dsh-pocket 1.15.0 → 1.16.0

package/README.en.md

@@ -44,6 +44,7 @@ What it looks like — the phone shows the exact same UI as your computer, live:
 | 📶 LAN QR access | Works out of the box: Settings → Phone access — scan the LAN QR on the same Wi-Fi (auto-detects the LAN IP; **under WSL it picks the Windows host's physical NIC IP**) |
 | 🚪 LAN switch | **Turn LAN access off/on with one click** in Settings (a confirmation dialog shows each time): off kills the LAN QR code and link instantly; public access is unaffected |
 | 🌐 Public QR (from anywhere) | Click "Enable anywhere" → cloudflared tunnel → scan the public QR over 4G / any network |
+| 🏷️ Fixed public hostname | Optional "**Named tunnel**" mode: paste a Cloudflare Tunnel Token + your own domain — the public address stays **fixed across restarts** (see below) |
 | 🔐 Access PIN | Public links require an **8-character PIN** (rotated on every tunnel start by default; **customizable to a fixed PIN** — custom PINs are not rotated); LAN has its own separate **8-character PIN** (on by default; switchable off in Settings — then LAN scans connect directly) |
 | 🔑 Custom PINs | Both the public and LAN PINs can be **set to your own fixed 8-character PIN (letters and digits) in Settings** (custom PINs are never auto-rotated) |
 | 🧘 Session persistence | Enter the PIN once and you're set for a long time (login is tied to the computer's dsh web process: as long as it stays up, the phone won't ask again; **after a dsh web restart/update, enter it once more**) |
@@ -95,6 +96,17 @@ On the same page click "**Enable anywhere**" → **a security disclaimer pops up
 
 > Upgrading: `dsh plugin --profile web update dsh-pocket --latest -w` (`--latest` is required across major versions — a `^0.x` range won't auto-jump to 1.x).
 
+### Fixed public hostname (named tunnel, optional)
+
+The default "quick tunnel" gets a new random URL on every restart. For a **fixed public address**, use a Cloudflare **named tunnel** (requires a Cloudflare account + your own domain):
+
+1. In [Cloudflare Zero Trust](https://one.dash.cloudflare.com/) → **Networks → Tunnels**, create a Tunnel and copy the **Tunnel Token**
+2. In that Tunnel's **Public Hostname**, point your domain (e.g. `pocket.example.com`) to `http://127.0.0.1:3081`
+3. Back in the settings page's public section: switch the mode to "**Named tunnel**", paste the Tunnel Token, enter the fixed hostname, and save
+4. Click "Enable anywhere" → the public address is now your own hostname and **survives restarts**
+
+Note: in named-tunnel mode the public PIN is **not auto-rotated** (the address is fixed, so the PIN stays the same across restarts) — manage it proactively with a custom PIN. The Tunnel Token is stored locally only (`$DSH_HOME/dsh-pocket/settings.json`, readable by your user only) and is never echoed back in the UI.
+
 ## ⚠️ Security (read first)
 
 - **DSH can execute code on your computer.** **LAN** QR/URL plus its own **8-character PIN** is the key (PIN **on by default**, switchable off — then LAN scans connect directly, same-network devices only) — **never share the LAN QR, URL or PIN**.
@@ -102,7 +114,8 @@ On the same page click "**Enable anywhere**" → **a security disclaimer pops up
 - **Public** access is protected by an **8-character PIN**: the link is random, the PIN rotates on every tunnel start by default, and old links die instantly — even a leaked link can't get in. **A custom PIN is never auto-rotated** (your value stays stable; custom PINs may use letters and digits).
 - Phone login state is tied to the computer's dsh web process: **no re-entry while dsh web stays up; one re-entry after a restart/update**.
 - **Login rate limiting** (anti brute-force): **5** consecutive wrong PINs from the same IP lock it for **60s**; a global failure threshold briefly locks everyone (blocks distributed IP-rotation scans); a successful login resets the counter.
-- The public URL is randomly assigned by cloudflared and **changes on every restart** (old links die automatically — a natural key rotation).
+- The public URL is randomly assigned by cloudflared and **changes on every restart** (old links die automatically — a natural key rotation); in **named-tunnel fixed-hostname** mode the address stays and the PIN is not auto-rotated — manage it with a custom PIN.
+- **Public detection is fail-closed** (issue #66): everything except loopback and private LAN addresses is treated as **public and PIN-gated** — including any self-hosted tunnel / reverse proxy pointing at the local port with its own hostname. There is no "change the domain to bypass the PIN" hole.
 - LAN mode exposes nothing publicly; only devices on the same network can reach it.
 - Built for personal use; the public PIN lives in `$DSH_HOME/dsh-pocket/token` (re-rolled per tunnel start unless customized), the LAN PIN in `$DSH_HOME/dsh-pocket/token-lan` (refreshed manually in Settings), and switches/custom flags in `$DSH_HOME/dsh-pocket/settings.json`.
 

package/README.md

@@ -44,6 +44,7 @@ DSH Pocket 就是干这个的：**装上它，手机扫个码，就能实时看
 | 📶 局域网扫码 | 装好即用：设置 → 手机访问，打开就有局域网二维码，手机连同一 WiFi 扫码即开（自动识别本机局域网 IP，**WSL 环境自动取 Windows 物理网卡 IP**） |
 | 🚪 局域网开关 | 设置页可**一键关闭/开启局域网访问**（切换时弹窗提醒）：关闭后局域网二维码/链接立即失效，仅公网可用 |
 | 🌐 公网扫码（人在外面） | 点「开启公网访问」→ cloudflared 隧道 → 出公网二维码，4G/任何网络都能访问 |
+| 🏷️ 公网固定域名 | 可选「**命名隧道**」模式：填 Cloudflare Tunnel Token + 自己的域名，公网地址**固定不变**（重启不再变；见下方说明） |
 | 🔐 访问密码 | 公网链接需输入 **8 位密码**（默认每次开启公网自动换新；**可自定义固定密码**——自定义后不再换新）；局域网有独立 **8 位密码**（默认开启，设置页可**一键关闭**——关闭后局域网扫码直连） |
 | 🔑 自定义密码 | 公网/局域网密码都可在设置页**设成自己固定的 8 位密码（英文字母大小写或数字）**（自定义后公网不再自动换新） |
 | 🧘 会话保持 | 手机输一次密码后**长期免输**（登录状态绑定电脑上的 dsh web 进程：只要它不重启，手机不用再输；**dsh web 重启/更新后需重新输入一次**） |
@@ -95,6 +96,17 @@ npx @deepseek-ai/dsh web
 
 > 更新到新版本：`dsh plugin --profile web update dsh-pocket --latest -w`（跨大版本时 `--latest` 是必须的，`^0.x` 范围不会自动升到 1.x）。
 
+### 公网固定域名（命名隧道，可选）
+
+默认「快速隧道」的公网地址每次重启都会变（前缀随机）。想要**固定公网地址**，可用 Cloudflare **命名隧道**（需要 Cloudflare 账号 + 自己的域名）：
+
+1. 在 [Cloudflare Zero Trust](https://one.dash.cloudflare.com/) → **Networks → Tunnels** 创建一条 Tunnel，复制 **Tunnel Token**
+2. 在该 Tunnel 的 **Public Hostname** 里把你的域名（如 `pocket.example.com`）的 Service 指向 `http://127.0.0.1:3081`
+3. 回到设置页公网区块：模式切到「**命名隧道**」，粘贴 Tunnel Token、填写固定域名，保存
+4. 点「开启公网访问」→ 公网地址固定为你的域名，**重启不再变化**
+
+注意：命名隧道模式下公网密码**不自动轮换**（地址固定，重启后密码不变），建议配合「自定义密码」主动管理；Tunnel Token 只存本机（`$DSH_HOME/dsh-pocket/settings.json`，仅本机可读），设置页不回显。
+
 ## ⚠️ 安全（必读）
 
 - **DSH 能执行你电脑上的代码**。**局域网**二维码/URL 配上独立 **8 位密码**才是钥匙（密码**默认开启**，可关——关闭后局域网扫码直连，仅同一网络设备可访问），**请勿把局域网二维码、URL 或密码发给别人**
@@ -102,7 +114,8 @@ npx @deepseek-ai/dsh web
 - **公网**有 **8 位密码**保护：链接随机分配、默认每次开启换新密码、旧链接立即作废——泄露了也进不来，改密码/重开即可作废；**自定义密码后不再自动换新**（你设的值即稳定密码，可为英文字母大小写或数字）
 - 手机登录状态与电脑上的 dsh web 进程绑定：**电脑 dsh web 一直开着就不用重复输入；重启/更新后需重新输入一次**
 - **登录限速**（防暴力破解）：同一 IP 连续输错 **5 次**锁定 **60 秒**；全局失败超阈值时短暂全锁（防换 IP 分布式扫描）；输对密码后计数清零
-- 公网 URL 由 cloudflared 随机分配，**每次重启会变化**（旧链接自动失效，相当于天然轮换）
+- 公网 URL 由 cloudflared 随机分配，**每次重启会变化**（旧链接自动失效，相当于天然轮换）；**命名隧道固定域名**模式下地址不变、密码不自动轮换，请配合自定义密码管理
+- **公网判定是 fail closed**（issue #66）：除本机（loopback）和局域网私网地址外，**一切陌生域名（包括你自建隧道/反向代理指向本机端口的固定域名）一律按公网处理、强制公网密码**——不存在「换域名绕过密码」的口子
 - 局域网模式不暴露公网，只有同一网络内的设备能访问
 - 适合个人自用；公网密码存本机 `$DSH_HOME/dsh-pocket/token`（默认每次开启公网自动换新，**自定义后不换**），局域网密码存 `$DSH_HOME/dsh-pocket/token-lan`（设置页手动刷新），开关/自定义标记存 `$DSH_HOME/dsh-pocket/settings.json`
 

package/client/api.js

@@ -5,6 +5,7 @@ export const POCKET_ENDPOINTS = Object.freeze({
   status: 'pocket.status',
   tunnelStart: 'tunnel.start',
   tunnelStop: 'tunnel.stop',
+  tunnelSetConfig: 'tunnel.setConfig',
   version: 'pocket.version',
   update: 'pocket.update',
   restart: 'pocket.restart',
@@ -62,6 +63,7 @@ export function redactStatus(s) {
     tunnelUrl: s?.tunnelUrl ?? null,
     tunnelQr: s?.tunnelQr ?? null,
     tunnelState: s?.tunnelState ?? { phase: 'idle' },
+    tunnelConfig: s?.tunnelConfig ?? { mode: 'quick', hostname: '', tokenSet: false },
     dshPort: s?.dshPort ?? null,
   };
 }

package/client/client.js

@@ -45,6 +45,7 @@ var POCKET_ENDPOINTS = Object.freeze({
   status: "pocket.status",
   tunnelStart: "tunnel.start",
   tunnelStop: "tunnel.stop",
+  tunnelSetConfig: "tunnel.setConfig",
   version: "pocket.version",
   update: "pocket.update",
   restart: "pocket.restart",
@@ -95,6 +96,7 @@ function redactStatus(s) {
     tunnelUrl: s?.tunnelUrl ?? null,
     tunnelQr: s?.tunnelQr ?? null,
     tunnelState: s?.tunnelState ?? { phase: "idle" },
+    tunnelConfig: s?.tunnelConfig ?? { mode: "quick", hostname: "", tokenSet: false },
     dshPort: s?.dshPort ?? null
   };
 }
@@ -1396,6 +1398,19 @@ var zh2 = {
   "stopTunnel": "\u5173\u95ED\u516C\u7F51",
   "enable": "\u5F00\u542F\u516C\u7F51\u8BBF\u95EE",
   "opening": "\u5F00\u542F\u4E2D\u2026",
+  "tunnelMode": "\u516C\u7F51\u6A21\u5F0F\uFF1A",
+  "modeQuick": "\u968F\u673A\u57DF\u540D\uFF08\u9ED8\u8BA4\uFF09",
+  "modeNamed": "\u56FA\u5B9A\u57DF\u540D",
+  "namedSummary": "\u56FA\u5B9A\u57DF\u540D\uFF1A{host} \xB7 Token {token}",
+  "namedTokenSet": "\u5DF2\u914D\u7F6E",
+  "namedTokenMissing": "\u672A\u914D\u7F6E",
+  "namedEdit": "\u4FEE\u6539",
+  "namedHostnameLabel": "\u56FA\u5B9A\u57DF\u540D\uFF1A",
+  "namedTokenLabel": "Tunnel Token\uFF08\u7559\u7A7A = \u4FDD\u6301\u4E0D\u53D8\uFF09\uFF1A",
+  "namedHow": "\u5728 Cloudflare Zero Trust \u2192 Networks \u2192 Tunnels \u521B\u5EFA\u96A7\u9053\u5E76\u590D\u5236 Token\uFF1B\u628A\u57DF\u540D\u7684 Service \u6307\u5411 http://127.0.0.1:3081\uFF08\u4EE3\u7406\u7AEF\u53E3\uFF09\u3002\u5730\u5740\u56FA\u5B9A\uFF0C\u91CD\u542F\u4E0D\u518D\u53D8\u5316\u3002",
+  "namedSecurity": "\u56FA\u5B9A\u57DF\u540D\u957F\u671F\u66B4\u9732\u5728\u516C\u7F51\u3001\u66F4\u6613\u88AB\u626B\u63CF\uFF0C\u5EFA\u8BAE\u540C\u65F6\u8BBE\u7F6E\u81EA\u5B9A\u4E49\u5F3A\u5BC6\u7801\uFF08\u672C\u6A21\u5F0F\u516C\u7F51\u5BC6\u7801\u9ED8\u8BA4\u4E0D\u968F\u91CD\u542F\u8F6E\u6362\uFF09\u3002",
+  "namedNeedCfg": "\u8BF7\u5148\u586B\u5199\u56FA\u5B9A\u57DF\u540D\u4E0E Tunnel Token",
+  "namedRunningHint": "\u56FA\u5B9A\u57DF\u540D\uFF08Cloudflare \u547D\u540D\u96A7\u9053\uFF09\u2014\u2014\u5730\u5740\u4E0D\u968F\u91CD\u542F\u53D8\u5316",
   "disclaimerTitle": "\u26A0\uFE0F \u5B89\u5168\u514D\u8D23\u58F0\u660E",
   "disclaimerBody": "\u5F00\u542F\u516C\u7F51 = \u628A\u672C\u673A DSH\uFF08\u80FD\u6267\u884C\u4EE3\u7801\uFF09\u66B4\u9732\u5230\u4E92\u8054\u7F51\u3002\u4EFB\u4F55\u4EBA\u62FF\u5230\u516C\u7F51\u94FE\u63A5\u548C\u5BC6\u7801\uFF0C\u90FD\u80FD\u8BBF\u95EE\u751A\u81F3\u64CD\u4F5C\u4F60\u7684\u7535\u8111\u3002\u8BF7\u786E\u8BA4\uFF1A\u2460 \u4F7F\u7528\u81EA\u5B9A\u4E49\u5F3A\u5BC6\u7801\u6216\u59A5\u5584\u4FDD\u7BA1\u81EA\u52A8\u5BC6\u7801\uFF1B\u2461 \u7528\u5B8C\u7ACB\u5373\u300C\u5173\u95ED\u516C\u7F51\u300D\uFF1B\u2462 \u516C\u53F8/\u6D89\u5BC6\u7F51\u7EDC\u8BF7\u5148\u786E\u8BA4\u5408\u89C4\u3002",
   "disclaimerAgree": "\u6211\u5DF2\u77E5\u60C5\uFF0C\u540C\u610F\u5F00\u542F",
@@ -1465,6 +1480,19 @@ var en2 = {
   "stopTunnel": "Stop",
   "enable": "Enable anywhere",
   "opening": "Enabling\u2026",
+  "tunnelMode": "Mode:",
+  "modeQuick": "Random URL (default)",
+  "modeNamed": "Fixed domain",
+  "namedSummary": "Fixed domain: {host} \xB7 Token {token}",
+  "namedTokenSet": "configured",
+  "namedTokenMissing": "not set",
+  "namedEdit": "Edit",
+  "namedHostnameLabel": "Fixed domain:",
+  "namedTokenLabel": "Tunnel Token (blank = keep current):",
+  "namedHow": "Create a tunnel in Cloudflare Zero Trust \u2192 Networks \u2192 Tunnels and copy the token; point the hostname's Service at http://127.0.0.1:3081 (the proxy port). The URL stays fixed across restarts.",
+  "namedSecurity": "A fixed domain is long-lived and easier to scan \u2014 set a strong custom PIN too (the public PIN is not rotated on restart in this mode).",
+  "namedNeedCfg": "Set the fixed domain and Tunnel Token first",
+  "namedRunningHint": "Fixed domain (Cloudflare named tunnel) \u2014 the URL no longer changes on restart",
   "disclaimerTitle": "\u26A0\uFE0F Security disclaimer",
   "disclaimerBody": "Enabling public access exposes this computer\u2019s DSH (which can execute code) to the internet. Anyone with the public link and PIN can reach \u2014 and operate \u2014 your computer. Please confirm: \u2460 use a strong custom PIN or keep the auto-generated one safe; \u2461 turn public access OFF as soon as you\u2019re done; \u2462 on a corporate/classified network, confirm compliance first.",
   "disclaimerAgree": "I understand and agree",
@@ -1612,6 +1640,11 @@ function PocketSettingsTab({ rpcCall, t }) {
   const [disclaimerOpen, setDisclaimerOpen] = (0, import_react2.useState)(false);
   const [disclaimerChecked, setDisclaimerChecked] = (0, import_react2.useState)(false);
   const doStartTunnel = async () => {
+    const cfg = status?.tunnelConfig;
+    if (cfg?.mode === "named" && (!cfg.hostname || !cfg.tokenSet)) {
+      setError(t("namedNeedCfg"));
+      return;
+    }
     setBusy(true);
     setError(null);
     setTunnelState({ phase: "starting", detail: "\u6B63\u5728\u5F00\u542F\u2026", startedAt: Date.now() });
@@ -1638,6 +1671,27 @@ function PocketSettingsTab({ rpcCall, t }) {
     } catch {
     }
   };
+  const [tunnelCfg, setTunnelCfg] = (0, import_react2.useState)(null);
+  const switchToQuick = async () => {
+    try {
+      setStatus(await call(POCKET_ENDPOINTS.tunnelSetConfig, { mode: "quick" }));
+    } catch (err) {
+      setError(err.message);
+    }
+  };
+  const saveNamedTunnel = async () => {
+    try {
+      setStatus(await call(POCKET_ENDPOINTS.tunnelSetConfig, {
+        mode: "named",
+        hostname: tunnelCfg?.hostname ?? "",
+        token: tunnelCfg?.token || void 0
+        // 留空不覆盖已存 Token
+      }));
+      setTunnelCfg(null);
+    } catch (err) {
+      setTunnelCfg((c) => ({ ...c, err: err.message }));
+    }
+  };
   const refreshLanPin = async () => {
     try {
       const r = await call(POCKET_ENDPOINTS.lanTokenRefresh, {});
@@ -1715,6 +1769,8 @@ function PocketSettingsTab({ rpcCall, t }) {
   const tunnelStarting = ["downloading", "starting", "registering"].includes(tunnelPhase);
   const tunnelStateDetail = tunnelState?.detail ?? "";
   const tunnelStateStarted = tunnelState?.startedAt ?? null;
+  const tunnelModeView = status?.tunnelConfig ?? { mode: "quick", hostname: "", tokenSet: false };
+  const namedMode = tunnelModeView.mode === "named";
   return (0, import_react2.createElement)(
     "div",
     { style: styles.card },
@@ -1851,18 +1907,87 @@ function PocketSettingsTab({ rpcCall, t }) {
         null,
         (0, import_react2.createElement)("img", { src: status.tunnelQr, alt: "Tunnel QR", style: styles.qr }),
         (0, import_react2.createElement)("div", { style: styles.code }, tunnelUrl),
-        (0, import_react2.createElement)("div", { style: styles.muted }, t("wanHint")),
+        (0, import_react2.createElement)("div", { style: styles.muted }, namedMode ? t("namedRunningHint") : t("wanHint")),
         status.accessToken ? customPin?.which === "public" ? customPinRow("public") : (0, import_react2.createElement)(
           "div",
           { style: { marginTop: 6, fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)", lineHeight: 1.5 } },
           fmt(t, status?.publicPinCustom ? "wanPinCustom" : "wanPin", { pin: status.accessToken }),
           customBtn("public"),
-          status?.publicPinCustom ? (0, import_react2.createElement)("div", { style: { marginTop: 2, fontSize: 11, color: "var(--dsw-alias-state-warn-primary,#b45309)" } }, t("pinCustomHint")) : null
+          status?.publicPinCustom ? (0, import_react2.createElement)("div", { style: { marginTop: 2, fontSize: 11, color: "var(--dsw-alias-state-warn-primary,#b45309)" } }, t("pinCustomHint")) : null,
+          namedMode ? (0, import_react2.createElement)("div", { style: { marginTop: 2, fontSize: 11, color: "var(--dsw-alias-state-warn-primary,#b45309)" } }, t("namedSecurity")) : null
         ) : null,
         (0, import_react2.createElement)("button", { style: styles.btn, onClick: stopTunnel }, t("stopTunnel"))
       ) : (0, import_react2.createElement)(
         "div",
         null,
+        // 公网模式（issue #66）：随机域名（默认）/ 固定域名（命名隧道）
+        (0, import_react2.createElement)(
+          "div",
+          { style: { display: "flex", alignItems: "center", gap: 8, marginTop: 8, flexWrap: "wrap" } },
+          (0, import_react2.createElement)("span", { style: { fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)" } }, t("tunnelMode")),
+          (0, import_react2.createElement)("button", {
+            style: { ...styles.btn, height: 28, padding: "0 12px", fontSize: 12, fontWeight: !namedMode ? 600 : 400, background: !namedMode ? "var(--dsw-alias-button-primary-fill, var(--dsw-alias-brand-primary,#4f6ef7))" : "var(--dsw-alias-bg-layer-1,#fff)", color: !namedMode ? "var(--dsw-alias-label-primary-foreground, #fff)" : "var(--dsw-alias-label-primary,inherit)" },
+            onClick: namedMode ? switchToQuick : void 0
+          }, t("modeQuick")),
+          (0, import_react2.createElement)("button", {
+            style: { ...styles.btn, height: 28, padding: "0 12px", fontSize: 12, fontWeight: namedMode ? 600 : 400, background: namedMode ? "var(--dsw-alias-button-primary-fill, var(--dsw-alias-brand-primary,#4f6ef7))" : "var(--dsw-alias-bg-layer-1,#fff)", color: namedMode ? "var(--dsw-alias-label-primary-foreground, #fff)" : "var(--dsw-alias-label-primary,inherit)" },
+            onClick: () => setTunnelCfg(tunnelCfg ? null : { hostname: tunnelModeView.hostname ?? "", token: "", err: null })
+          }, t("modeNamed"))
+        ),
+        // 固定域名：已保存的摘要 + 「修改」入口（非编辑态）
+        namedMode && !tunnelCfg ? (0, import_react2.createElement)(
+          "div",
+          { style: { marginTop: 6, fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)", lineHeight: 1.5 } },
+          fmt(t, "namedSummary", { host: tunnelModeView.hostname || "\u2014", token: tunnelModeView.tokenSet ? t("namedTokenSet") : t("namedTokenMissing") }),
+          (0, import_react2.createElement)("button", { style: { ...styles.btn, height: 26, padding: "0 10px", fontSize: 12, marginLeft: 8 }, onClick: () => setTunnelCfg({ hostname: tunnelModeView.hostname ?? "", token: "", err: null }) }, t("namedEdit")),
+          (0, import_react2.createElement)("div", { style: { ...styles.muted, marginTop: 4 } }, t("namedHow")),
+          !tunnelModeView.tokenSet || !tunnelModeView.hostname ? (0, import_react2.createElement)("div", { style: { marginTop: 2, fontSize: 12, color: "var(--dsw-alias-state-error-primary,#dc2626)" } }, t("namedNeedCfg")) : null
+        ) : null,
+        // 固定域名：编辑表单（域名 + Tunnel Token，Token 留空保持不变）
+        tunnelCfg ? (0, import_react2.createElement)(
+          "div",
+          { style: { marginTop: 8, fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)", lineHeight: 1.6 } },
+          (0, import_react2.createElement)(
+            "div",
+            null,
+            t("namedHostnameLabel"),
+            (0, import_react2.createElement)("input", {
+              style: { margin: "4px 0 0 6px", padding: "4px 8px", fontSize: 13, border: "1px solid var(--dsw-alias-border-l2,#d1d5db)", borderRadius: 6, outline: "none", width: 200 },
+              placeholder: "pocket.example.com",
+              value: tunnelCfg.hostname ?? "",
+              autoFocus: true,
+              onChange: (e) => setTunnelCfg((c) => ({ ...c, hostname: e.target.value.trim(), err: null })),
+              onKeyDown: (e) => {
+                if (e.key === "Enter") saveNamedTunnel();
+                if (e.key === "Escape") setTunnelCfg(null);
+              }
+            })
+          ),
+          (0, import_react2.createElement)(
+            "div",
+            { style: { marginTop: 6 } },
+            t("namedTokenLabel"),
+            (0, import_react2.createElement)("input", {
+              style: { margin: "4px 0 0 6px", padding: "4px 8px", fontSize: 13, border: "1px solid var(--dsw-alias-border-l2,#d1d5db)", borderRadius: 6, outline: "none", width: 240, fontFamily: "ui-monospace,Menlo,monospace" },
+              type: "password",
+              value: tunnelCfg.token ?? "",
+              onChange: (e) => setTunnelCfg((c) => ({ ...c, token: e.target.value.trim(), err: null })),
+              onKeyDown: (e) => {
+                if (e.key === "Enter") saveNamedTunnel();
+                if (e.key === "Escape") setTunnelCfg(null);
+              }
+            })
+          ),
+          (0, import_react2.createElement)(
+            "div",
+            { style: { marginTop: 6, display: "flex", gap: 8 } },
+            (0, import_react2.createElement)("button", { style: { ...styles.btn, height: 26, padding: "0 10px", fontSize: 12 }, onClick: saveNamedTunnel }, t("save")),
+            (0, import_react2.createElement)("button", { style: { ...styles.btn, height: 26, padding: "0 10px", fontSize: 12 }, onClick: () => setTunnelCfg(null) }, t("cancel"))
+          ),
+          (0, import_react2.createElement)("div", { style: { ...styles.muted, marginTop: 6 } }, t("namedHow")),
+          (0, import_react2.createElement)("div", { style: { marginTop: 2, fontSize: 11, color: "var(--dsw-alias-state-warn-primary,#b45309)", lineHeight: 1.5 } }, t("namedSecurity")),
+          tunnelCfg.err ? (0, import_react2.createElement)("div", { style: { color: "var(--dsw-alias-state-error-primary,#dc2626)", marginTop: 4 } }, tunnelCfg.err) : null
+        ) : null,
         (0, import_react2.createElement)("button", { style: { ...styles.primary, margin: "8px 0" }, onClick: startTunnel, disabled: busy || tunnelStarting }, busy ? t("opening") : t("enable")),
         tunnelStarting ? (0, import_react2.createElement)(
           "div",

package/client/index.jsx

@@ -169,6 +169,12 @@ function PocketSettingsTab({ rpcCall, t }) {
   const [disclaimerChecked, setDisclaimerChecked] = useState(false);
 
   const doStartTunnel = async () => {
+    // 命名隧道模式：Token/域名没配齐就不发起（服务端同样会拒绝）
+    const cfg = status?.tunnelConfig;
+    if (cfg?.mode === 'named' && (!cfg.hostname || !cfg.tokenSet)) {
+      setError(t('namedNeedCfg'));
+      return;
+    }
     setBusy(true);
     setError(null);
     setTunnelState({ phase: 'starting', detail: '正在开启…', startedAt: Date.now() });
@@ -195,6 +201,25 @@ function PocketSettingsTab({ rpcCall, t }) {
     try { setStatus(await call(POCKET_ENDPOINTS.tunnelStop, {})); } catch { /* 忽略 */ }
   };
 
+  // 公网模式（issue #66）：随机域名（默认零配置）/ 固定域名（Cloudflare 命名隧道 + Tunnel Token）
+  // tunnelCfg：编辑态 { hostname, token, err } | null；token 输入留空 = 保持已存的 Token 不变
+  const [tunnelCfg, setTunnelCfg] = useState(null);
+  const switchToQuick = async () => {
+    try { setStatus(await call(POCKET_ENDPOINTS.tunnelSetConfig, { mode: 'quick' })); } catch (err) { setError(err.message); }
+  };
+  const saveNamedTunnel = async () => {
+    try {
+      setStatus(await call(POCKET_ENDPOINTS.tunnelSetConfig, {
+        mode: 'named',
+        hostname: tunnelCfg?.hostname ?? '',
+        token: tunnelCfg?.token || undefined, // 留空不覆盖已存 Token
+      }));
+      setTunnelCfg(null);
+    } catch (err) {
+      setTunnelCfg((c) => ({ ...c, err: err.message }));
+    }
+  };
+
   // 刷新局域网访问密码（旧密码立即作废）
   const refreshLanPin = async () => {
     try {
@@ -279,6 +304,9 @@ function PocketSettingsTab({ rpcCall, t }) {
   const tunnelStarting = ['downloading', 'starting', 'registering'].includes(tunnelPhase);
   const tunnelStateDetail = tunnelState?.detail ?? '';
   const tunnelStateStarted = tunnelState?.startedAt ?? null;
+  // 公网模式视图（issue #66）：{ mode, hostname, tokenSet }
+  const tunnelModeView = status?.tunnelConfig ?? { mode: 'quick', hostname: '', tokenSet: false };
+  const namedMode = tunnelModeView.mode === 'named';
 
   return h('div', { style: styles.card },
     h('div', { style: { display: 'flex', alignItems: 'center', justifyContent: 'space-between', gap: 8 } },
@@ -400,7 +428,7 @@ function PocketSettingsTab({ rpcCall, t }) {
         ? h('div', null,
           h('img', { src: status.tunnelQr, alt: 'Tunnel QR', style: styles.qr }),
           h('div', { style: styles.code }, tunnelUrl),
-          h('div', { style: styles.muted }, t('wanHint')),
+          h('div', { style: styles.muted }, namedMode ? t('namedRunningHint') : t('wanHint')),
           status.accessToken
             ? (customPin?.which === 'public'
                 ? customPinRow('public')
@@ -408,11 +436,62 @@ function PocketSettingsTab({ rpcCall, t }) {
                   fmt(t, status?.publicPinCustom ? 'wanPinCustom' : 'wanPin', { pin: status.accessToken }),
                   customBtn('public'),
                   status?.publicPinCustom ? h('div', { style: { marginTop: 2, fontSize: 11, color: 'var(--dsw-alias-state-warn-primary,#b45309)' } }, t('pinCustomHint')) : null,
+                  namedMode ? h('div', { style: { marginTop: 2, fontSize: 11, color: 'var(--dsw-alias-state-warn-primary,#b45309)' } }, t('namedSecurity')) : null,
                 ))
             : null,
           h('button', { style: styles.btn, onClick: stopTunnel }, t('stopTunnel')),
         )
         : h('div', null,
+          // 公网模式（issue #66）：随机域名（默认）/ 固定域名（命名隧道）
+          h('div', { style: { display: 'flex', alignItems: 'center', gap: 8, marginTop: 8, flexWrap: 'wrap' } },
+            h('span', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)' } }, t('tunnelMode')),
+            h('button', {
+              style: { ...styles.btn, height: 28, padding: '0 12px', fontSize: 12, fontWeight: !namedMode ? 600 : 400, background: !namedMode ? 'var(--dsw-alias-button-primary-fill, var(--dsw-alias-brand-primary,#4f6ef7))' : 'var(--dsw-alias-bg-layer-1,#fff)', color: !namedMode ? 'var(--dsw-alias-label-primary-foreground, #fff)' : 'var(--dsw-alias-label-primary,inherit)' },
+              onClick: namedMode ? switchToQuick : undefined,
+            }, t('modeQuick')),
+            h('button', {
+              style: { ...styles.btn, height: 28, padding: '0 12px', fontSize: 12, fontWeight: namedMode ? 600 : 400, background: namedMode ? 'var(--dsw-alias-button-primary-fill, var(--dsw-alias-brand-primary,#4f6ef7))' : 'var(--dsw-alias-bg-layer-1,#fff)', color: namedMode ? 'var(--dsw-alias-label-primary-foreground, #fff)' : 'var(--dsw-alias-label-primary,inherit)' },
+              onClick: () => setTunnelCfg(tunnelCfg ? null : { hostname: tunnelModeView.hostname ?? '', token: '', err: null }),
+            }, t('modeNamed')),
+          ),
+          // 固定域名：已保存的摘要 + 「修改」入口（非编辑态）
+          namedMode && !tunnelCfg ? h('div', { style: { marginTop: 6, fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)', lineHeight: 1.5 } },
+            fmt(t, 'namedSummary', { host: tunnelModeView.hostname || '—', token: tunnelModeView.tokenSet ? t('namedTokenSet') : t('namedTokenMissing') }),
+            h('button', { style: { ...styles.btn, height: 26, padding: '0 10px', fontSize: 12, marginLeft: 8 }, onClick: () => setTunnelCfg({ hostname: tunnelModeView.hostname ?? '', token: '', err: null }) }, t('namedEdit')),
+            h('div', { style: { ...styles.muted, marginTop: 4 } }, t('namedHow')),
+            !tunnelModeView.tokenSet || !tunnelModeView.hostname ? h('div', { style: { marginTop: 2, fontSize: 12, color: 'var(--dsw-alias-state-error-primary,#dc2626)' } }, t('namedNeedCfg')) : null,
+          ) : null,
+          // 固定域名：编辑表单（域名 + Tunnel Token，Token 留空保持不变）
+          tunnelCfg ? h('div', { style: { marginTop: 8, fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)', lineHeight: 1.6 } },
+            h('div', null,
+              t('namedHostnameLabel'),
+              h('input', {
+                style: { margin: '4px 0 0 6px', padding: '4px 8px', fontSize: 13, border: '1px solid var(--dsw-alias-border-l2,#d1d5db)', borderRadius: 6, outline: 'none', width: 200 },
+                placeholder: 'pocket.example.com',
+                value: tunnelCfg.hostname ?? '',
+                autoFocus: true,
+                onChange: (e) => setTunnelCfg((c) => ({ ...c, hostname: e.target.value.trim(), err: null })),
+                onKeyDown: (e) => { if (e.key === 'Enter') saveNamedTunnel(); if (e.key === 'Escape') setTunnelCfg(null); },
+              }),
+            ),
+            h('div', { style: { marginTop: 6 } },
+              t('namedTokenLabel'),
+              h('input', {
+                style: { margin: '4px 0 0 6px', padding: '4px 8px', fontSize: 13, border: '1px solid var(--dsw-alias-border-l2,#d1d5db)', borderRadius: 6, outline: 'none', width: 240, fontFamily: 'ui-monospace,Menlo,monospace' },
+                type: 'password',
+                value: tunnelCfg.token ?? '',
+                onChange: (e) => setTunnelCfg((c) => ({ ...c, token: e.target.value.trim(), err: null })),
+                onKeyDown: (e) => { if (e.key === 'Enter') saveNamedTunnel(); if (e.key === 'Escape') setTunnelCfg(null); },
+              }),
+            ),
+            h('div', { style: { marginTop: 6, display: 'flex', gap: 8 } },
+              h('button', { style: { ...styles.btn, height: 26, padding: '0 10px', fontSize: 12 }, onClick: saveNamedTunnel }, t('save')),
+              h('button', { style: { ...styles.btn, height: 26, padding: '0 10px', fontSize: 12 }, onClick: () => setTunnelCfg(null) }, t('cancel')),
+            ),
+            h('div', { style: { ...styles.muted, marginTop: 6 } }, t('namedHow')),
+            h('div', { style: { marginTop: 2, fontSize: 11, color: 'var(--dsw-alias-state-warn-primary,#b45309)', lineHeight: 1.5 } }, t('namedSecurity')),
+            tunnelCfg.err ? h('div', { style: { color: 'var(--dsw-alias-state-error-primary,#dc2626)', marginTop: 4 } }, tunnelCfg.err) : null,
+          ) : null,
           h('button', { style: { ...styles.primary, margin: '8px 0' }, onClick: startTunnel, disabled: busy || tunnelStarting }, busy ? t('opening') : t('enable')),
           tunnelStarting
             ? h('div', { style: { marginTop: 4, fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)' } },

package/client/pocket-locales.js

@@ -61,6 +61,19 @@ export const zh = {
   'stopTunnel': '关闭公网',
   'enable': '开启公网访问',
   'opening': '开启中…',
+  'tunnelMode': '公网模式：',
+  'modeQuick': '随机域名（默认）',
+  'modeNamed': '固定域名',
+  'namedSummary': '固定域名：{host} · Token {token}',
+  'namedTokenSet': '已配置',
+  'namedTokenMissing': '未配置',
+  'namedEdit': '修改',
+  'namedHostnameLabel': '固定域名：',
+  'namedTokenLabel': 'Tunnel Token（留空 = 保持不变）：',
+  'namedHow': '在 Cloudflare Zero Trust → Networks → Tunnels 创建隧道并复制 Token；把域名的 Service 指向 http://127.0.0.1:3081（代理端口）。地址固定，重启不再变化。',
+  'namedSecurity': '固定域名长期暴露在公网、更易被扫描，建议同时设置自定义强密码（本模式公网密码默认不随重启轮换）。',
+  'namedNeedCfg': '请先填写固定域名与 Tunnel Token',
+  'namedRunningHint': '固定域名（Cloudflare 命名隧道）——地址不随重启变化',
   'disclaimerTitle': '⚠️ 安全免责声明',
   'disclaimerBody': '开启公网 = 把本机 DSH（能执行代码）暴露到互联网。任何人拿到公网链接和密码，都能访问甚至操作你的电脑。请确认：① 使用自定义强密码或妥善保管自动密码；② 用完立即「关闭公网」；③ 公司/涉密网络请先确认合规。',
   'disclaimerAgree': '我已知情，同意开启',
@@ -132,6 +145,19 @@ export const en = {
   'stopTunnel': 'Stop',
   'enable': 'Enable anywhere',
   'opening': 'Enabling…',
+  'tunnelMode': 'Mode:',
+  'modeQuick': 'Random URL (default)',
+  'modeNamed': 'Fixed domain',
+  'namedSummary': 'Fixed domain: {host} · Token {token}',
+  'namedTokenSet': 'configured',
+  'namedTokenMissing': 'not set',
+  'namedEdit': 'Edit',
+  'namedHostnameLabel': 'Fixed domain:',
+  'namedTokenLabel': 'Tunnel Token (blank = keep current):',
+  'namedHow': 'Create a tunnel in Cloudflare Zero Trust → Networks → Tunnels and copy the token; point the hostname\'s Service at http://127.0.0.1:3081 (the proxy port). The URL stays fixed across restarts.',
+  'namedSecurity': 'A fixed domain is long-lived and easier to scan — set a strong custom PIN too (the public PIN is not rotated on restart in this mode).',
+  'namedNeedCfg': 'Set the fixed domain and Tunnel Token first',
+  'namedRunningHint': 'Fixed domain (Cloudflare named tunnel) — the URL no longer changes on restart',
   'disclaimerTitle': '⚠️ Security disclaimer',
   'disclaimerBody': 'Enabling public access exposes this computer\u2019s DSH (which can execute code) to the internet. Anyone with the public link and PIN can reach — and operate — your computer. Please confirm: ① use a strong custom PIN or keep the auto-generated one safe; ② turn public access OFF as soon as you\u2019re done; ③ on a corporate/classified network, confirm compliance first.',
   'disclaimerAgree': 'I understand and agree',

package/lib/index.js

@@ -20,8 +20,8 @@ import { randomBytes } from 'node:crypto';
 import { createPocketService } from './service.mjs';
 import { installPocketRpc } from './web-rpc.js';
 import { restartHost } from './restart.js';
-import { desktopEnvPatchScript, advancedNoticeScript, DEFAULT_INJECT } from './proxy.mjs';
-import { lanEnabled, setLanEnabled, lanAuthEnabled, setLanAuthEnabled, lanIpOverride, setLanIpOverride, pinCustom, setPinCustom } from './settings.mjs';
+import { desktopEnvPatchScript, advancedNoticeScript, DEFAULT_INJECT, classifyHost } from './proxy.mjs';
+import { lanEnabled, setLanEnabled, lanAuthEnabled, setLanAuthEnabled, lanIpOverride, setLanIpOverride, pinCustom, setPinCustom, tunnelMode, setTunnelMode, tunnelToken, setTunnelToken, tunnelHostname, setTunnelHostname } from './settings.mjs';
 
 const name = 'dsh-pocket';
 const inject = ['connection', 'webServer'];
@@ -98,9 +98,14 @@ function refreshLanToken() {
   setPinCustom('lan', false);
   return writePinToFile(lanTokenPath(), newPin());
 }
-/** 按 Host 分发的访问密码：公网隧道用公网密码，局域网用局域网密码。 */
+/**
+ * 按 Host 分发的访问密码（issue #66：fail closed）。
+ * 公网 = classifyHost 判为 public 的 Host（trycloudflare **或用户自建命名隧道的任意固定域名**），
+ * 一律校验公网密码；loopback/局域网（私网 IP、.local 等）才走局域网密码——
+ * 自建隧道 + 关闭局域网密码不再出现公网裸奔。
+ */
 function tokenForHost(host) {
-  return /trycloudflare\.com$/i.test(String(host ?? '')) ? getAccessToken() : getLanToken();
+  return classifyHost(host) === 'public' ? getAccessToken() : getLanToken();
 }
 /**
  * 用户自定义访问密码（issue #33）：公网/局域网各自设一个固定的 8 位密码（英文字母大小写或数字）。
@@ -235,17 +240,26 @@ export function apply(ctx, config = {}, internals = {}) {
     injectHtml: isDesktop
       ? DEFAULT_INJECT + desktopEnvPatchScript(process.platform) + (desktopAdvanced ? advancedNoticeScript() : '')
       : undefined,
-    // 访问密码（issue #13 + #18 + #24 + #33）：公网永远要密码（默认每次开启变新，
+    // 访问密码（issue #13 + #18 + #24 + #33 + #66）：公网永远要密码（默认每次开启变新，
     // 用户自定义后不再轮换）；局域网按开关（默认开启；关闭后局域网扫码直连）。
+    // 公网的判定是 fail closed：除了 loopback/私网 Host，一切陌生域名（含自建
+    // 命名隧道的固定域名）都按公网处理、强制公网密码。
     auth: {
       // sessionKey：进程级随机密钥——登录 cookie 绑定它（会话保持，issue #33）：
       // dsh web 重启/更新后 sessionKey 变化 → 手机需重新输入
       sessionKey: randomBytes(16).toString('hex'),
       getToken: (host) => tokenForHost(host),
-      isProtected: (host) => /trycloudflare\.com$/i.test(String(host ?? '')) ? true : lanAuthEnabled(),
+      isProtected: (host) => (classifyHost(host) === 'public' ? true : lanAuthEnabled()),
     },
-    // 每次公网隧道就绪 → 轮换 8 位密码（旧密码/旧链接立即作废；用户自定义后不轮换）
-    onTunnelReady: () => {
+    // 隧道模式（issue #66）：'quick'（默认，随机 trycloudflare.com）| 'named'（固定域名）
+    getTunnelConfig: () => ({ mode: tunnelMode(), token: tunnelToken(), hostname: tunnelHostname() }),
+    // 隧道就绪回调：快速模式每次开启轮换 8 位密码（旧链接作废）；命名模式地址固定，
+    // 不自动轮换（重启后密码不变，用户可用「自定义密码」主动更换）。
+    onTunnelReady: (mode) => {
+      if (mode === 'named') {
+        logger.info('dsh-pocket: named tunnel ready — PIN not rotated | 命名隧道就绪（公网密码不自动轮换）');
+        return getAccessToken();
+      }
       const fresh = rotateAccessToken();
       logger.info('dsh-pocket: public access PIN refreshed | 公网访问密码已更新（自定义密码不受影响）');
       return fresh;
@@ -267,6 +281,16 @@ export function apply(ctx, config = {}, internals = {}) {
     setLanIpOverride: (ip) => setLanIpOverride(ip),
     getPinCustom: (which) => pinCustom(which),
     setCustomPin: (which, value) => setCustomPin(which, value),
+    // 命名隧道配置（issue #66）：RPC 只回显脱敏视图（token 只写不读）
+    getTunnelConfig: () => ({ mode: tunnelMode(), hostname: tunnelHostname(), tokenSet: tunnelToken().length > 0 }),
+    setTunnelConfig: ({ mode, hostname, token } = {}) => {
+      const m = mode === undefined ? tunnelMode() : mode;
+      if (m !== 'quick' && m !== 'named') throw new Error('未知隧道模式 | unknown tunnel mode');
+      setTunnelMode(m);
+      if (hostname !== undefined) setTunnelHostname(hostname);
+      if (token !== undefined) setTunnelToken(token);
+      return { mode: tunnelMode(), hostname: tunnelHostname(), tokenSet: tunnelToken().length > 0 };
+    },
     runUpdate: internals.runUpdate ?? { currentVersion, perform: performUpdate, loadedVersion: () => loadedVersion },
     restart: internals.restart ?? (() => pocketRestart(service)),
     restartNotice: internals.restartNotice ?? consumeRestartNotice,

package/lib/proxy.mjs

@@ -187,9 +187,38 @@ button{width:100%;padding:10px;font-size:15px;background:#4f6ef7;color:#fff;bord
 </div></body></html>`;
 }
 
-/** 该 Host 是否受访问密码保护（公网隧道；局域网 IP 直连免密码）。 */
+/**
+ * Host 信任边界分类（issue #66：fail closed）。
+ *
+ * 旧逻辑只认 `*.trycloudflare.com` 后缀为公网，其余一律当局域网——用户自建
+ * 命名隧道/反向代理指向本机端口时，固定域名被误判成局域网；若局域网密码又
+ * 关着，公网入口就无密码裸奔。现在反转为 fail closed：
+ *   - loopback：localhost / 127.x / ::1 / 0.0.0.0（本机与 cloudflared 回连）
+ *   - lan：RFC1918 私网 IPv4、IPv6 ULA/link-local、`.local`（mDNS）、
+ *     无点单标签名（NetBIOS 计算机名等——公网 DNS 不可能解析它们）
+ *   - public：其余一切 Host（trycloudflare 或任何陌生域名）→ 强制公网密码
+ *
+ * @returns {'loopback'|'lan'|'public'}
+ */
+export function classifyHost(host) {
+  let name = String(host ?? '').trim().toLowerCase();
+  if (name.startsWith('[')) {
+    const end = name.indexOf(']');
+    if (end >= 0) name = name.slice(1, end); // [::1]:3081 → ::1
+  } else {
+    name = name.replace(/:\d+$/, ''); // hostname:3081 / 127.0.0.1:3081 → 去掉端口
+  }
+  if (name === 'localhost' || name === '0.0.0.0' || name === '::1' || /^127\./.test(name)) return 'loopback';
+  if (/^(?:10\.|192\.168\.|172\.(?:1[6-9]|2\d|3[01])\.)/.test(name)) return 'lan'; // RFC1918
+  if (/^(?:fe80:|f[cd][0-9a-f]{2}:)/.test(name) && name.includes(':')) return 'lan'; // IPv6 link-local / ULA
+  if (name === '' || name.includes(':')) return 'loopback'; // 裸 IPv6 / 无 Host → 当本机
+  if (name.endsWith('.local') || !name.includes('.')) return 'lan'; // mDNS / NetBIOS 单标签名
+  return 'public';
+}
+
+/** 该 Host 是否受访问密码保护（公网一律要密码；局域网/本机按设置页开关）。 */
 function isProtectedHost(host, isProtected) {
-  return isProtected ? isProtected(host) : /trycloudflare\.com$/i.test(String(host ?? ''));
+  return isProtected ? isProtected(host) : classifyHost(host) === 'public';
 }
 
 /**
@@ -323,9 +352,10 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
   const limiter = auth ? createRateLimiter(rateLimit ?? {}) : null;
   const server = createServer((req, res) => {
     const host = String(req.headers.host ?? '');
-    const isPublic = /trycloudflare\.com$/i.test(host);
+    const isPublic = classifyHost(host) === 'public';
     // 局域网访问关闭（issue #54）：拦截经局域网 IP/主机名访问的请求；
-    // 公网（trycloudflare）与 loopback（本机/cloudflared 回连）放行。
+    // 公网（含任意非内网 Host——issue #66 fail closed）与 loopback（本机/cloudflared 回连）放行，
+    // 公网流量随后照常走访问密码认证。
     if (!isPublic && !isLoopbackHost(host) && !lanAccessEnabled()) {
       if (isHtmlRequest(req)) {
         res.writeHead(403, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
@@ -471,8 +501,8 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
   // WebSocket upgrade（DSH 的 /api/events.mux + events.host 流式通道）原样透传
   server.on('upgrade', (req, socket, head) => {
     const host = String(req.headers.host ?? '');
-    const isPublic = /trycloudflare\.com$/i.test(host);
-    // 局域网访问关闭：拦截经局域网 Host 的 WS 握手（公网/loopback 放行）
+    const isPublic = classifyHost(host) === 'public';
+    // 局域网访问关闭：拦截经局域网 Host 的 WS 握手（公网/loopback 放行——issue #66 fail closed）
     if (!isPublic && !isLoopbackHost(host) && !lanAccessEnabled()) {
       socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
       socket.destroy();

package/lib/service.mjs

@@ -13,7 +13,7 @@ import { execFile } from 'node:child_process';
 import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
 import { createPocketProxy } from './proxy.mjs';
-import { startQuickTunnel } from './tunnel.mjs';
+import { startQuickTunnel, startNamedTunnel } from './tunnel.mjs';
 import { isValidIpv4 } from './ip.mjs';
 
 const require = createRequire(import.meta.url);
@@ -180,11 +180,14 @@ export function createPocketService({
   injectHtml,
   /** 访问令牌认证配置（issue #13）：{ getToken, isProtected }，传给代理 */
   auth,
-  /** 隧道就绪回调（lib/index.js 用它轮换公网密码） */
+  /** 隧道配置（issue #66）：() => ({ mode:'quick'|'named', token, hostname })；named 用固定域名 */
+  getTunnelConfig,
+  /** 隧道就绪回调（lib/index.js 用它轮换公网密码；参数为 'quick'|'named'） */
   onTunnelReady,
 } = {}) {
   const createProxy = internals.createProxy ?? createPocketProxy;
   const startTunnel = internals.startTunnel ?? startQuickTunnel;
+  const startNamed = internals.startNamedTunnel ?? startNamedTunnel;
   const getLanOverride = () => {
     const value = String(getLanIpOverride?.() ?? '').trim();
     return isValidIpv4(value) ? value : '';
@@ -285,9 +288,22 @@ export function createPocketService({
       };
       tunnelPromise = (async () => {
         try {
-          const result = await startTunnel({ port: proxy.port, home, signal: controller.signal, onPhase });
-          // 归一化：startTunnel 契约返回 {url, kill}（字符串也兼容）
-          tunnel = typeof result === 'string' ? { url: result, kill: () => {} } : result;
+          // 命名隧道（issue #66）：固定域名模式——URL 由设置里的域名拼出（cloudflared 不打印）
+          const cfg = typeof getTunnelConfig === 'function' ? (getTunnelConfig() ?? {}) : {};
+          if (cfg?.mode === 'named') {
+            if (!cfg.token || !cfg.hostname) {
+              throw new Error(
+                '命名隧道未配置完整：需要 Tunnel Token 和固定域名（设置页「固定域名」里填写） | '
+                + 'named tunnel is incomplete — set the Tunnel Token and the fixed hostname in Settings',
+              );
+            }
+            const result = await startNamed({ token: cfg.token, home, signal: controller.signal, onPhase });
+            tunnel = { url: `https://${cfg.hostname}`, kill: result.kill, onExit: result.onExit };
+          } else {
+            const result = await startTunnel({ port: proxy.port, home, signal: controller.signal, onPhase });
+            // 归一化：startTunnel 契约返回 {url, kill}（字符串也兼容）
+            tunnel = typeof result === 'string' ? { url: result, kill: () => {} } : result;
+          }
           tunnelState.phase = 'ready';
           // M1：隧道进程运行中死亡（崩溃/被杀）→ 状态打回，别让 UI 永远显示"可用"
           tunnel.onExit?.((code) => {
@@ -297,8 +313,8 @@ export function createPocketService({
           });
           // 记录「隧道开启中」，供重启后自动恢复（issue #11）
           void persistAutoTunnel();
-          // 公网隧道就绪 → 轮换访问密码（issue #13：每次开启变新，旧链接作废）
-          try { onTunnelReady?.(); } catch { /* 忽略 */ }
+          // 公网隧道就绪 → 回调（快速模式轮换访问密码；命名模式不轮换，见 lib/index.js）
+          try { onTunnelReady?.(cfg?.mode === 'named' ? 'named' : 'quick'); } catch { /* 忽略 */ }
           return tunnel.url;
         } catch (err) {
           // stopTunnel 触发的 abort 不算错误：保持 idle，别把状态刷成 error
@@ -368,6 +384,15 @@ export function createPocketService({
         tunnelUrl: tunnel?.url ?? null,
         tunnelQr: await qrCached(tunnel?.url ?? null),
         tunnelState: { ...tunnelState },
+        // 隧道配置脱敏视图（issue #66）：token 永不回显，只有 tokenSet 布尔值
+        tunnelConfig: (() => {
+          const cfg = typeof getTunnelConfig === 'function' ? (getTunnelConfig() ?? {}) : {};
+          return {
+            mode: cfg?.mode === 'named' ? 'named' : 'quick',
+            hostname: typeof cfg?.hostname === 'string' ? cfg.hostname : '',
+            tokenSet: Boolean(cfg?.token),
+          };
+        })(),
         dshPort,
       };
     },

package/lib/settings.mjs

@@ -5,6 +5,9 @@
 //   - lanAuthEnabled    局域网访问密码开关（issue #24），默认开启
 //   - publicPinCustom   公网密码是否用户自定义（issue #33），自定义后不自动轮换
 //   - lanPinCustom      局域网密码是否用户自定义（issue #33）
+//   - tunnelMode        公网隧道模式（issue #66）：'quick'（默认，随机 trycloudflare.com）| 'named'（固定域名）
+//   - tunnelToken       Cloudflare 命名隧道 Token（issue #66，秘密；文件 0o600，RPC 不回显）
+//   - tunnelHostname    命名隧道绑定的固定域名（issue #66，如 pocket.example.com）
 // 默认**开启**（安全优先）：局域网扫码也要输 8 位密码；
 // 用户可关闭——关闭后局域网扫码直连（仅同一网络内的设备能访问），公网不受影响（永远要密码）。
 
@@ -99,3 +102,78 @@ export function setPinCustom(which, on) {
   writeSettings(s);
   return !!on;
 }
+
+// ---------- 命名隧道配置（issue #66：固定公网域名） ----------
+// 用户在 Cloudflare Zero Trust（Networks → Tunnels）创建命名隧道并复制 Tunnel Token，
+// 把自己域名的 ingress Service 指向 http://127.0.0.1:<代理端口>；填到这里后，
+// 开启公网改用 `cloudflared tunnel run`，公网地址固定为该域名（重启不再变化）。
+// token 是长期凭据：只存本机 0o600 文件，RPC 只写不读（回显仅 tokenSet 布尔值）。
+
+/** 隧道模式：'quick'（默认，随机地址）| 'named'（固定域名）。 */
+export function tunnelMode() {
+  return readSettings().tunnelMode === 'named' ? 'named' : 'quick';
+}
+
+/** 设置隧道模式（持久化）；非法值抛错。 */
+export function setTunnelMode(mode) {
+  if (mode !== 'quick' && mode !== 'named') {
+    throw new Error('隧道模式必须是 quick 或 named | tunnel mode must be quick or named');
+  }
+  const s = readSettings();
+  if (mode === 'quick') delete s.tunnelMode;
+  else s.tunnelMode = mode;
+  writeSettings(s);
+  return mode;
+}
+
+/** 命名隧道 Token（未配置返回空字符串）。 */
+export function tunnelToken() {
+  const v = readSettings().tunnelToken;
+  return typeof v === 'string' ? v : '';
+}
+
+/**
+ * 设置命名隧道 Token（持久化）。空字符串清除；非空要求至少 20 个
+ * base64url 字符（Cloudflare Token 是长 base64 串，过短/含空白视为无效）。
+ */
+export function setTunnelToken(value) {
+  const v = String(value ?? '').trim();
+  if (v) {
+    if (v.length < 20 || !/^[A-Za-z0-9+/_=-]+$/.test(v)) {
+      throw new Error('Tunnel Token 格式不对（应为 Cloudflare 后台复制的完整 Token） | invalid tunnel token');
+    }
+  }
+  const s = readSettings();
+  if (v) s.tunnelToken = v;
+  else delete s.tunnelToken;
+  writeSettings(s);
+  return v;
+}
+
+/** 命名隧道绑定的固定域名（未配置返回空字符串）。 */
+export function tunnelHostname() {
+  const v = readSettings().tunnelHostname;
+  return typeof v === 'string' ? v : '';
+}
+
+/**
+ * 设置固定域名（持久化）。接受 `https://host/path` 粘贴并归一化为裸域名；
+ * 空字符串清除。要求是带点的合法公网域名（局域网主机名/裸 IP 不允许——
+ * 那不该走公网密码边界之外的东西）。
+ */
+export function setTunnelHostname(value) {
+  let v = String(value ?? '').trim().toLowerCase();
+  v = v.replace(/^[a-z][a-z0-9+.-]*:\/\//, '').split(/[/?#\s]/)[0].replace(/:\d+$/, '').replace(/\.$/, '');
+  if (v) {
+    const HOSTNAME_RE = /^(?=.{1,253}$)[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/;
+    const IS_IPV4 = /^\d{1,3}(\.\d{1,3}){3}$/;
+    if (IS_IPV4.test(v) || !v.includes('.') || !HOSTNAME_RE.test(v)) {
+      throw new Error('固定域名格式不对（如 pocket.example.com） | invalid tunnel hostname');
+    }
+  }
+  const s = readSettings();
+  if (v) s.tunnelHostname = v;
+  else delete s.tunnelHostname;
+  writeSettings(s);
+  return v;
+}

package/lib/tunnel.mjs

@@ -1,7 +1,10 @@
-// cloudflared 快速隧道：把本机代理暴露成公网 https URL
+// cloudflared 隧道：把本机代理暴露成公网 https URL
 //
-// 手机在任何网络都能访问；URL 由 cloudflared 随机分配（每次重启会变）。
-// 无密码模式：URL 即钥匙（dsh web 能执行代码，请勿把二维码/URL 发给别人）。
+// 两条路径（issue #66）：
+//   - 快速隧道 startQuickTunnel：URL 由 cloudflared 随机分配（每次重启会变），零配置；
+//   - 命名隧道 startNamedTunnel：用户自带 Cloudflare Tunnel Token + 固定域名，重启地址不变。
+//
+// 手机在任何网络都能访问。公网一律要求访问密码（dsh web 能执行代码，请勿泄露二维码/URL）。
 
 import { spawn, execSync } from 'node:child_process';
 import { mkdir, access, chmod, rm, stat, rename, cp, open } from 'node:fs/promises';
@@ -347,6 +350,110 @@ export async function resolveCloudflared({ home, onPhase = () => {}, signal } =
  * @param {(phase:string)=>void} [opts.onPhase] 进度回调：downloading→starting→registering→ready
  * @returns {Promise<{url:string, kill:()=>void}>}
  */
+/**
+ * 启动 cloudflared 命名隧道（issue #66：固定公网域名）。
+ *
+ * 用户在 Cloudflare Zero Trust 后台创建 Tunnel、把域名 ingress 的 Service 指向
+ * `http://127.0.0.1:<port>`，复制 Tunnel Token 填进设置页。与快速隧道的区别：
+ *   - Token 走 `TUNNEL_TOKEN` **环境变量**（不进 argv——长期凭据不该出现在
+ *     进程列表/崩溃日志里，issue #66 讨论中的一致意见）；
+ *   - URL 固定为用户绑定的域名（cloudflared 输出不打印它），由调用方拼 `https://<域名>`，
+ *     所以这里返回 `url: null`；
+ *   - 就绪判据是 stderr 出现 `Registered tunnel connection`（边缘连接注册成功即开始服务）。
+ * @param {object} opts
+ * @param {string} opts.token    Cloudflare Tunnel Token
+ * @param {string} [opts.home]   $DSH_HOME（cloudflared 持久缓存）
+ * @param {AbortSignal} [opts.signal]
+ * @param {(phase:string)=>void} [opts.onPhase] 进度回调：downloading→starting→registering→ready
+ * @returns {Promise<{url:null, kill:()=>void, onExit:(cb)=>()=>void}>}
+ */
+export async function startNamedTunnel({ token, home, signal, onPhase = () => {} }) {
+  const bin = await resolveCloudflared({ home, onPhase, signal });
+  onPhase('starting');
+  // 与快速隧道一致强制 HTTP/2（国内/企业网常屏蔽 UDP 7844 → error 1033）
+  const child = spawn(bin, ['tunnel', 'run', '--protocol', 'http2', '--no-autoupdate'], {
+    stdio: ['ignore', 'pipe', 'pipe'],
+    env: { ...process.env, TUNNEL_TOKEN: String(token ?? '') },
+  });
+  let cleanup = null;
+  let rejectErr = null;
+  // H1：spawn 失败（缓存二进制损坏等）必须接住，否则 uncaughtException 崩宿主
+  child.on('error', (err) => {
+    cleanup?.();
+    onPhase?.('error');
+    rejectErr?.(new Error(`cloudflared 启动失败：${err?.message ?? err}（可删除 $DSH_HOME/dsh-pocket/bin 缓存后重试）`));
+  });
+  onPhase('registering');
+
+  await new Promise((resolve, reject) => {
+    let buf = '';
+    const onData = (chunk) => {
+      buf += String(chunk);
+      // 边缘连接注册成功即开始服务（每条连接一行；等第一条就够）
+      if (/Registered tunnel connection/i.test(buf)) {
+        cleanup();
+        onPhase('ready');
+        resolve();
+      }
+    };
+    const onExit = (code) => {
+      cleanup();
+      const tail = buf.trim().split(/\r?\n/).slice(-4).join('\n').trim();
+      reject(new Error(
+        `cloudflared 退出（code=${code}）${tail ? '：' + tail.slice(0, 500) : ''}`
+        + '——请检查 Tunnel Token 是否有效、域名 Service 是否指向本机代理端口 | tunnel exited — check the token and the ingress hostname',
+      ));
+    };
+    cleanup = () => {
+      child.stdout.off('data', onData);
+      child.stderr.off('data', onData);
+      child.off('exit', onExit);
+      clearTimeout(timer);
+      signal?.removeEventListener('abort', onAbort);
+      // M4：摘掉监听后管道不再消费 → 64KB 缓冲填满会阻塞 cloudflared → 继续吞掉输出
+      child.stdout.resume();
+      child.stderr.resume();
+    };
+    const onAbort = () => {
+      cleanup();
+      child.kill();
+      reject(new Error('已取消 | cancelled'));
+    };
+    const timer = setTimeout(() => {
+      cleanup();
+      child.kill();
+      reject(new Error(
+        'cloudflared 启动超时（30s）——请检查 Tunnel Token 是否有效、域名 Service 是否指向本机代理端口，'
+        + '以及是否开着代理/VPN（Clash 等 TUN 模式会掐断隧道连接） | timeout — check the token, the ingress hostname, and quit any proxy/VPN (TUN mode)',
+      ));
+    }, 30_000);
+
+    child.stdout.on('data', onData);
+    child.stderr.on('data', onData);
+    child.once('exit', onExit);
+    signal?.addEventListener('abort', onAbort, { once: true });
+    rejectErr = reject;
+  });
+
+  // M1：隧道进程运行中死亡（崩溃/被杀）→ 通知监听方（service 据此把状态从 ready 打回）
+  const exitListeners = new Set();
+  child.on('exit', (code) => {
+    for (const cb of exitListeners) cb(code);
+  });
+
+  return {
+    url: null, // 固定域名由调用方（service）按设置拼 https://<hostname>
+    kill: () => {
+      try { child.kill(); } catch { /* 忽略 */ }
+    },
+    /** 注册「进程已退出」回调，返回取消函数。 */
+    onExit: (cb) => {
+      exitListeners.add(cb);
+      return () => exitListeners.delete(cb);
+    },
+  };
+}
+
 export async function startQuickTunnel({ port, home, signal, onPhase = () => {} }) {
   const bin = await resolveCloudflared({ home, onPhase, signal });
   onPhase('starting');

package/lib/web-rpc.js

@@ -25,7 +25,7 @@ export function killHint(port) {
 }
 
 /** 注册 /dsh-pocket 逻辑通道（仅本机 loopback 可调）。 */
-export function installPocketRpc(ctx, { service, log = console, desktop = false, runUpdate = null, restart = null, restartNotice = null, getToken = null, getLanToken = null, refreshLanToken = null, getLanAuthEnabled = null, setLanAuthEnabled = null, getLanEnabled = null, setLanEnabled = null, getLanIpOverride = null, setLanIpOverride = null, getPinCustom = null, setCustomPin = null }) {
+export function installPocketRpc(ctx, { service, log = console, desktop = false, runUpdate = null, restart = null, restartNotice = null, getToken = null, getLanToken = null, refreshLanToken = null, getLanAuthEnabled = null, setLanAuthEnabled = null, getLanEnabled = null, setLanEnabled = null, getLanIpOverride = null, setLanIpOverride = null, getPinCustom = null, setCustomPin = null, getTunnelConfig = null, setTunnelConfig = null }) {
   if (!ctx?.connection?.rpc?.handle) {
     log.warn?.('dsh-pocket: DSH Host Connection RPC unavailable — settings tab disabled | 无 Connection RPC，设置页不可用');
     return () => {};
@@ -49,6 +49,7 @@ export function installPocketRpc(ctx, { service, log = console, desktop = false,
         lanEnabled: getLanEnabled?.() ?? true,
         publicPinCustom: getPinCustom?.('public') ?? false,
         lanPinCustom: getPinCustom?.('lan') ?? false,
+        tunnelConfig: getTunnelConfig?.() ?? { mode: 'quick', hostname: '', tokenSet: false },
       });
     };
 
@@ -94,6 +95,17 @@ export function installPocketRpc(ctx, { service, log = console, desktop = false,
           return fail('bad-request', err?.message ?? String(err));
         }
       }
+      if (endpoint === POCKET_ENDPOINTS.tunnelSetConfig) {
+        // 命名隧道配置（issue #66）：{ mode, hostname, token }——token 只写不读，
+        // 留空表示保持不变（undefined 不覆盖）；返回完整 status 供前端直接替换。
+        if (!setTunnelConfig) return fail('bad-request', '隧道配置不可用 | tunnel config unavailable');
+        try {
+          setTunnelConfig({ mode: payload?.mode, hostname: payload?.hostname, token: payload?.token });
+          return await statusPayload();
+        } catch (err) {
+          return fail('bad-request', err?.message ?? String(err));
+        }
+      }
       if (endpoint === POCKET_ENDPOINTS.tunnelStart) {
         // 安全免责声明（issue #31）：每次开启公网都必须先确认（前端弹框勾选）。
         // 服务端强制校验，防止绕过前端直接调 RPC。

package/package.json

@@ -80,5 +80,5 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "version": "1.15.0"
+  "version": "1.16.0"
 }