dsh-enhancement 1.0.0 → 1.1.0

package/README.en.md

@@ -1,89 +1,136 @@
 # dsh-enhancement
 
-DSH enhancement suite: a standalone **password gateway** for DSH Web, plus **PWA install/icons**, **desktop notifications**, and **PWA Web Push**. Useful for exposing DSH on a LAN, adding it to a phone home screen, or reaching it remotely without the `?token=` URL printed by `dsh web`.
+[![](https://img.shields.io/badge/powered_by-dsh-4D6BFE?style=flat-square&logo=deepseek&logoColor=white)](https://github.com/deepseek-ai/deepseek-harness)
 
-> Status: Phases 1–4 implemented; Phase 5 (docs/deps/cleanup) in progress. The gateway and push are disabled by default.
+[简体中文](README.md) | **English**
+
+A standalone password gateway for DSH Web, plus everything needed to use DSH like an app on your phone: PWA installation, desktop notifications, and mobile push.
+
+Set a password, open the gateway URL, and log in to DSH without carrying around the `?token=` URL printed by `dsh web`. Add DSH to your phone's home screen and get notified when a task finishes or needs your approval—tap the notification to return to the right session.
 
 ## Features
 
-The settings card is organized into expanded **Gateway / Access / PWA / Notifications** sections, each with its own save action, dirty indicator, inline feedback, and DSH `--dsw-alias-*` styling. Gateway settings, HTTPS, and listener options live in one block with a single save.
+| Feature | What it does |
+| --- | --- |
+| Password gateway | Access DSH through a dedicated port and password instead of `?token=`, suitable for LAN or remote use |
+| HTTPS | Upload a certificate, sign with your own CA, or let the plugin create a local CA |
+| PWA | Install DSH on the desktop or phone home screen, with custom app name, theme color, and icons |
+| Desktop notifications | System notifications for task completion, questions, approvals, and background jobs |
+| Mobile push | PWA Web Push notifications on your phone; tap to return to the matching session |
+| Session header | Send a DSH session-id request header on third-party API routes too, so a gateway can correlate requests by session |
 
-### Secure gateway
+## Password gateway
 
-- Independent listener (default `3088`, disabled by default); configurable interface, port, password and session lifetime.
-- scrypt password hashing; login failures are rate-limited per IP. Normal requests are not globally throttled.
-- DSH-styled dark login page; `HttpOnly; SameSite=Strict` session cookie, `Secure` under HTTPS.
-- Does not need DSH's `?token=`: the plugin reads the persistent signing secret from DSH `credentials` and mints a short-lived `dsh-auth-*` cookie per proxied request.
-- Rewrites upstream Host to the DSH bind address, strips Origin, and enforces same-origin/CSRF itself — no `--trusted-host` change or `dsh-web.service` edit.
-- HTTP + WebSocket reverse proxy; SSE is not buffered.
+- Off by default; listens on port `3088` by default, configurable to another free port.
+- A password must be set before the gateway can be enabled. Only a hash of the password is stored.
+- After login, the gateway keeps its own session; DSH's `?token=` is not needed.
+- Choose which network interface to listen on.
+- Works with normal DSH chat, files, terminal, WebSocket, and live streams.
+- Configurable login session lifetime; changing the password invalidates all gateway sessions.
 
-### HTTPS
+## HTTPS
 
-`off`, `uploaded` (certificate chain + key), `ca` (uploaded CA signs a leaf for the listener), `selfsigned` (plugin-generated local CA; CA certificate downloadable). Private keys stay in `$DSH_HOME/profiles/<profile>/fengyifan-dsh-enhancement/tls/` (current user only). Mobile devices must trust a self-signed/private CA.
+PWA installation, Service Workers, and mobile push require HTTPS (localhost is exempt). Three options are available:
 
-### PWA
+| Option | When to use it |
+| --- | --- |
+| Off (HTTP) | Temporary local/trusted-network use; PWA and push are unavailable |
+| Use an existing certificate | You already have a domain certificate; upload the chain and private key |
+| Sign with a CA | Upload your own CA, or let the plugin generate a local CA and issue a certificate for the current address |
 
-Takes over `/manifest.webmanifest`, icons, `apple-touch-icon`, `/sw.js` and the install prompt; replaces `dsh-pwa-icon`. Default icon set: 192/512 `any`, 512 `maskable`, 1600 WebP, iOS 180. Per-platform slots can be replaced by PNG upload (192, 512, maskable 512, Apple 180). Chromium gets `beforeinstallprompt`; iOS gets a manual “Share → Add to Home Screen” hint. HTTPS is required for installation, Service Worker and push.
+For a self-signed/private CA, install and trust the CA certificate on each device:
 
-### Desktop notifications
+- iOS: Settings → General → VPN & Device Management to install the profile, then General → About → Certificate Trust Settings and enable full trust.
+- Android: Settings → Security → Encryption & credentials → Install a certificate.
 
-Linux uses a small `notify-send --action` shim because `node-notifier@11.0.0`'s Linux backend drops actions/clicks; macOS/Windows use `node-notifier`. Clicking opens `<base>/?dsh-session=<id>`; the browser half calls `uiWorkspace.openSession(id)`. PWA notification clicks focus an existing window or post a message through the Service Worker.
+The certificate must cover the hostname or IP you actually use (SAN), otherwise browsers will still show a certificate error.
 
-Types: task complete, waiting for answer (`ask_user_question`), approval requested, approval denied, subagent finished, goal complete/blocked, background job settled (unawaited jobs only).
+## PWA
 
-### PWA Web Push
+- Takes over DSH's manifest, icons, `apple-touch-icon`, Service Worker, and install prompt.
+- Customize the app name, short name, theme color, and replace desktop/Android/iOS icons separately.
+- Chromium / Edge show an install prompt; iPhone / iPad use Safari's “Share → Add to Home Screen”.
+- Installed apps open without browser chrome; HTTPS is required for installation, Service Worker, and push.
 
-`web-push` + VAPID. Subscription records and the VAPID private key live in `state.json` (current user only). HTTPS is mandatory; iOS/iPadOS 16.4+ requires the app to be installed on the Home Screen, and permission must be requested from a user gesture. The settings card offers subscribe/unsubscribe/test and shows permission/subscription state.
+## Session header
 
-## Install
+DSH only sends `x-deepseek-harness-session-id` when talking to the official DeepSeek API; third-party routes through OpenAI-compatible gateways (`llm-pi-ai`) carry no session identifier at all. With this feature on, the plugin injects the current session id as a request header so your gateway can correlate requests by session.
 
-From npm:
+- **Off by default**; the default header name matches the official DeepSeek one: `x-deepseek-harness-session-id`.
+- The header name is configurable for gateways with their own convention; the value is always DSH's raw session id.
+- Applies only to third-party API adapters (`llm-pi-ai`); official DeepSeek routes already send it and are untouched.
+- Takes effect on the next model request after saving — no restart needed.
+- An existing header of the same name set upstream is never overwritten.
 
-```bash
-dsh plugin --profile web add dsh-enhancement
-```
+> Implementation note: injection happens on the third-party adapter's `streamWithSnapshot` prototype method, because DSH rebuilds the pi-ai options inside it — the `llm/stream` layer cannot change request headers. The feature therefore depends on host internals; if the host shape changes, it bypasses itself and records the reason instead of blocking requests.
 
-The bundle patch inserts the plugin row and also inserts `dsh-web-mobile` and `dsh-vertical-layout`; do **not** enable those two bundles separately.
+### Why it says "not mounted yet"
 
-Local development (link the source):
+`dsh-base` mounts `llm-pi-ai` in a **dormant** state: with no provider routes configured it never registers an adapter (`routes.length === 0` returns early), so there is nothing to inject into. That is a normal state, not a failure. The settings page distinguishes the causes:
 
-```bash
-cd ~/dev/projects/github/fengyifan/dsh-plugins
-pnpm --filter dsh-enhancement build
-cd ~/.dsh/profiles/web
-pnpm add link:../../dev/projects/github/fengyifan/dsh-plugins/packages/dsh-enhancement
-```
+| Message | Meaning | What to do |
+| --- | --- | --- |
+| Mounted on N third-party API adapters | Working | — |
+| No third-party model routes registered | No OpenAI-compatible provider configured yet | Add one under Settings → Models, or declare `providers` for `llm-pi-ai` in this profile's `cordis.patch.yml` |
+| N adapters registered, none is a third-party API adapter | Only official DeepSeek routes | Same as above: add a third-party provider |
+| Host llm service unavailable or reshaped | Version drift | Plugin has bypassed itself; requests are unaffected |
+
+## Notifications
 
-Add `dsh-enhancement` to `dsh.profile.bundles`; mobile/vertical are inserted by its patch.
+Supported events, all enabled by default and individually selectable:
 
-## Configuration and test isolation
+- Task completed
+- Waiting for your answer
+- Waiting for approval
+- Approval denied
+- Subagent finished
+- Goal completed or blocked
+- Background job finished (not every command)
 
-Runtime state lives at `$DSH_HOME/profiles/<profile>/fengyifan-dsh-enhancement/state.json` (current user only) and `tls/`. Passwords/private keys never go into the profile patch.
+Desktop notifications and mobile push share the event selection but can be enabled independently.
 
-For multi-instance or test profiles, override the state directory:
+Clicking a desktop notification opens the matching session. On Linux and Windows, if DSH is already open, it focuses the existing page and switches to that session; on macOS the system notification opens the link. On Linux, the system notification service must support actions (common desktop environments do); if notifications appear but clicks do nothing, check that `notify-send` and an action-capable notification service are available.
+
+## Mobile push
+
+- Standard Web Push with one subscription per device.
+- Click “Subscribe this device” in settings; the browser asks for notification permission, which must be triggered by your click.
+- iOS / iPadOS 16.4+ is required, and DSH must be added to the Home Screen; regular Safari tabs cannot receive push.
+- Unsubscribe at any time, or send a test push to verify the setup.
+
+## Install
 
 ```bash
-DSH_HOME="$HOME/.local/state/dsh-enhancement-test/home" \
-  dsh --profile enhancement-test --host 10.0.0.2 --port 3090 --no-open
+dsh plugin --profile web add dsh-enhancement
 ```
 
-Use a separate gateway port (e.g. 3098) so the production gateway on 3088 is not taken. Host-side code changes then only require restarting the test process, not the DSH instance hosting your current session.
+Restart DSH Web after installation. The plugin brings in the mobile and portrait-layout dependencies automatically; do not install or enable them separately.
 
-## Known limitations
+## Getting started
 
-- Linux click support depends on a notification daemon that implements actions; without `notify-send`/actions, notifications are display-only.
-- Native click opens/focuses a browser tab; exact focus of an existing tab is handled by the PWA Service Worker path.
-- iOS Web Push only works in an installed Home Screen web app on 16.4+; Safari tabs cannot receive push.
-- Self-signed certificates require installing the CA on every device.
-- Real-device iOS/Android acceptance and user-provided icon assets are still pending.
+1. Open DSH → Settings → Plugins → `dsh-enhancement`.
+2. Under “Access control”, set a password and save. The gateway enable switch becomes available after a password is set.
+3. Under “Gateway”, choose the listen address and port (default `3088`), enable the gateway, and save.
+4. If you need HTTPS, choose a certificate option in the same section and save. For a self-signed CA, install and trust the CA certificate on your devices.
+5. Open the gateway URL on your phone or another computer and log in with the password; DSH's `?token=` is not required.
+6. To use it as an app, install the PWA in your browser; on iOS use “Share → Add to Home Screen”.
+7. Under “Notifications”, select the events you want and click “Test desktop notification”. For mobile push, enable push and click “Subscribe this device”.
 
-## Development
+## Tips
 
-```bash
-pnpm --filter dsh-enhancement verify
-pnpm --filter dsh-enhancement build
-node scripts/smoke-plugin.mjs --package dsh-enhancement   # from repo root
-```
+- Use HTTPS and a strong password before exposing the gateway to the internet.
+- Do not reuse DSH's own port (default `3080`) for the gateway; choose another free port if needed.
+- Self-signed certificates are best for devices you control; use a proper certificate when sharing with others.
+- If you only use DSH locally, leave the gateway off; the normal DSH access path is unaffected.
+
+## Limitations
+
+- The gateway, PWA, and push are off by default and require setup; the gateway cannot be enabled before a password is set.
+- PWA installation, Service Worker, and Web Push all require HTTPS.
+- iOS push requires 16.4+ and installation on the Home Screen.
+- A self-signed/private CA must be installed and trusted on every device.
+- Linux notification click support depends on the notification service implementing actions.
+- Changing the password invalidates all gateway sessions, so you will need to log in again.
 
 ## License
 

package/README.md

@@ -1,128 +1,137 @@
 # dsh-enhancement
 
+[![](https://img.shields.io/badge/powered_by-dsh-4D6BFE?style=flat-square&logo=deepseek&logoColor=white)](https://github.com/deepseek-ai/deepseek-harness)
+
 **简体中文** | [English](README.en.md)
 
-DSH 增强套件：在 DSH Web 之外提供一个**独立的密码网关**，并整合 **PWA 安装/图标**、**桌面通知**与 **PWA Web Push**。适用于把 DSH 暴露到局域网、手机主屏或远程网络，同时不依赖 DSH 启动时打印的 `?token=`。
+给 DSH Web 加一层独立的密码入口，同时把它变成可以在手机主屏使用、会发通知的 Web 应用。
 
-> 状态：Phase 1–4 已实现，Phase 5（文档/依赖/清理）进行中。当前默认不启用网关、不启用 PWA 推送；先在“设置 → 插件 → dsh-enhancement”里配置。
+设置独立密码后，打开网关地址即可登录 DSH，无需携带 `dsh web` 启动时打印的 `?token=` 地址；装入手机主屏后，任务完成、等待审批等事件会直接推送给你，点通知即可回到对应会话。
 
-## 功能
+## 功能一览
 
-设置页按**网关配置 / 访问控制 / PWA / 通知**分区展开，每个配置块有独立保存按钮、未保存提示和块内保存反馈；表单使用 DSH 的 `--dsw-alias-*` 设计变量。网关配置把监听、访问与 HTTPS 收在同一块，只保留一个保存动作。
+| 功能 | 能做什么 |
+| --- | --- |
+| 密码网关 | 用独立端口和密码访问 DSH，无需 `?token=`，适合局域网或远程使用 |
+| HTTPS | 支持上传证书、使用自己的 CA 签发，或由插件自动生成本地 CA |
+| PWA | 把 DSH 添加到桌面/手机主屏，支持自定义应用名、主题色和图标 |
+| 桌面通知 | 任务完成、等待回答、等待审批、后台任务结束等事件弹出系统通知 |
+| 手机推送 | 通过 PWA Web Push 把通知推到手机，点击直接回到对应会话 |
+| 会话请求头 | 让第三方 API 路由也携带 DSH 的 session id 请求头，便于上游网关按会话关联请求 |
 
-### 1. 安全访问网关
+## 独立密码网关
 
-- 独立监听地址/端口（默认 `3088`，默认关闭），可配置网卡 IP、密码、会话有效期。
-- 密码只存 scrypt 哈希；登录失败按 IP 节流（可关）。普通请求**不做全局限流**，避免误伤 DSH 的静态资源/WS/SSE。
-- 登录页复用 DSH 深色风格；网关会话 cookie 为 `HttpOnly; SameSite=Strict`，HTTPS 下加 `Secure`。
-- **不需要 DSH `?token=`**：插件从 DSH 的 `credentials` 服务读取持久签名密钥，每次代理请求即时签发一个短时 `dsh-auth-*` cookie 注入上游；浏览器永远看不到它。
-- 上游 Host 改写为 DSH 绑定地址并剥离 Origin；网关自己校验同源 / `Sec-Fetch-Site` / CSRF。这样不需要修改 `dsh-web.service` 的 `--trusted-host`。
-- 支持 HTTP 与 WebSocket（`/api/remote.mux`）反向代理；SSE 不缓冲。
+- 默认关闭，监听端口默认 `3088`，可在设置中改到其他空闲端口。
+- 必须先设置访问密码，网关的启用开关才可用；密码只保存哈希，不保存明文。
+- 登录后由网关自己的会话维持访问，不需要 DSH 的 `?token=`；网关会替浏览器完成 DSH 认证。
+- 可以选择监听的网卡地址，默认只在你指定的地址上提供服务。
+- 支持 DSH 的正常聊天、文件、终端、WebSocket 和实时流，不只是静态页面。
+- 可以设置登录会话的有效期；修改密码后，所有已登录的网关会话都会失效。
 
-### 2. HTTPS
+## HTTPS
 
-四种模式：
+PWA 安装、Service Worker 和手机推送都要求 HTTPS（本机 `localhost` 除外）。设置里提供三种方式：
 
-| 模式 | 说明 |
+| 方式 | 适用场景 |
 | --- | --- |
-| `off` | 纯 HTTP（PWA 安装/推送不可用） |
-| `uploaded` | 上传证书链 + 私钥，直接使用 |
-| `ca` | 上传 CA 证书 + CA 私钥，由插件为当前监听地址签发 leaf |
-| `selfsigned` | 插件生成本地 CA + leaf，并提供 CA 证书下载 |
+| 关闭（HTTP） | 只在本机或完全可信的网络里临时使用；PWA 和推送不可用 |
+| 使用已有证书 | 已经有域名证书，上传证书链和私钥即可 |
+| 使用 CA 证书自签发 | 上传自己的 CA，或者让插件生成一个本地 CA，再为当前地址签发证书 |
 
-- 私钥写入 `$DSH_HOME/profiles/<profile>/fengyifan-dsh-enhancement/tls/`（仅当前用户可读）。
-- 自签/私有 CA 需要设备安装并信任 CA：iOS 在“设置 → 通用 → VPN 与设备管理”安装描述文件，再到“关于本机 → 证书信任设置”开启完全信任；Android 在“安全 → 加密与凭据 → 安装证书”安装。
-- 上传证书的 SAN 必须覆盖访问地址/IP，否则浏览器会报证书错误。
+使用自签/私有 CA 时，需要把 CA 证书安装到访问设备并设为信任：
 
-### 3. PWA
+- iOS：设置 → 通用 → VPN 与设备管理 安装描述文件，再到 关于本机 → 证书信任设置 开启完全信任。
+- Android：设置 → 安全 → 加密与凭据 → 安装证书。
 
-- 接管 `/manifest.webmanifest`、图标路由、`apple-touch-icon`、`/sw.js` 与安装提示；取代 `dsh-pwa-icon`。
-- 默认图标集：192/512 `any`、512 `maskable`、1600 WebP、iOS 180。
-- 桌面/安卓/iOS 没有 OS 专用的 manifest 图标字段；效果通过 `any`（桌面）+ `maskable`（Android 自适应）+ `apple-touch-icon`（iOS，优先级最高）组合实现。
-- Chromium/Edge 支持 `beforeinstallprompt`，页面会显示 DSH 风格的安装浮层；iOS 只能显示“分享 → 添加到主屏幕”的手动指引。
-- PWA 安装、Service Worker、Web Push 都要求 HTTPS（localhost 例外）。
+上传的证书必须包含你实际访问用的域名或 IP（SAN），否则浏览器仍会提示证书错误。
 
-### 4. 通知（桌面 + PWA 推送）
+## PWA
 
-- 原生通知通道：Linux 调用 `notify-send --action`（因为 `node-notifier@11.0.0` 的 Linux 后端不透传 actions/click），macOS/Windows 使用 `node-notifier`。
-- 点击原生通知时优先通过 SSE 通知已打开的 DSH 页面：页面 `window.focus()` 后调用 `uiWorkspace.openSession(id)`，不再新开标签页；没有已打开页面时才回退到 `<网关或 DSH>/?dsh-session=<id>` 深链。PWA 通知仍由 Service Worker 聚焦已有窗口或打开新窗口。
-- 通知事件（默认开启）：任务完成、等待回答、等待审批、审批被拒绝、子任务结束、目标完成/受阻、后台任务结束（仅未 await 的后台任务，避免每条命令都弹）。事件勾选同时作用于桌面通知和 PWA 推送；两个渠道在设置页独立开关。
-- 生命周期事件来自 DSH 公共事件：`agent/status`、`session/event`（`tool/call` / `approval/*`）、`subagent/end`、`goal/changed`、`jobs.events`。
-- PWA 推送：`web-push` + VAPID；订阅记录与 VAPID 私钥存 `state.json`（仅当前用户可读）。VAPID subject 只是推送服务要求的联系方式，收在高级选项，默认值即可。
-- PWA 推送必须 HTTPS；iOS/iPadOS 16.4+ 且必须“添加到主屏幕”，权限必须由用户点按钮触发。设置页提供“订阅本设备 / 取消订阅 / 发送测试推送”，并显示当前通知权限和订阅数。
+- 接管 DSH 的 manifest、图标、`apple-touch-icon`、Service Worker 和安装提示。
+- 可以自定义应用名称、短名称、主题色，并分别替换桌面/Android/iOS 图标。
+- Chromium / Edge 会显示安装提示；iPhone / iPad 使用 Safari 的“分享 → 添加到主屏幕”。
+- 安装后从主屏启动，不显示浏览器地址栏，使用体验接近原生应用。
+- 只有 HTTPS 下才能安装、注册 Service Worker 和接收推送。
 
+## 会话请求头
 
-## 安装
+DSH 只在直连官方 DeepSeek API 时发送 `x-deepseek-harness-session-id`；走 OpenAI 兼容网关（`llm-pi-ai`）的第三方路由不会携带任何会话标识。启用本功能后，插件会把当前会话的 session id 注入成请求头，让上游网关也能按会话关联请求。
 
-从 npm：
+- 默认**关闭**，默认头名与 DeepSeek 官方一致：`x-deepseek-harness-session-id`。
+- 头名可改成上游网关约定的其它名称；值始终是 DSH 的原始 session id。
+- 只作用于第三方 API adapter（`llm-pi-ai`）；官方 DeepSeek 路由本来就带该头，不受影响。
+- 保存后下一次模型请求即生效，不需要重启 DSH。
+- 上游若已存在同名头，插件的注入不会覆盖它。
 
-```bash
-dsh plugin --profile web add dsh-enhancement
-```
-
-插件行由包内 `cordis.patch.yml` 自动插入；`dsh-web-mobile`、`dsh-vertical-layout` 也由同一个 patch 一并插入，**不要**在 profile 里再重复启用这两个 bundle。
+> 实现说明：注入点在第三方 adapter 的 `streamWithSnapshot` 原型方法上（DSH 在该方法内重建 pi-ai 的 options，`llm/stream` 层改不动请求头）。因此本功能依赖宿主内部结构，宿主版本结构变化时会自动旁路并记录原因，不会阻断请求。
 
-本机开发（link 源码）：
-
-```bash
-cd ~/dev/projects/github/fengyifan/dsh-plugins
-pnpm --filter dsh-enhancement build
-cd ~/.dsh/profiles/web
-pnpm add link:../../dev/projects/github/fengyifan/dsh-plugins/packages/dsh-enhancement
-```
+### 为什么显示「尚未挂载」
 
-profile 的 `dsh.profile.bundles` 加入 `dsh-enhancement`；mobile/vertical 不用再单独加入。
+`dsh-base` 以**休眠态**挂载 `llm-pi-ai`：没有配置任何 provider 路由时它不会注册 adapter（`routes.length === 0` 直接返回），此时插件无处注入。这是正常状态，不是故障。设置页按原因区分：
 
-## 配置
+| 提示 | 含义 | 处理 |
+| --- | --- | --- |
+| 已挂载到 N 个第三方 API adapter | 正常工作 | — |
+| 当前没有已注册的第三方模型路由 | 尚未配置 OpenAI 兼容 provider | 到「设置 → 模型」添加，或在本 profile 的 `cordis.patch.yml` 写 `llm-pi-ai` 的 `providers` |
+| 已注册 N 个 adapter，但没有一个是第三方 API adapter | 只有官方 DeepSeek 路由 | 同上：需要添加第三方 provider |
+| 宿主 llm 服务不可用或结构已变化 | 版本漂移 | 插件已旁路，不影响正常请求 |
 
-打开 DSH → 设置 → 插件 → `dsh-enhancement`。运行配置与秘密都在：
+## 通知
 
-```
-$DSH_HOME/profiles/<profile>/fengyifan-dsh-enhancement/state.json   # 仅当前用户可读：密码哈希、网关签名密钥、VAPID、订阅
-$DSH_HOME/profiles/<profile>/fengyifan-dsh-enhancement/tls/         # 仅当前用户可读：证书与私钥
-```
+支持这些事件，默认全部开启，可以按需勾选：
 
-插件行本身只负责加载；`cordis.patch.yml` 不存放密码/私钥。
+- 任务完成
+- 等待你回答
+- 等待审批
+- 审批被拒绝
+- 子任务结束
+- 目标完成或受阻
+- 后台任务结束（不会为每条命令都弹）
 
-## 与现有入口共存
+桌面通知和手机推送共用同一组事件选择，但可以分别关闭其中一个渠道。
 
-- 本插件默认监听 `3088`，与现有 `3081`（Envoy + `dsh-bootstrap`）互不影响。
-- 浏览器原有的 `dsh-auth-*` cookie 在网关代理时会被过滤，只使用插件即时签发的短时 cookie。
+点击桌面通知会打开对应会话。Linux 和 Windows 下，如果 DSH 已经打开，会优先切回已有页面并跳转到会话；macOS 使用系统通知的打开链接。Linux 需要系统通知守护支持 action（常见桌面环境都支持）；如果只显示通知、点击没反应，检查系统是否有 `notify-send` 和可用的通知服务。
 
-## 已知限制
+## 手机推送
 
-- `node-notifier@11.0.0` 的 Linux 后端不支持点击，所以 Linux 点击由本插件的 `notify-send` shim 实现；如果系统没有 `notify-send` 或通知守护不支持 actions，只能显示、不能点击。
-- 原生通知点击是“打开 URL”，通常会新开/聚焦浏览器标签；精确聚焦已有标签由 PWA Service Worker 通道完成。
-- iOS Web Push 仅 16.4+ 且必须已添加到主屏幕；Safari 标签页不能收推送。
-- 自签证书需要每台设备安装 CA；不想装 CA 就用上传证书模式。
-- PWA 图标上传（桌面/Android/iOS 分别替换）在资产提供后加入；当前使用包内默认图标。
+- 使用标准 Web Push，每台设备单独订阅。
+- 在设置里点“订阅本设备”，浏览器会请求通知权限；权限必须由你主动点击触发。
+- iOS / iPadOS 需要 16.4 或更高版本，并且必须先把 DSH 添加到主屏幕；Safari 普通标签页收不到推送。
+- 可以随时取消订阅，或发送一条测试推送确认链路正常。
 
-## 开发与隔离测试
+## 安装
 
 ```bash
-pnpm --filter dsh-enhancement verify
-pnpm --filter dsh-enhancement build
+dsh plugin --profile web add dsh-enhancement
 ```
 
-不要在正在使用的 `web` profile 里反复重启 DSH 做测试。为多实例/测试隔离，本插件支持状态目录覆盖：
+安装后重启 DSH Web。插件会自动带入手机布局和竖屏布局依赖，不需要再单独安装或启用它们。
 
-```bash
-# 1) 建一个只加载本插件（及 base/web-app）的测试 profile，例如 ~/.dsh/profiles/enhancement-test
-#    package.json 的 dsh.profile.bundles 里放：
-#    @deepseek-ai/dsh-base, @deepseek-ai/dsh-web-app, dsh-enhancement
-# 2) 用独立状态目录启动另一个 DSH 进程（不同端口，避免与 3080/3088 冲突）
-DSH_HOME="$HOME/.local/state/dsh-enhancement-test/home" \
-  dsh --profile enhancement-test --host 10.0.0.2 --port 3090 --no-open
-# 3) 测试网关用另一个端口（例如 3098），不要把生产网关的 3088 抢掉
-```
+## 开始使用
+
+1. 打开 DSH → 设置 → 插件 → `dsh-enhancement`。
+2. 在“访问控制”里设置密码并保存。设置密码后，“网关配置”里的启用开关才会变为可用。
+3. 在“网关配置”里选择监听地址和端口（默认 `3088`），打开“启用网关”，保存并应用。
+4. 如果需要 HTTPS，在同一块里选择证书方式并保存；使用自签 CA 时，把 CA 证书安装到手机/电脑并设为信任。
+5. 在手机或另一台电脑上打开网关地址，用刚设置的密码登录，无需 DSH 的 `?token=`。
+6. 需要主屏应用时，在浏览器里安装 PWA；iOS 使用“分享 → 添加到主屏幕”。
+7. 进入“通知”块，确认事件勾选，点“测试桌面通知”；需要手机推送时，打开推送并点“订阅本设备”。
+
+## 使用建议
 
-状态默认放在当前 profile 目录下：`$DSH_HOME/profiles/<profile>/fengyifan-dsh-enhancement/`。`DSH_ENHANCEMENT_STATE_DIR` 仅用于特殊隔离测试，必须是绝对路径。测试 profile 的网关/密码/证书/推送订阅全部落在该目录，不会影响正在使用的 profile。测试环境应使用持久目录（例如 `~/.local/state/dsh-enhancement-test/home`），不要用 `/tmp`。
+- 把网关暴露到公网前，务必使用 HTTPS 和强密码。
+- 网关端口不要和 DSH 自身端口（默认 `3080`）重复；冲突时换一个空闲端口。
+- 自签证书只适合自己控制的设备；给多人使用建议上传正式证书。
+- 如果只需要在本机用，保持网关关闭即可，DSH 原本的访问方式不受影响。
 
-宿主侧代码变更需要重启**测试进程**（测试进程不托管当前 Agent 会话）；主 `web` profile 只在最终验收时重启一次。
+## 限制
 
-- 宿主半侧：`src/index.ts`、`src/gateway.ts`、`src/control.ts`、`src/tls.ts`、`src/pwa.ts`、`src/notify.ts`、`src/push.ts`。
-- 浏览器半侧：`src/client/index.tsx`，构建为 `lib/client.js`（`scripts/build-client.mjs`）。
-- 测试：`pnpm --filter dsh-enhancement verify`；HTTPS/证书与 PWA 路由可用临时 `DSH_HOME` 做进程内集成测试。
+- 网关、PWA 和推送默认关闭，需要手动配置；未设置密码不能启用网关。
+- PWA 安装、Service Worker 和 Web Push 都需要 HTTPS。
+- iOS 推送要求 16.4+ 且已添加到主屏幕。
+- 自签/私有 CA 需要在每台访问设备上安装并信任。
+- Linux 桌面通知的点击依赖系统通知服务的 action 支持。
+- 修改密码会使所有网关登录会话失效，需要重新登录。
 
 ## License
 

package/lib/client.js

@@ -223,6 +223,8 @@ window.__ModuleLoader__.load({
         const [pushCount, setPushCount] = (0, react_1.useState)(0);
         const [deviceSubscribed, setDeviceSubscribed] = (0, react_1.useState)(false);
         const [customIcons, setCustomIcons] = (0, react_1.useState)([]);
+        const [sessionHeaderEnabled, setSessionHeaderEnabled] = (0, react_1.useState)(false);
+        const [sessionHeaderName, setSessionHeaderName] = (0, react_1.useState)('x-deepseek-harness-session-id');
         const applyStatus = (0, react_1.useCallback)((next) => {
             setStatus(next);
             setEnabled(next.enabled);
@@ -252,6 +254,8 @@ window.__ModuleLoader__.load({
             setPushPublicKey(next.push?.publicKey ?? null);
             setPushCount(next.push?.subscriptions ?? 0);
             setCustomIcons(next.pwa?.customIcons ?? []);
+            setSessionHeaderEnabled(next.sessionHeader?.enabled ?? false);
+            setSessionHeaderName(next.sessionHeader?.headerName ?? 'x-deepseek-harness-session-id');
             setHttpsChoice(next.https?.mode === 'uploaded' ? 'uploaded' : next.https?.mode === 'off' ? 'off' : 'selfsigned');
             setCaSource(next.https?.mode === 'ca' ? 'uploaded' : 'generated');
         }, []);
@@ -323,6 +327,13 @@ window.__ModuleLoader__.load({
             const next = await api('/config', { method: 'POST', body: JSON.stringify(fields) });
             applyStatus(next);
         }, success);
+        const saveSessionHeader = () => runBlock('sessionHeader', async () => {
+            const next = await api('/config', {
+                method: 'POST',
+                body: JSON.stringify({ sessionHeaderEnabled, sessionHeaderName }),
+            });
+            applyStatus(next);
+        }, '会话请求头配置已保存，下一次模型请求即生效。');
         const saveGateway = () => runBlock('gateway', async () => {
             let next = await api('/config', {
                 method: 'POST',
@@ -586,8 +597,29 @@ window.__ModuleLoader__.load({
             notifyJobs !== status.notify.jobs ||
             pushEnabled !== status.push.enabled ||
             pushSubject !== status.push.subject;
+        const sessionHeaderDirty = sessionHeaderEnabled !== status.sessionHeader.enabled ||
+            sessionHeaderName !== status.sessionHeader.headerName;
         const accessDirty = newPassword.length > 0 || confirmPassword.length > 0;
         const iconUrl = (kind) => `/pwa/enhancement/${kind}?v=${iconVersion}`;
+        /**
+         * 会话请求头的挂载说明。
+         * 「没配第三方模型」是正常状态而非故障，必须与真正的结构异常区分开。
+         */
+        const sessionHeaderSummary = (errorStyle = false) => {
+            const header = status.sessionHeader;
+            if (header.patched > 0) {
+                return `已挂载到 ${header.patched} 个第三方 API adapter；改动即时生效，无需重启。`;
+            }
+            if (header.reason === 'no-adapters') {
+                return '当前没有已注册的第三方模型路由，因此暂时无处注入。在「设置 → 模型」添加一个 OpenAI 兼容 provider（或在本 profile 的 cordis.patch.yml 配置 llm-pi-ai 路由）后会自动挂载；官方 DeepSeek 路由本来就自带该头，不需要它。';
+            }
+            if (header.reason === 'no-pi-ai-adapter') {
+                return `已注册 ${header.adapterCount} 个 adapter，但没有一个是第三方 API adapter（llm-pi-ai），因此未挂载。`;
+            }
+            if (errorStyle)
+                return '宿主 llm 服务不可用或结构已变化，注入已旁路，不会影响正常请求。';
+            return '宿主 llm 服务不可用或结构已变化，注入暂时旁路。';
+        };
         return ((0, jsx_runtime_1.jsxs)("div", { className: "enh-root", style: styles.wrap, children: [(0, jsx_runtime_1.jsx)("style", { children: CARD_CSS }), (0, jsx_runtime_1.jsxs)("div", { style: styles.header, children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("h3", { style: styles.title, children: "\u63D2\u4EF6\u72B6\u6001" }), (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "DSH \u589E\u5F3A\u7684\u7F51\u5173\u3001PWA\u3001\u901A\u77E5\u4E0E\u63A8\u9001\u914D\u7F6E\u3002" })] }), (0, jsx_runtime_1.jsxs)("span", { style: styles.pill, children: [(0, jsx_runtime_1.jsx)("span", { style: styles.dot }), "\u8FD0\u884C\u4E2D"] })] }), error ? (0, jsx_runtime_1.jsx)("div", { style: styles.error, children: error }) : null, notice ? (0, jsx_runtime_1.jsx)("div", { style: styles.success, children: notice }) : null, (0, jsx_runtime_1.jsxs)(Block, { order: 2, title: "\u7F51\u5173\u914D\u7F6E", hint: "\u5BC6\u7801\u7F51\u5173\u7684\u76D1\u542C\u3001\u8BBF\u95EE\u4E0E\u4F1A\u8BDD\u8BBE\u7F6E\uFF1BHTTPS \u914D\u7F6E\u4E5F\u5728\u672C\u5757\u5185\uFF0C\u4FDD\u5B58\u65F6\u6309\u987A\u5E8F\u5E94\u7528\u3002", dirty: gatewayDirty, busy: busy, saveLabel: "\u4FDD\u5B58\u5E76\u5E94\u7528", onSave: saveGateway, status: blockStatus.gateway, extra: (0, jsx_runtime_1.jsx)("button", { style: styles.button, disabled: busy || !status.passwordSet, onClick: restart, children: "\u91CD\u542F\u7F51\u5173" }), children: [(0, jsx_runtime_1.jsxs)(InlineRow, { label: "DSH \u4E0A\u6E38", children: [(0, jsx_runtime_1.jsx)("code", { style: { ...styles.code, flex: '1 1 260px', whiteSpace: 'nowrap', overflow: 'hidden', textOverflow: 'ellipsis' }, children: status.dshAccessUrl || status.dshOrigin }), (0, jsx_runtime_1.jsx)("button", { style: styles.iconButton, title: "\u590D\u5236", "aria-label": "\u590D\u5236 DSH \u4E0A\u6E38\u5730\u5740\uFF08\u542B token\uFF09", onClick: () => copyToClipboard(status.dshAccessUrl || status.dshOrigin), children: (0, jsx_runtime_1.jsx)(CopyIcon, {}) }), (0, jsx_runtime_1.jsx)("a", { style: styles.iconButton, title: "\u6253\u5F00", "aria-label": "\u6253\u5F00 DSH \u4E0A\u6E38\uFF08\u542B token\uFF09", href: status.dshAccessUrl || status.dshOrigin, target: "_blank", rel: "noreferrer", children: (0, jsx_runtime_1.jsx)(OpenIcon, {}) })] }), (0, jsx_runtime_1.jsx)(InlineRow, { label: "\u7F51\u5173\u5730\u5740", children: status.url ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("code", { style: { ...styles.code, flex: '1 1 260px', whiteSpace: 'nowrap', overflow: 'hidden', textOverflow: 'ellipsis' }, children: status.url }), (0, jsx_runtime_1.jsx)("button", { style: styles.iconButton, title: "\u590D\u5236", "aria-label": "\u590D\u5236\u7F51\u5173\u5730\u5740", onClick: () => copyToClipboard(status.url), children: (0, jsx_runtime_1.jsx)(CopyIcon, {}) }), (0, jsx_runtime_1.jsx)("a", { style: styles.iconButton, title: "\u6253\u5F00", "aria-label": "\u6253\u5F00\u7F51\u5173", href: status.url, target: "_blank", rel: "noreferrer", children: (0, jsx_runtime_1.jsx)(OpenIcon, {}) })] })) : (0, jsx_runtime_1.jsx)("span", { style: styles.muted, children: "\u672A\u8FD0\u884C\uFF1B\u8BBE\u7F6E\u5BC6\u7801\u5E76\u542F\u7528\u540E\u751F\u6210" }) }), !status.dshSecretReady ? (0, jsx_runtime_1.jsx)("div", { style: styles.error, children: "\u7F51\u5173\u4F1A\u8BDD\u6CE8\u5165\u4E0D\u53EF\u7528\uFF1A\u65E0\u6CD5\u8BFB\u53D6 DSH \u6D4F\u89C8\u5668\u7B7E\u540D\u5BC6\u94A5\uFF0C\u7F51\u5173\u4EE3\u7406\u4F1A\u8FD4\u56DE 401\u3002" }) : null, status.error ? (0, jsx_runtime_1.jsxs)("div", { style: styles.error, children: ["\u6700\u8FD1\u9519\u8BEF\uFF1A", status.error] }) : null, (0, jsx_runtime_1.jsx)(Row, { label: "\u542F\u7528\u7F51\u5173", children: (0, jsx_runtime_1.jsxs)("label", { style: { display: 'inline-flex', alignItems: 'center', gap: 8 }, children: [(0, jsx_runtime_1.jsx)("input", { type: "checkbox", checked: enabled, disabled: !status.passwordSet, onChange: (event) => setEnabled(event.target.checked) }), (0, jsx_runtime_1.jsx)("span", { children: !status.passwordSet ? '请先设置密码' : enabled ? '启用' : '停用' })] }) }), enabled ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsxs)("div", { className: "enh-grid3", children: [(0, jsx_runtime_1.jsxs)(Row, { label: "\u76D1\u542C\u5730\u5740", children: [(0, jsx_runtime_1.jsx)("select", { style: styles.select, value: bindHost, onChange: (event) => setBindHost(event.target.value), children: interfaceOptions.map((option) => ((0, jsx_runtime_1.jsx)("option", { value: option.value, children: option.label }, option.value))) }), currentInterface ? (0, jsx_runtime_1.jsxs)("div", { style: styles.muted, children: ["\u5F53\u524D\uFF1A", currentInterface.address, "\uFF08", currentInterface.name, "\uFF09"] }) : null] }), (0, jsx_runtime_1.jsx)(Row, { label: "\u7AEF\u53E3", children: (0, jsx_runtime_1.jsx)("input", { style: styles.input, value: port, inputMode: "numeric", onChange: (event) => setPort(event.target.value) }) }), (0, jsx_runtime_1.jsxs)(Row, { label: "\u4F1A\u8BDD\u6709\u6548\u671F", children: [(0, jsx_runtime_1.jsx)("input", { style: styles.input, value: sessionDays, inputMode: "numeric", onChange: (event) => setSessionDays(event.target.value) }), (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "\u5929\uFF1B\u5BC6\u7801\u4FEE\u6539\u540E\u5168\u90E8\u4F1A\u8BDD\u5931\u6548\u3002" })] })] }), (0, jsx_runtime_1.jsx)(Row, { label: "\u767B\u5F55\u5931\u8D25\u8282\u6D41", children: (0, jsx_runtime_1.jsxs)("label", { style: { display: 'inline-flex', alignItems: 'center', gap: 8 }, children: [(0, jsx_runtime_1.jsx)("input", { type: "checkbox", checked: loginThrottle, onChange: (event) => setLoginThrottle(event.target.checked) }), (0, jsx_runtime_1.jsx)("span", { children: loginThrottle ? '开启（5 次 / 10 分钟 → 锁 1 分钟）' : '关闭（不推荐）' })] }) }), (0, jsx_runtime_1.jsx)(Row, { label: "HTTPS \u6A21\u5F0F", children: (0, jsx_runtime_1.jsxs)("select", { style: styles.select, value: httpsChoice, onChange: (event) => setHttpsChoice(event.target.value), children: [(0, jsx_runtime_1.jsx)("option", { value: "off", children: "\u5173\u95ED HTTPS" }), (0, jsx_runtime_1.jsx)("option", { value: "selfsigned", children: "\u4F7F\u7528 CA \u8BC1\u4E66\u81EA\u7B7E\u53D1" }), (0, jsx_runtime_1.jsx)("option", { value: "uploaded", children: "\u4F7F\u7528\u5DF2\u6709\u8BC1\u4E66" })] }) }), httpsChoice === 'off' ? ((0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "\u5173\u95ED\u540E\u6D4F\u89C8\u5668\u4F1A\u63D0\u793A\u4E0D\u5B89\u5168\uFF0CPWA \u5B89\u88C5\u3001Service Worker \u4E0E Web Push \u90FD\u4E0D\u53EF\u7528\u3002\u4FDD\u5B58\u540E\u751F\u6548\u3002" })) : null, httpsChoice === 'selfsigned' ? ((0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)(Row, { label: "CA \u6765\u6E90", children: (0, jsx_runtime_1.jsxs)("div", { style: { display: 'flex', flexWrap: 'wrap', gap: 16 }, children: [(0, jsx_runtime_1.jsxs)("label", { style: { display: 'inline-flex', alignItems: 'center', gap: 6 }, children: [(0, jsx_runtime_1.jsx)("input", { type: "radio", name: "ca-source", checked: caSource === 'generated', onChange: () => setCaSource('generated') }), (0, jsx_runtime_1.jsx)("span", { children: "\u81EA\u52A8\u751F\u6210 CA" })] }), (0, jsx_runtime_1.jsxs)("label", { style: { display: 'inline-flex', alignItems: 'center', gap: 6 }, children: [(0, jsx_runtime_1.jsx)("input", { type: "radio", name: "ca-source", checked: caSource === 'uploaded', onChange: () => setCaSource('uploaded') }), (0, jsx_runtime_1.jsx)("span", { children: "\u4F7F\u7528\u5DF2\u6709 CA" })] })] }) }), caSource === 'uploaded' ? ((0, jsx_runtime_1.jsx)(jsx_runtime_1.Fragment, { children: (0, jsx_runtime_1.jsxs)(Row, { label: "\u5F53\u524D CA", children: [status.https.uploadedCaInfo ? ((0, jsx_runtime_1.jsxs)("div", { style: styles.muted, children: [status.https.uploadedCaInfo.subject, "\uFF0C\u6709\u6548\u671F\u81F3 ", status.https.uploadedCaInfo.validTo, "\uFF1B\u6587\u4EF6\u5DF2\u4FDD\u5B58\uFF0C\u53EF\u76F4\u63A5\u4F7F\u7528\uFF0C\u65E0\u9700\u91CD\u65B0\u4E0A\u4F20\u3002"] })) : status.https.caInfo ? ((0, jsx_runtime_1.jsxs)("div", { style: styles.muted, children: [status.https.caInfo.subject, "\uFF0C\u6709\u6548\u671F\u81F3 ", status.https.caInfo.validTo, "\uFF1B\u6587\u4EF6\u4FDD\u5B58\u5728\u672C\u673A TLS \u76EE\u5F55\uFF0C\u53EF\u7EE7\u7EED\u7B7E\u53D1 leaf\u3002"] })) : (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "\u5C1A\u672A\u4E0A\u4F20 CA\u3002" }), (0, jsx_runtime_1.jsx)("input", { id: "enh-ca-cert-file", type: "file", accept: ".pem,.crt,.cer", style: { display: 'none' }, onChange: (event) => setCaCertFile(event.target.files?.[0] ?? null) }), (0, jsx_runtime_1.jsx)("input", { id: "enh-ca-key-file", type: "file", accept: ".pem,.key", style: { display: 'none' }, onChange: (event) => setCaKeyFile(event.target.files?.[0] ?? null) }), (0, jsx_runtime_1.jsxs)("div", { style: styles.actions, children: [(0, jsx_runtime_1.jsx)("label", { htmlFor: "enh-ca-cert-file", style: { ...styles.button, display: 'inline-flex', alignItems: 'center' }, children: caCertFile ? `已选择：${caCertFile.name}` : status.https.uploadedCaInfo ? '更换 CA 证书' : '选择 CA 证书' }), (0, jsx_runtime_1.jsx)("label", { htmlFor: "enh-ca-key-file", style: { ...styles.button, display: 'inline-flex', alignItems: 'center' }, children: caKeyFile ? `已选择：${caKeyFile.name}` : status.https.uploadedCaInfo ? '更换 CA 私钥' : '选择 CA 私钥' })] }), caCertFile || caKeyFile ? (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "\u4FDD\u5B58\u65F6\u624D\u4F1A\u5E94\u7528\uFF1B\u53EA\u4FDD\u7559\u6700\u65B0\u4E00\u4EFD\u6587\u4EF6\u3002" }) : null] }) })) : ((0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "\u4FDD\u5B58\u65F6\u4F1A\u5728\u63D2\u4EF6 TLS \u76EE\u5F55\u751F\u6210\u672C\u5730 CA\uFF0C\u5E76\u7528\u5B83\u7B7E\u53D1\u5F53\u524D\u76D1\u542C\u5730\u5740 + \u989D\u5916\u4E3B\u673A\u540D\u7684\u8BC1\u4E66\u3002" })), (0, jsx_runtime_1.jsxs)(Row, { label: "\u989D\u5916\u4E3B\u673A\u540D", children: [(0, jsx_runtime_1.jsx)("input", { style: styles.input, placeholder: "\u4F8B\u5982 dsh.lan, myhost.local\uFF08\u9017\u53F7\u5206\u9694\uFF09", value: httpsHostnames, onChange: (event) => setHttpsHostnames(event.target.value) }), (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "\u76D1\u542C IP\u3001localhost \u4F1A\u81EA\u52A8\u5305\u542B\uFF1B\u8FD9\u91CC\u8865\u5145 DNS \u4E3B\u673A\u540D\u3002" })] }), status.https.caAvailable ? ((0, jsx_runtime_1.jsx)("div", { style: styles.actions, children: (0, jsx_runtime_1.jsx)("a", { style: { ...styles.button, textDecoration: 'none', display: 'inline-flex', alignItems: 'center' }, href: `${API}/tls/ca`, download: "dsh-enhancement-ca.crt", children: "\u4E0B\u8F7D CA \u8BC1\u4E66" }) })) : null, status.https.mode !== 'off' && status.https.cert ? ((0, jsx_runtime_1.jsxs)("div", { style: styles.muted, children: ["\u5F53\u524D\u8BC1\u4E66\uFF1A", status.https.cert.subject, "\uFF0C\u6709\u6548\u671F\u81F3 ", status.https.cert.validTo] })) : null, (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "iOS \u5B89\u88C5 CA\uFF1ASafari \u6253\u5F00\u4E0B\u8F7D\u6587\u4EF6 \u2192 \u8BBE\u7F6E \u2192 \u901A\u7528 \u2192 VPN \u4E0E\u8BBE\u5907\u7BA1\u7406 \u2192 \u5B89\u88C5\u63CF\u8FF0\u6587\u4EF6 \u2192 \u8BBE\u7F6E \u2192 \u901A\u7528 \u2192 \u5173\u4E8E\u672C\u673A \u2192 \u8BC1\u4E66\u4FE1\u4EFB\u8BBE\u7F6E \u2192 \u5BF9 \u201CDSH Enhancement Local CA\u201D \u5F00\u542F\u5B8C\u5168\u4FE1\u4EFB\u3002" })] })) : null, httpsChoice === 'uploaded' ? ((0, jsx_runtime_1.jsx)("div", { children: (0, jsx_runtime_1.jsxs)(Row, { label: "\u5F53\u524D\u8BC1\u4E66", children: [status.https.cert && status.https.mode === 'uploaded' ? ((0, jsx_runtime_1.jsxs)("div", { style: styles.muted, children: [status.https.cert.subject, "\uFF0C\u6709\u6548\u671F\u81F3 ", status.https.cert.validTo, "\uFF1BSAN\uFF1A", status.https.cert.subjectAltName || '未提供', "\u3002\u8BC1\u4E66\u548C\u79C1\u94A5\u4FDD\u5B58\u5728\u672C\u673A TLS \u76EE\u5F55\u3002"] })) : (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "\u5C1A\u672A\u4E0A\u4F20\u8BC1\u4E66\u3002" }), (0, jsx_runtime_1.jsx)("input", { id: "enh-cert-file", type: "file", accept: ".pem,.crt,.cer", style: { display: 'none' }, onChange: (event) => setCertFile(event.target.files?.[0] ?? null) }), (0, jsx_runtime_1.jsx)("input", { id: "enh-key-file", type: "file", accept: ".pem,.key", style: { display: 'none' }, onChange: (event) => setKeyFile(event.target.files?.[0] ?? null) }), (0, jsx_runtime_1.jsxs)("div", { style: styles.actions, children: [(0, jsx_runtime_1.jsx)("label", { htmlFor: "enh-cert-file", style: { ...styles.button, display: 'inline-flex', alignItems: 'center' }, children: certFile ? `已选择：${certFile.name}` : status.https.mode === 'uploaded' ? '更换证书' : '选择证书' }), (0, jsx_runtime_1.jsx)("label", { htmlFor: "enh-key-file", style: { ...styles.button, display: 'inline-flex', alignItems: 'center' }, children: keyFile ? `已选择：${keyFile.name}` : status.https.mode === 'uploaded' ? '更换私钥' : '选择私钥' })] }), certFile || keyFile ? (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "\u4FDD\u5B58\u65F6\u624D\u4F1A\u5E94\u7528\uFF1B\u8BC1\u4E66 SAN \u5FC5\u987B\u8986\u76D6\u8BBF\u95EE\u5730\u5740/IP\uFF0C\u53EA\u4FDD\u7559\u6700\u65B0\u4E00\u4EFD\u6587\u4EF6\u3002" }) : null] }) })) : null] })) : (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "\u542F\u7528\u7F51\u5173\u540E\u663E\u793A\u76D1\u542C\u5730\u5740\u3001\u7AEF\u53E3\u3001\u4F1A\u8BDD\u548C HTTPS \u8BBE\u7F6E\u3002" })] }), (0, jsx_runtime_1.jsxs)(Block, { order: 1, title: "\u8BBF\u95EE\u63A7\u5236", hint: status.passwordSet ? '已设置访问密码；修改后全部网关会话失效。' : '尚未设置密码；设置后才能启用网关。', dirty: accessDirty, busy: busy, saveLabel: "\u8BBE\u7F6E\u5BC6\u7801", onSave: savePassword, status: blockStatus.access, extra: (0, jsx_runtime_1.jsx)("button", { style: { ...styles.button, ...styles.danger }, disabled: busy || !status.passwordSet, onClick: logoutAll, children: "\u9000\u51FA\u5168\u90E8\u7F51\u5173\u4F1A\u8BDD" }), children: [(0, jsx_runtime_1.jsxs)("div", { className: "enh-grid2", children: [(0, jsx_runtime_1.jsx)(Row, { label: "\u65B0\u5BC6\u7801", children: (0, jsx_runtime_1.jsx)(PasswordInput, { value: newPassword, onChange: setNewPassword, autoComplete: "new-password", show: showNewPassword, onToggle: () => setShowNewPassword((value) => !value) }) }), (0, jsx_runtime_1.jsx)(Row, { label: "\u786E\u8BA4\u65B0\u5BC6\u7801", children: (0, jsx_runtime_1.jsx)(PasswordInput, { value: confirmPassword, onChange: setConfirmPassword, autoComplete: "new-password", show: showConfirmPassword, onToggle: () => setShowConfirmPassword((value) => !value) }) })] }), newPassword.length > 0 ? ((0, jsx_runtime_1.jsx)("div", { style: { ...styles.error, marginTop: -4 }, children: newPassword.length < 6 ? '新密码至少 6 个字符' : confirmPassword.length > 0 && newPassword !== confirmPassword ? '两次输入的新密码不一致' : '' })) : null, (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "\u81F3\u5C11 6 \u4E2A\u5B57\u7B26\uFF1B\u5BC6\u7801\u7B49\u4EF7\u4E8E\u672C\u673A DSH \u7684\u8BBF\u95EE\u6743\u9650\uFF0C\u8BF7\u4F7F\u7528\u5F3A\u5BC6\u7801\u3002" })] }), (0, jsx_runtime_1.jsxs)(Block, { order: 3, title: "PWA\uFF08\u6DFB\u52A0\u5230\u684C\u9762 / \u4E3B\u5C4F\uFF09", hint: "\u542F\u7528\u540E\u63A5\u7BA1 /manifest.webmanifest\u3001\u56FE\u6807\u3001/sw.js \u4E0E\u5B89\u88C5\u63D0\u793A\uFF1BHTTP \u4E0B\u5B89\u88C5\u5165\u53E3\u548C Service Worker \u4E0D\u751F\u6548\u3002", dirty: pwaDirty, busy: busy, saveLabel: "\u4FDD\u5B58 PWA \u914D\u7F6E", onSave: savePwa, status: blockStatus.pwa, extra: (0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("a", { style: { ...styles.button, textDecoration: 'none', display: 'inline-flex', alignItems: 'center' }, href: "/manifest.webmanifest", target: "_blank", rel: "noreferrer", children: "\u67E5\u770B manifest" }), (0, jsx_runtime_1.jsx)("a", { style: { ...styles.button, textDecoration: 'none', display: 'inline-flex', alignItems: 'center' }, href: "/sw.js", target: "_blank", rel: "noreferrer", children: "\u67E5\u770B Service Worker" })] }), children: [(0, jsx_runtime_1.jsx)(Row, { label: "\u542F\u7528 PWA", children: (0, jsx_runtime_1.jsxs)("label", { style: { display: 'inline-flex', alignItems: 'center', gap: 8 }, children: [(0, jsx_runtime_1.jsx)("input", { type: "checkbox", checked: pwaEnabled, onChange: (event) => setPwaEnabled(event.target.checked) }), (0, jsx_runtime_1.jsx)("span", { children: pwaEnabled ? '启用' : '停用' })] }) }), status.https.mode === 'off' ? (0, jsx_runtime_1.jsx)("div", { style: styles.error, children: "\u5F53\u524D\u662F HTTP\uFF1A\u5B89\u88C5\u63D0\u793A\u3001Service Worker\u3001Web Push \u90FD\u4E0D\u4F1A\u751F\u6548\u3002\u8BF7\u5148\u5728\u7F51\u5173\u914D\u7F6E\u542F\u7528 HTTPS\u3002" }) : null, status.pwa.error ? (0, jsx_runtime_1.jsxs)("div", { style: styles.error, children: ["PWA \u6CE8\u518C\u5931\u8D25\uFF1A", status.pwa.error] }) : null, pwaEnabled ? ((0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsxs)("div", { className: "enh-grid2", children: [(0, jsx_runtime_1.jsx)(Row, { label: "\u5E94\u7528\u540D", children: (0, jsx_runtime_1.jsx)("input", { style: styles.input, value: pwaName, onChange: (event) => setPwaName(event.target.value) }) }), (0, jsx_runtime_1.jsx)(Row, { label: "\u77ED\u540D\u79F0", children: (0, jsx_runtime_1.jsx)("input", { style: styles.input, value: pwaShortName, onChange: (event) => setPwaShortName(event.target.value) }) })] }), (0, jsx_runtime_1.jsxs)("div", { className: "enh-grid3", children: [(0, jsx_runtime_1.jsx)(Row, { label: "\u663E\u793A\u6A21\u5F0F", children: (0, jsx_runtime_1.jsxs)("select", { style: styles.select, value: pwaDisplay, onChange: (event) => setPwaDisplay(event.target.value), children: [(0, jsx_runtime_1.jsx)("option", { value: "standalone", children: "standalone" }), (0, jsx_runtime_1.jsx)("option", { value: "fullscreen", children: "fullscreen" }), (0, jsx_runtime_1.jsx)("option", { value: "minimal-ui", children: "minimal-ui" })] }) }), (0, jsx_runtime_1.jsx)(Row, { label: "\u4E3B\u9898\u8272", children: (0, jsx_runtime_1.jsx)("input", { style: styles.input, value: pwaThemeColor, onChange: (event) => setPwaThemeColor(event.target.value) }) }), (0, jsx_runtime_1.jsx)(Row, { label: "\u80CC\u666F\u8272", children: (0, jsx_runtime_1.jsx)("input", { style: styles.input, value: pwaBackgroundColor, onChange: (event) => setPwaBackgroundColor(event.target.value) }) })] }), (0, jsx_runtime_1.jsx)("div", { style: { ...styles.label, marginTop: 8 }, children: "\u5206\u5E73\u53F0\u56FE\u6807" }), (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "\u4E0A\u4F20\u540E\u7ACB\u5373\u751F\u6548\uFF1BAndroid \u81EA\u9002\u5E94\u56FE\u6807\u8BF7\u5355\u72EC\u4E0A\u4F20 maskable \u56FE\u3002\u5EFA\u8BAE 512 \u56FE\u6807\u5185\u5BB9\u7559\u5728\u4E2D\u5FC3 80% \u5B89\u5168\u533A\u3002" }), (0, jsx_runtime_1.jsx)("div", { className: "enh-icon-grid", children: [
                                         ['icon-192.png', '通用 192 × 192', 'any'],
                                         ['icon-512.png', '通用 512 × 512', 'any'],
@@ -598,7 +630,7 @@ window.__ModuleLoader__.load({
                                                                     event.target.value = '';
                                                                     if (file)
                                                                         void uploadIcon(kind, file);
-                                                                } }), customIcons.includes(kind) ? (0, jsx_runtime_1.jsx)("button", { style: styles.button, disabled: busy, onClick: () => resetIcon(kind), children: "\u6062\u590D\u9ED8\u8BA4" }) : null] })] })] }, kind))) }), (0, jsx_runtime_1.jsx)("div", { style: styles.actions, children: (0, jsx_runtime_1.jsx)("button", { style: styles.button, disabled: busy || customIcons.length === 0, onClick: () => resetIcon(), children: "\u5168\u90E8\u6062\u590D\u9ED8\u8BA4" }) })] })) : (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "\u542F\u7528 PWA \u540E\u624D\u663E\u793A\u5E94\u7528\u540D\u3001\u989C\u8272\u4E0E\u56FE\u6807\u8BBE\u7F6E\u3002" })] }), (0, jsx_runtime_1.jsxs)(Block, { order: 4, title: "\u901A\u77E5", hint: "\u4E8B\u4EF6\u52FE\u9009\u540C\u65F6\u63A7\u5236\u684C\u9762\u901A\u77E5\u548C PWA \u63A8\u9001\uFF1B\u4E24\u4E2A\u6E20\u9053\u53EF\u4EE5\u72EC\u7ACB\u5F00\u5173\uFF0C\u5173\u95ED\u67D0\u4E2A\u6E20\u9053\u4E0D\u4F1A\u4E22\u4E8B\u4EF6\u9009\u62E9\u3002", dirty: notifyDirty, busy: busy, saveLabel: "\u4FDD\u5B58\u901A\u77E5\u914D\u7F6E", onSave: saveNotify, status: blockStatus.notify, extra: (0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("button", { style: styles.button, disabled: busy, onClick: testNotify, children: "\u6D4B\u8BD5\u684C\u9762\u901A\u77E5" }), pushUsable ? (0, jsx_runtime_1.jsx)("button", { style: styles.button, disabled: busy || pushCount === 0, onClick: testPush, children: "\u6D4B\u8BD5 PWA \u63A8\u9001" }) : null] }), children: [(0, jsx_runtime_1.jsx)(Row, { label: "\u901A\u77E5\u4E8B\u4EF6", children: (0, jsx_runtime_1.jsx)("div", { style: { display: 'flex', flexWrap: 'wrap', gap: '8px 18px' }, children: [['notifyTask', '任务完成', notifyTask, setNotifyTask], ['notifyAsk', '等待回答', notifyAsk, setNotifyAsk], ['notifyApproval', '等待审批', notifyApproval, setNotifyApproval], ['notifyDenied', '审批被拒绝', notifyDenied, setNotifyDenied], ['notifySubagent', '子任务结束', notifySubagent, setNotifySubagent], ['notifyGoal', '目标完成/受阻', notifyGoal, setNotifyGoal], ['notifyJobs', '后台任务结束', notifyJobs, setNotifyJobs]].map(([key, label, value, setter]) => ((0, jsx_runtime_1.jsxs)("label", { style: { display: 'inline-flex', alignItems: 'center', gap: 6, whiteSpace: 'nowrap' }, children: [(0, jsx_runtime_1.jsx)("input", { className: "enh-event-check", type: "checkbox", checked: value, onChange: (event) => setter(event.target.checked) }), (0, jsx_runtime_1.jsx)("span", { children: label })] }, key))) }) }), (0, jsx_runtime_1.jsx)(Row, { label: "\u684C\u9762\u901A\u77E5", children: (0, jsx_runtime_1.jsxs)("label", { style: { display: 'inline-flex', alignItems: 'center', gap: 8 }, children: [(0, jsx_runtime_1.jsx)("input", { type: "checkbox", checked: notifyEnabled, onChange: (event) => setNotifyEnabled(event.target.checked) }), (0, jsx_runtime_1.jsx)("span", { children: notifyEnabled ? '启用' : '停用' })] }) }), (0, jsx_runtime_1.jsxs)(Row, { label: "PWA \u63A8\u9001", children: [(0, jsx_runtime_1.jsxs)("label", { style: { display: 'inline-flex', alignItems: 'center', gap: 8, opacity: pushUsable ? 1 : 0.5 }, children: [(0, jsx_runtime_1.jsx)("input", { type: "checkbox", checked: pushUsable && pushEnabled, disabled: !pushUsable, onChange: (event) => setPushEnabled(event.target.checked) }), (0, jsx_runtime_1.jsx)("span", { children: pushUsable ? (pushEnabled ? '启用' : '停用') : '需要 HTTPS' })] }), !pushUsable ? (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "\u5F53\u524D\u9875\u9762\u4E0D\u662F HTTPS/\u5B89\u5168\u4E0A\u4E0B\u6587\uFF0CPWA \u63A8\u9001\u5F00\u5173\u7F6E\u7070\uFF1B\u8BF7\u5148\u542F\u7528 HTTPS\u3002" }) : null] }), pushUsable && pushEnabled ? ((0, jsx_runtime_1.jsxs)("div", { style: { paddingLeft: 12, borderLeft: '2px solid var(--dsw-alias-border-l4, rgba(0,0,0,.08))' }, children: [(0, jsx_runtime_1.jsxs)("div", { style: styles.muted, children: ["\u901A\u77E5\u6743\u9650\uFF1A", typeof Notification !== 'undefined' ? Notification.permission : '不可用', "\uFF1B\u5DF2\u8BA2\u9605\u8BBE\u5907\uFF1A", pushCount, "\u3002"] }), (0, jsx_runtime_1.jsx)("div", { style: styles.actions, children: (0, jsx_runtime_1.jsx)("button", { style: styles.button, disabled: busy, onClick: deviceSubscribed ? disablePush : enablePush, children: deviceSubscribed ? '取消本设备订阅' : '订阅本设备' }) }), (0, jsx_runtime_1.jsxs)("details", { className: "enh-advanced", children: [(0, jsx_runtime_1.jsx)("summary", { children: "\u9AD8\u7EA7\uFF1AVAPID \u8054\u7CFB\u5730\u5740" }), (0, jsx_runtime_1.jsxs)(Row, { label: "VAPID subject", children: [(0, jsx_runtime_1.jsx)("input", { style: styles.input, value: pushSubject, onChange: (event) => setPushSubject(event.target.value), placeholder: "mailto:dsh-enhancement@localhost" }), (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "Web Push \u534F\u8BAE\u8981\u6C42\u7684\u8054\u7CFB\u65B9\u5F0F\uFF0C\u4E0D\u662F\u767B\u5F55\u90AE\u7BB1\uFF0C\u4E5F\u4E0D\u9700\u8981\u9A8C\u8BC1\uFF1B\u4E2A\u4EBA\u4F7F\u7528\u4FDD\u7559\u9ED8\u8BA4\u5373\u53EF\u3002" })] })] })] })) : pushUsable ? (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "\u5F00\u542F PWA \u63A8\u9001\u540E\u663E\u793A\u8BA2\u9605\u3001\u6D4B\u8BD5\u548C VAPID \u8BBE\u7F6E\u3002" }) : null] }), (0, jsx_runtime_1.jsxs)("div", { style: { ...styles.card, order: 5 }, children: [(0, jsx_runtime_1.jsx)("div", { style: styles.label, children: "\u72B6\u6001\u6587\u4EF6" }), (0, jsx_runtime_1.jsx)("div", { style: styles.code, children: status.statePath }), (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "\u5BC6\u7801\u53EA\u5B58 scrypt \u54C8\u5E0C\uFF0CDSH \u7B7E\u540D\u5BC6\u94A5\u4E0D\u4F1A\u5199\u5165\u8FD9\u91CC\u3002" })] })] }));
+                                                                } }), customIcons.includes(kind) ? (0, jsx_runtime_1.jsx)("button", { style: styles.button, disabled: busy, onClick: () => resetIcon(kind), children: "\u6062\u590D\u9ED8\u8BA4" }) : null] })] })] }, kind))) }), (0, jsx_runtime_1.jsx)("div", { style: styles.actions, children: (0, jsx_runtime_1.jsx)("button", { style: styles.button, disabled: busy || customIcons.length === 0, onClick: () => resetIcon(), children: "\u5168\u90E8\u6062\u590D\u9ED8\u8BA4" }) })] })) : (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "\u542F\u7528 PWA \u540E\u624D\u663E\u793A\u5E94\u7528\u540D\u3001\u989C\u8272\u4E0E\u56FE\u6807\u8BBE\u7F6E\u3002" })] }), (0, jsx_runtime_1.jsxs)(Block, { order: 4, title: "\u901A\u77E5", hint: "\u4E8B\u4EF6\u52FE\u9009\u540C\u65F6\u63A7\u5236\u684C\u9762\u901A\u77E5\u548C PWA \u63A8\u9001\uFF1B\u4E24\u4E2A\u6E20\u9053\u53EF\u4EE5\u72EC\u7ACB\u5F00\u5173\uFF0C\u5173\u95ED\u67D0\u4E2A\u6E20\u9053\u4E0D\u4F1A\u4E22\u4E8B\u4EF6\u9009\u62E9\u3002", dirty: notifyDirty, busy: busy, saveLabel: "\u4FDD\u5B58\u901A\u77E5\u914D\u7F6E", onSave: saveNotify, status: blockStatus.notify, extra: (0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("button", { style: styles.button, disabled: busy, onClick: testNotify, children: "\u6D4B\u8BD5\u684C\u9762\u901A\u77E5" }), pushUsable ? (0, jsx_runtime_1.jsx)("button", { style: styles.button, disabled: busy || pushCount === 0, onClick: testPush, children: "\u6D4B\u8BD5 PWA \u63A8\u9001" }) : null] }), children: [(0, jsx_runtime_1.jsx)(Row, { label: "\u901A\u77E5\u4E8B\u4EF6", children: (0, jsx_runtime_1.jsx)("div", { style: { display: 'flex', flexWrap: 'wrap', gap: '8px 18px' }, children: [['notifyTask', '任务完成', notifyTask, setNotifyTask], ['notifyAsk', '等待回答', notifyAsk, setNotifyAsk], ['notifyApproval', '等待审批', notifyApproval, setNotifyApproval], ['notifyDenied', '审批被拒绝', notifyDenied, setNotifyDenied], ['notifySubagent', '子任务结束', notifySubagent, setNotifySubagent], ['notifyGoal', '目标完成/受阻', notifyGoal, setNotifyGoal], ['notifyJobs', '后台任务结束', notifyJobs, setNotifyJobs]].map(([key, label, value, setter]) => ((0, jsx_runtime_1.jsxs)("label", { style: { display: 'inline-flex', alignItems: 'center', gap: 6, whiteSpace: 'nowrap' }, children: [(0, jsx_runtime_1.jsx)("input", { className: "enh-event-check", type: "checkbox", checked: value, onChange: (event) => setter(event.target.checked) }), (0, jsx_runtime_1.jsx)("span", { children: label })] }, key))) }) }), (0, jsx_runtime_1.jsx)(Row, { label: "\u684C\u9762\u901A\u77E5", children: (0, jsx_runtime_1.jsxs)("label", { style: { display: 'inline-flex', alignItems: 'center', gap: 8 }, children: [(0, jsx_runtime_1.jsx)("input", { type: "checkbox", checked: notifyEnabled, onChange: (event) => setNotifyEnabled(event.target.checked) }), (0, jsx_runtime_1.jsx)("span", { children: notifyEnabled ? '启用' : '停用' })] }) }), (0, jsx_runtime_1.jsxs)(Row, { label: "PWA \u63A8\u9001", children: [(0, jsx_runtime_1.jsxs)("label", { style: { display: 'inline-flex', alignItems: 'center', gap: 8, opacity: pushUsable ? 1 : 0.5 }, children: [(0, jsx_runtime_1.jsx)("input", { type: "checkbox", checked: pushUsable && pushEnabled, disabled: !pushUsable, onChange: (event) => setPushEnabled(event.target.checked) }), (0, jsx_runtime_1.jsx)("span", { children: pushUsable ? (pushEnabled ? '启用' : '停用') : '需要 HTTPS' })] }), !pushUsable ? (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "\u5F53\u524D\u9875\u9762\u4E0D\u662F HTTPS/\u5B89\u5168\u4E0A\u4E0B\u6587\uFF0CPWA \u63A8\u9001\u5F00\u5173\u7F6E\u7070\uFF1B\u8BF7\u5148\u542F\u7528 HTTPS\u3002" }) : null] }), pushUsable && pushEnabled ? ((0, jsx_runtime_1.jsxs)("div", { style: { paddingLeft: 12, borderLeft: '2px solid var(--dsw-alias-border-l4, rgba(0,0,0,.08))' }, children: [(0, jsx_runtime_1.jsxs)("div", { style: styles.muted, children: ["\u901A\u77E5\u6743\u9650\uFF1A", typeof Notification !== 'undefined' ? Notification.permission : '不可用', "\uFF1B\u5DF2\u8BA2\u9605\u8BBE\u5907\uFF1A", pushCount, "\u3002"] }), (0, jsx_runtime_1.jsx)("div", { style: styles.actions, children: (0, jsx_runtime_1.jsx)("button", { style: styles.button, disabled: busy, onClick: deviceSubscribed ? disablePush : enablePush, children: deviceSubscribed ? '取消本设备订阅' : '订阅本设备' }) }), (0, jsx_runtime_1.jsxs)("details", { className: "enh-advanced", children: [(0, jsx_runtime_1.jsx)("summary", { children: "\u9AD8\u7EA7\uFF1AVAPID \u8054\u7CFB\u5730\u5740" }), (0, jsx_runtime_1.jsxs)(Row, { label: "VAPID subject", children: [(0, jsx_runtime_1.jsx)("input", { style: styles.input, value: pushSubject, onChange: (event) => setPushSubject(event.target.value), placeholder: "mailto:dsh-enhancement@localhost" }), (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "Web Push \u534F\u8BAE\u8981\u6C42\u7684\u8054\u7CFB\u65B9\u5F0F\uFF0C\u4E0D\u662F\u767B\u5F55\u90AE\u7BB1\uFF0C\u4E5F\u4E0D\u9700\u8981\u9A8C\u8BC1\uFF1B\u4E2A\u4EBA\u4F7F\u7528\u4FDD\u7559\u9ED8\u8BA4\u5373\u53EF\u3002" })] })] })] })) : pushUsable ? (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "\u5F00\u542F PWA \u63A8\u9001\u540E\u663E\u793A\u8BA2\u9605\u3001\u6D4B\u8BD5\u548C VAPID \u8BBE\u7F6E\u3002" }) : null] }), (0, jsx_runtime_1.jsxs)("div", { style: { ...styles.card, order: 5 }, children: [(0, jsx_runtime_1.jsx)("div", { style: styles.label, children: "\u72B6\u6001\u6587\u4EF6" }), (0, jsx_runtime_1.jsx)("div", { style: styles.code, children: status.statePath }), (0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: "\u5BC6\u7801\u53EA\u5B58 scrypt \u54C8\u5E0C\uFF0CDSH \u7B7E\u540D\u5BC6\u94A5\u4E0D\u4F1A\u5199\u5165\u8FD9\u91CC\u3002" })] }), (0, jsx_runtime_1.jsxs)(Block, { order: 5, title: "\u4F1A\u8BDD\u8BF7\u6C42\u5934", hint: "\u8BA9\u975E\u5B98\u65B9 API \u8DEF\u7531\uFF08\u5982 OpenAI \u517C\u5BB9\u7F51\u5173\uFF09\u4E5F\u643A\u5E26 DSH \u7684 session id\u3002\u5B98\u65B9 DeepSeek API \u672C\u6765\u5C31\u5E26\uFF0C\u4E0D\u53D7\u5F71\u54CD\u3002", dirty: sessionHeaderDirty, busy: busy, saveLabel: "\u4FDD\u5B58\u4F1A\u8BDD\u8BF7\u6C42\u5934", onSave: saveSessionHeader, status: blockStatus.sessionHeader, children: [(0, jsx_runtime_1.jsx)(Row, { label: "\u542F\u7528\u6CE8\u5165", children: (0, jsx_runtime_1.jsxs)("label", { style: { display: 'inline-flex', alignItems: 'center', gap: 8 }, children: [(0, jsx_runtime_1.jsx)("input", { type: "checkbox", checked: sessionHeaderEnabled, onChange: (event) => setSessionHeaderEnabled(event.target.checked) }), (0, jsx_runtime_1.jsx)("span", { children: sessionHeaderEnabled ? '启用' : '停用' })] }) }), (0, jsx_runtime_1.jsx)(Row, { label: "\u8BF7\u6C42\u5934\u540D\u79F0", children: (0, jsx_runtime_1.jsx)("input", { value: sessionHeaderName, onChange: (event) => setSessionHeaderName(event.target.value), placeholder: "x-deepseek-harness-session-id", style: { ...styles.input, width: '100%', maxWidth: 360 }, spellCheck: false, autoCapitalize: "off", autoCorrect: "off" }) }), (0, jsx_runtime_1.jsxs)("div", { style: styles.muted, children: ["\u9ED8\u8BA4\u503C\u4E0E DeepSeek \u5B98\u65B9\u53D1\u9001\u7684\u5934\u540D\u4E00\u81F4\uFF08", (0, jsx_runtime_1.jsx)("code", { children: "x-deepseek-harness-session-id" }), "\uFF09\uFF0C\u4E5F\u53EF\u6539\u6210\u4E0A\u6E38\u7F51\u5173\u7EA6\u5B9A\u7684\u5176\u5B83\u540D\u79F0\u3002"] }), status.sessionHeader.reason === 'llm-unavailable' ? ((0, jsx_runtime_1.jsx)("div", { style: styles.error, children: sessionHeaderSummary(true) })) : ((0, jsx_runtime_1.jsx)("div", { style: styles.muted, children: sessionHeaderSummary() }))] })] }));
     }
     const SESSION_ID_PATTERN = /^[A-Za-z0-9._:-]{1,200}$/;
     function openSession(ctx, sessionId) {

package/lib/control.d.ts

@@ -4,5 +4,5 @@ import type { Pwa } from './pwa.js';
 import type { NotificationEngine } from './notify.js';
 import type { PushService } from './push.js';
 import type { HostContextLike } from './types.js';
-export declare function registerControl(ctx: HostContextLike, gateway: Gateway, store: StateStore, pwa: Pwa, notify: NotificationEngine, push: PushService): void;
-//# sourceMappingURL=control.d.ts.map
+import type { SessionHeaderMount } from './session-header.js';
+export declare function registerControl(ctx: HostContextLike, gateway: Gateway, store: StateStore, pwa: Pwa, notify: NotificationEngine, push: PushService, sessionHeader?: SessionHeaderMount): void;