@shgroup/dsh-serenity-hooks 1.24.5 → 1.24.7

package/lib/index.js

@@ -6831,9 +6831,10 @@ function applyWirePatch(wire) {
 				const pass = a.pass;
 				const totp = a.totpSecret;
 				const totpReset = a.totpReset === true;
-				const totpConfirm = a.totpConfirm;
-				if (typeof totp === "string" && totp !== "") {
-					if (typeof totpConfirm !== "string" || verifyTotpCode(totp, totpConfirm) === null) throw new Error(`Account "${a.user}" TOTP confirmation code invalid — enter the 6-digit code currently shown by the authenticator`);
+				if (typeof totp === "string" && totp !== "") try {
+					base32Decode(totp);
+				} catch {
+					throw new Error(`Account "${a.user}" TOTP secret is not valid base32`);
 				}
 				const nextTotp = totpReset ? void 0 : typeof totp === "string" && totp !== "" ? totp : existing?.totpSecret;
 				const withTotp = {
@@ -7944,23 +7945,6 @@ function registerOpencodeSkills(ctx) {
 	};
 	ctx.skills.registerProvider(() => provider);
 }
-//#endregion
-//#region src/gateway-auth.ts
-/**
-* gateway-auth.ts — F1 双端口网关：认证域纯逻辑（v1.22.4 安全加固）
-*
-* 从 gateway.ts 拆分（S142 熵点治理，v1.22.8）：认证纯逻辑独立成模块——
-* 登录验证（scrypt）/ 会话 token（滑动 TTL + 吊销）/ 失败锁定（账号维度指数退避）/
-* CSRF（双提交 + Origin 校验）/ cookie 解析 / 登录页 HTML。
-* gateway.ts 保留 HTTP 装配（startGateway/registerGateway）并从本模块 import。
-*
-* 纯函数设计（可单测）：无 socket/无 HTTP 依赖，全部导出可注入测试。
-*/
-function verifyGatewayLogin(accounts, user, password) {
-	const account = accounts.find((a) => a.user === user);
-	if (!account) return false;
-	return verifyPassword(password, account.passHash);
-}
 /** 内存会话表（重启即清空——用户决策） */
 const sessions = /* @__PURE__ */ new Map();
 /** 颁发会话 token（Hex 32 字节） */
@@ -8127,13 +8111,13 @@ button:active{background:#2563eb}
 ${csrf ? `<input type="hidden" name="csrf" value="${csrf}">` : ""}
 <label for="f-user">用户名</label>
 <input id="f-user" type="text" name="user" placeholder="用户名" autocomplete="username" autocapitalize="none" autocorrect="off" required autofocus enterkeyhint="next">
-<label for="f-pass">密码</label>
-<input id="f-pass" type="password" name="password" placeholder="密码" autocomplete="current-password" required enterkeyhint="next">
+<label for="f-pass">密码（或下方验证码，二选一）</label>
+<input id="f-pass" type="password" name="password" placeholder="密码" autocomplete="current-password" enterkeyhint="next">
 <label for="f-code">验证码（已绑定 Authenticator 时填写）</label>
 <input id="f-code" type="text" name="code" placeholder="6 位验证码" inputmode="numeric" pattern="[0-9]{6}" maxlength="6" autocomplete="one-time-code" enterkeyhint="go">
 <button type="submit">登录</button>
 <div class="error">${extra}</div>
-<p class="hint">未绑定验证器的账号只需用户名 + 密码</p>
+<p class="hint">已绑定验证器的账号：密码 或 6 位验证码任一即可登录（二选一）</p>
 </form>
 <p class="foot">Serenity ACC · dsh-serenity-hooks</p>
 </div></body></html>`;
@@ -8488,17 +8472,16 @@ function startGateway(config, getAccounts) {
 					res.end(loginPageHtml(`账号已锁定，请 ${Math.ceil(lockedRemaining / 6e4)} 分钟后再试`));
 					return;
 				}
-				const accounts = getAccounts();
-				const account = accounts.find((a) => a.user === user);
-				const passOk = account !== void 0 && verifyGatewayLogin(accounts, user, password);
-				let totpOk = true;
-				if (totpEnabled && passOk && account !== void 0 && typeof account.totpSecret === "string" && account.totpSecret !== "") {
+				const account = getAccounts().find((a) => a.user === user);
+				const passOk = account !== void 0 && password !== "" && verifyPassword(password, account.passHash);
+				let totpOk = false;
+				if (totpEnabled && account !== void 0 && typeof account.totpSecret === "string" && account.totpSecret !== "") {
 					const hit = verifyTotpCode(account.totpSecret, code);
 					totpOk = hit !== null;
 					if (totpOk && hit !== null && lastTotpCounter.get(account.id) === hit) totpOk = false;
 					if (totpOk && hit !== null) lastTotpCounter.set(account.id, hit);
 				}
-				if (passOk && totpOk) {
+				if (passOk || totpOk) {
 					resetFailState(user);
 					const token = issueToken(user);
 					res.writeHead(302, {
@@ -8506,12 +8489,12 @@ function startGateway(config, getAccounts) {
 						"set-cookie": `${cookieName}=${token}; HttpOnly; SameSite=Strict; Path=/${cookieSecure ? "; Secure" : ""}`
 					});
 					res.end();
-					console.log(`[serenity-hooks] 登录成功: user=${user} ip=${remote}`);
+					console.log(`[serenity-hooks] 登录成功: user=${user} ip=${remote} via=${passOk ? "password" : "totp"}`);
 					return;
 				}
 				const lockMs = recordLoginFailure(user);
-				console.warn(`[serenity-hooks] 登录失败: user=${user} ip=${remote} reason=${!passOk ? "bad-password" : "bad-totp"}${lockMs > 0 ? ` 锁定=${Math.ceil(lockMs / 6e4)}min` : ""}`);
-				const msg = lockMs > 0 ? `尝试过多，账号已锁定 ${Math.ceil(lockMs / 6e4)} 分钟` : passOk ? "验证码错误" : "用户名或密码错误";
+				console.warn(`[serenity-hooks] 登录失败: user=${user} ip=${remote}${lockMs > 0 ? ` 锁定=${Math.ceil(lockMs / 6e4)}min` : ""}`);
+				const msg = lockMs > 0 ? `尝试过多，账号已锁定 ${Math.ceil(lockMs / 6e4)} 分钟` : "用户名、密码或验证码错误";
 				res.writeHead(401, { "content-type": "text/html; charset=utf-8" });
 				res.end(loginPageHtml(msg));
 			});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shgroup/dsh-serenity-hooks",
-  "version": "1.24.5",
+  "version": "1.24.7",
   "description": "宁静号 ACC harness — Native Cordis 插件（DeepSeek Harness 运行时）。真实 DSH 工具注册（cc_fs/session/acc_msm 等 9 工具）+ 拦截缝机械约束（safe-mode/路径守卫/会话落盘）+ 系统提示词注入（ACC/CCE/Constraints/SKILL/Session 五块）。适配 DSH 公开版（deepseek-ai/deepseek-harness 0.1.0-rc）。",
   "license": "MIT",
   "repository": {
@@ -55,9 +55,9 @@
     "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.5",
     "@deepseek-ai/dsh-llm": "^0.1.0-rc.5",
     "@deepseek-ai/dsh-session": "^0.1.0-rc.5",
+    "@deepseek-ai/dsh-session-title": "^0.1.0-rc.5",
     "@deepseek-ai/dsh-shell": "^0.1.0-rc.5",
     "@deepseek-ai/dsh-shell-env": "^0.1.0-rc.5",
-    "@deepseek-ai/dsh-session-title": "^0.1.0-rc.5",
     "@deepseek-ai/dsh-skill": "^0.1.0-rc.5",
     "@deepseek-ai/dsh-system-prompt": "^0.1.0-rc.5",
     "@deepseek-ai/dsh-tools": "^0.1.0-rc.5",
@@ -86,11 +86,18 @@
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
+    "@types/qrcode-generator": "^1.0.6",
     "@types/react": "^18.2.0",
+    "qrcode-generator": "^2.0.4",
     "react": "^18.2.0",
     "tsdown": "^0.22.14",
     "typescript": "^5.4.0",
     "unrun": "^0.3.1",
     "vitest": "^1.6.0"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild"
+    ]
   }
 }