fix(server): 控制面 8080 收口——默认绑 loopback + 部署时幂等纠偏 ADDR/ufw

现网 server.env 漂移成 ADDR=:8080(全网卡),ufw 又放行 8080 → 控制面 API 明文
裸奔公网(http://<IP>:8080),绕过 cloudflared/CF 的 TLS 层。两处硬化:
- main.go:ADDR 未设时默认由 :8080 改 127.0.0.1:8080(防御纵深;跨主机监听须显式设 ADDR)
- deploy-server.sh:部署重启前幂等把 ADDR=:8080 纠回 127.0.0.1:8080(备份原文件)+
  撤 ufw allow 8080/tcp。收口随 server-v* 发版自动落地,不再手改线上。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD

client/lib/main.dart

@@ -43,8 +43,8 @@ Future<void> main(List<String> args) async {
     await windowManager.setMinimumSize(const Size(720, 560));
     await windowManager.setSize(const Size(920, 640));
     await windowManager.center();
-    // 窗口标题用中文品牌名(不带 "VPN" 字眼);英文环境下原生标题为 "Pangolin"。
-    await windowManager.setTitle('穿山甲');
+    // 窗口标题用英文品牌名(不带 "VPN" 字眼;默认 UI 语言为英文,标题保持一致)。
+    await windowManager.setTitle('Pangolin');
     // 自启:首帧前就隐藏窗口(避免闪现),托盘已就绪可随时唤回;自动连接逻辑照常跑。
     if (bootAutostart) {
       await windowManager.hide();
@@ -109,7 +109,7 @@ class _PangolinAppState extends ConsumerState<PangolinApp> {
   Widget build(BuildContext context) {
     final mode = ref.watch(themeModeProvider);
     return MaterialApp(
-      title: '穿山甲',
+      title: 'Pangolin',
       debugShowCheckedModeBanner: false,
       theme: PangolinTheme.light,
       darkTheme: PangolinTheme.dark,

client/lib/screens/account_page.dart

@@ -60,15 +60,6 @@ class AccountPage extends ConsumerWidget {
           isFree: isFree,
           email: email,
           expiresLabel: expiresLabel,
-          // Renew/Upgrade 直达购买页(套餐 + 渠道 switch),不再经 PlansScreen。
-          onUpgrade: () => open(
-            NavView.purchase,
-            PurchaseScreen(
-              t: t,
-              onOrderCreated: () => Navigator.of(context).push(MaterialPageRoute(
-                  builder: (_) => PaymentScreen(t: t, onDone: () => Navigator.of(context).pop()))),
-            ),
-          ),
         ),
         const SizedBox(height: 18),
         // 账户信息
@@ -156,13 +147,11 @@ class _PlanBanner extends StatelessWidget {
     required this.isFree,
     required this.email,
     required this.expiresLabel,
-    required this.onUpgrade,
   });
   final AppText t;
   final bool isFree;
   final String email;
   final String expiresLabel;
-  final VoidCallback onUpgrade;
 
   @override
   Widget build(BuildContext context) {
@@ -193,7 +182,6 @@ class _PlanBanner extends StatelessWidget {
                 child: Text(t.freePlanName, style: PangolinText.caption.copyWith(color: c.fg2, fontWeight: FontWeight.w600, fontSize: 11)),
               ),
             ])),
-            _UpgradeButton(label: t.upgradeBtn, onTap: onUpgrade),
           ]),
         ]),
       );
@@ -222,40 +210,11 @@ class _PlanBanner extends StatelessWidget {
           Text(expiresLabel.isEmpty ? t.proMember : '${t.proMember} · $expiresLabel',
               style: TextStyle(color: PangolinColors.white.withValues(alpha: 0.85), fontSize: 12)),
         ])),
-        FilledButton(
-          onPressed: onUpgrade,
-          style: FilledButton.styleFrom(
-            backgroundColor: PangolinColors.white,
-            foregroundColor: PangolinColors.clay700,
-            shape: const StadiumBorder(),
-            padding: const EdgeInsets.symmetric(horizontal: 16, vertical: 10),
-          ),
-          child: Text(t.upgradeBtn, style: const TextStyle(fontWeight: FontWeight.w700, fontSize: 13)),
-        ),
       ]),
     );
   }
 }
 
-class _UpgradeButton extends StatelessWidget {
-  const _UpgradeButton({required this.label, required this.onTap});
-  final String label;
-  final VoidCallback onTap;
-  @override
-  Widget build(BuildContext context) {
-    final c = context.pangolin;
-    return FilledButton(
-      onPressed: onTap,
-      style: FilledButton.styleFrom(
-        backgroundColor: c.accent,
-        foregroundColor: c.fgOnAccent,
-        shape: const StadiumBorder(),
-        padding: const EdgeInsets.symmetric(horizontal: 14, vertical: 10),
-      ),
-      child: Text(label, style: const TextStyle(fontWeight: FontWeight.w700, fontSize: 13)),
-    );
-  }
-}
 
 class _SectionLabel extends StatelessWidget {
   const _SectionLabel({required this.text});

client/lib/state/app_providers.dart

@@ -1,4 +1,6 @@
 // app_providers.dart — 语言 / 主题 / 套餐视角等基础状态(Riverpod)
+import 'dart:ui' as ui;
+
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:shared_preferences/shared_preferences.dart';
@@ -32,15 +34,29 @@ AppText appTextFor(AppLang lang) {
   }
 }
 
-/// 当前语言(单显)。默认英文(国际化默认语种);用户选择持久化到
-/// shared_preferences(key `pg_lang`,存枚举 name),重启保留 —— 原来无持久化,
-/// 切了语言重启会丢。设置/账户页经 `.notifier).set(lang)` 切换。
+/// 当前语言。首启无用户选择时**跟随系统语言**(设备 locale → 支持的 AppLang,
+/// 命不中回退英文);用户在设置/账户页显式切换后持久化到 shared_preferences
+/// (key `pg_lang`,存枚举 name),此后一律以用户选择为准、不再看系统。
 class LocaleNotifier extends StateNotifier<AppLang> {
-  LocaleNotifier() : super(AppLang.en) {
+  LocaleNotifier() : super(_systemDefault()) {
     _load();
   }
   static const _key = 'pg_lang';
 
+  /// 设备语言 → 支持的 AppLang。取平台首选 locale 的语言码(zh/ja/ko/ru/es 命中
+  /// 对应语种,其余一律英文)。构造期同步可用,无需 await。
+  static AppLang _systemDefault() {
+    try {
+      final code = ui.PlatformDispatcher.instance.locale.languageCode.toLowerCase();
+      for (final l in AppLang.values) {
+        if (l.name == code) return l;
+      }
+    } catch (_) {
+      /* 取系统 locale 失败 → 英文 */
+    }
+    return AppLang.en;
+  }
+
   Future<void> _load() async {
     try {
       final saved = (await SharedPreferences.getInstance()).getString(_key);
@@ -53,7 +69,7 @@ class LocaleNotifier extends StateNotifier<AppLang> {
         }
       }
     } catch (_) {
-      /* 读失败保持默认 en */
+      /* 读失败保持系统默认 */
     }
   }
 

client/lib/system_tray.dart

@@ -58,11 +58,11 @@ class TrayService with TrayListener, WindowListener {
     await trayManager.setIcon(
       Platform.isWindows ? 'assets/tray_icon.ico' : 'assets/tray_icon.png',
     );
-    await trayManager.setToolTip('穿山甲 Pangolin');
+    await trayManager.setToolTip('Pangolin');
     await trayManager.setContextMenu(Menu(items: [
-      MenuItem(key: 'show', label: '显示主界面'),
+      MenuItem(key: 'show', label: 'Show Window'),
       MenuItem.separator(),
-      MenuItem(key: 'quit', label: '退出'),
+      MenuItem(key: 'quit', label: 'Quit'),
     ]));
   }
 

client/macos/Runner/Info.plist

@@ -13,7 +13,7 @@
 	<key>CFBundleInfoDictionaryVersion</key>
 	<string>6.0</string>
 	<key>CFBundleName</key>
-	<string>$(PRODUCT_NAME)</string>
+	<string>Pangolin</string>
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>

client/windows/installer/pangolin.iss

@@ -2,7 +2,7 @@
 ; 编译: ISCC.exe pangolin.iss  (或用 Inno Setup Compiler 打开)
 ; 前置: 先在 client/ 跑 `flutter build windows`(Release),产物在
 ;       ..\..\build\windows\x64\runner\Release
-#define MyAppName "穿山甲 Pangolin"
+#define MyAppName "Pangolin"
 #define MyAppVersion "1.0.73"
 #define MyAppPublisher "Pangolin"
 #define MyAppExeName "pangolin_vpn.exe"

scripts/ci/deploy-server.sh

@@ -52,6 +52,18 @@ install -m755 /tmp/pangolin-server "$BIN/pangolin-server"
 install -m755 /tmp/pangolin-agent  "$BIN/pangolin-agent"
 install -m755 /tmp/pangolin-migrate "$BIN/pangolin-migrate"
 install -m755 /tmp/pangolin-nodectl "$BIN/pangolin-nodectl"
+# ── 控制面收口(幂等):HTTP API 只绑 loopback,经 cloudflared 隧道对外,关公网 8080 ──
+# 现网 server.env 曾漂移成 ADDR=:8080(全网卡明文暴露 http://<公网IP>:8080,绕过 CF/TLS)。
+# 这里在重启前把它纠回 127.0.0.1:8080 并撤掉 ufw 放行,随本次部署自动生效——不再手改线上。
+# 幂等:仅当精确匹配公网形态 ADDR=:8080 才改;已收口则跳过。备份原文件。
+if grep -qxF 'ADDR=:8080' /etc/pangolin/server.env; then
+  cp -p /etc/pangolin/server.env "/etc/pangolin/server.env.bak-addr-$TAG"
+  sed -i 's/^ADDR=:8080\$/ADDR=127.0.0.1:8080/' /etc/pangolin/server.env
+  echo "==> deploy-server: ADDR 收口 :8080 -> 127.0.0.1:8080"
+fi
+if command -v ufw >/dev/null 2>&1; then
+  ufw delete allow 8080/tcp >/dev/null 2>&1 || true
+fi
 systemctl start pangolin-server
 systemctl is-active pangolin-server
 REMOTE

scripts/local_test.sh

@@ -24,9 +24,10 @@
 set -euo pipefail
 
 # ─────────── 配置(按需改)───────────
-# 联调控制面。默认指向联调节点;要装生产地址的包用 env 覆盖:
-#   API_URL=https://api.yanmeiai.com scripts/local_test.sh ipad
-API_URL="${API_URL:-http://103.119.13.48:8080}"
+# 控制面基址。默认生产(Cloudflare Tunnel);8080 已收口只绑 127.0.0.1,公网直连
+# 不再可用——联调自建控制面时用 env 显式覆盖:
+#   API_URL=http://<联调地址>:8080 scripts/local_test.sh macos
+API_URL="${API_URL:-https://api.yanmeiai.com}"
 SIGN_ID="Developer ID Application: Yanmei (beijing) Technology Co., Ltd (BYL4KQHMTN)"
 APP_PROFILE_NAME="Pangolin App DevID"            # 主 app 的 Developer ID 描述文件名
 SE_PROFILE_NAME="Pangolin PacketTunnel DevID"    # PacketTunnel 的描述文件名

server/cmd/server/main.go

@@ -48,14 +48,16 @@ import (
 )
 
 func main() {
-	listenAddr := flag.String("addr", "", "HTTP listen address (default :8080, overridden by ADDR env)")
+	listenAddr := flag.String("addr", "", "HTTP listen address (default 127.0.0.1:8080, overridden by ADDR env)")
 	flag.Parse()
 
 	if *listenAddr == "" {
 		if v := os.Getenv("ADDR"); v != "" {
 			*listenAddr = v
 		} else {
-			*listenAddr = ":8080"
+			// 默认只绑 loopback:控制面对外一律经 cloudflared 隧道(见 CLAUDE.md),
+			// 源站不该裸监听公网。要跨主机监听须显式设 ADDR=:8080(明知代价)。
+			*listenAddr = "127.0.0.1:8080"
 		}
 	}
 

web/usercenter/app/sso/page.tsx

@@ -25,6 +25,17 @@ import { makeT } from '../../lib/i18n';
 import { getClient } from '../../lib/api/client';
 import { bilingual } from '../../lib/api/errors';
 
+/** 站点 basePath(与 next.config.js 一致)。本页用的是 window.location 原生跳转,
+ *  Next 不会自动补 basePath,故绝对路径必须手动加前缀,否则会落到站点根(官网主页)
+ *  而不是用户中心 —— 这正是「点用户中心却跳到主页、还要求重新登录」的根因。 */
+const BASE_PATH = process.env.NEXT_PUBLIC_BASE_PATH ?? '/user';
+
+/** 把本站相对路径补上 basePath(供 window.location 原生跳转用)。 */
+function withBase(path: string): string {
+  const p = path.startsWith('/') ? path : `/${path}`;
+  return `${BASE_PATH}${p}`;
+}
+
 /** redirect 白名单：仅本站相对路径(单个 '/' 开头),其余一律回 '/'。 */
 function safeRedirect(raw: string | null): string {
   if (!raw) return '/';
@@ -45,14 +56,15 @@ export default function SsoPage() {
     const redirect = safeRedirect(params.get('redirect'));
 
     // 票据只用一次,立刻从地址栏抹掉,不留浏览器历史(与 jiu 一致)。
+    // 原生 history/location 不吃 Next 的 basePath,须手动补,否则地址与跳转都会漂到站点根。
     try {
-      window.history.replaceState(null, '', '/sso/');
+      window.history.replaceState(null, '', withBase('/sso/'));
     } catch {
       /* ignore */
     }
 
     if (!ticket) {
-      window.location.replace('/');
+      window.location.replace(withBase('/'));
       return;
     }
 
@@ -61,14 +73,14 @@ export default function SsoPage() {
       .exchangeWebTicket(ticket)
       .then(() => {
         if (!alive) return;
-        window.location.replace(redirect);
+        window.location.replace(withBase(redirect));
       })
       .catch((e) => {
         if (!alive) return;
         setMsg(bilingual(e, lang));
         setFailed(true);
         setTimeout(() => {
-          window.location.replace('/');
+          window.location.replace(withBase('/'));
         }, 1500);
       });