@shgroup/dsh-serenity-hooks 1.26.4 → 1.26.6

package/dsh.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "dsh-serenity-hooks",
-  "version": "1.26.4",
+  "version": "1.26.6",
   "main": "lib/index.js",
   "description": "宁静号 ACC harness（Native Cordis 插件）：真实 DSH 工具 cc_fs/session/acc_msm/eap/neat/cce/handyman/session_rebuild/skiff_admin + 拦截缝机械约束（safe-mode/路径守卫）+ 高级设定面板（双端口网关/账号管理）+ Skiff 认知子集角色（实验性）。适配 DSH 公开版（0.1.0-rc，deepseek-ai/deepseek-harness）。",
   "engines": {

package/lib/client.js

@@ -3263,7 +3263,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region \0sp-css:/home/yh/home/home-serenity/AI_LAB/dsh-serenity-plugin/hooks/dsh-serenity-hooks/src/client/AccountsEditor
-		const css$2 = "/* AccountsEditor — DSH 设置面板「外部访问」区块（v1.22）\n * 与 SettingsSection ss-* 同设计语言：--dsw-alias-* 语义 token，明暗自适应。 */\n\n.ae-root {\n  display: flex;\n  flex-direction: column;\n  gap: 16px;\n  padding: 12px 14px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 12px;\n  font-size: 13px;\n}\n\n.ae-warn {\n  margin: 0;\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-state-warning-fg, #f59e0b);\n  word-break: break-word;\n}\n\n.ae-block {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n}\n\n.ae-title {\n  margin: 0;\n  font-size: 12px;\n  line-height: 18px;\n  font-weight: 600;\n  letter-spacing: 0.02em;\n  text-transform: uppercase;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.ae-desc {\n  margin: 0;\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-label-tertiary);\n  word-break: break-word;\n  overflow-wrap: anywhere;\n}\n\n.ae-note {\n  margin: 0;\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n/* ── 监听设置 / 白名单输入行 ── */\n\n.ae-row {\n  display: flex;\n  align-items: center;\n  gap: 8px;\n}\n\n.ae-label {\n  flex: none;\n  font-size: 12px;\n  font-weight: 500;\n  color: var(--dsw-alias-label-secondary);\n  white-space: nowrap;\n}\n\n.ae-input {\n  flex: 1;\n  min-width: 0;\n  padding: 6px 10px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 8px;\n  background: var(--dsw-alias-bg-module);\n  color: var(--dsw-alias-label-primary);\n  font-size: 13px;\n  outline: none;\n}\n\n.ae-input:focus {\n  border-color: var(--dsw-alias-button-primary-bg, var(--dsw-alias-accent, #3b82f6));\n}\n\n.ae-input::placeholder {\n  color: var(--dsw-alias-label-dimmed);\n}\n\n.ae-input.ae-port {\n  flex: none;\n  width: 76px;\n}\n\n/* ── 账号列表 ── */\n\n.ae-list {\n  display: flex;\n  flex-direction: column;\n  gap: 4px;\n}\n\n.ae-head {\n  display: flex;\n  gap: 8px;\n  font-size: 11px;\n  font-weight: 500;\n  color: var(--dsw-alias-label-dimmed);\n  padding: 0 2px;\n  text-transform: uppercase;\n  letter-spacing: 0.02em;\n}\n\n.ae-item {\n  display: flex;\n  gap: 8px;\n  align-items: center;\n  padding: 6px 2px;\n}\n\n.ae-colUser { flex: 1.2; }\n.ae-colPass { flex: 1.6; }\n.ae-colTotp { flex: 2.2; min-width: 0; }\n.ae-colOp { flex: none; width: 48px; }\n\n/* ── v1.22.4 TOTP 第二因素 ── */\n\n.ae-totpBtn {\n  flex: none;\n  padding: 4px 10px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  background: transparent;\n  color: var(--dsw-alias-label-secondary);\n  font-size: 12px;\n  cursor: pointer;\n  white-space: nowrap;\n}\n\n.ae-totpBtn:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.ae-totpPending {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 6px;\n  align-items: center;\n  min-width: 0;\n}\n\n/* v1.24.6：TOTP 绑定二维码（扫码即录入；scalable SVG，白底保证扫码识别） */\n.ae-totpQr {\n  flex-basis: 100%;\n  display: inline-flex;\n  justify-content: center;\n  padding: 8px;\n  background: #fff;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 8px;\n}\n\n.ae-totpQr svg {\n  width: 132px;\n  height: 132px;\n  display: block;\n}\n\n.ae-totpSecret {\n  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n  font-size: 11px;\n  background: var(--dsw-alias-surface-raised, rgba(0, 0, 0, 0.25));\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 4px;\n  padding: 2px 6px;\n  color: var(--dsw-alias-label-secondary);\n  word-break: break-all;\n}\n\n.ae-totpUri {\n  font-size: 11px;\n  color: var(--dsw-alias-accent, #3b82f6);\n  text-decoration: none;\n}\n\n.ae-totpUri:hover {\n  text-decoration: underline;\n}\n\n/* v1.24.7：绑定提示（去确认码后——扫码或手动录入，保存即绑定） */\n.ae-totpHint {\n  flex-basis: 100%;\n  font-size: 11px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.ae-totpBadge {\n  font-size: 12px;\n  color: var(--dsw-alias-state-warning-fg, #f59e0b);\n}\n\n.ae-totpClear {\n  display: flex;\n  gap: 6px;\n  align-items: center;\n}\n\n.ae-check {\n  display: flex;\n  gap: 8px;\n  align-items: center;\n  font-size: 12px;\n  color: var(--dsw-alias-label-secondary);\n  margin-top: 10px;\n  cursor: pointer;\n}\n\n.ae-check input {\n  accent-color: var(--dsw-alias-accent, #3b82f6);\n}\n\n.ae-del {\n  flex: none;\n  padding: 4px 10px;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 6px;\n  background: transparent;\n  color: var(--dsw-alias-state-danger-fg, #f87171);\n  font-size: 12px;\n  cursor: pointer;\n}\n\n.ae-del:hover {\n  background: var(--dsw-alias-state-danger-bg, rgba(248, 113, 113, 0.12));\n}\n\n.ae-add {\n  align-self: flex-start;\n  padding: 5px 12px;\n  border: 1px dashed var(--dsw-alias-border-l2);\n  border-radius: 8px;\n  background: transparent;\n  color: var(--dsw-alias-label-secondary);\n  font-size: 12px;\n  cursor: pointer;\n}\n\n.ae-add:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.ae-wsSelect {\n  margin-top: 8px;\n  max-width: 100%;\n  cursor: pointer;\n}\n\n/* ── 工作区白名单 chips ── */\n\n.ae-wsList {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 6px;\n}\n\n.ae-wsChip {\n  display: inline-flex;\n  align-items: center;\n  gap: 6px;\n  padding: 3px 8px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 8px;\n  background: var(--dsw-alias-interactive-bg-active, rgba(128, 128, 128, 0.14));\n}\n\n.ae-wsPath {\n  font-size: 12px;\n  color: var(--dsw-alias-label-primary);\n  font-family: var(--ds-font-family-code, monospace);\n  word-break: break-all;\n}\n\n.ae-wsDel {\n  flex: none;\n  width: 18px;\n  height: 18px;\n  border: none;\n  border-radius: 50%;\n  background: transparent;\n  color: var(--dsw-alias-label-dimmed);\n  font-size: 13px;\n  line-height: 1;\n  cursor: pointer;\n}\n\n.ae-wsDel:hover {\n  background: var(--dsw-alias-state-danger-bg, rgba(248, 113, 113, 0.18));\n  color: var(--dsw-alias-state-danger-fg, #f87171);\n}\n\n/* ── 错误 / 操作区 ── */\n\n.ae-error {\n  margin: 0;\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-state-danger-fg, #f87171);\n  word-break: break-word;\n}\n\n.ae-actions {\n  display: flex;\n  justify-content: flex-end;\n  padding-top: 4px;\n  border-top: 1px solid var(--dsw-alias-border-l1);\n}\n\n.ae-save {\n  padding: 7px 24px;\n  border: 0;\n  border-radius: 8px;\n  background: var(--dsw-alias-button-primary-bg, var(--dsw-alias-accent, #3b82f6));\n  color: var(--dsw-alias-button-primary-fg, #fff);\n  font-size: 13px;\n  font-weight: 500;\n  cursor: pointer;\n}\n\n.ae-save:hover:not(:disabled) {\n  filter: brightness(1.08);\n}\n\n.ae-save:disabled {\n  opacity: 0.6;\n  cursor: default;\n}\n\n/* ── v1.26.2 建议问答页配置（PublicAskEditor：开放容器白名单 chips + key/地址展示）── */\n\n.ae-chips {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 6px;\n  margin: 8px 0 4px;\n}\n\n.ae-chip {\n  padding: 4px 12px;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 999px;\n  background: transparent;\n  color: var(--dsw-alias-text-primary);\n  font-size: 12px;\n  cursor: pointer;\n  transition: background 0.15s ease, border-color 0.15s ease;\n}\n\n.ae-chip:hover {\n  border-color: var(--dsw-alias-accent, #0ba875);\n}\n\n.ae-chipOn {\n  background: var(--dsw-alias-accent, #0ba875);\n  border-color: var(--dsw-alias-accent, #0ba875);\n  color: #fff;\n}\n\n.ae-saved {\n  margin-left: 10px;\n  font-size: 12px;\n  color: var(--dsw-alias-state-success-fg, #4ade80);\n}\n\n.ae-err {\n  margin-left: 10px;\n  font-size: 12px;\n  color: var(--dsw-alias-state-danger-fg, #f87171);\n}\n\n.ae-key {\n  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n  font-size: 12px;\n  padding: 2px 8px;\n  border-radius: 6px;\n  background: var(--dsw-alias-bg-l2);\n  color: var(--dsw-alias-text-primary);\n  word-break: break-all;\n  user-select: all;\n}\n\n.ae-copy {\n  flex: none;\n  margin-left: 8px;\n  padding: 3px 10px;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 6px;\n  background: transparent;\n  color: var(--dsw-alias-text-primary);\n  font-size: 12px;\n  cursor: pointer;\n}\n\n.ae-copy:hover {\n  border-color: var(--dsw-alias-accent, #0ba875);\n  color: var(--dsw-alias-accent, #0ba875);\n}\n\n.ae-rows {\n  display: flex;\n  flex-direction: column;\n  gap: 6px;\n  margin-top: 8px;\n}\n\n.ae-labelDim {\n  opacity: 0.65;\n  min-width: 96px;\n}\n";
+		const css$2 = "/* AccountsEditor — DSH 设置面板「外部访问」区块（v1.22）\n * 与 SettingsSection ss-* 同设计语言：--dsw-alias-* 语义 token，明暗自适应。 */\n\n.ae-root {\n  display: flex;\n  flex-direction: column;\n  gap: 16px;\n  padding: 12px 14px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 12px;\n  font-size: 13px;\n}\n\n.ae-warn {\n  margin: 0;\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-state-warning-fg, #f59e0b);\n  word-break: break-word;\n}\n\n.ae-block {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n}\n\n.ae-title {\n  margin: 0;\n  font-size: 12px;\n  line-height: 18px;\n  font-weight: 600;\n  letter-spacing: 0.02em;\n  text-transform: uppercase;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.ae-desc {\n  margin: 0;\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-label-tertiary);\n  word-break: break-word;\n  overflow-wrap: anywhere;\n}\n\n.ae-note {\n  margin: 0;\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n/* ── 监听设置 / 白名单输入行 ── */\n\n.ae-row {\n  display: flex;\n  align-items: center;\n  gap: 8px;\n}\n\n.ae-label {\n  flex: none;\n  font-size: 12px;\n  font-weight: 500;\n  color: var(--dsw-alias-label-secondary);\n  white-space: nowrap;\n}\n\n.ae-input {\n  flex: 1;\n  min-width: 0;\n  padding: 6px 10px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 8px;\n  background: var(--dsw-alias-bg-module);\n  color: var(--dsw-alias-label-primary);\n  font-size: 13px;\n  outline: none;\n}\n\n.ae-input:focus {\n  border-color: var(--dsw-alias-button-primary-bg, var(--dsw-alias-accent, #3b82f6));\n}\n\n.ae-input::placeholder {\n  color: var(--dsw-alias-label-dimmed);\n}\n\n.ae-input.ae-port {\n  flex: none;\n  width: 76px;\n}\n\n/* ── 账号列表 ── */\n\n.ae-list {\n  display: flex;\n  flex-direction: column;\n  gap: 4px;\n}\n\n.ae-head {\n  display: flex;\n  gap: 8px;\n  font-size: 11px;\n  font-weight: 500;\n  color: var(--dsw-alias-label-dimmed);\n  padding: 0 2px;\n  text-transform: uppercase;\n  letter-spacing: 0.02em;\n}\n\n.ae-item {\n  display: flex;\n  gap: 8px;\n  align-items: center;\n  padding: 6px 2px;\n}\n\n.ae-colUser { flex: 1.2; }\n.ae-colPass { flex: 1.6; }\n.ae-colTotp { flex: 2.2; min-width: 0; }\n.ae-colOp { flex: none; width: 48px; }\n\n/* ── v1.22.4 TOTP 第二因素 ── */\n\n.ae-totpBtn {\n  flex: none;\n  padding: 4px 10px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  background: transparent;\n  color: var(--dsw-alias-label-secondary);\n  font-size: 12px;\n  cursor: pointer;\n  white-space: nowrap;\n}\n\n.ae-totpBtn:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.ae-totpPending {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 6px;\n  align-items: center;\n  min-width: 0;\n}\n\n/* v1.24.6：TOTP 绑定二维码（扫码即录入；scalable SVG，白底保证扫码识别） */\n.ae-totpQr {\n  flex-basis: 100%;\n  display: inline-flex;\n  justify-content: center;\n  padding: 8px;\n  background: #fff;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 8px;\n}\n\n.ae-totpQr svg {\n  width: 132px;\n  height: 132px;\n  display: block;\n}\n\n.ae-totpSecret {\n  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n  font-size: 11px;\n  background: var(--dsw-alias-surface-raised, rgba(0, 0, 0, 0.25));\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 4px;\n  padding: 2px 6px;\n  color: var(--dsw-alias-label-secondary);\n  word-break: break-all;\n}\n\n.ae-totpUri {\n  font-size: 11px;\n  color: var(--dsw-alias-accent, #3b82f6);\n  text-decoration: none;\n}\n\n.ae-totpUri:hover {\n  text-decoration: underline;\n}\n\n/* v1.24.7：绑定提示（去确认码后——扫码或手动录入，保存即绑定） */\n.ae-totpHint {\n  flex-basis: 100%;\n  font-size: 11px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.ae-totpBadge {\n  font-size: 12px;\n  color: var(--dsw-alias-state-warning-fg, #f59e0b);\n}\n\n.ae-totpClear {\n  display: flex;\n  gap: 6px;\n  align-items: center;\n}\n\n.ae-check {\n  display: flex;\n  gap: 8px;\n  align-items: center;\n  font-size: 12px;\n  color: var(--dsw-alias-label-secondary);\n  margin-top: 10px;\n  cursor: pointer;\n}\n\n.ae-check input {\n  accent-color: var(--dsw-alias-accent, #3b82f6);\n}\n\n.ae-del {\n  flex: none;\n  padding: 4px 10px;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 6px;\n  background: transparent;\n  color: var(--dsw-alias-state-danger-fg, #f87171);\n  font-size: 12px;\n  cursor: pointer;\n}\n\n.ae-del:hover {\n  background: var(--dsw-alias-state-danger-bg, rgba(248, 113, 113, 0.12));\n}\n\n.ae-add {\n  align-self: flex-start;\n  padding: 5px 12px;\n  border: 1px dashed var(--dsw-alias-border-l2);\n  border-radius: 8px;\n  background: transparent;\n  color: var(--dsw-alias-label-secondary);\n  font-size: 12px;\n  cursor: pointer;\n}\n\n.ae-add:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.ae-wsSelect {\n  margin-top: 8px;\n  max-width: 100%;\n  cursor: pointer;\n}\n\n/* ── 工作区白名单 chips ── */\n\n.ae-wsList {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 6px;\n}\n\n.ae-wsChip {\n  display: inline-flex;\n  align-items: center;\n  gap: 6px;\n  padding: 3px 8px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 8px;\n  background: var(--dsw-alias-interactive-bg-active, rgba(128, 128, 128, 0.14));\n}\n\n.ae-wsPath {\n  font-size: 12px;\n  color: var(--dsw-alias-label-primary);\n  font-family: var(--ds-font-family-code, monospace);\n  word-break: break-all;\n}\n\n.ae-wsDel {\n  flex: none;\n  width: 18px;\n  height: 18px;\n  border: none;\n  border-radius: 50%;\n  background: transparent;\n  color: var(--dsw-alias-label-dimmed);\n  font-size: 13px;\n  line-height: 1;\n  cursor: pointer;\n}\n\n.ae-wsDel:hover {\n  background: var(--dsw-alias-state-danger-bg, rgba(248, 113, 113, 0.18));\n  color: var(--dsw-alias-state-danger-fg, #f87171);\n}\n\n/* ── 错误 / 操作区 ── */\n\n.ae-error {\n  margin: 0;\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-state-danger-fg, #f87171);\n  word-break: break-word;\n}\n\n.ae-actions {\n  display: flex;\n  justify-content: flex-end;\n  padding-top: 4px;\n  border-top: 1px solid var(--dsw-alias-border-l1);\n}\n\n.ae-save {\n  padding: 7px 24px;\n  border: 0;\n  border-radius: 8px;\n  background: var(--dsw-alias-button-primary-bg, var(--dsw-alias-accent, #3b82f6));\n  color: var(--dsw-alias-button-primary-fg, #fff);\n  font-size: 13px;\n  font-weight: 500;\n  cursor: pointer;\n}\n\n.ae-save:hover:not(:disabled) {\n  filter: brightness(1.08);\n}\n\n.ae-save:disabled {\n  opacity: 0.6;\n  cursor: default;\n}\n\n/* ── v1.26.2 建议问答页配置（PublicAskEditor：开放容器白名单 chips + key/地址展示）── */\n\n.ae-chips {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 6px;\n  margin: 8px 0 4px;\n}\n\n.ae-chip {\n  padding: 4px 12px;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 999px;\n  background: transparent;\n  color: var(--dsw-alias-text-primary);\n  font-size: 12px;\n  cursor: pointer;\n  transition: background 0.15s ease, border-color 0.15s ease;\n}\n\n.ae-chip:hover {\n  border-color: var(--dsw-alias-accent, #0ba875);\n}\n\n.ae-chipOn {\n  background: var(--dsw-alias-accent, #0ba875);\n  border-color: var(--dsw-alias-accent, #0ba875);\n  color: #fff;\n}\n\n.ae-saved {\n  margin-left: 10px;\n  font-size: 12px;\n  color: var(--dsw-alias-state-success-fg, #4ade80);\n}\n\n.ae-err {\n  margin-left: 10px;\n  font-size: 12px;\n  color: var(--dsw-alias-state-danger-fg, #f87171);\n}\n\n.ae-key {\n  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n  font-size: 12px;\n  padding: 2px 8px;\n  border-radius: 6px;\n  background: var(--dsw-alias-bg-l2);\n  color: var(--dsw-alias-text-primary);\n  word-break: break-all;\n  user-select: all;\n}\n\n.ae-copy {\n  flex: none;\n  margin-left: 8px;\n  padding: 3px 10px;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 6px;\n  background: transparent;\n  color: var(--dsw-alias-text-primary);\n  font-size: 12px;\n  cursor: pointer;\n}\n\n.ae-copy:hover {\n  border-color: var(--dsw-alias-accent, #0ba875);\n  color: var(--dsw-alias-accent, #0ba875);\n}\n\n/* v1.26.5 轮换 key（警示色：旧 key 立即失效） */\n.ae-rotate {\n  color: var(--dsw-alias-state-danger-fg, #f87171);\n  border-color: rgba(248, 113, 113, 0.35);\n}\n\n.ae-rotate:hover {\n  border-color: var(--dsw-alias-state-danger-fg, #f87171);\n  color: var(--dsw-alias-state-danger-fg, #f87171);\n}\n\n.ae-rotate:disabled {\n  opacity: 0.6;\n  cursor: wait;\n}\n\n.ae-rows {\n  display: flex;\n  flex-direction: column;\n  gap: 6px;\n  margin-top: 8px;\n}\n\n.ae-labelDim {\n  opacity: 0.65;\n  min-width: 96px;\n}\n";
 		if (typeof document !== "undefined" && document.querySelector("style[data-sp-css=\"AccountsEditor\"]") === null) {
 			const tag = document.createElement("style");
 			tag.setAttribute("data-sp-css", "AccountsEditor");
@@ -3841,6 +3841,34 @@ Instruction-following style:
 			const [busy, setBusy] = (0, react.useState)(false);
 			const [error, setError] = (0, react.useState)(null);
 			const [saved, setSaved] = (0, react.useState)(false);
+			const [rotating, setRotating] = (0, react.useState)(false);
+			const rotateKey = async () => {
+				if (!window.confirm("重新生成访问 Key？旧 Key 将立即失效，需要重新分享给使用者。")) return;
+				setRotating(true);
+				setError(null);
+				try {
+					const res = await fetch("/serenity/public-ask", {
+						method: "PUT",
+						headers: {
+							"content-type": "application/json",
+							"x-serenity-ui": "1"
+						},
+						body: JSON.stringify({ action: "rotate" })
+					});
+					if (!res.ok) throw new Error(`轮换失败（${res.status}）`);
+					const body = await res.json();
+					setInfo((cur) => cur ? {
+						...cur,
+						key: body.key
+					} : cur);
+					setSaved(true);
+					setTimeout(() => setSaved(false), 2500);
+				} catch (err) {
+					setError(err instanceof Error ? err.message : String(err));
+				} finally {
+					setRotating(false);
+				}
+			};
 			(0, react.useEffect)(() => {
 				let alive = true;
 				(async () => {
@@ -4003,6 +4031,13 @@ Instruction-following style:
 											navigator.clipboard?.writeText(info.key);
 										},
 										children: "复制"
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										className: "ae-copy ae-rotate",
+										disabled: rotating,
+										onClick: () => void rotateKey(),
+										children: rotating ? "生成中…" : "重新生成"
 									})
 								]
 							}),

package/lib/index.js

@@ -7559,6 +7559,62 @@ function verifyPublicAskKey(provided) {
 	return a.length === b.length && timingSafeEqual(a, b);
 }
 /**
+* 轮换问答页访问 key（v1.26.5，S142 用户：公网开放 + 不好说要换 key 呢）：
+* 生成新 32 字节随机 hex（64 字符）→ 覆盖写回（**强制替换**——旧 key 立即失效）。
+* @returns 新 key（面板展示给管理员，重新分享给使用者）
+*/
+function rotatePublicAskKey() {
+	const current = readAdvancedSettings();
+	const key = randomBytes(32).toString("hex");
+	updateAdvancedSettings({ publicAsk: {
+		key,
+		allowed: current.publicAsk.allowed
+	} });
+	return key;
+}
+/** 首次锁定基础时长（指数退避底数） */
+const PUBLIC_ASK_LOCK_BASE_MS = 9e5;
+/** 锁定上限 */
+const PUBLIC_ASK_LOCK_MAX_MS = 144e5;
+const ipFailStates = /* @__PURE__ */ new Map();
+/** 重置 IP 失败状态（测试/管理员解封） */
+function resetPublicAskIpFail(ip) {
+	ipFailStates.delete(ip);
+}
+/** IP 当前是否锁定（到期自动解锁） */
+function isPublicAskIpLocked(ip) {
+	const st = ipFailStates.get(ip);
+	if (!st || st.lockedUntil === 0) return false;
+	if (Date.now() >= st.lockedUntil) {
+		st.lockedUntil = 0;
+		st.count = 0;
+		return false;
+	}
+	return true;
+}
+/** 记录一次 key 校验失败；达到阈值 → 锁定（指数退避）。返回锁定剩余毫秒（0 = 未锁定） */
+function recordPublicAskFail(ip) {
+	let st = ipFailStates.get(ip);
+	if (!st) {
+		st = {
+			count: 0,
+			lockedUntil: 0,
+			lockRound: 0
+		};
+		ipFailStates.set(ip, st);
+	}
+	if (st.lockedUntil > 0 && Date.now() < st.lockedUntil) return st.lockedUntil - Date.now();
+	st.count += 1;
+	if (st.count >= 5) {
+		const base = PUBLIC_ASK_LOCK_BASE_MS * 2 ** st.lockRound;
+		st.lockedUntil = Date.now() + Math.min(base, PUBLIC_ASK_LOCK_MAX_MS);
+		st.lockRound += 1;
+		st.count = 0;
+		return st.lockedUntil - Date.now();
+	}
+	return 0;
+}
+/**
 * 一次性迁移（v1.21.x → v1.22）：旧版把 `serenityAdvanced` 存在 CCC localstore.json；
 * 新版归 plugin 全局文件。全局文件已存在 → 跳过（幂等）；localstore 无旧节 → 跳过。
 * @param root - CCC 根（localstore.json 所在目录）
@@ -8644,14 +8700,23 @@ function registerStatusApi(ctx, opts = {}) {
 		path: PUBLIC_ASK_PATH,
 		handler: async (req, res) => {
 			try {
-				if (req.method !== "GET") {
-					sendJson$2(res, 405, { error: "method not allowed" });
-					return;
-				}
 				if (req.headers["x-serenity-ui"] !== "1") {
 					sendJson$2(res, 403, { error: "仅限 WebUI（key 属敏感凭据）" });
 					return;
 				}
+				if (req.method === "PUT") {
+					const raw = await readBody$3(req, 16384);
+					if (JSON.parse(raw).action !== "rotate") {
+						sendJson$2(res, 400, { error: "unsupported action (expected \"rotate\")" });
+						return;
+					}
+					sendJson$2(res, 200, { key: rotatePublicAskKey() });
+					return;
+				}
+				if (req.method !== "GET") {
+					sendJson$2(res, 405, { error: "method not allowed" });
+					return;
+				}
 				const settings = readAdvancedSettings();
 				const { readSimpleSettings } = await Promise.resolve().then(() => settings_section_exports);
 				const simple = readSimpleSettings();
@@ -12045,6 +12110,7 @@ async function handle(ctx, defaultRoot, req, res) {
 	try {
 		const url = (req.url ?? "/").split("?")[0] ?? "/";
 		const s = readSimpleSettings();
+		const ip = req.headers["x-forwarded-for"]?.split(",")[0]?.trim() || req.socket.remoteAddress || "unknown";
 		if (req.method === "POST" && url === "/") {
 			if (!s.acpEnabled) {
 				sendJson(res, 403, { error: "ACP JSON-RPC disabled (enable in Serenity settings)" });
@@ -12119,7 +12185,7 @@ async function handle(ctx, defaultRoot, req, res) {
 				sendJson(res, 400, { error: "invalid JSON body" });
 				return;
 			}
-			await handleAskParsed(ctx, ccc, body, res);
+			await handleAskParsed(ctx, ccc, body, res, ip);
 			return;
 		}
 		if (req.method === "POST" && url === "/ask") {
@@ -12148,7 +12214,7 @@ async function handle(ctx, defaultRoot, req, res) {
 				sendJson(res, 403, { error: "container is not open for public ask" });
 				return;
 			}
-			await handleAskParsed(ctx, ccc, body, res);
+			await handleAskParsed(ctx, ccc, body, res, ip);
 			return;
 		}
 		sendJson(res, 404, { error: "not found" });
@@ -12158,14 +12224,22 @@ async function handle(ctx, defaultRoot, req, res) {
 }
 /**
 * 单容器问答核心（/c/<name>/ask 与 /ask 共用）：
-* body { key, role?, question, sessionId? } → key 校验（401）→ 角色缺省取 CCC 第一个
+* body { key, role?, question, sessionId? } → key 校验（401 + IP 失败锁定）→ 角色缺省取 CCC 第一个
 * → 会话延续（v1.25.10 语义，静默新建）→ askSkiff(0 全量轨迹) → { answer, answer_html, sessionId, continued, trajectory }
+* @param ip 请求来源 IP（v1.26.5 公网 key 失败锁定：X-Forwarded-For 优先——公网反代，回退 remoteAddress）
 */
-async function handleAskParsed(ctx, ccc, body, res) {
-	if (!verifyPublicAskKey(typeof body.key === "string" ? body.key : void 0)) {
-		sendJson(res, 401, { error: "invalid or missing key" });
+async function handleAskParsed(ctx, ccc, body, res, ip) {
+	const key = typeof body.key === "string" ? body.key : void 0;
+	if (isPublicAskIpLocked(ip)) {
+		sendJson(res, 429, { error: "too many failed attempts — temporarily locked (retry later)" });
+		return;
+	}
+	if (!verifyPublicAskKey(key)) {
+		const remaining = recordPublicAskFail(ip);
+		sendJson(res, remaining > 0 ? 429 : 401, { error: remaining > 0 ? `too many failed attempts — locked for ${Math.ceil(remaining / 6e4)} min` : "invalid or missing key" });
 		return;
 	}
+	resetPublicAskIpFail(ip);
 	const root = ccc.root;
 	const roleName = typeof body.role === "string" && body.role !== "" ? body.role : void 0;
 	const question = typeof body.question === "string" ? body.question : "";
@@ -12248,6 +12322,11 @@ const ASK_CSS = `
   .card .cmeta { opacity: .6; font-size: 12px; margin-top: 2px; }
   .empty { text-align: center; opacity: .7; padding: 24px 0; }
   .ccname { font-weight: 600; color: var(--sp-green); }
+  /* key 门（v1.26.6：选容器前必填） */
+  .keyGate { display: flex; align-items: center; gap: 8px; margin-bottom: 14px; background: rgba(127,127,127,.06); border: 1px solid rgba(127,127,127,.18); border-radius: 10px; padding: 10px 14px; }
+  .keyGate label { font-size: 12px; opacity: .7; white-space: nowrap; }
+  .keyGate input { flex: 1; border: 1px solid rgba(127,127,127,.25); border-radius: 8px; background: transparent; color: inherit; padding: 8px 12px; font-size: 14px; }
+  .keyGate input:focus { outline: none; border-color: var(--sp-green); }
 
   /* ── 聊天布局（v1.26.4 体验升级：参考 ChatGPT/Claude 会话形态）── */
   .chat { display: flex; flex-direction: column; height: 100vh; max-width: 720px; margin: 0 auto; }
@@ -12291,9 +12370,6 @@ const ASK_CSS = `
   .msg .err { padding: 0 4px; }
   /* 输入区 */
   .chatInput { border-top: 1px solid rgba(127,127,127,.18); padding: 10px 16px calc(12px + env(safe-area-inset-bottom)); background: rgba(127,127,127,.04); }
-  .chatInput .keyRow { display: flex; align-items: center; gap: 8px; margin-bottom: 8px; }
-  .chatInput .keyRow label { font-size: 12px; opacity: .7; white-space: nowrap; }
-  .chatInput .keyRow input { flex: 1; border: 1px solid rgba(127,127,127,.25); border-radius: 8px; background: transparent; color: inherit; padding: 6px 10px; font-size: 13px; }
   .inputRow { display: flex; align-items: flex-end; gap: 8px; }
   .inputRow textarea { flex: 1; border: 1px solid rgba(127,127,127,.25); border-radius: 12px; background: #fff; color: inherit; padding: 10px 12px; font-size: 14px; resize: none; min-height: 44px; max-height: 140px; line-height: 1.5; }
   @media (prefers-color-scheme: dark) { .inputRow textarea { background: #26282c; border-color: #3a3d42; } }
@@ -12302,11 +12378,35 @@ const ASK_CSS = `
   .inputRow .sendBtn:disabled { opacity: .5; cursor: wait; }
   .inputRow .sendBtn:hover:not(:disabled) { background: var(--sp-green-dim); }
   .hint { text-align: center; font-size: 12px; opacity: .55; padding: 20px 0; }
+
+  /* ── 移动端适配（v1.26.6：手机/平板——iOS 防放大 16px / 触控 ≥44px / 100dvh / safe-area）── */
+  @media (max-width: 640px) {
+    main { padding: 20px 16px calc(28px + env(safe-area-inset-bottom)); }
+    .sub { font-size: 14px; margin-bottom: 14px; }
+    .keyGate { flex-wrap: wrap; gap: 6px; }
+    .keyGate input { flex: 1 1 100%; font-size: 16px; padding: 12px 14px; min-height: 48px; } /* 16px 防 iOS 聚焦放大 + 触控 ≥44px */
+    .card { padding: 16px; border-radius: 12px; }
+    .card .cname { font-size: 16px; }
+    .card .cmeta { font-size: 13px; }
+    .chat { height: 100vh; height: 100dvh; } /* dvh：iOS 地址栏收起/展开不跳动 */
+    .chatHead { gap: 8px; padding: 8px 12px calc(8px + env(safe-area-inset-top)); }
+    .chatHead .back { font-size: 14px; padding: 10px 4px; } /* 触控目标 ≥44px */
+    .chatHead .title { font-size: 14px; }
+    .chatHead select { font-size: 16px; padding: 8px 6px; min-height: 44px; } /* 16px 防放大 + 触控 */
+    .chatHead .newBtn { font-size: 14px; padding: 10px 12px; min-height: 44px; }
+    .msgList { padding: 14px 12px calc(20px + env(safe-area-inset-bottom)); gap: 14px; }
+    .msg { max-width: 94%; }
+    .msg .bubble { font-size: 15px; padding: 12px 14px; }
+    .msg .who { font-size: 12px; }
+    .chatInput { padding: 8px 12px calc(10px + env(safe-area-inset-bottom)); }
+    .inputRow textarea { font-size: 16px; padding: 12px 14px; min-height: 48px; } /* 16px 防放大 + 触控 */
+    .inputRow .sendBtn { font-size: 16px; padding: 12px 20px; min-height: 48px; }
+  }
 `;
-/** 容器列表页（v1.26.2）：只列已开放容器，点击进入 /c/<name> */
+/** 容器列表页（v1.26.2 → v1.26.6）：key 在选容器前填写（v1.26.6 用户拍板：不填 key 不让选容器） */
 function publicAskListPage(cccs) {
 	const cards = cccs.map((c) => `
-    <a class="card" href="/c/${encodeURIComponent(c.name)}">
+    <a class="card" data-name="${c.name}" href="/c/${encodeURIComponent(c.name)}">
       <div class="cname">${c.name}</div>
       <div class="cmeta">${c.roles.length} 个问答角色 · 点击进入</div>
     </a>`).join("") || "<div class=\"empty\">暂无可问答的认知容器（管理员尚未开放）</div>";
@@ -12314,20 +12414,46 @@ function publicAskListPage(cccs) {
 <html lang="zh">
 <head>
 <meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
 <title>Serenity Public Ask</title>
 <style>${ASK_CSS}</style>
 </head>
 <body>
 <main>
   <h1>Serenity Public Ask</h1>
-  <div class="sub">选择认知容器开始提问（访问需 key，key 由管理员提供）</div>
-  ${cards}
+  <div class="sub">先填写访问 key，再选择认知容器开始提问</div>
+  <div class="keyGate">
+    <label for="gateKey">访问 Key</label>
+    <input id="gateKey" type="password" placeholder="请输入访问 key（仅本次浏览器记忆）" autocomplete="off" autocapitalize="none" enterkeyhint="done">
+  </div>
+  <div id="cards">${cards}</div>
 </main>
+<script>
+const KEY_STORE = 'serenity-public-ask-key'
+const gateKey = document.getElementById('gateKey')
+const cardList = document.getElementById('cards')
+// 容器卡片（key 未填时禁用——v1.26.6 用户拍板：key 在选容器前填写）
+function applyGate() {
+  const ok = gateKey.value.trim().length > 0
+  for (const card of cardList.querySelectorAll('a.card')) {
+    card.classList.toggle('locked', !ok)
+    card.setAttribute('aria-disabled', ok ? 'false' : 'true')
+    if (!ok) { card.removeAttribute('href'); card.style.pointerEvents = 'none'; card.style.opacity = '.4' }
+    else { card.setAttribute('href', '/c/' + encodeURIComponent(card.dataset.name)); card.style.pointerEvents = ''; card.style.opacity = '' }
+  }
+}
+gateKey.addEventListener('input', applyGate)
+// key 自动从 localStorage 恢复
+let hasSavedKey = false
+try { const saved = localStorage.getItem(KEY_STORE); if (saved) { gateKey.value = saved; hasSavedKey = true } } catch {}
+if (hasSavedKey) gateKey.placeholder = '访问 Key（已记忆，可修改）'
+applyGate()
+gateKey.focus()
+<\/script>
 </body>
 </html>`;
 }
-/** 单容器问答页（v1.26.2→v1.26.4）：URL 锁定容器；聊天 UI——消息流 + 连续对话 + key 自动记忆 */
+/** 单容器问答页（v1.26.2→v1.26.6）：URL 锁定容器；聊天 UI——消息流 + 连续对话 + key 从列表页记忆（v1.26.6 用户拍板：对话页不再填 key） */
 function publicAskContainerPage(ccc) {
 	const data = JSON.stringify({
 		name: ccc.name,
@@ -12338,7 +12464,7 @@ function publicAskContainerPage(ccc) {
 <html lang="zh">
 <head>
 <meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
 <title>Serenity · ${ccc.name}</title>
 <style>${ASK_CSS}</style>
 </head>
@@ -12355,12 +12481,8 @@ function publicAskContainerPage(ccc) {
   <div id="msgs" class="msgList"></div>
 
   <div class="chatInput">
-    <div class="keyRow" id="keyRow">
-      <label for="key">访问 Key</label>
-      <input id="key" type="password" placeholder="请输入访问 key（自动记忆）" autocomplete="off">
-    </div>
     <div class="inputRow">
-      <textarea id="q" placeholder="向 ${ccc.name} 提问…（Enter 发送，Shift+Enter 换行）" rows="1"></textarea>
+      <textarea id="q" placeholder="向 ${ccc.name} 提问…（Enter 发送，Shift+Enter 换行）" rows="1" enterkeyhint="send" autocapitalize="sentences"></textarea>
       <button id="ask" class="sendBtn">发送</button>
     </div>
   </div>
@@ -12369,19 +12491,19 @@ function publicAskContainerPage(ccc) {
 <script>
 const CCC = JSON.parse(document.getElementById('ask-data').textContent)
 const KEY_STORE = 'serenity-public-ask-key'
-const keyInput = document.getElementById('key')
 const roleSel = document.getElementById('role')
 const btn = document.getElementById('ask')
 const msgs = document.getElementById('msgs')
 const qInput = document.getElementById('q')
-const keyRow = document.getElementById('keyRow')
 let sessionId = ''
 let busy = false
 
 // 角色下拉
 roleSel.innerHTML = (CCC.roles || []).map((r) => '<option value="' + r + '">' + r + '</option>').join('') || '<option value="">(无角色)</option>'
-// key 自动从 localStorage 恢复
-try { const saved = localStorage.getItem(KEY_STORE); if (saved) { keyInput.value = saved; keyRow.style.display = 'none' } } catch {}
+// key 从 localStorage 读取（列表页填写时记忆；对话页不填——v1.26.6 用户拍板）
+function getStoredKey() {
+  try { return (localStorage.getItem(KEY_STORE) || '').trim() } catch { return '' }
+}
 
 /** 追加一条消息气泡（role: user|assistant） */
 function addMsg(role, htmlOrText, isHtml) {
@@ -12420,13 +12542,11 @@ function addTyping() {
 
 async function ask() {
   const q = qInput.value.trim()
-  const key = keyInput.value.trim()
+  const key = getStoredKey()
   const role = roleSel.value || undefined
   if (!q) return
-  if (!key) { keyInput.focus(); return }
+  if (!key) { addMsg('assistant', '⚠️ 未找到访问 key，请先回到 <a href="/">容器列表页</a> 填写 key。', true); return }
   if (busy) return
-  // 保存 key（下次自动记忆 + 隐藏 key 行）
-  try { localStorage.setItem(KEY_STORE, key); keyRow.style.display = 'none' } catch {}
   // 追加用户消息 + 打字指示
   addMsg('user', q, false)
   qInput.value = ''

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shgroup/dsh-serenity-hooks",
-  "version": "1.26.4",
+  "version": "1.26.6",
   "description": "宁静号 ACC harness — Native Cordis 插件（DeepSeek Harness 运行时）。真实 DSH 工具注册（cc_fs/session/acc_msm 等 9 工具）+ 拦截缝机械约束（safe-mode/路径守卫/会话落盘）+ 系统提示词注入（ACC/CCE/Constraints/SKILL/Session 五块）。适配 DSH 公开版（deepseek-ai/deepseek-harness 0.1.0-rc）。",
   "license": "MIT",
   "repository": {