feat: M1.1 完成 + M1.2 启动 — 全量更新

M1.1 收尾:
- 24项 P0/P1/P2 bug 修复 (Rust 107 tests + Flutter 15 tests)
- Flutter App v0.3: cupertino_icons 修复, 单元测试, 调试面板, APK 52.6MB
- 示例插件完善: manifest.json + 请求/响应示范 + 7个测试
- API 文档重写 (以 routes.rs 为唯一权威)
- MILESTONES.md 更新至 100%

M1.2 启动:
- P0: 插件管理 API 闭环 (handle_manager_message Custom 分支 + broadcast_plugin_states)
- ServiceManager 集成测试 8/8 (tests/m1_2_service_manager.rs)
- M1.2 测试计划 (docs/M1.2_TEST_PLAN.md, 18个E2E场景)
- 动态插件系统: auto_rollback + version_manager GC + 路径穿越防护

总计: Rust 115/115 测试, Flutter 15/15 测试, 零 warning

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/plugins/ble/gatt.rs

@@ -6,14 +6,14 @@ use dbus::blocking::stdintf::org_freedesktop_dbus::{ObjectManager, Properties};
 use dbus::blocking::Connection;
 use dbus::channel::MatchingReceiver;
 use dbus::channel::Sender;
-use dbus::message::MatchRule;
+use dbus::message::{MatchRule, Message as DbusMessage, MessageType};
 use dbus::Path;
 use dbus_crossroads::{Crossroads, IfaceBuilder, IfaceToken, MethodErr};
 use std::collections::HashMap;
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::mpsc::{self, Receiver, TryRecvError};
 use std::sync::{Arc, Mutex};
-use std::time::Duration;
+use std::time::{Duration, Instant};
 
 const BUS_NAME: &str = "io.showen.BleProvisioning";
 const BLUEZ_SERVICE: &str = "org.bluez";
@@ -37,6 +37,14 @@ const PROXY_TIMEOUT: Duration = Duration::from_secs(10);
 
 type ManagedObjects = HashMap<Path<'static>, HashMap<String, PropMap>>;
 
+#[derive(Default)]
+struct RegistrationReplies {
+    gatt_serial: Option<u32>,
+    advertisement_serial: Option<u32>,
+    gatt: Option<Result<()>>,
+    advertisement: Option<Result<()>>,
+}
+
 pub enum BleControl {
     UpdateStatus(String),
 }
@@ -171,8 +179,7 @@ pub fn run_ble_service(
     let shared = SharedState::new(tx.clone());
 
     eprintln!("[BLE] connecting to system bus...");
-    let conn =
-        Connection::new_system().context("failed to connect to system bus for BLE")?;
+    let conn = Connection::new_system().context("failed to connect to system bus for BLE")?;
     conn.request_name(BUS_NAME, false, true, false)
         .context("failed to request BLE D-Bus name")?;
     eprintln!("[BLE] D-Bus name acquired");
@@ -273,6 +280,35 @@ pub fn run_ble_service(
         }),
     );
 
+    let registration_replies = Arc::new(Mutex::new(RegistrationReplies::default()));
+    let replies_for_success = Arc::clone(&registration_replies);
+    let mut success_rule = MatchRule::new();
+    success_rule.msg_type = Some(MessageType::MethodReturn);
+    conn.start_receive(
+        success_rule,
+        Box::new(move |msg, _conn| {
+            record_registration_reply(&replies_for_success, &msg, Ok(()));
+            true
+        }),
+    );
+
+    let replies_for_error = Arc::clone(&registration_replies);
+    let mut error_rule = MatchRule::new();
+    error_rule.msg_type = Some(MessageType::Error);
+    conn.start_receive(
+        error_rule,
+        Box::new(move |msg, _conn| {
+            let error_message = msg.get1::<String>().unwrap_or_default();
+            let error = if error_message.is_empty() {
+                anyhow!("{msg:?}")
+            } else {
+                anyhow!("{error_message}")
+            };
+            record_registration_reply(&replies_for_error, &msg, Err(error));
+            true
+        }),
+    );
+
     // 配置 adapter
     let adapter_path = find_adapter(&conn)?;
     configure_adapter(&conn, &adapter_path, &device_name)?;
@@ -280,18 +316,23 @@ pub fn run_ble_service(
     // 先尝试清理上一次进程残留的注册（防止崩溃后 BlueZ 状态残留）
     let _ = unregister_ble_objects(&conn, &adapter_path);
 
-    // 非阻塞发送 RegisterApplication + RegisterAdvertisement
-    let _gatt_serial = send_register_gatt_app(&conn, &adapter_path)?;
-    let _ad_serial = send_register_advertisement(&conn, &adapter_path)?;
-    eprintln!("[BLE] registration requests sent, processing callbacks...");
+    let gatt_serial = send_register_gatt_app(&conn, &adapter_path)?;
+    let ad_serial = send_register_advertisement(&conn, &adapter_path)?;
+    if let Ok(mut replies) = registration_replies.lock() {
+        replies.gatt_serial = Some(gatt_serial);
+        replies.advertisement_serial = Some(ad_serial);
+    }
+    eprintln!("[BLE] registration requests sent, waiting for BlueZ replies...");
 
-    // 处理消息循环等待 BlueZ 回调 GetManagedObjects 并完成注册
-    // start_receive 会处理所有入站方法调用（包括 BlueZ 的回调），
-    // 注册回复也由 process() 内部分发，我们只需等待足够时间
-    let deadline = std::time::Instant::now() + Duration::from_secs(5);
-    while std::time::Instant::now() < deadline {
-        conn.process(Duration::from_millis(100))
-            .context("BLE connection process failed during registration")?;
+    if let Err(error) = wait_for_registration_replies(
+        &conn,
+        &registration_replies,
+        gatt_serial,
+        ad_serial,
+        Duration::from_secs(10),
+    ) {
+        let _ = unregister_ble_objects(&conn, &adapter_path);
+        return Err(error);
     }
 
     eprintln!("[BLE] GATT application and advertisement registered");
@@ -504,6 +545,81 @@ fn build_managed_objects() -> ManagedObjects {
     objects
 }
 
+fn record_registration_reply(
+    replies: &Arc<Mutex<RegistrationReplies>>,
+    msg: &DbusMessage,
+    result: Result<()>,
+) {
+    let Some(reply_serial) = msg.get_reply_serial() else {
+        return;
+    };
+
+    if let Ok(mut replies) = replies.lock() {
+        match replies_for_serial(&mut replies, reply_serial) {
+            Some(slot) if slot.is_none() => *slot = Some(result),
+            _ => {}
+        }
+    }
+}
+
+fn replies_for_serial(
+    replies: &mut RegistrationReplies,
+    reply_serial: u32,
+) -> Option<&mut Option<Result<()>>> {
+    if replies.gatt_serial == Some(reply_serial) {
+        Some(&mut replies.gatt)
+    } else if replies.advertisement_serial == Some(reply_serial) {
+        Some(&mut replies.advertisement)
+    } else {
+        None
+    }
+}
+
+fn wait_for_registration_replies(
+    conn: &Connection,
+    replies: &Arc<Mutex<RegistrationReplies>>,
+    gatt_serial: u32,
+    advertisement_serial: u32,
+    timeout: Duration,
+) -> Result<()> {
+    let deadline = Instant::now() + timeout;
+
+    loop {
+        if let Ok(mut replies) = replies.lock() {
+            match reply_status(&mut replies.gatt, "RegisterApplication")? {
+                Some(()) => {}
+                None => {}
+            }
+            match reply_status(&mut replies.advertisement, "RegisterAdvertisement")? {
+                Some(()) => {}
+                None => {}
+            }
+
+            if replies.gatt.is_some() && replies.advertisement.is_some() {
+                return Ok(());
+            }
+        }
+
+        let now = Instant::now();
+        if now >= deadline {
+            return Err(anyhow!(
+                "timed out waiting for BLE registration reply (gatt_serial={gatt_serial}, advertisement_serial={advertisement_serial})"
+            ));
+        }
+
+        conn.process(Duration::from_millis(100).min(deadline.saturating_duration_since(now)))
+            .context("BLE connection process failed during registration")?;
+    }
+}
+
+fn reply_status(reply: &mut Option<Result<()>>, operation: &str) -> Result<Option<()>> {
+    match reply {
+        Some(Ok(())) => Ok(Some(())),
+        Some(Err(error)) => Err(anyhow!("{operation} failed: {error}")),
+        None => Ok(None),
+    }
+}
+
 fn send_register_gatt_app(conn: &Connection, adapter_path: &str) -> Result<u32> {
     let msg = dbus::Message::method_call(
         &BLUEZ_SERVICE.into(),
@@ -594,8 +710,7 @@ fn unregister_ble_objects(conn: &Connection, adapter_path: &str) -> Result<()> {
 
 fn bytes_to_string(value: &[u8]) -> String {
     String::from_utf8_lossy(value)
-        .trim_end_matches('\0')
-        .trim()
+        .trim_matches(|c: char| c == '\0' || c.is_whitespace())
         .to_string()
 }
 
@@ -630,3 +745,80 @@ fn emit_status_notification(conn: &Connection, shared: &SharedState) -> Result<(
 
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::core::message::WifiCommand;
+
+    #[test]
+    fn bytes_to_string_trims_nulls_and_surrounding_whitespace() {
+        assert_eq!(bytes_to_string(b"  demo-ssid\0\0  "), "demo-ssid");
+    }
+
+    #[test]
+    fn dispatch_command_uses_cached_wifi_credentials() {
+        let (tx, rx) = mpsc::channel();
+        let shared = SharedState::new(tx);
+        shared.set_ssid(br#"Cafe \"Guest\""#);
+        shared.set_password(br#"pa\\ss word"#);
+
+        shared
+            .dispatch_command(b"connect")
+            .expect("connect command should dispatch");
+
+        let envelope = rx.recv().expect("command should be forwarded to core");
+        match envelope.message {
+            Message::WifiCommand(WifiCommand::Connect { ssid, password }) => {
+                assert_eq!(ssid, r#"Cafe \"Guest\""#);
+                assert_eq!(password, r#"pa\\ss word"#);
+            }
+            other => panic!("unexpected forwarded BLE command: {:?}", other),
+        }
+
+        assert_eq!(
+            String::from_utf8(shared.read_status()).expect("status should be utf8"),
+            r#"{"ok":true,"action":"connect","state":"queued"}"#
+        );
+    }
+
+    #[test]
+    fn dispatch_command_reports_invalid_command_in_status() {
+        let (tx, _rx) = mpsc::channel();
+        let shared = SharedState::new(tx);
+
+        let error = shared
+            .dispatch_command(b"bad-command")
+            .expect_err("invalid command should fail");
+
+        assert!(error
+            .to_string()
+            .contains("unsupported command: bad-command"));
+
+        let status = String::from_utf8(shared.read_status()).expect("status should be utf8");
+        assert!(status.contains(r#""ok":false"#));
+        assert!(status.contains(r#""action":"bad-command""#));
+        assert!(status.contains(r#"unsupported command: bad-command"#));
+    }
+
+    #[test]
+    fn drain_control_messages_updates_status_without_dbus() {
+        let (tx, _rx) = mpsc::channel();
+        let shared = SharedState::new(tx);
+        let (control_tx, control_rx) = mpsc::channel();
+
+        control_tx
+            .send(BleControl::UpdateStatus(
+                r#"{"ok":true,"action":"status"}"#.to_string(),
+            ))
+            .expect("status update should send");
+
+        drain_control_messages(&shared, &control_rx).expect("control queue should drain");
+
+        assert_eq!(
+            String::from_utf8(shared.read_status()).expect("status should be utf8"),
+            r#"{"ok":true,"action":"status"}"#
+        );
+        assert!(shared.take_pending_notification());
+    }
+}

src/plugins/http/mod.rs

@@ -11,7 +11,9 @@ use anyhow::{Context, Result};
 use serde::Serialize;
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::{Arc, Condvar, Mutex};
+use std::thread::JoinHandle;
 use tokio::sync::broadcast;
+use tokio::sync::{oneshot, Mutex as AsyncMutex};
 
 #[derive(Serialize)]
 struct WsEvent<'a, T> {
@@ -36,6 +38,7 @@ struct PendingWifiResponse {
 }
 
 pub(crate) struct HttpState {
+    wifi_request_lock: AsyncMutex<()>,
     wifi_response: Mutex<PendingWifiResponse>,
     wifi_response_cv: Condvar,
     last_wifi_result: Mutex<Option<String>>,
@@ -60,6 +63,7 @@ impl HttpState {
         };
 
         Self {
+            wifi_request_lock: AsyncMutex::new(()),
             wifi_response: Mutex::new(PendingWifiResponse {
                 version: 0,
                 payload: None,
@@ -202,6 +206,8 @@ impl HttpState {
 pub struct HttpPlugin {
     ctx: Option<PluginContext>,
     state: Option<Arc<HttpState>>,
+    shutdown_tx: Option<oneshot::Sender<()>>,
+    server_thread: Option<JoinHandle<()>>,
 }
 
 impl HttpPlugin {
@@ -209,6 +215,8 @@ impl HttpPlugin {
         Self {
             ctx: None,
             state: None,
+            shutdown_tx: None,
+            server_thread: None,
         }
     }
 }
@@ -244,6 +252,8 @@ impl Plugin for HttpPlugin {
     }
 
     fn start(&mut self) -> Result<()> {
+        self.stop()?;
+
         let ctx = self
             .ctx
             .as_ref()
@@ -263,7 +273,9 @@ impl Plugin for HttpPlugin {
                 .context("http plugin state is not initialized")?,
         );
 
-        std::thread::spawn(move || {
+        let (shutdown_tx, shutdown_rx) = oneshot::channel();
+
+        let server_thread = std::thread::spawn(move || {
             let runtime = match tokio::runtime::Builder::new_multi_thread()
                 .enable_all()
                 .build()
@@ -294,10 +306,18 @@ impl Plugin for HttpPlugin {
                 }
 
                 println!("[HttpPlugin] listening on http://{addr}");
-                warp::serve(routes).run(addr).await;
+                warp::serve(routes)
+                    .bind_with_graceful_shutdown(addr, async move {
+                        let _ = shutdown_rx.await;
+                    })
+                    .1
+                    .await;
             });
         });
 
+        self.shutdown_tx = Some(shutdown_tx);
+        self.server_thread = Some(server_thread);
+
         Ok(())
     }
 
@@ -344,6 +364,16 @@ impl Plugin for HttpPlugin {
     }
 
     fn stop(&mut self) -> Result<()> {
+        if let Some(shutdown_tx) = self.shutdown_tx.take() {
+            let _ = shutdown_tx.send(());
+        }
+
+        if let Some(server_thread) = self.server_thread.take() {
+            server_thread
+                .join()
+                .map_err(|_| anyhow::anyhow!("http server thread panicked"))?;
+        }
+
         Ok(())
     }
 }

src/plugins/http/routes.rs

@@ -10,11 +10,16 @@ use serde_json::Value;
 use std::convert::Infallible;
 use std::path::{Path, PathBuf};
 use std::sync::{mpsc, Arc};
+use std::sync::atomic::{AtomicU64, Ordering};
 use std::time::{Duration, Instant};
+use tokio::io::AsyncWriteExt;
 use warp::http::StatusCode;
 use warp::multipart::FormData;
 use warp::{Filter, Reply};
 
+const MAX_UPLOAD_FILE_SIZE: u64 = 100 * 1024 * 1024;
+static UPLOAD_TMP_COUNTER: AtomicU64 = AtomicU64::new(0);
+
 #[derive(Deserialize)]
 struct WifiConnectRequest {
     ssid: String,
@@ -801,28 +806,13 @@ async fn handle_video_upload(
             continue;
         }
 
-        let data = match part
-            .stream()
-            .try_fold(Vec::new(), |mut acc, buf| async move {
-                acc.extend_from_slice(buf.chunk());
-                Ok(acc)
-            })
-            .await
-        {
-            Ok(data) => data,
-            Err(error) => {
-                return Ok(error_json(
-                    StatusCode::INTERNAL_SERVER_ERROR,
-                    &format!("读取文件失败: {error}"),
-                ));
-            }
-        };
-
-        if let Err(error) = std::fs::write(dir.join(&safe_name), &data) {
-            return Ok(error_json(
-                StatusCode::INTERNAL_SERVER_ERROR,
-                &format!("保存文件失败: {error}"),
-            ));
+        if let Err(error) = stream_upload_part(part, &dir.join(&safe_name)).await {
+            let status = if error.contains("文件大小超过限制") {
+                StatusCode::PAYLOAD_TOO_LARGE
+            } else {
+                StatusCode::INTERNAL_SERVER_ERROR
+            };
+            return Ok(error_json(status, &error));
         }
 
         uploaded.push(safe_name);
@@ -959,6 +949,7 @@ async fn wifi_request(
     state: Arc<HttpState>,
     command: WifiCommand,
 ) -> Result<Value, warp::reply::Response> {
+    let _request_guard = state.wifi_request_lock.lock().await;
     let version = match state.wifi_response.lock() {
         Ok(guard) => guard.version,
         Err(_) => {
@@ -1044,6 +1035,69 @@ async fn wifi_request(
     Ok(payload)
 }
 
+async fn stream_upload_part(
+    part: warp::multipart::Part,
+    destination: &Path,
+) -> Result<(), String> {
+    let parent = destination
+        .parent()
+        .ok_or_else(|| "上传目标目录无效".to_string())?;
+    let temp_path = parent.join(format!(
+        ".upload-{}-{}.part",
+        std::process::id(),
+        UPLOAD_TMP_COUNTER.fetch_add(1, Ordering::Relaxed)
+    ));
+
+    let mut file = match tokio::fs::File::create(&temp_path).await {
+        Ok(file) => file,
+        Err(error) => return Err(format!("创建临时文件失败: {error}")),
+    };
+
+    let mut total_size = 0u64;
+    let mut stream = part.stream();
+
+    while let Some(chunk) = match stream.try_next().await {
+        Ok(chunk) => chunk,
+        Err(error) => {
+            let _ = tokio::fs::remove_file(&temp_path).await;
+            return Err(format!("读取文件失败: {error}"));
+        }
+    } {
+        let chunk_size = chunk.remaining() as u64;
+        total_size = total_size.saturating_add(chunk_size);
+        if total_size > MAX_UPLOAD_FILE_SIZE {
+            let _ = file.flush().await;
+            drop(file);
+            let _ = tokio::fs::remove_file(&temp_path).await;
+            return Err(format!(
+                "文件大小超过限制: 单文件最大 {} MB",
+                MAX_UPLOAD_FILE_SIZE / 1024 / 1024
+            ));
+        }
+
+        if let Err(error) = file.write_all(chunk.chunk()).await {
+            drop(file);
+            let _ = tokio::fs::remove_file(&temp_path).await;
+            return Err(format!("写入临时文件失败: {error}"));
+        }
+    }
+
+    if let Err(error) = file.flush().await {
+        drop(file);
+        let _ = tokio::fs::remove_file(&temp_path).await;
+        return Err(format!("刷新临时文件失败: {error}"));
+    }
+
+    drop(file);
+
+    if let Err(error) = tokio::fs::rename(&temp_path, destination).await {
+        let _ = tokio::fs::remove_file(&temp_path).await;
+        return Err(format!("保存文件失败: {error}"));
+    }
+
+    Ok(())
+}
+
 async fn websocket_session(
     ws: warp::ws::WebSocket,
     tx: mpsc::Sender<Envelope>,
@@ -1369,20 +1423,13 @@ fn file_upload_route(
                     continue;
                 }
 
-                let data = match part
-                    .stream()
-                    .try_fold(Vec::new(), |mut acc, buf| async move {
-                        acc.extend_from_slice(buf.chunk());
-                        Ok(acc)
-                    })
-                    .await
-                {
-                    Ok(d) => d,
-                    Err(e) => return Ok(error_json(StatusCode::INTERNAL_SERVER_ERROR, &format!("读取失败: {e}"))),
-                };
-
-                if let Err(e) = std::fs::write(&dest, &data) {
-                    return Ok(error_json(StatusCode::INTERNAL_SERVER_ERROR, &format!("保存失败: {e}")));
+                if let Err(error) = stream_upload_part(part, &dest).await {
+                    let status = if error.contains("文件大小超过限制") {
+                        StatusCode::PAYLOAD_TOO_LARGE
+                    } else {
+                        StatusCode::INTERNAL_SERVER_ERROR
+                    };
+                    return Ok(error_json(status, &error));
                 }
                 uploaded.push(safe_name);
             }

src/plugins/wifi/mod.rs

@@ -36,7 +36,32 @@ impl WifiPlugin {
         Self { ctx: None }
     }
 
-    fn run_nmcli(args: &[&str]) -> Result<String> {
+    fn nmcli_args(parts: &[&str]) -> Vec<String> {
+        parts.iter().map(|part| (*part).to_string()).collect()
+    }
+
+    fn build_connect_args(ssid: &str, password: &str) -> Vec<String> {
+        let mut args = Self::nmcli_args(&["device", "wifi", "connect", ssid]);
+        if !password.trim().is_empty() {
+            args.push("password".to_string());
+            args.push(password.to_string());
+        }
+        args
+    }
+
+    fn build_hotspot_args(ssid: &str, password: &str) -> Vec<String> {
+        vec![
+            "device".to_string(),
+            "wifi".to_string(),
+            "hotspot".to_string(),
+            "ssid".to_string(),
+            ssid.to_string(),
+            "password".to_string(),
+            password.to_string(),
+        ]
+    }
+
+    fn run_nmcli(args: &[String]) -> Result<String> {
         let output = Command::new("nmcli")
             .args(args)
             .output()
@@ -52,6 +77,39 @@ impl WifiPlugin {
         }
     }
 
+    fn parse_nmcli_fields(line: &str, expected_fields: usize) -> Vec<String> {
+        let mut fields = Vec::with_capacity(expected_fields.max(1));
+        let mut current = String::new();
+        let mut escaped = false;
+
+        for ch in line.chars() {
+            if escaped {
+                current.push(ch);
+                escaped = false;
+                continue;
+            }
+
+            match ch {
+                '\\' => escaped = true,
+                ':' if fields.len() + 1 < expected_fields => {
+                    fields.push(current);
+                    current = String::new();
+                }
+                _ => current.push(ch),
+            }
+        }
+
+        if escaped {
+            current.push('\\');
+        }
+
+        fields.push(current);
+        while fields.len() < expected_fields {
+            fields.push(String::new());
+        }
+        fields
+    }
+
     fn send_result(&self, payload: String) -> Result<()> {
         let ctx = self
             .ctx
@@ -87,27 +145,30 @@ impl WifiPlugin {
     }
 
     fn scan_networks(&self) -> Result<serde_json::Value> {
-        Self::run_nmcli(&["device", "wifi", "rescan"])?;
+        Self::run_nmcli(&Self::nmcli_args(&["device", "wifi", "rescan"]))?;
         thread::sleep(Duration::from_secs(2));
-        let output =
-            Self::run_nmcli(&["-t", "-f", "SSID,SIGNAL,SECURITY", "device", "wifi", "list"])?;
+        let output = Self::run_nmcli(&Self::nmcli_args(&[
+            "--terse",
+            "--escape",
+            "yes",
+            "-f",
+            "SSID,SIGNAL,SECURITY",
+            "device",
+            "wifi",
+            "list",
+        ]))?;
 
         let networks = output
             .lines()
             .filter(|line| !line.trim().is_empty())
             .filter_map(|line| {
-                let mut parts = line.splitn(3, ':');
-                let ssid = parts.next().unwrap_or_default().trim().to_string();
+                let parts = Self::parse_nmcli_fields(line, 3);
+                let ssid = parts[0].trim().to_string();
                 if ssid.is_empty() {
                     return None;
                 }
-                let signal = parts
-                    .next()
-                    .unwrap_or_default()
-                    .trim()
-                    .parse::<i32>()
-                    .unwrap_or_default();
-                let security = parts.next().unwrap_or_default().trim().to_string();
+                let signal = parts[1].trim().parse::<i32>().unwrap_or_default();
+                let security = parts[2].trim().to_string();
 
                 Some(WifiNetwork {
                     ssid,
@@ -134,11 +195,7 @@ impl WifiPlugin {
     }
 
     fn connect_network(&self, ssid: &str, password: &str) -> Result<serde_json::Value> {
-        let mut args = vec!["device", "wifi", "connect", ssid];
-        if !password.trim().is_empty() {
-            args.extend(["password", password]);
-        }
-        let output = Self::run_nmcli(&args)?;
+        let output = Self::run_nmcli(&Self::build_connect_args(ssid, password))?;
 
         Ok(json!({
             "ok": true,
@@ -149,20 +206,30 @@ impl WifiPlugin {
     }
 
     fn status(&self) -> Result<serde_json::Value> {
-        let device_output = Self::run_nmcli(&[
-            "-t",
+        let device_output = Self::run_nmcli(&Self::nmcli_args(&[
+            "--terse",
+            "--escape",
+            "yes",
             "-f",
             "DEVICE,TYPE,STATE,CONNECTION",
             "device",
             "status",
-        ])?;
-        let ip_output = Self::run_nmcli(&["-t", "-f", "DEVICE,IP4.ADDRESS", "device", "show"])?;
+        ]))?;
+        let ip_output = Self::run_nmcli(&Self::nmcli_args(&[
+            "--terse",
+            "--escape",
+            "yes",
+            "-f",
+            "DEVICE,IP4.ADDRESS",
+            "device",
+            "show",
+        ]))?;
 
         let mut ip_map: HashMap<String, Vec<String>> = HashMap::new();
         for line in ip_output.lines().filter(|line| !line.trim().is_empty()) {
-            let mut parts = line.splitn(2, ':');
-            let device = parts.next().unwrap_or_default().trim();
-            let address = parts.next().unwrap_or_default().trim();
+            let parts = Self::parse_nmcli_fields(line, 2);
+            let device = parts[0].trim();
+            let address = parts[1].trim();
 
             if device.is_empty() || address.is_empty() {
                 continue;
@@ -178,15 +245,15 @@ impl WifiPlugin {
             .lines()
             .filter(|line| !line.trim().is_empty())
             .map(|line| {
-                let mut parts = line.splitn(4, ':');
-                let device = parts.next().unwrap_or_default().trim().to_string();
+                let parts = Self::parse_nmcli_fields(line, 4);
+                let device = parts[0].trim().to_string();
 
                 DeviceStatus {
                     ip4_addresses: ip_map.remove(&device).unwrap_or_default(),
                     device,
-                    device_type: parts.next().unwrap_or_default().trim().to_string(),
-                    state: parts.next().unwrap_or_default().trim().to_string(),
-                    connection: parts.next().unwrap_or_default().trim().to_string(),
+                    device_type: parts[1].trim().to_string(),
+                    state: parts[2].trim().to_string(),
+                    connection: parts[3].trim().to_string(),
                 }
             })
             .collect::<Vec<_>>();
@@ -199,9 +266,7 @@ impl WifiPlugin {
     }
 
     fn ap_start(&self, ssid: &str, password: &str) -> Result<serde_json::Value> {
-        let output = Self::run_nmcli(&[
-            "device", "wifi", "hotspot", "ssid", ssid, "password", password,
-        ])?;
+        let output = Self::run_nmcli(&Self::build_hotspot_args(ssid, password))?;
 
         Ok(json!({
             "ok": true,
@@ -212,14 +277,23 @@ impl WifiPlugin {
     }
 
     fn ap_stop(&self) -> Result<serde_json::Value> {
-        let active = Self::run_nmcli(&["-t", "-f", "NAME", "connection", "show", "--active"])?;
+        let active = Self::run_nmcli(&Self::nmcli_args(&[
+            "--terse",
+            "--escape",
+            "yes",
+            "-f",
+            "NAME",
+            "connection",
+            "show",
+            "--active",
+        ]))?;
         let hotspot_name = active
             .lines()
             .map(str::trim)
             .find(|name| *name == "hotspot")
             .ok_or_else(|| anyhow!("active hotspot connection 'hotspot' not found"))?;
 
-        let output = Self::run_nmcli(&["connection", "down", hotspot_name])?;
+        let output = Self::run_nmcli(&Self::nmcli_args(&["connection", "down", hotspot_name]))?;
 
         Ok(json!({
             "ok": true,
@@ -276,3 +350,58 @@ impl Plugin for WifiPlugin {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::WifiPlugin;
+
+    #[test]
+    fn parse_nmcli_fields_unescapes_terse_output() {
+        let fields = WifiPlugin::parse_nmcli_fields(r#"Cafe\:Net:78:WPA2\\Enterprise"#, 3);
+
+        assert_eq!(fields, vec!["Cafe:Net", "78", r#"WPA2\Enterprise"#]);
+    }
+
+    #[test]
+    fn parse_nmcli_fields_keeps_colons_in_last_field() {
+        let fields = WifiPlugin::parse_nmcli_fields(r#"wlan0:wifi:connected:Office\:LAN"#, 4);
+
+        assert_eq!(fields, vec!["wlan0", "wifi", "connected", "Office:LAN"]);
+    }
+
+    #[test]
+    fn connect_args_preserve_special_characters() {
+        let args =
+            WifiPlugin::build_connect_args(r#"ssid \"qa\" demo"#, r#"p@ss\\word with spaces"#);
+
+        assert_eq!(
+            args,
+            vec![
+                "device",
+                "wifi",
+                "connect",
+                r#"ssid \"qa\" demo"#,
+                "password",
+                r#"p@ss\\word with spaces"#,
+            ]
+        );
+    }
+
+    #[test]
+    fn hotspot_args_preserve_special_characters() {
+        let args = WifiPlugin::build_hotspot_args("Showen AP", r#"\\quoted pass\\"#);
+
+        assert_eq!(
+            args,
+            vec![
+                "device",
+                "wifi",
+                "hotspot",
+                "ssid",
+                "Showen AP",
+                "password",
+                r#"\\quoted pass\\"#,
+            ]
+        );
+    }
+}