dsh-remote-plugin 0.6.16 → 0.6.18

package/gateway-stats.cjs

@@ -186,10 +186,11 @@ function tokenKeyName(key) {
 
 /** 统计存储: 单文件按天 + 游标。写操作由网关单进程调用, 内部用同步队列串行化。 */
 class StatsStore {
-  constructor(dir) {
+  constructor(dir, options = {}) {
     this.dir = dir || path.join(os.homedir(), '.dsh-remote', 'stats')
     this.daysDir = path.join(this.dir, DAYS_DIR)
     this.cursorsFile = path.join(this.dir, CURSORS_FILE)
+    this.spawn = typeof options.spawn === 'function' ? options.spawn : spawn
     this.cursors = null
     this.queue = Promise.resolve()
     fs.mkdirSync(this.daysDir, { recursive: true })
@@ -313,7 +314,7 @@ class StatsStore {
         if (lastSeq >= 0) this._setCursor(sessionId, lastSeq)
       }
 
-      const zstd = spawn('zstd', ['-dc', file], { stdio: ['ignore', 'pipe', 'ignore'] })
+      const zstd = this.spawn('zstd', ['-dc', file], { windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] })
       const rl = readline.createInterface({ input: zstd.stdout })
 
       zstd.on('error', (err) => {

package/gateway.cjs

@@ -22,6 +22,8 @@
  *   DSH_REMOTE_FS_ROOT       文件传输额外允许根, 默认 ~, 使用系统路径分隔符配置多根
  *   DSH_REMOTE_FS_MAX_UPLOAD 上传字节上限, 默认 2147483648 (2GB)
  *   DSH_REMOTE_WORKBENCH     工作台绑定文件, 默认 ~/.dsh-remote/workbench.json
+ *   DSH_REMOTE_ADVERTISE_HOSTS 额外写入配对二维码的宿主 IP/主机名, 逗号或空白分隔
+ *   DSH_REMOTE_DSH_CONTROL_MODE DSH 生命周期后端: auto/systemd/windows/disabled
  */
 'use strict'
 
@@ -84,6 +86,8 @@ const STARTED_AT = Date.now()
 const DSH_SERVICE = String(process.env.DSH_REMOTE_DSH_SERVICE || 'dsh-web').trim()
 const SYSTEMCTL = String(process.env.DSH_REMOTE_SYSTEMCTL || 'systemctl').trim() || 'systemctl'
 const WINDOWS_SC = String(process.env.DSH_REMOTE_WINDOWS_SC || 'sc.exe').trim() || 'sc.exe'
+const DSH_CONTROL_MODE_RAW = String(process.env.DSH_REMOTE_DSH_CONTROL_MODE || 'auto').trim().toLowerCase()
+const DSH_CONTROL_MODE = ['auto', 'systemd', 'windows', 'disabled'].includes(DSH_CONTROL_MODE_RAW) ? DSH_CONTROL_MODE_RAW : 'auto'
 const DSH_CONTROL_TIMEOUT_MS = durationEnv('DSH_REMOTE_DSH_CONTROL_TIMEOUT_MS', 45000, 2000, 5 * 60 * 1000)
 const DSH_CONTROL_POLL_MS = durationEnv('DSH_REMOTE_DSH_CONTROL_POLL_MS', 500, 50, 5000)
 const HTTP_REQUEST_TIMEOUT_MS = durationEnv('GATEWAY_HTTP_REQUEST_TIMEOUT_MS', 15 * 60 * 1000, 0, 24 * 60 * 60 * 1000)
@@ -104,6 +108,52 @@ function gatewayVersion() {
     return '0.0.0'
   }
 }
+
+function validAdvertisedHost(value) {
+  const host = String(value || '').trim()
+  if (!host || host.length > 253 || host === '0.0.0.0' || host === '127.0.0.1') return ''
+  if (!/^[A-Za-z0-9.-]+$/.test(host) || host.startsWith('.') || host.endsWith('.') || host.includes('..')) return ''
+  if (/^\d+(?:\.\d+){3}$/.test(host) && host.split('.').some(part => Number(part) > 255)) return ''
+  const labels = host.split('.')
+  if (labels.some(label => !label || label.length > 63 || label.startsWith('-') || label.endsWith('-'))) return ''
+  return host
+}
+
+function configuredAdvertisedHosts() {
+  return [...new Set(String(process.env.DSH_REMOTE_ADVERTISE_HOSTS || '')
+    .split(/[\s,]+/)
+    .map(validAdvertisedHost)
+    .filter(Boolean))]
+}
+
+function containerRuntimeDetected() {
+  if (fs.existsSync('/.dockerenv')) return true
+  try { return /(?:docker|containerd|kubepods|podman|lxc)/i.test(fs.readFileSync('/proc/1/cgroup', 'utf8')) } catch { return false }
+}
+
+function dshControlSupport() {
+  if (DSH_CONTROL_MODE === 'disabled') {
+    return { supported: false, code: 'EXTERNAL_LIFECYCLE', message: '当前 DSH 由 Docker、面板或其他外部平台管理' }
+  }
+  if (process.platform === 'win32') {
+    if (DSH_CONTROL_MODE === 'systemd') return { supported: false, code: 'CONTROL_MODE_MISMATCH', message: 'Windows 环境不能使用 systemd 控制 DSH' }
+    return { supported: true, manager: 'windows' }
+  }
+  if (DSH_CONTROL_MODE === 'windows') return { supported: false, code: 'CONTROL_MODE_MISMATCH', message: '当前系统不能使用 Windows Service 控制 DSH' }
+  if (DSH_CONTROL_MODE === 'systemd' || (process.env.DSH_REMOTE_SYSTEMCTL && SYSTEMCTL !== 'systemctl')) {
+    return { supported: true, manager: 'systemd' }
+  }
+  if (containerRuntimeDetected()) {
+    return { supported: false, code: 'EXTERNAL_LIFECYCLE', message: '当前网关运行在容器中，DSH 生命周期应由 Docker、面板或其他外部平台管理' }
+  }
+  if (!fs.existsSync('/run/systemd/system')) {
+    return { supported: false, code: 'EXTERNAL_LIFECYCLE', message: '当前环境没有 systemd，DSH 可能由 Docker、面板或其他外部平台管理' }
+  }
+  return { supported: true, manager: 'systemd' }
+}
+
+const ADVERTISED_HOSTS = configuredAdvertisedHosts()
+const DSH_CONTROL_SUPPORT = dshControlSupport()
 const VERSION = gatewayVersion()
 const PROTOCOL_VERSION = 1
 const CAPABILITIES = Object.freeze({
@@ -111,7 +161,7 @@ const CAPABILITIES = Object.freeze({
   eventPolling: 1,
   workspaceFiles: 2,
   imagePromptTransport: 1,
-  dshLifecycle: 2,
+  dshLifecycle: DSH_CONTROL_SUPPORT.supported ? 2 : 0,
   centralAnnouncements: 2,
   feedback: 1,
   deviceKeys: 1,
@@ -141,10 +191,16 @@ const MIME = {
 // 所有 /fs/* 路径 resolve 后都必须位于某个根内, 已存在的路径还会用 realpath
 // 复核一次, 防止 ../ 穿越与符号链接逃逸。
 const FS_DEFAULT_ROOT = path.resolve(os.homedir())
+function fsConfiguredRoot(value) {
+  const raw = String(value || '').trim()
+  if (!raw || raw === '~') return raw === '~' ? FS_DEFAULT_ROOT : ''
+  if (/^~[\\/]/.test(raw)) return path.resolve(FS_DEFAULT_ROOT, raw.slice(2))
+  return path.resolve(raw)
+}
 const FS_ROOTS = (process.env.DSH_REMOTE_FS_ROOT || FS_DEFAULT_ROOT)
   .split(path.delimiter)
+  .map(fsConfiguredRoot)
   .filter(Boolean)
-  .map(r => path.resolve(r.trim() === '~' ? FS_DEFAULT_ROOT : r.trim()))
 const FS_WORKSPACE_CACHE_MS = durationEnv('DSH_REMOTE_FS_WORKSPACE_CACHE_MS', 15_000, 1000, 10 * 60_000)
 const FS_MAX_UPLOAD = Number(process.env.DSH_REMOTE_FS_MAX_UPLOAD) || 2 * 1024 * 1024 * 1024
 const FS_UPLOAD_TTL_MS = durationEnv('DSH_REMOTE_FS_UPLOAD_TTL_MS', 24 * 60 * 60 * 1000, 60_000, 7 * 24 * 60 * 60 * 1000)
@@ -159,7 +215,7 @@ function fsRootReals() {
 }
 function fsInsideReal(real) {
   for (const root of [...fsRootReals(), ...fsWorkspaceRootsCache.reals]) {
-    if (real === root || real.startsWith(root + path.sep)) return true
+    if (fsInsideRoot(real, root)) return true
   }
   return false
 }
@@ -925,6 +981,9 @@ async function dshServiceStatus() {
   if (!/^[A-Za-z0-9_.@-]+$/.test(DSH_SERVICE)) {
     return { ok: false, supported: false, running: false, service: DSH_SERVICE, code: 'INVALID_SERVICE', message: 'DSH_REMOTE_DSH_SERVICE 服务名配置不合法' }
   }
+  if (!DSH_CONTROL_SUPPORT.supported) {
+    return { ok: true, supported: false, running: false, service: DSH_SERVICE, ...DSH_CONTROL_SUPPORT }
+  }
   if (process.platform === 'win32') return windowsServiceStatus()
   const r = await execFileResult(SYSTEMCTL, [
     '--user', 'show', DSH_SERVICE,
@@ -2026,6 +2085,7 @@ function serveAdminApi(req, res, url) {
         port: PORT,
         protocol: { version: PROTOCOL_VERSION },
         capabilities: CAPABILITIES,
+        dshControl: DSH_CONTROL_SUPPORT,
         upstream: { url: UPSTREAM.origin, reachable },
         latest: {
           version: latestState.version,
@@ -2243,8 +2303,19 @@ function fsAuthorized(req, url, res) {
   return true
 }
 
+function fsInsideRootFor(pathApi, abs, root, caseInsensitive = false) {
+  let candidate = pathApi.resolve(String(abs || ''))
+  let boundary = pathApi.resolve(String(root || ''))
+  if (caseInsensitive) {
+    candidate = candidate.toLowerCase()
+    boundary = boundary.toLowerCase()
+  }
+  const relative = pathApi.relative(boundary, candidate)
+  return relative === '' || (relative !== '..' && !relative.startsWith('..' + pathApi.sep) && !pathApi.isAbsolute(relative))
+}
+
 function fsInsideRoot(abs, root) {
-  return abs === root || abs.startsWith(root + path.sep)
+  return fsInsideRootFor(path, abs, root, process.platform === 'win32')
 }
 
 function fsWorkspacePath(value) {
@@ -2289,7 +2360,7 @@ async function fsResolve(input) {
   const raw = String(input ?? '').trim()
   let abs
   if (!raw || raw === '~') abs = FS_ROOTS[0]
-  else if (raw.startsWith('~/')) abs = path.resolve(FS_DEFAULT_ROOT, raw.slice(2))
+  else if (/^~[\\/]/.test(raw)) abs = path.resolve(FS_DEFAULT_ROOT, raw.slice(2))
   else if (path.isAbsolute(raw)) abs = path.resolve(raw)
   else abs = path.resolve(FS_ROOTS[0], raw) // 相对路径按默认根解析
   if (FS_ROOTS.some(root => fsInsideRoot(abs, root))) return { abs }
@@ -2386,6 +2457,7 @@ async function fsList(req, res, url) {
       if (!info.isFile() && !info.isDirectory()) continue
       entries.push({
         name: d.name,
+        path: full,
         type: info.isDirectory() ? 'dir' : 'file',
         size: info.isDirectory() ? 0 : info.size,
         mtimeMs: Math.round(info.mtimeMs)
@@ -2398,7 +2470,13 @@ async function fsList(req, res, url) {
     if (a.type !== b.type) return a.type === 'dir' ? -1 : 1
     return a.name.localeCompare(b.name, 'zh-CN', { numeric: true })
   })
-  fsJson(res, 200, { path: resolved.abs, entries })
+  fsJson(res, 200, {
+    path: resolved.abs,
+    entries,
+    roots: FS_ROOTS,
+    platform: process.platform,
+    separator: path.sep,
+  })
 }
 
 async function fsFile(req, res, url) {
@@ -3309,6 +3387,7 @@ async function serveHealth(req, res, url) {
     version: VERSION,
     protocol: { version: PROTOCOL_VERSION },
     capabilities: CAPABILITIES,
+    dshControl: DSH_CONTROL_SUPPORT,
     pid: process.pid,
     upstream: UPSTREAM.origin,
     upstreamProbe: DSH_HEALTH_PATH,
@@ -3322,12 +3401,12 @@ async function serveHealth(req, res, url) {
 }
 
 function lanAddresses() {
-  const out = []
+  const out = [...ADVERTISED_HOSTS]
   let groups
   try { groups = Object.values(os.networkInterfaces()) } catch { return out }
   for (const infos of groups) {
     for (const info of infos || []) {
-      if (info.family === 'IPv4' && !info.internal) out.push(info.address)
+      if (info.family === 'IPv4' && !info.internal && !out.includes(info.address)) out.push(info.address)
     }
   }
   return out

package/index.mjs

@@ -70,17 +70,34 @@ try {
 let dshListen = { host: '127.0.0.1', port: 3080 }
 
 function lanIPs() {
-  const out = []
+  const out = [...configuredAdvertisedHosts()]
   let groups
   try { groups = Object.values(networkInterfaces()) } catch { return out }
   for (const list of groups) {
     for (const it of list ?? []) {
-      if (it.family === 'IPv4' && !it.internal) out.push(it.address)
+      if (it.family === 'IPv4' && !it.internal && !out.includes(it.address)) out.push(it.address)
     }
   }
   return out
 }
 
+function validAdvertisedHost(value) {
+  const host = String(value || '').trim()
+  if (!host || host.length > 253 || host === '0.0.0.0' || host === '127.0.0.1') return ''
+  if (!/^[A-Za-z0-9.-]+$/.test(host) || host.startsWith('.') || host.endsWith('.') || host.includes('..')) return ''
+  if (/^\d+(?:\.\d+){3}$/.test(host) && host.split('.').some(part => Number(part) > 255)) return ''
+  const labels = host.split('.')
+  if (labels.some(label => !label || label.length > 63 || label.startsWith('-') || label.endsWith('-'))) return ''
+  return host
+}
+
+function configuredAdvertisedHosts() {
+  return [...new Set(String(process.env.DSH_REMOTE_ADVERTISE_HOSTS || '')
+    .split(/[\s,]+/)
+    .map(validAdvertisedHost)
+    .filter(Boolean))]
+}
+
 function targetPath(pathname) {
   let rel
   try {
@@ -152,7 +169,7 @@ function runExit(cmd, args) {
 
 const GATEWAY_ENV_KEYS = [
   'TOKEN', 'TOKEN_FILE', 'DSH_REMOTE_TOKEN', 'DSH_REMOTE_DEVICE_KEYS', 'DSH_REMOTE_FS_ROOT', 'DSH_REMOTE_FS_WORKSPACE_CACHE_MS', 'DSH_REMOTE_FS_MAX_UPLOAD',
-  'DSH_REMOTE_NOTES', 'DSH_REMOTE_WORKBENCH', 'DSH_REMOTE_DSH_SERVICE', 'DSH_REMOTE_SYSTEMCTL',
+  'DSH_REMOTE_NOTES', 'DSH_REMOTE_WORKBENCH', 'DSH_REMOTE_ADVERTISE_HOSTS', 'DSH_REMOTE_DSH_SERVICE', 'DSH_REMOTE_SYSTEMCTL', 'DSH_REMOTE_DSH_CONTROL_MODE',
   'DSH_REMOTE_DSH_CONTROL_TIMEOUT_MS', 'DSH_REMOTE_DSH_CONTROL_POLL_MS', 'DSH_REMOTE_FEEDBACK_URL',
   'UPDATE_CHECK_URL', 'UPDATE_INTERVAL_MS', 'UPDATE_PROXY', 'DSH_HEALTH_PATH',
   'GATEWAY_WS_IDLE_MS', 'GATEWAY_WS_PING_MS', 'GATEWAY_WS_PONG_TIMEOUT_MS',
@@ -552,6 +569,7 @@ async function serveStatic(req, res, ctx) {
         feedback: 0,
         deviceKeys: 0,
       },
+      dshControl: { supported: false, code: 'EXTERNAL_LIFECYCLE', message: '插件内嵌模式不负责管理 DSH 自身进程' },
       deviceKeys: { supported: false, enabled: false, entries: [] },
       upstream: { url: 'DSH 内嵌(同进程, 无需网关)', reachable: true },
       latest: { version, newer: false },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-plugin",
-  "version": "0.6.16",
+  "version": "0.6.18",
   "description": "DSH Remote 官方 bundle 插件：DSH 左侧原生边栏入口 + 右侧抽屉内嵌管理控制台；内置网关随 DSH 自动启停(systemd 独立单元)，抽屉直显令牌与设备监控；网关提供 /fs/* 文件传输端点(列表/断点下载/上传)，配合 Android App 远程操控会话/审批/提问/goal 与文件互传(多服务器测速切换、聊天记录离线缓存)。",
   "type": "module",
   "main": "./index.mjs",

package/public/admin.html

@@ -113,6 +113,8 @@
     .host-ip-title { font-size: 16px; font-weight: 750; }
     .host-ip-head .muted { margin-top: 4px; font-size: 12px; }
     .host-ip-badge { flex: none; padding: 5px 9px; border: 1px solid var(--dsr-accent-line); border-radius: 999px; color: var(--dsr-accent-strong); background: var(--dsr-accent-soft); font-size: 11px; font-weight: 700; }
+    .host-ip-head-actions { display: flex; align-items: center; justify-content: flex-end; gap: 8px; flex-wrap: wrap; }
+    .host-ip-remove { margin-left: 8px; padding: 3px 7px; }
     .host-ip-desc { margin: 12px 0; color: var(--dsr-muted); font-size: 12px; line-height: 1.55; }
     .host-ip-table-wrap { overflow: hidden; border: 1px solid var(--dsr-line); border-radius: 13px; }
     .host-ip-table { width: 100%; border-collapse: collapse; }
@@ -465,7 +467,10 @@
             <div class="host-ip-title" data-i18n="hostIPs.title">主机 IP 地址</div>
             <div id="host-ip-summary" class="muted" data-i18n="hostIPs.loading">正在读取主机地址…</div>
           </div>
-          <div class="host-ip-badge" data-i18n="hostIPs.badge">手机连接候选</div>
+          <div class="host-ip-head-actions">
+            <button id="btn-host-ip-add" class="mini-btn" type="button" data-i18n="hostIPs.add">添加宿主地址</button>
+            <div class="host-ip-badge" data-i18n="hostIPs.badge">手机连接候选</div>
+          </div>
         </div>
         <div class="host-ip-desc" data-i18n="hostIPs.desc">关闭虚拟机、容器或其他无效地址后，它们不会再写入配对二维码，也不会作为诊断和防火墙建议地址。</div>
         <div class="host-ip-table-wrap">
@@ -473,7 +478,7 @@
             <thead><tr><th data-i18n="hostIPs.enabledColumn">启用</th><th data-i18n="hostIPs.addressColumn">主机 IP</th><th data-i18n="hostIPs.statusColumn">状态</th></tr></thead>
             <tbody id="host-ip-rows"></tbody>
           </table>
-          <div id="host-ip-empty" class="host-ip-empty hidden" data-i18n="hostIPs.empty">暂无可用的非回环 IPv4 地址</div>
+          <div id="host-ip-empty" class="host-ip-empty hidden" data-i18n="hostIPs.empty">暂无可用的非回环地址</div>
         </div>
       </section>
 
@@ -601,13 +606,13 @@
         'badge.embedded': '内嵌', 'badge.gateway': '网关', 'badge.connected': '已连接',
         'badge.gateway.title': '新标签页打开网关管理面板', 'badge.gatewayDown': '网关未运行',
         'token.pluginNoGateway': '插件模式 · 未接网关, 无需令牌', 'token.unavailable': '未获取到令牌',
-        'toast.tokenInvalid': '令牌无效', 'toast.connFailed': '连接失败',
+        'toast.tokenInvalid': '令牌无效', 'toast.connFailed': '连接失败', 'toast.authLayer': '登录代理拦截了管理 API，请检查 /remote/* 的认证规则',
         'stat.pluginVersion': '插件版本', 'stat.gatewayVersion': '网关版本',
         'stat.updateAvailable': '{version} 可用', 'stat.currentV': '当前 v{version}',
         'stat.download': '去下载', 'stat.embedded': 'DSH 内嵌 · 免网关',
         'stat.updateCheck': '更新检查: {error}', 'stat.latest': '已是最新(来源检查)', 'stat.notChecked': '未检查更新',
         'stat.hostIP': '主机 IP · {hostname}', 'stat.ipSep': '、', 'stat.phoneGateway': ' (手机连 {port} 网关)', 'stat.phoneThis': ' (手机连这个地址)',
-        'hostIPs.title': '主机 IP 地址', 'hostIPs.badge': '手机连接候选', 'hostIPs.loading': '正在读取主机地址…', 'hostIPs.summary': '已启用 {enabled}/{total} 个地址', 'hostIPs.desc': '关闭虚拟机、容器或其他无效地址后，它们不会再写入配对二维码，也不会作为诊断和防火墙建议地址。', 'hostIPs.enabledColumn': '启用', 'hostIPs.addressColumn': '主机 IP', 'hostIPs.statusColumn': '状态', 'hostIPs.enabled': '已启用 · 会用于配对', 'hostIPs.disabled': '已关闭 · 不用于配对', 'hostIPs.enable': '切换此地址', 'hostIPs.empty': '暂无可用的非回环 IPv4 地址', 'hostIPs.keepOne': '至少保留一个可用地址',
+        'hostIPs.title': '主机 IP 地址', 'hostIPs.badge': '手机连接候选', 'hostIPs.loading': '正在读取主机地址…', 'hostIPs.summary': '已启用 {enabled}/{total} 个地址', 'hostIPs.desc': '关闭虚拟机、容器或其他无效地址后，它们不会再写入配对二维码，也不会作为诊断和防火墙建议地址。Docker 中可手动添加宿主地址。', 'hostIPs.enabledColumn': '启用', 'hostIPs.addressColumn': '主机 IP', 'hostIPs.statusColumn': '状态', 'hostIPs.enabled': '已启用 · 会用于配对', 'hostIPs.disabled': '已关闭 · 不用于配对', 'hostIPs.enable': '切换此地址', 'hostIPs.empty': '暂无可用的非回环地址', 'hostIPs.keepOne': '至少保留一个可用地址', 'hostIPs.add': '添加宿主地址', 'hostIPs.addPrompt': '输入手机可访问的宿主 IP 或主机名：', 'hostIPs.invalid': '地址格式无效', 'hostIPs.exists': '该地址已在列表中', 'hostIPs.remove': '删除',
         'stat.reachable': '可达', 'stat.unreachable': '不可达', 'stat.dshUpstream': 'DSH 上游 {url}',
         'stat.devicesOnline': '设备在线 / 累计', 'stat.totalRequests': '总请求数', 'stat.authFailures': '认证失败',
         'stat.uptime': '运行时长 · {host}:{port}',
@@ -711,13 +716,13 @@
         'badge.embedded': 'Embedded', 'badge.gateway': 'Gateway', 'badge.connected': 'Connected',
         'badge.gateway.title': 'Open gateway admin in a new tab', 'badge.gatewayDown': 'Gateway not running',
         'token.pluginNoGateway': 'Plugin mode · no gateway, no token needed', 'token.unavailable': 'Token unavailable',
-        'toast.tokenInvalid': 'Invalid token', 'toast.connFailed': 'Connection failed',
+        'toast.tokenInvalid': 'Invalid token', 'toast.connFailed': 'Connection failed', 'toast.authLayer': 'The login proxy blocked the admin API; check authentication rules for /remote/*',
         'stat.pluginVersion': 'Plugin version', 'stat.gatewayVersion': 'Gateway version',
         'stat.updateAvailable': 'v{version} available', 'stat.currentV': 'Current v{version}',
         'stat.download': 'Download', 'stat.embedded': 'Embedded in DSH · no gateway',
         'stat.updateCheck': 'Update check: {error}', 'stat.latest': 'Up to date (source check)', 'stat.notChecked': 'Not checked',
         'stat.hostIP': 'Host IP · {hostname}', 'stat.ipSep': ', ', 'stat.phoneGateway': ' (phone connects to gateway {port})', 'stat.phoneThis': ' (phone connects to this address)',
-        'hostIPs.title': 'Host IP addresses', 'hostIPs.badge': 'Phone connection candidates', 'hostIPs.loading': 'Reading host addresses…', 'hostIPs.summary': '{enabled}/{total} addresses enabled', 'hostIPs.desc': 'Disabled virtual-machine, container, or other invalid addresses are excluded from pairing QR codes, diagnostics, and firewall suggestions.', 'hostIPs.enabledColumn': 'Enabled', 'hostIPs.addressColumn': 'Host IP', 'hostIPs.statusColumn': 'Status', 'hostIPs.enabled': 'Enabled · used for pairing', 'hostIPs.disabled': 'Disabled · excluded from pairing', 'hostIPs.enable': 'Toggle this address', 'hostIPs.empty': 'No usable non-loopback IPv4 address', 'hostIPs.keepOne': 'Keep at least one usable address enabled',
+        'hostIPs.title': 'Host IP addresses', 'hostIPs.badge': 'Phone connection candidates', 'hostIPs.loading': 'Reading host addresses…', 'hostIPs.summary': '{enabled}/{total} addresses enabled', 'hostIPs.desc': 'Disabled virtual-machine, container, or other invalid addresses are excluded from pairing QR codes, diagnostics, and firewall suggestions. In Docker, add a host address manually.', 'hostIPs.enabledColumn': 'Enabled', 'hostIPs.addressColumn': 'Host IP', 'hostIPs.statusColumn': 'Status', 'hostIPs.enabled': 'Enabled · used for pairing', 'hostIPs.disabled': 'Disabled · excluded from pairing', 'hostIPs.enable': 'Toggle this address', 'hostIPs.empty': 'No usable non-loopback address', 'hostIPs.keepOne': 'Keep at least one usable address enabled', 'hostIPs.add': 'Add host address', 'hostIPs.addPrompt': 'Enter a host IP or hostname reachable by the phone:', 'hostIPs.invalid': 'Invalid address format', 'hostIPs.exists': 'This address is already listed', 'hostIPs.remove': 'Remove',
         'stat.reachable': 'Reachable', 'stat.unreachable': 'Unreachable', 'stat.dshUpstream': 'DSH upstream {url}',
         'stat.devicesOnline': 'Devices online / total', 'stat.totalRequests': 'Total requests', 'stat.authFailures': 'Auth failures',
         'stat.uptime': 'Uptime · {host}:{port}',

package/public/admin.js

@@ -18,6 +18,13 @@ const store = {
   del(k) { try { localStorage.removeItem(k) } catch {} }
 }
 let token = store.get('dshAdminToken') || new URLSearchParams(location.search).get('token') || ''
+function adminHeaders(extra = {}, accessToken = token) {
+  const headers = { 'x-dsh-remote-client': 'admin', ...extra }
+  // /remote/* 可能由 Caddy Basic Auth 保护。插件路由自身已在 DSH 登录态内，
+  // 这里不能再写 Authorization: Bearer，否则会覆盖浏览器的 Basic 凭据并形成 401 循环。
+  if (!pluginMode && accessToken) headers.authorization = 'Bearer ' + accessToken
+  return headers
+}
 let timer = null
 let gatewayRunning = false
 let gatewayBusy = false
@@ -32,17 +39,31 @@ let gatewayPortLoaded = false
 let doctorExpanded = store.get('dshAdminDoctorCollapsed') !== '1'
 let doctorChecks = []
 const HOST_IP_SELECTION_KEY = 'dshAdminEnabledHostIPsV1'
+const MANUAL_HOST_IP_KEY = 'dshAdminManualHostIPsV1'
 
 function normalizedHostIPs(st) {
-  return Array.isArray(st?.lanIPs)
-    ? [...new Set(st.lanIPs.map(value => String(value || '').trim()).filter(value => value && value !== '127.0.0.1' && value !== '0.0.0.0'))]
-    : []
+  const detected = Array.isArray(st?.lanIPs) ? st.lanIPs : []
+  return [...new Set([...detected, ...manualHostIPs(st)].map(validManualHost).filter(Boolean))]
+}
+
+function validManualHost(value) {
+  const host = String(value || '').trim()
+  if (!host || host.length > 253 || host === '0.0.0.0' || host === '127.0.0.1') return ''
+  if (!/^[A-Za-z0-9.-]+$/.test(host) || host.startsWith('.') || host.endsWith('.') || host.includes('..')) return ''
+  if (/^\d+(?:\.\d+){3}$/.test(host) && host.split('.').some(part => Number(part) > 255)) return ''
+  const labels = host.split('.')
+  if (labels.some(label => !label || label.length > 63 || label.startsWith('-') || label.endsWith('-'))) return ''
+  return host
 }
 
 function hostIPScope(st) {
   return [st?.hostname || location.hostname || 'host', st?.host || ''].join('|')
 }
 
+function manualHostIPScope(st) {
+  return st?.hostname || location.hostname || 'host'
+}
+
 function hostIPPreferences() {
   try {
     const value = JSON.parse(store.get(HOST_IP_SELECTION_KEY) || '{}')
@@ -52,6 +73,26 @@ function hostIPPreferences() {
   }
 }
 
+function manualHostPreferences() {
+  try {
+    const value = JSON.parse(store.get(MANUAL_HOST_IP_KEY) || '{}')
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {}
+  } catch {
+    return {}
+  }
+}
+
+function manualHostIPs(st) {
+  const values = manualHostPreferences()[manualHostIPScope(st)]
+  return Array.isArray(values) ? [...new Set(values.map(validManualHost).filter(Boolean))] : []
+}
+
+function saveManualHostIPs(st, values) {
+  const prefs = manualHostPreferences()
+  prefs[manualHostIPScope(st)] = [...new Set(values.map(validManualHost).filter(Boolean))]
+  store.set(MANUAL_HOST_IP_KEY, JSON.stringify(prefs))
+}
+
 function enabledHostIPs(st) {
   const all = normalizedHostIPs(st)
   if (!all.length) return []
@@ -67,9 +108,33 @@ function saveEnabledHostIPs(st, selected) {
   store.set(HOST_IP_SELECTION_KEY, JSON.stringify(prefs))
 }
 
+function addManualHostIP() {
+  if (!lastState) return
+  const input = prompt(t('hostIPs.addPrompt'), '')
+  if (input === null) return
+  const host = validManualHost(input)
+  if (!host) {
+    toast(t('hostIPs.invalid'), 'err')
+    return
+  }
+  if (normalizedHostIPs(lastState).includes(host)) {
+    toast(t('hostIPs.exists'), 'err')
+    return
+  }
+  saveManualHostIPs(lastState, [...manualHostIPs(lastState), host])
+  saveEnabledHostIPs(lastState, [...enabledHostIPs(lastState), host])
+  render(lastState)
+}
+
+function removeManualHostIP(st, host) {
+  saveManualHostIPs(st, manualHostIPs(st).filter(value => value !== host))
+  render(st)
+}
+
 function renderHostIPs(st) {
   const all = normalizedHostIPs(st)
   const selected = enabledHostIPs(st)
+  const manual = new Set(manualHostIPs(st))
   const rows = $('host-ip-rows')
   const empty = $('host-ip-empty')
   const summary = $('host-ip-summary')
@@ -80,7 +145,7 @@ function renderHostIPs(st) {
   rows.innerHTML = all.map(ip => `<tr>
     <td class="host-ip-toggle"><label class="host-ip-switch" title="${esc(t('hostIPs.enable'))}"><input type="checkbox" data-host-ip-toggle="${esc(ip)}" ${selected.includes(ip) ? 'checked' : ''}><span aria-hidden="true"></span></label></td>
     <td class="mono host-ip-value">${esc(ip)}</td>
-    <td class="host-ip-use">${esc(t(selected.includes(ip) ? 'hostIPs.enabled' : 'hostIPs.disabled'))}</td>
+    <td class="host-ip-use">${esc(t(selected.includes(ip) ? 'hostIPs.enabled' : 'hostIPs.disabled'))}${manual.has(ip) ? ` <button class="mini-btn host-ip-remove" type="button" data-host-ip-remove="${esc(ip)}">${esc(t('hostIPs.remove'))}</button>` : ''}</td>
   </tr>`).join('')
   empty.classList.toggle('hidden', all.length > 0)
   rows.querySelectorAll('[data-host-ip-toggle]').forEach(input => input.addEventListener('change', () => {
@@ -95,6 +160,9 @@ function renderHostIPs(st) {
     saveEnabledHostIPs(st, next)
     render(st)
   }))
+  rows.querySelectorAll('[data-host-ip-remove]').forEach(button => button.addEventListener('click', () => {
+    removeManualHostIP(st, button.dataset.hostIpRemove)
+  }))
 }
 
 function onlineClientDevices(st) {
@@ -183,7 +251,7 @@ async function loadStats() {
   if (!token && !pluginMode) return
   try {
     const res = await fetch(`${STATS_API}/summary?days=7`, {
-      headers: { authorization: 'Bearer ' + token, 'x-dsh-remote-client': 'admin' }
+      headers: adminHeaders(), credentials: 'same-origin'
     })
     if (!res.ok) {
       if (res.status === 401) return
@@ -204,7 +272,7 @@ async function loadGatewayConfig() {
   if (!pluginMode) return
   try {
     const res = await fetch(`${API}/config`, {
-      headers: { authorization: 'Bearer ' + token, 'x-dsh-remote-client': 'admin' }
+      headers: adminHeaders(), credentials: 'same-origin'
     })
     const out = await res.json().catch(() => ({}))
     if (out.ok) {
@@ -355,15 +423,19 @@ async function loadState() {
   if (!token && !pluginMode) return
   try {
     const res = await fetch(`${API}/state`, {
-      headers: { authorization: 'Bearer ' + token, 'x-dsh-remote-client': 'admin' }
+      headers: adminHeaders(), credentials: 'same-origin'
     })
-    if (res.status === 401) throw new Error('AUTH')
+    if (res.status === 401) throw new Error(pluginMode ? 'AUTH_LAYER' : 'AUTH')
+    if (pluginMode && !String(res.headers.get('content-type') || '').includes('application/json')) throw new Error('AUTH_LAYER')
     const st = await res.json()
     render(st)
   } catch (e) {
     if (e.message === 'AUTH') {
       toast(t('toast.tokenInvalid'), 'err')
       logout()
+    } else if (e.message === 'AUTH_LAYER') {
+      $('conn-badge').textContent = t('toast.authLayer')
+      $('conn-badge').className = 'conn-badge off'
     } else {
       $('conn-badge').textContent = t('toast.connFailed')
       $('conn-badge').className = 'conn-badge off'
@@ -530,7 +602,7 @@ async function setNote(ip, current) {
   if (name === null) return
   const res = await fetch(`${API}/note`, {
     method: 'POST',
-    headers: { 'content-type': 'application/json', authorization: 'Bearer ' + token, 'x-dsh-remote-client': 'admin' },
+    headers: adminHeaders({ 'content-type': 'application/json' }), credentials: 'same-origin',
     body: JSON.stringify({ ip, name })
   })
   if (res.ok) {
@@ -545,7 +617,7 @@ async function kick(ip) {
   if (!confirm(t('confirm.kick'))) return
   const res = await fetch(`${API}/kick`, {
     method: 'POST',
-    headers: { 'content-type': 'application/json', authorization: 'Bearer ' + token, 'x-dsh-remote-client': 'admin' },
+    headers: adminHeaders({ 'content-type': 'application/json' }), credentials: 'same-origin',
     body: JSON.stringify({ ip })
   })
   if (res.ok) {
@@ -563,7 +635,7 @@ async function deviceKeyMutation(action, payload = {}) {
   try {
     const res = await fetch(`${API}/device-keys/${action}`, {
       method: 'POST',
-      headers: { 'content-type': 'application/json', authorization: 'Bearer ' + token, 'x-dsh-remote-client': 'admin' },
+      headers: adminHeaders({ 'content-type': 'application/json' }), credentials: 'same-origin',
       body: JSON.stringify(payload),
     })
     const out = await res.json().catch(() => ({}))
@@ -755,6 +827,8 @@ $('btn-qr').addEventListener('click', () => {
   renderQr(lastState || { mode: '', token: shownToken })
 })
 
+$('btn-host-ip-add').addEventListener('click', addManualHostIP)
+
 /* 右上角「网关」徽章: 新标签页打开独立网关管理面板(带 token 免登录) */
 $('conn-badge').addEventListener('click', () => {
   const st = lastState
@@ -774,7 +848,7 @@ $('btn-rotate').addEventListener('click', async () => {
   try {
     const res = await fetch(`${API}/token/rotate`, {
       method: 'POST',
-      headers: { authorization: 'Bearer ' + (token || shownToken), 'x-dsh-remote-client': 'admin' }
+      headers: adminHeaders({}, token || shownToken), credentials: 'same-origin'
     })
     const out = await res.json().catch(() => ({}))
     if (out.ok && out.token) {
@@ -799,7 +873,7 @@ $('btn-gateway').addEventListener('click', async () => {
   try {
     const res = await fetch(`${API}/gateway`, {
       method: 'POST',
-      headers: { 'content-type': 'application/json', authorization: 'Bearer ' + token, 'x-dsh-remote-client': 'admin' },
+      headers: adminHeaders({ 'content-type': 'application/json' }), credentials: 'same-origin',
       body: JSON.stringify({ action: gatewayRunning ? 'stop' : 'start' })
     })
     const out = await res.json().catch(() => ({}))
@@ -829,7 +903,7 @@ $('btn-save-port').addEventListener('click', async () => {
   try {
     const res = await fetch(`${API}/config`, {
       method: 'PUT',
-      headers: { 'content-type': 'application/json', authorization: 'Bearer ' + token, 'x-dsh-remote-client': 'admin' },
+      headers: adminHeaders({ 'content-type': 'application/json' }), credentials: 'same-origin',
       body: JSON.stringify({ port })
     })
     const out = await res.json().catch(() => ({}))