dsh-pocket 1.6.0 → 1.7.1

package/client/client.js

@@ -1517,7 +1517,11 @@ function PocketSettingsTab({ rpcCall }) {
         (0, import_react2.createElement)("img", { src: status.tunnelQr, alt: "Tunnel QR", style: styles.qr }),
         (0, import_react2.createElement)("div", { style: styles.code }, tunnelUrl),
         (0, import_react2.createElement)("div", { style: styles.muted }, "\u4EFB\u4F55\u7F51\u7EDC\u626B\u7801\u5373\u7528\uFF08URL \u6BCF\u6B21\u91CD\u542F\u81EA\u52A8\u6362\u65B0\uFF09"),
-        (0, import_react2.createElement)("div", { style: styles.warn, marginTop: 4 }, "\u{1F511} \u94FE\u63A5\u5DF2\u6CC4\u9732\uFF1F\u91CD\u542F dsh web\u2014\u2014URL \u7ACB\u5373\u6362\u65B0\uFF0C\u65E7\u94FE\u63A5\u4F5C\u5E9F\uFF0C\u65E0\u5B89\u5168\u98CE\u9669 | URL leaked? Restart dsh web \u2014 the URL rotates and the old one dies"),
+        status.accessToken ? (0, import_react2.createElement)(
+          "div",
+          { style: { marginTop: 6, fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)", lineHeight: 1.5 } },
+          `\u{1F510} \u8BBF\u95EE\u5BC6\u7801\uFF1A${status.accessToken}\uFF08\u6BCF\u6B21\u5F00\u542F\u516C\u7F51\u53D8\u65B0\uFF1B\u624B\u673A\u6253\u5F00\u94FE\u63A5\u9700\u8F93\u5165\u6B64\u5BC6\u7801\uFF09| PIN: ${status.accessToken} \u2014 required on the phone`
+        ) : null,
         (0, import_react2.createElement)("button", { style: styles.btn, onClick: stopTunnel }, "\u5173\u95ED\u516C\u7F51 | Stop")
       ) : (0, import_react2.createElement)(
         "div",
@@ -1531,12 +1535,7 @@ function PocketSettingsTab({ rpcCall }) {
           "div",
           { style: { marginTop: 4, fontSize: 12, color: "var(--dsw-alias-state-error-primary,#dc2626)" } },
           `\u274C \u5F00\u542F\u5931\u8D25\uFF1A${tunnelStateDetail || "\u672A\u77E5\u9519\u8BEF | failed"}\uFF08\u53EF\u91CD\u8BD5\uFF1B\u82E5\u662F\u4EE3\u7406/VPN \u95EE\u9898\u89C1 README \u6392\u969C\uFF09`
-        ) : (0, import_react2.createElement)(
-          "div",
-          null,
-          (0, import_react2.createElement)("div", { style: styles.warn, marginTop: 4 }, "\u26A0\uFE0F DSH \u80FD\u6267\u884C\u7535\u8111\u4EE3\u7801\uFF1A\u4E8C\u7EF4\u7801/URL \u5C31\u662F\u94A5\u5319\uFF0C\u8BF7\u52FF\u53D1\u7ED9\u522B\u4EBA | the QR/URL is the key \u2014 never share it"),
-          (0, import_react2.createElement)("div", { style: styles.muted, marginTop: 4 }, "\u4E0D\u614E\u6CC4\u9732\u4E86\uFF1F\u91CD\u542F dsh web\uFF0CURL \u81EA\u52A8\u6362\u65B0\u3001\u65E7\u94FE\u63A5\u7ACB\u5373\u5931\u6548 | Leaked it? Restart dsh web \u2014 the URL rotates and the old one dies instantly")
-        )
+        ) : null
       )
     ),
     error ? (0, import_react2.createElement)("div", { style: { color: "var(--dsw-alias-state-error-primary,#dc2626)", fontSize: 12, marginTop: 8 } }, `\u274C ${error}`) : null,

package/client/index.jsx

@@ -247,7 +247,10 @@ function PocketSettingsTab({ rpcCall }) {
           h('img', { src: status.tunnelQr, alt: 'Tunnel QR', style: styles.qr }),
           h('div', { style: styles.code }, tunnelUrl),
           h('div', { style: styles.muted }, '任何网络扫码即用（URL 每次重启自动换新）'),
-          h('div', { style: styles.warn, marginTop: 4 }, '🔑 链接已泄露？重启 dsh web——URL 立即换新，旧链接作废，无安全风险 | URL leaked? Restart dsh web — the URL rotates and the old one dies'),
+          status.accessToken
+            ? h('div', { style: { marginTop: 6, fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)', lineHeight: 1.5 } },
+              `🔐 访问密码：${status.accessToken}（每次开启公网变新；手机打开链接需输入此密码）| PIN: ${status.accessToken} — required on the phone`)
+            : null,
           h('button', { style: styles.btn, onClick: stopTunnel }, '关闭公网 | Stop'),
         )
         : h('div', null,
@@ -260,10 +263,7 @@ function PocketSettingsTab({ rpcCall }) {
             : tunnelPhase === 'error'
               ? h('div', { style: { marginTop: 4, fontSize: 12, color: 'var(--dsw-alias-state-error-primary,#dc2626)' } },
                 `❌ 开启失败：${tunnelStateDetail || '未知错误 | failed'}（可重试；若是代理/VPN 问题见 README 排障）`)
-              : h('div', null,
-                h('div', { style: styles.warn, marginTop: 4 }, '⚠️ DSH 能执行电脑代码：二维码/URL 就是钥匙，请勿发给别人 | the QR/URL is the key — never share it'),
-                h('div', { style: styles.muted, marginTop: 4 }, '不慎泄露了？重启 dsh web，URL 自动换新、旧链接立即失效 | Leaked it? Restart dsh web — the URL rotates and the old one dies instantly'),
-              ),
+              : null,
         ),
     ),
 

package/lib/index.js

@@ -11,7 +11,7 @@
 
 import { fileURLToPath } from 'node:url';
 import { spawn } from 'node:child_process';
-import { readFileSync } from 'node:fs';
+import { readFileSync, mkdirSync, writeFileSync } from 'node:fs';
 import { writeFile, readFile, mkdir, rm } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
@@ -41,6 +41,35 @@ function currentVersion() {
 /** 进程启动时加载的版本（模块加载瞬间固化；用于识别「磁盘已更新但进程还是旧代码」）。 */
 const loadedVersion = currentVersion();
 
+// ---------- 公网访问密码（issue #13） ----------
+// 8 位数字，存本机 $DSH_HOME/dsh-pocket/token，每次开启公网时轮换（旧链接作废）。
+// 局域网 IP 直连免密码；仅公网隧道 Host 强制。
+const tokenRel = join('dsh-pocket', 'token');
+function tokenPath() {
+  return join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), tokenRel);
+}
+/** 生成 8 位数字密码并写文件（同步，保证后续读取一致）。 */
+function writeNewToken() {
+  const fresh = String(Math.floor(10000000 + Math.random() * 90000000));
+  try {
+    mkdirSync(dirname(tokenPath()), { recursive: true });
+    writeFileSync(tokenPath(), fresh, { mode: 0o600 });
+  } catch { /* 忽略 */ }
+  return fresh;
+}
+/** 当前公网访问密码；文件不存在时生成一个。 */
+function getAccessToken() {
+  try {
+    const existing = readFileSync(tokenPath(), 'utf8').trim();
+    if (/^\d{8}$/.test(existing)) return existing;
+  } catch { /* 无文件 */ }
+  return writeNewToken();
+}
+/** 轮换：生成新的 8 位数字密码（开启公网时调用，旧密码/链接立即作废）。 */
+function rotateAccessToken() {
+  return writeNewToken();
+}
+
 const restartNoticeRel = join('dsh-pocket', 'restarted.json');
 function restartNoticePath() {
   return join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), restartNoticeRel);
@@ -132,12 +161,24 @@ export function apply(ctx, config = {}, internals = {}) {
     // client 崩溃（issue #3/#4）。给代理注入「桌面参数补丁」（history.replaceState 补齐参数，
     // 无跳转；compatibility 模式不套桌面布局，避免移动端按钮叠加）。保留默认 polyfill。
     injectHtml: isDesktop ? DEFAULT_INJECT + desktopEnvPatchScript(process.platform) : undefined,
+    // 公网访问密码（issue #13）：仅公网隧道 Host 强制；局域网免密码
+    auth: {
+      getToken: () => getAccessToken(),
+      isProtected: (host) => /trycloudflare\.com$/i.test(String(host ?? '')),
+    },
+    // 每次公网隧道就绪 → 轮换 8 位密码（旧密码/旧链接立即作废）
+    onTunnelReady: () => {
+      const fresh = rotateAccessToken();
+      logger.info('dsh-pocket: public access PIN rotated | 公网访问密码已更新（旧链接作废）');
+      return fresh;
+    },
   });
 
   const disposers = [];
   const disposeRpc = installPocketRpc(ctx, {
     service,
     desktop: isDesktop,
+    getToken: () => getAccessToken(),
     runUpdate: internals.runUpdate ?? { currentVersion, perform: performUpdate, loadedVersion: () => loadedVersion },
     restart: internals.restart ?? (() => pocketRestart(service)),
     restartNotice: internals.restartNotice ?? consumeRestartNotice,

package/lib/proxy.mjs

@@ -52,6 +52,64 @@ function isCompressed(headers) {
 /** 默认注入到经代理的 HTML 文档里：crypto.randomUUID polyfill（非安全上下文必需）。 */
 export const DEFAULT_INJECT = RANDOM_UUID_POLYFILL;
 
+// ---------- 可选访问令牌认证（issue #13） ----------
+// 只对公网隧道 Host（trycloudflare.com）强制；局域网免密码。
+// 登录成功后种 HttpOnly 会话 cookie（浏览器关闭失效）→ SPA 内部 API/WS 自动携带。
+const TOKEN_COOKIE = 'dsh_pocket_token';
+
+function parseCookies(header) {
+  const out = {};
+  for (const part of String(header ?? '').split(';')) {
+    const eq = part.indexOf('=');
+    if (eq > 0) out[part.slice(0, eq).trim()] = part.slice(eq + 1).trim();
+  }
+  return out;
+}
+
+function loginPageHtml(error) {
+  return `<!doctype html><html lang="zh"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>DSH Pocket · 访问验证</title>
+<style>
+body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#f3f4f6;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif}
+.card{background:#fff;border:1px solid #e5e7eb;border-radius:12px;padding:28px 24px;max-width:320px;width:calc(100% - 48px);text-align:center}
+h1{font-size:16px;margin:0 0 4px;color:#111827}
+p{font-size:13px;color:#6b7280;margin:0 0 16px}
+input{width:100%;box-sizing:border-box;padding:10px 12px;font-size:18px;letter-spacing:6px;text-align:center;border:1px solid #d1d5db;border-radius:8px;outline:none;margin-bottom:12px}
+input:focus{border-color:#4f6ef7}
+button{width:100%;padding:10px;font-size:15px;background:#4f6ef7;color:#fff;border:none;border-radius:8px;cursor:pointer}
+.err{color:#dc2626;font-size:12px;margin-bottom:10px;min-height:16px}
+</style></head><body><div class="card">
+<h1>🔐 DSH Pocket</h1>
+<p>此公网地址受访问密码保护，请输入 8 位数字密码</p>
+<div class="err">${error ? '密码错误，请重试' : ''}</div>
+<form method="post" action="/pocket-login">
+<input name="token" type="password" inputmode="numeric" maxlength="8" autocomplete="one-time-code" autofocus required>
+<button type="submit">进入 | Enter</button>
+</form>
+</div></body></html>`;
+}
+
+/** 该 Host 是否受访问密码保护（公网隧道；局域网 IP 直连免密码）。 */
+function isProtectedHost(host, isProtected) {
+  return isProtected ? isProtected(host) : /trycloudflare\.com$/i.test(String(host ?? ''));
+}
+
+/** 请求是否期望 HTML（浏览器导航 → 返回登录页；API/WS → 401）。 */
+function isHtmlRequest(req) {
+  const accept = String(req.headers.accept ?? '');
+  return accept.includes('text/html') || req.url === '/' || /\.html?$/i.test(String(req.url));
+}
+
+/** 校验请求是否已认证；返回 true 放行。 */
+function authCheck(req, token) {
+  if (!token) return true; // 无 token（未配置密码）→ 放行
+  const cookieTok = parseCookies(req.headers.cookie)[TOKEN_COOKIE];
+  if (cookieTok === token) return true;
+  const qTok = new URL(req.url ?? '/', 'http://x').searchParams.get('token');
+  return qTok === token;
+}
+
 /** 把浏览器可见的权威改写成 loopback 权威（Host 和 Origin 都改）。 */
 function loopbackAuthority(headers, upstream) {
   const authority = `${upstream.host}:${upstream.port}`;
@@ -68,10 +126,49 @@ function loopbackAuthority(headers, upstream) {
  * @param {string} [opts.host]      监听地址（默认 0.0.0.0：LAN 与隧道都能到）
  * @param {{host:string,port:number}} [opts.upstream] 上游 dsh web（默认 127.0.0.1:3080）
  * @param {string} [opts.injectHtml] 注入 HTML 的内容（默认 polyfill + 移动端适配；传 '' 关闭）
+ * @param {object} [opts.auth]       可选访问令牌认证（issue #13）：{ getToken, isProtected }
  * @returns {Promise<{server:import('node:http').Server, close:()=>Promise<void>}>}
  */
-export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DEFAULT_UPSTREAM, log = null, injectHtml = DEFAULT_INJECT } = {}) {
+export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DEFAULT_UPSTREAM, log = null, injectHtml = DEFAULT_INJECT, auth = null } = {}) {
   const server = createServer((req, res) => {
+    // 访问令牌认证（issue #13）：仅公网隧道 Host 强制；局域网 IP 直连免密码
+    if (auth) {
+      const host = String(req.headers.host ?? '');
+      const protectedHost = isProtectedHost(host, auth.isProtected);
+      const token = protectedHost ? (auth.getToken?.() ?? null) : null;
+      if (protectedHost && token) {
+        // 登录提交：校验密码 → 种 HttpOnly 会话 cookie → 回首页
+        if (req.method === 'POST' && req.url?.startsWith('/pocket-login')) {
+          let body = '';
+          req.on('data', (c) => { body += c; if (body.length > 1024) req.destroy(); });
+          req.on('end', () => {
+            const submitted = String(new URLSearchParams(body).get('token') ?? '');
+            if (submitted === token) {
+              res.writeHead(302, {
+                location: '/',
+                'set-cookie': `${TOKEN_COOKIE}=${token}; HttpOnly; SameSite=Lax; Path=/`,
+                'cache-control': 'no-store',
+              });
+              res.end();
+            } else {
+              res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
+              res.end(loginPageHtml(true));
+            }
+          });
+          return;
+        }
+        if (!authCheck(req, token)) {
+          if (isHtmlRequest(req)) {
+            res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
+            res.end(loginPageHtml(false));
+          } else {
+            res.writeHead(401, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+            res.end('{"error":"unauthorized"}');
+          }
+          return;
+        }
+      }
+    }
     const headers = loopbackAuthority({ ...req.headers }, upstream);
     const proxyReq = httpRequest(
       { host: upstream.host, port: upstream.port, method: req.method, path: req.url, headers, agent: false },
@@ -148,6 +245,16 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
 
   // WebSocket upgrade（DSH 的 /api/events.mux + events.host 流式通道）原样透传
   server.on('upgrade', (req, socket, head) => {
+    // WebSocket 同样校验（防止绕过 HTTP 认证从 WS 进入）
+    if (auth) {
+      const host = String(req.headers.host ?? '');
+      const token = isProtectedHost(host, auth.isProtected) ? (auth.getToken?.() ?? null) : null;
+      if (token && !authCheck(req, token)) {
+        socket.write('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
+        socket.destroy();
+        return;
+      }
+    }
     const headers = loopbackAuthority({ ...req.headers }, upstream);
     const proxyReq = httpRequest({
       host: upstream.host, port: upstream.port, method: req.method, path: req.url, headers, agent: false,

package/lib/service.mjs

@@ -86,6 +86,10 @@ export function createPocketService({
   internals = {},
   /** 代理注入 HTML 的内容（桌面端补丁等由 lib/index.js 传入；默认 randomUUID polyfill） */
   injectHtml,
+  /** 访问令牌认证配置（issue #13）：{ getToken, isProtected }，传给代理 */
+  auth,
+  /** 隧道就绪回调（lib/index.js 用它轮换公网密码） */
+  onTunnelReady,
 } = {}) {
   const createProxy = internals.createProxy ?? createPocketProxy;
   const startTunnel = internals.startTunnel ?? startQuickTunnel;
@@ -142,6 +146,7 @@ export function createPocketService({
             host: '0.0.0.0',
             upstream: { host: '127.0.0.1', port: dshPort },
             ...(injectHtml ? { injectHtml } : {}),
+            ...(auth ? { auth } : {}),
           });
           if (p !== port) {
             console.log(`dsh-pocket: port ${port} busy, proxy on ${p} | 端口 ${port} 被占用，代理改用 ${p}`);
@@ -185,6 +190,8 @@ export function createPocketService({
           });
           // 记录「隧道开启中」，供重启后自动恢复（issue #11）
           void persistAutoTunnel();
+          // 公网隧道就绪 → 轮换访问密码（issue #13：每次开启变新，旧链接作废）
+          try { onTunnelReady?.(); } catch { /* 忽略 */ }
           return tunnel.url;
         } catch (err) {
           // stopTunnel 触发的 abort 不算错误：保持 idle，别把状态刷成 error

package/lib/web-rpc.js

@@ -25,7 +25,7 @@ export function killHint(port) {
 }
 
 /** 注册 /dsh-pocket 逻辑通道（仅本机 loopback 可调）。 */
-export function installPocketRpc(ctx, { service, log = console, desktop = false, runUpdate = null, restart = null, restartNotice = null }) {
+export function installPocketRpc(ctx, { service, log = console, desktop = false, runUpdate = null, restart = null, restartNotice = null, getToken = null }) {
   if (!ctx?.connection?.rpc?.handle) {
     log.warn?.('dsh-pocket: DSH Host Connection RPC unavailable — settings tab disabled | 无 Connection RPC，设置页不可用');
     return () => {};
@@ -33,12 +33,12 @@ export function installPocketRpc(ctx, { service, log = console, desktop = false,
   return ctx.connection.rpc.handle(POCKET_RPC_CHANNEL, async (endpoint, payload = {}, signal) => {
     if (signal?.aborted) return fail('cancelled', 'The request was cancelled.');
 
-    // status 响应：redact 后的服务状态 + 重启提示（重启后 30 分钟内有效）+ 停止命令（按平台）+ 桌面端标志
+    // status 响应：redact 后的服务状态 + 重启提示（重启后 30 分钟内有效）+ 停止命令（按平台）+ 桌面端标志 + 公网访问密码
     const statusPayload = async () => {
       let notice = null;
       try { notice = (await restartNotice?.()) ?? null; } catch { notice = null; }
       const s = await service.status();
-      return ok({ ...redactStatus(s), desktop, restartNotice: notice, killHint: killHint(s.dshPort ?? 3080) });
+      return ok({ ...redactStatus(s), desktop, restartNotice: notice, killHint: killHint(s.dshPort ?? 3080), accessToken: getToken?.() ?? null });
     };
 
     try {

package/package.json

@@ -76,5 +76,5 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "version": "1.6.0"
+  "version": "1.7.1"
 }