@wenbin_wb/dsh-bridge 2.5.1 → 2.5.3

package/lib/index.js

@@ -193,6 +193,38 @@ class ProxyServer {
         return;
       }
 
+      // 3.1 本机特权 Token 签发：仅限真正物理回环连接（127.0.0.1 / ::1，严禁隧道转发流量伪造）
+      if (req.url === '/__dsh_bridge__/loopback-token') {
+        const corsHeaders = {
+          'Access-Control-Allow-Origin': '*',
+          'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+          'Access-Control-Allow-Headers': 'Content-Type',
+        };
+        if (req.method === 'OPTIONS') {
+          res.writeHead(204, corsHeaders);
+          res.end();
+          return;
+        }
+
+        const remote = req.socket?.remoteAddress || '';
+        const isLoopback = (remote === '127.0.0.1' || remote === '::1' || remote === '::ffff:127.0.0.1');
+        const internalTunnelHeader = req.headers?.['x-dsh-internal-tunnel'];
+        const isCustomTunnel = Boolean(isLoopback && internalTunnelHeader && internalTunnelHeader === this.authManager?.internalTunnelSecret);
+        const isCloudflare = Boolean(isLoopback && (req.headers?.['cf-ray'] || req.headers?.['cf-connecting-ip']));
+        const isPublicTunnel = isCustomTunnel || isCloudflare;
+
+        if (isLoopback && !isPublicTunnel && this.authManager) {
+          const adminToken = this.authManager.createAdminSession();
+          res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8', ...corsHeaders });
+          res.end(JSON.stringify({ ok: true, adminToken }));
+          return;
+        }
+
+        res.writeHead(403, { 'Content-Type': 'application/json; charset=utf-8', ...corsHeaders });
+        res.end(JSON.stringify({ ok: false, error: 'Forbidden: loopback only' }));
+        return;
+      }
+
       // 4. 核心鉴权拦截
       const auth = this.authManager?.verifyRequest(req) ?? { authenticated: true };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenbin_wb/dsh-bridge",
-  "version": "2.5.1",
+  "version": "2.5.3",
   "description": "手机扫码即可在移动端/公网继续用 DeepSeek Harness，人不在电脑前也能接着干。一键局域网二维码、Cloudflare 公网隧道、自建隧道与微信 / QQ / 飞书 / Telegram Bot（多工作区/会话持久化/媒体/卡片审批/流式输出），无需自己搭公网服务器。",
   "type": "module",
   "main": "lib/index.js",
@@ -22,17 +22,20 @@
   ],
   "scripts": {
     "build:client": "node client/build.mjs",
-    "prepack": "npm run build:client",
+    "build:lark": "node scripts/bundle-lark.mjs",
+    "build:banner": "node scripts/generate-banner.mjs",
+    "prepack": "npm run build:lark && npm run build:client",
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {
-    "@larksuiteoapi/node-sdk": "^1.73.0",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
     "qrcode": "^1.5.3",
-    "ws": "^8.18.0",
-    "@deepseek-ai/dsh-llm": "0.1.0-rc.6"
+    "ws": "^8.18.0"
   },
   "devDependencies": {
-    "esbuild": "^0.25.9"
+    "@larksuiteoapi/node-sdk": "^1.73.0",
+    "esbuild": "^0.25.9",
+    "puppeteer-core": "^25.8.0"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1"