dsh-enhancement 1.1.1 → 1.1.3

package/README.en.md

@@ -27,6 +27,7 @@ Set a password, open the gateway URL, and log in to DSH without carrying around
 - Choose which network interface to listen on.
 - Works with normal DSH chat, files, terminal, WebSocket, and live streams.
 - Configurable login session lifetime; changing the password invalidates all gateway sessions.
+- The gateway session cookie name is scoped by protocol and port, so multiple profiles/gateways on the same host never overwrite each other; changing the port requires logging in again.
 
 ## HTTPS
 
@@ -94,6 +95,7 @@ Clicking a desktop notification opens the matching session. On Linux and Windows
 ## Mobile push
 
 - Standard Web Push with one subscription per device.
+- **PWA must be enabled first**: the Service Worker (`/sw.js`) is served by the PWA feature, so push cannot be subscribed while PWA is off.
 - Click “Subscribe this device” in settings; the browser asks for notification permission, which must be triggered by your click.
 - iOS / iPadOS 16.4+ is required, and DSH must be added to the Home Screen; regular Safari tabs cannot receive push.
 - Unsubscribe at any time, or send a test push to verify the setup.

package/README.md

@@ -27,6 +27,7 @@
 - 可以选择监听的网卡地址，默认只在你指定的地址上提供服务。
 - 支持 DSH 的正常聊天、文件、终端、WebSocket 和实时流，不只是静态页面。
 - 可以设置登录会话的有效期；修改密码后，所有已登录的网关会话都会失效。
+- 网关会话 cookie 名按「协议 + 端口」区分，同机多 profile / 多网关互不覆盖；换端口需重新登录。
 
 ## HTTPS
 
@@ -95,6 +96,7 @@ DSH 只在直连官方 DeepSeek API 时发送 `x-deepseek-harness-session-id`；
 ## 手机推送
 
 - 使用标准 Web Push，每台设备单独订阅。
+- **需要先启用 PWA**：Service Worker（`/sw.js`）由 PWA 提供，PWA 关闭时无法订阅。
 - 在设置里点“订阅本设备”，浏览器会请求通知权限；权限必须由你主动点击触发。
 - iOS / iPadOS 需要 16.4 或更高版本，并且必须先把 DSH 添加到主屏幕；Safari 普通标签页收不到推送。
 - 可以随时取消订阅，或发送一条测试推送确认链路正常。

package/lib/client.js

@@ -100,7 +100,7 @@ window.__ModuleLoader__.load({
         muted: { color: 'var(--dsw-alias-label-secondary, #667085)', fontSize: 12, lineHeight: 1.6 },
         card: { borderTop: '1px solid var(--dsw-alias-border-l4, rgba(0,0,0,.08))', padding: '16px 0 8px', display: 'flex', flexDirection: 'column', gap: 6, background: 'transparent' },
         blockHead: { display: 'flex', alignItems: 'flex-start', justifyContent: 'space-between', gap: 12 },
-        dirty: { flex: 'none', fontSize: 11, lineHeight: '18px', padding: '1px 8px', borderRadius: 999, color: 'var(--dsw-alias-state-warning-primary, #b54708)', background: 'var(--dsw-alias-state-warning-bg, rgba(247,144,9,.12))', border: '.5px solid var(--dsw-alias-state-warning-primary-a30, rgba(181,71,8,.3))' },
+        dirty: { flex: 'none', fontSize: 11, lineHeight: '18px', padding: '1px 8px', borderRadius: 999, color: 'var(--dsw-alias-state-warn-primary, #b54708)', background: 'color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 12%, transparent)', border: '.5px solid color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 30%, transparent)' },
         subhead: { margin: '14px 0 2px', fontSize: 13, fontWeight: 600, color: 'var(--dsw-alias-label-primary, inherit)' },
         row: { display: 'flex', flexDirection: 'column', gap: 6, padding: '10px 0' },
         label: { color: 'var(--dsw-alias-label-primary, inherit)', fontSize: 13, fontWeight: 500 },
@@ -111,12 +111,12 @@ window.__ModuleLoader__.load({
         actions: { display: 'flex', flexWrap: 'wrap', alignItems: 'center', gap: 8, paddingTop: 4 },
         button: { height: 32, padding: '0 14px', borderRadius: 'var(--dsw-radius-md, 12px)', border: '.5px solid var(--dsw-alias-border-l4, rgba(0,0,0,.16))', background: 'transparent', color: 'var(--dsw-alias-label-primary, inherit)', cursor: 'pointer', fontSize: 13 },
         primary: { background: 'var(--dsw-alias-state-business-primary, #4d8dff)', borderColor: 'transparent', color: '#fff', fontWeight: 600 },
-        danger: { color: 'var(--dsw-alias-state-danger-primary, #d92d20)' },
+        danger: { color: 'var(--dsw-alias-state-error-primary, #d92d20)' },
         pill: { display: 'inline-flex', alignItems: 'center', gap: 6, padding: '3px 9px', borderRadius: 999, border: '.5px solid var(--dsw-alias-border-l4, rgba(0,0,0,.16))', fontSize: 11, color: 'var(--dsw-alias-label-secondary, #667085)' },
         dot: { width: 7, height: 7, borderRadius: 999, background: '#54d18a', display: 'inline-block' },
         dotOff: { width: 7, height: 7, borderRadius: 999, background: '#98a2b3', display: 'inline-block' },
         code: { fontFamily: 'ui-monospace, SFMono-Regular, Menlo, monospace', fontSize: 11, wordBreak: 'break-all', background: 'var(--dsw-alias-bg-layer-3, rgba(0,0,0,.04))', color: 'var(--dsw-alias-label-secondary, #475467)', padding: '6px 8px', borderRadius: 8 },
-        error: { color: 'var(--dsw-alias-state-danger-primary, #d92d20)', fontSize: 12, lineHeight: 1.5 },
+        error: { color: 'var(--dsw-alias-state-error-primary, #d92d20)', fontSize: 12, lineHeight: 1.5 },
         success: { color: 'var(--dsw-alias-state-success-primary, #079455)', fontSize: 12, lineHeight: 1.5 },
         divider: { height: 1, background: 'var(--dsw-alias-border-l4, rgba(0,0,0,.08))', margin: '6px 0' },
     };
@@ -125,7 +125,7 @@ window.__ModuleLoader__.load({
     }
     const CARD_CSS = `
     .enh-root input:not([type="checkbox"]):not([type="file"]), .enh-root select { transition:border-color .15s, box-shadow .15s; }
-    .enh-root input:not([type="checkbox"]):not([type="file"]):focus, .enh-root input:not([type="checkbox"]):not([type="file"]):focus-visible, .enh-root select:focus, .enh-root select:focus-visible { outline:none !important; border-color:var(--dsw-alias-state-business-primary, #4d8dff) !important; box-shadow:0 0 0 3px var(--dsw-alias-state-business-primary-a10, rgba(77,141,255,.18)) !important; }
+    .enh-root input:not([type="checkbox"]):not([type="file"]):focus, .enh-root input:not([type="checkbox"]):not([type="file"]):focus-visible, .enh-root select:focus, .enh-root select:focus-visible { outline:none !important; border-color:var(--dsw-alias-state-business-primary, #4d8dff) !important; box-shadow:0 0 0 3px color-mix(in srgb, var(--dsw-alias-state-business-primary, #4d8dff) 18%, transparent) !important; }
     .enh-root select { appearance:none; background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 12 12'%3E%3Cpath d='M3 4.5 6 7.5 9 4.5' fill='none' stroke='%23667085' stroke-width='1.4' stroke-linecap='round' stroke-linejoin='round'/%3E%3C/svg%3E"); background-repeat:no-repeat; background-position:right 12px center; padding-right:32px !important; }
     .enh-root input[type="file"] { font-size:12px; color:var(--dsw-alias-label-secondary, #475467); max-width:100%; }
     .enh-root input[type="file"]::file-selector-button { appearance:none; height:32px; margin-right:10px; padding:0 14px; border-radius:var(--dsw-radius-md, 12px); border:.5px solid var(--dsw-alias-border-l4, rgba(0,0,0,.16)); background:var(--dsw-alias-bg-layer-3, #fff); color:var(--dsw-alias-label-primary, inherit); font:inherit; font-size:13px; cursor:pointer; }
@@ -139,7 +139,7 @@ window.__ModuleLoader__.load({
     .enh-root input[type="checkbox"]:focus-visible { outline:2px solid var(--dsw-alias-state-business-primary, #4d8dff); outline-offset:2px; }
     
     .enh-root .enh-block-head { display:flex; align-items:flex-start; justify-content:space-between; gap:12px; }
-    .enh-root .enh-dirty { flex:none; font-size:11px; line-height:18px; padding:1px 8px; border-radius:999px; color:var(--dsw-alias-state-warning-primary, #b54708); background:var(--dsw-alias-state-warning-bg, rgba(247,144,9,.12)); border:.5px solid var(--dsw-alias-state-warning-primary-a30, rgba(181,71,8,.3)); }
+    .enh-root .enh-dirty { flex:none; font-size:11px; line-height:18px; padding:1px 8px; border-radius:999px; color:var(--dsw-alias-state-warn-primary, #b54708); background:color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 12%, transparent); border:.5px solid color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 30%, transparent); }
     .enh-root .enh-subhead { margin:14px 0 2px; font-size:13px; font-weight:600; color:var(--dsw-alias-label-primary, inherit); }
     .enh-root .enh-grid2 { display:grid; grid-template-columns:repeat(2,minmax(0,1fr)); gap:10px 16px; }
     .enh-root .enh-grid3 { display:grid; grid-template-columns:repeat(3,minmax(0,1fr)); gap:10px 16px; }
@@ -464,6 +464,10 @@ window.__ModuleLoader__.load({
                 throw new Error('Web Push 需要 HTTPS（或 localhost）；请先启用 HTTPS');
             if (!('serviceWorker' in navigator) || !('PushManager' in window))
                 throw new Error('当前浏览器不支持 Web Push');
+            // /sw.js 仅在启用 PWA 时注册；PWA 关闭时 Service Worker 不可用，Web Push 无从订阅。
+            const swProbe = await fetch('/sw.js', { method: 'HEAD', cache: 'no-store' }).catch(() => undefined);
+            if (!swProbe || !swProbe.ok)
+                throw new Error('Web Push 需要先启用 PWA（PWA 关闭时 Service Worker /sw.js 不可用）');
             if (!pushPublicKey)
                 throw new Error('VAPID 公钥尚未生成，请刷新状态后重试');
             let permission = Notification.permission;
@@ -698,21 +702,31 @@ window.__ModuleLoader__.load({
                 /* ignore */
             }
         };
+        const onMessage = (event) => {
+            const data = event.data;
+            if (data?.type === 'dsh-enhancement-open-session' && data.sessionId && SESSION_ID_PATTERN.test(data.sessionId))
+                openSession(ctx, data.sessionId);
+        };
         read();
         window.addEventListener('popstate', read);
         try {
-            navigator.serviceWorker?.addEventListener('message', (event) => {
-                const data = event.data;
-                if (data?.type === 'dsh-enhancement-open-session' && data.sessionId && SESSION_ID_PATTERN.test(data.sessionId))
-                    openSession(ctx, data.sessionId);
-            });
+            navigator.serviceWorker?.addEventListener('message', onMessage);
         }
         catch {
             /* service worker unavailable on HTTP */
         }
+        return () => {
+            window.removeEventListener('popstate', read);
+            try {
+                navigator.serviceWorker?.removeEventListener('message', onMessage);
+            }
+            catch {
+                /* ignore */
+            }
+        };
     }
     function apply(ctx) {
-        openSessionFromQuery(ctx);
+        ctx.effect(() => openSessionFromQuery(ctx), 'dsh-enhancement: open session from query');
         ctx.effect(() => connectFocusEvents(ctx), 'dsh-enhancement: focus existing page');
         ctx.effect(() => {
             return ctx.slots.inject('plugins.bundle.config', () => ctx.slots.register({

package/lib/gateway.d.ts

@@ -11,6 +11,8 @@ export declare class Gateway {
     private dshSecretTimer;
     private secure;
     private failures;
+    /** 本实例专属会话 cookie 名（协议 + 端口）。按当前实际监听状态推导：HTTPS 起失败回落 http 时名字也须是 http 变体。 */
+    private get sessionName();
     constructor(ctx: HostContextLike, store: StateStore);
     get running(): boolean;
     private log;

package/lib/gateway.js

@@ -12,7 +12,8 @@ import { createServer, request as httpRequest } from 'node:http';
 import { createServer as createHttpsServer } from 'node:https';
 import { connect as netConnect } from 'node:net';
 import { URL } from 'node:url';
-import { SESSION_COOKIE, clearSessionCookie, formatHost, mintDshCookie, readDshSecret, requestAuthority, sessionCookie, signSession, verifySession, } from './state.js';
+import { dirname } from 'node:path';
+import { SESSION_COOKIE_ALT, SESSION_COOKIE_LEGACY, clearSessionCookie, formatHost, mintDshCookie, readDshSecret, requestAuthority, sessionCookie, sessionCookieName, signSession, verifySession, } from './state.js';
 import { caCertificatePem, prepareTls, tlsStatus } from './tls.js';
 const LOGIN_WINDOW_MS = 10 * 60 * 1000;
 const LOGIN_LOCK_MS = 60 * 1000;
@@ -53,7 +54,9 @@ function parseCookies(header) {
 function safeNext(raw) {
     if (typeof raw !== 'string' || !raw.startsWith('/') || raw.startsWith('//'))
         return '/';
-    if (/[\r\n]/.test(raw))
+    // 反斜杠在 URL 解析中会被归一成斜杠（`/\evil.com` → `//evil.com`），构成开放重定向；
+    // 编码形式 %5c 同理，一并拒绝。CRLF 用于防响应拆分。
+    if (/[\r\n\\]/.test(raw) || /%5c|%2f%2f/i.test(raw))
         return '/';
     return raw;
 }
@@ -128,6 +131,11 @@ export class Gateway {
     dshSecretTimer = null;
     secure = false;
     failures = new Map();
+    /** 本实例专属会话 cookie 名（协议 + 端口）。按当前实际监听状态推导：HTTPS 起失败回落 http 时名字也须是 http 变体。 */
+    get sessionName() {
+        const protocol = this.secure ? 'https:' : 'http:';
+        return sessionCookieName(protocol, this.store.config.port);
+    }
     constructor(ctx, store) {
         this.ctx = ctx;
         this.store = store;
@@ -189,8 +197,7 @@ export class Gateway {
         }
         this.dshSecret = await readDshSecret(this.ctx);
         if (!this.dshSecret) {
-            this.log('warn', '无法读取 DSH 浏览器会话签名密钥；会在后台重试（网关自身仍可登录）');
-            this.scheduleDshSecretRetry();
+            this.log('warn', '无法读取 DSH 浏览器会话签名密钥；启动后会在后台重试（网关自身仍可登录）');
         }
         const handler = (req, res) => {
             void this.handleRequest(req, res).catch((err) => {
@@ -232,6 +239,10 @@ export class Gateway {
             server.listen(config.port, config.bindHost, () => {
                 server.off('error', onError);
                 this.started = true;
+                // 监听成功（started=true）后才安排密钥重试：此前的 scheduleDshSecretRetry
+                // 会因守卫 !this.started 直接返回，导致重试从不发生。
+                if (!this.dshSecret)
+                    this.scheduleDshSecretRetry();
                 this.log('info', `gateway listening on ${this.secure ? 'https' : 'http'}://${formatHost(config.bindHost)}:${config.port}`);
                 resolve();
             });
@@ -299,7 +310,7 @@ export class Gateway {
             dshOrigin: origin,
             dshAccessUrl,
             interfaces,
-            stateDir: this.store.statePath.replace(/\/state\.json$/, ''),
+            stateDir: dirname(this.store.statePath),
             statePath: this.store.statePath,
             error: this.error,
             https: tlsStatus(config, this.ctx.webServer.host),
@@ -356,8 +367,9 @@ export class Gateway {
     isAuthenticated(req) {
         if (!this.store.passwordSet)
             return false;
+        const accepted = new Set([this.sessionName, SESSION_COOKIE_LEGACY, SESSION_COOKIE_ALT]);
         for (const [name, value] of parseCookies(req.headers.cookie)) {
-            if (name !== SESSION_COOKIE)
+            if (!accepted.has(name))
                 continue;
             if (verifySession(this.store.gateSecret, value) !== null)
                 return true;
@@ -477,7 +489,7 @@ export class Gateway {
         if (path === '/__enhancement/logout') {
             res.writeHead(303, {
                 location: '/__enhancement/login',
-                'set-cookie': clearSessionCookie(this.secure),
+                'set-cookie': clearSessionCookie(this.sessionName, this.secure),
                 'cache-control': 'no-store',
             });
             res.end();
@@ -579,7 +591,10 @@ export class Gateway {
         const token = signSession(this.store.gateSecret, this.store.config.sessionDays);
         res.writeHead(303, {
             location: next,
-            'set-cookie': sessionCookie(token, this.store.config.sessionDays, this.secure),
+            'set-cookie': [
+                ...clearSessionCookie(this.sessionName, this.secure),
+                ...sessionCookie(this.sessionName, token, this.store.config.sessionDays, this.secure),
+            ],
             'cache-control': 'no-store',
         });
         res.end();

package/lib/state.d.ts

@@ -71,7 +71,21 @@ export interface CredentialRecordLike {
 export interface CredentialsLike {
     readRecord(key: string): Promise<CredentialRecordLike | undefined>;
 }
-export declare const SESSION_COOKIE = "dsh_enhancement_session";
+/**
+ * 会话 cookie 名的前缀。实际名字会带「协议 + 端口」后缀，见 {@link sessionCookieName}。
+ * 浏览器 cookie 身份只有 (name, domain, path)、不含端口；固定名会让同机不同端口
+ * （DSH 主服务 / 本网关 / 另一个 profile 的网关）共用一份 cookie 存储而互相覆盖。
+ */
+export declare const SESSION_COOKIE_PREFIX = "dsh_enhancement_session";
+/**
+ * 组装实例专属会话 cookie 名：https→s、http→i，后缀接端口；只用 RFC6265 token 允许的
+ * [A-Za-z0-9_-]。非法端口退回 'd'。例：dsh_enhancement_session_s3088。
+ */
+export declare function sessionCookieName(protocol: 'http:' | 'https:', port: number): string;
+/** 升级前的固定名：仅用于「读取旧会话」和「清除残值」，新会话一律写实例专属名。 */
+export declare const SESSION_COOKIE_LEGACY = "dsh_enhancement_session";
+/** 历史调试期用过的备用固定名，一并接受与清理。 */
+export declare const SESSION_COOKIE_ALT = "dsh_enhancement_sid";
 export declare const DSH_HOME: string;
 export declare const PROFILE_NAME: string;
 export declare const PROFILE_DIR: string;
@@ -128,7 +142,7 @@ export interface SessionPayload {
 }
 export declare function signSession(secret: string, days: number): string;
 export declare function verifySession(secret: string, value: string | undefined): SessionPayload | null;
-export declare function sessionCookie(value: string, days: number, secure: boolean): string;
+export declare function sessionCookie(name: string, value: string, days: number, secure: boolean): string[];
 /**
  * 清空会话 cookie 的 Set-Cookie 头（返回**多条**）。
  *
@@ -137,7 +151,7 @@ export declare function sessionCookie(value: string, days: number, secure: boole
  * `/__enhancement` 等其它 path 的残值，只清 `Path=/` 清不掉它们；这些验签失败的
  * 死值会让请求携带多份同名 cookie（见 Gateway#isAuthenticated 的注释）。
  */
-export declare function clearSessionCookie(secure: boolean): string[];
+export declare function clearSessionCookie(currentName: string, secure: boolean): string[];
 export declare function requestAuthority(host: string, protocol: 'http:' | 'https:'): string;
 export declare function mintDshCookie(secret: Buffer, authority: string, ttlMs: number): string;
 export declare function readDshSecret(ctx: {

package/lib/state.js

@@ -16,7 +16,25 @@ const SCRYPT_R = 8;
 const SCRYPT_P = 1;
 const KEY_BYTES = 64;
 const SECRET_BYTES = 32;
-export const SESSION_COOKIE = 'dsh_enhancement_session';
+/**
+ * 会话 cookie 名的前缀。实际名字会带「协议 + 端口」后缀，见 {@link sessionCookieName}。
+ * 浏览器 cookie 身份只有 (name, domain, path)、不含端口；固定名会让同机不同端口
+ * （DSH 主服务 / 本网关 / 另一个 profile 的网关）共用一份 cookie 存储而互相覆盖。
+ */
+export const SESSION_COOKIE_PREFIX = 'dsh_enhancement_session';
+/**
+ * 组装实例专属会话 cookie 名：https→s、http→i，后缀接端口；只用 RFC6265 token 允许的
+ * [A-Za-z0-9_-]。非法端口退回 'd'。例：dsh_enhancement_session_s3088。
+ */
+export function sessionCookieName(protocol, port) {
+    const scheme = protocol === 'https:' ? 's' : 'i';
+    const safePort = Number.isInteger(port) && port > 0 && port <= 65535 ? port : 'd';
+    return `${SESSION_COOKIE_PREFIX}_${scheme}${safePort}`;
+}
+/** 升级前的固定名：仅用于「读取旧会话」和「清除残值」，新会话一律写实例专属名。 */
+export const SESSION_COOKIE_LEGACY = SESSION_COOKIE_PREFIX;
+/** 历史调试期用过的备用固定名，一并接受与清理。 */
+export const SESSION_COOKIE_ALT = 'dsh_enhancement_sid';
 export const DSH_HOME = process.env.DSH_HOME || join(homedir(), '.dsh');
 /** 从 CLI 参数解析当前 profile；systemd 默认 web。 */
 function activeProfileName() {
@@ -194,7 +212,16 @@ export class StateStore {
                 };
             }
             catch {
-                /* fall through to a fresh state; keep a warning via caller */
+                // 解析失败不能静默清空：先把损坏文件改名备份，再回落默认状态，避免用户
+                // 的密码哈希 / VAPID / 推送订阅被无提示地覆盖丢失。
+                try {
+                    const backup = `${this.statePath}.corrupt-${Date.now()}`;
+                    renameSync(this.statePath, backup);
+                    console.warn(`[dsh-enhancement] state.json 无法解析，已备份到 ${backup} 并以默认配置继续`);
+                }
+                catch {
+                    /* 备份失败也不阻塞启动 */
+                }
             }
         }
         const config = defaultConfig(this.webServerHost);
@@ -301,7 +328,7 @@ export function verifySession(secret, value) {
         return null;
     try {
         const payload = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));
-        if (payload.v !== 1 || typeof payload.exp !== 'number' || typeof payload.exp !== 'number')
+        if (payload.v !== 1 || typeof payload.sid !== 'string' || typeof payload.iat !== 'number' || typeof payload.exp !== 'number')
             return null;
         if (payload.exp <= Date.now())
             return null;
@@ -311,17 +338,10 @@ export function verifySession(secret, value) {
         return null;
     }
 }
-export function sessionCookie(value, days, secure) {
-    const attrs = [
-        `${SESSION_COOKIE}=${value}`,
-        `Max-Age=${Math.max(1, Math.floor(days * 86400))}`,
-        'Path=/',
-        'HttpOnly',
-        'SameSite=Strict',
-    ];
-    if (secure)
-        attrs.push('Secure');
-    return attrs.join('; ');
+export function sessionCookie(name, value, days, secure) {
+    const maxAge = Math.max(1, Math.floor(days * 86400));
+    const tail = `Max-Age=${maxAge}; Path=/; HttpOnly; SameSite=Strict${secure ? '; Secure' : ''}`;
+    return [`${name}=${value}; ${tail}`];
 }
 /**
  * 清空会话 cookie 的 Set-Cookie 头（返回**多条**）。
@@ -331,9 +351,16 @@ export function sessionCookie(value, days, secure) {
  * `/__enhancement` 等其它 path 的残值，只清 `Path=/` 清不掉它们；这些验签失败的
  * 死值会让请求携带多份同名 cookie（见 Gateway#isAuthenticated 的注释）。
  */
-export function clearSessionCookie(secure) {
+export function clearSessionCookie(currentName, secure) {
     const tail = `Max-Age=0; HttpOnly; SameSite=Strict${secure ? '; Secure' : ''}`;
-    return ['/', '/__enhancement', '/__enhancement/login'].map((path) => `${SESSION_COOKIE}=; Path=${path}; ${tail}`);
+    const names = [...new Set([currentName, SESSION_COOKIE_LEGACY, SESSION_COOKIE_ALT])];
+    const out = [];
+    for (const name of names) {
+        for (const path of ['/', '/__enhancement', '/__enhancement/login']) {
+            out.push(`${name}=; Path=${path}; ${tail}`);
+        }
+    }
+    return out;
 }
 // ---------------------------------------------------------------------------
 // DSH 会话 cookie 签发（与 @deepseek-ai/dsh-client-connection 的 v1 格式一致）

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-enhancement",
-  "version": "1.1.1",
+  "version": "1.1.3",
   "description": "DSH 增强套件：远程安全访问网关（密码/HTTPS）、PWA 安装与图标、桌面通知与 Web Push、会话请求头、设置页。",
   "type": "module",
   "main": "./lib/index.js",
@@ -31,7 +31,8 @@
     "build": "tsc -p tsconfig.json && tsc -p tsconfig.client.json && node scripts/build-client.mjs",
     "verify": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.client.json --noEmit",
     "prepare": "npm run build",
-    "test": "node --test test/session-header.test.mjs"
+    "pretest": "npm run build",
+    "test": "node --test test/session-header.test.mjs test/gateway-auth.test.mjs"
   },
   "dsh": {
     "bundle": {
@@ -40,7 +41,6 @@
     "client": {
       "platform": "web",
       "inject": [
-        "@deepseek-ai/dsh-client-ui-slots",
         "@deepseek-ai/dsh-client-ui-workspace"
       ],
       "immediately": true

package/src/client/index.tsx

@@ -159,7 +159,7 @@ const styles: Record<string, React.CSSProperties> = {
   muted: { color: 'var(--dsw-alias-label-secondary, #667085)', fontSize: 12, lineHeight: 1.6 },
   card: { borderTop: '1px solid var(--dsw-alias-border-l4, rgba(0,0,0,.08))', padding: '16px 0 8px', display: 'flex', flexDirection: 'column', gap: 6, background: 'transparent' },
   blockHead: { display: 'flex', alignItems: 'flex-start', justifyContent: 'space-between', gap: 12 },
-  dirty: { flex: 'none', fontSize: 11, lineHeight: '18px', padding: '1px 8px', borderRadius: 999, color: 'var(--dsw-alias-state-warning-primary, #b54708)', background: 'var(--dsw-alias-state-warning-bg, rgba(247,144,9,.12))', border: '.5px solid var(--dsw-alias-state-warning-primary-a30, rgba(181,71,8,.3))' },
+  dirty: { flex: 'none', fontSize: 11, lineHeight: '18px', padding: '1px 8px', borderRadius: 999, color: 'var(--dsw-alias-state-warn-primary, #b54708)', background: 'color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 12%, transparent)', border: '.5px solid color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 30%, transparent)' },
   subhead: { margin: '14px 0 2px', fontSize: 13, fontWeight: 600, color: 'var(--dsw-alias-label-primary, inherit)' },
   row: { display: 'flex', flexDirection: 'column', gap: 6, padding: '10px 0' },
   label: { color: 'var(--dsw-alias-label-primary, inherit)', fontSize: 13, fontWeight: 500 },
@@ -170,12 +170,12 @@ const styles: Record<string, React.CSSProperties> = {
   actions: { display: 'flex', flexWrap: 'wrap', alignItems: 'center', gap: 8, paddingTop: 4 },
   button: { height: 32, padding: '0 14px', borderRadius: 'var(--dsw-radius-md, 12px)', border: '.5px solid var(--dsw-alias-border-l4, rgba(0,0,0,.16))', background: 'transparent', color: 'var(--dsw-alias-label-primary, inherit)', cursor: 'pointer', fontSize: 13 },
   primary: { background: 'var(--dsw-alias-state-business-primary, #4d8dff)', borderColor: 'transparent', color: '#fff', fontWeight: 600 },
-  danger: { color: 'var(--dsw-alias-state-danger-primary, #d92d20)' },
+  danger: { color: 'var(--dsw-alias-state-error-primary, #d92d20)' },
   pill: { display: 'inline-flex', alignItems: 'center', gap: 6, padding: '3px 9px', borderRadius: 999, border: '.5px solid var(--dsw-alias-border-l4, rgba(0,0,0,.16))', fontSize: 11, color: 'var(--dsw-alias-label-secondary, #667085)' },
   dot: { width: 7, height: 7, borderRadius: 999, background: '#54d18a', display: 'inline-block' },
   dotOff: { width: 7, height: 7, borderRadius: 999, background: '#98a2b3', display: 'inline-block' },
   code: { fontFamily: 'ui-monospace, SFMono-Regular, Menlo, monospace', fontSize: 11, wordBreak: 'break-all', background: 'var(--dsw-alias-bg-layer-3, rgba(0,0,0,.04))', color: 'var(--dsw-alias-label-secondary, #475467)', padding: '6px 8px', borderRadius: 8 },
-  error: { color: 'var(--dsw-alias-state-danger-primary, #d92d20)', fontSize: 12, lineHeight: 1.5 },
+  error: { color: 'var(--dsw-alias-state-error-primary, #d92d20)', fontSize: 12, lineHeight: 1.5 },
   success: { color: 'var(--dsw-alias-state-success-primary, #079455)', fontSize: 12, lineHeight: 1.5 },
   divider: { height: 1, background: 'var(--dsw-alias-border-l4, rgba(0,0,0,.08))', margin: '6px 0' },
 }
@@ -192,7 +192,7 @@ function Row(props: { label: string; children: React.ReactNode }): React.ReactEl
 
 const CARD_CSS = `
 .enh-root input:not([type="checkbox"]):not([type="file"]), .enh-root select { transition:border-color .15s, box-shadow .15s; }
-.enh-root input:not([type="checkbox"]):not([type="file"]):focus, .enh-root input:not([type="checkbox"]):not([type="file"]):focus-visible, .enh-root select:focus, .enh-root select:focus-visible { outline:none !important; border-color:var(--dsw-alias-state-business-primary, #4d8dff) !important; box-shadow:0 0 0 3px var(--dsw-alias-state-business-primary-a10, rgba(77,141,255,.18)) !important; }
+.enh-root input:not([type="checkbox"]):not([type="file"]):focus, .enh-root input:not([type="checkbox"]):not([type="file"]):focus-visible, .enh-root select:focus, .enh-root select:focus-visible { outline:none !important; border-color:var(--dsw-alias-state-business-primary, #4d8dff) !important; box-shadow:0 0 0 3px color-mix(in srgb, var(--dsw-alias-state-business-primary, #4d8dff) 18%, transparent) !important; }
 .enh-root select { appearance:none; background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 12 12'%3E%3Cpath d='M3 4.5 6 7.5 9 4.5' fill='none' stroke='%23667085' stroke-width='1.4' stroke-linecap='round' stroke-linejoin='round'/%3E%3C/svg%3E"); background-repeat:no-repeat; background-position:right 12px center; padding-right:32px !important; }
 .enh-root input[type="file"] { font-size:12px; color:var(--dsw-alias-label-secondary, #475467); max-width:100%; }
 .enh-root input[type="file"]::file-selector-button { appearance:none; height:32px; margin-right:10px; padding:0 14px; border-radius:var(--dsw-radius-md, 12px); border:.5px solid var(--dsw-alias-border-l4, rgba(0,0,0,.16)); background:var(--dsw-alias-bg-layer-3, #fff); color:var(--dsw-alias-label-primary, inherit); font:inherit; font-size:13px; cursor:pointer; }
@@ -206,7 +206,7 @@ const CARD_CSS = `
 .enh-root input[type="checkbox"]:focus-visible { outline:2px solid var(--dsw-alias-state-business-primary, #4d8dff); outline-offset:2px; }
 
 .enh-root .enh-block-head { display:flex; align-items:flex-start; justify-content:space-between; gap:12px; }
-.enh-root .enh-dirty { flex:none; font-size:11px; line-height:18px; padding:1px 8px; border-radius:999px; color:var(--dsw-alias-state-warning-primary, #b54708); background:var(--dsw-alias-state-warning-bg, rgba(247,144,9,.12)); border:.5px solid var(--dsw-alias-state-warning-primary-a30, rgba(181,71,8,.3)); }
+.enh-root .enh-dirty { flex:none; font-size:11px; line-height:18px; padding:1px 8px; border-radius:999px; color:var(--dsw-alias-state-warn-primary, #b54708); background:color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 12%, transparent); border:.5px solid color-mix(in srgb, var(--dsw-alias-state-warn-primary, #b54708) 30%, transparent); }
 .enh-root .enh-subhead { margin:14px 0 2px; font-size:13px; font-weight:600; color:var(--dsw-alias-label-primary, inherit); }
 .enh-root .enh-grid2 { display:grid; grid-template-columns:repeat(2,minmax(0,1fr)); gap:10px 16px; }
 .enh-root .enh-grid3 { display:grid; grid-template-columns:repeat(3,minmax(0,1fr)); gap:10px 16px; }
@@ -625,6 +625,9 @@ function Card(): React.ReactElement {
   const enablePush = () => run(async () => {
     if (!window.isSecureContext) throw new Error('Web Push 需要 HTTPS（或 localhost）；请先启用 HTTPS')
     if (!('serviceWorker' in navigator) || !('PushManager' in window)) throw new Error('当前浏览器不支持 Web Push')
+    // /sw.js 仅在启用 PWA 时注册；PWA 关闭时 Service Worker 不可用，Web Push 无从订阅。
+    const swProbe = await fetch('/sw.js', { method: 'HEAD', cache: 'no-store' }).catch(() => undefined)
+    if (!swProbe || !swProbe.ok) throw new Error('Web Push 需要先启用 PWA（PWA 关闭时 Service Worker /sw.js 不可用）')
     if (!pushPublicKey) throw new Error('VAPID 公钥尚未生成，请刷新状态后重试')
     let permission = Notification.permission
     if (permission === 'default') permission = await Notification.requestPermission()
@@ -1210,7 +1213,7 @@ function connectFocusEvents(ctx: ClientContext): (() => void) | undefined {
   }
 }
 
-function openSessionFromQuery(ctx: ClientContext): void {
+function openSessionFromQuery(ctx: ClientContext): () => void {
   const read = () => {
     try {
       const url = new URL(location.href)
@@ -1223,20 +1226,29 @@ function openSessionFromQuery(ctx: ClientContext): void {
       /* ignore */
     }
   }
+  const onMessage = (event: MessageEvent) => {
+    const data = event.data as { type?: string; sessionId?: string } | undefined
+    if (data?.type === 'dsh-enhancement-open-session' && data.sessionId && SESSION_ID_PATTERN.test(data.sessionId)) openSession(ctx, data.sessionId)
+  }
   read()
   window.addEventListener('popstate', read)
   try {
-    navigator.serviceWorker?.addEventListener('message', (event) => {
-      const data = event.data as { type?: string; sessionId?: string } | undefined
-      if (data?.type === 'dsh-enhancement-open-session' && data.sessionId && SESSION_ID_PATTERN.test(data.sessionId)) openSession(ctx, data.sessionId)
-    })
+    navigator.serviceWorker?.addEventListener('message', onMessage)
   } catch {
     /* service worker unavailable on HTTP */
   }
+  return () => {
+    window.removeEventListener('popstate', read)
+    try {
+      navigator.serviceWorker?.removeEventListener('message', onMessage)
+    } catch {
+      /* ignore */
+    }
+  }
 }
 
 export function apply(ctx: ClientContext): void {
-  openSessionFromQuery(ctx)
+  ctx.effect(() => openSessionFromQuery(ctx), 'dsh-enhancement: open session from query')
   ctx.effect(() => connectFocusEvents(ctx), 'dsh-enhancement: focus existing page')
   ctx.effect(() => {
     return ctx.slots.inject('plugins.bundle.config', () =>

package/src/gateway.ts

@@ -12,8 +12,10 @@ import { createServer, request as httpRequest, type IncomingMessage, type Server
 import { createServer as createHttpsServer } from 'node:https'
 import { connect as netConnect, type Socket } from 'node:net'
 import { URL } from 'node:url'
+import { dirname } from 'node:path'
 import {
-  SESSION_COOKIE,
+  SESSION_COOKIE_ALT,
+  SESSION_COOKIE_LEGACY,
   StateStore,
   clearSessionCookie,
   formatHost,
@@ -21,6 +23,7 @@ import {
   readDshSecret,
   requestAuthority,
   sessionCookie,
+  sessionCookieName,
   signSession,
   verifySession,
 } from './state.js'
@@ -78,7 +81,9 @@ function parseCookies(header: string | undefined): Array<[string, string]> {
 
 function safeNext(raw: unknown): string {
   if (typeof raw !== 'string' || !raw.startsWith('/') || raw.startsWith('//')) return '/'
-  if (/[\r\n]/.test(raw)) return '/'
+  // 反斜杠在 URL 解析中会被归一成斜杠（`/\evil.com` → `//evil.com`），构成开放重定向；
+  // 编码形式 %5c 同理，一并拒绝。CRLF 用于防响应拆分。
+  if (/[\r\n\\]/.test(raw) || /%5c|%2f%2f/i.test(raw)) return '/'
   return raw
 }
 
@@ -153,6 +158,12 @@ export class Gateway {
   private secure = false
   private failures = new Map<string, LoginFailure>()
 
+  /** 本实例专属会话 cookie 名（协议 + 端口）。按当前实际监听状态推导：HTTPS 起失败回落 http 时名字也须是 http 变体。 */
+  private get sessionName(): string {
+    const protocol = this.secure ? 'https:' : 'http:'
+    return sessionCookieName(protocol, this.store.config.port)
+  }
+
   constructor(
     private readonly ctx: HostContextLike,
     private readonly store: StateStore,
@@ -213,8 +224,7 @@ export class Gateway {
     }
     this.dshSecret = await readDshSecret(this.ctx)
     if (!this.dshSecret) {
-      this.log('warn', '无法读取 DSH 浏览器会话签名密钥；会在后台重试（网关自身仍可登录）')
-      this.scheduleDshSecretRetry()
+      this.log('warn', '无法读取 DSH 浏览器会话签名密钥；启动后会在后台重试（网关自身仍可登录）')
     }
     const handler = (req: IncomingMessage, res: ServerResponse): void => {
       void this.handleRequest(req, res).catch((err: unknown) => {
@@ -256,6 +266,9 @@ export class Gateway {
       server.listen(config.port, config.bindHost, () => {
         server.off('error', onError)
         this.started = true
+        // 监听成功（started=true）后才安排密钥重试：此前的 scheduleDshSecretRetry
+        // 会因守卫 !this.started 直接返回，导致重试从不发生。
+        if (!this.dshSecret) this.scheduleDshSecretRetry()
         this.log('info', `gateway listening on ${this.secure ? 'https' : 'http'}://${formatHost(config.bindHost)}:${config.port}`)
         resolve()
       })
@@ -322,7 +335,7 @@ export class Gateway {
       dshOrigin: origin,
       dshAccessUrl,
       interfaces,
-      stateDir: this.store.statePath.replace(/\/state\.json$/, ''),
+      stateDir: dirname(this.store.statePath),
       statePath: this.store.statePath,
       error: this.error,
       https: tlsStatus(config, this.ctx.webServer.host),
@@ -380,8 +393,9 @@ export class Gateway {
    */
   private isAuthenticated(req: IncomingMessage): boolean {
     if (!this.store.passwordSet) return false
+    const accepted = new Set([this.sessionName, SESSION_COOKIE_LEGACY, SESSION_COOKIE_ALT])
     for (const [name, value] of parseCookies(req.headers.cookie)) {
-      if (name !== SESSION_COOKIE) continue
+      if (!accepted.has(name)) continue
       if (verifySession(this.store.gateSecret, value) !== null) return true
     }
     return false
@@ -493,7 +507,7 @@ export class Gateway {
     if (path === '/__enhancement/logout') {
       res.writeHead(303, {
         location: '/__enhancement/login',
-        'set-cookie': clearSessionCookie(this.secure),
+        'set-cookie': clearSessionCookie(this.sessionName, this.secure),
         'cache-control': 'no-store',
       })
       res.end()
@@ -601,7 +615,10 @@ export class Gateway {
     const token = signSession(this.store.gateSecret, this.store.config.sessionDays)
     res.writeHead(303, {
       location: next,
-      'set-cookie': sessionCookie(token, this.store.config.sessionDays, this.secure),
+      'set-cookie': [
+        ...clearSessionCookie(this.sessionName, this.secure),
+        ...sessionCookie(this.sessionName, token, this.store.config.sessionDays, this.secure),
+      ],
       'cache-control': 'no-store',
     })
     res.end()

package/src/state.ts

@@ -94,7 +94,28 @@ const SCRYPT_P = 1
 const KEY_BYTES = 64
 const SECRET_BYTES = 32
 
-export const SESSION_COOKIE = 'dsh_enhancement_session'
+/**
+ * 会话 cookie 名的前缀。实际名字会带「协议 + 端口」后缀，见 {@link sessionCookieName}。
+ * 浏览器 cookie 身份只有 (name, domain, path)、不含端口；固定名会让同机不同端口
+ * （DSH 主服务 / 本网关 / 另一个 profile 的网关）共用一份 cookie 存储而互相覆盖。
+ */
+export const SESSION_COOKIE_PREFIX = 'dsh_enhancement_session'
+
+/**
+ * 组装实例专属会话 cookie 名：https→s、http→i，后缀接端口；只用 RFC6265 token 允许的
+ * [A-Za-z0-9_-]。非法端口退回 'd'。例：dsh_enhancement_session_s3088。
+ */
+export function sessionCookieName(protocol: 'http:' | 'https:', port: number): string {
+  const scheme = protocol === 'https:' ? 's' : 'i'
+  const safePort = Number.isInteger(port) && port > 0 && port <= 65535 ? port : 'd'
+  return `${SESSION_COOKIE_PREFIX}_${scheme}${safePort}`
+}
+
+/** 升级前的固定名：仅用于「读取旧会话」和「清除残值」，新会话一律写实例专属名。 */
+export const SESSION_COOKIE_LEGACY = SESSION_COOKIE_PREFIX
+
+/** 历史调试期用过的备用固定名，一并接受与清理。 */
+export const SESSION_COOKIE_ALT = 'dsh_enhancement_sid'
 export const DSH_HOME = process.env.DSH_HOME || join(homedir(), '.dsh')
 
 /** 从 CLI 参数解析当前 profile；systemd 默认 web。 */
@@ -278,7 +299,15 @@ export class StateStore {
           updatedAt: nowIso(),
         }
       } catch {
-        /* fall through to a fresh state; keep a warning via caller */
+        // 解析失败不能静默清空：先把损坏文件改名备份，再回落默认状态，避免用户
+        // 的密码哈希 / VAPID / 推送订阅被无提示地覆盖丢失。
+        try {
+          const backup = `${this.statePath}.corrupt-${Date.now()}`
+          renameSync(this.statePath, backup)
+          console.warn(`[dsh-enhancement] state.json 无法解析，已备份到 ${backup} 并以默认配置继续`)
+        } catch {
+          /* 备份失败也不阻塞启动 */
+        }
       }
     }
     const config = defaultConfig(this.webServerHost)
@@ -404,7 +433,7 @@ export function verifySession(secret: string, value: string | undefined): Sessio
   if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) return null
   try {
     const payload = JSON.parse(Buffer.from(body, 'base64url').toString('utf8')) as SessionPayload
-    if (payload.v !== 1 || typeof payload.exp !== 'number' || typeof payload.exp !== 'number') return null
+    if (payload.v !== 1 || typeof payload.sid !== 'string' || typeof payload.iat !== 'number' || typeof payload.exp !== 'number') return null
     if (payload.exp <= Date.now()) return null
     return payload
   } catch {
@@ -412,16 +441,10 @@ export function verifySession(secret: string, value: string | undefined): Sessio
   }
 }
 
-export function sessionCookie(value: string, days: number, secure: boolean): string {
-  const attrs = [
-    `${SESSION_COOKIE}=${value}`,
-    `Max-Age=${Math.max(1, Math.floor(days * 86400))}`,
-    'Path=/',
-    'HttpOnly',
-    'SameSite=Strict',
-  ]
-  if (secure) attrs.push('Secure')
-  return attrs.join('; ')
+export function sessionCookie(name: string, value: string, days: number, secure: boolean): string[] {
+  const maxAge = Math.max(1, Math.floor(days * 86400))
+  const tail = `Max-Age=${maxAge}; Path=/; HttpOnly; SameSite=Strict${secure ? '; Secure' : ''}`
+  return [`${name}=${value}; ${tail}`]
 }
 
 /**
@@ -432,11 +455,16 @@ export function sessionCookie(value: string, days: number, secure: boolean): str
  * `/__enhancement` 等其它 path 的残值，只清 `Path=/` 清不掉它们；这些验签失败的
  * 死值会让请求携带多份同名 cookie（见 Gateway#isAuthenticated 的注释）。
  */
-export function clearSessionCookie(secure: boolean): string[] {
+export function clearSessionCookie(currentName: string, secure: boolean): string[] {
   const tail = `Max-Age=0; HttpOnly; SameSite=Strict${secure ? '; Secure' : ''}`
-  return ['/', '/__enhancement', '/__enhancement/login'].map(
-    (path) => `${SESSION_COOKIE}=; Path=${path}; ${tail}`,
-  )
+  const names = [...new Set([currentName, SESSION_COOKIE_LEGACY, SESSION_COOKIE_ALT])]
+  const out: string[] = []
+  for (const name of names) {
+    for (const path of ['/', '/__enhancement', '/__enhancement/login']) {
+      out.push(`${name}=; Path=${path}; ${tail}`)
+    }
+  }
+  return out
 }
 
 // ---------------------------------------------------------------------------

package/test/gateway-auth.test.mjs

@@ -1,14 +1,16 @@
-// 网关会话认证的回归测试。
+// 网关会话 cookie 的回归测试。
 //
-// 覆盖两个真实缺陷（与任何 PWA / 样式改动无关，属独立 bug 修复）：
+// 覆盖 2026-10-24 真机报障：「密码正确、点进入 DSH 后停在登录页，且不提示密码错误」。
 //
-// 1. **同名 cookie 只读第一个**：浏览器按 (name, domain, path) 存 cookie，重复项
-//    顺序由浏览器决定。旧实现用 `find()` 取第一个，一旦过期的旧值排在前面就永久
-//    认证失败 —— 表现是「密码正确、刷新又回登录页，且不报密码错误」，用户无法
-//    自愈（除非手动清 cookie）。
-//
-// 2. **清除 cookie 只清 Path=/**：`/__enhancement` 等其它 path 上的残值清不掉，
-//    它们会一直跟着每个请求，让上面的问题复现。
+// 两代根因，都在这里钉住：
+// 1. 认证只看**第一个**同名 cookie。浏览器按 (name, domain, path) 存 cookie，重复项
+//    顺序由浏览器决定，坏值排前面就永久认证失败。
+// 2. 会话 cookie 名是**固定**的。HTTP cookie 身份不含端口，于是同一 IP 上的不同
+//    端口（DSH 主服务 / 本网关 / 另一个 profile 的网关）共用一份存储：
+//    - 换端口后旧会话仍被带上（本该重新登录却没有）；
+//    - 混用协议时更糟：https 端口留下的 Secure cookie 在 http 端口既不发送、也无法
+//      被非 Secure 的 Set-Cookie 覆盖 → 新会话永远存不住 → 反复退回登录页。
+//    现在名字带「协议 + 端口」后缀，每实例独立槽位。
 //
 // 运行：node --test test/gateway-auth.test.mjs
 import { test } from 'node:test'
@@ -16,9 +18,12 @@ import assert from 'node:assert/strict'
 import {
   clearSessionCookie,
   sessionCookie,
+  sessionCookieName,
   signSession,
   verifySession,
-  SESSION_COOKIE,
+  SESSION_COOKIE_ALT,
+  SESSION_COOKIE_LEGACY,
+  SESSION_COOKIE_PREFIX,
 } from '../lib/state.js'
 
 const SECRET = Buffer.from('test-gate-secret-0123456789abcdef').toString('base64url')
@@ -37,113 +42,179 @@ function parseCookies(header) {
   return out
 }
 
-/** 修复后的判定（与 Gateway#isAuthenticated 一致）：任一同名项验签通过即认证。 */
-function isAuthenticated(header) {
+/** 复刻修复后的判定：接受实例名与两个历史名，任一同名项验签通过即认证。 */
+function isAuthenticated(header, cookieName) {
+  const accepted = new Set([cookieName, SESSION_COOKIE_LEGACY, SESSION_COOKIE_ALT])
   for (const [name, value] of parseCookies(header)) {
-    if (name !== SESSION_COOKIE) continue
+    if (!accepted.has(name)) continue
     if (verifySession(SECRET, value) !== null) return true
   }
   return false
 }
 
-/** 修复前的行为：只看第一个同名项。仅用于证明用例抓得住回归。 */
+/** 修复前：固定名 + 只看第一个。仅用于证明用例抓得住回归。 */
 function isAuthenticatedLegacy(header) {
-  const raw = parseCookies(header).find(([name]) => name === SESSION_COOKIE)?.[1]
+  const raw = parseCookies(header).find(([name]) => name === SESSION_COOKIE_PREFIX)?.[1]
   return verifySession(SECRET, raw) !== null
 }
 
+const NAME = sessionCookieName('http:', 3089)
+
 // ---------------------------------------------------------------------------
-// 1. 核心回归：同名 cookie 的顺序不能决定认证结果
+// 1. 实例专属名：协议 + 端口进入名字
+// ---------------------------------------------------------------------------
+
+test('cookie 名带协议与端口后缀，不同实例互不冲突', () => {
+  const a = sessionCookieName('http:', 3089)
+  const b = sessionCookieName('http:', 3090)
+  const c = sessionCookieName('https:', 3089)
+
+  assert.notEqual(a, b, '不同端口必须是不同 cookie 名')
+  assert.notEqual(a, c, '不同协议必须是不同 cookie 名')
+  assert.ok(a.startsWith(SESSION_COOKIE_PREFIX), '必须保留可识别的前缀')
+  assert.ok(a.includes('3089'), '名字里要能看出端口')
+})
+
+test('cookie 名只用 RFC 6265 token 允许的字符（Safari 比 Chromium 严格）', () => {
+  for (const [proto, port] of [
+    ['http:', 80], ['http:', 3089], ['https:', 443], ['https:', 3088],
+  ]) {
+    const name = sessionCookieName(proto, port)
+    // token = 1*<any CHAR except CTLs or separators>；这里收紧到最常见的安全子集。
+    assert.match(name, /^[A-Za-z0-9_-]+$/, `${name} 含 RFC 6265 separator 字符`)
+  }
+})
+
+test('非法端口退回占位值而不是生成坏名字', () => {
+  for (const port of [0, -1, 70000, Number.NaN, 3.14]) {
+    const name = sessionCookieName('http:', port)
+    assert.match(name, /^[A-Za-z0-9_-]+$/, `${port} 生成了非法名 ${name}`)
+  }
+})
+
+// ---------------------------------------------------------------------------
+// 2. 端口隔离语义：换端口即换槽位（登录态自然失效）
+// ---------------------------------------------------------------------------
+
+test('在 3089 登录后，3089 的请求带着它，3090 不认', () => {
+  const token = signSession(SECRET, 30)
+  const name3089 = sessionCookieName('http:', 3089)
+  const cookieHeader = `${name3089}=${token}`
+
+  assert.equal(isAuthenticated(cookieHeader, name3089), true, '3089 自己的会话应通过')
+  assert.equal(
+    isAuthenticated(cookieHeader, sessionCookieName('http:', 3090)),
+    false,
+    '3090 不应接受 3089 的会话（换端口必须重新登录）',
+  )
+})
+
+test('同端口不同协议也不互通（http 的会话在 https 上无效）', () => {
+  const token = signSession(SECRET, 30)
+  const httpCookie = `${sessionCookieName('http:', 3089)}=${token}`
+  assert.equal(isAuthenticated(httpCookie, sessionCookieName('https:', 3089)), false)
+})
+
+// ---------------------------------------------------------------------------
+// 3. 同名重复项的顺序不能决定认证结果（第一代根因）
 // ---------------------------------------------------------------------------
 
 test('Cookie 头里有多个同名项时，任意一个有效即认证通过', () => {
   const valid = signSession(SECRET, 30)
-  const bogus = `${SESSION_COOKIE}=v1.bogus.sig`
-  const good = `${SESSION_COOKIE}=${valid}`
-
+  const bogus = `${NAME}=v1.bogus.sig`
+  const good = `${NAME}=${valid}`
   for (const header of [`${bogus}; ${good}`, `${good}; ${bogus}`, good]) {
-    assert.equal(
-      isAuthenticated(header),
-      true,
-      `应通过：${header.replace(valid, '<valid>')}`,
-    )
+    assert.equal(isAuthenticated(header, NAME), true)
   }
 })
 
-test('回归护栏：旧实现（只取第一个同名 cookie）在坏值排前时失败', () => {
+test('回归护栏：旧实现（固定名 + 只取第一个）在坏值排前时失败', () => {
   const valid = signSession(SECRET, 30)
-  const staleFirst = `${SESSION_COOKIE}=v1.bogus.sig; ${SESSION_COOKIE}=${valid}`
-
-  // 这条断言是「测试有效性」的证明：它红了说明回归被引入。
+  const staleFirst = `${SESSION_COOKIE_PREFIX}=v1.bogus.sig; ${SESSION_COOKIE_PREFIX}=${valid}`
   assert.equal(isAuthenticatedLegacy(staleFirst), false, '旧实现应失败（证明用例有效）')
-  assert.equal(isAuthenticated(staleFirst), true, '新实现应通过')
 })
 
-test('全部无效时仍然拒绝（遍历不能放宽认证）', () => {
+test('全部无效时仍然拒绝，且不认无关名字', () => {
   for (const header of [
-    `${SESSION_COOKIE}=v1.bogus.sig`,
-    `${SESSION_COOKIE}=v1.bogus.sig; ${SESSION_COOKIE}=v1.other.sig`,
-    `${SESSION_COOKIE}=`,
+    `${NAME}=v1.bogus.sig`,
+    `${NAME}=v1.a.sig; ${NAME}=v1.b.sig`,
+    `${NAME}=`,
     '',
     'other=1',
+    `not_ours_3089=${signSession(SECRET, 30)}`,
   ]) {
-    assert.equal(isAuthenticated(header), false, `应拒绝：${JSON.stringify(header)}`)
+    assert.equal(isAuthenticated(header, NAME), false, `应拒绝：${JSON.stringify(header)}`)
   }
 })
 
 test('过期会话即使验签合法也拒绝', () => {
-  assert.equal(isAuthenticated(`${SESSION_COOKIE}=${signSession(SECRET, -1)}`), false)
+  assert.equal(isAuthenticated(`${NAME}=${signSession(SECRET, -1)}`, NAME), false)
 })
 
 test('换一把密钥签出的会话不再有效（改密码后旧会话失效的机制）', () => {
   const other = Buffer.from('another-gate-secret-value').toString('base64url')
-  assert.equal(isAuthenticated(`${SESSION_COOKIE}=${signSession(other, 30)}`), false)
+  assert.equal(isAuthenticated(`${NAME}=${signSession(other, 30)}`, NAME), false)
 })
 
 // ---------------------------------------------------------------------------
-// 2. 清除 cookie 必须覆盖多个 path（否则残值永远清不掉）
+// 4. 升级兼容：旧固定名写入的会话仍被接受（不让老用户被迫重登）
 // ---------------------------------------------------------------------------
 
-test('clearSessionCookie 覆盖多个 path，且都是立即过期的空值', () => {
-  const headers = clearSessionCookie(false)
-  assert.ok(Array.isArray(headers), '应返回多条 Set-Cookie')
-  assert.ok(headers.length >= 2, `应覆盖至少 2 个 path，实际 ${headers.length}`)
-
-  const paths = headers.map((h) => (/Path=([^;]+)/.exec(h) ?? [])[1])
-  assert.ok(paths.includes('/'), '必须包含 Path=/')
-  assert.ok(paths.includes('/__enhancement'), '必须包含 /__enhancement（登录页残值）')
-
-  for (const header of headers) {
-    assert.match(header, new RegExp(`^${SESSION_COOKIE}=;`), '清除头必须是空值')
-    assert.match(header, /Max-Age=0/, '清除头必须立即过期')
-    assert.match(header, /HttpOnly/, '清除头必须保持 HttpOnly')
-  }
-})
-
-test('HTTPS 下的清除头必须带 Secure，否则浏览器拒绝覆盖', () => {
-  for (const header of clearSessionCookie(true)) assert.match(header, /; Secure/)
-  for (const header of clearSessionCookie(false)) assert.doesNotMatch(header, /; Secure/)
+test('升级前用旧固定名写入的会话仍然有效', () => {
+  const token = signSession(SECRET, 30)
+  assert.equal(isAuthenticated(`${SESSION_COOKIE_LEGACY}=${token}`, NAME), true)
+  assert.equal(isAuthenticated(`${SESSION_COOKIE_ALT}=${token}`, NAME), true)
 })
 
 // ---------------------------------------------------------------------------
-// 3. 下发的新会话 cookie 属性
+// 5. Set-Cookie 下发与清除
 // ---------------------------------------------------------------------------
 
-test('登录成功后下发的会话 cookie 属性正确', () => {
+test('登录成功时只写实例专属名（不再写固定名）', () => {
   const token = signSession(SECRET, 30)
-  const header = sessionCookie(token, 30, false)
-  assert.match(header, new RegExp(`^${SESSION_COOKIE}=`))
-  assert.match(header, /Max-Age=2592000/, '30 天对应 2592000 秒')
+  const headers = sessionCookie(NAME, token, 30, false)
+
+  assert.equal(headers.length, 1, '只下发一条，避免在别的端口留下可读槽位')
+  const header = headers[0]
+  assert.ok(header.startsWith(`${NAME}=`), `应写实例名，实际：${header}`)
+  assert.ok(header.includes(token))
+  assert.match(header, /Max-Age=2592000/)
   assert.match(header, /Path=\//)
   assert.match(header, /HttpOnly/)
   assert.match(header, /SameSite=Strict/)
   assert.doesNotMatch(header, /; Secure/)
-  assert.match(sessionCookie(token, 30, true), /; Secure/)
+  assert.match(sessionCookie(NAME, token, 30, true)[0], /; Secure/)
+})
+
+test('清除时覆盖实例名 + 两个历史名 × 多个 path', () => {
+  const headers = clearSessionCookie(NAME, false)
+  assert.ok(Array.isArray(headers))
+
+  const combos = headers.map((h) => ({
+    name: h.slice(0, h.indexOf('=')),
+    path: (/Path=([^;]+)/.exec(h) ?? [])[1],
+  }))
+
+  for (const name of [NAME, SESSION_COOKIE_LEGACY, SESSION_COOKIE_ALT]) {
+    const paths = combos.filter((c) => c.name === name).map((c) => c.path)
+    assert.ok(paths.includes('/'), `${name} 必须包含 Path=/`)
+    assert.ok(paths.includes('/__enhancement'), `${name} 必须包含 /__enhancement（登录页残值）`)
+  }
+  for (const header of headers) {
+    assert.match(header, /=\s*;/, '清除头必须是空值')
+    assert.match(header, /Max-Age=0/)
+    assert.match(header, /HttpOnly/)
+  }
+})
+
+test('HTTPS 下的清除头必须带 Secure，否则浏览器拒绝覆盖', () => {
+  for (const header of clearSessionCookie(NAME, true)) assert.match(header, /; Secure/)
+  for (const header of clearSessionCookie(NAME, false)) assert.doesNotMatch(header, /; Secure/)
 })
 
-test('sessionDays 非正数时 Max-Age 仍为正（不退化成会话级 cookie）', () => {
+test('sessionDays 非正数时 Max-Age 仍为正', () => {
   const token = signSession(SECRET, 1)
   for (const days of [0, -5]) {
-    assert.match(sessionCookie(token, days, false), /Max-Age=1(;|$)/)
+    assert.match(sessionCookie(NAME, token, days, false)[0], /Max-Age=1(;|$)/)
   }
 })