dsh-bridge-gateway 0.2.2 → 0.3.0

package/lib/feishu/node.js

@@ -1,4 +1,4 @@
-// dsh-bridge Feishu / Lark conversation node
+// dsh-bridge-gateway Feishu / Lark conversation node
 // 把飞书 OpenAPI / WebSocket 长连接入站事件解析后交给平台无关的
 // ConversationBridge 处理，出站通过 FeishuGateway 发送文本 / 卡片。
 
@@ -117,7 +117,7 @@ export class FeishuConversationNode extends ConversationBridge {
     }
 
     if (!text && mediaFiles.length === 0) {
-      this.logger.debug?.(`[dsh-bridge feishu] ignore empty message from ${peerId}`)
+      this.logger.debug?.(`[dsh-bridge-gateway feishu] ignore empty message from ${peerId}`)
       return
     }
 
@@ -127,7 +127,7 @@ export class FeishuConversationNode extends ConversationBridge {
       fullText = fullText ? `${fullText}\n\n${mediaDesc}` : mediaDesc
     }
 
-    this.logger.debug?.(`[dsh-bridge feishu] handling inbound message from ${peerId} (group=${isGroup}): ${fullText}`)
+    this.logger.debug?.(`[dsh-bridge-gateway feishu] handling inbound message from ${peerId} (group=${isGroup}): ${fullText}`)
 
     // 如果还没有活动会话，且是首条消息，自动尝试选择最新已有会话
     if (!this.activeSessionId) {
@@ -162,10 +162,10 @@ export class FeishuConversationNode extends ConversationBridge {
           const filePath = path.join(mediaDir, safeName)
           await fs.promises.writeFile(filePath, buf)
           downloaded.push({ filename: safeName, path: filePath, size: buf.length })
-          this.logger.info?.(`[dsh-bridge feishu] downloaded media ${safeName} (${buf.length} bytes)`)
+          this.logger.info?.(`[dsh-bridge-gateway feishu] downloaded media ${safeName} (${buf.length} bytes)`)
         }
       } catch (err) {
-        this.logger.warn?.(`[dsh-bridge feishu] download media failed: ${err.message}`)
+        this.logger.warn?.(`[dsh-bridge-gateway feishu] download media failed: ${err.message}`)
       }
     }
     return downloaded
@@ -207,7 +207,7 @@ export class FeishuConversationNode extends ConversationBridge {
           this._streamCardId = res?.message_id || null
           this._streamContent = firstSlice
         } catch (err) {
-          this.logger.warn?.('[dsh-bridge feishu] sendMarkdownCard failed, fallback to sendText:', err?.message ?? err)
+          this.logger.warn?.('[dsh-bridge-gateway feishu] sendMarkdownCard failed, fallback to sendText:', err?.message ?? err)
           await this.gateway.sendText(peerId, content, { isGroup })
           return
         }
@@ -239,7 +239,7 @@ export class FeishuConversationNode extends ConversationBridge {
         }
       }
     } catch (err) {
-      this.logger.warn?.('[dsh-bridge feishu] sendMarkdownCard failed, fallback to plain text:', err?.message ?? err)
+      this.logger.warn?.('[dsh-bridge-gateway feishu] sendMarkdownCard failed, fallback to plain text:', err?.message ?? err)
       await this.gateway.sendText(peerId, content, { isGroup })
     }
   }

package/lib/gateway/cert.js

@@ -208,7 +208,7 @@ export async function getOrCreateSelfSignedCert({ certFile, keyFile, logger }) {
       writeFile(keyFile, key, 'utf8'),
     ]);
   } catch (err) {
-    logger?.warn?.('dsh-bridge: 无法持久化自签证书: %s', err?.message ?? err);
+    logger?.warn?.('dsh-bridge-gateway: 无法持久化自签证书: %s', err?.message ?? err);
   }
   return { cert, key };
 }

package/lib/index.js

@@ -1,4 +1,4 @@
-// dsh-bridge 主插件（Host）
+// dsh-bridge-gateway 主插件（Host）
 //
 // 多渠道访问桥：
 //   1. 局域网访问代理（自动启动，零配置）
@@ -25,6 +25,7 @@ import { FeishuService } from './feishu/index.js';
 import { TelegramService } from './telegram/index.js';
 import { AuthManager } from './auth/manager.js';
 import { renderLoginPage } from './auth/login-template.js';
+import { pwaIconSvg } from './auth/brand-assets.js';
 import { isSafeWorkspacePath, isSensitiveFolderName } from './security/path-validator.js';
 import { applyRestoredPlatformConfig, RESTORED_STRING_FIELDS, PLATFORM_TIMING_FIELDS } from './platform/config-restore.js';
 import {
@@ -34,6 +35,7 @@ import {
   certDir as certDirFor,
   migrateLegacyDataDir,
   migrateLegacyCloudflaredDir,
+  cloudflaredBinDirs,
 } from './paths.js';
 import { getOrCreateSelfSignedCert } from './gateway/cert.js';
 
@@ -235,6 +237,11 @@ class QrCache {
 
 /**
  * PWA Web App Manifest 与 App 启动图标
+ *
+ * 图标与配色统一到 DSH 本体：此前这里是一个蓝色机器人脸（#4f6ef7），而登录页是
+ * 绿色盾牌、DSH 本体是鲸鱼 —— 手机用户把网关加到主屏后，会经历「机器人图标 →
+ * 绿色盾牌页 → 鲸鱼 DSH」三方品牌跳变。现在三处同源同一枚鲸鱼（brand-assets.js），
+ * 底色用 DSH 暗色画布 --dsw-alias-bg-base = #151517。
  */
 const PWA_MANIFEST = JSON.stringify({
   name: 'DeepSeek Harness',
@@ -242,34 +249,52 @@ const PWA_MANIFEST = JSON.stringify({
   description: 'DeepSeek Harness Remote & Mobile Workspace',
   start_url: '/',
   display: 'standalone',
-  background_color: '#181825',
-  theme_color: '#1e1e2e',
+  background_color: '#151517',
+  theme_color: '#151517',
   orientation: 'any',
   icons: [
-    {
-      src: '/__dsh_bridge__/pwa-icon.svg',
-      sizes: 'any',
-      type: 'image/svg+xml',
-      purpose: 'any maskable'
-    }
+    // PNG 是主屏图标的主力：HarmonyOS 与多数 Android 启动器**不支持 SVG 图标**，
+    // 只声明 SVG 会导致"添加到桌面"后图标一片空白（2026-10-16 华为 Mate 80 实测）。
+    // any 与 maskable 分开声明：maskable 必须满幅，启动器会按自己的形状裁切。
+    { src: '/__dsh_bridge__/icon-192.png', sizes: '192x192', type: 'image/png', purpose: 'any' },
+    { src: '/__dsh_bridge__/icon-512.png', sizes: '512x512', type: 'image/png', purpose: 'any' },
+    { src: '/__dsh_bridge__/icon-maskable-192.png', sizes: '192x192', type: 'image/png', purpose: 'maskable' },
+    { src: '/__dsh_bridge__/icon-maskable-512.png', sizes: '512x512', type: 'image/png', purpose: 'maskable' },
+    { src: '/__dsh_bridge__/pwa-icon.svg', sizes: 'any', type: 'image/svg+xml', purpose: 'any' }
   ]
 }, null, 2);
 
-const PWA_ICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">
-  <defs>
-    <linearGradient id="g" x1="0%" y1="0%" x2="100%" y2="100%">
-      <stop offset="0%" stop-color="#4f6ef7"/>
-      <stop offset="100%" stop-color="#24388a"/>
-    </linearGradient>
-  </defs>
-  <rect width="512" height="512" rx="128" fill="url(#g)"/>
-  <path d="M150 170 C150 140, 362 140, 362 170 L362 330 C362 360, 150 360, 150 330 Z" fill="#ffffff" fill-opacity="0.12"/>
-  <circle cx="206" cy="220" r="28" fill="#ffffff"/>
-  <circle cx="306" cy="220" r="28" fill="#ffffff"/>
-  <path d="M200 290 Q256 340 312 290" stroke="#ffffff" stroke-width="24" stroke-linecap="round" fill="none"/>
-  <rect x="236" y="90" width="40" height="60" rx="10" fill="#ffffff"/>
-  <circle cx="256" cy="80" r="16" fill="#4f6ef7"/>
-</svg>`;
+const PWA_ICON_SVG = pwaIconSvg();
+
+/**
+ * 主屏图标的 PNG 路由表。文件由 scripts/generate-icons.mjs 生成并入库（assets/）。
+ * 运行期只读文件、不做图形转换。
+ */
+const PWA_ICON_ROUTES = {
+  '/__dsh_bridge__/icon-192.png': 'icon-192.png',
+  '/__dsh_bridge__/icon-512.png': 'icon-512.png',
+  '/__dsh_bridge__/icon-maskable-192.png': 'icon-maskable-192.png',
+  '/__dsh_bridge__/icon-maskable-512.png': 'icon-maskable-512.png',
+  // iOS 的约定路径：必须是 PNG（iOS 自己加圆角，所以用圆角版即可）
+  '/apple-touch-icon.png': 'apple-touch-icon-180.png',
+  '/apple-touch-icon-precomposed.png': 'apple-touch-icon-180.png',
+};
+
+/** assets 目录（图标 PNG 所在）。 */
+const PWA_ASSETS_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', 'assets');
+
+/**
+ * 读取一个图标 PNG。缺失时返回 null（说明没跑过 generate-icons），由调用方降级。
+ * @param {string} fileName assets 下的文件名
+ * @returns {Buffer|null}
+ */
+function readPwaIconPng(fileName) {
+  try {
+    return readFileSync(join(PWA_ASSETS_DIR, fileName));
+  } catch {
+    return null;
+  }
+}
 
 
 function encodeBase64Url(value) {
@@ -349,6 +374,58 @@ function normalizeClientIp(raw) {
   return ip.startsWith('::ffff:') ? ip.slice(7) : ip;
 }
 
+/**
+ * 判定 TCP 对端是否属于私网地址段（**不含环回**）。
+ *
+ * 用途：与 `auth.genuineLocal` 组合，决定登录页是否展示「忘记密码」救急指引
+ * （其中含宿主内部路径 ~/.dsh/dsh-bridge-gateway/reset-auth）。该指引对能登上
+ * 宿主 shell 的人有用，对匿名公网访客只是不必要的信息披露。
+ *
+ * 为什么环回不在这里判：TCP 对端是 127.0.0.1 有两种截然不同的情形 ——
+ *   ① 真的在宿主机上打开 127.0.0.1（应展示）
+ *   ② 经隧道或同机反向代理转发的公网流量（**绝不能展示**）
+ * 二者只能靠 Host 头与隧道标头区分，那段判定在 AuthManager.verifyRequest 里
+ * 已经做过（`genuineLocal`），这里只负责"非环回的私网直连"这一种情形。
+ *
+ * 注意：这是**展示用**判定，不参与任何鉴权决策。
+ *
+ * @param {string} rawIp 原始 remoteAddress（可能带 ::ffff: 前缀）
+ * @returns {boolean}
+ */
+function isPrivateLanAddress(rawIp) {
+  const ip = normalizeClientIp(rawIp);
+  if (!ip) return false;
+  // IPv6 唯一本地地址 fc00::/7 与链路本地 fe80::/10
+  if (/^f[cd][0-9a-f]{2}:/i.test(ip) || /^fe[89ab][0-9a-f]:/i.test(ip)) return true;
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(ip);
+  if (!m) return false;
+  const [a, b] = [Number(m[1]), Number(m[2])];
+  if (a === 10) return true;                          // 10.0.0.0/8
+  if (a === 172 && b >= 16 && b <= 31) return true;   // 172.16.0.0/12
+  if (a === 192 && b === 168) return true;            // 192.168.0.0/16
+  if (a === 169 && b === 254) return true;            // 169.254.0.0/16 链路本地
+  return false;
+}
+
+/**
+ * 组合出登录页的 `isLocal`（是否本机/局域网来源）—— **纯展示用，不参与鉴权**。
+ *
+ * 两个来源缺一不可：
+ *   - `auth.genuineLocal`：AuthManager 判定的"真·宿主机物理访问"
+ *     （环回 + 非隧道 + Host 指向本机）。隧道与同机反向代理虽然 TCP 对端也是
+ *     127.0.0.1，但这里会判为 false —— 这正是不能只用 IP 判断的原因。
+ *   - `isPrivateLanAddress`：非环回的私网直连（192.168/10/172.16-31）。
+ *
+ * 单独成函数是为了可单测：这里判错会导致向匿名公网访客泄露宿主内部路径。
+ *
+ * @param {{genuineLocal?: boolean}} auth verifyRequest 的返回值
+ * @param {string} remoteAddress TCP 对端地址
+ * @returns {boolean}
+ */
+function resolveLoginPageIsLocal(auth, remoteAddress) {
+  return Boolean(auth?.genuineLocal) || isPrivateLanAddress(remoteAddress);
+}
+
 /** 网关数据目录（与 config.json 同处） */
 function gatewayDataDir() {
   return dataDir();
@@ -430,11 +507,26 @@ class ProxyServer {
         res.end(PWA_MANIFEST);
         return;
       }
-      if (pathname === '/__dsh_bridge__/pwa-icon.svg' || pathname === '/apple-touch-icon.png') {
-        res.writeHead(200, { 'Content-Type': 'image/svg+xml; charset=utf-8', 'Access-Control-Allow-Origin': '*' });
-        res.end(PWA_ICON_SVG);
-        return;
-      }
+      // 主屏图标：PNG 优先（HarmonyOS / Android / iOS 都只认 PNG），
+        // 资源缺失时降级到内联 SVG，至少不是 404。
+        if (PWA_ICON_ROUTES[pathname]) {
+          const png = readPwaIconPng(PWA_ICON_ROUTES[pathname]);
+          if (png) {
+            res.writeHead(200, {
+              'Content-Type': 'image/png',
+              'Content-Length': png.length,
+              'Cache-Control': 'public, max-age=86400',
+              'Access-Control-Allow-Origin': '*',
+            });
+            res.end(png);
+            return;
+          }
+        }
+        if (pathname === '/__dsh_bridge__/pwa-icon.svg') {
+          res.writeHead(200, { 'Content-Type': 'image/svg+xml; charset=utf-8', 'Access-Control-Allow-Origin': '*' });
+          res.end(PWA_ICON_SVG);
+          return;
+        }
 
       // 1. 处理登录 API: POST /__dsh_bridge__/login
       if (pathname === '/__dsh_bridge__/login' && req.method === 'POST') {
@@ -558,13 +650,47 @@ class ProxyServer {
         const isHtml = accept.includes('text/html') || (!req.url.startsWith('/api/') && !req.url.includes('.'));
         if (isHtml) {
           const clientIp = req.socket?.remoteAddress || '';
-          const isLocked = this.authManager?.isIpBlocked(clientIp);
+          // 锁定状态只查一次：isIpBlocked() 与 lockRemainingMs() 语义等价
+          // （后者顺带清理已过期记录），分两次调用会在"锁定刚过期"的瞬间出现竞态
+          // —— 拿到 locked=true 却拿到剩余 0，页面会显示一个凭空的倒计时。
+          const lockRemainingMs = this.authManager?.lockRemainingMs(clientIp) ?? 0;
+          const isLocked = lockRemainingMs > 0;
+          // 认证模式与防护范围透传给模板：token_only 下不再渲染必然失败的密码框，
+          // 副标题也能说清"这次为什么要求认证"。
+          const publicStatus = this.authManager?.getPublicStatus() ?? {};
           const html = renderLoginPage({
-            hasPassword: this.authManager?.hasPassword,
+            mode: publicStatus.mode,
+            scope: publicStatus.scope,
+            hasPassword: publicStatus.hasPassword,
             locked: isLocked,
-            error: isLocked ? '尝试次数过多，请 60 秒后再试' : '',
+            lockRemainingMs,
+            isLocal: resolveLoginPageIsLocal(auth, clientIp),
+            version: VERSION,
+          });
+          // 登录页内嵌错误文案、锁定态与认证模式，必须禁缓存 ——
+          // 与本仓库对代理 DSH HTML 的处理保持一致（见下方 index.html 注入处）。
+          //
+          // CSP 是纵深防御：本页全部资源都是内联的（零外部请求，有测试钉死），
+          // 因此可以收到极紧。**connect-src 'self' 不能漏** —— 登录靠
+          // fetch('/__dsh_bridge__/login') 提交，default-src 'none' 下漏掉它会
+          // 直接让认证失效。form-action 'none' 兜住"JS 不可用时原生提交"这条路径。
+          res.writeHead(401, {
+            'Content-Type': 'text/html; charset=utf-8',
+            'Cache-Control': 'no-store, must-revalidate',
+            'Pragma': 'no-cache',
+            'X-Content-Type-Options': 'nosniff',
+            'Referrer-Policy': 'no-referrer',
+            'Content-Security-Policy': [
+              "default-src 'none'",
+              "style-src 'unsafe-inline'",
+              "script-src 'unsafe-inline'",
+              "connect-src 'self'",
+              "img-src 'self' data:",
+              "form-action 'none'",
+              "base-uri 'none'",
+              "frame-ancestors 'none'",
+            ].join('; '),
           });
-          res.writeHead(401, { 'Content-Type': 'text/html; charset=utf-8' });
           res.end(html);
           return;
         } else {
@@ -612,7 +738,7 @@ class ProxyServer {
             if (!res.headersSent) {
               res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' });
               res.end(
-                `dsh-bridge: 无法连接插件 host 服务 (127.0.0.1:${extra.targetPort}) — ${err.message}`
+                `dsh-bridge-gateway: 无法连接插件 host 服务 (127.0.0.1:${extra.targetPort}) — ${err.message}`
               );
             } else {
               res.destroy();
@@ -650,7 +776,7 @@ class ProxyServer {
       proxyReq.on('error', (err) => {
         this.logger.error('代理请求失败: %s', err.message);
         if (!res.headersSent) res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' });
-        res.end(`dsh-bridge: 无法连接 dsh web (127.0.0.1:${this.targetPort}) — ${err.message}`);
+        res.end(`dsh-bridge-gateway: 无法连接 dsh web (127.0.0.1:${this.targetPort}) — ${err.message}`);
       });
       req.pipe(proxyReq);
     };
@@ -778,7 +904,7 @@ class ProxyServer {
       this.server.once('error', reject);
       this.server.listen(this.localPort, '0.0.0.0', () => {
         const proto = this.tls ? 'https' : 'http';
-        this.logger.info('dsh-bridge: %s代理已启动 %s://0.0.0.0:%d -> 127.0.0.1:%d', this.tag, proto, this.localPort, this.targetPort);
+        this.logger.info('dsh-bridge-gateway: %s代理已启动 %s://0.0.0.0:%d -> 127.0.0.1:%d', this.tag, proto, this.localPort, this.targetPort);
         resolve();
       });
     });
@@ -823,7 +949,7 @@ class ProxyServer {
     const conn = this.wsSockets.get(socket);
     if (conn) conn.closeReason = reason;
     this.logger?.warn?.(
-      'dsh-bridge: %s回收外网长连接 %s（%s，静默 %ds，鉴权方式 %s）',
+      'dsh-bridge-gateway: %s回收外网长连接 %s（%s，静默 %ds，鉴权方式 %s）',
       this.tag, conn?.ip ?? '未知', reason, Math.round((idleMs ?? 0) / 1000), conn?.via ?? '未知',
     );
     try { socket.destroy(); } catch {}
@@ -877,7 +1003,7 @@ class ProxyServer {
         kicked += 1;
       }
     }
-    this.logger?.warn?.(`dsh-bridge: 管理员强制断开 ${target} 的 ${kicked} 条连接`);
+    this.logger?.warn?.(`dsh-bridge-gateway: 管理员强制断开 ${target} 的 ${kicked} 条连接`);
     return { kicked };
   }
 
@@ -1214,14 +1340,18 @@ class BridgeService {
     await this.onPersist?.({ cloudflared: this.cloudflaredConfig });
   }
 
-  // 重置 Cloudflare 隧道：关闭隧道 + 删除已下载的 cloudflared 二进制
+  // 重置 Cloudflare 隧道：关闭隧道 + 删除已下载的 cloudflared 二进制。
+  // 当前目录与全部历史目录都要删 —— 迁移失败时二进制可能留在旧目录里，
+  // 只删当前目录会让"重置"看起来没生效（下次仍从旧目录捡到那个二进制）。
+  // 目录一律取自 lib/paths.js，不在这里硬编码字面量（这正是 paths.js 存在的理由）。
   async resetCloudflared() {
     await this.stopCloudflared();
-    const binDir = join(this.home ?? join(homedir(), '.dsh-bridge'), 'bin');
+    const binDirs = this.home ? [join(this.home, 'bin')] : cloudflaredBinDirs();
     const candidates = ['cloudflared.exe', 'cloudflared'];
-    for (const name of candidates) {
-      const p = join(binDir, name);
-      try { await unlink(p); } catch {}
+    for (const binDir of binDirs) {
+      for (const binName of candidates) {
+        try { await unlink(join(binDir, binName)); } catch {}
+      }
     }
     this.cloudflaredState = { phase: 'idle', detail: '' };
   }
@@ -1436,7 +1566,7 @@ class BridgeService {
     });
 
     await this.gateway.start();
-    this.logger?.info?.('dsh-bridge: 公网直连网关已启用 0.0.0.0:%d (HTTPS + 强制登录门禁)', port);
+    this.logger?.info?.('dsh-bridge-gateway: 公网直连网关已启用 0.0.0.0:%d (HTTPS + 强制登录门禁)', port);
     return this.gateway;
   }
 
@@ -2147,7 +2277,7 @@ function apply(ctx, config = {}) {
           '<meta name="theme-color" content="#1e1e2e">',
           '<link rel="manifest" href="/manifest.webmanifest">',
           '<link rel="icon" type="image/svg+xml" href="/__dsh_bridge__/pwa-icon.svg">',
-          '<link rel="apple-touch-icon" href="/__dsh_bridge__/pwa-icon.svg">',
+          '<link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">',
         ].join(''),
       },
       {
@@ -2180,24 +2310,24 @@ function apply(ctx, config = {}) {
           try {
             await ctx.loader.remove(id);
           } catch (err) {
-            logger.warn('dsh-bridge: unmount %s failed: %s', id, err?.message ?? err);
+            logger.warn('dsh-bridge-gateway: unmount %s failed: %s', id, err?.message ?? err);
           }
         }
       };
       try {
-        logger.info('dsh-bridge: mounting directory picker (browse backend + web surface)');
+        logger.info('dsh-bridge-gateway: mounting directory picker (browse backend + web surface)');
         for (const name of [DIRECTORY_PICKER_BACKEND, DIRECTORY_PICKER_SURFACE]) {
           ids.push(await ctx.loader.create({ name }));
         }
       } catch (err) {
-        logger.error('dsh-bridge: directory picker mount failed: %s', err?.message ?? err);
+        logger.error('dsh-bridge-gateway: directory picker mount failed: %s', err?.message ?? err);
         await unmount();
         return () => {};
       }
       return unmount;
-    }, 'dsh-bridge: directory picker (browse backend + surface)');
+    }, 'dsh-bridge-gateway: directory picker (browse backend + surface)');
   } else {
-    logger.warn('dsh-bridge: loader unavailable, directory picker left to DSH native composition');
+    logger.warn('dsh-bridge-gateway: loader unavailable, directory picker left to DSH native composition');
   }
 
   const proxyPort = config.port ?? 3082;
@@ -2262,7 +2392,7 @@ function apply(ctx, config = {}) {
       const stored = await loadConfig();
       delete stored.auth;
       await saveConfig(stored);
-      logger.warn('dsh-bridge: [保命救急] 检测到 reset-auth 标记文件，已成功重置所有访问密码与安全策略！');
+      logger.warn('dsh-bridge-gateway: [保命救急] 检测到 reset-auth 标记文件，已成功重置所有访问密码与安全策略！');
     } catch {}
   }
 
@@ -2279,7 +2409,7 @@ function apply(ctx, config = {}) {
       if (stored.auth.adminPasswordSalt) authManager.adminPasswordSalt = stored.auth.adminPasswordSalt;
       if (stored.auth.secretToken) authManager.secretToken = stored.auth.secretToken;
       if (stored.auth.allowLoopback != null) authManager.allowLoopback = Boolean(stored.auth.allowLoopback);
-      logger.info('dsh-bridge: loaded saved auth config (enabled=%s, mode=%s, adminPolicy=%s)', authManager.enabled, authManager.mode, authManager.adminPolicy);
+      logger.info('dsh-bridge-gateway: loaded saved auth config (enabled=%s, mode=%s, adminPolicy=%s)', authManager.enabled, authManager.mode, authManager.adminPolicy);
     }
   }).catch(() => {});
 
@@ -2305,43 +2435,43 @@ function apply(ctx, config = {}) {
   loadConfig().then(async (stored) => {
     if (stored?.lan?.selectedIp) {
       service.selectedLanIp = stored.lan.selectedIp;
-      logger.info('dsh-bridge: loaded saved lan config (selectedIp=%s)', service.selectedLanIp);
+      logger.info('dsh-bridge-gateway: loaded saved lan config (selectedIp=%s)', service.selectedLanIp);
     }
     if (stored?.gateway) {
       service.gatewayConfig = stored.gateway;
-      logger.info('dsh-bridge: loaded saved gateway config (port=%s, autoStart=%s)', service.gatewayConfig.port ?? 7443, Boolean(service.gatewayConfig.autoStart));
+      logger.info('dsh-bridge-gateway: loaded saved gateway config (port=%s, autoStart=%s)', service.gatewayConfig.port ?? 7443, Boolean(service.gatewayConfig.autoStart));
       if (service.gatewayConfig.autoStart) {
-        logger.info('dsh-bridge: auto-starting public direct gateway...');
+        logger.info('dsh-bridge-gateway: auto-starting public direct gateway...');
         service.startGateway().catch((err) => {
-          logger.error('dsh-bridge: gateway auto-start failed: %s', err?.message ?? err);
+          logger.error('dsh-bridge-gateway: gateway auto-start failed: %s', err?.message ?? err);
         });
       }
     }
     if (stored?.cloudflared) {
       service.cloudflaredConfig = stored.cloudflared;
-      logger.info('dsh-bridge: loaded saved cloudflared config (autoStart=%s, tokenConfigured=%s)', Boolean(service.cloudflaredConfig.autoStart), Boolean(service.cloudflaredConfig.token));
+      logger.info('dsh-bridge-gateway: loaded saved cloudflared config (autoStart=%s, tokenConfigured=%s)', Boolean(service.cloudflaredConfig.autoStart), Boolean(service.cloudflaredConfig.token));
       if (service.cloudflaredConfig.autoStart) {
-        logger.info('dsh-bridge: auto-starting cloudflared tunnel...');
+        logger.info('dsh-bridge-gateway: auto-starting cloudflared tunnel...');
         service.startCloudflared({ autoStart: true }).catch((err) => {
-          logger.error('dsh-bridge: cloudflared auto-start failed: %s', err?.message ?? err);
+          logger.error('dsh-bridge-gateway: cloudflared auto-start failed: %s', err?.message ?? err);
         });
       }
     }
 
     if (stored?.customTunnel) {
       service.customTunnelConfig = stored.customTunnel;
-      logger.info('dsh-bridge: loaded saved custom tunnel config (autoStart=%s)', Boolean(service.customTunnelConfig.autoStart));
+      logger.info('dsh-bridge-gateway: loaded saved custom tunnel config (autoStart=%s)', Boolean(service.customTunnelConfig.autoStart));
       if (service.customTunnelConfig.autoStart && service.customTunnelConfig.serverUrl) {
-        logger.info('dsh-bridge: auto-starting custom tunnel...');
+        logger.info('dsh-bridge-gateway: auto-starting custom tunnel...');
         service.startCustomTunnel({ autoStart: true }).catch((err) => {
-          logger.error('dsh-bridge: custom tunnel auto-start failed: %s', err?.message ?? err);
+          logger.error('dsh-bridge-gateway: custom tunnel auto-start failed: %s', err?.message ?? err);
         });
       }
     }
 
     if (stored?.tailscale?.url) {
       service.tailscaleConfig = stored.tailscale;
-      logger.info('dsh-bridge: loaded saved tailscale url (%s)', service.tailscaleConfig.url);
+      logger.info('dsh-bridge-gateway: loaded saved tailscale url (%s)', service.tailscaleConfig.url);
     }
   }).catch(() => {});
 
@@ -2353,7 +2483,7 @@ function apply(ctx, config = {}) {
     const timer = setInterval(() => { void service.refreshTailnet(); }, TAILNET_TTL_MS);
     if (timer.unref) timer.unref();
     return () => clearInterval(timer);
-  }, 'dsh-bridge: tailnet probe refresh');
+  }, 'dsh-bridge-gateway: tailnet probe refresh');
 
   // 平台管理器：注册/协调所有 IM 平台适配器
   const platformManager = new PlatformManager({ logger });
@@ -2426,7 +2556,7 @@ function apply(ctx, config = {}) {
         try {
           if (cfg.activeSessionId) {
             wechat.node.activeSessionId = cfg.activeSessionId;
-            logger.info('dsh-bridge: restored wechat active session: %s', cfg.activeSessionId);
+            logger.info('dsh-bridge-gateway: restored wechat active session: %s', cfg.activeSessionId);
           } else {
             await wechat.node._pickDefaultSession().catch(() => {});
           }
@@ -2443,9 +2573,9 @@ function apply(ctx, config = {}) {
           accountId: cfg.accountId,
           baseUrl: cfg.baseUrl,
         });
-        logger.info('dsh-bridge: loaded saved wechat bot config, starting gateway');
+        logger.info('dsh-bridge-gateway: loaded saved wechat bot config, starting gateway');
         await wechat.start().catch((err) => {
-          logger.error('dsh-bridge: wechat auto-start failed: %s', err?.message ?? err);
+          logger.error('dsh-bridge-gateway: wechat auto-start failed: %s', err?.message ?? err);
         });
       }
     }
@@ -2465,7 +2595,7 @@ function apply(ctx, config = {}) {
         try {
           if (cfg.activeSessionId) {
             qq.node.activeSessionId = cfg.activeSessionId;
-            logger.info('dsh-bridge: restored qq active session: %s', cfg.activeSessionId);
+            logger.info('dsh-bridge-gateway: restored qq active session: %s', cfg.activeSessionId);
           } else {
             await qq.node._pickDefaultSession().catch(() => {});
           }
@@ -2485,9 +2615,9 @@ function apply(ctx, config = {}) {
           gatewayUrl: cfg.gatewayUrl,
           accountId: cfg.accountId,
         });
-        logger.info('dsh-bridge: loaded saved qq bot config, starting gateway');
+        logger.info('dsh-bridge-gateway: loaded saved qq bot config, starting gateway');
         await qq.start().catch((err) => {
-          logger.error('dsh-bridge: qq auto-start failed: %s', err?.message ?? err);
+          logger.error('dsh-bridge-gateway: qq auto-start failed: %s', err?.message ?? err);
         });
       }
     }
@@ -2507,7 +2637,7 @@ function apply(ctx, config = {}) {
         try {
           if (cfg.activeSessionId) {
             feishu.node.activeSessionId = cfg.activeSessionId;
-            logger.info('dsh-bridge: restored feishu active session: %s', cfg.activeSessionId);
+            logger.info('dsh-bridge-gateway: restored feishu active session: %s', cfg.activeSessionId);
           } else {
             await feishu.node._pickDefaultSession().catch(() => {});
           }
@@ -2524,9 +2654,9 @@ function apply(ctx, config = {}) {
           appSecret: cfg.appSecret,
           domain: cfg.domain || 'feishu',
         });
-        logger.info('dsh-bridge: loaded saved feishu bot config, starting gateway');
+        logger.info('dsh-bridge-gateway: loaded saved feishu bot config, starting gateway');
         await feishu.start().catch((err) => {
-          logger.error('dsh-bridge: feishu auto-start failed: %s', err?.message ?? err);
+          logger.error('dsh-bridge-gateway: feishu auto-start failed: %s', err?.message ?? err);
         });
       }
     }
@@ -2546,7 +2676,7 @@ function apply(ctx, config = {}) {
         try {
           if (cfg.activeSessionId) {
             telegram.node.activeSessionId = cfg.activeSessionId;
-            logger.info('dsh-bridge: restored telegram active session: %s', cfg.activeSessionId);
+            logger.info('dsh-bridge-gateway: restored telegram active session: %s', cfg.activeSessionId);
           } else {
             await telegram.node._pickDefaultSession().catch(() => {});
           }
@@ -2562,9 +2692,9 @@ function apply(ctx, config = {}) {
           botToken: cfg.botToken,
           proxy: cfg.proxy || '',
         });
-        logger.info('dsh-bridge: loaded saved telegram bot config, starting gateway');
+        logger.info('dsh-bridge-gateway: loaded saved telegram bot config, starting gateway');
         await telegram.start().catch((err) => {
-          logger.error('dsh-bridge: telegram auto-start failed: %s', err?.message ?? err);
+          logger.error('dsh-bridge-gateway: telegram auto-start failed: %s', err?.message ?? err);
         });
       }
     }
@@ -2670,11 +2800,11 @@ function apply(ctx, config = {}) {
     .catch(() => false)
     .then((lanAutoStart) => {
       if (!lanAutoStart) {
-        logger.info('dsh-bridge: LAN proxy auto-start disabled (default off; enable via lan.autoStart)');
+        logger.info('dsh-bridge-gateway: LAN proxy auto-start disabled (default off; enable via lan.autoStart)');
         return;
       }
       void service.startProxy().catch((err) => {
-        logger.error('dsh-bridge: proxy start failed: %s', err?.message ?? err);
+        logger.error('dsh-bridge-gateway: proxy start failed: %s', err?.message ?? err);
       });
     });
 
@@ -2687,7 +2817,7 @@ function apply(ctx, config = {}) {
     platformManager.dispose();
     authManager.dispose();
     await service.dispose();
-  }, 'dsh-bridge: stop wechat, qq, feishu, telegram, proxy, auth and tunnels');
+  }, 'dsh-bridge-gateway: stop wechat, qq, feishu, telegram, proxy, auth and tunnels');
 }
 
-export { name, inject, apply, ProxyServer, BridgeService, selectLanIPv4, listAllLanIPv4, LEGACY_BROWSER_POLYFILL };
+export { name, inject, apply, ProxyServer, BridgeService, selectLanIPv4, listAllLanIPv4, LEGACY_BROWSER_POLYFILL, resolveLoginPageIsLocal };