@wenbin_wb/dsh-bridge 2.10.0 → 2.10.2

package/CHANGELOG.md

@@ -4,25 +4,37 @@
 
 ---
 
-## [v2.10.0] - 2026-09-01
+## [v2.10.2] - 2026-09-01
+
+### ✨ 新功能
+
+- **外部已部署隧道登记**（issue #25）：自行部署 cloudflared（Docker 等）的用户可在面板登记公网地址，展示二维码与入口，插件不再重复下载管理
+
+### 🐞 修复
+
+- **修复会话列表/历史加载问题**：自建隧道下 session.list 502 修复 + 会话历史载入提速（社区 PR #27）
+
+---
+
+## [v2.10.1] - 2026-09-01
 
-> **本次为远程锁屏/解锁流程修复版**：重点修复远程访问场景下锁屏不显示、解锁后无限循环、会话失效后无法恢复等一连串问题，并新增「管理保护」独立开关与 DSH 宿主版本显示。建议升级前备份 `~/.dsh/dsh-bridge/config.json`。
+### 🧹 说明
 
-### 🔐 远程锁屏/解锁流程修复
+- 无代码变更：修正 npm 包内升级提示（releaseNotes）措辞，与 v2.10.0 发布说明保持一致（仅突出新增功能，不再罗列内部修复细节）。
 
-- **修复解锁后无限锁屏循环**：DSH 重启或访问会话过期后，旧 cookie 失效，所有接口被代理以 HTTP 401 拦截。此前即使管理密码解锁成功（`authAdminUnlock` 已豁免），解锁后 `getStatus` 依旧 401 → 面板把锁重置回 true → 无限循环。现在检测到访问会话失效（HTTP 401 / transport failure）时，**整页重载回绿色图标登录页**重新输入访问密码获取新会话，不再困在锁屏；带防循环保护（重载一次未恢复则提示手动刷新）。
-- **修复锁屏状态下无法解锁（401）**：锁屏时访问会话可能已失效，`authAdminUnlock` 请求此前也被 HTTP 访问认证拦截，导致锁屏永远解不开；现豁免该端点的访问认证（内部仍校验管理密码，安全不受影响）。
-- **修复关闭「访问认证」后锁屏不显示**：锁屏此前依赖访问认证开关，关闭后远程设备不再锁定（管理保护形同虚设）；现管理保护独立生效，关闭访问认证后远程设备仍显示锁屏，仅凭管理密码可解锁。
-- **修复关闭「访问认证」后仍要求密码**：`enabled` 开关豁免管理 gate（否则"关闭访问认证"这个动作本身会被管理保护锁死）。
-- **修复远程首次进入设置页不显示锁屏**：现在远程设备首次进入即显示完整全屏锁屏（输入管理密码后方可操作）。
-- **修复远程目录选择器卡死**：目录浏览被鉴权拦截时内嵌解锁入口，解锁后自动继续；`local_only` 策略下明确提示远程不可解锁。
-- **修复解锁成功后操作丢失**：被拦截的操作暂存队列，解锁成功后自动重放，无需重新点击。
+---
+
+## [v2.10.0] - 2026-09-01
 
 ### ✨ 新功能
 
-- **新增「管理保护」独立开关**：与访问认证解耦的独立安全开关（安全认证页可切换）。关闭后管理操作免 adminToken，与访问认证开关互不干扰。
+- **新增「管理保护」独立开关**：与访问认证解耦的独立安全开关（安全认证页可切换）。此前远程锁屏依附于访问认证开关，关闭访问认证后管理保护随之失效；现在两者完全独立，远程设备的管理权限始终受「管理保护」约束，仅凭管理密码可解锁。
 - **面板显示 DSH 宿主版本**：版本条新增灰色 `DSH vX.Y.Z` 标签（服务端惰性探测 `dsh --version` 并缓存，零轮询开销），与插件版本并排展示。
 
+### 🐞 修复
+
+- 修复远程锁屏/解锁流程的多处问题：会话失效（DSH 重启/过期）后自动跳回登录页重新登录，不再困在锁屏；锁屏状态下可正常输入管理密码解锁；关闭访问认证后锁屏仍生效、且不再误要求密码；远程首次进入设置页即显示全屏锁屏；目录选择器解锁不再卡死。
+
 ### 🧹 内部优化
 
 - 统一 adminToken 缓存为单一来源，删除死代码与重复实现（unlock-manager 未接入 API、组件内冗余 state、重复的 loopback-token 逻辑等）。

package/client/client.js

@@ -963,6 +963,7 @@ var BRIDGE_ENDPOINTS = {
   saveCloudflaredConfig: "saveCloudflaredConfig",
   setTunnelAutoStart: "setTunnelAutoStart",
   saveCustomTunnelConfig: "saveCustomTunnelConfig",
+  saveExternalTunnel: "saveExternalTunnel",
   setLanIp: "setLanIp",
   checkVersion: "checkVersion",
   upgradePlugin: "upgradePlugin",
@@ -1680,6 +1681,74 @@ var CloudflareConfigForm = React.memo(function CloudflareConfigForm2({ token, ho
     )
   );
 });
+var ExternalTunnelCard = React.memo(function ExternalTunnelCard2({ ext, onSave }) {
+  const [urlVal, setUrlVal] = React.useState(ext?.url ?? "");
+  const [saving, setSaving] = React.useState(false);
+  const [msg, setMsg] = React.useState(null);
+  React.useEffect(() => {
+    setUrlVal(ext?.url ?? "");
+  }, [ext?.url]);
+  const handleSave = async (e) => {
+    e.preventDefault();
+    setSaving(true);
+    setMsg(null);
+    try {
+      await onSave(urlVal.trim());
+      setMsg({ ok: true, text: urlVal.trim() ? "\u2713 \u5916\u90E8\u96A7\u9053\u5730\u5740\u5DF2\u767B\u8BB0" : "\u2713 \u5DF2\u6E05\u9664\u767B\u8BB0" });
+    } catch (err) {
+      setMsg({ ok: false, text: err.message || "\u4FDD\u5B58\u5931\u8D25" });
+    } finally {
+      setSaving(false);
+    }
+  };
+  return React.createElement(
+    "div",
+    { style: s.card },
+    React.createElement(
+      "div",
+      { style: { display: "flex", justifyContent: "space-between", alignItems: "flex-start", gap: 10 } },
+      React.createElement(
+        "div",
+        { style: { flex: "1 1 auto", minWidth: 0 } },
+        React.createElement("div", { style: s.label }, "\u5916\u90E8\u5DF2\u90E8\u7F72\u96A7\u9053"),
+        React.createElement(
+          "div",
+          { style: { ...s.muted, marginTop: 2 } },
+          "\u5DF2\u5728 Docker / \u670D\u52A1\u5668\u4E0A\u81EA\u884C\u90E8\u7F72\u96A7\u9053\uFF08\u5982 cloudflared\uFF09\u65F6\uFF0C\u767B\u8BB0\u516C\u7F51\u5730\u5740\u5373\u53EF\u5728\u9762\u677F\u5C55\u793A\u5165\u53E3\u4E0E\u4E8C\u7EF4\u7801\uFF1B\u63D2\u4EF6\u4E0D\u4F1A\u91CD\u590D\u4E0B\u8F7D\u6216\u7BA1\u7406\u8BE5\u96A7\u9053\u3002"
+        )
+      ),
+      React.createElement(StatusTag, { running: Boolean(ext?.configured) })
+    ),
+    ext?.configured && React.createElement(QrBlock, { url: ext?.url, qr: ext?.qr }),
+    React.createElement(
+      "form",
+      { onSubmit: handleSave, style: { marginTop: 10, display: "flex", gap: 8, alignItems: "center", flexWrap: "wrap" } },
+      React.createElement("input", {
+        style: { ...s.input, flex: "1 1 220px", minWidth: 0 },
+        type: "text",
+        placeholder: "https://tunnel.yourdomain.com \u6216 trycloudflare \u5730\u5740",
+        value: urlVal,
+        onChange: (e) => setUrlVal(e.target.value)
+      }),
+      React.createElement("button", {
+        type: "submit",
+        style: { ...s.btnPri, height: 28, fontSize: 12, padding: "0 12px" },
+        disabled: saving
+      }, saving ? "\u4FDD\u5B58\u4E2D\u2026" : "\u4FDD\u5B58"),
+      ext?.configured && React.createElement("button", {
+        type: "button",
+        style: { ...s.btnGhost, height: 28, fontSize: 12, padding: "0 10px" },
+        onClick: () => {
+          setUrlVal("");
+          onSave("");
+        }
+      }, "\u6E05\u9664"),
+      msg && React.createElement("span", {
+        style: { fontSize: 12, color: msg.ok ? "var(--dsw-alias-state-success-primary, #059669)" : "var(--dsw-alias-state-error-primary, #dc2626)" }
+      }, msg.text)
+    )
+  );
+});
 var AccessAuthCard = React.memo(function AccessAuthCard2({ auth, rpcCall, onUpdate }) {
   const [enabled, setEnabled] = React.useState(auth?.enabled ?? false);
   const [mode, setMode] = React.useState(auth?.mode ?? "token_and_password");
@@ -3915,6 +3984,10 @@ function BridgePanel({ rpcCall }) {
     (serverUrl, accessToken) => act(BRIDGE_ENDPOINTS.saveCustomTunnelConfig, { serverUrl, accessToken }),
     [act]
   );
+  const saveExternalTunnel = React.useCallback(
+    (url) => act(BRIDGE_ENDPOINTS.saveExternalTunnel, { url }),
+    [act]
+  );
   const navSecurity = React.useCallback(() => setActiveTab("security"), []);
   if (!status && !err) {
     return React.createElement("div", {
@@ -3948,6 +4021,7 @@ function BridgePanel({ rpcCall }) {
       })
     );
   } else if (activeTab === "tunnel") {
+    const ext = status?.externalTunnel;
     tabContent = React.createElement(
       React.Fragment,
       null,
@@ -3976,6 +4050,10 @@ function BridgePanel({ rpcCall }) {
           onSave: saveCloudflaredConfig
         })
       ),
+      React.createElement(ExternalTunnelCard, {
+        ext,
+        onSave: saveExternalTunnel
+      }),
       React.createElement(
         TunnelCard,
         {

package/client/index.js

@@ -649,6 +649,67 @@ const CloudflareConfigForm = React.memo(function CloudflareConfigForm({ token, h
   );
 });
 
+// 外部已部署隧道登记卡片：用户自行部署（Docker cloudflared / 其他反向代理）时，
+// 插件不下载不管理，仅登记公网地址用于面板展示二维码/URL 与放行 CORS。
+const ExternalTunnelCard = React.memo(function ExternalTunnelCard({ ext, onSave }) {
+  const [urlVal, setUrlVal] = React.useState(ext?.url ?? '');
+  const [saving, setSaving] = React.useState(false);
+  const [msg, setMsg] = React.useState(null);
+
+  React.useEffect(() => {
+    setUrlVal(ext?.url ?? '');
+  }, [ext?.url]);
+
+  const handleSave = async (e) => {
+    e.preventDefault();
+    setSaving(true);
+    setMsg(null);
+    try {
+      await onSave(urlVal.trim());
+      setMsg({ ok: true, text: urlVal.trim() ? '✓ 外部隧道地址已登记' : '✓ 已清除登记' });
+    } catch (err) {
+      setMsg({ ok: false, text: err.message || '保存失败' });
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  return React.createElement('div', { style: s.card },
+    React.createElement('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'flex-start', gap: 10 } },
+      React.createElement('div', { style: { flex: '1 1 auto', minWidth: 0 } },
+        React.createElement('div', { style: s.label }, '外部已部署隧道'),
+        React.createElement('div', { style: { ...s.muted, marginTop: 2 } },
+          '已在 Docker / 服务器上自行部署隧道（如 cloudflared）时，登记公网地址即可在面板展示入口与二维码；插件不会重复下载或管理该隧道。'
+        ),
+      ),
+      React.createElement(StatusTag, { running: Boolean(ext?.configured) }),
+    ),
+    ext?.configured && React.createElement(QrBlock, { url: ext?.url, qr: ext?.qr }),
+    React.createElement('form', { onSubmit: handleSave, style: { marginTop: 10, display: 'flex', gap: 8, alignItems: 'center', flexWrap: 'wrap' } },
+      React.createElement('input', {
+        style: { ...s.input, flex: '1 1 220px', minWidth: 0 },
+        type: 'text',
+        placeholder: 'https://tunnel.yourdomain.com 或 trycloudflare 地址',
+        value: urlVal,
+        onChange: (e) => setUrlVal(e.target.value),
+      }),
+      React.createElement('button', {
+        type: 'submit',
+        style: { ...s.btnPri, height: 28, fontSize: 12, padding: '0 12px' },
+        disabled: saving,
+      }, saving ? '保存中…' : '保存'),
+      ext?.configured && React.createElement('button', {
+        type: 'button',
+        style: { ...s.btnGhost, height: 28, fontSize: 12, padding: '0 10px' },
+        onClick: () => { setUrlVal(''); onSave(''); },
+      }, '清除'),
+      msg && React.createElement('span', {
+        style: { fontSize: 12, color: msg.ok ? 'var(--dsw-alias-state-success-primary, #059669)' : 'var(--dsw-alias-state-error-primary, #dc2626)' },
+      }, msg.text),
+    ),
+  );
+});
+
 // ---- 访问安全认证卡片 ----
 
 const AccessAuthCard = React.memo(function AccessAuthCard({ auth, rpcCall, onUpdate }) {
@@ -2707,6 +2768,10 @@ function BridgePanel({ rpcCall }) {
     act(BRIDGE_ENDPOINTS.saveCustomTunnelConfig, { serverUrl, accessToken })
   , [act]);
 
+  const saveExternalTunnel = React.useCallback((url) =>
+    act(BRIDGE_ENDPOINTS.saveExternalTunnel, { url })
+  , [act]);
+
   const navSecurity = React.useCallback(() => setActiveTab('security'), []);
 
   if (!status && !err) {
@@ -2744,6 +2809,7 @@ function BridgePanel({ rpcCall }) {
       })
     );
   } else if (activeTab === 'tunnel') {
+    const ext = status?.externalTunnel;
     tabContent = React.createElement(React.Fragment, null,
       React.createElement(TunnelCard, {
         title: 'Cloudflare 隧道',
@@ -2770,6 +2836,10 @@ function BridgePanel({ rpcCall }) {
           onSave: saveCloudflaredConfig,
         }),
       ),
+      React.createElement(ExternalTunnelCard, {
+        ext,
+        onSave: saveExternalTunnel,
+      }),
       React.createElement(TunnelCard, {
         title: '自建隧道',
         desc: '连接自己部署的隧道服务器，获得固定域名',

package/docs/release-process.md

@@ -0,0 +1,40 @@
+# 发布流程规则（RELEASE PROCESS）
+
+> 本文件是**发布操作的红线规则**，任何一次对外发布（npm / GitHub Release）都必须遵守。
+
+## 铁律：发布前必须人工确认
+
+**任何版本（正式版 / 补丁版）在推 tag、npm publish、创建 GitHub Release 之前，必须先向仓库所有者（wenbin-wb）确认，得到明确同意后才可执行。**
+
+原因（2026-09-01 教训）：v2.10.0 发布时未先确认就自行完成了 合并 → 打 tag → 推送 → npm publish 全流程，随后发现发布说明措辞需要修订，而 npm 不允许覆盖已发布版本，只能再补 v2.10.1 修正，造成不必要的版本噪音。
+
+### 确认清单（发布前发给所有者）
+
+1. **版本号**：下一个版本号（如 `v2.10.1`）是否认可？
+2. **发布说明（releaseNotes / CHANGELOG）**：内容是否准确？是否只包含用户可感知的变更（新功能、真实修复），不包含开发过程细节？
+3. **发布范围**：npm 发布 + GitHub Release + tag，是否全部执行？
+
+得到「可以发布」的明确回复后，才允许执行发布动作。
+
+## 发布流程
+
+1. **改版本**：`package.json` 的 `version` + `releaseNotes`
+2. **写 CHANGELOG**：`CHANGELOG.md` 顶部新增对应版本条目
+3. **构建与测试**：`npm run build:lark` + `npm run build:client` + `npm run build:banner` + `npm test`（全量 166 项）
+4. **提交**：合并到 `main`（fast-forward），提交信息 `release: vX.Y.Z — ...`
+5. **打 tag**：`git tag vX.Y.Z && git push origin vX.Y.Z`（触发 GitHub Actions 自动创建 Release）
+6. **npm 发布**：`npm publish`（prepack 自动构建产物）
+7. **验证**：npm 线上版本 + GitHub Release body 是否正确
+
+## 发布说明写作规范
+
+- ✅ 只写**用户可感知**的变更：新功能、真实修复（用户报告的问题）
+- ❌ 不写开发过程中自己引入又修复的内部 bug
+- ❌ 不罗列内部重构/清理细节（一句话概括即可）
+- ✅ 修复类条目建议**合并成一条概括**，不逐条展开技术实现
+
+## 注意事项
+
+- npm **不允许覆盖已发布版本**（403）。发布后发现说明要改，只能 bump 补丁版本——所以发布前确认说明尤其重要。
+- `release.yml` workflow 只创建 GitHub Release，npm 发布是手动步骤，不要漏。
+- 发布后如发现问题，走补丁版本（`vX.Y.Z+1`），不要尝试覆盖。

package/lib/bridge-rpc-constants.js

@@ -12,6 +12,7 @@ export const BRIDGE_ENDPOINTS = {
   saveCloudflaredConfig: 'saveCloudflaredConfig',
   setTunnelAutoStart: 'setTunnelAutoStart',
   saveCustomTunnelConfig: 'saveCustomTunnelConfig',
+  saveExternalTunnel: 'saveExternalTunnel',
   setLanIp: 'setLanIp',
   checkVersion: 'checkVersion',
   upgradePlugin: 'upgradePlugin',

package/lib/bridge-rpc.js

@@ -173,6 +173,16 @@ export function installBridgeRpc(ctx, { service, authManager, platformManager, l
           return ok(status);
         }
 
+        if (endpoint === BRIDGE_ENDPOINTS.saveExternalTunnel) {
+          const adminErr = checkAdminAuth(authManager, payload, { requireConfigured: true });
+          if (adminErr) return adminErr;
+
+          const { url } = payload;
+          await service.saveExternalTunnel({ url });
+          const status = await service.getStatus();
+          return ok(status);
+        }
+
         if (endpoint === BRIDGE_ENDPOINTS.setTunnelAutoStart) {
           const adminErr = checkAdminAuth(authManager, payload, { requireConfigured: true });
           if (adminErr) return adminErr;

package/lib/index.js

@@ -556,6 +556,7 @@ class BridgeService {
     this.home = home;
     this.cloudflaredConfig = cloudflaredConfig ?? { token: '', hostname: '', autoStart: false };
     this.customTunnelConfig = customTunnelConfig ?? null;
+    this.externalTunnelConfig = null; // 用户自行部署的外部隧道（Docker cloudflared 等），仅登记公网地址展示
     this.selectedLanIp = lanConfig?.selectedIp ?? null;
     this.authManager = authManager ?? null;
     this.onPersist = onPersist ?? null;
@@ -651,6 +652,7 @@ class BridgeService {
           if (this.selectedLanIp) origins.push(`http://${this.selectedLanIp}:${this.proxyPort}`);
           if (this.cloudflared?.url) origins.push(new URL(this.cloudflared.url).origin);
           if (this.customTunnel?.publicUrl) origins.push(new URL(this.customTunnel.publicUrl).origin);
+          if (this.externalTunnelConfig?.url) origins.push(new URL(this.externalTunnelConfig.url).origin);
         } catch { /* 单项来源解析失败不影响其余 */ }
         return origins;
       },
@@ -739,6 +741,15 @@ class BridgeService {
         autoStart: Boolean(this.customTunnelConfig?.autoStart),
       },
 
+      // 外部已部署隧道（用户自行 Docker/二进制部署，插件仅登记展示）
+      externalTunnel: {
+        configured: !!this.externalTunnelConfig?.url,
+        url: this.externalTunnelConfig?.url ?? '',
+        qr: this.externalTunnelConfig?.url
+          ? await this.qrCache.get(this.externalTunnelConfig.url)
+          : null,
+      },
+
       // 宿主系统运行监控指标
       system: this.getSystemMetrics(),
     };
@@ -755,6 +766,27 @@ class BridgeService {
     await this.onPersist?.({ cloudflared: this.cloudflaredConfig });
   }
 
+  // 登记用户自行部署的外部隧道（Docker cloudflared 等）。插件不下载/不管理该隧道，
+  // 仅保存公网地址用于面板展示二维码/URL 并放行 CORS。url 传空串则清除登记。
+  async saveExternalTunnel({ url } = {}) {
+    const trimmed = url ? String(url).trim() : '';
+    if (trimmed) {
+      // 仅接受 http/https 公网地址，防止注入任意协议或本地路径
+      let normalized;
+      try {
+        const u = new URL(trimmed);
+        if (u.protocol !== 'http:' && u.protocol !== 'https:') throw new Error('仅支持 http/https');
+        normalized = u.toString().replace(/\/+$/, '');
+      } catch {
+        throw new Error('请输入合法的公网隧道地址（https://...）');
+      }
+      this.externalTunnelConfig = { url: normalized };
+    } else {
+      this.externalTunnelConfig = null;
+    }
+    await this.onPersist?.({ externalTunnel: this.externalTunnelConfig });
+  }
+
   async setTunnelAutoStart({ tunnel, autoStart }) {
     const isAuto = Boolean(autoStart);
     if (tunnel === 'cloudflared') {
@@ -1595,6 +1627,9 @@ function apply(ctx, config = {}) {
 
   // 启动时读取已保存的局域网网卡配置与公网隧道配置并按需自动拉起
   loadConfig().then(async (stored) => {
+    if (stored?.externalTunnel) {
+      service.externalTunnelConfig = stored.externalTunnel;
+    }
     if (stored?.lan?.selectedIp) {
       service.selectedLanIp = stored.lan.selectedIp;
       logger.info('dsh-bridge: loaded saved lan config (selectedIp=%s)', service.selectedLanIp);

package/lib/tunnel-client.mjs

@@ -1,426 +1,440 @@
-// DSH Bridge - Custom Tunnel Client
-import { WebSocket } from 'ws';
-import { request as httpRequest } from 'node:http';
-import { connect as netConnect } from 'node:net';
-import { promisify } from 'node:util';
-import { gzip as gzipCallback } from 'node:zlib';
-
-const gzipAsync = promisify(gzipCallback);
-
-const HEARTBEAT_INTERVAL = 30000;
-const RECONNECT_DELAY = 5000;
-const MAX_RECONNECT_ATTEMPTS = 5;
-
-// 单响应内存上限：隧道把整个 body 缓冲进内存再 base64 传输，无上限会在大文件
-// 下载时把进程内存拖垮（一份 body 三份内存：chunks + Buffer + base64 字符串）
-const MAX_RESPONSE_BYTES = 32 * 1024 * 1024; // 32MB
-
-// 大响应 gzip 压缩阈值（超过此大小的可压缩响应将被 gzip）
-const GZIP_THRESHOLD = 102400; // 100KB
-// 可压缩的 content-type 前缀
-const COMPRESSIBLE_TYPES = ['text/', 'application/json', 'application/javascript', 'application/xml'];
-
-export class CustomTunnelClient {
-  constructor({ serverUrl, accessToken, localPort, internalTunnelSecret, signal, onStateChange, logger }) {
-    this.serverUrl = serverUrl;
-    this.accessToken = accessToken;
-    this.localPort = localPort;
-    this.internalTunnelSecret = internalTunnelSecret;
-    this.signal = signal;
-    this.onStateChange = onStateChange;
-    this.logger = logger;
-    this.ws = null;
-    this.publicUrl = null;
-    this.connected = false;
-    this.disconnecting = false;
-    this.reconnectAttempts = 0;
-    this.reconnectTimer = null;
-    this.heartbeatTimer = null;
-    this.localWsSockets = new Map(); // wsId -> net.Socket
-  }
-
-  async connect() {
-    if (this.connected) return;
-    this._setState('connecting', 'Connecting to tunnel server...');
-    try {
-      await this._connectWebSocket();
-      this._startHeartbeat();
-      this.reconnectAttempts = 0;
-      this._setState('ready', 'Tunnel established');
-    } catch (err) {
-      this._setState('error', err.message);
-      throw err;
-    }
-  }
-
-  _connectWebSocket() {
-    return new Promise((resolve, reject) => {
-      if (this.signal?.aborted) return reject(new Error('Aborted'));
-
-      const url = new URL(this.serverUrl);
-      url.searchParams.set('token', this.accessToken);
-
-      this.ws = new WebSocket(url.toString(), {
-        handshakeTimeout: 10000,
-        perMessageDeflate: {
-          clientNoContextTakeover: true,
-          serverNoContextTakeover: true,
-          clientMaxWindowBits: 15,
-          serverMaxWindowBits: 15,
-        },
-      });
-
-      const onAbort = () => { this.ws?.terminate(); reject(new Error('Aborted')); };
-      this.signal?.addEventListener('abort', onAbort);
-
-      this.ws.on('open', () => {
-        this.signal?.removeEventListener('abort', onAbort);
-        this.logger?.info('Tunnel WebSocket connected');
-      });
-
-      this.ws.on('message', (data) => this._handleMessage(data));
-
-      this.ws.on('close', (code, reason) => {
-        this.connected = false;
-        this._stopHeartbeat();
-        this._cleanupLocalWs();
-        if (!this.signal?.aborted) {
-          this.logger?.warn('Tunnel disconnected: code=%d, reason=%s', code, reason.toString());
-          this._scheduleReconnect();
-        }
-      });
-
-      this.ws.on('error', (err) => {
-        this.logger?.error('Tunnel WebSocket error: %s', err.message);
-        if (!this.connected) {
-          this.signal?.removeEventListener('abort', onAbort);
-          reject(err);
-        }
-      });
-
-      const readyHandler = (data) => {
-        try {
-          const msg = JSON.parse(data.toString());
-          if (msg.type === 'ready' && msg.publicUrl) {
-            this.publicUrl = msg.publicUrl;
-            this.connected = true;
-            this.ws.off('message', readyHandler);
-            this.signal?.removeEventListener('abort', onAbort);
-            this.logger?.info('Tunnel ready: %s', this.publicUrl);
-            resolve();
-          }
-        } catch {}
-      };
-      this.ws.on('message', readyHandler);
-
-      setTimeout(() => {
-        if (!this.connected) {
-          this.signal?.removeEventListener('abort', onAbort);
-          this.ws?.terminate();
-          reject(new Error('Connection timeout'));
-        }
-      }, 15000);
-    });
-  }
-
-  _handleMessage(data) {
-    try {
-      const msg = JSON.parse(data.toString());
-      if      (msg.type === 'request')  this._handleHttpRequest(msg);
-      else if (msg.type === 'ws-open')  this._handleWsOpen(msg);
-      else if (msg.type === 'ws-frame') this._handleWsFrame(msg);
-      else if (msg.type === 'ws-close') this._handleWsClose(msg);
-      // pong: ignore
-    } catch (err) {
-      this.logger?.error('Failed to parse tunnel message: %s', err.message);
-    }
-  }
-
-  // ── HTTP 请求代理 ─────────────────────────────────────────────────────────
-  _handleHttpRequest(msg) {
-    const { requestId, method, path, headers } = msg;
-    const SKIP = new Set(['transfer-encoding','connection','keep-alive',
-      'proxy-authenticate','proxy-authorization','te','trailer','upgrade']);
-    const safeHeaders = Object.fromEntries(
-      Object.entries(headers ?? {}).filter(([k]) => !SKIP.has(k.toLowerCase()))
-    );
-
-    const reqHeaders = { ...safeHeaders, host: `127.0.0.1:${this.localPort}` };
-    if (this.internalTunnelSecret) {
-      reqHeaders['x-dsh-internal-tunnel'] = this.internalTunnelSecret;
-    }
-
-    const req = httpRequest({
-      host: '127.0.0.1', port: this.localPort,
-      method, path: path || '/',
-      headers: reqHeaders,
-    }, (res) => {
-      const contentType = String(res.headers['content-type'] ?? '');
-      const isSSE = contentType.includes('text/event-stream');
-      const chunks = [];
-
-      if (isSSE) {
-        // SSE 流式响应：隧道协议不支持流式，收集初始数据后立即返回
-        // 避免 SSE 永不 end 导致隧道服务器超时返回 504
-        let sseSent = false;
-        const sseTimer = setTimeout(() => {
-          if (sseSent) return;
-          sseSent = true;
-          const respHeaders = Object.fromEntries(
-            Object.entries(res.headers).filter(([k]) => !SKIP.has(k.toLowerCase()))
-          );
-          this._sendMessage({
-            type: 'response', requestId,
-            statusCode: res.statusCode, headers: respHeaders,
-            body: Buffer.concat(chunks).toString('base64'),
-          });
-          res.destroy();
-        }, 500);
-
-        res.on('data', (c) => {
-          if (sseSent) return;
-          chunks.push(c);
-          // 收到初始数据后立即发送（不等超时）
-          if (chunks.length >= 2) {
-            clearTimeout(sseTimer);
-            sseSent = true;
-            const respHeaders = Object.fromEntries(
-              Object.entries(res.headers).filter(([k]) => !SKIP.has(k.toLowerCase()))
-            );
-            this._sendMessage({
-              type: 'response', requestId,
-              statusCode: res.statusCode, headers: respHeaders,
-              body: Buffer.concat(chunks).toString('base64'),
-            });
-            res.destroy();
-          }
-        });
-        res.on('error', () => {
-          if (!sseSent) {
-            clearTimeout(sseTimer);
-            this._sendMessage({
-              type: 'response', requestId, statusCode: 502,
-              headers: { 'content-type': 'text/plain' },
-              body: Buffer.from('Response Error').toString('base64'),
-            });
-          }
-        });
-        res.on('end', () => {
-          if (!sseSent) {
-            clearTimeout(sseTimer);
-            sseSent = true;
-            const respHeaders = Object.fromEntries(
-              Object.entries(res.headers).filter(([k]) => !SKIP.has(k.toLowerCase()))
-            );
-            this._sendMessage({
-              type: 'response', requestId,
-              statusCode: res.statusCode, headers: respHeaders,
-              body: Buffer.concat(chunks).toString('base64'),
-            });
-          }
-        });
-        return;
-      }
-
-      let responded = false;
-      const sendResponse = (statusCode, headers, body) => {
-        if (responded) return;
-        responded = true;
-        this._sendMessage({
-          type: 'response', requestId, statusCode, headers,
-          body: Buffer.from(body).toString('base64'),
-        });
-      };
-
-      let total = 0;
-      res.on('data', (c) => {
-        chunks.push(c);
-        total += c.length;
-        if (total > MAX_RESPONSE_BYTES) {
-          sendResponse(502, { 'content-type': 'text/plain' },
-            `Response too large for tunnel (>${Math.round(MAX_RESPONSE_BYTES / 1024 / 1024)}MB cap)`);
-          res.destroy();
-        }
-      });
-      res.on('error', () => {
-        sendResponse(502, { 'content-type': 'text/plain' }, 'Response Error');
-      });
-      res.on('end', () => {
-        if (responded) return;
-        const respHeaders = Object.fromEntries(
-          Object.entries(res.headers).filter(([k]) => !SKIP.has(k.toLowerCase()))
-        );
-        let bodyBuf = Buffer.concat(chunks);
-
-        // session.list 响应可能极大（数百会话 × contextHeaders = 60MB+）
-        // 剥离 contextHeaders 和 contextTimeline（侧边栏列表不需要，打开会话时通过 WebSocket 实时获取）
-        const cleanPath = String(path || '').split('?')[0];
-        if (cleanPath === '/api/session.list' && res.statusCode === 200) {
-          try {
-            const json = JSON.parse(bodyBuf.toString('utf8'));
-            if (json?.result?.ok && json.result.value?.items) {
-              for (const item of json.result.value.items) {
-                const proj = item?.projections?.values;
-                if (proj) {
-                  delete proj.contextHeaders;
-                  delete proj.contextTimeline;
-                }
-              }
-              bodyBuf = Buffer.from(JSON.stringify(json), 'utf8');
-              respHeaders['content-length'] = String(bodyBuf.length);
-            }
-          } catch {} // 解析失败则原样发送
-        }
-
-        // 大响应 gzip 压缩：异步执行，避免 gzipSync 卡住整个事件循环
-        const respCt = String(res.headers['content-type'] ?? '').toLowerCase();
-        const alreadyEncoded = String(res.headers['content-encoding'] ?? '').toLowerCase();
-        const compressible = COMPRESSIBLE_TYPES.some((t) => respCt.startsWith(t));
-        if (bodyBuf.length > GZIP_THRESHOLD && compressible && !alreadyEncoded) {
-          gzipAsync(bodyBuf).then((zipped) => {
-            respHeaders['content-encoding'] = 'gzip';
-            respHeaders['content-length'] = String(zipped.length);
-            sendResponse(res.statusCode, respHeaders, zipped);
-          }).catch(() => {
-            sendResponse(res.statusCode, respHeaders, bodyBuf);
-          });
-          return;
-        }
-
-        sendResponse(res.statusCode, respHeaders, bodyBuf);
-      });
-    });
-    req.on('error', err => {
-      this._sendMessage({ type: 'response', requestId, statusCode: 502,
-        headers: { 'content-type': 'text/plain' },
-        body: Buffer.from(`Bad Gateway: ${err.message}`).toString('base64') });
-    });
-    if (msg.body) req.write(Buffer.from(msg.body, 'base64'));
-    req.end();
-  }
-
-  // ── WebSocket 升级代理 ────────────────────────────────────────────────────
-  // 服务端通知有浏览器要建 WebSocket，用裸 TCP 连本地 DSH 完成握手再转发帧
-  _handleWsOpen(msg) {
-    const { wsId, path, headers } = msg;
-
-    const sock = netConnect({ host: '127.0.0.1', port: this.localPort });
-    this.localWsSockets.set(wsId, sock);
-
-    // 构造 HTTP Upgrade 请求
-    const reqHeaders = { ...headers, host: `127.0.0.1:${this.localPort}` };
-    delete reqHeaders['proxy-connection'];
-    delete reqHeaders['proxy-authorization'];
-    if (this.internalTunnelSecret) {
-      reqHeaders['x-dsh-internal-tunnel'] = this.internalTunnelSecret;
-    }
-
-    const lines = [`GET ${path || '/'} HTTP/1.1`];
-    for (const [k, v] of Object.entries(reqHeaders)) lines.push(`${k}: ${v}`);
-    lines.push('', '');
-    sock.write(lines.join('\r\n'));
-
-    let headerBuf = '';
-    let upgraded = false;
-
-    sock.on('data', (chunk) => {
-      if (upgraded) {
-        this._sendMessage({ type: 'ws-frame', wsId, data: chunk.toString('base64') });
-        return;
-      }
-      headerBuf += chunk.toString('binary');
-      const sep = headerBuf.indexOf('\r\n\r\n');
-      if (sep === -1) return;
-
-      upgraded = true;
-      const replyHeaders = {};
-      const headerLines = headerBuf.slice(0, sep).split('\r\n');
-      for (let i = 1; i < headerLines.length; i++) {
-        const ci = headerLines[i].indexOf(':');
-        if (ci > 0) {
-          replyHeaders[headerLines[i].slice(0, ci).trim().toLowerCase()] =
-            headerLines[i].slice(ci + 1).trim();
-        }
-      }
-      this._sendMessage({ type: 'ws-accept', wsId, replyHeaders });
-
-      // 握手后紧跟的帧数据
-      const rest = headerBuf.slice(sep + 4);
-      if (rest.length > 0) {
-        this._sendMessage({ type: 'ws-frame', wsId, data: Buffer.from(rest, 'binary').toString('base64') });
-      }
-    });
-
-    sock.on('close', () => {
-      this._sendMessage({ type: 'ws-close', wsId });
-      this.localWsSockets.delete(wsId);
-    });
-    sock.on('error', (err) => {
-      this.logger?.error('Local WS socket error wsId=%s: %s', wsId, err.message);
-      this._sendMessage({ type: 'ws-close', wsId });
-      this.localWsSockets.delete(wsId);
-    });
-  }
-
-  _handleWsFrame(msg) {
-    const sock = this.localWsSockets.get(msg.wsId);
-    if (sock && !sock.destroyed) sock.write(Buffer.from(msg.data, 'base64'));
-  }
-
-  _handleWsClose(msg) {
-    const sock = this.localWsSockets.get(msg.wsId);
-    if (sock) { sock.destroy(); this.localWsSockets.delete(msg.wsId); }
-  }
-
-  _cleanupLocalWs() {
-    for (const [, sock] of this.localWsSockets) sock.destroy();
-    this.localWsSockets.clear();
-  }
-
-  // ── 工具方法 ──────────────────────────────────────────────────────────────
-  _sendMessage(msg) {
-    if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(JSON.stringify(msg));
-  }
-
-  _startHeartbeat() {
-    this._stopHeartbeat();
-    this.heartbeatTimer = setInterval(() => {
-      if (this.connected) this._sendMessage({ type: 'ping' });
-    }, HEARTBEAT_INTERVAL);
-  }
-
-  _stopHeartbeat() {
-    if (this.heartbeatTimer) { clearInterval(this.heartbeatTimer); this.heartbeatTimer = null; }
-  }
-
-  _scheduleReconnect() {
-    if (this.signal?.aborted || this.disconnecting) return;
-    if (this.reconnectTimer) return;
-    if (this.reconnectAttempts >= MAX_RECONNECT_ATTEMPTS) {
-      this._setState('error', `Failed to reconnect after ${MAX_RECONNECT_ATTEMPTS} attempts`);
-      return;
-    }
-    this.reconnectAttempts++;
-    const delay = RECONNECT_DELAY * Math.pow(2, this.reconnectAttempts - 1);
-    this._setState('reconnecting', `Reconnecting in ${Math.round(delay / 1000)}s (attempt ${this.reconnectAttempts}/${MAX_RECONNECT_ATTEMPTS})`);
-    this.reconnectTimer = setTimeout(() => {
-      this.reconnectTimer = null;
-      this.connect().catch(() => {});
-    }, delay);
-  }
-
-  _setState(phase, detail) {
-    if (this.onStateChange) this.onStateChange({ phase, detail });
-  }
-
-  disconnect() {
-    this.disconnecting = true;
-    this._stopHeartbeat();
-    this._cleanupLocalWs();
-    if (this.reconnectTimer) { clearTimeout(this.reconnectTimer); this.reconnectTimer = null; }
-    if (this.ws) { this.ws.close(); this.ws = null; }
-    this.connected = false;
-    this.publicUrl = null;
-    this.logger?.info('Tunnel disconnected');
-  }
-}
+// DSH Bridge - Custom Tunnel Client
+import { WebSocket } from 'ws';
+import { request as httpRequest } from 'node:http';
+import { connect as netConnect } from 'node:net';
+import { promisify } from 'node:util';
+import { gzip as gzipCallback } from 'node:zlib';
+
+const gzipAsync = promisify(gzipCallback);
+
+const HEARTBEAT_INTERVAL = 30000;
+const RECONNECT_DELAY = 5000;
+const MAX_RECONNECT_ATTEMPTS = 5;
+
+// 单响应内存上限：隧道把整个 body 缓冲进内存再 base64 传输，无上限会在大文件
+// 下载时把进程内存拖垮（一份 body 三份内存：chunks + Buffer + base64 字符串）
+const MAX_RESPONSE_BYTES = 32 * 1024 * 1024; // 32MB
+
+// 大响应 gzip 压缩阈值（超过此大小的可压缩响应将被 gzip）
+const GZIP_THRESHOLD = 102400; // 100KB
+// 可压缩的 content-type 前缀
+const COMPRESSIBLE_TYPES = ['text/', 'application/json', 'application/javascript', 'application/xml'];
+
+export class CustomTunnelClient {
+  constructor({ serverUrl, accessToken, localPort, internalTunnelSecret, signal, onStateChange, logger }) {
+    this.serverUrl = serverUrl;
+    this.accessToken = accessToken;
+    this.localPort = localPort;
+    this.internalTunnelSecret = internalTunnelSecret;
+    this.signal = signal;
+    this.onStateChange = onStateChange;
+    this.logger = logger;
+    this.ws = null;
+    this.publicUrl = null;
+    this.connected = false;
+    this.disconnecting = false;
+    this.reconnectAttempts = 0;
+    this.reconnectTimer = null;
+    this.heartbeatTimer = null;
+    this.localWsSockets = new Map(); // wsId -> net.Socket
+  }
+
+  async connect() {
+    if (this.connected) return;
+    this._setState('connecting', 'Connecting to tunnel server...');
+    try {
+      await this._connectWebSocket();
+      this._startHeartbeat();
+      this.reconnectAttempts = 0;
+      this._setState('ready', 'Tunnel established');
+    } catch (err) {
+      this._setState('error', err.message);
+      throw err;
+    }
+  }
+
+  _connectWebSocket() {
+    return new Promise((resolve, reject) => {
+      if (this.signal?.aborted) return reject(new Error('Aborted'));
+
+      const url = new URL(this.serverUrl);
+      url.searchParams.set('token', this.accessToken);
+
+      this.ws = new WebSocket(url.toString(), {
+        handshakeTimeout: 10000,
+        perMessageDeflate: {
+          clientNoContextTakeover: true,
+          serverNoContextTakeover: true,
+          clientMaxWindowBits: 15,
+          serverMaxWindowBits: 15,
+        },
+      });
+
+      const onAbort = () => { this.ws?.terminate(); reject(new Error('Aborted')); };
+      this.signal?.addEventListener('abort', onAbort);
+
+      this.ws.on('open', () => {
+        this.signal?.removeEventListener('abort', onAbort);
+        this.logger?.info('Tunnel WebSocket connected');
+      });
+
+      this.ws.on('message', (data) => this._handleMessage(data));
+
+      this.ws.on('close', (code, reason) => {
+        this.connected = false;
+        this._stopHeartbeat();
+        this._cleanupLocalWs();
+        if (!this.signal?.aborted) {
+          this.logger?.warn('Tunnel disconnected: code=%d, reason=%s', code, reason.toString());
+          this._scheduleReconnect();
+        }
+      });
+
+      this.ws.on('error', (err) => {
+        this.logger?.error('Tunnel WebSocket error: %s', err.message);
+        if (!this.connected) {
+          this.signal?.removeEventListener('abort', onAbort);
+          reject(err);
+        }
+      });
+
+      const readyHandler = (data) => {
+        try {
+          const msg = JSON.parse(data.toString());
+          if (msg.type === 'ready' && msg.publicUrl) {
+            this.publicUrl = msg.publicUrl;
+            this.connected = true;
+            this.ws.off('message', readyHandler);
+            this.signal?.removeEventListener('abort', onAbort);
+            this.logger?.info('Tunnel ready: %s', this.publicUrl);
+            resolve();
+          }
+        } catch {}
+      };
+      this.ws.on('message', readyHandler);
+
+      setTimeout(() => {
+        if (!this.connected) {
+          this.signal?.removeEventListener('abort', onAbort);
+          this.ws?.terminate();
+          reject(new Error('Connection timeout'));
+        }
+      }, 15000);
+    });
+  }
+
+  _handleMessage(data) {
+    try {
+      const msg = JSON.parse(data.toString());
+      if      (msg.type === 'request')  this._handleHttpRequest(msg);
+      else if (msg.type === 'ws-open')  this._handleWsOpen(msg);
+      else if (msg.type === 'ws-frame') this._handleWsFrame(msg);
+      else if (msg.type === 'ws-close') this._handleWsClose(msg);
+      // pong: ignore
+    } catch (err) {
+      this.logger?.error('Failed to parse tunnel message: %s', err.message);
+    }
+  }
+
+  // ── HTTP 请求代理 ─────────────────────────────────────────────────────────
+  _handleHttpRequest(msg) {
+    const { requestId, method, path, headers } = msg;
+    const SKIP = new Set(['transfer-encoding','connection','keep-alive',
+      'proxy-authenticate','proxy-authorization','te','trailer','upgrade']);
+    const safeHeaders = Object.fromEntries(
+      Object.entries(headers ?? {}).filter(([k]) => !SKIP.has(k.toLowerCase()))
+    );
+
+    const reqHeaders = { ...safeHeaders, host: `127.0.0.1:${this.localPort}` };
+    if (this.internalTunnelSecret) {
+      reqHeaders['x-dsh-internal-tunnel'] = this.internalTunnelSecret;
+    }
+
+    const req = httpRequest({
+      host: '127.0.0.1', port: this.localPort,
+      method, path: path || '/',
+      headers: reqHeaders,
+    }, (res) => {
+      const contentType = String(res.headers['content-type'] ?? '');
+      const isSSE = contentType.includes('text/event-stream');
+      const chunks = [];
+
+      if (isSSE) {
+        // SSE 流式响应：隧道协议不支持流式，收集初始数据后立即返回
+        // 避免 SSE 永不 end 导致隧道服务器超时返回 504
+        let sseSent = false;
+        const sseTimer = setTimeout(() => {
+          if (sseSent) return;
+          sseSent = true;
+          const respHeaders = Object.fromEntries(
+            Object.entries(res.headers).filter(([k]) => !SKIP.has(k.toLowerCase()))
+          );
+          this._sendMessage({
+            type: 'response', requestId,
+            statusCode: res.statusCode, headers: respHeaders,
+            body: Buffer.concat(chunks).toString('base64'),
+          });
+          res.destroy();
+        }, 500);
+
+        res.on('data', (c) => {
+          if (sseSent) return;
+          chunks.push(c);
+          // 收到初始数据后立即发送（不等超时）
+          if (chunks.length >= 2) {
+            clearTimeout(sseTimer);
+            sseSent = true;
+            const respHeaders = Object.fromEntries(
+              Object.entries(res.headers).filter(([k]) => !SKIP.has(k.toLowerCase()))
+            );
+            this._sendMessage({
+              type: 'response', requestId,
+              statusCode: res.statusCode, headers: respHeaders,
+              body: Buffer.concat(chunks).toString('base64'),
+            });
+            res.destroy();
+          }
+        });
+        res.on('error', () => {
+          if (!sseSent) {
+            clearTimeout(sseTimer);
+            this._sendMessage({
+              type: 'response', requestId, statusCode: 502,
+              headers: { 'content-type': 'text/plain' },
+              body: Buffer.from('Response Error').toString('base64'),
+            });
+          }
+        });
+        res.on('end', () => {
+          if (!sseSent) {
+            clearTimeout(sseTimer);
+            sseSent = true;
+            const respHeaders = Object.fromEntries(
+              Object.entries(res.headers).filter(([k]) => !SKIP.has(k.toLowerCase()))
+            );
+            this._sendMessage({
+              type: 'response', requestId,
+              statusCode: res.statusCode, headers: respHeaders,
+              body: Buffer.concat(chunks).toString('base64'),
+            });
+          }
+        });
+        return;
+      }
+
+      let responded = false;
+      const sendResponse = (statusCode, headers, body) => {
+        if (responded) return;
+        responded = true;
+        this._sendMessage({
+          type: 'response', requestId, statusCode, headers,
+          body: Buffer.from(body).toString('base64'),
+        });
+      };
+
+      let total = 0;
+      const cleanPath = String(path || '').split('?')[0];
+      // session.list 会在 end 后剥离 contextHeaders 等大字段，跳过 data 阶段的大小检查
+      const skipSizeCheck = cleanPath === '/api/session.list';
+      res.on('data', (c) => {
+        chunks.push(c);
+        total += c.length;
+        if (!skipSizeCheck && total > MAX_RESPONSE_BYTES) {
+          sendResponse(502, { 'content-type': 'text/plain' },
+            `Response too large for tunnel (>${Math.round(MAX_RESPONSE_BYTES / 1024 / 1024)}MB cap)`);
+          res.destroy();
+        }
+      });
+      res.on('error', () => {
+        sendResponse(502, { 'content-type': 'text/plain' }, 'Response Error');
+      });
+      res.on('end', () => {
+        if (responded) return;
+        const respHeaders = Object.fromEntries(
+          Object.entries(res.headers).filter(([k]) => !SKIP.has(k.toLowerCase()))
+        );
+        let bodyBuf = Buffer.concat(chunks);
+
+        // 剥离 contextHeaders 和 contextTimeline — 这两个投影字段包含每轮完整
+        // 系统提示+工具定义（4.8MB+），但没有任何客户端 UI 读取它们。
+        // session.list: 数百会话 × contextHeaders = 60MB+
+        // session.history: 单会话 contextHeaders = 4.8MB，占响应 80%+
+        // 剥离后 session.history 从 1.2MB gzip 降到 ~150KB（8x 减少）
+        if ((cleanPath === '/api/session.list' || cleanPath === '/api/session.history') && res.statusCode === 200) {
+          try {
+            const json = JSON.parse(bodyBuf.toString('utf8'));
+            if (json?.result?.ok) {
+              const v = json.result.value;
+              // session.list: items[].projections.values
+              if (v?.items) {
+                for (const item of v.items) {
+                  const proj = item?.projections?.values;
+                  if (proj) {
+                    delete proj.contextHeaders;
+                    delete proj.contextTimeline;
+                  }
+                }
+              }
+              // session.history: projections.values
+              if (v?.projections?.values) {
+                delete v.projections.values.contextHeaders;
+                delete v.projections.values.contextTimeline;
+              }
+              bodyBuf = Buffer.from(JSON.stringify(json), 'utf8');
+              respHeaders['content-length'] = String(bodyBuf.length);
+            }
+          } catch {} // 解析失败则原样发送
+        }
+
+        // 大响应 gzip 压缩：异步执行，避免 gzipSync 卡住整个事件循环
+        const respCt = String(res.headers['content-type'] ?? '').toLowerCase();
+        const alreadyEncoded = String(res.headers['content-encoding'] ?? '').toLowerCase();
+        const compressible = COMPRESSIBLE_TYPES.some((t) => respCt.startsWith(t));
+        if (bodyBuf.length > GZIP_THRESHOLD && compressible && !alreadyEncoded) {
+          gzipAsync(bodyBuf).then((zipped) => {
+            respHeaders['content-encoding'] = 'gzip';
+            respHeaders['content-length'] = String(zipped.length);
+            sendResponse(res.statusCode, respHeaders, zipped);
+          }).catch(() => {
+            sendResponse(res.statusCode, respHeaders, bodyBuf);
+          });
+          return;
+        }
+
+        sendResponse(res.statusCode, respHeaders, bodyBuf);
+      });
+    });
+    req.on('error', err => {
+      this._sendMessage({ type: 'response', requestId, statusCode: 502,
+        headers: { 'content-type': 'text/plain' },
+        body: Buffer.from(`Bad Gateway: ${err.message}`).toString('base64') });
+    });
+    if (msg.body) req.write(Buffer.from(msg.body, 'base64'));
+    req.end();
+  }
+
+  // ── WebSocket 升级代理 ────────────────────────────────────────────────────
+  // 服务端通知有浏览器要建 WebSocket，用裸 TCP 连本地 DSH 完成握手再转发帧
+  _handleWsOpen(msg) {
+    const { wsId, path, headers } = msg;
+
+    const sock = netConnect({ host: '127.0.0.1', port: this.localPort });
+    this.localWsSockets.set(wsId, sock);
+
+    // 构造 HTTP Upgrade 请求
+    const reqHeaders = { ...headers, host: `127.0.0.1:${this.localPort}` };
+    delete reqHeaders['proxy-connection'];
+    delete reqHeaders['proxy-authorization'];
+    if (this.internalTunnelSecret) {
+      reqHeaders['x-dsh-internal-tunnel'] = this.internalTunnelSecret;
+    }
+
+    const lines = [`GET ${path || '/'} HTTP/1.1`];
+    for (const [k, v] of Object.entries(reqHeaders)) lines.push(`${k}: ${v}`);
+    lines.push('', '');
+    sock.write(lines.join('\r\n'));
+
+    let headerBuf = '';
+    let upgraded = false;
+
+    sock.on('data', (chunk) => {
+      if (upgraded) {
+        this._sendMessage({ type: 'ws-frame', wsId, data: chunk.toString('base64') });
+        return;
+      }
+      headerBuf += chunk.toString('binary');
+      const sep = headerBuf.indexOf('\r\n\r\n');
+      if (sep === -1) return;
+
+      upgraded = true;
+      const replyHeaders = {};
+      const headerLines = headerBuf.slice(0, sep).split('\r\n');
+      for (let i = 1; i < headerLines.length; i++) {
+        const ci = headerLines[i].indexOf(':');
+        if (ci > 0) {
+          replyHeaders[headerLines[i].slice(0, ci).trim().toLowerCase()] =
+            headerLines[i].slice(ci + 1).trim();
+        }
+      }
+      this._sendMessage({ type: 'ws-accept', wsId, replyHeaders });
+
+      // 握手后紧跟的帧数据
+      const rest = headerBuf.slice(sep + 4);
+      if (rest.length > 0) {
+        this._sendMessage({ type: 'ws-frame', wsId, data: Buffer.from(rest, 'binary').toString('base64') });
+      }
+    });
+
+    sock.on('close', () => {
+      this._sendMessage({ type: 'ws-close', wsId });
+      this.localWsSockets.delete(wsId);
+    });
+    sock.on('error', (err) => {
+      this.logger?.error('Local WS socket error wsId=%s: %s', wsId, err.message);
+      this._sendMessage({ type: 'ws-close', wsId });
+      this.localWsSockets.delete(wsId);
+    });
+  }
+
+  _handleWsFrame(msg) {
+    const sock = this.localWsSockets.get(msg.wsId);
+    if (sock && !sock.destroyed) sock.write(Buffer.from(msg.data, 'base64'));
+  }
+
+  _handleWsClose(msg) {
+    const sock = this.localWsSockets.get(msg.wsId);
+    if (sock) { sock.destroy(); this.localWsSockets.delete(msg.wsId); }
+  }
+
+  _cleanupLocalWs() {
+    for (const [, sock] of this.localWsSockets) sock.destroy();
+    this.localWsSockets.clear();
+  }
+
+  // ── 工具方法 ──────────────────────────────────────────────────────────────
+  _sendMessage(msg) {
+    if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(JSON.stringify(msg));
+  }
+
+  _startHeartbeat() {
+    this._stopHeartbeat();
+    this.heartbeatTimer = setInterval(() => {
+      if (this.connected) this._sendMessage({ type: 'ping' });
+    }, HEARTBEAT_INTERVAL);
+  }
+
+  _stopHeartbeat() {
+    if (this.heartbeatTimer) { clearInterval(this.heartbeatTimer); this.heartbeatTimer = null; }
+  }
+
+  _scheduleReconnect() {
+    if (this.signal?.aborted || this.disconnecting) return;
+    if (this.reconnectTimer) return;
+    if (this.reconnectAttempts >= MAX_RECONNECT_ATTEMPTS) {
+      this._setState('error', `Failed to reconnect after ${MAX_RECONNECT_ATTEMPTS} attempts`);
+      return;
+    }
+    this.reconnectAttempts++;
+    const delay = RECONNECT_DELAY * Math.pow(2, this.reconnectAttempts - 1);
+    this._setState('reconnecting', `Reconnecting in ${Math.round(delay / 1000)}s (attempt ${this.reconnectAttempts}/${MAX_RECONNECT_ATTEMPTS})`);
+    this.reconnectTimer = setTimeout(() => {
+      this.reconnectTimer = null;
+      this.connect().catch(() => {});
+    }, delay);
+  }
+
+  _setState(phase, detail) {
+    if (this.onStateChange) this.onStateChange({ phase, detail });
+  }
+
+  disconnect() {
+    this.disconnecting = true;
+    this._stopHeartbeat();
+    this._cleanupLocalWs();
+    if (this.reconnectTimer) { clearTimeout(this.reconnectTimer); this.reconnectTimer = null; }
+    if (this.ws) { this.ws.close(); this.ws = null; }
+    this.connected = false;
+    this.publicUrl = null;
+    this.logger?.info('Tunnel disconnected');
+  }
+}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@wenbin_wb/dsh-bridge",
-  "version": "2.10.0",
+  "version": "2.10.2",
   "description": "手机扫码即可在移动端/公网继续用 DeepSeek Harness，人不在电脑前也能接着干。一键局域网二维码、Cloudflare 公网隧道、自建隧道与微信 / QQ / 飞书 / Telegram Bot（多工作区/会话持久化/媒体/卡片审批/流式输出），无需自己搭公网服务器。",
-  "releaseNotes": "【v2.10.0 远程锁屏/解锁流程修复】\n• 🔐 修复解锁后无限锁屏循环：访问会话失效（DSH 重启/过期）时自动跳回绿色登录页重新登录；修复锁屏状态下无法解锁（401）；修复关闭访问认证后锁屏失效 / 仍要求密码；远程首次进入设置页即显示全屏锁屏；目录选择器解锁不再卡死\n• 🆕 新增「管理保护」独立开关（与访问认证解耦）；面板显示 DSH 宿主版本\n• 🧹 统一 adminToken 缓存，清理死代码与重复实现",
+  "releaseNotes": "【v2.10.2】\n• 🆕 外部已部署隧道登记（issue #25）：自行部署 cloudflared（Docker 等）可在面板登记公网地址，展示二维码与入口，插件不再重复下载管理\n• 🐞 修复会话列表/历史加载问题：自建隧道下 session.list 502 修复 + 会话历史载入提速（社区 PR #27）",
   "type": "module",
   "main": "lib/index.js",
   "exports": {