dsh-pocket 1.8.3 → 1.9.0

package/README.en.md

@@ -43,10 +43,10 @@ What it looks like — the phone shows the exact same UI as your computer, live:
 |---|---|
 | 📶 LAN QR access | Works out of the box: Settings → Phone access — scan the LAN QR on the same Wi-Fi |
 | 🌐 Public QR (from anywhere) | Click "Enable anywhere" → cloudflared tunnel → scan the public QR over 4G / any network |
-| 🔐 Access PIN | Public links require an **8-digit PIN** (rotated every time the tunnel starts — old links die instantly); LAN has its own separate **8-digit PIN** (refresh it manually in Settings) |
+| 🔐 Access PIN | Public links require an **8-digit PIN** (rotated every time the tunnel starts — old links die instantly); LAN has its own separate **8-digit PIN** (on by default; can be switched off in Settings — then LAN scans connect directly) |
 | ⚡ Real-time sync | Streaming output passes through WebSocket untouched — what the computer renders, the phone renders live; fully interactive both ways |
 | 📱 Mobile-adaptive layout | Narrow screens get a drawer layout automatically (ported from dsh-web-mobile, MIT): sidebar drawer, full-width conversation, safe-area insets, touch optimizations |
-| 🗜️ Transfer compression | Large JSON responses are gzip/brotli'd on the fly (17MB session history → ~1.3MB) — faster loads, less mobile data |
+| 🗜️ Transfer compression | Large JSON responses are gzip/brotli'd on the fly (17MB session history → ~1MB; brotli quality 6: fast and bandwidth-friendly) — faster loads, less mobile data |
 | 🔁 Tunnel auto-restore | After a DSH restart the previously-running public tunnel comes back automatically |
 | 🧩 Zero-dependency install | One npm package, one settings tab — no core/adapter split, no account, no server |
 
@@ -77,6 +77,8 @@ npx @deepseek-ai/dsh web
 
 Settings → **Phone access** → scan the "📶 LAN" QR code → enter the **LAN PIN** (shown in the LAN block of the settings page; hit **Refresh** to get a new one) → the phone opens the exact same DSH, in real time.
 
+> The LAN PIN is **on by default** (security-first). If you're the only user and find typing it every time annoying, flip "LAN access PIN" to **Off** in the LAN block — LAN scans then connect directly with no PIN (LAN-only devices; the **public tunnel always requires a PIN**, unaffected).
+
 ### Public (from anywhere)
 
 On the same page click "**Enable anywhere**" → wait for the tunnel (first run downloads cloudflared; macOS/Linux use the Tsinghua mirror, seconds) → scan the "🌐 Public" QR code → the phone opens the link and **enters the 8-digit PIN** (shown in the settings page's public section, **rotated on every tunnel start**) → works from outside (4G / office network).
@@ -85,11 +87,11 @@ On the same page click "**Enable anywhere**" → wait for the tunnel (first run
 
 ## ⚠️ Security (read first)
 
-- **DSH can execute code on your computer.** **LAN** QR/URL plus its own **8-digit PIN** is the key — **never share the LAN QR, URL or PIN**.
+- **DSH can execute code on your computer.** **LAN** QR/URL plus its own **8-digit PIN** is the key (PIN **on by default**, switchable off — then LAN scans connect directly, same-network devices only) — **never share the LAN QR, URL or PIN**.
 - **Public** access is protected by an **8-digit PIN**: the link is random, the PIN rotates on every tunnel start, and old links die instantly — even a leaked link can't get in.
 - The public URL is randomly assigned by cloudflared and **changes on every restart** (old links die automatically — a natural key rotation).
 - LAN mode exposes nothing publicly; only devices on the same network can reach it.
-- Built for personal use; the public PIN lives in `$DSH_HOME/dsh-pocket/token` (re-rolled on every tunnel start) and the LAN PIN in `$DSH_HOME/dsh-pocket/token-lan` (refreshed manually in Settings).
+- Built for personal use; the public PIN lives in `$DSH_HOME/dsh-pocket/token` (re-rolled on every tunnel start), the LAN PIN in `$DSH_HOME/dsh-pocket/token-lan` (refreshed manually in Settings), and the LAN-PIN switch state in `$DSH_HOME/dsh-pocket/settings.json`.
 
 ## 💻 DSH Desktop
 
@@ -149,9 +151,10 @@ Such tools take over all traffic and often cut cloudflared's tunnel-edge connect
 
 | File | Purpose |
 |---|---|
-| `lib/index.js` | Plugin entry: auto-start proxy + register RPC + access-PIN management (public: 8 digits rotated per tunnel start; LAN: separate 8 digits, manually refreshable) + DSH Desktop detection |
+| `lib/index.js` | Plugin entry: auto-start proxy + register RPC + access-PIN management (public: 8 digits rotated per tunnel start; LAN: separate 8 digits, manually refreshable / switchable) + DSH Desktop detection |
+| `lib/settings.mjs` | Settings persistence: LAN-PIN switch (on by default) stored in `$DSH_HOME/dsh-pocket/settings.json` |
 | `lib/service.mjs` | Service: proxy lifecycle (port auto-fallback), public tunnel (auto-restore), status snapshot (with QR data URLs) |
-| `lib/proxy.mjs` | Header-rewriting reverse proxy: Host/Origin → loopback, HTTP + WebSocket passthrough + polyfill injection + gzip/brotli compression + public-access PIN auth |
+| `lib/proxy.mjs` | Header-rewriting reverse proxy: Host/Origin → loopback, HTTP + WebSocket passthrough + polyfill injection + gzip/brotli compression + per-host token auth (public always; LAN per switch) |
 | `lib/tunnel.mjs` | cloudflared: multi-mirror download (Tsinghua first) / adaptive parallel / start / parse public URL (HTTP/2) |
 | `lib/web-rpc.js` | Loopback RPC: `status` / `tunnel.start` / `tunnel.stop` / `version` / `update` / `restart` |
 | `client/` | "Phone access" settings tab + mobile adaptation (dsh-web-mobile port) |

package/README.md

@@ -43,10 +43,10 @@ DSH Pocket 就是干这个的：**装上它，手机扫个码，就能实时看
 |---|---|
 | 📶 局域网扫码 | 装好即用：设置 → 手机访问，打开就有局域网二维码，手机连同一 WiFi 扫码即开 |
 | 🌐 公网扫码（人在外面） | 点「开启公网访问」→ cloudflared 隧道 → 出公网二维码，4G/任何网络都能访问 |
-| 🔐 访问密码 | 公网链接需输入 **8 位数字密码**（每次开启公网自动换新，旧链接立即作废）；局域网同样有独立 **8 位数字密码**（设置页可手动刷新） |
+| 🔐 访问密码 | 公网链接需输入 **8 位数字密码**（每次开启公网自动换新，旧链接立即作废）；局域网有独立 **8 位数字密码**（默认开启，设置页可**一键关闭**——关闭后局域网扫码直连） |
 | ⚡ 实时同步 | 流式输出走 WebSocket 全透传——**电脑上在输出，手机上同步在滚**，可双向操作 |
 | 📱 移动端适配 | 窄屏自动变抽屉布局（移植 dsh-web-mobile，MIT）：侧栏抽屉、会话全宽、状态栏安全区、触控优化 |
-| 🗜️ 传输压缩 | 大 JSON 响应自动 gzip/brotli（长会话 17MB → ~1.3MB），手机加载更快、更省流量 |
+| 🗜️ 传输压缩 | 大 JSON 响应自动 gzip/brotli（长会话 17MB → ~1MB，brotli 质量 6：快且省流量），手机加载更快、更省流量 |
 | 🔁 隧道自动恢复 | DSH 重启后自动重新拉起之前开着的公网隧道，无需手动重开 |
 | 🧩 零依赖安装 | 一个 npm 包、一个设置页，没有核心/适配器要分开装；无需账号、无需服务器 |
 
@@ -77,6 +77,8 @@ npx @deepseek-ai/dsh web
 
 设置 → **手机访问** → 手机扫「📶 局域网」二维码 → 打开链接**输入局域网密码**（显示在设置页局域网区块，点「刷新」可换新）→ 打开的就是电脑上的 DSH，实时同步。
 
+> 局域网密码**默认开启**（安全优先）。如果只有自己用、嫌每次输密码麻烦，可在设置页局域网区块把「局域网访问密码」切到**关**——之后局域网扫码直连、无需密码（仅同一局域网设备可访问；**公网始终要密码**，不受影响）。
+
 ### 公网（人在外面）
 
 同一页点「**开启公网访问**」→ 等隧道建立（首次会下载 cloudflared，macOS/Linux 走清华镜像秒下）→ 手机扫「🌐 公网」二维码 → 打开链接**输入 8 位访问密码**（密码显示在设置页公网区块，**每次开启公网变新**）→ 人在外面（4G/公司网）也能访问。
@@ -85,11 +87,11 @@ npx @deepseek-ai/dsh web
 
 ## ⚠️ 安全（必读）
 
-- **DSH 能执行你电脑上的代码**。**局域网**二维码/URL 配上独立 **8 位数字密码**才是钥匙，**请勿把局域网二维码、URL 或密码发给别人**
+- **DSH 能执行你电脑上的代码**。**局域网**二维码/URL 配上独立 **8 位数字密码**才是钥匙（密码**默认开启**，可关——关闭后局域网扫码直连，仅同一网络设备可访问），**请勿把局域网二维码、URL 或密码发给别人**
 - **公网**有 **8 位数字密码**保护：链接随机分配、每次开启换新密码、旧链接立即作废——泄露了也进不来，改密码/重开即可作废
 - 公网 URL 由 cloudflared 随机分配，**每次重启会变化**（旧链接自动失效，相当于天然轮换）
 - 局域网模式不暴露公网，只有同一网络内的设备能访问
-- 适合个人自用；公网密码存本机 `$DSH_HOME/dsh-pocket/token`（每次开启公网自动换新），局域网密码存 `$DSH_HOME/dsh-pocket/token-lan`（设置页手动刷新）
+- 适合个人自用；公网密码存本机 `$DSH_HOME/dsh-pocket/token`（每次开启公网自动换新），局域网密码存 `$DSH_HOME/dsh-pocket/token-lan`（设置页手动刷新），开关状态存 `$DSH_HOME/dsh-pocket/settings.json`
 
 ## 💻 DSH Desktop（桌面版）
 
@@ -150,9 +152,10 @@ npx @deepseek-ai/dsh web
 
 | 文件 | 说明 |
 |---|---|
-| `lib/index.js` | 插件入口：自动起代理 + 注册 RPC + 访问密码管理（公网 8 位每次开启变新；局域网独立 8 位可手动刷新）+ 桌面端环境适配 |
+| `lib/index.js` | 插件入口：自动起代理 + 注册 RPC + 访问密码管理（公网 8 位每次开启变新；局域网独立 8 位可手动刷新/开关）+ 桌面端环境适配 |
+| `lib/settings.mjs` | 设置持久化：局域网密码开关（默认开启）存 `$DSH_HOME/dsh-pocket/settings.json` |
 | `lib/service.mjs` | 服务：代理生命周期（端口自适应）、公网隧道（自动恢复）、状态快照（含二维码） |
-| `lib/proxy.mjs` | 改头反向代理：Host/Origin → loopback，HTTP + WebSocket 透传 + polyfill 注入 + gzip/brotli 压缩 + 公网访问令牌认证 |
+| `lib/proxy.mjs` | 改头反向代理：Host/Origin → loopback，HTTP + WebSocket 透传 + polyfill 注入 + gzip/brotli 压缩 + 按 Host 区分的访问令牌认证（公网必验；局域网按开关） |
 | `lib/tunnel.mjs` | cloudflared：多镜像源下载（清华优先）/自适应多线程/启动/解析公网 URL（HTTP/2） |
 | `lib/web-rpc.js` | loopback RPC：`status` / `tunnel.start` / `tunnel.stop` / `version` / `update` / `restart` |
 | `client/` | 设置页「手机访问」+ 移动端适配（dsh-web-mobile 移植） |

package/client/api.js

@@ -9,6 +9,7 @@ export const POCKET_ENDPOINTS = Object.freeze({
   update: 'pocket.update',
   restart: 'pocket.restart',
   lanTokenRefresh: 'token.lanRefresh',
+  lanAuthSetEnabled: 'lanAuth.setEnabled',
 });
 
 /** 语义化版本比较：a > b 返回正数，相等 0，a < b 负数（数字段 + 预发布后缀）。 */

package/client/client.js

@@ -48,7 +48,8 @@ var POCKET_ENDPOINTS = Object.freeze({
   version: "pocket.version",
   update: "pocket.update",
   restart: "pocket.restart",
-  lanTokenRefresh: "token.lanRefresh"
+  lanTokenRefresh: "token.lanRefresh",
+  lanAuthSetEnabled: "lanAuth.setEnabled"
 });
 function compareVersions(a, b) {
   const pa = String(a).replace(/^[vV]/, "").split(".");
@@ -1437,6 +1438,13 @@ function PocketSettingsTab({ rpcCall }) {
     } catch {
     }
   };
+  const setLanAuth = async (on) => {
+    try {
+      const r = await call(POCKET_ENDPOINTS.lanAuthSetEnabled, { on });
+      setStatus((s) => ({ ...s, lanAuthEnabled: r.lanAuthEnabled }));
+    } catch {
+    }
+  };
   const lanUrl = status?.lanUrl;
   const tunnelUrl = status?.tunnelUrl;
   const tunnelPhase = tunnelState?.phase ?? "idle";
@@ -1506,20 +1514,38 @@ function PocketSettingsTab({ rpcCall }) {
       "div",
       { style: styles.block },
       (0, import_react2.createElement)("div", { style: { fontWeight: 600, fontSize: 13 } }, "\u{1F4F6} \u5C40\u57DF\u7F51\uFF08\u540C\u4E00 WiFi\uFF09| LAN"),
+      // 访问密码开关（issue #24）：默认开启；关闭后扫码直连（仅同一局域网设备可访问）
+      (0, import_react2.createElement)(
+        "div",
+        { style: { display: "flex", alignItems: "center", gap: 8, marginTop: 8 } },
+        (0, import_react2.createElement)("span", { style: { fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)" } }, "\u5C40\u57DF\u7F51\u8BBF\u95EE\u5BC6\u7801 | LAN access PIN"),
+        (0, import_react2.createElement)("button", {
+          style: { ...styles.btn, height: 28, padding: "0 12px", fontSize: 12, fontWeight: status.lanAuthEnabled !== false ? 600 : 400, background: status.lanAuthEnabled !== false ? "var(--dsw-alias-button-primary-fill, var(--dsw-alias-brand-primary,#4f6ef7))" : "var(--dsw-alias-bg-layer-1,#fff)", color: status.lanAuthEnabled !== false ? "var(--dsw-alias-label-primary-foreground, #fff)" : "var(--dsw-alias-label-primary,inherit)" },
+          onClick: () => setLanAuth(true)
+        }, "\u5F00 | On"),
+        (0, import_react2.createElement)("button", {
+          style: { ...styles.btn, height: 28, padding: "0 12px", fontSize: 12, fontWeight: status.lanAuthEnabled === false ? 600 : 400, background: status.lanAuthEnabled === false ? "var(--dsw-alias-state-error-primary,#dc2626)" : "var(--dsw-alias-bg-layer-1,#fff)", color: status.lanAuthEnabled === false ? "#fff" : "var(--dsw-alias-label-primary,inherit)" },
+          onClick: () => setLanAuth(false)
+        }, "\u5173 | Off")
+      ),
       lanUrl ? (0, import_react2.createElement)(
         "div",
         null,
         (0, import_react2.createElement)("img", { src: status.lanQr, alt: "LAN QR", style: styles.qr }),
         (0, import_react2.createElement)("div", { style: styles.code }, lanUrl),
         (0, import_react2.createElement)("div", { style: styles.muted }, "\u624B\u673A\u8FDE\u63A5\u540C\u4E00 WiFi \u540E\u626B\u7801\u5373\u53EF\u6253\u5F00"),
-        status.lanToken ? (0, import_react2.createElement)(
+        status.lanAuthEnabled !== false ? (0, import_react2.createElement)(
           "div",
           { style: { marginTop: 6, fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)", lineHeight: 1.5 } },
           "\u{1F510} \u8BBF\u95EE\u5BC6\u7801\uFF1A",
           status.lanToken,
           "\uFF08\u624B\u673A\u6253\u5F00\u9700\u8F93\u5165\uFF1B\u4E0E\u516C\u7F51\u5BC6\u7801\u5206\u5F00\uFF09",
           (0, import_react2.createElement)("button", { style: { ...styles.btn, height: 26, padding: "0 10px", fontSize: 12, marginLeft: 8 }, onClick: refreshLanPin }, "\u5237\u65B0 | Refresh")
-        ) : null
+        ) : (0, import_react2.createElement)(
+          "div",
+          { style: { marginTop: 6, fontSize: 12, color: "var(--dsw-alias-state-warn-primary,#b45309)", lineHeight: 1.5 } },
+          "\u{1F513} \u5BC6\u7801\u5DF2\u5173\u95ED\uFF1A\u626B\u7801\u76F4\u8FDE\uFF0C\u65E0\u9700\u5BC6\u7801\uFF08\u4EC5\u540C\u4E00\u5C40\u57DF\u7F51\u8BBE\u5907\u53EF\u8BBF\u95EE\uFF1B\u516C\u7F51\u4ECD\u8981\u5BC6\u7801\uFF09| PIN off \u2014 scan & go (LAN only; public still requires PIN)"
+        )
       ) : (0, import_react2.createElement)("div", { style: styles.muted }, "\u4EE3\u7406\u672A\u5C31\u7EEA\u2026 | proxy starting\u2026")
     ),
     // 公网

package/client/index.jsx

@@ -175,6 +175,14 @@ function PocketSettingsTab({ rpcCall }) {
     } catch { /* 忽略 */ }
   };
 
+  // 局域网访问密码开关（issue #24）：默认开启；关闭后局域网扫码直连（公网不受影响）
+  const setLanAuth = async (on) => {
+    try {
+      const r = await call(POCKET_ENDPOINTS.lanAuthSetEnabled, { on });
+      setStatus((s) => ({ ...s, lanAuthEnabled: r.lanAuthEnabled }));
+    } catch { /* 忽略 */ }
+  };
+
   const lanUrl = status?.lanUrl;
   const tunnelUrl = status?.tunnelUrl;
   const tunnelPhase = tunnelState?.phase ?? 'idle';
@@ -238,19 +246,32 @@ function PocketSettingsTab({ rpcCall }) {
     // 局域网
     h('div', { style: styles.block },
       h('div', { style: { fontWeight: 600, fontSize: 13 } }, '📶 局域网（同一 WiFi）| LAN'),
+      // 访问密码开关（issue #24）：默认开启；关闭后扫码直连（仅同一局域网设备可访问）
+      h('div', { style: { display: 'flex', alignItems: 'center', gap: 8, marginTop: 8 } },
+        h('span', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)' } }, '局域网访问密码 | LAN access PIN'),
+        h('button', {
+          style: { ...styles.btn, height: 28, padding: '0 12px', fontSize: 12, fontWeight: status.lanAuthEnabled !== false ? 600 : 400, background: status.lanAuthEnabled !== false ? 'var(--dsw-alias-button-primary-fill, var(--dsw-alias-brand-primary,#4f6ef7))' : 'var(--dsw-alias-bg-layer-1,#fff)', color: status.lanAuthEnabled !== false ? 'var(--dsw-alias-label-primary-foreground, #fff)' : 'var(--dsw-alias-label-primary,inherit)' },
+          onClick: () => setLanAuth(true),
+        }, '开 | On'),
+        h('button', {
+          style: { ...styles.btn, height: 28, padding: '0 12px', fontSize: 12, fontWeight: status.lanAuthEnabled === false ? 600 : 400, background: status.lanAuthEnabled === false ? 'var(--dsw-alias-state-error-primary,#dc2626)' : 'var(--dsw-alias-bg-layer-1,#fff)', color: status.lanAuthEnabled === false ? '#fff' : 'var(--dsw-alias-label-primary,inherit)' },
+          onClick: () => setLanAuth(false),
+        }, '关 | Off'),
+      ),
       lanUrl
         ? h('div', null,
           h('img', { src: status.lanQr, alt: 'LAN QR', style: styles.qr }),
           h('div', { style: styles.code }, lanUrl),
           h('div', { style: styles.muted }, '手机连接同一 WiFi 后扫码即可打开'),
-          status.lanToken
+          status.lanAuthEnabled !== false
             ? h('div', { style: { marginTop: 6, fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)', lineHeight: 1.5 } },
               '🔐 访问密码：',
               status.lanToken,
               '（手机打开需输入；与公网密码分开）',
               h('button', { style: { ...styles.btn, height: 26, padding: '0 10px', fontSize: 12, marginLeft: 8 }, onClick: refreshLanPin }, '刷新 | Refresh'),
             )
-            : null,
+            : h('div', { style: { marginTop: 6, fontSize: 12, color: 'var(--dsw-alias-state-warn-primary,#b45309)', lineHeight: 1.5 } },
+              '🔓 密码已关闭：扫码直连，无需密码（仅同一局域网设备可访问；公网仍要密码）| PIN off — scan & go (LAN only; public still requires PIN)'),
         )
         : h('div', { style: styles.muted }, '代理未就绪… | proxy starting…'),
     ),

package/lib/index.js

@@ -20,6 +20,7 @@ import { createPocketService } from './service.mjs';
 import { installPocketRpc } from './web-rpc.js';
 import { restartHost } from './restart.js';
 import { desktopEnvPatchScript, advancedNoticeScript, DEFAULT_INJECT } from './proxy.mjs';
+import { lanAuthEnabled, setLanAuthEnabled } from './settings.mjs';
 
 const name = 'dsh-pocket';
 const inject = ['connection', 'webServer'];
@@ -202,10 +203,11 @@ export function apply(ctx, config = {}, internals = {}) {
     injectHtml: isDesktop
       ? DEFAULT_INJECT + desktopEnvPatchScript(process.platform) + (desktopAdvanced ? advancedNoticeScript() : '')
       : undefined,
-    // 访问密码（issue #13 + #18）：局域网与公网**分开**，所有代理访问都要验证
+    // 访问密码（issue #13 + #18 + #24）：公网永远要密码（每次开启变新）；
+    // 局域网按开关（默认开启；关闭后局域网扫码直连，仅同网段设备可访问）
     auth: {
       getToken: (host) => tokenForHost(host),
-      isProtected: () => true,
+      isProtected: (host) => /trycloudflare\.com$/i.test(String(host ?? '')) ? true : lanAuthEnabled(),
     },
     // 每次公网隧道就绪 → 轮换 8 位密码（旧密码/旧链接立即作废）
     onTunnelReady: () => {
@@ -222,6 +224,8 @@ export function apply(ctx, config = {}, internals = {}) {
     getToken: () => getAccessToken(),
     getLanToken: () => getLanToken(),
     refreshLanToken: () => refreshLanToken(),
+    getLanAuthEnabled: () => lanAuthEnabled(),
+    setLanAuthEnabled: (on) => setLanAuthEnabled(on),
     runUpdate: internals.runUpdate ?? { currentVersion, perform: performUpdate, loadedVersion: () => loadedVersion },
     restart: internals.restart ?? (() => pocketRestart(service)),
     restartNotice: internals.restartNotice ?? consumeRestartNotice,

package/lib/proxy.mjs

@@ -13,7 +13,7 @@
 
 import { createServer } from 'node:http';
 import { request as httpRequest } from 'node:http';
-import { createGzip, createBrotliCompress } from 'node:zlib';
+import { createGzip, createBrotliCompress, constants as zlibConstants } from 'node:zlib';
 
 const DEFAULT_UPSTREAM = { host: '127.0.0.1', port: 3080 };
 
@@ -211,8 +211,10 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
           return;
         }
         // 大 JSON/text 响应**流式压缩**（issue #12）：长会话历史一次返回 17MB+，
-        // 局域网直连与隧道段都吃满带宽；压缩到 ~1.3MB。跳过已压缩、SSE 流
+        // 局域网直连与隧道段都吃满带宽；压缩到 ~1MB。跳过已压缩、SSE 流
         // （/api/events.* 原样透传）、HTML（走上面的注入分支）。
+        // brotli 质量选 6（issue #25）：zlib 默认 q11 压 17MB 要 40s+，手机直接超时；
+        // q6 实测 128ms（比 gzip 的 88ms 略慢但同档）且输出更小（1.00MB vs 1.20MB）。
         const acceptEncoding = String(req.headers['accept-encoding'] ?? '');
         const canGzip = /\bgzip\b/.test(acceptEncoding);
         const canBr = /\bbr\b/.test(acceptEncoding);
@@ -230,7 +232,9 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
           delete outHeaders['transfer-encoding'];
           outHeaders['content-encoding'] = enc;
           res.writeHead(proxyRes.statusCode ?? 200, outHeaders);
-          const z = enc === 'br' ? createBrotliCompress() : createGzip();
+          const z = enc === 'br'
+            ? createBrotliCompress({ params: { [zlibConstants.BROTLI_PARAM_QUALITY]: 6 } })
+            : createGzip();
           proxyRes.pipe(z).pipe(res);
           // 任一端断开都要清理（含压缩流）。注意：不能用 proxyRes 的 'close'
           // 来掐 res——正常结束后 close 也会触发，此时压缩流可能还没写完，

package/lib/settings.mjs

@@ -0,0 +1,43 @@
+// dsh-pocket 设置持久化（$DSH_HOME/dsh-pocket/settings.json）
+//
+// 当前只有一项：局域网访问密码开关 lanAuthEnabled（issue #24）。
+// 默认**开启**（安全优先）：局域网扫码也要输 8 位密码；
+// 用户可关闭——关闭后局域网扫码直连（仅同一网络内的设备能访问），公网不受影响（永远要密码）。
+
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { homedir } from 'node:os';
+
+const settingsRel = join('dsh-pocket', 'settings.json');
+export function settingsPath() {
+  return join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), settingsRel);
+}
+
+function readSettings() {
+  try {
+    const raw = JSON.parse(readFileSync(settingsPath(), 'utf8'));
+    return raw && typeof raw === 'object' ? raw : {};
+  } catch { /* 无文件/损坏 → 默认 */ }
+  return {};
+}
+
+function writeSettings(s) {
+  try {
+    mkdirSync(dirname(settingsPath()), { recursive: true });
+    writeFileSync(settingsPath(), JSON.stringify(s, null, 2), { mode: 0o600 });
+  } catch { /* 忽略 */ }
+  return s;
+}
+
+/** 局域网访问密码开关：默认开启（文件缺失/损坏都视为开启）。 */
+export function lanAuthEnabled() {
+  return readSettings().lanAuthEnabled !== false;
+}
+
+/** 设置局域网访问密码开关，返回新状态（持久化）。 */
+export function setLanAuthEnabled(on) {
+  const s = readSettings();
+  s.lanAuthEnabled = !!on;
+  writeSettings(s);
+  return s.lanAuthEnabled;
+}

package/lib/web-rpc.js

@@ -25,7 +25,7 @@ export function killHint(port) {
 }
 
 /** 注册 /dsh-pocket 逻辑通道（仅本机 loopback 可调）。 */
-export function installPocketRpc(ctx, { service, log = console, desktop = false, runUpdate = null, restart = null, restartNotice = null, getToken = null, getLanToken = null, refreshLanToken = null }) {
+export function installPocketRpc(ctx, { service, log = console, desktop = false, runUpdate = null, restart = null, restartNotice = null, getToken = null, getLanToken = null, refreshLanToken = null, getLanAuthEnabled = null, setLanAuthEnabled = null }) {
   if (!ctx?.connection?.rpc?.handle) {
     log.warn?.('dsh-pocket: DSH Host Connection RPC unavailable — settings tab disabled | 无 Connection RPC，设置页不可用');
     return () => {};
@@ -33,7 +33,7 @@ export function installPocketRpc(ctx, { service, log = console, desktop = false,
   return ctx.connection.rpc.handle(POCKET_RPC_CHANNEL, async (endpoint, payload = {}, signal) => {
     if (signal?.aborted) return fail('cancelled', 'The request was cancelled.');
 
-    // status 响应：服务状态 + 重启提示 + 停止命令 + 桌面端标志 + 公网/局域网访问密码
+    // status 响应：服务状态 + 重启提示 + 停止命令 + 桌面端标志 + 公网/局域网访问密码 + 局域网密码开关
     const statusPayload = async () => {
       let notice = null;
       try { notice = (await restartNotice?.()) ?? null; } catch { notice = null; }
@@ -45,6 +45,7 @@ export function installPocketRpc(ctx, { service, log = console, desktop = false,
         killHint: killHint(s.dshPort ?? 3080),
         accessToken: getToken?.() ?? null,
         lanToken: getLanToken?.() ?? null,
+        lanAuthEnabled: getLanAuthEnabled?.() ?? true,
       });
     };
 
@@ -57,6 +58,11 @@ export function installPocketRpc(ctx, { service, log = console, desktop = false,
         if (!fresh) return fail('bad-request', '局域网密码刷新不可用 | LAN PIN refresh unavailable');
         return ok({ lanToken: fresh });
       }
+      if (endpoint === POCKET_ENDPOINTS.lanAuthSetEnabled) {
+        const enabled = setLanAuthEnabled?.(payload?.on === true);
+        if (enabled === undefined) return fail('bad-request', '局域网密码开关不可用 | LAN PIN switch unavailable');
+        return ok({ lanAuthEnabled: enabled });
+      }
       if (endpoint === POCKET_ENDPOINTS.tunnelStart) {
         await service.startTunnel();
         return await statusPayload();

package/package.json

@@ -76,5 +76,5 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "version": "1.8.3"
+  "version": "1.9.0"
 }