dsh-pocket 2.10.0 → 2.10.2

package/client/client.js

@@ -239,42 +239,104 @@ function MobileNavOverlay({ toggleSidebar, t }) {
   }, [mobile, open, toggleSidebar]);
   (0, import_react.useEffect)(() => {
     if (!mobile || !open) return;
+    let lastTouchNavAt = 0;
+    let lastTouchX = 0;
+    let lastTouchY = 0;
+    let suppressTouchClickUntil = 0;
+    let pendingTouchRow = null;
+    let selectedRowAtArm = null;
+    let navClickArrived = false;
+    let navObserver = null;
+    let navTimer = null;
+    const drawerRoot = () => document.querySelector(DRAWER_SELECTOR);
+    const disarmNav = () => {
+      navObserver?.disconnect();
+      navObserver = null;
+      if (navTimer !== null) window.clearTimeout(navTimer);
+      navTimer = null;
+      pendingTouchRow = null;
+      selectedRowAtArm = null;
+      navClickArrived = false;
+    };
+    const armNav = (row) => {
+      disarmNav();
+      pendingTouchRow = row;
+      const drawer = drawerRoot();
+      selectedRowAtArm = drawer?.querySelector('[role="treeitem"][aria-selected="true"]') ?? null;
+      if (drawer === null) return;
+      navObserver = new MutationObserver(() => {
+        const frame = document.querySelector('[data-mobile-nav="frame"]');
+        if (frame === null || frame.hasAttribute("data-sidebar-collapsed")) {
+          disarmNav();
+          return;
+        }
+        const selectedRow = drawerRoot()?.querySelector('[role="treeitem"][aria-selected="true"]') ?? null;
+        if (navClickArrived && selectedRow !== null && selectedRow !== selectedRowAtArm) {
+          disarmNav();
+          toggleSidebar();
+        }
+      });
+      navObserver.observe(drawer, {
+        childList: true,
+        subtree: true,
+        attributes: true,
+        attributeFilter: ["aria-selected"]
+      });
+      navTimer = window.setTimeout(disarmNav, 2e3);
+    };
+    const navigationTarget = (target) => {
+      if (document.querySelector('[aria-modal="true"]') !== null) return null;
+      const frame = document.querySelector('[data-mobile-nav="frame"]');
+      if (frame === null || frame.hasAttribute("data-sidebar-collapsed")) return null;
+      if (!(target instanceof Element)) return null;
+      const drawer = drawerRoot();
+      if (drawer === null || !drawer.contains(target)) return null;
+      return navTargetFor(target);
+    };
+    const isPendingTouchClick = (event) => {
+      const capabilities = event.sourceCapabilities;
+      if (capabilities?.firesTouchEvents === true) return true;
+      return Math.hypot(event.clientX - lastTouchX, event.clientY - lastTouchY) <= 24;
+    };
     const onDrawerClick = (event) => {
-      if (document.querySelector('[aria-modal="true"]') !== null) return;
-      const target = event.target;
-      if (target === null) return;
-      const drawer = document.querySelector(DRAWER_SELECTOR);
-      if (drawer === null || !drawer.contains(target)) return;
-      if (navTargetFor(target) !== null) toggleSidebar();
+      if (performance.now() < suppressTouchClickUntil) return;
+      if (pendingTouchRow !== null && performance.now() - lastTouchNavAt < 500 && isPendingTouchClick(event)) {
+        const target = navigationTarget(event.target);
+        const row = target?.closest('[role="treeitem"]');
+        if (row !== null && row !== void 0) {
+          pendingTouchRow = row;
+          navClickArrived = true;
+          return;
+        }
+      }
+      if (navigationTarget(event.target) !== null) toggleSidebar();
     };
-    document.addEventListener("click", onDrawerClick, true);
-    return () => document.removeEventListener("click", onDrawerClick, true);
-  }, [mobile, open, toggleSidebar]);
-  (0, import_react.useEffect)(() => {
-    if (!mobile || !open) return;
-    let timer = null;
     const onDrawerPointerUp = (event) => {
       if (event.pointerType !== "touch" && event.pointerType !== "pen") return;
-      const target = event.target;
-      if (!(target instanceof Element)) return;
-      const drawer = document.querySelector(DRAWER_SELECTOR);
-      if (drawer === null || !drawer.contains(target)) return;
-      if (navTargetFor(target) === null) return;
-      if (timer !== null) return;
-      timer = window.setTimeout(() => {
-        timer = null;
-        const frame = document.querySelector('[data-mobile-nav="frame"]');
-        if (frame === null || frame.hasAttribute("data-sidebar-collapsed")) return;
-        const row = navTargetFor(target);
-        row?.dispatchEvent(new MouseEvent("click", { bubbles: true, cancelable: true, view: window }));
-      }, 0);
+      const target = navigationTarget(event.target);
+      if (target === null) return;
+      const row = target.closest('[role="treeitem"]');
+      if (row !== null) {
+        if (row.getAttribute("aria-selected") === "true") {
+          suppressTouchClickUntil = performance.now() + 500;
+          toggleSidebar();
+        } else {
+          lastTouchNavAt = performance.now();
+          lastTouchX = event.clientX;
+          lastTouchY = event.clientY;
+          armNav(row);
+        }
+        return;
+      }
     };
+    document.addEventListener("click", onDrawerClick, true);
     document.addEventListener("pointerup", onDrawerPointerUp, true);
     return () => {
-      if (timer !== null) window.clearTimeout(timer);
+      disarmNav();
+      document.removeEventListener("click", onDrawerClick, true);
       document.removeEventListener("pointerup", onDrawerPointerUp, true);
     };
-  }, [mobile, open]);
+  }, [mobile, open, toggleSidebar]);
   (0, import_react.useEffect)(() => {
     if (!mobile || !open) return;
     const onOutsideClick = (event) => {
@@ -283,6 +345,8 @@ function MobileNavOverlay({ toggleSidebar, t }) {
       if (target === null) return;
       if (target.closest(TOGGLE_SELECTOR) !== null) return;
       if (isOverlayTap(target)) return;
+      const frame = document.querySelector('[data-mobile-nav="frame"]');
+      if (frame === null || frame.hasAttribute("data-sidebar-collapsed")) return;
       const drawer = document.querySelector(DRAWER_SELECTOR);
       if (drawer !== null && drawer.contains(target)) return;
       toggleSidebar();
@@ -824,26 +888,77 @@ var MOBILE_CSS = `
     font-size: 15px !important;
   }
 
+  /* Keep DSH's own process disclosures and their expand/collapse behaviour,
+     but remove desktop-sized vertical breathing room between consecutive
+     context, Skill, and system-prompt entries. */
+  [data-phase] [data-turn-process] {
+    height: 28px !important;
+    padding-bottom: 4px !important;
+    margin-bottom: 4px !important;
+  }
+  [data-phase] [data-turn-process][data-open] {
+    margin-bottom: 4px !important;
+  }
+  [data-phase] [data-disclosure-row] {
+    min-height: 24px !important;
+  }
+  [data-phase] :is([data-context-injection-body], [data-system-prompt-body]) {
+    margin-top: 2px !important;
+  }
+
   /* --- Composer bottom row on mobile ---
-     The official row gives the model pill (trailing) flex:0 0 auto, which
-     squeezes the agent-permission pill (modes) down to 15px: the pill's
-     chevron then overflows on top of the model name. Let the permission
-     pill keep its natural width and let the model pill shrink instead.
-     Anchored by the composer card (:has(textarea)): row = last child,
-     tools = first child, permission pill = its 2nd child, model pill =
-     row's last child. */
-  [data-phase] [class*="_card"]:has(textarea) > :last-child {
-    gap: 8px !important;
+     Keep add, permission, model, reasoning and send controls on one line at
+     the Honor 50's 360px CSS viewport. DSH's stable data-composer-card hook
+     survives the editor's textarea -> contenteditable migration. */
+  [data-phase] [data-composer-card="true"] > [class$="_row"] {
+    flex-wrap: nowrap !important;
+    gap: 6px !important;
   }
-  [data-phase] [class*="_card"]:has(textarea) > :last-child > :first-child {
+  [data-phase] [data-composer-card="true"] > [class$="_row"] > :first-child {
     gap: 8px !important;
+    min-width: 0 !important;
   }
-  [data-phase] [class*="_card"]:has(textarea) > :last-child > :first-child > :nth-child(2) {
-    flex: 0 0 auto !important;
+  [data-phase] [data-composer-card="true"] > [class$="_row"] > :first-child > :nth-child(2) {
+    flex: 0 1 auto !important;
+    min-width: 0 !important;
   }
-  [data-phase] [class*="_card"]:has(textarea) > :last-child > :last-child {
-    flex: 1 1 auto !important;
+  [data-phase] [data-composer-card="true"] > [class$="_row"] > :last-child {
+    flex: 1 1 0 !important;
     min-width: 0 !important;
+    gap: 6px !important;
+  }
+
+  /* --- Composer popups as bottom sheets on mobile ---
+     Two composer-anchored popups break on phones (field: bottom + side
+     cut, only part of the popup visible):
+     1. the model pill menu ([role=menu], max 360px, opens upward from the
+        pill inside the composer card);
+     2. the "/" command palette (max 320px card with the search box \u2014 it
+        hosts the /model popupSelect list: search + provider-grouped rows).
+     Both are position:absolute INSIDE the conversation scrollBody
+     (overflow:hidden) and the shell center column (overflow:hidden), so
+     the scroll containers clip them mid-list. Forensics showed neither
+     layer creates a containing block (no transform/contain/will-change),
+     so on mobile we snap whichever popup is open to a viewport-anchored
+     sheet: fixed positioning escapes the scroll clip entirely, width is
+     deterministic, safe-area keeps it off the gesture bar. A transient
+     picker covering the composer is standard mobile UX; selection or an
+     outside tap still dismisses it. */
+  [data-phase] [class$="_root"]:has(> [aria-haspopup="menu"]) > [role="menu"],
+  [data-phase] [class$="_card"]:has(> [class$="_search"]) {
+    position: fixed !important;
+    left: 12px !important;
+    right: 12px !important;
+    top: auto !important;
+    bottom: calc(env(safe-area-inset-bottom, 0px) + 12px) !important;
+    width: auto !important;
+    min-width: 0 !important;
+    max-width: none !important;
+    max-height: min(65vh, 480px) !important;
+    max-height: min(65dvh, 480px) !important;
+    z-index: 130 !important;
+    border-radius: 14px !important;
+    box-shadow: 0 -4px 28px rgba(0, 0, 0, .18) !important;
   }
 
   /* --- Session header on mobile ---
@@ -854,14 +969,22 @@ var MOBILE_CSS = `
        header > :first-child                   titleRow (titleCluster + utilities)
        header > :first-child > :last-child     headerUtilities (Session log seat) */
   [data-phase] header {
-    padding-right: 12px !important;
+    padding: 8px 12px 0 !important;
   }
-  /* Give the title row a lane clear of the absolutely-placed toggle, then
-     balance the header: with header padding-right 12px, a 20px left
-     padding puts the title's geometric center exactly on the viewport
-     center (measured 195/195 at 390px). */
+  /* The directory and Files controls are absolutely positioned, so reserve
+     their lanes and let the title use the remaining width without squeezing. */
   [data-phase] header > :first-child {
-    padding-left: 20px !important;
+    min-height: 36px !important;
+    padding: 0 32px !important;
+  }
+  [data-phase] header [class$="_titleCluster"],
+  [data-phase] header [class$="_crumbs"] {
+    min-width: 0 !important;
+  }
+  [data-phase] header button[class*="_crumb"] {
+    max-width: calc(100vw - 104px) !important;
+    padding-left: 0 !important;
+    padding-right: 0 !important;
   }
   /* The directory toggle sits at the far left of the header (the header
      is position:relative; the data-slot wrappers are display:contents). */
@@ -1588,11 +1711,10 @@ function mobileApply(ctx) {
       }
     };
     const mark = () => {
-      for (const root of document.querySelectorAll('[data-phase] [class$="_root"]')) {
-        if (root.closest('[class$="_composerStack"]') === null) continue;
+      const selector = '[data-phase] [data-slot="conversation.composer.dock"] [class$="_root"]';
+      for (const root of document.querySelectorAll(selector)) {
         const text = root.textContent ?? "";
         if (!/(turns|steps|\bLLM\b|轮|步)/.test(text)) continue;
-        if (root.querySelector("textarea") !== null) continue;
         root.setAttribute("data-mobile-nav", "stats");
         moveTps(root);
         return;
@@ -2540,6 +2662,16 @@ function PocketSettingsTab({ rpcCall, t }) {
   );
 }
 function apply(ctx) {
+  if (ctx?.connection) {
+    try {
+      Object.defineProperty(ctx.connection, "isLoopback", { value: true, writable: true, configurable: true });
+    } catch {
+      try {
+        ctx.connection.isLoopback = true;
+      } catch {
+      }
+    }
+  }
   mobileApply(ctx);
   const rpcCall = (endpoint, payload, signal) => ctx.connection.rpc.call(POCKET_RPC_CHANNEL, endpoint, payload, signal);
   const translate = ctx.locale.bind(NS2);

package/client/index.jsx

@@ -625,6 +625,18 @@ function PocketSettingsTab({ rpcCall, t }) {
 }
 
 export function apply(ctx) {
+  // 双保险：确保 connection.isLoopback 为 true（issue #58）。
+  // 主修复在代理注入的 loopback 补丁（proxy.mjs LOOPBACK_ENV_PATCH）——它在
+  // connection 模块 provide 时就改写句柄，早于 ui-settings 选择镜像模式；
+  // 这里兜底覆盖时序差异（若本插件 apply 晚于 ui-settings，则只能影响后续读者）。
+  if (ctx?.connection) {
+    try {
+      Object.defineProperty(ctx.connection, 'isLoopback', { value: true, writable: true, configurable: true });
+    } catch {
+      try { ctx.connection.isLoopback = true; } catch { /* 忽略 */ }
+    }
+  }
+
   // 移动端适配（dsh-web-mobile 移植）：抽屉布局/触控/安全区，仅窄屏生效
   mobileApply(ctx);
 

package/client/mobile/MobileNavOverlay.tsx

@@ -102,9 +102,9 @@ export function MobileNavOverlay({ toggleSidebar, t }: MobileNavOverlayProps) {
 
   // Navigation inside the drawer closes it: tapping a session row or a
   // plugin takeover entry (task board / ssh) must hand the screen to the
-  // content it just opened. Capture phase — the drawer closes before the
-  // shell or a plugin processes the click, so takeover panels never render
-  // under the open drawer.
+  // content it just opened. Mouse clicks keep the direct close path. Touch
+  // session rows close only after aria-selected changes, so live session
+  // updates cannot strand a delayed click on a detached DOM target.
   //
   // Deliberately NOT closed by this rule:
   // - Settings / Session log: their dialogs render INSIDE the drawer DOM
@@ -115,67 +115,127 @@ export function MobileNavOverlay({ toggleSidebar, t }: MobileNavOverlayProps) {
   // - Anything while a modal dialog is open: the dialog owns the screen.
   useEffect(() => {
     if (!mobile || !open) return
-    const onDrawerClick = (event: MouseEvent) => {
-      if (document.querySelector('[aria-modal="true"]') !== null) return
-      const target = event.target as HTMLElement | null
-      if (target === null) return
-      const drawer = document.querySelector<HTMLElement>(DRAWER_SELECTOR)
-      if (drawer === null || !drawer.contains(target)) return
-      // A session row's own action buttons — the "Session actions" kebab
-      // (delete / rename), revealed on hover / long-press — open an edit
-      // menu. Tapping one must NOT count as tapping the row, or the drawer
-      // would close and take the just-opened menu with it.
-      if (navTargetFor(target) !== null) toggleSidebar()
+    let lastTouchNavAt = 0
+    let lastTouchX = 0
+    let lastTouchY = 0
+    let suppressTouchClickUntil = 0
+    let pendingTouchRow: Element | null = null
+    let selectedRowAtArm: Element | null = null
+    let navClickArrived = false
+    let navObserver: MutationObserver | null = null
+    let navTimer: number | null = null
+
+    const drawerRoot = (): HTMLElement | null =>
+      document.querySelector<HTMLElement>(DRAWER_SELECTOR)
+
+    const disarmNav = (): void => {
+      navObserver?.disconnect()
+      navObserver = null
+      if (navTimer !== null) window.clearTimeout(navTimer)
+      navTimer = null
+      pendingTouchRow = null
+      selectedRowAtArm = null
+      navClickArrived = false
+    }
+
+    const armNav = (row: Element): void => {
+      disarmNav()
+      pendingTouchRow = row
+      const drawer = drawerRoot()
+      selectedRowAtArm = drawer?.querySelector('[role="treeitem"][aria-selected="true"]') ?? null
+      if (drawer === null) return
+      navObserver = new MutationObserver(() => {
+        const frame = document.querySelector('[data-mobile-nav="frame"]')
+        if (frame === null || frame.hasAttribute('data-sidebar-collapsed')) {
+          disarmNav()
+          return
+        }
+        const selectedRow = drawerRoot()?.querySelector('[role="treeitem"][aria-selected="true"]') ?? null
+        if (navClickArrived && selectedRow !== null && selectedRow !== selectedRowAtArm) {
+          disarmNav()
+          toggleSidebar()
+        }
+      })
+      navObserver.observe(drawer, {
+        childList: true,
+        subtree: true,
+        attributes: true,
+        attributeFilter: ['aria-selected'],
+      })
+      navTimer = window.setTimeout(disarmNav, 2000)
+    }
+
+    const navigationTarget = (target: EventTarget | null): Element | null => {
+      if (document.querySelector('[aria-modal="true"]') !== null) return null
+      const frame = document.querySelector('[data-mobile-nav="frame"]')
+      if (frame === null || frame.hasAttribute('data-sidebar-collapsed')) return null
+      if (!(target instanceof Element)) return null
+      const drawer = drawerRoot()
+      if (drawer === null || !drawer.contains(target)) return null
+      return navTargetFor(target)
+    }
+
+    const isPendingTouchClick = (event: MouseEvent): boolean => {
+      const capabilities = (event as MouseEvent & {
+        sourceCapabilities?: { firesTouchEvents?: boolean }
+      }).sourceCapabilities
+      if (capabilities?.firesTouchEvents === true) return true
+      return Math.hypot(event.clientX - lastTouchX, event.clientY - lastTouchY) <= 24
+    }
+
+    const onDrawerClick = (event: MouseEvent): void => {
+      // A touch row tap owns the close through the selection observer. Let the
+      // browser click reach React without a capture-phase close racing it.
+      if (performance.now() < suppressTouchClickUntil) return
+      if (
+        pendingTouchRow !== null
+        && performance.now() - lastTouchNavAt < 500
+        && isPendingTouchClick(event)
+      ) {
+        const target = navigationTarget(event.target)
+        const row = target?.closest('[role="treeitem"]')
+        if (row !== null && row !== undefined) {
+          pendingTouchRow = row
+          navClickArrived = true
+          return
+        }
+      }
+      if (navigationTarget(event.target) !== null) toggleSidebar()
     }
-    document.addEventListener('click', onDrawerClick, true)
-    return () => document.removeEventListener('click', onDrawerClick, true)
-  }, [mobile, open, toggleSidebar])
 
-  // iOS Safari touch self-heal (issue #72).
-  //
-  // A tap on a drawer row is delivered to the page as touchstart/touchend
-  // plus a browser-synthesized click. On iOS that click is routinely
-  // suppressed: a few px of finger drift is classified as a pan, and any DOM
-  // shift under the finger before dispatch cancels it outright. When it does
-  // not arrive, neither the row's own onClick nor the capture handler above
-  // runs — the row looks completely dead ("抽屉点了没反应").
-  //
-  // So: on touch/pen pointerup inside the drawer that hits a navigation row,
-  // arm a one-macrotask timer. When it fires:
-  // - the drawer is already closed → the real click did arrive and handled
-  //   everything → do nothing (zero interference with the normal path);
-  // - otherwise the click never came → re-dispatch a bubbling click on the
-  //   row ourselves. React's delegated listener runs the row's onClick (the
-  //   session opens / the workspace switches) and the same click bubbles
-  //   through the capture handler above, which closes the drawer.
-  //
-  // Mouse/pen-on-desktop keeps the plain click path: pointerType is 'mouse'.
-  useEffect(() => {
-    if (!mobile || !open) return
-    let timer: number | null = null
     const onDrawerPointerUp = (event: PointerEvent): void => {
       if (event.pointerType !== 'touch' && event.pointerType !== 'pen') return
-      const target = event.target
-      if (!(target instanceof Element)) return
-      const drawer = document.querySelector<HTMLElement>(DRAWER_SELECTOR)
-      if (drawer === null || !drawer.contains(target)) return
-      if (navTargetFor(target) === null) return
-      if (timer !== null) return
-      timer = window.setTimeout(() => {
-        timer = null
-        const frame = document.querySelector('[data-mobile-nav="frame"]')
-        // Real click already closed it — nothing to heal.
-        if (frame === null || frame.hasAttribute('data-sidebar-collapsed')) return
-        const row = navTargetFor(target)
-        row?.dispatchEvent(new MouseEvent('click', { bubbles: true, cancelable: true, view: window }))
-      }, 0)
+      const target = navigationTarget(event.target)
+      if (target === null) return
+
+      const row = target.closest('[role="treeitem"]')
+      if (row !== null) {
+        if (row.getAttribute('aria-selected') === 'true') {
+          // Already-selected rows will not navigate; closing now is safe.
+          suppressTouchClickUntil = performance.now() + 500
+          toggleSidebar()
+        } else {
+          // Let React navigate first, then close on the selection mutation.
+          lastTouchNavAt = performance.now()
+          lastTouchX = event.clientX
+          lastTouchY = event.clientY
+          armNav(row)
+        }
+        return
+      }
+
+      // Non-row targets keep their existing click path; only host
+      // session/search rows participate in the selected-state hand-off.
     }
+
+    document.addEventListener('click', onDrawerClick, true)
     document.addEventListener('pointerup', onDrawerPointerUp, true)
     return () => {
-      if (timer !== null) window.clearTimeout(timer)
+      disarmNav()
+      document.removeEventListener('click', onDrawerClick, true)
       document.removeEventListener('pointerup', onDrawerPointerUp, true)
     }
-  }, [mobile, open])
+  }, [mobile, open, toggleSidebar])
 
   // Tap-outside closes the drawer (issue #38). The backdrop is now
   // pointer-events: none (pure dimming layer that never steals clicks), so
@@ -198,6 +258,8 @@ export function MobileNavOverlay({ toggleSidebar, t }: MobileNavOverlayProps) {
       // unmounts with the sidebar, and the item's onClick never runs, so
       // every workspace control reads as "点了没反应" on a phone.
       if (isOverlayTap(target)) return
+      const frame = document.querySelector('[data-mobile-nav="frame"]')
+      if (frame === null || frame.hasAttribute('data-sidebar-collapsed')) return
       const drawer = document.querySelector<HTMLElement>(DRAWER_SELECTOR)
       if (drawer !== null && drawer.contains(target)) return
       toggleSidebar()

package/client/mobile/mobile-apply.tsx

@@ -182,11 +182,10 @@ export function mobileApply(ctx): void {
 
   // The official conversation status row (turns / steps / LLM time / TTFT /
   // cache) has a hashed class, so the stylesheet cannot target it directly.
-  // Mark the exact row on narrow screens by text: a [class$=_root] that
-  // carries the metrics text and no textarea (the composer card also ends in
-  // _root and can mention turns in its model line). The CSS then lays the
-  // marked row out as ONE horizontally scrolling line with every metric
-  // reachable.
+  // Its stable boundary is the official conversation.composer.dock slot. Mark
+  // only the metrics root inside that slot; never scan every *_root under the
+  // composer because the editor itself is now contenteditable (not textarea)
+  // and its root also contains the dock text.
   ctx.effect(() => {
     if (!narrow.matches) return () => {}
     // The composer root renders the TPS readout ("TPS 89.4 tok/s") as its
@@ -206,13 +205,10 @@ export function mobileApply(ctx): void {
       }
     }
     const mark = (): void => {
-      for (const root of document.querySelectorAll('[data-phase] [class$="_root"]')) {
-        // The status row lives inside the composer stack; message-area
-        // blocks can also mention turns/steps and must be skipped.
-        if (root.closest('[class$="_composerStack"]') === null) continue
+      const selector = '[data-phase] [data-slot="conversation.composer.dock"] [class$="_root"]'
+      for (const root of document.querySelectorAll(selector)) {
         const text = root.textContent ?? ''
         if (!/(turns|steps|\bLLM\b|轮|步)/.test(text)) continue
-        if (root.querySelector('textarea') !== null) continue
         root.setAttribute('data-mobile-nav', 'stats')
         moveTps(root)
         return

package/client/mobile/mobile.css.ts

@@ -333,26 +333,77 @@ export const MOBILE_CSS = `
     font-size: 15px !important;
   }
 
+  /* Keep DSH's own process disclosures and their expand/collapse behaviour,
+     but remove desktop-sized vertical breathing room between consecutive
+     context, Skill, and system-prompt entries. */
+  [data-phase] [data-turn-process] {
+    height: 28px !important;
+    padding-bottom: 4px !important;
+    margin-bottom: 4px !important;
+  }
+  [data-phase] [data-turn-process][data-open] {
+    margin-bottom: 4px !important;
+  }
+  [data-phase] [data-disclosure-row] {
+    min-height: 24px !important;
+  }
+  [data-phase] :is([data-context-injection-body], [data-system-prompt-body]) {
+    margin-top: 2px !important;
+  }
+
   /* --- Composer bottom row on mobile ---
-     The official row gives the model pill (trailing) flex:0 0 auto, which
-     squeezes the agent-permission pill (modes) down to 15px: the pill's
-     chevron then overflows on top of the model name. Let the permission
-     pill keep its natural width and let the model pill shrink instead.
-     Anchored by the composer card (:has(textarea)): row = last child,
-     tools = first child, permission pill = its 2nd child, model pill =
-     row's last child. */
-  [data-phase] [class*="_card"]:has(textarea) > :last-child {
-    gap: 8px !important;
+     Keep add, permission, model, reasoning and send controls on one line at
+     the Honor 50's 360px CSS viewport. DSH's stable data-composer-card hook
+     survives the editor's textarea -> contenteditable migration. */
+  [data-phase] [data-composer-card="true"] > [class$="_row"] {
+    flex-wrap: nowrap !important;
+    gap: 6px !important;
   }
-  [data-phase] [class*="_card"]:has(textarea) > :last-child > :first-child {
+  [data-phase] [data-composer-card="true"] > [class$="_row"] > :first-child {
     gap: 8px !important;
+    min-width: 0 !important;
   }
-  [data-phase] [class*="_card"]:has(textarea) > :last-child > :first-child > :nth-child(2) {
-    flex: 0 0 auto !important;
+  [data-phase] [data-composer-card="true"] > [class$="_row"] > :first-child > :nth-child(2) {
+    flex: 0 1 auto !important;
+    min-width: 0 !important;
   }
-  [data-phase] [class*="_card"]:has(textarea) > :last-child > :last-child {
-    flex: 1 1 auto !important;
+  [data-phase] [data-composer-card="true"] > [class$="_row"] > :last-child {
+    flex: 1 1 0 !important;
     min-width: 0 !important;
+    gap: 6px !important;
+  }
+
+  /* --- Composer popups as bottom sheets on mobile ---
+     Two composer-anchored popups break on phones (field: bottom + side
+     cut, only part of the popup visible):
+     1. the model pill menu ([role=menu], max 360px, opens upward from the
+        pill inside the composer card);
+     2. the "/" command palette (max 320px card with the search box — it
+        hosts the /model popupSelect list: search + provider-grouped rows).
+     Both are position:absolute INSIDE the conversation scrollBody
+     (overflow:hidden) and the shell center column (overflow:hidden), so
+     the scroll containers clip them mid-list. Forensics showed neither
+     layer creates a containing block (no transform/contain/will-change),
+     so on mobile we snap whichever popup is open to a viewport-anchored
+     sheet: fixed positioning escapes the scroll clip entirely, width is
+     deterministic, safe-area keeps it off the gesture bar. A transient
+     picker covering the composer is standard mobile UX; selection or an
+     outside tap still dismisses it. */
+  [data-phase] [class$="_root"]:has(> [aria-haspopup="menu"]) > [role="menu"],
+  [data-phase] [class$="_card"]:has(> [class$="_search"]) {
+    position: fixed !important;
+    left: 12px !important;
+    right: 12px !important;
+    top: auto !important;
+    bottom: calc(env(safe-area-inset-bottom, 0px) + 12px) !important;
+    width: auto !important;
+    min-width: 0 !important;
+    max-width: none !important;
+    max-height: min(65vh, 480px) !important;
+    max-height: min(65dvh, 480px) !important;
+    z-index: 130 !important;
+    border-radius: 14px !important;
+    box-shadow: 0 -4px 28px rgba(0, 0, 0, .18) !important;
   }
 
   /* --- Session header on mobile ---
@@ -363,14 +414,22 @@ export const MOBILE_CSS = `
        header > :first-child                   titleRow (titleCluster + utilities)
        header > :first-child > :last-child     headerUtilities (Session log seat) */
   [data-phase] header {
-    padding-right: 12px !important;
+    padding: 8px 12px 0 !important;
   }
-  /* Give the title row a lane clear of the absolutely-placed toggle, then
-     balance the header: with header padding-right 12px, a 20px left
-     padding puts the title's geometric center exactly on the viewport
-     center (measured 195/195 at 390px). */
+  /* The directory and Files controls are absolutely positioned, so reserve
+     their lanes and let the title use the remaining width without squeezing. */
   [data-phase] header > :first-child {
-    padding-left: 20px !important;
+    min-height: 36px !important;
+    padding: 0 32px !important;
+  }
+  [data-phase] header [class$="_titleCluster"],
+  [data-phase] header [class$="_crumbs"] {
+    min-width: 0 !important;
+  }
+  [data-phase] header button[class*="_crumb"] {
+    max-width: calc(100vw - 104px) !important;
+    padding-left: 0 !important;
+    padding-right: 0 !important;
   }
   /* The directory toggle sits at the far left of the header (the header
      is position:relative; the data-slot wrappers are display:contents). */

package/lib/index.js

@@ -15,7 +15,7 @@ import { readFileSync, mkdirSync, writeFileSync } from 'node:fs';
 import { writeFile, readFile, mkdir, rm } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
-import { randomBytes } from 'node:crypto';
+import { randomBytes, randomInt } from 'node:crypto';
 
 import { createPocketService } from './service.mjs';
 import { installPocketRpc } from './web-rpc.js';
@@ -65,8 +65,15 @@ function readPin(p) {
   } catch { /* 无文件 */ }
   return null;
 }
+/**
+ * 生成 8 位访问 PIN（issue #90）。
+ * 必须用 CSPRNG。语言内置的非加密随机数（V8 的 xorshift128+）是可预测的：拿到少量
+ * 输出即可还原内部状态并推算后续值——用它生成访问密码，等于把 9×10⁷ 的搜索空间
+ * 进一步压缩。`randomInt(min, max)` 上界开区间，取值 10000000..99999999。
+ * test/auth-routing.test.js 有源码守卫，禁止这里再出现非加密随机数调用。
+ */
 function newPin() {
-  return String(Math.floor(10000000 + Math.random() * 90000000));
+  return String(randomInt(10_000_000, 100_000_000));
 }
 
 // --- 公网密码 ---

package/lib/proxy.mjs

@@ -14,7 +14,7 @@
 import { createServer } from 'node:http';
 import { request as httpRequest } from 'node:http';
 import { createGzip, createBrotliCompress, constants as zlibConstants } from 'node:zlib';
-import { createHash } from 'node:crypto';
+import { createHash, timingSafeEqual } from 'node:crypto';
 
 const DEFAULT_UPSTREAM = { host: '127.0.0.1', port: 3080 };
 
@@ -66,8 +66,75 @@ function isCompressed(headers) {
   return /(^|,\s*)(gzip|br|deflate)(\s*,|$)/i.test(String(headers['content-encoding'] ?? ''));
 }
 
-/** 默认注入到经代理的 HTML 文档里：crypto.randomUUID polyfill（非安全上下文必需）。 */
-export const DEFAULT_INJECT = RANDOM_UUID_POLYFILL;
+/**
+ * DSH 客户端信任环境补丁（issue #58 的可行修法）：
+ * 手机/局域网浏览器访问时 location.hostname 不是回环地址，dsh-client-connection 据此
+ * 把 ctx.connection.isLoopback 判定为 false，dsh-client-ui-settings 便把 settings 镜像
+ * 置为 memory 模式（不拉取 settings.describe），模型/通用设置页于是报
+ * "settings are unavailable in this browser"（issue #58）。
+ *
+ * 与已回退的「全局 let location + Proxy」伪装方案不同，本补丁**不碰 location**——
+ * 它包装 window.__ModuleLoader__，在 dsh-client-connection 模块向 Cordis 容器
+ * provide('connection') 时把服务句柄的 isLoopback 强制为 true。经本代理（带 PIN 鉴权、
+ * 请求头已回环化）的远程访问由此获得与本机一致的完整设置能力，会话列表回归不存在。
+ *
+ * 关键细节：HTML 只预加载 client-modules/client-runtime 两个 bundle（队列模式注册）；
+ * connection 等插件 bundle 是 create() 启动后由加载器**动态**加载的，而 create() 会把
+ * facade.load 整体替换为 live 注册函数。因此不能只包一次 load 函数——必须在 facade
+ * 对象上把 load 装成访问器（getter/setter），每次赋值（队列→live 切换）都重新包装。
+ */
+const LOOPBACK_ENV_PATCH = `<script data-dsh-pocket-loopback-patch="1">!function(){try{
+var ml=window.__ModuleLoader__;
+function wrapFactory(h){
+  var of=h.factory;
+  h.factory=function(r){
+    var exp=of.apply(this,arguments);
+    if(exp&&typeof exp.apply==='function'){
+      var oa=exp.apply;
+      exp.apply=function(ctx){
+        var op=ctx&&ctx.provide;
+        if(typeof op==='function'){
+          ctx.provide=function(n,v){
+            if(n==='connection'&&v&&typeof v==='object'){
+              try{Object.defineProperty(v,'isLoopback',{value:true,writable:true,configurable:true});}catch(e){v.isLoopback=true;}
+            }
+            return op.apply(this,arguments);
+          };
+        }
+        return oa.apply(this,arguments);
+      };
+    }
+    return exp;
+  };
+}
+function wrapLoad(fn){
+  return function(h){
+    if(h&&h.id&&String(h.id).indexOf('connection')!==-1&&typeof h.factory==='function'){wrapFactory(h);}
+    return fn.call(this,h);
+  };
+}
+function wrapFacade(facade){
+  if(!facade||facade._dsh_p_w)return facade;
+  var current=wrapLoad(facade.load);
+  try{
+    Object.defineProperty(facade,'load',{
+      configurable:true,
+      get:function(){return current;},
+      set:function(fn){current=wrapLoad(fn);}
+    });
+  }catch(e){facade.load=current;}
+  facade._dsh_p_w=true;
+  return facade;
+}
+if(ml){wrapFacade(ml);}
+else{
+  var cur=undefined;
+  Object.defineProperty(window,'__ModuleLoader__',{configurable:true,enumerable:true,get:function(){return cur;},set:function(v){cur=wrapFacade(v);}});
+}
+}catch(e){}}();</script>`;
+
+/** 默认注入到经代理的 HTML 文档里：polyfill + loopback 信任环境补丁（issue #58）。 */
+export const DEFAULT_INJECT = RANDOM_UUID_POLYFILL + LOOPBACK_ENV_PATCH;
 
 /**
  * DSH Desktop advanced 模式不支持的提示覆盖层（issue #19）。
@@ -230,6 +297,52 @@ function isProtectedHost(host, isProtected) {
   return isProtected ? isProtected(host) : classifyHost(host) === 'public';
 }
 
+/** 保护强度序：本机最弱（可免密）→ 局域网（按开关）→ 公网（永远要密码）。 */
+const HOST_CLASS_RANK = { loopback: 0, lan: 1, public: 2 };
+
+/**
+ * 按 TCP 源地址给出来源类别（issue #90）。
+ * 与 classifyHost 的区别在**兜底方向**：Host 头里认不出的形态按 loopback 处理
+ * （历史行为，避免裸 IPv6 之类把本机访问判成公网）；而源地址认不出时必须按
+ * public 处理——源地址是我们唯一不可伪造的信息，兜底方向错了整条防线就白搭。
+ * @returns {'loopback'|'lan'|'public'|null} null 表示拿不到源地址（不做任何收紧）
+ */
+export function classifySource(addr) {
+  let a = String(addr ?? '').trim().toLowerCase();
+  if (!a) return null;
+  if (a.startsWith('::ffff:')) a = a.slice(7); // IPv4-mapped IPv6（Node 双栈监听时常见）
+  if (a === '::1' || /^127\./.test(a)) return 'loopback';
+  // RFC1918 私网 + CGNAT 100.64/10（与 classifyHost 保持同一套网段判定）
+  if (/^(?:10\.|192\.168\.|172\.(?:1[6-9]|2\d|3[01])\.|100\.(?:6[4-9]|[7-9]\d|1(?:0\d|1\d|2[0-7]))\.)/.test(a)) return 'lan';
+  if (/^169\.254\./.test(a)) return 'lan';            // IPv4 link-local
+  if (/^(?:fe80:|f[cd][0-9a-f]{2}:)/.test(a)) return 'lan'; // IPv6 link-local / ULA
+  return 'public';
+}
+
+/**
+ * 用于策略判定的 Host（issue #90 第 7 条）。
+ *
+ * Host 头完全由客户端控制：能直连代理端口的人只要写 `Host: 127.0.0.1:3081`
+ * 就会被 classifyHost 判成本机，从而绕过局域网开关和局域网密码——用户若按
+ * README 关掉了局域网密码，这就是一条零认证通道。TCP 源地址无法伪造，用它给
+ * Host 声明设一个下限。
+ *
+ * **只收紧、绝不放松**：经 cloudflared 隧道进来的公网请求源地址正是 127.0.0.1，
+ * 若按源地址覆盖就会把公网访问降级成本机免密，比原来的问题更严重。所以仅当
+ * 声明的保护级别**低于**来源真实级别时，才改用源地址参与判定。
+ */
+export function policyHost(req, host) {
+  const actual = classifySource(req?.socket?.remoteAddress);
+  if (!actual) return host;
+  const claimed = classifyHost(host);
+  if (HOST_CLASS_RANK[actual] <= HOST_CLASS_RANK[claimed]) return host;
+  // 用真实源地址替代被伪造的 Host 参与后续全部策略判定（密码归属、局域网开关、
+  // 局域网地址覆盖），保证各处判定看到的是同一个来源。
+  let addr = String(req.socket.remoteAddress);
+  if (addr.toLowerCase().startsWith('::ffff:')) addr = addr.slice(7);
+  return addr;
+}
+
 /**
  * 该 Host 是否 loopback（本机 / cloudflared 回环）。
  * 「关闭局域网」只拦截经局域网 IP/主机名访问的请求，loopback 与公网（trycloudflare）放行：
@@ -296,7 +409,42 @@ code{background:#f3f4f6;padding:2px 6px;border-radius:6px;font-size:12px;color:#
 /** 请求是否期望 HTML（浏览器导航 → 返回登录页；API/WS → 401）。 */
 function isHtmlRequest(req) {
   const accept = String(req.headers.accept ?? '');
-  return accept.includes('text/html') || req.url === '/' || /\.html?$/i.test(String(req.url));
+  if (accept.includes('text/html')) return true;
+  const url = String(req.url ?? '');
+  // 按 pathname 判断，别用 `url === '/'` 严格比 —— 根路径常带 query
+  // （`/?dsh-pocket-auth=1`、`/?dsh-pocket-retry=1`、`/?token=…`），
+  // 那些同样是浏览器导航，漏判会让它们拿到 401/303 而不是该给的页面。
+  let pathname = url;
+  try { pathname = new URL(url || '/', 'http://dsh.invalid').pathname; } catch { /* 用原值兜底 */ }
+  return pathname === '/' || /\.html?$/i.test(pathname);
+}
+
+/**
+ * 常量时间的密码比较（issue #90）：普通 `===` 会在首个不同字节处提前返回，
+ * 理论上可被计时侧信道逐字节还原 PIN。长度不同直接判否（PIN 长度固定，
+ * 长度本身不是秘密），等长则走 timingSafeEqual。
+ */
+function safeEqual(a, b) {
+  const ba = Buffer.from(String(a ?? ''), 'utf8');
+  const bb = Buffer.from(String(b ?? ''), 'utf8');
+  if (ba.length !== bb.length) return false;
+  return timingSafeEqual(ba, bb);
+}
+
+/**
+ * 请求是否携带 `?token=` —— 用于区分「一次密码尝试」与「普通未认证访问」（issue #90）。
+ * 只有前者计入限速失败：普通未认证访问（无 cookie 无 token）本来就该看到登录页，
+ * 若也计数，正常用户第一次打开页面就会把自己锁死（子资源还会放大）。
+ * cookie 不匹配同样不计数——cookie 值是 sha256(PIN:sessionKey)，攻击者不知道
+ * 进程级 sessionKey，这条通道本身不可穷举；而 dsh web 重启后旧 cookie 必然失配，
+ * 计数只会误锁老用户。
+ */
+function hasQueryToken(req) {
+  try {
+    return new URL(req.url ?? '/', 'http://x').searchParams.get('token') != null;
+  } catch {
+    return false;
+  }
 }
 
 /** 校验请求是否已认证。返回 { ok, rawQueryToken }：
@@ -309,7 +457,7 @@ function authCheck(req, tokens, sessionKey) {
   const cookieTok = cookies[TOKEN_COOKIE];
   if (cookieTok) {
     for (const token of list) {
-      if (cookieTok === cookieFor(token, sessionKey)) return { ok: true, rawQueryToken: null };
+      if (safeEqual(cookieTok, cookieFor(token, sessionKey))) return { ok: true, rawQueryToken: null };
     }
   }
   const qTok = new URL(req.url ?? '/', 'http://x').searchParams.get('token');
@@ -319,7 +467,7 @@ function authCheck(req, tokens, sessionKey) {
     // 种 HttpOnly 哈希 cookie，让浏览器后续子资源（assets/*.js 等）也走 cookie
     // 路径——避免「主页 200 但子资源 401」白屏（issue #35）。
     for (const token of list) {
-      if (qTok === token) return { ok: true, rawQueryToken: qTok };
+      if (safeEqual(qTok, token)) return { ok: true, rawQueryToken: qTok };
     }
   }
   return { ok: false, rawQueryToken: null };
@@ -346,13 +494,37 @@ function maybeSeedAuthCookie(req, res, rawToken, sessionKey) {
   };
 }
 
-/** 把浏览器可见的权威改写成 loopback 权威（Host 和 Origin 都改）。 */
+/**
+ * 把浏览器可见的权威改写成 loopback 权威。
+ * 除 Host/Origin 外，还必须规范化 Referer 与 Sec-Fetch-Site：DSH 宿主的特权方法
+ * 栅栏（settings.describe/credentials.* 等 PRIVILEGED_METHODS）会拒绝
+ * sec-fetch-site === 'cross-site'，并校验 Origin 与 Host 匹配；远程访问的这两个头
+ * 若不改写，设置/凭据平面会在宿主侧被 403（issue #58 的另一半）。
+ * 统一小写化键名，避免 Node 原样转发时大小写键并存导致重复头。
+ */
 function loopbackAuthority(headers, upstream) {
   const authority = `${upstream.host}:${upstream.port}`;
-  headers.Host = authority;
-  if (headers.origin) headers.origin = `http://${authority}`;
-  if (headers.Origin) headers.Origin = `http://${authority}`;
-  return headers;
+  const out = {};
+  for (const [k, v] of Object.entries(headers)) {
+    const lk = k.toLowerCase();
+    if (lk === 'host' || lk === 'origin' || lk === 'referer' || lk === 'sec-fetch-site') continue;
+    out[lk] = v;
+  }
+  out.host = authority;
+  out.origin = `http://${authority}`;
+  const referer = headers.referer ?? headers.Referer;
+  if (referer) {
+    try {
+      const ref = new URL(referer);
+      ref.protocol = 'http:';
+      ref.host = authority;
+      out.referer = ref.toString();
+    } catch {
+      out.referer = `http://${authority}/`;
+    }
+  }
+  out['sec-fetch-site'] = 'same-origin';
+  return out;
 }
 
 // ---------- dsh web 浏览器会话 token（issue #77） ----------
@@ -407,6 +579,101 @@ export function upstreamPathWithLaunchToken(reqUrl, method, cookieHeader, launch
   return `${u.pathname}${u.search}`;
 }
 
+// ---------- 会话握手重试计数（issue #91） ----------
+// Safari（iOS/macOS）不持久化「http:// + 纯 IP 源」上由 3xx 响应下发的 cookie，
+// 于是 dsh web 的 launch-token→cookie 握手永远收敛不了：代理每次 `GET /`
+// 都补 `?token=`，上游每次 303 回 `/`，浏览器每次都不带 cookie → 无限重定向
+// （Safari 报「发生了太多重定位」）。
+//
+// 两道防线：
+//   1) 代理把这次 303 改写成 200 过渡页（Set-Cookie 照发 + meta refresh 跳回 `/`），
+//      200 响应上的 cookie 不会被 Safari 的重定向 cookie 策略丢掉；
+//   2) 万一 1) 也不管用，用下面的计数器在若干次尝试后停止注入 token 并给出
+//      可操作提示页——宁可给用户一句人话，也不要无限转圈。
+//
+// 只按客户端 IP 计数（无需 cookie 支持，正适合「cookie 用不了」的这个场景）。
+export const DEFAULT_HANDSHAKE_LIMIT = 3;
+export const HANDSHAKE_WINDOW_MS = 60_000;
+/** 提示页「重试」按钮用的查询参数：命中即清空该 IP 的失败计数，且不往上游透传。 */
+export const HANDSHAKE_RETRY_PARAM = 'dsh-pocket-retry';
+
+/** 摘掉某个查询参数后重新拼路径；解析失败或本来就没有则原样返回。 */
+export function stripQueryParam(reqUrl, name) {
+  let u;
+  try { u = new URL(reqUrl ?? '/', 'http://dsh.invalid'); } catch { return reqUrl; }
+  if (!u.searchParams.has(name)) return reqUrl;
+  u.searchParams.delete(name);
+  return `${u.pathname}${u.search}`;
+}
+
+export function createHandshakeTracker({ max = DEFAULT_HANDSHAKE_LIMIT, windowMs = HANDSHAKE_WINDOW_MS } = {}) {
+  /** ip -> { count, start } */
+  const hits = new Map();
+  return {
+    /** 记一次握手注入，返回窗口内的累计次数。 */
+    record(ip, now = Date.now()) {
+      const rec = hits.get(ip);
+      if (!rec || now - rec.start > windowMs) {
+        hits.set(ip, { count: 1, start: now });
+        return 1;
+      }
+      rec.count += 1;
+      return rec.count;
+    },
+    /** 握手成功（拿到会话 cookie 的请求）→ 清零。 */
+    clear(ip) {
+      hits.delete(ip);
+    },
+    /** 该 IP 是否已达重试上限。 */
+    exhausted(ip) {
+      const rec = hits.get(ip);
+      return !!rec && rec.count >= max;
+    },
+    /** 清理过期条目，防长期运行内存膨胀。 */
+    prune(now = Date.now()) {
+      for (const [ip, rec] of hits) {
+        if (now - rec.start > windowMs) hits.delete(ip);
+      }
+    },
+  };
+}
+
+/** 握手过渡页：200 + Set-Cookie（由调用方带上）+ meta refresh 跳回干净根路径。 */
+export function handshakePageHtml() {
+  return `<!doctype html><html lang="zh"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<meta http-equiv="refresh" content="0; url=/">
+<title>DSH Pocket · 正在进入 | opening…</title>
+<style>
+body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#f3f4f6;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif}
+p{font-size:13px;color:#6b7280;margin:0}
+</style></head><body><p>正在进入… | opening…</p></body></html>`;
+}
+
+/** 握手反复失败时的提示页（issue #91）：说清原因并给出可操作的规避办法。 */
+export function handshakeBlockedPageHtml() {
+  return `<!doctype html><html lang="zh"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>DSH Pocket · 无法完成登录握手</title>
+<style>
+body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#f3f4f6;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif}
+.card{background:#fff;border:1px solid #e5e7eb;border-radius:12px;padding:24px 22px;max-width:380px;width:calc(100% - 40px)}
+h1{font-size:15px;margin:0 0 10px;color:#111827}
+p{font-size:13px;color:#6b7280;margin:0 0 10px;line-height:1.7}
+code{background:#f3f4f6;padding:1px 5px;border-radius:4px;font-size:12px}
+a{color:#4f6ef7}
+</style></head><body><div class="card">
+<h1>🔁 无法完成登录握手</h1>
+<p>浏览器没有保存 DSH 下发的会话 cookie，代理反复重试后仍未成功，因此停在这里而不是无限跳转。</p>
+<p><strong>Safari（iOS/macOS）</strong> 在 <code>http://</code> 纯 IP 地址上不会保存这类 cookie，局域网入口因此进不去。</p>
+<p>可以试试：<br>
+① 换 Chromium 系浏览器（Chrome / Edge）打开局域网地址；<br>
+② 改用<strong>公网入口</strong>（设置页开启公网访问，拿到 <code>https://…trycloudflare.com</code> 地址）——HTTPS 域名上 Safari 正常。</p>
+<p style="margin-top:14px"><a href="/?${HANDSHAKE_RETRY_PARAM}=1" style="display:inline-block;padding:8px 14px;background:#4f6ef7;color:#fff;border-radius:8px;text-decoration:none;font-size:13px">重试一次 | Retry</a></p>
+<p style="color:#9ca3af;font-size:12px">Browser did not keep the session cookie, so the login handshake could not complete (issue #91). Safari over plain <code>http://</code> + IP is the known case — try Chrome, or use the public HTTPS entry.</p>
+</div></body></html>`;
+}
+
 // ---------- WebSocket 心跳注入（PR #41，issue #29） ----------
 // DSH 客户端与宿主的 WebSocket downlink 都不发 ping/pong（客户端只读流、
 // 宿主只推帧），空闲连接会被路由器 NAT 空闲超时或手机系统省电机制**静默**
@@ -478,10 +745,16 @@ function attachWebSocketHeartbeat(socket, { intervalMs = 30_000, missLimit = 2 }
  * @param {() => boolean} [opts.lanAccessEnabled] 局域网访问是否开启（默认开启）。关闭时拦截经局域网 Host 的请求（公网/loopback 不受影响）。
  * @returns {Promise<{server:import('node:http').Server, close:()=>Promise<void>}>}
  */
-export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DEFAULT_UPSTREAM, log = null, injectHtml = DEFAULT_INJECT, auth = null, rateLimit = null, heartbeat = {}, lanAccessEnabled = () => true, launchToken = () => '' } = {}) {
+export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DEFAULT_UPSTREAM, log = null, injectHtml = DEFAULT_INJECT, auth = null, rateLimit = null, heartbeat = {}, lanAccessEnabled = () => true, launchToken = () => '', handshakeLimit } = {}) {
   const limiter = auth ? createRateLimiter(rateLimit ?? {}) : null;
+  // 会话握手重试计数（issue #91）：Safari 在 http://IP 源上丢 3xx 的 cookie → 死循环
+  const handshake = createHandshakeTracker(
+    typeof handshakeLimit === 'number' ? { max: handshakeLimit } : {},
+  );
   const server = createServer((req, res) => {
-    const host = String(req.headers.host ?? '');
+    // 策略判定一律用 policyHost（issue #90）：Host 头可伪造，用不可伪造的 TCP 源地址
+    // 给它设下限。转发给上游的 Host 由 loopbackAuthority 单独改写，不受这里影响。
+    const host = policyHost(req, String(req.headers.host ?? ''));
     const isPublic = classifyHost(host) === 'public';
     // 局域网访问关闭（issue #54）：拦截经局域网 IP/主机名访问的请求；
     // 公网（含任意非内网 Host——issue #66 fail closed）与 loopback（本机/cloudflared 回连）放行，
@@ -541,8 +814,35 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
           });
           return;
         }
+        // `?token=<PIN>` 是与 POST 登录等价的一次密码尝试（issue #90）：此前只有 POST
+        // 分支调用 limiter.record()，这条通道既不计数也不受锁定约束，等于给攻击者留了
+        // 一个可全速穷举 8 位 PIN 的旁路。下面把它并入同一套限速。
+        const isGuess = hasQueryToken(req);
+        if (isGuess) {
+          const rl = limiter?.status(ip) ?? { locked: false, retryAfter: 0 };
+          // 锁定期内直接拒绝、不做比对——否则锁定窗口本身就是免费的穷举窗口。
+          // 正确密码也一并拒绝，与 POST 登录的锁定语义保持一致。
+          if (rl.locked) {
+            if (isHtmlRequest(req)) {
+              res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
+              res.end(loginPageHtml('locked', isPublic, rl.retryAfter));
+            } else {
+              res.writeHead(429, {
+                'content-type': 'application/json',
+                'cache-control': 'no-store',
+                'retry-after': String(rl.retryAfter),
+              });
+              res.end('{"error":"too-many-attempts"}');
+            }
+            return;
+          }
+        }
         const authResult = authCheck(req, acceptedTokens, sessionKey);
         if (!authResult.ok) {
+          if (isGuess) {
+            limiter?.record(ip);
+            log?.(`dsh-pocket: bad ?token= from ${ip} | URL 密码错误 IP: ${ip}`);
+          }
           if (isHtmlRequest(req)) {
             // 锁定期间打开登录页也给提示（HTTP 200 + 锁定文案；429 语义留给 POST 拒绝）
             const rl = limiter?.status(ip) ?? { locked: false, retryAfter: 0 };
@@ -555,24 +855,74 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
           return;
         }
         // ?token=<原始 PIN> 直达时种 HttpOnly cookie，让浏览器后续子资源也走 cookie 路径（issue #35）
-        if (authResult.rawQueryToken) maybeSeedAuthCookie(req, res, authResult.rawQueryToken, sessionKey);
+        if (authResult.rawQueryToken) {
+          limiter?.clear(ip); // 与 POST 登录成功一致：正确的分享链接不该逐步累积到锁定
+          maybeSeedAuthCookie(req, res, authResult.rawQueryToken, sessionKey);
+        }
       }
     }
     const headers = loopbackAuthority({ ...req.headers }, upstream);
     // dsh web 浏览器会话 token（issue #77）：首屏根路径补一次，换回绑定 authority 的 cookie
     const launchTok = (typeof launchToken === 'function' ? launchToken() : '') || '';
     // 先清掉历史遗留的 dsh-desktop-* 参数（issue #75），再补 launch token
-    const upstreamPath = upstreamPathWithLaunchToken(
-      stripDesktopMarkers(req.url),
-      req.method,
-      req.headers.cookie,
-      launchTok,
-    );
+    // 握手重试上限（issue #91）：Safari 不保存 http://IP 源上 3xx 下发的 cookie →
+    // 补 token → 上游 303 → 浏览器仍无 cookie → 无限循环。达到上限就别再补了，
+    // 让请求落到提示页，而不是继续转圈。
+    const handshakeIp = clientIp(req);
+    // `/?dsh-pocket-retry=1`：提示页上的「重试」入口——清掉这一轮的失败计数，让握手
+    // 重新走一遍（否则用户得干等窗口过期）。这参数是我们自己加的，不往上游透传。
+    let cleanPath = stripDesktopMarkers(req.url);
+    if (cleanPath.includes(HANDSHAKE_RETRY_PARAM)) {
+      handshake.clear(handshakeIp);
+      cleanPath = stripQueryParam(cleanPath, HANDSHAKE_RETRY_PARAM);
+    }
+    const handshakeOver = launchTok !== '' && handshake.exhausted(handshakeIp);
+    const upstreamPath = handshakeOver
+      ? cleanPath
+      : upstreamPathWithLaunchToken(cleanPath, req.method, req.headers.cookie, launchTok);
+    const didInjectToken = upstreamPath !== cleanPath;
+    if (didInjectToken) {
+      handshake.record(handshakeIp);
+      handshake.prune();
+    }
+    // 请求带上了会话 cookie → 这一轮的握手计数可以清掉了（说明 cookie 通路是好的）
+    if (!didInjectToken && String(req.headers.cookie ?? '').includes(DSH_AUTH_COOKIE)) {
+      handshake.clear(handshakeIp);
+    }
+    if (handshakeOver && isHtmlRequest(req)) {
+      // 已判定握不上手 → 停在这里给人话，别再转圈。API/WS 不走这里（上游会 401）。
+      res.writeHead(503, {
+        'content-type': 'text/html; charset=utf-8',
+        'cache-control': 'no-store',
+        'x-dsh-pocket-handshake': 'blocked',
+      });
+      res.end(handshakeBlockedPageHtml());
+      return;
+    }
     const proxyReq = httpRequest(
       { host: upstream.host, port: upstream.port, method: req.method, path: upstreamPath, headers, agent: false },
       (proxyRes) => {
         log?.(`${req.method} ${req.url} -> ${proxyRes.statusCode}`);
         const contentType = String(proxyRes.headers['content-type'] ?? '');
+        // issue #91：我们刚注入了 launch token，上游回 303（换 cookie 后回干净根路径）。
+        // Safari 不保存 http://IP 源上 3xx 响应下发的 cookie，于是浏览器下次仍无 cookie
+        // → 代理再注入 → 再 303 → 死循环。这里把这次 303 改成 200 过渡页：Set-Cookie
+        // 照发（200 上的 cookie 不会被那条重定向策略丢掉），页面用 meta refresh 跳回 `/`。
+        if (didInjectToken && proxyRes.statusCode === 303 && isHtmlRequest(req)) {
+          const out = { ...proxyRes.headers };
+          delete out['content-length'];
+          delete out['transfer-encoding'];
+          delete out.location; // 自己跳，不留给浏览器去重做一次 303
+          const page = Buffer.from(handshakePageHtml(), 'utf8');
+          out['content-type'] = 'text/html; charset=utf-8';
+          out['content-length'] = String(page.length);
+          out['cache-control'] = 'no-store';
+          out['x-dsh-pocket-handshake'] = 'transition';
+          proxyRes.resume(); // 消费掉上游响应体，释放连接
+          res.writeHead(200, out);
+          res.end(page);
+          return;
+        }
         // issue #81：上游 desktop-browser-access 门禁（DSH Desktop 未开启「浏览器访问」时）
         // 对普通浏览器（含经本代理转发的手机）返回 403 text/plain "forbidden"，且本代理无法
         // 携带 Electron renderer secret 绕过。对符合该特征的**浏览器导航**请求改写为可操作
@@ -625,6 +975,13 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
             delete outHeaders['content-length'];
             delete outHeaders['transfer-encoding'];
             outHeaders['content-length'] = String(out.length);
+            // 注入后的 HTML 携带本代理的动态补丁（含注入标记判重），
+            // 必须禁用缓存——否则手机/中间层（nginx 等）拿到没有补丁的旧
+            // 文档后，isLoopback 修复不生效且难以排查（表现为"改了没效果"）。
+            outHeaders['cache-control'] = 'no-store';
+            delete outHeaders['etag'];
+            delete outHeaders['last-modified'];
+            delete outHeaders['expires'];
             res.writeHead(proxyRes.statusCode ?? 200, outHeaders);
             res.end(out);
           });
@@ -684,7 +1041,8 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
 
   // WebSocket upgrade（DSH 的 /api/events.mux + events.host 流式通道）原样透传
   server.on('upgrade', (req, socket, head) => {
-    const host = String(req.headers.host ?? '');
+    // 与 HTTP 侧同一套判定（issue #90）：否则伪造 Host 的 WS 握手仍可绕过局域网开关
+    const host = policyHost(req, String(req.headers.host ?? ''));
     const isPublic = classifyHost(host) === 'public';
     // 局域网访问关闭：拦截经局域网 Host 的 WS 握手（公网/loopback 放行——issue #66 fail closed）
     if (!isPublic && !isLoopbackHost(host) && !lanAccessEnabled()) {
@@ -697,12 +1055,29 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
       const token = isProtectedHost(host, auth.isProtected) ? (auth.getToken?.(host) ?? null) : null;
       const altTokens = token && typeof auth.getAltTokens === 'function' ? (auth.getAltTokens(host) ?? []) : [];
       const acceptedTokens = token ? [token, ...altTokens] : [];
+      // WS 握手上的 ?token= 与 HTTP 侧同权（issue #90）：不并入限速的话，攻击者
+      // 只要把穷举换到 upgrade 请求上就照样不受限。
+      const wsIp = clientIp(req);
+      const wsGuess = hasQueryToken(req);
+      if (token && wsGuess) {
+        const rl = limiter?.status(wsIp) ?? { locked: false, retryAfter: 0 };
+        if (rl.locked) {
+          socket.write(`HTTP/1.1 429 Too Many Requests\r\nRetry-After: ${rl.retryAfter}\r\nConnection: close\r\n\r\n`);
+          socket.destroy();
+          return;
+        }
+      }
       const wsAuth = authCheck(req, acceptedTokens, auth.sessionKey ?? null);
       if (token && !wsAuth.ok) {
+        if (wsGuess) {
+          limiter?.record(wsIp);
+          log?.(`dsh-pocket: bad ws ?token= from ${wsIp} | WS 密码错误 IP: ${wsIp}`);
+        }
         socket.write('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
         socket.destroy();
         return;
       }
+      if (token && wsAuth.ok && wsGuess) limiter?.clear(wsIp);
     }
     const headers = loopbackAuthority({ ...req.headers }, upstream);
     const proxyReq = httpRequest({

package/package.json

@@ -80,5 +80,5 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "version": "2.10.0"
+  "version": "2.10.2"
 }