dsh-pocket 1.7.2 → 1.7.4

package/README.en.md

@@ -41,12 +41,14 @@ What it looks like — the phone shows the exact same UI as your computer, live:
 
 | Feature | Description |
 |---|---|
-| 📶 LAN QR access | Works out of the box: Settings → Plugins → Phone access — scan the LAN QR on the same Wi-Fi |
+| 📶 LAN QR access | Works out of the box: Settings → Phone access — scan the LAN QR on the same Wi-Fi |
 | 🌐 Public QR (from anywhere) | Click "Enable anywhere" → cloudflared tunnel → scan the public QR over 4G / any network |
+| 🔐 Public access PIN | Public links require an **8-digit PIN** (rotated every time the tunnel starts — old links die instantly); LAN stays password-free |
 | ⚡ Real-time sync | Streaming output passes through WebSocket untouched — what the computer renders, the phone renders live; fully interactive both ways |
 | 📱 Mobile-adaptive layout | Narrow screens get a drawer layout automatically (ported from dsh-web-mobile, MIT): sidebar drawer, full-width conversation, safe-area insets, touch optimizations |
+| 🗜️ Transfer compression | Large JSON responses are gzip/brotli'd on the fly (17MB session history → ~1.3MB) — faster loads, less mobile data |
+| 🔁 Tunnel auto-restore | After a DSH restart the previously-running public tunnel comes back automatically |
 | 🧩 Zero-dependency install | One npm package, one settings tab — no core/adapter split, no account, no server |
-| 🔒 URL is the key | No public URL exposure in LAN mode; public URL rotates on every restart |
 
 ## 🚀 Usage
 
@@ -73,20 +75,21 @@ npx @deepseek-ai/dsh web
 
 ### LAN (same Wi-Fi)
 
-Settings → Plugins → **Phone access** → scan the "📶 LAN" QR code → the phone opens the exact same DSH, in real time.
+Settings → **Phone access** → scan the "📶 LAN" QR code → the phone opens the exact same DSH, in real time.
 
 ### Public (from anywhere)
 
-On the same page click "**Enable anywhere**" → wait for the tunnel (first run downloads cloudflared) → scan the "🌐 Public" QR code → works from outside (4G / office network).
+On the same page click "**Enable anywhere**" → wait for the tunnel (first run downloads cloudflared; macOS/Linux use the Tsinghua mirror, seconds) → scan the "🌐 Public" QR code → the phone opens the link and **enters the 8-digit PIN** (shown in the settings page's public section, **rotated on every tunnel start**) → works from outside (4G / office network).
 
 > Upgrading: `dsh plugin --profile web update dsh-pocket --latest -w` (`--latest` is required across major versions — a `^0.x` range won't auto-jump to 1.x).
 
 ## ⚠️ Security (read first)
 
-- **DSH can execute code on your computer.** The QR code / URL is the key — **never share it with anyone**.
+- **DSH can execute code on your computer.** **LAN** QR/URL is the key (no password) — **never share the LAN QR or URL**.
+- **Public** access is protected by an **8-digit PIN**: the link is random, the PIN rotates on every tunnel start, and old links die instantly — even a leaked link can't get in.
 - The public URL is randomly assigned by cloudflared and **changes on every restart** (old links die automatically — a natural key rotation).
 - LAN mode exposes nothing publicly; only devices on the same network can reach it.
-- Built for personal use; access tokens for multi-device/sharing are planned.
+- Built for personal use; the PIN lives in `$DSH_HOME/dsh-pocket/token` and is re-rolled by restarting the public tunnel.
 
 ## 🩹 Troubleshooting (traps users step on)
 
@@ -135,16 +138,16 @@ Such tools take over all traffic and often cut cloudflared's tunnel-edge connect
    - Windows: `winget install cloudflared` or from the official site
    - Any platform: `npm i -g cloudflared`
 2. Enable a proxy (system proxy / Clash etc.) and click "Enable anywhere" again
-3. Manually download the binary into `$DSH_HOME/dsh-pocket/bin/` (`$DSH_HOME` is usually `~/.dsh`, on Windows `%USERPROFILE%\.dsh`)
+3. Manually download the binary into `$DSH_HOME/dsh-pocket/bin/` (`$DSH_HOME` is usually `~/.dsh`, on Windows `%USERPROFILE%\.dsh`; name it `cloudflared` (add `.exe` on Windows) **or** the release asset name — both are recognized)
 
 ## 🗂 Architecture (single package)
 
 | File | Purpose |
 |---|---|
-| `lib/index.js` | Plugin entry: auto-start proxy + register RPC (`inject: connection, webServer`) |
-| `lib/service.mjs` | Service: proxy lifecycle, public tunnel, status snapshot (with QR data URLs) |
-| `lib/proxy.mjs` | Header-rewriting reverse proxy: Host/Origin → loopback, HTTP + WebSocket passthrough + polyfill injection |
-| `lib/tunnel.mjs` | cloudflared quick tunnel: download/extract/start/parse public URL (HTTP/2) |
+| `lib/index.js` | Plugin entry: auto-start proxy + register RPC + public-access PIN management (8 digits, rotated per tunnel start) + DSH Desktop detection |
+| `lib/service.mjs` | Service: proxy lifecycle (port auto-fallback), public tunnel (auto-restore), status snapshot (with QR data URLs) |
+| `lib/proxy.mjs` | Header-rewriting reverse proxy: Host/Origin → loopback, HTTP + WebSocket passthrough + polyfill injection + gzip/brotli compression + public-access PIN auth |
+| `lib/tunnel.mjs` | cloudflared: multi-mirror download (Tsinghua first) / adaptive parallel / start / parse public URL (HTTP/2) |
 | `lib/web-rpc.js` | Loopback RPC: `status` / `tunnel.start` / `tunnel.stop` / `version` / `update` / `restart` |
 | `client/` | "Phone access" settings tab + mobile adaptation (dsh-web-mobile port) |
 | `bin/dsh-pocket.mjs` | CLI: LAN/public modes, prints URL + QR |
@@ -154,7 +157,7 @@ Such tools take over all traffic and often cut cloudflared's tunnel-edge connect
 ```sh
 npm install
 node client/build.mjs   # rebuild after editing client/
-npm test                # proxy rewrite / WS passthrough / tunnel / service / RPC (7 tests)
+npm test                # proxy / auth / compression / tunnel / service / RPC (40 tests)
 ```
 
 ## 🤝 Credits

package/README.md

@@ -41,12 +41,14 @@ DSH Pocket 就是干这个的：**装上它，手机扫个码，就能实时看
 
 | 特性 | 说明 |
 |---|---|
-| 📶 局域网扫码 | 装好即用：设置 → 插件 → 手机访问，打开就有局域网二维码，手机连同一 WiFi 扫码即开 |
+| 📶 局域网扫码 | 装好即用：设置 → 手机访问，打开就有局域网二维码，手机连同一 WiFi 扫码即开 |
 | 🌐 公网扫码（人在外面） | 点「开启公网访问」→ cloudflared 隧道 → 出公网二维码，4G/任何网络都能访问 |
+| 🔐 公网访问密码 | 公网链接需输入 **8 位数字密码**（每次开启公网自动换新，旧链接立即作废）；局域网免密码 |
 | ⚡ 实时同步 | 流式输出走 WebSocket 全透传——**电脑上在输出，手机上同步在滚**，可双向操作 |
 | 📱 移动端适配 | 窄屏自动变抽屉布局（移植 dsh-web-mobile，MIT）：侧栏抽屉、会话全宽、状态栏安全区、触控优化 |
+| 🗜️ 传输压缩 | 大 JSON 响应自动 gzip/brotli（长会话 17MB → ~1.3MB），手机加载更快、更省流量 |
+| 🔁 隧道自动恢复 | DSH 重启后自动重新拉起之前开着的公网隧道，无需手动重开 |
 | 🧩 零依赖安装 | 一个 npm 包、一个设置页，没有核心/适配器要分开装；无需账号、无需服务器 |
-| 🔒 URL 即钥匙 | 无公网 URL 暴露给第三方（局域网模式）；公网 URL 每次重启自动换新 |
 
 ## 🚀 怎么用
 
@@ -73,20 +75,21 @@ npx @deepseek-ai/dsh web
 
 ### 局域网（同一 WiFi）
 
-设置 → 插件 → **手机访问** → 手机扫「📶 局域网」二维码 → 打开的就是电脑上的 DSH，实时同步。
+设置 → **手机访问** → 手机扫「📶 局域网」二维码 → 打开的就是电脑上的 DSH，实时同步。
 
 ### 公网（人在外面）
 
-同一页点「**开启公网访问**」→ 等隧道建立（首次会下载 cloudflared）→ 手机扫「🌐 公网」二维码 → 人在外面（4G/公司网）也能访问。
+同一页点「**开启公网访问**」→ 等隧道建立（首次会下载 cloudflared，macOS/Linux 走清华镜像秒下）→ 手机扫「🌐 公网」二维码 → 打开链接**输入 8 位访问密码**（密码显示在设置页公网区块，**每次开启公网变新**）→ 人在外面（4G/公司网）也能访问。
 
 > 更新到新版本：`dsh plugin --profile web update dsh-pocket --latest -w`（跨大版本时 `--latest` 是必须的，`^0.x` 范围不会自动升到 1.x）。
 
 ## ⚠️ 安全（必读）
 
-- **DSH 能执行你电脑上的代码**。二维码/URL 就是钥匙，**请勿把二维码或 URL 发给任何人**
+- **DSH 能执行你电脑上的代码**。**局域网**二维码/URL 就是钥匙（无密码），**请勿把局域网二维码或 URL 发给别人**
+- **公网**有 **8 位数字密码**保护：链接随机分配、每次开启换新密码、旧链接立即作废——泄露了也进不来，改密码/重开即可作废
 - 公网 URL 由 cloudflared 随机分配，**每次重启会变化**（旧链接自动失效，相当于天然轮换）
 - 局域网模式不暴露公网，只有同一网络内的设备能访问
-- 适合个人自用；多设备/分享场景后续会加访问令牌
+- 适合个人自用；密码存本机 `$DSH_HOME/dsh-pocket/token`，可随时重开公网换新
 
 ## 🩹 常见问题（别踩的坑）
 
@@ -136,16 +139,16 @@ npx @deepseek-ai/dsh web
    - Windows：`winget install cloudflared` 或官网下载
    - 任何平台：`npm i -g cloudflared`
 2. 挂代理（系统代理/Clash 等）后重新点「开启公网访问」
-3. 手动下载二进制放到 `$DSH_HOME/dsh-pocket/bin/` 目录（`$DSH_HOME` 一般是 `~/.dsh`，Windows 是 `%USERPROFILE%\.dsh`）
+3. 手动下载二进制放到 `$DSH_HOME/dsh-pocket/bin/` 目录（`$DSH_HOME` 一般是 `~/.dsh`，Windows 是 `%USERPROFILE%\.dsh`；文件名用 `cloudflared`（Windows 加 `.exe`）或发布资产名均可，插件都认）
 
 ## 🗂 架构（单包）
 
 | 文件 | 说明 |
 |---|---|
-| `lib/index.js` | 插件入口：自动起代理 + 注册 RPC（`inject: connection, webServer`） |
-| `lib/service.mjs` | 服务：代理生命周期、公网隧道、状态快照（含二维码 data URL） |
-| `lib/proxy.mjs` | 改头反向代理：Host/Origin → loopback，HTTP + WebSocket 全透传 + polyfill 注入 |
-| `lib/tunnel.mjs` | cloudflared 快速隧道：下载/解压/启动/解析公网 URL（HTTP/2） |
+| `lib/index.js` | 插件入口：自动起代理 + 注册 RPC + 公网访问密码管理（8 位数字，每次开启变新）+ 桌面端环境适配 |
+| `lib/service.mjs` | 服务：代理生命周期（端口自适应）、公网隧道（自动恢复）、状态快照（含二维码） |
+| `lib/proxy.mjs` | 改头反向代理：Host/Origin → loopback，HTTP + WebSocket 透传 + polyfill 注入 + gzip/brotli 压缩 + 公网访问令牌认证 |
+| `lib/tunnel.mjs` | cloudflared：多镜像源下载（清华优先）/自适应多线程/启动/解析公网 URL（HTTP/2） |
 | `lib/web-rpc.js` | loopback RPC：`status` / `tunnel.start` / `tunnel.stop` / `version` / `update` / `restart` |
 | `client/` | 设置页「手机访问」+ 移动端适配（dsh-web-mobile 移植） |
 | `bin/dsh-pocket.mjs` | CLI：局域网/公网模式，打印 URL + 二维码 |
@@ -155,7 +158,7 @@ npx @deepseek-ai/dsh web
 ```sh
 npm install
 node client/build.mjs   # 改 client/ 后重新打包
-npm test                # 代理改写 / WS 透传 / 隧道 / 服务 / RPC（7 测试）
+npm test                # 代理 / 认证 / 压缩 / 隧道 / 服务 / RPC（40 测试）
 ```
 
 ## 🤝 致谢

package/client/client.js

@@ -1297,7 +1297,7 @@ var styles = {
   muted: { color: "var(--dsw-alias-label-tertiary,#8b93a1)", fontSize: 12, lineHeight: 1.5 },
   code: { fontFamily: "ui-monospace,Menlo,monospace", fontSize: 12, wordBreak: "break-all", margin: "6px 0 10px", color: "var(--dsw-alias-label-primary,inherit)" },
   // 主按钮：官方 md 胶囊形（36px）
-  primary: { font: "inherit", cursor: "pointer", border: "none", background: "var(--dsw-alias-button-primary-fill, var(--dsw-alias-brand-primary,#4f6ef7))", color: "#fff", height: 36, padding: "0 16px", borderRadius: 999, fontSize: 13, fontWeight: 500, display: "inline-flex", alignItems: "center", justifyContent: "center" },
+  primary: { font: "inherit", cursor: "pointer", border: "none", background: "var(--dsw-alias-button-primary-fill, var(--dsw-alias-brand-primary,#4f6ef7))", color: "var(--dsw-alias-label-primary-foreground, #fff)", height: 36, padding: "0 16px", borderRadius: 999, fontSize: 13, fontWeight: 500, display: "inline-flex", alignItems: "center", justifyContent: "center" },
   // 次级按钮：官方 outline/ghost 胶囊形
   btn: { font: "inherit", cursor: "pointer", border: "1px solid var(--dsw-alias-button-ghost-active-border, var(--dsw-alias-border-l2,#d1d5db))", background: "var(--dsw-alias-bg-layer-1,#fff)", color: "var(--dsw-alias-label-primary,inherit)", height: 36, padding: "0 16px", borderRadius: 999, fontSize: 13, display: "inline-flex", alignItems: "center", justifyContent: "center" },
   qr: { width: 220, height: 220, borderRadius: 10, border: "1px solid var(--dsw-alias-border-l2,#e5e7eb)", margin: "8px 0" },

package/client/index.jsx

@@ -24,7 +24,7 @@ const styles = {
   muted: { color: 'var(--dsw-alias-label-tertiary,#8b93a1)', fontSize: 12, lineHeight: 1.5 },
   code: { fontFamily: 'ui-monospace,Menlo,monospace', fontSize: 12, wordBreak: 'break-all', margin: '6px 0 10px', color: 'var(--dsw-alias-label-primary,inherit)' },
   // 主按钮：官方 md 胶囊形（36px）
-  primary: { font: 'inherit', cursor: 'pointer', border: 'none', background: 'var(--dsw-alias-button-primary-fill, var(--dsw-alias-brand-primary,#4f6ef7))', color: '#fff', height: 36, padding: '0 16px', borderRadius: 999, fontSize: 13, fontWeight: 500, display: 'inline-flex', alignItems: 'center', justifyContent: 'center' },
+  primary: { font: 'inherit', cursor: 'pointer', border: 'none', background: 'var(--dsw-alias-button-primary-fill, var(--dsw-alias-brand-primary,#4f6ef7))', color: 'var(--dsw-alias-label-primary-foreground, #fff)', height: 36, padding: '0 16px', borderRadius: 999, fontSize: 13, fontWeight: 500, display: 'inline-flex', alignItems: 'center', justifyContent: 'center' },
   // 次级按钮：官方 outline/ghost 胶囊形
   btn: { font: 'inherit', cursor: 'pointer', border: '1px solid var(--dsw-alias-button-ghost-active-border, var(--dsw-alias-border-l2,#d1d5db))', background: 'var(--dsw-alias-bg-layer-1,#fff)', color: 'var(--dsw-alias-label-primary,inherit)', height: 36, padding: '0 16px', borderRadius: 999, fontSize: 13, display: 'inline-flex', alignItems: 'center', justifyContent: 'center' },
   qr: { width: 220, height: 220, borderRadius: 10, border: '1px solid var(--dsw-alias-border-l2,#e5e7eb)', margin: '8px 0' },

package/lib/tunnel.mjs

@@ -4,7 +4,7 @@
 // 无密码模式：URL 即钥匙（dsh web 能执行代码，请勿把二维码/URL 发给别人）。
 
 import { spawn, execSync } from 'node:child_process';
-import { mkdir, access, chmod, rm, stat, rename, cp } from 'node:fs/promises';
+import { mkdir, access, chmod, rm, stat, rename, cp, open } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join, dirname } from 'node:path';
 import { pipeline } from 'node:stream/promises';
@@ -146,13 +146,15 @@ export async function downloadFile(url, dest, { signal, segments = PARALLEL_SEGM
 
 /**
  * 清华 TUNA 镜像的 cloudflared Homebrew bottle URL（国内 CDN，实测 ~3MB/s）。
- * 只覆盖 macOS/Linux（Windows 无 Homebrew bottle，返回 null）。
+ * **仅 macOS**——Linux 的 Homebrew bottle 其 ELF 解释器是 `@@HOMEBREW_PREFIX@@`
+ * 占位符（需 brew install 时 patchelf 替换），没装 Homebrew 的机器直接 spawn 会
+ * ENOENT（issue #22）；Linux 走官方 GitHub tgz（解压即用）+ 加速源。
  * 匹配按 CPU 架构取清华目录里版本号最新的 bottle——Homebrew 构建时部署目标
  * 设得较老、向后兼容，所以旧系统（如 Ventura）也能用新一点的 bottle。
  * 抓目录失败/无匹配 → null（调用方回退 GitHub/加速源，不影响可用性）。
  */
 async function tsinghuaBottleUrl({ os, a }) {
-  if (os !== 'darwin' && os !== 'linux') return null;
+  if (os !== 'darwin') return null;
   let res;
   try {
     res = await fetch(TUNA_BOTTLES, { signal: AbortSignal.timeout(20_000) });
@@ -303,6 +305,22 @@ export async function resolveCloudflared({ home, onPhase = () => {}, signal } =
   for (const bin of candidates) {
     try {
       await access(bin);
+      // Linux：识别并丢弃 Homebrew bottle 坏缓存（issue #22）——其 ELF 解释器是
+      // @@HOMEBREW_PREFIX@@ 占位符，直接 spawn 报 ENOENT；读文件头（解释器路径在
+      // ELF 头部附近）即可识别，命中则删掉走重新下载
+      if (os === 'linux') {
+        try {
+          const fd = await open(bin, 'r');
+          const head = Buffer.alloc(8192);
+          await fd.read(head, 0, 8192, 0);
+          await fd.close();
+          if (head.includes('@@HOMEBREW_PREFIX@@')) {
+            await rm(bin, { force: true }).catch(() => {});
+            console.warn('dsh-pocket: discarding unusable Homebrew-bottle cloudflared cache | 丢弃不可用的 Homebrew bottle 缓存，重新下载');
+            continue;
+          }
+        } catch { /* 读失败按正常缓存处理 */ }
+      }
       return bin; // 缓存命中，秒开
     } catch { /* 继续找下一个 */ }
   }

package/package.json

@@ -76,5 +76,5 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "version": "1.7.2"
+  "version": "1.7.4"
 }