo "  all                    - Build frontend, sync, and build binaries"
+	@echo "  all                    - Build frontend, sync, and current platform binaries"
 	@echo "  build-frontend         - Build frontend (npm)"
 	@echo "  sync-frontend          - Sync web/dist to internal/server/app/dist"
 	@echo "  sync-only              - Sync without rebuilding frontend"
 	@echo "  build-server           - Build server for current platform"
 	@echo "  build-client           - Build client for current platform"
-	@echo "  build-server-linux-arm64 - Cross-compile server for Linux ARM64"
+	@echo "  build-current-platform - Build server/client into build/<os>_<arch>/"
-	@echo "  build-server-linux-amd64 - Cross-compile server for Linux AMD64"
+	@echo "  build-all-platforms    - Build Windows/Linux/macOS server/client binaries"
-	@echo "  full-build             - Complete build with frontend"
+	@echo "  build-android          - Android build placeholder"
-	@echo "  dev-build              - Quick build (assumes frontend exists)"
 	@echo "  clean                  - Remove build artifacts"

android/.gitignore

@@ -0,0 +1,5 @@
+/.gradle
+/build
+/app/build
+/local.properties
+/captures

android/README.md

@@ -0,0 +1,27 @@
+# GoTunnel Android Host
+
+This directory contains a minimal Android Studio / Gradle project skeleton for the GoTunnel Android host app.
+
+## What is included
+
+- Foreground service shell for keeping the tunnel process alive
+- Boot receiver for auto-start on device reboot
+- Network recovery helper for reconnect/restart triggers
+- Basic configuration screen for server address and token
+- Notification channel and ongoing service notification
+- A stub bridge layer that can later be replaced with a gomobile/native Go core binding
+
+## Current status
+
+The Go tunnel core is not wired into Android yet. `GoTunnelBridge` returns a stub controller so the app structure can be developed independently from the Go runtime integration.
+
+## Open in Android Studio
+
+Open the `android/` folder as a Gradle project. Android Studio can sync it directly and generate a wrapper if you want to build from the command line later.
+
+## Notes
+
+- The foreground service is marked as `dataSync` and starts in sticky mode.
+- Auto-start is controlled by the saved configuration.
+- Network restoration currently triggers a restart hook in the stub controller.
+- Replace the stub bridge with a native binding when the Go client core is exported for Android.

android/app/build.gradle.kts

@@ -0,0 +1,48 @@
+plugins {
+    id("com.android.application")
+    id("org.jetbrains.kotlin.android")
+}
+
+android {
+    namespace = "com.gotunnel.android"
+    compileSdk = 34
+
+    defaultConfig {
+        applicationId = "com.gotunnel.android"
+        minSdk = 24
+        targetSdk = 34
+        versionCode = 1
+        versionName = "0.1.0"
+    }
+
+    buildTypes {
+        release {
+            isMinifyEnabled = false
+            proguardFiles(
+                getDefaultProguardFile("proguard-android-optimize.txt"),
+                "proguard-rules.pro",
+            )
+        }
+    }
+
+    compileOptions {
+        sourceCompatibility = JavaVersion.VERSION_17
+        targetCompatibility = JavaVersion.VERSION_17
+    }
+
+    kotlinOptions {
+        jvmTarget = "17"
+    }
+
+    buildFeatures {
+        viewBinding = true
+    }
+}
+
+dependencies {
+    implementation("androidx.appcompat:appcompat:1.7.0")
+    implementation("androidx.core:core-ktx:1.13.1")
+    implementation("androidx.activity:activity-ktx:1.9.2")
+    implementation("com.google.android.material:material:1.12.0")
+    implementation("org.jetbrains.kotlinx:kotlinx-coroutines-android:1.8.1")
+}

android/app/proguard-rules.pro

@@ -0,0 +1,2 @@
+# Placeholder rules for the Android host shell.
+# Add Go bridge / native binding rules here when the core integration is introduced.

android/app/src/main/AndroidManifest.xml

@@ -0,0 +1,51 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
+    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_DATA_SYNC" />
+    <uses-permission android:name="android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS" />
+
+    <application
+        android:name=".GoTunnelApp"
+        android:allowBackup="true"
+        android:icon="@drawable/ic_gotunnel_app"
+        android:label="@string/app_name"
+        android:roundIcon="@drawable/ic_gotunnel_app"
+        android:supportsRtl="true"
+        android:theme="@style/Theme.GoTunnel">
+
+        <activity
+            android:name=".MainActivity"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+
+        <activity
+            android:name=".SettingsActivity"
+            android:exported="false" />
+
+        <service
+            android:name=".service.TunnelService"
+            android:exported="false"
+            android:foregroundServiceType="dataSync"
+            android:stopWithTask="false" />
+
+        <receiver
+            android:name=".service.BootReceiver"
+            android:enabled="true"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.BOOT_COMPLETED" />
+                <action android:name="android.intent.action.MY_PACKAGE_REPLACED" />
+            </intent-filter>
+        </receiver>
+    </application>
+
+</manifest>

android/app/src/main/java/com/gotunnel/android/GoTunnelApp.kt

@@ -0,0 +1,11 @@
+package com.gotunnel.android
+
+import android.app.Application
+import com.gotunnel.android.service.NotificationHelper
+
+class GoTunnelApp : Application() {
+    override fun onCreate() {
+        super.onCreate()
+        NotificationHelper.ensureChannel(this)
+    }
+}

android/app/src/main/java/com/gotunnel/android/MainActivity.kt

@@ -0,0 +1,132 @@
+package com.gotunnel.android
+
+import android.Manifest
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.os.Bundle
+import android.widget.Toast
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.appcompat.app.AppCompatActivity
+import androidx.core.content.ContextCompat
+import com.gotunnel.android.bridge.TunnelStatus
+import com.gotunnel.android.config.ConfigStore
+import com.gotunnel.android.config.LogStore
+import com.gotunnel.android.config.ServiceStateStore
+import com.gotunnel.android.databinding.ActivityMainBinding
+import com.gotunnel.android.service.TunnelService
+import java.text.DateFormat
+import java.util.Date
+
+class MainActivity : AppCompatActivity() {
+    private lateinit var binding: ActivityMainBinding
+    private lateinit var configStore: ConfigStore
+    private lateinit var stateStore: ServiceStateStore
+    private lateinit var logStore: LogStore
+
+    private val notificationPermissionLauncher =
+        registerForActivityResult(ActivityResultContracts.RequestPermission()) { granted ->
+            if (!granted) {
+                Toast.makeText(this, R.string.notification_permission_denied, Toast.LENGTH_SHORT).show()
+            }
+        }
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        requestNotificationPermissionIfNeeded()
+
+        binding = ActivityMainBinding.inflate(layoutInflater)
+        setContentView(binding.root)
+
+        configStore = ConfigStore(this)
+        stateStore = ServiceStateStore(this)
+        logStore = LogStore(this)
+
+        binding.topToolbar.setNavigationOnClickListener {
+            startActivity(Intent(this, SettingsActivity::class.java))
+        }
+
+        binding.startButton.setOnClickListener {
+            val config = configStore.load()
+            if (config.serverAddress.isBlank() || config.token.isBlank()) {
+                Toast.makeText(this, R.string.config_missing, Toast.LENGTH_SHORT).show()
+                startActivity(Intent(this, SettingsActivity::class.java))
+                return@setOnClickListener
+            }
+
+            ContextCompat.startForegroundService(
+                this,
+                TunnelService.createStartIntent(this, "manual-start"),
+            )
+            Toast.makeText(this, R.string.service_start_requested, Toast.LENGTH_SHORT).show()
+        }
+
+        binding.stopButton.setOnClickListener {
+            ContextCompat.startForegroundService(
+                this,
+                TunnelService.createStopIntent(this, "manual-stop"),
+            )
+            Toast.makeText(this, R.string.service_stop_requested, Toast.LENGTH_SHORT).show()
+        }
+    }
+
+    override fun onResume() {
+        super.onResume()
+        renderScreen()
+    }
+
+    private fun renderScreen() {
+        val config = configStore.load()
+        val state = stateStore.load()
+        val timestamp = if (state.updatedAt > 0L) {
+            DateFormat.getDateTimeInstance().format(Date(state.updatedAt))
+        } else {
+            getString(R.string.state_never_updated)
+        }
+
+        binding.statusValue.text = getStatusLabel(state.status)
+        binding.statusDetail.text = state.detail.ifBlank { getString(R.string.state_no_detail) }
+        binding.stateMeta.text = getString(R.string.state_meta_format, timestamp)
+        binding.stateHint.text = getStateHint(state.status)
+        binding.serverSummary.text = if (config.serverAddress.isBlank()) {
+            getString(R.string.status_server_unconfigured)
+        } else {
+            getString(R.string.status_server_configured, config.serverAddress)
+        }
+        binding.logValue.text = logStore.render()
+    }
+
+    private fun getStatusLabel(status: TunnelStatus): String {
+        return when (status) {
+            TunnelStatus.RUNNING -> getString(R.string.status_running)
+            TunnelStatus.STARTING -> getString(R.string.status_starting)
+            TunnelStatus.RECONNECTING -> getString(R.string.status_reconnecting)
+            TunnelStatus.ERROR -> getString(R.string.status_error)
+            TunnelStatus.STOPPED -> getString(R.string.status_stopped)
+        }
+    }
+
+    private fun getStateHint(status: TunnelStatus): String {
+        val messageId = when (status) {
+            TunnelStatus.RUNNING -> R.string.state_hint_running
+            TunnelStatus.STARTING -> R.string.state_hint_starting
+            TunnelStatus.RECONNECTING -> R.string.state_hint_reconnecting
+            TunnelStatus.ERROR -> R.string.state_hint_error
+            TunnelStatus.STOPPED -> R.string.state_hint_stopped
+        }
+        return getString(messageId)
+    }
+
+    private fun requestNotificationPermissionIfNeeded() {
+        if (android.os.Build.VERSION.SDK_INT < android.os.Build.VERSION_CODES.TIRAMISU) {
+            return
+        }
+
+        val granted = ContextCompat.checkSelfPermission(
+            this,
+            Manifest.permission.POST_NOTIFICATIONS,
+        ) == PackageManager.PERMISSION_GRANTED
+        if (!granted) {
+            notificationPermissionLauncher.launch(Manifest.permission.POST_NOTIFICATIONS)
+        }
+    }
+}

android/app/src/main/java/com/gotunnel/android/SettingsActivity.kt

@@ -0,0 +1,70 @@
+package com.gotunnel.android
+
+import android.content.Intent
+import android.net.Uri
+import android.os.Bundle
+import android.os.PowerManager
+import android.provider.Settings
+import android.widget.Toast
+import androidx.appcompat.app.AppCompatActivity
+import com.gotunnel.android.config.AppConfig
+import com.gotunnel.android.config.ConfigStore
+import com.gotunnel.android.databinding.ActivitySettingsBinding
+
+class SettingsActivity : AppCompatActivity() {
+    private lateinit var binding: ActivitySettingsBinding
+    private lateinit var configStore: ConfigStore
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+
+        binding = ActivitySettingsBinding.inflate(layoutInflater)
+        setContentView(binding.root)
+
+        configStore = ConfigStore(this)
+        populateForm(configStore.load())
+
+        binding.topToolbar.setNavigationOnClickListener {
+            finish()
+        }
+
+        binding.saveButton.setOnClickListener {
+            configStore.save(readForm())
+            Toast.makeText(this, R.string.config_saved, Toast.LENGTH_SHORT).show()
+            finish()
+        }
+
+        binding.batteryButton.setOnClickListener {
+            openBatteryOptimizationSettings()
+        }
+    }
+
+    private fun populateForm(config: AppConfig) {
+        binding.serverAddressInput.setText(config.serverAddress)
+        binding.tokenInput.setText(config.token)
+        binding.autoStartSwitch.isChecked = config.autoStart
+        binding.autoReconnectSwitch.isChecked = config.autoReconnect
+    }
+
+    private fun readForm(): AppConfig {
+        return AppConfig(
+            serverAddress = binding.serverAddressInput.text?.toString().orEmpty().trim(),
+            token = binding.tokenInput.text?.toString().orEmpty().trim(),
+            autoStart = binding.autoStartSwitch.isChecked,
+            autoReconnect = binding.autoReconnectSwitch.isChecked,
+        )
+    }
+
+    private fun openBatteryOptimizationSettings() {
+        val powerManager = getSystemService(PowerManager::class.java)
+        if (powerManager != null && powerManager.isIgnoringBatteryOptimizations(packageName)) {
+            Toast.makeText(this, R.string.battery_optimization_already_disabled, Toast.LENGTH_SHORT).show()
+            return
+        }
+
+        val intent = Intent(Settings.ACTION_REQUEST_IGNORE_BATTERY_OPTIMIZATIONS).apply {
+            data = Uri.parse("package:$packageName")
+        }
+        startActivity(intent)
+    }
+}

android/app/src/main/java/com/gotunnel/android/bridge/GoTunnelBridge.kt

@@ -0,0 +1,10 @@
+package com.gotunnel.android.bridge
+
+import android.content.Context
+
+object GoTunnelBridge {
+    fun create(context: Context): TunnelController {
+        // Stub bridge for the Android shell. Replace with a native Go binding later.
+        return StubTunnelController(context.applicationContext)
+    }
+}

android/app/src/main/java/com/gotunnel/android/bridge/StubTunnelController.kt

@@ -0,0 +1,64 @@
+package com.gotunnel.android.bridge
+
+import android.content.Context
+import com.gotunnel.android.config.AppConfig
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.isActive
+import kotlinx.coroutines.launch
+
+class StubTunnelController(
+    @Suppress("unused") private val context: Context,
+) : TunnelController {
+    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.Main.immediate)
+    private var listener: TunnelController.Listener? = null
+    private var config: AppConfig = AppConfig()
+    private var job: Job? = null
+
+    override val isRunning: Boolean
+        get() = job?.isActive == true
+
+    override fun setListener(listener: TunnelController.Listener?) {
+        this.listener = listener
+    }
+
+    override fun updateConfig(config: AppConfig) {
+        this.config = config
+    }
+
+    override fun start(config: AppConfig) {
+        updateConfig(config)
+        if (isRunning) {
+            listener?.onLog("Stub tunnel already running")
+            return
+        }
+
+        job = scope.launch {
+            listener?.onStatusChanged(TunnelStatus.STARTING, "Preparing tunnel session")
+            delay(400)
+            listener?.onLog("Stub tunnel prepared for ${config.serverAddress}")
+            listener?.onStatusChanged(TunnelStatus.RUNNING, "Waiting for native Go core")
+
+            while (isActive) {
+                delay(30_000)
+                listener?.onLog("Stub keepalive tick for ${this@StubTunnelController.config.serverAddress}")
+            }
+        }
+    }
+
+    override fun stop(reason: String) {
+        listener?.onLog("Stub tunnel stop requested: $reason")
+        job?.cancel()
+        job = null
+        listener?.onStatusChanged(TunnelStatus.STOPPED, reason)
+    }
+
+    override fun restart(reason: String) {
+        listener?.onStatusChanged(TunnelStatus.RECONNECTING, reason)
+        stop(reason)
+        start(config)
+    }
+}

android/app/src/main/java/com/gotunnel/android/bridge/TunnelController.kt

@@ -0,0 +1,26 @@
+package com.gotunnel.android.bridge
+
+import com.gotunnel.android.config.AppConfig
+
+enum class TunnelStatus {
+    STOPPED,
+    STARTING,
+    RUNNING,
+    RECONNECTING,
+    ERROR,
+}
+
+interface TunnelController {
+    interface Listener {
+        fun onStatusChanged(status: TunnelStatus, detail: String = "")
+        fun onLog(message: String)
+    }
+
+    val isRunning: Boolean
+
+    fun setListener(listener: Listener?)
+    fun updateConfig(config: AppConfig)
+    fun start(config: AppConfig)
+    fun stop(reason: String = "manual")
+    fun restart(reason: String = "manual")
+}

android/app/src/main/java/com/gotunnel/android/config/AppConfig.kt

@@ -0,0 +1,8 @@
+package com.gotunnel.android.config
+
+data class AppConfig(
+    val serverAddress: String = "",
+    val token: String = "",
+    val autoStart: Boolean = true,
+    val autoReconnect: Boolean = true,
+)

android/app/src/main/java/com/gotunnel/android/config/ConfigStore.kt

@@ -0,0 +1,35 @@
+package com.gotunnel.android.config
+
+import android.content.Context
+
+class ConfigStore(context: Context) {
+    private val prefs = context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
+
+    fun load(): AppConfig {
+        return AppConfig(
+            serverAddress = prefs.getString(KEY_SERVER_ADDRESS, "") ?: "",
+            token = prefs.getString(KEY_TOKEN, "") ?: "",
+            autoStart = prefs.getBoolean(KEY_AUTO_START, true),
+            autoReconnect = prefs.getBoolean(KEY_AUTO_RECONNECT, true),
+        )
+    }
+
+    fun save(config: AppConfig) {
+        prefs.edit()
+            .putString(KEY_SERVER_ADDRESS, config.serverAddress)
+            .putString(KEY_TOKEN, config.token)
+            .putBoolean(KEY_AUTO_START, config.autoStart)
+            .putBoolean(KEY_AUTO_RECONNECT, config.autoReconnect)
+            .remove(KEY_USE_TLS)
+            .apply()
+    }
+
+    companion object {
+        private const val PREFS_NAME = "gotunnel_config"
+        private const val KEY_SERVER_ADDRESS = "server_address"
+        private const val KEY_TOKEN = "token"
+        private const val KEY_AUTO_START = "auto_start"
+        private const val KEY_AUTO_RECONNECT = "auto_reconnect"
+        private const val KEY_USE_TLS = "use_tls"
+    }
+}

android/app/src/main/java/com/gotunnel/android/config/LogStore.kt

@@ -0,0 +1,52 @@
+package com.gotunnel.android.config
+
+import android.content.Context
+import java.text.SimpleDateFormat
+import java.util.Date
+import java.util.Locale
+
+class LogStore(context: Context) {
+    private val prefs = context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
+
+    fun append(message: String) {
+        if (message.isBlank()) {
+            return
+        }
+
+        val current = load().toMutableList()
+        current += "${timestamp()}  $message"
+        while (current.size > MAX_LINES) {
+            current.removeAt(0)
+        }
+
+        prefs.edit().putString(KEY_LOGS, current.joinToString(SEPARATOR)).apply()
+    }
+
+    fun load(): List<String> {
+        val raw = prefs.getString(KEY_LOGS, "") ?: ""
+        if (raw.isBlank()) {
+            return emptyList()
+        }
+        return raw.split(SEPARATOR).filter { it.isNotBlank() }
+    }
+
+    fun render(): String {
+        val lines = load()
+        return if (lines.isEmpty()) {
+            "No logs yet."
+        } else {
+            lines.joinToString("\n")
+        }
+    }
+
+    private fun timestamp(): String {
+        return SimpleDateFormat("HH:mm:ss", Locale.getDefault()).format(Date())
+    }
+
+    companion object {
+        private const val PREFS_NAME = "gotunnel_logs"
+        private const val KEY_LOGS = "logs"
+        private const val MAX_LINES = 80
+        private const val SEPARATOR = "\u0001"
+    }
+}

android/app/src/main/java/com/gotunnel/android/config/ServiceStateStore.kt

@@ -0,0 +1,40 @@
+package com.gotunnel.android.config
+
+import android.content.Context
+import com.gotunnel.android.bridge.TunnelStatus
+
+data class ServiceState(
+    val status: TunnelStatus = TunnelStatus.STOPPED,
+    val detail: String = "",
+    val updatedAt: Long = 0L,
+)
+
+class ServiceStateStore(context: Context) {
+    private val prefs = context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
+
+    fun load(): ServiceState {
+        val statusName = prefs.getString(KEY_STATUS, TunnelStatus.STOPPED.name) ?: TunnelStatus.STOPPED.name
+        val status = runCatching { TunnelStatus.valueOf(statusName) }.getOrDefault(TunnelStatus.STOPPED)
+
+        return ServiceState(
+            status = status,
+            detail = prefs.getString(KEY_DETAIL, "") ?: "",
+            updatedAt = prefs.getLong(KEY_UPDATED_AT, 0L),
+        )
+    }
+
+    fun save(status: TunnelStatus, detail: String) {
+        prefs.edit()
+            .putString(KEY_STATUS, status.name)
+            .putString(KEY_DETAIL, detail)
+            .putLong(KEY_UPDATED_AT, System.currentTimeMillis())
+            .apply()
+    }
+
+    companion object {
+        private const val PREFS_NAME = "gotunnel_state"
+        private const val KEY_STATUS = "status"
+        private const val KEY_DETAIL = "detail"
+        private const val KEY_UPDATED_AT = "updated_at"
+    }
+}

android/app/src/main/java/com/gotunnel/android/service/BootReceiver.kt

@@ -0,0 +1,26 @@
+package com.gotunnel.android.service
+
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import androidx.core.content.ContextCompat
+import com.gotunnel.android.config.ConfigStore
+
+class BootReceiver : BroadcastReceiver() {
+    override fun onReceive(context: Context, intent: Intent) {
+        val action = intent.action ?: return
+        if (action != Intent.ACTION_BOOT_COMPLETED && action != Intent.ACTION_MY_PACKAGE_REPLACED) {
+            return
+        }
+
+        val config = ConfigStore(context).load()
+        if (!config.autoStart) {
+            return
+        }
+
+        ContextCompat.startForegroundService(
+            context,
+            TunnelService.createStartIntent(context, action.lowercase()),
+        )
+    }
+}

android/app/src/main/java/com/gotunnel/android/service/NetworkMonitor.kt

@@ -0,0 +1,52 @@
+package com.gotunnel.android.service
+
+import android.content.Context
+import android.net.ConnectivityManager
+import android.net.Network
+import android.net.NetworkCapabilities
+
+class NetworkMonitor(
+    context: Context,
+    private val onAvailable: () -> Unit,
+    private val onLost: () -> Unit = {},
+) {
+    private val connectivityManager =
+        context.getSystemService(Context.CONNECTIVITY_SERVICE) as ConnectivityManager
+
+    private var registered = false
+
+    private val callback = object : ConnectivityManager.NetworkCallback() {
+        override fun onAvailable(network: Network) {
+            onAvailable()
+        }
+
+        override fun onLost(network: Network) {
+            onLost()
+        }
+    }
+
+    fun start() {
+        if (registered) {
+            return
+        }
+        connectivityManager.registerDefaultNetworkCallback(callback)
+        registered = true
+    }
+
+    fun isConnected(): Boolean {
+        val network = connectivityManager.activeNetwork ?: return false
+        val capabilities = connectivityManager.getNetworkCapabilities(network) ?: return false
+        return capabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET) &&
+            capabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_VALIDATED)
+    }
+
+    fun stop() {
+        if (!registered) {
+            return
+        }
+        runCatching {
+            connectivityManager.unregisterNetworkCallback(callback)
+        }
+        registered = false
+    }
+}

android/app/src/main/java/com/gotunnel/android/service/NotificationHelper.kt

@@ -0,0 +1,106 @@
+package com.gotunnel.android.service
+
+import android.app.Notification
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.content.Context
+import android.content.Intent
+import android.os.Build
+import androidx.core.app.NotificationCompat
+import com.gotunnel.android.MainActivity
+import com.gotunnel.android.R
+import com.gotunnel.android.bridge.TunnelStatus
+import com.gotunnel.android.config.AppConfig
+
+object NotificationHelper {
+    const val CHANNEL_ID = "gotunnel_tunnel"
+    const val NOTIFICATION_ID = 2001
+
+    fun ensureChannel(context: Context) {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) {
+            return
+        }
+
+        val manager = context.getSystemService(NotificationManager::class.java) ?: return
+        if (manager.getNotificationChannel(CHANNEL_ID) != null) {
+            return
+        }
+
+        val channel = NotificationChannel(
+            CHANNEL_ID,
+            context.getString(R.string.notification_channel_name),
+            NotificationManager.IMPORTANCE_LOW,
+        ).apply {
+            description = context.getString(R.string.notification_channel_description)
+        }
+        manager.createNotificationChannel(channel)
+    }
+
+    fun build(
+        context: Context,
+        status: TunnelStatus,
+        detail: String,
+        config: AppConfig,
+    ): Notification {
+        val baseText = when {
+            detail.isNotBlank() -> detail
+            config.serverAddress.isNotBlank() -> context.getString(
+                R.string.notification_text_configured,
+                config.serverAddress,
+            )
+            else -> context.getString(R.string.notification_text_unconfigured)
+        }
+
+        val contentIntent = PendingIntent.getActivity(
+            context,
+            0,
+            Intent(context, MainActivity::class.java),
+            pendingIntentFlags(),
+        )
+
+        val stopIntent = PendingIntent.getService(
+            context,
+            1,
+            TunnelService.createStopIntent(context, "notification-stop"),
+            pendingIntentFlags(),
+        )
+
+        val restartIntent = PendingIntent.getService(
+            context,
+            2,
+            TunnelService.createRestartIntent(context, "notification-restart"),
+            pendingIntentFlags(),
+        )
+
+        return NotificationCompat.Builder(context, CHANNEL_ID)
+            .setSmallIcon(R.drawable.ic_gotunnel_notification)
+            .setContentTitle(context.getString(R.string.notification_title, statusLabel(context, status)))
+            .setContentText(baseText)
+            .setStyle(NotificationCompat.BigTextStyle().bigText(baseText))
+            .setOngoing(status != TunnelStatus.STOPPED)
+            .setOnlyAlertOnce(true)
+            .setContentIntent(contentIntent)
+            .addAction(android.R.drawable.ic_popup_sync, context.getString(R.string.notification_action_restart), restartIntent)
+            .addAction(android.R.drawable.ic_menu_close_clear_cancel, context.getString(R.string.notification_action_stop), stopIntent)
+            .build()
+    }
+
+    private fun statusLabel(context: Context, status: TunnelStatus): String {
+        return when (status) {
+            TunnelStatus.RUNNING -> context.getString(R.string.status_running)
+            TunnelStatus.STARTING -> context.getString(R.string.status_starting)
+            TunnelStatus.RECONNECTING -> context.getString(R.string.status_reconnecting)
+            TunnelStatus.ERROR -> context.getString(R.string.status_error)
+            TunnelStatus.STOPPED -> context.getString(R.string.status_stopped)
+        }
+    }
+
+    private fun pendingIntentFlags(): Int {
+        return if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
+            PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE
+        } else {
+            PendingIntent.FLAG_UPDATE_CURRENT
+        }
+    }
+}

android/app/src/main/java/com/gotunnel/android/service/TunnelService.kt

@@ -0,0 +1,180 @@
+package com.gotunnel.android.service
+
+import android.app.Service
+import android.content.Context
+import android.content.Intent
+import android.os.IBinder
+import androidx.core.app.NotificationManagerCompat
+import com.gotunnel.android.bridge.GoTunnelBridge
+import com.gotunnel.android.bridge.TunnelController
+import com.gotunnel.android.bridge.TunnelStatus
+import com.gotunnel.android.config.AppConfig
+import com.gotunnel.android.config.ConfigStore
+import com.gotunnel.android.config.LogStore
+import com.gotunnel.android.config.ServiceStateStore
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+
+class TunnelService : Service() {
+    private val serviceScope = CoroutineScope(SupervisorJob() + Dispatchers.Main.immediate)
+    private lateinit var configStore: ConfigStore
+    private lateinit var stateStore: ServiceStateStore
+    private lateinit var logStore: LogStore
+    private lateinit var controller: TunnelController
+    private lateinit var networkMonitor: NetworkMonitor
+    private var currentConfig: AppConfig = AppConfig()
+    private var networkMonitorPrimed = false
+
+    override fun onCreate() {
+        super.onCreate()
+        configStore = ConfigStore(this)
+        stateStore = ServiceStateStore(this)
+        logStore = LogStore(this)
+        controller = GoTunnelBridge.create(applicationContext)
+        controller.setListener(object : TunnelController.Listener {
+            override fun onStatusChanged(status: TunnelStatus, detail: String) {
+                stateStore.save(status, detail)
+                logStore.append("status: ${status.name} ${detail.ifBlank { "" }}".trim())
+                updateNotification(status, detail)
+            }
+
+            override fun onLog(message: String) {
+                val current = stateStore.load()
+                logStore.append(message)
+                updateNotification(current.status, message)
+            }
+        })
+        networkMonitor = NetworkMonitor(
+            this,
+            onAvailable = {
+                if (networkMonitorPrimed) {
+                    networkMonitorPrimed = false
+                } else {
+                    val config = configStore.load()
+                    if (config.autoReconnect && controller.isRunning) {
+                        controller.restart("network-restored")
+                    }
+                }
+            },
+            onLost = {
+                val detail = getString(com.gotunnel.android.R.string.network_lost)
+                stateStore.save(TunnelStatus.RECONNECTING, detail)
+                logStore.append(detail)
+                updateNotification(TunnelStatus.RECONNECTING, detail)
+            },
+        )
+    }
+
+    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        ensureForeground()
+
+        when (intent?.action) {
+            ACTION_STOP -> {
+                stopServiceInternal(intent.getStringExtra(EXTRA_REASON) ?: "stop")
+                return START_NOT_STICKY
+            }
+
+            ACTION_RESTART -> {
+                controller.restart(intent.getStringExtra(EXTRA_REASON) ?: "restart")
+            }
+
+            else -> {
+                startOrRefreshTunnel(intent?.getStringExtra(EXTRA_REASON) ?: "start")
+            }
+        }
+
+        return START_STICKY
+    }
+
+    override fun onDestroy() {
+        runCatching { networkMonitor.stop() }
+        runCatching { controller.stop("service-destroyed") }
+        serviceScope.cancel()
+        super.onDestroy()
+    }
+
+    override fun onBind(intent: Intent?): IBinder? = null
+
+    private fun ensureForeground() {
+        val state = stateStore.load()
+        val config = configStore.load()
+        NotificationHelper.ensureChannel(this)
+        startForeground(
+            NotificationHelper.NOTIFICATION_ID,
+            NotificationHelper.build(this, state.status, state.detail, config),
+        )
+    }
+
+    private fun startOrRefreshTunnel(reason: String) {
+        currentConfig = configStore.load()
+        controller.updateConfig(currentConfig)
+        stateStore.save(TunnelStatus.STARTING, reason)
+        logStore.append("start requested: $reason")
+        updateNotification(TunnelStatus.STARTING, reason)
+
+        if (!isConfigReady(currentConfig)) {
+            val detail = getString(com.gotunnel.android.R.string.config_missing)
+            stateStore.save(TunnelStatus.STOPPED, detail)
+            logStore.append(detail)
+            updateNotification(TunnelStatus.STOPPED, detail)
+            return
+        }
+
+        networkMonitorPrimed = networkMonitor.isConnected()
+        controller.start(currentConfig)
+        runCatching { networkMonitor.start() }
+    }
+
+    private fun stopServiceInternal(reason: String) {
+        runCatching { networkMonitor.stop() }
+        networkMonitorPrimed = false
+        controller.stop(reason)
+        stateStore.save(TunnelStatus.STOPPED, reason)
+        logStore.append("stop requested: $reason")
+        updateNotification(TunnelStatus.STOPPED, reason)
+        stopForeground(STOP_FOREGROUND_REMOVE)
+        stopSelf()
+    }
+
+    private fun updateNotification(status: TunnelStatus, detail: String) {
+        val config = currentConfig.takeIf { it.serverAddress.isNotBlank() } ?: configStore.load()
+        NotificationManagerCompat.from(this).notify(
+            NotificationHelper.NOTIFICATION_ID,
+            NotificationHelper.build(this, status, detail, config),
+        )
+    }
+
+    private fun isConfigReady(config: AppConfig): Boolean {
+        return config.serverAddress.isNotBlank() && config.token.isNotBlank()
+    }
+
+    companion object {
+        const val ACTION_START = "com.gotunnel.android.service.action.START"
+        const val ACTION_STOP = "com.gotunnel.android.service.action.STOP"
+        const val ACTION_RESTART = "com.gotunnel.android.service.action.RESTART"
+        const val EXTRA_REASON = "extra_reason"
+
+        fun createStartIntent(context: Context, reason: String): Intent {
+            return Intent(context, TunnelService::class.java).apply {
+                action = ACTION_START
+                putExtra(EXTRA_REASON, reason)
+            }
+        }
+
+        fun createStopIntent(context: Context, reason: String): Intent {
+            return Intent(context, TunnelService::class.java).apply {
+                action = ACTION_STOP
+                putExtra(EXTRA_REASON, reason)
+            }
+        }
+
+        fun createRestartIntent(context: Context, reason: String): Intent {
+            return Intent(context, TunnelService::class.java).apply {
+                action = ACTION_RESTART
+                putExtra(EXTRA_REASON, reason)
+            }
+        }
+    }
+}

android/app/src/main/res/drawable/ic_gotunnel_app.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?>
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="108dp"
+    android:height="108dp"
+    android:viewportWidth="108"
+    android:viewportHeight="108">
+    <path
+        android:fillColor="#0EA5A8"
+        android:pathData="M54,10a44,44 0 1,0 0,88a44,44 0 1,0 0,-88z" />
+    <path
+        android:fillColor="#0F172A"
+        android:pathData="M39,35h30c4.4,0 8,3.6 8,8v22c0,4.4 -3.6,8 -8,8H39c-4.4,0 -8,-3.6 -8,-8V43c0,-4.4 3.6,-8 8,-8z" />
+    <path
+        android:fillColor="#E5E7EB"
+        android:pathData="M44,43h20c2.2,0 4,1.8 4,4v14c0,2.2 -1.8,4 -4,4H44c-2.2,0 -4,-1.8 -4,-4V47c0,-2.2 1.8,-4 4,-4z" />
+    <path
+        android:fillColor="#38BDF8"
+        android:pathData="M52,49l10,6l-10,6z" />
+</vector>

android/app/src/main/res/drawable/ic_gotunnel_notification.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="24dp"
+    android:height="24dp"
+    android:viewportWidth="24"
+    android:viewportHeight="24">
+    <path
+        android:fillColor="#FFFFFFFF"
+        android:pathData="M12,2a10,10 0 1,0 0,20a10,10 0 1,0 0,-20z" />
+    <path
+        android:fillColor="#0EA5A8"
+        android:pathData="M8,8h8c1.1,0 2,0.9 2,2v4c0,1.1 -0.9,2 -2,2H8c-1.1,0 -2,-0.9 -2,-2v-4c0,-1.1 0.9,-2 2,-2z" />
+    <path
+        android:fillColor="#0F172A"
+        android:pathData="M10,10l4,2l-4,2z" />
+</vector>

android/app/src/main/res/layout/activity_main.xml

@@ -0,0 +1,223 @@
+<?xml version="1.0" encoding="utf-8"?>
+<androidx.core.widget.NestedScrollView xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:app="http://schemas.android.com/apk/res-auto"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent"
+    android:background="@color/gotunnel_background"
+    android:fillViewport="true">
+
+    <LinearLayout
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:orientation="vertical"
+        android:padding="20dp">
+
+        <com.google.android.material.appbar.MaterialToolbar
+            android:id="@+id/topToolbar"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:background="@android:color/transparent"
+            app:navigationIcon="@android:drawable/ic_menu_manage"
+            app:navigationIconTint="@color/gotunnel_text"
+            app:subtitle="@string/main_subtitle"
+            app:subtitleTextColor="@color/gotunnel_text_muted"
+            app:title="@string/home_title"
+            app:titleTextColor="@color/gotunnel_text" />
+
+        <com.google.android.material.card.MaterialCardView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="12dp"
+            app:cardBackgroundColor="@color/gotunnel_surface"
+            app:cardCornerRadius="24dp"
+            app:strokeColor="@color/gotunnel_border"
+            app:strokeWidth="1dp">
+
+            <LinearLayout
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:orientation="vertical"
+                android:padding="20dp">
+
+                <TextView
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:text="@string/status_card_title"
+                    android:textColor="@color/gotunnel_text_muted"
+                    android:textSize="13sp" />
+
+                <TextView
+                    android:id="@+id/statusValue"
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="8dp"
+                    android:textColor="@color/gotunnel_text"
+                    android:textSize="30sp"
+                    android:textStyle="bold" />
+
+                <TextView
+                    android:id="@+id/statusDetail"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="8dp"
+                    android:textColor="@color/gotunnel_text"
+                    android:textSize="15sp" />
+
+                <TextView
+                    android:id="@+id/stateHint"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="8dp"
+                    android:textColor="@color/gotunnel_text_muted"
+                    android:textSize="14sp" />
+
+                <TextView
+                    android:id="@+id/serverSummary"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="14dp"
+                    android:textColor="@color/gotunnel_text"
+                    android:textSize="14sp" />
+
+                <TextView
+                    android:id="@+id/stateMeta"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="6dp"
+                    android:textColor="@color/gotunnel_text_muted"
+                    android:textSize="12sp" />
+
+                <LinearLayout
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="18dp"
+                    android:orientation="horizontal">
+
+                    <com.google.android.material.button.MaterialButton
+                        android:id="@+id/startButton"
+                        android:layout_width="0dp"
+                        android:layout_height="wrap_content"
+                        android:layout_weight="1"
+                        android:text="@string/start_button" />
+
+                    <com.google.android.material.button.MaterialButton
+                        android:id="@+id/stopButton"
+                        style="?attr/materialButtonOutlinedStyle"
+                        android:layout_width="0dp"
+                        android:layout_height="wrap_content"
+                        android:layout_marginStart="12dp"
+                        android:layout_weight="1"
+                        android:text="@string/stop_button" />
+                </LinearLayout>
+            </LinearLayout>
+        </com.google.android.material.card.MaterialCardView>
+
+        <com.google.android.material.card.MaterialCardView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="14dp"
+            app:cardBackgroundColor="@color/gotunnel_surface"
+            app:cardCornerRadius="24dp"
+            app:strokeColor="@color/gotunnel_border"
+            app:strokeWidth="1dp">
+
+            <LinearLayout
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:orientation="vertical"
+                android:padding="20dp">
+
+                <TextView
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:text="@string/log_card_title"
+                    android:textColor="@color/gotunnel_text"
+                    android:textSize="18sp"
+                    android:textStyle="bold" />
+
+                <TextView
+                    android:id="@+id/logValue"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="12dp"
+                    android:fontFamily="monospace"
+                    android:lineSpacingExtra="4dp"
+                    android:textColor="@color/gotunnel_text"
+                    android:textIsSelectable="true"
+                    android:textSize="13sp" />
+            </LinearLayout>
+        </com.google.android.material.card.MaterialCardView>
+
+        <com.google.android.material.card.MaterialCardView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="14dp"
+            app:cardBackgroundColor="@color/gotunnel_surface"
+            app:cardCornerRadius="24dp"
+            app:strokeColor="@color/gotunnel_border"
+            app:strokeWidth="1dp">
+
+            <LinearLayout
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:orientation="vertical"
+                android:padding="20dp">
+
+                <TextView
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:text="@string/proxy_card_title"
+                    android:textColor="@color/gotunnel_text"
+                    android:textSize="18sp"
+                    android:textStyle="bold" />
+
+                <TextView
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="6dp"
+                    android:text="@string/proxy_card_subtitle"
+                    android:textColor="@color/gotunnel_text_muted"
+                    android:textSize="13sp" />
+
+                <com.google.android.material.chip.ChipGroup
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="14dp"
+                    app:chipSpacingHorizontal="8dp"
+                    app:chipSpacingVertical="8dp"
+                    app:singleLine="false">
+
+                    <com.google.android.material.chip.Chip
+                        style="@style/Widget.Material3.Chip.Assist"
+                        android:layout_width="wrap_content"
+                        android:layout_height="wrap_content"
+                        android:text="TCP" />
+
+                    <com.google.android.material.chip.Chip
+                        style="@style/Widget.Material3.Chip.Assist"
+                        android:layout_width="wrap_content"
+                        android:layout_height="wrap_content"
+                        android:text="UDP" />
+
+                    <com.google.android.material.chip.Chip
+                        style="@style/Widget.Material3.Chip.Assist"
+                        android:layout_width="wrap_content"
+                        android:layout_height="wrap_content"
+                        android:text="HTTP" />
+
+                    <com.google.android.material.chip.Chip
+                        style="@style/Widget.Material3.Chip.Assist"
+                        android:layout_width="wrap_content"
+                        android:layout_height="wrap_content"
+                        android:text="HTTPS" />
+
+                    <com.google.android.material.chip.Chip
+                        style="@style/Widget.Material3.Chip.Assist"
+                        android:layout_width="wrap_content"
+                        android:layout_height="wrap_content"
+                        android:text="SOCKS5" />
+                </com.google.android.material.chip.ChipGroup>
+            </LinearLayout>
+        </com.google.android.material.card.MaterialCardView>
+    </LinearLayout>
+</androidx.core.widget.NestedScrollView>

android/app/src/main/res/layout/activity_settings.xml

@@ -0,0 +1,156 @@
+<?xml version="1.0" encoding="utf-8"?>
+<androidx.core.widget.NestedScrollView xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:app="http://schemas.android.com/apk/res-auto"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent"
+    android:background="@color/gotunnel_background"
+    android:fillViewport="true">
+
+    <LinearLayout
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:orientation="vertical"
+        android:padding="20dp">
+
+        <com.google.android.material.appbar.MaterialToolbar
+            android:id="@+id/topToolbar"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:background="@android:color/transparent"
+            app:navigationIcon="@android:drawable/ic_media_previous"
+            app:navigationIconTint="@color/gotunnel_text"
+            app:subtitle="@string/settings_subtitle"
+            app:subtitleTextColor="@color/gotunnel_text_muted"
+            app:title="@string/settings_title"
+            app:titleTextColor="@color/gotunnel_text" />
+
+        <com.google.android.material.card.MaterialCardView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="12dp"
+            app:cardBackgroundColor="@color/gotunnel_surface"
+            app:cardCornerRadius="24dp"
+            app:strokeColor="@color/gotunnel_border"
+            app:strokeWidth="1dp">
+
+            <LinearLayout
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:orientation="vertical"
+                android:padding="20dp">
+
+                <TextView
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:text="@string/settings_basic_title"
+                    android:textColor="@color/gotunnel_text"
+                    android:textSize="18sp"
+                    android:textStyle="bold" />
+
+                <com.google.android.material.textfield.TextInputLayout
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="18dp"
+                    android:hint="@string/server_address_label"
+                    app:boxBackgroundMode="outline"
+                    app:helperText="@string/server_address_helper">
+
+                    <com.google.android.material.textfield.TextInputEditText
+                        android:id="@+id/serverAddressInput"
+                        android:layout_width="match_parent"
+                        android:layout_height="wrap_content"
+                        android:inputType="textUri"
+                        android:maxLines="1" />
+                </com.google.android.material.textfield.TextInputLayout>
+
+                <com.google.android.material.textfield.TextInputLayout
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="14dp"
+                    android:hint="@string/token_label"
+                    app:boxBackgroundMode="outline"
+                    app:helperText="@string/token_helper">
+
+                    <com.google.android.material.textfield.TextInputEditText
+                        android:id="@+id/tokenInput"
+                        android:layout_width="match_parent"
+                        android:layout_height="wrap_content"
+                        android:inputType="textPassword"
+                        android:maxLines="1" />
+                </com.google.android.material.textfield.TextInputLayout>
+            </LinearLayout>
+        </com.google.android.material.card.MaterialCardView>
+
+        <com.google.android.material.card.MaterialCardView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="14dp"
+            app:cardBackgroundColor="@color/gotunnel_surface"
+            app:cardCornerRadius="24dp"
+            app:strokeColor="@color/gotunnel_border"
+            app:strokeWidth="1dp">
+
+            <LinearLayout
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:orientation="vertical"
+                android:padding="20dp">
+
+                <TextView
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:text="@string/settings_behavior_title"
+                    android:textColor="@color/gotunnel_text"
+                    android:textSize="18sp"
+                    android:textStyle="bold" />
+
+                <com.google.android.material.switchmaterial.SwitchMaterial
+                    android:id="@+id/autoStartSwitch"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="14dp"
+                    android:text="@string/auto_start_label"
+                    android:textColor="@color/gotunnel_text" />
+
+                <TextView
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginStart="4dp"
+                    android:text="@string/auto_start_helper"
+                    android:textColor="@color/gotunnel_text_muted"
+                    android:textSize="13sp" />
+
+                <com.google.android.material.switchmaterial.SwitchMaterial
+                    android:id="@+id/autoReconnectSwitch"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="14dp"
+                    android:text="@string/auto_reconnect_label"
+                    android:textColor="@color/gotunnel_text" />
+
+                <TextView
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginStart="4dp"
+                    android:text="@string/auto_reconnect_helper"
+                    android:textColor="@color/gotunnel_text_muted"
+                    android:textSize="13sp" />
+            </LinearLayout>
+        </com.google.android.material.card.MaterialCardView>
+
+        <com.google.android.material.button.MaterialButton
+            android:id="@+id/batteryButton"
+            style="?attr/materialButtonOutlinedStyle"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="18dp"
+            android:text="@string/battery_button" />
+
+        <com.google.android.material.button.MaterialButton
+            android:id="@+id/saveButton"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="12dp"
+            android:text="@string/save_button" />
+    </LinearLayout>
+</androidx.core.widget.NestedScrollView>

android/app/src/main/res/values/colors.xml

@@ -0,0 +1,9 @@
+<resources>
+    <color name="gotunnel_background">#F3F7FB</color>
+    <color name="gotunnel_surface">#FFFFFF</color>
+    <color name="gotunnel_primary">#0F766E</color>
+    <color name="gotunnel_secondary">#0891B2</color>
+    <color name="gotunnel_text">#0F172A</color>
+    <color name="gotunnel_text_muted">#475569</color>
+    <color name="gotunnel_border">#D9E2EC</color>
+</resources>

android/app/src/main/res/values/strings.xml

@@ -0,0 +1,54 @@
+<resources>
+    <string name="app_name">GoTunnel</string>
+    <string name="home_title">GoTunnel Client</string>
+    <string name="main_subtitle">Status, recent logs, and supported proxy types</string>
+    <string name="settings_title">Client Settings</string>
+    <string name="settings_subtitle">Connection settings and startup behavior</string>
+    <string name="settings_basic_title">Basic Connection</string>
+    <string name="settings_behavior_title">Startup and Recovery</string>
+    <string name="server_address_label">Server Address</string>
+    <string name="server_address_helper">Example: 1.2.3.4:7000. This is the GoTunnel server endpoint.</string>
+    <string name="token_label">Access Token</string>
+    <string name="token_helper">The token issued by the server to identify this client.</string>
+    <string name="auto_start_label">Start on boot</string>
+    <string name="auto_start_helper">Restore the foreground service after reboot or app update.</string>
+    <string name="auto_reconnect_label">Reconnect when network returns</string>
+    <string name="auto_reconnect_helper">Restart the client automatically after connectivity is restored.</string>
+    <string name="save_button">Save Settings</string>
+    <string name="start_button">Start Client</string>
+    <string name="stop_button">Stop Client</string>
+    <string name="battery_button">Battery Optimization</string>
+    <string name="status_card_title">Software Status</string>
+    <string name="log_card_title">Recent Logs</string>
+    <string name="proxy_card_title">Supported Proxies</string>
+    <string name="proxy_card_subtitle">The current Android shell can present these proxy types. Live proxy rules can be shown after the native Go core is connected.</string>
+    <string name="config_saved">Client settings saved.</string>
+    <string name="service_start_requested">Client start requested.</string>
+    <string name="service_stop_requested">Client stop requested.</string>
+    <string name="battery_optimization_already_disabled">Battery optimization is already disabled for GoTunnel.</string>
+    <string name="notification_permission_denied">Notification permission was denied. Foreground service notifications may be limited.</string>
+    <string name="state_never_updated">Not updated yet</string>
+    <string name="state_no_detail">No detail available</string>
+    <string name="state_meta_format">Last update: %1$s</string>
+    <string name="state_hint_stopped">The client is idle. Save settings first, then start it from the home screen.</string>
+    <string name="state_hint_starting">The client is preparing a tunnel connection.</string>
+    <string name="state_hint_running">The client is running and ready for the native Go core to handle real proxy traffic.</string>
+    <string name="state_hint_reconnecting">The client is waiting for the network and will reconnect automatically.</string>
+    <string name="state_hint_error">The last run failed. Check the settings and recent logs.</string>
+    <string name="status_running">Running</string>
+    <string name="status_starting">Starting</string>
+    <string name="status_reconnecting">Reconnecting</string>
+    <string name="status_error">Error</string>
+    <string name="status_stopped">Stopped</string>
+    <string name="status_server_unconfigured">No server is configured yet. Open Settings to finish the basic client setup.</string>
+    <string name="status_server_configured">Current server: %1$s</string>
+    <string name="notification_channel_name">GoTunnel foreground service</string>
+    <string name="notification_channel_description">Keeps the GoTunnel Android client running in the foreground</string>
+    <string name="notification_title">GoTunnel - %1$s</string>
+    <string name="notification_text_configured">Current target: %1$s</string>
+    <string name="notification_text_unconfigured">No server configured yet</string>
+    <string name="notification_action_restart">Restart</string>
+    <string name="notification_action_stop">Stop</string>
+    <string name="config_missing">Please open Settings and fill in the server address and access token first.</string>
+    <string name="network_lost">Network connection lost</string>
+</resources>

android/app/src/main/res/values/themes.xml

@@ -0,0 +1,18 @@
+<resources xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools">
+    <style name="Theme.GoTunnel" parent="Theme.Material3.Light.NoActionBar">
+        <item name="colorPrimary">@color/gotunnel_primary</item>
+        <item name="colorOnPrimary">@android:color/white</item>
+        <item name="colorSecondary">@color/gotunnel_secondary</item>
+        <item name="colorOnSecondary">@android:color/white</item>
+        <item name="colorSurface">@color/gotunnel_surface</item>
+        <item name="colorOnSurface">@color/gotunnel_text</item>
+        <item name="colorOutline">@color/gotunnel_border</item>
+        <item name="android:colorBackground">@color/gotunnel_background</item>
+        <item name="android:windowBackground">@color/gotunnel_background</item>
+        <item name="android:textColorPrimary">@color/gotunnel_text</item>
+        <item name="android:textColorSecondary">@color/gotunnel_text_muted</item>
+        <item name="android:statusBarColor" tools:targetApi="l">@color/gotunnel_background</item>
+        <item name="android:navigationBarColor" tools:targetApi="l">@color/gotunnel_background</item>
+    </style>
+</resources>

android/build.gradle.kts

@@ -0,0 +1,4 @@
+plugins {
+    id("com.android.application") version "8.5.2" apply false
+    id("org.jetbrains.kotlin.android") version "1.9.24" apply false
+}

android/gradle.properties

@@ -0,0 +1,4 @@
+android.useAndroidX=true
+android.nonTransitiveRClass=true
+kotlin.code.style=official
+org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8

android/settings.gradle.kts

@@ -0,0 +1,18 @@
+pluginManagement {
+    repositories {
+        google()
+        mavenCentral()
+        gradlePluginPortal()
+    }
+}
+
+dependencyResolutionManagement {
+    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
+    repositories {
+        google()
+        mavenCentral()
+    }
+}
+
+rootProject.name = "GoTunnelAndroid"
+include(":app")

cmd/client/main.go

@@ -3,6 +3,7 @@ package main
 import (
 	"flag"
 	"log"
+	"time"
 
 	"github.com/gotunnel/internal/client/config"
 	"github.com/gotunnel/internal/client/tunnel"
@@ -10,7 +11,7 @@ import (
 	"github.com/gotunnel/pkg/version"
 )
 
-// 版本信息（通过 ldflags 注入）
+// Version information injected by ldflags.
 var Version string
 var BuildTime string
 var GitCommit string
@@ -24,9 +25,13 @@ func main() {
 	server := flag.String("s", "", "server address (ip:port)")
 	token := flag.String("t", "", "auth token")
 	configPath := flag.String("c", "", "config file path")
+	dataDir := flag.String("data-dir", "", "client data directory")
+	clientName := flag.String("name", "", "client display name")
+	clientID := flag.String("id", "", "client id")
+	reconnectMin := flag.Int("reconnect-min", 0, "minimum reconnect delay in seconds")
+	reconnectMax := flag.Int("reconnect-max", 0, "maximum reconnect delay in seconds")
 	flag.Parse()
 
-	// 优先加载配置文件
 	var cfg *config.ClientConfig
 	if *configPath != "" {
 		var err error
@@ -38,26 +43,53 @@ func main() {
 		cfg = &config.ClientConfig{}
 	}
 
-	// 命令行参数覆盖配置文件
 	if *server != "" {
 		cfg.Server = *server
 	}
 	if *token != "" {
 		cfg.Token = *token
 	}
+	if *dataDir != "" {
+		cfg.DataDir = *dataDir
+	}
+	if *clientName != "" {
+		cfg.Name = *clientName
+	}
+	if *clientID != "" {
+		cfg.ClientID = *clientID
+	}
+	if *reconnectMin > 0 {
+		cfg.ReconnectMinSec = *reconnectMin
+	}
+	if *reconnectMax > 0 {
+		cfg.ReconnectMaxSec = *reconnectMax
+	}
 
 	if cfg.Server == "" || cfg.Token == "" {
 		log.Fatal("Usage: client [-c config.yaml] | [-s <server:port> -t <token>]")
 	}
 
-	client := tunnel.NewClient(cfg.Server, cfg.Token)
+	opts := tunnel.ClientOptions{
+		DataDir:    cfg.DataDir,
+		ClientID:   cfg.ClientID,
+		ClientName: cfg.Name,
+	}
+	if cfg.ReconnectMinSec > 0 {
+		opts.ReconnectDelay = time.Duration(cfg.ReconnectMinSec) * time.Second
+	}
+	if cfg.ReconnectMaxSec > 0 {
+		opts.ReconnectMaxDelay = time.Duration(cfg.ReconnectMaxSec) * time.Second
+	}
+
+	client := tunnel.NewClientWithOptions(cfg.Server, cfg.Token, opts)
 
-	// TLS 默认启用，默认跳过证书验证（类似 frp）
 	if !cfg.NoTLS {
 		client.TLSEnabled = true
 		client.TLSConfig = crypto.ClientTLSConfig()
 		log.Printf("[Client] TLS enabled")
 	}
 
-	client.Run()
+	if err := client.Run(); err != nil {
+		log.Fatalf("Client stopped: %v", err)
+	}
 }

internal/client/config/config.go

@@ -6,14 +6,19 @@ import (
 	"gopkg.in/yaml.v3"
 )
 
-// ClientConfig 客户端配置
+// ClientConfig defines client runtime configuration.
 type ClientConfig struct {
-	Server string `yaml:"server"` // 服务器地址
+	Server          string `yaml:"server"`
-	Token  string `yaml:"token"`  // 认证 Token
+	Token           string `yaml:"token"`
-	NoTLS  bool   `yaml:"no_tls"` // 禁用 TLS
+	NoTLS           bool   `yaml:"no_tls"`
+	DataDir         string `yaml:"data_dir"`
+	Name            string `yaml:"name"`
+	ClientID        string `yaml:"client_id"`
+	ReconnectMinSec int    `yaml:"reconnect_min_sec"`
+	ReconnectMaxSec int    `yaml:"reconnect_max_sec"`
 }
 
-// LoadClientConfig 加载客户端配置
+// LoadClientConfig loads client configuration from YAML.
 func LoadClientConfig(path string) (*ClientConfig, error) {
 	data, err := os.ReadFile(path)
 	if err != nil {

internal/client/tunnel/client.go

@@ -22,82 +22,90 @@ import (
 	"github.com/hashicorp/yamux"
 )
 
-// 客户端常量
 const (
-	dialTimeout      = 10 * time.Second
+	dialTimeout       = 10 * time.Second
-	localDialTimeout = 5 * time.Second
+	localDialTimeout  = 5 * time.Second
-	udpTimeout       = 10 * time.Second
+	udpTimeout        = 10 * time.Second
-	reconnectDelay   = 5 * time.Second
+	reconnectDelay    = 5 * time.Second
-	disconnectDelay  = 3 * time.Second
+	maxReconnectDelay = 30 * time.Second
-	udpBufferSize    = 65535
+	disconnectDelay   = 3 * time.Second
+	tcpKeepAlive      = 30 * time.Second
+	udpBufferSize     = 65535
 )
 
-// Client 隧道客户端
+// Client is the tunnel client runtime.
 type Client struct {
 	ServerAddr string
 	Token      string
 	ID         string
-	Name       string // 客户端名称（主机名）
+	Name       string
 	TLSEnabled bool
 	TLSConfig  *tls.Config
-	DataDir    string // 数据目录
+	DataDir    string
-	session    *yamux.Session
+
-	rules      []protocol.ProxyRule
+	features          PlatformFeatures
-	mu         sync.RWMutex
+	reconnectDelay    time.Duration
-	logger     *Logger // 日志收集器
+	reconnectMaxDelay time.Duration
+
+	session *yamux.Session
+	rules   []protocol.ProxyRule
+	mu      sync.RWMutex
+	logger  *Logger
 }
 
-// NewClient 创建客户端
+// NewClient creates a client with default desktop options.
 func NewClient(serverAddr, token string) *Client {
-	// 默认数据目录：优先使用用户主目录，失败时回退到当前工作目录
+	return NewClientWithOptions(serverAddr, token, ClientOptions{})
-	var dataDir string
+}
-	if home, err := os.UserHomeDir(); err == nil && home != "" {
-		dataDir = filepath.Join(home, ".gotunnel")
-	} else {
-		// UserHomeDir 失败（如 Android adb shell 环境），使用当前工作目录
-		if cwd, err := os.Getwd(); err == nil {
-			dataDir = filepath.Join(cwd, ".gotunnel")
-			log.Printf("[Client] UserHomeDir unavailable, using current directory: %s", dataDir)
-		} else {
-			// 最后回退到相对路径
-			dataDir = ".gotunnel"
-			log.Printf("[Client] Warning: using relative path for data directory")
-		}
-	}
 
-	// 确保数据目录存在
+// NewClientWithOptions creates a client with explicit runtime options.
+func NewClientWithOptions(serverAddr, token string, opts ClientOptions) *Client {
+	dataDir := resolveDataDir(opts.DataDir)
 	if err := os.MkdirAll(dataDir, 0755); err != nil {
 		log.Printf("Failed to create data dir: %v", err)
 	}
 
-	// ID 优先级：命令行参数 > 机器ID
-	id := getMachineID()
-
-	// 获取主机名作为客户端名称
-	hostname, _ := os.Hostname()
-
-	// 初始化日志收集器
 	logger, err := NewLogger(dataDir)
 	if err != nil {
 		log.Printf("Failed to initialize logger: %v", err)
 	}
 
+	features := DefaultPlatformFeatures()
+	if opts.Features != nil {
+		features = *opts.Features
+	}
+
+	delay := opts.ReconnectDelay
+	if delay <= 0 {
+		delay = reconnectDelay
+	}
+
+	maxDelay := opts.ReconnectMaxDelay
+	if maxDelay <= 0 {
+		maxDelay = maxReconnectDelay
+	}
+	if maxDelay < delay {
+		maxDelay = delay
+	}
+
 	return &Client{
-		ServerAddr: serverAddr,
+		ServerAddr:        serverAddr,
-		Token:      token,
+		Token:             token,
-		ID:         id,
+		ID:                resolveClientID(dataDir, opts.ClientID),
-		Name:       hostname,
+		Name:              resolveClientName(opts.ClientName),
-		DataDir:    dataDir,
+		DataDir:           dataDir,
-		logger:     logger,
+		features:          features,
+		reconnectDelay:    delay,
+		reconnectMaxDelay: maxDelay,
+		logger:            logger,
 	}
 }
 
-// InitVersionStore 初始化版本存储
+// InitVersionStore is kept for compatibility with older callers.
 func (c *Client) InitVersionStore() error {
 	return nil
 }
 
-// logf 安全地记录日志（同时输出到标准日志和日志收集器）
 func (c *Client) logf(format string, args ...interface{}) {
 	msg := fmt.Sprintf(format, args...)
 	log.Print(msg)
@@ -106,7 +114,6 @@ func (c *Client) logf(format string, args ...interface{}) {
 	}
 }
 
-// logErrorf 安全地记录错误日志
 func (c *Client) logErrorf(format string, args ...interface{}) {
 	msg := fmt.Sprintf(format, args...)
 	log.Print(msg)
@@ -115,7 +122,6 @@ func (c *Client) logErrorf(format string, args ...interface{}) {
 	}
 }
 
-// logWarnf 安全地记录警告日志
 func (c *Client) logWarnf(format string, args ...interface{}) {
 	msg := fmt.Sprintf(format, args...)
 	log.Print(msg)
@@ -124,32 +130,82 @@ func (c *Client) logWarnf(format string, args ...interface{}) {
 	}
 }
 
-// Run 启动客户端（带断线重连）
+// Run starts the reconnect loop until the process exits.
 func (c *Client) Run() error {
+	return c.RunContext(context.Background())
+}
+
+// RunContext starts the reconnect loop and exits when ctx is cancelled.
+func (c *Client) RunContext(ctx context.Context) error {
+	backoff := c.reconnectDelay
+
 	for {
-		if err := c.connect(); err != nil {
+		if ctx.Err() != nil {
+			return nil
+		}
+
+		if err := c.connect(ctx); err != nil {
+			if ctx.Err() != nil {
+				return nil
+			}
 			c.logErrorf("Connect error: %v", err)
-			c.logf("Reconnecting in %v...", reconnectDelay)
+			c.logf("Reconnecting in %v...", backoff)
-			time.Sleep(reconnectDelay)
+			if !sleepWithContext(ctx, backoff) {
+				return nil
+			}
+			backoff *= 2
+			if backoff > c.reconnectMaxDelay {
+				backoff = c.reconnectMaxDelay
+			}
 			continue
 		}
 
-		c.handleSession()
+		backoff = c.reconnectDelay
+		c.handleSession(ctx)
+		if ctx.Err() != nil {
+			return nil
+		}
 		c.logWarnf("Disconnected, reconnecting...")
-		time.Sleep(disconnectDelay)
+		if !sleepWithContext(ctx, disconnectDelay) {
+			return nil
+		}
 	}
 }
 
-// connect 连接到服务端并认证
+func sleepWithContext(ctx context.Context, wait time.Duration) bool {
-func (c *Client) connect() error {
+	timer := time.NewTimer(wait)
+	defer timer.Stop()
+
+	select {
+	case <-ctx.Done():
+		return false
+	case <-timer.C:
+		return true
+	}
+}
+
+func (c *Client) connect(ctx context.Context) error {
 	var conn net.Conn
 	var err error
 
+	dialer := &net.Dialer{
+		Timeout:   dialTimeout,
+		KeepAlive: tcpKeepAlive,
+	}
+
 	if c.TLSEnabled && c.TLSConfig != nil {
-		dialer := &net.Dialer{Timeout: dialTimeout}
+		rawConn, dialErr := dialer.DialContext(ctx, "tcp", c.ServerAddr)
-		conn, err = tls.DialWithDialer(dialer, "tcp", c.ServerAddr, c.TLSConfig)
+		if dialErr != nil {
+			return dialErr
+		}
+		tlsConn := tls.Client(rawConn, c.TLSConfig)
+		if handshakeErr := tlsConn.HandshakeContext(ctx); handshakeErr != nil {
+			rawConn.Close()
+			return handshakeErr
+		}
+		conn = tlsConn
 	} else {
-		conn, err = net.DialTimeout("tcp", c.ServerAddr, dialTimeout)
+		conn, err = dialer.DialContext(ctx, "tcp", c.ServerAddr)
 	}
 	if err != nil {
 		return err
@@ -184,8 +240,6 @@ func (c *Client) connect() error {
 		conn.Close()
 		return fmt.Errorf("auth failed: %s", authResp.Message)
 	}
-
-	// 如果服务端分配了新 ID，则更新
 	if authResp.ClientID != "" && authResp.ClientID != c.ID {
 		conn.Close()
 		return fmt.Errorf("server returned unexpected client id: %s", authResp.ClientID)
@@ -206,12 +260,31 @@ func (c *Client) connect() error {
 	return nil
 }
 
-// handleSession 处理会话
+func (c *Client) currentSession() *yamux.Session {
-func (c *Client) handleSession() {
+	c.mu.RLock()
-	defer c.session.Close()
+	defer c.mu.RUnlock()
+	return c.session
+}
+
+func (c *Client) handleSession(ctx context.Context) {
+	session := c.currentSession()
+	if session == nil {
+		return
+	}
+
+	done := make(chan struct{})
+	go func() {
+		select {
+		case <-ctx.Done():
+			session.Close()
+		case <-done:
+		}
+	}()
+	defer close(done)
+	defer session.Close()
 
 	for {
-		stream, err := c.session.Accept()
+		stream, err := session.Accept()
 		if err != nil {
 			return
 		}
@@ -219,7 +292,6 @@ func (c *Client) handleSession() {
 	}
 }
 
-// handleStream 处理流
 func (c *Client) handleStream(stream net.Conn) {
 	msg, err := protocol.ReadMessage(stream)
 	if err != nil {
@@ -254,10 +326,11 @@ func (c *Client) handleStream(stream net.Conn) {
 		c.handleScreenshotRequest(stream, msg)
 	case protocol.MsgTypeShellExecuteRequest:
 		c.handleShellExecuteRequest(stream, msg)
+	default:
+		stream.Close()
 	}
 }
 
-// handleProxyConfig 处理代理配置
 func (c *Client) handleProxyConfig(stream net.Conn, msg *protocol.Message) {
 	defer stream.Close()
 
@@ -276,12 +349,10 @@ func (c *Client) handleProxyConfig(stream net.Conn, msg *protocol.Message) {
 		c.logf("  %s: %s:%d", r.Name, r.LocalIP, r.LocalPort)
 	}
 
-	// 发送配置确认
 	ack := &protocol.Message{Type: protocol.MsgTypeProxyReady}
 	protocol.WriteMessage(stream, ack)
 }
 
-// handleNewProxy 处理新代理请求
 func (c *Client) handleNewProxy(stream net.Conn, msg *protocol.Message) {
 	var req protocol.NewProxyRequest
 	if err := msg.ParsePayload(&req); err != nil {
@@ -291,9 +362,9 @@ func (c *Client) handleNewProxy(stream net.Conn, msg *protocol.Message) {
 
 	var rule *protocol.ProxyRule
 	c.mu.RLock()
-	for _, r := range c.rules {
+	for i := range c.rules {
-		if r.RemotePort == req.RemotePort {
+		if c.rules[i].RemotePort == req.RemotePort {
-			rule = &r
+			rule = &c.rules[i]
 			break
 		}
 	}
@@ -314,13 +385,11 @@ func (c *Client) handleNewProxy(stream net.Conn, msg *protocol.Message) {
 	relay.Relay(stream, localConn)
 }
 
-// handleHeartbeat 处理心跳
 func (c *Client) handleHeartbeat(stream net.Conn) {
 	msg := &protocol.Message{Type: protocol.MsgTypeHeartbeatAck}
 	protocol.WriteMessage(stream, msg)
 }
 
-// handleProxyConnect 处理代理连接请求 (SOCKS5/HTTP)
 func (c *Client) handleProxyConnect(stream net.Conn, msg *protocol.Message) {
 	defer stream.Close()
 
@@ -330,7 +399,6 @@ func (c *Client) handleProxyConnect(stream net.Conn, msg *protocol.Message) {
 		return
 	}
 
-	// 连接目标地址
 	targetConn, err := net.DialTimeout("tcp", req.Target, dialTimeout)
 	if err != nil {
 		c.sendProxyResult(stream, false, err.Error())
@@ -338,23 +406,19 @@ func (c *Client) handleProxyConnect(stream net.Conn, msg *protocol.Message) {
 	}
 	defer targetConn.Close()
 
-	// 发送成功响应
 	if err := c.sendProxyResult(stream, true, ""); err != nil {
 		return
 	}
 
-	// 双向转发数据
 	relay.Relay(stream, targetConn)
 }
 
-// sendProxyResult 发送代理连接结果
 func (c *Client) sendProxyResult(stream net.Conn, success bool, message string) error {
 	result := protocol.ProxyConnectResult{Success: success, Message: message}
 	msg, _ := protocol.NewMessage(protocol.MsgTypeProxyResult, result)
 	return protocol.WriteMessage(stream, msg)
 }
 
-// handleUDPData 处理 UDP 数据
 func (c *Client) handleUDPData(stream net.Conn, msg *protocol.Message) {
 	defer stream.Close()
 
@@ -363,13 +427,11 @@ func (c *Client) handleUDPData(stream net.Conn, msg *protocol.Message) {
 		return
 	}
 
-	// 查找对应的规则
 	rule := c.findRuleByPort(packet.RemotePort)
 	if rule == nil {
 		return
 	}
 
-	// 连接本地 UDP 服务
 	target := fmt.Sprintf("%s:%d", rule.LocalIP, rule.LocalPort)
 	conn, err := net.DialTimeout("udp", target, localDialTimeout)
 	if err != nil {
@@ -377,20 +439,17 @@ func (c *Client) handleUDPData(stream net.Conn, msg *protocol.Message) {
 	}
 	defer conn.Close()
 
-	// 发送数据到本地服务
 	conn.SetDeadline(time.Now().Add(udpTimeout))
 	if _, err := conn.Write(packet.Data); err != nil {
 		return
 	}
 
-	// 读取响应
 	buf := make([]byte, udpBufferSize)
 	n, err := conn.Read(buf)
 	if err != nil {
 		return
 	}
 
-	// 发送响应回服务端
 	respPacket := protocol.UDPPacket{
 		RemotePort: packet.RemotePort,
 		ClientAddr: packet.ClientAddr,
@@ -400,7 +459,6 @@ func (c *Client) handleUDPData(stream net.Conn, msg *protocol.Message) {
 	protocol.WriteMessage(stream, respMsg)
 }
 
-// findRuleByPort 根据端口查找规则
 func (c *Client) findRuleByPort(port int) *protocol.ProxyRule {
 	c.mu.RLock()
 	defer c.mu.RUnlock()
@@ -413,7 +471,6 @@ func (c *Client) findRuleByPort(port int) *protocol.ProxyRule {
 	return nil
 }
 
-// handleClientRestart 处理客户端重启请求
 func (c *Client) handleClientRestart(stream net.Conn, msg *protocol.Message) {
 	defer stream.Close()
 
@@ -422,7 +479,6 @@ func (c *Client) handleClientRestart(stream net.Conn, msg *protocol.Message) {
 
 	c.logf("Restart requested: %s", req.Reason)
 
-	// 发送响应
 	resp := protocol.ClientRestartResponse{
 		Success: true,
 		Message: "restarting",
@@ -430,17 +486,19 @@ func (c *Client) handleClientRestart(stream net.Conn, msg *protocol.Message) {
 	respMsg, _ := protocol.NewMessage(protocol.MsgTypeClientRestart, resp)
 	protocol.WriteMessage(stream, respMsg)
 
-	// 停止所有运行中的插件
+	if session := c.currentSession(); session != nil {
-	// 关闭会话（会触发重连）
+		session.Close()
-	if c.session != nil {
-		c.session.Close()
 	}
 }
 
-// handleUpdateDownload 处理更新下载请求
 func (c *Client) handleUpdateDownload(stream net.Conn, msg *protocol.Message) {
 	defer stream.Close()
 
+	if !c.features.AllowSelfUpdate {
+		c.sendUpdateResult(stream, false, "self-update not supported on this platform")
+		return
+	}
+
 	var req protocol.UpdateDownloadRequest
 	if err := msg.ParsePayload(&req); err != nil {
 		c.logErrorf("Parse update request error: %v", err)
@@ -450,7 +508,6 @@ func (c *Client) handleUpdateDownload(stream net.Conn, msg *protocol.Message) {
 
 	c.logf("Update download requested: %s", req.DownloadURL)
 
-	// 异步执行更新
 	go func() {
 		if err := c.performSelfUpdate(req.DownloadURL); err != nil {
 			c.logErrorf("Update failed: %v", err)
@@ -460,7 +517,6 @@ func (c *Client) handleUpdateDownload(stream net.Conn, msg *protocol.Message) {
 	c.sendUpdateResult(stream, true, "update started")
 }
 
-// sendUpdateResult 发送更新结果
 func (c *Client) sendUpdateResult(stream net.Conn, success bool, message string) {
 	result := protocol.UpdateResultResponse{
 		Success: success,
@@ -470,11 +526,13 @@ func (c *Client) sendUpdateResult(stream net.Conn, success bool, message string)
 	protocol.WriteMessage(stream, msg)
 }
 
-// performSelfUpdate 执行自更新
 func (c *Client) performSelfUpdate(downloadURL string) error {
+	if runtime.GOOS == "android" {
+		return fmt.Errorf("self-update must be handled by the Android host app")
+	}
+
 	c.logf("Starting self-update from: %s", downloadURL)
 
-	// 获取当前可执行文件路径
 	currentPath, err := os.Executable()
 	if err != nil {
 		c.logErrorf("Update failed: cannot get executable path: %v", err)
@@ -482,17 +540,12 @@ func (c *Client) performSelfUpdate(downloadURL string) error {
 	}
 	currentPath, _ = filepath.EvalSymlinks(currentPath)
 
-	// 预检查：验证是否有写权限（在下载前检查，避免浪费带宽）
-	// Windows 跳过预检查，因为 Windows 更新通过 batch 脚本以提升权限执行
-	// 非 Windows：原始路径 → DataDir → 临时目录，逐级回退
 	fallbackDir := ""
 	if runtime.GOOS != "windows" {
 		if err := c.checkUpdatePermissions(currentPath); err != nil {
-			// 尝试 DataDir
 			fallbackDir = c.DataDir
 			testFile := filepath.Join(fallbackDir, ".gotunnel_update_test")
 			if f, err := os.Create(testFile); err != nil {
-				// DataDir 也不可写，回退到临时目录
 				fallbackDir = os.TempDir()
 				c.logf("DataDir not writable, falling back to temp directory: %s", fallbackDir)
 			} else {
@@ -503,7 +556,6 @@ func (c *Client) performSelfUpdate(downloadURL string) error {
 		}
 	}
 
-	// 使用共享的下载和解压逻辑
 	c.logf("Downloading update package...")
 	binaryPath, cleanup, err := update.DownloadAndExtract(downloadURL, "client")
 	if err != nil {
@@ -512,12 +564,10 @@ func (c *Client) performSelfUpdate(downloadURL string) error {
 	}
 	defer cleanup()
 
-	// Windows 需要特殊处理
 	if runtime.GOOS == "windows" {
 		return performWindowsClientUpdate(binaryPath, currentPath, c.ServerAddr, c.Token)
 	}
 
-	// 确定目标路径
 	targetPath := currentPath
 	if fallbackDir != "" {
 		targetPath = filepath.Join(fallbackDir, filepath.Base(currentPath))
@@ -525,7 +575,6 @@ func (c *Client) performSelfUpdate(downloadURL string) error {
 	}
 
 	if fallbackDir == "" {
-		// 原地替换：备份 → 复制 → 清理
 		backupPath := currentPath + ".bak"
 
 		c.logf("Backing up current binary...")
@@ -549,7 +598,6 @@ func (c *Client) performSelfUpdate(downloadURL string) error {
 
 		os.Remove(backupPath)
 	} else {
-		// 回退路径：直接复制到回退目录
 		c.logf("Installing new binary to data directory...")
 		if err := update.CopyFile(binaryPath, targetPath); err != nil {
 			c.logErrorf("Update failed: cannot install new binary: %v", err)
@@ -563,15 +611,11 @@ func (c *Client) performSelfUpdate(downloadURL string) error {
 	}
 
 	c.logf("Update completed successfully, restarting...")
-
-	// 重启进程（从新路径启动）
 	restartClientProcess(targetPath, c.ServerAddr, c.Token)
 	return nil
 }
 
-// checkUpdatePermissions 检查是否有更新权限
 func (c *Client) checkUpdatePermissions(execPath string) error {
-	// 检查可执行文件所在目录是否可写
 	dir := filepath.Dir(execPath)
 	testFile := filepath.Join(dir, ".gotunnel_update_test")
 
@@ -583,7 +627,6 @@ func (c *Client) checkUpdatePermissions(execPath string) error {
 	f.Close()
 	os.Remove(testFile)
 
-	// 检查可执行文件本身是否可写
 	f, err = os.OpenFile(execPath, os.O_WRONLY, 0)
 	if err != nil {
 		c.logErrorf("No write permission to executable: %s", execPath)
@@ -594,9 +637,7 @@ func (c *Client) checkUpdatePermissions(execPath string) error {
 	return nil
 }
 
-// performWindowsClientUpdate Windows 平台更新
 func performWindowsClientUpdate(newFile, currentPath, serverAddr, token string) error {
-	// 创建批处理脚本
 	args := fmt.Sprintf(`-s "%s" -t "%s"`, serverAddr, token)
 	batchScript := fmt.Sprintf(`@echo off
 :: Check for admin rights, request UAC elevation if needed
@@ -622,12 +663,10 @@ del "%%~f0"
 		return fmt.Errorf("start batch: %w", err)
 	}
 
-	// 退出当前进程
 	os.Exit(0)
 	return nil
 }
 
-// restartClientProcess 重启客户端进程
 func restartClientProcess(path, serverAddr, token string) {
 	args := []string{"-s", serverAddr, "-t", token}
 
@@ -638,7 +677,6 @@ func restartClientProcess(path, serverAddr, token string) {
 	os.Exit(0)
 }
 
-// handleLogRequest 处理日志请求
 func (c *Client) handleLogRequest(stream net.Conn, msg *protocol.Message) {
 	if c.logger == nil {
 		stream.Close()
@@ -653,7 +691,6 @@ func (c *Client) handleLogRequest(stream net.Conn, msg *protocol.Message) {
 
 	c.logger.Printf("Log request received: session=%s, follow=%v", req.SessionID, req.Follow)
 
-	// 发送历史日志
 	entries := c.logger.GetRecentLogs(req.Lines, req.Level)
 	if len(entries) > 0 {
 		data := protocol.LogData{
@@ -668,20 +705,16 @@ func (c *Client) handleLogRequest(stream net.Conn, msg *protocol.Message) {
 		}
 	}
 
-	// 如果不需要持续推送，关闭流
 	if !req.Follow {
 		stream.Close()
 		return
 	}
 
-	// 订阅新日志
 	ch := c.logger.Subscribe(req.SessionID)
 	defer c.logger.Unsubscribe(req.SessionID)
 	defer stream.Close()
 
-	// 持续推送新日志
 	for entry := range ch {
-		// 应用级别过滤
 		if req.Level != "" && entry.Level != req.Level {
 			continue
 		}
@@ -698,7 +731,6 @@ func (c *Client) handleLogRequest(stream net.Conn, msg *protocol.Message) {
 	}
 }
 
-// handleLogStop 处理停止日志流请求
 func (c *Client) handleLogStop(stream net.Conn, msg *protocol.Message) {
 	defer stream.Close()
 
@@ -714,13 +746,20 @@ func (c *Client) handleLogStop(stream net.Conn, msg *protocol.Message) {
 	c.logger.Unsubscribe(req.SessionID)
 }
 
-// handleSystemStatsRequest 处理系统状态请求
 func (c *Client) handleSystemStatsRequest(stream net.Conn, msg *protocol.Message) {
 	defer stream.Close()
 
+	if !c.features.AllowSystemStats {
+		respMsg, _ := protocol.NewMessage(protocol.MsgTypeSystemStatsResponse, protocol.SystemStatsResponse{})
+		protocol.WriteMessage(stream, respMsg)
+		return
+	}
+
 	stats, err := utils.GetSystemStats()
 	if err != nil {
 		log.Printf("Failed to get system stats: %v", err)
+		respMsg, _ := protocol.NewMessage(protocol.MsgTypeSystemStatsResponse, protocol.SystemStatsResponse{})
+		protocol.WriteMessage(stream, respMsg)
 		return
 	}
 
@@ -738,14 +777,19 @@ func (c *Client) handleSystemStatsRequest(stream net.Conn, msg *protocol.Message
 	protocol.WriteMessage(stream, respMsg)
 }
 
-// handleScreenshotRequest 处理截图请求
 func (c *Client) handleScreenshotRequest(stream net.Conn, msg *protocol.Message) {
 	defer stream.Close()
 
 	var req protocol.ScreenshotRequest
 	msg.ParsePayload(&req)
 
-	// 捕获截图
+	if !c.features.AllowScreenshot {
+		resp := protocol.ScreenshotResponse{Error: "screenshot not supported on this platform"}
+		respMsg, _ := protocol.NewMessage(protocol.MsgTypeScreenshotResponse, resp)
+		protocol.WriteMessage(stream, respMsg)
+		return
+	}
+
 	data, width, height, err := utils.CaptureScreenshot(req.Quality)
 	if err != nil {
 		c.logErrorf("Screenshot capture failed: %v", err)
@@ -755,9 +799,7 @@ func (c *Client) handleScreenshotRequest(stream net.Conn, msg *protocol.Message)
 		return
 	}
 
-	// 编码为 Base64
 	base64Data := base64.StdEncoding.EncodeToString(data)
-
 	resp := protocol.ScreenshotResponse{
 		Data:      base64Data,
 		Width:     width,
@@ -769,10 +811,16 @@ func (c *Client) handleScreenshotRequest(stream net.Conn, msg *protocol.Message)
 	protocol.WriteMessage(stream, respMsg)
 }
 
-// handleShellExecuteRequest 处理 Shell 执行请求
 func (c *Client) handleShellExecuteRequest(stream net.Conn, msg *protocol.Message) {
 	defer stream.Close()
 
+	if !c.features.AllowShellExecute {
+		resp := protocol.ShellExecuteResponse{ExitCode: -1, Error: "remote shell execution not supported on this platform"}
+		respMsg, _ := protocol.NewMessage(protocol.MsgTypeShellExecuteResponse, resp)
+		protocol.WriteMessage(stream, respMsg)
+		return
+	}
+
 	var req protocol.ShellExecuteRequest
 	if err := msg.ParsePayload(&req); err != nil {
 		resp := protocol.ShellExecuteResponse{Error: err.Error(), ExitCode: -1}
@@ -781,7 +829,6 @@ func (c *Client) handleShellExecuteRequest(stream net.Conn, msg *protocol.Messag
 		return
 	}
 
-	// 设置默认超时
 	timeout := req.Timeout
 	if timeout <= 0 {
 		timeout = 30
@@ -789,7 +836,6 @@ func (c *Client) handleShellExecuteRequest(stream net.Conn, msg *protocol.Messag
 
 	c.logf("Executing shell command: %s", req.Command)
 
-	// 根据操作系统选择 shell
 	var cmd *exec.Cmd
 	if runtime.GOOS == "windows" {
 		cmd = exec.Command("cmd", "/C", req.Command)
@@ -797,12 +843,10 @@ func (c *Client) handleShellExecuteRequest(stream net.Conn, msg *protocol.Messag
 		cmd = exec.Command("sh", "-c", req.Command)
 	}
 
-	// 设置超时上下文
 	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(timeout)*time.Second)
 	defer cancel()
 	cmd = exec.CommandContext(ctx, cmd.Path, cmd.Args[1:]...)
 
-	// 执行命令并获取输出
 	output, err := cmd.CombinedOutput()
 
 	exitCode := 0

internal/client/tunnel/identity.go

@@ -0,0 +1,90 @@
+package tunnel
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+
+	"github.com/google/uuid"
+)
+
+const clientIDFileName = "client.id"
+
+func resolveDataDir(explicit string) string {
+	if explicit != "" {
+		return explicit
+	}
+
+	if envDir := strings.TrimSpace(os.Getenv("GOTUNNEL_DATA_DIR")); envDir != "" {
+		return envDir
+	}
+
+	if configDir, err := os.UserConfigDir(); err == nil && configDir != "" {
+		return filepath.Join(configDir, "gotunnel")
+	}
+
+	if home, err := os.UserHomeDir(); err == nil && home != "" {
+		return filepath.Join(home, ".gotunnel")
+	}
+
+	if cwd, err := os.Getwd(); err == nil && cwd != "" {
+		return filepath.Join(cwd, ".gotunnel")
+	}
+
+	return ".gotunnel"
+}
+
+func resolveClientName(explicit string) string {
+	if explicit != "" {
+		return explicit
+	}
+
+	if hostname, err := os.Hostname(); err == nil && hostname != "" {
+		return hostname
+	}
+
+	if runtime.GOOS == "android" {
+		return "android-device"
+	}
+
+	return "gotunnel-client"
+}
+
+func resolveClientID(dataDir, explicit string) string {
+	if explicit != "" {
+		_ = persistClientID(dataDir, explicit)
+		return explicit
+	}
+
+	if id := loadClientID(dataDir); id != "" {
+		return id
+	}
+
+	if id := getMachineID(); id != "" {
+		_ = persistClientID(dataDir, id)
+		return id
+	}
+
+	id := strings.ReplaceAll(uuid.NewString(), "-", "")[:16]
+	_ = persistClientID(dataDir, id)
+	return id
+}
+
+func loadClientID(dataDir string) string {
+	data, err := os.ReadFile(filepath.Join(dataDir, clientIDFileName))
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(string(data))
+}
+
+func persistClientID(dataDir, id string) error {
+	if id == "" {
+		return nil
+	}
+	if err := os.MkdirAll(dataDir, 0755); err != nil {
+		return err
+	}
+	return os.WriteFile(filepath.Join(dataDir, clientIDFileName), []byte(id+"\n"), 0600)
+}

internal/client/tunnel/machine_id.go

@@ -14,11 +14,15 @@ import (
 // getMachineID builds a stable fingerprint from multiple host identifiers
 // and hashes the combined result into the client ID we expose externally.
 func getMachineID() string {
-	return hashID(strings.Join(collectMachineIDParts(), "|"))
+	parts := collectMachineIDParts()
+	if len(parts) == 0 {
+		return ""
+	}
+	return hashID(strings.Join(parts, "|"))
 }
 
 func collectMachineIDParts() []string {
-	parts := []string{"os=" + runtime.GOOS, "arch=" + runtime.GOARCH}
+	parts := make([]string, 0, 6)
 
 	if id := getSystemMachineID(); id != "" {
 		parts = append(parts, "system="+id)
@@ -36,6 +40,11 @@ func collectMachineIDParts() []string {
 		parts = append(parts, "ifaces="+strings.Join(names, ","))
 	}
 
+	if len(parts) == 0 {
+		return nil
+	}
+
+	parts = append(parts, "os="+runtime.GOOS, "arch="+runtime.GOARCH)
 	return parts
 }
 
@@ -47,6 +56,8 @@ func getSystemMachineID() string {
 		return getDarwinMachineID()
 	case "windows":
 		return getWindowsMachineID()
+	case "android":
+		return ""
 	default:
 		return ""
 	}

internal/client/tunnel/options.go

@@ -0,0 +1,41 @@
+package tunnel
+
+import "time"
+
+// PlatformFeatures controls which platform-specific capabilities the client may use.
+type PlatformFeatures struct {
+	AllowSelfUpdate   bool
+	AllowScreenshot   bool
+	AllowShellExecute bool
+	AllowSystemStats  bool
+}
+
+// ClientOptions controls optional client runtime settings.
+type ClientOptions struct {
+	DataDir           string
+	ClientID          string
+	ClientName        string
+	Features          *PlatformFeatures
+	ReconnectDelay    time.Duration
+	ReconnectMaxDelay time.Duration
+}
+
+// DefaultPlatformFeatures enables the desktop feature set.
+func DefaultPlatformFeatures() PlatformFeatures {
+	return PlatformFeatures{
+		AllowSelfUpdate:   true,
+		AllowScreenshot:   true,
+		AllowShellExecute: true,
+		AllowSystemStats:  true,
+	}
+}
+
+// MobilePlatformFeatures disables capabilities that are unsuitable for a mobile sandbox.
+func MobilePlatformFeatures() PlatformFeatures {
+	return PlatformFeatures{
+		AllowSelfUpdate:   false,
+		AllowScreenshot:   false,
+		AllowShellExecute: false,
+		AllowSystemStats:  true,
+	}
+}

internal/server/router/handler/install.go

@@ -3,7 +3,10 @@ package handler
 import (
 	"crypto/rand"
 	"encoding/hex"
+	"fmt"
+	"io"
 	"net/http"
+	"strings"
 	"time"
 
 	"github.com/gin-gonic/gin"
@@ -14,6 +17,11 @@ type InstallHandler struct {
 	app AppInterface
 }
 
+const (
+	installTokenHeader = "X-GoTunnel-Install-Token"
+	installTokenTTL    = 3600
+)
+
 func NewInstallHandler(app AppInterface) *InstallHandler {
 	return &InstallHandler{app: app}
 }
@@ -61,7 +69,115 @@ func (h *InstallHandler) GenerateInstallCommand(c *gin.Context) {
 
 	c.JSON(http.StatusOK, InstallCommandResponse{
 		Token:      token,
-		ExpiresAt:  now + 3600,
+		ExpiresAt:  now + installTokenTTL,
 		TunnelPort: h.app.GetServer().GetBindPort(),
 	})
 }
+
+func (h *InstallHandler) ServeShellScript(c *gin.Context) {
+	if !h.validateInstallToken(c) {
+		return
+	}
+
+	applyInstallSecurityHeaders(c)
+	c.Header("Content-Type", "text/x-shellscript; charset=utf-8")
+	c.String(http.StatusOK, shellInstallScript)
+}
+
+func (h *InstallHandler) ServePowerShellScript(c *gin.Context) {
+	if !h.validateInstallToken(c) {
+		return
+	}
+
+	applyInstallSecurityHeaders(c)
+	c.Header("Content-Type", "text/plain; charset=utf-8")
+	c.String(http.StatusOK, powerShellInstallScript)
+}
+
+func (h *InstallHandler) DownloadClient(c *gin.Context) {
+	if !h.validateInstallToken(c) {
+		return
+	}
+
+	osName := c.Query("os")
+	arch := c.Query("arch")
+
+	updateInfo, err := checkClientUpdateForPlatform(osName, arch)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to resolve client package"})
+		return
+	}
+	if updateInfo.DownloadURL == "" {
+		c.JSON(http.StatusNotFound, gin.H{"error": "no client package found for this platform"})
+		return
+	}
+
+	req, err := http.NewRequestWithContext(c.Request.Context(), http.MethodGet, updateInfo.DownloadURL, nil)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create download request"})
+		return
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		c.JSON(http.StatusBadGateway, gin.H{"error": "failed to download client package"})
+		return
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		c.JSON(http.StatusBadGateway, gin.H{"error": fmt.Sprintf("upstream returned %s", resp.Status)})
+		return
+	}
+
+	contentType := resp.Header.Get("Content-Type")
+	if contentType == "" {
+		contentType = "application/octet-stream"
+	}
+
+	applyInstallSecurityHeaders(c)
+	c.Header("Content-Type", contentType)
+	if contentLength := resp.Header.Get("Content-Length"); contentLength != "" {
+		c.Header("Content-Length", contentLength)
+	}
+	if updateInfo.AssetName != "" {
+		c.Header("Content-Disposition", fmt.Sprintf(`attachment; filename="%s"`, updateInfo.AssetName))
+	}
+
+	c.Status(http.StatusOK)
+	_, _ = io.Copy(c.Writer, resp.Body)
+}
+
+func (h *InstallHandler) validateInstallToken(c *gin.Context) bool {
+	token := strings.TrimSpace(c.GetHeader(installTokenHeader))
+	if token == "" {
+		c.AbortWithStatus(http.StatusNotFound)
+		return false
+	}
+
+	store, ok := h.app.GetClientStore().(db.InstallTokenStore)
+	if !ok {
+		c.AbortWithStatus(http.StatusNotFound)
+		return false
+	}
+
+	installToken, err := store.GetInstallToken(token)
+	if err != nil {
+		c.AbortWithStatus(http.StatusNotFound)
+		return false
+	}
+
+	if installToken.Used || time.Now().Unix()-installToken.CreatedAt >= installTokenTTL {
+		c.AbortWithStatus(http.StatusNotFound)
+		return false
+	}
+
+	return true
+}
+
+func applyInstallSecurityHeaders(c *gin.Context) {
+	c.Header("Cache-Control", "no-store, no-cache, must-revalidate, max-age=0")
+	c.Header("Pragma", "no-cache")
+	c.Header("X-Content-Type-Options", "nosniff")
+	c.Header("X-Robots-Tag", "noindex, nofollow, noarchive")
+}

internal/server/router/handler/install_scripts.go

@@ -0,0 +1,185 @@
+package handler
+
+const shellInstallScript = `#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage: bash install.sh -s <server:port> -t <token> -b <web-base-url>
+
+Options:
+  -s  Tunnel server address, for example 10.0.0.2:7000
+  -t  One-time install token generated by the server
+  -b  Web console base URL, for example https://example.com:7500
+EOF
+}
+
+require_cmd() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    echo "missing required command: $1" >&2
+    exit 1
+  fi
+}
+
+detect_os() {
+  case "$(uname -s)" in
+    Linux) echo "linux" ;;
+    Darwin) echo "darwin" ;;
+    *)
+      echo "unsupported operating system: $(uname -s)" >&2
+      exit 1
+      ;;
+  esac
+}
+
+detect_arch() {
+  case "$(uname -m)" in
+    x86_64|amd64) echo "amd64" ;;
+    aarch64|arm64) echo "arm64" ;;
+    i386|i686) echo "386" ;;
+    armv7l|armv6l|arm) echo "arm" ;;
+    *)
+      echo "unsupported architecture: $(uname -m)" >&2
+      exit 1
+      ;;
+  esac
+}
+
+SERVER_ADDR=""
+INSTALL_TOKEN=""
+BASE_URL=""
+
+while getopts ":s:t:b:h" opt; do
+  case "$opt" in
+    s) SERVER_ADDR="$OPTARG" ;;
+    t) INSTALL_TOKEN="$OPTARG" ;;
+    b) BASE_URL="$OPTARG" ;;
+    h)
+      usage
+      exit 0
+      ;;
+    :)
+      echo "option -$OPTARG requires a value" >&2
+      usage
+      exit 1
+      ;;
+    \?)
+      echo "unknown option: -$OPTARG" >&2
+      usage
+      exit 1
+      ;;
+  esac
+done
+
+if [[ -z "$SERVER_ADDR" || -z "$INSTALL_TOKEN" || -z "$BASE_URL" ]]; then
+  usage
+  exit 1
+fi
+
+require_cmd curl
+require_cmd tar
+require_cmd mktemp
+
+OS_NAME="$(detect_os)"
+ARCH_NAME="$(detect_arch)"
+BASE_URL="${BASE_URL%/}"
+INSTALL_ROOT="${HOME:-$(pwd)}/.gotunnel"
+BIN_DIR="$INSTALL_ROOT/bin"
+TARGET_BIN="$BIN_DIR/gotunnel-client"
+LOG_FILE="$INSTALL_ROOT/client.log"
+PID_FILE="$INSTALL_ROOT/client.pid"
+TMP_DIR="$(mktemp -d)"
+ARCHIVE_PATH="$TMP_DIR/gotunnel-client.tar.gz"
+DOWNLOAD_URL="$BASE_URL/install/client?os=$OS_NAME&arch=$ARCH_NAME"
+
+cleanup() {
+  rm -rf "$TMP_DIR"
+}
+trap cleanup EXIT
+
+mkdir -p "$BIN_DIR"
+
+echo "Downloading GoTunnel client from $DOWNLOAD_URL"
+curl -fsSL -H "X-GoTunnel-Install-Token: $INSTALL_TOKEN" "$DOWNLOAD_URL" -o "$ARCHIVE_PATH"
+tar -xzf "$ARCHIVE_PATH" -C "$TMP_DIR"
+
+EXTRACTED_BIN="$(find "$TMP_DIR" -type f -name 'gotunnel-client*' ! -name '*.tar.gz' ! -name '*.zip' | head -n 1)"
+if [[ -z "$EXTRACTED_BIN" ]]; then
+  echo "failed to find extracted client binary" >&2
+  exit 1
+fi
+
+cp "$EXTRACTED_BIN" "$TARGET_BIN"
+chmod 0755 "$TARGET_BIN"
+
+if [[ -f "$PID_FILE" ]]; then
+  OLD_PID="$(cat "$PID_FILE" 2>/dev/null || true)"
+  if [[ -n "$OLD_PID" ]]; then
+    kill "$OLD_PID" >/dev/null 2>&1 || true
+  fi
+fi
+
+nohup "$TARGET_BIN" -s "$SERVER_ADDR" -t "$INSTALL_TOKEN" >>"$LOG_FILE" 2>&1 &
+NEW_PID=$!
+echo "$NEW_PID" >"$PID_FILE"
+
+echo "GoTunnel client installed to $TARGET_BIN"
+echo "Client started in background with PID $NEW_PID"
+echo "Logs: $LOG_FILE"
+`
+
+const powerShellInstallScript = `function Get-GoTunnelArch {
+  switch ([System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture.ToString().ToLowerInvariant()) {
+    'x64' { return 'amd64' }
+    'arm64' { return 'arm64' }
+    'x86' { return '386' }
+    default { throw "Unsupported architecture: $([System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture)" }
+  }
+}
+
+function Install-GoTunnel {
+  param(
+    [Parameter(Mandatory = $true)][string]$Server,
+    [Parameter(Mandatory = $true)][string]$Token,
+    [Parameter(Mandatory = $true)][string]$BaseUrl
+  )
+
+  $BaseUrl = $BaseUrl.TrimEnd('/')
+  $Arch = Get-GoTunnelArch
+  $InstallRoot = Join-Path $env:LOCALAPPDATA 'GoTunnel'
+  $ExtractDir = Join-Path $InstallRoot 'extract'
+  $ArchivePath = Join-Path $InstallRoot 'gotunnel-client.zip'
+  $TargetPath = Join-Path $InstallRoot 'gotunnel-client.exe'
+  $DownloadUrl = "$BaseUrl/install/client?os=windows&arch=$Arch"
+
+  New-Item -ItemType Directory -Force -Path $InstallRoot | Out-Null
+
+  Write-Host "Downloading GoTunnel client from $DownloadUrl"
+  $Headers = @{ 'X-GoTunnel-Install-Token' = $Token }
+  Invoke-WebRequest -Uri $DownloadUrl -Headers $Headers -OutFile $ArchivePath -MaximumRedirection 5
+
+  if (Test-Path $ExtractDir) {
+    Remove-Item -Path $ExtractDir -Recurse -Force
+  }
+  Expand-Archive -Path $ArchivePath -DestinationPath $ExtractDir -Force
+
+  $Binary = Get-ChildItem -Path $ExtractDir -Recurse -File |
+    Where-Object { $_.Name -eq 'gotunnel-client.exe' } |
+    Select-Object -First 1
+
+  if (-not $Binary) {
+    throw 'Failed to find extracted client binary.'
+  }
+
+  Copy-Item -Path $Binary.FullName -Destination $TargetPath -Force
+
+  Get-Process |
+    Where-Object { $_.Path -eq $TargetPath } |
+    Stop-Process -Force -ErrorAction SilentlyContinue
+
+  Start-Process -FilePath $TargetPath -ArgumentList @('-s', $Server, '-t', $Token) -WindowStyle Hidden
+
+  Write-Host "GoTunnel client installed to $TargetPath"
+  Write-Host 'Client started in background.'
+}
+`

internal/server/router/router.go

@@ -48,6 +48,11 @@ func (r *GinRouter) SetupRoutes(app handler.AppInterface, jwtAuth *auth.JWTAuth,
 	engine.POST("/api/auth/login", authHandler.Login)
 	engine.GET("/api/auth/check", authHandler.Check)
 
+	installHandler := handler.NewInstallHandler(app)
+	engine.GET("/install.sh", installHandler.ServeShellScript)
+	engine.GET("/install.ps1", installHandler.ServePowerShellScript)
+	engine.GET("/install/client", installHandler.DownloadClient)
+
 	// API 路由 (需要 JWT)
 	api := engine.Group("/api")
 	api.Use(middleware.JWTAuth(jwtAuth))
@@ -94,7 +99,6 @@ func (r *GinRouter) SetupRoutes(app handler.AppInterface, jwtAuth *auth.JWTAuth,
 		api.GET("/traffic/hourly", trafficHandler.GetHourly)
 
 		// 安装命令生成
-		installHandler := handler.NewInstallHandler(app)
 		api.POST("/install/generate", installHandler.GenerateInstallCommand)
 	}
 }

mobile/gotunnelmobile/gotunnelmobile.go

@@ -0,0 +1,144 @@
+package gotunnelmobile
+
+import (
+	"context"
+	"strings"
+	"sync"
+
+	"github.com/gotunnel/internal/client/tunnel"
+	"github.com/gotunnel/pkg/crypto"
+)
+
+// Service exposes a gomobile-friendly wrapper around the Go tunnel client.
+type Service struct {
+	mu sync.Mutex
+
+	server     string
+	token      string
+	dataDir    string
+	clientName string
+	clientID   string
+	disableTLS bool
+
+	client    *tunnel.Client
+	cancel    context.CancelFunc
+	running   bool
+	status    string
+	lastError string
+}
+
+// NewService creates a mobile client service wrapper.
+func NewService() *Service {
+	return &Service{status: "stopped"}
+}
+
+// Configure stores the parameters used by Start.
+func (s *Service) Configure(server, token, dataDir, clientName, clientID string, disableTLS bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.server = strings.TrimSpace(server)
+	s.token = strings.TrimSpace(token)
+	s.dataDir = strings.TrimSpace(dataDir)
+	s.clientName = strings.TrimSpace(clientName)
+	s.clientID = strings.TrimSpace(clientID)
+	s.disableTLS = disableTLS
+}
+
+// Start launches the tunnel loop in the background.
+func (s *Service) Start() string {
+	s.mu.Lock()
+	if s.running {
+		s.mu.Unlock()
+		return ""
+	}
+	if s.server == "" || s.token == "" {
+		s.mu.Unlock()
+		return "server and token are required"
+	}
+
+	features := tunnel.MobilePlatformFeatures()
+	client := tunnel.NewClientWithOptions(s.server, s.token, tunnel.ClientOptions{
+		DataDir:    s.dataDir,
+		ClientID:   s.clientID,
+		ClientName: s.clientName,
+		Features:   &features,
+	})
+	if !s.disableTLS {
+		client.TLSEnabled = true
+		client.TLSConfig = crypto.ClientTLSConfig()
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	s.client = client
+	s.cancel = cancel
+	s.running = true
+	s.status = "running"
+	s.lastError = ""
+	s.mu.Unlock()
+
+	go func() {
+		err := client.RunContext(ctx)
+
+		s.mu.Lock()
+		defer s.mu.Unlock()
+		s.running = false
+		s.cancel = nil
+		s.client = nil
+
+		if err != nil {
+			s.status = "error"
+			s.lastError = err.Error()
+			return
+		}
+
+		if s.status != "stopped" {
+			s.status = "stopped"
+		}
+	}()
+
+	return ""
+}
+
+// Stop cancels the running tunnel loop.
+func (s *Service) Stop() string {
+	s.mu.Lock()
+	cancel := s.cancel
+	s.cancel = nil
+	s.running = false
+	s.status = "stopped"
+	s.mu.Unlock()
+
+	if cancel != nil {
+		cancel()
+	}
+
+	return ""
+}
+
+// Restart restarts the service with the stored configuration.
+func (s *Service) Restart() string {
+	s.Stop()
+	return s.Start()
+}
+
+// IsRunning reports whether the tunnel loop is active.
+func (s *Service) IsRunning() bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.running
+}
+
+// Status returns a coarse-grained runtime status.
+func (s *Service) Status() string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.status
+}
+
+// LastError returns the last background error string, if any.
+func (s *Service) LastError() string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.lastError
+}

pkg/utils/screenshot_desktop.go

@@ -1,3 +1,5 @@
+//go:build windows || linux || darwin
+
 package utils
 
 import (
@@ -9,34 +11,27 @@ import (
 	"github.com/kbinani/screenshot"
 )
 
-// CaptureScreenshot 捕获主屏幕截图
+// CaptureScreenshot captures the primary display.
-// quality: JPEG 质量 (1-100), 0 使用默认值 (75)
-// 返回: JPEG 图片数据, 宽度, 高度, 错误
 func CaptureScreenshot(quality int) ([]byte, int, int, error) {
-	// 默认质量
 	if quality <= 0 || quality > 100 {
 		quality = 75
 	}
 
-	// 获取活动显示器数量
 	n := screenshot.NumActiveDisplays()
 	if n == 0 {
 		return nil, 0, 0, fmt.Errorf("no active display found")
 	}
 
-	// 获取主显示器边界
 	bounds := screenshot.GetDisplayBounds(0)
 	if bounds.Empty() {
 		return nil, 0, 0, fmt.Errorf("failed to get display bounds")
 	}
 
-	// 捕获屏幕
 	img, err := screenshot.CaptureRect(bounds)
 	if err != nil {
 		return nil, 0, 0, fmt.Errorf("capture screen: %w", err)
 	}
 
-	// 编码为 JPEG
 	var buf bytes.Buffer
 	opts := &jpeg.Options{Quality: quality}
 	if err := jpeg.Encode(&buf, img, opts); err != nil {
@@ -46,40 +41,30 @@ func CaptureScreenshot(quality int) ([]byte, int, int, error) {
 	return buf.Bytes(), bounds.Dx(), bounds.Dy(), nil
 }
 
-// CaptureAllScreens 捕获所有屏幕并拼接
+// CaptureAllScreens captures all active displays and stitches them together.
-// quality: JPEG 质量 (1-100), 0 使用默认值 (75)
-// 返回: JPEG 图片数据, 宽度, 高度, 错误
 func CaptureAllScreens(quality int) ([]byte, int, int, error) {
-	// 默认质量
 	if quality <= 0 || quality > 100 {
 		quality = 75
 	}
 
-	// 获取活动显示器数量
 	n := screenshot.NumActiveDisplays()
 	if n == 0 {
 		return nil, 0, 0, fmt.Errorf("no active display found")
 	}
 
-	// 计算所有屏幕的总边界
 	var totalBounds image.Rectangle
 	for i := 0; i < n; i++ {
 		bounds := screenshot.GetDisplayBounds(i)
 		totalBounds = totalBounds.Union(bounds)
 	}
 
-	// 创建总画布
 	totalImg := image.NewRGBA(totalBounds)
-
-	// 捕获每个屏幕并绘制到总画布
 	for i := 0; i < n; i++ {
 		bounds := screenshot.GetDisplayBounds(i)
 		img, err := screenshot.CaptureRect(bounds)
 		if err != nil {
-			continue // 跳过失败的屏幕
+			continue
 		}
-
-		// 绘制到总画布
 		for y := bounds.Min.Y; y < bounds.Max.Y; y++ {
 			for x := bounds.Min.X; x < bounds.Max.X; x++ {
 				totalImg.Set(x, y, img.At(x-bounds.Min.X, y-bounds.Min.Y))
@@ -87,7 +72,6 @@ func CaptureAllScreens(quality int) ([]byte, int, int, error) {
 		}
 	}
 
-	// 编码为 JPEG
 	var buf bytes.Buffer
 	opts := &jpeg.Options{Quality: quality}
 	if err := jpeg.Encode(&buf, totalImg, opts); err != nil {

pkg/utils/screenshot_stub.go

@@ -0,0 +1,15 @@
+//go:build !windows && !linux && !darwin
+
+package utils
+
+import "fmt"
+
+// CaptureScreenshot is not available on this platform.
+func CaptureScreenshot(quality int) ([]byte, int, int, error) {
+	return nil, 0, 0, fmt.Errorf("screenshot not supported on this platform")
+}
+
+// CaptureAllScreens is not available on this platform.
+func CaptureAllScreens(quality int) ([]byte, int, int, error) {
+	return nil, 0, 0, fmt.Errorf("screenshot not supported on this platform")
+}

pkg/version/version.go

@@ -11,37 +11,19 @@ import (
 	"time"
 )
 
-// 版本信息
 var Version = "1.0.0"
 var GitCommit = ""
 var BuildTime = ""
 
-// SetVersion 设置版本号（由 main 包在初始化时调用）
-func SetVersion(v string) {
-	if v != "" {
-		Version = v
-	}
-}
-
-// SetBuildInfo 设置构建信息（由 main 包在初始化时调用）
-func SetBuildInfo(gitCommit, buildTime string) {
-	if gitCommit != "" {
-		GitCommit = gitCommit
-	}
-	if buildTime != "" {
-		BuildTime = buildTime
-	}
-}
-
-// 仓库信息
 const (
-	RepoURL    = "https://git.92coco.cn/flik/GoTunnel"
+	RepoURL          = "https://github.com/Flikify/Gotunnel"
-	APIBaseURL = "https://git.92coco.cn/api/v1"
+	APIBaseURL       = "https://api.github.com"
-	RepoOwner  = "flik"
+	RepoOwner        = "Flikify"
-	RepoName   = "GoTunnel"
+	RepoName         = "Gotunnel"
+	GitHubAPIVersion = "2022-11-28"
+	GitHubUserAgent  = "GoTunnel-Updater"
 )
 
-// Info 版本详细信息
 type Info struct {
 	Version   string `json:"version"`
 	GitCommit string `json:"git_commit"`
@@ -51,7 +33,43 @@ type Info struct {
 	Arch      string `json:"arch"`
 }
 
-// GetInfo 获取版本信息
+type ReleaseInfo struct {
+	TagName     string         `json:"tag_name"`
+	Name        string         `json:"name"`
+	Body        string         `json:"body"`
+	PublishedAt string         `json:"published_at"`
+	Assets      []ReleaseAsset `json:"assets"`
+}
+
+type ReleaseAsset struct {
+	Name               string `json:"name"`
+	Size               int64  `json:"size"`
+	BrowserDownloadURL string `json:"browser_download_url"`
+}
+
+type UpdateInfo struct {
+	Latest      string `json:"latest"`
+	ReleaseNote string `json:"release_note"`
+	DownloadURL string `json:"download_url"`
+	AssetName   string `json:"asset_name"`
+	AssetSize   int64  `json:"asset_size"`
+}
+
+func SetVersion(v string) {
+	if v != "" {
+		Version = v
+	}
+}
+
+func SetBuildInfo(gitCommit, buildTime string) {
+	if gitCommit != "" {
+		GitCommit = gitCommit
+	}
+	if buildTime != "" {
+		BuildTime = buildTime
+	}
+}
+
 func GetInfo() Info {
 	return Info{
 		Version:   Version,
@@ -63,39 +81,27 @@ func GetInfo() Info {
 	}
 }
 
-// ReleaseInfo Release 信息
+func newGitHubRequest(url string) (*http.Request, error) {
-type ReleaseInfo struct {
+	req, err := http.NewRequest(http.MethodGet, url, nil)
-	TagName     string         `json:"tag_name"`
+	if err != nil {
-	Name        string         `json:"name"`
+		return nil, err
-	Body        string         `json:"body"`
+	}
-	PublishedAt string         `json:"published_at"`
+	req.Header.Set("Accept", "application/vnd.github+json")
-	Assets      []ReleaseAsset `json:"assets"`
+	req.Header.Set("X-GitHub-Api-Version", GitHubAPIVersion)
+	req.Header.Set("User-Agent", GitHubUserAgent)
+	return req, nil
 }
 
-// ReleaseAsset Release 资产
-type ReleaseAsset struct {
-	Name               string `json:"name"`
-	Size               int64  `json:"size"`
-	BrowserDownloadURL string `json:"browser_download_url"`
-}
-
-// UpdateInfo 更新信息
-type UpdateInfo struct {
-	Latest      string `json:"latest"`
-	ReleaseNote string `json:"release_note"`
-	DownloadURL string `json:"download_url"`
-	AssetName   string `json:"asset_name"`
-	AssetSize   int64  `json:"asset_size"`
-}
-
-// GetLatestRelease 获取最新 Release
-// Gitea 兼容：先尝试 /releases/latest，失败则尝试 /releases 取第一个
 func GetLatestRelease() (*ReleaseInfo, error) {
 	client := &http.Client{Timeout: 30 * time.Second}
 
-	// 首先尝试 /releases/latest 端点（GitHub 兼容）
 	latestURL := fmt.Sprintf("%s/repos/%s/%s/releases/latest", APIBaseURL, RepoOwner, RepoName)
-	resp, err := client.Get(latestURL)
+	req, err := newGitHubRequest(latestURL)
+	if err != nil {
+		return nil, fmt.Errorf("build request: %w", err)
+	}
+
+	resp, err := client.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("request failed: %w", err)
 	}
@@ -109,10 +115,15 @@ func GetLatestRelease() (*ReleaseInfo, error) {
 		return &release, nil
 	}
 
-	// 如果 /releases/latest 不可用，尝试 /releases 并取第一个
 	resp.Body.Close()
-	listURL := fmt.Sprintf("%s/repos/%s/%s/releases?limit=1", APIBaseURL, RepoOwner, RepoName)
+
-	resp, err = client.Get(listURL)
+	listURL := fmt.Sprintf("%s/repos/%s/%s/releases?per_page=1", APIBaseURL, RepoOwner, RepoName)
+	req, err = newGitHubRequest(listURL)
+	if err != nil {
+		return nil, fmt.Errorf("build request: %w", err)
+	}
+
+	resp, err = client.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("request failed: %w", err)
 	}
@@ -135,14 +146,12 @@ func GetLatestRelease() (*ReleaseInfo, error) {
 	return &releases[0], nil
 }
 
-// CheckUpdate 检查更新（返回最新版本信息）
 func CheckUpdate(component string) (*UpdateInfo, error) {
 	release, err := GetLatestRelease()
 	if err != nil {
 		return nil, fmt.Errorf("get latest release: %w", err)
 	}
 
-	// 查找对应平台的资产
 	var downloadURL string
 	var assetName string
 	var assetSize int64
@@ -162,14 +171,12 @@ func CheckUpdate(component string) (*UpdateInfo, error) {
 	}, nil
 }
 
-// CheckUpdateForPlatform 检查指定平台的更新
 func CheckUpdateForPlatform(component, osName, arch string) (*UpdateInfo, error) {
 	release, err := GetLatestRelease()
 	if err != nil {
 		return nil, fmt.Errorf("get latest release: %w", err)
 	}
 
-	// 查找对应平台的资产
 	var downloadURL string
 	var assetName string
 	var assetSize int64
@@ -189,17 +196,12 @@ func CheckUpdateForPlatform(component, osName, arch string) (*UpdateInfo, error)
 	}, nil
 }
 
-// findAssetForPlatform 在 Release 资产中查找匹配的文件
 func findAssetForPlatform(assets []ReleaseAsset, component, osName, arch string) *ReleaseAsset {
-	// 构建匹配模式
-	// CI 格式: gotunnel-server-v1.0.0-linux-amd64.tar.gz
-	// 或者:    gotunnel-client-v1.0.0-windows-amd64.zip
 	prefix := fmt.Sprintf("gotunnel-%s-", component)
 	suffix := fmt.Sprintf("-%s-%s", osName, arch)
 
 	for i := range assets {
 		name := assets[i].Name
-		// 检查是否匹配 gotunnel-{component}-{version}-{os}-{arch}.{ext}
 		if strings.HasPrefix(name, prefix) && strings.Contains(name, suffix) {
 			return &assets[i]
 		}
@@ -207,8 +209,6 @@ func findAssetForPlatform(assets []ReleaseAsset, component, osName, arch string)
 	return nil
 }
 
-// CompareVersions 比较版本号
-// 返回: -1 (v1 < v2), 0 (v1 == v2), 1 (v1 > v2)
 func CompareVersions(v1, v2 string) int {
 	parts1 := parseVersionParts(v1)
 	parts2 := parseVersionParts(v2)

scripts/build.ps1

@@ -1,6 +1,6 @@
 # GoTunnel Build Script for Windows
 # Usage: .\build.ps1 [command]
-# Commands: all, current, web, server, client, clean, help
+# Commands: all, current, web, server, client, android, clean, help
 
 param(
     [Parameter(Position=0)]
@@ -13,15 +13,11 @@ param(
 
 $ErrorActionPreference = "Stop"
 
-# 项目根目录
+$RootDir = Split-Path -Parent $PSScriptRoot
-$RootDir = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
-if (-not $RootDir) {
-    $RootDir = Split-Path -Parent (Split-Path -Parent $MyInvocation.MyCommand.Path)
-}
 $BuildDir = Join-Path $RootDir "build"
+$env:GOCACHE = if ($env:GOCACHE) { $env:GOCACHE } else { Join-Path $BuildDir ".gocache" }
 
-# 版本信息
+$BuildTime = (Get-Date).ToUniversalTime().ToString("yyyy-MM-dd HH:mm:ss")
-$BuildTime = (Get-Date -Format "yyyy-MM-dd HH:mm:ss")
 try {
     $GitCommit = (git -C $RootDir rev-parse --short HEAD 2>$null)
     if (-not $GitCommit) { $GitCommit = "unknown" }
@@ -29,17 +25,15 @@ try {
     $GitCommit = "unknown"
 }
 
-# 目标平台
+$DesktopPlatforms = @(
-$Platforms = @(
+    @{ OS = "windows"; Arch = "amd64" },
-    @{OS="windows"; Arch="amd64"},
+    @{ OS = "windows"; Arch = "arm64" },
-    @{OS="linux"; Arch="amd64"},
+    @{ OS = "linux"; Arch = "amd64" },
-    @{OS="linux"; Arch="arm64"},
+    @{ OS = "linux"; Arch = "arm64" },
-    @{OS="darwin"; Arch="amd64"},
+    @{ OS = "darwin"; Arch = "amd64" },
-    @{OS="darwin"; Arch="arm64"}
+    @{ OS = "darwin"; Arch = "arm64" }
-)
 )
 
-# 颜色输出函数
 function Write-Info {
     param([string]$Message)
     Write-Host "[INFO] " -ForegroundColor Green -NoNewline
@@ -58,7 +52,6 @@ function Write-Err {
     Write-Host $Message
 }
 
-# 检查 UPX 是否可用
 function Test-UPX {
     try {
         $null = Get-Command upx -ErrorAction Stop
@@ -68,16 +61,17 @@ function Test-UPX {
     }
 }
 
-# UPX 压缩二进制
 function Compress-Binary {
-    param([string]$FilePath, [string]$OS)
+    param(
+        [string]$FilePath,
+        [string]$OS
+    )
 
     if ($NoUPX) { return }
     if (-not (Test-UPX)) {
         Write-Warn "UPX not found, skipping compression"
         return
     }
-    # macOS 二进制不支持 UPX
     if ($OS -eq "darwin") {
         Write-Warn "Skipping UPX for macOS binary: $FilePath"
         return
@@ -91,7 +85,6 @@ function Compress-Binary {
     }
 }
 
-# 构建 Web UI
 function Build-Web {
     Write-Info "Building web UI..."
 
@@ -111,7 +104,6 @@ function Build-Web {
         Pop-Location
     }
 
-    # 复制到 embed 目录
     Write-Info "Copying dist to embed directory..."
     $DistSource = Join-Path $WebDir "dist"
     $DistDest = Join-Path $RootDir "internal\server\app\dist"
@@ -124,51 +116,55 @@ function Build-Web {
     Write-Info "Web UI built successfully"
 }
 
-# 构建单个二进制
+function Get-OutputName {
+    param(
+        [string]$Component,
+        [string]$OS
+    )
+
+    if ($OS -eq "windows") {
+        return "$Component.exe"
+    }
+
+    return $Component
+}
+
 function Build-Binary {
     param(
         [string]$OS,
         [string]$Arch,
-        [string]$Component  # server 或 client
+        [string]$Component
     )
 
-    $OutputName = $Component
-    if ($OS -eq "windows") {
-        $OutputName = "$Component.exe"
-    }
-
     $OutputDir = Join-Path $BuildDir "${OS}_${Arch}"
     if (-not (Test-Path $OutputDir)) {
         New-Item -ItemType Directory -Path $OutputDir -Force | Out-Null
     }
 
+    $OutputName = Get-OutputName -Component $Component -OS $OS
+    $OutputPath = Join-Path $OutputDir $OutputName
+    $SourcePath = Join-Path $RootDir "cmd\$Component"
+
     Write-Info "Building $Component for $OS/$Arch..."
 
     $env:GOOS = $OS
     $env:GOARCH = $Arch
     $env:CGO_ENABLED = "0"
 
-    $LDFlags = "-s -w -X 'github.com/gotunnel/pkg/version.Version=$Version' -X 'github.com/gotunnel/pkg/version.BuildTime=$BuildTime' -X 'github.com/gotunnel/pkg/version.GitCommit=$GitCommit'"
+    $LdFlags = "-s -w -X 'main.Version=$Version' -X 'main.BuildTime=$BuildTime' -X 'main.GitCommit=$GitCommit'"
-    $OutputPath = Join-Path $OutputDir $OutputName
+    & go build -buildvcs=false -trimpath -ldflags $LdFlags -o $OutputPath $SourcePath
-    $SourcePath = Join-Path $RootDir "cmd\$Component"
-
-    & go build -ldflags $LDFlags -o $OutputPath $SourcePath
 
     if ($LASTEXITCODE -ne 0) {
         throw "Build failed for $Component $OS/$Arch"
     }
 
-    # UPX 压缩
     Compress-Binary -FilePath $OutputPath -OS $OS
-
-    # 显示文件大小
     $FileSize = (Get-Item $OutputPath).Length / 1MB
-    Write-Info "  -> $OutputPath ({0:N2} MB)" -f $FileSize
+    Write-Info ("  -> {0} ({1:N2} MB)" -f $OutputPath, $FileSize)
 }
 
-# 构建所有平台
 function Build-All {
-    foreach ($Platform in $Platforms) {
+    foreach ($Platform in $DesktopPlatforms) {
         Build-Binary -OS $Platform.OS -Arch $Platform.Arch -Component "server"
         Build-Binary -OS $Platform.OS -Arch $Platform.Arch -Component "client"
     }
@@ -184,7 +180,6 @@ function Build-All {
     }
 }
 
-# 仅构建当前平台
 function Build-Current {
     $OS = go env GOOS
     $Arch = go env GOARCH
@@ -195,7 +190,51 @@ function Build-Current {
     Write-Info "Binaries built in $BuildDir\${OS}_${Arch}\"
 }
 
-# 清理构建产物
+function Build-Android {
+    $OutputDir = Join-Path $BuildDir "android_arm64"
+    if (-not (Test-Path $OutputDir)) {
+        New-Item -ItemType Directory -Path $OutputDir -Force | Out-Null
+    }
+
+    Write-Info "Building client for android/arm64..."
+    $env:GOOS = "android"
+    $env:GOARCH = "arm64"
+    $env:CGO_ENABLED = "0"
+
+    $OutputPath = Join-Path $OutputDir "client"
+    $LdFlags = "-s -w -X 'main.Version=$Version' -X 'main.BuildTime=$BuildTime' -X 'main.GitCommit=$GitCommit'"
+    & go build -buildvcs=false -trimpath -ldflags $LdFlags -o $OutputPath (Join-Path $RootDir "cmd\client")
+    if ($LASTEXITCODE -ne 0) {
+        throw "Build failed for client android/arm64"
+    }
+
+    if (Get-Command gomobile -ErrorAction SilentlyContinue) {
+        Write-Info "Building gomobile Android binding..."
+        & gomobile bind -target android/arm64 -o (Join-Path $OutputDir "gotunnelmobile.aar") "github.com/gotunnel/mobile/gotunnelmobile"
+        if ($LASTEXITCODE -ne 0) {
+            throw "gomobile bind failed"
+        }
+    } else {
+        Write-Warn "gomobile not found, skipping Android AAR build"
+    }
+
+    $GradleWrapper = Join-Path $RootDir "android\gradlew.bat"
+    if (Test-Path $GradleWrapper) {
+        Write-Info "Building Android debug APK..."
+        Push-Location (Join-Path $RootDir "android")
+        try {
+            & $GradleWrapper assembleDebug
+            if ($LASTEXITCODE -ne 0) {
+                throw "Android APK build failed"
+            }
+        } finally {
+            Pop-Location
+        }
+    } else {
+        Write-Warn "android\\gradlew.bat not found, skipping APK build"
+    }
+}
+
 function Clean-Build {
     Write-Info "Cleaning build directory..."
     if (Test-Path $BuildDir) {
@@ -204,7 +243,6 @@ function Clean-Build {
     Write-Info "Clean completed"
 }
 
-# 显示帮助
 function Show-Help {
     Write-Host @"
 GoTunnel Build Script for Windows
@@ -212,11 +250,12 @@ GoTunnel Build Script for Windows
 Usage: .\build.ps1 [command] [-Version <version>] [-NoUPX]
 
 Commands:
-  all       Build web UI + all platforms (default)
+  all       Build web UI + all desktop platforms (default)
   current   Build web UI + current platform only
   web       Build web UI only
   server    Build server for current platform
   client    Build client for current platform
+  android   Build android/arm64 client and optional Android artifacts
   clean     Clean build directory
   help      Show this help message
 
@@ -226,20 +265,20 @@ Options:
 
 Target platforms:
   - windows/amd64
+  - windows/arm64
   - linux/amd64
   - linux/arm64
-  - darwin/amd64 (macOS Intel)
+  - darwin/amd64
-  - darwin/arm64 (macOS Apple Silicon)
+  - darwin/arm64
 
 Examples:
-  .\build.ps1                    # Build all platforms
+  .\build.ps1                    # Build all desktop platforms
   .\build.ps1 all -Version 1.0.0 # Build with version
   .\build.ps1 current            # Build current platform only
   .\build.ps1 clean              # Clean build directory
 "@
 }
 
-# 主函数
 function Main {
     Push-Location $RootDir
 
@@ -270,10 +309,13 @@ function Main {
                 $Arch = go env GOARCH
                 Build-Binary -OS $OS -Arch $Arch -Component "client"
             }
+            "android" {
+                Build-Android
+            }
             "clean" {
                 Clean-Build
             }
-            { $_ -in "help", "--help", "-h", "/?" } {
+            { $_ -in @("help", "--help", "-h", "/?") } {
                 Show-Help
                 return
             }
@@ -286,7 +328,6 @@ function Main {
 
         Write-Info ""
         Write-Info "Done!"
-
     } finally {
         Pop-Location
     }

scripts/build.sh

@@ -1,27 +1,22 @@
 #!/bin/bash
 
-set -e
+set -euo pipefail
 
-# 项目根目录
 ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 BUILD_DIR="$ROOT_DIR/build"
+export GOCACHE="${GOCACHE:-$BUILD_DIR/.gocache}"
 
-# 版本信息
 VERSION="${VERSION:-dev}"
-BUILD_TIME=$(date -u '+%Y-%m-%d %H:%M:%S')
+BUILD_TIME="$(date -u '+%Y-%m-%d %H:%M:%S')"
-GIT_COMMIT=$(git -C "$ROOT_DIR" rev-parse --short HEAD 2>/dev/null || echo "unknown")
+GIT_COMMIT="$(git -C "$ROOT_DIR" rev-parse --short HEAD 2>/dev/null || echo unknown)"
-
-# 默认目标平台
-DEFAULT_PLATFORMS="linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64"
-
-# 是否启用 UPX 压缩
 USE_UPX="${USE_UPX:-true}"
 
-# 颜色输出
+DESKTOP_PLATFORMS="linux/amd64 linux/arm64 windows/amd64 windows/arm64 darwin/amd64 darwin/arm64"
+
 RED='\033[0;31m'
 GREEN='\033[0;32m'
 YELLOW='\033[1;33m'
-NC='\033[0m' # No Color
+NC='\033[0m'
 
 log_info() {
     echo -e "${GREEN}[INFO]${NC} $1"
@@ -35,17 +30,14 @@ log_error() {
     echo -e "${RED}[ERROR]${NC} $1"
 }
 
-# 检查 UPX 是否可用
 check_upx() {
-    if command -v upx &> /dev/null; then
+    command -v upx >/dev/null 2>&1
-        return 0
-    fi
-    return 1
 }
 
-# UPX 压缩二进制
 compress_binary() {
     local file=$1
+    local os=$2
+
     if [ "$USE_UPX" != "true" ]; then
         return
     fi
@@ -53,27 +45,27 @@ compress_binary() {
         log_warn "UPX not found, skipping compression"
         return
     fi
-    # macOS 二进制不支持 UPX
+    if [ "$os" = "darwin" ]; then
-    if [[ "$file" == *"darwin"* ]]; then
         log_warn "Skipping UPX for macOS binary: $file"
         return
     fi
+
     log_info "Compressing $file with UPX..."
     upx -9 -q "$file" 2>/dev/null || log_warn "UPX compression failed for $file"
 }
 
-# 构建 Web UI
 build_web() {
     log_info "Building web UI..."
-    cd "$ROOT_DIR/web"
+    pushd "$ROOT_DIR/web" >/dev/null
+
     if [ ! -d "node_modules" ]; then
         log_info "Installing npm dependencies..."
         npm install
     fi
     npm run build
-    cd "$ROOT_DIR"
 
-    # 复制到 embed 目录
+    popd >/dev/null
+
     log_info "Copying dist to embed directory..."
     rm -rf "$ROOT_DIR/internal/server/app/dist"
     cp -r "$ROOT_DIR/web/dist" "$ROOT_DIR/internal/server/app/dist"
@@ -81,85 +73,127 @@ build_web() {
     log_info "Web UI built successfully"
 }
 
-# 构建单个二进制
+output_name() {
+    local component=$1
+    local os=$2
+
+    if [ "$os" = "windows" ]; then
+        echo "${component}.exe"
+    else
+        echo "${component}"
+    fi
+}
+
 build_binary() {
     local os=$1
     local arch=$2
-    local component=$3  # server 或 client
+    local component=$3
-
-    local output_name="${component}"
-    if [ "$os" = "windows" ]; then
-        output_name="${component}.exe"
-    fi
 
     local output_dir="$BUILD_DIR/${os}_${arch}"
-    mkdir -p "$output_dir"
+    local output_file
+    output_file="$(output_name "$component" "$os")"
+    local output_path="$output_dir/$output_file"
 
+    mkdir -p "$output_dir"
     log_info "Building $component for $os/$arch..."
 
-    GOOS=$os GOARCH=$arch go build \
+    GOOS="$os" GOARCH="$arch" CGO_ENABLED=0 go build \
+        -buildvcs=false \
+        -trimpath \
         -ldflags "-s -w -X 'main.Version=$VERSION' -X 'main.BuildTime=$BUILD_TIME' -X 'main.GitCommit=$GIT_COMMIT'" \
-        -o "$output_dir/$output_name" \
+        -o "$output_path" \
         "$ROOT_DIR/cmd/$component"
 
-    # UPX 压缩
+    compress_binary "$output_path" "$os"
-    compress_binary "$output_dir/$output_name"
+    log_info "  -> $output_path"
 }
 
-# 构建所有平台
 build_all() {
-    local platforms="${1:-$DEFAULT_PLATFORMS}"
+    local platforms="${1:-$DESKTOP_PLATFORMS}"
+    local platform os arch
 
     for platform in $platforms; do
-        local os="${platform%/*}"
+        os="${platform%/*}"
-        local arch="${platform#*/}"
+        arch="${platform#*/}"
-        build_binary "$os" "$arch" "server"
+        build_binary "$os" "$arch" server
-        build_binary "$os" "$arch" "client"
+        build_binary "$os" "$arch" client
     done
 }
 
-# 仅构建当前平台
 build_current() {
-    local os=$(go env GOOS)
+    local os
-    local arch=$(go env GOARCH)
+    local arch
 
-    build_binary "$os" "$arch" "server"
+    os="$(go env GOOS)"
-    build_binary "$os" "$arch" "client"
+    arch="$(go env GOARCH)"
+
+    build_binary "$os" "$arch" server
+    build_binary "$os" "$arch" client
 
     log_info "Binaries built in $BUILD_DIR/${os}_${arch}/"
 }
 
-# 清理构建产物
+build_android() {
+    local output_dir="$BUILD_DIR/android_arm64"
+
+    mkdir -p "$output_dir"
+    log_info "Building client for android/arm64..."
+    GOOS=android GOARCH=arm64 CGO_ENABLED=0 go build \
+        -buildvcs=false \
+        -trimpath \
+        -ldflags "-s -w -X 'main.Version=$VERSION' -X 'main.BuildTime=$BUILD_TIME' -X 'main.GitCommit=$GIT_COMMIT'" \
+        -o "$output_dir/client" \
+        "$ROOT_DIR/cmd/client"
+
+    if command -v gomobile >/dev/null 2>&1; then
+        log_info "Building gomobile Android binding..."
+        gomobile bind -target=android/arm64 -o "$output_dir/gotunnelmobile.aar" github.com/gotunnel/mobile/gotunnelmobile
+    else
+        log_warn "gomobile not found, skipping Android AAR build"
+    fi
+
+    if [ -d "$ROOT_DIR/android" ]; then
+        if [ -x "$ROOT_DIR/android/gradlew" ]; then
+            log_info "Building Android debug APK..."
+            (cd "$ROOT_DIR/android" && ./gradlew assembleDebug)
+        else
+            log_warn "android/gradlew not found, skipping APK build"
+        fi
+    else
+        log_warn "Android host project not found, skipping APK build"
+    fi
+}
+
 clean() {
     log_info "Cleaning build directory..."
     rm -rf "$BUILD_DIR"
     log_info "Clean completed"
 }
 
-# 显示帮助
 show_help() {
-    echo "Usage: $0 [command] [options]"
+    cat <<'EOF'
-    echo ""
+Usage: build.sh [command] [options]
-    echo "Commands:"
+
-    echo "  all       Build for all platforms (default: $DEFAULT_PLATFORMS)"
+Commands:
-    echo "  current   Build for current platform only"
+  all       Build web UI + all desktop platforms (default)
-    echo "  web       Build web UI only"
+  current   Build web UI + current platform only
-    echo "  server    Build server for current platform"
+  web       Build web UI only
-    echo "  client    Build client for current platform"
+  server    Build server for current platform
-    echo "  clean     Clean build directory"
+  client    Build client for current platform
-    echo "  help      Show this help message"
+  android   Build android/arm64 client and optional Android artifacts
-    echo ""
+  clean     Clean build directory
-    echo "Environment variables:"
+  help      Show this help message
-    echo "  VERSION   Set version string (default: dev)"
+
-    echo "  USE_UPX   Enable UPX compression (default: true)"
+Environment variables:
-    echo ""
+  VERSION   Set version string (default: dev)
-    echo "Examples:"
+  USE_UPX   Enable UPX compression (default: true)
-    echo "  $0 current              # Build for current platform"
+
-    echo "  $0 all                  # Build for all platforms"
+Examples:
-    echo "  VERSION=1.0.0 $0 all    # Build with version"
+  ./scripts/build.sh current
+  VERSION=1.0.0 ./scripts/build.sh all
+EOF
 }
 
-# 主函数
 main() {
     cd "$ROOT_DIR"
 
@@ -176,10 +210,13 @@ main() {
             build_web
             ;;
         server)
-            build_binary "$(go env GOOS)" "$(go env GOARCH)" "server"
+            build_binary "$(go env GOOS)" "$(go env GOARCH)" server
             ;;
         client)
-            build_binary "$(go env GOOS)" "$(go env GOARCH)" "client"
+            build_binary "$(go env GOOS)" "$(go env GOARCH)" client
+            ;;
+        android)
+            build_android
             ;;
         clean)
             clean

web/src/views/ClientsView.vue

@@ -17,12 +17,12 @@ const showInstallModal = ref(false)
 const installData = ref<InstallCommandResponse | null>(null)
 const generatingInstall = ref(false)
 const search = ref('')
-const installScriptUrl = 'https://raw.githubusercontent.com/gotunnel/gotunnel/main/scripts/install.sh'
-const installPs1Url = 'https://raw.githubusercontent.com/gotunnel/gotunnel/main/scripts/install.ps1'
 
 const quoteShellArg = (value: string) => `'${value.replace(/'/g, `'\"'\"'`)}'`
+const quotePowerShellSingle = (value: string) => value.replace(/'/g, "''")
 
 const resolveTunnelHost = () => window.location.hostname || 'localhost'
+const resolveWebBaseUrl = () => window.location.origin || 'http://localhost:7500'
 
 const formatServerAddr = (host: string, port: number) => {
   const normalizedHost = host.includes(':') && !host.startsWith('[') ? `[${host}]` : host
@@ -30,12 +30,18 @@ const formatServerAddr = (host: string, port: number) => {
 }
 
 const buildInstallCommands = (data: InstallCommandResponse) => {
+  const webBaseUrl = resolveWebBaseUrl()
   const serverAddr = formatServerAddr(resolveTunnelHost(), data.tunnel_port)
+  const installScriptUrl = `${webBaseUrl}/install.sh`
+  const installPs1Url = `${webBaseUrl}/install.ps1`
+  const psServerAddr = quotePowerShellSingle(serverAddr)
+  const psToken = quotePowerShellSingle(data.token)
+  const psBaseUrl = quotePowerShellSingle(webBaseUrl)
 
   return {
-    linux: `bash <(curl -fsSL ${installScriptUrl}) -s ${quoteShellArg(serverAddr)} -t ${quoteShellArg(data.token)}`,
+    linux: `bash <(curl -fsSL -H "X-GoTunnel-Install-Token: ${data.token}" ${installScriptUrl}) -s ${quoteShellArg(serverAddr)} -t ${quoteShellArg(data.token)} -b ${quoteShellArg(webBaseUrl)}`,
-    macos: `bash <(curl -fsSL ${installScriptUrl}) -s ${quoteShellArg(serverAddr)} -t ${quoteShellArg(data.token)}`,
+    macos: `bash <(curl -fsSL -H "X-GoTunnel-Install-Token: ${data.token}" ${installScriptUrl}) -s ${quoteShellArg(serverAddr)} -t ${quoteShellArg(data.token)} -b ${quoteShellArg(webBaseUrl)}`,
-    windows: `powershell -c \"irm ${installPs1Url} | iex; Install-GoTunnel -Server '${serverAddr}' -Token '${data.token}'\"`,
+    windows: `powershell -c \"irm ${installPs1Url} -Headers @{ 'X-GoTunnel-Install-Token' = '${psToken}' } | iex; Install-GoTunnel -Server '${psServerAddr}' -Token '${psToken}' -BaseUrl '${psBaseUrl}'\"`,
   }
 }