dsh-enhancement 1.1.0 → 1.1.2

package/README.en.md

@@ -94,6 +94,7 @@ Clicking a desktop notification opens the matching session. On Linux and Windows
 ## Mobile push
 
 - Standard Web Push with one subscription per device.
+- **PWA must be enabled first**: the Service Worker (`/sw.js`) is served by the PWA feature, so push cannot be subscribed while PWA is off.
 - Click “Subscribe this device” in settings; the browser asks for notification permission, which must be triggered by your click.
 - iOS / iPadOS 16.4+ is required, and DSH must be added to the Home Screen; regular Safari tabs cannot receive push.
 - Unsubscribe at any time, or send a test push to verify the setup.

package/README.md

@@ -95,6 +95,7 @@ DSH 只在直连官方 DeepSeek API 时发送 `x-deepseek-harness-session-id`；
 ## 手机推送
 
 - 使用标准 Web Push，每台设备单独订阅。
+- **需要先启用 PWA**：Service Worker（`/sw.js`）由 PWA 提供，PWA 关闭时无法订阅。
 - 在设置里点“订阅本设备”，浏览器会请求通知权限；权限必须由你主动点击触发。
 - iOS / iPadOS 需要 16.4 或更高版本，并且必须先把 DSH 添加到主屏幕；Safari 普通标签页收不到推送。
 - 可以随时取消订阅，或发送一条测试推送确认链路正常。

package/lib/client.js

@@ -100,7 +100,7 @@ window.__ModuleLoader__.load({
         muted: { color: 'var(--dsw-alias-label-secondary, #667085)', fontSize: 12, lineHeight: 1.6 },
         card: { borderTop: '1px solid var(--dsw-alias-border-l4, rgba(0,0,0,.08))', padding: '16px 0 8px', display: 'flex', flexDirection: 'column', gap: 6, background: 'transparent' },
         blockHead: { display: 'flex', alignItems: 'flex-start', justifyContent: 'space-between', gap: 12 },
-        dirty: { flex: 'none', fontSize: 11, lineHeight: '18px', padding: '1px 8px', borderRadius: 999, color: 'var(--dsw-alias-state-warning-primary, #b54708)', background: 'var(--dsw-alias-state-warning-bg, rgba(247,144,9,.12))', border: '.5px solid var(--dsw-alias-state-warning-primary-a30, rgba(181,71,8,.3))' },
+        dirty: { flex: 'none', fontSize: 11, lineHeight: '18px', padding: '1px 8px', borderRadius: 999, color: 'var(--dsw-alias-state-warn-primary, #b54708)', background: 'color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 12%, transparent)', border: '.5px solid color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 30%, transparent)' },
         subhead: { margin: '14px 0 2px', fontSize: 13, fontWeight: 600, color: 'var(--dsw-alias-label-primary, inherit)' },
         row: { display: 'flex', flexDirection: 'column', gap: 6, padding: '10px 0' },
         label: { color: 'var(--dsw-alias-label-primary, inherit)', fontSize: 13, fontWeight: 500 },
@@ -111,12 +111,12 @@ window.__ModuleLoader__.load({
         actions: { display: 'flex', flexWrap: 'wrap', alignItems: 'center', gap: 8, paddingTop: 4 },
         button: { height: 32, padding: '0 14px', borderRadius: 'var(--dsw-radius-md, 12px)', border: '.5px solid var(--dsw-alias-border-l4, rgba(0,0,0,.16))', background: 'transparent', color: 'var(--dsw-alias-label-primary, inherit)', cursor: 'pointer', fontSize: 13 },
         primary: { background: 'var(--dsw-alias-state-business-primary, #4d8dff)', borderColor: 'transparent', color: '#fff', fontWeight: 600 },
-        danger: { color: 'var(--dsw-alias-state-danger-primary, #d92d20)' },
+        danger: { color: 'var(--dsw-alias-state-error-primary, #d92d20)' },
         pill: { display: 'inline-flex', alignItems: 'center', gap: 6, padding: '3px 9px', borderRadius: 999, border: '.5px solid var(--dsw-alias-border-l4, rgba(0,0,0,.16))', fontSize: 11, color: 'var(--dsw-alias-label-secondary, #667085)' },
         dot: { width: 7, height: 7, borderRadius: 999, background: '#54d18a', display: 'inline-block' },
         dotOff: { width: 7, height: 7, borderRadius: 999, background: '#98a2b3', display: 'inline-block' },
         code: { fontFamily: 'ui-monospace, SFMono-Regular, Menlo, monospace', fontSize: 11, wordBreak: 'break-all', background: 'var(--dsw-alias-bg-layer-3, rgba(0,0,0,.04))', color: 'var(--dsw-alias-label-secondary, #475467)', padding: '6px 8px', borderRadius: 8 },
-        error: { color: 'var(--dsw-alias-state-danger-primary, #d92d20)', fontSize: 12, lineHeight: 1.5 },
+        error: { color: 'var(--dsw-alias-state-error-primary, #d92d20)', fontSize: 12, lineHeight: 1.5 },
         success: { color: 'var(--dsw-alias-state-success-primary, #079455)', fontSize: 12, lineHeight: 1.5 },
         divider: { height: 1, background: 'var(--dsw-alias-border-l4, rgba(0,0,0,.08))', margin: '6px 0' },
     };
@@ -125,7 +125,7 @@ window.__ModuleLoader__.load({
     }
     const CARD_CSS = `
     .enh-root input:not([type="checkbox"]):not([type="file"]), .enh-root select { transition:border-color .15s, box-shadow .15s; }
-    .enh-root input:not([type="checkbox"]):not([type="file"]):focus, .enh-root input:not([type="checkbox"]):not([type="file"]):focus-visible, .enh-root select:focus, .enh-root select:focus-visible { outline:none !important; border-color:var(--dsw-alias-state-business-primary, #4d8dff) !important; box-shadow:0 0 0 3px var(--dsw-alias-state-business-primary-a10, rgba(77,141,255,.18)) !important; }
+    .enh-root input:not([type="checkbox"]):not([type="file"]):focus, .enh-root input:not([type="checkbox"]):not([type="file"]):focus-visible, .enh-root select:focus, .enh-root select:focus-visible { outline:none !important; border-color:var(--dsw-alias-state-business-primary, #4d8dff) !important; box-shadow:0 0 0 3px color-mix(in srgb, var(--dsw-alias-state-business-primary, #4d8dff) 18%, transparent) !important; }
     .enh-root select { appearance:none; background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 12 12'%3E%3Cpath d='M3 4.5 6 7.5 9 4.5' fill='none' stroke='%23667085' stroke-width='1.4' stroke-linecap='round' stroke-linejoin='round'/%3E%3C/svg%3E"); background-repeat:no-repeat; background-position:right 12px center; padding-right:32px !important; }
     .enh-root input[type="file"] { font-size:12px; color:var(--dsw-alias-label-secondary, #475467); max-width:100%; }
     .enh-root input[type="file"]::file-selector-button { appearance:none; height:32px; margin-right:10px; padding:0 14px; border-radius:var(--dsw-radius-md, 12px); border:.5px solid var(--dsw-alias-border-l4, rgba(0,0,0,.16)); background:var(--dsw-alias-bg-layer-3, #fff); color:var(--dsw-alias-label-primary, inherit); font:inherit; font-size:13px; cursor:pointer; }
@@ -139,7 +139,7 @@ window.__ModuleLoader__.load({
     .enh-root input[type="checkbox"]:focus-visible { outline:2px solid var(--dsw-alias-state-business-primary, #4d8dff); outline-offset:2px; }
     
     .enh-root .enh-block-head { display:flex; align-items:flex-start; justify-content:space-between; gap:12px; }
-    .enh-root .enh-dirty { flex:none; font-size:11px; line-height:18px; padding:1px 8px; border-radius:999px; color:var(--dsw-alias-state-warning-primary, #b54708); background:var(--dsw-alias-state-warning-bg, rgba(247,144,9,.12)); border:.5px solid var(--dsw-alias-state-warning-primary-a30, rgba(181,71,8,.3)); }
+    .enh-root .enh-dirty { flex:none; font-size:11px; line-height:18px; padding:1px 8px; border-radius:999px; color:var(--dsw-alias-state-warn-primary, #b54708); background:color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 12%, transparent); border:.5px solid color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 30%, transparent); }
     .enh-root .enh-subhead { margin:14px 0 2px; font-size:13px; font-weight:600; color:var(--dsw-alias-label-primary, inherit); }
     .enh-root .enh-grid2 { display:grid; grid-template-columns:repeat(2,minmax(0,1fr)); gap:10px 16px; }
     .enh-root .enh-grid3 { display:grid; grid-template-columns:repeat(3,minmax(0,1fr)); gap:10px 16px; }
@@ -464,6 +464,10 @@ window.__ModuleLoader__.load({
                 throw new Error('Web Push 需要 HTTPS（或 localhost）；请先启用 HTTPS');
             if (!('serviceWorker' in navigator) || !('PushManager' in window))
                 throw new Error('当前浏览器不支持 Web Push');
+            // /sw.js 仅在启用 PWA 时注册；PWA 关闭时 Service Worker 不可用，Web Push 无从订阅。
+            const swProbe = await fetch('/sw.js', { method: 'HEAD', cache: 'no-store' }).catch(() => undefined);
+            if (!swProbe || !swProbe.ok)
+                throw new Error('Web Push 需要先启用 PWA（PWA 关闭时 Service Worker /sw.js 不可用）');
             if (!pushPublicKey)
                 throw new Error('VAPID 公钥尚未生成，请刷新状态后重试');
             let permission = Notification.permission;
@@ -698,21 +702,31 @@ window.__ModuleLoader__.load({
                 /* ignore */
             }
         };
+        const onMessage = (event) => {
+            const data = event.data;
+            if (data?.type === 'dsh-enhancement-open-session' && data.sessionId && SESSION_ID_PATTERN.test(data.sessionId))
+                openSession(ctx, data.sessionId);
+        };
         read();
         window.addEventListener('popstate', read);
         try {
-            navigator.serviceWorker?.addEventListener('message', (event) => {
-                const data = event.data;
-                if (data?.type === 'dsh-enhancement-open-session' && data.sessionId && SESSION_ID_PATTERN.test(data.sessionId))
-                    openSession(ctx, data.sessionId);
-            });
+            navigator.serviceWorker?.addEventListener('message', onMessage);
         }
         catch {
             /* service worker unavailable on HTTP */
         }
+        return () => {
+            window.removeEventListener('popstate', read);
+            try {
+                navigator.serviceWorker?.removeEventListener('message', onMessage);
+            }
+            catch {
+                /* ignore */
+            }
+        };
     }
     function apply(ctx) {
-        openSessionFromQuery(ctx);
+        ctx.effect(() => openSessionFromQuery(ctx), 'dsh-enhancement: open session from query');
         ctx.effect(() => connectFocusEvents(ctx), 'dsh-enhancement: focus existing page');
         ctx.effect(() => {
             return ctx.slots.inject('plugins.bundle.config', () => ctx.slots.register({

package/lib/gateway.d.ts

@@ -19,6 +19,16 @@ export declare class Gateway {
     stop(): Promise<void>;
     restart(): Promise<void>;
     status(interfaces: NetworkInterfaceInfo[]): Status;
+    /**
+     * 请求是否携带有效的网关会话。
+     *
+     * 必须遍历**所有**同名 cookie，不能只看第一个：浏览器在 path / 域重叠、或
+     * 同一个地址先后被不同版本写入过时，Cookie 头里会出现多个同名项，顺序由浏览器
+     * 决定（通常按创建时间或 path 长度）。旧实现取 `find(...)` 的第一个，一旦过期
+     * 的旧 cookie 排在前面就永久认证失败 —— 表现为「密码正确、登录页刷新一下又回
+     * 到登录页，且不报密码错误」，用户无法自愈（除非手动清 cookie）。
+     * 现在任何一个值验签通过即视为已认证。
+     */
     private isAuthenticated;
     private isSameOrigin;
     private gatewayOrigin;

package/lib/gateway.js

@@ -12,6 +12,7 @@ import { createServer, request as httpRequest } from 'node:http';
 import { createServer as createHttpsServer } from 'node:https';
 import { connect as netConnect } from 'node:net';
 import { URL } from 'node:url';
+import { dirname } from 'node:path';
 import { SESSION_COOKIE, clearSessionCookie, formatHost, mintDshCookie, readDshSecret, requestAuthority, sessionCookie, signSession, verifySession, } from './state.js';
 import { caCertificatePem, prepareTls, tlsStatus } from './tls.js';
 const LOGIN_WINDOW_MS = 10 * 60 * 1000;
@@ -53,7 +54,9 @@ function parseCookies(header) {
 function safeNext(raw) {
     if (typeof raw !== 'string' || !raw.startsWith('/') || raw.startsWith('//'))
         return '/';
-    if (/[\r\n]/.test(raw))
+    // 反斜杠在 URL 解析中会被归一成斜杠（`/\evil.com` → `//evil.com`），构成开放重定向；
+    // 编码形式 %5c 同理，一并拒绝。CRLF 用于防响应拆分。
+    if (/[\r\n\\]/.test(raw) || /%5c|%2f%2f/i.test(raw))
         return '/';
     return raw;
 }
@@ -189,8 +192,7 @@ export class Gateway {
         }
         this.dshSecret = await readDshSecret(this.ctx);
         if (!this.dshSecret) {
-            this.log('warn', '无法读取 DSH 浏览器会话签名密钥；会在后台重试（网关自身仍可登录）');
-            this.scheduleDshSecretRetry();
+            this.log('warn', '无法读取 DSH 浏览器会话签名密钥；启动后会在后台重试（网关自身仍可登录）');
         }
         const handler = (req, res) => {
             void this.handleRequest(req, res).catch((err) => {
@@ -232,6 +234,10 @@ export class Gateway {
             server.listen(config.port, config.bindHost, () => {
                 server.off('error', onError);
                 this.started = true;
+                // 监听成功（started=true）后才安排密钥重试：此前的 scheduleDshSecretRetry
+                // 会因守卫 !this.started 直接返回，导致重试从不发生。
+                if (!this.dshSecret)
+                    this.scheduleDshSecretRetry();
                 this.log('info', `gateway listening on ${this.secure ? 'https' : 'http'}://${formatHost(config.bindHost)}:${config.port}`);
                 resolve();
             });
@@ -299,7 +305,7 @@ export class Gateway {
             dshOrigin: origin,
             dshAccessUrl,
             interfaces,
-            stateDir: this.store.statePath.replace(/\/state\.json$/, ''),
+            stateDir: dirname(this.store.statePath),
             statePath: this.store.statePath,
             error: this.error,
             https: tlsStatus(config, this.ctx.webServer.host),
@@ -343,12 +349,26 @@ export class Gateway {
     // -------------------------------------------------------------------------
     // 认证
     // -------------------------------------------------------------------------
+    /**
+     * 请求是否携带有效的网关会话。
+     *
+     * 必须遍历**所有**同名 cookie，不能只看第一个：浏览器在 path / 域重叠、或
+     * 同一个地址先后被不同版本写入过时，Cookie 头里会出现多个同名项，顺序由浏览器
+     * 决定（通常按创建时间或 path 长度）。旧实现取 `find(...)` 的第一个，一旦过期
+     * 的旧 cookie 排在前面就永久认证失败 —— 表现为「密码正确、登录页刷新一下又回
+     * 到登录页，且不报密码错误」，用户无法自愈（除非手动清 cookie）。
+     * 现在任何一个值验签通过即视为已认证。
+     */
     isAuthenticated(req) {
         if (!this.store.passwordSet)
             return false;
-        const cookies = parseCookies(req.headers.cookie);
-        const raw = cookies.find(([name]) => name === SESSION_COOKIE)?.[1];
-        return verifySession(this.store.gateSecret, raw) !== null;
+        for (const [name, value] of parseCookies(req.headers.cookie)) {
+            if (name !== SESSION_COOKIE)
+                continue;
+            if (verifySession(this.store.gateSecret, value) !== null)
+                return true;
+        }
+        return false;
     }
     isSameOrigin(req) {
         const host = req.headers.host;

package/lib/state.d.ts

@@ -129,7 +129,15 @@ export interface SessionPayload {
 export declare function signSession(secret: string, days: number): string;
 export declare function verifySession(secret: string, value: string | undefined): SessionPayload | null;
 export declare function sessionCookie(value: string, days: number, secure: boolean): string;
-export declare function clearSessionCookie(secure: boolean): string;
+/**
+ * 清空会话 cookie 的 Set-Cookie 头（返回**多条**）。
+ *
+ * 浏览器按 (name, domain, path) 三元组存 cookie：同一个名字挂在不同 path 下就是
+ * 不同条目，每个都会出现在同一条 Cookie 请求头里。历史版本或人工改动可能留下
+ * `/__enhancement` 等其它 path 的残值，只清 `Path=/` 清不掉它们；这些验签失败的
+ * 死值会让请求携带多份同名 cookie（见 Gateway#isAuthenticated 的注释）。
+ */
+export declare function clearSessionCookie(secure: boolean): string[];
 export declare function requestAuthority(host: string, protocol: 'http:' | 'https:'): string;
 export declare function mintDshCookie(secret: Buffer, authority: string, ttlMs: number): string;
 export declare function readDshSecret(ctx: {

package/lib/state.js

@@ -194,7 +194,16 @@ export class StateStore {
                 };
             }
             catch {
-                /* fall through to a fresh state; keep a warning via caller */
+                // 解析失败不能静默清空：先把损坏文件改名备份，再回落默认状态，避免用户
+                // 的密码哈希 / VAPID / 推送订阅被无提示地覆盖丢失。
+                try {
+                    const backup = `${this.statePath}.corrupt-${Date.now()}`;
+                    renameSync(this.statePath, backup);
+                    console.warn(`[dsh-enhancement] state.json 无法解析，已备份到 ${backup} 并以默认配置继续`);
+                }
+                catch {
+                    /* 备份失败也不阻塞启动 */
+                }
             }
         }
         const config = defaultConfig(this.webServerHost);
@@ -301,7 +310,7 @@ export function verifySession(secret, value) {
         return null;
     try {
         const payload = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));
-        if (payload.v !== 1 || typeof payload.exp !== 'number' || typeof payload.exp !== 'number')
+        if (payload.v !== 1 || typeof payload.sid !== 'string' || typeof payload.iat !== 'number' || typeof payload.exp !== 'number')
             return null;
         if (payload.exp <= Date.now())
             return null;
@@ -323,8 +332,17 @@ export function sessionCookie(value, days, secure) {
         attrs.push('Secure');
     return attrs.join('; ');
 }
+/**
+ * 清空会话 cookie 的 Set-Cookie 头（返回**多条**）。
+ *
+ * 浏览器按 (name, domain, path) 三元组存 cookie：同一个名字挂在不同 path 下就是
+ * 不同条目，每个都会出现在同一条 Cookie 请求头里。历史版本或人工改动可能留下
+ * `/__enhancement` 等其它 path 的残值，只清 `Path=/` 清不掉它们；这些验签失败的
+ * 死值会让请求携带多份同名 cookie（见 Gateway#isAuthenticated 的注释）。
+ */
 export function clearSessionCookie(secure) {
-    return `${SESSION_COOKIE}=; Max-Age=0; Path=/; HttpOnly; SameSite=Strict${secure ? '; Secure' : ''}`;
+    const tail = `Max-Age=0; HttpOnly; SameSite=Strict${secure ? '; Secure' : ''}`;
+    return ['/', '/__enhancement', '/__enhancement/login'].map((path) => `${SESSION_COOKIE}=; Path=${path}; ${tail}`);
 }
 // ---------------------------------------------------------------------------
 // DSH 会话 cookie 签发（与 @deepseek-ai/dsh-client-connection 的 v1 格式一致）

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-enhancement",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "DSH 增强套件：远程安全访问网关（密码/HTTPS）、PWA 安装与图标、桌面通知与 Web Push、会话请求头、设置页。",
   "type": "module",
   "main": "./lib/index.js",
@@ -31,7 +31,8 @@
     "build": "tsc -p tsconfig.json && tsc -p tsconfig.client.json && node scripts/build-client.mjs",
     "verify": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.client.json --noEmit",
     "prepare": "npm run build",
-    "test": "node --test test/session-header.test.mjs"
+    "pretest": "npm run build",
+    "test": "node --test test/session-header.test.mjs test/gateway-auth.test.mjs"
   },
   "dsh": {
     "bundle": {
@@ -40,7 +41,6 @@
     "client": {
       "platform": "web",
       "inject": [
-        "@deepseek-ai/dsh-client-ui-slots",
         "@deepseek-ai/dsh-client-ui-workspace"
       ],
       "immediately": true
@@ -48,12 +48,12 @@
   },
   "devDependencies": {
     "@types/node": "^22.20.1",
-    "@types/react": "~18.3.12",
-    "react": "^18.2.0",
-    "typescript": "^6.0.3",
     "@types/node-forge": "^1.3.14",
     "@types/node-notifier": "^8.0.5",
-    "@types/web-push": "^3.6.4"
+    "@types/react": "~18.3.12",
+    "@types/web-push": "^3.6.4",
+    "react": "^18.2.0",
+    "typescript": "^6.0.3"
   },
   "engines": {
     "node": ">=22.18.0"
@@ -74,10 +74,10 @@
     "deepseek"
   ],
   "dependencies": {
+    "dsh-vertical-layout": "^1.1.0",
+    "dsh-web-mobile": "^3.1.0",
     "node-forge": "^1.4.0",
     "node-notifier": "^11.0.0",
-    "web-push": "^3.6.7",
-    "dsh-web-mobile": "^3.1.0",
-    "dsh-vertical-layout": "^1.1.0"
+    "web-push": "^3.6.7"
   }
 }

package/src/client/index.tsx

@@ -159,7 +159,7 @@ const styles: Record<string, React.CSSProperties> = {
   muted: { color: 'var(--dsw-alias-label-secondary, #667085)', fontSize: 12, lineHeight: 1.6 },
   card: { borderTop: '1px solid var(--dsw-alias-border-l4, rgba(0,0,0,.08))', padding: '16px 0 8px', display: 'flex', flexDirection: 'column', gap: 6, background: 'transparent' },
   blockHead: { display: 'flex', alignItems: 'flex-start', justifyContent: 'space-between', gap: 12 },
-  dirty: { flex: 'none', fontSize: 11, lineHeight: '18px', padding: '1px 8px', borderRadius: 999, color: 'var(--dsw-alias-state-warning-primary, #b54708)', background: 'var(--dsw-alias-state-warning-bg, rgba(247,144,9,.12))', border: '.5px solid var(--dsw-alias-state-warning-primary-a30, rgba(181,71,8,.3))' },
+  dirty: { flex: 'none', fontSize: 11, lineHeight: '18px', padding: '1px 8px', borderRadius: 999, color: 'var(--dsw-alias-state-warn-primary, #b54708)', background: 'color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 12%, transparent)', border: '.5px solid color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 30%, transparent)' },
   subhead: { margin: '14px 0 2px', fontSize: 13, fontWeight: 600, color: 'var(--dsw-alias-label-primary, inherit)' },
   row: { display: 'flex', flexDirection: 'column', gap: 6, padding: '10px 0' },
   label: { color: 'var(--dsw-alias-label-primary, inherit)', fontSize: 13, fontWeight: 500 },
@@ -170,12 +170,12 @@ const styles: Record<string, React.CSSProperties> = {
   actions: { display: 'flex', flexWrap: 'wrap', alignItems: 'center', gap: 8, paddingTop: 4 },
   button: { height: 32, padding: '0 14px', borderRadius: 'var(--dsw-radius-md, 12px)', border: '.5px solid var(--dsw-alias-border-l4, rgba(0,0,0,.16))', background: 'transparent', color: 'var(--dsw-alias-label-primary, inherit)', cursor: 'pointer', fontSize: 13 },
   primary: { background: 'var(--dsw-alias-state-business-primary, #4d8dff)', borderColor: 'transparent', color: '#fff', fontWeight: 600 },
-  danger: { color: 'var(--dsw-alias-state-danger-primary, #d92d20)' },
+  danger: { color: 'var(--dsw-alias-state-error-primary, #d92d20)' },
   pill: { display: 'inline-flex', alignItems: 'center', gap: 6, padding: '3px 9px', borderRadius: 999, border: '.5px solid var(--dsw-alias-border-l4, rgba(0,0,0,.16))', fontSize: 11, color: 'var(--dsw-alias-label-secondary, #667085)' },
   dot: { width: 7, height: 7, borderRadius: 999, background: '#54d18a', display: 'inline-block' },
   dotOff: { width: 7, height: 7, borderRadius: 999, background: '#98a2b3', display: 'inline-block' },
   code: { fontFamily: 'ui-monospace, SFMono-Regular, Menlo, monospace', fontSize: 11, wordBreak: 'break-all', background: 'var(--dsw-alias-bg-layer-3, rgba(0,0,0,.04))', color: 'var(--dsw-alias-label-secondary, #475467)', padding: '6px 8px', borderRadius: 8 },
-  error: { color: 'var(--dsw-alias-state-danger-primary, #d92d20)', fontSize: 12, lineHeight: 1.5 },
+  error: { color: 'var(--dsw-alias-state-error-primary, #d92d20)', fontSize: 12, lineHeight: 1.5 },
   success: { color: 'var(--dsw-alias-state-success-primary, #079455)', fontSize: 12, lineHeight: 1.5 },
   divider: { height: 1, background: 'var(--dsw-alias-border-l4, rgba(0,0,0,.08))', margin: '6px 0' },
 }
@@ -192,7 +192,7 @@ function Row(props: { label: string; children: React.ReactNode }): React.ReactEl
 
 const CARD_CSS = `
 .enh-root input:not([type="checkbox"]):not([type="file"]), .enh-root select { transition:border-color .15s, box-shadow .15s; }
-.enh-root input:not([type="checkbox"]):not([type="file"]):focus, .enh-root input:not([type="checkbox"]):not([type="file"]):focus-visible, .enh-root select:focus, .enh-root select:focus-visible { outline:none !important; border-color:var(--dsw-alias-state-business-primary, #4d8dff) !important; box-shadow:0 0 0 3px var(--dsw-alias-state-business-primary-a10, rgba(77,141,255,.18)) !important; }
+.enh-root input:not([type="checkbox"]):not([type="file"]):focus, .enh-root input:not([type="checkbox"]):not([type="file"]):focus-visible, .enh-root select:focus, .enh-root select:focus-visible { outline:none !important; border-color:var(--dsw-alias-state-business-primary, #4d8dff) !important; box-shadow:0 0 0 3px color-mix(in srgb, var(--dsw-alias-state-business-primary, #4d8dff) 18%, transparent) !important; }
 .enh-root select { appearance:none; background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 12 12'%3E%3Cpath d='M3 4.5 6 7.5 9 4.5' fill='none' stroke='%23667085' stroke-width='1.4' stroke-linecap='round' stroke-linejoin='round'/%3E%3C/svg%3E"); background-repeat:no-repeat; background-position:right 12px center; padding-right:32px !important; }
 .enh-root input[type="file"] { font-size:12px; color:var(--dsw-alias-label-secondary, #475467); max-width:100%; }
 .enh-root input[type="file"]::file-selector-button { appearance:none; height:32px; margin-right:10px; padding:0 14px; border-radius:var(--dsw-radius-md, 12px); border:.5px solid var(--dsw-alias-border-l4, rgba(0,0,0,.16)); background:var(--dsw-alias-bg-layer-3, #fff); color:var(--dsw-alias-label-primary, inherit); font:inherit; font-size:13px; cursor:pointer; }
@@ -206,7 +206,7 @@ const CARD_CSS = `
 .enh-root input[type="checkbox"]:focus-visible { outline:2px solid var(--dsw-alias-state-business-primary, #4d8dff); outline-offset:2px; }
 
 .enh-root .enh-block-head { display:flex; align-items:flex-start; justify-content:space-between; gap:12px; }
-.enh-root .enh-dirty { flex:none; font-size:11px; line-height:18px; padding:1px 8px; border-radius:999px; color:var(--dsw-alias-state-warning-primary, #b54708); background:var(--dsw-alias-state-warning-bg, rgba(247,144,9,.12)); border:.5px solid var(--dsw-alias-state-warning-primary-a30, rgba(181,71,8,.3)); }
+.enh-root .enh-dirty { flex:none; font-size:11px; line-height:18px; padding:1px 8px; border-radius:999px; color:var(--dsw-alias-state-warn-primary, #b54708); background:color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 12%, transparent); border:.5px solid color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 30%, transparent); }
 .enh-root .enh-subhead { margin:14px 0 2px; font-size:13px; font-weight:600; color:var(--dsw-alias-label-primary, inherit); }
 .enh-root .enh-grid2 { display:grid; grid-template-columns:repeat(2,minmax(0,1fr)); gap:10px 16px; }
 .enh-root .enh-grid3 { display:grid; grid-template-columns:repeat(3,minmax(0,1fr)); gap:10px 16px; }
@@ -625,6 +625,9 @@ function Card(): React.ReactElement {
   const enablePush = () => run(async () => {
     if (!window.isSecureContext) throw new Error('Web Push 需要 HTTPS（或 localhost）；请先启用 HTTPS')
     if (!('serviceWorker' in navigator) || !('PushManager' in window)) throw new Error('当前浏览器不支持 Web Push')
+    // /sw.js 仅在启用 PWA 时注册；PWA 关闭时 Service Worker 不可用，Web Push 无从订阅。
+    const swProbe = await fetch('/sw.js', { method: 'HEAD', cache: 'no-store' }).catch(() => undefined)
+    if (!swProbe || !swProbe.ok) throw new Error('Web Push 需要先启用 PWA（PWA 关闭时 Service Worker /sw.js 不可用）')
     if (!pushPublicKey) throw new Error('VAPID 公钥尚未生成，请刷新状态后重试')
     let permission = Notification.permission
     if (permission === 'default') permission = await Notification.requestPermission()
@@ -1210,7 +1213,7 @@ function connectFocusEvents(ctx: ClientContext): (() => void) | undefined {
   }
 }
 
-function openSessionFromQuery(ctx: ClientContext): void {
+function openSessionFromQuery(ctx: ClientContext): () => void {
   const read = () => {
     try {
       const url = new URL(location.href)
@@ -1223,20 +1226,29 @@ function openSessionFromQuery(ctx: ClientContext): void {
       /* ignore */
     }
   }
+  const onMessage = (event: MessageEvent) => {
+    const data = event.data as { type?: string; sessionId?: string } | undefined
+    if (data?.type === 'dsh-enhancement-open-session' && data.sessionId && SESSION_ID_PATTERN.test(data.sessionId)) openSession(ctx, data.sessionId)
+  }
   read()
   window.addEventListener('popstate', read)
   try {
-    navigator.serviceWorker?.addEventListener('message', (event) => {
-      const data = event.data as { type?: string; sessionId?: string } | undefined
-      if (data?.type === 'dsh-enhancement-open-session' && data.sessionId && SESSION_ID_PATTERN.test(data.sessionId)) openSession(ctx, data.sessionId)
-    })
+    navigator.serviceWorker?.addEventListener('message', onMessage)
   } catch {
     /* service worker unavailable on HTTP */
   }
+  return () => {
+    window.removeEventListener('popstate', read)
+    try {
+      navigator.serviceWorker?.removeEventListener('message', onMessage)
+    } catch {
+      /* ignore */
+    }
+  }
 }
 
 export function apply(ctx: ClientContext): void {
-  openSessionFromQuery(ctx)
+  ctx.effect(() => openSessionFromQuery(ctx), 'dsh-enhancement: open session from query')
   ctx.effect(() => connectFocusEvents(ctx), 'dsh-enhancement: focus existing page')
   ctx.effect(() => {
     return ctx.slots.inject('plugins.bundle.config', () =>

package/src/gateway.ts

@@ -12,6 +12,7 @@ import { createServer, request as httpRequest, type IncomingMessage, type Server
 import { createServer as createHttpsServer } from 'node:https'
 import { connect as netConnect, type Socket } from 'node:net'
 import { URL } from 'node:url'
+import { dirname } from 'node:path'
 import {
   SESSION_COOKIE,
   StateStore,
@@ -78,7 +79,9 @@ function parseCookies(header: string | undefined): Array<[string, string]> {
 
 function safeNext(raw: unknown): string {
   if (typeof raw !== 'string' || !raw.startsWith('/') || raw.startsWith('//')) return '/'
-  if (/[\r\n]/.test(raw)) return '/'
+  // 反斜杠在 URL 解析中会被归一成斜杠（`/\evil.com` → `//evil.com`），构成开放重定向；
+  // 编码形式 %5c 同理，一并拒绝。CRLF 用于防响应拆分。
+  if (/[\r\n\\]/.test(raw) || /%5c|%2f%2f/i.test(raw)) return '/'
   return raw
 }
 
@@ -213,8 +216,7 @@ export class Gateway {
     }
     this.dshSecret = await readDshSecret(this.ctx)
     if (!this.dshSecret) {
-      this.log('warn', '无法读取 DSH 浏览器会话签名密钥；会在后台重试（网关自身仍可登录）')
-      this.scheduleDshSecretRetry()
+      this.log('warn', '无法读取 DSH 浏览器会话签名密钥；启动后会在后台重试（网关自身仍可登录）')
     }
     const handler = (req: IncomingMessage, res: ServerResponse): void => {
       void this.handleRequest(req, res).catch((err: unknown) => {
@@ -256,6 +258,9 @@ export class Gateway {
       server.listen(config.port, config.bindHost, () => {
         server.off('error', onError)
         this.started = true
+        // 监听成功（started=true）后才安排密钥重试：此前的 scheduleDshSecretRetry
+        // 会因守卫 !this.started 直接返回，导致重试从不发生。
+        if (!this.dshSecret) this.scheduleDshSecretRetry()
         this.log('info', `gateway listening on ${this.secure ? 'https' : 'http'}://${formatHost(config.bindHost)}:${config.port}`)
         resolve()
       })
@@ -322,7 +327,7 @@ export class Gateway {
       dshOrigin: origin,
       dshAccessUrl,
       interfaces,
-      stateDir: this.store.statePath.replace(/\/state\.json$/, ''),
+      stateDir: dirname(this.store.statePath),
       statePath: this.store.statePath,
       error: this.error,
       https: tlsStatus(config, this.ctx.webServer.host),
@@ -368,11 +373,23 @@ export class Gateway {
   // 认证
   // -------------------------------------------------------------------------
 
+  /**
+   * 请求是否携带有效的网关会话。
+   *
+   * 必须遍历**所有**同名 cookie，不能只看第一个：浏览器在 path / 域重叠、或
+   * 同一个地址先后被不同版本写入过时，Cookie 头里会出现多个同名项，顺序由浏览器
+   * 决定（通常按创建时间或 path 长度）。旧实现取 `find(...)` 的第一个，一旦过期
+   * 的旧 cookie 排在前面就永久认证失败 —— 表现为「密码正确、登录页刷新一下又回
+   * 到登录页，且不报密码错误」，用户无法自愈（除非手动清 cookie）。
+   * 现在任何一个值验签通过即视为已认证。
+   */
   private isAuthenticated(req: IncomingMessage): boolean {
     if (!this.store.passwordSet) return false
-    const cookies = parseCookies(req.headers.cookie)
-    const raw = cookies.find(([name]) => name === SESSION_COOKIE)?.[1]
-    return verifySession(this.store.gateSecret, raw) !== null
+    for (const [name, value] of parseCookies(req.headers.cookie)) {
+      if (name !== SESSION_COOKIE) continue
+      if (verifySession(this.store.gateSecret, value) !== null) return true
+    }
+    return false
   }
 
   private isSameOrigin(req: IncomingMessage): boolean {

package/src/state.ts

@@ -278,7 +278,15 @@ export class StateStore {
           updatedAt: nowIso(),
         }
       } catch {
-        /* fall through to a fresh state; keep a warning via caller */
+        // 解析失败不能静默清空：先把损坏文件改名备份，再回落默认状态，避免用户
+        // 的密码哈希 / VAPID / 推送订阅被无提示地覆盖丢失。
+        try {
+          const backup = `${this.statePath}.corrupt-${Date.now()}`
+          renameSync(this.statePath, backup)
+          console.warn(`[dsh-enhancement] state.json 无法解析，已备份到 ${backup} 并以默认配置继续`)
+        } catch {
+          /* 备份失败也不阻塞启动 */
+        }
       }
     }
     const config = defaultConfig(this.webServerHost)
@@ -404,7 +412,7 @@ export function verifySession(secret: string, value: string | undefined): Sessio
   if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) return null
   try {
     const payload = JSON.parse(Buffer.from(body, 'base64url').toString('utf8')) as SessionPayload
-    if (payload.v !== 1 || typeof payload.exp !== 'number' || typeof payload.exp !== 'number') return null
+    if (payload.v !== 1 || typeof payload.sid !== 'string' || typeof payload.iat !== 'number' || typeof payload.exp !== 'number') return null
     if (payload.exp <= Date.now()) return null
     return payload
   } catch {
@@ -424,8 +432,19 @@ export function sessionCookie(value: string, days: number, secure: boolean): str
   return attrs.join('; ')
 }
 
-export function clearSessionCookie(secure: boolean): string {
-  return `${SESSION_COOKIE}=; Max-Age=0; Path=/; HttpOnly; SameSite=Strict${secure ? '; Secure' : ''}`
+/**
+ * 清空会话 cookie 的 Set-Cookie 头（返回**多条**）。
+ *
+ * 浏览器按 (name, domain, path) 三元组存 cookie：同一个名字挂在不同 path 下就是
+ * 不同条目，每个都会出现在同一条 Cookie 请求头里。历史版本或人工改动可能留下
+ * `/__enhancement` 等其它 path 的残值，只清 `Path=/` 清不掉它们；这些验签失败的
+ * 死值会让请求携带多份同名 cookie（见 Gateway#isAuthenticated 的注释）。
+ */
+export function clearSessionCookie(secure: boolean): string[] {
+  const tail = `Max-Age=0; HttpOnly; SameSite=Strict${secure ? '; Secure' : ''}`
+  return ['/', '/__enhancement', '/__enhancement/login'].map(
+    (path) => `${SESSION_COOKIE}=; Path=${path}; ${tail}`,
+  )
 }
 
 // ---------------------------------------------------------------------------

package/test/gateway-auth.test.mjs

@@ -0,0 +1,149 @@
+// 网关会话认证的回归测试。
+//
+// 覆盖两个真实缺陷（与任何 PWA / 样式改动无关，属独立 bug 修复）：
+//
+// 1. **同名 cookie 只读第一个**：浏览器按 (name, domain, path) 存 cookie，重复项
+//    顺序由浏览器决定。旧实现用 `find()` 取第一个，一旦过期的旧值排在前面就永久
+//    认证失败 —— 表现是「密码正确、刷新又回登录页，且不报密码错误」，用户无法
+//    自愈（除非手动清 cookie）。
+//
+// 2. **清除 cookie 只清 Path=/**：`/__enhancement` 等其它 path 上的残值清不掉，
+//    它们会一直跟着每个请求，让上面的问题复现。
+//
+// 运行：node --test test/gateway-auth.test.mjs
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import {
+  clearSessionCookie,
+  sessionCookie,
+  signSession,
+  verifySession,
+  SESSION_COOKIE,
+} from '../lib/state.js'
+
+const SECRET = Buffer.from('test-gate-secret-0123456789abcdef').toString('base64url')
+
+/** 复刻网关的 cookie 解析：保序、保留重复项。 */
+function parseCookies(header) {
+  if (!header) return []
+  const out = []
+  for (const segment of header.split(';')) {
+    const at = segment.indexOf('=')
+    if (at === -1) continue
+    const name = segment.slice(0, at).trim()
+    if (!name) continue
+    out.push([name, segment.slice(at + 1).trim()])
+  }
+  return out
+}
+
+/** 修复后的判定（与 Gateway#isAuthenticated 一致）：任一同名项验签通过即认证。 */
+function isAuthenticated(header) {
+  for (const [name, value] of parseCookies(header)) {
+    if (name !== SESSION_COOKIE) continue
+    if (verifySession(SECRET, value) !== null) return true
+  }
+  return false
+}
+
+/** 修复前的行为：只看第一个同名项。仅用于证明用例抓得住回归。 */
+function isAuthenticatedLegacy(header) {
+  const raw = parseCookies(header).find(([name]) => name === SESSION_COOKIE)?.[1]
+  return verifySession(SECRET, raw) !== null
+}
+
+// ---------------------------------------------------------------------------
+// 1. 核心回归：同名 cookie 的顺序不能决定认证结果
+// ---------------------------------------------------------------------------
+
+test('Cookie 头里有多个同名项时，任意一个有效即认证通过', () => {
+  const valid = signSession(SECRET, 30)
+  const bogus = `${SESSION_COOKIE}=v1.bogus.sig`
+  const good = `${SESSION_COOKIE}=${valid}`
+
+  for (const header of [`${bogus}; ${good}`, `${good}; ${bogus}`, good]) {
+    assert.equal(
+      isAuthenticated(header),
+      true,
+      `应通过：${header.replace(valid, '<valid>')}`,
+    )
+  }
+})
+
+test('回归护栏：旧实现（只取第一个同名 cookie）在坏值排前时失败', () => {
+  const valid = signSession(SECRET, 30)
+  const staleFirst = `${SESSION_COOKIE}=v1.bogus.sig; ${SESSION_COOKIE}=${valid}`
+
+  // 这条断言是「测试有效性」的证明：它红了说明回归被引入。
+  assert.equal(isAuthenticatedLegacy(staleFirst), false, '旧实现应失败（证明用例有效）')
+  assert.equal(isAuthenticated(staleFirst), true, '新实现应通过')
+})
+
+test('全部无效时仍然拒绝（遍历不能放宽认证）', () => {
+  for (const header of [
+    `${SESSION_COOKIE}=v1.bogus.sig`,
+    `${SESSION_COOKIE}=v1.bogus.sig; ${SESSION_COOKIE}=v1.other.sig`,
+    `${SESSION_COOKIE}=`,
+    '',
+    'other=1',
+  ]) {
+    assert.equal(isAuthenticated(header), false, `应拒绝：${JSON.stringify(header)}`)
+  }
+})
+
+test('过期会话即使验签合法也拒绝', () => {
+  assert.equal(isAuthenticated(`${SESSION_COOKIE}=${signSession(SECRET, -1)}`), false)
+})
+
+test('换一把密钥签出的会话不再有效（改密码后旧会话失效的机制）', () => {
+  const other = Buffer.from('another-gate-secret-value').toString('base64url')
+  assert.equal(isAuthenticated(`${SESSION_COOKIE}=${signSession(other, 30)}`), false)
+})
+
+// ---------------------------------------------------------------------------
+// 2. 清除 cookie 必须覆盖多个 path（否则残值永远清不掉）
+// ---------------------------------------------------------------------------
+
+test('clearSessionCookie 覆盖多个 path，且都是立即过期的空值', () => {
+  const headers = clearSessionCookie(false)
+  assert.ok(Array.isArray(headers), '应返回多条 Set-Cookie')
+  assert.ok(headers.length >= 2, `应覆盖至少 2 个 path，实际 ${headers.length}`)
+
+  const paths = headers.map((h) => (/Path=([^;]+)/.exec(h) ?? [])[1])
+  assert.ok(paths.includes('/'), '必须包含 Path=/')
+  assert.ok(paths.includes('/__enhancement'), '必须包含 /__enhancement（登录页残值）')
+
+  for (const header of headers) {
+    assert.match(header, new RegExp(`^${SESSION_COOKIE}=;`), '清除头必须是空值')
+    assert.match(header, /Max-Age=0/, '清除头必须立即过期')
+    assert.match(header, /HttpOnly/, '清除头必须保持 HttpOnly')
+  }
+})
+
+test('HTTPS 下的清除头必须带 Secure，否则浏览器拒绝覆盖', () => {
+  for (const header of clearSessionCookie(true)) assert.match(header, /; Secure/)
+  for (const header of clearSessionCookie(false)) assert.doesNotMatch(header, /; Secure/)
+})
+
+// ---------------------------------------------------------------------------
+// 3. 下发的新会话 cookie 属性
+// ---------------------------------------------------------------------------
+
+test('登录成功后下发的会话 cookie 属性正确', () => {
+  const token = signSession(SECRET, 30)
+  const header = sessionCookie(token, 30, false)
+  assert.match(header, new RegExp(`^${SESSION_COOKIE}=`))
+  assert.match(header, /Max-Age=2592000/, '30 天对应 2592000 秒')
+  assert.match(header, /Path=\//)
+  assert.match(header, /HttpOnly/)
+  assert.match(header, /SameSite=Strict/)
+  assert.doesNotMatch(header, /; Secure/)
+  assert.match(sessionCookie(token, 30, true), /; Secure/)
+})
+
+test('sessionDays 非正数时 Max-Age 仍为正（不退化成会话级 cookie）', () => {
+  const token = signSession(SECRET, 1)
+  for (const days of [0, -5]) {
+    assert.match(sessionCookie(token, days, false), /Max-Age=1(;|$)/)
+  }
+})