dsh-dock 0.8.0 → 0.9.0

package/features/mobile-relay/host.js

@@ -1,56 +1,257 @@
 // dsh-dock · 功能模块【手机接力】· 宿主半部
 //
-// 不复制或迁移 DSH 会话：手机与电脑都连接同一个 DSH 宿主时，会话本来就是同一份。
-// 本模块只负责短时配对、在线状态、实时任务摘要和接力备注，避免把任务状态再做成一套
-// 容易分叉的副本。所有配对凭据均只存内存，宿主重启后自动失效。
-import { randomBytes } from 'node:crypto'
-import { readBody, sendJson } from '../../src/host-core.js'
+// 「服务器模式」（单实例架构）：所有设备访问同一个 DSH 进程，会话、任务进度、
+// 设置、功能坞完全一致——这就是"dsh 装在服务器上，任何设备打开都一样"的形态。
+//
+//   - 开启：插件把 `- id: webserver / config: {host:'0.0.0.0', port}` 写进用户的
+//     profile 补丁层（~/.dsh/profiles/web/cordis.patch.yml，DSH 官方补丁语义），
+//     重启 `dsh web` 后主实例直接绑定 0.0.0.0。绑定后 DSH 自身派生局域网信任
+//     （connection 行 trustedHosts = 局域网 IPv4），目录选择器自动切浏览模式；
+//     手机接力的网关上游也直接指向主实例——不再有第二个进程，自然不存在
+//     任务状态在不同实例间不同步的问题。
+//   - 兼容兜底：局域网 http 非安全上下文，部分浏览器缺 crypto.randomUUID（DSH
+//     客户端生成消息/RPC ID 直接调用）。通过 webServer.tapIndex 在 index.html
+//     内联注入 ES5 兜底；回环/安全上下文下脚本自我短路零副作用。
+//
+// 配对状态、在线设备与接力备注只存内存；会话数据始终只有 ~/.dsh 这一份。
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto'
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { dirname, join } from 'node:path'
+import yaml from 'js-yaml'
+import { DOCK_NS, readBody, sendJson } from '../../src/host-core.js'
 import { lanAddresses, startProtectedLanGateway } from './gateway.js'
 
-const PAIR_TTL_MS = 10 * 60 * 1000
-const PRESENCE_TTL_MS = 45 * 1000
-const NOTE_MAX_LENGTH = 1200
-const MAX_JOIN_ATTEMPTS = 8
-const DEFAULT_GATEWAY_PORT = 3081
+function dshHome() { return process.env.DSH_HOME || join(homedir(), '.dsh') }
+/** 远程访问开关所在的用户补丁层（web profile 专属；测试可用环境变量指到临时文件）。 */
+function serverPatchFile() {
+  return process.env.DSH_DOCK_PATCH_FILE || join(dshHome(), 'profiles', 'web', 'cordis.patch.yml')
+}
+
+// 与 DSH include 插件同款的 !!js 表达式标签：用户补丁层可能含 !!js 表达式，
+// 读写必须无损往返，否则一次开关操作就会破坏用户手工配置。
+const JsExprType = new yaml.Type('tag:yaml.org,2002:js', {
+  kind: 'scalar',
+  resolve: (data) => typeof data === 'string',
+  construct: (data) => ({ __jsExpr: data }),
+  represent: (data) => data['__jsExpr'],
+})
+const patchYamlSchema = yaml.JSON_SCHEMA.extend(JsExprType)
 
-function now() { return Date.now() }
-function cleanText(value, max) { return String(value || '').replace(/\u0000/g, '').trim().slice(0, max) }
-function publicId() { return randomBytes(9).toString('base64url') }
-function joinCode() { return randomBytes(5).toString('hex').toUpperCase() }
-function phaseOf(event) {
-  if (event && event.type === 'assistant/chunk') {
-    const type = event.data && event.data.chunk && event.data.chunk.type
-    if (type === 'reasoning-delta') return 'think'
-    if (type === 'text-delta') return 'write'
+function readPatchList(file) {
+  let text
+  try {
+    text = readFileSync(file, 'utf8')
+  } catch (error) {
+    if (error && error.code === 'ENOENT') return null
+    const err = new Error('读取局域网服务补丁失败：' + ((error && error.message) || String(error)))
+    err.statusCode = 500
+    throw err
   }
-  if (event && event.type === 'tool/call') {
-    const name = String(event.data && event.data.name || '').toLowerCase()
-    return /web|search|fetch|grep|glob|find|read|ls$|^ls|tree|locate/.test(name) ? 'search' : 'code'
+  try {
+    const data = yaml.load(text, { schema: patchYamlSchema })
+    return Array.isArray(data) ? data : []
+  } catch (error) {
+    const err = new Error('局域网服务补丁不是合法的补丁列表：' + ((error && error.message) || String(error)))
+    err.statusCode = 500
+    throw err
   }
-  return ''
 }
-function extractText(content) {
-  if (!Array.isArray(content)) return ''
-  return content.filter((x) => x && x.type === 'text' && typeof x.text === 'string')
-    .map((x) => x.text).join(' ').replace(/\s+/g, ' ').trim()
+function writePatchList(file, list) {
+  try {
+    mkdirSync(dirname(file), { recursive: true })
+    writeFileSync(file, yaml.dump(list, { schema: patchYamlSchema }), 'utf8')
+  } catch (error) {
+    const err = new Error('写入局域网服务补丁失败：' + ((error && error.message) || String(error)))
+    err.statusCode = 500
+    throw err
+  }
+}
+// 补丁层的扁平行视图：insert 块（{insert:[…]}）展开成行，其余原样。
+// DSH 补丁语义里，非 insert 行只能改已存在 id 的 config/disabled——想新增行必须包
+// insert（applyEntryPatches 对未知 id 的普通行只告警后跳过，对 name 不一致的行同样
+// 整行跳过）。展开后统一按行检测/清理，兼容旧版写坏的平铺文件。
+function patchRows(list) {
+  if (!Array.isArray(list)) return []
+  return list.flatMap((row) => (row && Array.isArray(row.insert)) ? row.insert : [row])
+}
+function serverPatchApplied(list) {
+  // 远程访问补丁：目录选择器钉死为浏览模式（远程设备不能弹本机对话框）。
+  return patchRows(list).some((row) => row && row.id === 'directory-picker-browse')
+}
+function legacyWebserverRowPresent(list) {
+  // 旧「服务器模式」残留：0.0.0.0 的 webserver 覆盖行。账号认证架构下主实例必须回到仅本机，
+  // 否则局域网设备可以绕过登录网关直连。
+  return patchRows(list).some((row) => row && row.id === 'webserver'
+    && row.config && row.config.host === '0.0.0.0')
+}
+function stripRemoteRows(list) {
+  // 清掉全部远程访问相关行：平铺的 browse 行、webserver 行、auto 钉死行，以及
+  // insert 块里的 browse 行（块清空则整块移除，块里混有用户自己的行则只摘除 browse）。
+  return list
+    .map((row) => {
+      if (!(row && Array.isArray(row.insert))) return row
+      const rest = row.insert.filter((item) => !(item && (item.id === 'directory-picker-browse' || item.id === 'ui-directory-picker-browse')))
+      return rest.length ? { insert: rest } : null
+    })
+    .filter((row) => row && !(row.id === 'webserver'
+      || row.id === 'directory-picker' || row.id === 'directory-picker-browse' || row.id === 'ui-directory-picker-browse'))
+}
+function upsertRemotePatches(list) {
+  const cleaned = stripRemoteRows(list)
+  cleaned.push(
+    { id: 'directory-picker', disabled: true },
+    { insert: [
+      { id: 'directory-picker-browse', name: '@deepseek-ai/dsh-host-directory-picker-browse' },
+      { id: 'ui-directory-picker-browse', name: '@deepseek-ai/dsh-client-ui-directory-picker-browse' },
+    ] },
+  )
+  return cleaned
+}
+function removeRemotePatches(list) {
+  return stripRemoteRows(list)
+}
+
+// LAN HTTP 不是浏览器安全上下文：部分浏览器在 http://<局域网IP> 下只暴露
+// crypto.getRandomValues() 而省略 crypto.randomUUID()，而 DSH 的 connection /
+// conversation 客户端直接调用 randomUUID() 生成消息 ID 与 RPC ID——缺失时整个
+// 客户端引导失败（会话列表、工作区等全部不可用）。下面这段与手机接力网关同款、
+// 局域网 http 不是浏览器安全上下文：部分浏览器（老内核/加固内核）在 http://<局域网IP>
+// 下缺失 crypto.randomUUID（DSH 的 connection/conversation 客户端生成消息与 RPC ID
+// 直接调用它，缺失则整个客户端瘫痪——会话列表、设置目录、工作区全不可用）。
+// 这段 ES5 兜底无前置条件：randomUUID 与 getRandomValues 都补齐（实例属性 +
+// Crypto.prototype 双路径）；crypto 被整体冻结的极端浏览器则替换整个对象。
+// 回环/安全上下文下 randomUUID 原生存在，脚本自我短路零副作用。
+const LAN_COMPAT_JS = "(function(){var g=typeof globalThis!=='undefined'?globalThis:(typeof window!=='undefined'?window:(typeof self!=='undefined'?self:undefined));if(!g)return;if(!g.crypto){try{g.crypto={}}catch(e){return}}var c=g.crypto;var nativeRng=typeof c.getRandomValues==='function'?c.getRandomValues.bind(c):null;function rng(bytes){if(nativeRng){nativeRng(bytes);return bytes}for(var i=0;i<bytes.length;i++)bytes[i]=Math.floor(Math.random()*256)&255;return bytes}function uuid(){var b=rng(new Uint8Array(16));b[6]=(b[6]&15)|64;b[8]=(b[8]&63)|128;var h=[];for(var i=0;i<16;i++)h.push((b[i]+256).toString(16).slice(1));return h.slice(0,4).join('')+'-'+h.slice(4,6).join('')+'-'+h.slice(6,8).join('')+'-'+h.slice(8,10).join('')+'-'+h.slice(10).join('')}function fill(array){rng(array);return array}function define(obj,name,value){if(!obj||typeof obj[name]==='function')return;try{Object.defineProperty(obj,name,{value:value,configurable:true})}catch(e){try{obj[name]=value}catch(e2){}}}define(c,'randomUUID',uuid);if(!nativeRng)define(c,'getRandomValues',fill);define(g.Crypto&&g.Crypto.prototype||null,'randomUUID',uuid);if(!nativeRng)define(g.Crypto&&g.Crypto.prototype||null,'getRandomValues',fill);if(typeof c.randomUUID!=='function'){var fresh={getRandomValues:fill,randomUUID:uuid};if(c.subtle)fresh.subtle=c.subtle;var keyOrigin=Object.create(null);for(var k in c){try{keyOrigin[k]=c[k]}catch(e3){}}for(var k2 in keyOrigin){if(typeof fresh[k2]==='undefined')fresh[k2]=keyOrigin[k2]}try{Object.defineProperty(g,'crypto',{value:fresh,configurable:true})}catch(e4){try{g.crypto=fresh}catch(e5){}}}})()"
+const LAN_COMPAT_MARKER = 'data-dsh-lan-compat'
+// 手机端排版补丁（窄屏媒体查询护栏，桌面零影响）：
+// 1) 设置弹窗官方只有"左导航+右内容"两栏，窄屏内容栏被压到不足百像素（一字一行）；
+//    改纵向堆叠：导航横排在上、内容占满。
+// 2) 侧边栏展开是 grid 栅格挤占会话区（窄屏会话区只剩 ~110px）；改为浮层覆盖。
+// 类名用语义后缀匹配（哈希前缀随 DSH 版本会变，后缀稳定）；DSH 升级改了结构时
+// 选择器自然失效，不影响其他功能。
+const MOBILE_LAYOUT_CSS = [
+  '@media (max-width:700px){',
+  '  [role="dialog"][class*="panel"]{flex-direction:column;width:100vw!important;max-width:100vw!important;height:100vh!important;height:100dvh!important;max-height:none!important;border-radius:0!important}',
+  '  [role="dialog"][class*="panel"]>[class*="nav"]{flex:none!important;width:auto!important;height:auto!important;flex-direction:row;align-items:center;gap:2px;padding:6px 8px;overflow-x:auto;border-bottom:1px solid color-mix(in srgb,gray 25%,transparent)}',
+  '  [role="dialog"][class*="panel"] [class*="navList"]{flex-direction:row;overflow-x:auto;gap:2px}',
+  '  [role="dialog"][class*="panel"] [class*="navTitle"]{flex:none;white-space:nowrap;margin-right:6px}',
+  '  [role="dialog"][class*="panel"]>[class*="nav"] [class*="navCell"]{flex:none}',
+  '  [role="dialog"][class*="panel"]>[class*="content"]{flex:1 1 auto!important;width:auto!important;min-width:0!important;max-width:none!important}',
+  '  [class$="frame"]{grid-template-columns:0px minmax(0,1fr) 0px!important}',
+  '  [class$="_handle"]{display:none!important}',
+  '  [class$="frame"]:not([data-sidebar-collapsed]) [class*="sidebarCol"]{position:fixed!important;top:0!important;bottom:0!important;left:0!important;width:min(85vw,320px)!important;z-index:80!important;box-shadow:0 12px 48px rgba(0,0,0,.45)}',
+  '  [class$="frame"]:not([data-details-collapsed="true"]) [class*="detailsCol"]{position:fixed!important;top:0!important;bottom:0!important;right:0!important;left:auto!important;width:min(85vw,320px)!important;z-index:85!important;box-shadow:-12px 0 48px rgba(0,0,0,.45)}',
+  '  [class*="overlayLayer"]{z-index:90!important}',
+  '}',
+].join('\n')
+const MOBILE_LAYOUT_MARKER = 'data-dsh-mobile-layout'
+// 窄屏行为补丁：侧边栏浮层化后，原生的"保持展开"会一直挡住半屏——
+// 点会话行/新会话后自动收起；点侧栏外的页面区域也收起（浮层语义）。
+// 侧栏内的其他点击（工作区折叠、搜索、功能坞入口）保持原生行为不收。
+const MOBILE_BEHAVIOR_JS = ";(function(){var mq=window.matchMedia?window.matchMedia('(max-width:700px)'):null;if(!mq)return;function narrow(){return mq.matches}function collapse(){var b=document.querySelector('button[aria-label=\"收起侧边栏\"],button[aria-label=\"Collapse sidebar\"]');if(b)b.click()}function closeDetails(){var d=document.querySelector('[class*=\"detailsCol\"]');if(!d||!d.getBoundingClientRect().width)return;var c=d.querySelector('button[aria-label=\"关闭详情\"]');if(c)c.click()}document.addEventListener('click',function(e){if(!narrow())return;var t=e.target;if(!t||!t.closest)return;var expanded=!!document.querySelector('button[aria-label=\"收起侧边栏\"],button[aria-label=\"Collapse sidebar\"]');var col=document.querySelector('[class*=\"sidebarCol\"]');var inSidebar=col&&col.contains(t);if(!expanded&&!inSidebar)return;if(inSidebar){var row=t.closest('[role=\"treeitem\"]');var leaf=row&&!row.querySelector('[role=\"treeitem\"]')&&row.closest('[role=\"tree\"]');var fresh=t.closest('[class*=\"newSession\"]');if(leaf||fresh)setTimeout(function(){collapse();closeDetails()},300);return}if(t.closest('[role=\"dialog\"],[class*=\"dockm\"],[class*=\"dgfab\"],[class*=\"dgwin\"],[class*=\"dgame\"],[class*=\"detailsCol\"]'))return;collapse()},true)})();"
+const MOBILE_BEHAVIOR_MARKER = 'data-dsh-mobile-behave'
+/** 把兼容脚本、移动端排版样式与行为脚本内联注入 index.html 的 <head> 之后（幂等）。 */
+function injectLanCompat(html) {
+  let out = html
+  const match = /<head(?:\s[^>]*)?>/i.exec(out)
+  const at = match ? match.index + match[0].length : 0
+  const parts = []
+  if (!out.includes(LAN_COMPAT_MARKER)) parts.push(`<script ${LAN_COMPAT_MARKER}>${LAN_COMPAT_JS}</script>`)
+  if (!out.includes(MOBILE_LAYOUT_MARKER)) parts.push(`<style ${MOBILE_LAYOUT_MARKER}>${MOBILE_LAYOUT_CSS}</style>`)
+  if (!out.includes(MOBILE_BEHAVIOR_MARKER)) parts.push(`<script ${MOBILE_BEHAVIOR_MARKER}>${MOBILE_BEHAVIOR_JS}</script>`)
+  if (!parts.length) return out
+  const injected = parts.join('')
+  return at > 0 ? out.slice(0, at) + injected + out.slice(at) : injected + out
 }
 function routeMethod(req) {
   const url = new URL(req.url || '/', 'http://dsh.internal')
-  return url.pathname.replace(/^\/dsh-dock\/mobile-relay\/?/, '').split('/')[0] || ''
+  return url.pathname.replace(/^\/dsh-dock\/mobile-relay\/?/, '').replace(/\/+$/, '')
 }
 
 export const feature = {
   id: 'mobile-relay',
-  name: '手机接力',
-  description: '安全反向代理与扫码接力，同步当前任务状态和备注',
+  name: '远程访问',
+  description: '账号密码登录的远程入口：局域网/虚拟网设备访问同一个 DSH，任务进度实时一致',
   defaultEnabled: true,
   setup(ctx) {
     const disposers = []
-    const pairs = new Map()
-    const tasks = new Map()
-    const joinAttempts = new Map()
     let gateway = null
     let gatewayStarting = null
+    let settingsCtx = null
+
+    // 自愈：早期版本把 browse 行平铺写进补丁层——DSH 会把未知 id 的普通补丁行整行
+    // 跳过（且 auto 已被停用），结果 directoryPicker 服务无人提供，/api 整面 404，
+    // 重启时更会因条目未激活直接起不来。这里把旧形态无损改写成 insert 形态。
+    try {
+      const file = serverPatchFile()
+      const list = readPatchList(file)
+      if (list && list.some((row) => row && (row.id === 'directory-picker-browse' || row.id === 'ui-directory-picker-browse'))) {
+        writePatchList(file, upsertRemotePatches(list))
+      }
+    } catch { /* 补丁层不可读时交给 lanStatus 的错误呈现，不在启动路径上放大 */ }
+
+    disposers.push(ctx.inject(['settings'], (sctx) => { settingsCtx = sctx }))
+
+    // ── 远程访问账号（settings 持久化；密码只存加盐哈希） ──
+    function hashPassword(salt, password) {
+      return createHash('sha256').update(String(salt) + '\u0000' + String(password), 'utf8').digest('hex')
+    }
+    function sameText(a, b) {
+      const ba = Buffer.from(String(a || ''))
+      const bb = Buffer.from(String(b || ''))
+      return ba.length > 0 && ba.length === bb.length && timingSafeEqual(ba, bb)
+    }
+    function getAuth() {
+      if (!settingsCtx) return null
+      const value = settingsCtx.settings.get(DOCK_NS)
+      const auth = value && value.remoteAuth
+      return auth && auth.username && auth.passwordHash && auth.salt ? auth : null
+    }
+    async function saveAuth(username, password) {
+      if (!settingsCtx || typeof settingsCtx.settings.mutate !== 'function') {
+        const error = new Error('settings 服务未就绪，无法保存账号')
+        error.statusCode = 500
+        throw error
+      }
+      const salt = randomBytes(16).toString('hex')
+      await settingsCtx.settings.mutate(DOCK_NS, [{
+        op: 'set',
+        path: ['remoteAuth'],
+        value: { username, salt, passwordHash: hashPassword(salt, password) },
+      }])
+      // 账号密码变更：作废所有已登录设备，强制重新登录。
+      if (gateway) gateway.revokeAllSessions()
+    }
+    async function verifyLogin(username, password) {
+      const auth = getAuth()
+      if (!auth) return false
+      return sameText(username, auth.username) && sameText(hashPassword(auth.salt, password), auth.passwordHash)
+    }
+
+    /** 远程访问状态：网关、账号、浏览模式补丁、旧服务器模式残留。 */
+    function lanStatus(webServer) {
+      const file = serverPatchFile()
+      let applied = false
+      let webserverActive = false
+      try {
+        const list = readPatchList(file)
+        applied = serverPatchApplied(list)
+        webserverActive = legacyWebserverRowPresent(list)
+      } catch { applied = false }
+      const auth = getAuth()
+      return {
+        gatewayActive: Boolean(gateway),
+        gatewayPort: gateway ? gateway.port : null,
+        mainPort: webServer.port,
+        addresses: lanAddresses(),
+        patchApplied: applied,
+        webserverActive,
+        accountSet: Boolean(auth),
+        username: auth ? auth.username : '',
+        patchPath: file,
+      }
+    }
 
     async function stopGateway() {
       const current = gateway
@@ -59,8 +260,12 @@ export const feature = {
       if (current) await current.close()
     }
 
+    /** 远程访问网关：上游即主实例；主实例保持仅本机，远程一律经账号登录进入。 */
     async function ensureGateway(webServer, requestedPort) {
-      const port = Number(requestedPort === undefined ? DEFAULT_GATEWAY_PORT : requestedPort)
+      // 默认端口跟主实例走（主端口+1）：网关和主服务是同一台机器上的两个监听，
+      // 结构上不能同端口；跟随主端口让"哪个口是哪个"一目了然。
+      const port = Number(requestedPort === undefined || requestedPort === null || requestedPort === ''
+        ? webServer.port + 1 : requestedPort)
       if (!Number.isInteger(port) || port < 1024 || port > 65535) {
         const error = new Error('局域网端口需为 1024 到 65535 之间的整数')
         error.statusCode = 400
@@ -77,8 +282,17 @@ export const feature = {
         error.statusCode = 409
         throw error
       }
+      // 上游即主实例：单实例架构下所有设备看到的就是同一个进程，任务状态天然同步。
+      // 主实例保持仅本机 → 网关把 Host/Origin 改写成回环（回环恒被信任），
+      // 远程设备必须先经过账号登录，不存在绕过登录的直连路径。
       if (!gatewayStarting) {
-        gatewayStarting = startProtectedLanGateway({ port, upstreamHost: '127.0.0.1', upstreamPort: webServer.port })
+        gatewayStarting = startProtectedLanGateway({
+          port,
+          upstreamHost: '127.0.0.1',
+          upstreamPort: webServer.port,
+          spoofLoopback: true,
+          verifyLogin,
+        })
           .then((started) => { gateway = started; gatewayStarting = null; return started })
           .catch((error) => { gatewayStarting = null; throw error })
       }
@@ -92,137 +306,14 @@ export const feature = {
       }
     }
 
-    function purge() {
-      const stamp = now()
-      for (const [id, pair] of pairs) {
-        for (const [deviceId, device] of pair.devices) {
-          if (stamp - device.seenAt > PRESENCE_TTL_MS) pair.devices.delete(deviceId)
-        }
-        if (pair.joinExpiresAt <= stamp && pair.devices.size === 0) {
-          pairs.delete(id)
-          if (gateway) gateway.revokePair(id)
-        }
-      }
-      for (const [key, stampAt] of joinAttempts) if (stamp - stampAt.firstAt > PAIR_TTL_MS) joinAttempts.delete(key)
-      if (gateway) gateway.purge()
-      if (gateway && pairs.size === 0) void stopGateway()
-    }
-    const purgeTimer = setInterval(purge, 15 * 1000)
-    disposers.push(() => clearInterval(purgeTimer))
-
-    function taskSnapshot() {
-      const stamp = now()
-      return [...tasks.values()].filter((task) => task.running).map((task) => ({
-        sessionId: task.sessionId,
-        title: task.title || task.firstPrompt || '(等待任务标题)',
-        phase: task.phase || 'think',
-        startedAt: task.startedAt,
-        elapsed: stamp - task.startedAt,
-        lastActivityAt: task.lastActivityAt,
-      })).sort((a, b) => b.lastActivityAt - a.lastActivityAt)
-    }
-    function visiblePair(pair) {
-      const devices = [...pair.devices.values()].map((device) => ({
-        id: device.id,
-        role: device.role,
-        label: device.label,
-        seenAt: device.seenAt,
-      })).sort((a, b) => b.seenAt - a.seenAt)
-      return {
-        id: pair.id,
-        expiresAt: pair.joinExpiresAt,
-        note: pair.note,
-        noteAt: pair.noteAt,
-        noteFrom: pair.noteFrom,
-        devices,
-        tasks: taskSnapshot(),
-        now: now(),
-      }
-    }
-    function requirePair(payload) {
-      const pairId = cleanText(payload && payload.pairId, 48)
-      const deviceId = cleanText(payload && payload.deviceId, 80)
-      const secret = cleanText(payload && payload.secret, 160)
-      const pair = pairs.get(pairId)
-      if (!pair) {
-        const error = new Error('配对不存在，请在电脑端重新开启连接')
-        error.statusCode = 410
-        throw error
-      }
-      const device = pair.devices.get(deviceId)
-      if (!device || device.secret !== secret) {
-        const error = new Error('此设备未完成配对，请重新打开手机接力链接')
-        error.statusCode = 403
-        throw error
-      }
-      device.seenAt = now()
-      return { pair, device }
-    }
-    function joinRateKey(req) {
-      return (req.socket && req.socket.remoteAddress) || 'unknown'
-    }
-    function recordFailedJoin(req) {
-      const key = joinRateKey(req)
-      const item = joinAttempts.get(key) || { count: 0, firstAt: now() }
-      if (now() - item.firstAt > PAIR_TTL_MS) { item.count = 0; item.firstAt = now() }
-      item.count++
-      joinAttempts.set(key, item)
-      return item.count
-    }
-    function canJoin(req) {
-      const item = joinAttempts.get(joinRateKey(req))
-      return !item || now() - item.firstAt > PAIR_TTL_MS || item.count < MAX_JOIN_ATTEMPTS
-    }
-
-    // 任务状态只取最小必要字段。真正的会话内容仍由 DSH 的既有会话服务管理，
-    // 这样手机继续输入后不会和电脑产生两个任务副本。
-    disposers.push(ctx.inject(['sessionQuery'], (sqCtx) => {
-      const sessionQuery = sqCtx.sessionQuery
-      const titleFor = async (task) => {
-        try {
-          const snapshot = sessionQuery && typeof sessionQuery.readTitle === 'function'
-            ? await sessionQuery.readTitle(task.sessionId) : null
-          if (snapshot && snapshot.title && tasks.get(task.sessionId) === task) task.title = snapshot.title
-        } catch { /* 标题缺失时以首条输入兜底 */ }
-      }
-      disposers.push(sqCtx.on('agent/status', (payload) => {
-        const agent = payload && payload.agent
-        const sid = agent && agent.id ? String(agent.id) : ''
-        if (!sid) return
-        if (payload.status === 'running') {
-          let task = tasks.get(sid)
-          if (!task) {
-            task = { sessionId: sid, title: '', firstPrompt: '', phase: 'think', startedAt: now(), lastActivityAt: now(), running: true }
-            tasks.set(sid, task)
-            titleFor(task)
-          }
-          task.running = true
-          task.lastActivityAt = now()
-        } else if (payload.status === 'idle') {
-          const task = tasks.get(sid)
-          if (task) { task.running = false; task.lastActivityAt = now() }
-        }
-      }))
-      disposers.push(sqCtx.on('agent/disposed', (payload) => {
-        const sid = payload && payload.agent && payload.agent.id ? String(payload.agent.id) : ''
-        const task = tasks.get(sid)
-        if (task) { task.running = false; task.lastActivityAt = now() }
-      }))
-      disposers.push(sqCtx.on('session/event', (session, event) => {
-        const sid = typeof session === 'object' && session ? String(session.id || '') : String(session || '')
-        const task = tasks.get(sid)
-        if (!task) return
-        const phase = phaseOf(event)
-        if (phase) task.phase = phase
-        if (!task.firstPrompt && event && event.type === 'user/message') {
-          const text = extractText(event.data && event.data.content)
-          if (text) task.firstPrompt = text.slice(0, 120)
-        }
-        task.lastActivityAt = (event && event.time) || now()
-      }))
-    }))
 
     disposers.push(ctx.inject(['webServer'], (wsCtx) => {
+      // 服务器模式下的主实例同样服务局域网浏览器：注入 crypto.randomUUID 兜底，
+      // 修复非安全上下文下 DSH 客户端引导失败。回环/安全上下文下脚本自我短路，
+      // 对本机使用零副作用。
+      if (typeof wsCtx.webServer.tapIndex === 'function') {
+        disposers.push(wsCtx.effect(() => wsCtx.webServer.tapIndex(injectLanCompat)))
+      }
       wsCtx.effect(() => wsCtx.webServer.register({
         kind: 'prefix',
         path: '/dsh-dock/mobile-relay',
@@ -230,80 +321,66 @@ export const feature = {
           try {
             const method = routeMethod(req)
             const payload = await readBody(req)
-            purge()
-            if (method === 'network') {
-              return sendJson(res, 200, { ok: true, data: {
-                addresses: lanAddresses(),
-                defaultPort: DEFAULT_GATEWAY_PORT,
-                main: { host: wsCtx.webServer.host, port: wsCtx.webServer.port },
-                gateway: gateway ? { active: true, port: gateway.port, addresses: gateway.addresses } : { active: false },
-              } })
+            if (method === 'lan') {
+              return sendJson(res, 200, { ok: true, data: lanStatus(wsCtx.webServer) })
             }
-            if (method === 'start') {
-              const activeGateway = await ensureGateway(wsCtx.webServer, payload && payload.port)
-              const id = publicId()
-              const code = joinCode()
-              const desktopId = cleanText(payload && payload.deviceId, 80) || publicId()
-              const desktopSecret = publicId() + publicId()
-              const pair = {
-                id, code, joinExpiresAt: now() + PAIR_TTL_MS, note: '', noteAt: 0, noteFrom: '', devices: new Map(),
-              }
-              pair.devices.set(desktopId, { id: desktopId, secret: desktopSecret, role: 'desktop', label: '电脑端', seenAt: now() })
-              pairs.set(id, pair)
-              const gatewayToken = activeGateway.issue(id, `${id}.${code}`, pair.joinExpiresAt)
-              return sendJson(res, 200, { ok: true, data: {
-                pairId: id, code, secret: desktopSecret, expiresAt: pair.joinExpiresAt, gatewayToken,
-                gateway: { active: true, port: activeGateway.port, addresses: activeGateway.addresses },
-                pair: visiblePair(pair),
-              } })
-            }
-            if (method === 'join') {
-              if (!canJoin(req)) {
-                const error = new Error('尝试次数过多，请稍后重试或在电脑端重新生成链接')
-                error.statusCode = 429
+            if (method === 'auth/set') {
+              // 设置/修改远程访问账号密码；改完作废所有已登录会话。
+              const username = String((payload && payload.username) || '').trim()
+              const password = String((payload && payload.password) || '')
+              if (!username || username.length > 64) {
+                const error = new Error('账号需为 1 到 64 个字符')
+                error.statusCode = 400
                 throw error
               }
-              const pairId = cleanText(payload && payload.pairId, 48)
-              const code = cleanText(payload && payload.code, 32).toUpperCase()
-              const pair = pairs.get(pairId)
-              if (!pair || pair.joinExpiresAt <= now() || code !== pair.code) {
-                recordFailedJoin(req)
-                const error = new Error('连接码无效或已过期，请回到电脑端重新开启')
-                error.statusCode = 403
+              if (password.length < 6 || password.length > 128) {
+                const error = new Error('密码至少 6 位、至多 128 位')
+                error.statusCode = 400
                 throw error
               }
-              const deviceId = cleanText(payload && payload.deviceId, 80) || publicId()
-              const secret = publicId() + publicId()
-              pair.devices.set(deviceId, { id: deviceId, secret, role: 'mobile', label: cleanText(payload && payload.label, 32) || '手机端', seenAt: now() })
-              return sendJson(res, 200, { ok: true, data: { pairId, secret, expiresAt: pair.joinExpiresAt, pair: visiblePair(pair) } })
+              await saveAuth(username, password)
+              return sendJson(res, 200, { ok: true, data: { ...lanStatus(wsCtx.webServer) } })
             }
-            if (method === 'status') {
-              const { pair } = requirePair(payload)
-              return sendJson(res, 200, { ok: true, data: { pair: visiblePair(pair) } })
-            }
-            if (method === 'note') {
-              const { pair, device } = requirePair(payload)
-              const note = cleanText(payload && payload.note, NOTE_MAX_LENGTH)
-              if (!note) {
-                const error = new Error('请先写下接力内容')
+            if (method === 'lan/start') {
+              // 开启远程访问：网关监听 0.0.0.0（唯一远程入口，登录后才放行）；
+              // 同时移除旧服务器模式行（主实例必须回到仅本机）并把目录选择器钉为浏览模式。
+              const username = String((payload && payload.username) || '').trim()
+              const password = String((payload && payload.password) || '')
+              if (username && password) {
+                if (!username || username.length > 64) {
+                  const error = new Error('账号需为 1 到 64 个字符')
+                  error.statusCode = 400
+                  throw error
+                }
+                if (password.length < 6 || password.length > 128) {
+                  const error = new Error('密码至少 6 位、至多 128 位')
+                  error.statusCode = 400
+                  throw error
+                }
+                await saveAuth(username, password)
+              }
+              if (!getAuth()) {
+                const error = new Error('请先设置远程访问的账号和密码')
                 error.statusCode = 400
                 throw error
               }
-              pair.note = note
-              pair.noteAt = now()
-              pair.noteFrom = device.role === 'mobile' ? '手机端' : '电脑端'
-              return sendJson(res, 200, { ok: true, data: { pair: visiblePair(pair) } })
+              const file = serverPatchFile()
+              const list = readPatchList(file) || []
+              const changed = !serverPatchApplied(list) || legacyWebserverRowPresent(list)
+              writePatchList(file, upsertRemotePatches(list))
+              await ensureGateway(wsCtx.webServer, payload && payload.port)
+              return sendJson(res, 200, { ok: true, data: { ...lanStatus(wsCtx.webServer), needsRestart: changed } })
             }
-            if (method === 'end') {
-              const { pair } = requirePair(payload)
-              pairs.delete(pair.id)
-              if (gateway) gateway.revokePair(pair.id)
-              const shouldStopGateway = pairs.size === 0
-              sendJson(res, 200, { ok: true, data: { ended: true } })
-              // 手机端的关闭请求本身也经过网关。先完成响应，再异步停止监听，
-              // 避免 server.close() 等待当前请求、当前请求又等待 close() 的死锁。
-              if (shouldStopGateway) setTimeout(() => { void stopGateway() }, 50)
-              return
+            if (method === 'lan/stop') {
+              const file = serverPatchFile()
+              const list = readPatchList(file)
+              await stopGateway()
+              if (list === null) {
+                return sendJson(res, 200, { ok: true, data: { ...lanStatus(wsCtx.webServer), needsRestart: false } })
+              }
+              const changed = serverPatchApplied(list) || legacyWebserverRowPresent(list)
+              if (changed) writePatchList(file, removeRemotePatches(list))
+              return sendJson(res, 200, { ok: true, data: { ...lanStatus(wsCtx.webServer), needsRestart: changed } })
             }
             return sendJson(res, 404, { ok: false, error: { code: 'method-not-found', message: 'unknown method: ' + method } })
           } catch (error) {
@@ -320,8 +397,6 @@ export const feature = {
         const dispose = disposers.pop()
         try { if (typeof dispose === 'function') dispose() } catch { /* ignore */ }
       }
-      pairs.clear()
-      tasks.clear()
       void stopGateway()
     }
   },