@wenbin_wb/dsh-bridge 2.9.0 → 2.10.0

package/client/client.js

@@ -832,6 +832,125 @@ var MOBILE_STYLES_CSS = `
     }
 `;
 
+// client/unlock-manager.js
+var SESSION_KEY = "dsh_admin_token";
+var _token = "";
+var _pendingOps = [];
+var _onUnlocked = null;
+function _readStorage() {
+  try {
+    return typeof window !== "undefined" ? window.sessionStorage.getItem(SESSION_KEY) : "";
+  } catch {
+    return "";
+  }
+}
+function _writeStorage(t) {
+  try {
+    if (typeof window === "undefined") return;
+    if (t) window.sessionStorage.setItem(SESSION_KEY, t);
+    else window.sessionStorage.removeItem(SESSION_KEY);
+  } catch {
+  }
+}
+function getAdminToken() {
+  if (_token) return _token;
+  const saved = _readStorage();
+  if (saved) {
+    _token = saved;
+    return saved;
+  }
+  return "";
+}
+function setAdminToken(t) {
+  _token = t || "";
+  _writeStorage(_token);
+}
+function clearAdminToken() {
+  setAdminToken("");
+}
+async function fetchLoopbackTokenOnce(force = true) {
+  if (typeof window === "undefined") return null;
+  if (!force) {
+    const existing = getAdminToken();
+    if (existing) return existing;
+  }
+  const candidates = [
+    "/__dsh_bridge__/loopback-token",
+    "http://127.0.0.1:3082/__dsh_bridge__/loopback-token",
+    "http://localhost:3082/__dsh_bridge__/loopback-token"
+  ];
+  for (const url of [...new Set(candidates)]) {
+    try {
+      const res = await fetch(url, { method: "POST" });
+      if (res.ok) {
+        const data = await res.json();
+        if (data?.ok && data.adminToken) {
+          setAdminToken(data.adminToken);
+          return data.adminToken;
+        }
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function queuePendingOperation(retry) {
+  _pendingOps.push(retry);
+}
+async function replayPending() {
+  if (_pendingOps.length === 0) return;
+  const ops = _pendingOps;
+  _pendingOps = [];
+  for (const retry of ops) {
+    try {
+      await retry();
+    } catch {
+    }
+  }
+}
+function onUnlocked(cb) {
+  if (!_onUnlocked) _onUnlocked = [];
+  _onUnlocked.push(cb);
+  return () => {
+    _onUnlocked = _onUnlocked.filter((f) => f !== cb);
+  };
+}
+function _emitUnlocked() {
+  if (_onUnlocked) {
+    for (const cb of _onUnlocked) {
+      try {
+        cb();
+      } catch {
+      }
+    }
+  }
+}
+async function unlockAdmin(rpcCall, password) {
+  try {
+    const res = await rpcCall("authAdminUnlock", { password });
+    if (res?.ok) {
+      const token = res.value?.adminToken || "";
+      setAdminToken(token);
+      _emitUnlocked();
+      await replayPending();
+      return { ok: true };
+    }
+    return { ok: false, error: res?.error?.message || "\u7BA1\u7406\u5458\u5BC6\u7801\u9519\u8BEF" };
+  } catch (err) {
+    const msg = String(err?.message || err || "");
+    if (msg.includes("401") || msg.includes("transport failure") || msg.includes("unauthorized")) {
+      if (typeof window !== "undefined" && typeof window.location?.reload === "function") {
+        try {
+          window.sessionStorage.setItem("dsh_access_expired_reloaded", "1");
+        } catch {
+        }
+        window.location.reload();
+      }
+    }
+    return { ok: false, error: err?.message || "\u89E3\u9501\u8BF7\u6C42\u5931\u8D25" };
+  }
+}
+
 // lib/bridge-rpc-constants.js
 var BRIDGE_RPC_CHANNEL = "/dsh-bridge";
 var BRIDGE_ENDPOINTS = {
@@ -900,37 +1019,35 @@ if (typeof window !== "undefined") {
     };
   }
 }
-var _globalAdminToken = "";
-function setGlobalAdminToken(t) {
-  _globalAdminToken = t || "";
-  if (typeof window !== "undefined") {
-    try {
-      if (t) sessionStorage.setItem("dsh_admin_token", t);
-      else sessionStorage.removeItem("dsh_admin_token");
-    } catch {
-    }
-  }
-}
-function getGlobalAdminToken() {
-  if (_globalAdminToken) return _globalAdminToken;
-  if (typeof window !== "undefined") {
-    try {
-      const saved = sessionStorage.getItem("dsh_admin_token");
-      if (saved) {
-        _globalAdminToken = saved;
-        return saved;
-      }
-    } catch {
-    }
-  }
-  return "";
-}
 function isLocalEnvironment() {
   if (typeof window === "undefined") return true;
   const host = window.location.hostname || "";
   const proto = window.location.protocol || "";
   return host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "" || proto === "file:" || proto === "vscode-webview:" || proto === "app:" || typeof window.__DSH_ELECTRON__ !== "undefined" || typeof navigator !== "undefined" && navigator.userAgent && navigator.userAgent.includes("Electron");
 }
+var ACCESS_EXPIRED_FLAG = "dsh_access_expired_reloaded";
+function isAccessSessionFailure(err) {
+  const msg = String(err?.message || err || "");
+  return msg.includes("401") || msg.includes("transport failure") || msg.includes("unauthorized");
+}
+function reloadToLoginPage() {
+  try {
+    if (sessionStorage.getItem(ACCESS_EXPIRED_FLAG)) {
+      sessionStorage.removeItem(ACCESS_EXPIRED_FLAG);
+      return false;
+    }
+    sessionStorage.setItem(ACCESS_EXPIRED_FLAG, "1");
+  } catch {
+  }
+  window.location.reload();
+  return true;
+}
+function clearAccessExpiredFlag() {
+  try {
+    sessionStorage.removeItem(ACCESS_EXPIRED_FLAG);
+  } catch {
+  }
+}
 var GITHUB_URL = "https://github.com/wenbin-wb/dsh-bridge";
 var RELEASES_URL = "https://github.com/wenbin-wb/dsh-bridge/releases";
 var ISSUES_URL = "https://github.com/wenbin-wb/dsh-bridge/issues/new";
@@ -1568,6 +1685,7 @@ var AccessAuthCard = React.memo(function AccessAuthCard2({ auth, rpcCall, onUpda
   const [mode, setMode] = React.useState(auth?.mode ?? "token_and_password");
   const [scope, setScope] = React.useState(auth?.scope ?? "all");
   const [adminPolicy, setAdminPolicy] = React.useState(auth?.adminPolicy ?? "password_unlock");
+  const [adminProtection, setAdminProtection] = React.useState(auth?.adminProtection ?? true);
   const [accessPassword, setAccessPassword] = React.useState("");
   const [showAccessPassword, setShowAccessPassword] = React.useState(false);
   const [savingAccess, setSavingAccess] = React.useState(false);
@@ -1579,12 +1697,21 @@ var AccessAuthCard = React.memo(function AccessAuthCard2({ auth, rpcCall, onUpda
   const [saveAdminSuccess, setSaveAdminSuccess] = React.useState(false);
   const [msgAdmin, setMsgAdmin] = React.useState(null);
   const [topMsg, setTopMsg] = React.useState(null);
+  React.useEffect(() => {
+    const off = onUnlocked(() => {
+      setTopMsg(null);
+      setMsgAccess(null);
+      setMsgAdmin(null);
+    });
+    return off;
+  }, []);
   React.useEffect(() => {
     if (auth) {
       setEnabled(auth.enabled ?? false);
       setMode(auth.mode ?? "token_and_password");
       setScope(auth.scope ?? "all");
       setAdminPolicy(auth.adminPolicy ?? "password_unlock");
+      setAdminProtection(auth.adminProtection ?? true);
     }
   }, [auth]);
   const handleToggleEnabled = async () => {
@@ -1594,13 +1721,27 @@ var AccessAuthCard = React.memo(function AccessAuthCard2({ auth, rpcCall, onUpda
     try {
       const res = await rpcCall(BRIDGE_ENDPOINTS.authUpdateConfig, { enabled: next });
       if (!res?.ok) throw new Error(res?.error?.message || "\u66F4\u65B0\u5931\u8D25");
-      setTopMsg({ ok: true, text: next ? "\u2713 \u8BBF\u95EE\u5B89\u5168\u8BA4\u8BC1\u5DF2\u5F00\u542F\uFF08\u73B0\u6709\u767B\u5F55\u6001\u5DF2\u5237\u65B0\uFF09" : "\u2713 \u8BBF\u95EE\u5B89\u5168\u8BA4\u8BC1\u5DF2\u5173\u95ED" });
+      setTopMsg({ ok: true, text: next ? "\u2713 \u8BBF\u95EE\u5B89\u5168\u8BA4\u8BC1\u5DF2\u5F00\u542F\uFF08\u73B0\u6709\u767B\u5F55\u6001\u5DF2\u5237\u65B0\uFF09" : "\u2713 \u8BBF\u95EE\u5B89\u5168\u8BA4\u8BC1\u5DF2\u5173\u95ED\uFF08\u8BBF\u95EE\u514D\u5BC6\uFF0C\u7BA1\u7406\u4FDD\u62A4\u4E0D\u53D7\u5F71\u54CD\uFF09" });
       onUpdate?.();
     } catch (e) {
       setEnabled(prev);
       setTopMsg({ ok: false, text: e.message || "\u66F4\u65B0\u5931\u8D25" });
     }
   };
+  const handleToggleAdminProtection = async () => {
+    const prev = adminProtection;
+    const next = !adminProtection;
+    setAdminProtection(next);
+    try {
+      const res = await rpcCall(BRIDGE_ENDPOINTS.authUpdateConfig, { adminProtection: next });
+      if (!res?.ok) throw new Error(res?.error?.message || "\u66F4\u65B0\u5931\u8D25");
+      setTopMsg({ ok: true, text: next ? "\u2713 \u7BA1\u7406\u4FDD\u62A4\u5DF2\u5F00\u542F\uFF08\u4FEE\u6539\u914D\u7F6E\u9700\u7BA1\u7406\u5BC6\u7801\uFF09" : "\u2713 \u7BA1\u7406\u4FDD\u62A4\u5DF2\u5173\u95ED\uFF08\u4FEE\u6539\u914D\u7F6E\u514D\u5BC6\uFF0C\u8BF7\u8C28\u614E\uFF09" });
+      onUpdate?.();
+    } catch (e) {
+      setAdminProtection(prev);
+      setTopMsg({ ok: false, text: e.message || "\u66F4\u65B0\u5931\u8D25" });
+    }
+  };
   const handleChangeMode = async (m) => {
     const prev = mode;
     setMode(m);
@@ -1785,13 +1926,13 @@ var AccessAuthCard = React.memo(function AccessAuthCard2({ auth, rpcCall, onUpda
         }
       }, topMsg.text)
     ),
-    enabled && React.createElement(
+    React.createElement(
       React.Fragment,
       null,
       // =========================================================================
       // ---- 第一道防线：外部访问门禁（控制谁能进入 Web 界面使用 AI） ----
       // =========================================================================
-      React.createElement(
+      enabled && React.createElement(
         "div",
         { style: s.card },
         React.createElement(
@@ -1976,6 +2117,22 @@ var AccessAuthCard = React.memo(function AccessAuthCard2({ auth, rpcCall, onUpda
             "div",
             { style: { ...s.muted, marginTop: 3 } },
             "\u9501\u5B9A\u6574\u4E2A\u63D2\u4EF6\u8BBE\u7F6E\u540E\u53F0\uFF08\u5305\u542B\u5C40\u57DF\u7F51\u3001\u516C\u7F51\u96A7\u9053\u3001IM \u673A\u5668\u4EBA\u5BC6\u94A5\u4E0E\u5B89\u5168\u8BBE\u7F6E\uFF09\uFF0C\u9632\u6B62\u4ED6\u4EBA\u968F\u610F\u7BE1\u6539\u914D\u7F6E"
+          ),
+          React.createElement(
+            "div",
+            {
+              style: { display: "flex", alignItems: "center", justifyContent: "space-between", flexWrap: "wrap", gap: 8, marginTop: 10, paddingTop: 10, borderTop: "1px solid var(--dsw-alias-border-l2,#e5e7eb)" }
+            },
+            React.createElement(
+              "div",
+              { style: { fontSize: 12, fontWeight: 600, color: "var(--dsw-alias-label-primary,currentColor)" } },
+              adminProtection ? "\u{1F6E1}\uFE0F \u7BA1\u7406\u4FDD\u62A4\u5DF2\u5F00\u542F\uFF08\u4FEE\u6539\u914D\u7F6E\u9700\u7BA1\u7406\u5BC6\u7801\uFF09" : "\u26A0\uFE0F \u7BA1\u7406\u4FDD\u62A4\u5DF2\u5173\u95ED\uFF08\u4FEE\u6539\u914D\u7F6E\u514D\u5BC6\uFF09"
+            ),
+            React.createElement("button", {
+              type: "button",
+              style: { ...adminProtection ? s.btnGhost : s.btnPri, height: 28, fontSize: 12, padding: "0 12px" },
+              onClick: handleToggleAdminProtection
+            }, adminProtection ? "\u5173\u95ED\u7BA1\u7406\u4FDD\u62A4" : "\u5F00\u542F\u7BA1\u7406\u4FDD\u62A4")
           )
         ),
         // 管理员密码设置
@@ -3284,6 +3441,25 @@ function VersionBanner({ rpcCall }) {
           hasUpdate && React.createElement("span", { style: { fontWeight: 600, fontSize: 11 } }, `\u2794 v${info.latest}`),
           info?.error && React.createElement("span", { style: { color: "var(--dsw-alias-state-warn-primary,#d97706)", fontSize: 11 } }, "(\u7F51\u7EDC\u8D85\u65F6)")
         ),
+        // DSH 宿主版本标签
+        info?.dshVersion && React.createElement(
+          "span",
+          {
+            style: {
+              ...s.tag,
+              background: "var(--dsw-alias-bg-layer-2,#f3f4f6)",
+              color: "var(--dsw-alias-label-tertiary,#6b7280)",
+              padding: "3px 10px",
+              fontSize: 12,
+              fontWeight: 500,
+              display: "inline-flex",
+              alignItems: "center",
+              gap: 5
+            }
+          },
+          React.createElement("span", { style: { opacity: 0.75, fontSize: 11, fontWeight: 400 } }, "DSH"),
+          `v${info.dshVersion}`
+        ),
         // 刷新检查按钮
         React.createElement(
           "button",
@@ -3556,7 +3732,6 @@ function BridgePanel({ rpcCall }) {
   const [platforms, setPlatforms] = React.useState(null);
   const [selectedPlatform, setSelectedPlatform] = React.useState("wechat");
   const isLocalhost = typeof window === "undefined" || (!window.location.hostname || window.location.hostname === "127.0.0.1" || window.location.hostname === "localhost" || window.location.hostname === "::1" || window.location.hostname === "" || window.location.protocol === "file:" || window.location.protocol === "vscode-webview:" || window.location.protocol === "app:" || window.location.hostname.endsWith(".local"));
-  const [adminToken, setAdminToken] = React.useState("");
   const [adminUnlocked, setAdminUnlocked] = React.useState(false);
   const [unlockPassword, setUnlockPassword] = React.useState("");
   const [unlockErr, setUnlockErr] = React.useState(null);
@@ -3565,39 +3740,27 @@ function BridgePanel({ rpcCall }) {
   const [showUnlockModal, setShowUnlockModal] = React.useState(false);
   const fetchLoopbackToken = React.useCallback(async () => {
     if (!isLocalhost) return null;
-    const proxyPort = status?.proxy?.port || 3082;
-    const candidateUrls = [
-      "/__dsh_bridge__/loopback-token",
-      `http://127.0.0.1:${proxyPort}/__dsh_bridge__/loopback-token`,
-      `http://localhost:${proxyPort}/__dsh_bridge__/loopback-token`,
-      "http://127.0.0.1:3082/__dsh_bridge__/loopback-token"
-    ];
-    const uniqueUrls = [...new Set(candidateUrls)];
-    for (const url of uniqueUrls) {
-      try {
-        const res = await fetch(url, { method: "POST" });
-        if (res.ok) {
-          const data = await res.json();
-          if (data?.ok && data.adminToken) {
-            setAdminToken(data.adminToken);
-            setGlobalAdminToken(data.adminToken);
-            setAdminUnlocked(true);
-            return data.adminToken;
-          }
-        }
-      } catch {
-      }
+    const token = await fetchLoopbackTokenOnce();
+    if (token) {
+      setAdminUnlocked(true);
     }
-    return null;
-  }, [isLocalhost, status?.proxy?.port]);
+    return token;
+  }, [isLocalhost]);
   React.useEffect(() => {
     if (isLocalhost && !adminUnlocked) {
       fetchLoopbackToken();
     }
   }, [isLocalhost, adminUnlocked, fetchLoopbackToken]);
-  const pendingRetryRef = React.useRef(null);
+  const handleAccessSessionExpired = React.useCallback(() => {
+    setAdminUnlocked(false);
+    clearAdminToken();
+    const reloaded = reloadToLoginPage();
+    if (!reloaded) {
+      setErr("\u8BBF\u95EE\u4F1A\u8BDD\u5DF2\u5931\u6548\uFF0C\u8BF7\u5237\u65B0\u9875\u9762\u91CD\u65B0\u767B\u5F55");
+    }
+  }, []);
   const authRpcCall = React.useCallback(async (endpoint, payload = {}, signal) => {
-    let token = adminToken || getGlobalAdminToken();
+    let token = getAdminToken();
     if (isLocalhost && !token) {
       token = await fetchLoopbackToken();
     }
@@ -3606,51 +3769,60 @@ function BridgePanel({ rpcCall }) {
       ...token ? { adminToken: token } : {},
       ...isLocalhost ? { isLocalhost: true } : {}
     };
-    const res = await rpcCall(endpoint, enriched, signal);
+    let res;
+    try {
+      res = await rpcCall(endpoint, enriched, signal);
+    } catch (e) {
+      if (isAccessSessionFailure(e)) {
+        handleAccessSessionExpired();
+      }
+      throw e;
+    }
     if (res?.ok === false) {
       const msg = res?.error?.message || "";
       if (msg.includes("\u7BA1\u7406\u5458\u6743\u9650") || msg.includes("\u7BA1\u7406\u5BC6\u7801\u89E3\u9501")) {
-        pendingRetryRef.current = { endpoint, payload: enriched };
+        queuePendingOperation(async () => {
+          let fresh = getAdminToken();
+          if (!fresh && isLocalhost) fresh = await fetchLoopbackToken();
+          if (!fresh) return;
+          const retry = await rpcCall(endpoint, { ...payload, adminToken: fresh, ...isLocalhost ? { isLocalhost: true } : {} }, signal);
+          if (retry?.ok) {
+            setStatus(retry.value);
+            setErr(null);
+          }
+        });
         setUnlockErr(msg);
         setShowUnlockModal(true);
       }
     }
     return res;
-  }, [rpcCall, adminToken, isLocalhost, fetchLoopbackToken]);
+  }, [rpcCall, isLocalhost, fetchLoopbackToken, handleAccessSessionExpired]);
   const handleUnlockAdmin = React.useCallback(async (e) => {
     e?.preventDefault?.();
     setUnlocking(true);
     setUnlockErr(null);
-    try {
-      const res = await rpcCall(BRIDGE_ENDPOINTS.authAdminUnlock, { password: unlockPassword });
-      if (res?.ok) {
-        const token = res.value?.adminToken || "";
-        setAdminToken(token);
-        setGlobalAdminToken(token);
-        setAdminUnlocked(true);
-        setUnlockPassword("");
-        setShowUnlockModal(false);
-        setErr(null);
-      } else {
-        setUnlockErr(res?.error?.message || "\u7BA1\u7406\u5458\u5BC6\u7801\u9519\u8BEF");
-      }
-    } catch (err2) {
-      setUnlockErr(err2.message || "\u89E3\u9501\u8BF7\u6C42\u5931\u8D25");
-    } finally {
-      setUnlocking(false);
+    const res = await unlockAdmin(rpcCall, unlockPassword);
+    if (res.ok) {
+      setAdminUnlocked(true);
+      setUnlockPassword("");
+      setShowUnlockModal(false);
+      setErr(null);
+    } else {
+      setUnlockErr(res.error);
     }
+    setUnlocking(false);
   }, [rpcCall, unlockPassword]);
   const handleLockAdmin = React.useCallback(async () => {
     try {
-      if (adminToken) {
-        await rpcCall(BRIDGE_ENDPOINTS.authAdminLock, { adminToken });
+      const t = getAdminToken();
+      if (t) {
+        await rpcCall(BRIDGE_ENDPOINTS.authAdminLock, { adminToken: t });
       }
     } catch {
     }
-    setAdminToken("");
-    setGlobalAdminToken("");
+    clearAdminToken();
     setAdminUnlocked(false);
-  }, [rpcCall, adminToken]);
+  }, [rpcCall]);
   const loadInFlightRef = React.useRef(false);
   const loadSeqRef = React.useRef(0);
   const load = React.useCallback(async (quiet = false) => {
@@ -3663,12 +3835,19 @@ function BridgePanel({ rpcCall }) {
       if (!r?.ok) throw new Error(r?.error?.message ?? "RPC failed");
       setStatus(r.value);
       if (!quiet) setErr(null);
+      clearAccessExpiredFlag();
     } catch (e) {
-      if (currentSeq === loadSeqRef.current) setErr(e.message);
+      if (currentSeq === loadSeqRef.current) {
+        if (isAccessSessionFailure(e)) {
+          handleAccessSessionExpired();
+        } else {
+          setErr(e.message);
+        }
+      }
     } finally {
       loadInFlightRef.current = false;
     }
-  }, [authRpcCall]);
+  }, [authRpcCall, handleAccessSessionExpired]);
   const pollPlatformsSeqRef = React.useRef(0);
   React.useEffect(() => {
     let alive = true;
@@ -3687,38 +3866,20 @@ function BridgePanel({ rpcCall }) {
         inFlight = false;
       }
     };
+    if (!adminUnlocked && !isLocalhost) return;
     poll();
     const t = setInterval(poll, 4e3);
     return () => {
       alive = false;
       clearInterval(t);
     };
-  }, [authRpcCall]);
+  }, [authRpcCall, adminUnlocked, isLocalhost]);
   React.useEffect(() => {
     load();
+    if (!adminUnlocked && !isLocalhost) return;
     const t = setInterval(() => load(true), 3e3);
     return () => clearInterval(t);
-  }, [load]);
-  React.useEffect(() => {
-    if (!adminUnlocked) return;
-    const pending = pendingRetryRef.current;
-    if (!pending) return;
-    pendingRetryRef.current = null;
-    const token = adminToken || getGlobalAdminToken();
-    (async () => {
-      try {
-        const r = await rpcCall(pending.endpoint, { ...pending.payload, adminToken: token });
-        if (r?.ok) {
-          if (r.value) setStatus(r.value);
-          setErr(null);
-        } else {
-          setErr(r?.error?.message || "\u521A\u624D\u7684\u64CD\u4F5C\u91CD\u8BD5\u5931\u8D25\uFF0C\u8BF7\u624B\u52A8\u91CD\u8BD5");
-        }
-      } catch (e) {
-        setErr(e.message || "\u521A\u624D\u7684\u64CD\u4F5C\u91CD\u8BD5\u5931\u8D25\uFF0C\u8BF7\u624B\u52A8\u91CD\u8BD5");
-      }
-    })();
-  }, [adminUnlocked, adminToken, rpcCall]);
+  }, [load, adminUnlocked, isLocalhost]);
   const act = React.useCallback(async (endpoint, payload) => {
     try {
       const r = await authRpcCall(endpoint, payload ?? {});
@@ -3933,7 +4094,7 @@ function BridgePanel({ rpcCall }) {
   }
   const auth = status?.auth;
   const policy = auth?.adminPolicy ?? "password_unlock";
-  const isLocked = !isLocalhost && auth?.enabled && policy !== "open" && !adminUnlocked;
+  const isLocked = !isLocalhost && auth?.adminProtection !== false && policy !== "open" && !adminUnlocked;
   if (isLocked) {
     return React.createElement(
       "div",
@@ -4227,6 +4388,8 @@ function injectMobileStyles() {
   if (document.getElementById("dsh-bridge-mobile-styles")) return;
   const style = document.createElement("style");
   style.id = "dsh-bridge-mobile-styles";
+  style.dataset.plugin = "@wenbin_wb/dsh-bridge";
+  style.dataset.pluginCss = "@wenbin_wb/dsh-bridge/mobile-styles";
   style.textContent = MOBILE_STYLES_CSS;
   document.head.appendChild(style);
 }
@@ -4509,6 +4672,11 @@ function showRemoteWorkspaceDialog(rpcCall, onWorkspaceAdded, clientCtx, onPicke
   let isSubmitting = false;
   let statusMessage = null;
   let isErrorMessage = false;
+  let needUnlock = false;
+  let unlockable = true;
+  let unlockInput = "";
+  let unlockErr = null;
+  let unlocking = false;
   function closeModal() {
     document.removeEventListener("keydown", handleKeydown);
     overlay.style.opacity = "0";
@@ -4551,6 +4719,20 @@ function showRemoteWorkspaceDialog(rpcCall, onWorkspaceAdded, clientCtx, onPicke
         <button id="dsh-ws-close-btn" style="border: none; background: none; font-size: 18px; cursor: pointer; color: var(--dsw-alias-label-tertiary, #9ca3af); padding: 4px 8px; border-radius: 6px; line-height: 1; flex-shrink: 0;">\u2715</button>
       </div>
 
+      <!-- \u7BA1\u7406\u6743\u9650\u89E3\u9501\u5757\uFF08\u8FDC\u7A0B\u8BBF\u95EE\u9700\u8981\u7BA1\u7406\u5BC6\u7801\uFF1Blocal_only \u7B56\u7565\u4E0B\u4E0D\u663E\u793A\uFF0C\u4EC5\u63D0\u793A\uFF09 -->
+      ${needUnlock && unlockable ? `
+        <div style="padding: 14px 16px; background: var(--dsw-alias-state-warn-bg, #fffbeb); border-bottom: 1px solid var(--dsw-alias-state-warn-border, #fde68a); flex-shrink: 0;">
+          <div style="font-size: 12px; font-weight: 600; color: var(--dsw-alias-state-warn-primary, #92400e); margin-bottom: 6px;">\u{1F512} \u6B64\u64CD\u4F5C\u9700\u8981\u7BA1\u7406\u5458\u6743\u9650</div>
+          <div style="font-size: 11px; color: var(--dsw-alias-label-secondary, #6b7280); margin-bottom: 8px; line-height: 1.5;">\u8FDC\u7A0B\u8BBF\u95EE\u65F6\u6D4F\u89C8/\u6DFB\u52A0\u5DE5\u4F5C\u533A\u9700\u8F93\u5165\u540E\u53F0\u7BA1\u7406\u5BC6\u7801\u89E3\u9501\uFF08\u4E0E\u8BBF\u95EE\u5BC6\u7801\u4E0D\u540C\uFF09\u3002</div>
+          <form id="dsh-ws-unlock-form" style="display: flex; gap: 8px;">
+            <input id="dsh-ws-unlock-input" type="password" placeholder="\u8BF7\u8F93\u5165\u540E\u53F0\u7BA1\u7406\u5BC6\u7801" value="${escapeHtml(unlockInput)}"
+              style="flex: 1; font: inherit; font-size: 13px; padding: 7px 10px; border-radius: 8px; border: 1px solid var(--dsw-alias-border-l2, #d1d5db); background: var(--dsw-alias-bg-layer-1, #fff); color: var(--dsw-alias-label-primary, currentColor); outline: none; box-sizing: border-box;" />
+            <button type="submit" style="border: none; background: var(--dsw-alias-brand-primary, #4f6ef7); color: #fff; border-radius: 8px; padding: 0 14px; font-size: 12px; font-weight: 600; cursor: pointer; flex-shrink: 0;" ${unlocking ? "disabled" : ""}>${unlocking ? "\u89E3\u9501\u4E2D\u2026" : "\u89E3\u9501"}</button>
+          </form>
+          ${unlockErr ? `<div style="font-size: 11px; color: var(--dsw-alias-state-error-primary, #dc2626); margin-top: 6px;">${escapeHtml(unlockErr)}</div>` : ""}
+        </div>
+      ` : ""}
+
       <div style="padding: 12px 16px; overflow-y: auto; flex: 1; display: flex; flex-direction: column; gap: 10px;">
         <!-- \u63D0\u793A\u4FE1\u606F\u6A2A\u5E45 -->
         ${statusMessage ? `
@@ -4711,6 +4893,31 @@ function showRemoteWorkspaceDialog(rpcCall, onWorkspaceAdded, clientCtx, onPicke
     `;
     modal.querySelector("#dsh-ws-close-btn")?.addEventListener("click", closeModal);
     modal.querySelector("#dsh-ws-cancel-btn")?.addEventListener("click", closeModal);
+    const unlockForm = modal.querySelector("#dsh-ws-unlock-form");
+    if (unlockForm) {
+      unlockForm.addEventListener("submit", async (e) => {
+        e.preventDefault();
+        if (unlocking) return;
+        const input = modal.querySelector("#dsh-ws-unlock-input");
+        const pwd = input?.value || "";
+        if (!pwd) return;
+        unlocking = true;
+        unlockErr = null;
+        render();
+        const res = await unlockAdmin(rpcCall, pwd);
+        if (res.ok) {
+          needUnlock = false;
+          unlockInput = "";
+          statusMessage = null;
+          isErrorMessage = false;
+          await loadDirectory(currentPath);
+        } else {
+          unlockErr = res.error || "\u89E3\u9501\u5931\u8D25";
+        }
+        unlocking = false;
+        render();
+      });
+    }
     modal.querySelectorAll(".dsh-ws-crumb-btn").forEach((btn) => {
       btn.addEventListener("click", () => {
         const p = btn.getAttribute("data-path");
@@ -4800,25 +5007,40 @@ function showRemoteWorkspaceDialog(rpcCall, onWorkspaceAdded, clientCtx, onPicke
     }
   }
   async function authRpc(endpoint, payload = {}) {
-    let token = getGlobalAdminToken();
-    if (!token && isLocalEnvironment()) {
-      try {
-        const res = await fetch("/__dsh_bridge__/loopback-token", { method: "POST" });
-        if (res.ok) {
-          const data = await res.json();
-          if (data?.adminToken) {
-            token = data.adminToken;
-            setGlobalAdminToken(token);
-          }
-        }
-      } catch {
-      }
+    let token = getAdminToken();
+    if (isLocalEnvironment()) {
+      token = await fetchLoopbackTokenOnce();
     }
-    return rpcCall(endpoint, {
+    const enriched = {
       ...payload,
       ...token ? { adminToken: token } : {},
       ...isLocalEnvironment() ? { isLocalhost: true } : {}
+    };
+    const res = await rpcCall(endpoint, enriched).catch((e) => {
+      if (isAccessSessionFailure(e)) {
+        clearAdminToken();
+        reloadToLoginPage();
+      }
+      throw e;
     });
+    if (res?.ok === false) {
+      const msg = res?.error?.message || "";
+      if (isLocalEnvironment() && (msg.includes("\u7BA1\u7406\u5458\u6743\u9650") || msg.includes("\u7BA1\u7406\u5BC6\u7801\u89E3\u9501"))) {
+        const fresh = await fetchLoopbackTokenOnce(true);
+        if (fresh) {
+          return rpcCall(endpoint, { ...payload, adminToken: fresh, isLocalhost: true });
+        }
+      }
+      if (msg.includes("\u7BA1\u7406\u5458\u6743\u9650") || msg.includes("\u7BA1\u7406\u5BC6\u7801\u89E3\u9501")) {
+        clearAdminToken();
+        const err = new Error("need-unlock");
+        err.needUnlock = true;
+        err.message = msg;
+        err.unlockable = !msg.includes("\u4EC5\u9650\u7535\u8111\u672C\u673A\u7BA1\u7406");
+        throw err;
+      }
+    }
+    return res;
   }
   async function switchToWorkspace(wsId, wsPath) {
     if (isSubmitting) return;
@@ -4898,13 +5120,25 @@ function showRemoteWorkspaceDialog(rpcCall, onWorkspaceAdded, clientCtx, onPicke
         drives = res.drives || [];
         workspaces = res.workspaces || [];
         if (res.error) {
-          statusMessage = res.error;
+          statusMessage = typeof res.error === "string" ? res.error : res.error?.message || "\u8BFB\u53D6\u76EE\u5F55\u5931\u8D25";
           isErrorMessage = true;
         }
       }
     } catch (err) {
-      statusMessage = err.message || "\u8BFB\u53D6\u76EE\u5F55\u5931\u8D25";
-      isErrorMessage = true;
+      if (err?.needUnlock) {
+        needUnlock = true;
+        unlockErr = null;
+        statusMessage = null;
+        isErrorMessage = false;
+        unlockable = err.unlockable !== false;
+        if (!unlockable) {
+          statusMessage = err.message || "\u5F53\u524D\u7B56\u7565\u4EC5\u9650\u7535\u8111\u672C\u673A\u7BA1\u7406\uFF0C\u8FDC\u7A0B\u65E0\u6CD5\u89E3\u9501";
+          isErrorMessage = true;
+        }
+      } else {
+        statusMessage = err.message || "\u8BFB\u53D6\u76EE\u5F55\u5931\u8D25";
+        isErrorMessage = true;
+      }
     } finally {
       isLoading = false;
       render();
@@ -4977,8 +5211,20 @@ function showRemoteWorkspaceDialog(rpcCall, onWorkspaceAdded, clientCtx, onPicke
         render();
       }
     } catch (err) {
-      statusMessage = err.message || "\u6DFB\u52A0\u5DE5\u4F5C\u533A\u5F02\u5E38";
-      isErrorMessage = true;
+      if (err?.needUnlock) {
+        needUnlock = true;
+        unlockable = err.unlockable !== false;
+        unlockErr = null;
+        statusMessage = null;
+        isErrorMessage = false;
+        if (!unlockable) {
+          statusMessage = err.message || "\u5F53\u524D\u7B56\u7565\u4EC5\u9650\u7535\u8111\u672C\u673A\u7BA1\u7406\uFF0C\u8FDC\u7A0B\u65E0\u6CD5\u89E3\u9501";
+          isErrorMessage = true;
+        }
+      } else {
+        statusMessage = err.message || "\u6DFB\u52A0\u5DE5\u4F5C\u533A\u5F02\u5E38";
+        isErrorMessage = true;
+      }
       render();
     } finally {
       isSubmitting = false;