@jingyi0605/codingns4dsh 0.2.0-beta.1 → 0.2.0-rc.2

package/data/build/dist/host/lan-access-dsh.js

@@ -5,7 +5,11 @@ import { createHmac, randomBytes, scryptSync, timingSafeEqual } from 'node:crypt
 import { homedir } from 'node:os';
 import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
+import { normalizeLanAccessDshPwaSettings, DEFAULT_LAN_ACCESS_DSH_PWA_SETTINGS } from '../shared/contracts/config.js';
+import { PWA_ASSET_PREFIX, PWA_MANIFEST_PATH, PWA_SERVICE_WORKER_PATH } from './modules/pwa/index.js';
 import { CodingNsRpcError } from './rpc-table.js';
+import { createLoginAttemptContext, LoginAttemptGuard } from './login-attempt-guard.js';
+import { hostBrowserText, resolveAcceptLanguageLocale, resolveHostPushLocale } from './browser-text.js';
 /**
  * Cookie 不包含端口信息；多个 DSH 实例若共用名称，浏览器会在实例之间覆盖会话。
  * 正式环境保留旧名称，开发环境由启动包装命令显式指定独立名称。
@@ -139,7 +143,9 @@ export class LanAccessDshProxy {
     loginConfig = null;
     /** 当前进程内主动退出的会话；正常会话由签名令牌承载，可跨代理重建复用。 */
     revokedSessions = new Set();
+    loginAttempts = new LoginAttemptGuard();
     upstreamCookie = null;
+    pwaProvider = null;
     constructor(runtime = createNodeLanAccessDshRuntime(), authenticatedUrl, sessionCookieName = resolveLoginProtectionCookieName()) {
         this.runtime = runtime;
         this.authenticatedUrl = authenticatedUrl;
@@ -207,6 +213,7 @@ export class LanAccessDshProxy {
             socket.destroy();
         active.sockets.clear();
         this.revokedSessions.clear();
+        this.loginAttempts.reset();
         await active.close();
     }
     async close() {
@@ -217,9 +224,26 @@ export class LanAccessDshProxy {
     }
     setLoginConfig(config) {
         this.loginConfig = config === null ? null : normalizeLoginConfig(config);
+        this.loginAttempts.reset();
         if (config === null || !config.enabled)
             this.revokedSessions.clear();
     }
+    /** 注入 PWA 资产来源；传 null 表示回到“不提供 PWA 资产”的原始行为。 */
+    setPwaProvider(provider) {
+        this.pwaProvider = provider;
+    }
+    /** PWA 资产就绪状态；只描述代理侧能力，不含浏览器状态与凭据。 */
+    pwaStatus() {
+        const bundle = this.pwaProvider?.snapshot() ?? null;
+        return {
+            listening: this.active?.state === 'listening',
+            manifest: bundle !== null,
+            serviceWorker: bundle?.serviceWorker !== null && bundle?.serviceWorker !== undefined,
+            marker: bundle?.marker ?? null,
+            assetPaths: bundle === null ? [] : [...bundle.assets.keys()],
+            paths: { manifest: PWA_MANIFEST_PATH, serviceWorker: PWA_SERVICE_WORKER_PATH },
+        };
+    }
     loginSettings() {
         const config = this.loginConfig;
         return {
@@ -264,7 +288,7 @@ export class LanAccessDshProxy {
             // pipe 以便验证连接关系。
             if (typeof dshSocket.on === 'function') {
                 const localAddress = isLoopbackSocket(localSocket);
-                const authTransform = new LanAccessDshAuthTransform(localSocket, (request) => this.authorize(request, localAddress));
+                const authTransform = new LanAccessDshAuthTransform(localSocket, (request) => this.authorize(request, localAddress, localSocket));
                 const requestTransform = new LanAccessDshRequestTransform(`127.0.0.1:${active.config.dshPort}`, this.upstreamCookie);
                 localSocket.pipe(authTransform);
                 authTransform.pipe(requestTransform);
@@ -286,8 +310,43 @@ export class LanAccessDshProxy {
             loginEnabled: this.loginConfig?.enabled === true,
         };
     }
-    authorize(request, localAddress) {
+    authorize(request, localAddress, localSocket) {
         const config = this.loginConfig;
+        // 登录页与登录错误按浏览器自己的语言渲染；DSH 只支持 zh/en，其它语言回退中文。
+        const locale = resolveAcceptLanguageLocale(request.headers['accept-language']);
+        const loginContext = createLoginAttemptContext(readRemoteAddress(localSocket), request.headers);
+        // PeerHost 的握手和目标 Host 认证端点必须在建立登录保护会话前可达：
+        // 握手只返回公开能力摘要，auth/login 负责交换目标 Host 自己签发的短期票据。
+        // 其他 API 仍然经过登录保护，不把业务数据面暴露给未登录客户端。
+        if (request.method === 'GET' && request.path === '/api/public/host-handshake')
+            return 'pass';
+        const authResponse = resolvePeerHostAuthResponse(request, config, this.revokedSessions, this.loginAttempts, loginContext);
+        if (authResponse !== undefined)
+            return authResponse;
+        // Host-to-Host 请求不持有浏览器 Cookie，而是由 PeerHost Host 侧注入目标 Host
+        // 签发的 Bearer 票据；只放行固定资源白名单，票据本身必须通过签名校验。
+        if (isPeerHostRouteRequest(request)) {
+            const token = readBearerToken(request.headers.authorization);
+            if (token !== undefined) {
+                return verifyPeerHostAccessToken(config, token, this.revokedSessions)
+                    ? 'pass'
+                    : loginResponse(401, '需要登录');
+            }
+        }
+        // PWA 静态资产先于登录判定：它们只包含公开元数据，未登录时也可取；命中时
+        // 直接合成响应，不进入上游转发路径。
+        const pwaResponse = this.authorizePwa(request);
+        if (pwaResponse !== undefined)
+            return pwaResponse;
+        if (request.path === '/__codingns/captcha' && request.method === 'GET') {
+            const captchaId = readQueryParameter(request.query, 'id');
+            const svg = !localAddress && config !== null && config.enabled && config.scopes.lan && captchaId !== undefined
+                ? this.loginAttempts.renderCaptcha(captchaId, loginContext)
+                : undefined;
+            return svg === undefined
+                ? synthLanResponse({ status: 404, contentType: 'text/plain; charset=utf-8', body: 'Not Found' })
+                : synthLanResponse({ status: 200, contentType: 'image/svg+xml; charset=utf-8', body: svg });
+        }
         if (request.path === '/__codingns/session' && request.method === 'GET') {
             const token = readCookie(request.headers.cookie, this.sessionCookieName);
             const authenticated = !localAddress && config !== null && config.enabled && config.scopes.lan
@@ -313,9 +372,26 @@ export class LanAccessDshProxy {
             return 'pass';
         if (request.path === '/__codingns/login' && request.method === 'POST') {
             const form = new URLSearchParams(new TextDecoder().decode(request.body));
-            if (form.get('username') !== config.username || !verifyPassword(form.get('password') ?? '', config)) {
-                return loginResponse(401, loginPageWithError('用户名或密码错误', form.get('username') ?? ''));
+            const username = form.get('username') ?? '';
+            const captchaId = form.get('captchaId') ?? undefined;
+            const captchaCode = form.get('captchaCode') ?? undefined;
+            const attempt = this.loginAttempts.beforeLogin(loginContext, {
+                ...(captchaId === undefined ? {} : { captchaId }),
+                ...(captchaCode === undefined ? {} : { captchaCode }),
+            });
+            if (!attempt.allowed) {
+                const challenge = this.loginAttempts.requiresCaptcha(loginContext) ? this.loginAttempts.issueCaptcha(loginContext) : undefined;
+                const message = attempt.reason === 'rate_limited'
+                    ? hostBrowserText(locale, 'login.rateLimited', { seconds: attempt.retryAfterSeconds })
+                    : hostBrowserText(locale, 'login.badCaptcha');
+                return loginResponse(429, loginPageWithError(message, username, challenge, locale), { 'Retry-After': String(attempt.retryAfterSeconds) });
             }
+            if (username !== config.username || !verifyPassword(form.get('password') ?? '', config)) {
+                this.loginAttempts.recordFailure(loginContext);
+                const challenge = this.loginAttempts.requiresCaptcha(loginContext) ? this.loginAttempts.issueCaptcha(loginContext) : undefined;
+                return loginResponse(401, loginPageWithError(hostBrowserText(locale, 'login.badCredentials'), username, challenge, locale));
+            }
+            this.loginAttempts.recordSuccess(loginContext);
             const expiresAt = Date.now() + config.timeoutSeconds * 1000;
             const payload = encodeSessionPayload({ username: config.username, scope: 'lan', expiresAt, nonce: randomBytes(16).toString('base64url') });
             const token = `${payload}.${signSessionPayload(payload, config)}`;
@@ -336,9 +412,25 @@ export class LanAccessDshProxy {
         if (token !== undefined && !this.revokedSessions.has(token) && verifySignedSessionToken(token, config, 'lan')) {
             return 'pass';
         }
-        return request.path === '/' || request.path.endsWith('.html')
-            ? loginResponse(200, loginPage())
-            : loginResponse(401, '需要登录');
+        // 只有真正渲染登录页的 HTML 请求才签发验证码。浏览器会为 favicon、图标等
+        // 静态资源发出额外的未登录请求，如果它们也签发验证码，就会不断翻转页面上
+        // 已经渲染的 captchaId，用户永远提交不到与图片一致的答案。
+        if (request.path !== '/' && !request.path.endsWith('.html'))
+            return loginResponse(401, hostBrowserText(locale, 'login.required'));
+        const challenge = this.loginAttempts.requiresCaptcha(loginContext) ? this.loginAttempts.issueCaptcha(loginContext) : undefined;
+        return loginResponse(200, loginPage(challenge, locale));
+    }
+    /**
+     * PWA 白名单：`/manifest.webmanifest`、`/sw.js` 与 `/__codingns/pwa/*`。
+     *
+     * 返回 undefined 表示“不属于 PWA 白名单，或当前未启用”，交回原有登录与转发
+     * 语义；这样关闭增强时行为与改造前完全一致。合成内容只有公开元数据与图标，
+     * 不允许出现任何 Cookie、令牌或宿主路径。
+     */
+    authorizePwa(request) {
+        // manifest 的 description 属于浏览器可见文案，按请求语言选择。
+        const locale = resolveAcceptLanguageLocale(request.headers['accept-language']);
+        return resolveLanAccessDshPwaResponse(request, this.pwaProvider?.snapshot(locale) ?? null);
     }
     /** DSH 启动时的认证 URL 只在 Host 内交换一次 Cookie，绝不下发到浏览器。 */
     async takeOverDshWebToken() {
@@ -351,10 +443,195 @@ export class LanAccessDshProxy {
         this.upstreamCookie = cookie;
     }
 }
+/**
+ * PeerHost 出站请求允许访问的固定路由白名单。
+ *
+ * 票据校验在调用方完成：这里只回答“这条路由是否属于 Host-to-Host 数据面”，
+ * 避免把路径判定和签名校验混在一起，也避免把整个 LAN API 变成公开入口。
+ */
+export function isPeerHostRouteRequest(request) {
+    const routes = [
+        { prefix: '/ws', methods: ['GET'] },
+        { prefix: '/api/codingns/host/status', methods: ['POST'] },
+        { prefix: '/api/codingns/peerHost/nativeLocal', methods: ['POST'] },
+        { prefix: '/api/codingns/peerHost/native', methods: ['POST'] },
+        { prefix: '/api/codingns/peerHost/nativeStream', methods: ['POST'] },
+        { prefix: '/api/codingns/peerHost/nativeStreamOpen', methods: ['POST'] },
+        { prefix: '/api/codingns/peerHost/nativeStreamNext', methods: ['POST'] },
+        { prefix: '/api/codingns/peerHost/nativeStreamClose', methods: ['POST'] },
+        // 远端对话框的适配器、模型、会话绑定和命令目录都通过 CodingNS CLI RPC
+        // 读取；这是 Host-to-Host 数据面，必须与 Host API 代理的白名单保持一致。
+        { prefix: '/api/codingns/cli', methods: ['POST'] },
+        { prefix: '/api/workspaces', methods: ['GET'] },
+        { prefix: '/api/sessions', methods: ['GET', 'POST'] },
+        { prefix: '/api/file-tree', methods: ['GET'] },
+        { prefix: '/api/files', methods: ['GET', 'PUT', 'POST'] },
+        { prefix: '/api/git', methods: ['GET', 'POST'] },
+        { prefix: '/api/terminal', methods: ['GET', 'POST'] },
+        { prefix: '/api/right-tools', methods: ['GET', 'POST'] },
+    ];
+    const route = routes.find((candidate) => request.path === candidate.prefix || request.path.startsWith(`${candidate.prefix}/`));
+    return route !== undefined && route.methods.includes(request.method.toUpperCase());
+}
+/** PeerHost 目标侧认证端点；路径固定，客户端不能自定义目标或凭据格式。 */
+export const PEER_HOST_AUTH_PATHS = {
+    login: '/api/auth/login',
+    refresh: '/api/auth/refresh',
+    logout: '/api/auth/logout',
+};
+/**
+ * PeerHost 目标侧认证裁决。
+ *
+ * 目标 Host 自己签发短期票据，当前 Host 才能在不保存目标密码的前提下代理请求。
+ * 票据复用登录保护的签名材料；登录保护未覆盖局域网范围时返回占位票据，与
+ * “未启用保护即放行”的既有语义保持一致。返回 undefined 表示不是认证端点。
+ */
+export function resolvePeerHostAuthResponse(request, config, revoked, loginAttempts, loginContext) {
+    if (request.method.toUpperCase() !== 'POST')
+        return undefined;
+    if (request.path === PEER_HOST_AUTH_PATHS.login) {
+        const credentials = readJsonBody(request.body);
+        const username = typeof credentials?.username === 'string' ? credentials.username : '';
+        const password = typeof credentials?.password === 'string' ? credentials.password : '';
+        if (!peerHostLoginProtected(config))
+            return loginJsonResponse(200, issueOpenPeerHostCredential());
+        const attempt = loginAttempts?.beforeLogin(loginContext ?? { ipAddress: 'unknown', deviceFingerprint: 'unknown-device' }, { allowCaptcha: false });
+        if (attempt !== undefined && !attempt.allowed) {
+            return loginJsonResponse(429, { error: { code: 'PEER_HOST_LOGIN_RATE_LIMITED', message: '目标 Host 登录尝试过于频繁' } }, { 'Retry-After': String(attempt.retryAfterSeconds) });
+        }
+        if (username === '' || password === '' || username !== config.username || !verifyPassword(password, config)) {
+            if (loginAttempts !== undefined)
+                loginAttempts.recordFailure(loginContext ?? { ipAddress: 'unknown', deviceFingerprint: 'unknown-device' });
+            return loginJsonResponse(401, { error: { code: 'PEER_HOST_SESSION_REQUIRED', message: '目标 Host 用户名或密码错误' } });
+        }
+        if (loginAttempts !== undefined)
+            loginAttempts.recordSuccess(loginContext ?? { ipAddress: 'unknown', deviceFingerprint: 'unknown-device' });
+        return loginJsonResponse(200, issuePeerHostCredential(config));
+    }
+    if (request.path === PEER_HOST_AUTH_PATHS.refresh) {
+        const body = readJsonBody(request.body);
+        const refreshToken = typeof body?.refreshToken === 'string' ? body.refreshToken : '';
+        if (!peerHostLoginProtected(config))
+            return loginJsonResponse(200, issueOpenPeerHostCredential());
+        if (refreshToken === '' || revoked.has(refreshToken) || !verifySignedSessionToken(refreshToken, config, 'lan')) {
+            return loginJsonResponse(401, { error: { code: 'PEER_HOST_SESSION_REQUIRED', message: '目标 Host 登录态已失效' } });
+        }
+        return loginJsonResponse(200, issuePeerHostCredential(config));
+    }
+    if (request.path === PEER_HOST_AUTH_PATHS.logout) {
+        const token = readBearerToken(request.headers.authorization);
+        if (token !== undefined && peerHostLoginProtected(config))
+            revoked.add(token);
+        return loginJsonResponse(200, { ok: true });
+    }
+    return undefined;
+}
+/** 校验 PeerHost 出站票据；登录保护未覆盖局域网范围时保持向后兼容。 */
+export function verifyPeerHostAccessToken(config, token, revoked = new Set()) {
+    if (!peerHostLoginProtected(config))
+        return true;
+    return !revoked.has(token) && verifySignedSessionToken(token, config, 'lan');
+}
+export function readBearerToken(value) {
+    const match = /^Bearer\s+(\S+)$/u.exec(value?.trim() ?? '');
+    return match?.[1];
+}
+function peerHostLoginProtected(config) {
+    return config !== null && config.enabled && config.scopes.lan;
+}
+function issuePeerHostCredential(config) {
+    return {
+        accessToken: issueLoginProtectionSession(config, 'lan').token,
+        refreshToken: issueLoginProtectionSession(config, 'lan').token,
+        expiresIn: config.timeoutSeconds,
+    };
+}
+/** 未启用登录保护时目标不校验票据，这里只保证 Host 侧凭据格式一致。 */
+function issueOpenPeerHostCredential() {
+    return {
+        accessToken: `open.${randomBytes(16).toString('base64url')}`,
+        refreshToken: `open.${randomBytes(16).toString('base64url')}`,
+        expiresIn: 3600,
+    };
+}
+function readJsonBody(body) {
+    try {
+        const value = JSON.parse(new TextDecoder().decode(body));
+        return isRecord(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * PWA 静态资产白名单：`/manifest.webmanifest`、`/sw.js` 与 `/__codingns/pwa/*`。
+ *
+ * 返回 undefined 表示“不属于白名单，或当前未启用”，交回原有登录与转发语义；
+ * 这样关闭增强时行为与改造前完全一致。合成内容只有公开元数据与图标，不允许
+ * 出现任何 Cookie、令牌或宿主路径。
+ */
+export function resolveLanAccessDshPwaResponse(request, bundle) {
+    const path = request.path;
+    const inWhitelist = path === PWA_MANIFEST_PATH || path === PWA_SERVICE_WORKER_PATH || path.startsWith(PWA_ASSET_PREFIX);
+    if (!inWhitelist)
+        return undefined;
+    const headOnly = request.method === 'HEAD';
+    if (request.method !== 'GET' && !headOnly) {
+        return synthLanResponse({
+            status: 405,
+            contentType: 'text/plain; charset=utf-8',
+            body: 'Method Not Allowed',
+            headers: { Allow: 'GET, HEAD' },
+        });
+    }
+    if (bundle === null) {
+        // 未启用：manifest 与 SW 保持原有语义（manifest 透传上游、/sw.js 走登录/上游），
+        // 图标路径没有上游对应物，直接 404 以免落到 SPA 兜底。
+        return path.startsWith(PWA_ASSET_PREFIX)
+            ? synthLanResponse({ status: 404, contentType: 'text/plain; charset=utf-8', body: 'Not Found' })
+            : undefined;
+    }
+    if (path === PWA_MANIFEST_PATH) {
+        return synthLanResponse({
+            status: 200,
+            contentType: 'application/manifest+json; charset=utf-8',
+            body: bundle.manifest,
+            cacheControl: 'public, max-age=300',
+            headOnly,
+        });
+    }
+    if (path === PWA_SERVICE_WORKER_PATH) {
+        if (bundle.serviceWorker === null)
+            return undefined;
+        return synthLanResponse({
+            status: 200,
+            contentType: 'text/javascript; charset=utf-8',
+            body: bundle.serviceWorker,
+            // SW 脚本必须每次回源校验：插件升级后要能立刻安装新版本。
+            cacheControl: 'no-cache',
+            headOnly,
+        });
+    }
+    const asset = bundle.assets.get(path);
+    if (asset === undefined) {
+        return synthLanResponse({ status: 404, contentType: 'text/plain; charset=utf-8', body: 'Not Found' });
+    }
+    return synthLanResponse({
+        status: 200,
+        contentType: asset.contentType,
+        body: asset.body,
+        cacheControl: asset.cacheControl,
+        headOnly,
+    });
+}
 function isLoopbackSocket(socket) {
     const remoteAddress = socket.remoteAddress;
     return remoteAddress === '127.0.0.1' || remoteAddress === '::1' || remoteAddress === '::ffff:127.0.0.1';
 }
+function readRemoteAddress(socket) {
+    const remoteAddress = socket.remoteAddress;
+    return typeof remoteAddress === 'string' ? remoteAddress : undefined;
+}
 /** 在 TCP 转发前完成登录校验；未通过时直接向局域网客户端返回页面/错误。 */
 class LanAccessDshAuthTransform extends Transform {
     client;
@@ -388,9 +665,12 @@ class LanAccessDshAuthTransform extends Transform {
         }
         const requestLine = decodeLatin1(head).split('\r\n', 1)[0] ?? '';
         const parts = requestLine.split(' ');
+        const target = parts[1] ?? '/';
+        const querySeparator = target.indexOf('?');
         const request = {
             method: parts[0] ?? 'GET',
-            path: (parts[1] ?? '/').split('?', 1)[0] ?? '/',
+            path: querySeparator < 0 ? target : target.slice(0, querySeparator),
+            ...(querySeparator < 0 ? {} : { query: target.slice(querySeparator + 1) }),
             headers,
             body: this.pending.subarray(end + 4, end + 4 + bodyLength),
         };
@@ -431,6 +711,17 @@ function readCookie(value, name) {
     }
     return undefined;
 }
+function readQueryParameter(query, name) {
+    if (query === undefined)
+        return undefined;
+    try {
+        const value = new URLSearchParams(query).get(name)?.trim();
+        return value === undefined || value === '' ? undefined : value;
+    }
+    catch {
+        return undefined;
+    }
+}
 function sessionCookie(name, token, timeoutSeconds) {
     return `${name}=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${timeoutSeconds}`;
 }
@@ -447,6 +738,21 @@ function getSetCookie(headers) {
     const values = extended.getSetCookie?.() ?? (headers.get('set-cookie') === null ? [] : [headers.get('set-cookie')]);
     return values.map((value) => value.split(';', 1)[0]).find((value) => value !== '');
 }
+export function synthLanResponse(input) {
+    const body = typeof input.body === 'string'
+        ? new TextEncoder().encode(input.body)
+        : input.body ?? new Uint8Array(0);
+    const headers = {
+        'Content-Type': input.contentType,
+        'Content-Length': String(body.length),
+        'Cache-Control': input.cacheControl ?? 'no-store',
+        'X-Content-Type-Options': 'nosniff',
+        Connection: 'close',
+        ...input.headers,
+    };
+    const head = encodeLatin1(`HTTP/1.1 ${input.status} ${statusText(input.status)}\r\n${Object.entries(headers).map(([key, value]) => `${key}: ${value}`).join('\r\n')}\r\n\r\n`);
+    return input.headOnly === true ? head : concatBytes(head, body);
+}
 function loginResponse(status, body, extra = {}) {
     const isHtml = body.startsWith('<!doctype html>');
     const isJson = extra['Content-Type']?.startsWith('application/json') === true;
@@ -457,7 +763,7 @@ function loginResponse(status, body, extra = {}) {
         'Cache-Control': 'no-store',
         'X-Content-Type-Options': 'nosniff',
         'X-Frame-Options': 'DENY',
-        'Content-Security-Policy': "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'",
+        'Content-Security-Policy': "default-src 'none'; img-src 'self'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'",
         'Referrer-Policy': 'no-referrer',
         Connection: 'close',
         ...extra,
@@ -468,22 +774,39 @@ function loginResponse(status, body, extra = {}) {
 function loginJsonResponse(status, value, extra = {}) {
     return loginResponse(status, JSON.stringify(value), { 'Content-Type': 'application/json; charset=utf-8', ...extra });
 }
-function loginPage() {
+function loginPage(captcha, locale) {
+    const captchaFields = captcha === undefined ? '' : `<input type="hidden" name="captchaId" value="${escapeHtml(captcha.id)}"><div class="cyber-captcha" style="display:flex;flex-direction:row;align-items:center;gap:12px;width:100%;"><img src="/__codingns/captcha?id=${encodeURIComponent(captcha.id)}" width="140" height="52" alt="${escapeHtml(hostBrowserText(locale, 'login.captchaAlt'))}" style="display:block;flex:0 0 140px;width:140px;height:52px;border:1px solid rgba(59,130,246,.5);border-radius:7px;background:rgba(15,23,42,.68);"><input class="cyber-input" name="captchaCode" autocomplete="off" inputmode="text" maxlength="5" placeholder="${escapeHtml(hostBrowserText(locale, 'login.captchaPlaceholder'))}" required style="flex:1 1 auto;min-width:0;width:auto;height:52px;padding:12px 14px;border:1px solid rgba(59,130,246,.5);border-radius:8px;background:rgba(15,23,42,.68);box-shadow:inset 0 0 8px rgba(59,130,246,.12);color:#f1f5f9;font:14px var(--font-mono);outline:0;"></div>`;
     // 视觉规则直接复用 codingns4dsh-h5/styles.css 的 Cyber 登录区，只把 Connect
     // 账号字段替换成本地用户名/密码；不能依赖外部 CSS，避免局域网入口离线时失效。
-    return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>DSH Web | 本地登录</title><style>
-:root{font-family:"SFMono-Regular",Consolas,"Liberation Mono",Menlo,monospace;color:#f1f5f9;background:#0a0f1d}*{box-sizing:border-box}html,body{width:100%;height:100%;margin:0}body{overflow:hidden}.cyber-login-page{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;overflow:hidden;background:radial-gradient(ellipse at center,#0f172a 0%,#0a0f1d 100%);color:#f1f5f9}.cyber-login-page:before{content:"";position:absolute;inset:0;background-image:linear-gradient(rgba(59,130,246,.08) 1px,transparent 1px),linear-gradient(90deg,rgba(59,130,246,.08) 1px,transparent 1px);background-size:50px 50px;transform:perspective(500px) rotateX(60deg);transform-origin:center top}.cyber-login-page:after{content:"";position:absolute;inset:0;pointer-events:none;background:repeating-linear-gradient(0deg,transparent,transparent 2px,rgba(0,0,0,.15) 2px,rgba(0,0,0,.15) 4px)}.cyber-login-container{position:relative;z-index:2;display:flex;flex-direction:column;align-items:center;gap:30px;width:min(440px,calc(100% - 32px));padding:24px}.cyber-login-content{display:flex;flex-direction:column;align-items:center;gap:28px;width:100%}.cyber-brand{display:flex;flex-direction:column;align-items:center;gap:13px;text-align:center}.cyber-logo{display:grid;place-items:center;width:80px;height:80px;border:1px solid rgba(59,130,246,.48);border-radius:22px;color:#60a5fa;font-size:19px;font-weight:700;letter-spacing:2px;box-shadow:0 0 25px rgba(0,212,255,.35),inset 0 0 22px rgba(59,130,246,.18);transform:rotate(30deg)}.cyber-logo span{transform:rotate(-30deg)}.cyber-brand-title{margin:0;color:#f1f5f9;font-size:28px;font-weight:700;letter-spacing:4px}.cyber-brand-subtitle{margin:0;color:#94a3b8;font-size:12px;letter-spacing:1.5px}.cyber-card{width:100%;padding:30px;border:1px solid rgba(59,130,246,.28);border-radius:12px;background:rgba(30,41,59,.78);backdrop-filter:blur(10px);box-shadow:0 8px 32px rgba(0,0,0,.4),0 0 0 1px rgba(59,130,246,.28)}.cyber-card-header{display:flex;align-items:center;gap:12px;margin-bottom:22px}.cyber-line{flex:1;height:1px;background:linear-gradient(90deg,transparent,rgba(59,130,246,.48),transparent)}.cyber-card-label{color:#94a3b8;font-size:11px;font-weight:600;letter-spacing:3px;white-space:nowrap}.cyber-form{display:flex;flex-direction:column;gap:18px}.cyber-connect-hint{margin:0;color:#94a3b8;font-size:12px;line-height:1.7}.cyber-field{position:relative;padding:12px 16px;border:1px solid rgba(59,130,246,.28);border-radius:8px;background:rgba(15,23,42,.68)}.cyber-field-label{display:flex;align-items:center;gap:8px;margin-bottom:8px;color:#94a3b8;font-size:11px;letter-spacing:1px}.cyber-field-icon{color:#60a5fa}.cyber-input{width:100%;padding:0;border:0;outline:0;background:transparent;color:#f1f5f9;font:14px var(--font-mono)}.cyber-input::placeholder{color:#94a3b8;opacity:.55}.cyber-submit{position:relative;width:100%;min-height:48px;margin-top:4px;padding:14px 24px;overflow:hidden;border:0;border-radius:8px;background:linear-gradient(135deg,#3b82f6,#06b6d4);color:white;font:600 13px var(--font-mono);letter-spacing:2px;cursor:pointer;box-shadow:0 0 18px rgba(59,130,246,.32)}.cyber-submit:hover{filter:brightness(1.12)}.cyber-submit:active{transform:translateY(1px)}.cyber-submit:disabled{cursor:wait;opacity:.6}.cyber-submit-text{position:relative;display:flex;align-items:center;justify-content:center;gap:8px}.cyber-status{display:flex;align-items:center;gap:8px;margin:0;padding:10px 12px;border:1px solid rgba(239,68,68,.25);border-radius:6px;background:rgba(239,68,68,.1);color:#fca5a5;font-size:12px;line-height:1.5}.cyber-footer{margin-top:2px}.cyber-divider{display:flex;align-items:center;gap:12px;margin-bottom:14px}.cyber-divider-line{flex:1;height:1px;background:linear-gradient(90deg,transparent,rgba(59,130,246,.48),transparent)}.cyber-divider-text{color:#64748b;font-size:10px;letter-spacing:2px}.cyber-version{display:flex;align-items:center;gap:12px;color:#64748b;font-size:10px;letter-spacing:2px;opacity:.65}@media(prefers-color-scheme:light){.cyber-login-page{color:#0f172a;background:radial-gradient(ellipse at center,#f8fafc 0%,#eef4fb 100%)}.cyber-card{background:rgba(255,255,255,.86);box-shadow:0 8px 28px rgba(15,23,42,.12),0 0 0 1px rgba(37,99,235,.13)}.cyber-brand-title{color:#0f172a}.cyber-input{color:#0f172a}.cyber-connect-hint,.cyber-field-label,.cyber-card-label{color:#64748b}.cyber-field{background:rgba(241,245,249,.86)}}@media(max-width:520px){.cyber-login-container{width:100%;padding:20px 16px}.cyber-card{padding:24px 20px}.cyber-brand-subtitle{font-size:10px;letter-spacing:1px}}
-</style></head><body><main class="cyber-login-page"><div class="cyber-login-container"><div class="cyber-login-content"><div class="cyber-brand"><div class="cyber-logo"><span>DSH</span></div><h1 class="cyber-brand-title">DSH Web</h1><p class="cyber-brand-subtitle">LOCAL SECURE DSH ENVIRONMENT</p></div><div class="cyber-card"><form class="cyber-form" method="post" action="/__codingns/login"><div class="cyber-card-header"><div class="cyber-line"></div><span class="cyber-card-label">LOCAL ACCESS</span><div class="cyber-line"></div></div><p class="cyber-connect-hint">使用本机设置的本地账号进入 DSH Web。</p><div class="cyber-field"><label class="cyber-field-label" for="login-username"><span class="cyber-field-icon" aria-hidden="true">⌁</span>用户名</label><input class="cyber-input" id="login-username" name="username" autocomplete="username" placeholder="输入本地用户名" required></div><div class="cyber-field"><label class="cyber-field-label" for="login-password"><span class="cyber-field-icon" aria-hidden="true">⚷</span>密码</label><input class="cyber-input" id="login-password" name="password" type="password" autocomplete="current-password" placeholder="输入本地密码" required></div><button class="cyber-submit" type="submit"><span class="cyber-submit-text"><span aria-hidden="true">➤</span>登录 DSH Web</span></button><div class="cyber-footer"><div class="cyber-divider"><span class="cyber-divider-line"></span><span class="cyber-divider-text">CODINGNS</span><span class="cyber-divider-line"></span></div></div></form></div></div><div class="cyber-version"><span>CODINGNS4DSH</span><span>|</span><span>LOCAL AUTH READY</span></div></div></main></body></html>`;
+    return `<!doctype html><html lang="${locale === 'zh' ? 'zh-CN' : 'en'}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover"><meta name="theme-color" content="#0a0f1d"><meta name="mobile-web-app-capable" content="yes"><meta name="apple-mobile-web-app-capable" content="yes"><meta name="apple-mobile-web-app-status-bar-style" content="black-translucent"><link rel="apple-touch-icon" sizes="180x180" href="/__codingns/pwa/apple-touch-icon.png"><title>${escapeHtml(hostBrowserText(locale, 'login.documentTitle'))}</title><style>
+:root{font-family:"SFMono-Regular",Consolas,"Liberation Mono",Menlo,monospace;color:#f1f5f9;background:#0a0f1d}*{box-sizing:border-box}html,body{width:100%;height:100%;margin:0}body{overflow:hidden}.cyber-login-page{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;overflow:hidden;background:radial-gradient(ellipse at center,#0f172a 0%,#0a0f1d 100%);color:#f1f5f9}.cyber-login-page:before{content:"";position:absolute;inset:0;background-image:linear-gradient(rgba(59,130,246,.08) 1px,transparent 1px),linear-gradient(90deg,rgba(59,130,246,.08) 1px,transparent 1px);background-size:50px 50px;transform:perspective(500px) rotateX(60deg);transform-origin:center top}.cyber-login-page:after{content:"";position:absolute;inset:0;pointer-events:none;background:repeating-linear-gradient(0deg,transparent,transparent 2px,rgba(0,0,0,.15) 2px,rgba(0,0,0,.15) 4px)}.cyber-login-container{position:relative;z-index:2;display:flex;flex-direction:column;align-items:center;gap:30px;width:min(440px,calc(100% - 32px));padding:calc(24px + env(safe-area-inset-top,0px)) calc(24px + env(safe-area-inset-right,0px)) calc(24px + env(safe-area-inset-bottom,0px)) calc(24px + env(safe-area-inset-left,0px))}.cyber-login-content{display:flex;flex-direction:column;align-items:center;gap:28px;width:100%}.cyber-brand{display:flex;flex-direction:column;align-items:center;gap:13px;text-align:center}.cyber-logo{display:grid;place-items:center;width:80px;height:80px;border:1px solid rgba(59,130,246,.48);border-radius:22px;color:#60a5fa;font-size:19px;font-weight:700;letter-spacing:2px;box-shadow:0 0 25px rgba(0,212,255,.35),inset 0 0 22px rgba(59,130,246,.18);transform:rotate(30deg)}.cyber-logo span{transform:rotate(-30deg)}.cyber-brand-title{margin:0;color:#f1f5f9;font-size:28px;font-weight:700;letter-spacing:4px}.cyber-brand-subtitle{margin:0;color:#94a3b8;font-size:12px;letter-spacing:1.5px}.cyber-card{width:100%;padding:30px;border:1px solid rgba(59,130,246,.28);border-radius:12px;background:rgba(30,41,59,.78);backdrop-filter:blur(10px);box-shadow:0 8px 32px rgba(0,0,0,.4),0 0 0 1px rgba(59,130,246,.28)}.cyber-card-header{display:flex;align-items:center;gap:12px;margin-bottom:22px}.cyber-line{flex:1;height:1px;background:linear-gradient(90deg,transparent,rgba(59,130,246,.48),transparent)}.cyber-card-label{color:#94a3b8;font-size:11px;font-weight:600;letter-spacing:3px;white-space:nowrap}.cyber-form{display:flex;flex-direction:column;gap:18px}.cyber-connect-hint{margin:0;color:#94a3b8;font-size:12px;line-height:1.7}.cyber-field{position:relative;padding:12px 16px;border:1px solid rgba(59,130,246,.28);border-radius:8px;background:rgba(15,23,42,.68)}.cyber-field-label{display:flex;align-items:center;gap:8px;margin-bottom:8px;color:#94a3b8;font-size:11px;letter-spacing:1px}.cyber-field-icon{color:#60a5fa}.cyber-input{width:100%;padding:0;border:0;outline:0;background:transparent;color:#f1f5f9;font:14px var(--font-mono)}.cyber-input::placeholder{color:#94a3b8;opacity:.55}.cyber-captcha{display:flex;align-items:center;gap:12px}.cyber-captcha img{display:block;flex:0 0 140px;width:140px;height:52px;border:1px solid rgba(59,130,246,.28);border-radius:7px}.cyber-captcha .cyber-input{flex:1;min-width:0;width:auto;padding:12px;border:1px solid rgba(59,130,246,.28);border-radius:8px;background:rgba(15,23,42,.68)}.cyber-submit{position:relative;width:100%;min-height:48px;margin-top:4px;padding:14px 24px;overflow:hidden;border:0;border-radius:8px;background:linear-gradient(135deg,#3b82f6,#06b6d4);color:white;font:600 13px var(--font-mono);letter-spacing:2px;cursor:pointer;box-shadow:0 0 18px rgba(59,130,246,.32)}.cyber-submit:hover{filter:brightness(1.12)}.cyber-submit:active{transform:translateY(1px)}.cyber-submit:disabled{cursor:wait;opacity:.6}.cyber-submit-text{position:relative;display:flex;align-items:center;justify-content:center;gap:8px}.cyber-status{display:flex;align-items:center;gap:8px;margin:0;padding:10px 12px;border:1px solid rgba(239,68,68,.25);border-radius:6px;background:rgba(239,68,68,.1);color:#fca5a5;font-size:12px;line-height:1.5}.cyber-footer{margin-top:2px}.cyber-divider{display:flex;align-items:center;gap:12px;margin-bottom:14px}.cyber-divider-line{flex:1;height:1px;background:linear-gradient(90deg,transparent,rgba(59,130,246,.48),transparent)}.cyber-divider-text{color:#64748b;font-size:10px;letter-spacing:2px}.cyber-version{display:flex;align-items:center;gap:12px;color:#64748b;font-size:10px;letter-spacing:2px;opacity:.65}@media(prefers-color-scheme:light){.cyber-login-page{color:#0f172a;background:radial-gradient(ellipse at center,#f8fafc 0%,#eef4fb 100%)}.cyber-card{background:rgba(255,255,255,.86);box-shadow:0 8px 28px rgba(15,23,42,.12),0 0 0 1px rgba(37,99,235,.13)}.cyber-brand-title{color:#0f172a}.cyber-input{color:#0f172a}.cyber-connect-hint,.cyber-field-label,.cyber-card-label{color:#64748b}.cyber-field{background:rgba(241,245,249,.86)}}@media(max-width:520px){.cyber-login-container{width:100%;padding:calc(20px + env(safe-area-inset-top,0px)) calc(16px + env(safe-area-inset-right,0px)) calc(20px + env(safe-area-inset-bottom,0px)) calc(16px + env(safe-area-inset-left,0px))}.cyber-card{padding:24px 20px}.cyber-brand-subtitle{font-size:10px;letter-spacing:1px}}
+</style></head><body><main class="cyber-login-page"><div class="cyber-login-container"><div class="cyber-login-content"><div class="cyber-brand"><div class="cyber-logo"><span>DSH</span></div><h1 class="cyber-brand-title">DSH Web</h1><p class="cyber-brand-subtitle">LOCAL SECURE DSH ENVIRONMENT</p></div><div class="cyber-card"><form class="cyber-form" method="post" action="/__codingns/login"><div class="cyber-card-header"><div class="cyber-line"></div><span class="cyber-card-label">LOCAL ACCESS</span><div class="cyber-line"></div></div><p class="cyber-connect-hint">${escapeHtml(hostBrowserText(locale, 'login.description'))}</p><div class="cyber-field"><label class="cyber-field-label" for="login-username"><span class="cyber-field-icon" aria-hidden="true">⌁</span>${escapeHtml(hostBrowserText(locale, 'login.username'))}</label><input class="cyber-input" id="login-username" name="username" autocomplete="username" placeholder="${escapeHtml(hostBrowserText(locale, 'login.usernamePlaceholder'))}" required></div><div class="cyber-field"><label class="cyber-field-label" for="login-password"><span class="cyber-field-icon" aria-hidden="true">⚷</span>${escapeHtml(hostBrowserText(locale, 'login.password'))}</label><input class="cyber-input" id="login-password" name="password" type="password" autocomplete="current-password" placeholder="${escapeHtml(hostBrowserText(locale, 'login.passwordPlaceholder'))}" required></div>${captchaFields}<button class="cyber-submit" type="submit"><span class="cyber-submit-text"><span aria-hidden="true">➤</span>${escapeHtml(hostBrowserText(locale, 'login.submit'))}</span></button><div class="cyber-footer"><div class="cyber-divider"><span class="cyber-divider-line"></span><span class="cyber-divider-text">CODINGNS</span><span class="cyber-divider-line"></span></div></div></form></div></div><div class="cyber-version"><span>CODINGNS4DSH</span><span>|</span><span>LOCAL AUTH READY</span></div></div></main></body></html>`;
 }
 /** 登录失败时继续渲染完整登录页，避免浏览器落到无样式的纯文本错误页。 */
-function loginPageWithError(message, username) {
-    const page = loginPage();
+function loginPageWithError(message, username, captcha, locale) {
+    const page = loginPage(captcha, locale);
     const status = `<p class="cyber-status" role="alert" aria-live="polite"><span aria-hidden="true">!</span>${escapeHtml(message)}</p>`;
     return page
         .replace('<p class="cyber-connect-hint">', `${status}<p class="cyber-connect-hint">`)
         .replace('name="username" autocomplete="username"', `name="username" autocomplete="username" value="${escapeHtml(username)}"`);
 }
-function statusText(status) { return status === 200 ? 'OK' : status === 303 ? 'See Other' : status === 401 ? 'Unauthorized' : 'Request Error'; }
+function statusText(status) {
+    switch (status) {
+        case 200: return 'OK';
+        case 204: return 'No Content';
+        case 301: return 'Moved Permanently';
+        case 302: return 'Found';
+        case 303: return 'See Other';
+        case 400: return 'Bad Request';
+        case 401: return 'Unauthorized';
+        case 404: return 'Not Found';
+        case 405: return 'Method Not Allowed';
+        case 429: return 'Too Many Requests';
+        case 431: return 'Request Header Fields Too Large';
+        case 500: return 'Internal Server Error';
+        default: return 'Request Error';
+    }
+}
 function escapeHtml(value) { return value.replace(/[&<>"']/g, (char) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[char] ?? char); }
 /**
  * 将局域网入口发往上游 DSH 的 HTTP 请求头改成上游自身的 authority。
@@ -712,7 +1035,12 @@ export function normalizeLanAccessDshConfig(value, allowedListenHosts) {
         ...(value.login === undefined ? {} : { login: normalizeLoginConfig(value.login) }),
     };
 }
-export function createLanAccessDshRpcHandler(proxy, settings, loginStore = new FileLanAccessDshLoginStore()) {
+export function createLanAccessDshRpcHandler(proxy, settings, loginStore = new FileLanAccessDshLoginStore(), options = {}) {
+    const requirePush = () => {
+        if (options.push === undefined)
+            throw new CodingNsRpcError('CODINGNS_PWA_PUSH_UNAVAILABLE', '推送服务未启用');
+        return options.push;
+    };
     return async (action, payload) => {
         switch (action) {
             case 'addresses':
@@ -726,12 +1054,45 @@ export function createLanAccessDshRpcHandler(proxy, settings, loginStore = new F
             case 'settings/set': {
                 if (settings === undefined)
                     throw new CodingNsRpcError('CODINGNS_SETTINGS_UNAVAILABLE', 'Codingns4DSH 设置服务不可用');
-                const next = parseLanAccessDshSettings(payload, proxy.listenHosts());
+                const next = parseLanAccessDshSettings(payload, proxy.listenHosts(), settings.get().lanAccessDsh.pwa);
                 await settings.update({ lanAccessDsh: next });
                 return settings.get().lanAccessDsh;
             }
             case 'login/get':
                 return proxy.loginSettings();
+            case 'pwa/status':
+                return proxy.pwaStatus();
+            case 'pwa/vapid': {
+                const push = requirePush();
+                return { available: true, publicKey: (await push.vapidKeys()).publicKey };
+            }
+            case 'pwa/push/status': {
+                if (options.push === undefined)
+                    return { available: false, subscriptions: 0 };
+                const subscriptions = await options.push.listSubscriptions();
+                return { available: true, subscriptions: subscriptions.length };
+            }
+            case 'pwa/push/subscribe': {
+                const push = requirePush();
+                const input = parsePushSubscribePayload(payload);
+                const record = await push.subscribe(input, readPushLabel(payload));
+                return { endpoint: record.endpoint, createdAt: record.createdAt, subscriptions: (await push.listSubscriptions()).length };
+            }
+            case 'pwa/push/unsubscribe': {
+                const push = requirePush();
+                const endpoint = readPushEndpoint(payload);
+                return { removed: await push.unsubscribe(endpoint) };
+            }
+            case 'pwa/push/test': {
+                const push = requirePush();
+                const locale = options.resolveLocale?.() ?? 'zh';
+                const summary = await push.sendToAll({
+                    title: hostBrowserText(locale, 'push.testTitle'),
+                    body: hostBrowserText(locale, 'push.testBody'),
+                    tag: 'codingns4dsh-test',
+                });
+                return summary;
+            }
             case 'login/set': {
                 const current = await loginStore.read();
                 const next = parseLoginSettings(payload, current);
@@ -791,7 +1152,7 @@ function parseLoginSessionRefreshPayload(value) {
     return { token, scope };
 }
 function defaultLanAccessDshSettings() {
-    return { autoStart: false, listenHost: '0.0.0.0', listenPort: 13080, dshPort: 0 };
+    return { autoStart: false, listenHost: '0.0.0.0', listenPort: 13080, dshPort: 0, pwa: { ...DEFAULT_LAN_ACCESS_DSH_PWA_SETTINGS } };
 }
 function parseLoginSettings(value, current) {
     if (!value || typeof value !== 'object')
@@ -805,13 +1166,28 @@ function parseLoginSettings(value, current) {
     const timeoutSeconds = requireInteger(input.timeoutSeconds, '超时时间', 60, 604800);
     const scopes = parseLoginScopes(input.scopes ?? current?.scopes);
     const password = typeof input.password === 'string' ? input.password : '';
-    if (password === '' && current === null)
-        throw new LanAccessDshError('LAN_ACCESS_DSH_INVALID', '启用登录保护时必须设置密码');
-    if (password !== '' && (password.length < 8 || password.length > 256))
+    if (password === '') {
+        if (current === null)
+            throw new LanAccessDshError('LAN_ACCESS_DSH_INVALID', '启用登录保护时必须设置密码');
+        return { enabled: true, username, passwordHash: current.passwordHash, passwordSalt: current.passwordSalt, timeoutSeconds, scopes };
+    }
+    return createLoginProtectionConfig({ username, password, timeoutSeconds, scopes });
+}
+/** 由明文密码生成登录保护配置；只在设置写入与测试夹具中使用，不回显密码。 */
+export function createLoginProtectionConfig(input) {
+    const username = requireLoginText(input.username, '用户名', 1, 128);
+    const timeoutSeconds = requireInteger(input.timeoutSeconds, '超时时间', 60, 604800);
+    if (input.password.length < 8 || input.password.length > 256)
         throw new LanAccessDshError('LAN_ACCESS_DSH_INVALID', '密码长度必须是 8 到 256 个字符');
-    const passwordSalt = password === '' ? current.passwordSalt : randomBytes(16).toString('hex');
-    const passwordHash = password === '' ? current.passwordHash : hashPassword(password, passwordSalt);
-    return { enabled: true, username, passwordHash, passwordSalt, timeoutSeconds, scopes };
+    const passwordSalt = randomBytes(16).toString('hex');
+    return {
+        enabled: true,
+        username,
+        passwordHash: hashPassword(input.password, passwordSalt),
+        passwordSalt,
+        timeoutSeconds,
+        scopes: parseLoginScopes(input.scopes),
+    };
 }
 function normalizeLoginConfig(value) {
     if (typeof value !== 'object' || value === null)
@@ -900,8 +1276,36 @@ function parseLoginScopes(value) {
     return { lan: input.lan, relay: input.relay };
 }
 function isNodeError(error, code) { return typeof error === 'object' && error !== null && 'code' in error && error.code === code; }
+/** 推送订阅只接受 endpoint + 两个密钥，其余字段忽略；非法输入给出稳定错误码。 */
+function parsePushSubscribePayload(value) {
+    if (!isRecord(value))
+        throw new CodingNsRpcError('CODINGNS_PWA_PUSH_INVALID', '推送订阅参数无效');
+    const keys = value.keys;
+    if (typeof value.endpoint !== 'string' || !isRecord(keys) || typeof keys.p256dh !== 'string' || typeof keys.auth !== 'string') {
+        throw new CodingNsRpcError('CODINGNS_PWA_PUSH_INVALID', '推送订阅参数无效');
+    }
+    return { endpoint: value.endpoint, keys: { p256dh: keys.p256dh, auth: keys.auth } };
+}
+function readPushLabel(value) {
+    if (!isRecord(value))
+        return '';
+    return typeof value.label === 'string' ? value.label : '';
+}
+function readPushEndpoint(value) {
+    if (!isRecord(value) || typeof value.endpoint !== 'string' || value.endpoint === '') {
+        throw new CodingNsRpcError('CODINGNS_PWA_PUSH_INVALID', '推送订阅 endpoint 无效');
+    }
+    return value.endpoint;
+}
 function isRecord(value) { return typeof value === 'object' && value !== null && !Array.isArray(value); }
-function parseLanAccessDshSettings(value, allowedListenHosts) {
+/**
+ * 解析监听映射设置。
+ *
+ * PWA 设置已经移到「移动端访问增强」卡片，它的写入走设置 RPC 的 `lanAccessDsh.pwa` 路径；
+ * 这里在请求未携带 `pwa` 时沿用当前值，避免用户在局域网卡片里只改监听端口就把手机端
+ * 资产配置重置成默认档位。显式传入 `pwa` 时仍然走归一化。
+ */
+function parseLanAccessDshSettings(value, allowedListenHosts, currentPwa = null) {
     if (!value || typeof value !== 'object')
         throw new LanAccessDshError('LAN_ACCESS_DSH_INVALID', '局域网访问 DSH 设置必须是对象');
     const input = value;
@@ -912,7 +1316,14 @@ function parseLanAccessDshSettings(value, allowedListenHosts) {
     const dshPort = requirePort(input.dshPort, 'dshPort', true);
     if (!new Set(allowedListenHosts).has(listenHost))
         throw new LanAccessDshError('LAN_ACCESS_DSH_INVALID', '监听地址必须来自本机网卡或 0.0.0.0');
-    return { autoStart: input.autoStart, listenHost, listenPort, dshPort };
+    const pwa = input.pwa === undefined && currentPwa !== null
+        ? currentPwa
+        : parseLanAccessDshPwaSettings(input.pwa);
+    return { autoStart: input.autoStart, listenHost, listenPort, dshPort, pwa };
+}
+/** PWA 档位走归一化而非严格校验：非法值收敛到保守默认，避免设置页写不进去。 */
+function parseLanAccessDshPwaSettings(value) {
+    return normalizeLanAccessDshPwaSettings(value);
 }
 function parseStartPayload(value) {
     if (!value || typeof value !== 'object')