dsh-pocket 1.10.0 → 1.11.1

package/README.en.md

@@ -43,7 +43,9 @@ What it looks like — the phone shows the exact same UI as your computer, live:
 |---|---|
 | 📶 LAN QR access | Works out of the box: Settings → Phone access — scan the LAN QR on the same Wi-Fi |
 | 🌐 Public QR (from anywhere) | Click "Enable anywhere" → cloudflared tunnel → scan the public QR over 4G / any network |
-| 🔐 Access PIN | Public links require an **8-digit PIN** (rotated every time the tunnel starts — old links die instantly); LAN has its own separate **8-digit PIN** (on by default; can be switched off in Settings — then LAN scans connect directly) |
+| 🔐 Access PIN | Public links require an **8-digit PIN** (rotated on every tunnel start by default; **customizable to a fixed PIN** — custom PINs are not rotated); LAN has its own separate **8-digit PIN** (on by default; switchable off in Settings — then LAN scans connect directly) |
+| 🔑 Custom PINs | Both the public and LAN PINs can be **set to your own fixed 8-digit number** in Settings (custom PINs are never auto-rotated) |
+| 🧘 Session persistence | Enter the PIN once and you're set for a long time (login is tied to the computer's dsh web process: as long as it stays up, the phone won't ask again; **after a dsh web restart/update, enter it once more**) |
 | ⚡ Real-time sync | Streaming output passes through WebSocket untouched — what the computer renders, the phone renders live; fully interactive both ways |
 | 📱 Mobile-adaptive layout | Narrow screens get a drawer layout automatically (ported from dsh-web-mobile, MIT): sidebar drawer, full-width conversation, safe-area insets, touch optimizations |
 | 🗜️ Transfer compression | Large JSON responses are gzip/brotli'd on the fly (17MB session history → ~1MB; brotli quality 6: fast and bandwidth-friendly) — faster loads, less mobile data |
@@ -75,23 +77,27 @@ npx @deepseek-ai/dsh web
 
 ### LAN (same Wi-Fi)
 
-Settings → **Phone access** → scan the "📶 LAN" QR code → enter the **LAN PIN** (shown in the LAN block of the settings page; hit **Refresh** to get a new one) → the phone opens the exact same DSH, in real time.
+Settings → **Phone access** → scan the "📶 LAN" QR code → enter the **LAN PIN** (shown in the LAN block; hit **Refresh** to roll a new one, or **Customize** to set your own fixed 8 digits) → the phone opens the exact same DSH, in real time.
 
 > The LAN PIN is **on by default** (security-first). If you're the only user and find typing it every time annoying, flip "LAN access PIN" to **Off** in the LAN block — LAN scans then connect directly with no PIN (LAN-only devices; the **public tunnel always requires a PIN**, unaffected).
+>
+> After logging in once, the phone **won't ask again**: as long as the computer's dsh web keeps running, reopening the phone needs no PIN (**a dsh web restart/update asks for it once more**).
 
 ### Public (from anywhere)
 
-On the same page click "**Enable anywhere**" → wait for the tunnel (first run downloads cloudflared; macOS/Linux use the Tsinghua mirror, seconds) → scan the "🌐 Public" QR code → the phone opens the link and **enters the 8-digit PIN** (shown in the settings page's public section, **rotated on every tunnel start**) → works from outside (4G / office network).
+On the same page click "**Enable anywhere**" → wait for the tunnel (first run downloads cloudflared; macOS/Linux use the Tsinghua mirror, seconds) → scan the "🌐 Public" QR code → the phone opens the link and **enters the 8-digit PIN** (shown in the settings page's public section; **rotated on every tunnel start by default**, or **Customize** it to a fixed PIN that is never rotated) → works from outside (4G / office network).
 
 > Upgrading: `dsh plugin --profile web update dsh-pocket --latest -w` (`--latest` is required across major versions — a `^0.x` range won't auto-jump to 1.x).
 
 ## ⚠️ Security (read first)
 
 - **DSH can execute code on your computer.** **LAN** QR/URL plus its own **8-digit PIN** is the key (PIN **on by default**, switchable off — then LAN scans connect directly, same-network devices only) — **never share the LAN QR, URL or PIN**.
-- **Public** access is protected by an **8-digit PIN**: the link is random, the PIN rotates on every tunnel start, and old links die instantly — even a leaked link can't get in.
+- **Public** access is protected by an **8-digit PIN**: the link is random, the PIN rotates on every tunnel start by default, and old links die instantly — even a leaked link can't get in. **A custom PIN is never auto-rotated** (your value stays stable).
+- Phone login state is tied to the computer's dsh web process: **no re-entry while dsh web stays up; one re-entry after a restart/update**.
+- **Login rate limiting** (anti brute-force): **5** consecutive wrong PINs from the same IP lock it for **60s**; a global failure threshold briefly locks everyone (blocks distributed IP-rotation scans); a successful login resets the counter.
 - The public URL is randomly assigned by cloudflared and **changes on every restart** (old links die automatically — a natural key rotation).
 - LAN mode exposes nothing publicly; only devices on the same network can reach it.
-- Built for personal use; the public PIN lives in `$DSH_HOME/dsh-pocket/token` (re-rolled on every tunnel start), the LAN PIN in `$DSH_HOME/dsh-pocket/token-lan` (refreshed manually in Settings), and the LAN-PIN switch state in `$DSH_HOME/dsh-pocket/settings.json`.
+- Built for personal use; the public PIN lives in `$DSH_HOME/dsh-pocket/token` (re-rolled per tunnel start unless customized), the LAN PIN in `$DSH_HOME/dsh-pocket/token-lan` (refreshed manually in Settings), and switches/custom flags in `$DSH_HOME/dsh-pocket/settings.json`.
 
 ## 💻 DSH Desktop
 

package/README.md

@@ -43,7 +43,9 @@ DSH Pocket 就是干这个的：**装上它，手机扫个码，就能实时看
 |---|---|
 | 📶 局域网扫码 | 装好即用：设置 → 手机访问，打开就有局域网二维码，手机连同一 WiFi 扫码即开 |
 | 🌐 公网扫码（人在外面） | 点「开启公网访问」→ cloudflared 隧道 → 出公网二维码，4G/任何网络都能访问 |
-| 🔐 访问密码 | 公网链接需输入 **8 位数字密码**（每次开启公网自动换新，旧链接立即作废）；局域网有独立 **8 位数字密码**（默认开启，设置页可**一键关闭**——关闭后局域网扫码直连） |
+| 🔐 访问密码 | 公网链接需输入 **8 位数字密码**（默认每次开启公网自动换新；**可自定义固定密码**——自定义后不再换新）；局域网有独立 **8 位数字密码**（默认开启，设置页可**一键关闭**——关闭后局域网扫码直连） |
+| 🔑 自定义密码 | 公网/局域网密码都可在设置页**设成自己固定的 8 位数字**（自定义后公网不再自动换新） |
+| 🧘 会话保持 | 手机输一次密码后**长期免输**（登录状态绑定电脑上的 dsh web 进程：只要它不重启，手机不用再输；**dsh web 重启/更新后需重新输入一次**） |
 | ⚡ 实时同步 | 流式输出走 WebSocket 全透传——**电脑上在输出，手机上同步在滚**，可双向操作 |
 | 📱 移动端适配 | 窄屏自动变抽屉布局（移植 dsh-web-mobile，MIT）：侧栏抽屉、会话全宽、状态栏安全区、触控优化 |
 | 🗜️ 传输压缩 | 大 JSON 响应自动 gzip/brotli（长会话 17MB → ~1MB，brotli 质量 6：快且省流量），手机加载更快、更省流量 |
@@ -75,23 +77,27 @@ npx @deepseek-ai/dsh web
 
 ### 局域网（同一 WiFi）
 
-设置 → **手机访问** → 手机扫「📶 局域网」二维码 → 打开链接**输入局域网密码**（显示在设置页局域网区块，点「刷新」可换新）→ 打开的就是电脑上的 DSH，实时同步。
+设置 → **手机访问** → 手机扫「📶 局域网」二维码 → 打开链接**输入局域网密码**（显示在设置页局域网区块，点「刷新」可换新，或点「自定义」设成自己固定的 8 位数字）→ 打开的就是电脑上的 DSH，实时同步。
 
 > 局域网密码**默认开启**（安全优先）。如果只有自己用、嫌每次输密码麻烦，可在设置页局域网区块把「局域网访问密码」切到**关**——之后局域网扫码直连、无需密码（仅同一局域网设备可访问；**公网始终要密码**，不受影响）。
+>
+> 手机登录一次后**长期免输**：只要电脑上的 dsh web 不重启，再次打开手机不用再输入（**dsh web 重启/更新后需重新输入一次**）。
 
 ### 公网（人在外面）
 
-同一页点「**开启公网访问**」→ 等隧道建立（首次会下载 cloudflared，macOS/Linux 走清华镜像秒下）→ 手机扫「🌐 公网」二维码 → 打开链接**输入 8 位访问密码**（密码显示在设置页公网区块，**每次开启公网变新**）→ 人在外面（4G/公司网）也能访问。
+同一页点「**开启公网访问**」→ 等隧道建立（首次会下载 cloudflared，macOS/Linux 走清华镜像秒下）→ 手机扫「🌐 公网」二维码 → 打开链接**输入 8 位访问密码**（密码显示在设置页公网区块，默认**每次开启公网变新**，也可点「自定义」设成固定密码——自定义后不再换新）→ 人在外面（4G/公司网）也能访问。
 
 > 更新到新版本：`dsh plugin --profile web update dsh-pocket --latest -w`（跨大版本时 `--latest` 是必须的，`^0.x` 范围不会自动升到 1.x）。
 
 ## ⚠️ 安全（必读）
 
 - **DSH 能执行你电脑上的代码**。**局域网**二维码/URL 配上独立 **8 位数字密码**才是钥匙（密码**默认开启**，可关——关闭后局域网扫码直连，仅同一网络设备可访问），**请勿把局域网二维码、URL 或密码发给别人**
-- **公网**有 **8 位数字密码**保护：链接随机分配、每次开启换新密码、旧链接立即作废——泄露了也进不来，改密码/重开即可作废
+- **公网**有 **8 位数字密码**保护：链接随机分配、默认每次开启换新密码、旧链接立即作废——泄露了也进不来，改密码/重开即可作废；**自定义密码后不再自动换新**（你设的值即稳定密码）
+- 手机登录状态与电脑上的 dsh web 进程绑定：**电脑 dsh web 一直开着就不用重复输入；重启/更新后需重新输入一次**
+- **登录限速**（防暴力破解）：同一 IP 连续输错 **5 次**锁定 **60 秒**；全局失败超阈值时短暂全锁（防换 IP 分布式扫描）；输对密码后计数清零
 - 公网 URL 由 cloudflared 随机分配，**每次重启会变化**（旧链接自动失效，相当于天然轮换）
 - 局域网模式不暴露公网，只有同一网络内的设备能访问
-- 适合个人自用；公网密码存本机 `$DSH_HOME/dsh-pocket/token`（每次开启公网自动换新），局域网密码存 `$DSH_HOME/dsh-pocket/token-lan`（设置页手动刷新），开关状态存 `$DSH_HOME/dsh-pocket/settings.json`
+- 适合个人自用；公网密码存本机 `$DSH_HOME/dsh-pocket/token`（默认每次开启公网自动换新，**自定义后不换**），局域网密码存 `$DSH_HOME/dsh-pocket/token-lan`（设置页手动刷新），开关/自定义标记存 `$DSH_HOME/dsh-pocket/settings.json`
 
 ## 💻 DSH Desktop（桌面版）
 

package/client/api.js

@@ -10,6 +10,7 @@ export const POCKET_ENDPOINTS = Object.freeze({
   restart: 'pocket.restart',
   lanTokenRefresh: 'token.lanRefresh',
   lanAuthSetEnabled: 'lanAuth.setEnabled',
+  pinSetCustom: 'pin.setCustom',
 });
 
 /** 语义化版本比较：a > b 返回正数，相等 0，a < b 负数（数字段 + 预发布后缀）。 */

package/client/client.js

@@ -49,7 +49,8 @@ var POCKET_ENDPOINTS = Object.freeze({
   update: "pocket.update",
   restart: "pocket.restart",
   lanTokenRefresh: "token.lanRefresh",
-  lanAuthSetEnabled: "lanAuth.setEnabled"
+  lanAuthSetEnabled: "lanAuth.setEnabled",
+  pinSetCustom: "pin.setCustom"
 });
 function compareVersions(a, b) {
   const pa = String(a).replace(/^[vV]/, "").split(".");
@@ -1323,12 +1324,20 @@ var zh2 = {
   "on": "\u5F00",
   "off": "\u5173",
   "lanPinValue": "\u{1F510} \u8BBF\u95EE\u5BC6\u7801\uFF1A{pin}\uFF08\u624B\u673A\u6253\u5F00\u9700\u8F93\u5165\uFF1B\u4E0E\u516C\u7F51\u5BC6\u7801\u5206\u5F00\uFF09",
+  "lanPinCustomValue": "\u{1F510} \u8BBF\u95EE\u5BC6\u7801\uFF1A{pin}\uFF08\u81EA\u5B9A\u4E49\uFF1B\u624B\u673A\u6253\u5F00\u9700\u8F93\u5165\uFF09",
   "refresh": "\u5237\u65B0",
+  "customize": "\u81EA\u5B9A\u4E49",
+  "customizing": "\u65B0\u5BC6\u7801\uFF088 \u4F4D\u6570\u5B57\uFF09\uFF1A",
+  "save": "\u4FDD\u5B58",
+  "cancel": "\u53D6\u6D88",
+  "pinInvalid": "\u5BC6\u7801\u5FC5\u987B\u662F 8 \u4F4D\u6570\u5B57",
+  "pinCustomHint": "\u81EA\u5B9A\u4E49\u540E\u5F00\u542F\u516C\u7F51\u4E0D\u518D\u81EA\u52A8\u6362\u65B0",
   "lanPinOff": "\u{1F513} \u5BC6\u7801\u5DF2\u5173\u95ED\uFF1A\u626B\u7801\u76F4\u8FDE\uFF0C\u65E0\u9700\u5BC6\u7801\uFF08\u4EC5\u540C\u4E00\u5C40\u57DF\u7F51\u8BBE\u5907\u53EF\u8BBF\u95EE\uFF1B\u516C\u7F51\u4ECD\u8981\u5BC6\u7801\uFF09",
   "lanStarting": "\u4EE3\u7406\u672A\u5C31\u7EEA\u2026",
   "wanTitle": "\u{1F310} \u516C\u7F51\uFF08\u4EBA\u5728\u5916\u9762\uFF09",
   "wanHint": "\u4EFB\u4F55\u7F51\u7EDC\u626B\u7801\u5373\u7528\uFF08URL \u6BCF\u6B21\u91CD\u542F\u81EA\u52A8\u6362\u65B0\uFF09",
   "wanPin": "\u{1F510} \u8BBF\u95EE\u5BC6\u7801\uFF1A{pin}\uFF08\u6BCF\u6B21\u5F00\u542F\u516C\u7F51\u53D8\u65B0\uFF1B\u624B\u673A\u6253\u5F00\u94FE\u63A5\u9700\u8F93\u5165\u6B64\u5BC6\u7801\uFF09",
+  "wanPinCustom": "\u{1F510} \u8BBF\u95EE\u5BC6\u7801\uFF1A{pin}\uFF08\u81EA\u5B9A\u4E49\uFF0C\u5F00\u542F\u516C\u7F51\u4E0D\u518D\u81EA\u52A8\u6362\u65B0\uFF09",
   "stopTunnel": "\u5173\u95ED\u516C\u7F51",
   "enable": "\u5F00\u542F\u516C\u7F51\u8BBF\u95EE",
   "opening": "\u5F00\u542F\u4E2D\u2026",
@@ -1370,12 +1379,20 @@ var en2 = {
   "on": "On",
   "off": "Off",
   "lanPinValue": "\u{1F510} PIN: {pin} (required on the phone; separate from the public PIN)",
+  "lanPinCustomValue": "\u{1F510} PIN: {pin} (custom; required on the phone)",
   "refresh": "Refresh",
+  "customize": "Customize",
+  "customizing": "New PIN (8 digits): ",
+  "save": "Save",
+  "cancel": "Cancel",
+  "pinInvalid": "PIN must be exactly 8 digits",
+  "pinCustomHint": "custom PINs are not rotated on tunnel start",
   "lanPinOff": "\u{1F513} PIN off \u2014 scan & go, no PIN (LAN devices only; public still requires PIN)",
   "lanStarting": "Proxy starting\u2026",
   "wanTitle": "\u{1F310} Anywhere (public)",
   "wanHint": "Scan from any network (the URL changes on every restart)",
   "wanPin": "\u{1F510} PIN: {pin} (changes each time the tunnel is enabled; required on the phone)",
+  "wanPinCustom": "\u{1F510} PIN: {pin} (custom \u2014 not rotated on tunnel start)",
   "stopTunnel": "Stop",
   "enable": "Enable anywhere",
   "opening": "Enabling\u2026",
@@ -1551,6 +1568,44 @@ function PocketSettingsTab({ rpcCall, t }) {
     } catch {
     }
   };
+  const [customPin, setCustomPin] = (0, import_react2.useState)(null);
+  const saveCustomPin = async (which) => {
+    try {
+      const r = await call(POCKET_ENDPOINTS.pinSetCustom, { which, value: customPin?.value ?? "" });
+      setStatus((s) => ({
+        ...s,
+        accessToken: which === "public" ? r.pin : s.accessToken,
+        lanToken: which === "lan" ? r.pin : s.lanToken,
+        publicPinCustom: which === "public" ? true : s.publicPinCustom,
+        lanPinCustom: which === "lan" ? true : s.lanPinCustom
+      }));
+      setCustomPin(null);
+    } catch (err) {
+      setCustomPin((c) => ({ ...c, err: err.message }));
+    }
+  };
+  const customPinRow = (which) => (0, import_react2.createElement)(
+    "div",
+    { style: { marginTop: 6, fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)", lineHeight: 1.5 } },
+    t("customizing"),
+    (0, import_react2.createElement)("input", {
+      style: { width: 110, margin: "0 6px", padding: "4px 8px", fontSize: 14, letterSpacing: 2, textAlign: "center", border: "1px solid var(--dsw-alias-border-l2,#d1d5db)", borderRadius: 6, outline: "none" },
+      type: "password",
+      inputMode: "numeric",
+      maxLength: 8,
+      value: customPin?.value ?? "",
+      autoFocus: true,
+      onChange: (e) => setCustomPin((c) => ({ ...c, value: e.target.value.replace(/\D/g, ""), err: null })),
+      onKeyDown: (e) => {
+        if (e.key === "Enter") saveCustomPin(which);
+        if (e.key === "Escape") setCustomPin(null);
+      }
+    }),
+    (0, import_react2.createElement)("button", { style: { ...styles.btn, height: 26, padding: "0 10px", fontSize: 12, marginLeft: 2 }, onClick: () => saveCustomPin(which) }, t("save")),
+    (0, import_react2.createElement)("button", { style: { ...styles.btn, height: 26, padding: "0 10px", fontSize: 12 }, onClick: () => setCustomPin(null) }, t("cancel")),
+    customPin?.err ? (0, import_react2.createElement)("div", { style: { color: "var(--dsw-alias-state-error-primary,#dc2626)", marginTop: 4 } }, customPin.err) : null
+  );
+  const customBtn = (which) => (0, import_react2.createElement)("button", { style: { ...styles.btn, height: 26, padding: "0 10px", fontSize: 12, marginLeft: 8 }, onClick: () => setCustomPin({ which, value: "", err: null }) }, t("customize"));
   const lanUrl = status?.lanUrl;
   const tunnelUrl = status?.tunnelUrl;
   const tunnelPhase = tunnelState?.phase ?? "idle";
@@ -1640,11 +1695,12 @@ function PocketSettingsTab({ rpcCall, t }) {
             onClick: () => setLanAuth(false)
           }, t("off"))
         ),
-        status?.lanAuthEnabled !== false ? (0, import_react2.createElement)(
+        status?.lanAuthEnabled !== false ? customPin?.which === "lan" ? customPinRow("lan") : (0, import_react2.createElement)(
           "div",
           { style: { marginTop: 6, fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)", lineHeight: 1.5 } },
-          fmt(t, "lanPinValue", { pin: status.lanToken }),
-          (0, import_react2.createElement)("button", { style: { ...styles.btn, height: 26, padding: "0 10px", fontSize: 12, marginLeft: 8 }, onClick: refreshLanPin }, t("refresh"))
+          fmt(t, status?.lanPinCustom ? "lanPinCustomValue" : "lanPinValue", { pin: status.lanToken }),
+          (0, import_react2.createElement)("button", { style: { ...styles.btn, height: 26, padding: "0 10px", fontSize: 12, marginLeft: 8 }, onClick: refreshLanPin }, t("refresh")),
+          customBtn("lan")
         ) : (0, import_react2.createElement)(
           "div",
           { style: { marginTop: 6, fontSize: 12, color: "var(--dsw-alias-state-warn-primary,#b45309)", lineHeight: 1.5 } },
@@ -1663,10 +1719,12 @@ function PocketSettingsTab({ rpcCall, t }) {
         (0, import_react2.createElement)("img", { src: status.tunnelQr, alt: "Tunnel QR", style: styles.qr }),
         (0, import_react2.createElement)("div", { style: styles.code }, tunnelUrl),
         (0, import_react2.createElement)("div", { style: styles.muted }, t("wanHint")),
-        status.accessToken ? (0, import_react2.createElement)(
+        status.accessToken ? customPin?.which === "public" ? customPinRow("public") : (0, import_react2.createElement)(
           "div",
           { style: { marginTop: 6, fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)", lineHeight: 1.5 } },
-          fmt(t, "wanPin", { pin: status.accessToken })
+          fmt(t, status?.publicPinCustom ? "wanPinCustom" : "wanPin", { pin: status.accessToken }),
+          customBtn("public"),
+          status?.publicPinCustom ? (0, import_react2.createElement)("div", { style: { marginTop: 2, fontSize: 11, color: "var(--dsw-alias-state-warn-primary,#b45309)" } }, t("pinCustomHint")) : null
         ) : null,
         (0, import_react2.createElement)("button", { style: styles.btn, onClick: stopTunnel }, t("stopTunnel"))
       ) : (0, import_react2.createElement)(

package/client/index.jsx

@@ -196,6 +196,44 @@ function PocketSettingsTab({ rpcCall, t }) {
     } catch { /* 忽略 */ }
   };
 
+  // 自定义访问密码（issue #33）：公网/局域网各自设固定 8 位数字；自定义后公网不再自动轮换。
+  // customPin: { which: 'public'|'lan', value, err } | null —— 正在输入自定义密码的区块
+  const [customPin, setCustomPin] = useState(null);
+  const saveCustomPin = async (which) => {
+    try {
+      const r = await call(POCKET_ENDPOINTS.pinSetCustom, { which, value: customPin?.value ?? '' });
+      setStatus((s) => ({
+        ...s,
+        accessToken: which === 'public' ? r.pin : s.accessToken,
+        lanToken: which === 'lan' ? r.pin : s.lanToken,
+        publicPinCustom: which === 'public' ? true : s.publicPinCustom,
+        lanPinCustom: which === 'lan' ? true : s.lanPinCustom,
+      }));
+      setCustomPin(null);
+    } catch (err) {
+      setCustomPin((c) => ({ ...c, err: err.message }));
+    }
+  };
+  // 渲染自定义输入行（共用）：输入框 + 保存/取消
+  const customPinRow = (which) => h('div', { style: { marginTop: 6, fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)', lineHeight: 1.5 } },
+    t('customizing'),
+    h('input', {
+      style: { width: 110, margin: '0 6px', padding: '4px 8px', fontSize: 14, letterSpacing: 2, textAlign: 'center', border: '1px solid var(--dsw-alias-border-l2,#d1d5db)', borderRadius: 6, outline: 'none' },
+      type: 'password',
+      inputMode: 'numeric',
+      maxLength: 8,
+      value: customPin?.value ?? '',
+      autoFocus: true,
+      onChange: (e) => setCustomPin((c) => ({ ...c, value: e.target.value.replace(/\D/g, ''), err: null })),
+      onKeyDown: (e) => { if (e.key === 'Enter') saveCustomPin(which); if (e.key === 'Escape') setCustomPin(null); },
+    }),
+    h('button', { style: { ...styles.btn, height: 26, padding: '0 10px', fontSize: 12, marginLeft: 2 }, onClick: () => saveCustomPin(which) }, t('save')),
+    h('button', { style: { ...styles.btn, height: 26, padding: '0 10px', fontSize: 12 }, onClick: () => setCustomPin(null) }, t('cancel')),
+    customPin?.err ? h('div', { style: { color: 'var(--dsw-alias-state-error-primary,#dc2626)', marginTop: 4 } }, customPin.err) : null,
+  );
+  // 「自定义」按钮（非输入态显示在密码行末尾）
+  const customBtn = (which) => h('button', { style: { ...styles.btn, height: 26, padding: '0 10px', fontSize: 12, marginLeft: 8 }, onClick: () => setCustomPin({ which, value: '', err: null }) }, t('customize'));
+
   const lanUrl = status?.lanUrl;
   const tunnelUrl = status?.tunnelUrl;
   const tunnelPhase = tunnelState?.phase ?? 'idle';
@@ -277,10 +315,13 @@ function PocketSettingsTab({ rpcCall, t }) {
             }, t('off')),
           ),
           status?.lanAuthEnabled !== false
-            ? h('div', { style: { marginTop: 6, fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)', lineHeight: 1.5 } },
-              fmt(t, 'lanPinValue', { pin: status.lanToken }),
-              h('button', { style: { ...styles.btn, height: 26, padding: '0 10px', fontSize: 12, marginLeft: 8 }, onClick: refreshLanPin }, t('refresh')),
-            )
+            ? (customPin?.which === 'lan'
+                ? customPinRow('lan')
+                : h('div', { style: { marginTop: 6, fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)', lineHeight: 1.5 } },
+                  fmt(t, status?.lanPinCustom ? 'lanPinCustomValue' : 'lanPinValue', { pin: status.lanToken }),
+                  h('button', { style: { ...styles.btn, height: 26, padding: '0 10px', fontSize: 12, marginLeft: 8 }, onClick: refreshLanPin }, t('refresh')),
+                  customBtn('lan'),
+                ))
             : h('div', { style: { marginTop: 6, fontSize: 12, color: 'var(--dsw-alias-state-warn-primary,#b45309)', lineHeight: 1.5 } },
               t('lanPinOff')),
         )
@@ -296,8 +337,13 @@ function PocketSettingsTab({ rpcCall, t }) {
           h('div', { style: styles.code }, tunnelUrl),
           h('div', { style: styles.muted }, t('wanHint')),
           status.accessToken
-            ? h('div', { style: { marginTop: 6, fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)', lineHeight: 1.5 } },
-              fmt(t, 'wanPin', { pin: status.accessToken }))
+            ? (customPin?.which === 'public'
+                ? customPinRow('public')
+                : h('div', { style: { marginTop: 6, fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)', lineHeight: 1.5 } },
+                  fmt(t, status?.publicPinCustom ? 'wanPinCustom' : 'wanPin', { pin: status.accessToken }),
+                  customBtn('public'),
+                  status?.publicPinCustom ? h('div', { style: { marginTop: 2, fontSize: 11, color: 'var(--dsw-alias-state-warn-primary,#b45309)' } }, t('pinCustomHint')) : null,
+                ))
             : null,
           h('button', { style: styles.btn, onClick: stopTunnel }, t('stopTunnel')),
         )

package/client/pocket-locales.js

@@ -34,12 +34,20 @@ export const zh = {
   'on': '开',
   'off': '关',
   'lanPinValue': '🔐 访问密码：{pin}（手机打开需输入；与公网密码分开）',
+  'lanPinCustomValue': '🔐 访问密码：{pin}（自定义；手机打开需输入）',
   'refresh': '刷新',
+  'customize': '自定义',
+  'customizing': '新密码（8 位数字）：',
+  'save': '保存',
+  'cancel': '取消',
+  'pinInvalid': '密码必须是 8 位数字',
+  'pinCustomHint': '自定义后开启公网不再自动换新',
   'lanPinOff': '🔓 密码已关闭：扫码直连，无需密码（仅同一局域网设备可访问；公网仍要密码）',
   'lanStarting': '代理未就绪…',
   'wanTitle': '🌐 公网（人在外面）',
   'wanHint': '任何网络扫码即用（URL 每次重启自动换新）',
   'wanPin': '🔐 访问密码：{pin}（每次开启公网变新；手机打开链接需输入此密码）',
+  'wanPinCustom': '🔐 访问密码：{pin}（自定义，开启公网不再自动换新）',
   'stopTunnel': '关闭公网',
   'enable': '开启公网访问',
   'opening': '开启中…',
@@ -83,12 +91,20 @@ export const en = {
   'on': 'On',
   'off': 'Off',
   'lanPinValue': '🔐 PIN: {pin} (required on the phone; separate from the public PIN)',
+  'lanPinCustomValue': '🔐 PIN: {pin} (custom; required on the phone)',
   'refresh': 'Refresh',
+  'customize': 'Customize',
+  'customizing': 'New PIN (8 digits): ',
+  'save': 'Save',
+  'cancel': 'Cancel',
+  'pinInvalid': 'PIN must be exactly 8 digits',
+  'pinCustomHint': 'custom PINs are not rotated on tunnel start',
   'lanPinOff': '🔓 PIN off — scan & go, no PIN (LAN devices only; public still requires PIN)',
   'lanStarting': 'Proxy starting…',
   'wanTitle': '🌐 Anywhere (public)',
   'wanHint': 'Scan from any network (the URL changes on every restart)',
   'wanPin': '🔐 PIN: {pin} (changes each time the tunnel is enabled; required on the phone)',
+  'wanPinCustom': '🔐 PIN: {pin} (custom — not rotated on tunnel start)',
   'stopTunnel': 'Stop',
   'enable': 'Enable anywhere',
   'opening': 'Enabling…',

package/lib/index.js

@@ -15,12 +15,13 @@ import { readFileSync, mkdirSync, writeFileSync } from 'node:fs';
 import { writeFile, readFile, mkdir, rm } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
+import { randomBytes } from 'node:crypto';
 
 import { createPocketService } from './service.mjs';
 import { installPocketRpc } from './web-rpc.js';
 import { restartHost } from './restart.js';
 import { desktopEnvPatchScript, advancedNoticeScript, DEFAULT_INJECT } from './proxy.mjs';
-import { lanAuthEnabled, setLanAuthEnabled } from './settings.mjs';
+import { lanAuthEnabled, setLanAuthEnabled, pinCustom, setPinCustom } from './settings.mjs';
 
 const name = 'dsh-pocket';
 const inject = ['connection', 'webServer'];
@@ -42,10 +43,13 @@ function currentVersion() {
 /** 进程启动时加载的版本（模块加载瞬间固化；用于识别「磁盘已更新但进程还是旧代码」）。 */
 const loadedVersion = currentVersion();
 
-// ---------- 访问密码（issue #13 + #18） ----------
+// ---------- 访问密码（issue #13 + #18 + #33） ----------
 // 公网与局域网**分开**：各自 8 位数字，存本机 $DSH_HOME/dsh-pocket/。
-// 公网密码（token）：每次开启公网时轮换（旧链接作废）；
-// 局域网密码（token-lan）：手动刷新（设置页按钮）。
+// 公网密码（token）：默认每次开启公网时轮换（旧链接作废）；**用户自定义后不再轮换**；
+// 局域网密码（token-lan）：默认手动刷新（设置页按钮）；自定义后刷新会换回随机值。
+// 会话保持（issue #33）：登录 cookie 绑定进程级 sessionKey（见 apply）——
+// dsh web 重启/更新后 sessionKey 变化 → 手机需重新输入。
+const PIN_RE = /^\d{8}$/;
 function writePinToFile(p, fresh) {
   try {
     mkdirSync(dirname(p), { recursive: true });
@@ -56,7 +60,7 @@ function writePinToFile(p, fresh) {
 function readPin(p) {
   try {
     const existing = readFileSync(p, 'utf8').trim();
-    if (/^\d{8}$/.test(existing)) return existing;
+    if (PIN_RE.test(existing)) return existing;
   } catch { /* 无文件 */ }
   return null;
 }
@@ -70,11 +74,12 @@ function tokenPath() {
   return join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), tokenRel);
 }
 /** 当前公网访问密码；文件不存在时生成一个。 */
-function getAccessToken() {
+export function getAccessToken() {
   return readPin(tokenPath()) ?? writePinToFile(tokenPath(), newPin());
 }
-/** 轮换公网密码（开启公网时调用，旧密码/链接立即作废）。 */
-function rotateAccessToken() {
+/** 轮换公网密码（开启公网时调用）。用户自定义后不再轮换（尊重自定义值）。 */
+export function rotateAccessToken() {
+  if (pinCustom('public')) return getAccessToken();
   return writePinToFile(tokenPath(), newPin());
 }
 
@@ -87,14 +92,35 @@ function lanTokenPath() {
 function getLanToken() {
   return readPin(lanTokenPath()) ?? writePinToFile(lanTokenPath(), newPin());
 }
-/** 刷新局域网密码（设置页按钮触发，旧密码立即作废）。 */
+/** 刷新局域网密码（设置页按钮触发，旧密码立即作废）；换新后清除自定义标记。 */
 function refreshLanToken() {
+  setPinCustom('lan', false);
   return writePinToFile(lanTokenPath(), newPin());
 }
 /** 按 Host 分发的访问密码：公网隧道用公网密码，局域网用局域网密码。 */
 function tokenForHost(host) {
   return /trycloudflare\.com$/i.test(String(host ?? '')) ? getAccessToken() : getLanToken();
 }
+/**
+ * 用户自定义访问密码（issue #33）：公网/局域网各自设一个固定的 8 位数字。
+ * 自定义后公网开启时不再自动轮换（rotateAccessToken 见上）。
+ * 非法输入（非 8 位数字）抛错，由 RPC 层转成错误响应。
+ */
+export function setCustomPin(which, value) {
+  const v = String(value ?? '').trim();
+  if (!PIN_RE.test(v)) throw new Error('密码必须是 8 位数字 | PIN must be exactly 8 digits');
+  if (which === 'public') {
+    writePinToFile(tokenPath(), v);
+    setPinCustom('public', true);
+    return v;
+  }
+  if (which === 'lan') {
+    writePinToFile(lanTokenPath(), v);
+    setPinCustom('lan', true);
+    return v;
+  }
+  throw new Error('未知密码类型 | unknown PIN kind');
+}
 
 const restartNoticeRel = join('dsh-pocket', 'restarted.json');
 function restartNoticePath() {
@@ -203,16 +229,19 @@ export function apply(ctx, config = {}, internals = {}) {
     injectHtml: isDesktop
       ? DEFAULT_INJECT + desktopEnvPatchScript(process.platform) + (desktopAdvanced ? advancedNoticeScript() : '')
       : undefined,
-    // 访问密码（issue #13 + #18 + #24）：公网永远要密码（每次开启变新）；
-    // 局域网按开关（默认开启；关闭后局域网扫码直连，仅同网段设备可访问）
+    // 访问密码（issue #13 + #18 + #24 + #33）：公网永远要密码（默认每次开启变新，
+    // 用户自定义后不再轮换）；局域网按开关（默认开启；关闭后局域网扫码直连）。
     auth: {
+      // sessionKey：进程级随机密钥——登录 cookie 绑定它（会话保持，issue #33）：
+      // dsh web 重启/更新后 sessionKey 变化 → 手机需重新输入
+      sessionKey: randomBytes(16).toString('hex'),
       getToken: (host) => tokenForHost(host),
       isProtected: (host) => /trycloudflare\.com$/i.test(String(host ?? '')) ? true : lanAuthEnabled(),
     },
-    // 每次公网隧道就绪 → 轮换 8 位密码（旧密码/旧链接立即作废）
+    // 每次公网隧道就绪 → 轮换 8 位密码（旧密码/旧链接立即作废；用户自定义后不轮换）
     onTunnelReady: () => {
       const fresh = rotateAccessToken();
-      logger.info('dsh-pocket: public access PIN rotated | 公网访问密码已更新（旧链接作废）');
+      logger.info('dsh-pocket: public access PIN refreshed | 公网访问密码已更新（自定义密码不受影响）');
       return fresh;
     },
   });
@@ -226,6 +255,8 @@ export function apply(ctx, config = {}, internals = {}) {
     refreshLanToken: () => refreshLanToken(),
     getLanAuthEnabled: () => lanAuthEnabled(),
     setLanAuthEnabled: (on) => setLanAuthEnabled(on),
+    getPinCustom: (which) => pinCustom(which),
+    setCustomPin: (which, value) => setCustomPin(which, value),
     runUpdate: internals.runUpdate ?? { currentVersion, perform: performUpdate, loadedVersion: () => loadedVersion },
     restart: internals.restart ?? (() => pocketRestart(service)),
     restartNotice: internals.restartNotice ?? consumeRestartNotice,

package/lib/proxy.mjs

@@ -14,6 +14,7 @@
 import { createServer } from 'node:http';
 import { request as httpRequest } from 'node:http';
 import { createGzip, createBrotliCompress, constants as zlibConstants } from 'node:zlib';
+import { createHash } from 'node:crypto';
 
 const DEFAULT_UPSTREAM = { host: '127.0.0.1', port: 3080 };
 
@@ -62,10 +63,82 @@ export function advancedNoticeScript() {
   return `<script data-dsh-pocket-advanced-notice="1">!function(){try{var d=document.createElement('div');d.style.cssText='position:fixed;inset:0;z-index:2147483647;display:flex;align-items:center;justify-content:center;background:rgba(0,0,0,.55);color:#fff;font:15px/1.7 -apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;text-align:center;padding:24px';d.textContent='DSH 桌面端处于 advanced 模式，手机访问暂不支持。请在桌面端设置中切回 compatibility 模式后重启。| DSH Desktop is in advanced mode — phone access is not supported yet. Switch back to compatibility in the desktop app and restart.';document.documentElement.appendChild(d);}catch(e){}}();</script>`;
 }
 
-// ---------- 可选访问令牌认证（issue #13） ----------
-// 只对公网隧道 Host（trycloudflare.com）强制；局域网免密码。
-// 登录成功后种 HttpOnly 会话 cookie（浏览器关闭失效）→ SPA 内部 API/WS 自动携带。
+// ---------- 可选访问令牌认证（issue #13 + #33） ----------
+// 只对受保护 Host（公网隧道 + 局域网按开关）强制。
+// 登录成功后种 HttpOnly 持久 cookie（Max-Age 30 天）→ SPA 内部 API/WS 自动携带。
+// 会话保持（issue #33）：cookie 值 = sha256(PIN:sessionKey)——sessionKey 是 dsh web
+// 进程级随机密钥（lib/index.js 每次启动生成）。于是：
+//   - 电脑 dsh web 一直开着 → 手机输一次密码后长期免输（持久 cookie）
+//   - dsh web 重启/更新 → sessionKey 变化 → 旧 cookie 失效 → 手机重新输入
 const TOKEN_COOKIE = 'dsh_pocket_token';
+const COOKIE_MAX_AGE = 30 * 24 * 60 * 60; // 30 天（秒）
+
+/** cookie 校验值：有 sessionKey 时派生，无则退化为 PIN 本身（向后兼容）。 */
+function cookieFor(token, sessionKey) {
+  if (!sessionKey) return token;
+  return createHash('sha256').update(`${token}:${sessionKey}`).digest('hex');
+}
+
+// ---------- 登录速率限制（issue #40，改进版方案 A） ----------
+// 8 位数字密码（10^8 组合）本身可接受，真正风险是「无限制重试」让穷举可行。
+// 这里做三层防护（内存态，随进程生命周期，与 sessionKey 一致）：
+//   1) 单 IP 滑动窗口：60 秒内失败 ≥5 次 → 锁 60 秒（429）
+//   2) 全局滑动窗口：1 分钟全局失败 > 50 次 → 全局锁 30 秒（防分布式扫描换 IP 绕过）
+//   3) 成功登录清空该 IP 计数
+// IP 识别：优先 cf-connecting-ip（Cloudflare 在隧道入口设置的**真实**客户端 IP，
+// 可信）；无则回退 socket remoteAddress。**不信任客户端 x-forwarded-for**（可伪造）。
+export const DEFAULT_RATE_LIMIT = {
+  windowMs: 60_000,      // 失败计数滑动窗口
+  maxFailures: 5,        // 窗口内失败阈值 → 触发单 IP 锁
+  lockMs: 60_000,        // 单 IP 锁定时长
+  globalMaxFailures: 50, // 全局失败阈值（同窗口）→ 触发全局锁
+  globalLockMs: 30_000,  // 全局锁定时长
+};
+function createRateLimiter(cfg = {}) {
+  const c = { ...DEFAULT_RATE_LIMIT, ...cfg };
+  const failCounts = new Map(); // ip -> { count, windowStart }
+  const ipLocks = new Map();    // ip -> lockedUntil
+  const global = { count: 0, windowStart: 0, lockedUntil: 0 };
+  return {
+    /** 该 IP 当前是否被锁；返回 { locked, retryAfter }。 */
+    status(ip) {
+      const now = Date.now();
+      if (global.lockedUntil > now) return { locked: true, retryAfter: Math.ceil((global.lockedUntil - now) / 1000) };
+      const until = ipLocks.get(ip) ?? 0;
+      if (until > now) return { locked: true, retryAfter: Math.ceil((until - now) / 1000) };
+      return { locked: false, retryAfter: 0 };
+    },
+    /** 记一次失败：维护滑动窗口计数，达阈值触发单 IP / 全局锁。 */
+    record(ip) {
+      const now = Date.now();
+      let rec = failCounts.get(ip);
+      if (!rec || now - rec.windowStart > c.windowMs) rec = { count: 0, windowStart: now };
+      rec.count++;
+      failCounts.set(ip, rec);
+      if (now - global.windowStart > c.windowMs) { global.count = 0; global.windowStart = now; }
+      global.count++;
+      if (rec.count >= c.maxFailures) ipLocks.set(ip, now + c.lockMs);
+      if (global.count >= c.globalMaxFailures) global.lockedUntil = now + c.globalLockMs;
+      // 防内存膨胀：超过 2000 条记录时清掉已过窗口期的条目
+      if (failCounts.size > 2000) {
+        for (const [k, v] of failCounts) {
+          if (now - v.windowStart > c.windowMs) failCounts.delete(k);
+        }
+      }
+    },
+    /** 成功登录：清空该 IP 计数与锁。 */
+    clear(ip) {
+      failCounts.delete(ip);
+      ipLocks.delete(ip);
+    },
+  };
+}
+/** 客户端真实 IP：cf-connecting-ip（隧道，可信）优先，否则 socket 地址；不信 XFF。 */
+function clientIp(req) {
+  const cf = String(req.headers['cf-connecting-ip'] ?? '').trim();
+  if (cf) return cf;
+  return String(req.socket?.remoteAddress ?? 'unknown');
+}
 
 function parseCookies(header) {
   const out = {};
@@ -76,10 +149,13 @@ function parseCookies(header) {
   return out;
 }
 
-/** 登录页：按访问来源显示提示（局域网 / 公网）。 */
-function loginPageHtml(error, isPublic) {
+/** 登录页：按访问来源显示提示（局域网 / 公网）；error: false|true|'locked'（locked 带剩余秒数）。 */
+function loginPageHtml(error, isPublic, retryAfter = 0) {
   const where = isPublic ? '此公网地址' : '此局域网地址';
   const whereEn = isPublic ? 'This public address' : 'This LAN address';
+  const errMsg = error === 'locked'
+    ? `尝试次数过多，请 ${retryAfter} 秒后再试 | Too many attempts — try again in ${retryAfter}s`
+    : error ? '密码错误，请重试 | Wrong PIN, try again' : '';
   return `<!doctype html><html lang="zh"><head><meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
 <title>DSH Pocket · 访问验证</title>
@@ -95,7 +171,7 @@ button{width:100%;padding:10px;font-size:15px;background:#4f6ef7;color:#fff;bord
 </style></head><body><div class="card">
 <h1>🔐 DSH Pocket</h1>
 <p>${where}受访问密码保护，请输入 8 位数字密码 | ${whereEn} is password-protected — enter the 8-digit PIN</p>
-<div class="err">${error ? '密码错误，请重试' : ''}</div>
+<div class="err">${errMsg}</div>
 <form method="post" action="/pocket-login">
 <input name="token" type="password" inputmode="numeric" maxlength="8" autocomplete="one-time-code" autofocus required>
 <button type="submit">进入 | Enter</button>
@@ -115,12 +191,13 @@ function isHtmlRequest(req) {
 }
 
 /** 校验请求是否已认证；返回 true 放行。 */
-function authCheck(req, token) {
+function authCheck(req, token, sessionKey) {
   if (!token) return true; // 无 token（未配置密码）→ 放行
+  const expected = cookieFor(token, sessionKey);
   const cookieTok = parseCookies(req.headers.cookie)[TOKEN_COOKIE];
-  if (cookieTok === token) return true;
+  if (cookieTok === expected) return true;
   const qTok = new URL(req.url ?? '/', 'http://x').searchParams.get('token');
-  return qTok === token;
+  return qTok === expected;
 }
 
 /** 把浏览器可见的权威改写成 loopback 权威（Host 和 Origin 都改）。 */
@@ -139,42 +216,61 @@ function loopbackAuthority(headers, upstream) {
  * @param {string} [opts.host]      监听地址（默认 0.0.0.0：LAN 与隧道都能到）
  * @param {{host:string,port:number}} [opts.upstream] 上游 dsh web（默认 127.0.0.1:3080）
  * @param {string} [opts.injectHtml] 注入 HTML 的内容（默认 polyfill + 移动端适配；传 '' 关闭）
- * @param {object} [opts.auth]       可选访问令牌认证（issue #13）：{ getToken, isProtected }
+ * @param {object} [opts.auth]       可选访问令牌认证（issue #13）：{ getToken, isProtected, sessionKey }
+ * @param {object} [opts.rateLimit]  登录速率限制参数覆盖（issue #40；测试用短窗口）
  * @returns {Promise<{server:import('node:http').Server, close:()=>Promise<void>}>}
  */
-export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DEFAULT_UPSTREAM, log = null, injectHtml = DEFAULT_INJECT, auth = null } = {}) {
+export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DEFAULT_UPSTREAM, log = null, injectHtml = DEFAULT_INJECT, auth = null, rateLimit = null } = {}) {
+  const limiter = auth ? createRateLimiter(rateLimit ?? {}) : null;
   const server = createServer((req, res) => {
-    // 访问令牌认证（issue #13 + #18）：局域网与公网都要求密码
+    // 访问令牌认证（issue #13 + #18 + #33 + #40）：局域网与公网按开关/来源要求密码
     if (auth) {
       const host = String(req.headers.host ?? '');
       const isPublic = /trycloudflare\.com$/i.test(host);
       const protectedHost = isProtectedHost(host, auth.isProtected);
       const token = protectedHost ? (auth.getToken?.(host) ?? null) : null;
+      const sessionKey = auth.sessionKey ?? null;
       if (protectedHost && token) {
-        // 登录提交：校验密码 → 种 HttpOnly 会话 cookie → 回首页
+        const ip = clientIp(req);
+        // 登录提交：速率限制（issue #40）→ 校验密码 → 种持久 HttpOnly cookie（30 天，绑定进程会话密钥）→ 回首页
         if (req.method === 'POST' && req.url?.startsWith('/pocket-login')) {
+          const rl = limiter?.status(ip) ?? { locked: false, retryAfter: 0 };
+          if (rl.locked) {
+            res.writeHead(429, {
+              'content-type': 'text/html; charset=utf-8',
+              'cache-control': 'no-store',
+              'retry-after': String(rl.retryAfter),
+            });
+            res.end(loginPageHtml('locked', isPublic, rl.retryAfter));
+            return;
+          }
           let body = '';
           req.on('data', (c) => { body += c; if (body.length > 1024) req.destroy(); });
           req.on('end', () => {
             const submitted = String(new URLSearchParams(body).get('token') ?? '');
             if (submitted === token) {
+              limiter?.clear(ip);
               res.writeHead(302, {
                 location: '/',
-                'set-cookie': `${TOKEN_COOKIE}=${token}; HttpOnly; SameSite=Lax; Path=/`,
+                'set-cookie': `${TOKEN_COOKIE}=${cookieFor(token, sessionKey)}; HttpOnly; SameSite=Lax; Path=/; Max-Age=${COOKIE_MAX_AGE}`,
                 'cache-control': 'no-store',
               });
               res.end();
             } else {
+              limiter?.record(ip);
+              log?.(`dsh-pocket: login failed from ${ip} | 登录失败 IP: ${ip}`);
               res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
               res.end(loginPageHtml(true, isPublic));
             }
           });
           return;
         }
-        if (!authCheck(req, token)) {
+        if (!authCheck(req, token, sessionKey)) {
           if (isHtmlRequest(req)) {
+            // 锁定期间打开登录页也给提示（HTTP 200 + 锁定文案；429 语义留给 POST 拒绝）
+            const rl = limiter?.status(ip) ?? { locked: false, retryAfter: 0 };
             res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
-            res.end(loginPageHtml(false, isPublic));
+            res.end(loginPageHtml(rl.locked ? 'locked' : false, isPublic, rl.retryAfter));
           } else {
             res.writeHead(401, { 'content-type': 'application/json', 'cache-control': 'no-store' });
             res.end('{"error":"unauthorized"}');
@@ -267,7 +363,7 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
     if (auth) {
       const host = String(req.headers.host ?? '');
       const token = isProtectedHost(host, auth.isProtected) ? (auth.getToken?.(host) ?? null) : null;
-      if (token && !authCheck(req, token)) {
+      if (token && !authCheck(req, token, auth.sessionKey ?? null)) {
         socket.write('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
         socket.destroy();
         return;

package/lib/settings.mjs

@@ -1,6 +1,9 @@
 // dsh-pocket 设置持久化（$DSH_HOME/dsh-pocket/settings.json）
 //
-// 当前只有一项：局域网访问密码开关 lanAuthEnabled（issue #24）。
+// 当前项：
+//   - lanAuthEnabled    局域网访问密码开关（issue #24），默认开启
+//   - publicPinCustom   公网密码是否用户自定义（issue #33），自定义后不自动轮换
+//   - lanPinCustom      局域网密码是否用户自定义（issue #33）
 // 默认**开启**（安全优先）：局域网扫码也要输 8 位密码；
 // 用户可关闭——关闭后局域网扫码直连（仅同一网络内的设备能访问），公网不受影响（永远要密码）。
 
@@ -41,3 +44,25 @@ export function setLanAuthEnabled(on) {
   writeSettings(s);
   return s.lanAuthEnabled;
 }
+
+// ---------- 访问密码「自定义」标记（issue #33） ----------
+// 用户可把公网/局域网密码设成自己固定的 8 位数字（自定义后不再自动轮换）。
+// 标记存 settings.json：publicPinCustom / lanPinCustom。
+const PIN_CUSTOM_KEYS = { public: 'publicPinCustom', lan: 'lanPinCustom' };
+
+/** 该 PIN（public | lan）是否用户自定义过（自定义后不自动轮换）。 */
+export function pinCustom(which) {
+  const key = PIN_CUSTOM_KEYS[which];
+  if (!key) return false;
+  return readSettings()[key] === true;
+}
+
+/** 设置自定义标记，返回新状态。 */
+export function setPinCustom(which, on) {
+  const key = PIN_CUSTOM_KEYS[which];
+  if (!key) return false;
+  const s = readSettings();
+  s[key] = !!on;
+  writeSettings(s);
+  return !!on;
+}

package/lib/web-rpc.js

@@ -25,7 +25,7 @@ export function killHint(port) {
 }
 
 /** 注册 /dsh-pocket 逻辑通道（仅本机 loopback 可调）。 */
-export function installPocketRpc(ctx, { service, log = console, desktop = false, runUpdate = null, restart = null, restartNotice = null, getToken = null, getLanToken = null, refreshLanToken = null, getLanAuthEnabled = null, setLanAuthEnabled = null }) {
+export function installPocketRpc(ctx, { service, log = console, desktop = false, runUpdate = null, restart = null, restartNotice = null, getToken = null, getLanToken = null, refreshLanToken = null, getLanAuthEnabled = null, setLanAuthEnabled = null, getPinCustom = null, setCustomPin = null }) {
   if (!ctx?.connection?.rpc?.handle) {
     log.warn?.('dsh-pocket: DSH Host Connection RPC unavailable — settings tab disabled | 无 Connection RPC，设置页不可用');
     return () => {};
@@ -46,6 +46,8 @@ export function installPocketRpc(ctx, { service, log = console, desktop = false,
         accessToken: getToken?.() ?? null,
         lanToken: getLanToken?.() ?? null,
         lanAuthEnabled: getLanAuthEnabled?.() ?? true,
+        publicPinCustom: getPinCustom?.('public') ?? false,
+        lanPinCustom: getPinCustom?.('lan') ?? false,
       });
     };
 
@@ -63,6 +65,17 @@ export function installPocketRpc(ctx, { service, log = console, desktop = false,
         if (enabled === undefined) return fail('bad-request', '局域网密码开关不可用 | LAN PIN switch unavailable');
         return ok({ lanAuthEnabled: enabled });
       }
+      if (endpoint === POCKET_ENDPOINTS.pinSetCustom) {
+        const which = payload?.which === 'public' || payload?.which === 'lan' ? payload.which : null;
+        if (!which) return fail('bad-request', '未知密码类型 | unknown PIN kind');
+        try {
+          const pin = setCustomPin?.(which, payload?.value);
+          if (pin === undefined) return fail('bad-request', '自定义密码不可用 | custom PIN unavailable');
+          return ok({ which, pin, custom: true });
+        } catch (err) {
+          return fail('bad-request', err?.message ?? String(err));
+        }
+      }
       if (endpoint === POCKET_ENDPOINTS.tunnelStart) {
         await service.startTunnel();
         return await statusPayload();

package/package.json

@@ -76,5 +76,5 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "version": "1.10.0"
+  "version": "1.11.1"
 }