@wenbin_wb/dsh-bridge 2.10.1 → 2.10.2

package/CHANGELOG.md

@@ -4,6 +4,18 @@
 
 ---
 
+## [v2.10.2] - 2026-09-01
+
+### ✨ 新功能
+
+- **外部已部署隧道登记**（issue #25）：自行部署 cloudflared（Docker 等）的用户可在面板登记公网地址，展示二维码与入口，插件不再重复下载管理
+
+### 🐞 修复
+
+- **修复会话列表/历史加载问题**：自建隧道下 session.list 502 修复 + 会话历史载入提速（社区 PR #27）
+
+---
+
 ## [v2.10.1] - 2026-09-01
 
 ### 🧹 说明

package/client/client.js

@@ -963,6 +963,7 @@ var BRIDGE_ENDPOINTS = {
   saveCloudflaredConfig: "saveCloudflaredConfig",
   setTunnelAutoStart: "setTunnelAutoStart",
   saveCustomTunnelConfig: "saveCustomTunnelConfig",
+  saveExternalTunnel: "saveExternalTunnel",
   setLanIp: "setLanIp",
   checkVersion: "checkVersion",
   upgradePlugin: "upgradePlugin",
@@ -1680,6 +1681,74 @@ var CloudflareConfigForm = React.memo(function CloudflareConfigForm2({ token, ho
     )
   );
 });
+var ExternalTunnelCard = React.memo(function ExternalTunnelCard2({ ext, onSave }) {
+  const [urlVal, setUrlVal] = React.useState(ext?.url ?? "");
+  const [saving, setSaving] = React.useState(false);
+  const [msg, setMsg] = React.useState(null);
+  React.useEffect(() => {
+    setUrlVal(ext?.url ?? "");
+  }, [ext?.url]);
+  const handleSave = async (e) => {
+    e.preventDefault();
+    setSaving(true);
+    setMsg(null);
+    try {
+      await onSave(urlVal.trim());
+      setMsg({ ok: true, text: urlVal.trim() ? "\u2713 \u5916\u90E8\u96A7\u9053\u5730\u5740\u5DF2\u767B\u8BB0" : "\u2713 \u5DF2\u6E05\u9664\u767B\u8BB0" });
+    } catch (err) {
+      setMsg({ ok: false, text: err.message || "\u4FDD\u5B58\u5931\u8D25" });
+    } finally {
+      setSaving(false);
+    }
+  };
+  return React.createElement(
+    "div",
+    { style: s.card },
+    React.createElement(
+      "div",
+      { style: { display: "flex", justifyContent: "space-between", alignItems: "flex-start", gap: 10 } },
+      React.createElement(
+        "div",
+        { style: { flex: "1 1 auto", minWidth: 0 } },
+        React.createElement("div", { style: s.label }, "\u5916\u90E8\u5DF2\u90E8\u7F72\u96A7\u9053"),
+        React.createElement(
+          "div",
+          { style: { ...s.muted, marginTop: 2 } },
+          "\u5DF2\u5728 Docker / \u670D\u52A1\u5668\u4E0A\u81EA\u884C\u90E8\u7F72\u96A7\u9053\uFF08\u5982 cloudflared\uFF09\u65F6\uFF0C\u767B\u8BB0\u516C\u7F51\u5730\u5740\u5373\u53EF\u5728\u9762\u677F\u5C55\u793A\u5165\u53E3\u4E0E\u4E8C\u7EF4\u7801\uFF1B\u63D2\u4EF6\u4E0D\u4F1A\u91CD\u590D\u4E0B\u8F7D\u6216\u7BA1\u7406\u8BE5\u96A7\u9053\u3002"
+        )
+      ),
+      React.createElement(StatusTag, { running: Boolean(ext?.configured) })
+    ),
+    ext?.configured && React.createElement(QrBlock, { url: ext?.url, qr: ext?.qr }),
+    React.createElement(
+      "form",
+      { onSubmit: handleSave, style: { marginTop: 10, display: "flex", gap: 8, alignItems: "center", flexWrap: "wrap" } },
+      React.createElement("input", {
+        style: { ...s.input, flex: "1 1 220px", minWidth: 0 },
+        type: "text",
+        placeholder: "https://tunnel.yourdomain.com \u6216 trycloudflare \u5730\u5740",
+        value: urlVal,
+        onChange: (e) => setUrlVal(e.target.value)
+      }),
+      React.createElement("button", {
+        type: "submit",
+        style: { ...s.btnPri, height: 28, fontSize: 12, padding: "0 12px" },
+        disabled: saving
+      }, saving ? "\u4FDD\u5B58\u4E2D\u2026" : "\u4FDD\u5B58"),
+      ext?.configured && React.createElement("button", {
+        type: "button",
+        style: { ...s.btnGhost, height: 28, fontSize: 12, padding: "0 10px" },
+        onClick: () => {
+          setUrlVal("");
+          onSave("");
+        }
+      }, "\u6E05\u9664"),
+      msg && React.createElement("span", {
+        style: { fontSize: 12, color: msg.ok ? "var(--dsw-alias-state-success-primary, #059669)" : "var(--dsw-alias-state-error-primary, #dc2626)" }
+      }, msg.text)
+    )
+  );
+});
 var AccessAuthCard = React.memo(function AccessAuthCard2({ auth, rpcCall, onUpdate }) {
   const [enabled, setEnabled] = React.useState(auth?.enabled ?? false);
   const [mode, setMode] = React.useState(auth?.mode ?? "token_and_password");
@@ -3915,6 +3984,10 @@ function BridgePanel({ rpcCall }) {
     (serverUrl, accessToken) => act(BRIDGE_ENDPOINTS.saveCustomTunnelConfig, { serverUrl, accessToken }),
     [act]
   );
+  const saveExternalTunnel = React.useCallback(
+    (url) => act(BRIDGE_ENDPOINTS.saveExternalTunnel, { url }),
+    [act]
+  );
   const navSecurity = React.useCallback(() => setActiveTab("security"), []);
   if (!status && !err) {
     return React.createElement("div", {
@@ -3948,6 +4021,7 @@ function BridgePanel({ rpcCall }) {
       })
     );
   } else if (activeTab === "tunnel") {
+    const ext = status?.externalTunnel;
     tabContent = React.createElement(
       React.Fragment,
       null,
@@ -3976,6 +4050,10 @@ function BridgePanel({ rpcCall }) {
           onSave: saveCloudflaredConfig
         })
       ),
+      React.createElement(ExternalTunnelCard, {
+        ext,
+        onSave: saveExternalTunnel
+      }),
       React.createElement(
         TunnelCard,
         {

package/client/index.js

@@ -649,6 +649,67 @@ const CloudflareConfigForm = React.memo(function CloudflareConfigForm({ token, h
   );
 });
 
+// 外部已部署隧道登记卡片：用户自行部署（Docker cloudflared / 其他反向代理）时，
+// 插件不下载不管理，仅登记公网地址用于面板展示二维码/URL 与放行 CORS。
+const ExternalTunnelCard = React.memo(function ExternalTunnelCard({ ext, onSave }) {
+  const [urlVal, setUrlVal] = React.useState(ext?.url ?? '');
+  const [saving, setSaving] = React.useState(false);
+  const [msg, setMsg] = React.useState(null);
+
+  React.useEffect(() => {
+    setUrlVal(ext?.url ?? '');
+  }, [ext?.url]);
+
+  const handleSave = async (e) => {
+    e.preventDefault();
+    setSaving(true);
+    setMsg(null);
+    try {
+      await onSave(urlVal.trim());
+      setMsg({ ok: true, text: urlVal.trim() ? '✓ 外部隧道地址已登记' : '✓ 已清除登记' });
+    } catch (err) {
+      setMsg({ ok: false, text: err.message || '保存失败' });
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  return React.createElement('div', { style: s.card },
+    React.createElement('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'flex-start', gap: 10 } },
+      React.createElement('div', { style: { flex: '1 1 auto', minWidth: 0 } },
+        React.createElement('div', { style: s.label }, '外部已部署隧道'),
+        React.createElement('div', { style: { ...s.muted, marginTop: 2 } },
+          '已在 Docker / 服务器上自行部署隧道（如 cloudflared）时，登记公网地址即可在面板展示入口与二维码；插件不会重复下载或管理该隧道。'
+        ),
+      ),
+      React.createElement(StatusTag, { running: Boolean(ext?.configured) }),
+    ),
+    ext?.configured && React.createElement(QrBlock, { url: ext?.url, qr: ext?.qr }),
+    React.createElement('form', { onSubmit: handleSave, style: { marginTop: 10, display: 'flex', gap: 8, alignItems: 'center', flexWrap: 'wrap' } },
+      React.createElement('input', {
+        style: { ...s.input, flex: '1 1 220px', minWidth: 0 },
+        type: 'text',
+        placeholder: 'https://tunnel.yourdomain.com 或 trycloudflare 地址',
+        value: urlVal,
+        onChange: (e) => setUrlVal(e.target.value),
+      }),
+      React.createElement('button', {
+        type: 'submit',
+        style: { ...s.btnPri, height: 28, fontSize: 12, padding: '0 12px' },
+        disabled: saving,
+      }, saving ? '保存中…' : '保存'),
+      ext?.configured && React.createElement('button', {
+        type: 'button',
+        style: { ...s.btnGhost, height: 28, fontSize: 12, padding: '0 10px' },
+        onClick: () => { setUrlVal(''); onSave(''); },
+      }, '清除'),
+      msg && React.createElement('span', {
+        style: { fontSize: 12, color: msg.ok ? 'var(--dsw-alias-state-success-primary, #059669)' : 'var(--dsw-alias-state-error-primary, #dc2626)' },
+      }, msg.text),
+    ),
+  );
+});
+
 // ---- 访问安全认证卡片 ----
 
 const AccessAuthCard = React.memo(function AccessAuthCard({ auth, rpcCall, onUpdate }) {
@@ -2707,6 +2768,10 @@ function BridgePanel({ rpcCall }) {
     act(BRIDGE_ENDPOINTS.saveCustomTunnelConfig, { serverUrl, accessToken })
   , [act]);
 
+  const saveExternalTunnel = React.useCallback((url) =>
+    act(BRIDGE_ENDPOINTS.saveExternalTunnel, { url })
+  , [act]);
+
   const navSecurity = React.useCallback(() => setActiveTab('security'), []);
 
   if (!status && !err) {
@@ -2744,6 +2809,7 @@ function BridgePanel({ rpcCall }) {
       })
     );
   } else if (activeTab === 'tunnel') {
+    const ext = status?.externalTunnel;
     tabContent = React.createElement(React.Fragment, null,
       React.createElement(TunnelCard, {
         title: 'Cloudflare 隧道',
@@ -2770,6 +2836,10 @@ function BridgePanel({ rpcCall }) {
           onSave: saveCloudflaredConfig,
         }),
       ),
+      React.createElement(ExternalTunnelCard, {
+        ext,
+        onSave: saveExternalTunnel,
+      }),
       React.createElement(TunnelCard, {
         title: '自建隧道',
         desc: '连接自己部署的隧道服务器，获得固定域名',

package/lib/bridge-rpc-constants.js

@@ -12,6 +12,7 @@ export const BRIDGE_ENDPOINTS = {
   saveCloudflaredConfig: 'saveCloudflaredConfig',
   setTunnelAutoStart: 'setTunnelAutoStart',
   saveCustomTunnelConfig: 'saveCustomTunnelConfig',
+  saveExternalTunnel: 'saveExternalTunnel',
   setLanIp: 'setLanIp',
   checkVersion: 'checkVersion',
   upgradePlugin: 'upgradePlugin',

package/lib/bridge-rpc.js

@@ -173,6 +173,16 @@ export function installBridgeRpc(ctx, { service, authManager, platformManager, l
           return ok(status);
         }
 
+        if (endpoint === BRIDGE_ENDPOINTS.saveExternalTunnel) {
+          const adminErr = checkAdminAuth(authManager, payload, { requireConfigured: true });
+          if (adminErr) return adminErr;
+
+          const { url } = payload;
+          await service.saveExternalTunnel({ url });
+          const status = await service.getStatus();
+          return ok(status);
+        }
+
         if (endpoint === BRIDGE_ENDPOINTS.setTunnelAutoStart) {
           const adminErr = checkAdminAuth(authManager, payload, { requireConfigured: true });
           if (adminErr) return adminErr;

package/lib/index.js

@@ -556,6 +556,7 @@ class BridgeService {
     this.home = home;
     this.cloudflaredConfig = cloudflaredConfig ?? { token: '', hostname: '', autoStart: false };
     this.customTunnelConfig = customTunnelConfig ?? null;
+    this.externalTunnelConfig = null; // 用户自行部署的外部隧道（Docker cloudflared 等），仅登记公网地址展示
     this.selectedLanIp = lanConfig?.selectedIp ?? null;
     this.authManager = authManager ?? null;
     this.onPersist = onPersist ?? null;
@@ -651,6 +652,7 @@ class BridgeService {
           if (this.selectedLanIp) origins.push(`http://${this.selectedLanIp}:${this.proxyPort}`);
           if (this.cloudflared?.url) origins.push(new URL(this.cloudflared.url).origin);
           if (this.customTunnel?.publicUrl) origins.push(new URL(this.customTunnel.publicUrl).origin);
+          if (this.externalTunnelConfig?.url) origins.push(new URL(this.externalTunnelConfig.url).origin);
         } catch { /* 单项来源解析失败不影响其余 */ }
         return origins;
       },
@@ -739,6 +741,15 @@ class BridgeService {
         autoStart: Boolean(this.customTunnelConfig?.autoStart),
       },
 
+      // 外部已部署隧道（用户自行 Docker/二进制部署，插件仅登记展示）
+      externalTunnel: {
+        configured: !!this.externalTunnelConfig?.url,
+        url: this.externalTunnelConfig?.url ?? '',
+        qr: this.externalTunnelConfig?.url
+          ? await this.qrCache.get(this.externalTunnelConfig.url)
+          : null,
+      },
+
       // 宿主系统运行监控指标
       system: this.getSystemMetrics(),
     };
@@ -755,6 +766,27 @@ class BridgeService {
     await this.onPersist?.({ cloudflared: this.cloudflaredConfig });
   }
 
+  // 登记用户自行部署的外部隧道（Docker cloudflared 等）。插件不下载/不管理该隧道，
+  // 仅保存公网地址用于面板展示二维码/URL 并放行 CORS。url 传空串则清除登记。
+  async saveExternalTunnel({ url } = {}) {
+    const trimmed = url ? String(url).trim() : '';
+    if (trimmed) {
+      // 仅接受 http/https 公网地址，防止注入任意协议或本地路径
+      let normalized;
+      try {
+        const u = new URL(trimmed);
+        if (u.protocol !== 'http:' && u.protocol !== 'https:') throw new Error('仅支持 http/https');
+        normalized = u.toString().replace(/\/+$/, '');
+      } catch {
+        throw new Error('请输入合法的公网隧道地址（https://...）');
+      }
+      this.externalTunnelConfig = { url: normalized };
+    } else {
+      this.externalTunnelConfig = null;
+    }
+    await this.onPersist?.({ externalTunnel: this.externalTunnelConfig });
+  }
+
   async setTunnelAutoStart({ tunnel, autoStart }) {
     const isAuto = Boolean(autoStart);
     if (tunnel === 'cloudflared') {
@@ -1595,6 +1627,9 @@ function apply(ctx, config = {}) {
 
   // 启动时读取已保存的局域网网卡配置与公网隧道配置并按需自动拉起
   loadConfig().then(async (stored) => {
+    if (stored?.externalTunnel) {
+      service.externalTunnelConfig = stored.externalTunnel;
+    }
     if (stored?.lan?.selectedIp) {
       service.selectedLanIp = stored.lan.selectedIp;
       logger.info('dsh-bridge: loaded saved lan config (selectedIp=%s)', service.selectedLanIp);

package/lib/tunnel-client.mjs

@@ -1,426 +1,440 @@
-// DSH Bridge - Custom Tunnel Client
-import { WebSocket } from 'ws';
-import { request as httpRequest } from 'node:http';
-import { connect as netConnect } from 'node:net';
-import { promisify } from 'node:util';
-import { gzip as gzipCallback } from 'node:zlib';
-
-const gzipAsync = promisify(gzipCallback);
-
-const HEARTBEAT_INTERVAL = 30000;
-const RECONNECT_DELAY = 5000;
-const MAX_RECONNECT_ATTEMPTS = 5;
-
-// 单响应内存上限：隧道把整个 body 缓冲进内存再 base64 传输，无上限会在大文件
-// 下载时把进程内存拖垮（一份 body 三份内存：chunks + Buffer + base64 字符串）
-const MAX_RESPONSE_BYTES = 32 * 1024 * 1024; // 32MB
-
-// 大响应 gzip 压缩阈值（超过此大小的可压缩响应将被 gzip）
-const GZIP_THRESHOLD = 102400; // 100KB
-// 可压缩的 content-type 前缀
-const COMPRESSIBLE_TYPES = ['text/', 'application/json', 'application/javascript', 'application/xml'];
-
-export class CustomTunnelClient {
-  constructor({ serverUrl, accessToken, localPort, internalTunnelSecret, signal, onStateChange, logger }) {
-    this.serverUrl = serverUrl;
-    this.accessToken = accessToken;
-    this.localPort = localPort;
-    this.internalTunnelSecret = internalTunnelSecret;
-    this.signal = signal;
-    this.onStateChange = onStateChange;
-    this.logger = logger;
-    this.ws = null;
-    this.publicUrl = null;
-    this.connected = false;
-    this.disconnecting = false;
-    this.reconnectAttempts = 0;
-    this.reconnectTimer = null;
-    this.heartbeatTimer = null;
-    this.localWsSockets = new Map(); // wsId -> net.Socket
-  }
-
-  async connect() {
-    if (this.connected) return;
-    this._setState('connecting', 'Connecting to tunnel server...');
-    try {
-      await this._connectWebSocket();
-      this._startHeartbeat();
-      this.reconnectAttempts = 0;
-      this._setState('ready', 'Tunnel established');
-    } catch (err) {
-      this._setState('error', err.message);
-      throw err;
-    }
-  }
-
-  _connectWebSocket() {
-    return new Promise((resolve, reject) => {
-      if (this.signal?.aborted) return reject(new Error('Aborted'));
-
-      const url = new URL(this.serverUrl);
-      url.searchParams.set('token', this.accessToken);
-
-      this.ws = new WebSocket(url.toString(), {
-        handshakeTimeout: 10000,
-        perMessageDeflate: {
-          clientNoContextTakeover: true,
-          serverNoContextTakeover: true,
-          clientMaxWindowBits: 15,
-          serverMaxWindowBits: 15,
-        },
-      });
-
-      const onAbort = () => { this.ws?.terminate(); reject(new Error('Aborted')); };
-      this.signal?.addEventListener('abort', onAbort);
-
-      this.ws.on('open', () => {
-        this.signal?.removeEventListener('abort', onAbort);
-        this.logger?.info('Tunnel WebSocket connected');
-      });
-
-      this.ws.on('message', (data) => this._handleMessage(data));
-
-      this.ws.on('close', (code, reason) => {
-        this.connected = false;
-        this._stopHeartbeat();
-        this._cleanupLocalWs();
-        if (!this.signal?.aborted) {
-          this.logger?.warn('Tunnel disconnected: code=%d, reason=%s', code, reason.toString());
-          this._scheduleReconnect();
-        }
-      });
-
-      this.ws.on('error', (err) => {
-        this.logger?.error('Tunnel WebSocket error: %s', err.message);
-        if (!this.connected) {
-          this.signal?.removeEventListener('abort', onAbort);
-          reject(err);
-        }
-      });
-
-      const readyHandler = (data) => {
-        try {
-          const msg = JSON.parse(data.toString());
-          if (msg.type === 'ready' && msg.publicUrl) {
-            this.publicUrl = msg.publicUrl;
-            this.connected = true;
-            this.ws.off('message', readyHandler);
-            this.signal?.removeEventListener('abort', onAbort);
-            this.logger?.info('Tunnel ready: %s', this.publicUrl);
-            resolve();
-          }
-        } catch {}
-      };
-      this.ws.on('message', readyHandler);
-
-      setTimeout(() => {
-        if (!this.connected) {
-          this.signal?.removeEventListener('abort', onAbort);
-          this.ws?.terminate();
-          reject(new Error('Connection timeout'));
-        }
-      }, 15000);
-    });
-  }
-
-  _handleMessage(data) {
-    try {
-      const msg = JSON.parse(data.toString());
-      if      (msg.type === 'request')  this._handleHttpRequest(msg);
-      else if (msg.type === 'ws-open')  this._handleWsOpen(msg);
-      else if (msg.type === 'ws-frame') this._handleWsFrame(msg);
-      else if (msg.type === 'ws-close') this._handleWsClose(msg);
-      // pong: ignore
-    } catch (err) {
-      this.logger?.error('Failed to parse tunnel message: %s', err.message);
-    }
-  }
-
-  // ── HTTP 请求代理 ─────────────────────────────────────────────────────────
-  _handleHttpRequest(msg) {
-    const { requestId, method, path, headers } = msg;
-    const SKIP = new Set(['transfer-encoding','connection','keep-alive',
-      'proxy-authenticate','proxy-authorization','te','trailer','upgrade']);
-    const safeHeaders = Object.fromEntries(
-      Object.entries(headers ?? {}).filter(([k]) => !SKIP.has(k.toLowerCase()))
-    );
-
-    const reqHeaders = { ...safeHeaders, host: `127.0.0.1:${this.localPort}` };
-    if (this.internalTunnelSecret) {
-      reqHeaders['x-dsh-internal-tunnel'] = this.internalTunnelSecret;
-    }
-
-    const req = httpRequest({
-      host: '127.0.0.1', port: this.localPort,
-      method, path: path || '/',
-      headers: reqHeaders,
-    }, (res) => {
-      const contentType = String(res.headers['content-type'] ?? '');
-      const isSSE = contentType.includes('text/event-stream');
-      const chunks = [];
-
-      if (isSSE) {
-        // SSE 流式响应：隧道协议不支持流式，收集初始数据后立即返回
-        // 避免 SSE 永不 end 导致隧道服务器超时返回 504
-        let sseSent = false;
-        const sseTimer = setTimeout(() => {
-          if (sseSent) return;
-          sseSent = true;
-          const respHeaders = Object.fromEntries(
-            Object.entries(res.headers).filter(([k]) => !SKIP.has(k.toLowerCase()))
-          );
-          this._sendMessage({
-            type: 'response', requestId,
-            statusCode: res.statusCode, headers: respHeaders,
-            body: Buffer.concat(chunks).toString('base64'),
-          });
-          res.destroy();
-        }, 500);
-
-        res.on('data', (c) => {
-          if (sseSent) return;
-          chunks.push(c);
-          // 收到初始数据后立即发送（不等超时）
-          if (chunks.length >= 2) {
-            clearTimeout(sseTimer);
-            sseSent = true;
-            const respHeaders = Object.fromEntries(
-              Object.entries(res.headers).filter(([k]) => !SKIP.has(k.toLowerCase()))
-            );
-            this._sendMessage({
-              type: 'response', requestId,
-              statusCode: res.statusCode, headers: respHeaders,
-              body: Buffer.concat(chunks).toString('base64'),
-            });
-            res.destroy();
-          }
-        });
-        res.on('error', () => {
-          if (!sseSent) {
-            clearTimeout(sseTimer);
-            this._sendMessage({
-              type: 'response', requestId, statusCode: 502,
-              headers: { 'content-type': 'text/plain' },
-              body: Buffer.from('Response Error').toString('base64'),
-            });
-          }
-        });
-        res.on('end', () => {
-          if (!sseSent) {
-            clearTimeout(sseTimer);
-            sseSent = true;
-            const respHeaders = Object.fromEntries(
-              Object.entries(res.headers).filter(([k]) => !SKIP.has(k.toLowerCase()))
-            );
-            this._sendMessage({
-              type: 'response', requestId,
-              statusCode: res.statusCode, headers: respHeaders,
-              body: Buffer.concat(chunks).toString('base64'),
-            });
-          }
-        });
-        return;
-      }
-
-      let responded = false;
-      const sendResponse = (statusCode, headers, body) => {
-        if (responded) return;
-        responded = true;
-        this._sendMessage({
-          type: 'response', requestId, statusCode, headers,
-          body: Buffer.from(body).toString('base64'),
-        });
-      };
-
-      let total = 0;
-      res.on('data', (c) => {
-        chunks.push(c);
-        total += c.length;
-        if (total > MAX_RESPONSE_BYTES) {
-          sendResponse(502, { 'content-type': 'text/plain' },
-            `Response too large for tunnel (>${Math.round(MAX_RESPONSE_BYTES / 1024 / 1024)}MB cap)`);
-          res.destroy();
-        }
-      });
-      res.on('error', () => {
-        sendResponse(502, { 'content-type': 'text/plain' }, 'Response Error');
-      });
-      res.on('end', () => {
-        if (responded) return;
-        const respHeaders = Object.fromEntries(
-          Object.entries(res.headers).filter(([k]) => !SKIP.has(k.toLowerCase()))
-        );
-        let bodyBuf = Buffer.concat(chunks);
-
-        // session.list 响应可能极大（数百会话 × contextHeaders = 60MB+）
-        // 剥离 contextHeaders 和 contextTimeline（侧边栏列表不需要，打开会话时通过 WebSocket 实时获取）
-        const cleanPath = String(path || '').split('?')[0];
-        if (cleanPath === '/api/session.list' && res.statusCode === 200) {
-          try {
-            const json = JSON.parse(bodyBuf.toString('utf8'));
-            if (json?.result?.ok && json.result.value?.items) {
-              for (const item of json.result.value.items) {
-                const proj = item?.projections?.values;
-                if (proj) {
-                  delete proj.contextHeaders;
-                  delete proj.contextTimeline;
-                }
-              }
-              bodyBuf = Buffer.from(JSON.stringify(json), 'utf8');
-              respHeaders['content-length'] = String(bodyBuf.length);
-            }
-          } catch {} // 解析失败则原样发送
-        }
-
-        // 大响应 gzip 压缩：异步执行，避免 gzipSync 卡住整个事件循环
-        const respCt = String(res.headers['content-type'] ?? '').toLowerCase();
-        const alreadyEncoded = String(res.headers['content-encoding'] ?? '').toLowerCase();
-        const compressible = COMPRESSIBLE_TYPES.some((t) => respCt.startsWith(t));
-        if (bodyBuf.length > GZIP_THRESHOLD && compressible && !alreadyEncoded) {
-          gzipAsync(bodyBuf).then((zipped) => {
-            respHeaders['content-encoding'] = 'gzip';
-            respHeaders['content-length'] = String(zipped.length);
-            sendResponse(res.statusCode, respHeaders, zipped);
-          }).catch(() => {
-            sendResponse(res.statusCode, respHeaders, bodyBuf);
-          });
-          return;
-        }
-
-        sendResponse(res.statusCode, respHeaders, bodyBuf);
-      });
-    });
-    req.on('error', err => {
-      this._sendMessage({ type: 'response', requestId, statusCode: 502,
-        headers: { 'content-type': 'text/plain' },
-        body: Buffer.from(`Bad Gateway: ${err.message}`).toString('base64') });
-    });
-    if (msg.body) req.write(Buffer.from(msg.body, 'base64'));
-    req.end();
-  }
-
-  // ── WebSocket 升级代理 ────────────────────────────────────────────────────
-  // 服务端通知有浏览器要建 WebSocket，用裸 TCP 连本地 DSH 完成握手再转发帧
-  _handleWsOpen(msg) {
-    const { wsId, path, headers } = msg;
-
-    const sock = netConnect({ host: '127.0.0.1', port: this.localPort });
-    this.localWsSockets.set(wsId, sock);
-
-    // 构造 HTTP Upgrade 请求
-    const reqHeaders = { ...headers, host: `127.0.0.1:${this.localPort}` };
-    delete reqHeaders['proxy-connection'];
-    delete reqHeaders['proxy-authorization'];
-    if (this.internalTunnelSecret) {
-      reqHeaders['x-dsh-internal-tunnel'] = this.internalTunnelSecret;
-    }
-
-    const lines = [`GET ${path || '/'} HTTP/1.1`];
-    for (const [k, v] of Object.entries(reqHeaders)) lines.push(`${k}: ${v}`);
-    lines.push('', '');
-    sock.write(lines.join('\r\n'));
-
-    let headerBuf = '';
-    let upgraded = false;
-
-    sock.on('data', (chunk) => {
-      if (upgraded) {
-        this._sendMessage({ type: 'ws-frame', wsId, data: chunk.toString('base64') });
-        return;
-      }
-      headerBuf += chunk.toString('binary');
-      const sep = headerBuf.indexOf('\r\n\r\n');
-      if (sep === -1) return;
-
-      upgraded = true;
-      const replyHeaders = {};
-      const headerLines = headerBuf.slice(0, sep).split('\r\n');
-      for (let i = 1; i < headerLines.length; i++) {
-        const ci = headerLines[i].indexOf(':');
-        if (ci > 0) {
-          replyHeaders[headerLines[i].slice(0, ci).trim().toLowerCase()] =
-            headerLines[i].slice(ci + 1).trim();
-        }
-      }
-      this._sendMessage({ type: 'ws-accept', wsId, replyHeaders });
-
-      // 握手后紧跟的帧数据
-      const rest = headerBuf.slice(sep + 4);
-      if (rest.length > 0) {
-        this._sendMessage({ type: 'ws-frame', wsId, data: Buffer.from(rest, 'binary').toString('base64') });
-      }
-    });
-
-    sock.on('close', () => {
-      this._sendMessage({ type: 'ws-close', wsId });
-      this.localWsSockets.delete(wsId);
-    });
-    sock.on('error', (err) => {
-      this.logger?.error('Local WS socket error wsId=%s: %s', wsId, err.message);
-      this._sendMessage({ type: 'ws-close', wsId });
-      this.localWsSockets.delete(wsId);
-    });
-  }
-
-  _handleWsFrame(msg) {
-    const sock = this.localWsSockets.get(msg.wsId);
-    if (sock && !sock.destroyed) sock.write(Buffer.from(msg.data, 'base64'));
-  }
-
-  _handleWsClose(msg) {
-    const sock = this.localWsSockets.get(msg.wsId);
-    if (sock) { sock.destroy(); this.localWsSockets.delete(msg.wsId); }
-  }
-
-  _cleanupLocalWs() {
-    for (const [, sock] of this.localWsSockets) sock.destroy();
-    this.localWsSockets.clear();
-  }
-
-  // ── 工具方法 ──────────────────────────────────────────────────────────────
-  _sendMessage(msg) {
-    if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(JSON.stringify(msg));
-  }
-
-  _startHeartbeat() {
-    this._stopHeartbeat();
-    this.heartbeatTimer = setInterval(() => {
-      if (this.connected) this._sendMessage({ type: 'ping' });
-    }, HEARTBEAT_INTERVAL);
-  }
-
-  _stopHeartbeat() {
-    if (this.heartbeatTimer) { clearInterval(this.heartbeatTimer); this.heartbeatTimer = null; }
-  }
-
-  _scheduleReconnect() {
-    if (this.signal?.aborted || this.disconnecting) return;
-    if (this.reconnectTimer) return;
-    if (this.reconnectAttempts >= MAX_RECONNECT_ATTEMPTS) {
-      this._setState('error', `Failed to reconnect after ${MAX_RECONNECT_ATTEMPTS} attempts`);
-      return;
-    }
-    this.reconnectAttempts++;
-    const delay = RECONNECT_DELAY * Math.pow(2, this.reconnectAttempts - 1);
-    this._setState('reconnecting', `Reconnecting in ${Math.round(delay / 1000)}s (attempt ${this.reconnectAttempts}/${MAX_RECONNECT_ATTEMPTS})`);
-    this.reconnectTimer = setTimeout(() => {
-      this.reconnectTimer = null;
-      this.connect().catch(() => {});
-    }, delay);
-  }
-
-  _setState(phase, detail) {
-    if (this.onStateChange) this.onStateChange({ phase, detail });
-  }
-
-  disconnect() {
-    this.disconnecting = true;
-    this._stopHeartbeat();
-    this._cleanupLocalWs();
-    if (this.reconnectTimer) { clearTimeout(this.reconnectTimer); this.reconnectTimer = null; }
-    if (this.ws) { this.ws.close(); this.ws = null; }
-    this.connected = false;
-    this.publicUrl = null;
-    this.logger?.info('Tunnel disconnected');
-  }
-}
+// DSH Bridge - Custom Tunnel Client
+import { WebSocket } from 'ws';
+import { request as httpRequest } from 'node:http';
+import { connect as netConnect } from 'node:net';
+import { promisify } from 'node:util';
+import { gzip as gzipCallback } from 'node:zlib';
+
+const gzipAsync = promisify(gzipCallback);
+
+const HEARTBEAT_INTERVAL = 30000;
+const RECONNECT_DELAY = 5000;
+const MAX_RECONNECT_ATTEMPTS = 5;
+
+// 单响应内存上限：隧道把整个 body 缓冲进内存再 base64 传输，无上限会在大文件
+// 下载时把进程内存拖垮（一份 body 三份内存：chunks + Buffer + base64 字符串）
+const MAX_RESPONSE_BYTES = 32 * 1024 * 1024; // 32MB
+
+// 大响应 gzip 压缩阈值（超过此大小的可压缩响应将被 gzip）
+const GZIP_THRESHOLD = 102400; // 100KB
+// 可压缩的 content-type 前缀
+const COMPRESSIBLE_TYPES = ['text/', 'application/json', 'application/javascript', 'application/xml'];
+
+export class CustomTunnelClient {
+  constructor({ serverUrl, accessToken, localPort, internalTunnelSecret, signal, onStateChange, logger }) {
+    this.serverUrl = serverUrl;
+    this.accessToken = accessToken;
+    this.localPort = localPort;
+    this.internalTunnelSecret = internalTunnelSecret;
+    this.signal = signal;
+    this.onStateChange = onStateChange;
+    this.logger = logger;
+    this.ws = null;
+    this.publicUrl = null;
+    this.connected = false;
+    this.disconnecting = false;
+    this.reconnectAttempts = 0;
+    this.reconnectTimer = null;
+    this.heartbeatTimer = null;
+    this.localWsSockets = new Map(); // wsId -> net.Socket
+  }
+
+  async connect() {
+    if (this.connected) return;
+    this._setState('connecting', 'Connecting to tunnel server...');
+    try {
+      await this._connectWebSocket();
+      this._startHeartbeat();
+      this.reconnectAttempts = 0;
+      this._setState('ready', 'Tunnel established');
+    } catch (err) {
+      this._setState('error', err.message);
+      throw err;
+    }
+  }
+
+  _connectWebSocket() {
+    return new Promise((resolve, reject) => {
+      if (this.signal?.aborted) return reject(new Error('Aborted'));
+
+      const url = new URL(this.serverUrl);
+      url.searchParams.set('token', this.accessToken);
+
+      this.ws = new WebSocket(url.toString(), {
+        handshakeTimeout: 10000,
+        perMessageDeflate: {
+          clientNoContextTakeover: true,
+          serverNoContextTakeover: true,
+          clientMaxWindowBits: 15,
+          serverMaxWindowBits: 15,
+        },
+      });
+
+      const onAbort = () => { this.ws?.terminate(); reject(new Error('Aborted')); };
+      this.signal?.addEventListener('abort', onAbort);
+
+      this.ws.on('open', () => {
+        this.signal?.removeEventListener('abort', onAbort);
+        this.logger?.info('Tunnel WebSocket connected');
+      });
+
+      this.ws.on('message', (data) => this._handleMessage(data));
+
+      this.ws.on('close', (code, reason) => {
+        this.connected = false;
+        this._stopHeartbeat();
+        this._cleanupLocalWs();
+        if (!this.signal?.aborted) {
+          this.logger?.warn('Tunnel disconnected: code=%d, reason=%s', code, reason.toString());
+          this._scheduleReconnect();
+        }
+      });
+
+      this.ws.on('error', (err) => {
+        this.logger?.error('Tunnel WebSocket error: %s', err.message);
+        if (!this.connected) {
+          this.signal?.removeEventListener('abort', onAbort);
+          reject(err);
+        }
+      });
+
+      const readyHandler = (data) => {
+        try {
+          const msg = JSON.parse(data.toString());
+          if (msg.type === 'ready' && msg.publicUrl) {
+            this.publicUrl = msg.publicUrl;
+            this.connected = true;
+            this.ws.off('message', readyHandler);
+            this.signal?.removeEventListener('abort', onAbort);
+            this.logger?.info('Tunnel ready: %s', this.publicUrl);
+            resolve();
+          }
+        } catch {}
+      };
+      this.ws.on('message', readyHandler);
+
+      setTimeout(() => {
+        if (!this.connected) {
+          this.signal?.removeEventListener('abort', onAbort);
+          this.ws?.terminate();
+          reject(new Error('Connection timeout'));
+        }
+      }, 15000);
+    });
+  }
+
+  _handleMessage(data) {
+    try {
+      const msg = JSON.parse(data.toString());
+      if      (msg.type === 'request')  this._handleHttpRequest(msg);
+      else if (msg.type === 'ws-open')  this._handleWsOpen(msg);
+      else if (msg.type === 'ws-frame') this._handleWsFrame(msg);
+      else if (msg.type === 'ws-close') this._handleWsClose(msg);
+      // pong: ignore
+    } catch (err) {
+      this.logger?.error('Failed to parse tunnel message: %s', err.message);
+    }
+  }
+
+  // ── HTTP 请求代理 ─────────────────────────────────────────────────────────
+  _handleHttpRequest(msg) {
+    const { requestId, method, path, headers } = msg;
+    const SKIP = new Set(['transfer-encoding','connection','keep-alive',
+      'proxy-authenticate','proxy-authorization','te','trailer','upgrade']);
+    const safeHeaders = Object.fromEntries(
+      Object.entries(headers ?? {}).filter(([k]) => !SKIP.has(k.toLowerCase()))
+    );
+
+    const reqHeaders = { ...safeHeaders, host: `127.0.0.1:${this.localPort}` };
+    if (this.internalTunnelSecret) {
+      reqHeaders['x-dsh-internal-tunnel'] = this.internalTunnelSecret;
+    }
+
+    const req = httpRequest({
+      host: '127.0.0.1', port: this.localPort,
+      method, path: path || '/',
+      headers: reqHeaders,
+    }, (res) => {
+      const contentType = String(res.headers['content-type'] ?? '');
+      const isSSE = contentType.includes('text/event-stream');
+      const chunks = [];
+
+      if (isSSE) {
+        // SSE 流式响应：隧道协议不支持流式，收集初始数据后立即返回
+        // 避免 SSE 永不 end 导致隧道服务器超时返回 504
+        let sseSent = false;
+        const sseTimer = setTimeout(() => {
+          if (sseSent) return;
+          sseSent = true;
+          const respHeaders = Object.fromEntries(
+            Object.entries(res.headers).filter(([k]) => !SKIP.has(k.toLowerCase()))
+          );
+          this._sendMessage({
+            type: 'response', requestId,
+            statusCode: res.statusCode, headers: respHeaders,
+            body: Buffer.concat(chunks).toString('base64'),
+          });
+          res.destroy();
+        }, 500);
+
+        res.on('data', (c) => {
+          if (sseSent) return;
+          chunks.push(c);
+          // 收到初始数据后立即发送（不等超时）
+          if (chunks.length >= 2) {
+            clearTimeout(sseTimer);
+            sseSent = true;
+            const respHeaders = Object.fromEntries(
+              Object.entries(res.headers).filter(([k]) => !SKIP.has(k.toLowerCase()))
+            );
+            this._sendMessage({
+              type: 'response', requestId,
+              statusCode: res.statusCode, headers: respHeaders,
+              body: Buffer.concat(chunks).toString('base64'),
+            });
+            res.destroy();
+          }
+        });
+        res.on('error', () => {
+          if (!sseSent) {
+            clearTimeout(sseTimer);
+            this._sendMessage({
+              type: 'response', requestId, statusCode: 502,
+              headers: { 'content-type': 'text/plain' },
+              body: Buffer.from('Response Error').toString('base64'),
+            });
+          }
+        });
+        res.on('end', () => {
+          if (!sseSent) {
+            clearTimeout(sseTimer);
+            sseSent = true;
+            const respHeaders = Object.fromEntries(
+              Object.entries(res.headers).filter(([k]) => !SKIP.has(k.toLowerCase()))
+            );
+            this._sendMessage({
+              type: 'response', requestId,
+              statusCode: res.statusCode, headers: respHeaders,
+              body: Buffer.concat(chunks).toString('base64'),
+            });
+          }
+        });
+        return;
+      }
+
+      let responded = false;
+      const sendResponse = (statusCode, headers, body) => {
+        if (responded) return;
+        responded = true;
+        this._sendMessage({
+          type: 'response', requestId, statusCode, headers,
+          body: Buffer.from(body).toString('base64'),
+        });
+      };
+
+      let total = 0;
+      const cleanPath = String(path || '').split('?')[0];
+      // session.list 会在 end 后剥离 contextHeaders 等大字段，跳过 data 阶段的大小检查
+      const skipSizeCheck = cleanPath === '/api/session.list';
+      res.on('data', (c) => {
+        chunks.push(c);
+        total += c.length;
+        if (!skipSizeCheck && total > MAX_RESPONSE_BYTES) {
+          sendResponse(502, { 'content-type': 'text/plain' },
+            `Response too large for tunnel (>${Math.round(MAX_RESPONSE_BYTES / 1024 / 1024)}MB cap)`);
+          res.destroy();
+        }
+      });
+      res.on('error', () => {
+        sendResponse(502, { 'content-type': 'text/plain' }, 'Response Error');
+      });
+      res.on('end', () => {
+        if (responded) return;
+        const respHeaders = Object.fromEntries(
+          Object.entries(res.headers).filter(([k]) => !SKIP.has(k.toLowerCase()))
+        );
+        let bodyBuf = Buffer.concat(chunks);
+
+        // 剥离 contextHeaders 和 contextTimeline — 这两个投影字段包含每轮完整
+        // 系统提示+工具定义（4.8MB+），但没有任何客户端 UI 读取它们。
+        // session.list: 数百会话 × contextHeaders = 60MB+
+        // session.history: 单会话 contextHeaders = 4.8MB，占响应 80%+
+        // 剥离后 session.history 从 1.2MB gzip 降到 ~150KB（8x 减少）
+        if ((cleanPath === '/api/session.list' || cleanPath === '/api/session.history') && res.statusCode === 200) {
+          try {
+            const json = JSON.parse(bodyBuf.toString('utf8'));
+            if (json?.result?.ok) {
+              const v = json.result.value;
+              // session.list: items[].projections.values
+              if (v?.items) {
+                for (const item of v.items) {
+                  const proj = item?.projections?.values;
+                  if (proj) {
+                    delete proj.contextHeaders;
+                    delete proj.contextTimeline;
+                  }
+                }
+              }
+              // session.history: projections.values
+              if (v?.projections?.values) {
+                delete v.projections.values.contextHeaders;
+                delete v.projections.values.contextTimeline;
+              }
+              bodyBuf = Buffer.from(JSON.stringify(json), 'utf8');
+              respHeaders['content-length'] = String(bodyBuf.length);
+            }
+          } catch {} // 解析失败则原样发送
+        }
+
+        // 大响应 gzip 压缩：异步执行，避免 gzipSync 卡住整个事件循环
+        const respCt = String(res.headers['content-type'] ?? '').toLowerCase();
+        const alreadyEncoded = String(res.headers['content-encoding'] ?? '').toLowerCase();
+        const compressible = COMPRESSIBLE_TYPES.some((t) => respCt.startsWith(t));
+        if (bodyBuf.length > GZIP_THRESHOLD && compressible && !alreadyEncoded) {
+          gzipAsync(bodyBuf).then((zipped) => {
+            respHeaders['content-encoding'] = 'gzip';
+            respHeaders['content-length'] = String(zipped.length);
+            sendResponse(res.statusCode, respHeaders, zipped);
+          }).catch(() => {
+            sendResponse(res.statusCode, respHeaders, bodyBuf);
+          });
+          return;
+        }
+
+        sendResponse(res.statusCode, respHeaders, bodyBuf);
+      });
+    });
+    req.on('error', err => {
+      this._sendMessage({ type: 'response', requestId, statusCode: 502,
+        headers: { 'content-type': 'text/plain' },
+        body: Buffer.from(`Bad Gateway: ${err.message}`).toString('base64') });
+    });
+    if (msg.body) req.write(Buffer.from(msg.body, 'base64'));
+    req.end();
+  }
+
+  // ── WebSocket 升级代理 ────────────────────────────────────────────────────
+  // 服务端通知有浏览器要建 WebSocket，用裸 TCP 连本地 DSH 完成握手再转发帧
+  _handleWsOpen(msg) {
+    const { wsId, path, headers } = msg;
+
+    const sock = netConnect({ host: '127.0.0.1', port: this.localPort });
+    this.localWsSockets.set(wsId, sock);
+
+    // 构造 HTTP Upgrade 请求
+    const reqHeaders = { ...headers, host: `127.0.0.1:${this.localPort}` };
+    delete reqHeaders['proxy-connection'];
+    delete reqHeaders['proxy-authorization'];
+    if (this.internalTunnelSecret) {
+      reqHeaders['x-dsh-internal-tunnel'] = this.internalTunnelSecret;
+    }
+
+    const lines = [`GET ${path || '/'} HTTP/1.1`];
+    for (const [k, v] of Object.entries(reqHeaders)) lines.push(`${k}: ${v}`);
+    lines.push('', '');
+    sock.write(lines.join('\r\n'));
+
+    let headerBuf = '';
+    let upgraded = false;
+
+    sock.on('data', (chunk) => {
+      if (upgraded) {
+        this._sendMessage({ type: 'ws-frame', wsId, data: chunk.toString('base64') });
+        return;
+      }
+      headerBuf += chunk.toString('binary');
+      const sep = headerBuf.indexOf('\r\n\r\n');
+      if (sep === -1) return;
+
+      upgraded = true;
+      const replyHeaders = {};
+      const headerLines = headerBuf.slice(0, sep).split('\r\n');
+      for (let i = 1; i < headerLines.length; i++) {
+        const ci = headerLines[i].indexOf(':');
+        if (ci > 0) {
+          replyHeaders[headerLines[i].slice(0, ci).trim().toLowerCase()] =
+            headerLines[i].slice(ci + 1).trim();
+        }
+      }
+      this._sendMessage({ type: 'ws-accept', wsId, replyHeaders });
+
+      // 握手后紧跟的帧数据
+      const rest = headerBuf.slice(sep + 4);
+      if (rest.length > 0) {
+        this._sendMessage({ type: 'ws-frame', wsId, data: Buffer.from(rest, 'binary').toString('base64') });
+      }
+    });
+
+    sock.on('close', () => {
+      this._sendMessage({ type: 'ws-close', wsId });
+      this.localWsSockets.delete(wsId);
+    });
+    sock.on('error', (err) => {
+      this.logger?.error('Local WS socket error wsId=%s: %s', wsId, err.message);
+      this._sendMessage({ type: 'ws-close', wsId });
+      this.localWsSockets.delete(wsId);
+    });
+  }
+
+  _handleWsFrame(msg) {
+    const sock = this.localWsSockets.get(msg.wsId);
+    if (sock && !sock.destroyed) sock.write(Buffer.from(msg.data, 'base64'));
+  }
+
+  _handleWsClose(msg) {
+    const sock = this.localWsSockets.get(msg.wsId);
+    if (sock) { sock.destroy(); this.localWsSockets.delete(msg.wsId); }
+  }
+
+  _cleanupLocalWs() {
+    for (const [, sock] of this.localWsSockets) sock.destroy();
+    this.localWsSockets.clear();
+  }
+
+  // ── 工具方法 ──────────────────────────────────────────────────────────────
+  _sendMessage(msg) {
+    if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(JSON.stringify(msg));
+  }
+
+  _startHeartbeat() {
+    this._stopHeartbeat();
+    this.heartbeatTimer = setInterval(() => {
+      if (this.connected) this._sendMessage({ type: 'ping' });
+    }, HEARTBEAT_INTERVAL);
+  }
+
+  _stopHeartbeat() {
+    if (this.heartbeatTimer) { clearInterval(this.heartbeatTimer); this.heartbeatTimer = null; }
+  }
+
+  _scheduleReconnect() {
+    if (this.signal?.aborted || this.disconnecting) return;
+    if (this.reconnectTimer) return;
+    if (this.reconnectAttempts >= MAX_RECONNECT_ATTEMPTS) {
+      this._setState('error', `Failed to reconnect after ${MAX_RECONNECT_ATTEMPTS} attempts`);
+      return;
+    }
+    this.reconnectAttempts++;
+    const delay = RECONNECT_DELAY * Math.pow(2, this.reconnectAttempts - 1);
+    this._setState('reconnecting', `Reconnecting in ${Math.round(delay / 1000)}s (attempt ${this.reconnectAttempts}/${MAX_RECONNECT_ATTEMPTS})`);
+    this.reconnectTimer = setTimeout(() => {
+      this.reconnectTimer = null;
+      this.connect().catch(() => {});
+    }, delay);
+  }
+
+  _setState(phase, detail) {
+    if (this.onStateChange) this.onStateChange({ phase, detail });
+  }
+
+  disconnect() {
+    this.disconnecting = true;
+    this._stopHeartbeat();
+    this._cleanupLocalWs();
+    if (this.reconnectTimer) { clearTimeout(this.reconnectTimer); this.reconnectTimer = null; }
+    if (this.ws) { this.ws.close(); this.ws = null; }
+    this.connected = false;
+    this.publicUrl = null;
+    this.logger?.info('Tunnel disconnected');
+  }
+}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@wenbin_wb/dsh-bridge",
-  "version": "2.10.1",
+  "version": "2.10.2",
   "description": "手机扫码即可在移动端/公网继续用 DeepSeek Harness，人不在电脑前也能接着干。一键局域网二维码、Cloudflare 公网隧道、自建隧道与微信 / QQ / 飞书 / Telegram Bot（多工作区/会话持久化/媒体/卡片审批/流式输出），无需自己搭公网服务器。",
-  "releaseNotes": "【v2.10.1】\n• 🧹 与 v2.10.0 代码一致：修正升级提示措辞，与发布说明对齐\n\n【v2.10.0】\n• 🆕 新增「管理保护」独立开关：与访问认证解耦，远程设备管理权限始终受管理保护约束，仅凭管理密码可解锁\n• 🆕 面板版本条新增 DSH 宿主版本显示\n• 🐞 修复远程锁屏/解锁流程多处问题（会话失效后自动回登录页、锁屏可正常解锁、关闭访问认证后锁屏仍生效、首次进入即显示锁屏等）\n• 🧹 内部：统一 adminToken 缓存，清理死代码与重复实现",
+  "releaseNotes": "【v2.10.2】\n• 🆕 外部已部署隧道登记（issue #25）：自行部署 cloudflared（Docker 等）可在面板登记公网地址，展示二维码与入口，插件不再重复下载管理\n• 🐞 修复会话列表/历史加载问题：自建隧道下 session.list 502 修复 + 会话历史载入提速（社区 PR #27）",
   "type": "module",
   "main": "lib/index.js",
   "exports": {