fix(server): 控制面 8080 收口——默认绑 loopback + 部署时幂等纠偏 ADDR/ufw

现网 server.env 漂移成 ADDR=:8080(全网卡),ufw 又放行 8080 → 控制面 API 明文
裸奔公网(http://<IP>:8080),绕过 cloudflared/CF 的 TLS 层。两处硬化:
- main.go:ADDR 未设时默认由 :8080 改 127.0.0.1:8080(防御纵深;跨主机监听须显式设 ADDR)
- deploy-server.sh:部署重启前幂等把 ADDR=:8080 纠回 127.0.0.1:8080(备份原文件)+
  撤 ufw allow 8080/tcp。收口随 server-v* 发版自动落地,不再手改线上。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD

client/lib/main.dart

@@ -43,8 +43,8 @@ Future<void> main(List<String> args) async {
     await windowManager.setMinimumSize(const Size(720, 560));
     await windowManager.setSize(const Size(920, 640));
     await windowManager.center();
-    // 窗口标题用中文品牌名(不带 "VPN" 字眼);英文环境下原生标题为 "Pangolin"。
+    // 窗口标题用英文品牌名(不带 "VPN" 字眼;默认 UI 语言为英文,标题保持一致)。
-    await windowManager.setTitle('穿山甲');
+    await windowManager.setTitle('Pangolin');
     // 自启:首帧前就隐藏窗口(避免闪现),托盘已就绪可随时唤回;自动连接逻辑照常跑。
     if (bootAutostart) {
       await windowManager.hide();
@@ -109,7 +109,7 @@ class _PangolinAppState extends ConsumerState<PangolinApp> {
   Widget build(BuildContext context) {
     final mode = ref.watch(themeModeProvider);
     return MaterialApp(
-      title: '穿山甲',
+      title: 'Pangolin',
       debugShowCheckedModeBanner: false,
       theme: PangolinTheme.light,
       darkTheme: PangolinTheme.dark,

client/lib/screens/account_page.dart

@@ -60,15 +60,6 @@ class AccountPage extends ConsumerWidget {
           isFree: isFree,
           email: email,
           expiresLabel: expiresLabel,
-          // Renew/Upgrade 直达购买页(套餐 + 渠道 switch),不再经 PlansScreen。
-          onUpgrade: () => open(
-            NavView.purchase,
-            PurchaseScreen(
-              t: t,
-              onOrderCreated: () => Navigator.of(context).push(MaterialPageRoute(
-                  builder: (_) => PaymentScreen(t: t, onDone: () => Navigator.of(context).pop()))),
-            ),
-          ),
         ),
         const SizedBox(height: 18),
         // 账户信息
@@ -156,13 +147,11 @@ class _PlanBanner extends StatelessWidget {
     required this.isFree,
     required this.email,
     required this.expiresLabel,
-    required this.onUpgrade,
   });
   final AppText t;
   final bool isFree;
   final String email;
   final String expiresLabel;
-  final VoidCallback onUpgrade;
 
   @override
   Widget build(BuildContext context) {
@@ -193,7 +182,6 @@ class _PlanBanner extends StatelessWidget {
                 child: Text(t.freePlanName, style: PangolinText.caption.copyWith(color: c.fg2, fontWeight: FontWeight.w600, fontSize: 11)),
               ),
             ])),
-            _UpgradeButton(label: t.upgradeBtn, onTap: onUpgrade),
           ]),
         ]),
       );
@@ -222,40 +210,11 @@ class _PlanBanner extends StatelessWidget {
           Text(expiresLabel.isEmpty ? t.proMember : '${t.proMember} · $expiresLabel',
               style: TextStyle(color: PangolinColors.white.withValues(alpha: 0.85), fontSize: 12)),
         ])),
-        FilledButton(
-          onPressed: onUpgrade,
-          style: FilledButton.styleFrom(
-            backgroundColor: PangolinColors.white,
-            foregroundColor: PangolinColors.clay700,
-            shape: const StadiumBorder(),
-            padding: const EdgeInsets.symmetric(horizontal: 16, vertical: 10),
-          ),
-          child: Text(t.upgradeBtn, style: const TextStyle(fontWeight: FontWeight.w700, fontSize: 13)),
-        ),
       ]),
     );
   }
 }
 
-class _UpgradeButton extends StatelessWidget {
-  const _UpgradeButton({required this.label, required this.onTap});
-  final String label;
-  final VoidCallback onTap;
-  @override
-  Widget build(BuildContext context) {
-    final c = context.pangolin;
-    return FilledButton(
-      onPressed: onTap,
-      style: FilledButton.styleFrom(
-        backgroundColor: c.accent,
-        foregroundColor: c.fgOnAccent,
-        shape: const StadiumBorder(),
-        padding: const EdgeInsets.symmetric(horizontal: 14, vertical: 10),
-      ),
-      child: Text(label, style: const TextStyle(fontWeight: FontWeight.w700, fontSize: 13)),
-    );
-  }
-}
 
 class _SectionLabel extends StatelessWidget {
   const _SectionLabel({required this.text});

client/lib/state/app_providers.dart

@@ -1,4 +1,6 @@
 // app_providers.dart — 语言 / 主题 / 套餐视角等基础状态(Riverpod)
+import 'dart:ui' as ui;
+
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:shared_preferences/shared_preferences.dart';
@@ -32,15 +34,29 @@ AppText appTextFor(AppLang lang) {
   }
 }
 
-/// 当前语言(单显)。默认英文(国际化默认语种);用户选择持久化到
+/// 当前语言。首启无用户选择时**跟随系统语言**(设备 locale → 支持的 AppLang,
-/// shared_preferences(key `pg_lang`,存枚举 name),重启保留 —— 原来无持久化,
+/// 命不中回退英文);用户在设置/账户页显式切换后持久化到 shared_preferences
-/// 切了语言重启会丢。设置/账户页经 `.notifier).set(lang)` 切换。
+/// (key `pg_lang`,存枚举 name),此后一律以用户选择为准、不再看系统。
 class LocaleNotifier extends StateNotifier<AppLang> {
-  LocaleNotifier() : super(AppLang.en) {
+  LocaleNotifier() : super(_systemDefault()) {
     _load();
   }
   static const _key = 'pg_lang';
 
+  /// 设备语言 → 支持的 AppLang。取平台首选 locale 的语言码(zh/ja/ko/ru/es 命中
+  /// 对应语种,其余一律英文)。构造期同步可用,无需 await。
+  static AppLang _systemDefault() {
+    try {
+      final code = ui.PlatformDispatcher.instance.locale.languageCode.toLowerCase();
+      for (final l in AppLang.values) {
+        if (l.name == code) return l;
+      }
+    } catch (_) {
+      /* 取系统 locale 失败 → 英文 */
+    }
+    return AppLang.en;
+  }
+
   Future<void> _load() async {
     try {
       final saved = (await SharedPreferences.getInstance()).getString(_key);
@@ -53,7 +69,7 @@ class LocaleNotifier extends StateNotifier<AppLang> {
         }
       }
     } catch (_) {
-      /* 读失败保持默认 en */
+      /* 读失败保持系统默认 */
     }
   }
 

client/lib/system_tray.dart

@@ -58,11 +58,11 @@ class TrayService with TrayListener, WindowListener {
     await trayManager.setIcon(
       Platform.isWindows ? 'assets/tray_icon.ico' : 'assets/tray_icon.png',
     );
-    await trayManager.setToolTip('穿山甲 Pangolin');
+    await trayManager.setToolTip('Pangolin');
     await trayManager.setContextMenu(Menu(items: [
-      MenuItem(key: 'show', label: '显示主界面'),
+      MenuItem(key: 'show', label: 'Show Window'),
       MenuItem.separator(),
-      MenuItem(key: 'quit', label: '退出'),
+      MenuItem(key: 'quit', label: 'Quit'),
     ]));
   }
 

client/macos/Runner/Info.plist

@@ -13,7 +13,7 @@
 	<key>CFBundleInfoDictionaryVersion</key>
 	<string>6.0</string>
 	<key>CFBundleName</key>
-	<string>$(PRODUCT_NAME)</string>
+	<string>Pangolin</string>
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>

client/windows/installer/pangolin.iss

@@ -2,7 +2,7 @@
 ; 编译: ISCC.exe pangolin.iss  (或用 Inno Setup Compiler 打开)
 ; 前置: 先在 client/ 跑 `flutter build windows`(Release),产物在
 ;       ..\..\build\windows\x64\runner\Release
-#define MyAppName "穿山甲 Pangolin"
+#define MyAppName "Pangolin"
 #define MyAppVersion "1.0.73"
 #define MyAppPublisher "Pangolin"
 #define MyAppExeName "pangolin_vpn.exe"

scripts/ci/compile-macos.sh

@@ -225,6 +225,10 @@ cat > "${WORK}/sysext.entitlements" <<PLIST
 	<key>com.apple.developer.networking.networkextension</key>
 	<array><string>packet-tunnel-provider-systemextension</string></array>
 	<key>com.apple.security.app-sandbox</key><true/>
+	<!-- 沙箱 sysext 必须显式网络权限才能对外建连/收发(同仓库 PacketTunnel.entitlements)。
+	     曾漏掉这两键 → 隧道扩展被沙箱拒绝出站,连不上节点(v1.1.2 事故,连上隧道但不通)。 -->
+	<key>com.apple.security.network.client</key><true/>
+	<key>com.apple.security.network.server</key><true/>
 	<key>com.apple.security.application-groups</key>
 	<array><string>${APP_GROUP}</string></array>
 </dict></plist>
@@ -275,6 +279,12 @@ case "$MACH" in
   "${APP_GROUP}"*) ;;
   *) echo "ERROR: NEMachServiceName(${MACH:-<missing>}) 必须以 App Group(${APP_GROUP}) 为前缀，否则 sysextd 校验失败 Code=6" >&2; exit 1 ;;
 esac
+# 沙箱 sysext 无 network.client/server = 无权对外建连 → 隧道起了也连不上节点(v1.1.2 事故)。
+SE_NC="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.network.client' "${WORK}/se.signed.plist" 2>/dev/null || true)"
+SE_NS="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.network.server' "${WORK}/se.signed.plist" 2>/dev/null || true)"
+echo "    sysext network.client=${SE_NC:-<missing>} network.server=${SE_NS:-<missing>}"
+[ "$SE_NC" = "true" ] || { echo "ERROR: sysext 缺 com.apple.security.network.client —— 沙箱扩展无权出站,隧道连不上节点" >&2; exit 1; }
+[ "$SE_NS" = "true" ] || { echo "ERROR: sysext 缺 com.apple.security.network.server" >&2; exit 1; }
 echo "    OK: ${APP_GROUP}"
 
 # ── [7/7] 公证(notarytool，API key 三件套) + staple + 打包 ──────────────────

scripts/ci/deploy-server.sh

@@ -52,6 +52,18 @@ install -m755 /tmp/pangolin-server "$BIN/pangolin-server"
 install -m755 /tmp/pangolin-agent  "$BIN/pangolin-agent"
 install -m755 /tmp/pangolin-migrate "$BIN/pangolin-migrate"
 install -m755 /tmp/pangolin-nodectl "$BIN/pangolin-nodectl"
+# ── 控制面收口(幂等):HTTP API 只绑 loopback,经 cloudflared 隧道对外,关公网 8080 ──
+# 现网 server.env 曾漂移成 ADDR=:8080(全网卡明文暴露 http://<公网IP>:8080,绕过 CF/TLS)。
+# 这里在重启前把它纠回 127.0.0.1:8080 并撤掉 ufw 放行,随本次部署自动生效——不再手改线上。
+# 幂等:仅当精确匹配公网形态 ADDR=:8080 才改;已收口则跳过。备份原文件。
+if grep -qxF 'ADDR=:8080' /etc/pangolin/server.env; then
+  cp -p /etc/pangolin/server.env "/etc/pangolin/server.env.bak-addr-$TAG"
+  sed -i 's/^ADDR=:8080\$/ADDR=127.0.0.1:8080/' /etc/pangolin/server.env
+  echo "==> deploy-server: ADDR 收口 :8080 -> 127.0.0.1:8080"
+fi
+if command -v ufw >/dev/null 2>&1; then
+  ufw delete allow 8080/tcp >/dev/null 2>&1 || true
+fi
 systemctl start pangolin-server
 systemctl is-active pangolin-server
 REMOTE

scripts/local_test.sh

@@ -24,9 +24,10 @@
 set -euo pipefail
 
 # ─────────── 配置(按需改)───────────
-# 联调控制面。默认指向联调节点;要装生产地址的包用 env 覆盖:
+# 控制面基址。默认生产(Cloudflare Tunnel);8080 已收口只绑 127.0.0.1,公网直连
-#   API_URL=https://api.yanmeiai.com scripts/local_test.sh ipad
+# 不再可用——联调自建控制面时用 env 显式覆盖:
-API_URL="${API_URL:-http://103.119.13.48:8080}"
+#   API_URL=http://<联调地址>:8080 scripts/local_test.sh macos
+API_URL="${API_URL:-https://api.yanmeiai.com}"
 SIGN_ID="Developer ID Application: Yanmei (beijing) Technology Co., Ltd (BYL4KQHMTN)"
 APP_PROFILE_NAME="Pangolin App DevID"            # 主 app 的 Developer ID 描述文件名
 SE_PROFILE_NAME="Pangolin PacketTunnel DevID"    # PacketTunnel 的描述文件名
@@ -112,6 +113,10 @@ PLIST
 	<key>com.apple.developer.networking.networkextension</key>
 	<array><string>packet-tunnel-provider-systemextension</string></array>
 	<key>com.apple.security.app-sandbox</key><true/>
+	<!-- 沙箱 sysext 必须显式网络权限才能对外建连(同仓库 PacketTunnel.entitlements;
+	     v1.1.2 CI 重签漏掉这两键 → 隧道连不上节点)。 -->
+	<key>com.apple.security.network.client</key><true/>
+	<key>com.apple.security.network.server</key><true/>
 	<key>com.apple.security.application-groups</key>
 	<array><string>${APP_GROUP}</string></array>
 </dict></plist>
@@ -142,6 +147,13 @@ verify_app_group(){
     "$APP_GROUP"*) ;;
     *) die "NEMachServiceName($mach)必须以 App Group($APP_GROUP)为前缀,否则 sysextd 校验失败 Code=6" ;;
   esac
+  # 沙箱 sysext 无 network.client/server = 无权对外建连 → 隧道起了也连不上节点(v1.1.2 事故)。
+  local se_nc se_ns
+  se_nc="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.network.client' "$WORK/se.ents.plist" 2>/dev/null || true)"
+  se_ns="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.network.server' "$WORK/se.ents.plist" 2>/dev/null || true)"
+  echo "  sysext network.client=${se_nc:-<缺失>} network.server=${se_ns:-<缺失>}"
+  [ "$se_nc" = "true" ] || die "sysext 缺 com.apple.security.network.client —— 沙箱扩展无权出站,隧道连不上节点"
+  [ "$se_ns" = "true" ] || die "sysext 缺 com.apple.security.network.server"
   echo "  ✅ 一致($APP_GROUP)"
 }
 

server/cmd/server/main.go

@@ -48,14 +48,16 @@ import (
 )
 
 func main() {
-	listenAddr := flag.String("addr", "", "HTTP listen address (default :8080, overridden by ADDR env)")
+	listenAddr := flag.String("addr", "", "HTTP listen address (default 127.0.0.1:8080, overridden by ADDR env)")
 	flag.Parse()
 
 	if *listenAddr == "" {
 		if v := os.Getenv("ADDR"); v != "" {
 			*listenAddr = v
 		} else {
-			*listenAddr = ":8080"
+			// 默认只绑 loopback:控制面对外一律经 cloudflared 隧道(见 CLAUDE.md),
+			// 源站不该裸监听公网。要跨主机监听须显式设 ADDR=:8080(明知代价)。
+			*listenAddr = "127.0.0.1:8080"
 		}
 	}
 

todo/todo.html

@@ -327,12 +327,12 @@ header .header-meta{color:var(--fg-soft)}
 <header>
   <div class="wrap">
     <h1>feature+windows — 项目 TODO</h1>
-    <div class="header-meta">生成于 2026-08-08 · 真相源 todo/todo.json</div>
+    <div class="header-meta">生成于 2026-08-09 · 真相源 todo/todo.json</div>
     <div class="stats">
       <div class="stat-pill"><strong>29</strong>全部</div>
-      <div class="stat-pill"><strong>16</strong>待开始</div>
+      <div class="stat-pill"><strong>15</strong>待开始</div>
       <div class="stat-pill"><strong>0</strong>开发中</div>
-      <div class="stat-pill"><strong>5</strong>待验收</div>
+      <div class="stat-pill"><strong>6</strong>待验收</div>
       <div class="stat-pill"><strong>8</strong>已验收</div>
       
     </div>
@@ -376,43 +376,12 @@ header .header-meta{color:var(--fg-soft)}
   
   <div class="section-block" id="section-open">
     <div class="section-title st-open" data-toggle="open">
-      📋 待开始 <span class="s-count">16</span>
+      📋 待开始 <span class="s-count">15</span>
       <span class="s-arrow">▴ 收起</span>
     </div>
     <div class="section-list-wrap " id="list-wrap-open">
       <ul class="todo-list" id="list-open">
         
-    <li class="todo-card s-open"
-        data-id="28"
-        data-level="high"
-        data-status="open"
-        data-tier="2"
-        data-tags="mac,CI/CD">
-      <div class="card-header">
-        <span class="item-id">#28</span>
-        <span class="item-title">修复 macOS PacketTunnel 系统扩展 App Group 不一致导致装不上</span>
-        <div class="card-badges">
-          <span class="tag status-badge s-open">待开始</span>
-          <span class="tag t-block">高优 · 紧急</span>
-          <span class="tag tier-2">二级</span>
-          
-          
-        </div>
-      </div>
-      
-      <div class="item-desc">根因：scripts/ci/compile-macos.sh 第 221 行把 sysext 的 application-groups 硬编码成 iOS 风格的 group.com.pangolin.pangolin，且第 195-210 行生成的 app.entitlements 完全没有 application-groups 键。二者与扩展 Info.plist 里的 NEMachServiceName（BYL4KQHMTN.com.pangolin.pangolin.PacketTunnel）对不上前缀 —— nesessionmanager 报 NetworkExtensionErrorDomain Code=6，sysextd 校验失败当场卸载刚 staging 的新扩展；VpnChannel.start() 的 step1 activateSystemExtensionIfNeeded 抛 code=9，永远走不到 step2 的 loadOrCreateManager，NETunnelProviderManager 配置建不出来，scutil --nc list 里没有 Pangolin，客户端一个包都发不到服务器（服务端侧该 Mac 出口 IP 的握手尝试数为 0）。这违反了 CLAUDE.md 第 152 行已写明的铁律。注意这两个 entitlements 是 codesign --force 最终覆盖签名用的，仓库里的 .entitlements 源文件只在 Xcode 编译阶段生效，所以线上包坏而本地 all 流程正常。修复：compile-macos.sh 两处改用脚本第 99 行已定义的 APP_GROUP 变量，app.entitlements 补 application-groups。scripts/local_test.sh 的同款硬编码本次已修，并新增 verify_app_group 一致性闸（读最终产物签名，比对两端 App Group 与 NEMachServiceName 前缀）和 macos 一条龙子命令。建议把同样的闸加进 .gitea/workflows/ci.yml。改完需重新构建+公证+替换 api.yanmeiai.com/downloads/pangolin-macos-x64.zip。附带：受影响机器会堆积多个 terminated waiting to uninstall on reboot 的旧扩展（本机 13 个，已 38 天未重启），建议重启清理。</div>
-      
-      
-      <div class="card-footer">
-        <div class="tag-row"><span class="tag t-tag" data-tag="mac">mac</span> <span class="tag t-tag" data-tag="CI/CD">CI/CD</span></div>
-        <div class="item-meta">
-      <span class="tag owner-agent">🤖 agent</span>
-      <span class="meta-date">🕐 2026-08-08</span>
-      
-    </div>
-      </div>
-    </li>
-
     <li class="todo-card s-open"
         data-id="29"
         data-level="high"
@@ -893,12 +862,43 @@ header .header-meta{color:var(--fg-soft)}
   </div>
   <div class="section-block" id="section-done">
     <div class="section-title st-done" data-toggle="done">
-      🔍 待验收 <span class="s-count">5</span>
+      🔍 待验收 <span class="s-count">6</span>
       <span class="s-arrow">▴ 收起</span>
     </div>
     <div class="section-list-wrap " id="list-wrap-done">
       <ul class="todo-list" id="list-done">
         
+    <li class="todo-card s-done"
+        data-id="28"
+        data-level="high"
+        data-status="done"
+        data-tier="2"
+        data-tags="mac,CI/CD">
+      <div class="card-header">
+        <span class="item-id">#28</span>
+        <span class="item-title">修复 macOS PacketTunnel 系统扩展 App Group 不一致导致装不上</span>
+        <div class="card-badges">
+          <span class="tag status-badge s-done">待验收</span>
+          <span class="tag t-block">高优 · 紧急</span>
+          <span class="tag tier-2">二级</span>
+          
+          <button class="reject-btn" data-id="28" data-title="修复 macOS PacketTunnel 系统扩展 App Group 不一致导致装不上">拒绝验收</button>
+        </div>
+      </div>
+      
+      <div class="item-desc">根因：scripts/ci/compile-macos.sh 第 221 行把 sysext 的 application-groups 硬编码成 iOS 风格的 group.com.pangolin.pangolin，且第 195-210 行生成的 app.entitlements 完全没有 application-groups 键。二者与扩展 Info.plist 里的 NEMachServiceName（BYL4KQHMTN.com.pangolin.pangolin.PacketTunnel）对不上前缀 —— nesessionmanager 报 NetworkExtensionErrorDomain Code=6，sysextd 校验失败当场卸载刚 staging 的新扩展；VpnChannel.start() 的 step1 activateSystemExtensionIfNeeded 抛 code=9，永远走不到 step2 的 loadOrCreateManager，NETunnelProviderManager 配置建不出来，scutil --nc list 里没有 Pangolin，客户端一个包都发不到服务器（服务端侧该 Mac 出口 IP 的握手尝试数为 0）。这违反了 CLAUDE.md 第 152 行已写明的铁律。注意这两个 entitlements 是 codesign --force 最终覆盖签名用的，仓库里的 .entitlements 源文件只在 Xcode 编译阶段生效，所以线上包坏而本地 all 流程正常。修复：compile-macos.sh 两处改用脚本第 99 行已定义的 APP_GROUP 变量，app.entitlements 补 application-groups。scripts/local_test.sh 的同款硬编码本次已修，并新增 verify_app_group 一致性闸（读最终产物签名，比对两端 App Group 与 NEMachServiceName 前缀）和 macos 一条龙子命令。建议把同样的闸加进 .gitea/workflows/ci.yml。改完需重新构建+公证+替换 api.yanmeiai.com/downloads/pangolin-macos-x64.zip。附带：受影响机器会堆积多个 terminated waiting to uninstall on reboot 的旧扩展（本机 13 个，已 38 天未重启），建议重启清理。</div>
+      
+      
+      <div class="card-footer">
+        <div class="tag-row"><span class="tag t-tag" data-tag="mac">mac</span> <span class="tag t-tag" data-tag="CI/CD">CI/CD</span></div>
+        <div class="item-meta">
+      <span class="tag owner-agent">🤖 agent</span>
+      <span class="meta-date">🕐 2026-08-08</span>
+      
+    </div>
+      </div>
+    </li>
+
     <li class="todo-card s-done"
         data-id="18"
         data-level="mid"

todo/todo.json

@@ -1,7 +1,7 @@
 {
   "meta": {
     "title": "feature+windows — 项目 TODO",
-    "updated_at": "2026-08-08T01:41:54.388Z"
+    "updated_at": "2026-08-08T16:07:14.004Z"
   },
   "seq": 30,
   "items": [
@@ -441,7 +441,7 @@
         "CI/CD"
       ],
       "owner": "agent",
-      "status": "open",
+      "status": "done",
       "created_at": "2026-08-08T01:20:23.304Z",
       "done": false,
       "completed_at": null,

web/usercenter/app/sso/page.tsx

@@ -25,6 +25,17 @@ import { makeT } from '../../lib/i18n';
 import { getClient } from '../../lib/api/client';
 import { bilingual } from '../../lib/api/errors';
 
+/** 站点 basePath(与 next.config.js 一致)。本页用的是 window.location 原生跳转,
+ *  Next 不会自动补 basePath,故绝对路径必须手动加前缀,否则会落到站点根(官网主页)
+ *  而不是用户中心 —— 这正是「点用户中心却跳到主页、还要求重新登录」的根因。 */
+const BASE_PATH = process.env.NEXT_PUBLIC_BASE_PATH ?? '/user';
+
+/** 把本站相对路径补上 basePath(供 window.location 原生跳转用)。 */
+function withBase(path: string): string {
+  const p = path.startsWith('/') ? path : `/${path}`;
+  return `${BASE_PATH}${p}`;
+}
+
 /** redirect 白名单：仅本站相对路径(单个 '/' 开头),其余一律回 '/'。 */
 function safeRedirect(raw: string | null): string {
   if (!raw) return '/';
@@ -45,14 +56,15 @@ export default function SsoPage() {
     const redirect = safeRedirect(params.get('redirect'));
 
     // 票据只用一次,立刻从地址栏抹掉,不留浏览器历史(与 jiu 一致)。
+    // 原生 history/location 不吃 Next 的 basePath,须手动补,否则地址与跳转都会漂到站点根。
     try {
-      window.history.replaceState(null, '', '/sso/');
+      window.history.replaceState(null, '', withBase('/sso/'));
     } catch {
       /* ignore */
     }
 
     if (!ticket) {
-      window.location.replace('/');
+      window.location.replace(withBase('/'));
       return;
     }
 
@@ -61,14 +73,14 @@ export default function SsoPage() {
       .exchangeWebTicket(ticket)
       .then(() => {
         if (!alive) return;
-        window.location.replace(redirect);
+        window.location.replace(withBase(redirect));
       })
       .catch((e) => {
         if (!alive) return;
         setMsg(bilingual(e, lang));
         setFailed(true);
         setTimeout(() => {
-          window.location.replace('/');
+          window.location.replace(withBase('/'));
         }, 1500);
       });