dsh-pocket 1.8.2 → 1.8.3

package/README.en.md

@@ -43,7 +43,7 @@ What it looks like — the phone shows the exact same UI as your computer, live:
 |---|---|
 | 📶 LAN QR access | Works out of the box: Settings → Phone access — scan the LAN QR on the same Wi-Fi |
 | 🌐 Public QR (from anywhere) | Click "Enable anywhere" → cloudflared tunnel → scan the public QR over 4G / any network |
-| 🔐 Public access PIN | Public links require an **8-digit PIN** (rotated every time the tunnel starts — old links die instantly); LAN stays password-free |
+| 🔐 Access PIN | Public links require an **8-digit PIN** (rotated every time the tunnel starts — old links die instantly); LAN has its own separate **8-digit PIN** (refresh it manually in Settings) |
 | ⚡ Real-time sync | Streaming output passes through WebSocket untouched — what the computer renders, the phone renders live; fully interactive both ways |
 | 📱 Mobile-adaptive layout | Narrow screens get a drawer layout automatically (ported from dsh-web-mobile, MIT): sidebar drawer, full-width conversation, safe-area insets, touch optimizations |
 | 🗜️ Transfer compression | Large JSON responses are gzip/brotli'd on the fly (17MB session history → ~1.3MB) — faster loads, less mobile data |
@@ -75,7 +75,7 @@ npx @deepseek-ai/dsh web
 
 ### LAN (same Wi-Fi)
 
-Settings → **Phone access** → scan the "📶 LAN" QR code → the phone opens the exact same DSH, in real time.
+Settings → **Phone access** → scan the "📶 LAN" QR code → enter the **LAN PIN** (shown in the LAN block of the settings page; hit **Refresh** to get a new one) → the phone opens the exact same DSH, in real time.
 
 ### Public (from anywhere)
 
@@ -85,11 +85,11 @@ On the same page click "**Enable anywhere**" → wait for the tunnel (first run
 
 ## ⚠️ Security (read first)
 
-- **DSH can execute code on your computer.** **LAN** QR/URL is the key (no password) — **never share the LAN QR or URL**.
+- **DSH can execute code on your computer.** **LAN** QR/URL plus its own **8-digit PIN** is the key — **never share the LAN QR, URL or PIN**.
 - **Public** access is protected by an **8-digit PIN**: the link is random, the PIN rotates on every tunnel start, and old links die instantly — even a leaked link can't get in.
 - The public URL is randomly assigned by cloudflared and **changes on every restart** (old links die automatically — a natural key rotation).
 - LAN mode exposes nothing publicly; only devices on the same network can reach it.
-- Built for personal use; the PIN lives in `$DSH_HOME/dsh-pocket/token` and is re-rolled by restarting the public tunnel.
+- Built for personal use; the public PIN lives in `$DSH_HOME/dsh-pocket/token` (re-rolled on every tunnel start) and the LAN PIN in `$DSH_HOME/dsh-pocket/token-lan` (refreshed manually in Settings).
 
 ## 💻 DSH Desktop
 
@@ -149,7 +149,7 @@ Such tools take over all traffic and often cut cloudflared's tunnel-edge connect
 
 | File | Purpose |
 |---|---|
-| `lib/index.js` | Plugin entry: auto-start proxy + register RPC + public-access PIN management (8 digits, rotated per tunnel start) + DSH Desktop detection |
+| `lib/index.js` | Plugin entry: auto-start proxy + register RPC + access-PIN management (public: 8 digits rotated per tunnel start; LAN: separate 8 digits, manually refreshable) + DSH Desktop detection |
 | `lib/service.mjs` | Service: proxy lifecycle (port auto-fallback), public tunnel (auto-restore), status snapshot (with QR data URLs) |
 | `lib/proxy.mjs` | Header-rewriting reverse proxy: Host/Origin → loopback, HTTP + WebSocket passthrough + polyfill injection + gzip/brotli compression + public-access PIN auth |
 | `lib/tunnel.mjs` | cloudflared: multi-mirror download (Tsinghua first) / adaptive parallel / start / parse public URL (HTTP/2) |

package/README.md

@@ -43,7 +43,7 @@ DSH Pocket 就是干这个的：**装上它，手机扫个码，就能实时看
 |---|---|
 | 📶 局域网扫码 | 装好即用：设置 → 手机访问，打开就有局域网二维码，手机连同一 WiFi 扫码即开 |
 | 🌐 公网扫码（人在外面） | 点「开启公网访问」→ cloudflared 隧道 → 出公网二维码，4G/任何网络都能访问 |
-| 🔐 公网访问密码 | 公网链接需输入 **8 位数字密码**（每次开启公网自动换新，旧链接立即作废）；局域网免密码 |
+| 🔐 访问密码 | 公网链接需输入 **8 位数字密码**（每次开启公网自动换新，旧链接立即作废）；局域网同样有独立 **8 位数字密码**（设置页可手动刷新） |
 | ⚡ 实时同步 | 流式输出走 WebSocket 全透传——**电脑上在输出，手机上同步在滚**，可双向操作 |
 | 📱 移动端适配 | 窄屏自动变抽屉布局（移植 dsh-web-mobile，MIT）：侧栏抽屉、会话全宽、状态栏安全区、触控优化 |
 | 🗜️ 传输压缩 | 大 JSON 响应自动 gzip/brotli（长会话 17MB → ~1.3MB），手机加载更快、更省流量 |
@@ -75,7 +75,7 @@ npx @deepseek-ai/dsh web
 
 ### 局域网（同一 WiFi）
 
-设置 → **手机访问** → 手机扫「📶 局域网」二维码 → 打开的就是电脑上的 DSH，实时同步。
+设置 → **手机访问** → 手机扫「📶 局域网」二维码 → 打开链接**输入局域网密码**（显示在设置页局域网区块，点「刷新」可换新）→ 打开的就是电脑上的 DSH，实时同步。
 
 ### 公网（人在外面）
 
@@ -85,11 +85,11 @@ npx @deepseek-ai/dsh web
 
 ## ⚠️ 安全（必读）
 
-- **DSH 能执行你电脑上的代码**。**局域网**二维码/URL 就是钥匙（无密码），**请勿把局域网二维码或 URL 发给别人**
+- **DSH 能执行你电脑上的代码**。**局域网**二维码/URL 配上独立 **8 位数字密码**才是钥匙，**请勿把局域网二维码、URL 或密码发给别人**
 - **公网**有 **8 位数字密码**保护：链接随机分配、每次开启换新密码、旧链接立即作废——泄露了也进不来，改密码/重开即可作废
 - 公网 URL 由 cloudflared 随机分配，**每次重启会变化**（旧链接自动失效，相当于天然轮换）
 - 局域网模式不暴露公网，只有同一网络内的设备能访问
-- 适合个人自用；密码存本机 `$DSH_HOME/dsh-pocket/token`，可随时重开公网换新
+- 适合个人自用；公网密码存本机 `$DSH_HOME/dsh-pocket/token`（每次开启公网自动换新），局域网密码存 `$DSH_HOME/dsh-pocket/token-lan`（设置页手动刷新）
 
 ## 💻 DSH Desktop（桌面版）
 
@@ -150,7 +150,7 @@ npx @deepseek-ai/dsh web
 
 | 文件 | 说明 |
 |---|---|
-| `lib/index.js` | 插件入口：自动起代理 + 注册 RPC + 公网访问密码管理（8 位数字，每次开启变新）+ 桌面端环境适配 |
+| `lib/index.js` | 插件入口：自动起代理 + 注册 RPC + 访问密码管理（公网 8 位每次开启变新；局域网独立 8 位可手动刷新）+ 桌面端环境适配 |
 | `lib/service.mjs` | 服务：代理生命周期（端口自适应）、公网隧道（自动恢复）、状态快照（含二维码） |
 | `lib/proxy.mjs` | 改头反向代理：Host/Origin → loopback，HTTP + WebSocket 透传 + polyfill 注入 + gzip/brotli 压缩 + 公网访问令牌认证 |
 | `lib/tunnel.mjs` | cloudflared：多镜像源下载（清华优先）/自适应多线程/启动/解析公网 URL（HTTP/2） |

package/package.json

@@ -76,5 +76,5 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "version": "1.8.2"
+  "version": "1.8.3"
 }