dsh-pocket 1.9.2 → 1.11.0

package/README.en.md

@@ -43,7 +43,9 @@ What it looks like — the phone shows the exact same UI as your computer, live:
 |---|---|
 | 📶 LAN QR access | Works out of the box: Settings → Phone access — scan the LAN QR on the same Wi-Fi |
 | 🌐 Public QR (from anywhere) | Click "Enable anywhere" → cloudflared tunnel → scan the public QR over 4G / any network |
-| 🔐 Access PIN | Public links require an **8-digit PIN** (rotated every time the tunnel starts — old links die instantly); LAN has its own separate **8-digit PIN** (on by default; can be switched off in Settings — then LAN scans connect directly) |
+| 🔐 Access PIN | Public links require an **8-digit PIN** (rotated on every tunnel start by default; **customizable to a fixed PIN** — custom PINs are not rotated); LAN has its own separate **8-digit PIN** (on by default; switchable off in Settings — then LAN scans connect directly) |
+| 🔑 Custom PINs | Both the public and LAN PINs can be **set to your own fixed 8-digit number** in Settings (custom PINs are never auto-rotated) |
+| 🧘 Session persistence | Enter the PIN once and you're set for a long time (login is tied to the computer's dsh web process: as long as it stays up, the phone won't ask again; **after a dsh web restart/update, enter it once more**) |
 | ⚡ Real-time sync | Streaming output passes through WebSocket untouched — what the computer renders, the phone renders live; fully interactive both ways |
 | 📱 Mobile-adaptive layout | Narrow screens get a drawer layout automatically (ported from dsh-web-mobile, MIT): sidebar drawer, full-width conversation, safe-area insets, touch optimizations |
 | 🗜️ Transfer compression | Large JSON responses are gzip/brotli'd on the fly (17MB session history → ~1MB; brotli quality 6: fast and bandwidth-friendly) — faster loads, less mobile data |
@@ -75,23 +77,26 @@ npx @deepseek-ai/dsh web
 
 ### LAN (same Wi-Fi)
 
-Settings → **Phone access** → scan the "📶 LAN" QR code → enter the **LAN PIN** (shown in the LAN block of the settings page; hit **Refresh** to get a new one) → the phone opens the exact same DSH, in real time.
+Settings → **Phone access** → scan the "📶 LAN" QR code → enter the **LAN PIN** (shown in the LAN block; hit **Refresh** to roll a new one, or **Customize** to set your own fixed 8 digits) → the phone opens the exact same DSH, in real time.
 
 > The LAN PIN is **on by default** (security-first). If you're the only user and find typing it every time annoying, flip "LAN access PIN" to **Off** in the LAN block — LAN scans then connect directly with no PIN (LAN-only devices; the **public tunnel always requires a PIN**, unaffected).
+>
+> After logging in once, the phone **won't ask again**: as long as the computer's dsh web keeps running, reopening the phone needs no PIN (**a dsh web restart/update asks for it once more**).
 
 ### Public (from anywhere)
 
-On the same page click "**Enable anywhere**" → wait for the tunnel (first run downloads cloudflared; macOS/Linux use the Tsinghua mirror, seconds) → scan the "🌐 Public" QR code → the phone opens the link and **enters the 8-digit PIN** (shown in the settings page's public section, **rotated on every tunnel start**) → works from outside (4G / office network).
+On the same page click "**Enable anywhere**" → wait for the tunnel (first run downloads cloudflared; macOS/Linux use the Tsinghua mirror, seconds) → scan the "🌐 Public" QR code → the phone opens the link and **enters the 8-digit PIN** (shown in the settings page's public section; **rotated on every tunnel start by default**, or **Customize** it to a fixed PIN that is never rotated) → works from outside (4G / office network).
 
 > Upgrading: `dsh plugin --profile web update dsh-pocket --latest -w` (`--latest` is required across major versions — a `^0.x` range won't auto-jump to 1.x).
 
 ## ⚠️ Security (read first)
 
 - **DSH can execute code on your computer.** **LAN** QR/URL plus its own **8-digit PIN** is the key (PIN **on by default**, switchable off — then LAN scans connect directly, same-network devices only) — **never share the LAN QR, URL or PIN**.
-- **Public** access is protected by an **8-digit PIN**: the link is random, the PIN rotates on every tunnel start, and old links die instantly — even a leaked link can't get in.
+- **Public** access is protected by an **8-digit PIN**: the link is random, the PIN rotates on every tunnel start by default, and old links die instantly — even a leaked link can't get in. **A custom PIN is never auto-rotated** (your value stays stable).
+- Phone login state is tied to the computer's dsh web process: **no re-entry while dsh web stays up; one re-entry after a restart/update**.
 - The public URL is randomly assigned by cloudflared and **changes on every restart** (old links die automatically — a natural key rotation).
 - LAN mode exposes nothing publicly; only devices on the same network can reach it.
-- Built for personal use; the public PIN lives in `$DSH_HOME/dsh-pocket/token` (re-rolled on every tunnel start), the LAN PIN in `$DSH_HOME/dsh-pocket/token-lan` (refreshed manually in Settings), and the LAN-PIN switch state in `$DSH_HOME/dsh-pocket/settings.json`.
+- Built for personal use; the public PIN lives in `$DSH_HOME/dsh-pocket/token` (re-rolled per tunnel start unless customized), the LAN PIN in `$DSH_HOME/dsh-pocket/token-lan` (refreshed manually in Settings), and switches/custom flags in `$DSH_HOME/dsh-pocket/settings.json`.
 
 ## 💻 DSH Desktop
 

package/README.md

@@ -43,7 +43,9 @@ DSH Pocket 就是干这个的：**装上它，手机扫个码，就能实时看
 |---|---|
 | 📶 局域网扫码 | 装好即用：设置 → 手机访问，打开就有局域网二维码，手机连同一 WiFi 扫码即开 |
 | 🌐 公网扫码（人在外面） | 点「开启公网访问」→ cloudflared 隧道 → 出公网二维码，4G/任何网络都能访问 |
-| 🔐 访问密码 | 公网链接需输入 **8 位数字密码**（每次开启公网自动换新，旧链接立即作废）；局域网有独立 **8 位数字密码**（默认开启，设置页可**一键关闭**——关闭后局域网扫码直连） |
+| 🔐 访问密码 | 公网链接需输入 **8 位数字密码**（默认每次开启公网自动换新；**可自定义固定密码**——自定义后不再换新）；局域网有独立 **8 位数字密码**（默认开启，设置页可**一键关闭**——关闭后局域网扫码直连） |
+| 🔑 自定义密码 | 公网/局域网密码都可在设置页**设成自己固定的 8 位数字**（自定义后公网不再自动换新） |
+| 🧘 会话保持 | 手机输一次密码后**长期免输**（登录状态绑定电脑上的 dsh web 进程：只要它不重启，手机不用再输；**dsh web 重启/更新后需重新输入一次**） |
 | ⚡ 实时同步 | 流式输出走 WebSocket 全透传——**电脑上在输出，手机上同步在滚**，可双向操作 |
 | 📱 移动端适配 | 窄屏自动变抽屉布局（移植 dsh-web-mobile，MIT）：侧栏抽屉、会话全宽、状态栏安全区、触控优化 |
 | 🗜️ 传输压缩 | 大 JSON 响应自动 gzip/brotli（长会话 17MB → ~1MB，brotli 质量 6：快且省流量），手机加载更快、更省流量 |
@@ -75,23 +77,26 @@ npx @deepseek-ai/dsh web
 
 ### 局域网（同一 WiFi）
 
-设置 → **手机访问** → 手机扫「📶 局域网」二维码 → 打开链接**输入局域网密码**（显示在设置页局域网区块，点「刷新」可换新）→ 打开的就是电脑上的 DSH，实时同步。
+设置 → **手机访问** → 手机扫「📶 局域网」二维码 → 打开链接**输入局域网密码**（显示在设置页局域网区块，点「刷新」可换新，或点「自定义」设成自己固定的 8 位数字）→ 打开的就是电脑上的 DSH，实时同步。
 
 > 局域网密码**默认开启**（安全优先）。如果只有自己用、嫌每次输密码麻烦，可在设置页局域网区块把「局域网访问密码」切到**关**——之后局域网扫码直连、无需密码（仅同一局域网设备可访问；**公网始终要密码**，不受影响）。
+>
+> 手机登录一次后**长期免输**：只要电脑上的 dsh web 不重启，再次打开手机不用再输入（**dsh web 重启/更新后需重新输入一次**）。
 
 ### 公网（人在外面）
 
-同一页点「**开启公网访问**」→ 等隧道建立（首次会下载 cloudflared，macOS/Linux 走清华镜像秒下）→ 手机扫「🌐 公网」二维码 → 打开链接**输入 8 位访问密码**（密码显示在设置页公网区块，**每次开启公网变新**）→ 人在外面（4G/公司网）也能访问。
+同一页点「**开启公网访问**」→ 等隧道建立（首次会下载 cloudflared，macOS/Linux 走清华镜像秒下）→ 手机扫「🌐 公网」二维码 → 打开链接**输入 8 位访问密码**（密码显示在设置页公网区块，默认**每次开启公网变新**，也可点「自定义」设成固定密码——自定义后不再换新）→ 人在外面（4G/公司网）也能访问。
 
 > 更新到新版本：`dsh plugin --profile web update dsh-pocket --latest -w`（跨大版本时 `--latest` 是必须的，`^0.x` 范围不会自动升到 1.x）。
 
 ## ⚠️ 安全（必读）
 
 - **DSH 能执行你电脑上的代码**。**局域网**二维码/URL 配上独立 **8 位数字密码**才是钥匙（密码**默认开启**，可关——关闭后局域网扫码直连，仅同一网络设备可访问），**请勿把局域网二维码、URL 或密码发给别人**
-- **公网**有 **8 位数字密码**保护：链接随机分配、每次开启换新密码、旧链接立即作废——泄露了也进不来，改密码/重开即可作废
+- **公网**有 **8 位数字密码**保护：链接随机分配、默认每次开启换新密码、旧链接立即作废——泄露了也进不来，改密码/重开即可作废；**自定义密码后不再自动换新**（你设的值即稳定密码）
+- 手机登录状态与电脑上的 dsh web 进程绑定：**电脑 dsh web 一直开着就不用重复输入；重启/更新后需重新输入一次**
 - 公网 URL 由 cloudflared 随机分配，**每次重启会变化**（旧链接自动失效，相当于天然轮换）
 - 局域网模式不暴露公网，只有同一网络内的设备能访问
-- 适合个人自用；公网密码存本机 `$DSH_HOME/dsh-pocket/token`（每次开启公网自动换新），局域网密码存 `$DSH_HOME/dsh-pocket/token-lan`（设置页手动刷新），开关状态存 `$DSH_HOME/dsh-pocket/settings.json`
+- 适合个人自用；公网密码存本机 `$DSH_HOME/dsh-pocket/token`（默认每次开启公网自动换新，**自定义后不换**），局域网密码存 `$DSH_HOME/dsh-pocket/token-lan`（设置页手动刷新），开关/自定义标记存 `$DSH_HOME/dsh-pocket/settings.json`
 
 ## 💻 DSH Desktop（桌面版）
 

package/client/api.js

@@ -10,6 +10,7 @@ export const POCKET_ENDPOINTS = Object.freeze({
   restart: 'pocket.restart',
   lanTokenRefresh: 'token.lanRefresh',
   lanAuthSetEnabled: 'lanAuth.setEnabled',
+  pinSetCustom: 'pin.setCustom',
 });
 
 /** 语义化版本比较：a > b 返回正数，相等 0，a < b 负数（数字段 + 预发布后缀）。 */

package/client/client.js

@@ -49,7 +49,8 @@ var POCKET_ENDPOINTS = Object.freeze({
   update: "pocket.update",
   restart: "pocket.restart",
   lanTokenRefresh: "token.lanRefresh",
-  lanAuthSetEnabled: "lanAuth.setEnabled"
+  lanAuthSetEnabled: "lanAuth.setEnabled",
+  pinSetCustom: "pin.setCustom"
 });
 function compareVersions(a, b) {
   const pa = String(a).replace(/^[vV]/, "").split(".");
@@ -1290,9 +1291,131 @@ function mobileApply(ctx) {
   }, MobileDrawerFooter));
 }
 
+// client/pocket-locales.js
+var NS2 = "pocket";
+var zh2 = {
+  "section": "\u624B\u673A\u8BBF\u95EE",
+  "title": "\u{1F4F1} \u624B\u673A\u8BBF\u95EE",
+  "subtitle": "\u624B\u673A\u626B\u7801\u6253\u5F00\u7684\u5C31\u662F\u7535\u8111\u4E0A\u7684\u8FD9\u4E2A\u754C\u9762\uFF0C\u5B9E\u65F6\u540C\u6B65",
+  "developer": "\u5F00\u53D1\u8005\uFF1A\u7A0B\u5E8F\u5458\u5C11\u5317\u6668",
+  "starAsk": "\u2B50 \u987A\u624B\u7559\u9897 Star\uFF0C\u4F5C\u8005\u80FD\u9AD8\u5174\u4E00\u6574\u5929",
+  "starCta": "\u884C\uFF0C\u7ED9\u4F60\u4E00\u9897 Star",
+  "restarted": "\u{1F504} \u5DF2\u91CD\u542F",
+  "ok": "\u77E5\u9053\u4E86",
+  "bgHint": "\u8FDB\u7A0B\u5728\u540E\u53F0\u8FD0\u884C\uFF08\u4E0D\u6302\u7EC8\u7AEF\uFF09\u3002\u5982\u9700\u505C\u6B62\uFF1A{cmd}",
+  "updatedRestart": "\u2705 \u5DF2\u66F4\u65B0 v{ver}\uFF0C\u91CD\u542F\u751F\u6548",
+  "updateAutoRestarting": "\u2705 \u5DF2\u66F4\u65B0 v{ver}\uFF0C\u6B63\u5728\u81EA\u52A8\u91CD\u542F\u2026",
+  "updatedOk": "\u2705 \u5DF2\u66F4\u65B0 v{ver}",
+  "updateAvailable": "\u{1F4E6} \u65B0\u7248\u672C v{ver}",
+  "updating": "\u66F4\u65B0\u4E2D\u2026",
+  "updateTo": "\u66F4\u65B0\u5230 v{ver}",
+  "restartingNow": "\u6B63\u5728\u91CD\u542F\u751F\u6548\u2026",
+  "restarting": "\u91CD\u542F\u4E2D\u2026",
+  "restartNow": "\u{1F504} \u91CD\u542F dsh web \u751F\u6548",
+  "updatingDetail": "\u23F3 \u66F4\u65B0\u4E2D\uFF08\u901A\u5E38 1-2 \u5206\u949F\uFF09\xB7 \u5DF2\u7B49\u5F85 {s} \u79D2",
+  "restartingDetail": "\u23F3 \u6B63\u5728\u91CD\u542F\u751F\u6548\uFF08\u901A\u5E38 10-30 \u79D2\uFF09\xB7 \u5DF2\u7B49\u5F85 {s} \u79D2",
+  "updatedAutoDetail": "\u2705 \u5DF2\u66F4\u65B0\uFF0C\u6B63\u5728\u81EA\u52A8\u91CD\u542F\u751F\u6548\uFF0C\u8BF7\u7A0D\u5019\u5237\u65B0",
+  "updatedRestartDetail": "\u2705 \u5DF2\u66F4\u65B0\uFF0C\u91CD\u542F dsh web \u751F\u6548",
+  "updateFailed": "\u274C \u5931\u8D25\uFF1A{err}\uFF08\u624B\u52A8\u66F4\u65B0\uFF1Adsh plugin --profile web update dsh-pocket --latest -w\uFF09",
+  "versionRange": "\u5F53\u524D v{cur} \u2192 \u6700\u65B0 v{latest}",
+  "lanTitle": "\u{1F4F6} \u5C40\u57DF\u7F51\uFF08\u540C\u4E00 WiFi\uFF09",
+  "lanHint": "\u624B\u673A\u8FDE\u63A5\u540C\u4E00 WiFi \u540E\u626B\u7801\u5373\u53EF\u6253\u5F00",
+  "lanPin": "\u5C40\u57DF\u7F51\u8BBF\u95EE\u5BC6\u7801",
+  "on": "\u5F00",
+  "off": "\u5173",
+  "lanPinValue": "\u{1F510} \u8BBF\u95EE\u5BC6\u7801\uFF1A{pin}\uFF08\u624B\u673A\u6253\u5F00\u9700\u8F93\u5165\uFF1B\u4E0E\u516C\u7F51\u5BC6\u7801\u5206\u5F00\uFF09",
+  "lanPinCustomValue": "\u{1F510} \u8BBF\u95EE\u5BC6\u7801\uFF1A{pin}\uFF08\u81EA\u5B9A\u4E49\uFF1B\u624B\u673A\u6253\u5F00\u9700\u8F93\u5165\uFF09",
+  "refresh": "\u5237\u65B0",
+  "customize": "\u81EA\u5B9A\u4E49",
+  "customizing": "\u65B0\u5BC6\u7801\uFF088 \u4F4D\u6570\u5B57\uFF09\uFF1A",
+  "save": "\u4FDD\u5B58",
+  "cancel": "\u53D6\u6D88",
+  "pinInvalid": "\u5BC6\u7801\u5FC5\u987B\u662F 8 \u4F4D\u6570\u5B57",
+  "pinCustomHint": "\u81EA\u5B9A\u4E49\u540E\u5F00\u542F\u516C\u7F51\u4E0D\u518D\u81EA\u52A8\u6362\u65B0",
+  "lanPinOff": "\u{1F513} \u5BC6\u7801\u5DF2\u5173\u95ED\uFF1A\u626B\u7801\u76F4\u8FDE\uFF0C\u65E0\u9700\u5BC6\u7801\uFF08\u4EC5\u540C\u4E00\u5C40\u57DF\u7F51\u8BBE\u5907\u53EF\u8BBF\u95EE\uFF1B\u516C\u7F51\u4ECD\u8981\u5BC6\u7801\uFF09",
+  "lanStarting": "\u4EE3\u7406\u672A\u5C31\u7EEA\u2026",
+  "wanTitle": "\u{1F310} \u516C\u7F51\uFF08\u4EBA\u5728\u5916\u9762\uFF09",
+  "wanHint": "\u4EFB\u4F55\u7F51\u7EDC\u626B\u7801\u5373\u7528\uFF08URL \u6BCF\u6B21\u91CD\u542F\u81EA\u52A8\u6362\u65B0\uFF09",
+  "wanPin": "\u{1F510} \u8BBF\u95EE\u5BC6\u7801\uFF1A{pin}\uFF08\u6BCF\u6B21\u5F00\u542F\u516C\u7F51\u53D8\u65B0\uFF1B\u624B\u673A\u6253\u5F00\u94FE\u63A5\u9700\u8F93\u5165\u6B64\u5BC6\u7801\uFF09",
+  "wanPinCustom": "\u{1F510} \u8BBF\u95EE\u5BC6\u7801\uFF1A{pin}\uFF08\u81EA\u5B9A\u4E49\uFF0C\u5F00\u542F\u516C\u7F51\u4E0D\u518D\u81EA\u52A8\u6362\u65B0\uFF09",
+  "stopTunnel": "\u5173\u95ED\u516C\u7F51",
+  "enable": "\u5F00\u542F\u516C\u7F51\u8BBF\u95EE",
+  "opening": "\u5F00\u542F\u4E2D\u2026",
+  "downloading": "\u23F3 \u4E0B\u8F7D cloudflared\uFF08\u9996\u6B21\u7EA6 20-50MB\uFF0C\u901A\u5E38 1-2 \u5206\u949F\uFF1B\u4E4B\u540E\u79D2\u5F00\uFF09\xB7 \u5DF2\u7B49\u5F85 {s} \u79D2",
+  "connecting": "\u23F3 \u8FDE\u63A5 Cloudflare \u8FB9\u7F18\uFF08\u901A\u5E38 5-30 \u79D2\uFF09\xB7 \u5DF2\u7B49\u5F85 {s} \u79D2{suffix}",
+  "slowHint": " \u2014 \u6709\u70B9\u4E45\uFF1F\u68C0\u67E5\u662F\u5426\u5F00\u7740\u4EE3\u7406/VPN\uFF08Clash TUN \u7B49\uFF09",
+  "error": "\u274C \u5F00\u542F\u5931\u8D25\uFF1A{detail}\uFF08\u53EF\u91CD\u8BD5\uFF1B\u82E5\u662F\u4EE3\u7406/VPN \u95EE\u9898\u89C1 README \u6392\u969C\uFF09",
+  "unknownError": "\u672A\u77E5\u9519\u8BEF",
+  "feedback": "\u6709\u95EE\u9898\uFF1F\u6B22\u8FCE\u5230 GitHub Issues \u53CD\u9988 \u{1F64F}"
+};
+var en2 = {
+  "section": "Phone access",
+  "title": "\u{1F4F1} Phone access",
+  "subtitle": "The phone shows this exact screen, live",
+  "developer": "Developer: \u5C11\u5317\u6668 (shaobeichen)",
+  "starAsk": "\u2B50 Drop a Star if it helped \u2014 it makes the author\u2019s day",
+  "starCta": "\u2605 Give a Star",
+  "restarted": "\u{1F504} Restarted",
+  "ok": "Got it",
+  "bgHint": "Running in the background (not attached to a terminal). To stop: {cmd}",
+  "updatedRestart": "\u2705 Updated to v{ver} \u2014 restart to apply",
+  "updateAutoRestarting": "\u2705 Updated to v{ver} \u2014 auto-restarting\u2026",
+  "updatedOk": "\u2705 Updated to v{ver}",
+  "updateAvailable": "\u{1F4E6} Update available: v{ver}",
+  "updating": "Updating\u2026",
+  "updateTo": "Update to v{ver}",
+  "restartingNow": "Restarting to apply\u2026",
+  "restarting": "Restarting\u2026",
+  "restartNow": "\u{1F504} Restart dsh web now",
+  "updatingDetail": "\u23F3 Updating (usually 1-2 min) \xB7 {s}s elapsed",
+  "restartingDetail": "\u23F3 Restarting to apply (usually 10-30s) \xB7 {s}s elapsed",
+  "updatedAutoDetail": "\u2705 Updated \u2014 auto-restarting in progress, refresh shortly",
+  "updatedRestartDetail": "\u2705 Updated \u2014 restart dsh web to apply",
+  "updateFailed": "\u274C Failed: {err} (manual update: dsh plugin --profile web update dsh-pocket --latest -w)",
+  "versionRange": "Current v{cur} \u2192 latest v{latest}",
+  "lanTitle": "\u{1F4F6} LAN (same Wi-Fi)",
+  "lanHint": "Scan to open once your phone is on the same Wi-Fi",
+  "lanPin": "LAN access PIN",
+  "on": "On",
+  "off": "Off",
+  "lanPinValue": "\u{1F510} PIN: {pin} (required on the phone; separate from the public PIN)",
+  "lanPinCustomValue": "\u{1F510} PIN: {pin} (custom; required on the phone)",
+  "refresh": "Refresh",
+  "customize": "Customize",
+  "customizing": "New PIN (8 digits): ",
+  "save": "Save",
+  "cancel": "Cancel",
+  "pinInvalid": "PIN must be exactly 8 digits",
+  "pinCustomHint": "custom PINs are not rotated on tunnel start",
+  "lanPinOff": "\u{1F513} PIN off \u2014 scan & go, no PIN (LAN devices only; public still requires PIN)",
+  "lanStarting": "Proxy starting\u2026",
+  "wanTitle": "\u{1F310} Anywhere (public)",
+  "wanHint": "Scan from any network (the URL changes on every restart)",
+  "wanPin": "\u{1F510} PIN: {pin} (changes each time the tunnel is enabled; required on the phone)",
+  "wanPinCustom": "\u{1F510} PIN: {pin} (custom \u2014 not rotated on tunnel start)",
+  "stopTunnel": "Stop",
+  "enable": "Enable anywhere",
+  "opening": "Enabling\u2026",
+  "downloading": "\u23F3 Downloading cloudflared (first run ~20-50MB, usually 1-2 min; instant afterward) \xB7 {s}s elapsed",
+  "connecting": "\u23F3 Connecting to Cloudflare edge (usually 5-30s) \xB7 {s}s elapsed{suffix}",
+  "slowHint": " \u2014 taking long? Check for a proxy/VPN (e.g., Clash TUN)",
+  "error": "\u274C Failed to enable: {detail} (you can retry; for proxy/VPN issues see the README)",
+  "unknownError": "unknown error",
+  "feedback": "\u{1F64F} Questions? Open an issue on GitHub"
+};
+
 // client/index.jsx
 var name = "dsh-pocket";
 var inject = ["slots", "connection", "layout", "locale", "sessionLogDownload"];
+function fmt(t, key, vars) {
+  let s = t(key);
+  if (vars) {
+    for (const [k, v] of Object.entries(vars)) {
+      s = String(s).split(`{${k}}`).join(String(v));
+    }
+  }
+  return s;
+}
 var styles = {
   card: { background: "var(--dsw-alias-bg-layer-1,#fff)", border: "1px solid var(--dsw-alias-border-l2,#e5e7eb)", borderRadius: 12, padding: "16px 20px", maxWidth: 480 },
   block: { borderTop: "1px solid var(--dsw-alias-border-l2,#e5e7eb)", marginTop: 16, paddingTop: 16 },
@@ -1305,7 +1428,7 @@ var styles = {
   qr: { width: 220, height: 220, borderRadius: 10, border: "1px solid var(--dsw-alias-border-l2,#e5e7eb)", margin: "8px 0" },
   warn: { color: "var(--dsw-alias-state-warn-primary,#b45309)", fontSize: 12, lineHeight: 1.5 }
 };
-function PocketSettingsTab({ rpcCall }) {
+function PocketSettingsTab({ rpcCall, t }) {
   const [status, setStatus] = (0, import_react2.useState)(null);
   const [busy, setBusy] = (0, import_react2.useState)(false);
   const [error, setError] = (0, import_react2.useState)(null);
@@ -1315,8 +1438,8 @@ function PocketSettingsTab({ rpcCall }) {
   const [isDesktop, setIsDesktop] = (0, import_react2.useState)(false);
   const [now, setNow] = (0, import_react2.useState)(Date.now());
   (0, import_react2.useEffect)(() => {
-    const t = setInterval(() => setNow(Date.now()), 1e3);
-    return () => clearInterval(t);
+    const t2 = setInterval(() => setNow(Date.now()), 1e3);
+    return () => clearInterval(t2);
   }, []);
   const elapsed = (startedAt) => startedAt ? Math.max(0, Math.floor((Date.now() - startedAt) / 1e3)) : 0;
   const call = async (endpoint, payload) => {
@@ -1348,8 +1471,8 @@ function PocketSettingsTab({ rpcCall }) {
   };
   (0, import_react2.useEffect)(() => {
     load();
-    const t = setInterval(load, 3e3);
-    return () => clearInterval(t);
+    const t2 = setInterval(load, 3e3);
+    return () => clearInterval(t2);
   }, []);
   (0, import_react2.useEffect)(() => {
     try {
@@ -1375,10 +1498,10 @@ function PocketSettingsTab({ rpcCall }) {
       }
     };
     check();
-    const t = setInterval(check, 5 * 60 * 1e3);
+    const t2 = setInterval(check, 5 * 60 * 1e3);
     return () => {
       alive = false;
-      clearInterval(t);
+      clearInterval(t2);
     };
   }, [isDesktop]);
   const restartPocket = async () => {
@@ -1445,6 +1568,44 @@ function PocketSettingsTab({ rpcCall }) {
     } catch {
     }
   };
+  const [customPin, setCustomPin] = (0, import_react2.useState)(null);
+  const saveCustomPin = async (which) => {
+    try {
+      const r = await call(POCKET_ENDPOINTS.pinSetCustom, { which, value: customPin?.value ?? "" });
+      setStatus((s) => ({
+        ...s,
+        accessToken: which === "public" ? r.pin : s.accessToken,
+        lanToken: which === "lan" ? r.pin : s.lanToken,
+        publicPinCustom: which === "public" ? true : s.publicPinCustom,
+        lanPinCustom: which === "lan" ? true : s.lanPinCustom
+      }));
+      setCustomPin(null);
+    } catch (err) {
+      setCustomPin((c) => ({ ...c, err: err.message }));
+    }
+  };
+  const customPinRow = (which) => (0, import_react2.createElement)(
+    "div",
+    { style: { marginTop: 6, fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)", lineHeight: 1.5 } },
+    t("customizing"),
+    (0, import_react2.createElement)("input", {
+      style: { width: 110, margin: "0 6px", padding: "4px 8px", fontSize: 14, letterSpacing: 2, textAlign: "center", border: "1px solid var(--dsw-alias-border-l2,#d1d5db)", borderRadius: 6, outline: "none" },
+      type: "password",
+      inputMode: "numeric",
+      maxLength: 8,
+      value: customPin?.value ?? "",
+      autoFocus: true,
+      onChange: (e) => setCustomPin((c) => ({ ...c, value: e.target.value.replace(/\D/g, ""), err: null })),
+      onKeyDown: (e) => {
+        if (e.key === "Enter") saveCustomPin(which);
+        if (e.key === "Escape") setCustomPin(null);
+      }
+    }),
+    (0, import_react2.createElement)("button", { style: { ...styles.btn, height: 26, padding: "0 10px", fontSize: 12, marginLeft: 2 }, onClick: () => saveCustomPin(which) }, t("save")),
+    (0, import_react2.createElement)("button", { style: { ...styles.btn, height: 26, padding: "0 10px", fontSize: 12 }, onClick: () => setCustomPin(null) }, t("cancel")),
+    customPin?.err ? (0, import_react2.createElement)("div", { style: { color: "var(--dsw-alias-state-error-primary,#dc2626)", marginTop: 4 } }, customPin.err) : null
+  );
+  const customBtn = (which) => (0, import_react2.createElement)("button", { style: { ...styles.btn, height: 26, padding: "0 10px", fontSize: 12, marginLeft: 8 }, onClick: () => setCustomPin({ which, value: "", err: null }) }, t("customize"));
   const lanUrl = status?.lanUrl;
   const tunnelUrl = status?.tunnelUrl;
   const tunnelPhase = tunnelState?.phase ?? "idle";
@@ -1460,18 +1621,18 @@ function PocketSettingsTab({ rpcCall }) {
       (0, import_react2.createElement)(
         "div",
         null,
-        (0, import_react2.createElement)("strong", null, "\u{1F4F1} \u624B\u673A\u8BBF\u95EE | Phone access"),
-        (0, import_react2.createElement)("div", { style: styles.muted }, "\u624B\u673A\u626B\u7801\u6253\u5F00\u7684\u5C31\u662F\u7535\u8111\u4E0A\u7684\u8FD9\u4E2A\u754C\u9762\uFF0C\u5B9E\u65F6\u540C\u6B65 | the phone shows this exact screen, live")
+        (0, import_react2.createElement)("strong", null, t("title")),
+        (0, import_react2.createElement)("div", { style: styles.muted }, t("subtitle"))
       ),
       (0, import_react2.createElement)(
         "div",
         { style: { fontSize: 12, color: "var(--dsw-alias-label-tertiary,#8b93a1)", textAlign: "right" } },
-        (0, import_react2.createElement)("div", { style: { whiteSpace: "nowrap" } }, "\u5F00\u53D1\u8005\uFF1A\u7A0B\u5E8F\u5458\u5C11\u5317\u6668"),
-        (0, import_react2.createElement)("div", { style: { whiteSpace: "nowrap" } }, "\u2B50 \u987A\u624B\u7559\u9897 Star\uFF0C\u4F5C\u8005\u80FD\u9AD8\u5174\u4E00\u6574\u5929"),
+        (0, import_react2.createElement)("div", { style: { whiteSpace: "nowrap" } }, t("developer")),
+        (0, import_react2.createElement)("div", { style: { whiteSpace: "nowrap" } }, t("starAsk")),
         (0, import_react2.createElement)(
           "a",
           { href: "https://github.com/shaobeichen/dsh-pocket", target: "_blank", rel: "noreferrer", style: { color: "var(--dsw-alias-brand-primary,#4f6ef7)", fontSize: 12, lineHeight: 1.6, textDecoration: "underline" } },
-          "\u884C\uFF0C\u7ED9\u4F60\u4E00\u9897 Star"
+          t("starCta")
         )
       )
     ),
@@ -1483,10 +1644,10 @@ function PocketSettingsTab({ rpcCall }) {
       (0, import_react2.createElement)(
         "div",
         { style: { display: "flex", alignItems: "center", justifyContent: "space-between", gap: 8 } },
-        (0, import_react2.createElement)("div", { style: { fontWeight: 600, fontSize: 13 } }, "\u{1F504} \u5DF2\u91CD\u542F | Restarted"),
-        (0, import_react2.createElement)("button", { style: styles.btn, onClick: () => setRestartNotice(false) }, "\u77E5\u9053\u4E86 | OK")
+        (0, import_react2.createElement)("div", { style: { fontWeight: 600, fontSize: 13 } }, t("restarted")),
+        (0, import_react2.createElement)("button", { style: styles.btn, onClick: () => setRestartNotice(false) }, t("ok"))
       ),
-      (0, import_react2.createElement)("div", { style: styles.muted, marginTop: 4, wordBreak: "break-all" }, `\u8FDB\u7A0B\u5728\u540E\u53F0\u8FD0\u884C\uFF08\u4E0D\u6302\u7EC8\u7AEF\uFF09\u3002\u5982\u9700\u505C\u6B62\uFF1A${status?.killHint ?? `lsof -ti :${status?.dshPort ?? 3080} | xargs kill -9`}`)
+      (0, import_react2.createElement)("div", { style: styles.muted, marginTop: 4, wordBreak: "break-all" }, fmt(t, "bgHint", { cmd: status?.killHint ?? `lsof -ti :${status?.dshPort ?? 3080} | xargs kill -9` }))
     ) : null,
     // 更新提示——左侧黄色色条（提示有新版本）；单状态：有更新/更新中/已更新自动重启，不并存
     // 桌面端不渲染（更新由 DSH Desktop 管理）
@@ -1499,84 +1660,85 @@ function PocketSettingsTab({ rpcCall }) {
         (0, import_react2.createElement)(
           "div",
           { style: { fontWeight: 600, fontSize: 13 } },
-          updateInfo.updated ? `\u2705 \u5DF2\u66F4\u65B0 v${updateInfo.current}\uFF0C\u91CD\u542F\u751F\u6548 | Updated \u2014 restart to apply` : updateInfo.result === "ok" ? updateInfo.autoRestart ? `\u2705 \u5DF2\u66F4\u65B0 v${updateInfo.latest}\uFF0C\u6B63\u5728\u81EA\u52A8\u91CD\u542F\u2026 | updated \u2014 restarting\u2026` : `\u2705 \u5DF2\u66F4\u65B0 v${updateInfo.latest} | Updated` : `\u{1F4E6} \u65B0\u7248\u672C v${updateInfo.latest} | Update available`
+          updateInfo.updated ? fmt(t, "updatedRestart", { ver: updateInfo.current }) : updateInfo.result === "ok" ? updateInfo.autoRestart ? fmt(t, "updateAutoRestarting", { ver: updateInfo.latest }) : fmt(t, "updatedOk", { ver: updateInfo.latest }) : fmt(t, "updateAvailable", { ver: updateInfo.latest })
         ),
-        updateInfo.result !== "ok" ? (0, import_react2.createElement)("button", { style: styles.primary, onClick: runUpdate, disabled: updateInfo.updating }, updateInfo.updating ? "\u66F4\u65B0\u4E2D\u2026" : `\u66F4\u65B0\u5230 v${updateInfo.latest} | Update`) : updateInfo.autoRestart ? (0, import_react2.createElement)("button", { style: styles.btn, disabled: true }, "\u6B63\u5728\u91CD\u542F\u751F\u6548\u2026 | restarting\u2026") : (0, import_react2.createElement)("button", { style: styles.primary, onClick: restartPocket, disabled: updateInfo.restarting }, updateInfo.restarting ? "\u91CD\u542F\u4E2D\u2026" : "\u{1F504} \u91CD\u542F dsh web \u751F\u6548 | Restart now")
+        updateInfo.result !== "ok" ? (0, import_react2.createElement)("button", { style: styles.primary, onClick: runUpdate, disabled: updateInfo.updating }, updateInfo.updating ? t("updating") : fmt(t, "updateTo", { ver: updateInfo.latest })) : updateInfo.autoRestart ? (0, import_react2.createElement)("button", { style: styles.btn, disabled: true }, t("restartingNow")) : (0, import_react2.createElement)("button", { style: styles.primary, onClick: restartPocket, disabled: updateInfo.restarting }, updateInfo.restarting ? t("restarting") : t("restartNow"))
       ),
       (0, import_react2.createElement)(
         "div",
         { style: styles.muted, marginTop: 4 },
-        updateInfo.updating ? `\u23F3 \u66F4\u65B0\u4E2D\uFF08\u901A\u5E38 1-2 \u5206\u949F\uFF09\xB7 \u5DF2\u7B49\u5F85 ${elapsed(updateInfo.startedAt)} \u79D2 | updating (usually 1-2 min) \xB7 ${elapsed(updateInfo.startedAt)}s` : updateInfo.restarting ? `\u23F3 \u6B63\u5728\u91CD\u542F\u751F\u6548\uFF08\u901A\u5E38 10-30 \u79D2\uFF09\xB7 \u5DF2\u7B49\u5F85 ${elapsed(updateInfo.startedAt)} \u79D2 | restarting (usually 10-30s) \xB7 ${elapsed(updateInfo.startedAt)}s` : updateInfo.result === "ok" ? updateInfo.autoRestart ? "\u2705 \u5DF2\u66F4\u65B0\uFF0C\u6B63\u5728\u81EA\u52A8\u91CD\u542F\u751F\u6548\uFF0C\u8BF7\u7A0D\u5019\u5237\u65B0 | updated \u2014 restarting automatically, refresh shortly" : "\u2705 \u5DF2\u66F4\u65B0\uFF0C\u91CD\u542F dsh web \u751F\u6548 | updated \u2014 restart dsh web" : updateInfo.result === "fail" ? `\u274C \u5931\u8D25\uFF1A${updateInfo.output || "\u672A\u77E5"}\uFF08\u624B\u52A8\u66F4\u65B0\uFF1Adsh plugin --profile web update dsh-pocket --latest -w\uFF09` : `\u5F53\u524D v${updateInfo.current} \u2192 \u6700\u65B0 v${updateInfo.latest}`
+        updateInfo.updating ? fmt(t, "updatingDetail", { s: elapsed(updateInfo.startedAt) }) : updateInfo.restarting ? fmt(t, "restartingDetail", { s: elapsed(updateInfo.startedAt) }) : updateInfo.result === "ok" ? updateInfo.autoRestart ? t("updatedAutoDetail") : t("updatedRestartDetail") : updateInfo.result === "fail" ? fmt(t, "updateFailed", { err: updateInfo.output || t("unknownError") }) : fmt(t, "versionRange", { cur: updateInfo.current, latest: updateInfo.latest })
       )
     ) : null,
     // 局域网
     (0, import_react2.createElement)(
       "div",
       { style: styles.block },
-      (0, import_react2.createElement)("div", { style: { fontWeight: 600, fontSize: 13 } }, "\u{1F4F6} \u5C40\u57DF\u7F51\uFF08\u540C\u4E00 WiFi\uFF09| LAN"),
+      (0, import_react2.createElement)("div", { style: { fontWeight: 600, fontSize: 13 } }, t("lanTitle")),
       lanUrl ? (0, import_react2.createElement)(
         "div",
         null,
         (0, import_react2.createElement)("img", { src: status.lanQr, alt: "LAN QR", style: styles.qr }),
         (0, import_react2.createElement)("div", { style: styles.code }, lanUrl),
-        (0, import_react2.createElement)("div", { style: styles.muted }, "\u624B\u673A\u8FDE\u63A5\u540C\u4E00 WiFi \u540E\u626B\u7801\u5373\u53EF\u6253\u5F00"),
+        (0, import_react2.createElement)("div", { style: styles.muted }, t("lanHint")),
         // 访问密码开关（issue #24）：默认开启；关闭后扫码直连（仅同一局域网设备可访问）
         (0, import_react2.createElement)(
           "div",
           { style: { display: "flex", alignItems: "center", gap: 8, marginTop: 8 } },
-          (0, import_react2.createElement)("span", { style: { fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)" } }, "\u5C40\u57DF\u7F51\u8BBF\u95EE\u5BC6\u7801 | LAN access PIN"),
+          (0, import_react2.createElement)("span", { style: { fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)" } }, t("lanPin")),
           (0, import_react2.createElement)("button", {
             style: { ...styles.btn, height: 28, padding: "0 12px", fontSize: 12, fontWeight: status?.lanAuthEnabled !== false ? 600 : 400, background: status?.lanAuthEnabled !== false ? "var(--dsw-alias-button-primary-fill, var(--dsw-alias-brand-primary,#4f6ef7))" : "var(--dsw-alias-bg-layer-1,#fff)", color: status?.lanAuthEnabled !== false ? "var(--dsw-alias-label-primary-foreground, #fff)" : "var(--dsw-alias-label-primary,inherit)" },
             onClick: () => setLanAuth(true)
-          }, "\u5F00 | On"),
+          }, t("on")),
           (0, import_react2.createElement)("button", {
             style: { ...styles.btn, height: 28, padding: "0 12px", fontSize: 12, fontWeight: status?.lanAuthEnabled === false ? 600 : 400, background: status?.lanAuthEnabled === false ? "var(--dsw-alias-state-error-primary,#dc2626)" : "var(--dsw-alias-bg-layer-1,#fff)", color: status?.lanAuthEnabled === false ? "#fff" : "var(--dsw-alias-label-primary,inherit)" },
             onClick: () => setLanAuth(false)
-          }, "\u5173 | Off")
+          }, t("off"))
         ),
-        status?.lanAuthEnabled !== false ? (0, import_react2.createElement)(
+        status?.lanAuthEnabled !== false ? customPin?.which === "lan" ? customPinRow("lan") : (0, import_react2.createElement)(
           "div",
           { style: { marginTop: 6, fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)", lineHeight: 1.5 } },
-          "\u{1F510} \u8BBF\u95EE\u5BC6\u7801\uFF1A",
-          status.lanToken,
-          "\uFF08\u624B\u673A\u6253\u5F00\u9700\u8F93\u5165\uFF1B\u4E0E\u516C\u7F51\u5BC6\u7801\u5206\u5F00\uFF09",
-          (0, import_react2.createElement)("button", { style: { ...styles.btn, height: 26, padding: "0 10px", fontSize: 12, marginLeft: 8 }, onClick: refreshLanPin }, "\u5237\u65B0 | Refresh")
+          fmt(t, status?.lanPinCustom ? "lanPinCustomValue" : "lanPinValue", { pin: status.lanToken }),
+          (0, import_react2.createElement)("button", { style: { ...styles.btn, height: 26, padding: "0 10px", fontSize: 12, marginLeft: 8 }, onClick: refreshLanPin }, t("refresh")),
+          customBtn("lan")
         ) : (0, import_react2.createElement)(
           "div",
           { style: { marginTop: 6, fontSize: 12, color: "var(--dsw-alias-state-warn-primary,#b45309)", lineHeight: 1.5 } },
-          "\u{1F513} \u5BC6\u7801\u5DF2\u5173\u95ED\uFF1A\u626B\u7801\u76F4\u8FDE\uFF0C\u65E0\u9700\u5BC6\u7801\uFF08\u4EC5\u540C\u4E00\u5C40\u57DF\u7F51\u8BBE\u5907\u53EF\u8BBF\u95EE\uFF1B\u516C\u7F51\u4ECD\u8981\u5BC6\u7801\uFF09| PIN off \u2014 scan & go (LAN only; public still requires PIN)"
+          t("lanPinOff")
         )
-      ) : (0, import_react2.createElement)("div", { style: styles.muted }, "\u4EE3\u7406\u672A\u5C31\u7EEA\u2026 | proxy starting\u2026")
+      ) : (0, import_react2.createElement)("div", { style: styles.muted }, t("lanStarting"))
     ),
     // 公网
     (0, import_react2.createElement)(
       "div",
       { style: styles.block },
-      (0, import_react2.createElement)("div", { style: { fontWeight: 600, fontSize: 13 } }, "\u{1F310} \u516C\u7F51\uFF08\u4EBA\u5728\u5916\u9762\uFF09| Anywhere"),
+      (0, import_react2.createElement)("div", { style: { fontWeight: 600, fontSize: 13 } }, t("wanTitle")),
       tunnelUrl ? (0, import_react2.createElement)(
         "div",
         null,
         (0, import_react2.createElement)("img", { src: status.tunnelQr, alt: "Tunnel QR", style: styles.qr }),
         (0, import_react2.createElement)("div", { style: styles.code }, tunnelUrl),
-        (0, import_react2.createElement)("div", { style: styles.muted }, "\u4EFB\u4F55\u7F51\u7EDC\u626B\u7801\u5373\u7528\uFF08URL \u6BCF\u6B21\u91CD\u542F\u81EA\u52A8\u6362\u65B0\uFF09"),
-        status.accessToken ? (0, import_react2.createElement)(
+        (0, import_react2.createElement)("div", { style: styles.muted }, t("wanHint")),
+        status.accessToken ? customPin?.which === "public" ? customPinRow("public") : (0, import_react2.createElement)(
           "div",
           { style: { marginTop: 6, fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)", lineHeight: 1.5 } },
-          `\u{1F510} \u8BBF\u95EE\u5BC6\u7801\uFF1A${status.accessToken}\uFF08\u6BCF\u6B21\u5F00\u542F\u516C\u7F51\u53D8\u65B0\uFF1B\u624B\u673A\u6253\u5F00\u94FE\u63A5\u9700\u8F93\u5165\u6B64\u5BC6\u7801\uFF09| PIN: ${status.accessToken} \u2014 required on the phone`
+          fmt(t, status?.publicPinCustom ? "wanPinCustom" : "wanPin", { pin: status.accessToken }),
+          customBtn("public"),
+          status?.publicPinCustom ? (0, import_react2.createElement)("div", { style: { marginTop: 2, fontSize: 11, color: "var(--dsw-alias-state-warn-primary,#b45309)" } }, t("pinCustomHint")) : null
         ) : null,
-        (0, import_react2.createElement)("button", { style: styles.btn, onClick: stopTunnel }, "\u5173\u95ED\u516C\u7F51 | Stop")
+        (0, import_react2.createElement)("button", { style: styles.btn, onClick: stopTunnel }, t("stopTunnel"))
       ) : (0, import_react2.createElement)(
         "div",
         null,
-        (0, import_react2.createElement)("button", { style: { ...styles.primary, margin: "8px 0" }, onClick: startTunnel, disabled: busy || tunnelStarting }, busy ? "\u5F00\u542F\u4E2D\u2026" : "\u5F00\u542F\u516C\u7F51\u8BBF\u95EE | Enable anywhere"),
+        (0, import_react2.createElement)("button", { style: { ...styles.primary, margin: "8px 0" }, onClick: startTunnel, disabled: busy || tunnelStarting }, busy ? t("opening") : t("enable")),
         tunnelStarting ? (0, import_react2.createElement)(
           "div",
           { style: { marginTop: 4, fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)" } },
-          tunnelPhase === "downloading" ? `\u23F3 \u4E0B\u8F7D cloudflared\uFF08\u9996\u6B21\u7EA6 20-50MB\uFF0C\u901A\u5E38 1-2 \u5206\u949F\uFF1B\u4E4B\u540E\u79D2\u5F00\uFF09\xB7 \u5DF2\u7B49\u5F85 ${elapsed(tunnelStateStarted)} \u79D2` : `\u23F3 \u8FDE\u63A5 Cloudflare \u8FB9\u7F18\uFF08\u901A\u5E38 5-30 \u79D2\uFF09\xB7 \u5DF2\u7B49\u5F85 ${elapsed(tunnelStateStarted)} \u79D2${elapsed(tunnelStateStarted) > 30 ? " \u2014 \u6709\u70B9\u4E45\uFF1F\u68C0\u67E5\u662F\u5426\u5F00\u7740\u4EE3\u7406/VPN\uFF08Clash TUN \u7B49\uFF09" : ""}`
+          tunnelPhase === "downloading" ? fmt(t, "downloading", { s: elapsed(tunnelStateStarted) }) : fmt(t, "connecting", { s: elapsed(tunnelStateStarted), suffix: elapsed(tunnelStateStarted) > 30 ? t("slowHint") : "" })
         ) : tunnelPhase === "error" ? (0, import_react2.createElement)(
           "div",
           { style: { marginTop: 4, fontSize: 12, color: "var(--dsw-alias-state-error-primary,#dc2626)" } },
-          `\u274C \u5F00\u542F\u5931\u8D25\uFF1A${tunnelStateDetail || "\u672A\u77E5\u9519\u8BEF | failed"}\uFF08\u53EF\u91CD\u8BD5\uFF1B\u82E5\u662F\u4EE3\u7406/VPN \u95EE\u9898\u89C1 README \u6392\u969C\uFF09`
+          fmt(t, "error", { detail: tunnelStateDetail || t("unknownError") })
         ) : null
       )
     ),
@@ -1588,7 +1750,7 @@ function PocketSettingsTab({ rpcCall }) {
       (0, import_react2.createElement)(
         "a",
         { href: "https://github.com/shaobeichen/dsh-pocket/issues", target: "_blank", rel: "noreferrer", style: { fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)", textDecoration: "none" } },
-        "\u6709\u95EE\u9898\uFF1F\u6B22\u8FCE\u5230 GitHub Issues \u53CD\u9988 \u{1F64F} | Questions? Open an issue on GitHub"
+        t("feedback")
       )
     )
   );
@@ -1596,6 +1758,8 @@ function PocketSettingsTab({ rpcCall }) {
 function apply(ctx) {
   mobileApply(ctx);
   const rpcCall = (endpoint, payload, signal) => ctx.connection.rpc.call(POCKET_RPC_CHANNEL, endpoint, payload, signal);
+  const translate = ctx.locale.bind(NS2);
+  ctx.effect(() => ctx.locale.register(NS2, { zh: zh2, en: en2 }), "dsh-pocket: pocket locale dictionaries");
   ctx.slots.inject(
     "settings.section",
     () => ctx.slots.register(
@@ -1603,8 +1767,8 @@ function apply(ctx) {
         name: "settings.section",
         id: "pocket",
         order: 1,
-        label: () => "\u624B\u673A\u8BBF\u95EE",
-        inject: () => ({ rpcCall })
+        label: () => translate("section"),
+        inject: () => ({ rpcCall, t: translate })
       },
       PocketSettingsTab
     )

package/client/index.jsx

@@ -11,10 +11,23 @@ import { createElement as h, useEffect, useState } from 'react';
 
 import { POCKET_RPC_CHANNEL, POCKET_ENDPOINTS, redactStatus, compareVersions } from './api.js';
 import { mobileApply } from './mobile/mobile-apply.tsx';
+import { NS as POCKET_NS, zh as POCKET_ZH, en as POCKET_EN } from './pocket-locales.js';
 
 const name = 'dsh-pocket';
 const inject = ['slots', 'connection', 'layout', 'locale', 'sessionLogDownload'];
 
+// 词典在 pocket-locales.js；这里只做「取 key → 替换 {占位符} → 字符串」。
+// 不依赖 DSH t() 的插值能力，避免行为不一致。
+function fmt(t, key, vars) {
+  let s = t(key);
+  if (vars) {
+    for (const [k, v] of Object.entries(vars)) {
+      s = String(s).split(`{${k}}`).join(String(v));
+    }
+  }
+  return s;
+}
+
 // 官方 DeepSeek Harness 设计系统（dsh-client-ui-theme design-platform.css）：
 // 按钮 md=36px 胶囊形 / sm=28px；品牌色 --dsw-alias-brand-primary；
 // hover 走 --dsw-alias-button-*-hover；间距 4px 栅格；正文 13px。
@@ -31,7 +44,7 @@ const styles = {
   warn: { color: 'var(--dsw-alias-state-warn-primary,#b45309)', fontSize: 12, lineHeight: 1.5 },
 };
 
-function PocketSettingsTab({ rpcCall }) {
+function PocketSettingsTab({ rpcCall, t }) {
   const [status, setStatus] = useState(null);
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState(null);
@@ -183,6 +196,44 @@ function PocketSettingsTab({ rpcCall }) {
     } catch { /* 忽略 */ }
   };
 
+  // 自定义访问密码（issue #33）：公网/局域网各自设固定 8 位数字；自定义后公网不再自动轮换。
+  // customPin: { which: 'public'|'lan', value, err } | null —— 正在输入自定义密码的区块
+  const [customPin, setCustomPin] = useState(null);
+  const saveCustomPin = async (which) => {
+    try {
+      const r = await call(POCKET_ENDPOINTS.pinSetCustom, { which, value: customPin?.value ?? '' });
+      setStatus((s) => ({
+        ...s,
+        accessToken: which === 'public' ? r.pin : s.accessToken,
+        lanToken: which === 'lan' ? r.pin : s.lanToken,
+        publicPinCustom: which === 'public' ? true : s.publicPinCustom,
+        lanPinCustom: which === 'lan' ? true : s.lanPinCustom,
+      }));
+      setCustomPin(null);
+    } catch (err) {
+      setCustomPin((c) => ({ ...c, err: err.message }));
+    }
+  };
+  // 渲染自定义输入行（共用）：输入框 + 保存/取消
+  const customPinRow = (which) => h('div', { style: { marginTop: 6, fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)', lineHeight: 1.5 } },
+    t('customizing'),
+    h('input', {
+      style: { width: 110, margin: '0 6px', padding: '4px 8px', fontSize: 14, letterSpacing: 2, textAlign: 'center', border: '1px solid var(--dsw-alias-border-l2,#d1d5db)', borderRadius: 6, outline: 'none' },
+      type: 'password',
+      inputMode: 'numeric',
+      maxLength: 8,
+      value: customPin?.value ?? '',
+      autoFocus: true,
+      onChange: (e) => setCustomPin((c) => ({ ...c, value: e.target.value.replace(/\D/g, ''), err: null })),
+      onKeyDown: (e) => { if (e.key === 'Enter') saveCustomPin(which); if (e.key === 'Escape') setCustomPin(null); },
+    }),
+    h('button', { style: { ...styles.btn, height: 26, padding: '0 10px', fontSize: 12, marginLeft: 2 }, onClick: () => saveCustomPin(which) }, t('save')),
+    h('button', { style: { ...styles.btn, height: 26, padding: '0 10px', fontSize: 12 }, onClick: () => setCustomPin(null) }, t('cancel')),
+    customPin?.err ? h('div', { style: { color: 'var(--dsw-alias-state-error-primary,#dc2626)', marginTop: 4 } }, customPin.err) : null,
+  );
+  // 「自定义」按钮（非输入态显示在密码行末尾）
+  const customBtn = (which) => h('button', { style: { ...styles.btn, height: 26, padding: '0 10px', fontSize: 12, marginLeft: 8 }, onClick: () => setCustomPin({ which, value: '', err: null }) }, t('customize'));
+
   const lanUrl = status?.lanUrl;
   const tunnelUrl = status?.tunnelUrl;
   const tunnelPhase = tunnelState?.phase ?? 'idle';
@@ -193,14 +244,14 @@ function PocketSettingsTab({ rpcCall }) {
   return h('div', { style: styles.card },
     h('div', { style: { display: 'flex', alignItems: 'center', justifyContent: 'space-between', gap: 8 } },
       h('div', null,
-        h('strong', null, '📱 手机访问 | Phone access'),
-        h('div', { style: styles.muted }, '手机扫码打开的就是电脑上的这个界面，实时同步 | the phone shows this exact screen, live'),
+        h('strong', null, t('title')),
+        h('div', { style: styles.muted }, t('subtitle')),
       ),
       h('div', { style: { fontSize: 12, color: 'var(--dsw-alias-label-tertiary,#8b93a1)', textAlign: 'right' } },
-        h('div', { style: { whiteSpace: 'nowrap' } }, '开发者：程序员少北晨'),
-        h('div', { style: { whiteSpace: 'nowrap' } }, '⭐ 顺手留颗 Star，作者能高兴一整天'),
+        h('div', { style: { whiteSpace: 'nowrap' } }, t('developer')),
+        h('div', { style: { whiteSpace: 'nowrap' } }, t('starAsk')),
         h('a', { href: 'https://github.com/shaobeichen/dsh-pocket', target: '_blank', rel: 'noreferrer', style: { color: 'var(--dsw-alias-brand-primary,#4f6ef7)', fontSize: 12, lineHeight: 1.6, textDecoration: 'underline' } },
-          '行，给你一颗 Star'),
+          t('starCta')),
       ),
     ),
 
@@ -209,10 +260,10 @@ function PocketSettingsTab({ rpcCall }) {
     // 重启后提示（进程在后台运行，停止方法）——左侧蓝色色条（桌面端不会触发本插件的自重启）
     !isDesktop && restartNotice ? h('div', { style: { ...styles.block, borderLeft: '4px solid var(--dsw-alias-brand-primary,#4f6ef7)', borderRadius: 8, background: 'var(--dsw-alias-bg-layer-2,#f3f4f6)', padding: '10px 12px' } },
       h('div', { style: { display: 'flex', alignItems: 'center', justifyContent: 'space-between', gap: 8 } },
-        h('div', { style: { fontWeight: 600, fontSize: 13 } }, '🔄 已重启 | Restarted'),
-        h('button', { style: styles.btn, onClick: () => setRestartNotice(false) }, '知道了 | OK'),
+        h('div', { style: { fontWeight: 600, fontSize: 13 } }, t('restarted')),
+        h('button', { style: styles.btn, onClick: () => setRestartNotice(false) }, t('ok')),
       ),
-      h('div', { style: styles.muted, marginTop: 4, wordBreak: 'break-all' }, `进程在后台运行（不挂终端）。如需停止：${status?.killHint ?? `lsof -ti :${status?.dshPort ?? 3080} | xargs kill -9`}`),
+      h('div', { style: styles.muted, marginTop: 4, wordBreak: 'break-all' }, fmt(t, 'bgHint', { cmd: status?.killHint ?? `lsof -ti :${status?.dshPort ?? 3080} | xargs kill -9` })),
     ) : null,
 
     // 更新提示——左侧黄色色条（提示有新版本）；单状态：有更新/更新中/已更新自动重启，不并存
@@ -221,85 +272,91 @@ function PocketSettingsTab({ rpcCall }) {
       h('div', { style: { display: 'flex', alignItems: 'center', justifyContent: 'space-between', gap: 8 } },
         h('div', { style: { fontWeight: 600, fontSize: 13 } },
           updateInfo.updated
-            ? `✅ 已更新 v${updateInfo.current}，重启生效 | Updated — restart to apply`
+            ? fmt(t, 'updatedRestart', { ver: updateInfo.current })
             : updateInfo.result === 'ok'
-              ? (updateInfo.autoRestart ? `✅ 已更新 v${updateInfo.latest}，正在自动重启… | updated — restarting…` : `✅ 已更新 v${updateInfo.latest} | Updated`)
-              : `📦 新版本 v${updateInfo.latest} | Update available`),
+              ? (updateInfo.autoRestart ? fmt(t, 'updateAutoRestarting', { ver: updateInfo.latest }) : fmt(t, 'updatedOk', { ver: updateInfo.latest }))
+              : fmt(t, 'updateAvailable', { ver: updateInfo.latest })),
         updateInfo.result !== 'ok'
-          ? h('button', { style: styles.primary, onClick: runUpdate, disabled: updateInfo.updating }, updateInfo.updating ? '更新中…' : `更新到 v${updateInfo.latest} | Update`)
+          ? h('button', { style: styles.primary, onClick: runUpdate, disabled: updateInfo.updating }, updateInfo.updating ? t('updating') : fmt(t, 'updateTo', { ver: updateInfo.latest }))
           : updateInfo.autoRestart
-            ? h('button', { style: styles.btn, disabled: true }, '正在重启生效… | restarting…')
-            : h('button', { style: styles.primary, onClick: restartPocket, disabled: updateInfo.restarting }, updateInfo.restarting ? '重启中…' : '🔄 重启 dsh web 生效 | Restart now'),
+            ? h('button', { style: styles.btn, disabled: true }, t('restartingNow'))
+            : h('button', { style: styles.primary, onClick: restartPocket, disabled: updateInfo.restarting }, updateInfo.restarting ? t('restarting') : t('restartNow')),
       ),
       h('div', { style: styles.muted, marginTop: 4 },
         updateInfo.updating
-          ? `⏳ 更新中（通常 1-2 分钟）· 已等待 ${elapsed(updateInfo.startedAt)} 秒 | updating (usually 1-2 min) · ${elapsed(updateInfo.startedAt)}s`
+          ? fmt(t, 'updatingDetail', { s: elapsed(updateInfo.startedAt) })
         : updateInfo.restarting
-          ? `⏳ 正在重启生效（通常 10-30 秒）· 已等待 ${elapsed(updateInfo.startedAt)} 秒 | restarting (usually 10-30s) · ${elapsed(updateInfo.startedAt)}s`
+          ? fmt(t, 'restartingDetail', { s: elapsed(updateInfo.startedAt) })
         : updateInfo.result === 'ok'
-          ? (updateInfo.autoRestart ? '✅ 已更新，正在自动重启生效，请稍候刷新 | updated — restarting automatically, refresh shortly'
-            : '✅ 已更新，重启 dsh web 生效 | updated — restart dsh web')
-        : updateInfo.result === 'fail' ? `❌ 失败：${updateInfo.output || '未知'}（手动更新：dsh plugin --profile web update dsh-pocket --latest -w）`
-        : `当前 v${updateInfo.current} → 最新 v${updateInfo.latest}`),
+          ? (updateInfo.autoRestart ? t('updatedAutoDetail')
+            : t('updatedRestartDetail'))
+        : updateInfo.result === 'fail' ? fmt(t, 'updateFailed', { err: updateInfo.output || t('unknownError') })
+        : fmt(t, 'versionRange', { cur: updateInfo.current, latest: updateInfo.latest })),
     ) : null,
 
     // 局域网
     h('div', { style: styles.block },
-      h('div', { style: { fontWeight: 600, fontSize: 13 } }, '📶 局域网（同一 WiFi）| LAN'),
+      h('div', { style: { fontWeight: 600, fontSize: 13 } }, t('lanTitle')),
       lanUrl
         ? h('div', null,
           h('img', { src: status.lanQr, alt: 'LAN QR', style: styles.qr }),
           h('div', { style: styles.code }, lanUrl),
-          h('div', { style: styles.muted }, '手机连接同一 WiFi 后扫码即可打开'),
+          h('div', { style: styles.muted }, t('lanHint')),
           // 访问密码开关（issue #24）：默认开启；关闭后扫码直连（仅同一局域网设备可访问）
           h('div', { style: { display: 'flex', alignItems: 'center', gap: 8, marginTop: 8 } },
-            h('span', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)' } }, '局域网访问密码 | LAN access PIN'),
+            h('span', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)' } }, t('lanPin')),
             h('button', {
               style: { ...styles.btn, height: 28, padding: '0 12px', fontSize: 12, fontWeight: status?.lanAuthEnabled !== false ? 600 : 400, background: status?.lanAuthEnabled !== false ? 'var(--dsw-alias-button-primary-fill, var(--dsw-alias-brand-primary,#4f6ef7))' : 'var(--dsw-alias-bg-layer-1,#fff)', color: status?.lanAuthEnabled !== false ? 'var(--dsw-alias-label-primary-foreground, #fff)' : 'var(--dsw-alias-label-primary,inherit)' },
               onClick: () => setLanAuth(true),
-            }, '开 | On'),
+            }, t('on')),
             h('button', {
               style: { ...styles.btn, height: 28, padding: '0 12px', fontSize: 12, fontWeight: status?.lanAuthEnabled === false ? 600 : 400, background: status?.lanAuthEnabled === false ? 'var(--dsw-alias-state-error-primary,#dc2626)' : 'var(--dsw-alias-bg-layer-1,#fff)', color: status?.lanAuthEnabled === false ? '#fff' : 'var(--dsw-alias-label-primary,inherit)' },
               onClick: () => setLanAuth(false),
-            }, '关 | Off'),
+            }, t('off')),
           ),
           status?.lanAuthEnabled !== false
-            ? h('div', { style: { marginTop: 6, fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)', lineHeight: 1.5 } },
-              '🔐 访问密码：',
-              status.lanToken,
-              '（手机打开需输入；与公网密码分开）',
-              h('button', { style: { ...styles.btn, height: 26, padding: '0 10px', fontSize: 12, marginLeft: 8 }, onClick: refreshLanPin }, '刷新 | Refresh'),
-            )
+            ? (customPin?.which === 'lan'
+                ? customPinRow('lan')
+                : h('div', { style: { marginTop: 6, fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)', lineHeight: 1.5 } },
+                  fmt(t, status?.lanPinCustom ? 'lanPinCustomValue' : 'lanPinValue', { pin: status.lanToken }),
+                  h('button', { style: { ...styles.btn, height: 26, padding: '0 10px', fontSize: 12, marginLeft: 8 }, onClick: refreshLanPin }, t('refresh')),
+                  customBtn('lan'),
+                ))
             : h('div', { style: { marginTop: 6, fontSize: 12, color: 'var(--dsw-alias-state-warn-primary,#b45309)', lineHeight: 1.5 } },
-              '🔓 密码已关闭：扫码直连，无需密码（仅同一局域网设备可访问；公网仍要密码）| PIN off — scan & go (LAN only; public still requires PIN)'),
+              t('lanPinOff')),
         )
-        : h('div', { style: styles.muted }, '代理未就绪… | proxy starting…'),
+        : h('div', { style: styles.muted }, t('lanStarting')),
     ),
 
     // 公网
     h('div', { style: styles.block },
-      h('div', { style: { fontWeight: 600, fontSize: 13 } }, '🌐 公网（人在外面）| Anywhere'),
+      h('div', { style: { fontWeight: 600, fontSize: 13 } }, t('wanTitle')),
       tunnelUrl
         ? h('div', null,
           h('img', { src: status.tunnelQr, alt: 'Tunnel QR', style: styles.qr }),
           h('div', { style: styles.code }, tunnelUrl),
-          h('div', { style: styles.muted }, '任何网络扫码即用（URL 每次重启自动换新）'),
+          h('div', { style: styles.muted }, t('wanHint')),
           status.accessToken
-            ? h('div', { style: { marginTop: 6, fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)', lineHeight: 1.5 } },
-              `🔐 访问密码：${status.accessToken}（每次开启公网变新；手机打开链接需输入此密码）| PIN: ${status.accessToken} — required on the phone`)
+            ? (customPin?.which === 'public'
+                ? customPinRow('public')
+                : h('div', { style: { marginTop: 6, fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)', lineHeight: 1.5 } },
+                  fmt(t, status?.publicPinCustom ? 'wanPinCustom' : 'wanPin', { pin: status.accessToken }),
+                  customBtn('public'),
+                  status?.publicPinCustom ? h('div', { style: { marginTop: 2, fontSize: 11, color: 'var(--dsw-alias-state-warn-primary,#b45309)' } }, t('pinCustomHint')) : null,
+                ))
             : null,
-          h('button', { style: styles.btn, onClick: stopTunnel }, '关闭公网 | Stop'),
+          h('button', { style: styles.btn, onClick: stopTunnel }, t('stopTunnel')),
         )
         : h('div', null,
-          h('button', { style: { ...styles.primary, margin: '8px 0' }, onClick: startTunnel, disabled: busy || tunnelStarting }, busy ? '开启中…' : '开启公网访问 | Enable anywhere'),
+          h('button', { style: { ...styles.primary, margin: '8px 0' }, onClick: startTunnel, disabled: busy || tunnelStarting }, busy ? t('opening') : t('enable')),
           tunnelStarting
             ? h('div', { style: { marginTop: 4, fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)' } },
               tunnelPhase === 'downloading'
-                ? `⏳ 下载 cloudflared（首次约 20-50MB，通常 1-2 分钟；之后秒开）· 已等待 ${elapsed(tunnelStateStarted)} 秒`
-                : `⏳ 连接 Cloudflare 边缘（通常 5-30 秒）· 已等待 ${elapsed(tunnelStateStarted)} 秒${elapsed(tunnelStateStarted) > 30 ? ' — 有点久？检查是否开着代理/VPN（Clash TUN 等）' : ''}`)
+                ? fmt(t, 'downloading', { s: elapsed(tunnelStateStarted) })
+                : fmt(t, 'connecting', { s: elapsed(tunnelStateStarted), suffix: elapsed(tunnelStateStarted) > 30 ? t('slowHint') : '' }))
             : tunnelPhase === 'error'
               ? h('div', { style: { marginTop: 4, fontSize: 12, color: 'var(--dsw-alias-state-error-primary,#dc2626)' } },
-                `❌ 开启失败：${tunnelStateDetail || '未知错误 | failed'}（可重试；若是代理/VPN 问题见 README 排障）`)
+                fmt(t, 'error', { detail: tunnelStateDetail || t('unknownError') }))
               : null,
         ),
     ),
@@ -309,7 +366,7 @@ function PocketSettingsTab({ rpcCall }) {
     // 页面最底部：反馈入口
     h('div', { style: { ...styles.block, textAlign: 'center' } },
       h('a', { href: 'https://github.com/shaobeichen/dsh-pocket/issues', target: '_blank', rel: 'noreferrer', style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)', textDecoration: 'none' } },
-        '有问题？欢迎到 GitHub Issues 反馈 🙏 | Questions? Open an issue on GitHub'),
+        t('feedback')),
     ),
   );
 }
@@ -321,6 +378,10 @@ export function apply(ctx) {
   const rpcCall = (endpoint, payload, signal) =>
     ctx.connection.rpc.call(POCKET_RPC_CHANNEL, endpoint, payload, signal);
 
+  // 设置页签接入 DSH 本地化：注册 pocket 词典（zh/en），并绑定一个随当前 locale 切换的 t()。
+  const translate = ctx.locale.bind(POCKET_NS);
+  ctx.effect(() => ctx.locale.register(POCKET_NS, { zh: POCKET_ZH, en: POCKET_EN }), 'dsh-pocket: pocket locale dictionaries');
+
   // 设置一级入口（与 通用设置/模型/插件 同级，order 1 = 通用之后、最外层）
   ctx.slots.inject('settings.section', () =>
     ctx.slots.register(
@@ -328,8 +389,8 @@ export function apply(ctx) {
         name: 'settings.section',
         id: 'pocket',
         order: 1,
-        label: () => '手机访问',
-        inject: () => ({ rpcCall }),
+        label: () => translate('section'),
+        inject: () => ({ rpcCall, t: translate }),
       },
       PocketSettingsTab,
     ),

package/client/pocket-locales.js

@@ -0,0 +1,117 @@
+// dsh-pocket 设置页签 i18n 词典（与 client/mobile/locales.ts 同款：zh 为源真，en 为译文）。
+// 需要新增字符串时：先加到 zh（key-set 唯一来源），再补 en（key 必须与 zh 完全一致）。
+export const NS = 'pocket'
+
+/** Simplified Chinese dictionary (the key-set source of truth). */
+export const zh = {
+  'section': '手机访问',
+  'title': '📱 手机访问',
+  'subtitle': '手机扫码打开的就是电脑上的这个界面，实时同步',
+  'developer': '开发者：程序员少北晨',
+  'starAsk': '⭐ 顺手留颗 Star，作者能高兴一整天',
+  'starCta': '行，给你一颗 Star',
+  'restarted': '🔄 已重启',
+  'ok': '知道了',
+  'bgHint': '进程在后台运行（不挂终端）。如需停止：{cmd}',
+  'updatedRestart': '✅ 已更新 v{ver}，重启生效',
+  'updateAutoRestarting': '✅ 已更新 v{ver}，正在自动重启…',
+  'updatedOk': '✅ 已更新 v{ver}',
+  'updateAvailable': '📦 新版本 v{ver}',
+  'updating': '更新中…',
+  'updateTo': '更新到 v{ver}',
+  'restartingNow': '正在重启生效…',
+  'restarting': '重启中…',
+  'restartNow': '🔄 重启 dsh web 生效',
+  'updatingDetail': '⏳ 更新中（通常 1-2 分钟）· 已等待 {s} 秒',
+  'restartingDetail': '⏳ 正在重启生效（通常 10-30 秒）· 已等待 {s} 秒',
+  'updatedAutoDetail': '✅ 已更新，正在自动重启生效，请稍候刷新',
+  'updatedRestartDetail': '✅ 已更新，重启 dsh web 生效',
+  'updateFailed': '❌ 失败：{err}（手动更新：dsh plugin --profile web update dsh-pocket --latest -w）',
+  'versionRange': '当前 v{cur} → 最新 v{latest}',
+  'lanTitle': '📶 局域网（同一 WiFi）',
+  'lanHint': '手机连接同一 WiFi 后扫码即可打开',
+  'lanPin': '局域网访问密码',
+  'on': '开',
+  'off': '关',
+  'lanPinValue': '🔐 访问密码：{pin}（手机打开需输入；与公网密码分开）',
+  'lanPinCustomValue': '🔐 访问密码：{pin}（自定义；手机打开需输入）',
+  'refresh': '刷新',
+  'customize': '自定义',
+  'customizing': '新密码（8 位数字）：',
+  'save': '保存',
+  'cancel': '取消',
+  'pinInvalid': '密码必须是 8 位数字',
+  'pinCustomHint': '自定义后开启公网不再自动换新',
+  'lanPinOff': '🔓 密码已关闭：扫码直连，无需密码（仅同一局域网设备可访问；公网仍要密码）',
+  'lanStarting': '代理未就绪…',
+  'wanTitle': '🌐 公网（人在外面）',
+  'wanHint': '任何网络扫码即用（URL 每次重启自动换新）',
+  'wanPin': '🔐 访问密码：{pin}（每次开启公网变新；手机打开链接需输入此密码）',
+  'wanPinCustom': '🔐 访问密码：{pin}（自定义，开启公网不再自动换新）',
+  'stopTunnel': '关闭公网',
+  'enable': '开启公网访问',
+  'opening': '开启中…',
+  'downloading': '⏳ 下载 cloudflared（首次约 20-50MB，通常 1-2 分钟；之后秒开）· 已等待 {s} 秒',
+  'connecting': '⏳ 连接 Cloudflare 边缘（通常 5-30 秒）· 已等待 {s} 秒{suffix}',
+  'slowHint': ' — 有点久？检查是否开着代理/VPN（Clash TUN 等）',
+  'error': '❌ 开启失败：{detail}（可重试；若是代理/VPN 问题见 README 排障）',
+  'unknownError': '未知错误',
+  'feedback': '有问题？欢迎到 GitHub Issues 反馈 🙏',
+}
+
+/** English dictionary, key-identical to the Chinese source of truth. */
+export const en = {
+  'section': 'Phone access',
+  'title': '📱 Phone access',
+  'subtitle': 'The phone shows this exact screen, live',
+  'developer': 'Developer: 少北晨 (shaobeichen)',
+  'starAsk': '⭐ Drop a Star if it helped — it makes the author’s day',
+  'starCta': '★ Give a Star',
+  'restarted': '🔄 Restarted',
+  'ok': 'Got it',
+  'bgHint': 'Running in the background (not attached to a terminal). To stop: {cmd}',
+  'updatedRestart': '✅ Updated to v{ver} — restart to apply',
+  'updateAutoRestarting': '✅ Updated to v{ver} — auto-restarting…',
+  'updatedOk': '✅ Updated to v{ver}',
+  'updateAvailable': '📦 Update available: v{ver}',
+  'updating': 'Updating…',
+  'updateTo': 'Update to v{ver}',
+  'restartingNow': 'Restarting to apply…',
+  'restarting': 'Restarting…',
+  'restartNow': '🔄 Restart dsh web now',
+  'updatingDetail': '⏳ Updating (usually 1-2 min) · {s}s elapsed',
+  'restartingDetail': '⏳ Restarting to apply (usually 10-30s) · {s}s elapsed',
+  'updatedAutoDetail': '✅ Updated — auto-restarting in progress, refresh shortly',
+  'updatedRestartDetail': '✅ Updated — restart dsh web to apply',
+  'updateFailed': '❌ Failed: {err} (manual update: dsh plugin --profile web update dsh-pocket --latest -w)',
+  'versionRange': 'Current v{cur} → latest v{latest}',
+  'lanTitle': '📶 LAN (same Wi-Fi)',
+  'lanHint': 'Scan to open once your phone is on the same Wi-Fi',
+  'lanPin': 'LAN access PIN',
+  'on': 'On',
+  'off': 'Off',
+  'lanPinValue': '🔐 PIN: {pin} (required on the phone; separate from the public PIN)',
+  'lanPinCustomValue': '🔐 PIN: {pin} (custom; required on the phone)',
+  'refresh': 'Refresh',
+  'customize': 'Customize',
+  'customizing': 'New PIN (8 digits): ',
+  'save': 'Save',
+  'cancel': 'Cancel',
+  'pinInvalid': 'PIN must be exactly 8 digits',
+  'pinCustomHint': 'custom PINs are not rotated on tunnel start',
+  'lanPinOff': '🔓 PIN off — scan & go, no PIN (LAN devices only; public still requires PIN)',
+  'lanStarting': 'Proxy starting…',
+  'wanTitle': '🌐 Anywhere (public)',
+  'wanHint': 'Scan from any network (the URL changes on every restart)',
+  'wanPin': '🔐 PIN: {pin} (changes each time the tunnel is enabled; required on the phone)',
+  'wanPinCustom': '🔐 PIN: {pin} (custom — not rotated on tunnel start)',
+  'stopTunnel': 'Stop',
+  'enable': 'Enable anywhere',
+  'opening': 'Enabling…',
+  'downloading': '⏳ Downloading cloudflared (first run ~20-50MB, usually 1-2 min; instant afterward) · {s}s elapsed',
+  'connecting': '⏳ Connecting to Cloudflare edge (usually 5-30s) · {s}s elapsed{suffix}',
+  'slowHint': ' — taking long? Check for a proxy/VPN (e.g., Clash TUN)',
+  'error': '❌ Failed to enable: {detail} (you can retry; for proxy/VPN issues see the README)',
+  'unknownError': 'unknown error',
+  'feedback': '🙏 Questions? Open an issue on GitHub',
+}

package/lib/index.js

@@ -15,12 +15,13 @@ import { readFileSync, mkdirSync, writeFileSync } from 'node:fs';
 import { writeFile, readFile, mkdir, rm } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
+import { randomBytes } from 'node:crypto';
 
 import { createPocketService } from './service.mjs';
 import { installPocketRpc } from './web-rpc.js';
 import { restartHost } from './restart.js';
 import { desktopEnvPatchScript, advancedNoticeScript, DEFAULT_INJECT } from './proxy.mjs';
-import { lanAuthEnabled, setLanAuthEnabled } from './settings.mjs';
+import { lanAuthEnabled, setLanAuthEnabled, pinCustom, setPinCustom } from './settings.mjs';
 
 const name = 'dsh-pocket';
 const inject = ['connection', 'webServer'];
@@ -42,10 +43,13 @@ function currentVersion() {
 /** 进程启动时加载的版本（模块加载瞬间固化；用于识别「磁盘已更新但进程还是旧代码」）。 */
 const loadedVersion = currentVersion();
 
-// ---------- 访问密码（issue #13 + #18） ----------
+// ---------- 访问密码（issue #13 + #18 + #33） ----------
 // 公网与局域网**分开**：各自 8 位数字，存本机 $DSH_HOME/dsh-pocket/。
-// 公网密码（token）：每次开启公网时轮换（旧链接作废）；
-// 局域网密码（token-lan）：手动刷新（设置页按钮）。
+// 公网密码（token）：默认每次开启公网时轮换（旧链接作废）；**用户自定义后不再轮换**；
+// 局域网密码（token-lan）：默认手动刷新（设置页按钮）；自定义后刷新会换回随机值。
+// 会话保持（issue #33）：登录 cookie 绑定进程级 sessionKey（见 apply）——
+// dsh web 重启/更新后 sessionKey 变化 → 手机需重新输入。
+const PIN_RE = /^\d{8}$/;
 function writePinToFile(p, fresh) {
   try {
     mkdirSync(dirname(p), { recursive: true });
@@ -56,7 +60,7 @@ function writePinToFile(p, fresh) {
 function readPin(p) {
   try {
     const existing = readFileSync(p, 'utf8').trim();
-    if (/^\d{8}$/.test(existing)) return existing;
+    if (PIN_RE.test(existing)) return existing;
   } catch { /* 无文件 */ }
   return null;
 }
@@ -70,11 +74,12 @@ function tokenPath() {
   return join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), tokenRel);
 }
 /** 当前公网访问密码；文件不存在时生成一个。 */
-function getAccessToken() {
+export function getAccessToken() {
   return readPin(tokenPath()) ?? writePinToFile(tokenPath(), newPin());
 }
-/** 轮换公网密码（开启公网时调用，旧密码/链接立即作废）。 */
-function rotateAccessToken() {
+/** 轮换公网密码（开启公网时调用）。用户自定义后不再轮换（尊重自定义值）。 */
+export function rotateAccessToken() {
+  if (pinCustom('public')) return getAccessToken();
   return writePinToFile(tokenPath(), newPin());
 }
 
@@ -87,14 +92,35 @@ function lanTokenPath() {
 function getLanToken() {
   return readPin(lanTokenPath()) ?? writePinToFile(lanTokenPath(), newPin());
 }
-/** 刷新局域网密码（设置页按钮触发，旧密码立即作废）。 */
+/** 刷新局域网密码（设置页按钮触发，旧密码立即作废）；换新后清除自定义标记。 */
 function refreshLanToken() {
+  setPinCustom('lan', false);
   return writePinToFile(lanTokenPath(), newPin());
 }
 /** 按 Host 分发的访问密码：公网隧道用公网密码，局域网用局域网密码。 */
 function tokenForHost(host) {
   return /trycloudflare\.com$/i.test(String(host ?? '')) ? getAccessToken() : getLanToken();
 }
+/**
+ * 用户自定义访问密码（issue #33）：公网/局域网各自设一个固定的 8 位数字。
+ * 自定义后公网开启时不再自动轮换（rotateAccessToken 见上）。
+ * 非法输入（非 8 位数字）抛错，由 RPC 层转成错误响应。
+ */
+export function setCustomPin(which, value) {
+  const v = String(value ?? '').trim();
+  if (!PIN_RE.test(v)) throw new Error('密码必须是 8 位数字 | PIN must be exactly 8 digits');
+  if (which === 'public') {
+    writePinToFile(tokenPath(), v);
+    setPinCustom('public', true);
+    return v;
+  }
+  if (which === 'lan') {
+    writePinToFile(lanTokenPath(), v);
+    setPinCustom('lan', true);
+    return v;
+  }
+  throw new Error('未知密码类型 | unknown PIN kind');
+}
 
 const restartNoticeRel = join('dsh-pocket', 'restarted.json');
 function restartNoticePath() {
@@ -203,16 +229,19 @@ export function apply(ctx, config = {}, internals = {}) {
     injectHtml: isDesktop
       ? DEFAULT_INJECT + desktopEnvPatchScript(process.platform) + (desktopAdvanced ? advancedNoticeScript() : '')
       : undefined,
-    // 访问密码（issue #13 + #18 + #24）：公网永远要密码（每次开启变新）；
-    // 局域网按开关（默认开启；关闭后局域网扫码直连，仅同网段设备可访问）
+    // 访问密码（issue #13 + #18 + #24 + #33）：公网永远要密码（默认每次开启变新，
+    // 用户自定义后不再轮换）；局域网按开关（默认开启；关闭后局域网扫码直连）。
     auth: {
+      // sessionKey：进程级随机密钥——登录 cookie 绑定它（会话保持，issue #33）：
+      // dsh web 重启/更新后 sessionKey 变化 → 手机需重新输入
+      sessionKey: randomBytes(16).toString('hex'),
       getToken: (host) => tokenForHost(host),
       isProtected: (host) => /trycloudflare\.com$/i.test(String(host ?? '')) ? true : lanAuthEnabled(),
     },
-    // 每次公网隧道就绪 → 轮换 8 位密码（旧密码/旧链接立即作废）
+    // 每次公网隧道就绪 → 轮换 8 位密码（旧密码/旧链接立即作废；用户自定义后不轮换）
     onTunnelReady: () => {
       const fresh = rotateAccessToken();
-      logger.info('dsh-pocket: public access PIN rotated | 公网访问密码已更新（旧链接作废）');
+      logger.info('dsh-pocket: public access PIN refreshed | 公网访问密码已更新（自定义密码不受影响）');
       return fresh;
     },
   });
@@ -226,6 +255,8 @@ export function apply(ctx, config = {}, internals = {}) {
     refreshLanToken: () => refreshLanToken(),
     getLanAuthEnabled: () => lanAuthEnabled(),
     setLanAuthEnabled: (on) => setLanAuthEnabled(on),
+    getPinCustom: (which) => pinCustom(which),
+    setCustomPin: (which, value) => setCustomPin(which, value),
     runUpdate: internals.runUpdate ?? { currentVersion, perform: performUpdate, loadedVersion: () => loadedVersion },
     restart: internals.restart ?? (() => pocketRestart(service)),
     restartNotice: internals.restartNotice ?? consumeRestartNotice,

package/lib/proxy.mjs

@@ -14,6 +14,7 @@
 import { createServer } from 'node:http';
 import { request as httpRequest } from 'node:http';
 import { createGzip, createBrotliCompress, constants as zlibConstants } from 'node:zlib';
+import { createHash } from 'node:crypto';
 
 const DEFAULT_UPSTREAM = { host: '127.0.0.1', port: 3080 };
 
@@ -62,10 +63,21 @@ export function advancedNoticeScript() {
   return `<script data-dsh-pocket-advanced-notice="1">!function(){try{var d=document.createElement('div');d.style.cssText='position:fixed;inset:0;z-index:2147483647;display:flex;align-items:center;justify-content:center;background:rgba(0,0,0,.55);color:#fff;font:15px/1.7 -apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;text-align:center;padding:24px';d.textContent='DSH 桌面端处于 advanced 模式，手机访问暂不支持。请在桌面端设置中切回 compatibility 模式后重启。| DSH Desktop is in advanced mode — phone access is not supported yet. Switch back to compatibility in the desktop app and restart.';document.documentElement.appendChild(d);}catch(e){}}();</script>`;
 }
 
-// ---------- 可选访问令牌认证（issue #13） ----------
-// 只对公网隧道 Host（trycloudflare.com）强制；局域网免密码。
-// 登录成功后种 HttpOnly 会话 cookie（浏览器关闭失效）→ SPA 内部 API/WS 自动携带。
+// ---------- 可选访问令牌认证（issue #13 + #33） ----------
+// 只对受保护 Host（公网隧道 + 局域网按开关）强制。
+// 登录成功后种 HttpOnly 持久 cookie（Max-Age 30 天）→ SPA 内部 API/WS 自动携带。
+// 会话保持（issue #33）：cookie 值 = sha256(PIN:sessionKey)——sessionKey 是 dsh web
+// 进程级随机密钥（lib/index.js 每次启动生成）。于是：
+//   - 电脑 dsh web 一直开着 → 手机输一次密码后长期免输（持久 cookie）
+//   - dsh web 重启/更新 → sessionKey 变化 → 旧 cookie 失效 → 手机重新输入
 const TOKEN_COOKIE = 'dsh_pocket_token';
+const COOKIE_MAX_AGE = 30 * 24 * 60 * 60; // 30 天（秒）
+
+/** cookie 校验值：有 sessionKey 时派生，无则退化为 PIN 本身（向后兼容）。 */
+function cookieFor(token, sessionKey) {
+  if (!sessionKey) return token;
+  return createHash('sha256').update(`${token}:${sessionKey}`).digest('hex');
+}
 
 function parseCookies(header) {
   const out = {};
@@ -115,12 +127,13 @@ function isHtmlRequest(req) {
 }
 
 /** 校验请求是否已认证；返回 true 放行。 */
-function authCheck(req, token) {
+function authCheck(req, token, sessionKey) {
   if (!token) return true; // 无 token（未配置密码）→ 放行
+  const expected = cookieFor(token, sessionKey);
   const cookieTok = parseCookies(req.headers.cookie)[TOKEN_COOKIE];
-  if (cookieTok === token) return true;
+  if (cookieTok === expected) return true;
   const qTok = new URL(req.url ?? '/', 'http://x').searchParams.get('token');
-  return qTok === token;
+  return qTok === expected;
 }
 
 /** 把浏览器可见的权威改写成 loopback 权威（Host 和 Origin 都改）。 */
@@ -144,14 +157,15 @@ function loopbackAuthority(headers, upstream) {
  */
 export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DEFAULT_UPSTREAM, log = null, injectHtml = DEFAULT_INJECT, auth = null } = {}) {
   const server = createServer((req, res) => {
-    // 访问令牌认证（issue #13 + #18）：局域网与公网都要求密码
+    // 访问令牌认证（issue #13 + #18 + #33）：局域网与公网按开关/来源要求密码
     if (auth) {
       const host = String(req.headers.host ?? '');
       const isPublic = /trycloudflare\.com$/i.test(host);
       const protectedHost = isProtectedHost(host, auth.isProtected);
       const token = protectedHost ? (auth.getToken?.(host) ?? null) : null;
+      const sessionKey = auth.sessionKey ?? null;
       if (protectedHost && token) {
-        // 登录提交：校验密码 → 种 HttpOnly 会话 cookie → 回首页
+        // 登录提交：校验密码 → 种持久 HttpOnly cookie（30 天，绑定进程会话密钥）→ 回首页
         if (req.method === 'POST' && req.url?.startsWith('/pocket-login')) {
           let body = '';
           req.on('data', (c) => { body += c; if (body.length > 1024) req.destroy(); });
@@ -160,7 +174,7 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
             if (submitted === token) {
               res.writeHead(302, {
                 location: '/',
-                'set-cookie': `${TOKEN_COOKIE}=${token}; HttpOnly; SameSite=Lax; Path=/`,
+                'set-cookie': `${TOKEN_COOKIE}=${cookieFor(token, sessionKey)}; HttpOnly; SameSite=Lax; Path=/; Max-Age=${COOKIE_MAX_AGE}`,
                 'cache-control': 'no-store',
               });
               res.end();
@@ -171,7 +185,7 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
           });
           return;
         }
-        if (!authCheck(req, token)) {
+        if (!authCheck(req, token, sessionKey)) {
           if (isHtmlRequest(req)) {
             res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
             res.end(loginPageHtml(false, isPublic));
@@ -267,7 +281,7 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
     if (auth) {
       const host = String(req.headers.host ?? '');
       const token = isProtectedHost(host, auth.isProtected) ? (auth.getToken?.(host) ?? null) : null;
-      if (token && !authCheck(req, token)) {
+      if (token && !authCheck(req, token, auth.sessionKey ?? null)) {
         socket.write('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
         socket.destroy();
         return;

package/lib/settings.mjs

@@ -1,6 +1,9 @@
 // dsh-pocket 设置持久化（$DSH_HOME/dsh-pocket/settings.json）
 //
-// 当前只有一项：局域网访问密码开关 lanAuthEnabled（issue #24）。
+// 当前项：
+//   - lanAuthEnabled    局域网访问密码开关（issue #24），默认开启
+//   - publicPinCustom   公网密码是否用户自定义（issue #33），自定义后不自动轮换
+//   - lanPinCustom      局域网密码是否用户自定义（issue #33）
 // 默认**开启**（安全优先）：局域网扫码也要输 8 位密码；
 // 用户可关闭——关闭后局域网扫码直连（仅同一网络内的设备能访问），公网不受影响（永远要密码）。
 
@@ -41,3 +44,25 @@ export function setLanAuthEnabled(on) {
   writeSettings(s);
   return s.lanAuthEnabled;
 }
+
+// ---------- 访问密码「自定义」标记（issue #33） ----------
+// 用户可把公网/局域网密码设成自己固定的 8 位数字（自定义后不再自动轮换）。
+// 标记存 settings.json：publicPinCustom / lanPinCustom。
+const PIN_CUSTOM_KEYS = { public: 'publicPinCustom', lan: 'lanPinCustom' };
+
+/** 该 PIN（public | lan）是否用户自定义过（自定义后不自动轮换）。 */
+export function pinCustom(which) {
+  const key = PIN_CUSTOM_KEYS[which];
+  if (!key) return false;
+  return readSettings()[key] === true;
+}
+
+/** 设置自定义标记，返回新状态。 */
+export function setPinCustom(which, on) {
+  const key = PIN_CUSTOM_KEYS[which];
+  if (!key) return false;
+  const s = readSettings();
+  s[key] = !!on;
+  writeSettings(s);
+  return !!on;
+}

package/lib/web-rpc.js

@@ -25,7 +25,7 @@ export function killHint(port) {
 }
 
 /** 注册 /dsh-pocket 逻辑通道（仅本机 loopback 可调）。 */
-export function installPocketRpc(ctx, { service, log = console, desktop = false, runUpdate = null, restart = null, restartNotice = null, getToken = null, getLanToken = null, refreshLanToken = null, getLanAuthEnabled = null, setLanAuthEnabled = null }) {
+export function installPocketRpc(ctx, { service, log = console, desktop = false, runUpdate = null, restart = null, restartNotice = null, getToken = null, getLanToken = null, refreshLanToken = null, getLanAuthEnabled = null, setLanAuthEnabled = null, getPinCustom = null, setCustomPin = null }) {
   if (!ctx?.connection?.rpc?.handle) {
     log.warn?.('dsh-pocket: DSH Host Connection RPC unavailable — settings tab disabled | 无 Connection RPC，设置页不可用');
     return () => {};
@@ -46,6 +46,8 @@ export function installPocketRpc(ctx, { service, log = console, desktop = false,
         accessToken: getToken?.() ?? null,
         lanToken: getLanToken?.() ?? null,
         lanAuthEnabled: getLanAuthEnabled?.() ?? true,
+        publicPinCustom: getPinCustom?.('public') ?? false,
+        lanPinCustom: getPinCustom?.('lan') ?? false,
       });
     };
 
@@ -63,6 +65,17 @@ export function installPocketRpc(ctx, { service, log = console, desktop = false,
         if (enabled === undefined) return fail('bad-request', '局域网密码开关不可用 | LAN PIN switch unavailable');
         return ok({ lanAuthEnabled: enabled });
       }
+      if (endpoint === POCKET_ENDPOINTS.pinSetCustom) {
+        const which = payload?.which === 'public' || payload?.which === 'lan' ? payload.which : null;
+        if (!which) return fail('bad-request', '未知密码类型 | unknown PIN kind');
+        try {
+          const pin = setCustomPin?.(which, payload?.value);
+          if (pin === undefined) return fail('bad-request', '自定义密码不可用 | custom PIN unavailable');
+          return ok({ which, pin, custom: true });
+        } catch (err) {
+          return fail('bad-request', err?.message ?? String(err));
+        }
+      }
       if (endpoint === POCKET_ENDPOINTS.tunnelStart) {
         await service.startTunnel();
         return await statusPayload();

package/package.json

@@ -76,5 +76,5 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "version": "1.9.2"
+  "version": "1.11.0"
 }