diff --git a/.github/workflows/tauri-build.yml b/.github/workflows/tauri-build.yml
index 287b959..bf18181 100644
--- a/.github/workflows/tauri-build.yml
+++ b/.github/workflows/tauri-build.yml
@@ -36,13 +36,42 @@ jobs:
       - name: setup node
         uses: actions/setup-node@v4
         with:
-          node-version: lts/*
+          node-version: 24
 
       - name: setup pnpm
         uses: pnpm/action-setup@v4
         with:
           version: 10
 
+      - name: get pnpm store directory
+        id: pnpm-store
+        shell: bash
+        run: |
+          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
+          echo "NODE_VERSION=$(node --version)" >> $GITHUB_OUTPUT
+
+      - name: setup pnpm store cache
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.pnpm-store.outputs.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-node-${{ steps.pnpm-store.outputs.NODE_VERSION }}-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-node-${{ steps.pnpm-store.outputs.NODE_VERSION }}-
+
+      - name: setup Next.js cache
+        uses: actions/cache@v4
+        with:
+          path: .next/cache
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('**/pnpm-lock.yaml') }}-${{ hashFiles('**/*.js', '**/*.jsx', '**/*.ts', '**/*.tsx') }}
+          restore-keys: |
+            ${{ runner.os }}-nextjs-${{ hashFiles('**/pnpm-lock.yaml') }}-
+            ${{ runner.os }}-nextjs-
+
+      - name: setup Rust cache
+        uses: swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri
+
       - name: install Rust stable
         uses: dtolnay/rust-toolchain@stable
         with:
diff --git a/.prettierignore b/.prettierignore
index 4f1c01d..621b74e 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -1 +1 @@
-src-tauri
\ No newline at end of file
+src-tauri/target
\ No newline at end of file
diff --git a/.vscode/settings.json b/.vscode/settings.json
index 5ac1c06..469845f 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -1,5 +1,6 @@
 {
   "files.associations": {
     "*.css": "tailwindcss"
-  }
+  },
+  "typescript.tsdk": "node_modules/typescript/lib"
 }
diff --git a/app/api/whistle/route.ts b/app/api/whistle/route.ts
deleted file mode 100644
index 4916b7a..0000000
--- a/app/api/whistle/route.ts
+++ /dev/null
@@ -1,460 +0,0 @@
-import dgram from "node:dgram";
-import net from "node:net";
-import type { NextRequest } from "next/server";
-
-export const runtime = "nodejs";
-
-type Mode = "tcp-send" | "udp-send" | "tcp-listen" | "udp-listen";
-
-interface WhistleRequest {
-  mode: Mode;
-  host?: string;
-  port: number;
-  payload?: string;
-  timeoutMs?: number;
-  delayMs?: number;
-  chunkSize?: number;
-  durationMs?: number;
-  malformed?: boolean;
-  echo?: boolean;
-  echoPayload?: string;
-  respondDelayMs?: number;
-  maxCapture?: number;
-}
-
-interface CaptureEntry {
-  at: string;
-  remoteAddress?: string | null;
-  remotePort?: number | null;
-  bytes: number;
-  hex: string;
-  text: string;
-  elapsedMs?: number;
-  note?: string;
-}
-
-const MAX_PAYLOAD_BYTES = 4096;
-const MAX_RESPONSE_BYTES = 128 * 1024;
-const MAX_DURATION_MS = 600000;
-const MAX_DELAY_MS = 8000;
-
-function toSafeDelay(value: unknown, fallback: number): number {
-  const num = Number(value);
-  if (Number.isNaN(num) || num < 0) return fallback;
-  return Math.min(num, MAX_DELAY_MS);
-}
-
-function toSafeDuration(value: unknown, fallback: number): number {
-  const num = Number(value);
-  if (Number.isNaN(num) || num <= 0) return fallback;
-  return Math.min(num, MAX_DURATION_MS);
-}
-
-function buildPayload(
-  payload: string | undefined,
-  malformed?: boolean,
-): Buffer {
-  const trimmed = payload ?? "";
-  const baseBuffer = Buffer.from(trimmed).subarray(0, MAX_PAYLOAD_BYTES);
-  if (!malformed) return baseBuffer;
-
-  const noise = Buffer.from([0x00, 0xff, 0x13, 0x37]);
-  return Buffer.concat([baseBuffer, noise]).subarray(0, MAX_PAYLOAD_BYTES);
-}
-
-function preview(buffer: Buffer) {
-  return {
-    text: buffer.toString("utf8"),
-    hex: buffer.toString("hex"),
-    bytes: buffer.length,
-  };
-}
-
-function validatePort(port: number): string | null {
-  if (!Number.isInteger(port) || port < 1 || port > 65535) {
-    return "Invalid port";
-  }
-  return null;
-}
-
-function validateHost(host?: string): string | null {
-  if (!host) return "Host is required";
-  if (typeof host !== "string" || host.trim().length === 0) {
-    return "Host is required";
-  }
-  if (host.length > 255) return "Host too long";
-
-  const normalizedHost = host.trim().toLowerCase();
-  const allowedHosts = ["localhost", "127.0.0.1", "::1", "[::1]"];
-
-  // Check if it's an allowed host
-  if (!allowedHosts.includes(normalizedHost)) {
-    // Allow IPv4 loopback range (127.0.0.0/8)
-    const ipv4Regex =
-      /^127\.(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){2}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/;
-    if (!ipv4Regex.test(normalizedHost)) {
-      return "Only localhost/loopback addresses are allowed for security reasons";
-    }
-  }
-
-  return null;
-}
-
-function parseChunkSize(value: unknown): number | undefined {
-  const num = Number(value);
-  if (Number.isNaN(num) || num <= 0) return undefined;
-  return Math.floor(num);
-}
-
-async function wait(ms: number) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-async function handleTcpSend(req: WhistleRequest) {
-  const payloadBuffer = buildPayload(req.payload, req.malformed);
-  const delayMs = toSafeDelay(req.delayMs, 0);
-  const timeoutMs = Math.max(Number(req.timeoutMs) || 5000, 500);
-  const chunkSize = parseChunkSize(req.chunkSize);
-  const start = Date.now();
-
-  return new Promise((resolve, reject) => {
-    const socket = new net.Socket();
-    let collected = Buffer.alloc(0);
-    let settled = false;
-
-    const finalize = (error?: Error) => {
-      if (settled) return;
-      settled = true;
-      socket.destroy();
-      if (error) {
-        reject(error);
-        return;
-      }
-
-      const elapsedMs = Date.now() - start;
-      const truncated = collected.subarray(0, MAX_RESPONSE_BYTES);
-      resolve({
-        ok: true,
-        mode: "tcp-send" as const,
-        elapsedMs,
-        bytesSent: payloadBuffer.length,
-        bytesReceived: truncated.length,
-        response: preview(truncated),
-      });
-    };
-
-    socket.setTimeout(timeoutMs, () => {
-      finalize(new Error("Timed out while waiting for a response"));
-    });
-    socket.on("error", (err) => finalize(err));
-    socket.on("data", (chunk: Buffer) => {
-      if (settled) return;
-      collected = Buffer.concat([collected, chunk]).subarray(
-        0,
-        MAX_RESPONSE_BYTES,
-      );
-    });
-    socket.on("close", () => finalize());
-
-    socket.connect(req.port, req.host ?? "", () => {
-      (async () => {
-        if (delayMs > 0) await wait(delayMs);
-
-        if (chunkSize && chunkSize < payloadBuffer.length) {
-          for (let i = 0; i < payloadBuffer.length; i += chunkSize) {
-            socket.write(payloadBuffer.subarray(i, i + chunkSize));
-            await wait(120);
-          }
-          socket.end();
-        } else {
-          socket.end(payloadBuffer);
-        }
-      })().catch((err) => finalize(err));
-    });
-  });
-}
-
-async function handleUdpSend(req: WhistleRequest) {
-  const payloadBuffer = buildPayload(req.payload, req.malformed);
-  const delayMs = toSafeDelay(req.delayMs, 0);
-  const timeoutMs = Math.max(Number(req.timeoutMs) || 4000, 500);
-  const start = Date.now();
-  const family = net.isIP(req.host ?? "") === 6 ? "udp6" : "udp4";
-
-  return new Promise((resolve, reject) => {
-    const socket = dgram.createSocket(family);
-    let settled = false;
-    let responseBuffer = Buffer.alloc(0);
-    let timer: NodeJS.Timeout | null = null;
-
-    const finalize = (error?: Error) => {
-      if (settled) return;
-      settled = true;
-      if (timer) clearTimeout(timer);
-      socket.close();
-      if (error) {
-        reject(error);
-        return;
-      }
-      const elapsedMs = Date.now() - start;
-      const truncated = responseBuffer.subarray(0, MAX_RESPONSE_BYTES);
-      resolve({
-        ok: true,
-        mode: "udp-send" as const,
-        elapsedMs,
-        bytesSent: payloadBuffer.length,
-        bytesReceived: truncated.length,
-        response: preview(truncated),
-      });
-    };
-
-    timer = setTimeout(
-      () => finalize(new Error("UDP receive timeout")),
-      timeoutMs,
-    );
-
-    socket.on("message", (msg) => {
-      responseBuffer = Buffer.concat([responseBuffer, msg]).subarray(
-        0,
-        MAX_RESPONSE_BYTES,
-      );
-      finalize();
-    });
-    socket.on("error", (err) => finalize(err));
-
-    (async () => {
-      if (delayMs > 0) await wait(delayMs);
-      socket.send(payloadBuffer, req.port, req.host ?? "", (err) => {
-        if (err) finalize(err);
-      });
-    })().catch((err) => finalize(err));
-  });
-}
-
-async function handleTcpListen(req: WhistleRequest, signal?: AbortSignal) {
-  const durationMs = toSafeDuration(req.durationMs, 600000);
-  const respondDelayMs = toSafeDelay(req.respondDelayMs, 0);
-  const maxCapture = Math.min(req.maxCapture ?? 10, 25);
-  const echoPayload = buildPayload(req.echoPayload, req.malformed);
-  const captures: CaptureEntry[] = [];
-  const activeSockets = new Set<net.Socket>();
-
-  return new Promise((resolve, reject) => {
-    const server = net.createServer((socket) => {
-      activeSockets.add(socket);
-      const started = Date.now();
-      let collected = Buffer.alloc(0);
-
-      const removeSocket = () => {
-        activeSockets.delete(socket);
-      };
-
-      socket.on("close", removeSocket);
-
-      socket.on("data", (chunk: Buffer) => {
-        collected = Buffer.concat([collected, chunk]).subarray(
-          0,
-          MAX_RESPONSE_BYTES,
-        );
-      });
-
-      socket.on("end", async () => {
-        if (captures.length >= maxCapture) return;
-
-        const truncated = collected.subarray(0, MAX_RESPONSE_BYTES);
-        captures.push({
-          at: new Date().toISOString(),
-          remoteAddress: socket.remoteAddress,
-          remotePort: socket.remotePort,
-          bytes: truncated.length,
-          hex: truncated.toString("hex"),
-          text: truncated.toString("utf8"),
-          elapsedMs: Date.now() - started,
-        });
-
-        if (req.echo) {
-          try {
-            await wait(respondDelayMs);
-            socket.write(echoPayload);
-          } catch {
-            // socket may have been destroyed
-          }
-        }
-        socket.end();
-      });
-
-      socket.on("error", (err) => {
-        removeSocket();
-        captures.push({
-          at: new Date().toISOString(),
-          remoteAddress: socket.remoteAddress,
-          remotePort: socket.remotePort,
-          bytes: 0,
-          hex: "",
-          text: "",
-          note: `Socket error: ${err.message}`,
-        });
-      });
-    });
-
-    server.on("error", (err) => reject(err));
-
-    const cleanup = () => {
-      for (const socket of activeSockets) {
-        socket.destroy();
-      }
-      activeSockets.clear();
-
-      server.close(() => {
-        resolve({
-          ok: true,
-          mode: "tcp-listen" as const,
-          durationMs: Date.now() - serverStartTime,
-          captures,
-        });
-      });
-    };
-
-    let serverStartTime = 0;
-    let timer: NodeJS.Timeout | null = null;
-
-    if (signal) {
-      signal.addEventListener("abort", () => {
-        if (timer) clearTimeout(timer);
-        cleanup();
-      });
-    }
-
-    server.listen(req.port, () => {
-      serverStartTime = Date.now();
-      timer = setTimeout(() => {
-        cleanup();
-      }, durationMs);
-    });
-  });
-}
-
-async function handleUdpListen(req: WhistleRequest, signal?: AbortSignal) {
-  const durationMs = toSafeDuration(req.durationMs, 5000);
-  const respondDelayMs = toSafeDelay(req.respondDelayMs, 0);
-  const maxCapture = Math.min(req.maxCapture ?? 10, 25);
-  const family = req.host && net.isIP(req.host) === 6 ? "udp6" : "udp4";
-  const captures: CaptureEntry[] = [];
-  const reply = buildPayload(req.echoPayload, req.malformed);
-
-  return new Promise((resolve, reject) => {
-    const socket = dgram.createSocket(family);
-    let serverStartTime = 0;
-    let timer: NodeJS.Timeout | null = null;
-
-    const cleanup = () => {
-      if (timer) clearTimeout(timer);
-      socket.close();
-      resolve({
-        ok: true,
-        mode: "udp-listen" as const,
-        durationMs: Date.now() - serverStartTime,
-        captures,
-      });
-    };
-
-    if (signal) {
-      signal.addEventListener("abort", cleanup);
-    }
-
-    socket.on("message", async (msg, rinfo) => {
-      if (captures.length < maxCapture) {
-        const truncated = msg.subarray(0, MAX_RESPONSE_BYTES);
-        captures.push({
-          at: new Date().toISOString(),
-          remoteAddress: rinfo.address,
-          remotePort: rinfo.port,
-          bytes: truncated.length,
-          hex: truncated.toString("hex"),
-          text: truncated.toString("utf8"),
-        });
-      }
-
-      if (req.echo) {
-        try {
-          await wait(respondDelayMs);
-          socket.send(reply, rinfo.port, rinfo.address);
-        } catch {
-          // socket may have been closed
-        }
-      }
-    });
-
-    socket.on("error", (err) => reject(err));
-
-    socket.bind(req.port, req.host, () => {
-      serverStartTime = Date.now();
-      timer = setTimeout(cleanup, durationMs);
-    });
-  });
-}
-
-export async function POST(request: NextRequest) {
-  try {
-    const body = (await request.json()) as Partial<WhistleRequest>;
-    const mode = body.mode as Mode | undefined;
-    const portError = validatePort(Number(body.port));
-    const hostError =
-      mode === "tcp-send" || mode === "udp-send"
-        ? validateHost(body.host)
-        : null;
-
-    if (!mode) {
-      return Response.json({ error: "Mode is required" }, { status: 400 });
-    }
-    if (portError) {
-      return Response.json({ error: portError }, { status: 400 });
-    }
-    if (hostError) {
-      return Response.json({ error: hostError }, { status: 400 });
-    }
-
-    const req: WhistleRequest = {
-      mode,
-      host: body.host?.trim(),
-      port: Number(body.port),
-      payload: body.payload ?? "",
-      timeoutMs: body.timeoutMs,
-      delayMs: body.delayMs,
-      chunkSize: body.chunkSize,
-      durationMs: body.durationMs,
-      malformed: body.malformed ?? false,
-      echo: body.echo ?? false,
-      echoPayload: body.echoPayload ?? "ack",
-      respondDelayMs: body.respondDelayMs,
-      maxCapture: body.maxCapture,
-    };
-
-    if (req.mode === "tcp-send") {
-      const result = await handleTcpSend(req);
-      return Response.json(result);
-    }
-    if (req.mode === "udp-send") {
-      const result = await handleUdpSend(req);
-      return Response.json(result);
-    }
-    if (req.mode === "tcp-listen") {
-      const result = await handleTcpListen(req, request.signal);
-      return Response.json(result);
-    }
-    if (req.mode === "udp-listen") {
-      const result = await handleUdpListen(req, request.signal);
-      return Response.json(result);
-    }
-
-    return Response.json({ error: "Unsupported mode" }, { status: 400 });
-  } catch (error) {
-    console.error("[whistle] request failed", error);
-    return Response.json(
-      {
-        error: error instanceof Error ? error.message : "Request failed",
-      },
-      { status: 500 },
-    );
-  }
-}
diff --git a/app/page.tsx b/app/page.tsx
index 4ffce29..42d954a 100644
--- a/app/page.tsx
+++ b/app/page.tsx
@@ -71,7 +71,9 @@ export default function Home() {
           });
 
           if (confirmed) {
-            appWindow.close();
+            // Use exit from @tauri-apps/plugin-process for clean app termination
+            const { exit } = await import("@tauri-apps/plugin-process");
+            await exit(0);
           }
         });
 
diff --git a/components/tools/curl-converter.tsx b/components/tools/curl-converter.tsx
index 0785a84..21dd3a6 100644
--- a/components/tools/curl-converter.tsx
+++ b/components/tools/curl-converter.tsx
@@ -29,6 +29,7 @@ import {
 import { cn } from "@/lib/utils";
 import { useCopyAnimation } from "@/hooks/use-copy-animation";
 import { useTranslation } from "react-i18next";
+import { httpProxy } from "@/lib/api";
 
 interface ParsedRequest {
   method: string;
@@ -268,22 +269,14 @@ export function CurlConverter({ tabId: _tabId }: CurlConverterProps) {
         }
       });
 
-      // Use proxy to avoid CORS issues
-      const res = await fetch("/api/proxy", {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-        },
-        body: JSON.stringify({
-          InputUrl: url,
-          method,
-          headers: headersObj,
-          body: method !== "GET" && body ? body : undefined,
-        }),
+      // Use unified API (Tauri invoke or fetch proxy)
+      const data = await httpProxy({
+        InputUrl: url,
+        method,
+        headers: headersObj,
+        body: method !== "GET" && body ? body : undefined,
       });
 
-      const data = await res.json();
-
       if (data.error) {
         setError(data.error);
         return;
diff --git a/components/tools/port-detective.tsx b/components/tools/port-detective.tsx
index 07a1905..22599e5 100644
--- a/components/tools/port-detective.tsx
+++ b/components/tools/port-detective.tsx
@@ -2,7 +2,7 @@
 
 import type React from "react";
 
-import { useState, useCallback } from "react";
+import { useState, useCallback, useEffect } from "react";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import {
@@ -14,6 +14,15 @@ import {
 } from "@/components/ui/card";
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import { Progress } from "@/components/ui/progress";
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from "@/components/ui/alert-dialog";
 import {
   Search,
   Trash2,
@@ -26,6 +35,7 @@ import {
 import { toast } from "sonner";
 import { useTranslation } from "react-i18next";
 import { invoke } from "@tauri-apps/api/core";
+import { isTauri } from "@/lib/tauri";
 
 interface PortInfo {
   port: number;
@@ -42,6 +52,7 @@ interface PortDetectiveProps {
 // eslint-disable-next-line @typescript-eslint/no-unused-vars
 export function PortDetective({ tabId: _tabId }: PortDetectiveProps) {
   const { t } = useTranslation();
+  const [showNotAvailableDialog, setShowNotAvailableDialog] = useState(false);
   const [singlePort, setSinglePort] = useState<string>("3000");
   const [singlePortInfo, setSinglePortInfo] = useState<PortInfo | null>(null);
   const [isCheckingPort, setIsCheckingPort] = useState(false);
@@ -53,8 +64,19 @@ export function PortDetective({ tabId: _tabId }: PortDetectiveProps) {
   const [scanProgress, setScanProgress] = useState(0);
   const [error, setError] = useState<string | null>(null);
 
+  const isDesktop = isTauri();
+
+  useEffect(() => {
+    if (!isDesktop) {
+      setShowNotAvailableDialog(true);
+    }
+  }, [isDesktop]);
+
   const checkPort = useCallback(
     async (port: number) => {
+      if (!isDesktop) {
+        throw new Error(t("tools.portDetective.desktopOnly.description"));
+      }
       try {
         const result = await invoke<PortInfo>("check_port", { port });
         return result;
@@ -66,10 +88,12 @@ export function PortDetective({ tabId: _tabId }: PortDetectiveProps) {
         );
       }
     },
-    [t],
+    [t, isDesktop],
   );
 
   const handleCheckSinglePort = async () => {
+    if (!isDesktop) return;
+
     const port = parseInt(singlePort);
     if (isNaN(port) || port < 1 || port > 65535) {
       setError(t("tools.portDetective.errors.invalidPort"));
@@ -97,6 +121,8 @@ export function PortDetective({ tabId: _tabId }: PortDetectiveProps) {
   };
 
   const handleKillProcess = async (pid: number, port?: number) => {
+    if (!isDesktop) return;
+
     try {
       await invoke("kill_process", { pid });
       toast.success(t("tools.portDetective.success.processKilled"));
@@ -118,6 +144,8 @@ export function PortDetective({ tabId: _tabId }: PortDetectiveProps) {
   };
 
   const handleScanPorts = async () => {
+    if (!isDesktop) return;
+
     const startPort = parseInt(scanStartPort);
     const endPort = parseInt(scanEndPort);
 
@@ -190,6 +218,25 @@ export function PortDetective({ tabId: _tabId }: PortDetectiveProps) {
 
   return (
     <div className="flex h-full flex-col gap-4 overflow-hidden p-4">
+      <AlertDialog
+        open={showNotAvailableDialog}
+        onOpenChange={setShowNotAvailableDialog}
+      >
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>
+              {t("tools.portDetective.desktopOnly.title")}
+            </AlertDialogTitle>
+            <AlertDialogDescription>
+              {t("tools.portDetective.desktopOnly.description")}
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogAction>{t("common.ok")}</AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+
       <Tabs defaultValue="single" className="flex min-h-0 flex-1 flex-col">
         <TabsList className="w-fit shrink-0">
           <TabsTrigger value="single">
@@ -265,7 +312,7 @@ export function PortDetective({ tabId: _tabId }: PortDetectiveProps) {
                 />
                 <Button
                   onClick={handleCheckSinglePort}
-                  disabled={isCheckingPort}
+                  disabled={!isDesktop || isCheckingPort}
                 >
                   <Search className="mr-2 size-4" />
                   {isCheckingPort
@@ -312,6 +359,7 @@ export function PortDetective({ tabId: _tabId }: PortDetectiveProps) {
                           <Button
                             variant="destructive"
                             size="sm"
+                            disabled={!isDesktop}
                             onClick={() =>
                               handleKillProcess(
                                 singlePortInfo.pid!,
@@ -405,7 +453,10 @@ export function PortDetective({ tabId: _tabId }: PortDetectiveProps) {
                     onChange={(e) => setScanEndPort(e.target.value)}
                   />
                 </div>
-                <Button onClick={handleScanPorts} disabled={isScanning}>
+                <Button
+                  onClick={handleScanPorts}
+                  disabled={!isDesktop || isScanning}
+                >
                   <RefreshCw
                     className={`
                       mr-2 size-4
diff --git a/components/tools/ssl-toothbrush.tsx b/components/tools/ssl-toothbrush.tsx
index 7a2bd04..9810c1d 100644
--- a/components/tools/ssl-toothbrush.tsx
+++ b/components/tools/ssl-toothbrush.tsx
@@ -28,33 +28,7 @@ import {
 } from "lucide-react";
 import { useCopyAnimation } from "@/hooks/use-copy-animation";
 import { cn } from "@/lib/utils";
-
-type WarningKey =
-  | "expired"
-  | "expiresSoon"
-  | "hostnameMismatch"
-  | "chainInvalid";
-
-interface CertificateResult {
-  source: "remote" | "pem";
-  subject: string | null;
-  subjectCN: string | null;
-  issuer: string | null;
-  issuerCN: string | null;
-  san: string[];
-  validFrom: string | null;
-  validTo: string | null;
-  daysRemaining: number | null;
-  isExpired: boolean;
-  aboutToExpire: boolean;
-  chainValid: boolean | null;
-  authorizationError: string | null;
-  validForHost: boolean | null;
-  rawPem: string | null;
-  serialNumber: string | null;
-  fingerprint256: string | null;
-  warnings: WarningKey[];
-}
+import { certCheck, type CertificatePayload, type WarningKey } from "@/lib/api";
 
 interface SSLToothbrushProps {
   tabId: string;
@@ -95,7 +69,7 @@ export function SSLToothbrush({ tabId: _tabId }: SSLToothbrushProps) {
   const [pem, setPem] = useState("");
   const [checking, setChecking] = useState(false);
   const [error, setError] = useState<string | null>(null);
-  const [result, setResult] = useState<CertificateResult | null>(null);
+  const [result, setResult] = useState<CertificatePayload | null>(null);
   const { copyWithAnimation } = useCopyAnimation();
 
   const warningMessages = useMemo(() => {
@@ -178,18 +152,10 @@ export function SSLToothbrush({ tabId: _tabId }: SSLToothbrushProps) {
     setChecking(true);
     setError(null);
     try {
-      const response = await fetch("/api/cert-check", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          host: host.trim(),
-          port: parseInt(port, 10) || 443,
-        }),
+      const data = await certCheck({
+        host: host.trim(),
+        port: parseInt(port, 10) || 443,
       });
-      const data = await response.json();
-      if (!response.ok) {
-        throw new Error(data.error || "Request failed");
-      }
       setResult(data);
     } catch (err) {
       setError(err instanceof Error ? err.message : "Request failed");
@@ -207,15 +173,10 @@ export function SSLToothbrush({ tabId: _tabId }: SSLToothbrushProps) {
     setChecking(true);
     setError(null);
     try {
-      const response = await fetch("/api/cert-check", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ host: host.trim() || undefined, certPem: pem }),
+      const data = await certCheck({
+        host: host.trim() || undefined,
+        certPem: pem,
       });
-      const data = await response.json();
-      if (!response.ok) {
-        throw new Error(data.error || "Request failed");
-      }
       setResult(data);
     } catch (err) {
       setError(err instanceof Error ? err.message : "Request failed");
@@ -340,7 +301,7 @@ export function SSLToothbrush({ tabId: _tabId }: SSLToothbrushProps) {
               <Textarea
                 value={pem}
                 onChange={(e) => setPem(e.target.value)}
-                className="min-h-[180px] font-mono text-xs"
+                className="min-h-44 font-mono text-xs"
                 placeholder="-----BEGIN CERTIFICATE-----"
               />
               <div className="flex flex-wrap justify-between gap-3">
@@ -393,7 +354,7 @@ export function SSLToothbrush({ tabId: _tabId }: SSLToothbrushProps) {
         </div>
       )}
 
-      <Card className="min-h-[280px] w-full shrink-0">
+      <Card className="min-h-72 w-full shrink-0">
         <CardHeader className="pb-3">
           <CardTitle className="flex items-center gap-2">
             <ShieldCheck className="size-4" />
diff --git a/components/tools/tcp-udp-whistle.tsx b/components/tools/tcp-udp-whistle.tsx
index 5bff6b7..d9cfee9 100644
--- a/components/tools/tcp-udp-whistle.tsx
+++ b/components/tools/tcp-udp-whistle.tsx
@@ -1,6 +1,6 @@
 "use client";
 
-import { useMemo, useState } from "react";
+import { useEffect, useMemo, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
@@ -16,6 +16,15 @@ import { Badge } from "@/components/ui/badge";
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import { Switch } from "@/components/ui/switch";
 import { Separator } from "@/components/ui/separator";
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from "@/components/ui/alert-dialog";
 import {
   Activity,
   History,
@@ -27,40 +36,15 @@ import {
   Timer,
   Waves,
 } from "lucide-react";
+import {
+  whistle,
+  type WhistleSendResponse,
+  type WhistleListenResponse,
+} from "@/lib/api";
+import { isTauri } from "@/lib/tauri";
 
 type Protocol = "tcp" | "udp";
 
-interface SendResult {
-  ok: boolean;
-  mode: "tcp-send" | "udp-send";
-  elapsedMs: number;
-  bytesSent: number;
-  bytesReceived: number;
-  response: {
-    text: string;
-    hex: string;
-    bytes: number;
-  };
-}
-
-interface CaptureEntry {
-  at: string;
-  remoteAddress?: string | null;
-  remotePort?: number | null;
-  bytes: number;
-  hex: string;
-  text: string;
-  elapsedMs?: number;
-  note?: string;
-}
-
-interface ListenResult {
-  ok: boolean;
-  mode: "tcp-listen" | "udp-listen";
-  durationMs: number;
-  captures: CaptureEntry[];
-}
-
 interface HistoryEntry {
   id: string;
   type: "send" | "listen";
@@ -80,6 +64,7 @@ function formatDate(input: string) {
 // eslint-disable-next-line @typescript-eslint/no-unused-vars
 export function TcpUdpWhistle({ tabId: _tabId }: TcpUdpWhistleProps) {
   const { t } = useTranslation();
+  const [showNotAvailableDialog, setShowNotAvailableDialog] = useState(false);
   const [sendProtocol, setSendProtocol] = useState<Protocol>("tcp");
   const [host, setHost] = useState("127.0.0.1");
   const [port, setPort] = useState("9000");
@@ -89,22 +74,41 @@ export function TcpUdpWhistle({ tabId: _tabId }: TcpUdpWhistleProps) {
   const [timeoutMs, setTimeoutMs] = useState("4000");
   const [malformed, setMalformed] = useState(false);
   const [isSending, setIsSending] = useState(false);
-  const [sendResult, setSendResult] = useState<SendResult | null>(null);
+  const [sendResult, setSendResult] = useState<WhistleSendResponse | null>(
+    null,
+  );
 
   const [listenProtocol, setListenProtocol] = useState<Protocol>("udp");
   const [listenPort, setListenPort] = useState("9001");
-  const [listenAbortController, setListenAbortController] =
-    useState<AbortController | null>(null);
   const [echoReply, setEchoReply] = useState(true);
   const [echoPayload, setEchoPayload] = useState("ack");
   const [respondDelay, setRespondDelay] = useState("150");
-  const [listenResult, setListenResult] = useState<ListenResult | null>(null);
+  const [listenResult, setListenResult] =
+    useState<WhistleListenResponse | null>(null);
   const [isListening, setIsListening] = useState(false);
+  const stopListeningRef = useRef(false);
 
   const [sendError, setSendError] = useState<string | null>(null);
   const [listenError, setListenError] = useState<string | null>(null);
   const [history, setHistory] = useState<HistoryEntry[]>([]);
 
+  const isAvailable = isTauri();
+
+  useEffect(() => {
+    if (!isAvailable) {
+      setShowNotAvailableDialog(true);
+    }
+  }, [isAvailable]);
+
+  // Cleanup effect: stop listening if component unmounts while active
+  useEffect(() => {
+    return () => {
+      if (stopListeningRef.current === false && isListening) {
+        stopListeningRef.current = true;
+      }
+    };
+  }, [isListening]);
+
   const protocolBadge = useMemo(
     () =>
       sendProtocol === "tcp" ? (
@@ -122,6 +126,8 @@ export function TcpUdpWhistle({ tabId: _tabId }: TcpUdpWhistleProps) {
   );
 
   const handleSend = async () => {
+    if (!isAvailable) return;
+
     const portNumber = parseInt(port, 10);
     const delay = Math.max(parseInt(delayMs, 10) || 0, 0);
     const chunk = Math.max(parseInt(chunkSize, 10) || 0, 0);
@@ -141,25 +147,17 @@ export function TcpUdpWhistle({ tabId: _tabId }: TcpUdpWhistleProps) {
     setSendResult(null);
 
     try {
-      const res = await fetch("/api/whistle", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          mode: `${sendProtocol}-send`,
-          host: host.trim(),
-          port: portNumber,
-          payload,
-          delayMs: delay,
-          chunkSize: chunk || undefined,
-          timeoutMs: timeout,
-          malformed,
-        }),
-      });
-
-      const data = (await res.json()) as SendResult & { error?: string };
-      if (!res.ok) {
-        throw new Error(data.error || "Request failed");
-      }
+      const data = (await whistle({
+        mode: `${sendProtocol}-send`,
+        host: host.trim(),
+        port: portNumber,
+        payload,
+        delayMs: delay,
+        chunkSize: chunk || undefined,
+        timeoutMs: timeout,
+        malformed,
+      })) as WhistleSendResponse;
+
       setSendResult(data);
       setHistory((prev) =>
         [
@@ -185,6 +183,8 @@ export function TcpUdpWhistle({ tabId: _tabId }: TcpUdpWhistleProps) {
   };
 
   const handleListen = async () => {
+    if (!isAvailable) return;
+
     const portNumber = parseInt(listenPort, 10);
     const replyDelay = Math.max(parseInt(respondDelay, 10) || 0, 0);
 
@@ -196,49 +196,68 @@ export function TcpUdpWhistle({ tabId: _tabId }: TcpUdpWhistleProps) {
     setListenError(null);
     setIsListening(true);
     setListenResult(null);
+    stopListeningRef.current = false;
 
-    const abortController = new AbortController();
-    setListenAbortController(abortController);
+    const allCaptures: WhistleListenResponse["captures"] = [];
+    const maxCaptures = 12;
+    const pollDurationMs = 3000; // Short polling interval
+    const maxTotalDurationMs = 600000; // 10 minutes max
+    const startTime = Date.now();
 
     try {
-      const res = await fetch("/api/whistle", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
+      while (
+        !stopListeningRef.current &&
+        allCaptures.length < maxCaptures &&
+        Date.now() - startTime < maxTotalDurationMs
+      ) {
+        const data = (await whistle({
           mode: `${listenProtocol}-listen`,
           port: portNumber,
-          durationMs: 600000,
+          durationMs: pollDurationMs,
           echo: echoReply,
           echoPayload,
           respondDelayMs: replyDelay,
-          maxCapture: 12,
-        }),
-        signal: abortController.signal,
-      });
-
-      const data = (await res.json()) as ListenResult & { error?: string };
-      if (!res.ok) {
-        throw new Error(data.error || "Request failed");
+          maxCapture: maxCaptures - allCaptures.length,
+        })) as WhistleListenResponse;
+
+        if (data.captures.length > 0) {
+          allCaptures.push(...data.captures);
+          // Update result incrementally so user sees captures as they arrive
+          setListenResult({
+            ok: true,
+            mode: data.mode,
+            durationMs: Date.now() - startTime,
+            captures: [...allCaptures],
+          });
+        }
       }
 
-      setListenResult(data);
-      setHistory((prev) =>
-        [
-          {
-            id: crypto.randomUUID(),
-            type: "listen" as const,
-            protocol: listenProtocol,
-            summary: `${data.captures.length} capture${data.captures.length === 1 ? "" : "s"}`,
-            at: new Date().toISOString(),
-          },
-          ...prev,
-        ].slice(0, 8),
-      );
+      // Final result
+      const finalResult: WhistleListenResponse = {
+        ok: true,
+        mode: `${listenProtocol}-listen` as "tcp-listen" | "udp-listen",
+        durationMs: Date.now() - startTime,
+        captures: allCaptures,
+      };
+      setListenResult(finalResult);
+
+      if (allCaptures.length > 0) {
+        setHistory((prev) =>
+          [
+            {
+              id: crypto.randomUUID(),
+              type: "listen" as const,
+              protocol: listenProtocol,
+              summary: `${allCaptures.length} capture${allCaptures.length === 1 ? "" : "s"}`,
+              at: new Date().toISOString(),
+            },
+            ...prev,
+          ].slice(0, 8),
+        );
+      }
     } catch (err) {
-      if (err instanceof Error && err.name === "AbortError") {
-        // User stopped listening, this is expected
-        setListenError(null);
-      } else {
+      // Only show error if we weren't intentionally stopped
+      if (!stopListeningRef.current) {
         setListenError(
           err instanceof Error
             ? err.message
@@ -247,15 +266,11 @@ export function TcpUdpWhistle({ tabId: _tabId }: TcpUdpWhistleProps) {
       }
     } finally {
       setIsListening(false);
-      setListenAbortController(null);
     }
   };
 
   const handleStopListening = () => {
-    if (listenAbortController) {
-      listenAbortController.abort();
-      setListenAbortController(null);
-    }
+    stopListeningRef.current = true;
   };
 
   const lastResponseHex =
@@ -264,6 +279,25 @@ export function TcpUdpWhistle({ tabId: _tabId }: TcpUdpWhistleProps) {
 
   return (
     <div className="h-full space-y-4 overflow-auto p-4">
+      <AlertDialog
+        open={showNotAvailableDialog}
+        onOpenChange={setShowNotAvailableDialog}
+      >
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>
+              {t("tools.tcpWhistle.desktopOnly.title")}
+            </AlertDialogTitle>
+            <AlertDialogDescription>
+              {t("tools.tcpWhistle.desktopOnly.description")}
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogAction>{t("common.ok")}</AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+
       <div className="flex items-center gap-3">
         <div
           className="
@@ -446,7 +480,10 @@ export function TcpUdpWhistle({ tabId: _tabId }: TcpUdpWhistleProps) {
               </div>
 
               <div className="flex items-center gap-2">
-                <Button onClick={handleSend} disabled={isSending}>
+                <Button
+                  onClick={handleSend}
+                  disabled={!isAvailable || isSending}
+                >
                   <Send className="mr-2 size-4" />
                   {t("tools.tcpWhistle.send.button")}
                 </Button>
@@ -668,16 +705,16 @@ export function TcpUdpWhistle({ tabId: _tabId }: TcpUdpWhistleProps) {
               </div>
 
               <div className="flex items-center gap-2">
-                {!isListening ? (
-                  <Button onClick={handleListen}>
-                    <Inbox className="mr-2 size-4" />
-                    {t("tools.tcpWhistle.listen.button")}
-                  </Button>
-                ) : (
+                {isListening ? (
                   <Button onClick={handleStopListening} variant="destructive">
                     <Square className="mr-2 size-4" />
                     {t("tools.tcpWhistle.listen.stopButton")}
                   </Button>
+                ) : (
+                  <Button onClick={handleListen} disabled={!isAvailable}>
+                    <Inbox className="mr-2 size-4" />
+                    {t("tools.tcpWhistle.listen.button")}
+                  </Button>
                 )}
                 {listenError && (
                   <span className="text-sm text-destructive">
diff --git a/components/ui/alert-dialog.tsx b/components/ui/alert-dialog.tsx
new file mode 100644
index 0000000..f9f1b9a
--- /dev/null
+++ b/components/ui/alert-dialog.tsx
@@ -0,0 +1,153 @@
+"use client";
+
+import * as React from "react";
+import * as AlertDialogPrimitive from "@radix-ui/react-alert-dialog";
+
+import { cn } from "@/lib/utils";
+import { buttonVariants } from "@/components/ui/button";
+
+function AlertDialog({
+  ...props
+}: React.ComponentProps<typeof AlertDialogPrimitive.Root>) {
+  return <AlertDialogPrimitive.Root data-slot="alert-dialog" {...props} />;
+}
+
+// function AlertDialogTrigger({
+//   ...props
+// }: React.ComponentProps<typeof AlertDialogPrimitive.Trigger>) {
+//   return (
+//     <AlertDialogPrimitive.Trigger data-slot="alert-dialog-trigger" {...props} />
+//   );
+// }
+
+function AlertDialogPortal({
+  ...props
+}: React.ComponentProps<typeof AlertDialogPrimitive.Portal>) {
+  return (
+    <AlertDialogPrimitive.Portal data-slot="alert-dialog-portal" {...props} />
+  );
+}
+
+function AlertDialogOverlay({
+  className,
+  ...props
+}: React.ComponentProps<typeof AlertDialogPrimitive.Overlay>) {
+  return (
+    <AlertDialogPrimitive.Overlay
+      data-slot="alert-dialog-overlay"
+      className={cn(
+        "fixed inset-0 z-50 bg-black/50 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:animate-in data-[state=open]:fade-in-0",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function AlertDialogContent({
+  className,
+  ...props
+}: React.ComponentProps<typeof AlertDialogPrimitive.Content>) {
+  return (
+    <AlertDialogPortal>
+      <AlertDialogOverlay />
+      <AlertDialogPrimitive.Content
+        data-slot="alert-dialog-content"
+        className={cn(
+          "fixed top-[50%] left-[50%] z-50 grid w-full max-w-[calc(100%-2rem)] translate-[-50%] gap-4 rounded-lg border bg-background p-6 shadow-lg duration-200 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[state=open]:animate-in data-[state=open]:fade-in-0 data-[state=open]:zoom-in-95 sm:max-w-lg",
+          className,
+        )}
+        {...props}
+      />
+    </AlertDialogPortal>
+  );
+}
+
+function AlertDialogHeader({
+  className,
+  ...props
+}: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="alert-dialog-header"
+      className={cn("flex flex-col gap-2 text-center sm:text-left", className)}
+      {...props}
+    />
+  );
+}
+
+function AlertDialogFooter({
+  className,
+  ...props
+}: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="alert-dialog-footer"
+      className={cn(
+        "flex flex-col-reverse gap-2 sm:flex-row sm:justify-end",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function AlertDialogTitle({
+  className,
+  ...props
+}: React.ComponentProps<typeof AlertDialogPrimitive.Title>) {
+  return (
+    <AlertDialogPrimitive.Title
+      data-slot="alert-dialog-title"
+      className={cn("text-lg font-semibold", className)}
+      {...props}
+    />
+  );
+}
+
+function AlertDialogDescription({
+  className,
+  ...props
+}: React.ComponentProps<typeof AlertDialogPrimitive.Description>) {
+  return (
+    <AlertDialogPrimitive.Description
+      data-slot="alert-dialog-description"
+      className={cn("text-sm text-muted-foreground", className)}
+      {...props}
+    />
+  );
+}
+
+function AlertDialogAction({
+  className,
+  ...props
+}: React.ComponentProps<typeof AlertDialogPrimitive.Action>) {
+  return (
+    <AlertDialogPrimitive.Action
+      className={cn(buttonVariants(), className)}
+      {...props}
+    />
+  );
+}
+
+// function AlertDialogCancel({
+//   className,
+//   ...props
+// }: React.ComponentProps<typeof AlertDialogPrimitive.Cancel>) {
+//   return (
+//     <AlertDialogPrimitive.Cancel
+//       className={cn(buttonVariants({ variant: "outline" }), className)}
+//       {...props}
+//     />
+//   );
+// }
+
+export {
+  AlertDialog,
+  AlertDialogContent,
+  AlertDialogHeader,
+  AlertDialogFooter,
+  AlertDialogTitle,
+  AlertDialogDescription,
+  AlertDialogAction,
+};
diff --git a/components/ui/button.tsx b/components/ui/button.tsx
index f286bd3..5b409e4 100644
--- a/components/ui/button.tsx
+++ b/components/ui/button.tsx
@@ -101,4 +101,4 @@ function Button({
   );
 }
 
-export { Button };
+export { Button, buttonVariants };
diff --git a/lib/api.ts b/lib/api.ts
new file mode 100644
index 0000000..d1602e7
--- /dev/null
+++ b/lib/api.ts
@@ -0,0 +1,187 @@
+/**
+ * Unified API abstraction layer
+ * Uses Tauri invoke for desktop app, fetch for web preview
+ */
+
+import { isTauri, invokeCommand } from "./tauri";
+
+// ============================================================================
+// Certificate Check API
+// ============================================================================
+
+export type WarningKey =
+  | "expired"
+  | "expiresSoon"
+  | "hostnameMismatch"
+  | "chainInvalid";
+
+export interface CertificatePayload {
+  source: "remote" | "pem";
+  subject: string | null;
+  subjectCN: string | null;
+  issuer: string | null;
+  issuerCN: string | null;
+  san: string[];
+  validFrom: string | null;
+  validTo: string | null;
+  daysRemaining: number | null;
+  isExpired: boolean;
+  aboutToExpire: boolean;
+  chainValid: boolean | null;
+  authorizationError: string | null;
+  validForHost: boolean | null;
+  rawPem: string | null;
+  serialNumber: string | null;
+  fingerprint256: string | null;
+  warnings: WarningKey[];
+}
+
+export interface CertCheckRequest {
+  host?: string;
+  port?: number;
+  certPem?: string;
+}
+
+export async function certCheck(
+  request: CertCheckRequest,
+): Promise<CertificatePayload> {
+  if (isTauri()) {
+    return invokeCommand<CertificatePayload>("cert_check", {
+      host: request.host,
+      port: request.port,
+      certPem: request.certPem,
+    });
+  }
+
+  // Web fallback
+  const response = await fetch("/api/cert-check", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(request),
+  });
+
+  if (!response.ok) {
+    const error = await response.json();
+    throw new Error(error.error || "Certificate check failed");
+  }
+
+  return response.json();
+}
+
+// ============================================================================
+// HTTP Proxy API
+// ============================================================================
+
+export interface ProxyRequest {
+  InputUrl: string;
+  method?: string;
+  headers?: Record<string, string>;
+  body?: string;
+}
+
+export interface ProxyResponse {
+  status: number;
+  statusText: string;
+  responseTime: number;
+  data: string;
+  contentType: string;
+  error?: string;
+}
+
+export async function httpProxy(request: ProxyRequest): Promise<ProxyResponse> {
+  if (isTauri()) {
+    return invokeCommand<ProxyResponse>("http_proxy", {
+      request,
+    });
+  }
+
+  // Web fallback
+  const response = await fetch("/api/proxy", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(request),
+  });
+
+  if (!response.ok) {
+    const errorBody = await response.text();
+    let errorMessage: string;
+    try {
+      const errorJson = JSON.parse(errorBody);
+      errorMessage = errorJson.error || errorBody;
+    } catch {
+      errorMessage = errorBody;
+    }
+    throw new Error(`HTTP ${response.status}: ${errorMessage}`);
+  }
+
+  return response.json();
+}
+
+// ============================================================================
+// TCP/UDP Whistle API
+// ============================================================================
+
+type WhistleMode = "tcp-send" | "udp-send" | "tcp-listen" | "udp-listen";
+
+export interface WhistleRequest {
+  mode: WhistleMode;
+  host?: string;
+  port: number;
+  payload?: string;
+  timeoutMs?: number;
+  delayMs?: number;
+  chunkSize?: number;
+  durationMs?: number;
+  malformed?: boolean;
+  echo?: boolean;
+  echoPayload?: string;
+  respondDelayMs?: number;
+  maxCapture?: number;
+}
+
+export interface ResponsePreview {
+  text: string;
+  hex: string;
+  bytes: number;
+}
+
+export interface WhistleSendResponse {
+  ok: boolean;
+  mode: "tcp-send" | "udp-send";
+  elapsedMs: number;
+  bytesSent: number;
+  bytesReceived: number;
+  response: ResponsePreview;
+}
+
+export interface CaptureEntry {
+  at: string;
+  remoteAddress?: string | null;
+  remotePort?: number | null;
+  bytes: number;
+  hex: string;
+  text: string;
+  elapsedMs?: number;
+  note?: string;
+}
+
+export interface WhistleListenResponse {
+  ok: boolean;
+  mode: "tcp-listen" | "udp-listen";
+  durationMs: number;
+  captures: CaptureEntry[];
+}
+
+export type WhistleResponse = WhistleSendResponse | WhistleListenResponse;
+
+export async function whistle(
+  request: WhistleRequest,
+): Promise<WhistleResponse> {
+  if (!isTauri()) {
+    throw new Error("TCP/UDP Whistle is only available in the desktop app");
+  }
+
+  return invokeCommand<WhistleResponse>("whistle", {
+    request,
+  });
+}
diff --git a/lib/tauri.ts b/lib/tauri.ts
new file mode 100644
index 0000000..0c5dffc
--- /dev/null
+++ b/lib/tauri.ts
@@ -0,0 +1,28 @@
+/**
+ * Tauri environment detection and invoke wrapper
+ */
+
+/**
+ * Check if the app is running in a Tauri environment
+ */
+export function isTauri(): boolean {
+  return typeof window !== "undefined" && "__TAURI__" in window;
+}
+
+/**
+ * Invoke a Tauri command in the desktop environment.
+ * @throws {Error} Throws an Error with message "Not in Tauri environment"
+ *         when called outside of the Tauri desktop app context.
+ * @returns A promise that resolves with the command result of type T.
+ */
+export async function invokeCommand<T>(
+  command: string,
+  args?: Record<string, unknown>,
+): Promise<T> {
+  if (!isTauri()) {
+    throw new Error("Not in Tauri environment");
+  }
+
+  const { invoke } = await import("@tauri-apps/api/core");
+  return invoke<T>(command, args);
+}
diff --git a/messages/en.json b/messages/en.json
index 41ed37c..a085f69 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -602,6 +602,10 @@
       "adminWarning": {
         "title": "Admin privileges required",
         "description": "Run this app with administrator/root privileges to see process information (PID and process name) for ports in use. On macOS/Linux, run with sudo. On Windows, run as Administrator."
+      },
+      "desktopOnly": {
+        "title": "Desktop App Required",
+        "description": "This tool requires the desktop app to function. Port scanning and process management are not available in the web preview environment."
       }
     },
     "sslToothbrush": {
@@ -982,6 +986,10 @@
         "hostRequired": "Host is required",
         "portInvalid": "Port must be between 1-65535",
         "requestFailed": "Request failed"
+      },
+      "desktopOnly": {
+        "title": "Desktop App Required",
+        "description": "This tool requires the desktop app to function. TCP/UDP socket operations are not available in the web preview environment."
       }
     }
   },
@@ -1001,6 +1009,7 @@
     "traditionalChinese": "繁體中文"
   },
   "common": {
+    "ok": "OK",
     "close": "Close",
     "save": "Save",
     "cancel": "Cancel",
diff --git a/messages/zh-TW.json b/messages/zh-TW.json
index 899dc5d..a9d21b0 100644
--- a/messages/zh-TW.json
+++ b/messages/zh-TW.json
@@ -588,6 +588,10 @@
       "adminWarning": {
         "title": "需要管理員權限",
         "description": "使用管理員/root 權限執行此應用以查看連接埠使用的程序資訊（PID 和程序名稱）。在 macOS/Linux 上，使用 sudo 執行。在 Windows 上，以管理員身份執行。"
+      },
+      "desktopOnly": {
+        "title": "需要桌面應用",
+        "description": "此工具需要桌面應用程式才能運行。連接埠掃描和程序管理在 Web 預覽環境中無法使用。"
       }
     },
     "sslToothbrush": {
@@ -968,6 +972,10 @@
         "hostRequired": "主機為必填",
         "portInvalid": "埠口必須在 1-65535 之間",
         "requestFailed": "請求失敗"
+      },
+      "desktopOnly": {
+        "title": "需要桌面應用",
+        "description": "此工具需要桌面應用程式才能運行。TCP/UDP 套接字操作在 Web 預覽環境中無法使用。"
       }
     }
   },
@@ -988,6 +996,7 @@
   },
   "common": {
     "close": "關閉",
+    "ok": "確定",
     "save": "儲存",
     "cancel": "取消",
     "delete": "刪除",
diff --git a/messages/zh.json b/messages/zh.json
index d87d44b..b1a8c52 100644
--- a/messages/zh.json
+++ b/messages/zh.json
@@ -588,6 +588,10 @@
       "adminWarning": {
         "title": "需要管理员权限",
         "description": "使用管理员/root 权限运行此应用以查看端口使用的进程信息（PID 和进程名称）。在 macOS/Linux 上，使用 sudo 运行。在 Windows 上，以管理员身份运行。"
+      },
+      "desktopOnly": {
+        "title": "需要桌面应用",
+        "description": "此工具需要桌面应用才能运行。端口扫描和进程管理在 Web 预览环境中不可用。"
       }
     },
     "sslToothbrush": {
@@ -968,6 +972,10 @@
         "hostRequired": "主机为必填",
         "portInvalid": "端口必须在 1-65535 之间",
         "requestFailed": "请求失败"
+      },
+      "desktopOnly": {
+        "title": "需要桌面应用",
+        "description": "此工具需要桌面应用才能运行。TCP/UDP 套接字操作在 Web 预览环境中不可用。"
       }
     }
   },
@@ -988,6 +996,7 @@
   },
   "common": {
     "close": "关闭",
+    "ok": "确定",
     "save": "保存",
     "cancel": "取消",
     "delete": "删除",
diff --git a/package.json b/package.json
index 6380386..0f33ac1 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "devutils",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "private": true,
   "scripts": {
     "dev": "next dev",
@@ -10,13 +10,15 @@
     "format:rust": "cd ./src-tauri && cargo fmt && cd ..",
     "tauri": "tauri",
     "check-types": "concurrently -n transpile,types -c cyan,magenta \"pnpm run check-types:transpile\" \"tsgo -p tsconfig.json\" && rm -rf .swc",
-    "check-types:transpile": "swc app components hooks lib --out-dir .swc --ignore '**/*.d.ts' --ignore 'node_modules' --ignore '.next'",
+    "check-types:transpile": "swc app components hooks lib --out-dir .swc --ignore '**/*.d.ts' --ignore 'node_modules/' --ignore '.next/'",
     "prepare": "husky",
     "format": "prettier -w --list-different .",
     "pre-commit": "pnpm run check-types && pnpm run lint && pnpm run format:rust && pnpm run format",
+    "clean": "rm -rf .swc .next src-tauri/target",
     "knip": "knip"
   },
   "dependencies": {
+    "@radix-ui/react-alert-dialog": "^1.1.15",
     "@radix-ui/react-avatar": "1.1.11",
     "@radix-ui/react-dialog": "1.1.15",
     "@radix-ui/react-dropdown-menu": "2.1.16",
@@ -33,6 +35,7 @@
     "@tauri-apps/api": "^2.9.1",
     "@tauri-apps/plugin-dialog": "~2.6.0",
     "@tauri-apps/plugin-fs": "^2.4.5",
+    "@tauri-apps/plugin-process": "^2.3.1",
     "@uiw/react-color-sketch": "^2.9.2",
     "bcryptjs": "^3.0.3",
     "class-variance-authority": "^0.7.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index dfb97b7..2889b88 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -7,6 +7,9 @@ settings:
 importers:
   .:
     dependencies:
+      "@radix-ui/react-alert-dialog":
+        specifier: ^1.1.15
+        version: 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)
       "@radix-ui/react-avatar":
         specifier: 1.1.11
         version: 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)
@@ -55,6 +58,9 @@ importers:
       "@tauri-apps/plugin-fs":
         specifier: ^2.4.5
         version: 2.4.5
+      "@tauri-apps/plugin-process":
+        specifier: ^2.3.1
+        version: 2.3.1
       "@uiw/react-color-sketch":
         specifier: ^2.9.2
         version: 2.9.2(@babel/runtime@7.28.6)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)
@@ -1176,6 +1182,22 @@ packages:
         integrity: sha512-JTF99U/6XIjCBo0wqkU5sK10glYe27MRRsfwoiq5zzOEZLHU3A3KCMa5X/azekYRCJ0HlwI0crAXS/5dEHTzDg==,
       }
 
+  "@radix-ui/react-alert-dialog@1.1.15":
+    resolution:
+      {
+        integrity: sha512-oTVLkEw5GpdRe29BqJ0LSDFWI3qu0vR1M0mUkOQWDIUnY/QIkLpgDMWuKxP94c2NAC2LGcgVhG1ImF3jkZ5wXw==,
+      }
+    peerDependencies:
+      "@types/react": "*"
+      "@types/react-dom": "*"
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      "@types/react":
+        optional: true
+      "@types/react-dom":
+        optional: true
+
   "@radix-ui/react-arrow@1.1.7":
     resolution:
       {
@@ -2182,6 +2204,12 @@ packages:
         integrity: sha512-dVxWWGE6VrOxC7/jlhyE+ON/Cc2REJlM35R3PJX3UvFw2XwYhLGQVAIyrehenDdKjotipjYEVc4YjOl3qq90fA==,
       }
 
+  "@tauri-apps/plugin-process@2.3.1":
+    resolution:
+      {
+        integrity: sha512-nCa4fGVaDL/B9ai03VyPOjfAHRHSBz5v6F/ObsB73r/dA3MHHhZtldaDMIc0V/pnUw9ehzr2iEG+XkSEyC0JJA==,
+      }
+
   "@tokenizer/inflate@0.2.7":
     resolution:
       {
@@ -6472,6 +6500,20 @@ snapshots:
 
   "@radix-ui/primitive@1.1.3": {}
 
+  "@radix-ui/react-alert-dialog@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)":
+    dependencies:
+      "@radix-ui/primitive": 1.1.3
+      "@radix-ui/react-compose-refs": 1.1.2(@types/react@19.2.8)(react@19.2.3)
+      "@radix-ui/react-context": 1.1.2(@types/react@19.2.8)(react@19.2.3)
+      "@radix-ui/react-dialog": 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)
+      "@radix-ui/react-primitive": 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)
+      "@radix-ui/react-slot": 1.2.3(@types/react@19.2.8)(react@19.2.3)
+      react: 19.2.3
+      react-dom: 19.2.3(react@19.2.3)
+    optionalDependencies:
+      "@types/react": 19.2.8
+      "@types/react-dom": 19.2.3(@types/react@19.2.8)
+
   "@radix-ui/react-arrow@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)":
     dependencies:
       "@radix-ui/react-primitive": 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)
@@ -7139,6 +7181,10 @@ snapshots:
     dependencies:
       "@tauri-apps/api": 2.9.1
 
+  "@tauri-apps/plugin-process@2.3.1":
+    dependencies:
+      "@tauri-apps/api": 2.9.1
+
   "@tokenizer/inflate@0.2.7":
     dependencies:
       debug: 4.4.3
diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index 7476cfd..28acce3 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -125,6 +125,45 @@ dependencies = [
  "stable_deref_trait",
 ]
 
+[[package]]
+name = "asn1-rs"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5493c3bedbacf7fd7382c6346bbd66687d12bbaad3a89a2d2c303ee6cf20b048"
+dependencies = [
+ "asn1-rs-derive",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom 7.1.3",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror 1.0.69",
+ "time",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "965c2d33e53cb6b267e148a4cb0760bc01f4904c1cd4bb4002a085bb016d1490"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+ "synstructure",
+]
+
+[[package]]
+name = "asn1-rs-impl"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+]
+
 [[package]]
 name = "atk"
 version = "0.18.2"
@@ -189,7 +228,7 @@ dependencies = [
  "anyhow",
  "arrayvec",
  "log",
- "nom",
+ "nom 8.0.0",
  "num-rational",
  "v_frame",
 ]
@@ -517,8 +556,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fac4744fb15ae8337dc853fee7fb3f4e48c0fbaa23d0afe49c447b4fab126118"
 dependencies = [
  "iana-time-zone",
+ "js-sys",
  "num-traits",
  "serde",
+ "wasm-bindgen",
  "windows-link 0.2.1",
 ]
 
@@ -554,6 +595,16 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.10.1"
@@ -577,9 +628,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fa95a34622365fa5bbf40b20b75dba8dfa8c94c734aea8ac9a5ca38af14316f1"
 dependencies = [
  "bitflags 2.10.0",
- "core-foundation",
+ "core-foundation 0.10.1",
  "core-graphics-types",
- "foreign-types",
+ "foreign-types 0.5.0",
  "libc",
 ]
 
@@ -590,7 +641,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d44a101f213f6c4cdc1853d4b78aef6db6bdfa3468798cc1d9912f4735013eb"
 dependencies = [
  "bitflags 2.10.0",
- "core-foundation",
+ "core-foundation 0.10.1",
  "libc",
 ]
 
@@ -743,6 +794,26 @@ dependencies = [
  "syn 2.0.114",
 ]
 
+[[package]]
+name = "data-encoding"
+version = "2.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7a1e2f27636f116493b8b860f5546edb47c8d8f8ea73e1d2a20be88e28d1fea"
+
+[[package]]
+name = "der-parser"
+version = "9.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cd0a5c643689626bec213c4d8bd4d96acc8ffdb4ad4bb6bc16abf27d5f4b553"
+dependencies = [
+ "asn1-rs",
+ "displaydoc",
+ "nom 7.1.3",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
 [[package]]
 name = "deranged"
 version = "0.5.5"
@@ -768,18 +839,29 @@ dependencies = [
 
 [[package]]
 name = "devutils"
-version = "0.1.0"
+version = "1.0.0"
 dependencies = [
+ "base64 0.22.1",
+ "chrono",
+ "hex",
  "image",
  "log",
+ "native-tls",
+ "reqwest",
  "serde",
  "serde_json",
+ "sha2",
  "tauri",
  "tauri-build",
  "tauri-plugin-dialog",
  "tauri-plugin-fs",
  "tauri-plugin-log",
+ "tauri-plugin-process",
+ "time",
  "tokio",
+ "tokio-native-tls",
+ "url",
+ "x509-parser",
 ]
 
 [[package]]
@@ -927,6 +1009,15 @@ version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ef6b89e5b37196644d8796de5268852ff179b44e96276cf4290264843743bb7"
 
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
 [[package]]
 name = "env_filter"
 version = "0.1.4"
@@ -974,6 +1065,16 @@ dependencies = [
  "typeid",
 ]
 
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "exr"
 version = "1.74.0"
@@ -989,6 +1090,12 @@ dependencies = [
  "zune-inflate",
 ]
 
+[[package]]
+name = "fastrand"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+
 [[package]]
 name = "fax"
 version = "0.2.6"
@@ -1059,6 +1166,15 @@ version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared 0.1.1",
+]
+
 [[package]]
 name = "foreign-types"
 version = "0.5.0"
@@ -1066,7 +1182,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
 dependencies = [
  "foreign-types-macros",
- "foreign-types-shared",
+ "foreign-types-shared 0.3.1",
 ]
 
 [[package]]
@@ -1080,6 +1196,12 @@ dependencies = [
  "syn 2.0.114",
 ]
 
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
 [[package]]
 name = "foreign-types-shared"
 version = "0.3.1"
@@ -1493,6 +1615,25 @@ dependencies = [
  "syn 2.0.114",
 ]
 
+[[package]]
+name = "h2"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap 2.13.0",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
 [[package]]
 name = "half"
 version = "2.7.1"
@@ -1598,6 +1739,7 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-core",
+ "h2",
  "http",
  "http-body",
  "httparse",
@@ -1609,6 +1751,38 @@ dependencies = [
  "want",
 ]
 
+[[package]]
+name = "hyper-rustls"
+version = "0.27.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-tls"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
+dependencies = [
+ "bytes",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+ "tower-service",
+]
+
 [[package]]
 name = "hyper-util"
 version = "0.1.19"
@@ -1628,9 +1802,11 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "socket2",
+ "system-configuration",
  "tokio",
  "tower-service",
  "tracing",
+ "windows-registry",
 ]
 
 [[package]]
@@ -2071,6 +2247,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "linux-raw-sys"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"
+
 [[package]]
 name = "litemap"
 version = "0.8.1"
@@ -2172,6 +2354,12 @@ version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
 [[package]]
 name = "miniz_oxide"
 version = "0.8.9"
@@ -2224,6 +2412,23 @@ dependencies = [
  "windows-sys 0.60.2",
 ]
 
+[[package]]
+name = "native-tls"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87de3442987e9dbec73158d5c715e7ad9072fda936bb03d19d7fa10e00520f0e"
+dependencies = [
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework",
+ "security-framework-sys",
+ "tempfile",
+]
+
 [[package]]
 name = "ndk"
 version = "0.9.0"
@@ -2266,6 +2471,16 @@ version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72ef4a56884ca558e5ddb05a1d1e7e1bfd9a68d9ed024c21704cc98872dae1bb"
 
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
 [[package]]
 name = "nom"
 version = "8.0.0"
@@ -2580,12 +2795,65 @@ dependencies = [
  "objc2-security",
 ]
 
+[[package]]
+name = "oid-registry"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8d8034d9489cdaf79228eb9f6a3b8d7bb32ba00d6645ebd48eef4077ceb5bd9"
+dependencies = [
+ "asn1-rs",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
 
+[[package]]
+name = "openssl"
+version = "0.10.75"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08838db121398ad17ab8531ce9de97b244589089e290a384c900cb9ff7434328"
+dependencies = [
+ "bitflags 2.10.0",
+ "cfg-if",
+ "foreign-types 0.3.2",
+ "libc",
+ "once_cell",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.111"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82cab2d520aa75e3c58898289429321eb788c3106963d0dc886ec7a5f4adc321"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
 [[package]]
 name = "option-ext"
 version = "0.2.0"
@@ -3312,22 +3580,30 @@ checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
  "base64 0.22.1",
  "bytes",
+ "encoding_rs",
  "futures-core",
  "futures-util",
+ "h2",
  "http",
  "http-body",
  "http-body-util",
  "hyper",
+ "hyper-rustls",
+ "hyper-tls",
  "hyper-util",
  "js-sys",
  "log",
+ "mime",
+ "native-tls",
  "percent-encoding",
  "pin-project-lite",
+ "rustls-pki-types",
  "serde",
  "serde_json",
  "serde_urlencoded",
  "sync_wrapper",
  "tokio",
+ "tokio-native-tls",
  "tokio-util",
  "tower",
  "tower-http",
@@ -3369,6 +3645,20 @@ version = "0.8.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c6a884d2998352bb4daf0183589aec883f16a6da1f4dde84d8e2e9a5409a1ce"
 
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "rkyv"
 version = "0.7.46"
@@ -3423,6 +3713,61 @@ dependencies = [
  "semver",
 ]
 
+[[package]]
+name = "rusticata-macros"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
+dependencies = [
+ "nom 7.1.3",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
+dependencies = [
+ "bitflags 2.10.0",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c665f33d38cea657d9614f766881e4d510e0eda4239891eea56b4cadcf01801b"
+dependencies = [
+ "once_cell",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.22"
@@ -3444,6 +3789,15 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "schannel"
+version = "0.1.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "891d81b926048e76efe18581bf793546b4c0eaf8448d72be8de2bbee5fd166e1"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "schemars"
 version = "0.8.22"
@@ -3507,6 +3861,29 @@ version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"
 
+[[package]]
+name = "security-framework"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
+dependencies = [
+ "bitflags 2.10.0",
+ "core-foundation 0.9.4",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc1f0cbffaac4852523ce30d8bd3c5cdc873501d96ff467ca09b6767bb8cd5c0"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "selectors"
 version = "0.24.0"
@@ -3862,6 +4239,12 @@ version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
 [[package]]
 name = "swift-rs"
 version = "1.0.7"
@@ -3915,6 +4298,27 @@ dependencies = [
  "syn 2.0.114",
 ]
 
+[[package]]
+name = "system-configuration"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
+dependencies = [
+ "bitflags 2.10.0",
+ "core-foundation 0.9.4",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "system-deps"
 version = "6.2.2"
@@ -3936,7 +4340,7 @@ checksum = "f3a753bdc39c07b192151523a3f77cd0394aa75413802c883a0f6f6a0e5ee2e7"
 dependencies = [
  "bitflags 2.10.0",
  "block2",
- "core-foundation",
+ "core-foundation 0.10.1",
  "core-graphics",
  "crossbeam-channel",
  "dispatch",
@@ -4184,6 +4588,16 @@ dependencies = [
  "time",
 ]
 
+[[package]]
+name = "tauri-plugin-process"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d55511a7bf6cd70c8767b02c97bf8134fa434daf3926cfc1be0a0f94132d165a"
+dependencies = [
+ "tauri",
+ "tauri-plugin",
+]
+
 [[package]]
 name = "tauri-runtime"
 version = "2.9.2"
@@ -4285,6 +4699,19 @@ dependencies = [
  "toml 0.9.11+spec-1.1.0",
 ]
 
+[[package]]
+name = "tempfile"
+version = "3.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "655da9c7eb6305c55742045d5a8d2037996d61d8de95806335c7c86ce0f82e9c"
+dependencies = [
+ "fastrand",
+ "getrandom 0.3.4",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "tendril"
 version = "0.4.3"
@@ -4422,6 +4849,26 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "tokio-native-tls"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
+dependencies = [
+ "native-tls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-util"
 version = "0.7.18"
@@ -4688,6 +5135,12 @@ version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
 
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
 [[package]]
 name = "url"
 version = "2.5.8"
@@ -4760,6 +5213,12 @@ version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7ba6f5989077681266825251a52748b8c1d8a4ad098cc37e440103d0ea717fc0"
 
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
 [[package]]
 name = "version-compare"
 version = "0.2.1"
@@ -5149,6 +5608,17 @@ dependencies = [
  "windows-link 0.1.3",
 ]
 
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link 0.2.1",
+ "windows-result 0.4.1",
+ "windows-strings 0.5.1",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.3.4"
@@ -5194,6 +5664,15 @@ dependencies = [
  "windows-targets 0.42.2",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.59.0"
@@ -5540,6 +6019,23 @@ dependencies = [
  "pkg-config",
 ]
 
+[[package]]
+name = "x509-parser"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcbc162f30700d6f3f82a24bf7cc62ffe7caea42c0b2cba8bf7f3ae50cf51f69"
+dependencies = [
+ "asn1-rs",
+ "data-encoding",
+ "der-parser",
+ "lazy_static",
+ "nom 7.1.3",
+ "oid-registry",
+ "rusticata-macros",
+ "thiserror 1.0.69",
+ "time",
+]
+
 [[package]]
 name = "y4m"
 version = "0.8.0"
@@ -5610,6 +6106,12 @@ dependencies = [
  "synstructure",
 ]
 
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+
 [[package]]
 name = "zerotrie"
 version = "0.2.3"
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 6c99c7c..954a518 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "devutils"
-version = "1.0.0"
+version = "1.0.1"
 description = "DevUtils - Developer Utilities Desktop Application"
 authors = ["miyukiyue"]
 license = "GPL-3.0-or-later"
@@ -25,5 +25,16 @@ tauri = { version = "2.9.5", features = [] }
 tauri-plugin-log = "2"
 tauri-plugin-dialog = "2"
 tauri-plugin-fs = "2"
+tauri-plugin-process = "2"
 image = "0.25"
-tokio = { version = "1.49.0", features = ["rt"] }
+tokio = { version = "1.49.0", features = ["rt", "net", "time", "io-util"] }
+reqwest = { version = "0.12", features = ["json"] }
+tokio-native-tls = "0.3"
+native-tls = "0.2"
+x509-parser = "0.16"
+chrono = "0.4"
+url = "2.5"
+hex = "0.4"
+sha2 = "0.10"
+base64 = "0.22"
+time = "0.3"
diff --git a/src-tauri/capabilities/default.json b/src-tauri/capabilities/default.json
deleted file mode 100644
index f2b0e82..0000000
--- a/src-tauri/capabilities/default.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "$schema": "../gen/schemas/desktop-schema.json",
-  "identifier": "default",
-  "description": "enables the default permissions",
-  "windows": ["main"],
-  "permissions": ["core:default", "dialog:default", "core:window:allow-close"]
-}
diff --git a/src-tauri/capabilities/main.json b/src-tauri/capabilities/main.json
new file mode 100644
index 0000000..574282f
--- /dev/null
+++ b/src-tauri/capabilities/main.json
@@ -0,0 +1,17 @@
+{
+  "$schema": "../gen/schemas/desktop-schema.json",
+  "identifier": "default",
+  "description": "enables the default permissions",
+  "windows": ["*"],
+  "permissions": [
+    "core:default",
+    "dialog:default",
+    "core:window:allow-close",
+    "core:window:allow-destroy",
+    "core:app:allow-app-hide",
+    "core:app:allow-app-show",
+    "core:app:default",
+    "process:default",
+    "process:allow-exit"
+  ]
+}
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index 2ecf9bd..b9ae073 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -1,5 +1,10 @@
+use chrono::{DateTime, TimeZone, Utc};
 use image::GenericImageView;
+use native_tls::TlsConnector;
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream, ToSocketAddrs, UdpSocket};
 use std::process::Command;
+use std::time::{Duration, Instant};
 
 #[tauri::command]
 async fn extract_palette_from_image(
@@ -767,11 +772,975 @@ fn scan_listening_ports_blocking(start_port: u16, end_port: u16) -> Result<Vec<P
     Ok(results)
 }
 
+#[derive(serde::Serialize, Clone)]
+struct CertificatePayload {
+    source: String,
+    subject: Option<String>,
+    #[serde(rename = "subjectCN")]
+    subject_cn: Option<String>,
+    issuer: Option<String>,
+    #[serde(rename = "issuerCN")]
+    issuer_cn: Option<String>,
+    san: Vec<String>,
+    #[serde(rename = "validFrom")]
+    valid_from: Option<String>,
+    #[serde(rename = "validTo")]
+    valid_to: Option<String>,
+    #[serde(rename = "daysRemaining")]
+    days_remaining: Option<i64>,
+    #[serde(rename = "isExpired")]
+    is_expired: bool,
+    #[serde(rename = "aboutToExpire")]
+    about_to_expire: bool,
+    #[serde(rename = "chainValid")]
+    chain_valid: Option<bool>,
+    #[serde(rename = "authorizationError")]
+    authorization_error: Option<String>,
+    #[serde(rename = "validForHost")]
+    valid_for_host: Option<bool>,
+    #[serde(rename = "rawPem")]
+    raw_pem: Option<String>,
+    #[serde(rename = "serialNumber")]
+    serial_number: Option<String>,
+    #[serde(rename = "fingerprint256")]
+    fingerprint256: Option<String>,
+    warnings: Vec<String>,
+}
+
+fn extract_cn(subject: &str) -> Option<String> {
+    for part in subject.split(',') {
+        let part = part.trim();
+        if part.starts_with("CN=") {
+            return Some(part[3..].to_string());
+        }
+    }
+    None
+}
+
+fn parse_alt_names(
+    san_ext: Option<&x509_parser::extensions::SubjectAlternativeName>,
+) -> Vec<String> {
+    let mut names = Vec::new();
+    if let Some(san) = san_ext {
+        for name in &san.general_names {
+            match name {
+                x509_parser::extensions::GeneralName::DNSName(dns) => {
+                    names.push(dns.to_string());
+                }
+                x509_parser::extensions::GeneralName::IPAddress(ip) => {
+                    if ip.len() == 4 {
+                        names.push(format!("{}.{}.{}.{}", ip[0], ip[1], ip[2], ip[3]));
+                    } else if ip.len() == 16 {
+                        // IPv6
+                        let parts: Vec<String> = ip
+                            .chunks(2)
+                            .map(|c| format!("{:02x}{:02x}", c[0], c[1]))
+                            .collect();
+                        names.push(parts.join(":"));
+                    }
+                }
+                _ => {}
+            }
+        }
+    }
+    names
+}
+
+fn host_matches(host: &str, candidates: &[String]) -> bool {
+    if host.is_empty() || candidates.is_empty() {
+        return false;
+    }
+    let normalized_host = host.to_lowercase();
+
+    for entry in candidates {
+        let candidate = entry.trim().to_lowercase();
+        if candidate.is_empty() {
+            continue;
+        }
+
+        if candidate.starts_with("*.") {
+            let domain = &candidate[2..];
+            if domain.is_empty() {
+                continue;
+            }
+            if !normalized_host.ends_with(&format!(".{}", domain)) {
+                continue;
+            }
+            let host_parts: Vec<&str> = normalized_host.split('.').collect();
+            let domain_parts: Vec<&str> = domain.split('.').collect();
+            if host_parts.len() == domain_parts.len() + 1 {
+                return true;
+            }
+        } else if normalized_host == candidate {
+            return true;
+        }
+    }
+    false
+}
+
+/// Convert time::OffsetDateTime to chrono::DateTime<Utc>
+fn offset_to_chrono(odt: time::OffsetDateTime) -> DateTime<Utc> {
+    Utc.timestamp_opt(odt.unix_timestamp(), odt.nanosecond())
+        .unwrap()
+}
+
+fn calculate_days_remaining(valid_to: Option<&DateTime<Utc>>) -> Option<i64> {
+    valid_to.map(|target| {
+        let now = Utc::now();
+        let duration = *target - now;
+        duration.num_days()
+    })
+}
+
+fn collect_warnings(
+    is_expired: bool,
+    about_to_expire: bool,
+    valid_for_host: Option<bool>,
+    chain_valid: Option<bool>,
+) -> Vec<String> {
+    let mut warnings = Vec::new();
+    if is_expired {
+        warnings.push("expired".to_string());
+    }
+    if !is_expired && about_to_expire {
+        warnings.push("expiresSoon".to_string());
+    }
+    if valid_for_host == Some(false) {
+        warnings.push("hostnameMismatch".to_string());
+    }
+    if chain_valid == Some(false) {
+        warnings.push("chainInvalid".to_string());
+    }
+    warnings
+}
+
+fn buffer_to_pem(der: &[u8]) -> String {
+    use base64::Engine;
+    let base64 = base64::engine::general_purpose::STANDARD.encode(der);
+    let lines: Vec<&str> = base64
+        .as_bytes()
+        .chunks(64)
+        .map(|chunk| std::str::from_utf8(chunk).unwrap_or(""))
+        .collect();
+    format!(
+        "-----BEGIN CERTIFICATE-----\n{}\n-----END CERTIFICATE-----",
+        lines.join("\n")
+    )
+}
+
+fn sha256_fingerprint(der: &[u8]) -> String {
+    use sha2::{Digest, Sha256};
+    let mut hasher = Sha256::new();
+    hasher.update(der);
+    let result = hasher.finalize();
+    let hex_bytes: Vec<String> = result.iter().map(|b| format!("{:02X}", b)).collect();
+    hex_bytes.join(":")
+}
+
+#[tauri::command]
+async fn cert_check(
+    host: Option<String>,
+    port: Option<u16>,
+    cert_pem: Option<String>,
+) -> Result<CertificatePayload, String> {
+    // If certPem is provided, parse it directly
+    if let Some(pem) = cert_pem {
+        return parse_pem_certificate(&pem, host.as_deref());
+    }
+
+    let host = host.ok_or("Host is required")?;
+    let port = port.unwrap_or(443);
+
+    tokio::task::spawn_blocking(move || fetch_remote_certificate(&host, port))
+        .await
+        .map_err(|e| format!("Task join error: {}", e))?
+}
+
+fn parse_pem_certificate(pem: &str, host: Option<&str>) -> Result<CertificatePayload, String> {
+    use x509_parser::prelude::*;
+
+    let (_, pem_parsed) = x509_parser::pem::parse_x509_pem(pem.as_bytes())
+        .map_err(|e| format!("Failed to parse PEM: {:?}", e))?;
+
+    let (_, cert) = X509Certificate::from_der(&pem_parsed.contents)
+        .map_err(|e| format!("Failed to parse certificate: {:?}", e))?;
+
+    let subject = cert.subject().to_string();
+    let subject_cn = extract_cn(&subject);
+    let issuer = cert.issuer().to_string();
+    let issuer_cn = extract_cn(&issuer);
+
+    let san = cert.extensions().iter().find_map(|ext| {
+        if let x509_parser::extensions::ParsedExtension::SubjectAlternativeName(san) =
+            ext.parsed_extension()
+        {
+            Some(san)
+        } else {
+            None
+        }
+    });
+
+    let san_names = parse_alt_names(san);
+
+    let valid_from = offset_to_chrono(cert.validity().not_before.to_datetime());
+    let valid_to = offset_to_chrono(cert.validity().not_after.to_datetime());
+
+    let now = Utc::now();
+    let is_expired = valid_to < now;
+    let days_remaining = calculate_days_remaining(Some(&valid_to));
+    let about_to_expire = !is_expired && days_remaining.map(|d| d <= 14).unwrap_or(false);
+
+    let valid_for_host = host.map(|h| {
+        let candidates = if !san_names.is_empty() {
+            san_names.clone()
+        } else if let Some(ref cn) = subject_cn {
+            vec![cn.clone()]
+        } else {
+            vec![subject.clone()]
+        };
+        host_matches(h, &candidates)
+    });
+
+    let warnings = collect_warnings(is_expired, about_to_expire, valid_for_host, None);
+
+    Ok(CertificatePayload {
+        source: "pem".to_string(),
+        subject: Some(subject),
+        subject_cn,
+        issuer: Some(issuer),
+        issuer_cn,
+        san: san_names,
+        valid_from: Some(valid_from.to_rfc3339()),
+        valid_to: Some(valid_to.to_rfc3339()),
+        days_remaining,
+        is_expired,
+        about_to_expire,
+        chain_valid: None,
+        authorization_error: None,
+        valid_for_host,
+        raw_pem: Some(pem.to_string()),
+        serial_number: Some(cert.serial.to_str_radix(16)),
+        fingerprint256: Some(sha256_fingerprint(&pem_parsed.contents)),
+        warnings,
+    })
+}
+
+fn fetch_remote_certificate(host: &str, port: u16) -> Result<CertificatePayload, String> {
+    use x509_parser::prelude::*;
+
+    let addr = format!("{}:{}", host, port);
+
+    // Connect with TCP
+    let stream = TcpStream::connect_timeout(
+        &addr
+            .to_socket_addrs()
+            .map_err(|e| format!("Failed to resolve host: {}", e))?
+            .next()
+            .ok_or("No addresses found")?,
+        Duration::from_secs(8),
+    )
+    .map_err(|e| format!("Failed to connect: {}", e))?;
+
+    stream
+        .set_read_timeout(Some(Duration::from_secs(8)))
+        .map_err(|e| format!("Failed to set timeout: {}", e))?;
+
+    // TLS handshake
+    let connector = TlsConnector::builder()
+        .danger_accept_invalid_certs(true)
+        .danger_accept_invalid_hostnames(true)
+        .build()
+        .map_err(|e| format!("Failed to build TLS connector: {}", e))?;
+
+    let tls_stream = connector
+        .connect(host, stream)
+        .map_err(|e| format!("TLS handshake failed: {}", e))?;
+
+    // Get peer certificate
+    let cert = tls_stream
+        .peer_certificate()
+        .map_err(|e| format!("Failed to get certificate: {}", e))?
+        .ok_or("No certificate presented")?;
+
+    let der = cert
+        .to_der()
+        .map_err(|e| format!("Failed to get DER: {}", e))?;
+
+    let (_, x509_cert) = X509Certificate::from_der(&der)
+        .map_err(|e| format!("Failed to parse certificate: {:?}", e))?;
+
+    let subject = x509_cert.subject().to_string();
+    let subject_cn = extract_cn(&subject);
+    let issuer = x509_cert.issuer().to_string();
+    let issuer_cn = extract_cn(&issuer);
+
+    let san = x509_cert.extensions().iter().find_map(|ext| {
+        if let x509_parser::extensions::ParsedExtension::SubjectAlternativeName(san) =
+            ext.parsed_extension()
+        {
+            Some(san)
+        } else {
+            None
+        }
+    });
+
+    let san_names = parse_alt_names(san);
+
+    let valid_from = offset_to_chrono(x509_cert.validity().not_before.to_datetime());
+    let valid_to = offset_to_chrono(x509_cert.validity().not_after.to_datetime());
+
+    let now = Utc::now();
+    let is_expired = valid_to < now;
+    let days_remaining = calculate_days_remaining(Some(&valid_to));
+    let about_to_expire = !is_expired && days_remaining.map(|d| d <= 14).unwrap_or(false);
+
+    let valid_for_host = {
+        let candidates = if !san_names.is_empty() {
+            san_names.clone()
+        } else if let Some(ref cn) = subject_cn {
+            vec![cn.clone()]
+        } else {
+            vec![subject.clone()]
+        };
+        host_matches(host, &candidates)
+    };
+
+    // Check chain validity by trying with verification enabled
+    let chain_valid = {
+        let verify_connector = TlsConnector::builder().build().ok();
+
+        if let Some(vc) = verify_connector {
+            let resolved_addr = addr.to_socket_addrs().ok().and_then(|mut a| a.next());
+
+            if let Some(socket_addr) = resolved_addr {
+                let verify_stream =
+                    TcpStream::connect_timeout(&socket_addr, Duration::from_secs(5)).ok();
+
+                if let Some(vs) = verify_stream {
+                    vc.connect(host, vs).is_ok()
+                } else {
+                    false
+                }
+            } else {
+                false
+            }
+        } else {
+            false
+        }
+    };
+
+    let warnings = collect_warnings(
+        is_expired,
+        about_to_expire,
+        Some(valid_for_host),
+        Some(chain_valid),
+    );
+
+    Ok(CertificatePayload {
+        source: "remote".to_string(),
+        subject: Some(subject),
+        subject_cn,
+        issuer: Some(issuer),
+        issuer_cn,
+        san: san_names,
+        valid_from: Some(valid_from.to_rfc3339()),
+        valid_to: Some(valid_to.to_rfc3339()),
+        days_remaining,
+        is_expired,
+        about_to_expire,
+        chain_valid: Some(chain_valid),
+        authorization_error: if !chain_valid {
+            Some("Certificate chain validation failed".to_string())
+        } else {
+            None
+        },
+        valid_for_host: Some(valid_for_host),
+        raw_pem: Some(buffer_to_pem(&der)),
+        serial_number: Some(x509_cert.serial.to_str_radix(16)),
+        fingerprint256: Some(sha256_fingerprint(&der)),
+        warnings,
+    })
+}
+
+// ============================================================================
+// HTTP Proxy Commands
+// ============================================================================
+
+#[derive(serde::Deserialize)]
+struct ProxyRequest {
+    #[serde(rename = "InputUrl")]
+    input_url: String,
+    method: Option<String>,
+    headers: Option<std::collections::HashMap<String, String>>,
+    body: Option<String>,
+}
+
+#[derive(serde::Serialize)]
+struct ProxyResponse {
+    status: u16,
+    #[serde(rename = "statusText")]
+    status_text: String,
+    #[serde(rename = "responseTime")]
+    response_time: u64,
+    data: String,
+    #[serde(rename = "contentType")]
+    content_type: String,
+}
+
+#[tauri::command]
+async fn http_proxy(request: ProxyRequest) -> Result<ProxyResponse, String> {
+    let url = url::Url::parse(&request.input_url).map_err(|e| format!("Invalid URL: {}", e))?;
+
+    let method = request.method.unwrap_or_else(|| "GET".to_string());
+    let method =
+        reqwest::Method::from_bytes(method.as_bytes()).map_err(|_| "Invalid HTTP method")?;
+
+    let client = reqwest::Client::builder()
+        .timeout(Duration::from_secs(30))
+        .build()
+        .map_err(|e| format!("Failed to create client: {}", e))?;
+
+    let start = Instant::now();
+
+    let mut req_builder = client.request(method.clone(), url);
+
+    if let Some(headers) = request.headers {
+        for (key, value) in headers {
+            // Skip headers with CRLF injection
+            if !value.contains('\r') && !value.contains('\n') {
+                req_builder = req_builder.header(&key, &value);
+            }
+        }
+    }
+
+    if method != reqwest::Method::GET {
+        if let Some(body) = request.body {
+            req_builder = req_builder.body(body);
+        }
+    }
+
+    let response = req_builder
+        .send()
+        .await
+        .map_err(|e| format!("Request failed: {}", e))?;
+
+    let response_time = start.elapsed().as_millis() as u64;
+    let status = response.status().as_u16();
+    let status_text = response
+        .status()
+        .canonical_reason()
+        .unwrap_or("")
+        .to_string();
+    let content_type = response
+        .headers()
+        .get("content-type")
+        .and_then(|v| v.to_str().ok())
+        .unwrap_or("")
+        .to_string();
+
+    let data = if content_type.contains("application/json") {
+        let json: serde_json::Value = response
+            .json()
+            .await
+            .map_err(|e| format!("Failed to parse JSON: {}", e))?;
+        serde_json::to_string_pretty(&json).unwrap_or_default()
+    } else {
+        response
+            .text()
+            .await
+            .map_err(|e| format!("Failed to read response: {}", e))?
+    };
+
+    Ok(ProxyResponse {
+        status,
+        status_text,
+        response_time,
+        data,
+        content_type,
+    })
+}
+
+// ============================================================================
+// TCP/UDP Whistle Commands
+// ============================================================================
+
+#[derive(serde::Deserialize, Clone)]
+struct WhistleRequest {
+    mode: String,
+    host: Option<String>,
+    port: u16,
+    payload: Option<String>,
+    #[serde(rename = "timeoutMs")]
+    timeout_ms: Option<u64>,
+    #[serde(rename = "delayMs")]
+    delay_ms: Option<u64>,
+    #[serde(rename = "chunkSize")]
+    chunk_size: Option<usize>,
+    #[serde(rename = "durationMs")]
+    duration_ms: Option<u64>,
+    malformed: Option<bool>,
+    echo: Option<bool>,
+    #[serde(rename = "echoPayload")]
+    echo_payload: Option<String>,
+    #[serde(rename = "respondDelayMs")]
+    respond_delay_ms: Option<u64>,
+    #[serde(rename = "maxCapture")]
+    max_capture: Option<usize>,
+}
+
+#[derive(serde::Serialize)]
+struct WhistleSendResponse {
+    ok: bool,
+    mode: String,
+    #[serde(rename = "elapsedMs")]
+    elapsed_ms: u64,
+    #[serde(rename = "bytesSent")]
+    bytes_sent: usize,
+    #[serde(rename = "bytesReceived")]
+    bytes_received: usize,
+    response: ResponsePreview,
+}
+
+#[derive(serde::Serialize)]
+struct ResponsePreview {
+    text: String,
+    hex: String,
+    bytes: usize,
+}
+
+#[derive(serde::Serialize, Clone)]
+struct CaptureEntry {
+    at: String,
+    #[serde(rename = "remoteAddress")]
+    remote_address: Option<String>,
+    #[serde(rename = "remotePort")]
+    remote_port: Option<u16>,
+    bytes: usize,
+    hex: String,
+    text: String,
+    #[serde(rename = "elapsedMs", skip_serializing_if = "Option::is_none")]
+    elapsed_ms: Option<u64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    note: Option<String>,
+}
+
+#[derive(serde::Serialize)]
+struct WhistleListenResponse {
+    ok: bool,
+    mode: String,
+    #[serde(rename = "durationMs")]
+    duration_ms: u64,
+    captures: Vec<CaptureEntry>,
+}
+
+const MAX_PAYLOAD_BYTES: usize = 4096;
+const MAX_RESPONSE_BYTES: usize = 128 * 1024;
+const MAX_DURATION_MS: u64 = 600000;
+const MAX_DELAY_MS: u64 = 8000;
+
+fn to_safe_delay(value: Option<u64>, fallback: u64) -> u64 {
+    value.map(|v| v.min(MAX_DELAY_MS)).unwrap_or(fallback)
+}
+
+fn to_safe_duration(value: Option<u64>, fallback: u64) -> u64 {
+    value
+        .map(|v| v.min(MAX_DURATION_MS).max(1))
+        .unwrap_or(fallback)
+}
+
+fn build_payload(payload: Option<&str>, malformed: bool) -> Vec<u8> {
+    let mut data: Vec<u8> = payload.unwrap_or("").as_bytes().to_vec();
+    data.truncate(MAX_PAYLOAD_BYTES);
+
+    if malformed {
+        data.extend_from_slice(&[0x00, 0xff, 0x13, 0x37]);
+        data.truncate(MAX_PAYLOAD_BYTES);
+    }
+
+    data
+}
+
+fn preview(buffer: &[u8]) -> ResponsePreview {
+    ResponsePreview {
+        text: String::from_utf8_lossy(buffer).to_string(),
+        hex: hex::encode(buffer),
+        bytes: buffer.len(),
+    }
+}
+
+fn validate_whistle_host(host: Option<&str>) -> Result<(), String> {
+    let host = host.ok_or("Host is required")?;
+    let normalized = host.trim().to_lowercase();
+
+    let allowed = ["localhost", "127.0.0.1", "::1", "[::1]"];
+    if allowed.contains(&normalized.as_str()) {
+        return Ok(());
+    }
+
+    // Allow 127.x.x.x range
+    if normalized.starts_with("127.") {
+        let parts: Vec<&str> = normalized.split('.').collect();
+        if parts.len() == 4 && parts.iter().all(|p| p.parse::<u8>().is_ok()) {
+            return Ok(());
+        }
+    }
+
+    Err("Only localhost/loopback addresses are allowed for security reasons".to_string())
+}
+
+#[tauri::command]
+async fn whistle(request: WhistleRequest) -> Result<serde_json::Value, String> {
+    let mode = request.mode.as_str();
+
+    match mode {
+        "tcp-send" | "udp-send" => {
+            validate_whistle_host(request.host.as_deref())?;
+        }
+        _ => {}
+    }
+
+    match mode {
+        "tcp-send" => {
+            let result = handle_tcp_send(request).await?;
+            serde_json::to_value(result).map_err(|e| e.to_string())
+        }
+        "udp-send" => {
+            let result = handle_udp_send(request).await?;
+            serde_json::to_value(result).map_err(|e| e.to_string())
+        }
+        "tcp-listen" => {
+            let result = handle_tcp_listen(request).await?;
+            serde_json::to_value(result).map_err(|e| e.to_string())
+        }
+        "udp-listen" => {
+            let result = handle_udp_listen(request).await?;
+            serde_json::to_value(result).map_err(|e| e.to_string())
+        }
+        _ => Err("Unsupported mode".to_string()),
+    }
+}
+
+async fn handle_tcp_send(req: WhistleRequest) -> Result<WhistleSendResponse, String> {
+    let host = req.host.as_deref().unwrap_or("localhost");
+    let payload = build_payload(req.payload.as_deref(), req.malformed.unwrap_or(false));
+    let delay_ms = to_safe_delay(req.delay_ms, 0);
+    let timeout_ms = req.timeout_ms.unwrap_or(5000).max(500);
+    let chunk_size = req.chunk_size;
+
+    let addr = format!("{}:{}", host, req.port);
+    let start = Instant::now();
+
+    let result = tokio::task::spawn_blocking(move || {
+        let mut stream = TcpStream::connect_timeout(
+            &addr
+                .to_socket_addrs()
+                .map_err(|e| format!("Failed to resolve: {}", e))?
+                .next()
+                .ok_or("No address found")?,
+            Duration::from_millis(timeout_ms),
+        )
+        .map_err(|e| format!("Connect failed: {}", e))?;
+
+        stream
+            .set_read_timeout(Some(Duration::from_millis(timeout_ms)))
+            .map_err(|e| format!("Set timeout failed: {}", e))?;
+        stream
+            .set_write_timeout(Some(Duration::from_millis(timeout_ms)))
+            .map_err(|e| format!("Set timeout failed: {}", e))?;
+
+        if delay_ms > 0 {
+            std::thread::sleep(Duration::from_millis(delay_ms));
+        }
+
+        // Send data
+        if let Some(chunk) = chunk_size {
+            if chunk < payload.len() {
+                for chunk_data in payload.chunks(chunk) {
+                    stream
+                        .write_all(chunk_data)
+                        .map_err(|e| format!("Write failed: {}", e))?;
+                    std::thread::sleep(Duration::from_millis(120));
+                }
+            } else {
+                stream
+                    .write_all(&payload)
+                    .map_err(|e| format!("Write failed: {}", e))?;
+            }
+        } else {
+            stream
+                .write_all(&payload)
+                .map_err(|e| format!("Write failed: {}", e))?;
+        }
+
+        stream.shutdown(std::net::Shutdown::Write).ok();
+
+        // Read response
+        let mut response = Vec::new();
+        let mut buf = [0u8; 8192];
+        loop {
+            match stream.read(&mut buf) {
+                Ok(0) => break,
+                Ok(n) => {
+                    response.extend_from_slice(&buf[..n]);
+                    if response.len() >= MAX_RESPONSE_BYTES {
+                        response.truncate(MAX_RESPONSE_BYTES);
+                        break;
+                    }
+                }
+                Err(e) if e.kind() == std::io::ErrorKind::WouldBlock => break,
+                Err(e) if e.kind() == std::io::ErrorKind::TimedOut => break,
+                Err(e) => return Err(format!("Read failed: {}", e)),
+            }
+        }
+
+        Ok::<(Vec<u8>, usize), String>((response, payload.len()))
+    })
+    .await
+    .map_err(|e| format!("Task error: {}", e))??;
+
+    let elapsed_ms = start.elapsed().as_millis() as u64;
+
+    Ok(WhistleSendResponse {
+        ok: true,
+        mode: "tcp-send".to_string(),
+        elapsed_ms,
+        bytes_sent: result.1,
+        bytes_received: result.0.len(),
+        response: preview(&result.0),
+    })
+}
+
+async fn handle_udp_send(req: WhistleRequest) -> Result<WhistleSendResponse, String> {
+    let host = req.host.as_deref().unwrap_or("localhost");
+    let payload = build_payload(req.payload.as_deref(), req.malformed.unwrap_or(false));
+    let delay_ms = to_safe_delay(req.delay_ms, 0);
+    let timeout_ms = req.timeout_ms.unwrap_or(4000).max(500);
+
+    let addr = format!("{}:{}", host, req.port);
+    let start = Instant::now();
+
+    let payload_len = payload.len();
+
+    let result = tokio::task::spawn_blocking(move || {
+        let socket = UdpSocket::bind("0.0.0.0:0").map_err(|e| format!("Bind failed: {}", e))?;
+
+        socket
+            .set_read_timeout(Some(Duration::from_millis(timeout_ms)))
+            .map_err(|e| format!("Set timeout failed: {}", e))?;
+
+        socket
+            .connect(&addr)
+            .map_err(|e| format!("Connect failed: {}", e))?;
+
+        if delay_ms > 0 {
+            std::thread::sleep(Duration::from_millis(delay_ms));
+        }
+
+        socket
+            .send(&payload)
+            .map_err(|e| format!("Send failed: {}", e))?;
+
+        let mut buf = [0u8; 65535];
+        let response = match socket.recv(&mut buf) {
+            Ok(n) => buf[..n.min(MAX_RESPONSE_BYTES)].to_vec(),
+            Err(e) if e.kind() == std::io::ErrorKind::WouldBlock => Vec::new(),
+            Err(e) if e.kind() == std::io::ErrorKind::TimedOut => Vec::new(),
+            Err(e) => return Err(format!("Recv failed: {}", e)),
+        };
+
+        Ok::<Vec<u8>, String>(response)
+    })
+    .await
+    .map_err(|e| format!("Task error: {}", e))??;
+
+    let elapsed_ms = start.elapsed().as_millis() as u64;
+
+    Ok(WhistleSendResponse {
+        ok: true,
+        mode: "udp-send".to_string(),
+        elapsed_ms,
+        bytes_sent: payload_len,
+        bytes_received: result.len(),
+        response: preview(&result),
+    })
+}
+
+async fn handle_tcp_listen(req: WhistleRequest) -> Result<WhistleListenResponse, String> {
+    let duration_ms = to_safe_duration(req.duration_ms, 600000);
+    let respond_delay_ms = to_safe_delay(req.respond_delay_ms, 0);
+    let max_capture = req.max_capture.unwrap_or(10).min(25);
+    let echo = req.echo.unwrap_or(false);
+    let echo_payload = build_payload(req.echo_payload.as_deref(), req.malformed.unwrap_or(false));
+    let port = req.port;
+
+    let captures = tokio::task::spawn_blocking(move || {
+        let addr = format!("0.0.0.0:{}", port);
+
+        let listener = TcpListener::bind(&addr).map_err(|e| format!("Bind failed: {}", e))?;
+
+        listener
+            .set_nonblocking(true)
+            .map_err(|e| format!("Set nonblocking failed: {}", e))?;
+
+        let start = Instant::now();
+        let mut captures: Vec<CaptureEntry> = Vec::new();
+
+        let deadline = Duration::from_millis(duration_ms);
+
+        while start.elapsed() < deadline && captures.len() < max_capture {
+            match listener.accept() {
+                Ok((mut stream, addr)) => {
+                    let conn_start = Instant::now();
+                    stream.set_read_timeout(Some(Duration::from_secs(5))).ok();
+
+                    let mut data = Vec::new();
+                    let mut buf = [0u8; 8192];
+                    loop {
+                        match stream.read(&mut buf) {
+                            Ok(0) => break,
+                            Ok(n) => {
+                                data.extend_from_slice(&buf[..n]);
+                                if data.len() >= MAX_RESPONSE_BYTES {
+                                    data.truncate(MAX_RESPONSE_BYTES);
+                                    break;
+                                }
+                            }
+                            Err(_) => break,
+                        }
+                    }
+
+                    captures.push(CaptureEntry {
+                        at: Utc::now().to_rfc3339(),
+                        remote_address: Some(addr.ip().to_string()),
+                        remote_port: Some(addr.port()),
+                        bytes: data.len(),
+                        hex: hex::encode(&data),
+                        text: String::from_utf8_lossy(&data).to_string(),
+                        elapsed_ms: Some(conn_start.elapsed().as_millis() as u64),
+                        note: None,
+                    });
+
+                    if echo {
+                        if respond_delay_ms > 0 {
+                            std::thread::sleep(Duration::from_millis(respond_delay_ms));
+                        }
+                        stream.write_all(&echo_payload).ok();
+                    }
+                }
+                Err(e) if e.kind() == std::io::ErrorKind::WouldBlock => {
+                    std::thread::sleep(Duration::from_millis(50));
+                }
+                Err(e) => {
+                    captures.push(CaptureEntry {
+                        at: Utc::now().to_rfc3339(),
+                        remote_address: None,
+                        remote_port: None,
+                        bytes: 0,
+                        hex: String::new(),
+                        text: String::new(),
+                        elapsed_ms: None,
+                        note: Some(format!("Accept error: {}", e)),
+                    });
+                }
+            }
+        }
+
+        Ok::<(Vec<CaptureEntry>, u64), String>((captures, start.elapsed().as_millis() as u64))
+    })
+    .await
+    .map_err(|e| format!("Task error: {}", e))??;
+
+    Ok(WhistleListenResponse {
+        ok: true,
+        mode: "tcp-listen".to_string(),
+        duration_ms: captures.1,
+        captures: captures.0,
+    })
+}
+
+async fn handle_udp_listen(req: WhistleRequest) -> Result<WhistleListenResponse, String> {
+    let duration_ms = to_safe_duration(req.duration_ms, 5000);
+    let respond_delay_ms = to_safe_delay(req.respond_delay_ms, 0);
+    let max_capture = req.max_capture.unwrap_or(10).min(25);
+    let echo = req.echo.unwrap_or(false);
+    let echo_payload = build_payload(req.echo_payload.as_deref(), req.malformed.unwrap_or(false));
+    let port = req.port;
+
+    let captures = tokio::task::spawn_blocking(move || {
+        let addr = format!("0.0.0.0:{}", port);
+
+        let socket = UdpSocket::bind(&addr).map_err(|e| format!("Bind failed: {}", e))?;
+
+        socket
+            .set_nonblocking(true)
+            .map_err(|e| format!("Set nonblocking failed: {}", e))?;
+
+        let start = Instant::now();
+        let mut captures: Vec<CaptureEntry> = Vec::new();
+
+        let deadline = Duration::from_millis(duration_ms);
+        let mut buf = [0u8; 65535];
+
+        while start.elapsed() < deadline && captures.len() < max_capture {
+            match socket.recv_from(&mut buf) {
+                Ok((n, addr)) => {
+                    let data = buf[..n.min(MAX_RESPONSE_BYTES)].to_vec();
+
+                    captures.push(CaptureEntry {
+                        at: Utc::now().to_rfc3339(),
+                        remote_address: Some(addr.ip().to_string()),
+                        remote_port: Some(addr.port()),
+                        bytes: data.len(),
+                        hex: hex::encode(&data),
+                        text: String::from_utf8_lossy(&data).to_string(),
+                        elapsed_ms: None,
+                        note: None,
+                    });
+
+                    if echo {
+                        if respond_delay_ms > 0 {
+                            std::thread::sleep(Duration::from_millis(respond_delay_ms));
+                        }
+                        socket.send_to(&echo_payload, addr).ok();
+                    }
+                }
+                Err(e) if e.kind() == std::io::ErrorKind::WouldBlock => {
+                    std::thread::sleep(Duration::from_millis(50));
+                }
+                Err(e) => {
+                    captures.push(CaptureEntry {
+                        at: Utc::now().to_rfc3339(),
+                        remote_address: None,
+                        remote_port: None,
+                        bytes: 0,
+                        hex: String::new(),
+                        text: String::new(),
+                        elapsed_ms: None,
+                        note: Some(format!("Recv error: {}", e)),
+                    });
+                }
+            }
+        }
+
+        Ok::<(Vec<CaptureEntry>, u64), String>((captures, start.elapsed().as_millis() as u64))
+    })
+    .await
+    .map_err(|e| format!("Task error: {}", e))??;
+
+    Ok(WhistleListenResponse {
+        ok: true,
+        mode: "udp-listen".to_string(),
+        duration_ms: captures.1,
+        captures: captures.0,
+    })
+}
+
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
     tauri::Builder::default()
         .plugin(tauri_plugin_dialog::init())
         .plugin(tauri_plugin_fs::init())
+        .plugin(tauri_plugin_process::init())
         .setup(|app| {
             if cfg!(debug_assertions) {
                 app.handle().plugin(
@@ -787,7 +1756,10 @@ pub fn run() {
             extract_palette_from_image,
             check_port,
             kill_process,
-            scan_listening_ports
+            scan_listening_ports,
+            cert_check,
+            http_proxy,
+            whistle
         ])
         .run(tauri::generate_context!())
         .expect("error while running tauri application");
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 9d2a3a9..7c9e63f 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -24,15 +24,21 @@
       }
     ],
     "security": {
-      "csp": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: asset: https://asset.localhost; font-src 'self' data:",
+      "csp": null,
       "capabilities": [
         {
           "identifier": "main-capability",
-          "windows": ["main"],
+          "windows": ["*"],
           "permissions": [
             "core:default",
             "dialog:default",
-            "fs:allow-read-file"
+            "core:window:allow-close",
+            "core:window:allow-destroy",
+            "core:app:allow-app-hide",
+            "core:app:allow-app-show",
+            "core:app:default",
+            "process:default",
+            "process:allow-exit"
           ]
         }
       ]