dsh-pocket 1.7.5 → 1.8.1

package/client/api.js

@@ -8,6 +8,7 @@ export const POCKET_ENDPOINTS = Object.freeze({
   version: 'pocket.version',
   update: 'pocket.update',
   restart: 'pocket.restart',
+  lanTokenRefresh: 'token.lanRefresh',
 });
 
 /** 语义化版本比较：a > b 返回正数，相等 0，a < b 负数（数字段 + 预发布后缀）。 */

package/client/client.js

@@ -47,7 +47,8 @@ var POCKET_ENDPOINTS = Object.freeze({
   tunnelStop: "tunnel.stop",
   version: "pocket.version",
   update: "pocket.update",
-  restart: "pocket.restart"
+  restart: "pocket.restart",
+  lanTokenRefresh: "token.lanRefresh"
 });
 function compareVersions(a, b) {
   const pa = String(a).replace(/^[vV]/, "").split(".");
@@ -1429,6 +1430,13 @@ function PocketSettingsTab({ rpcCall }) {
     } catch {
     }
   };
+  const refreshLanPin = async () => {
+    try {
+      const r = await call(POCKET_ENDPOINTS.lanTokenRefresh, {});
+      setStatus((s) => ({ ...s, lanToken: r.lanToken }));
+    } catch {
+    }
+  };
   const lanUrl = status?.lanUrl;
   const tunnelUrl = status?.tunnelUrl;
   const tunnelPhase = tunnelState?.phase ?? "idle";
@@ -1503,7 +1511,15 @@ function PocketSettingsTab({ rpcCall }) {
         null,
         (0, import_react2.createElement)("img", { src: status.lanQr, alt: "LAN QR", style: styles.qr }),
         (0, import_react2.createElement)("div", { style: styles.code }, lanUrl),
-        (0, import_react2.createElement)("div", { style: styles.muted }, "\u624B\u673A\u8FDE\u63A5\u540C\u4E00 WiFi \u540E\u626B\u7801\u5373\u53EF\u6253\u5F00")
+        (0, import_react2.createElement)("div", { style: styles.muted }, "\u624B\u673A\u8FDE\u63A5\u540C\u4E00 WiFi \u540E\u626B\u7801\u5373\u53EF\u6253\u5F00"),
+        status.lanToken ? (0, import_react2.createElement)(
+          "div",
+          { style: { marginTop: 6, fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)", lineHeight: 1.5 } },
+          "\u{1F510} \u8BBF\u95EE\u5BC6\u7801\uFF1A",
+          status.lanToken,
+          "\uFF08\u624B\u673A\u6253\u5F00\u9700\u8F93\u5165\uFF1B\u4E0E\u516C\u7F51\u5BC6\u7801\u5206\u5F00\uFF09",
+          (0, import_react2.createElement)("button", { style: { ...styles.btn, height: 26, padding: "0 10px", fontSize: 12, marginLeft: 8 }, onClick: refreshLanPin }, "\u5237\u65B0 | Refresh")
+        ) : null
       ) : (0, import_react2.createElement)("div", { style: styles.muted }, "\u4EE3\u7406\u672A\u5C31\u7EEA\u2026 | proxy starting\u2026")
     ),
     // 公网

package/client/index.jsx

@@ -167,6 +167,14 @@ function PocketSettingsTab({ rpcCall }) {
     try { setStatus(await call(POCKET_ENDPOINTS.tunnelStop, {})); } catch { /* 忽略 */ }
   };
 
+  // 刷新局域网访问密码（旧密码立即作废）
+  const refreshLanPin = async () => {
+    try {
+      const r = await call(POCKET_ENDPOINTS.lanTokenRefresh, {});
+      setStatus((s) => ({ ...s, lanToken: r.lanToken }));
+    } catch { /* 忽略 */ }
+  };
+
   const lanUrl = status?.lanUrl;
   const tunnelUrl = status?.tunnelUrl;
   const tunnelPhase = tunnelState?.phase ?? 'idle';
@@ -235,6 +243,14 @@ function PocketSettingsTab({ rpcCall }) {
           h('img', { src: status.lanQr, alt: 'LAN QR', style: styles.qr }),
           h('div', { style: styles.code }, lanUrl),
           h('div', { style: styles.muted }, '手机连接同一 WiFi 后扫码即可打开'),
+          status.lanToken
+            ? h('div', { style: { marginTop: 6, fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)', lineHeight: 1.5 } },
+              '🔐 访问密码：',
+              status.lanToken,
+              '（手机打开需输入；与公网密码分开）',
+              h('button', { style: { ...styles.btn, height: 26, padding: '0 10px', fontSize: 12, marginLeft: 8 }, onClick: refreshLanPin }, '刷新 | Refresh'),
+            )
+            : null,
         )
         : h('div', { style: styles.muted }, '代理未就绪… | proxy starting…'),
     ),

package/lib/index.js

@@ -41,33 +41,58 @@ function currentVersion() {
 /** 进程启动时加载的版本（模块加载瞬间固化；用于识别「磁盘已更新但进程还是旧代码」）。 */
 const loadedVersion = currentVersion();
 
-// ---------- 公网访问密码（issue #13） ----------
-// 8 位数字，存本机 $DSH_HOME/dsh-pocket/token，每次开启公网时轮换（旧链接作废）。
-// 局域网 IP 直连免密码；仅公网隧道 Host 强制。
-const tokenRel = join('dsh-pocket', 'token');
-function tokenPath() {
-  return join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), tokenRel);
-}
-/** 生成 8 位数字密码并写文件（同步，保证后续读取一致）。 */
-function writeNewToken() {
-  const fresh = String(Math.floor(10000000 + Math.random() * 90000000));
+// ---------- 访问密码（issue #13 + #18） ----------
+// 公网与局域网**分开**：各自 8 位数字，存本机 $DSH_HOME/dsh-pocket/。
+// 公网密码（token）：每次开启公网时轮换（旧链接作废）；
+// 局域网密码（token-lan）：手动刷新（设置页按钮）。
+function writePinToFile(p, fresh) {
   try {
-    mkdirSync(dirname(tokenPath()), { recursive: true });
-    writeFileSync(tokenPath(), fresh, { mode: 0o600 });
+    mkdirSync(dirname(p), { recursive: true });
+    writeFileSync(p, fresh, { mode: 0o600 });
   } catch { /* 忽略 */ }
   return fresh;
 }
-/** 当前公网访问密码；文件不存在时生成一个。 */
-function getAccessToken() {
+function readPin(p) {
   try {
-    const existing = readFileSync(tokenPath(), 'utf8').trim();
+    const existing = readFileSync(p, 'utf8').trim();
     if (/^\d{8}$/.test(existing)) return existing;
   } catch { /* 无文件 */ }
-  return writeNewToken();
+  return null;
+}
+function newPin() {
+  return String(Math.floor(10000000 + Math.random() * 90000000));
+}
+
+// --- 公网密码 ---
+const tokenRel = join('dsh-pocket', 'token');
+function tokenPath() {
+  return join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), tokenRel);
+}
+/** 当前公网访问密码；文件不存在时生成一个。 */
+function getAccessToken() {
+  return readPin(tokenPath()) ?? writePinToFile(tokenPath(), newPin());
 }
-/** 轮换：生成新的 8 位数字密码（开启公网时调用，旧密码/链接立即作废）。 */
+/** 轮换公网密码（开启公网时调用，旧密码/链接立即作废）。 */
 function rotateAccessToken() {
-  return writeNewToken();
+  return writePinToFile(tokenPath(), newPin());
+}
+
+// --- 局域网密码（issue #18：局域网与公网分开，手动刷新） ---
+const lanTokenRel = join('dsh-pocket', 'token-lan');
+function lanTokenPath() {
+  return join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), lanTokenRel);
+}
+/** 当前局域网访问密码；文件不存在时生成一个。 */
+function getLanToken() {
+  return readPin(lanTokenPath()) ?? writePinToFile(lanTokenPath(), newPin());
+}
+/** 刷新局域网密码（设置页按钮触发，旧密码立即作废）。 */
+function refreshLanToken() {
+  return writePinToFile(lanTokenPath(), newPin());
+}
+/** 按 Host 分发的访问密码：公网隧道用公网密码，局域网用局域网密码。 */
+function tokenForHost(host) {
+  return /trycloudflare\.com$/i.test(String(host ?? '')) ? getAccessToken() : getLanToken();
 }
 
 const restartNoticeRel = join('dsh-pocket', 'restarted.json');
@@ -177,10 +202,10 @@ export function apply(ctx, config = {}, internals = {}) {
     injectHtml: isDesktop
       ? DEFAULT_INJECT + desktopEnvPatchScript(process.platform) + (desktopAdvanced ? advancedNoticeScript() : '')
       : undefined,
-    // 公网访问密码（issue #13）：仅公网隧道 Host 强制；局域网免密码
+    // 访问密码（issue #13 + #18）：局域网与公网**分开**，所有代理访问都要验证
     auth: {
-      getToken: () => getAccessToken(),
-      isProtected: (host) => /trycloudflare\.com$/i.test(String(host ?? '')),
+      getToken: (host) => tokenForHost(host),
+      isProtected: () => true,
     },
     // 每次公网隧道就绪 → 轮换 8 位密码（旧密码/旧链接立即作废）
     onTunnelReady: () => {
@@ -195,6 +220,8 @@ export function apply(ctx, config = {}, internals = {}) {
     service,
     desktop: isDesktop,
     getToken: () => getAccessToken(),
+    getLanToken: () => getLanToken(),
+    refreshLanToken: () => refreshLanToken(),
     runUpdate: internals.runUpdate ?? { currentVersion, perform: performUpdate, loadedVersion: () => loadedVersion },
     restart: internals.restart ?? (() => pocketRestart(service)),
     restartNotice: internals.restartNotice ?? consumeRestartNotice,

package/lib/proxy.mjs

@@ -76,7 +76,10 @@ function parseCookies(header) {
   return out;
 }
 
-function loginPageHtml(error) {
+/** 登录页：按访问来源显示提示（局域网 / 公网）。 */
+function loginPageHtml(error, isPublic) {
+  const where = isPublic ? '此公网地址' : '此局域网地址';
+  const whereEn = isPublic ? 'This public address' : 'This LAN address';
   return `<!doctype html><html lang="zh"><head><meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
 <title>DSH Pocket · 访问验证</title>
@@ -91,7 +94,7 @@ button{width:100%;padding:10px;font-size:15px;background:#4f6ef7;color:#fff;bord
 .err{color:#dc2626;font-size:12px;margin-bottom:10px;min-height:16px}
 </style></head><body><div class="card">
 <h1>🔐 DSH Pocket</h1>
-<p>此公网地址受访问密码保护，请输入 8 位数字密码</p>
+<p>${where}受访问密码保护，请输入 8 位数字密码 | ${whereEn} is password-protected — enter the 8-digit PIN</p>
 <div class="err">${error ? '密码错误，请重试' : ''}</div>
 <form method="post" action="/pocket-login">
 <input name="token" type="password" inputmode="numeric" maxlength="8" autocomplete="one-time-code" autofocus required>
@@ -141,11 +144,12 @@ function loopbackAuthority(headers, upstream) {
  */
 export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DEFAULT_UPSTREAM, log = null, injectHtml = DEFAULT_INJECT, auth = null } = {}) {
   const server = createServer((req, res) => {
-    // 访问令牌认证（issue #13）：仅公网隧道 Host 强制；局域网 IP 直连免密码
+    // 访问令牌认证（issue #13 + #18）：局域网与公网都要求密码
     if (auth) {
       const host = String(req.headers.host ?? '');
+      const isPublic = /trycloudflare\.com$/i.test(host);
       const protectedHost = isProtectedHost(host, auth.isProtected);
-      const token = protectedHost ? (auth.getToken?.() ?? null) : null;
+      const token = protectedHost ? (auth.getToken?.(host) ?? null) : null;
       if (protectedHost && token) {
         // 登录提交：校验密码 → 种 HttpOnly 会话 cookie → 回首页
         if (req.method === 'POST' && req.url?.startsWith('/pocket-login')) {
@@ -162,7 +166,7 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
               res.end();
             } else {
               res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
-              res.end(loginPageHtml(true));
+              res.end(loginPageHtml(true, isPublic));
             }
           });
           return;
@@ -170,7 +174,7 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
         if (!authCheck(req, token)) {
           if (isHtmlRequest(req)) {
             res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
-            res.end(loginPageHtml(false));
+            res.end(loginPageHtml(false, isPublic));
           } else {
             res.writeHead(401, { 'content-type': 'application/json', 'cache-control': 'no-store' });
             res.end('{"error":"unauthorized"}');
@@ -258,7 +262,7 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
     // WebSocket 同样校验（防止绕过 HTTP 认证从 WS 进入）
     if (auth) {
       const host = String(req.headers.host ?? '');
-      const token = isProtectedHost(host, auth.isProtected) ? (auth.getToken?.() ?? null) : null;
+      const token = isProtectedHost(host, auth.isProtected) ? (auth.getToken?.(host) ?? null) : null;
       if (token && !authCheck(req, token)) {
         socket.write('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
         socket.destroy();

package/lib/web-rpc.js

@@ -25,7 +25,7 @@ export function killHint(port) {
 }
 
 /** 注册 /dsh-pocket 逻辑通道（仅本机 loopback 可调）。 */
-export function installPocketRpc(ctx, { service, log = console, desktop = false, runUpdate = null, restart = null, restartNotice = null, getToken = null }) {
+export function installPocketRpc(ctx, { service, log = console, desktop = false, runUpdate = null, restart = null, restartNotice = null, getToken = null, getLanToken = null, refreshLanToken = null }) {
   if (!ctx?.connection?.rpc?.handle) {
     log.warn?.('dsh-pocket: DSH Host Connection RPC unavailable — settings tab disabled | 无 Connection RPC，设置页不可用');
     return () => {};
@@ -33,18 +33,30 @@ export function installPocketRpc(ctx, { service, log = console, desktop = false,
   return ctx.connection.rpc.handle(POCKET_RPC_CHANNEL, async (endpoint, payload = {}, signal) => {
     if (signal?.aborted) return fail('cancelled', 'The request was cancelled.');
 
-    // status 响应：redact 后的服务状态 + 重启提示（重启后 30 分钟内有效）+ 停止命令（按平台）+ 桌面端标志 + 公网访问密码
+    // status 响应：服务状态 + 重启提示 + 停止命令 + 桌面端标志 + 公网/局域网访问密码
     const statusPayload = async () => {
       let notice = null;
       try { notice = (await restartNotice?.()) ?? null; } catch { notice = null; }
       const s = await service.status();
-      return ok({ ...redactStatus(s), desktop, restartNotice: notice, killHint: killHint(s.dshPort ?? 3080), accessToken: getToken?.() ?? null });
+      return ok({
+        ...redactStatus(s),
+        desktop,
+        restartNotice: notice,
+        killHint: killHint(s.dshPort ?? 3080),
+        accessToken: getToken?.() ?? null,
+        lanToken: getLanToken?.() ?? null,
+      });
     };
 
     try {
       if (endpoint === POCKET_ENDPOINTS.status) {
         return await statusPayload();
       }
+      if (endpoint === POCKET_ENDPOINTS.lanTokenRefresh) {
+        const fresh = refreshLanToken?.() ?? null;
+        if (!fresh) return fail('bad-request', '局域网密码刷新不可用 | LAN PIN refresh unavailable');
+        return ok({ lanToken: fresh });
+      }
       if (endpoint === POCKET_ENDPOINTS.tunnelStart) {
         await service.startTunnel();
         return await statusPayload();

package/package.json

@@ -76,5 +76,5 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "version": "1.7.5"
+  "version": "1.8.1"
 }