@wenbin_wb/dsh-bridge 2.4.0 → 2.5.1

package/client/client.js

@@ -43,6 +43,12 @@ var BRIDGE_ENDPOINTS = {
   saveCustomTunnelConfig: "saveCustomTunnelConfig",
   checkVersion: "checkVersion",
   upgradePlugin: "upgradePlugin",
+  // 访问安全认证（密码保护 / 扫码免密 Token）
+  authGetStatus: "authGetStatus",
+  authUpdateConfig: "authUpdateConfig",
+  authRegenerateToken: "authRegenerateToken",
+  authAdminUnlock: "authAdminUnlock",
+  authAdminLock: "authAdminLock",
   // 平台管理器（多 IM 平台统一接口）
   listPlatforms: "listPlatforms",
   platformLogin: "platformLogin",
@@ -135,6 +141,11 @@ var Icons = {
     { viewBox: "0 0 24 24", width: 16, height: 16, fill: "currentColor", ...props },
     React.createElement("path", { d: "M19.35 10.04C18.67 6.59 15.64 4 12 4 9.11 4 6.6 5.64 5.35 8.04 2.34 8.36 0 10.91 0 14c0 3.31 2.69 6 6 6h13c2.76 0 5-2.24 5-5 0-2.64-2.05-4.78-4.65-4.96zM19 18H6c-2.21 0-4-1.79-4-4 0-2.05 1.53-3.76 3.56-3.97l1.07-.11.5-.95C8.08 7.14 9.94 6 12 6c2.62 0 4.88 1.86 5.39 4.43l.3 1.5 1.53.11c1.56.1 2.78 1.41 2.78 2.96 0 1.65-1.35 3-3 3z" })
   ),
+  security: (props) => React.createElement(
+    "svg",
+    { viewBox: "0 0 24 24", width: 16, height: 16, fill: "currentColor", ...props },
+    React.createElement("path", { d: "M12 1L3 5v6c0 5.55 3.84 10.74 9 12 5.16-1.26 9-6.45 9-12V5l-9-4zm0 10.99h7c-.53 4.12-3.28 7.79-7 8.94V12H5V6.3l7-3.11v8.8z" })
+  ),
   bot: (props) => React.createElement(
     "svg",
     { viewBox: "0 0 24 24", width: 16, height: 16, fill: "currentColor", ...props },
@@ -216,7 +227,7 @@ function StatusTag({ running, status }) {
     style: { ...s.tag, background: bg, color }
   }, text);
 }
-function QrBlock({ url, qr, onReset }) {
+function QrBlock({ url, qr, onReset, auth, onNavigateSecurity }) {
   const [copied, setCopied] = React.useState(false);
   const [showQr, setShowQr] = React.useState(true);
   const copy = React.useCallback(() => {
@@ -247,14 +258,41 @@ function QrBlock({ url, qr, onReset }) {
   return React.createElement(
     "div",
     { style: { marginTop: 10 } },
-    React.createElement(
+    auth?.enabled ? React.createElement(
+      "div",
+      {
+        style: {
+          display: "inline-flex",
+          alignItems: "center",
+          gap: 6,
+          padding: "4px 10px",
+          background: "var(--dsw-alias-state-success-bg,#ecfdf5)",
+          border: "1px solid var(--dsw-alias-state-success-primary,#10b981)",
+          borderRadius: 8,
+          fontSize: 12,
+          color: "var(--dsw-alias-state-success-primary,#059669)",
+          marginBottom: 8,
+          fontWeight: 500,
+          cursor: onNavigateSecurity ? "pointer" : "default"
+        },
+        onClick: onNavigateSecurity,
+        title: onNavigateSecurity ? "\u70B9\u51FB\u524D\u5F80\u300C\u5B89\u5168\u8BA4\u8BC1\u300D\u914D\u7F6E" : void 0
+      },
+      "\u{1F6E1}\uFE0F \u8BBF\u95EE\u5B89\u5168\u8BA4\u8BC1\u5DF2\u751F\u6548 \xB7 \u626B\u7801\u8BBE\u5907\u81EA\u52A8\u5B8C\u6210\u514D\u5BC6\u6388\u6743",
+      onNavigateSecurity && React.createElement("span", { style: { textDecoration: "underline", fontSize: 11, marginLeft: 4 } }, "\u8BBE\u7F6E \u2794")
+    ) : React.createElement(
       "div",
-      { style: s.warn },
-      "\u26A0\uFE0F \u8BF7\u52FF\u5C06\u6B64\u94FE\u63A5\u6216\u4E8C\u7EF4\u7801\u5206\u4EAB\u7ED9\u4ED6\u4EBA\uFF0C\u4EFB\u4F55\u4EBA\u626B\u7801\u540E\u90FD\u53EF\u76F4\u63A5\u8BBF\u95EE\u60A8\u7684 DSH\u3002"
+      {
+        style: { ...s.warn, cursor: onNavigateSecurity ? "pointer" : "default", display: "flex", alignItems: "center", justifyContent: "space-between", flexWrap: "wrap", gap: 6 },
+        onClick: onNavigateSecurity,
+        title: onNavigateSecurity ? "\u70B9\u51FB\u524D\u5F80\u300C\u5B89\u5168\u8BA4\u8BC1\u300D\u5F00\u542F\u8BBF\u95EE\u4FDD\u62A4" : void 0
+      },
+      React.createElement("span", null, "\u26A0\uFE0F \u5F53\u524D\u672A\u5F00\u542F\u8BBF\u95EE\u8BA4\u8BC1\uFF0C\u5EFA\u8BAE\u5728\u300C\u5B89\u5168\u8BA4\u8BC1\u300D\u5F00\u542F\u5BC6\u7801\u6216\u626B\u7801\u4FDD\u62A4\u3002"),
+      onNavigateSecurity && React.createElement("span", { style: { fontWeight: 600, textDecoration: "underline", fontSize: 12, color: "var(--dsw-alias-brand-primary,#4f6ef7)" } }, "\u53BB\u5F00\u542F \u2794")
     ),
     React.createElement(
       "div",
-      { style: { display: "flex", alignItems: "center", gap: 8, marginTop: 10 } },
+      { style: { display: "flex", alignItems: "center", gap: 8, marginTop: 6 } },
       React.createElement("code", { style: { ...s.code, flex: 1 } }, url),
       React.createElement("button", {
         style: { ...s.btnGhost, height: 26, padding: "0 10px", fontSize: 12, flexShrink: 0 },
@@ -308,13 +346,17 @@ var CustomTunnelConfigForm = React.memo(function CustomTunnelConfigForm2({ serve
     }
   }, [initUrl, initToken]);
   const dirty = serverUrl !== (initUrl ?? "") || accessToken !== (initToken ?? "");
+  const [saveErr, setSaveErr] = React.useState(null);
   const handleSave = React.useCallback(async () => {
     setSaving(true);
     setSaveSuccess(false);
+    setSaveErr(null);
     try {
       await onSave(serverUrl, accessToken);
       setSaveSuccess(true);
       setTimeout(() => setSaveSuccess(false), 2500);
+    } catch (e) {
+      setSaveErr(e.message || "\u4FDD\u5B58\u914D\u7F6E\u5931\u8D25");
     } finally {
       setSaving(false);
     }
@@ -322,15 +364,17 @@ var CustomTunnelConfigForm = React.memo(function CustomTunnelConfigForm2({ serve
   const handleUrlChange = React.useCallback((e) => {
     setServerUrl(e.target.value);
     setSaveSuccess(false);
+    setSaveErr(null);
   }, []);
   const handleTokenChange = React.useCallback((e) => {
     setAccessToken(e.target.value);
     setSaveSuccess(false);
+    setSaveErr(null);
   }, []);
   return React.createElement(
     "div",
     { style: s.block },
-    React.createElement("div", { style: { ...s.muted, marginBottom: 8 } }, "\u670D\u52A1\u5668\u914D\u7F6E"),
+    React.createElement("div", { style: { ...s.muted, marginBottom: 8 } }, "\u96A7\u9053\u670D\u52A1\u5668\u914D\u7F6E"),
     React.createElement(
       "div",
       { style: { display: "flex", flexDirection: "column", gap: 8 } },
@@ -347,7 +391,7 @@ var CustomTunnelConfigForm = React.memo(function CustomTunnelConfigForm2({ serve
       React.createElement("input", {
         style: s.input,
         type: "password",
-        placeholder: "\u8BBF\u95EE\u4EE4\u724C\uFF08Access Token\uFF09",
+        placeholder: "\u96A7\u9053\u670D\u52A1\u7AEF\u8FDE\u63A5\u4EE4\u724C\uFF08Tunnel Access Token\uFF09",
         value: accessToken,
         onChange: handleTokenChange,
         onKeyDown: (e) => {
@@ -355,6 +399,12 @@ var CustomTunnelConfigForm = React.memo(function CustomTunnelConfigForm2({ serve
         },
         disabled: saving
       }),
+      saveErr && React.createElement("div", { style: s.err }, `\u274C ${saveErr}`),
+      React.createElement(
+        "div",
+        { style: { ...s.muted, fontSize: 11 } },
+        "\u{1F4A1} \u7528\u4E8E\u4E0E\u60A8\u7684 VPS \u96A7\u9053\u670D\u52A1\u7AEF\u5EFA\u7ACB\u53CD\u5411\u901A\u9053\uFF08\u4E0E Web \u7F51\u9875\u8BBF\u5BA2\u8BBF\u95EE\u5BC6\u7801\u4E92\u76F8\u72EC\u7ACB\uFF09\u3002"
+      ),
       React.createElement("button", {
         style: {
           ...s.btnPri,
@@ -368,7 +418,7 @@ var CustomTunnelConfigForm = React.memo(function CustomTunnelConfigForm2({ serve
     )
   );
 });
-var TunnelCard = React.memo(function TunnelCard2({ title, desc, data, onStart, onStop, onReset, children }) {
+var TunnelCard = React.memo(function TunnelCard2({ title, desc, data, onStart, onStop, onReset, auth, onNavigateSecurity, children }) {
   const { running, configured, url, qr, state } = data ?? {};
   const phase = state?.phase ?? "idle";
   return React.createElement(
@@ -393,7 +443,7 @@ var TunnelCard = React.memo(function TunnelCard2({ title, desc, data, onStart, o
         color: phase === "error" ? "var(--dsw-alias-state-error-primary,#dc2626)" : "var(--dsw-alias-label-secondary,#6b7280)"
       }
     }, state?.detail ?? phase),
-    url && React.createElement(QrBlock, { url, qr, onReset }),
+    url && React.createElement(QrBlock, { url, qr, onReset, auth, onNavigateSecurity }),
     (onStart || onStop) && React.createElement(
       "div",
       {
@@ -409,6 +459,514 @@ var TunnelCard = React.memo(function TunnelCard2({ title, desc, data, onStart, o
     )
   );
 });
+var AccessAuthCard = React.memo(function AccessAuthCard2({ auth, rpcCall, onUpdate }) {
+  const [enabled, setEnabled] = React.useState(auth?.enabled ?? false);
+  const [mode, setMode] = React.useState(auth?.mode ?? "token_and_password");
+  const [scope, setScope] = React.useState(auth?.scope ?? "all");
+  const [adminPolicy, setAdminPolicy] = React.useState(auth?.adminPolicy ?? "password_unlock");
+  const [accessPassword, setAccessPassword] = React.useState("");
+  const [showAccessPassword, setShowAccessPassword] = React.useState(false);
+  const [savingAccess, setSavingAccess] = React.useState(false);
+  const [saveAccessSuccess, setSaveAccessSuccess] = React.useState(false);
+  const [msgAccess, setMsgAccess] = React.useState(null);
+  const [adminPassword, setAdminPassword] = React.useState("");
+  const [showAdminPassword, setShowAdminPassword] = React.useState(false);
+  const [savingAdmin, setSavingAdmin] = React.useState(false);
+  const [saveAdminSuccess, setSaveAdminSuccess] = React.useState(false);
+  const [msgAdmin, setMsgAdmin] = React.useState(null);
+  const [topMsg, setTopMsg] = React.useState(null);
+  React.useEffect(() => {
+    if (auth) {
+      setEnabled(auth.enabled ?? false);
+      setMode(auth.mode ?? "token_and_password");
+      setScope(auth.scope ?? "all");
+      setAdminPolicy(auth.adminPolicy ?? "password_unlock");
+    }
+  }, [auth]);
+  const handleToggleEnabled = async () => {
+    const prev = enabled;
+    const next = !enabled;
+    setEnabled(next);
+    try {
+      const res = await rpcCall(BRIDGE_ENDPOINTS.authUpdateConfig, { enabled: next });
+      if (!res?.ok) throw new Error(res?.error?.message || "\u66F4\u65B0\u5931\u8D25");
+      setTopMsg({ ok: true, text: next ? "\u2713 \u8BBF\u95EE\u5B89\u5168\u8BA4\u8BC1\u5DF2\u5F00\u542F\uFF08\u73B0\u6709\u767B\u5F55\u6001\u5DF2\u5237\u65B0\uFF09" : "\u2713 \u8BBF\u95EE\u5B89\u5168\u8BA4\u8BC1\u5DF2\u5173\u95ED" });
+      onUpdate?.();
+    } catch (e) {
+      setEnabled(prev);
+      setTopMsg({ ok: false, text: e.message || "\u66F4\u65B0\u5931\u8D25" });
+    }
+  };
+  const handleChangeMode = async (m) => {
+    const prev = mode;
+    setMode(m);
+    try {
+      const res = await rpcCall(BRIDGE_ENDPOINTS.authUpdateConfig, { mode: m });
+      if (!res?.ok) throw new Error(res?.error?.message || "\u66F4\u65B0\u5931\u8D25");
+      setTopMsg({ ok: true, text: "\u2713 \u5916\u90E8\u9A8C\u8BC1\u6A21\u5F0F\u5DF2\u5207\u6362\uFF0C\u5DF2\u5237\u65B0\u5168\u57DF\u767B\u5F55\u6001" });
+      onUpdate?.();
+    } catch (e) {
+      setMode(prev);
+      setTopMsg({ ok: false, text: e.message || "\u66F4\u65B0\u5931\u8D25" });
+    }
+  };
+  const handleChangeScope = async (sc) => {
+    const prev = scope;
+    setScope(sc);
+    try {
+      const res = await rpcCall(BRIDGE_ENDPOINTS.authUpdateConfig, { scope: sc });
+      if (!res?.ok) throw new Error(res?.error?.message || "\u66F4\u65B0\u5931\u8D25");
+      setTopMsg({ ok: true, text: "\u2713 \u9632\u62A4\u751F\u6548\u8303\u56F4\u5DF2\u66F4\u65B0" });
+      onUpdate?.();
+    } catch (e) {
+      setScope(prev);
+      setTopMsg({ ok: false, text: e.message || "\u66F4\u65B0\u5931\u8D25" });
+    }
+  };
+  const handleChangeAdminPolicy = async (pol) => {
+    const prev = adminPolicy;
+    setAdminPolicy(pol);
+    try {
+      const res = await rpcCall(BRIDGE_ENDPOINTS.authUpdateConfig, { adminPolicy: pol });
+      if (!res?.ok) throw new Error(res?.error?.message || "\u66F4\u65B0\u5931\u8D25");
+      setTopMsg({ ok: true, text: "\u2713 \u8FDC\u7A0B\u7BA1\u7406\u9632\u7BE1\u6539\u7B56\u7565\u5DF2\u66F4\u65B0" });
+      onUpdate?.();
+    } catch (e) {
+      setAdminPolicy(prev);
+      setTopMsg({ ok: false, text: e.message || "\u66F4\u65B0\u5931\u8D25" });
+    }
+  };
+  const handleSaveAccessPassword = async () => {
+    setSavingAccess(true);
+    setMsgAccess(null);
+    try {
+      const res = await rpcCall(BRIDGE_ENDPOINTS.authUpdateConfig, { password: accessPassword });
+      if (res?.ok) {
+        setSaveAccessSuccess(true);
+        setMsgAccess({ ok: true, text: "\u2713 \u8BBF\u5BA2\u8BBF\u95EE\u5BC6\u7801\u5DF2\u6210\u529F\u4FDD\u5B58\uFF01\u539F\u6709\u7684\u5386\u53F2\u8BBF\u5BA2\u4F1A\u8BDD\u5DF2\u5168\u90E8\u5B89\u5168\u5237\u65B0\u3002" });
+        setAccessPassword("");
+        setTimeout(() => setSaveAccessSuccess(false), 3500);
+        onUpdate?.();
+      } else {
+        setMsgAccess({ ok: false, text: res?.error?.message || "\u4FDD\u5B58\u5931\u8D25" });
+      }
+    } catch (e) {
+      setMsgAccess({ ok: false, text: e.message || "\u4FDD\u5B58\u5931\u8D25" });
+    } finally {
+      setSavingAccess(false);
+    }
+  };
+  const handleSaveAdminPassword = async () => {
+    setSavingAdmin(true);
+    setMsgAdmin(null);
+    try {
+      const res = await rpcCall(BRIDGE_ENDPOINTS.authUpdateConfig, { adminPassword });
+      if (res?.ok) {
+        setSaveAdminSuccess(true);
+        setMsgAdmin({ ok: true, text: "\u2713 \u540E\u53F0\u7BA1\u7406\u5BC6\u7801\u5DF2\u6210\u529F\u4FDD\u5B58\uFF01\u8FDC\u7A0B\u7BA1\u7406\u89E3\u9501\u72B6\u6001\u5DF2\u91CD\u7F6E\u751F\u6548\u3002" });
+        setAdminPassword("");
+        setTimeout(() => setSaveAdminSuccess(false), 3500);
+        onUpdate?.();
+      } else {
+        setMsgAdmin({ ok: false, text: res?.error?.message || "\u4FDD\u5B58\u5931\u8D25" });
+      }
+    } catch (e) {
+      setMsgAdmin({ ok: false, text: e.message || "\u4FDD\u5B58\u5931\u8D25" });
+    } finally {
+      setSavingAdmin(false);
+    }
+  };
+  const handleRegenerateToken = async () => {
+    if (!confirm("\u91CD\u7F6E\u540E\uFF0C\u4E4B\u524D\u5305\u542B\u65E7 Token \u7684\u4E8C\u7EF4\u7801\u548C\u5206\u4EAB\u94FE\u63A5\u5C06\u7ACB\u5373\u5931\u6548\u3002\u662F\u5426\u786E\u8BA4\u91CD\u7F6E\uFF1F")) return;
+    try {
+      const res = await rpcCall(BRIDGE_ENDPOINTS.authRegenerateToken, {});
+      if (!res?.ok) throw new Error(res?.error?.message || "\u91CD\u7F6E\u5931\u8D25");
+      setTopMsg({ ok: true, text: "\u2713 \u5B89\u5168 Token \u5DF2\u91CD\u7F6E\uFF0C\u4E8C\u7EF4\u7801\u4E0E\u4E13\u5C5E\u94FE\u63A5\u5DF2\u5237\u65B0" });
+      onUpdate?.();
+    } catch (e) {
+      setTopMsg({ ok: false, text: e.message || "\u91CD\u7F6E\u5931\u8D25" });
+    }
+  };
+  const scopeLabel = scope === "all" ? "\u5168\u90E8\u901A\u9053 (\u5C40\u57DF\u7F51+\u516C\u7F51)" : scope === "public_only" ? "\u4EC5\u516C\u7F51\u96A7\u9053" : "\u4EC5\u5C40\u57DF\u7F51";
+  const modeLabel = mode === "token_and_password" ? "\u626B\u7801\u514D\u5BC6 + \u5BC6\u7801" : mode === "password_only" ? "\u4EC5\u5BC6\u7801\u767B\u5F55" : "\u4EC5\u5B89\u5168 Token";
+  const adminLabel = adminPolicy === "password_unlock" ? "\u9700\u5BC6\u7801\u89E3\u9501" : adminPolicy === "local_only" ? "\u4EC5\u9650\u7535\u8111\u672C\u673A\u7BA1\u7406" : "\u5BBD\u677E\u6A21\u5F0F";
+  return React.createElement(
+    "div",
+    { style: { display: "flex", flexDirection: "column", gap: 14 } },
+    // ---- 顶部总控与状态概览卡片 ----
+    React.createElement(
+      "div",
+      { style: s.card },
+      React.createElement(
+        "div",
+        {
+          style: { display: "flex", alignItems: "center", justifyContent: "space-between", flexWrap: "wrap", gap: 12 }
+        },
+        React.createElement(
+          "div",
+          { style: { flex: "1 1 260px" } },
+          React.createElement(
+            "div",
+            { style: { ...s.label, fontSize: 15, display: "flex", alignItems: "center", gap: 8 } },
+            "\u{1F510} \u5168\u5C40\u8BBF\u95EE\u5B89\u5168\u9632\u62A4\u4F53\u7CFB"
+          ),
+          React.createElement(
+            "div",
+            { style: { ...s.muted, marginTop: 4 } },
+            "\u96C6\u6210\u5916\u90E8\u8BBF\u95EE\u95E8\u7981\u62E6\u622A\u4E0E\u7BA1\u7406\u540E\u53F0\u9632\u7BE1\u6539\u63A7\u5236\uFF0C\u53CC\u91CD\u5B88\u62A4\u8FDC\u7A0B\u4F1A\u8BDD\u4E0E\u7F51\u7EDC\u914D\u7F6E\u5B89\u5168"
+          )
+        ),
+        React.createElement("button", {
+          style: { ...enabled ? s.btnPri : s.btnGhost, whiteSpace: "nowrap", flexShrink: 0 },
+          onClick: handleToggleEnabled
+        }, enabled ? "\u2713 \u5DF2\u542F\u7528\u5B89\u5168\u9632\u62A4" : "\u672A\u5F00\u542F\u5B89\u5168\u9632\u62A4")
+      ),
+      enabled && React.createElement(
+        "div",
+        {
+          style: {
+            display: "flex",
+            gap: 8,
+            flexWrap: "wrap",
+            marginTop: 14,
+            paddingTop: 12,
+            borderTop: "1px solid var(--dsw-alias-border-l2,#e5e7eb)"
+          }
+        },
+        React.createElement("div", {
+          style: {
+            display: "inline-flex",
+            alignItems: "center",
+            gap: 5,
+            padding: "4px 10px",
+            borderRadius: 16,
+            fontSize: 11,
+            background: "var(--dsw-alias-bg-layer-2,#f3f4f6)",
+            color: "var(--dsw-alias-label-secondary,#4b5563)"
+          }
+        }, "\u{1F310} \u4FDD\u62A4\u8303\u56F4: ", React.createElement("strong", { style: { color: "var(--dsw-alias-brand-primary,#4f6ef7)" } }, scopeLabel)),
+        React.createElement("div", {
+          style: {
+            display: "inline-flex",
+            alignItems: "center",
+            gap: 5,
+            padding: "4px 10px",
+            borderRadius: 16,
+            fontSize: 11,
+            background: "var(--dsw-alias-bg-layer-2,#f3f4f6)",
+            color: "var(--dsw-alias-label-secondary,#4b5563)"
+          }
+        }, "\u{1F511} \u5916\u90E8\u9A8C\u8BC1: ", React.createElement("strong", { style: { color: "var(--dsw-alias-brand-primary,#4f6ef7)" } }, modeLabel)),
+        React.createElement("div", {
+          style: {
+            display: "inline-flex",
+            alignItems: "center",
+            gap: 5,
+            padding: "4px 10px",
+            borderRadius: 16,
+            fontSize: 11,
+            background: "var(--dsw-alias-bg-layer-2,#f3f4f6)",
+            color: "var(--dsw-alias-label-secondary,#4b5563)"
+          }
+        }, "\u{1F512} \u540E\u53F0\u9632\u7BE1\u6539: ", React.createElement("strong", { style: { color: "var(--dsw-alias-state-success-primary,#059669)" } }, adminLabel))
+      ),
+      topMsg && React.createElement("div", {
+        style: {
+          marginTop: 12,
+          padding: "8px 12px",
+          borderRadius: 6,
+          fontSize: 12,
+          background: topMsg.ok ? "var(--dsw-alias-state-success-bg,#ecfdf5)" : "var(--dsw-alias-state-error-bg,#fef2f2)",
+          color: topMsg.ok ? "var(--dsw-alias-state-success-primary,#059669)" : "var(--dsw-alias-state-error-primary,#dc2626)"
+        }
+      }, topMsg.text)
+    ),
+    enabled && React.createElement(
+      React.Fragment,
+      null,
+      // =========================================================================
+      // ---- 第一道防线：外部访问门禁（控制谁能进入 Web 界面使用 AI） ----
+      // =========================================================================
+      React.createElement(
+        "div",
+        { style: s.card },
+        React.createElement(
+          "div",
+          { style: { marginBottom: 14 } },
+          React.createElement(
+            "div",
+            { style: { ...s.label, fontSize: 14, display: "flex", alignItems: "center", gap: 6 } },
+            "\u{1F6E1}\uFE0F \u7B2C\u4E00\u9053\u9632\u7EBF\uFF1A\u5916\u90E8\u8BBF\u95EE\u95E8\u7981\uFF08\u63A7\u5236\u8C01\u80FD\u4F7F\u7528 AI\uFF09"
+          ),
+          React.createElement(
+            "div",
+            { style: { ...s.muted, marginTop: 3 } },
+            "\u63A7\u5236\u5916\u90E8\u8BBE\u5907\u901A\u8FC7\u5C40\u57DF\u7F51 IP \u6216\u516C\u7F51\u96A7\u9053\uFF08Cloudflare/\u81EA\u5EFA\u96A7\u9053\uFF09\u8FDB\u5165 DSH \u804A\u5929\u754C\u9762\u65F6\u7684\u8EAB\u4EFD\u9A8C\u8BC1\u65B9\u5F0F"
+          )
+        ),
+        // 验证模式选择
+        React.createElement(
+          "div",
+          { style: { marginBottom: 16 } },
+          React.createElement("label", { style: { ...s.label, display: "block", marginBottom: 8, fontSize: 12 } }, "\u9A8C\u8BC1\u6A21\u5F0F\u9009\u62E9"),
+          React.createElement(
+            "div",
+            { style: { display: "flex", gap: 8, flexWrap: "wrap" } },
+            [
+              { id: "token_and_password", title: "\u{1F7E2} \u626B\u7801\u514D\u5BC6 + \u5BC6\u7801\u8BA4\u8BC1 (\u63A8\u8350)", desc: "\u4E8C\u7EF4\u7801\u81EA\u5E26\u4E13\u5C5E Token \u626B\u7801\u79D2\u8FDB\uFF1B\u76F4\u63A5\u8F93 IP/\u516C\u7F51\u57DF\u540D\u9700\u8F93\u5BC6\u7801" },
+              { id: "password_only", title: "\u{1F511} \u4EC5\u5BC6\u7801 / PIN \u7801\u767B\u5F55", desc: "\u6240\u6709\u5916\u90E8\u8BBF\u95EE\u5FC5\u987B\u624B\u52A8\u8F93\u5165\u8BBF\u95EE\u5BC6\u7801\u65B9\u53EF\u8FDB\u5165" },
+              { id: "token_only", title: "\u{1F3AB} \u4EC5\u5B89\u5168 Token \u514D\u5BC6", desc: "\u4EC5\u6301\u6709\u5E26\u5B89\u5168 Token \u7684\u4E8C\u7EF4\u7801\u6216\u4E13\u5C5E\u5206\u4EAB\u94FE\u63A5\u65B9\u53EF\u8FDB\u5165" }
+            ].map((opt) => {
+              const isSel = mode === opt.id;
+              return React.createElement(
+                "div",
+                {
+                  key: opt.id,
+                  onClick: () => handleChangeMode(opt.id),
+                  style: {
+                    flex: "1 1 200px",
+                    padding: "10px 12px",
+                    borderRadius: 8,
+                    border: `1px solid ${isSel ? "var(--dsw-alias-brand-primary,#4f6ef7)" : "var(--dsw-alias-border-l2,#e5e7eb)"}`,
+                    background: isSel ? "var(--dsw-alias-state-info-bg,#eff6ff)" : "var(--dsw-alias-bg-layer-2,#f9fafb)",
+                    cursor: "pointer",
+                    transition: "all 0.15s ease"
+                  }
+                },
+                React.createElement("div", { style: { fontSize: 13, fontWeight: isSel ? 600 : 500, color: isSel ? "var(--dsw-alias-brand-primary,#4f6ef7)" : "var(--dsw-alias-label-primary,currentColor)" } }, opt.title),
+                React.createElement("div", { style: { ...s.muted, fontSize: 11, marginTop: 4 } }, opt.desc)
+              );
+            })
+          )
+        ),
+        // 防护生效范围
+        React.createElement(
+          "div",
+          { style: { marginBottom: 16 } },
+          React.createElement("label", { style: { ...s.label, display: "block", marginBottom: 8, fontSize: 12 } }, "\u9632\u62A4\u751F\u6548\u901A\u9053"),
+          React.createElement(
+            "div",
+            { style: { display: "flex", gap: 8, flexWrap: "wrap" } },
+            [
+              { id: "all", title: "\u5168\u90E8\u901A\u9053\u9632\u62A4 (\u63A8\u8350)", desc: "\u5C40\u57DF\u7F51 IP \u76F4\u8FDE\u4E0E\u516C\u7F51\u96A7\u9053\u5168\u90E8\u53D7\u5B89\u5168\u4FDD\u62A4" },
+              { id: "public_only", title: "\u4EC5\u516C\u7F51\u96A7\u9053\u5F00\u542F\u9632\u62A4", desc: "\u5C40\u57DF\u7F51\u5185\u8BBE\u5907\u76F4\u63A5\u514D\u5BC6\u76F4\u8FDE\uFF0C\u516C\u7F51\u96A7\u9053\u5F3A\u5236\u9A8C\u8BC1" },
+              { id: "lan_only", title: "\u4EC5\u5C40\u57DF\u7F51\u5F00\u542F\u9632\u62A4", desc: "\u4EC5\u5C40\u57DF\u7F51\u76F4\u8FDE\u9700\u9A8C\u8BC1\uFF0C\u516C\u7F51\u96A7\u9053\u4E0D\u5F00\u542F" }
+            ].map((opt) => {
+              const isSel = scope === opt.id;
+              return React.createElement(
+                "div",
+                {
+                  key: opt.id,
+                  onClick: () => handleChangeScope(opt.id),
+                  style: {
+                    flex: "1 1 180px",
+                    padding: "9px 12px",
+                    borderRadius: 8,
+                    border: `1px solid ${isSel ? "var(--dsw-alias-brand-primary,#4f6ef7)" : "var(--dsw-alias-border-l2,#e5e7eb)"}`,
+                    background: isSel ? "var(--dsw-alias-state-info-bg,#eff6ff)" : "var(--dsw-alias-bg-layer-2,#f9fafb)",
+                    cursor: "pointer",
+                    transition: "all 0.15s ease"
+                  }
+                },
+                React.createElement("div", { style: { fontSize: 13, fontWeight: isSel ? 600 : 500, color: isSel ? "var(--dsw-alias-brand-primary,#4f6ef7)" : "var(--dsw-alias-label-primary,currentColor)" } }, opt.title),
+                React.createElement("div", { style: { ...s.muted, fontSize: 11, marginTop: 3 } }, opt.desc)
+              );
+            })
+          )
+        ),
+        // 访客访问密码输入框 (当非 token_only 时展示)
+        mode !== "token_only" && React.createElement(
+          "div",
+          { style: { marginBottom: 16 } },
+          React.createElement(
+            "label",
+            { style: { ...s.label, display: "block", marginBottom: 6, fontSize: 12 } },
+            `\u8BBE\u7F6E\u5916\u90E8\u8BBF\u5BA2\u8BBF\u95EE\u5BC6\u7801 ${auth?.hasPassword ? "(\u2713 \u5DF2\u8BBE\u7F6E\u8BBF\u5BA2\u5BC6\u7801)" : "(\u26A0\uFE0F \u5C1A\u672A\u8BBE\u7F6E\u5BC6\u7801\uFF0C\u76F4\u63A5\u8F93\u5165 IP \u5C06\u514D\u5BC6)"}`
+          ),
+          React.createElement(
+            "div",
+            { style: { display: "flex", gap: 8, alignItems: "center" } },
+            React.createElement("input", {
+              type: showAccessPassword ? "text" : "password",
+              style: { ...s.input, flex: 1 },
+              placeholder: auth?.hasPassword ? "\u8F93\u5165\u65B0\u5BC6\u7801\u4EE5\u4FEE\u6539\uFF08\u7559\u7A7A\u4FDD\u5B58\u53EF\u6E05\u9664\u8BBF\u5BA2\u5BC6\u7801\uFF09" : "\u8BBE\u7F6E\u5916\u90E8\u8BBF\u5BA2\u8BBF\u95EE\u5BC6\u7801 / PIN \u7801",
+              value: accessPassword,
+              onChange: (e) => setAccessPassword(e.target.value)
+            }),
+            React.createElement("button", {
+              style: { ...s.btnGhost, height: 32, fontSize: 12, whiteSpace: "nowrap", flexShrink: 0 },
+              onClick: () => setShowAccessPassword((v) => !v)
+            }, showAccessPassword ? "\u9690\u85CF" : "\u663E\u793A"),
+            React.createElement("button", {
+              style: {
+                ...s.btnPri,
+                height: 32,
+                fontSize: 12,
+                whiteSpace: "nowrap",
+                flexShrink: 0,
+                background: saveAccessSuccess ? "#059669" : "var(--dsw-alias-brand-primary, #4f6ef7)",
+                color: "#ffffff",
+                cursor: savingAccess ? "wait" : "pointer"
+              },
+              onClick: handleSaveAccessPassword,
+              disabled: savingAccess
+            }, savingAccess ? "\u4FDD\u5B58\u4E2D\u2026" : saveAccessSuccess ? "\u2713 \u5DF2\u6210\u529F\u4FDD\u5B58\uFF01" : "\u4FDD\u5B58\u8BBF\u95EE\u5BC6\u7801")
+          ),
+          React.createElement(
+            "div",
+            { style: { ...s.muted, fontSize: 11, marginTop: 4 } },
+            "\u{1F4A1} \u5F53\u5916\u90E8\u670B\u53CB\u6216\u540C\u4E8B\u672A\u901A\u8FC7\u4E8C\u7EF4\u7801\u626B\u7801\uFF0C\u800C\u662F\u76F4\u63A5\u8F93\u5165 IP \u6216\u516C\u7F51\u57DF\u540D\u8BBF\u95EE\u65F6\uFF0C\u9700\u8F93\u5165\u6B64\u5BC6\u7801\u767B\u5F55\u3002"
+          ),
+          msgAccess && React.createElement("div", {
+            style: {
+              marginTop: 8,
+              padding: "6px 12px",
+              borderRadius: 6,
+              fontSize: 12,
+              background: msgAccess.ok ? "var(--dsw-alias-state-success-bg,#ecfdf5)" : "var(--dsw-alias-state-error-bg,#fef2f2)",
+              color: msgAccess.ok ? "var(--dsw-alias-state-success-primary,#059669)" : "var(--dsw-alias-state-error-primary,#dc2626)"
+            }
+          }, msgAccess.text)
+        ),
+        // 免密 Token 管理
+        mode !== "password_only" && React.createElement(
+          "div",
+          { style: s.block },
+          React.createElement("label", { style: { ...s.label, display: "block", marginBottom: 6, fontSize: 12 } }, "\u514D\u5BC6\u626B\u7801 Token (\u4E13\u5C5E\u8BBF\u95EE\u51ED\u636E)"),
+          React.createElement(
+            "div",
+            { style: { display: "flex", gap: 8, alignItems: "center" } },
+            React.createElement(
+              "code",
+              { style: { ...s.code, flex: 1, padding: "6px 10px", background: "var(--dsw-alias-bg-layer-1,#fff)", borderRadius: 6, border: "1px solid var(--dsw-alias-border-l2,#e5e7eb)" } },
+              auth?.secretToken ? `${auth.secretToken.slice(0, 10)}****************` : "\u672A\u751F\u6210"
+            ),
+            React.createElement("button", {
+              style: { ...s.btnGhost, height: 32, fontSize: 12, whiteSpace: "nowrap", flexShrink: 0 },
+              onClick: handleRegenerateToken,
+              title: "\u91CD\u65B0\u751F\u6210 Token\uFF0C\u4F7F\u4E4B\u524D\u5206\u4EAB\u7684\u65E7\u4E8C\u7EF4\u7801\u548C\u94FE\u63A5\u7ACB\u5373\u5931\u6548"
+            }, "\u{1F504} \u91CD\u7F6E\u5B89\u5168 Token")
+          ),
+          React.createElement(
+            "div",
+            { style: { ...s.muted, fontSize: 11, marginTop: 4 } },
+            "\u{1F4A1} \u63A7\u5236\u53F0\u751F\u6210\u7684\u5C40\u57DF\u7F51\u4E0E\u516C\u7F51\u4E8C\u7EF4\u7801\u5DF2\u81EA\u52A8\u5D4C\u5165\u6B64 Token\uFF0C\u624B\u673A\u626B\u7801\u5373\u53EF\u514D\u5BC6\u8FDB\u5165\u804A\u5929\u754C\u9762\uFF08\u4F46\u4E0D\u8D4B\u4E88\u540E\u53F0\u7BA1\u7406\u8BBE\u7F6E\u6743\u9650\uFF09\u3002"
+          )
+        )
+      ),
+      // =========================================================================
+      // ---- 第二道防线：后台管理防篡改（控制谁能修改本插件所有设置） ----
+      // =========================================================================
+      React.createElement(
+        "div",
+        { style: s.card },
+        React.createElement(
+          "div",
+          { style: { marginBottom: 14 } },
+          React.createElement(
+            "div",
+            { style: { ...s.label, fontSize: 14, display: "flex", alignItems: "center", gap: 6 } },
+            "\u{1F512} \u7B2C\u4E8C\u9053\u9632\u7EBF\uFF1A\u7BA1\u7406\u540E\u53F0\u9632\u7BE1\u6539\uFF08\u63A7\u5236\u8C01\u80FD\u4FEE\u6539\u672C\u63D2\u4EF6\u6240\u6709\u8BBE\u7F6E\uFF09"
+          ),
+          React.createElement(
+            "div",
+            { style: { ...s.muted, marginTop: 3 } },
+            "\u9501\u5B9A\u6574\u4E2A\u63D2\u4EF6\u8BBE\u7F6E\u540E\u53F0\uFF08\u5305\u542B\u5C40\u57DF\u7F51\u3001\u516C\u7F51\u96A7\u9053\u3001IM \u673A\u5668\u4EBA\u5BC6\u94A5\u4E0E\u5B89\u5168\u8BBE\u7F6E\uFF09\uFF0C\u9632\u6B62\u4ED6\u4EBA\u968F\u610F\u7BE1\u6539\u914D\u7F6E"
+          )
+        ),
+        // 管理员密码设置
+        React.createElement(
+          "div",
+          { style: { marginBottom: 16 } },
+          React.createElement(
+            "label",
+            { style: { ...s.label, display: "block", marginBottom: 6, fontSize: 12 } },
+            `\u8BBE\u7F6E\u72EC\u7ACB\u7BA1\u7406\u5458\u5BC6\u7801 ${auth?.hasAdminPassword ? "(\u2713 \u5DF2\u8BBE\u7F6E\u72EC\u7ACB\u7BA1\u7406\u5BC6\u7801)" : "(\u672A\u5355\u72EC\u8BBE\u7F6E\uFF0C\u9ED8\u8BA4\u4F7F\u7528\u4E0A\u8FF0\u8BBF\u5BA2\u8BBF\u95EE\u5BC6\u7801)"}`
+          ),
+          React.createElement(
+            "div",
+            { style: { display: "flex", gap: 8, alignItems: "center" } },
+            React.createElement("input", {
+              type: showAdminPassword ? "text" : "password",
+              style: { ...s.input, flex: 1 },
+              placeholder: auth?.hasAdminPassword ? "\u8F93\u5165\u65B0\u5BC6\u7801\u4EE5\u4FEE\u6539\uFF08\u7559\u7A7A\u4FDD\u5B58\u53EF\u6E05\u9664\u72EC\u7ACB\u7BA1\u7406\u5BC6\u7801\uFF09" : "\u8BBE\u7F6E\u540E\u53F0\u7BA1\u7406\u89E3\u9501\u5BC6\u7801\uFF08\u5EFA\u8BAE\u4E0E\u8BBF\u5BA2\u5BC6\u7801\u4E0D\u540C\uFF09",
+              value: adminPassword,
+              onChange: (e) => setAdminPassword(e.target.value)
+            }),
+            React.createElement("button", {
+              style: { ...s.btnGhost, height: 32, fontSize: 12, whiteSpace: "nowrap", flexShrink: 0 },
+              onClick: () => setShowAdminPassword((v) => !v)
+            }, showAdminPassword ? "\u9690\u85CF" : "\u663E\u793A"),
+            React.createElement("button", {
+              style: {
+                ...s.btnPri,
+                height: 32,
+                fontSize: 12,
+                whiteSpace: "nowrap",
+                flexShrink: 0,
+                background: saveAdminSuccess ? "#059669" : "var(--dsw-alias-brand-primary, #4f6ef7)",
+                color: "#ffffff",
+                cursor: savingAdmin ? "wait" : "pointer"
+              },
+              onClick: handleSaveAdminPassword,
+              disabled: savingAdmin
+            }, savingAdmin ? "\u4FDD\u5B58\u4E2D\u2026" : saveAdminSuccess ? "\u2713 \u5DF2\u6210\u529F\u4FDD\u5B58\uFF01" : "\u4FDD\u5B58\u7BA1\u7406\u5BC6\u7801")
+          ),
+          React.createElement(
+            "div",
+            { style: { ...s.muted, fontSize: 11, marginTop: 4, color: "var(--dsw-alias-brand-primary,#4f6ef7)" } },
+            "\u{1F511} \u6838\u5FC3\u4F5C\u7528\uFF1A\u7528\u4E8E\u8FDC\u7A0B\u8BBE\u5907\u8FDB\u5165\u8BBE\u7F6E\u540E\u53F0\u65F6\u7684\u89E3\u9501\u9A8C\u8BC1\u3002\u8BBE\u7F6E\u540E\uFF0C\u5373\u4FBF\u628A\u8BBF\u95EE\u5BC6\u7801\u544A\u77E5\u4ED6\u4EBA\uFF0C\u4ED6\u4EBA\u4E5F\u65E0\u6CD5\u8FDB\u5165\u8BBE\u7F6E\u540E\u53F0\u6539\u914D\u7F6E\u3002"
+          ),
+          msgAdmin && React.createElement("div", {
+            style: {
+              marginTop: 8,
+              padding: "6px 12px",
+              borderRadius: 6,
+              fontSize: 12,
+              background: msgAdmin.ok ? "var(--dsw-alias-state-success-bg,#ecfdf5)" : "var(--dsw-alias-state-error-bg,#fef2f2)",
+              color: msgAdmin.ok ? "var(--dsw-alias-state-success-primary,#059669)" : "var(--dsw-alias-state-error-primary,#dc2626)"
+            }
+          }, msgAdmin.text)
+        ),
+        // 远程管理权限控制策略
+        React.createElement(
+          "div",
+          { style: s.block },
+          React.createElement("label", { style: { ...s.label, display: "block", marginBottom: 8, fontSize: 12 } }, "\u8FDC\u7A0B\u8BBE\u5907\u7BA1\u7406\u6743\u9650\u7B56\u7565"),
+          React.createElement(
+            "div",
+            { style: { display: "flex", gap: 8, flexWrap: "wrap" } },
+            [
+              { id: "password_unlock", title: "\u{1F512} \u9700\u5BC6\u7801\u89E3\u9501 (\u63A8\u8350)", desc: "\u8FDC\u7A0B\u624B\u673A/\u5916\u7F51\u6253\u5F00\u672C\u63D2\u4EF6\u8BBE\u7F6E\u65F6\u9ED8\u8BA4\u5168\u5C40\u9501\u5B9A\uFF0C\u8F93\u5165\u7BA1\u7406\u5BC6\u7801\u89E3\u9501\u540E\u65B9\u53EF\u4F7F\u7528" },
+              { id: "local_only", title: "\u{1F6AB} \u4EC5\u9650\u7535\u8111\u672C\u673A\u7BA1\u7406 (\u6700\u4E25\u683C)", desc: "\u8FDC\u7A0B\u8BBE\u5907\u5F7B\u5E95\u9501\u5B9A\u6574\u4E2A\u8BBE\u7F6E\u540E\u53F0\uFF0C\u4EC5\u5141\u8BB8\u5728 127.0.0.1 \u7535\u8111\u672C\u673A\u4E0A\u64CD\u4F5C" },
+              { id: "open", title: "\u{1F513} \u5BBD\u677E\u6A21\u5F0F", desc: "\u4EFB\u4F55\u5DF2\u901A\u8FC7\u7B2C\u4E00\u9053\u9632\u7EBF\u767B\u5F55\u7684\u8BBE\u5907\u5747\u53EF\u76F4\u63A5\u4FEE\u6539\u6240\u6709\u914D\u7F6E" }
+            ].map((opt) => {
+              const isSel = adminPolicy === opt.id;
+              return React.createElement(
+                "div",
+                {
+                  key: opt.id,
+                  onClick: () => handleChangeAdminPolicy(opt.id),
+                  style: {
+                    flex: "1 1 180px",
+                    padding: "10px 12px",
+                    borderRadius: 8,
+                    border: `1px solid ${isSel ? "var(--dsw-alias-brand-primary,#4f6ef7)" : "var(--dsw-alias-border-l2,#e5e7eb)"}`,
+                    background: isSel ? "var(--dsw-alias-state-info-bg,#eff6ff)" : "var(--dsw-alias-bg-layer-2,#f9fafb)",
+                    cursor: "pointer",
+                    transition: "all 0.15s ease"
+                  }
+                },
+                React.createElement("div", { style: { fontSize: 13, fontWeight: isSel ? 600 : 500, color: isSel ? "var(--dsw-alias-brand-primary,#4f6ef7)" : "var(--dsw-alias-label-primary,currentColor)" } }, opt.title),
+                React.createElement("div", { style: { ...s.muted, fontSize: 11, marginTop: 4 } }, opt.desc)
+              );
+            })
+          )
+        )
+      )
+    )
+  );
+});
 function PlatformCard({ platformId, platformName, platformDesc, rpcCall, onStatusChange }) {
   const [platform, setPlatform] = React.useState(null);
   const [err, setErr] = React.useState(null);
@@ -437,15 +995,23 @@ function PlatformCard({ platformId, platformName, platformDesc, rpcCall, onStatu
     const connected2 = platform?.status === "connected" || platform?.status === "starting" || platform?.status === "reconnecting";
     onStatusChange?.(connected2);
   }, [platform?.status, onStatusChange]);
+  const loadInFlightRef = React.useRef(false);
+  const seqRef = React.useRef(0);
   const load = React.useCallback(async (quiet = false) => {
+    if (loadInFlightRef.current) return;
+    loadInFlightRef.current = true;
+    const currentSeq = ++seqRef.current;
     try {
       const r = await rpcCall(BRIDGE_ENDPOINTS.listPlatforms, {});
+      if (currentSeq !== seqRef.current) return;
       if (!r?.ok) throw new Error(r?.error?.message ?? "RPC failed");
       const allPlatforms = r.value ?? {};
       setPlatform(allPlatforms[platformId] ?? null);
       if (!quiet) setErr(null);
     } catch (e) {
-      if (!quiet) setErr(e.message);
+      if (currentSeq === seqRef.current && !quiet) setErr(e.message);
+    } finally {
+      loadInFlightRef.current = false;
     }
   }, [rpcCall, platformId]);
   React.useEffect(() => {
@@ -476,9 +1042,20 @@ function PlatformCard({ platformId, platformName, platformDesc, rpcCall, onStatu
     const id = newId.trim();
     if (!id) return;
     const list = [...platform?.allowFrom ?? [], id];
-    await act(BRIDGE_ENDPOINTS.platformSetAllowFrom, { allowFrom: list });
-    setNewId("");
-  }, [act, newId, platform?.allowFrom]);
+    setBusy(true);
+    try {
+      const r = await rpcCall(BRIDGE_ENDPOINTS.platformSetAllowFrom, { platformId, allowFrom: list });
+      if (!r?.ok) throw new Error(r?.error?.message ?? "\u6DFB\u52A0\u767D\u540D\u5355\u5931\u8D25");
+      setPlatform(r.value);
+      setNewId("");
+      setErr(null);
+      await load(true);
+    } catch (e) {
+      setErr(e.message);
+    } finally {
+      setBusy(false);
+    }
+  }, [rpcCall, platformId, newId, platform?.allowFrom, load]);
   const removeAllow = React.useCallback(async (id) => {
     const list = (platform?.allowFrom ?? []).filter((x) => x !== id);
     await act(BRIDGE_ENDPOINTS.platformSetAllowFrom, { allowFrom: list });
@@ -524,7 +1101,7 @@ function PlatformCard({ platformId, platformName, platformDesc, rpcCall, onStatu
       React.createElement("div", { style: { ...s.muted, marginTop: 6 } }, "\u52A0\u8F7D\u4E2D\u2026")
     );
   }
-  const connected = platform?.status === "connected" || platform?.status === "starting";
+  const connected = platform?.status === "connected" || platform?.status === "starting" || platform?.status === "reconnecting";
   const login = platform?.login ?? {};
   const showQr = login.phase === "qr" || login.phase === "scaned";
   const statusLabel = platform?.status === "connected" ? "\u5DF2\u8FDE\u63A5" : platform?.status === "starting" ? "\u8FDE\u63A5\u4E2D\u2026" : platform?.status === "reconnecting" ? "\u91CD\u8FDE\u4E2D\u2026" : platform?.status === "paused" ? "\u6682\u505C\uFF08\u4F1A\u8BDD\u8FC7\u671F\uFF09" : platform?.status === "error" ? "\u9519\u8BEF" : "\u672A\u8FDE\u63A5";
@@ -1178,7 +1755,8 @@ function VersionBanner({ rpcCall }) {
 var TABS = [
   { id: "lan", label: "\u5C40\u57DF\u7F51", icon: Icons.lan },
   { id: "tunnel", label: "\u516C\u7F51\u96A7\u9053", icon: Icons.tunnel },
-  { id: "im", label: "IM \u673A\u5668\u4EBA", icon: Icons.bot }
+  { id: "im", label: "IM \u673A\u5668\u4EBA", icon: Icons.bot },
+  { id: "security", label: "\u5B89\u5168\u8BA4\u8BC1", icon: Icons.security }
 ];
 function TabBar({ active, onChange, dots }) {
   return React.createElement(
@@ -1245,25 +1823,84 @@ function BridgePanel({ rpcCall }) {
   const [activeTab, setActiveTab] = React.useState("lan");
   const [platforms, setPlatforms] = React.useState(null);
   const [selectedPlatform, setSelectedPlatform] = React.useState("wechat");
+  const isLocalhost = typeof window === "undefined" || (!window.location.hostname || window.location.hostname === "127.0.0.1" || window.location.hostname === "localhost" || window.location.hostname === "::1" || window.location.hostname === "" || window.location.protocol === "file:" || window.location.protocol === "vscode-webview:" || window.location.protocol === "app:" || window.location.hostname.endsWith(".local"));
+  const [adminToken, setAdminToken] = React.useState("");
+  const [adminUnlocked, setAdminUnlocked] = React.useState(false);
+  const [unlockPassword, setUnlockPassword] = React.useState("");
+  const [unlockErr, setUnlockErr] = React.useState(null);
+  const [unlocking, setUnlocking] = React.useState(false);
+  const [showForgotGuide, setShowForgotGuide] = React.useState(false);
+  const authRpcCall = React.useCallback((endpoint, payload = {}, signal) => {
+    const enriched = {
+      ...payload,
+      ...adminToken ? { adminToken } : {},
+      ...isLocalhost ? { isLocalhost: true } : {}
+    };
+    return rpcCall(endpoint, enriched, signal);
+  }, [rpcCall, adminToken, isLocalhost]);
+  const handleUnlockAdmin = React.useCallback(async (e) => {
+    e?.preventDefault?.();
+    setUnlocking(true);
+    setUnlockErr(null);
+    try {
+      const res = await rpcCall(BRIDGE_ENDPOINTS.authAdminUnlock, { password: unlockPassword });
+      if (res?.ok) {
+        setAdminToken(res.value?.adminToken || "");
+        setAdminUnlocked(true);
+        setUnlockPassword("");
+      } else {
+        setUnlockErr(res?.error?.message || "\u7BA1\u7406\u5458\u5BC6\u7801\u9519\u8BEF");
+      }
+    } catch (err2) {
+      setUnlockErr(err2.message || "\u89E3\u9501\u8BF7\u6C42\u5931\u8D25");
+    } finally {
+      setUnlocking(false);
+    }
+  }, [rpcCall, unlockPassword]);
+  const handleLockAdmin = React.useCallback(async () => {
+    try {
+      if (adminToken) {
+        await rpcCall(BRIDGE_ENDPOINTS.authAdminLock, { adminToken });
+      }
+    } catch {
+    }
+    setAdminToken("");
+    setAdminUnlocked(false);
+  }, [rpcCall, adminToken]);
+  const loadInFlightRef = React.useRef(false);
+  const loadSeqRef = React.useRef(0);
   const load = React.useCallback(async (quiet = false) => {
+    if (loadInFlightRef.current) return;
+    loadInFlightRef.current = true;
+    const currentSeq = ++loadSeqRef.current;
     try {
-      const r = await rpcCall(BRIDGE_ENDPOINTS.getStatus, {});
+      const r = await authRpcCall(BRIDGE_ENDPOINTS.getStatus, {});
+      if (currentSeq !== loadSeqRef.current) return;
       if (!r?.ok) throw new Error(r?.error?.message ?? "RPC failed");
       setStatus(r.value);
       if (!quiet) setErr(null);
     } catch (e) {
-      setErr(e.message);
+      if (currentSeq === loadSeqRef.current) setErr(e.message);
+    } finally {
+      loadInFlightRef.current = false;
     }
-  }, [rpcCall]);
+  }, [authRpcCall]);
+  const pollPlatformsSeqRef = React.useRef(0);
   React.useEffect(() => {
     let alive = true;
+    let inFlight = false;
     const poll = async () => {
+      if (inFlight || !alive) return;
+      inFlight = true;
+      const currentSeq = ++pollPlatformsSeqRef.current;
       try {
-        const r = await rpcCall(BRIDGE_ENDPOINTS.listPlatforms, {});
-        if (alive && r?.ok) {
+        const r = await authRpcCall(BRIDGE_ENDPOINTS.listPlatforms, {});
+        if (alive && currentSeq === pollPlatformsSeqRef.current && r?.ok) {
           setPlatforms(r.value ?? {});
         }
       } catch {
+      } finally {
+        inFlight = false;
       }
     };
     poll();
@@ -1272,7 +1909,7 @@ function BridgePanel({ rpcCall }) {
       alive = false;
       clearInterval(t);
     };
-  }, [rpcCall]);
+  }, [authRpcCall]);
   React.useEffect(() => {
     load();
     const t = setInterval(() => load(true), 3e3);
@@ -1280,14 +1917,14 @@ function BridgePanel({ rpcCall }) {
   }, [load]);
   const act = React.useCallback(async (endpoint, payload) => {
     try {
-      const r = await rpcCall(endpoint, payload ?? {});
+      const r = await authRpcCall(endpoint, payload ?? {});
       if (!r?.ok) throw new Error(r?.error?.message ?? "RPC failed");
       setStatus(r.value);
       setErr(null);
     } catch (e) {
       setErr(e.message);
     }
-  }, [rpcCall]);
+  }, [authRpcCall]);
   const onStartCloudflared = React.useCallback(() => act(BRIDGE_ENDPOINTS.startCloudflared), [act]);
   const onStopCloudflared = React.useCallback(() => act(BRIDGE_ENDPOINTS.stopCloudflared), [act]);
   const onResetCloudflared = React.useCallback(
@@ -1300,6 +1937,7 @@ function BridgePanel({ rpcCall }) {
     (serverUrl, accessToken) => act(BRIDGE_ENDPOINTS.saveCustomTunnelConfig, { serverUrl, accessToken }),
     [act]
   );
+  const navSecurity = React.useCallback(() => setActiveTab("security"), []);
   if (!status && !err) {
     return React.createElement("div", {
       style: { padding: 32, color: "var(--dsw-alias-label-tertiary,#9ca3af)", fontSize: 13 }
@@ -1312,14 +1950,17 @@ function BridgePanel({ rpcCall }) {
   const dots = {
     lan: !!status?.proxy?.running,
     tunnel: !!(status?.cloudflared?.running || ct?.running),
-    im: !!imConnected
+    im: !!imConnected,
+    security: !!status?.auth?.enabled
   };
   let tabContent;
   if (activeTab === "lan") {
     tabContent = React.createElement(TunnelCard, {
       title: "\u5C40\u57DF\u7F51\u8BBF\u95EE",
       desc: "\u540C\u4E00 Wi-Fi \u4E0B\u7684\u8BBE\u5907\u53EF\u76F4\u63A5\u626B\u7801\u8BBF\u95EE",
-      data: { running: status?.proxy?.running, url: status?.lan?.url, qr: status?.lan?.qr }
+      data: { running: status?.proxy?.running, url: status?.lan?.url, qr: status?.lan?.qr },
+      auth: status?.auth,
+      onNavigateSecurity: navSecurity
     });
   } else if (activeTab === "tunnel") {
     tabContent = React.createElement(
@@ -1334,6 +1975,8 @@ function BridgePanel({ rpcCall }) {
           qr: status?.cloudflared?.qr,
           state: status?.cloudflared?.state
         },
+        auth: status?.auth,
+        onNavigateSecurity: navSecurity,
         onStart: onStartCloudflared,
         onStop: onStopCloudflared,
         onReset: status?.cloudflared?.running ? onResetCloudflared : null
@@ -1350,6 +1993,8 @@ function BridgePanel({ rpcCall }) {
             qr: ct?.qr,
             state: ct?.state
           },
+          auth: status?.auth,
+          onNavigateSecurity: navSecurity,
           onStart: onStartCustom,
           onStop: onStopCustom
         },
@@ -1361,6 +2006,12 @@ function BridgePanel({ rpcCall }) {
         })
       )
     );
+  } else if (activeTab === "security") {
+    tabContent = React.createElement(AccessAuthCard, {
+      auth: status?.auth,
+      rpcCall: authRpcCall,
+      onUpdate: () => load(true)
+    });
   } else if (activeTab === "im") {
     const IM_PLATFORMS = [
       { id: "wechat", label: "\u5FAE\u4FE1", icon: Icons.wechat, brandColor: "#07C160", desc: "ClawBot \u626B\u7801\u76F4\u8FDE \xB7 \u65E0\u9700\u516C\u7F51" },
@@ -1421,25 +2072,167 @@ function BridgePanel({ rpcCall }) {
           );
         })
       ),
-      // 显示选中的平台卡片
+      // 显示选中的平台卡片（带有 key 保证切换时重置表单状态）
       selectedPlatform && platforms?.[selectedPlatform] && React.createElement(PlatformCard, {
+        key: selectedPlatform,
         platformId: selectedPlatform,
         platformName: IM_PLATFORMS.find((p) => p.id === selectedPlatform)?.label ?? selectedPlatform,
         platformDesc: IM_PLATFORMS.find((p) => p.id === selectedPlatform)?.desc ?? "",
-        rpcCall,
+        rpcCall: authRpcCall,
         onStatusChange: () => {
         }
         // 状态变化已由 listPlatforms 轮询处理，不需要回调
       })
     );
   }
+  const auth = status?.auth;
+  const policy = auth?.adminPolicy ?? "password_unlock";
+  const isLocked = !isLocalhost && auth?.enabled && policy !== "open" && !adminUnlocked;
+  if (isLocked) {
+    return React.createElement(
+      "div",
+      { style: { maxWidth: 620 } },
+      policy === "local_only" ? React.createElement(
+        "div",
+        {
+          style: { ...s.card, textAlign: "center", padding: "36px 20px", marginTop: 10 }
+        },
+        React.createElement("div", { style: { fontSize: 40, marginBottom: 12 } }, "\u{1F6E1}\uFE0F"),
+        React.createElement("div", { style: { ...s.label, fontSize: 16, fontWeight: 600, marginBottom: 8 } }, "\u7BA1\u7406\u63A7\u5236\u53F0\u5DF2\u9501\u5B9A\uFF08\u4EC5\u9650\u7535\u8111\u672C\u673A\u7BA1\u7406\uFF09"),
+        React.createElement(
+          "div",
+          { style: { ...s.muted, maxWidth: 420, margin: "0 auto", lineHeight: 1.6, fontSize: 13 } },
+          "\u5F53\u524D\u8BBE\u5907\u901A\u8FC7\u8FDC\u7A0B\u5C40\u57DF\u7F51\u6216\u516C\u7F51\u63A5\u5165\u3002\u5DF2\u5F00\u542F\u300C\u4EC5\u9650\u7535\u8111\u672C\u673A\u7BA1\u7406\u300D\u6700\u9AD8\u5B89\u5168\u7B56\u7565\uFF0C\u8FDC\u7A0B\u8BBE\u5907\u7981\u6B62\u67E5\u770B\u4E0E\u4FEE\u6539\u4EFB\u4F55\u7F51\u7EDC\u4E0E\u673A\u5668\u4EBA\u914D\u7F6E\u3002\u5982\u9700\u7BA1\u7406\u8BF7\u5728\u7535\u8111\u672C\u673A\uFF08127.0.0.1\uFF09\u4E0A\u64CD\u4F5C\u3002"
+        ),
+        React.createElement(
+          "div",
+          { style: { marginTop: 20 } },
+          React.createElement("button", {
+            type: "button",
+            style: { ...s.btnLink, fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)" },
+            onClick: () => setShowForgotGuide((v) => !v)
+          }, "\u2753 \u8FDC\u7A0B\u5982\u4F55\u6551\u6025\u89E3\u9664\u9501\u5B9A\uFF1F")
+        ),
+        showForgotGuide && React.createElement(
+          "div",
+          {
+            style: {
+              marginTop: 14,
+              padding: "12px 14px",
+              borderRadius: 8,
+              fontSize: 12,
+              lineHeight: 1.6,
+              background: "var(--dsw-alias-bg-layer-2,#f3f4f6)",
+              border: "1px solid var(--dsw-alias-border-l2,#e5e7eb)",
+              color: "var(--dsw-alias-label-secondary,#4b5563)",
+              textAlign: "left",
+              maxWidth: 420,
+              margin: "14px auto 0"
+            }
+          },
+          React.createElement("div", { style: { fontWeight: 600, color: "var(--dsw-alias-label-primary,currentColor)", marginBottom: 4 } }, "\u{1F6DF} \u6551\u6025\u89E3\u9664\u9501\u5B9A\u6307\u5F15\uFF1A"),
+          React.createElement("div", null, "1. ", React.createElement("strong", null, "\u7535\u8111\u672C\u673A\u76F4\u8FDE\u4FEE\u6539"), "\uFF1A\u76F4\u63A5\u5728\u8FD0\u884C\u672C\u7A0B\u5E8F\u7684\u7535\u8111\u672C\u673A\u6253\u5F00\u672C\u63A7\u5236\u53F0\uFF08127.0.0.1 \u4EAB\u6709\u7269\u7406\u514D\u9501\u7279\u6743\uFF09\uFF0C\u53EF\u968F\u65F6\u4FEE\u6539\u7B56\u7565\u6216\u6E05\u9664\u5BC6\u7801\u3002"),
+          React.createElement("div", { style: { marginTop: 4 } }, "2. ", React.createElement("strong", null, "\u670D\u52A1\u5668\u6551\u6025\u6307\u4EE4"), "\uFF1A\u5728\u5BBF\u4E3B\u7535\u8111/\u670D\u52A1\u5668\u7EC8\u7AEF\u6267\u884C ", React.createElement("code", { style: s.code }, "touch ~/.dsh/dsh-bridge/reset-auth"), " \u5373\u53EF\u77AC\u95F4\u6E05\u7A7A\u5BC6\u7801\u6062\u590D\u521D\u59CB\u72B6\u6001\u3002")
+        )
+      ) : React.createElement(
+        "div",
+        {
+          style: { ...s.card, maxWidth: 440, margin: "20px auto", padding: "32px 24px" }
+        },
+        React.createElement(
+          "div",
+          { style: { textAlign: "center", marginBottom: 20 } },
+          React.createElement("div", { style: { fontSize: 40, marginBottom: 10 } }, "\u{1F512}"),
+          React.createElement("div", { style: { ...s.label, fontSize: 16, fontWeight: 600 } }, "\u7BA1\u7406\u63A7\u5236\u53F0\u5DF2\u9501\u5B9A"),
+          React.createElement(
+            "div",
+            { style: { ...s.muted, fontSize: 12, marginTop: 6, lineHeight: 1.5 } },
+            "\u5F53\u524D\u8BBE\u5907\u4E3A\u8FDC\u7A0B\u8BBF\u95EE\u3002\u4E3A\u4FDD\u62A4\u60A8\u7684\u7F51\u7EDC\u4E0E\u5E73\u53F0\u914D\u7F6E\u5B89\u5168\uFF0C\u8BF7\u8F93\u5165\u7BA1\u7406\u5458\u5BC6\u7801\u89E3\u9501\u7BA1\u7406\u6743\u9650\u3002"
+          )
+        ),
+        React.createElement(
+          "form",
+          {
+            onSubmit: handleUnlockAdmin,
+            style: { display: "flex", flexDirection: "column", gap: 12 }
+          },
+          React.createElement("input", {
+            type: "password",
+            style: s.input,
+            placeholder: "\u8F93\u5165\u540E\u53F0\u7BA1\u7406\u5BC6\u7801",
+            value: unlockPassword,
+            onChange: (e) => setUnlockPassword(e.target.value),
+            autoFocus: true
+          }),
+          unlockErr && React.createElement("div", {
+            style: { fontSize: 12, color: "var(--dsw-alias-state-error-primary,#dc2626)" }
+          }, unlockErr),
+          React.createElement("button", {
+            type: "submit",
+            style: { ...s.btnPri, width: "100%", justifyContent: "center", height: 36, background: "#4f6ef7", color: "#ffffff" },
+            disabled: unlocking
+          }, unlocking ? "\u9A8C\u8BC1\u4E2D\u2026" : "\u89E3\u9501\u7BA1\u7406\u6743\u9650")
+        ),
+        React.createElement(
+          "div",
+          { style: { marginTop: 16, textAlign: "center" } },
+          React.createElement("button", {
+            type: "button",
+            style: { ...s.btnLink, fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)" },
+            onClick: () => setShowForgotGuide((v) => !v)
+          }, "\u2753 \u5FD8\u8BB0\u540E\u53F0\u7BA1\u7406\u5BC6\u7801\uFF1F")
+        ),
+        showForgotGuide && React.createElement(
+          "div",
+          {
+            style: {
+              marginTop: 12,
+              padding: "12px 14px",
+              borderRadius: 8,
+              fontSize: 12,
+              lineHeight: 1.6,
+              background: "var(--dsw-alias-bg-layer-2,#f3f4f6)",
+              border: "1px solid var(--dsw-alias-border-l2,#e5e7eb)",
+              color: "var(--dsw-alias-label-secondary,#4b5563)",
+              textAlign: "left"
+            }
+          },
+          React.createElement("div", { style: { fontWeight: 600, color: "var(--dsw-alias-label-primary,currentColor)", marginBottom: 4 } }, "\u{1F6DF} \u627E\u56DE\u4E0E\u91CD\u7F6E\u5BC6\u7801\u6307\u5F15\uFF1A"),
+          React.createElement("div", null, "1. ", React.createElement("strong", null, "\u7535\u8111\u672C\u673A\u76F4\u8FDE\u4FEE\u6539"), "\uFF1A\u76F4\u63A5\u5728\u8FD0\u884C\u672C\u7A0B\u5E8F\u7684\u7535\u8111\u672C\u673A\u6253\u5F00\u672C\u63A7\u5236\u53F0\uFF08127.0.0.1 \u4EAB\u6709\u7269\u7406\u514D\u9501\u7279\u6743\uFF09\uFF0C\u53EF\u968F\u65F6\u4FEE\u6539\u7BA1\u7406\u5BC6\u7801\u3002"),
+          React.createElement("div", { style: { marginTop: 4 } }, "2. ", React.createElement("strong", null, "\u670D\u52A1\u5668\u6551\u6025\u6307\u4EE4"), "\uFF1A\u5728\u5BBF\u4E3B\u7535\u8111\u7EC8\u7AEF\u6267\u884C ", React.createElement("code", { style: s.code }, "touch ~/.dsh/dsh-bridge/reset-auth"), " \u5373\u53EF\u77AC\u95F4\u6E05\u7A7A\u5BC6\u7801\u6062\u590D\u521D\u59CB\u72B6\u6001\u3002")
+        )
+      )
+    );
+  }
   return React.createElement(
     "div",
     { style: { maxWidth: 620 } },
     err && React.createElement("div", {
       style: { ...s.card, background: "var(--dsw-alias-state-error-bg,#fef2f2)", color: "var(--dsw-alias-state-error-primary,#dc2626)", fontSize: 13, marginBottom: 16 }
     }, err),
-    React.createElement(VersionBanner, { rpcCall }),
+    !isLocalhost && adminUnlocked && React.createElement(
+      "div",
+      {
+        style: {
+          display: "flex",
+          alignItems: "center",
+          justifyContent: "space-between",
+          padding: "8px 14px",
+          background: "var(--dsw-alias-state-info-bg,#eff6ff)",
+          border: "1px solid var(--dsw-alias-brand-primary,#4f6ef7)",
+          borderRadius: 8,
+          marginBottom: 14,
+          fontSize: 12,
+          color: "var(--dsw-alias-brand-primary,#4f6ef7)"
+        }
+      },
+      React.createElement("span", null, "\u{1F513} \u7BA1\u7406\u5458\u6743\u9650\u5DF2\u89E3\u9501\uFF08\u5F53\u524D\u4E34\u65F6\u4F1A\u8BDD\u6709\u6548\uFF09"),
+      React.createElement("button", {
+        style: { ...s.btnGhost, height: 24, fontSize: 11, padding: "0 8px" },
+        onClick: handleLockAdmin
+      }, "\u{1F512} \u91CD\u65B0\u9501\u5B9A\u540E\u53F0")
+    ),
+    React.createElement(VersionBanner, { rpcCall: authRpcCall }),
     React.createElement(TabBar, { active: activeTab, onChange: setActiveTab, dots }),
     tabContent
   );