dsh-pocket 2.9.0 → 2.10.0

package/client/client.js

@@ -503,85 +503,6 @@ function startFileGuard(readFile) {
   };
 }
 
-// client/mobile/sessionGuard.ts
-var SESSION_META = "dsh-pocket-session";
-function readFingerprint() {
-  const meta = document.querySelector(`meta[name="${SESSION_META}"]`);
-  const fp = meta?.content?.trim();
-  return fp && fp.length > 0 ? fp : null;
-}
-function mountBadge(fp) {
-  const badge = document.createElement("div");
-  badge.setAttribute("data-mobile-nav", "session-fp");
-  badge.textContent = `\u{1F512} \u4F1A\u8BDD\u6307\u7EB9 ${fp}`;
-  badge.style.cssText = [
-    "position:fixed",
-    "left:50%",
-    "bottom:8px",
-    "transform:translateX(-50%)",
-    "z-index:2147483646",
-    "padding:4px 10px",
-    "border-radius:999px",
-    "background:rgba(17,24,39,.82)",
-    "color:#fff",
-    'font:12px/1.4 -apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif',
-    "letter-spacing:.5px",
-    "pointer-events:none",
-    "user-select:none",
-    "white-space:nowrap"
-  ].join(";");
-  badge.title = "\u672C\u9875\u4F1A\u8BDD\u6307\u7EB9\uFF0C\u5E94\u4E0E\u7535\u8111\u300C\u624B\u673A\u8BBF\u95EE\u300D\u8BBE\u7F6E\u9875\u663E\u793A\u7684\u4E00\u81F4\uFF1B\u4E0D\u4E00\u81F4\u8BF4\u660E\u94FE\u63A5\u5DF2\u88AB\u4ED6\u4EBA\u590D\u7528";
-  document.body.appendChild(badge);
-  return () => badge.remove();
-}
-function mountWarning() {
-  const overlay = document.createElement("div");
-  overlay.setAttribute("data-mobile-nav", "session-warn");
-  overlay.style.cssText = [
-    "position:fixed",
-    "inset:0",
-    "z-index:2147483647",
-    "display:flex",
-    "align-items:center",
-    "justify-content:center",
-    "padding:24px",
-    "background:rgba(0,0,0,.72)",
-    "color:#fff",
-    'font:15px/1.7 -apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif',
-    "text-align:center"
-  ].join(";");
-  overlay.style.whiteSpace = "pre-line";
-  overlay.textContent = "\u26A0\uFE0F \u6B64\u9875\u9762\u4E0D\u662F\u4F60\u7684 DSH\uFF1A\u94FE\u63A5\u53EF\u80FD\u5DF2\u88AB\u4ED6\u4EBA\u590D\u7528\u3002\n\u8BF7\u52FF\u5728\u6B64\u8F93\u5165\u4EFB\u4F55\u5BC6\u7801\u3002\n\u8BF7\u91CD\u65B0\u5728\u7535\u8111\u300C\u624B\u673A\u8BBF\u95EE\u300D\u8BBE\u7F6E\u9875\u626B\u5F53\u524D\u4E8C\u7EF4\u7801\u3002";
-  document.documentElement.appendChild(overlay);
-  return () => overlay.remove();
-}
-function startSessionGuard() {
-  let cleanupBadge = null;
-  let cleanupWarn = null;
-  const evaluate = () => {
-    const fp = readFingerprint();
-    if (fp) {
-      cleanupWarn?.();
-      cleanupWarn = null;
-      if (!cleanupBadge) cleanupBadge = mountBadge(fp);
-    } else {
-      cleanupBadge?.();
-      cleanupBadge = null;
-      if (!cleanupWarn) cleanupWarn = mountWarning();
-    }
-  };
-  evaluate();
-  const timer = window.setTimeout(evaluate, 300);
-  const observer = new MutationObserver(evaluate);
-  observer.observe(document.documentElement, { childList: true, subtree: true });
-  return () => {
-    window.clearTimeout(timer);
-    observer.disconnect();
-    cleanupBadge?.();
-    cleanupWarn?.();
-  };
-}
-
 // client/mobile/mobile.css.ts
 var MOBILE_CSS = `
 /* ---------- base control styles (rendered at any width, hidden where unused) ---------- */
@@ -1740,11 +1661,6 @@ function mobileApply(ctx) {
     );
     return startFileGuard(readFile);
   }, "dsh-mobile-nav: file open guard + copy button + hide add-workspace (issue #17)");
-  ctx.effect(() => {
-    if (!narrow.matches) return () => {
-    };
-    return startSessionGuard();
-  }, "dsh-mobile-nav: session fingerprint guard (issue #82)");
   ctx.slots.inject("conversation.session.header.actions", () => ctx.slots.register({
     name: "conversation.session.header.actions",
     id: "mobile-nav-toggle",
@@ -1845,7 +1761,6 @@ var zh2 = {
   "wanPin": "\u{1F510} \u8BBF\u95EE\u5BC6\u7801\uFF1A{pin}\uFF08\u6BCF\u6B21\u5F00\u542F\u516C\u7F51\u53D8\u65B0\uFF1B\u624B\u673A\u6253\u5F00\u94FE\u63A5\u9700\u8F93\u5165\u6B64\u5BC6\u7801\uFF09",
   "wanPinCustom": "\u{1F510} \u8BBF\u95EE\u5BC6\u7801\uFF1A{pin}\uFF08\u81EA\u5B9A\u4E49\uFF0C\u5F00\u542F\u516C\u7F51\u4E0D\u518D\u81EA\u52A8\u6362\u65B0\uFF09",
   "wanEphemeralWarn": "\u26A0\uFE0F \u516C\u7F51\u94FE\u63A5\u4EC5\u5728\u672C\u6B21\u5F00\u542F\u671F\u95F4\u6709\u6548\uFF1A\u5173\u95ED\u6216\u91CD\u542F\u540E\u5931\u6548\uFF0C\u5E76\u53EF\u80FD\u88AB\u4ED6\u4EBA\u590D\u7528\u4E3A\u964C\u751F\u7F51\u7AD9\u3002\u8BF7\u52FF\u6536\u85CF\uFF0C\u6BCF\u6B21\u4ECE\u672C\u9875\u626B\u300C\u5F53\u524D\u300D\u4E8C\u7EF4\u7801\u3002\u9700\u8981\u56FA\u5B9A\u4E0D\u53D8\u7684\u5730\u5740\u8BF7\u7528\u4E0B\u65B9\u300C\u56FA\u5B9A\u57DF\u540D\u300D\u3002",
-  "wanSessionFp": "\u672C\u9875\u4F1A\u8BDD\u6307\u7EB9\uFF1A{fp}\uFF08\u624B\u673A\u767B\u5F55\u9875\u4F1A\u663E\u793A\u540C\u6837\u7684\uFF1B\u4E0D\u4E00\u81F4\u8BF4\u660E\u94FE\u63A5\u5DF2\u88AB\u4ED6\u4EBA\u590D\u7528\uFF0C\u8BF7\u52FF\u8F93\u5165\u5BC6\u7801\uFF09",
   "stopTunnel": "\u5173\u95ED\u516C\u7F51",
   "enable": "\u5F00\u542F\u516C\u7F51\u8BBF\u95EE",
   "opening": "\u5F00\u542F\u4E2D\u2026",
@@ -1942,7 +1857,6 @@ var en2 = {
   "wanPin": "\u{1F510} PIN: {pin} (changes each time the tunnel is enabled; required on the phone)",
   "wanPinCustom": "\u{1F510} PIN: {pin} (custom \u2014 not rotated on tunnel start)",
   "wanEphemeralWarn": '\u26A0\uFE0F The public link is valid only for this session: it stops working after you close or restart, and may be reused by someone else for an unrelated site. Do not bookmark it \u2014 scan the CURRENT QR code from this page each time. For a permanent address use "Fixed domain" below.',
-  "wanSessionFp": "Session fingerprint: {fp} (the phone login page shows the same; if it differs, the link has been reused \u2014 do not enter your PIN)",
   "stopTunnel": "Stop",
   "enable": "Enable anywhere",
   "opening": "Enabling\u2026",
@@ -2443,13 +2357,8 @@ function PocketSettingsTab({ rpcCall, t }) {
         "div",
         null,
         qrArea(status.tunnelQr, tunnelUrl, namedMode ? t("namedRunningHint") : t("wanHint")),
-        // 防钓鱼 / 别收藏（issue #82）：链接 ephemeral 提示 + 本次会话指纹交叉核对
+        // 防钓鱼 / 别收藏（issue #82）：公网链接仅本次有效、勿收藏提示
         (0, import_react2.createElement)("div", { style: { marginTop: 8, fontSize: 12, lineHeight: 1.5, borderLeft: "4px solid var(--dsw-alias-state-warn-primary,#b45309)", background: "var(--dsw-alias-bg-layer-2,#f3f4f6)", borderRadius: 8, padding: "8px 10px" } }, t("wanEphemeralWarn")),
-        status?.sessionFingerprint ? (0, import_react2.createElement)(
-          "div",
-          { style: { marginTop: 8, fontSize: 12, color: "var(--dsw-alias-label-secondary,#6b7280)", lineHeight: 1.5 } },
-          fmt(t, "wanSessionFp", { fp: status.sessionFingerprint })
-        ) : null,
         // 地址模式行（随机/固定；固定域名选中或编辑时高亮）
         row(
           t("modeLabel"),

package/client/index.jsx

@@ -487,11 +487,8 @@ function PocketSettingsTab({ rpcCall, t }) {
       tunnelUrl
         ? h('div', null,
           qrArea(status.tunnelQr, tunnelUrl, namedMode ? t('namedRunningHint') : t('wanHint')),
-          // 防钓鱼 / 别收藏（issue #82）：链接 ephemeral 提示 + 本次会话指纹交叉核对
+          // 防钓鱼 / 别收藏（issue #82）：公网链接仅本次有效、勿收藏提示
           h('div', { style: { marginTop: 8, fontSize: 12, lineHeight: 1.5, borderLeft: '4px solid var(--dsw-alias-state-warn-primary,#b45309)', background: 'var(--dsw-alias-bg-layer-2,#f3f4f6)', borderRadius: 8, padding: '8px 10px' } }, t('wanEphemeralWarn')),
-          status?.sessionFingerprint ? h('div', { style: { marginTop: 8, fontSize: 12, color: 'var(--dsw-alias-label-secondary,#6b7280)', lineHeight: 1.5 } },
-            fmt(t, 'wanSessionFp', { fp: status.sessionFingerprint }),
-          ) : null,
           // 地址模式行（随机/固定；固定域名选中或编辑时高亮）
           row(t('modeLabel'),
             h('span', { style: { display: 'inline-flex', gap: 6 } },

package/client/mobile/mobile-apply.tsx

@@ -4,7 +4,6 @@ import { MobileNavToggle } from './MobileNavToggle.tsx'
 import { MobileNavOverlay } from './MobileNavOverlay.tsx'
 import { MobileDrawerFooter } from './MobileDrawerFooter.tsx'
 import { startFileGuard } from './fileGuard.ts'
-import { startSessionGuard } from './sessionGuard.ts'
 import { MOBILE_CSS } from './mobile.css.ts'
 import { POCKET_RPC_CHANNEL, POCKET_ENDPOINTS } from '../api.js'
 import { NS, en, zh } from './locales.ts'
@@ -304,14 +303,6 @@ export function mobileApply(ctx): void {
     return startFileGuard(readFile)
   }, 'dsh-mobile-nav: file open guard + copy button + hide add-workspace (issue #17)')
 
-  // 公网会话指纹校验（issue #82，防密码被钓）：页面带指纹 meta 即我们的页面、
-  // 显示交叉核对徽标；不带则极可能不是我们的页面（链接被复用/克隆登录页钓鱼），
-  // 弹红屏警告并拦截交互。只挂窄屏（登录页是 server-render、无本脚本，主要靠
-  // 登录页与设置页的可见指纹做人工交叉核对；此层是应用页的兜底）。
-  ctx.effect(() => {
-    if (!narrow.matches) return () => {}
-    return startSessionGuard()
-  }, 'dsh-mobile-nav: session fingerprint guard (issue #82)')
 
   ctx.slots.inject('conversation.session.header.actions', () => ctx.slots.register({
     name: 'conversation.session.header.actions',

package/client/pocket-locales.js

@@ -71,7 +71,6 @@ export const zh = {
   'wanPin': '🔐 访问密码：{pin}（每次开启公网变新；手机打开链接需输入此密码）',
   'wanPinCustom': '🔐 访问密码：{pin}（自定义，开启公网不再自动换新）',
   'wanEphemeralWarn': '⚠️ 公网链接仅在本次开启期间有效：关闭或重启后失效，并可能被他人复用为陌生网站。请勿收藏，每次从本页扫「当前」二维码。需要固定不变的地址请用下方「固定域名」。',
-  'wanSessionFp': '本页会话指纹：{fp}（手机登录页会显示同样的；不一致说明链接已被他人复用，请勿输入密码）',
   'stopTunnel': '关闭公网',
   'enable': '开启公网访问',
   'opening': '开启中…',
@@ -170,7 +169,6 @@ export const en = {
   'wanPin': '🔐 PIN: {pin} (changes each time the tunnel is enabled; required on the phone)',
   'wanPinCustom': '🔐 PIN: {pin} (custom — not rotated on tunnel start)',
   'wanEphemeralWarn': '⚠️ The public link is valid only for this session: it stops working after you close or restart, and may be reused by someone else for an unrelated site. Do not bookmark it — scan the CURRENT QR code from this page each time. For a permanent address use "Fixed domain" below.',
-  'wanSessionFp': 'Session fingerprint: {fp} (the phone login page shows the same; if it differs, the link has been reused — do not enter your PIN)',
   'stopTunnel': 'Stop',
   'enable': 'Enable anywhere',
   'opening': 'Enabling…',

package/lib/proxy.mjs

@@ -15,7 +15,6 @@ import { createServer } from 'node:http';
 import { request as httpRequest } from 'node:http';
 import { createGzip, createBrotliCompress, constants as zlibConstants } from 'node:zlib';
 import { createHash } from 'node:crypto';
-import { ensureSessionFingerprint } from './session.mjs';
 
 const DEFAULT_UPSTREAM = { host: '127.0.0.1', port: 3080 };
 
@@ -37,8 +36,6 @@ export const RANDOM_UUID_POLYFILL = `<script data-dsh-pocket-polyfill="1">!funct
 已回退；该问题属 DSH 客户端限制（location.hostname 是 unforgeable 属性）无法安全绕过。*/</script>`;
 
 const INJECT_MARK = 'data-dsh-pocket-polyfill="1"';
-/** 防密码被钓（issue #82）：本代理注入到每个 HTML 的会话指纹标记。 */
-const SESSION_MARK = 'name="dsh-pocket-session"';
 
 /**
  * DSH Desktop（桌面版）渲染进程兼容补丁（issue #3/#4，已于 issue #76 停用）。
@@ -168,20 +165,15 @@ function parseCookies(header) {
   return out;
 }
 
-/** 登录页：按访问来源显示提示（局域网 / 公网）；error: false|true|'locked'（locked 带剩余秒数）。
- *  fp: 本次公网会话指纹（issue #82 防钓鱼）——与电脑「手机访问」设置页一致才是你的 DSH。 */
-function loginPageHtml(error, isPublic, retryAfter = 0, fp = '') {
+/** 登录页：按访问来源显示提示（局域网 / 公网）；error: false|true|'locked'（locked 带剩余秒数）。 */
+function loginPageHtml(error, isPublic, retryAfter = 0) {
   const where = isPublic ? '此公网地址' : '此局域网地址';
   const whereEn = isPublic ? 'This public address' : 'This LAN address';
   const errMsg = error === 'locked'
     ? `尝试次数过多，请 ${retryAfter} 秒后再试 | Too many attempts — try again in ${retryAfter}s`
     : error ? '密码错误，请重试 | Wrong PIN, try again' : '';
-  const fpLine = fp
-    ? `<p style="margin:14px 0 0;font-size:12px;line-height:1.6;color:#6b7280">本页会话指纹：<b style="font-family:ui-monospace,Menlo,monospace;letter-spacing:1px;color:#111827">${fp}</b><br>与电脑「手机访问」设置页显示的<b>一致</b>，才是你的 DSH；不一致请勿输入密码。<br><span style="color:#9ca3af">Session fingerprint — only enter your PIN if it matches the one shown on your computer's "Phone access" settings.</span></p>`
-    : '';
   return `<!doctype html><html lang="zh"><head><meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
-<meta name="dsh-pocket-session" content="${fp}">
 <title>DSH Pocket · 访问验证</title>
 <style>
 body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#f3f4f6;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif}
@@ -199,7 +191,7 @@ button{width:100%;padding:10px;font-size:15px;background:#4f6ef7;color:#fff;bord
 <form method="post" action="/pocket-login">
 <input name="token" type="password" maxlength="8" autocomplete="one-time-code" autofocus required>
 <button type="submit">进入 | Enter</button>
-</form>${fpLine}
+</form>
 </div></body></html>`;
 }
 
@@ -488,9 +480,6 @@ function attachWebSocketHeartbeat(socket, { intervalMs = 30_000, missLimit = 2 }
  */
 export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DEFAULT_UPSTREAM, log = null, injectHtml = DEFAULT_INJECT, auth = null, rateLimit = null, heartbeat = {}, lanAccessEnabled = () => true, launchToken = () => '' } = {}) {
   const limiter = auth ? createRateLimiter(rateLimit ?? {}) : null;
-  // 防密码被钓（issue #82）：本次进程会话指纹，注入到所有经代理伺服的 HTML
-  const sessionFingerprint = ensureSessionFingerprint();
-  const sessionMeta = `<meta name="dsh-pocket-session" content="${sessionFingerprint}">`;
   const server = createServer((req, res) => {
     const host = String(req.headers.host ?? '');
     const isPublic = classifyHost(host) === 'public';
@@ -526,7 +515,7 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
                 'cache-control': 'no-store',
                 'retry-after': String(rl.retryAfter),
               });
-              res.end(loginPageHtml('locked', isPublic, rl.retryAfter, sessionFingerprint));
+              res.end(loginPageHtml('locked', isPublic, rl.retryAfter));
             return;
           }
           let body = '';
@@ -547,7 +536,7 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
               limiter?.record(ip);
               log?.(`dsh-pocket: login failed from ${ip} | 登录失败 IP: ${ip}`);
               res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
-              res.end(loginPageHtml(true, isPublic, 0, sessionFingerprint));
+              res.end(loginPageHtml(true, isPublic, 0));
             }
           });
           return;
@@ -558,7 +547,7 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
             // 锁定期间打开登录页也给提示（HTTP 200 + 锁定文案；429 语义留给 POST 拒绝）
             const rl = limiter?.status(ip) ?? { locked: false, retryAfter: 0 };
             res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
-            res.end(loginPageHtml(rl.locked ? 'locked' : false, isPublic, rl.retryAfter, sessionFingerprint));
+            res.end(loginPageHtml(rl.locked ? 'locked' : false, isPublic, rl.retryAfter));
           } else {
             res.writeHead(401, { 'content-type': 'application/json', 'cache-control': 'no-store' });
             res.end('{"error":"unauthorized"}');
@@ -628,11 +617,6 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
           proxyRes.on('data', (c) => chunks.push(c));
           proxyRes.on('end', () => {
             let html = Buffer.concat(chunks).toString('utf8');
-            // 防密码被钓（issue #82）：注入会话指纹 meta（与登录页同源）。
-            // 仅当页面尚无该标记时注入，避免重复；不存在 <head> 时跳过（dsh web 必有）。
-            if (!html.includes(SESSION_MARK)) {
-              html = html.replace(/<head[^>]*>/i, (m) => `${m}${sessionMeta}`);
-            }
             if (!html.includes(INJECT_MARK)) {
               html = html.replace(/<head[^>]*>/i, (m) => `${m}${injectHtml}`);
             }

package/lib/service.mjs

@@ -15,7 +15,6 @@ import { join, dirname } from 'node:path';
 import { createPocketProxy } from './proxy.mjs';
 import { startQuickTunnel, startNamedTunnel } from './tunnel.mjs';
 import { isValidIpv4 } from './ip.mjs';
-import { ensureSessionFingerprint } from './session.mjs';
 
 const require = createRequire(import.meta.url);
 
@@ -400,8 +399,6 @@ export function createPocketService({
           };
         })(),
         dshPort,
-        // 防密码被钓（issue #82）：本次进程的会话指纹，设置页展示供用户与手机登录页交叉核对
-        sessionFingerprint: ensureSessionFingerprint(),
       };
     },
 

package/lib/tunnel.mjs

@@ -27,15 +27,15 @@ export const QUICK_TUNNEL_URL_RE = /https:\/\/(?!api\.)[a-z0-9-]+\.trycloudflare
  *
  * cloudflared 参数错误（如 "Incorrect Usage: flag provided but not defined"）的
  * 关键信息在输出**开头**，尾部整段都是 usage 帮助文本（对用户没用）；而运行期错误
- * （403 / 协议 / 网络）的关键信息在**尾部**。所以：参数错误取开头片段，其它仍取尾部。
+ * （403 / 协议 / 网络）的关键信息在**尾部**。所以：参数错误取该行，其它仍取尾部。
  * 最多 500 字符，与历史上限一致。
  */
 export function firstMeaningfulErrorLine(buf) {
-  const text = String(buf ?? '').trim();
-  if (/^(Incorrect Usage|flag provided but not defined|unknown flag|unknown command)/im.test(text)) {
-    return text.split(/\r?\n/)[0].trim().slice(0, 500);
-  }
-  return text.split(/\r?\n/).slice(-4).join('\n').trim().slice(0, 500);
+  const lines = String(buf ?? '').trim().split(/\r?\n/);
+  // 命中哪行就返回哪行：cloudflared 先打版本横幅时，参数错误未必是首行
+  const usageIdx = lines.findIndex((l) => /^(?:Incorrect Usage|flag provided but not defined|unknown flag|unknown command)/i.test(l.trim()));
+  if (usageIdx >= 0) return lines[usageIdx].trim().slice(0, 500);
+  return lines.slice(-4).join('\n').trim().slice(0, 500);
 }
 
 function platformBinary() {

package/package.json

@@ -80,5 +80,5 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "version": "2.9.0"
+  "version": "2.10.0"
 }

package/client/mobile/sessionGuard.ts

@@ -1,80 +0,0 @@
-// 公网会话指纹校验（issue #82，防密码被钓）。
-//
-// 本代理会给每个经它伺服的 HTML（应用页 + 登录页）注入
-// <meta name="dsh-pocket-session" content="<本次进程随机指纹>">。该指纹只在本机
-// 代理内生成、只出现在我们伺服的页面，陌生人复用被回收的快速隧道子域时（其站点
-// 不经我们的代理）拿不到它、也猜不出。
-//
-// 校验逻辑（纯前端、不依赖任何外部请求，避免被钓鱼站点误导）：
-//   - 页面带指纹 meta → 这是我们的页面，显示一个小徽标供用户与电脑设置页交叉核对
-//     （不一致即说明链接被复用）；
-//   - 页面不带指纹 meta → 很可能不是我们的页面（链接已被他人复用，或克隆登录页钓鱼），
-//     弹红色全屏警告并拦截交互，防止用户在被钓鱼页输入 8 位密码。
-
-const SESSION_META = 'dsh-pocket-session'
-
-function readFingerprint(): string | null {
-  const meta = document.querySelector<HTMLMetaElement>(`meta[name="${SESSION_META}"]`)
-  const fp = meta?.content?.trim()
-  return fp && fp.length > 0 ? fp : null
-}
-
-function mountBadge(fp: string): () => void {
-  const badge = document.createElement('div')
-  badge.setAttribute('data-mobile-nav', 'session-fp')
-  badge.textContent = `🔒 会话指纹 ${fp}`
-  // 固定在底部居中、低存在感、仅供交叉核对
-  badge.style.cssText = [
-    'position:fixed', 'left:50%', 'bottom:8px', 'transform:translateX(-50%)',
-    'z-index:2147483646', 'padding:4px 10px', 'border-radius:999px',
-    'background:rgba(17,24,39,.82)', 'color:#fff',
-    'font:12px/1.4 -apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif',
-    'letter-spacing:.5px', 'pointer-events:none', 'user-select:none', 'white-space:nowrap',
-  ].join(';')
-  badge.title = '本页会话指纹，应与电脑「手机访问」设置页显示的一致；不一致说明链接已被他人复用'
-  document.body.appendChild(badge)
-  return () => badge.remove()
-}
-
-function mountWarning(): () => void {
-  const overlay = document.createElement('div')
-  overlay.setAttribute('data-mobile-nav', 'session-warn')
-  overlay.style.cssText = [
-    'position:fixed', 'inset:0', 'z-index:2147483647',
-    'display:flex', 'align-items:center', 'justify-content:center', 'padding:24px',
-    'background:rgba(0,0,0,.72)', 'color:#fff',
-    'font:15px/1.7 -apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif', 'text-align:center',
-  ].join(';')
-  overlay.style.whiteSpace = 'pre-line'
-  overlay.textContent = '⚠️ 此页面不是你的 DSH：链接可能已被他人复用。\n请勿在此输入任何密码。\n请重新在电脑「手机访问」设置页扫当前二维码。'
-  document.documentElement.appendChild(overlay)
-  return () => overlay.remove()
-}
-
-export function startSessionGuard(): () => void {
-  let cleanupBadge: (() => void) | null = null
-  let cleanupWarn: (() => void) | null = null
-  const evaluate = (): void => {
-    const fp = readFingerprint()
-    if (fp) {
-      cleanupWarn?.()
-      cleanupWarn = null
-      if (!cleanupBadge) cleanupBadge = mountBadge(fp)
-    } else {
-      cleanupBadge?.()
-      cleanupBadge = null
-      if (!cleanupWarn) cleanupWarn = mountWarning()
-    }
-  }
-  evaluate()
-  // 容错：极少数情况下 meta 在 effect 运行时尚未解析，稍后复查一次
-  const timer = window.setTimeout(evaluate, 300)
-  const observer = new MutationObserver(evaluate)
-  observer.observe(document.documentElement, { childList: true, subtree: true })
-  return () => {
-    window.clearTimeout(timer)
-    observer.disconnect()
-    cleanupBadge?.()
-    cleanupWarn?.()
-  }
-}

package/lib/session.mjs

@@ -1,35 +0,0 @@
-// 公网会话指纹（防密码被钓，issue #82）。
-//
-// 每次 dsh web 进程启动生成一次，随机、不可预测。只经本代理注入到我们伺服的
-// HTML（应用页 + 登录页），并显示在电脑「手机访问」设置页——永不落盘、不进日志、
-// 不出现在任何静态产物里。
-//
-// 快速隧道子域被 Cloudflare 回收、分给陌生人后，陌生人的站点不经我们的代理，
-// 拿不到这个指纹、也猜不出。于是其克隆的登录页要么没有指纹、要么指纹对不上：
-// 用户在手机登录页看到的指纹若与电脑设置页不一致，即说明链接已被他人复用，
-// 不应输入密码。这是"密码不防回收"之外，真正能拦住密码钓鱼的一层。
-
-import { randomBytes } from 'node:crypto'
-
-let fingerprint = null
-
-/**
- * 惰性生成并返回本次进程的会话指纹（多次调用返回同一值）。
- * @returns {string} 6 位大写字母/数字指纹
- */
-export function ensureSessionFingerprint() {
-  if (!fingerprint) {
-    let s = ''
-    while (s.length < 6) {
-      // base64 含 + / 等非字母数字字符，只保留 A-Z0-9 并转大写
-      s += randomBytes(6).toString('base64').replace(/[^A-Z0-9]/gi, '').toUpperCase()
-    }
-    fingerprint = s.slice(0, 6)
-  }
-  return fingerprint
-}
-
-/** 读取已生成的指纹（代理尚未启动时返回 null）。 */
-export function getSessionFingerprint() {
-  return fingerprint
-}