@wenbin_wb/dsh-bridge 2.4.0 → 2.5.1

package/README.en.md

@@ -14,6 +14,11 @@ Seamlessly extend your local DeepSeek Harness to mobile phones, tablets, public
 
 ## Features
 
+- **🔐 Enterprise Access Security & Admin Guard (v2.5.0 Major Release)**:
+  - **1st Line of Defense (Visitor Access Guard)**: Auto-injected 256-bit security Token in QR codes for 1-click passwordless login; manual IP/domain visits enforce password verification; granular channel scoping (All / Public Tunnels Only / LAN Only);
+  - **2nd Line of Defense (Admin Console Guard)**: Separated administrator password and visitor password; global console lockout for remote devices to prevent unauthorized configuration changes (Password Unlock / Local Host Only / Open);
+  - **Fail-safe Recovery System (Triple Protection)**: Host machine (`127.0.0.1`) enjoys permanent physical privileges (never locked out) + terminal command `touch ~/.dsh/dsh-bridge/reset-auth` for instant emergency recovery + built-in "Forgot Password" guides;
+  - **Financial-grade Security Engine**: PBKDF2 + SHA-256 salted password hashing, 30-day HttpOnly SameSite session protection, IP brute-force rate limiter (5 failed attempts trigger 60s cooldown).
 - **LAN Access**: Scan QR code with your smartphone/tablet, direct access on the same Wi-Fi — keep the conversation going from your phone
 - **Cloudflare Tunnel**: One-click public internet exposure, connect from anywhere without a public server of your own — keep working even when you're away from home
 - **Custom Tunnel**: Connect to your own tunnel server with a fixed domain ([Setup Guide](docs/custom-tunnel.md))
@@ -24,7 +29,6 @@ Seamlessly extend your local DeepSeek Harness to mobile phones, tablets, public
 - **Official Brand SVG Icons**: Authentic vector brand icons for WeChat, QQ, Feishu, Telegram with real-time status indicators
 - **Fast Version Check & 1-Click Upgrade**: Dual-channel registry check (npmmirror + npmjs fallback in ~200ms) with seamless **1-click in-app upgrade**, no terminal copying required
 - **Dark Mode Support**: Deep integration with DeepSeek Harness Design Tokens (`--dsw-alias-*`), QR code background protection for safe dark mode scanning
-- **Security Alerts**: URLs and QR codes with access warnings to prevent accidental sharing
 
 ![npm](https://img.shields.io/npm/v/@wenbin_wb/dsh-bridge?label=npm)
 ![npm downloads](https://img.shields.io/npm/dt/@wenbin_wb/dsh-bridge?label=downloads)
@@ -37,12 +41,12 @@ Seamlessly extend your local DeepSeek Harness to mobile phones, tablets, public
 
 | Target | Description | Status |
 |--------|-------------|--------|
+| **Access Security** | Visitor Access Auth Guard + Admin Console Anti-Tamper + Fail-safe Recovery | ✅ **Completed** (v2.5.0) |
+| **Telegram** | IM channel suited for self-hosting and overseas (Long Polling / Proxy / Native Menu / Inline Cards / Streaming) | ✅ **Completed** (v2.4.0) |
+| **Feishu** | Feishu / Lark official persistent WebSocket bot (No-public-IP WS / Card Approvals) | ✅ **Completed** (v2.3.0) |
+| **QQ Bot** | QQ bot integration for group/private chat (Markdown / buttons / rich media) | ✅ **Completed** (v2.1.0) |
+| **WeChat** | Chat with your Agent directly in WeChat (workspaces / persisted sessions / media / approvals) | ✅ **Completed** (v1.0.0) |
 | **Platform Abstraction** | Platform-agnostic core (sessions / approvals / commands / digest) shared across IM channels | ✅ **Completed** (v2.0.0) |
-| **WeChat** | Chat with your Agent directly in WeChat | ✅ Supported (workspaces / persisted sessions / media / approvals) |
-| **QQ Bot** | QQ bot integration for group/private chat | ✅ **Completed** (v2.1.0) — Markdown / buttons / rich media |
-| **Feishu** | Feishu / Lark official persistent WebSocket bot | ✅ **Completed** (v2.3.0) — No-public-IP WS / Card Approvals |
-| **Telegram** | IM channel suited for self-hosting and overseas | ✅ **Completed** (v2.4.0) — Long Polling / Proxy / Native Menu / Inline Cards / Streaming |
-| **OpenClaw** | Connect with the OpenClaw ecosystem | Planned |
 
 ---
 
@@ -82,8 +86,8 @@ npm install -g @deepseek-ai/dsh
 # Install the latest version
 dsh plugin --profile web add @wenbin_wb/dsh-bridge
 
-# Or specify a version (e.g. 2.2.6)
-dsh plugin --profile web add @wenbin_wb/dsh-bridge@2.2.6
+# Or specify a version (e.g. 2.5.0)
+dsh plugin --profile web add @wenbin_wb/dsh-bridge@2.5.0
 ```
 
 > 💡 **No global install permission?** Use `npx`:
@@ -127,6 +131,39 @@ After upgrading, restart DSH, perform a **hard refresh** in your browser (Window
 
 ## Usage
 
+### 🔐 Access Security & Admin Guard (v2.5.0 Major Release)
+
+Go to Settings -> "Remote Access" -> "**Security**" tab to enable enterprise-grade protection with a single click.
+
+#### 1. 🛡️ 1st Line of Defense: Visitor Access Guard (Protects Web UI Entry)
+- **Flexible Scope Control**:
+  - `Protect All Channels`: LAN and all public tunnels require authentication;
+  - `Protect Public Tunnels Only (Recommended)`: LAN keeps zero-friction passwordless access, while public internet exposure requires authentication;
+  - `Protect LAN Only`: Enforces guard exclusively on local network.
+- **Three Verification Modes**:
+  - 🟢 **Scan QR Code Passwordless + Password Verification (Recommended)**: Console-generated QR codes automatically inject a 256-bit secure Token for instant 1-second passwordless access. Visitors manually typing IP/domain must enter the visitor access password;
+  - 🔑 **Password / PIN Only**: All external devices must manually enter the password;
+  - 🎫 **Secure Token Only**: Only devices with valid QR codes or Token links can enter.
+- **1-Click Token Rotation**: Click "🔄 Reset Security Token" to immediately invalidate all previously shared QR codes and URLs.
+
+#### 2. 🔒 2nd Line of Defense: Admin Console Anti-Tamper Guard (Protects Plugin Settings)
+- **Separated Admin Password**: Independent administrator password decoupled from visitor password; guests with access passwords cannot tamper with tunnels, bots, or tokens;
+- **Three Admin Policies**:
+  - 🔑 **Password Unlock (Recommended)**: Remote devices see a full-screen lock until the admin password is entered for a temporary session;
+  - 🛡️ **Host Computer Only (Highest Security)**: Remote devices are strictly blocked from viewing or changing network/bot/security settings — management is only allowed from the physical host (`127.0.0.1`);
+  - 🌐 **Open Mode**: Remote authenticated users can directly manage settings.
+
+#### 3. 🛟 Fail-safe Recovery System (Never Locked Out)
+- **Physical Host Privileges**: Host computer running DSH (`127.0.0.1` / `localhost`) has permanent physical privileges — **never requires access password, settings panel is never locked**;
+- **Emergency Terminal Command**: On headless Linux servers or in case of forgotten passwords, run a single command in your terminal:
+  ```bash
+  touch ~/.dsh/dsh-bridge/reset-auth
+  ```
+  The plugin instantly detects the marker, wipes all passwords and locks, deletes the marker, and restores default passwordless access;
+- **Built-in Recovery Guides**: Both visitor login pages and admin lock screens provide expandable `❓ Forgot Password?` help cards.
+
+---
+
 ### LAN Access
 
 Automatically active when the plugin starts, zero configuration needed. Open Settings -> "Remote Access", and scan the QR code with your phone.
@@ -142,7 +179,7 @@ Automatically active when the plugin starts, zero configuration needed. Open Set
 
 ### Custom Tunnel
 
-Requires a server with a public IP. See the [Custom Tunnel Setup Guide](docs/custom-tunnel.md) for detailed steps.
+Requires a server with a public IP (server environment requires Node.js >= 18, recommended Node.js 22 LTS). See the [Custom Tunnel Setup Guide](docs/custom-tunnel.md) for detailed steps.
 
 1. Deploy the tunnel server on your server following the guide
 2. Enter the WebSocket URL (`wss://...`) and access token in the "Custom Tunnel" card

package/README.md

@@ -14,6 +14,11 @@
 
 ## 功能特性
 
+- **🔐 全套访问安全认证与后台防篡改（v2.5.0 重磅）**：
+  - **第一道防线（外部访问门禁）**：二维码自带专属 Token 扫码一秒免密直入；手动输入 IP 或公网域名强制验证密码；支持「全部防护 / 仅公网 / 仅局域网」精准通道分流；
+  - **第二道防线（管理控制台防篡改）**：独立管理员密码，远程设备进入控制台全局锁定网络配置与 IM 机器人密钥，支持「需密码解锁 / 仅电脑本机管理 / 宽松直管」；
+  - **三重容灾保命体系**：电脑本机（`127.0.0.1`）永久最高物理特权（永不自锁） + 终端 `touch ~/.dsh/dsh-bridge/reset-auth` 一秒救急重置 + 全界面忘记密码求助引导；
+  - **金融级安全引擎**：PBKDF2 + SHA-256 加盐哈希安全存储、30 天 HttpOnly SameSite 会话、单 IP 连续 5 次错误封禁 60 秒防暴力破解。
 - **局域网访问**：手机/平板扫码，同一 Wi-Fi 直接访问，躺着也能在手机上接着聊
 - **Cloudflare 隧道**：一键暴露公网地址，随时随地连接，出差在外、不在家也能接着干，无需自建公网服务器
 - **自建隧道**：连接自己的隧道服务器，获得固定域名（[搭建教程](docs/custom-tunnel.md)）
@@ -24,7 +29,6 @@
 - **IM 官方品牌矢量图标**：微信、QQ、飞书、Telegram 官方矢量图标与状态展示，直接在聊天软件里呼唤你的 Agent
 - **极速版本检查与一键升级**：国内高速镜像（npmmirror）优先 + 官方源毫秒级双通道检查，检测到新版本支持**界面一键直接升级**，无需手动打开终端
 - **深色模式深度适配**：完美适配 DeepSeek Harness 设计系统明暗主题切换，二维码自带白底安全垫，暗光下手机扫码 100% 极速识别
-- **安全提示**：URL 和二维码带访问警告，防止误分享
 
 ![npm](https://img.shields.io/npm/v/@wenbin_wb/dsh-bridge?label=npm)
 ![npm downloads](https://img.shields.io/npm/dt/@wenbin_wb/dsh-bridge?label=downloads)
@@ -37,12 +41,12 @@
 
 | 目标 | 说明 | 状态 |
 |------|------|------|
+| **访问安全认证** | 外部访问门禁拦截 + 管理后台防篡改锁 + 三重容灾保命体系 | ✅ **已完成**（v2.5.0） |
+| **Telegram** | 适合自托管与海外的 IM 渠道（免公网长轮询 / 代理支持 / 原生菜单 / Inline 卡片 / 流式打字机） | ✅ **已完成**（v2.4.0） |
+| **飞书** | 飞书开放平台长连接机器人，办公场景直接调用（免公网 WS / 卡片审批） | ✅ **已完成**（v2.3.0） |
+| **QQ Bot** | 接入 QQ 机器人，群聊/私聊唤起 Agent（Markdown / 按钮 / 富媒体） | ✅ **已完成**（v2.1.0） |
+| **微信** | 在微信里直接与你的 Agent 对话（多工作区 / 会话持久化 / 媒体 / 审批） | ✅ **已完成**（v1.0.0） |
 | **平台抽象层** | 平台无关的核心（会话/审批/命令/digest）跨 IM 渠道复用 | ✅ **已完成**（v2.0.0） |
-| **微信** | 在微信里直接与你的 Agent 对话 | ✅ 已支持（多工作区 / 会话持久化 / 媒体 / 审批） |
-| **QQ Bot** | 接入 QQ 机器人，群聊/私聊唤起 Agent | ✅ **已完成**（v2.1.0）— Markdown / 按钮 / 富媒体 |
-| **飞书** | 飞书开放平台长连接机器人，办公场景直接调用 | ✅ **已完成**（v2.3.0）— 免公网 WS / 卡片审批 |
-| **Telegram** | 适合自托管与海外的 IM 渠道 | ✅ **已完成**（v2.4.0）— 免公网长轮询 / 代理支持 / 原生菜单 / Inline 卡片 / 流式打字机 |
-| **OpenClaw** | 与 OpenClaw 生态打通 | 规划中 |
 
 ---
 
@@ -82,8 +86,8 @@ npm install -g @deepseek-ai/dsh
 # 安装最新版
 dsh plugin --profile web add @wenbin_wb/dsh-bridge
 
-# 或指定版本（如 2.2.6）
-dsh plugin --profile web add @wenbin_wb/dsh-bridge@2.2.6
+# 或指定版本（如 2.5.0）
+dsh plugin --profile web add @wenbin_wb/dsh-bridge@2.5.0
 ```
 
 > 💡 **没有全局安装权限？** 使用 `npx` 方式：
@@ -127,6 +131,39 @@ dsh plugin --profile web add @wenbin_wb/dsh-bridge@latest
 
 ## 使用
 
+### 🔐 访问安全认证与后台防篡改（v2.5.0 重磅）
+
+打开设置页「远程访问」→「**安全认证**」Tab 即可一键启用全方位安全守护。
+
+#### 1. 🛡️ 第一道防线：外部访问门禁（保护谁能进 Web 界面）
+- **多通道分流生效**：
+  - `全部通道开启防护`：局域网与所有公网隧道均需认证；
+  - `仅公网隧道开启防护 (推荐)`：局域网同一 Wi-Fi 内保持免密，暴露至公网的隧道强制开启认证门禁；
+  - `仅局域网开启防护`：仅对局域网进行门禁拦截。
+- **三种灵活验证模式**：
+  - 🟢 **扫码免密 + 密码认证 (默认推荐)**：控制台生成的二维码已自动注入 256-bit 专属安全 Token，手机扫码即可免密秒进；直接在浏览器手动输入 IP 或公网域名的访客，需输入您设置的访客访问密码；
+  - 🔑 **仅密码 / PIN 码**：所有外部设备一律要求输入访问密码；
+  - 🎫 **仅专属 Token 免密**：仅允许通过控制台生成的二维码或带 Token 的专属链接进入。
+- **一键轮换凭据**：点击「🔄 重置安全 Token」即可使之前分享的旧二维码和链接立即全部失效。
+
+#### 2. 🔒 第二道防线：管理后台防篡改（保护谁能改插件设置）
+- **独立管理员密码**：访客访问密码与管理控制密码彻底分离，即使将访问密码告诉外部朋友，对方也无法查看或篡改您的插件设置；
+- **三种后台权限策略**：
+  - 🔑 **需密码解锁 (默认推荐)**：远程设备进入控制台时全屏锁定，输入管理密码后解锁临时会话；
+  - 🛡️ **仅限电脑本机管理 (最高安全)**：远程设备一律禁止查看与修改任何网络、机器人配置与 Token，仅允许在电脑本机（`127.0.0.1`）操作；
+  - 🌐 **宽松模式**：允许通过访客认证的远程设备直接管理。
+
+#### 3. 🛟 三重容灾保命体系（永不自锁）
+- **物理机免密直通**：运行 DSH 的宿主电脑（`127.0.0.1` / `localhost`）享有全局最高物理特权，**永不要求输入访问密码，设置面板永不会被锁定**；
+- **服务器一键救急指令**：无头 Linux 服务器或极端忘记密码时，在宿主电脑终端执行单行命令：
+  ```bash
+  touch ~/.dsh/dsh-bridge/reset-auth
+  ```
+  插件将在毫秒级自动清空密码与策略并删除标记，瞬间恢复初始免密状态；
+- **全界面忘记密码指引**：访客登录页与锁屏页均提供 `❓ 忘记密码？` 救助展开卡片。
+
+---
+
 ### 局域网访问
 
 插件启动后自动开启，无需任何配置。打开设置页「远程访问」，用手机扫描二维码即可访问。
@@ -142,7 +179,7 @@ dsh plugin --profile web add @wenbin_wb/dsh-bridge@latest
 
 ### 自建隧道
 
-需要一台有公网 IP 的服务器。详细搭建步骤见 [自建隧道教程](docs/custom-tunnel.md)。
+需要一台有公网 IP 的服务器（服务端环境要求 Node.js >= 18，推荐 Node.js 22 LTS）。详细搭建步骤见 [自建隧道教程](docs/custom-tunnel.md)。
 
 1. 按教程在服务器上部署隧道服务端
 2. 在「自建隧道」卡片中填写 WebSocket 地址（`wss://...`）和访问令牌