@qzsy/dsh-bridge 3.0.1 → 3.1.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # 更新日志
 
+## [v3.0.2] - 2026-11-01
+
+### 🐛 修复
+
+- 兼容部分 DSH 版本 connection 服务注册 RPC 通道时的 `webServer without inject` 异常（lib/rpc-compat.js）；此前通道注册失败会让面板所有操作返回 HTTP 405。
+
 ## [v3.0.1] - 2026-11-01
 
 ### 🔒 安全
@@ -7,6 +13,23 @@
 - 改/清访问口令时轮换会话密钥，旧远程会话立即失效。
 - 门禁登录限流：同一 IP 连续 5 次失败锁定 60 秒（锁定期内正确口令也返回 429）。
 
+## [v3.1.0] - 2026-11-01
+
+> 无感登录授权与扫码进入：点「立即登录授权」→ 浏览器授权 → 面板自动绑定并出现二维码，全程不输入设备码、不设本地口令。
+
+### ✨ 新增
+
+- **startLogin RPC + 面板按钮**：自动调用设备码接口，返回 `/device/authorize?code=...` 并打开系统浏览器；后台沿用 pairing 轮询，授权后自动 claim、自动开启隧道。
+- **扫码进入**：二维码内容改为 `<控制面>/open/<publicId>`（不再使用网关地址或本地 `?auth=` 令牌）；面板可一键显示/收起二维码。
+- **网关信任头 `x-qzsy-gate`**：格式 `ts.uid.hmac`，HMAC-SHA256、±60 秒；验签通过即认证，隧道来源未验签一律 401，不再要求本地口令。
+- **每连接 gate.secret**：hello-ack 携带 `gate.secret`（32 字节 hex），断线/drain/终态立即清空；转发 DSH 前剥离 `x-qzsy-gate` 与隧道标记。
+- **无感绑定不要求口令**：startTunnel/自动启动移除口令前置；本地口令保留为「高级」可选局域网能力。
+
+### ✅ 验证
+
+- 单测覆盖 gate 验签（合法/过期/篡改/伪造/无密钥/剥离）、startLogin 全流程（模拟控制面）、gate.secret 生命周期、`/open/<publicId>` 二维码。
+- 全量单测、网关 e2e、插件级 e2e 保持全绿。
+
 ## [v3.0.0] - 2026-11-01
 
 > DSH 远程隧道云官方客户端插件的**首个独立实现版本**。包内所有代码均为本仓库自研，不包含或依赖任何第三方 dsh-bridge 代码。

package/README.md

@@ -18,18 +18,20 @@ dsh plugin --profile <name> add @qzsy/dsh-bridge
 
 ## 绑定设备（接入 DSH 远程隧道云）
 
-0. **首次使用**：在面板设置访问口令（远程访客的门禁凭据）。
+无感授权流程（推荐，全程不需要输入设备码、也不需要设本地口令）：
+
 1. 面板中确认 **SaaS 网关地址**：官方云为
    `wss://dsh.b.nps.qzsyzn.com/_gw/connect`（自建部署填自己的网关地址），点「保存网关」。
-2. 点「获取设备码」，面板显示 8 位设备码（10 分钟内有效）。
-3. 打开 [DSH 远程隧道云控制台](https://dsh.b.nps.qzsyzn.com/user/tunnels) →「添加设备」，
-   输入设备码并确认。
-4. 面板会自动轮询并在批准后领取设备密钥；显示「已绑定」后点「开启隧道」。
-5. 公网地址出现后，可一键复制子域地址 / 路径地址，或扫码打开。
+2. 点「**立即登录授权**」：插件自动申请设备码并在系统浏览器打开
+   `https://<控制面>/device/authorize?code=...`。
+3. 在浏览器登录 SaaS 账号 → 点「**授权此设备**」→ 回到 DSH 面板。
+4. 面板会自动轮询并完成绑定，**绑定后自动开启隧道**，随后出现「**显示二维码**」按钮。
+5. 手机扫码（`https://<控制面>/open/<publicId>`）→ 登录 SaaS 账号 → 自动验证隧道归属并签发一次性
+   ticket，跳转进入本机 DSH。
 
-绑定信息（`deviceId` / `deviceSecret`）只保存在本机
-`~/.dsh/qzsy-dsh-bridge/config.json`（权限 0600）；面板只显示掩码。解绑会清除本机凭证，
-设备本身需在控制台吊销。
+> 需要手动输入设备码时，可展开面板「高级：手动设备码 / 局域网口令」，用「获取设备码」走旧流程。
+> 绑定信息（`deviceId` / `deviceSecret`）只保存在本机 `~/.dsh/qzsy-dsh-bridge/config.json`
+> （权限 0600）；面板只显示掩码。解绑会清除本机凭证，设备本身需在控制台吊销。
 
 ## 公网地址形态
 
@@ -46,13 +48,15 @@ loopback 会话 cookie。来源判定：
 | 来源 | 判定 | 结果 |
 | --- | --- | --- |
 | 物理本机回环 | 连接来自 `127.0.0.1` / `::1` 且未带隧道标记 | 免认证，享有本机特权 |
-| SaaS 隧道 | 携带插件隧道客户端注入的 `x-dsh-internal-tunnel`（进程内随机密钥，公网不可伪造） | 仅代表来源是隧道；访客仍必须通过本地口令 / `?auth=` 会话，否则 401 |
-| 局域网 / 其它直连 | 非回环且无有效隧道标记 | 必须通过本地口令登录或 `?auth=` 令牌换取会话，否则 401 |
+| SaaS 隧道 | 携带 `x-dsh-internal-tunnel` 标记，并带网关注入的 `x-qzsy-gate: ts.uid.hmac` | 验签通过（HMAC-SHA256、±60 秒）即认证；未验签一律 401，不再要求本地口令 |
+| 局域网 / 其它直连 | 非回环且无有效隧道标记 | 需本地口令登录或 `?auth=` 令牌换取会话（可选能力） |
 
 - `/__qzsy_bridge__/loopback-token` 只对物理回环签发；经隧道访问一律 **403**。
-- **首次使用必须在面板设置访问口令**（至少 6 位）；未设置时所有远程/隧道访客都会被拒绝并返回初始化引导页。
-- 面板「带访问令牌的链接」包含固定 `?auth=` 令牌，首次打开后换取 30 天会话 cookie；令牌可重复使用，请只发给可信设备，泄露后请在控制台吊销设备并解绑重绑。
-- 隧道标记密钥每次进程启动重新生成，不落盘。
+- 隧道访客由**网关信任头**认证：hello-ack 为每条连接下发随机 32 字节 `gate.secret`，网关在校验一次性 ticket
+  且账号为隧道 owner 后附加 `x-qzsy-gate`；插件验签通过即放行，不依赖本地口令。
+- `x-qzsy-gate` 由网关先剥掉客户端伪造值再附加；插件转发 DSH 前也会剥离该头与隧道标记。
+- 本地口令是**可选的局域网直连能力**（面板「高级」里可设置），与 SaaS 扫码进入互不影响；
+  `?auth=` 固定令牌同样只用于局域网/直连，请只发给可信设备。
 
 ## 配置
 
@@ -73,18 +77,18 @@ loopback 会话 cookie。来源判定：
 
 | 现象 | 排查 |
 | --- | --- |
-| 面板显示「未绑定」 | 确认网关地址可访问；重新获取设备码；确认控制台批准的是同一设备码 |
-| 设备码过期 | 设备码 10 分钟有效，重新「获取设备码」 |
+| 面板显示「未绑定」 | 确认网关地址可访问；重新点「立即登录授权」，确认浏览器里已点「授权此设备」 |
+| 授权页提示设备码无效/过期 | 设备码 10 分钟有效，回面板重新点「立即登录授权」 |
 | 开启隧道一直「连接中」 | 检查 `wss://.../_gw/connect` 是否可直连（公司代理/防火墙可能拦截 WebSocket） |
 | 握手失败 `auth_failed` / `revoked` | 设备已吊销或令牌失效：解绑后重新绑定；被吊销需在控制台重新添加设备 |
-| 打开公网地址 401 | 先确认已在面板设置访问口令；用「带访问令牌的链接」打开一次换取会话；或确认控制台访问模式为 password |
+| 打开公网地址 401 | 隧道来源只认网关 `x-qzsy-gate` 签名：确认控制台/网关已升级到支持无感授权（hello-ack 下发 gate.secret），并重新扫码获取新 ticket |
 | 本机 3092 被占用 | 在 `config.json` 或 cordis 配置里改 `port` |
 | 请求 502 | DSH 本体不可达：确认 `dsh web` 在运行，或配置 `targetPort` |
 | WebSocket 打不开 | 确认网关与反代放行 WS Upgrade；插件会透传 `ws-open/accept/frame/close` |
 
-## 已知限制（v3.0.0）
+## 已知限制（v3.1.0）
 
-- `getStatus` 为面板引导接口，免 adminToken，只返回脱敏状态（设备 id/secret 均掩码，不含访问令牌与二维码）。
+- `getStatus` 为面板引导接口，免 adminToken，只返回脱敏状态（设备 id/secret 均掩码，不含访问令牌与二维码；`openUrl` 由 /open/<publicId> 二次校验归属）。
 - adminToken 每次进程启动随机生成，只经物理回环 `/__qzsy_bridge__/loopback-token` 签发；重启 DSH 后需重新领取（面板自动完成）。
 - 访问口令登录已内置限流（同一 IP 连续 5 次失败锁定 60 秒）；请使用足够强的口令，并只在内网/可信网络暴露本地端口。
 - 修改或清除访问口令会轮换会话签名密钥，所有已登录的远程访客会立即失效。

package/client/client.js

@@ -46,6 +46,8 @@ var RPC_ENDPOINTS = Object.freeze({
   startTunnel: "startTunnel",
   stopTunnel: "stopTunnel",
   getAccessUrl: "getAccessUrl",
+  startLogin: "startLogin",
+  getEntryQr: "getEntryQr",
   setAccessPassword: "setAccessPassword",
   clearAccessPassword: "clearAccessPassword"
 });
@@ -61,6 +63,14 @@ var zh = {
   notBound: "\u672A\u7ED1\u5B9A",
   bound: "\u5DF2\u7ED1\u5B9A",
   getCode: "\u83B7\u53D6\u8BBE\u5907\u7801",
+  loginNow: "\u7ACB\u5373\u767B\u5F55\u6388\u6743",
+  loginWaiting: "\u5DF2\u6253\u5F00\u6D4F\u89C8\u5668\u6388\u6743\u9875\uFF0C\u8BF7\u5728\u6D4F\u89C8\u5668\u4E2D\u5B8C\u6210\u767B\u5F55\u5E76\u70B9\u300C\u6388\u6743\u6B64\u8BBE\u5907\u300D\uFF1B\u6388\u6743\u540E\u672C\u9875\u4F1A\u81EA\u52A8\u5237\u65B0\u3002",
+  reopenAuthorize: "\u91CD\u65B0\u6253\u5F00\u6388\u6743\u9875",
+  advanced: "\u9AD8\u7EA7\uFF1A\u624B\u52A8\u8BBE\u5907\u7801 / \u5C40\u57DF\u7F51\u53E3\u4EE4\uFF08\u53EF\u9009\uFF09",
+  entryUrl: "\u626B\u7801\u5165\u53E3\uFF08SaaS \u767B\u5F55\u540E\u8FDB\u5165\uFF09",
+  showQr: "\u663E\u793A\u4E8C\u7EF4\u7801",
+  hideQr: "\u6536\u8D77\u4E8C\u7EF4\u7801",
+  qrLoading: "\u4E8C\u7EF4\u7801\u751F\u6210\u4E2D\u2026",
   codeTitle: "\u5728\u63A7\u5236\u53F0\u6DFB\u52A0\u8BBE\u5907\u5E76\u8F93\u5165\u6B64\u8BBE\u5907\u7801",
   codeExpires: "\u8BBE\u5907\u7801 10 \u5206\u949F\u5185\u6709\u6548\uFF0C\u7ED1\u5B9A\u540E\u81EA\u52A8\u6D88\u5931\u3002",
   openConsole: "\u6253\u5F00\u63A7\u5236\u53F0",
@@ -82,7 +92,7 @@ var zh = {
   qr: "\u626B\u7801\u6253\u5F00",
   lastError: "\u6700\u8FD1\u9519\u8BEF",
   password: "\u8BBF\u95EE\u53E3\u4EE4",
-  passwordHint: "\u9996\u6B21\u4F7F\u7528\u5FC5\u987B\u5148\u8BBE\u7F6E\u8BBF\u95EE\u53E3\u4EE4\uFF1B\u8FDC\u7A0B/\u5C40\u57DF\u7F51\u8BBF\u5BA2\u9700\u51ED\u6B64\u53E3\u4EE4\u901A\u8FC7\u672C\u5730\u95E8\u7981\u3002",
+  passwordHint: "\u53EF\u9009\uFF1A\u4E3A\u5C40\u57DF\u7F51\u76F4\u8FDE\u8BBE\u7F6E\u672C\u5730\u53E3\u4EE4\uFF1BSaaS \u96A7\u9053\u8BBF\u5BA2\u8D70\u7F51\u5173\u7B7E\u540D\uFF0C\u65E0\u9700\u53E3\u4EE4\u3002",
   passwordSet: "\u5DF2\u8BBE\u7F6E\u8BBF\u95EE\u53E3\u4EE4\uFF08\u53EF\u5728\u6B64\u4FEE\u6539\uFF09\u3002",
   passwordPlaceholder: "\u81F3\u5C11 6 \u4F4D",
   savePassword: "\u4FDD\u5B58\u53E3\u4EE4",
@@ -103,6 +113,14 @@ var en = {
   notBound: "Not bound",
   bound: "Bound",
   getCode: "Get device code",
+  loginNow: "Log in & authorize",
+  loginWaiting: "The authorization page is open in your browser. Sign in and click \u201CAuthorize this device\u201D; this panel will refresh automatically.",
+  reopenAuthorize: "Reopen authorization page",
+  advanced: "Advanced: manual device code / LAN password (optional)",
+  entryUrl: "Scan entry (sign in to SaaS first)",
+  showQr: "Show QR code",
+  hideQr: "Hide QR code",
+  qrLoading: "Generating QR code\u2026",
   codeTitle: "Add the device in the console and enter this code",
   codeExpires: "The code is valid for 10 minutes and disappears after binding.",
   openConsole: "Open console",
@@ -124,7 +142,7 @@ var en = {
   qr: "Scan to open",
   lastError: "Last error",
   password: "Access password",
-  passwordHint: "Set an access password before first use; remote/LAN visitors must pass the local gate with it.",
+  passwordHint: "Optional: set a local password for LAN access. SaaS tunnel visitors are authenticated by the gateway signature and do not need it.",
   passwordSet: "Access password is set (you can change it here).",
   passwordPlaceholder: "At least 6 characters",
   savePassword: "Save password",
@@ -215,8 +233,8 @@ function BridgePanel() {
   const [error, setError] = React.useState("");
   const [notice, setNotice] = React.useState("");
   const [confirmUnbind, setConfirmUnbind] = React.useState(false);
-  const [accessUrl, setAccessUrl] = React.useState("");
-  const [qrDataUrl, setQrDataUrl] = React.useState("");
+  const [showQr, setShowQr] = React.useState(false);
+  const [entryQr, setEntryQr] = React.useState("");
   const [passwordDraft, setPasswordDraft] = React.useState("");
   const loadAdminToken = React.useCallback(async (port) => {
     if (!port) return;
@@ -248,22 +266,20 @@ function BridgePanel() {
     return () => clearInterval(timer);
   }, [refresh]);
   React.useEffect(() => {
-    if (!adminToken || !status?.publicUrl) {
-      setAccessUrl("");
-      setQrDataUrl("");
+    if (!adminToken || !showQr || !status?.openUrl) {
+      setEntryQr("");
       return;
     }
     let cancelled = false;
-    rpc(RPC_ENDPOINTS.getAccessUrl).then((res) => {
+    rpc(RPC_ENDPOINTS.getEntryQr).then((res) => {
       if (cancelled || !res?.ok) return;
-      setAccessUrl(res.value?.url ?? "");
-      setQrDataUrl(res.value?.qrDataUrl ?? "");
+      setEntryQr(res.value?.qrDataUrl ?? "");
     }).catch(() => {
     });
     return () => {
       cancelled = true;
     };
-  }, [adminToken, status?.publicUrl, rpc]);
+  }, [adminToken, showQr, status?.openUrl, rpc]);
   const run = React.useCallback(async (key, fn) => {
     setBusy(key);
     setError("");
@@ -282,6 +298,31 @@ function BridgePanel() {
   }, [refresh]);
   const saveGateway = () => run("gateway", () => rpc(RPC_ENDPOINTS.saveGateway, { gatewayUrl: gatewayDraft })).then(() => setNotice(t("saved")));
   const requestCode = () => run("code", () => rpc(RPC_ENDPOINTS.requestDeviceCode));
+  const startLogin = () => {
+    let popup = null;
+    try {
+      popup = window.open("about:blank", "_blank");
+    } catch {
+    }
+    return run("login", () => rpc(RPC_ENDPOINTS.startLogin)).then((value) => {
+      if (!value?.verificationUrl) {
+        try {
+          popup?.close();
+        } catch {
+        }
+        return;
+      }
+      try {
+        if (popup && !popup.closed) popup.location.href = value.verificationUrl;
+        else window.open(value.verificationUrl, "_blank", "noopener,noreferrer");
+      } catch {
+        try {
+          window.open(value.verificationUrl, "_blank", "noopener,noreferrer");
+        } catch {
+        }
+      }
+    });
+  };
   const bindCode = () => run("bind", () => rpc(RPC_ENDPOINTS.bindDevice, { code: codeDraft })).then((value) => {
     if (value) setCodeDraft("");
   });
@@ -299,6 +340,7 @@ function BridgePanel() {
   const phase = status?.phase ?? "idle";
   const publicUrl = status?.publicUrl ?? "";
   const pairing = status?.pairing;
+  const openUrl = status?.openUrl ?? "";
   const passwordSet = Boolean(status?.access?.passwordSet);
   const stateText = connected ? t("ready") : phase === "connecting" || phase === "reconnecting" ? t("connecting") : t("offline");
   return h(
@@ -356,7 +398,7 @@ function BridgePanel() {
             bound ? `${status?.device?.tunnel?.name || "DSH"} \xB7 ${status?.device?.tunnel?.publicId || ""}` : t("notBound")
           )
         ),
-        !bound && h("button", { style: styles.btnPrimary, disabled: Boolean(busy), onClick: requestCode }, t("getCode")),
+        !bound && h("button", { style: styles.btnPrimary, disabled: Boolean(busy), onClick: startLogin }, t("loginNow")),
         bound && h("button", {
           style: styles.btn,
           disabled: Boolean(busy),
@@ -366,22 +408,44 @@ function BridgePanel() {
       pairing && pairing.status === "pending" ? h(
         "div",
         { style: { marginTop: 12 } },
-        h("div", { style: styles.muted }, t("codeTitle")),
-        h("div", { style: styles.code }, pairing.code),
-        h("div", { style: styles.muted }, t("codeExpires")),
-        pairing.verificationUrl ? h("a", { href: pairing.verificationUrl, target: "_blank", rel: "noreferrer", style: { fontSize: 12 } }, t("openConsole")) : null
+        h("div", { style: styles.muted }, t("loginWaiting")),
+        pairing.verificationUrl ? h("a", { href: pairing.verificationUrl, target: "_blank", rel: "noreferrer", style: { fontSize: 12 } }, t("reopenAuthorize")) : null
       ) : null,
-      !bound ? h(
-        "div",
+      h(
+        "details",
         { style: { marginTop: 12 } },
-        h("span", { style: styles.label }, t("bindManual")),
+        h("summary", { style: { ...styles.muted, cursor: "pointer" } }, t("advanced")),
+        !bound ? h(
+          "div",
+          { style: { marginTop: 10 } },
+          h("span", { style: styles.label }, t("bindManual")),
+          h(
+            "div",
+            { style: styles.row },
+            h("input", { style: styles.input, value: codeDraft, onChange: (e) => setCodeDraft(e.target.value), placeholder: "ABCD-1234" }),
+            h("button", { style: styles.btn, disabled: busy === "bind" || !codeDraft, onClick: bindCode }, t("bind")),
+            h("button", { style: styles.btn, disabled: Boolean(busy), onClick: requestCode }, t("getCode"))
+          )
+        ) : null,
         h(
           "div",
-          { style: styles.row },
-          h("input", { style: styles.input, value: codeDraft, onChange: (e) => setCodeDraft(e.target.value), placeholder: "ABCD-1234" }),
-          h("button", { style: styles.btn, disabled: busy === "bind" || !codeDraft, onClick: bindCode }, t("bind"))
+          { style: { marginTop: 12 } },
+          h("div", { style: { fontSize: 13, fontWeight: 600 } }, t("password")),
+          h("div", { style: styles.muted }, passwordSet ? t("passwordSet") : t("passwordHint")),
+          h(
+            "div",
+            { style: { ...styles.row, marginTop: 8 } },
+            h("input", {
+              style: styles.input,
+              type: "password",
+              value: passwordDraft,
+              onChange: (e) => setPasswordDraft(e.target.value),
+              placeholder: t("passwordPlaceholder")
+            }),
+            h("button", { style: styles.btn, disabled: busy === "password" || passwordDraft.length < 6, onClick: savePassword }, t("savePassword"))
+          )
         )
-      ) : null,
+      ),
       confirmUnbind ? h(
         "div",
         { style: { marginTop: 12 } },
@@ -394,24 +458,6 @@ function BridgePanel() {
         )
       ) : null
     ),
-    h(
-      "div",
-      { style: styles.card },
-      h("div", { style: { fontSize: 13, fontWeight: 600 } }, t("password")),
-      h("div", { style: styles.muted }, passwordSet ? t("passwordSet") : t("passwordHint")),
-      h(
-        "div",
-        { style: { ...styles.row, marginTop: 8 } },
-        h("input", {
-          style: styles.input,
-          type: "password",
-          value: passwordDraft,
-          onChange: (e) => setPasswordDraft(e.target.value),
-          placeholder: t("passwordPlaceholder")
-        }),
-        h("button", { style: styles.btnPrimary, disabled: busy === "password" || passwordDraft.length < 6, onClick: savePassword }, t("savePassword"))
-      )
-    ),
     h(
       "div",
       { style: styles.card },
@@ -424,22 +470,22 @@ function BridgePanel() {
           h("div", { style: { fontSize: 13, fontWeight: 600 } }, t("tunnel")),
           h("div", { style: styles.muted }, connected ? publicUrl : t("noPublicUrl"))
         ),
-        connected ? h("button", { style: styles.btn, disabled: Boolean(busy), onClick: stopTunnel }, t("stop")) : h("button", { style: styles.btnPrimary, disabled: Boolean(busy) || !bound || !passwordSet, onClick: startTunnel }, t("start"))
+        connected ? h("button", { style: styles.btn, disabled: Boolean(busy), onClick: stopTunnel }, t("stop")) : h("button", { style: styles.btnPrimary, disabled: Boolean(busy) || !bound, onClick: startTunnel }, t("start"))
       ),
-      publicUrl ? h(
+      openUrl ? h(
         "div",
-        { style: { display: "flex", gap: 16, marginTop: 12, flexWrap: "wrap", alignItems: "flex-start" } },
+        { style: { marginTop: 12 } },
         h(
           "div",
-          { style: { flex: "1 1 320px", minWidth: 260 } },
-          h(UrlRow, { label: t("publicUrl"), url: publicUrl, t }),
-          h(UrlRow, { label: t("accessUrl"), url: accessUrl, t })
+          { style: styles.row },
+          h(UrlRow, { label: t("entryUrl"), url: openUrl, t }),
+          h("button", { style: styles.btn, onClick: () => setShowQr((value) => !value) }, showQr ? t("hideQr") : t("showQr"))
         ),
-        qrDataUrl ? h(
+        showQr ? h(
           "div",
-          null,
+          { style: { marginTop: 12 } },
           h("div", { style: styles.label }, t("qr")),
-          h("img", { src: qrDataUrl, alt: t("qr"), style: styles.qr })
+          entryQr ? h("img", { src: entryQr, alt: t("qr"), style: styles.qr }) : h("div", { style: styles.muted }, t("qrLoading"))
         ) : null
       ) : null
     )

package/client/index.js

@@ -64,8 +64,8 @@ function BridgePanel() {
   const [error, setError] = React.useState('');
   const [notice, setNotice] = React.useState('');
   const [confirmUnbind, setConfirmUnbind] = React.useState(false);
-  const [accessUrl, setAccessUrl] = React.useState('');
-  const [qrDataUrl, setQrDataUrl] = React.useState('');
+  const [showQr, setShowQr] = React.useState(false);
+  const [entryQr, setEntryQr] = React.useState('');
   const [passwordDraft, setPasswordDraft] = React.useState('');
 
   const loadAdminToken = React.useCallback(async (port) => {
@@ -96,19 +96,17 @@ function BridgePanel() {
   }, [refresh]);
 
   React.useEffect(() => {
-    if (!adminToken || !status?.publicUrl) {
-      setAccessUrl('');
-      setQrDataUrl('');
+    if (!adminToken || !showQr || !status?.openUrl) {
+      setEntryQr('');
       return;
     }
     let cancelled = false;
-    rpc(RPC_ENDPOINTS.getAccessUrl).then((res) => {
+    rpc(RPC_ENDPOINTS.getEntryQr).then((res) => {
       if (cancelled || !res?.ok) return;
-      setAccessUrl(res.value?.url ?? '');
-      setQrDataUrl(res.value?.qrDataUrl ?? '');
+      setEntryQr(res.value?.qrDataUrl ?? '');
     }).catch(() => {});
     return () => { cancelled = true; };
-  }, [adminToken, status?.publicUrl, rpc]);
+  }, [adminToken, showQr, status?.openUrl, rpc]);
 
   const run = React.useCallback(async (key, fn) => {
     setBusy(key);
@@ -129,6 +127,21 @@ function BridgePanel() {
 
   const saveGateway = () => run('gateway', () => rpc(RPC_ENDPOINTS.saveGateway, { gatewayUrl: gatewayDraft })).then(() => setNotice(t('saved')));
   const requestCode = () => run('code', () => rpc(RPC_ENDPOINTS.requestDeviceCode));
+  const startLogin = () => {
+    // 先同步开一个空白窗口，避免 RPC 返回后 await 导致浏览器拦截弹窗；
+    // 拿到 verificationUrl 再导航，失败时回退为普通 window.open。
+    let popup = null;
+    try { popup = window.open('about:blank', '_blank'); } catch {}
+    return run('login', () => rpc(RPC_ENDPOINTS.startLogin)).then((value) => {
+      if (!value?.verificationUrl) { try { popup?.close(); } catch {} return; }
+      try {
+        if (popup && !popup.closed) popup.location.href = value.verificationUrl;
+        else window.open(value.verificationUrl, '_blank', 'noopener,noreferrer');
+      } catch {
+        try { window.open(value.verificationUrl, '_blank', 'noopener,noreferrer'); } catch {}
+      }
+    });
+  };
   const bindCode = () => run('bind', () => rpc(RPC_ENDPOINTS.bindDevice, { code: codeDraft })).then((value) => { if (value) setCodeDraft(''); });
   const startTunnel = () => run('start', () => rpc(RPC_ENDPOINTS.startTunnel, { autoStart: true }));
   const stopTunnel = () => run('stop', () => rpc(RPC_ENDPOINTS.stopTunnel));
@@ -142,6 +155,7 @@ function BridgePanel() {
   const phase = status?.phase ?? 'idle';
   const publicUrl = status?.publicUrl ?? '';
   const pairing = status?.pairing;
+  const openUrl = status?.openUrl ?? '';
   const passwordSet = Boolean(status?.access?.passwordSet);
   const stateText = connected ? t('ready') : (phase === 'connecting' || phase === 'reconnecting' ? t('connecting') : t('offline'));
 
@@ -184,7 +198,7 @@ function BridgePanel() {
               : t('notBound'),
           ),
         ),
-        !bound && h('button', { style: styles.btnPrimary, disabled: Boolean(busy), onClick: requestCode }, t('getCode')),
+        !bound && h('button', { style: styles.btnPrimary, disabled: Boolean(busy), onClick: startLogin }, t('loginNow')),
         bound && h('button', {
           style: styles.btn,
           disabled: Boolean(busy),
@@ -192,18 +206,34 @@ function BridgePanel() {
         }, t('unbind')),
       ),
       pairing && pairing.status === 'pending' ? h('div', { style: { marginTop: 12 } },
-        h('div', { style: styles.muted }, t('codeTitle')),
-        h('div', { style: styles.code }, pairing.code),
-        h('div', { style: styles.muted }, t('codeExpires')),
-        pairing.verificationUrl ? h('a', { href: pairing.verificationUrl, target: '_blank', rel: 'noreferrer', style: { fontSize: 12 } }, t('openConsole')) : null,
+        h('div', { style: styles.muted }, t('loginWaiting')),
+        pairing.verificationUrl ? h('a', { href: pairing.verificationUrl, target: '_blank', rel: 'noreferrer', style: { fontSize: 12 } }, t('reopenAuthorize')) : null,
       ) : null,
-      !bound ? h('div', { style: { marginTop: 12 } },
-        h('span', { style: styles.label }, t('bindManual')),
-        h('div', { style: styles.row },
-          h('input', { style: styles.input, value: codeDraft, onChange: (e) => setCodeDraft(e.target.value), placeholder: 'ABCD-1234' }),
-          h('button', { style: styles.btn, disabled: busy === 'bind' || !codeDraft, onClick: bindCode }, t('bind')),
+      h('details', { style: { marginTop: 12 } },
+        h('summary', { style: { ...styles.muted, cursor: 'pointer' } }, t('advanced')),
+        !bound ? h('div', { style: { marginTop: 10 } },
+          h('span', { style: styles.label }, t('bindManual')),
+          h('div', { style: styles.row },
+            h('input', { style: styles.input, value: codeDraft, onChange: (e) => setCodeDraft(e.target.value), placeholder: 'ABCD-1234' }),
+            h('button', { style: styles.btn, disabled: busy === 'bind' || !codeDraft, onClick: bindCode }, t('bind')),
+            h('button', { style: styles.btn, disabled: Boolean(busy), onClick: requestCode }, t('getCode')),
+          ),
+        ) : null,
+        h('div', { style: { marginTop: 12 } },
+          h('div', { style: { fontSize: 13, fontWeight: 600 } }, t('password')),
+          h('div', { style: styles.muted }, passwordSet ? t('passwordSet') : t('passwordHint')),
+          h('div', { style: { ...styles.row, marginTop: 8 } },
+            h('input', {
+              style: styles.input,
+              type: 'password',
+              value: passwordDraft,
+              onChange: (e) => setPasswordDraft(e.target.value),
+              placeholder: t('passwordPlaceholder'),
+            }),
+            h('button', { style: styles.btn, disabled: busy === 'password' || passwordDraft.length < 6, onClick: savePassword }, t('savePassword')),
+          ),
         ),
-      ) : null,
+      ),
       confirmUnbind ? h('div', { style: { marginTop: 12 } },
         h('div', { style: { ...styles.muted, marginBottom: 8 } }, t('unbindConfirm')),
         h('div', { style: styles.row },
@@ -213,21 +243,6 @@ function BridgePanel() {
       ) : null,
     ),
 
-    h('div', { style: styles.card },
-      h('div', { style: { fontSize: 13, fontWeight: 600 } }, t('password')),
-      h('div', { style: styles.muted }, passwordSet ? t('passwordSet') : t('passwordHint')),
-      h('div', { style: { ...styles.row, marginTop: 8 } },
-        h('input', {
-          style: styles.input,
-          type: 'password',
-          value: passwordDraft,
-          onChange: (e) => setPasswordDraft(e.target.value),
-          placeholder: t('passwordPlaceholder'),
-        }),
-        h('button', { style: styles.btnPrimary, disabled: busy === 'password' || passwordDraft.length < 6, onClick: savePassword }, t('savePassword')),
-      ),
-    ),
-
     h('div', { style: styles.card },
       h('div', { style: styles.row },
         h('div', { style: { flex: 1, minWidth: 200 } },
@@ -236,16 +251,16 @@ function BridgePanel() {
         ),
         connected
           ? h('button', { style: styles.btn, disabled: Boolean(busy), onClick: stopTunnel }, t('stop'))
-          : h('button', { style: styles.btnPrimary, disabled: Boolean(busy) || !bound || !passwordSet, onClick: startTunnel }, t('start')),
+          : h('button', { style: styles.btnPrimary, disabled: Boolean(busy) || !bound, onClick: startTunnel }, t('start')),
       ),
-      publicUrl ? h('div', { style: { display: 'flex', gap: 16, marginTop: 12, flexWrap: 'wrap', alignItems: 'flex-start' } },
-        h('div', { style: { flex: '1 1 320px', minWidth: 260 } },
-          h(UrlRow, { label: t('publicUrl'), url: publicUrl, t }),
-          h(UrlRow, { label: t('accessUrl'), url: accessUrl, t }),
+      openUrl ? h('div', { style: { marginTop: 12 } },
+        h('div', { style: styles.row },
+          h(UrlRow, { label: t('entryUrl'), url: openUrl, t }),
+          h('button', { style: styles.btn, onClick: () => setShowQr((value) => !value) }, showQr ? t('hideQr') : t('showQr')),
         ),
-        qrDataUrl ? h('div', null,
+        showQr ? h('div', { style: { marginTop: 12 } },
           h('div', { style: styles.label }, t('qr')),
-          h('img', { src: qrDataUrl, alt: t('qr'), style: styles.qr }),
+          entryQr ? h('img', { src: entryQr, alt: t('qr'), style: styles.qr }) : h('div', { style: styles.muted }, t('qrLoading')),
         ) : null,
       ) : null,
     ),

package/client/locales.mjs

@@ -9,6 +9,14 @@ export const zh = {
   notBound: '未绑定',
   bound: '已绑定',
   getCode: '获取设备码',
+  loginNow: '立即登录授权',
+  loginWaiting: '已打开浏览器授权页，请在浏览器中完成登录并点「授权此设备」；授权后本页会自动刷新。',
+  reopenAuthorize: '重新打开授权页',
+  advanced: '高级：手动设备码 / 局域网口令（可选）',
+  entryUrl: '扫码入口（SaaS 登录后进入）',
+  showQr: '显示二维码',
+  hideQr: '收起二维码',
+  qrLoading: '二维码生成中…',
   codeTitle: '在控制台添加设备并输入此设备码',
   codeExpires: '设备码 10 分钟内有效，绑定后自动消失。',
   openConsole: '打开控制台',
@@ -30,7 +38,7 @@ export const zh = {
   qr: '扫码打开',
   lastError: '最近错误',
   password: '访问口令',
-  passwordHint: '首次使用必须先设置访问口令；远程/局域网访客需凭此口令通过本地门禁。',
+  passwordHint: '可选：为局域网直连设置本地口令；SaaS 隧道访客走网关签名，无需口令。',
   passwordSet: '已设置访问口令（可在此修改）。',
   passwordPlaceholder: '至少 6 位',
   savePassword: '保存口令',
@@ -52,6 +60,14 @@ export const en = {
   notBound: 'Not bound',
   bound: 'Bound',
   getCode: 'Get device code',
+  loginNow: 'Log in & authorize',
+  loginWaiting: 'The authorization page is open in your browser. Sign in and click “Authorize this device”; this panel will refresh automatically.',
+  reopenAuthorize: 'Reopen authorization page',
+  advanced: 'Advanced: manual device code / LAN password (optional)',
+  entryUrl: 'Scan entry (sign in to SaaS first)',
+  showQr: 'Show QR code',
+  hideQr: 'Hide QR code',
+  qrLoading: 'Generating QR code…',
   codeTitle: 'Add the device in the console and enter this code',
   codeExpires: 'The code is valid for 10 minutes and disappears after binding.',
   openConsole: 'Open console',
@@ -73,7 +89,7 @@ export const en = {
   qr: 'Scan to open',
   lastError: 'Last error',
   password: 'Access password',
-  passwordHint: 'Set an access password before first use; remote/LAN visitors must pass the local gate with it.',
+  passwordHint: 'Optional: set a local password for LAN access. SaaS tunnel visitors are authenticated by the gateway signature and do not need it.',
   passwordSet: 'Access password is set (you can change it here).',
   passwordPlaceholder: 'At least 6 characters',
   savePassword: 'Save password',

package/lib/config.js

@@ -35,7 +35,7 @@ export function normalizeConfig(raw = {}) {
   const access = input.access && typeof input.access === 'object' ? input.access : {};
   const port = Number(input.port);
   return {
-    port: Number.isInteger(port) && port > 0 && port < 65536 ? port : DEFAULT_PORT,
+    port: Number.isInteger(port) && port > 0 && port < 65_536 ? port : DEFAULT_PORT,
     gatewayUrl: typeof input.gatewayUrl === 'string' && input.gatewayUrl.trim()
       ? input.gatewayUrl.trim()
       : DEFAULT_GATEWAY_URL,

package/lib/dsh-cookie.js

@@ -15,7 +15,7 @@ import { readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { resolveDshHome } from './data-dir.js';
 
-const COOKIE_SPEC = { prefix: 'dsh-auth-', version: 1, ttlMs: 2592000000 };
+const COOKIE_SPEC = { prefix: 'dsh-auth-', version: 1, ttlMs: 2_592_000_000 };
 export const DSH_AUTH_COOKIE_PREFIX = COOKIE_SPEC.prefix;
 export const DSH_AUTH_COOKIE_VERSION = COOKIE_SPEC.version;
 export const DSH_AUTH_COOKIE_MAX_AGE_MS = COOKIE_SPEC.ttlMs;

package/lib/gate.js

@@ -19,6 +19,8 @@ import { PLUGIN_ID } from './identity.js';
 export const AUTH_COOKIE = 'qzsy_bridge_auth';
 export const TUNNEL_HEADER = 'x-dsh-internal-tunnel';
 export const SAAS_USER_HEADER = 'x-saas-user';
+export const GATE_HEADER = 'x-qzsy-gate';
+const GATE_MAX_SKEW_SECONDS = 60;
 const SESSION_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000;
 const LOGIN_MAX_FAILURES = 5;
 const LOGIN_LOCK_MS = 60 * 1000;
@@ -58,7 +60,7 @@ function cleanHeaders(headers, { cookie, targetPort } = {}) {
   const out = {};
   for (const [name, value] of Object.entries(headers ?? {})) {
     const lower = name.toLowerCase();
-    if (HOP_BY_HOP.has(lower) || lower === TUNNEL_HEADER || lower === SAAS_USER_HEADER) continue;
+    if (HOP_BY_HOP.has(lower) || lower === TUNNEL_HEADER || lower === SAAS_USER_HEADER || lower === GATE_HEADER) continue;
     if (value === undefined) continue;
     out[lower] = value;
   }
@@ -89,6 +91,7 @@ export class GateProxy {
     this.host = host;
     this.config = config;
     this.internalSecret = String(internalSecret ?? '');
+    this.gateSecret = '';
     this.logger = logger;
     this.dshHome = dshHome;
     this.now = now;
@@ -114,6 +117,30 @@ export class GateProxy {
     return safeEqual(parts[2], this.sessionToken(expiresAt).split('.')[2]);
   }
 
+  /** 网关信任密钥（随每条控制连接随机下发；断开即失效）。 */
+  setGateSecret(secret) {
+    this.gateSecret = /^[0-9a-f]{64}$/i.test(String(secret ?? '')) ? String(secret).toLowerCase() : '';
+  }
+
+  /**
+   * 校验网关注入的 x-qzsy-gate：ts.uid.hmac（ts 秒，hmac=HMAC-SHA256(secret, ts.uid) hex）。
+   * 允许 ±60 秒漂移；任何格式/签名/时效问题都返回 false。
+   */
+  verifyGateTrust(rawValue, nowMs = this.now()) {
+    if (!this.gateSecret) return false;
+    const parts = String(rawValue ?? '').split('.');
+    if (parts.length !== 3) return false;
+    const [rawTs, uid, signature] = parts;
+    const ts = Number(rawTs);
+    if (!Number.isInteger(ts) || uid.length === 0) return false;
+    const nowSeconds = Math.floor(nowMs / 1000);
+    if (Math.abs(nowSeconds - ts) > GATE_MAX_SKEW_SECONDS) return false;
+    const expected = createHmac('sha256', this.gateSecret)
+      .update(`${ts}.${uid}`)
+      .digest('hex');
+    return safeEqual(String(signature).toLowerCase(), expected);
+  }
+
   /** 来源分类：返回 { source: 'loopback'|'tunnel'|'remote', authenticated, saasUser }。 */
   classify(req) {
     const headers = req?.headers ?? {};
@@ -121,11 +148,14 @@ export class GateProxy {
     if (this.internalSecret && safeEqual(marker, this.internalSecret)) {
       // 内部标记只证明"请求来自本插件的隧道客户端"，不等于访客已认证：
       // 仍需本地口令会话 / ?auth= 令牌换来的会话 cookie。
-      const cookies = parseCookies(headers.cookie);
+      const gateTrust = this.verifyGateTrust(headers[GATE_HEADER]);
+      const gateUid = gateTrust ? String(headers[GATE_HEADER]).split('.')[1] : '';
       return {
         source: 'tunnel',
-        authenticated: this.verifySession(cookies[AUTH_COOKIE]),
-        saasUser: String(headers[SAAS_USER_HEADER] ?? ''),
+        // 契约 §3：隧道来源只认网关签名；未验签一律 401（本地口令会话也不再作为隧道回退）。
+        authenticated: gateTrust,
+        gateTrust,
+        saasUser: gateUid || String(headers[SAAS_USER_HEADER] ?? ''),
       };
     }
     const address = req?.socket?.remoteAddress;
@@ -171,6 +201,13 @@ export class GateProxy {
 <div><h1>尚未设置访问口令</h1><p>DSH 远程隧道云默认拒绝未认证的远程/隧道访客。</p><p>请先在<b>本机</b> DSH 设置页「远程访问」中设置访问口令，再把「带访问令牌的链接」发给需要访问的人。</p></div></html>`;
   }
 
+  _gateRejectedPage() {
+    return `<!doctype html><html lang="zh-CN"><meta charset="utf-8" />
+<title>DSH 远程隧道云 · 未授权</title>
+<style>body{font-family:system-ui,-apple-system,"Segoe UI",sans-serif;background:#0f1115;color:#e5e7eb;display:grid;place-items:center;min-height:100vh;margin:0}div{background:#171a21;padding:28px;border-radius:12px;width:min(92vw,440px);border:1px solid #2b303b}h1{font-size:17px;margin:0 0 12px}p{color:#9ca3af;font-size:13px;line-height:1.7;margin:6px 0}</style>
+<div><h1>未获得云隧道授权</h1><p>该请求缺少有效的网关签名。请回到 DSH 面板，点「立即登录授权」并完成浏览器授权，或重新扫码进入。</p></div></html>`;
+  }
+
   _loginBlocked(address) {
     const entry = this.loginFailures.get(address);
     if (!entry) return false;
@@ -318,7 +355,7 @@ export class GateProxy {
       const headers = {};
       for (const [name, value] of Object.entries(req.headers)) {
         const lower = name.toLowerCase();
-        if (lower === TUNNEL_HEADER || lower === SAAS_USER_HEADER) continue;
+        if (lower === TUNNEL_HEADER || lower === SAAS_USER_HEADER || lower === GATE_HEADER) continue;
         if (value !== undefined) headers[lower] = value;
       }
       headers.host = `127.0.0.1:${this.targetPort}`;
@@ -358,6 +395,17 @@ export class GateProxy {
     if (!verdict.authenticated) {
       const wantsJson = String(req.headers.accept ?? '').includes('application/json')
         || String(req.url ?? '').startsWith('/api/');
+      // 隧道来源只认网关签名，不再降级到本地口令；未验签一律 401。
+      if (verdict.source === 'tunnel') {
+        if (wantsJson) {
+          res.writeHead(401, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
+          res.end(JSON.stringify({ ok: false, error: 'unauthorized', code: 'gate_trust_required' }));
+        } else {
+          res.writeHead(401, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
+          res.end(this._gateRejectedPage());
+        }
+        return;
+      }
       const passwordSet = this.passwordConfigured();
       if (wantsJson) {
         res.writeHead(401, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });

package/lib/identity.js

@@ -18,6 +18,8 @@ export const RPC_ENDPOINTS = Object.freeze({
   startTunnel: 'startTunnel',
   stopTunnel: 'stopTunnel',
   getAccessUrl: 'getAccessUrl',
+  startLogin: 'startLogin',
+  getEntryQr: 'getEntryQr',
   setAccessPassword: 'setAccessPassword',
   clearAccessPassword: 'clearAccessPassword',
 });

package/lib/index.js

@@ -1,23 +1,17 @@
-// DSH 远程隧道云 · 官方客户端插件（Host 侧）
-//
-// 职责（保持精简，全部为独立实现）：
-//   1. 本地门禁代理：监听本机端口 → 转发 DSH 本体，注入 DSH 原生 loopback cookie；
-//   2. SaaS 隧道客户端：设备码绑定 → 短期令牌 → v2 控制通道（转发 HTTP / SSE / WS）；
-//   3. 设置页面的 RPC 控制面：状态、绑定、解绑、启停、访问链接。
-import { randomBytes } from 'node:crypto';
+
 import { readFileSync } from 'node:fs';
 import { hostname, platform as osPlatform, arch as osArch } from 'node:os';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import QRCode from 'qrcode';
 
+import { registerRpcChannel } from './rpc-compat.js';
 import { PLUGIN_ID, PACKAGE_NAME, DEFAULT_PORT, RPC_CHANNEL, RPC_ENDPOINTS, GATEWAY_PATH } from './identity.js';
 import { resolveConfigPath } from './data-dir.js';
 import {
   ensureConfigSecrets,
   loadConfig,
   maskSecret,
-  normalizeConfig,
   saveConfig,
   createSecret,
   hashPassword,
@@ -55,21 +49,20 @@ function errorPayload(err) {
 }
 
 function registerRpc(ctx, handler, logger) {
-  const rpc = ctx?.connection?.rpc;
-  if (!rpc?.handle) {
+  if (!ctx?.connection?.rpc?.handle) {
     logger?.warn?.('connection RPC unavailable — panel will stay disabled');
     return () => {};
   }
   try {
-    const dispose = rpc.handle(RPC_CHANNEL, handler, { authority: 'loopback' });
+    const dispose = registerRpcChannel(ctx, RPC_CHANNEL, handler, { authority: 'loopback' }, logger);
     return typeof dispose === 'function' ? dispose : () => {};
   } catch (err) {
     logger?.warn?.(`RPC register with options failed, retrying without: ${err?.message ?? err}`);
     try {
-      const dispose = rpc.handle(RPC_CHANNEL, handler);
+      const dispose = registerRpcChannel(ctx, RPC_CHANNEL, handler, undefined, logger);
       return typeof dispose === 'function' ? dispose : () => {};
     } catch (retryErr) {
-      logger?.error?.(`RPC register failed: ${retryErr?.message ?? retryErr}`);
+      logger?.error?.(`RPC register failed, panel buttons will return 405: ${retryErr?.message ?? retryErr}`);
       return () => {};
     }
   }
@@ -124,6 +117,14 @@ export async function apply(ctx, pluginConfig = {}) {
   };
 
   const gatewayBase = () => normalizeSaasBaseUrl(config.gatewayUrl);
+  const webBase = () => gatewayBase();
+  const currentPublicId = () => config.tunnel?.publicId || tunnel?.tunnel?.publicId || '';
+  const openUrl = () => {
+    const publicId = currentPublicId();
+    return publicId ? `${webBase()}/open/${encodeURIComponent(publicId)}` : '';
+  };
+  const authorizeUrl = (code) => `${webBase()}/device/authorize?code=${encodeURIComponent(code)}`;
+  const pairingPollMs = Math.max(10, Number(pluginConfig.pairingPollMs) || PAIRING_POLL_MS);
 
   const createTunnel = () => new SaasTunnelClient({
     gatewayUrl: gatewayBase(),
@@ -145,7 +146,12 @@ export async function apply(ctx, pluginConfig = {}) {
     }),
     onHelloAck: (ack) => {
       lastError = null;
-      logger?.info?.(`SaaS tunnel ready (publicId=%s)`, ack?.tunnel?.publicId ?? '');
+      // 网关为每条连接随机下发信任密钥：gate 用它验 x-qzsy-gate，验签通过即免本地口令。
+      gate.setGateSecret(ack?.gate?.secret ?? '');
+      if (ack?.tunnel?.publicId && (config.tunnel?.publicId !== ack.tunnel.publicId || config.tunnel?.name !== ack.tunnel.name)) {
+        persist({ tunnel: { publicId: String(ack.tunnel.publicId), name: String(ack.tunnel.name ?? '') } });
+      }
+      logger?.info?.(`SaaS tunnel ready (publicId=%s, gateTrust=%s)`, ack?.tunnel?.publicId ?? '', Boolean(gate.gateSecret));
     },
     onRouteUpdate: ({ routes, rev }) => {
       persist({ routesVersion: rev });
@@ -154,7 +160,10 @@ export async function apply(ctx, pluginConfig = {}) {
     onDrain: () => logger?.warn?.('SaaS tunnel draining by gateway'),
     onDrainComplete: () => { lastError = 'SaaS 网关已下线（drain）'; },
     onStateChange: ({ state, detail }) => {
-      if (state === 'error') lastError = detail;
+      if (state === 'error' || state === 'idle' || state === 'closed' || state === 'reconnecting') {
+        gate.setGateSecret('');
+        if (state === 'error') lastError = detail;
+      }
     },
     logger,
   });
@@ -195,7 +204,13 @@ export async function apply(ctx, pluginConfig = {}) {
             routesVersion: 0,
           });
           clearPairing();
-          if (config.autoStart) await ensureConnected().catch((err) => { lastError = err?.message ?? String(err); });
+          // 无感授权：绑定成功即自动开隧道（面板随即显示二维码），无需再点一次。
+          if (pairing.autoStart !== false) {
+            persist({ autoStart: true });
+            await ensureConnected().catch((err) => { lastError = err?.message ?? String(err); });
+          } else if (config.autoStart) {
+            await ensureConnected().catch((err) => { lastError = err?.message ?? String(err); });
+          }
         } else if (info.status === 'expired' || info.status === 'consumed') {
           pairing.status = info.status;
           clearPairing();
@@ -203,7 +218,7 @@ export async function apply(ctx, pluginConfig = {}) {
       } catch (err) {
         lastError = err?.message ?? String(err);
       }
-    }, PAIRING_POLL_MS);
+    }, pairingPollMs);
     pairingTimer.unref?.();
   };
 
@@ -225,6 +240,7 @@ export async function apply(ctx, pluginConfig = {}) {
         tunnel: config.tunnel ?? null,
       },
       publicUrl,
+      openUrl: openUrl(),
       routes: Array.isArray(tunnel?.routes) ? tunnel.routes : [],
       lastError: lastError || tunnel?.lastError || '',
       proxy: { port: gatePort, host: '127.0.0.1', url: `http://127.0.0.1:${gatePort}` },
@@ -269,8 +285,9 @@ export async function apply(ctx, pluginConfig = {}) {
             code: created.code,
             expiresAt: created.expiresAt ?? null,
             expiresAtMs: created.expiresAtMs ?? null,
-            verificationUrl: created.verificationUrl ?? '',
+            verificationUrl: created.verificationUrl || authorizeUrl(created.code),
             status: 'pending',
+            autoStart: false,
           };
           lastError = null;
           startPairingPoll();
@@ -295,13 +312,46 @@ export async function apply(ctx, pluginConfig = {}) {
           return ok({ deviceId: config.deviceId, tunnel: config.tunnel });
         }
         case RPC_ENDPOINTS.unbindDevice:
+          gate.setGateSecret('');
           await stopTunnel();
           clearPairing();
           pairing = null;
           persist({ deviceId: '', deviceSecret: '', tunnel: null, routesVersion: 0, autoStart: false });
           return ok({ unbound: true });
+        case RPC_ENDPOINTS.startLogin: {
+          const created = await requestDeviceCode({
+            gatewayUrl: gatewayBase(),
+            deviceInfo: buildDeviceInfo({
+              name: hostname(),
+              platform: osPlatform(),
+              hostname: hostname(),
+              arch: osArch(),
+              pluginVersion: VERSION,
+            }),
+          });
+          const verificationUrl = authorizeUrl(created.code);
+          pairing = {
+            code: created.code,
+            expiresAt: created.expiresAt ?? null,
+            expiresAtMs: created.expiresAtMs ?? null,
+            verificationUrl,
+            status: 'pending',
+            autoStart: true,
+          };
+          lastError = null;
+          startPairingPoll();
+          return ok({ code: created.code, verificationUrl, expiresAt: created.expiresAt ?? null });
+        }
+        case RPC_ENDPOINTS.getEntryQr: {
+          const url = openUrl();
+          if (!url) return fail('bad-request', '尚未绑定设备或尚未获得公网隧道');
+          let qrDataUrl = null;
+          try {
+            qrDataUrl = await QRCode.toDataURL(url, { width: 240, margin: 2, color: { dark: '#1F2421', light: '#FFFFFF' } });
+          } catch { qrDataUrl = null; }
+          return ok({ openUrl: url, qrDataUrl });
+        }
         case RPC_ENDPOINTS.startTunnel:
-          if (!gate.passwordConfigured()) return fail('password_not_set', '请先设置访问密码：远程访客需要凭此口令访问');
           persist({ autoStart: payload?.autoStart !== false });
           await ensureConnected();
           return ok(await status());
@@ -342,7 +392,7 @@ export async function apply(ctx, pluginConfig = {}) {
 
   const disposeRpc = registerRpc(ctx, rpcHandler, logger);
 
-  if (config.deviceSecret && config.autoStart && gate.passwordConfigured()) {
+  if (config.deviceSecret && config.autoStart) {
     ensureConnected().catch((err) => { lastError = err?.message ?? String(err); });
   }
 

package/lib/rpc-compat.js

@@ -0,0 +1,46 @@
+// RPC 通道注册兼容层（自研）。
+//
+// 部分 DSH 版本的 connection 服务在注册 RPC 通道时，会在它自己的 ctx 上读取 webServer，
+// 而该 ctx 没有声明 inject，cordis 抛出 `cannot get property "webServer" without inject`。
+// 若不处理，通道注册失败，面板仍能渲染，但所有 RPC 调用在宿主侧得到 HTTP 405。
+//
+// 做法：先走公开的 rpc.handle；仅当抛出上述错误时，在 `internal/get` 事件上临时挂一个
+// 监听器，默认解析失败才补上本插件已 inject 的 webServer 单例，调用结束立即摘除。
+
+const MISSING_INJECT = /without inject/;
+
+export function isMissingWebServerInject(err) {
+  return err instanceof Error && MISSING_INJECT.test(err.message) && /webServer/.test(err.message);
+}
+
+function installFallback(ctx) {
+  const webServer = ctx?.webServer;
+  if (webServer === undefined || typeof ctx.on !== 'function') return () => {};
+  const listener = (lookupCtx, prop, error, next) => {
+    if (prop !== 'webServer') return next();
+    try {
+      return next();
+    } catch (err) {
+      if (err !== error) throw err;
+      return webServer;
+    }
+  };
+  const off = ctx.on('internal/get', listener, { global: true });
+  return typeof off === 'function' ? off : () => {};
+}
+
+export function registerRpcChannel(ctx, channel, handler, options, logger) {
+  const call = () => ctx.connection.rpc.handle(channel, handler, options);
+  try {
+    return call();
+  } catch (err) {
+    if (!isMissingWebServerInject(err)) throw err;
+    logger?.warn?.('connection RPC hit webServer inject regression, retrying with fallback');
+    const off = installFallback(ctx);
+    try {
+      return call();
+    } finally {
+      off();
+    }
+  }
+}

package/lib/saas/tunnel-client.mjs

@@ -7,7 +7,6 @@
 import { WebSocket } from 'ws';
 import { request as httpRequest } from 'node:http';
 import { connect as netConnect } from 'node:net';
-import { randomBytes } from 'node:crypto';
 
 export const SAAS_HEARTBEAT_INTERVAL_MS = 30_000;
 export const SAAS_HEARTBEAT_MAX_MISSED = 3;
@@ -150,6 +149,7 @@ export class SaasTunnelClient {
     this.limits = null;
     this.features = null;
     this.serverTime = null;
+    this.gateSecret = '';
     this._inFlight = new Set();
     this._localWs = new Map();
     this._bytesIn = 0;
@@ -378,6 +378,10 @@ export class SaasTunnelClient {
     if (msg.tunnel) this.tunnel = { publicId: String(msg.tunnel.publicId ?? ''), name: String(msg.tunnel.name ?? '') };
     this.limits = msg.limits ?? null;
     this.features = msg.features ?? null;
+    // 网关为每条控制连接随机下发信任密钥；gate 用它验 x-qzsy-gate 的 HMAC。
+    this.gateSecret = typeof msg.gate?.secret === 'string' && /^[0-9a-f]{64}$/i.test(msg.gate.secret)
+      ? msg.gate.secret.toLowerCase()
+      : '';
     this.serverTime = msg.serverTime ?? null;
     if (this.limits?.heartbeatMs) this.heartbeatIntervalMs = Math.max(10, Number(this.limits.heartbeatMs) || this.heartbeatIntervalMs);
     if (this.limits?.maxResponseBytes) this.maxResponseBytes = Math.max(1024, Number(this.limits.maxResponseBytes) || this.maxResponseBytes);
@@ -425,6 +429,7 @@ export class SaasTunnelClient {
   _finishDrain() {
     if (!this._draining) return;
     this._draining = false;
+    this.gateSecret = '';
     this._suppressReconnect = true;
     if (this._drainTimer) { clearTimeout(this._drainTimer); this._drainTimer = null; }
     this._connected = false;
@@ -687,6 +692,7 @@ export class SaasTunnelClient {
 
   _onClose(code, reason) {
     this._connected = false;
+    this.gateSecret = '';
     this._stopHeartbeat();
     this._cleanupLocalWs();
     this._inFlight.clear();
@@ -743,6 +749,7 @@ export class SaasTunnelClient {
 
   async disconnect() {
     this._manuallyClosed = true;
+    this.gateSecret = '';
     this._draining = false;
     this._connected = false;
     if (this._reconnectTimer) { clearTimeout(this._reconnectTimer); this._reconnectTimer = null; }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@qzsy/dsh-bridge",
-  "version": "3.0.1",
+  "version": "3.1.0",
   "description": "DSH 远程隧道云官方客户端插件：一条命令把本机 DeepSeek Harness 接入云端隧道（设备码绑定、短期令牌、本地门禁代理、HTTP/SSE/WebSocket 反向隧道）。",
-  "releaseNotes": "【v3.0.0】官方客户端插件首个独立实现版本\n• 全新自研代码：插件骨架、本地门禁代理、SaaS 隧道客户端与设置面板均独立实现\n• 设备码绑定 + 短期设备令牌 + v2 控制通道（心跳/路由热更新/drain/终态吊销）\n• 本地门禁：回环免认证、隧道来源用进程内随机密钥标记、局域网访问需本地口令\n• 支持 HTTP / SSE 流式 / WebSocket 转发，公网地址复制与二维码\n• 数据目录 ~/.dsh/qzsy-dsh-bridge，默认本地端口 3092（可配置）",
+  "releaseNotes": "【v3.1.0】无感登录授权与扫码进入\\n• 面板新增「立即登录授权」：自动申请设备码、浏览器授权、绑定后自动开隧道，无需输入设备码或设置本地口令\\n• 新增扫码入口二维码：https://<控制面>/open/<publicId>，扫码登录 SaaS 账号即可进入隧道\\n• 网关信任头 x-qzsy-gate（HMAC-SHA256，±60 秒）：验签通过即免本地口令，未验签隧道来源一律 401\\n• hello-ack 支持 gate.secret 每连接随机下发；改口令/断线自动清理信任密钥\\n• 本地口令降级为可选「高级」局域网能力",
   "type": "module",
   "main": "lib/index.js",
   "exports": {