kczx-user-management 1.0.2 → 1.0.3

package/CUTOVER-RUNBOOK.md

@@ -39,7 +39,7 @@ takes a few minutes and the rollback takes one command.
 #    user-management:
 #      listenHost: '0.0.0.0'    # was 127.0.0.1 (observer mode)
 #      plaintext: false         # was true: the door terminates TLS again
-#      port: 19843
+#      port: 8088
 #      trustedSecret: ''        # no signing gateway in front of it any more
 
 # 2. remove dsh-passwords from the profile
@@ -50,7 +50,7 @@ dsh plugin --profile web remove dsh-passwords
 
 ## Verification after the switch
 
-1. `https://<host>:19843/login` renders, a wrong password is refused, a correct
+1. `https://<host>:8088/login` renders, a wrong password is refused, a correct
    one lands on the SPA.
 2. The settings page shows 用户管理 with the accounts that were migrated
    (`mxz`, `mxz1`) and their permissions intact.

package/MERGED-DEPLOYMENT.md

@@ -43,7 +43,7 @@ dsh 宿主 127.0.0.1:3080
 user-management:
   enabled: true
   listenHost: '127.0.0.1'   # 明文模式会强制为回环，配别的会被拒绝并告警
-  port: 19843
+  port: 8088
   plaintext: true           # 明文监听：登录门的 WS 升级走裸 TCP 隧道，无法对这一跳做 TLS
   trustedSecret: '<64 hex>' # 与 dsh-passwords 的 MCP_IDENTITY_SECRET 必须逐字一致
   # trustedPeers: []        # 默认即回环；仅在确有需要时覆盖
@@ -53,7 +53,7 @@ user-management:
 
 ```
 MCP_IDENTITY_SECRET=<同一个 64 hex>     # 专用密钥，不复用 MCP_INTERNAL_SECRET
-MCP_GATEWAY_UPSTREAM=http://127.0.0.1:19843
+MCP_GATEWAY_UPSTREAM=http://127.0.0.1:8088
 ```
 
 两端密钥不一致是**静默失败**——观察层会拒绝全部请求，台账停止增长而没有任何报错。

package/README.md

@@ -54,11 +54,30 @@ pnpm add ./kczx-user-management-1.0.0.tgz        # 正常路径：依赖从 regi
 node scripts/ensure-deps.mjs                     # 仅当上述解析不到 schemastery 时才需要
 ```
 
+## 首次使用（初始化）
+
+**自助注册是关闭的**：账号只能由管理员在设置页创建，第一个管理员走"初始化"流程。
+
+1. 启动 dsh。库里还没有任何账号时，启动日志会打印一行初始化密钥：
+
+   ```
+   [user-management] first-run setup key 3f0c… (also in ~/.dsh/user-management/setup-key.txt)
+   ```
+
+   密钥同时写在 `$DSH_HOME/user-management/setup-key.txt`；也可以用 `settings.yaml` 的
+   `user-management.setupKey` 自行指定（那样不会往磁盘写密钥文件）。
+
+2. 浏览器打开 `https://<主机>:8088/login` —— 此时显示**初始化页**：填初始化密钥 + 用户名 + 密码。
+3. 提交后该账号**直接成为管理员并登录**，初始化密钥当场销毁（删文件、清内存）；此后 `/login` 只显示登录表单，
+   `/user-management/api/setup` 拒绝一切后续调用。
+
+> 登录页样式与 dsh-passwords 一致（光晕背景 + 网格 + 玻璃卡片 + 渐变按钮），跟随宿主主题深浅色，右上角可切换中文 / English。
+
 ## 它做什么
 
 ### 一扇门
 
-独立的 `node:https` 监听器（默认 `0.0.0.0:19843`），自签证书（SAN 覆盖本机全部 IP + sslip.io / nip.io 别名），
+独立的 `node:https` 监听器（默认 `0.0.0.0:8088`），自签证书（SAN 覆盖本机全部 IP + sslip.io / nip.io 别名），
 未登录的页面访问跳转 `/login`、API 请求 401；登录页自带深浅色。设置页提供证书下载（PEM/DER）、指纹核对与
 各系统导入向导。
 
@@ -80,7 +99,7 @@ node scripts/ensure-deps.mjs                     # 仅当上述解析不到 sche
 
 | 台账 | 内容 |
 |---|---|
-| 登录记录 | 登录 / 失败 / 登出 / 改密 / 注册 / 角色变更 / 删号 / 权限变更（含紧凑差异串） |
+| 登录记录 | 登录 / 失败 / 登出 / 改密 / 初始化（首次建号）/ 建号 / 删号 / 角色变更 / 资料变更 / 权限变更（含紧凑差异串） |
 | 访问记录 | 页面级访问（保留真实客户端 IP） |
 | 操作日志 | 经过网关的每次 API 调用与 WebSocket 连接（方法 / 路径 / 状态 / 来源 IP） |
 
@@ -94,11 +113,11 @@ node scripts/ensure-deps.mjs                     # 仅当上述解析不到 sche
 user-management:
   enabled: true
   listenHost: '0.0.0.0'   # 只本机可达就填 127.0.0.1
-  port: 19843
+  port: 8088
   plaintext: false        # true 时只允许回环（明文服务观察层用，见 MERGED-DEPLOYMENT.md）
   sites: []               # 空 = 自动枚举本机 IP；配域名 + 证书则按 SNI 选择
   title: 'DSH 控制台'
-  autoActivate: false     # false = 自助注册需管理员启用
+  setupKey: ''            # 首次初始化密钥；留空 = 启动时随机生成并写到 setup-key.txt
   historyMaxBytes: 67108864   # 历史改写缓冲上限（字节，默认 64 MiB，最小 1 MiB）
 ```
 

package/client/bundle.js

@@ -518,6 +518,10 @@ window.__ModuleLoader__.load({
     .um-wrap { font-size: 13px; color: var(--dsw-alias-label-primary); display: flex; flex-direction: column; gap: 14px; }
     .um-avatar { border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; color: rgba(255,255,255,.95); font-weight: 600; flex: none; user-select: none; letter-spacing: 0; }
     .um-brand-name { font-size: 13px; font-weight: 600; color: var(--dsw-alias-label-primary); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; display: block; max-width: 150px; }
+    .um-header-user { display: inline-flex; align-items: center; }
+    .um-header-user-btn { display: inline-flex; align-items: center; gap: 7px; padding: 3px 10px 3px 3px; border: 1px solid transparent; border-radius: 999px; background: transparent; color: var(--dsw-alias-label-primary); font: inherit; font-size: 12.5px; line-height: 1; cursor: pointer; }
+    .um-header-user-btn:hover { background: var(--dsw-alias-interactive-bg-hover); border-color: var(--dsw-alias-border-l2); }
+    .um-header-user-name { max-width: 130px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
     .um-logout { display: inline-flex; align-items: center; gap: 6px; border: 0; background: transparent; color: var(--dsw-alias-label-secondary); font-size: 12px; padding: 6px 10px; border-radius: 7px; cursor: pointer; flex: none; }
     .um-logout:hover { background: var(--dsw-alias-interactive-bg-hover); color: var(--dsw-alias-state-error-primary); }
     .um-user-menu { min-width: 216px; background: var(--dsw-alias-bg-layer-1); border: 1px solid var(--dsw-alias-border-l2); border-radius: 10px; box-shadow: 0 8px 28px rgba(0,0,0,.18); padding: 6px; }
@@ -650,45 +654,36 @@ window.__ModuleLoader__.load({
       }, label.charAt(0).toUpperCase())
     }
 
-    /** Sidebar brand mark — host renders it in the expanded brand row AND the
-     *  collapsed rail (owner supplies the square `size`), so fold states adapt
-     *  without us tracking the shell. Clicking it (or the name) opens the
-     *  user menu; sign-out sits at the bottom in red. */
-    function BrandMark({ size, className }) {
+    /** Account menu for the right end of the conversation header.
+     *
+     *  It lives in the session header's utilities group rather than the sidebar's
+     *  brand seat: the brand belongs to the host (its fish logo returns there
+     *  untouched), while the signed-in account belongs to the surface that acts on
+     *  its behalf. Clicking opens the same menu used everywhere else — change
+     *  password, sign out — with sign-out last, in red.
+     *
+     *  Session-scoped by construction: the header only exists once a conversation
+     *  is open, so on the welcome screen there is no account chip to click. */
+    function HeaderUserMenu() {
       useEffect(ensureStyles, [])
       const [me, setMe] = useState(sessionCache.me)
       useEffect(() => { loadMeCached().then((user) => setMe(user)) }, [])
       const { toggle, menu, dialog } = useUserMenu(me)
-      if (!me) {
-        return h('div', { className, style: { width: size, height: size, borderRadius: '50%', background: 'var(--dsw-alias-bg-layer-3)' } })
-      }
-      return h('div', {
-        className,
-        style: { cursor: 'pointer', display: 'inline-flex', borderRadius: '50%' },
-        title: me.username,
-        'aria-haspopup': 'menu',
-        onClick: toggle,
-      },
-        h(UserAvatar, { username: me.username, size: size || 24 }),
+      if (!me) return null
+      return h('div', { className: 'um-header-user' },
+        h('button', {
+          type: 'button',
+          className: 'um-header-user-btn',
+          title: me.username,
+          'aria-haspopup': 'menu',
+          onClick: toggle,
+        },
+          h(UserAvatar, { username: me.username, size: 22 }),
+          h('span', { className: 'um-header-user-name' }, me.username)),
         menu,
         dialog)
     }
 
-    /** Sidebar brand name — host renders it beside the expanded mark only. */
-    function BrandName() {
-      useEffect(ensureStyles, [])
-      const [me, setMe] = useState(sessionCache.me)
-      useEffect(() => { loadMeCached().then((user) => setMe(user)) }, [])
-      const { toggle, menu, dialog } = useUserMenu(me)
-      return h('span', {
-        className: 'um-brand-name',
-        style: { cursor: 'pointer' },
-        title: me ? me.username : '',
-        'aria-haspopup': 'menu',
-        onClick: toggle,
-      }, me ? me.username : '', menu, dialog)
-    }
-
     // ── logout ────────────────────────────────────────────────────────────────
 
     /** Locale accessor for slot components living outside apply()'s closure —
@@ -1810,24 +1805,24 @@ window.__ModuleLoader__.load({
       name: CLIENT_NAME,
       inject: ['slots', 'locale'],
       __boot,
-      __internals: { NS, ZH, EN, TYPE_LABELS, api, formatTime, interpolate, filterActivity, filterAudit, avatarHue, UserAvatar, BrandMark, BrandName, canBanIp, BanIpButton, ChangePasswordDialog, UserMenu, CertCard, CERT_INSTALL_COMMANDS, UserManagementSection, UserManagementEntry, AdminPanel, TotpCard, TotpSetupDialog, TotpDisableDialog },
+      __internals: { NS, ZH, EN, TYPE_LABELS, api, formatTime, interpolate, filterActivity, filterAudit, avatarHue, UserAvatar, HeaderUserMenu, canBanIp, BanIpButton, ChangePasswordDialog, UserMenu, CertCard, CERT_INSTALL_COMMANDS, UserManagementSection, UserManagementEntry, AdminPanel, TotpCard, TotpSetupDialog, TotpDisableDialog },
       apply(ctx) {
         ctx.locale.register(NS, 'zh', ZH)
         ctx.locale.register(NS, 'en', EN)
         const t = ctx.locale.bind(NS)
         localeT = t
         ctx.effect(() => {
-          // Official-brand pattern: nested injects claim both brand seats, one
-          // generator registers them. The mark shows in expanded row + collapsed
-          // rail (fold-adaptive), the name only beside the expanded mark.
-          // priority: -1 shadows the host's default brand registration at 0
-          // ("lowest renders"); uninstalling this plugin restores the official
-          // brand with no residue.
-          ctx.slots.inject('sidebar.brand.mark', () => ctx.slots.inject('sidebar.brand.name', function* () {
-            yield ctx.slots.register({ name: 'sidebar.brand.mark', priority: -1 }, BrandMark)
-            yield ctx.slots.register({ name: 'sidebar.brand.name', priority: -1 }, BrandName)
-          }))
-        }, 'user-management: sidebar brand')
+          // The account chip sits at the right end of the conversation header (the
+          // utilities group). The sidebar's brand seats are deliberately left to the
+          // host: its fish logo stays where it was, and uninstalling this plugin
+          // leaves nothing behind.
+          ctx.slots.inject('conversation.session.header.utilities', () => ctx.slots.register({
+            name: 'conversation.session.header.utilities',
+            id: `${CLIENT_NAME}:user-menu`,
+            order: 50,
+            locale: NS,
+          }, HeaderUserMenu))
+        }, 'user-management: session header account menu')
         // Token accounting: the session-scoped dock slot is the one seat whose
         // standard props carry `useProjection` — the only place the browser can
         // read the host's own token totals.

package/client/index.js

@@ -508,6 +508,10 @@ const STYLE = `
 .um-wrap { font-size: 13px; color: var(--dsw-alias-label-primary); display: flex; flex-direction: column; gap: 14px; }
 .um-avatar { border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; color: rgba(255,255,255,.95); font-weight: 600; flex: none; user-select: none; letter-spacing: 0; }
 .um-brand-name { font-size: 13px; font-weight: 600; color: var(--dsw-alias-label-primary); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; display: block; max-width: 150px; }
+.um-header-user { display: inline-flex; align-items: center; }
+.um-header-user-btn { display: inline-flex; align-items: center; gap: 7px; padding: 3px 10px 3px 3px; border: 1px solid transparent; border-radius: 999px; background: transparent; color: var(--dsw-alias-label-primary); font: inherit; font-size: 12.5px; line-height: 1; cursor: pointer; }
+.um-header-user-btn:hover { background: var(--dsw-alias-interactive-bg-hover); border-color: var(--dsw-alias-border-l2); }
+.um-header-user-name { max-width: 130px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
 .um-logout { display: inline-flex; align-items: center; gap: 6px; border: 0; background: transparent; color: var(--dsw-alias-label-secondary); font-size: 12px; padding: 6px 10px; border-radius: 7px; cursor: pointer; flex: none; }
 .um-logout:hover { background: var(--dsw-alias-interactive-bg-hover); color: var(--dsw-alias-state-error-primary); }
 .um-user-menu { min-width: 216px; background: var(--dsw-alias-bg-layer-1); border: 1px solid var(--dsw-alias-border-l2); border-radius: 10px; box-shadow: 0 8px 28px rgba(0,0,0,.18); padding: 6px; }
@@ -640,45 +644,36 @@ function UserAvatar({ username, size = 22 }) {
   }, label.charAt(0).toUpperCase())
 }
 
-/** Sidebar brand mark — host renders it in the expanded brand row AND the
- *  collapsed rail (owner supplies the square `size`), so fold states adapt
- *  without us tracking the shell. Clicking it (or the name) opens the
- *  user menu; sign-out sits at the bottom in red. */
-function BrandMark({ size, className }) {
+/** Account menu for the right end of the conversation header.
+ *
+ *  It lives in the session header's utilities group rather than the sidebar's
+ *  brand seat: the brand belongs to the host (its fish logo returns there
+ *  untouched), while the signed-in account belongs to the surface that acts on
+ *  its behalf. Clicking opens the same menu used everywhere else — change
+ *  password, sign out — with sign-out last, in red.
+ *
+ *  Session-scoped by construction: the header only exists once a conversation
+ *  is open, so on the welcome screen there is no account chip to click. */
+function HeaderUserMenu() {
   useEffect(ensureStyles, [])
   const [me, setMe] = useState(sessionCache.me)
   useEffect(() => { loadMeCached().then((user) => setMe(user)) }, [])
   const { toggle, menu, dialog } = useUserMenu(me)
-  if (!me) {
-    return h('div', { className, style: { width: size, height: size, borderRadius: '50%', background: 'var(--dsw-alias-bg-layer-3)' } })
-  }
-  return h('div', {
-    className,
-    style: { cursor: 'pointer', display: 'inline-flex', borderRadius: '50%' },
-    title: me.username,
-    'aria-haspopup': 'menu',
-    onClick: toggle,
-  },
-    h(UserAvatar, { username: me.username, size: size || 24 }),
+  if (!me) return null
+  return h('div', { className: 'um-header-user' },
+    h('button', {
+      type: 'button',
+      className: 'um-header-user-btn',
+      title: me.username,
+      'aria-haspopup': 'menu',
+      onClick: toggle,
+    },
+      h(UserAvatar, { username: me.username, size: 22 }),
+      h('span', { className: 'um-header-user-name' }, me.username)),
     menu,
     dialog)
 }
 
-/** Sidebar brand name — host renders it beside the expanded mark only. */
-function BrandName() {
-  useEffect(ensureStyles, [])
-  const [me, setMe] = useState(sessionCache.me)
-  useEffect(() => { loadMeCached().then((user) => setMe(user)) }, [])
-  const { toggle, menu, dialog } = useUserMenu(me)
-  return h('span', {
-    className: 'um-brand-name',
-    style: { cursor: 'pointer' },
-    title: me ? me.username : '',
-    'aria-haspopup': 'menu',
-    onClick: toggle,
-  }, me ? me.username : '', menu, dialog)
-}
-
 // ── logout ────────────────────────────────────────────────────────────────
 
 /** Locale accessor for slot components living outside apply()'s closure —
@@ -1800,24 +1795,24 @@ module.exports = {
   name: CLIENT_NAME,
   inject: ['slots', 'locale'],
   __boot,
-  __internals: { NS, ZH, EN, TYPE_LABELS, api, formatTime, interpolate, filterActivity, filterAudit, avatarHue, UserAvatar, BrandMark, BrandName, canBanIp, BanIpButton, ChangePasswordDialog, UserMenu, CertCard, CERT_INSTALL_COMMANDS, UserManagementSection, UserManagementEntry, AdminPanel, TotpCard, TotpSetupDialog, TotpDisableDialog },
+  __internals: { NS, ZH, EN, TYPE_LABELS, api, formatTime, interpolate, filterActivity, filterAudit, avatarHue, UserAvatar, HeaderUserMenu, canBanIp, BanIpButton, ChangePasswordDialog, UserMenu, CertCard, CERT_INSTALL_COMMANDS, UserManagementSection, UserManagementEntry, AdminPanel, TotpCard, TotpSetupDialog, TotpDisableDialog },
   apply(ctx) {
     ctx.locale.register(NS, 'zh', ZH)
     ctx.locale.register(NS, 'en', EN)
     const t = ctx.locale.bind(NS)
     localeT = t
     ctx.effect(() => {
-      // Official-brand pattern: nested injects claim both brand seats, one
-      // generator registers them. The mark shows in expanded row + collapsed
-      // rail (fold-adaptive), the name only beside the expanded mark.
-      // priority: -1 shadows the host's default brand registration at 0
-      // ("lowest renders"); uninstalling this plugin restores the official
-      // brand with no residue.
-      ctx.slots.inject('sidebar.brand.mark', () => ctx.slots.inject('sidebar.brand.name', function* () {
-        yield ctx.slots.register({ name: 'sidebar.brand.mark', priority: -1 }, BrandMark)
-        yield ctx.slots.register({ name: 'sidebar.brand.name', priority: -1 }, BrandName)
-      }))
-    }, 'user-management: sidebar brand')
+      // The account chip sits at the right end of the conversation header (the
+      // utilities group). The sidebar's brand seats are deliberately left to the
+      // host: its fish logo stays where it was, and uninstalling this plugin
+      // leaves nothing behind.
+      ctx.slots.inject('conversation.session.header.utilities', () => ctx.slots.register({
+        name: 'conversation.session.header.utilities',
+        id: `${CLIENT_NAME}:user-menu`,
+        order: 50,
+        locale: NS,
+      }, HeaderUserMenu))
+    }, 'user-management: session header account menu')
     // Token accounting: the session-scoped dock slot is the one seat whose
     // standard props carry `useProjection` — the only place the browser can
     // read the host's own token totals.

package/docs/FAQ.md

@@ -57,7 +57,7 @@ rm ~/.dsh/user-management/users.json ~/.dsh/user-management/sessions.json
 
 ## 为什么直连 dsh web 端口（19080/3080）没有登录墙
 
-v0.4 起门禁由本插件**自带的 HTTPS 网关**（默认 `https://<IP>:19843`）承担，不是宿主的 19080。直连 19080 等于绕过网关——**请保证 dsh web 只监听 loopback**（127.0.0.1），对外只暴露 19843。本机 `dsh web` 若被改绑到 0.0.0.0:19080，等于没有认证裸奔。
+v0.4 起门禁由本插件**自带的 HTTPS 网关**（默认 `https://<IP>:8088`）承担，不是宿主的 19080。直连 19080 等于绕过网关——**请保证 dsh web 只监听 loopback**（127.0.0.1），对外只暴露 8088。本机 `dsh web` 若被改绑到 0.0.0.0:19080，等于没有认证裸奔。
 
 ## 登录后很快又被要求登录
 
@@ -80,13 +80,13 @@ v0.4 起门禁由本插件**自带的 HTTPS 网关**（默认 `https://<IP>:1984
 ## 网关没起来 / 端口被占用
 
 ```bash
-# 谁占着 19843：
-lsof -iTCP:19843
+# 谁占着 8088：
+lsof -iTCP:8088
 # 启动日志（用户管理所有 [user-management] 前缀的输出都在这里）：
 grep user-management ~/.dsh/logs/web.out.log ~/.dsh/logs/web.err.log
 ```
 
-- `EADDRINUSE`：19843 被别的进程（或另一个 dsh 实例）占了——杀掉占用者，或在 `~/.dsh/settings.yaml` 的 `user-management:` 段改 `port`
+- `EADDRINUSE`：8088 被别的进程（或另一个 dsh 实例）占了——杀掉占用者，或在 `~/.dsh/settings.yaml` 的 `user-management:` 段改 `port`
 - 配置了 `enabled: false` 网关不会启动
 - 改了 hosts/证书配置不生效：删除 `~/.dsh/user-management/certs/` 下的旧证书文件再重启（旧证书按指纹稳定复用，不会自动重签）
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kczx-user-management",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "type": "module",
   "description": "dsh 插件 · 登录门 + 账号 / 权限 / 配额 / 审计台账（dsh-passwords 的功能已并入）：HTTPS 登录网关与自签证书、用户增删改查、工作区白名单与归属跟踪、每小时 token 与每日时长配额、沙盒档位下限、上传/git 开关、三本审计台账（登录/访问/操作）、IP 封禁、TOTP 两步验证。",
   "license": "MIT",

package/src/certs.js

@@ -5,9 +5,11 @@
  * generates a self-signed one (persisted under the certs dir so the
  * fingerprint stays stable across restarts — regenerating every boot would
  * break any client that pinned or trusted the previous cert). Self-signed
- * certs are issued for 100 years (days 36500). Persisted certs are NOT
- * regenerated automatically: to pick up a new expiry or a changed SAN set,
- * delete the cert/key files under the certs dir and restart.
+ * certs are issued for 100 years (days 36500). A persisted cert is reused while
+ * it still covers every host the site declares; when the host list gains a name
+ * it cannot validate (a new local IP, or the loopback literals), it is
+ * regenerated instead of silently serving a certificate that fails validation
+ * for that name. Expiry is not re-checked: rotate by deleting the files.
  *
  * Ported from dsh-gateway (clarknu/dsh-gateway) lib/certs.js, adapted to
  * CommonJS. SANs cover every host the site declares, as DNS or IP entries
@@ -15,6 +17,7 @@
  * not the CN) accept the self-signed certificate for each configured name.
  */
 
+import { X509Certificate } from 'node:crypto'
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
 import selfsigned from 'selfsigned'
@@ -40,12 +43,21 @@ function loadOrCreateSiteCert({ cert, key, hosts }, certsDir, log) {
   const crtPath = join(certsDir, `${safe}.crt`)
   const keyPath = join(certsDir, `${safe}.key`)
   if (existsSync(crtPath) && existsSync(keyPath)) {
-    return {
-      cert: readFileSync(crtPath, 'utf8'),
-      key: readFileSync(keyPath, 'utf8'),
-      auto: true,
-      certPath: crtPath,
-      keyPath: keyPath,
+    const existing = readFileSync(crtPath, 'utf8')
+    if (certCovers(existing, hosts, primary)) {
+      return {
+        cert: existing,
+        key: readFileSync(keyPath, 'utf8'),
+        auto: true,
+        certPath: crtPath,
+        keyPath: keyPath,
+      }
+    }
+    if (typeof log === 'function') {
+      log(
+        `user-management: regenerating the self-signed certificate for ${JSON.stringify(hosts || [primary])} — ` +
+          `the cached one at ${crtPath} does not cover every host`,
+      )
     }
   }
   const pems = selfsigned.generate(
@@ -76,6 +88,27 @@ function loadOrCreateSiteCert({ cert, key, hosts }, certsDir, log) {
   return { cert: pems.cert, key: pems.private, auto: true, certPath: crtPath, keyPath: keyPath }
 }
 
+/**
+ * Does an already-persisted certificate still cover every name we need?
+ *
+ * Browsers validate the SAN list, so a cached certificate that predates a host
+ * is not merely stale — it fails for that name. checkIP/checkHost also
+ * normalize IPv6 spellings (`::1` vs the expanded form) for us, which a string
+ * comparison would get wrong and would then regenerate on every boot.
+ */
+function certCovers(certPem, hosts, primary) {
+  let certificate
+  try {
+    certificate = new X509Certificate(certPem)
+  } catch {
+    return false
+  }
+  return sanEntries(hosts, primary).every((entry) => {
+    if (entry.type === 7) return certificate.checkIP(String(entry.ip)) !== undefined
+    return certificate.checkHost(String(entry.value)) !== undefined
+  })
+}
+
 /** node-forge SAN entries: type 2 = DNS, type 7 = iPAddress (IPv4 or IPv6 literal). */
 function sanEntries(hosts, primary) {
   const names = [...new Set([...(hosts || []), primary].filter((h) => h && h !== '*'))]
@@ -86,4 +119,4 @@ function sanEntries(hosts, primary) {
   })
 }
 
-export { loadOrCreateSiteCert, sanEntries }
+export { loadOrCreateSiteCert, sanEntries, certCovers }

package/src/gateway-core.js

@@ -116,6 +116,16 @@ function createGateway(options) {
   /** workspaceId → path, harvested from workspace-list responses (see below). */
   const workspacePathById = new Map()
 
+  /** ?lang=en switches the standalone door page; anything else stays Chinese. */
+  function loginPageLang(req) {
+    try {
+      const lang = new URL(req.url || '/', 'http://dsh.local').searchParams.get('lang')
+      return lang === 'en' ? 'en' : 'zh'
+    } catch {
+      return 'zh'
+    }
+  }
+
   function requestPath(req) {
     try { return new URL(req.url || '/', 'http://dsh.local').pathname } catch { return '' }
   }
@@ -600,8 +610,10 @@ function createGateway(options) {
       }))
     }
 
-    // /login — standalone login/register page (register tab is default on a
-    // fresh system; first registrant becomes admin). Authed users bounce to /.
+    // /login — the standalone door page. On a fresh system it renders the
+    // setup form instead of the login form (the owner account is created there
+    // with the server's setup key; self-registration is closed). Authed users
+    // bounce to /.
     if (path === LOGIN_PAGE_PATH) {
       if (method !== 'GET' && method !== 'HEAD') {
         return send(res, 405, { 'content-type': 'text/plain; charset=utf-8', allow: 'GET, HEAD' }, 'method not allowed')
@@ -610,6 +622,7 @@ function createGateway(options) {
       const html = options.renderLoginPage({
         hasUsers: options.deps.store.listUsers().length > 0,
         title: options.title || 'DSH 控制台',
+        lang: loginPageLang(req),
       })
       return send(res, 200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' }, html)
     }
@@ -759,7 +772,7 @@ function createGateway(options) {
       const onError = (err) => { server.removeListener('listening', onListening); reject(err) }
       server.once('listening', onListening)
       server.once('error', onError)
-      server.listen({ host: options.listenHost || '0.0.0.0', port: options.port != null ? options.port : 19843 })
+      server.listen({ host: options.listenHost || '0.0.0.0', port: options.port != null ? options.port : 8088 })
     })
     boundPort = server.address().port
     server.on('error', (err) => {