dsh-enhancement 1.1.1 → 1.1.2

package/README.en.md

@@ -94,6 +94,7 @@ Clicking a desktop notification opens the matching session. On Linux and Windows
 ## Mobile push
 
 - Standard Web Push with one subscription per device.
+- **PWA must be enabled first**: the Service Worker (`/sw.js`) is served by the PWA feature, so push cannot be subscribed while PWA is off.
 - Click “Subscribe this device” in settings; the browser asks for notification permission, which must be triggered by your click.
 - iOS / iPadOS 16.4+ is required, and DSH must be added to the Home Screen; regular Safari tabs cannot receive push.
 - Unsubscribe at any time, or send a test push to verify the setup.

package/README.md

@@ -95,6 +95,7 @@ DSH 只在直连官方 DeepSeek API 时发送 `x-deepseek-harness-session-id`；
 ## 手机推送
 
 - 使用标准 Web Push，每台设备单独订阅。
+- **需要先启用 PWA**：Service Worker（`/sw.js`）由 PWA 提供，PWA 关闭时无法订阅。
 - 在设置里点“订阅本设备”，浏览器会请求通知权限；权限必须由你主动点击触发。
 - iOS / iPadOS 需要 16.4 或更高版本，并且必须先把 DSH 添加到主屏幕；Safari 普通标签页收不到推送。
 - 可以随时取消订阅，或发送一条测试推送确认链路正常。

package/lib/client.js

@@ -100,7 +100,7 @@ window.__ModuleLoader__.load({
         muted: { color: 'var(--dsw-alias-label-secondary, #667085)', fontSize: 12, lineHeight: 1.6 },
         card: { borderTop: '1px solid var(--dsw-alias-border-l4, rgba(0,0,0,.08))', padding: '16px 0 8px', display: 'flex', flexDirection: 'column', gap: 6, background: 'transparent' },
         blockHead: { display: 'flex', alignItems: 'flex-start', justifyContent: 'space-between', gap: 12 },
-        dirty: { flex: 'none', fontSize: 11, lineHeight: '18px', padding: '1px 8px', borderRadius: 999, color: 'var(--dsw-alias-state-warning-primary, #b54708)', background: 'var(--dsw-alias-state-warning-bg, rgba(247,144,9,.12))', border: '.5px solid var(--dsw-alias-state-warning-primary-a30, rgba(181,71,8,.3))' },
+        dirty: { flex: 'none', fontSize: 11, lineHeight: '18px', padding: '1px 8px', borderRadius: 999, color: 'var(--dsw-alias-state-warn-primary, #b54708)', background: 'color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 12%, transparent)', border: '.5px solid color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 30%, transparent)' },
         subhead: { margin: '14px 0 2px', fontSize: 13, fontWeight: 600, color: 'var(--dsw-alias-label-primary, inherit)' },
         row: { display: 'flex', flexDirection: 'column', gap: 6, padding: '10px 0' },
         label: { color: 'var(--dsw-alias-label-primary, inherit)', fontSize: 13, fontWeight: 500 },
@@ -111,12 +111,12 @@ window.__ModuleLoader__.load({
         actions: { display: 'flex', flexWrap: 'wrap', alignItems: 'center', gap: 8, paddingTop: 4 },
         button: { height: 32, padding: '0 14px', borderRadius: 'var(--dsw-radius-md, 12px)', border: '.5px solid var(--dsw-alias-border-l4, rgba(0,0,0,.16))', background: 'transparent', color: 'var(--dsw-alias-label-primary, inherit)', cursor: 'pointer', fontSize: 13 },
         primary: { background: 'var(--dsw-alias-state-business-primary, #4d8dff)', borderColor: 'transparent', color: '#fff', fontWeight: 600 },
-        danger: { color: 'var(--dsw-alias-state-danger-primary, #d92d20)' },
+        danger: { color: 'var(--dsw-alias-state-error-primary, #d92d20)' },
         pill: { display: 'inline-flex', alignItems: 'center', gap: 6, padding: '3px 9px', borderRadius: 999, border: '.5px solid var(--dsw-alias-border-l4, rgba(0,0,0,.16))', fontSize: 11, color: 'var(--dsw-alias-label-secondary, #667085)' },
         dot: { width: 7, height: 7, borderRadius: 999, background: '#54d18a', display: 'inline-block' },
         dotOff: { width: 7, height: 7, borderRadius: 999, background: '#98a2b3', display: 'inline-block' },
         code: { fontFamily: 'ui-monospace, SFMono-Regular, Menlo, monospace', fontSize: 11, wordBreak: 'break-all', background: 'var(--dsw-alias-bg-layer-3, rgba(0,0,0,.04))', color: 'var(--dsw-alias-label-secondary, #475467)', padding: '6px 8px', borderRadius: 8 },
-        error: { color: 'var(--dsw-alias-state-danger-primary, #d92d20)', fontSize: 12, lineHeight: 1.5 },
+        error: { color: 'var(--dsw-alias-state-error-primary, #d92d20)', fontSize: 12, lineHeight: 1.5 },
         success: { color: 'var(--dsw-alias-state-success-primary, #079455)', fontSize: 12, lineHeight: 1.5 },
         divider: { height: 1, background: 'var(--dsw-alias-border-l4, rgba(0,0,0,.08))', margin: '6px 0' },
     };
@@ -125,7 +125,7 @@ window.__ModuleLoader__.load({
     }
     const CARD_CSS = `
     .enh-root input:not([type="checkbox"]):not([type="file"]), .enh-root select { transition:border-color .15s, box-shadow .15s; }
-    .enh-root input:not([type="checkbox"]):not([type="file"]):focus, .enh-root input:not([type="checkbox"]):not([type="file"]):focus-visible, .enh-root select:focus, .enh-root select:focus-visible { outline:none !important; border-color:var(--dsw-alias-state-business-primary, #4d8dff) !important; box-shadow:0 0 0 3px var(--dsw-alias-state-business-primary-a10, rgba(77,141,255,.18)) !important; }
+    .enh-root input:not([type="checkbox"]):not([type="file"]):focus, .enh-root input:not([type="checkbox"]):not([type="file"]):focus-visible, .enh-root select:focus, .enh-root select:focus-visible { outline:none !important; border-color:var(--dsw-alias-state-business-primary, #4d8dff) !important; box-shadow:0 0 0 3px color-mix(in srgb, var(--dsw-alias-state-business-primary, #4d8dff) 18%, transparent) !important; }
     .enh-root select { appearance:none; background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 12 12'%3E%3Cpath d='M3 4.5 6 7.5 9 4.5' fill='none' stroke='%23667085' stroke-width='1.4' stroke-linecap='round' stroke-linejoin='round'/%3E%3C/svg%3E"); background-repeat:no-repeat; background-position:right 12px center; padding-right:32px !important; }
     .enh-root input[type="file"] { font-size:12px; color:var(--dsw-alias-label-secondary, #475467); max-width:100%; }
     .enh-root input[type="file"]::file-selector-button { appearance:none; height:32px; margin-right:10px; padding:0 14px; border-radius:var(--dsw-radius-md, 12px); border:.5px solid var(--dsw-alias-border-l4, rgba(0,0,0,.16)); background:var(--dsw-alias-bg-layer-3, #fff); color:var(--dsw-alias-label-primary, inherit); font:inherit; font-size:13px; cursor:pointer; }
@@ -139,7 +139,7 @@ window.__ModuleLoader__.load({
     .enh-root input[type="checkbox"]:focus-visible { outline:2px solid var(--dsw-alias-state-business-primary, #4d8dff); outline-offset:2px; }
     
     .enh-root .enh-block-head { display:flex; align-items:flex-start; justify-content:space-between; gap:12px; }
-    .enh-root .enh-dirty { flex:none; font-size:11px; line-height:18px; padding:1px 8px; border-radius:999px; color:var(--dsw-alias-state-warning-primary, #b54708); background:var(--dsw-alias-state-warning-bg, rgba(247,144,9,.12)); border:.5px solid var(--dsw-alias-state-warning-primary-a30, rgba(181,71,8,.3)); }
+    .enh-root .enh-dirty { flex:none; font-size:11px; line-height:18px; padding:1px 8px; border-radius:999px; color:var(--dsw-alias-state-warn-primary, #b54708); background:color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 12%, transparent); border:.5px solid color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 30%, transparent); }
     .enh-root .enh-subhead { margin:14px 0 2px; font-size:13px; font-weight:600; color:var(--dsw-alias-label-primary, inherit); }
     .enh-root .enh-grid2 { display:grid; grid-template-columns:repeat(2,minmax(0,1fr)); gap:10px 16px; }
     .enh-root .enh-grid3 { display:grid; grid-template-columns:repeat(3,minmax(0,1fr)); gap:10px 16px; }
@@ -464,6 +464,10 @@ window.__ModuleLoader__.load({
                 throw new Error('Web Push 需要 HTTPS（或 localhost）；请先启用 HTTPS');
             if (!('serviceWorker' in navigator) || !('PushManager' in window))
                 throw new Error('当前浏览器不支持 Web Push');
+            // /sw.js 仅在启用 PWA 时注册；PWA 关闭时 Service Worker 不可用，Web Push 无从订阅。
+            const swProbe = await fetch('/sw.js', { method: 'HEAD', cache: 'no-store' }).catch(() => undefined);
+            if (!swProbe || !swProbe.ok)
+                throw new Error('Web Push 需要先启用 PWA（PWA 关闭时 Service Worker /sw.js 不可用）');
             if (!pushPublicKey)
                 throw new Error('VAPID 公钥尚未生成，请刷新状态后重试');
             let permission = Notification.permission;
@@ -698,21 +702,31 @@ window.__ModuleLoader__.load({
                 /* ignore */
             }
         };
+        const onMessage = (event) => {
+            const data = event.data;
+            if (data?.type === 'dsh-enhancement-open-session' && data.sessionId && SESSION_ID_PATTERN.test(data.sessionId))
+                openSession(ctx, data.sessionId);
+        };
         read();
         window.addEventListener('popstate', read);
         try {
-            navigator.serviceWorker?.addEventListener('message', (event) => {
-                const data = event.data;
-                if (data?.type === 'dsh-enhancement-open-session' && data.sessionId && SESSION_ID_PATTERN.test(data.sessionId))
-                    openSession(ctx, data.sessionId);
-            });
+            navigator.serviceWorker?.addEventListener('message', onMessage);
         }
         catch {
             /* service worker unavailable on HTTP */
         }
+        return () => {
+            window.removeEventListener('popstate', read);
+            try {
+                navigator.serviceWorker?.removeEventListener('message', onMessage);
+            }
+            catch {
+                /* ignore */
+            }
+        };
     }
     function apply(ctx) {
-        openSessionFromQuery(ctx);
+        ctx.effect(() => openSessionFromQuery(ctx), 'dsh-enhancement: open session from query');
         ctx.effect(() => connectFocusEvents(ctx), 'dsh-enhancement: focus existing page');
         ctx.effect(() => {
             return ctx.slots.inject('plugins.bundle.config', () => ctx.slots.register({

package/lib/gateway.js

@@ -12,6 +12,7 @@ import { createServer, request as httpRequest } from 'node:http';
 import { createServer as createHttpsServer } from 'node:https';
 import { connect as netConnect } from 'node:net';
 import { URL } from 'node:url';
+import { dirname } from 'node:path';
 import { SESSION_COOKIE, clearSessionCookie, formatHost, mintDshCookie, readDshSecret, requestAuthority, sessionCookie, signSession, verifySession, } from './state.js';
 import { caCertificatePem, prepareTls, tlsStatus } from './tls.js';
 const LOGIN_WINDOW_MS = 10 * 60 * 1000;
@@ -53,7 +54,9 @@ function parseCookies(header) {
 function safeNext(raw) {
     if (typeof raw !== 'string' || !raw.startsWith('/') || raw.startsWith('//'))
         return '/';
-    if (/[\r\n]/.test(raw))
+    // 反斜杠在 URL 解析中会被归一成斜杠（`/\evil.com` → `//evil.com`），构成开放重定向；
+    // 编码形式 %5c 同理，一并拒绝。CRLF 用于防响应拆分。
+    if (/[\r\n\\]/.test(raw) || /%5c|%2f%2f/i.test(raw))
         return '/';
     return raw;
 }
@@ -189,8 +192,7 @@ export class Gateway {
         }
         this.dshSecret = await readDshSecret(this.ctx);
         if (!this.dshSecret) {
-            this.log('warn', '无法读取 DSH 浏览器会话签名密钥；会在后台重试（网关自身仍可登录）');
-            this.scheduleDshSecretRetry();
+            this.log('warn', '无法读取 DSH 浏览器会话签名密钥；启动后会在后台重试（网关自身仍可登录）');
         }
         const handler = (req, res) => {
             void this.handleRequest(req, res).catch((err) => {
@@ -232,6 +234,10 @@ export class Gateway {
             server.listen(config.port, config.bindHost, () => {
                 server.off('error', onError);
                 this.started = true;
+                // 监听成功（started=true）后才安排密钥重试：此前的 scheduleDshSecretRetry
+                // 会因守卫 !this.started 直接返回，导致重试从不发生。
+                if (!this.dshSecret)
+                    this.scheduleDshSecretRetry();
                 this.log('info', `gateway listening on ${this.secure ? 'https' : 'http'}://${formatHost(config.bindHost)}:${config.port}`);
                 resolve();
             });
@@ -299,7 +305,7 @@ export class Gateway {
             dshOrigin: origin,
             dshAccessUrl,
             interfaces,
-            stateDir: this.store.statePath.replace(/\/state\.json$/, ''),
+            stateDir: dirname(this.store.statePath),
             statePath: this.store.statePath,
             error: this.error,
             https: tlsStatus(config, this.ctx.webServer.host),

package/lib/state.js

@@ -194,7 +194,16 @@ export class StateStore {
                 };
             }
             catch {
-                /* fall through to a fresh state; keep a warning via caller */
+                // 解析失败不能静默清空：先把损坏文件改名备份，再回落默认状态，避免用户
+                // 的密码哈希 / VAPID / 推送订阅被无提示地覆盖丢失。
+                try {
+                    const backup = `${this.statePath}.corrupt-${Date.now()}`;
+                    renameSync(this.statePath, backup);
+                    console.warn(`[dsh-enhancement] state.json 无法解析，已备份到 ${backup} 并以默认配置继续`);
+                }
+                catch {
+                    /* 备份失败也不阻塞启动 */
+                }
             }
         }
         const config = defaultConfig(this.webServerHost);
@@ -301,7 +310,7 @@ export function verifySession(secret, value) {
         return null;
     try {
         const payload = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));
-        if (payload.v !== 1 || typeof payload.exp !== 'number' || typeof payload.exp !== 'number')
+        if (payload.v !== 1 || typeof payload.sid !== 'string' || typeof payload.iat !== 'number' || typeof payload.exp !== 'number')
             return null;
         if (payload.exp <= Date.now())
             return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-enhancement",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "DSH 增强套件：远程安全访问网关（密码/HTTPS）、PWA 安装与图标、桌面通知与 Web Push、会话请求头、设置页。",
   "type": "module",
   "main": "./lib/index.js",
@@ -31,7 +31,8 @@
     "build": "tsc -p tsconfig.json && tsc -p tsconfig.client.json && node scripts/build-client.mjs",
     "verify": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.client.json --noEmit",
     "prepare": "npm run build",
-    "test": "node --test test/session-header.test.mjs"
+    "pretest": "npm run build",
+    "test": "node --test test/session-header.test.mjs test/gateway-auth.test.mjs"
   },
   "dsh": {
     "bundle": {
@@ -40,7 +41,6 @@
     "client": {
       "platform": "web",
       "inject": [
-        "@deepseek-ai/dsh-client-ui-slots",
         "@deepseek-ai/dsh-client-ui-workspace"
       ],
       "immediately": true

package/src/client/index.tsx

@@ -159,7 +159,7 @@ const styles: Record<string, React.CSSProperties> = {
   muted: { color: 'var(--dsw-alias-label-secondary, #667085)', fontSize: 12, lineHeight: 1.6 },
   card: { borderTop: '1px solid var(--dsw-alias-border-l4, rgba(0,0,0,.08))', padding: '16px 0 8px', display: 'flex', flexDirection: 'column', gap: 6, background: 'transparent' },
   blockHead: { display: 'flex', alignItems: 'flex-start', justifyContent: 'space-between', gap: 12 },
-  dirty: { flex: 'none', fontSize: 11, lineHeight: '18px', padding: '1px 8px', borderRadius: 999, color: 'var(--dsw-alias-state-warning-primary, #b54708)', background: 'var(--dsw-alias-state-warning-bg, rgba(247,144,9,.12))', border: '.5px solid var(--dsw-alias-state-warning-primary-a30, rgba(181,71,8,.3))' },
+  dirty: { flex: 'none', fontSize: 11, lineHeight: '18px', padding: '1px 8px', borderRadius: 999, color: 'var(--dsw-alias-state-warn-primary, #b54708)', background: 'color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 12%, transparent)', border: '.5px solid color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 30%, transparent)' },
   subhead: { margin: '14px 0 2px', fontSize: 13, fontWeight: 600, color: 'var(--dsw-alias-label-primary, inherit)' },
   row: { display: 'flex', flexDirection: 'column', gap: 6, padding: '10px 0' },
   label: { color: 'var(--dsw-alias-label-primary, inherit)', fontSize: 13, fontWeight: 500 },
@@ -170,12 +170,12 @@ const styles: Record<string, React.CSSProperties> = {
   actions: { display: 'flex', flexWrap: 'wrap', alignItems: 'center', gap: 8, paddingTop: 4 },
   button: { height: 32, padding: '0 14px', borderRadius: 'var(--dsw-radius-md, 12px)', border: '.5px solid var(--dsw-alias-border-l4, rgba(0,0,0,.16))', background: 'transparent', color: 'var(--dsw-alias-label-primary, inherit)', cursor: 'pointer', fontSize: 13 },
   primary: { background: 'var(--dsw-alias-state-business-primary, #4d8dff)', borderColor: 'transparent', color: '#fff', fontWeight: 600 },
-  danger: { color: 'var(--dsw-alias-state-danger-primary, #d92d20)' },
+  danger: { color: 'var(--dsw-alias-state-error-primary, #d92d20)' },
   pill: { display: 'inline-flex', alignItems: 'center', gap: 6, padding: '3px 9px', borderRadius: 999, border: '.5px solid var(--dsw-alias-border-l4, rgba(0,0,0,.16))', fontSize: 11, color: 'var(--dsw-alias-label-secondary, #667085)' },
   dot: { width: 7, height: 7, borderRadius: 999, background: '#54d18a', display: 'inline-block' },
   dotOff: { width: 7, height: 7, borderRadius: 999, background: '#98a2b3', display: 'inline-block' },
   code: { fontFamily: 'ui-monospace, SFMono-Regular, Menlo, monospace', fontSize: 11, wordBreak: 'break-all', background: 'var(--dsw-alias-bg-layer-3, rgba(0,0,0,.04))', color: 'var(--dsw-alias-label-secondary, #475467)', padding: '6px 8px', borderRadius: 8 },
-  error: { color: 'var(--dsw-alias-state-danger-primary, #d92d20)', fontSize: 12, lineHeight: 1.5 },
+  error: { color: 'var(--dsw-alias-state-error-primary, #d92d20)', fontSize: 12, lineHeight: 1.5 },
   success: { color: 'var(--dsw-alias-state-success-primary, #079455)', fontSize: 12, lineHeight: 1.5 },
   divider: { height: 1, background: 'var(--dsw-alias-border-l4, rgba(0,0,0,.08))', margin: '6px 0' },
 }
@@ -192,7 +192,7 @@ function Row(props: { label: string; children: React.ReactNode }): React.ReactEl
 
 const CARD_CSS = `
 .enh-root input:not([type="checkbox"]):not([type="file"]), .enh-root select { transition:border-color .15s, box-shadow .15s; }
-.enh-root input:not([type="checkbox"]):not([type="file"]):focus, .enh-root input:not([type="checkbox"]):not([type="file"]):focus-visible, .enh-root select:focus, .enh-root select:focus-visible { outline:none !important; border-color:var(--dsw-alias-state-business-primary, #4d8dff) !important; box-shadow:0 0 0 3px var(--dsw-alias-state-business-primary-a10, rgba(77,141,255,.18)) !important; }
+.enh-root input:not([type="checkbox"]):not([type="file"]):focus, .enh-root input:not([type="checkbox"]):not([type="file"]):focus-visible, .enh-root select:focus, .enh-root select:focus-visible { outline:none !important; border-color:var(--dsw-alias-state-business-primary, #4d8dff) !important; box-shadow:0 0 0 3px color-mix(in srgb, var(--dsw-alias-state-business-primary, #4d8dff) 18%, transparent) !important; }
 .enh-root select { appearance:none; background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 12 12'%3E%3Cpath d='M3 4.5 6 7.5 9 4.5' fill='none' stroke='%23667085' stroke-width='1.4' stroke-linecap='round' stroke-linejoin='round'/%3E%3C/svg%3E"); background-repeat:no-repeat; background-position:right 12px center; padding-right:32px !important; }
 .enh-root input[type="file"] { font-size:12px; color:var(--dsw-alias-label-secondary, #475467); max-width:100%; }
 .enh-root input[type="file"]::file-selector-button { appearance:none; height:32px; margin-right:10px; padding:0 14px; border-radius:var(--dsw-radius-md, 12px); border:.5px solid var(--dsw-alias-border-l4, rgba(0,0,0,.16)); background:var(--dsw-alias-bg-layer-3, #fff); color:var(--dsw-alias-label-primary, inherit); font:inherit; font-size:13px; cursor:pointer; }
@@ -206,7 +206,7 @@ const CARD_CSS = `
 .enh-root input[type="checkbox"]:focus-visible { outline:2px solid var(--dsw-alias-state-business-primary, #4d8dff); outline-offset:2px; }
 
 .enh-root .enh-block-head { display:flex; align-items:flex-start; justify-content:space-between; gap:12px; }
-.enh-root .enh-dirty { flex:none; font-size:11px; line-height:18px; padding:1px 8px; border-radius:999px; color:var(--dsw-alias-state-warning-primary, #b54708); background:var(--dsw-alias-state-warning-bg, rgba(247,144,9,.12)); border:.5px solid var(--dsw-alias-state-warning-primary-a30, rgba(181,71,8,.3)); }
+.enh-root .enh-dirty { flex:none; font-size:11px; line-height:18px; padding:1px 8px; border-radius:999px; color:var(--dsw-alias-state-warn-primary, #b54708); background:color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 12%, transparent); border:.5px solid color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 30%, transparent); }
 .enh-root .enh-subhead { margin:14px 0 2px; font-size:13px; font-weight:600; color:var(--dsw-alias-label-primary, inherit); }
 .enh-root .enh-grid2 { display:grid; grid-template-columns:repeat(2,minmax(0,1fr)); gap:10px 16px; }
 .enh-root .enh-grid3 { display:grid; grid-template-columns:repeat(3,minmax(0,1fr)); gap:10px 16px; }
@@ -625,6 +625,9 @@ function Card(): React.ReactElement {
   const enablePush = () => run(async () => {
     if (!window.isSecureContext) throw new Error('Web Push 需要 HTTPS（或 localhost）；请先启用 HTTPS')
     if (!('serviceWorker' in navigator) || !('PushManager' in window)) throw new Error('当前浏览器不支持 Web Push')
+    // /sw.js 仅在启用 PWA 时注册；PWA 关闭时 Service Worker 不可用，Web Push 无从订阅。
+    const swProbe = await fetch('/sw.js', { method: 'HEAD', cache: 'no-store' }).catch(() => undefined)
+    if (!swProbe || !swProbe.ok) throw new Error('Web Push 需要先启用 PWA（PWA 关闭时 Service Worker /sw.js 不可用）')
     if (!pushPublicKey) throw new Error('VAPID 公钥尚未生成，请刷新状态后重试')
     let permission = Notification.permission
     if (permission === 'default') permission = await Notification.requestPermission()
@@ -1210,7 +1213,7 @@ function connectFocusEvents(ctx: ClientContext): (() => void) | undefined {
   }
 }
 
-function openSessionFromQuery(ctx: ClientContext): void {
+function openSessionFromQuery(ctx: ClientContext): () => void {
   const read = () => {
     try {
       const url = new URL(location.href)
@@ -1223,20 +1226,29 @@ function openSessionFromQuery(ctx: ClientContext): void {
       /* ignore */
     }
   }
+  const onMessage = (event: MessageEvent) => {
+    const data = event.data as { type?: string; sessionId?: string } | undefined
+    if (data?.type === 'dsh-enhancement-open-session' && data.sessionId && SESSION_ID_PATTERN.test(data.sessionId)) openSession(ctx, data.sessionId)
+  }
   read()
   window.addEventListener('popstate', read)
   try {
-    navigator.serviceWorker?.addEventListener('message', (event) => {
-      const data = event.data as { type?: string; sessionId?: string } | undefined
-      if (data?.type === 'dsh-enhancement-open-session' && data.sessionId && SESSION_ID_PATTERN.test(data.sessionId)) openSession(ctx, data.sessionId)
-    })
+    navigator.serviceWorker?.addEventListener('message', onMessage)
   } catch {
     /* service worker unavailable on HTTP */
   }
+  return () => {
+    window.removeEventListener('popstate', read)
+    try {
+      navigator.serviceWorker?.removeEventListener('message', onMessage)
+    } catch {
+      /* ignore */
+    }
+  }
 }
 
 export function apply(ctx: ClientContext): void {
-  openSessionFromQuery(ctx)
+  ctx.effect(() => openSessionFromQuery(ctx), 'dsh-enhancement: open session from query')
   ctx.effect(() => connectFocusEvents(ctx), 'dsh-enhancement: focus existing page')
   ctx.effect(() => {
     return ctx.slots.inject('plugins.bundle.config', () =>

package/src/gateway.ts

@@ -12,6 +12,7 @@ import { createServer, request as httpRequest, type IncomingMessage, type Server
 import { createServer as createHttpsServer } from 'node:https'
 import { connect as netConnect, type Socket } from 'node:net'
 import { URL } from 'node:url'
+import { dirname } from 'node:path'
 import {
   SESSION_COOKIE,
   StateStore,
@@ -78,7 +79,9 @@ function parseCookies(header: string | undefined): Array<[string, string]> {
 
 function safeNext(raw: unknown): string {
   if (typeof raw !== 'string' || !raw.startsWith('/') || raw.startsWith('//')) return '/'
-  if (/[\r\n]/.test(raw)) return '/'
+  // 反斜杠在 URL 解析中会被归一成斜杠（`/\evil.com` → `//evil.com`），构成开放重定向；
+  // 编码形式 %5c 同理，一并拒绝。CRLF 用于防响应拆分。
+  if (/[\r\n\\]/.test(raw) || /%5c|%2f%2f/i.test(raw)) return '/'
   return raw
 }
 
@@ -213,8 +216,7 @@ export class Gateway {
     }
     this.dshSecret = await readDshSecret(this.ctx)
     if (!this.dshSecret) {
-      this.log('warn', '无法读取 DSH 浏览器会话签名密钥；会在后台重试（网关自身仍可登录）')
-      this.scheduleDshSecretRetry()
+      this.log('warn', '无法读取 DSH 浏览器会话签名密钥；启动后会在后台重试（网关自身仍可登录）')
     }
     const handler = (req: IncomingMessage, res: ServerResponse): void => {
       void this.handleRequest(req, res).catch((err: unknown) => {
@@ -256,6 +258,9 @@ export class Gateway {
       server.listen(config.port, config.bindHost, () => {
         server.off('error', onError)
         this.started = true
+        // 监听成功（started=true）后才安排密钥重试：此前的 scheduleDshSecretRetry
+        // 会因守卫 !this.started 直接返回，导致重试从不发生。
+        if (!this.dshSecret) this.scheduleDshSecretRetry()
         this.log('info', `gateway listening on ${this.secure ? 'https' : 'http'}://${formatHost(config.bindHost)}:${config.port}`)
         resolve()
       })
@@ -322,7 +327,7 @@ export class Gateway {
       dshOrigin: origin,
       dshAccessUrl,
       interfaces,
-      stateDir: this.store.statePath.replace(/\/state\.json$/, ''),
+      stateDir: dirname(this.store.statePath),
       statePath: this.store.statePath,
       error: this.error,
       https: tlsStatus(config, this.ctx.webServer.host),

package/src/state.ts

@@ -278,7 +278,15 @@ export class StateStore {
           updatedAt: nowIso(),
         }
       } catch {
-        /* fall through to a fresh state; keep a warning via caller */
+        // 解析失败不能静默清空：先把损坏文件改名备份，再回落默认状态，避免用户
+        // 的密码哈希 / VAPID / 推送订阅被无提示地覆盖丢失。
+        try {
+          const backup = `${this.statePath}.corrupt-${Date.now()}`
+          renameSync(this.statePath, backup)
+          console.warn(`[dsh-enhancement] state.json 无法解析，已备份到 ${backup} 并以默认配置继续`)
+        } catch {
+          /* 备份失败也不阻塞启动 */
+        }
       }
     }
     const config = defaultConfig(this.webServerHost)
@@ -404,7 +412,7 @@ export function verifySession(secret: string, value: string | undefined): Sessio
   if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) return null
   try {
     const payload = JSON.parse(Buffer.from(body, 'base64url').toString('utf8')) as SessionPayload
-    if (payload.v !== 1 || typeof payload.exp !== 'number' || typeof payload.exp !== 'number') return null
+    if (payload.v !== 1 || typeof payload.sid !== 'string' || typeof payload.iat !== 'number' || typeof payload.exp !== 'number') return null
     if (payload.exp <= Date.now()) return null
     return payload
   } catch {