dsh-pocket 1.0.16 → 1.0.17

package/client/api.js

@@ -15,20 +15,22 @@ export const POCKET_ENDPOINTS = Object.freeze({
   restart: 'pocket.restart',
 });
 
-/** 语义化版本比较：a > b 返回正数，相等 0，a < b 负数（仅数字段；带预发布后缀的更旧）。 */
+/** 语义化版本比较：a > b 返回正数，相等 0，a < b 负数（数字段 + 预发布后缀）。 */
 export function compareVersions(a, b) {
-  const pa = String(a).replace(/^v/, '').split('.');
-  const pb = String(b).replace(/^v/, '').split('.');
+  const pa = String(a).replace(/^[vV]/, '').split('.');
+  const pb = String(b).replace(/^[vV]/, '').split('.');
   for (let i = 0; i < 3; i++) {
     const x = parseInt(pa[i], 10) || 0;
     const y = parseInt(pb[i], 10) || 0;
     if (x !== y) return x - y;
   }
-  // 数字段相等：带预发布（-）的更旧
-  const aPre = /-/.test(pa[2] ?? '');
-  const bPre = /-/.test(pb[2] ?? '');
-  if (aPre !== bPre) return aPre ? -1 : 1;
-  return 0;
+  // 数字段相等：无预发布后缀的更新；都有后缀时按后缀字典序（alpha < beta < rc…）
+  const aPre = String(a).replace(/^[vV]/, '').match(/-.*$/)?.[0] ?? '';
+  const bPre = String(b).replace(/^[vV]/, '').match(/-.*$/)?.[0] ?? '';
+  if (!aPre && !bPre) return 0;
+  if (!aPre) return 1;
+  if (!bPre) return -1;
+  return aPre < bPre ? -1 : aPre > bPre ? 1 : 0;
 }
 
 /** 浏览器可见的状态字段（无敏感信息；含二维码 data URL）。 */

package/client/client.js

@@ -48,17 +48,19 @@ var POCKET_ENDPOINTS = Object.freeze({
   restart: "pocket.restart"
 });
 function compareVersions(a, b) {
-  const pa = String(a).replace(/^v/, "").split(".");
-  const pb = String(b).replace(/^v/, "").split(".");
+  const pa = String(a).replace(/^[vV]/, "").split(".");
+  const pb = String(b).replace(/^[vV]/, "").split(".");
   for (let i = 0; i < 3; i++) {
     const x = parseInt(pa[i], 10) || 0;
     const y = parseInt(pb[i], 10) || 0;
     if (x !== y) return x - y;
   }
-  const aPre = /-/.test(pa[2] ?? "");
-  const bPre = /-/.test(pb[2] ?? "");
-  if (aPre !== bPre) return aPre ? -1 : 1;
-  return 0;
+  const aPre = String(a).replace(/^[vV]/, "").match(/-.*$/)?.[0] ?? "";
+  const bPre = String(b).replace(/^[vV]/, "").match(/-.*$/)?.[0] ?? "";
+  if (!aPre && !bPre) return 0;
+  if (!aPre) return 1;
+  if (!bPre) return -1;
+  return aPre < bPre ? -1 : aPre > bPre ? 1 : 0;
 }
 function redactStatus(s) {
   return {
@@ -1328,8 +1330,14 @@ function PocketSettingsTab({ rpcCall }) {
     return () => clearInterval(t);
   }, []);
   (0, import_react2.useEffect)(() => {
-    call(POCKET_ENDPOINTS.pushStatus, {}).then((s) => setPushEnabled(s.enabled)).catch(() => {
-    });
+    (async () => {
+      try {
+        const s = await call(POCKET_ENDPOINTS.pushStatus, {});
+        setPushEnabled(s.enabled);
+        if (s.enabled) setPushState(await setupPush(rpcCall));
+      } catch {
+      }
+    })();
   }, []);
   (0, import_react2.useEffect)(() => {
     let alive = true;
@@ -1356,6 +1364,11 @@ function PocketSettingsTab({ rpcCall }) {
     try {
       await call(POCKET_ENDPOINTS.restart, {});
     } catch (err) {
+      const msg = String(err?.message ?? "");
+      if (/connection|socket|fetch|network|abort|cancelled|ECONN|disconnect|closed/i.test(msg)) {
+        setUpdateInfo((u) => ({ ...u, restarting: true, result: "ok" }));
+        return;
+      }
       setUpdateInfo((u) => ({ ...u, restarting: false, result: "fail", output: err.message }));
     }
   };
@@ -1369,26 +1382,34 @@ function PocketSettingsTab({ rpcCall }) {
     }
   };
   const enablePush = async () => {
-    await call(POCKET_ENDPOINTS.pushSetEnabled, { enabled: true });
-    setPushEnabled(true);
-    setPushState(await setupPush(rpcCall));
+    try {
+      await call(POCKET_ENDPOINTS.pushSetEnabled, { enabled: true });
+      setPushEnabled(true);
+      setPushState(await setupPush(rpcCall));
+    } catch (err) {
+      setError(err?.message ?? "\u63A8\u9001\u5F00\u542F\u5931\u8D25 | failed to enable push");
+    }
   };
   const disablePush = async () => {
     try {
-      if ("serviceWorker" in navigator) {
-        const reg = await navigator.serviceWorker.getRegistration("/pocket-sw.js");
-        const sub = await reg?.pushManager?.getSubscription();
-        if (sub) {
-          const endpoint = sub.endpoint;
-          await sub.unsubscribe();
-          await call(POCKET_ENDPOINTS.pushUnsubscribe, { endpoint });
+      try {
+        if ("serviceWorker" in navigator) {
+          const reg = await navigator.serviceWorker.getRegistration("/pocket-sw.js");
+          const sub = await reg?.pushManager?.getSubscription();
+          if (sub) {
+            const endpoint = sub.endpoint;
+            await sub.unsubscribe();
+            await call(POCKET_ENDPOINTS.pushUnsubscribe, { endpoint });
+          }
         }
+      } catch {
       }
-    } catch {
+      await call(POCKET_ENDPOINTS.pushSetEnabled, { enabled: false });
+      setPushEnabled(false);
+      setPushState("off");
+    } catch (err) {
+      setError(err?.message ?? "\u63A8\u9001\u5173\u95ED\u5931\u8D25 | failed to disable push");
     }
-    await call(POCKET_ENDPOINTS.pushSetEnabled, { enabled: false });
-    setPushEnabled(false);
-    setPushState("off");
   };
   const startTunnel = async () => {
     setBusy(true);

package/client/index.jsx

@@ -85,9 +85,15 @@ function PocketSettingsTab({ rpcCall }) {
     return () => clearInterval(t);
   }, []);
 
-  // 读取宿主开关状态
+  // 读取宿主开关状态；已开启时同步检查浏览器订阅状态（否则刷新后一直显示"检查中…"）
   useEffect(() => {
-    call(POCKET_ENDPOINTS.pushStatus, {}).then((s) => setPushEnabled(s.enabled)).catch(() => {});
+    (async () => {
+      try {
+        const s = await call(POCKET_ENDPOINTS.pushStatus, {});
+        setPushEnabled(s.enabled);
+        if (s.enabled) setPushState(await setupPush(rpcCall));
+      } catch { /* 忽略瞬时失败 */ }
+    })();
   }, []);
 
   // 版本检测：host 当前版本 vs npm registry latest（registry 带 CORS *）
@@ -116,8 +122,13 @@ function PocketSettingsTab({ rpcCall }) {
     setUpdateInfo((u) => ({ ...u, restarting: true }));
     try {
       await call(POCKET_ENDPOINTS.restart, {});
-      // 宿主即将退出重启，无需更多处理
     } catch (err) {
+      // 宿主 500ms 后自杀，RPC 响应可能来不及送达——网络断连视为「已请求重启」
+      const msg = String(err?.message ?? '');
+      if (/connection|socket|fetch|network|abort|cancelled|ECONN|disconnect|closed/i.test(msg)) {
+        setUpdateInfo((u) => ({ ...u, restarting: true, result: 'ok' }));
+        return;
+      }
       setUpdateInfo((u) => ({ ...u, restarting: false, result: 'fail', output: err.message }));
     }
   };
@@ -135,27 +146,35 @@ function PocketSettingsTab({ rpcCall }) {
 
   // 开启推送：宿主开关开 + 浏览器订阅（安全上下文才有效）
   const enablePush = async () => {
-    await call(POCKET_ENDPOINTS.pushSetEnabled, { enabled: true });
-    setPushEnabled(true);
-    setPushState(await setupPush(rpcCall));
+    try {
+      await call(POCKET_ENDPOINTS.pushSetEnabled, { enabled: true });
+      setPushEnabled(true);
+      setPushState(await setupPush(rpcCall));
+    } catch (err) {
+      setError(err?.message ?? '推送开启失败 | failed to enable push');
+    }
   };
 
   // 关闭推送：取消浏览器订阅 + 宿主开关关
   const disablePush = async () => {
     try {
-      if ('serviceWorker' in navigator) {
-        const reg = await navigator.serviceWorker.getRegistration('/pocket-sw.js');
-        const sub = await reg?.pushManager?.getSubscription();
-        if (sub) {
-          const endpoint = sub.endpoint;
-          await sub.unsubscribe();
-          await call(POCKET_ENDPOINTS.pushUnsubscribe, { endpoint });
+      try {
+        if ('serviceWorker' in navigator) {
+          const reg = await navigator.serviceWorker.getRegistration('/pocket-sw.js');
+          const sub = await reg?.pushManager?.getSubscription();
+          if (sub) {
+            const endpoint = sub.endpoint;
+            await sub.unsubscribe();
+            await call(POCKET_ENDPOINTS.pushUnsubscribe, { endpoint });
+          }
         }
-      }
-    } catch { /* 忽略 */ }
-    await call(POCKET_ENDPOINTS.pushSetEnabled, { enabled: false });
-    setPushEnabled(false);
-    setPushState('off');
+      } catch { /* 浏览器侧失败不影响宿主开关 */ }
+      await call(POCKET_ENDPOINTS.pushSetEnabled, { enabled: false });
+      setPushEnabled(false);
+      setPushState('off');
+    } catch (err) {
+      setError(err?.message ?? '推送关闭失败 | failed to disable push');
+    }
   };
 
   const startTunnel = async () => {

package/lib/index.js

@@ -115,7 +115,9 @@ export function apply(ctx, config = {}, internals = {}) {
   const disposers = [];
   const disposeRpc = installPocketRpc(ctx, {
     service,
-    push: internals.push ?? { vapidPublicKey: () => '', count: () => 0, subscribe: async () => false, unsubscribe: async () => false, isEnabled: () => true, setEnabled: async () => true },
+    // push 传 promise：插件启动早期 createPushService 可能还没 resolve，
+    // RPC 侧每次调用前动态 await（不能传空 fallback——会拿到空的 VAPID key）
+    push: internals.push ?? pushPromise,
     runUpdate: internals.runUpdate ?? { currentVersion, perform: performUpdate, loadedVersion: () => loadedVersion },
     restart: internals.restart ?? pocketRestart,
     restartNotice: internals.restartNotice ?? readRestartNotice,

package/lib/pocket-sw.js

@@ -1,6 +1,13 @@
 // dsh-pocket Service Worker（经 webServer 同源提供：/pocket-sw.js）
 // 职责：接收推送 → 显示通知；点击通知 → 聚焦/打开 DSH 页面。
-const ICON = '/favicon.svg';
+// 图标用内联 data URI（不依赖 dsh 静态资源，避免 404 导致通知无图标）。
+const ICON = 'data:image/svg+xml,' + encodeURIComponent(
+  '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">' +
+  '<rect width="64" height="64" rx="14" fill="#4f6ef7"/>' +
+  '<rect x="16" y="12" width="32" height="40" rx="5" fill="#fff"/>' +
+  '<rect x="22" y="18" width="20" height="26" rx="2" fill="#4f6ef7"/>' +
+  '<circle cx="32" cy="49" r="2.2" fill="#fff"/>' +
+  '</svg>');
 
 self.addEventListener('push', (event) => {
   let data = {};

package/lib/proxy.mjs

@@ -20,8 +20,17 @@ const DEFAULT_UPSTREAM = { host: '127.0.0.1', port: 3080 };
  * 非安全上下文（http://<LAN-IP>:端口）里浏览器没有 crypto.randomUUID，
  * 前端（DSH 连接层 mint RPC id 用）会直接抛 "crypto.randomUUID is not a function"。
  * 通过代理给 HTML 文档注入 polyfill（只在缺少时生效，用 getRandomValues 实现 v4）。
+ * 带 data-dsh-pocket-polyfill 标记：注入判重用它，而不是搜索 "crypto.randomUUID"
+ * 字样（dsh 页面源码里可能恰好出现该字符串，导致误判为已注入而跳过）。
  */
-const RANDOM_UUID_POLYFILL = `<script>!function(){try{if(self.crypto&&!self.crypto.randomUUID){self.crypto.randomUUID=function(){var b=new Uint8Array(16);self.crypto.getRandomValues(b);b[6]=b[6]&15|64;b[8]=b[8]&63|128;var h="";for(var i=0;i<16;i++){var x=b[i].toString(16);h+=(x.length<2?"0":"")+x;if(i===3||i===5||i===7||i===9)h+="-";}return h;}}}catch(e){}}();</script>`;
+const RANDOM_UUID_POLYFILL = `<script data-dsh-pocket-polyfill="1">!function(){try{if(self.crypto&&!self.crypto.randomUUID){self.crypto.randomUUID=function(){var b=new Uint8Array(16);self.crypto.getRandomValues(b);b[6]=b[6]&15|64;b[8]=b[8]&63|128;var h="";for(var i=0;i<16;i++){var x=b[i].toString(16);h+=(x.length<2?"0":"")+x;if(i===3||i===5||i===7||i===9)h+="-";}return h;}}}catch(e){}}();</script>`;
+
+const INJECT_MARK = 'data-dsh-pocket-polyfill="1"';
+
+/** 上游响应是否压缩过（压缩流不能做文本注入，会损坏页面）。 */
+function isCompressed(headers) {
+  return /(^|,\s*)(gzip|br|deflate)(\s*,|$)/i.test(String(headers['content-encoding'] ?? ''));
+}
 
 /** 默认注入到经代理的 HTML 文档里：crypto.randomUUID polyfill（非安全上下文必需）。 */
 const DEFAULT_INJECT = RANDOM_UUID_POLYFILL;
@@ -52,13 +61,14 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
       (proxyRes) => {
         log?.(`${req.method} ${req.url} -> ${proxyRes.statusCode}`);
         const contentType = String(proxyRes.headers['content-type'] ?? '');
-        // 只给 HTML 文档注入（SSE/WS/JS/CSS 原样透传）；注入后修正 Content-Length
-        if (injectHtml && contentType.includes('text/html')) {
+        // 只给**未压缩**的 HTML 文档注入（SSE/WS/JS/CSS 原样透传；压缩流注入会损坏页面）；
+        // 注入后修正 Content-Length
+        if (injectHtml && contentType.includes('text/html') && !isCompressed(proxyRes.headers)) {
           const chunks = [];
           proxyRes.on('data', (c) => chunks.push(c));
           proxyRes.on('end', () => {
             let html = Buffer.concat(chunks).toString('utf8');
-            if (!html.includes('crypto.randomUUID')) {
+            if (!html.includes(INJECT_MARK)) {
               html = html.replace(/<head[^>]*>/i, (m) => `${m}${injectHtml}`);
             }
             const out = Buffer.from(html, 'utf8');
@@ -74,6 +84,8 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
         }
         res.writeHead(proxyRes.statusCode ?? 502, proxyRes.headers);
         proxyRes.pipe(res);
+        // 客户端断开时销毁上游响应（SSE 流手机断连后不留僵尸连接）
+        res.on('close', () => proxyRes.destroy());
       },
     );
     proxyReq.on('error', (err) => {
@@ -100,6 +112,23 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
       if (proxyHead?.length) socket.write(proxyHead);
       proxySocket.pipe(socket);
       socket.pipe(proxySocket);
+      // 任一端断开都要清理另一端（避免上游残留僵尸连接占用 dsh 连接槽）
+      const teardown = () => { try { proxySocket.destroy(); } catch {} try { socket.destroy(); } catch {} };
+      proxySocket.on('close', teardown);
+      socket.on('close', teardown);
+    });
+    // 上游返回普通 HTTP 响应（非 101）：把状态码/头回写后断开，别让客户端永久挂起
+    proxyReq.on('response', (proxyRes) => {
+      if (proxyRes.statusCode === 101) return; // 理论上 101 走 upgrade 事件
+      try {
+        const raw = [`HTTP/1.1 ${proxyRes.statusCode} ${proxyRes.statusMessage ?? ''}`.trim()];
+        for (const [k, v] of Object.entries(proxyRes.headers)) {
+          raw.push(`${k}: ${Array.isArray(v) ? v.join(', ') : v}`);
+        }
+        socket.end(raw.join('\r\n') + '\r\n\r\n');
+        proxyRes.resume(); // 消费掉上游响应体，释放连接
+      } catch { /* socket 已关 */ }
+      socket.destroy();
     });
     proxyReq.on('error', () => socket.destroy());
     // 关键：浏览器在握手请求后可能立即发出首帧（如 mux 流的初始 RPC），

package/lib/push.mjs

@@ -33,6 +33,7 @@ function defaultWebPush() {
  * @param {string} [opts.home]      $DSH_HOME（默认 ~/.dsh）
  * @param {object} [opts.webpush]   web-push 库（测试注入 stub）
  * @param {string} [opts.subject]   VAPID subject（mailto:）
+ * @param {object} [opts.log]       日志（默认 console）
  * @param {object} [opts.internals] 测试注入：mkdir/write/read
  * @returns {Promise<PushService>}
  */
@@ -40,6 +41,7 @@ export async function createPushService({
   home,
   webpush = defaultWebPush(),
   subject = 'mailto:shaobeichen@outlook.com',
+  log = console,
   internals = {},
 } = {}) {
   const dshHome = home ?? process.env.DSH_HOME ?? join(homedir(), '.dsh');
@@ -132,6 +134,8 @@ export async function createPushService({
           if (code === 410 || code === 404) {
             subs.delete(endpoint);
             await persist();
+          } else {
+            log.warn?.('dsh-pocket: push send failed (endpoint %s…) | 推送失败: %s', String(endpoint).slice(0, 48), err?.message ?? err);
           }
         }
       }

package/lib/restart.js

@@ -3,50 +3,80 @@
 //
 // 方案借鉴 dshmarket 的 self-restart（lib/restart.js，MIT）：不直接拉起新
 // 进程，而是先拉一个 detached 的 node 辅助进程，等旧进程退出、端口释放
-// （1.5s）后再拉起新 dsh，并把新进程输出写入临时日志——避免端口竞争
+// 后再拉起新 dsh，并把新进程输出写入临时日志——避免端口竞争
 // （EADDRINUSE）导致新进程静默崩溃。
 //
+// 与 dshmarket 的差异：不赌固定 1.5s 延时，而是轮询探测端口真正释放
+// （ECONNREFUSED）再拉起，旧进程退出慢也不会撞端口。
+//
 // 注意：新进程 detached，不挂终端——停止方式：lsof -ti :3080 | xargs kill -9。
 
 import { spawn } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
-/** 重建启动调用（与当前宿主相同的命令）。 */
+/** 从启动参数里解析 dsh web 端口（--port/-p），默认 3080。 */
+export function dshPortFromArgs(args) {
+  for (let i = 0; i < args.length; i++) {
+    if ((args[i] === '--port' || args[i] === '-p') && args[i + 1]) {
+      const n = Number(args[i + 1]);
+      if (Number.isInteger(n) && n > 0 && n < 65536) return n;
+    }
+  }
+  return 3080;
+}
+
+/** 重建启动调用（与当前宿主相同的命令，含 node 运行参数）。 */
 export function restartLaunch() {
   return {
     file: process.argv[0], // node
-    args: [process.argv[1], ...process.argv.slice(2)], // <bin.js> + web [flags]
+    args: [...process.execArgv, process.argv[1], ...process.argv.slice(2)], // [flags] <bin.js> + web [flags]
     cwd: process.cwd(),
   };
 }
 
-/** 辅助进程代码：等待 1.5s（旧进程释放端口）→ 拉起新 dsh → 输出写日志。 */
-function helperCode(launch, logOut, logErr) {
+/** 辅助进程代码：等 dsh 端口真正释放（最多 20s）→ 拉起新 dsh → 输出写日志。 */
+function helperCode(launch, logOut, logErr, port) {
   const spawn = "const { spawn } = require('node:child_process')";
   const fs = "const fs = require('node:fs')";
+  const net = "const net = require('node:net')";
   const file = `const file = ${JSON.stringify(launch.file)}`;
   const args = `const args = ${JSON.stringify(launch.args)}`;
   const cwd = `const cwd = ${JSON.stringify(launch.cwd)}`;
   const o = `const logOut = ${JSON.stringify(logOut)}`;
   const e = `const logErr = ${JSON.stringify(logErr)}`;
   const body = [
-    'setTimeout(() => {',
-    '  try {',
-    '    const out = fs.openSync(logOut, "a")',
-    '    const err = fs.openSync(logErr, "a")',
-    '    const child = spawn(file, args, { cwd, detached: true, stdio: ["ignore", out, err], env: process.env })',
-    '    child.unref()',
-    '  } catch {}',
-    '}, 1500)',
+    'function portFree(p, cb) {',
+    '  const s = net.connect(p, "127.0.0.1")',
+    '  s.once("connect", () => { s.destroy(); cb(false) })', // 还能连上 = 端口仍被占用
+    '  s.once("error", () => cb(true))',                      // 连接被拒 = 已释放
+    '}',
+    'function waitPort(p, tries, cb) {',
+    '  portFree(p, (free) => {',
+    '    if (free || tries <= 0) cb(free)',
+    '    else setTimeout(() => waitPort(p, tries - 1, cb), 200)',
+    '  })',
+    '}',
+    `waitPort(${port}, 100, (free) => {`, // 最多 100×200ms = 20s
+    '  setTimeout(() => {',
+    '    try {',
+    '      const out = fs.openSync(logOut, "a")',
+    '      const err = fs.openSync(logErr, "a")',
+    '      const child = spawn(file, args, { cwd, detached: true, stdio: ["ignore", out, err], env: process.env })',
+    '      child.unref()',
+    '    } catch (ex) {',
+    '      try { fs.appendFileSync(logErr, "restart helper failed: " + (ex && ex.message) + "\\n") } catch {}',
+    '    }',
+    '  }, 300)',
+    '})',
   ].join('\n');
-  return [spawn, fs, file, args, cwd, o, e, body].join('\n');
+  return [spawn, fs, net, file, args, cwd, o, e, body].join('\n');
 }
 
 /**
  * 拉起替代宿主（detached 辅助进程交接），随后结束当前进程。
  * @param {object} opts
- * @param {number} [opts.handoffMs] 等待旧进程释放端口的时长（默认 1500ms）
+ * @param {number} [opts.handoffMs] 保留参数（兼容旧调用；现由端口探测接管）
  * @param {object} [opts.internals] 测试注入：spawn / kill
  * @returns {{helperPid:number|null, logOut:string, logErr:string}}
  */
@@ -54,20 +84,22 @@ export function restartHost({ handoffMs = 1500, internals = {} } = {}) {
   const spawnFn = internals.spawn ?? spawn;
   const killFn = internals.kill ?? ((pid) => process.kill(pid, 'SIGTERM'));
   const launch = restartLaunch();
+  const port = dshPortFromArgs(launch.args);
   const stamp = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19);
   const logOut = join(tmpdir(), `dsh-pocket-restart-${stamp}.out.log`);
   const logErr = join(tmpdir(), `dsh-pocket-restart-${stamp}.err.log`);
 
   let helperPid = null;
   try {
-    const helper = spawnFn(process.execPath, ['-e', helperCode(launch, logOut, logErr)], {
+    const helper = spawnFn(process.execPath, ['-e', helperCode(launch, logOut, logErr, port)], {
       detached: true,
       stdio: 'ignore',
       env: process.env,
     });
     helper.unref?.();
+    helper.on?.('error', () => {}); // 参数异常等异步错误兜底，别让旧进程先崩
     helperPid = helper.pid ?? null;
-    // 短暂等待后结束当前进程（释放端口）；由辅助进程在 1.5s 后拉起新宿主
+    // 短暂等待后结束当前进程（释放端口）；由辅助进程探测到端口释放后拉起新宿主
     setTimeout(() => { try { killFn(process.pid); } catch { /* 忽略 */ } }, 500);
   } catch (err) {
     return { helperPid: null, logOut, logErr, error: err?.message ?? String(err) };

package/lib/service.mjs

@@ -49,8 +49,21 @@ export function createPocketService({
   let proxy = null;
   let tunnel = null;
   let tunnelAbort = null;
+  /** in-flight 隧道启动（单飞）：并发调用复用同一次，避免 spawn 多个 cloudflared 孤儿进程 */
+  let tunnelPromise = null;
   /** 隧道进度：{ phase: idle|downloading|starting|registering|ready|error, detail, startedAt } */
   const tunnelState = { phase: 'idle', detail: '', startedAt: null };
+  /** 二维码缓存：URL → data URL promise。status() 每 3 秒轮询一次，不能每次都重新生成（CPU 密集）。 */
+  const qrCache = new Map();
+  const encodeQr = internals.encodeQr ?? qrDataUrl;
+  async function qrCached(text) {
+    if (!text) return null;
+    if (!qrCache.has(text)) {
+      if (qrCache.size > 8) qrCache.clear(); // 隧道 URL 每次重启换新，防止无限增长
+      qrCache.set(text, encodeQr(text).catch(() => null));
+    }
+    return qrCache.get(text);
+  }
 
   return {
     /** 启动局域网代理（幂等）。 */
@@ -64,11 +77,13 @@ export function createPocketService({
       return proxy;
     },
 
-    /** 启动公网隧道（幂等；返回公网 URL）。进度写进 tunnelState。 */
+    /** 启动公网隧道（幂等；返回公网 URL）。进度写进 tunnelState。并发调用单飞。 */
     async startTunnel() {
       await this.startProxy();
       if (tunnel) return tunnel.url;
-      tunnelAbort = new AbortController();
+      if (tunnelPromise) return tunnelPromise; // 复用 in-flight，防孤儿 cloudflared
+      const controller = new AbortController();
+      tunnelAbort = controller;
       tunnelState.startedAt = Date.now();
       const onPhase = (phase) => {
         tunnelState.phase = phase;
@@ -77,23 +92,33 @@ export function createPocketService({
         else if (phase === 'registering') tunnelState.detail = '连接 Cloudflare 边缘（通常 5-30 秒）| connecting to Cloudflare edge (usually 5-30s)';
         else if (phase === 'ready') tunnelState.detail = '隧道就绪 | ready';
       };
-      try {
-        const result = await startTunnel({ port: proxy.port, home, signal: tunnelAbort.signal, onPhase });
-        // 归一化：startTunnel 契约返回 {url, kill}（字符串也兼容）
-        tunnel = typeof result === 'string' ? { url: result, kill: () => {} } : result;
-        tunnelState.phase = 'ready';
-        return tunnel.url;
-      } catch (err) {
-        tunnelState.phase = 'error';
-        tunnelState.detail = err?.message ?? String(err);
-        throw err;
-      }
+      tunnelPromise = (async () => {
+        try {
+          const result = await startTunnel({ port: proxy.port, home, signal: controller.signal, onPhase });
+          // 归一化：startTunnel 契约返回 {url, kill}（字符串也兼容）
+          tunnel = typeof result === 'string' ? { url: result, kill: () => {} } : result;
+          tunnelState.phase = 'ready';
+          return tunnel.url;
+        } catch (err) {
+          // stopTunnel 触发的 abort 不算错误：保持 idle，别把状态刷成 error
+          if (!controller.signal.aborted) {
+            tunnelState.phase = 'error';
+            tunnelState.detail = err?.message ?? String(err);
+          }
+          tunnelState.startedAt = null; // 失败后清掉计时，避免 UI 误显"启动中"
+          throw err;
+        } finally {
+          tunnelPromise = null;
+        }
+      })();
+      return tunnelPromise;
     },
 
     /** 停止公网隧道（代理保持）。 */
     stopTunnel() {
       tunnelAbort?.abort();
       tunnelAbort = null;
+      tunnelPromise = null; // 丢弃已 abort 的 in-flight（其 finally 会再清一次，无害）
       if (tunnel) tunnel.kill();
       tunnel = null;
       tunnelState.phase = 'idle';
@@ -101,20 +126,19 @@ export function createPocketService({
       tunnelState.startedAt = null;
     },
 
-    /** 状态快照（RPC 返回，不含敏感信息；二维码 data URL 本地生成）。 */
+    /** 状态快照（RPC 返回，不含敏感信息；二维码 data URL 本地生成 + 缓存）。 */
     async status() {
       const lan = getLan();
       const proxyPort = proxy?.port ?? null;
       const lanUrl = lan && proxyPort ? `http://${lan}:${proxyPort}` : null;
-      const encode = internals.encodeQr ?? qrDataUrl;
       return {
         proxyRunning: proxy !== null,
         proxyPort,
         lanUrl,
-        lanQr: lanUrl ? await encode(lanUrl) : null,
+        lanQr: await qrCached(lanUrl),
         tunnelRunning: tunnel !== null,
         tunnelUrl: tunnel?.url ?? null,
-        tunnelQr: tunnel?.url ? await encode(tunnel.url) : null,
+        tunnelQr: await qrCached(tunnel?.url ?? null),
         tunnelState: { ...tunnelState },
         dshPort,
       };
@@ -126,7 +150,7 @@ export function createPocketService({
       if (proxy) {
         const p = proxy;
         proxy = null;
-        await p.close();
+        try { await p.close(); } catch { /* server 已关闭等边缘情况 */ }
       }
     },
   };

package/lib/tunnel.mjs

@@ -4,7 +4,7 @@
 // 无密码模式：URL 即钥匙（dsh web 能执行代码，请勿把二维码/URL 发给别人）。
 
 import { spawn, execSync } from 'node:child_process';
-import { mkdir, access, chmod } from 'node:fs/promises';
+import { mkdir, access, chmod, rm } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join, dirname } from 'node:path';
 import { pipeline } from 'node:stream/promises';
@@ -25,7 +25,7 @@ async function downloadCloudflared(binPath) {
   // cloudflared 新版发布资产是 .tgz 压缩包（内含 cloudflared 二进制）
   const url = `https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-${os}-${a}.tgz`;
   console.log(`⬇️  正在下载 cloudflared（首次运行，之后跳过）…`);
-  const res = await fetch(url);
+  const res = await fetch(url, { signal: AbortSignal.timeout(180_000) });
   if (!res.ok) throw new Error(`cloudflared 下载失败（HTTP ${res.status}）`);
   const dir = dirname(binPath);
   const tgz = join(dir, `cloudflared.tgz`);
@@ -38,6 +38,8 @@ async function downloadCloudflared(binPath) {
   });
   const extracted = join(dir, `cloudflared${ext}`);
   if (os !== 'windows') await chmod(extracted, 0o755);
+  // 解压成功就删掉 ~20MB 的 tgz，避免长期占用缓存目录
+  await rm(tgz, { force: true }).catch(() => {});
   return extracted;
 }
 
@@ -51,6 +53,9 @@ function cloudflaredOnPath() {
   }
 }
 
+/** in-flight 下载（单飞）：并发调用复用同一次，防止交错写入损坏 tgz。 */
+let downloading = null;
+
 /**
  * 拿一个可用的 cloudflared 路径。
  * 优先：PATH 已有 → 直接用；否则用持久缓存（$DSH_HOME/dsh-pocket/cloudflared），
@@ -67,8 +72,10 @@ export async function resolveCloudflared({ home, onPhase = () => {} } = {}) {
   } catch { /* 缓存缺失，下载 */ }
   onPhase('downloading');
   await mkdir(cacheDir, { recursive: true });
-  const downloaded = await downloadCloudflared(bin);
-  return downloaded;
+  if (!downloading) {
+    downloading = downloadCloudflared(bin).finally(() => { downloading = null; });
+  }
+  return downloading;
 }
 
 /**

package/lib/web-rpc.js

@@ -32,6 +32,9 @@ export function installPocketRpc(ctx, { service, push, log = console, runUpdate
       return ok({ ...redactStatus(await service.status()), restartNotice: notice });
     };
 
+    // push 可能是 promise（插件启动早期 createPushService 尚未 resolve）；动态取实例
+    const pushApi = await Promise.resolve(push).catch(() => null);
+
     try {
       if (endpoint === POCKET_ENDPOINTS.status) {
         return await statusPayload();
@@ -45,22 +48,27 @@ export function installPocketRpc(ctx, { service, push, log = console, runUpdate
         return await statusPayload();
       }
       if (endpoint === POCKET_ENDPOINTS.pushVapidKey) {
-        return ok({ publicKey: push.vapidPublicKey() });
+        if (!pushApi) return fail('bad-request', '推送服务未就绪 | push service unavailable');
+        return ok({ publicKey: pushApi.vapidPublicKey() });
       }
       if (endpoint === POCKET_ENDPOINTS.pushSubscribe) {
-        const added = await push.subscribe(payload?.subscription);
-        return ok({ subscribed: added, count: push.count() });
+        if (!pushApi) return fail('bad-request', '推送服务未就绪 | push service unavailable');
+        const added = await pushApi.subscribe(payload?.subscription);
+        return ok({ subscribed: added, count: pushApi.count() });
       }
       if (endpoint === POCKET_ENDPOINTS.pushUnsubscribe) {
-        const removed = await push.unsubscribe(payload?.endpoint);
-        return ok({ removed, count: push.count() });
+        if (!pushApi) return fail('bad-request', '推送服务未就绪 | push service unavailable');
+        const removed = await pushApi.unsubscribe(payload?.endpoint);
+        return ok({ removed, count: pushApi.count() });
       }
       if (endpoint === POCKET_ENDPOINTS.pushStatus) {
-        return ok({ enabled: push.isEnabled(), count: push.count() });
+        if (!pushApi) return fail('bad-request', '推送服务未就绪 | push service unavailable');
+        return ok({ enabled: pushApi.isEnabled(), count: pushApi.count() });
       }
       if (endpoint === POCKET_ENDPOINTS.pushSetEnabled) {
-        const enabled = await push.setEnabled(payload?.enabled === true);
-        return ok({ enabled, count: push.count() });
+        if (!pushApi) return fail('bad-request', '推送服务未就绪 | push service unavailable');
+        const enabled = await pushApi.setEnabled(payload?.enabled === true);
+        return ok({ enabled, count: pushApi.count() });
       }
       if (endpoint === POCKET_ENDPOINTS.version) {
         return ok({ current: runUpdate?.currentVersion?.() ?? null, loaded: runUpdate?.loadedVersion?.() ?? null });

package/package.json

@@ -77,5 +77,5 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "version": "1.0.16"
+  "version": "1.0.17"
 }