fix(server): 控制面 8080 收口——默认绑 loopback + 部署时幂等纠偏 ADDR/ufw

现网 server.env 漂移成 ADDR=:8080(全网卡),ufw 又放行 8080 → 控制面 API 明文裸奔公网(http://<IP>:8080),绕过 cloudflared/CF 的 TLS 层。两处硬化: - main.go:ADDR 未设时默认由 :8080 改 127.0.0.1:8080(防御纵深;跨主机监听须显式设 ADDR) - deploy-server.sh:部署重启前幂等把 ADDR=:8080 纠回 127.0.0.1:8080(备份原文件)+ 撤 ufw allow 8080/tcp。收口随 server-v* 发版自动落地,不再手改线上。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD
fix(client/web): 语言跟随系统 + SSO 落地补 basePath + 移除账户页续费按钮
2026-08-09 10:02:10 +08:00 · 2026-08-09 09:42:25 +08:00 · 2026-08-09 01:43:39 +08:00 · 2026-08-09 00:54:03 +08:00 · 2026-08-09 00:49:05 +08:00 · 2026-08-09 00:07:14 +08:00
15 changed files with 370 additions and 113 deletions
@@ -90,25 +90,16 @@ jobs:
          name: windows
          path: dist/

-  # Why build-macos/build-ios don't block the working android+windows pipeline
-  # when Apple secrets aren't configured yet (they aren't, as of this writing):
-  #   1. release-deploy's `needs:` below is [build-android, build-windows]
-  #      ONLY — macOS/iOS are NOT dependencies, so release-deploy never waits
-  #      on them and never fails because of them.
-  #   2. `continue-on-error: true` on both jobs keeps the overall workflow-run
-  #      status green even while compile-macos.sh hard-fails (Apple Developer
-  #      ID / notary secrets absent — see its fail-fast checks) — that failure
-  #      is real signal ("go configure the secrets"), but it shouldn't read as
-  #      "the release pipeline is broken" when android+windows shipped fine.
-  #   3. compile-macos.sh's own default behavior is to hard-fail (not skip)
-  #      when its secrets are missing (macOS distribution must never ship
-  #      unsigned/unnotarized — see its header comment); compile-ios.sh's
-  #      default is to skip gracefully (exit 0) since an unconfigured iOS
-  #      account is a normal "not set up yet" state, not a defect. Either way
-  #      the job produces no dist/pangolin-macos-x64.zip, and
-  #      release-deploy's "Download all artifacts" step (no `name:` filter)
-  #      simply picks up whatever artifacts DO exist — an absent "macos"
-  #      artifact is not an error there.
+  # build-macos/build-ios 用 `continue-on-error: true` → 即便 Apple 侧构建抖了
+  # (frps 拉 sing-box 源码 / 公证超时等),也不阻塞 android+windows 发布:
+  #   1. release-deploy 现在 `needs:` 全部四个平台(见下),所以它会**等**全部
+  #      build 完成再发布 —— 避免旧 `needs: [build-android]` 只等 android、
+  #      macos/ios 还没传产物就发布导致漏平台的竞态。
+  #   2. continue-on-error 让 macos/ios 失败仍算「completed」满足 needs,不使整个
+  #      workflow 变红、不阻断已成功平台的发布;release-deploy 的「Download all
+  #      artifacts」(无 name 过滤)只捡实际存在的产物,缺某平台不报错。
+  #   3. Apple 签名 secret 现已在 gitea 用户级配齐(DEVELOPER_ID_P12/IOS_DIST_P12/
+  #      APPSTORE_API_* 等),macos/ios 正常应成功;continue-on-error 只是抖动兜底。
  build-macos:
    runs-on: mac
    continue-on-error: true
@@ -172,13 +163,24 @@ jobs:
      # No artifact upload — compile-ios.sh uploads straight to TestFlight via
      # altool (matches jiu); nothing is produced under dist/ for this job.

-  # release-deploy 只 needs build-android(唯一稳定可用的平台 floor)。windows/macos/ios
-  # best-effort:各自 runner+secret 就绪则上传 artifact,release-deploy flatten 收
-  # dist-raw/ 里"当时存在"的产物。windows 机离线 / Apple secret 未配 都不阻塞发版
-  # (对应平台下载保留 pangolin1 上一版,待可用时下个 client-v* 追上)。
+  # release-deploy 发布策略:needs 全部四平台(等它们**完成**,不抢跑),但用
+  # `if` 让 mac/ios/windows 的失败不 skip 本 job —— 只要 android(稳定 floor)成功即发。
+  # 背景:build-macos/ios 必须跑在 mac runner,其 Checkout(git fetch git.51yanmei.com)
+  # 走 frps 隧道偶发超时挂掉(run 239 的 ios 就是 fetch fdc13ea 超时,非 iOS 构建问题;
+  # run 238 同代码 fetch 碰巧成功)。这类瞬断不该阻断已成功平台的发布。
+  #   · needs 四平台 → download-artifact 收到当时**全部已上传**的产物(修旧
+  #     `needs:[build-android]` 只等 android、macos/ios 没传就发布漏平台的竞态)。
+  #   · continue-on-error 在 gitea 里**不**让下游 needs 在失败时继续(会 skip),故必须
+  #     配 `if: always() && needs.build-android.result=='success'` 才能「等全部、失败不阻」。
  release-deploy:
-    needs: [build-android]
-    runs-on: mac
+    needs: [build-android, build-windows, build-macos, build-ios]
+    if: ${{ always() && needs.build-android.result == 'success' }}
+    # ubuntu-latest = 家里 nas act_runner,与 gitea 同机/同网:Release → Forgejo 的
+    # API 调用走本地不过 frps 隧道(mac runner 走 git.51yanmei.com→frps→抖,curl 超时
+    # exit 28,3m3s=release_ensure 60s×3 重试耗尽)。deploy-server/deploy-site 同为
+    # ubuntu-latest,其 Forgejo release 步稳定通过(server 仅 13s)。此 job 全为网络/
+    # SSH 步骤(下载产物/传 Forgejo/SSH pangolin1/通知),无 mac 专属需求。
+    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -43,8 +43,8 @@ Future<void> main(List<String> args) async {
    await windowManager.setMinimumSize(const Size(720, 560));
    await windowManager.setSize(const Size(920, 640));
    await windowManager.center();
-    // 窗口标题用中文品牌名(不带 "VPN" 字眼);英文环境下原生标题为 "Pangolin"。
-    await windowManager.setTitle('穿山甲');
+    // 窗口标题用英文品牌名(不带 "VPN" 字眼;默认 UI 语言为英文,标题保持一致)。
+    await windowManager.setTitle('Pangolin');
    // 自启:首帧前就隐藏窗口(避免闪现),托盘已就绪可随时唤回;自动连接逻辑照常跑。
    if (bootAutostart) {
      await windowManager.hide();
@@ -109,7 +109,7 @@ class _PangolinAppState extends ConsumerState<PangolinApp> {
  Widget build(BuildContext context) {
    final mode = ref.watch(themeModeProvider);
    return MaterialApp(
-      title: '穿山甲',
+      title: 'Pangolin',
      debugShowCheckedModeBanner: false,
      theme: PangolinTheme.light,
      darkTheme: PangolinTheme.dark,
@@ -60,15 +60,6 @@ class AccountPage extends ConsumerWidget {
          isFree: isFree,
          email: email,
          expiresLabel: expiresLabel,
-          // Renew/Upgrade 直达购买页(套餐 + 渠道 switch),不再经 PlansScreen。
-          onUpgrade: () => open(
-            NavView.purchase,
-            PurchaseScreen(
-              t: t,
-              onOrderCreated: () => Navigator.of(context).push(MaterialPageRoute(
-                  builder: (_) => PaymentScreen(t: t, onDone: () => Navigator.of(context).pop()))),
-            ),
-          ),
        ),
        const SizedBox(height: 18),
        // 账户信息
@@ -156,13 +147,11 @@ class _PlanBanner extends StatelessWidget {
    required this.isFree,
    required this.email,
    required this.expiresLabel,
-    required this.onUpgrade,
  });
  final AppText t;
  final bool isFree;
  final String email;
  final String expiresLabel;
-  final VoidCallback onUpgrade;

  @override
  Widget build(BuildContext context) {
@@ -193,7 +182,6 @@ class _PlanBanner extends StatelessWidget {
                child: Text(t.freePlanName, style: PangolinText.caption.copyWith(color: c.fg2, fontWeight: FontWeight.w600, fontSize: 11)),
              ),
            ])),
-            _UpgradeButton(label: t.upgradeBtn, onTap: onUpgrade),
          ]),
        ]),
      );
@@ -222,40 +210,11 @@ class _PlanBanner extends StatelessWidget {
          Text(expiresLabel.isEmpty ? t.proMember : '${t.proMember} · $expiresLabel',
              style: TextStyle(color: PangolinColors.white.withValues(alpha: 0.85), fontSize: 12)),
        ])),
-        FilledButton(
-          onPressed: onUpgrade,
-          style: FilledButton.styleFrom(
-            backgroundColor: PangolinColors.white,
-            foregroundColor: PangolinColors.clay700,
-            shape: const StadiumBorder(),
-            padding: const EdgeInsets.symmetric(horizontal: 16, vertical: 10),
-          ),
-          child: Text(t.upgradeBtn, style: const TextStyle(fontWeight: FontWeight.w700, fontSize: 13)),
-        ),
      ]),
    );
  }
 }

-class _UpgradeButton extends StatelessWidget {
-  const _UpgradeButton({required this.label, required this.onTap});
-  final String label;
-  final VoidCallback onTap;
-  @override
-  Widget build(BuildContext context) {
-    final c = context.pangolin;
-    return FilledButton(
-      onPressed: onTap,
-      style: FilledButton.styleFrom(
-        backgroundColor: c.accent,
-        foregroundColor: c.fgOnAccent,
-        shape: const StadiumBorder(),
-        padding: const EdgeInsets.symmetric(horizontal: 14, vertical: 10),
-      ),
-      child: Text(label, style: const TextStyle(fontWeight: FontWeight.w700, fontSize: 13)),
-    );
-  }
-}

 class _SectionLabel extends StatelessWidget {
  const _SectionLabel({required this.text});
@@ -1,4 +1,6 @@
 // app_providers.dart — 语言 / 主题 / 套餐视角等基础状态(Riverpod)
+import 'dart:ui' as ui;
+
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:shared_preferences/shared_preferences.dart';
@@ -32,15 +34,29 @@ AppText appTextFor(AppLang lang) {
  }
 }

-/// 当前语言(单显)。默认英文(国际化默认语种);用户选择持久化到
-/// shared_preferences(key `pg_lang`,存枚举 name),重启保留 —— 原来无持久化,
-/// 切了语言重启会丢。设置/账户页经 `.notifier).set(lang)` 切换。
+/// 当前语言。首启无用户选择时**跟随系统语言**(设备 locale → 支持的 AppLang,
+/// 命不中回退英文);用户在设置/账户页显式切换后持久化到 shared_preferences
+/// (key `pg_lang`,存枚举 name),此后一律以用户选择为准、不再看系统。
 class LocaleNotifier extends StateNotifier<AppLang> {
-  LocaleNotifier() : super(AppLang.en) {
+  LocaleNotifier() : super(_systemDefault()) {
    _load();
  }
  static const _key = 'pg_lang';

+  /// 设备语言 → 支持的 AppLang。取平台首选 locale 的语言码(zh/ja/ko/ru/es 命中
+  /// 对应语种,其余一律英文)。构造期同步可用,无需 await。
+  static AppLang _systemDefault() {
+    try {
+      final code = ui.PlatformDispatcher.instance.locale.languageCode.toLowerCase();
+      for (final l in AppLang.values) {
+        if (l.name == code) return l;
+      }
+    } catch (_) {
+      /* 取系统 locale 失败 → 英文 */
+    }
+    return AppLang.en;
+  }
+
  Future<void> _load() async {
    try {
      final saved = (await SharedPreferences.getInstance()).getString(_key);
@@ -53,7 +69,7 @@ class LocaleNotifier extends StateNotifier<AppLang> {
        }
      }
    } catch (_) {
-      /* 读失败保持默认 en */
+      /* 读失败保持系统默认 */
    }
  }

@@ -58,11 +58,11 @@ class TrayService with TrayListener, WindowListener {
    await trayManager.setIcon(
      Platform.isWindows ? 'assets/tray_icon.ico' : 'assets/tray_icon.png',
    );
-    await trayManager.setToolTip('穿山甲 Pangolin');
+    await trayManager.setToolTip('Pangolin');
    await trayManager.setContextMenu(Menu(items: [
-      MenuItem(key: 'show', label: '显示主界面'),
+      MenuItem(key: 'show', label: 'Show Window'),
      MenuItem.separator(),
-      MenuItem(key: 'quit', label: '退出'),
+      MenuItem(key: 'quit', label: 'Quit'),
    ]));
  }

@@ -659,7 +659,7 @@
 			baseConfigurationReference = C57BBFD43F9175D1E23685EF /* Pods-RunnerTests.debug.xcconfig */;
 			buildSettings = {
 				BUNDLE_LOADER = "$(TEST_HOST)";
-				CURRENT_PROJECT_VERSION = 53;
+				CURRENT_PROJECT_VERSION = 55;
 				GENERATE_INFOPLIST_FILE = YES;
 				MARKETING_VERSION = 1.0;
 				PRODUCT_BUNDLE_IDENTIFIER = com.pangolin.pangolin.RunnerTests;
@@ -674,7 +674,7 @@
 			baseConfigurationReference = F8904897A48DC81799B8752E /* Pods-RunnerTests.release.xcconfig */;
 			buildSettings = {
 				BUNDLE_LOADER = "$(TEST_HOST)";
-				CURRENT_PROJECT_VERSION = 53;
+				CURRENT_PROJECT_VERSION = 55;
 				GENERATE_INFOPLIST_FILE = YES;
 				MARKETING_VERSION = 1.0;
 				PRODUCT_BUNDLE_IDENTIFIER = com.pangolin.pangolin.RunnerTests;
@@ -689,7 +689,7 @@
 			baseConfigurationReference = B21E68FC1F5D33DD67A0DF5E /* Pods-RunnerTests.profile.xcconfig */;
 			buildSettings = {
 				BUNDLE_LOADER = "$(TEST_HOST)";
-				CURRENT_PROJECT_VERSION = 53;
+				CURRENT_PROJECT_VERSION = 55;
 				GENERATE_INFOPLIST_FILE = YES;
 				MARKETING_VERSION = 1.0;
 				PRODUCT_BUNDLE_IDENTIFIER = com.pangolin.pangolin.RunnerTests;
@@ -960,7 +960,7 @@
 				CODE_SIGN_ENTITLEMENTS = PacketTunnel/PacketTunnel.entitlements;
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 53;
+				CURRENT_PROJECT_VERSION = 55;
 				DEVELOPMENT_TEAM = BYL4KQHMTN;
 				ENABLE_APP_SANDBOX = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
@@ -1010,7 +1010,7 @@
 				CODE_SIGN_ENTITLEMENTS = PacketTunnel/PacketTunnel.entitlements;
 				CODE_SIGN_IDENTITY = "Developer ID Application";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 53;
+				CURRENT_PROJECT_VERSION = 55;
 				DEVELOPMENT_TEAM = BYL4KQHMTN;
 				ENABLE_APP_SANDBOX = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
@@ -1059,7 +1059,7 @@
 				CODE_SIGN_ENTITLEMENTS = PacketTunnel/PacketTunnel.entitlements;
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 53;
+				CURRENT_PROJECT_VERSION = 55;
 				DEVELOPMENT_TEAM = BYL4KQHMTN;
 				ENABLE_APP_SANDBOX = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
@@ -13,7 +13,7 @@
 	<key>CFBundleInfoDictionaryVersion</key>
 	<string>6.0</string>
 	<key>CFBundleName</key>
-	<string>$(PRODUCT_NAME)</string>
+	<string>Pangolin</string>
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
@@ -2,7 +2,7 @@
 ; 编译: ISCC.exe pangolin.iss  (或用 Inno Setup Compiler 打开)
 ; 前置: 先在 client/ 跑 `flutter build windows`(Release),产物在
 ;       ..\..\build\windows\x64\runner\Release
-#define MyAppName "穿山甲 Pangolin"
+#define MyAppName "Pangolin"
 #define MyAppVersion "1.0.73"
 #define MyAppPublisher "Pangolin"
 #define MyAppExeName "pangolin_vpn.exe"
@@ -192,6 +192,12 @@ SE="${APP}/Contents/Library/SystemExtensions/${SYSEXT_BUNDLE_ID}.systemextension
 [ -d "$SE" ]  || { echo "ERROR: sysext bundle not found: ${SE}" >&2; exit 1; }

 # ── [6/7] inside-out 重签（sysext → app frameworks → app），同 local_test.sh cmd_sign ──
+# ⚠️ 这两份 entitlements 是最终产物的**真相源**——codesign --force 会覆盖 Xcode 用
+# 仓库 .entitlements 打的签名。两边的 application-groups 必须同为 ${APP_GROUP}
+# （macOS 原生格式 <TeamID>.<name>，见 CLAUDE.md），且 sysext Info.plist 的
+# NEMachServiceName 必须以它为前缀。曾因这里硬编码成 iOS 的 group. 前缀，导致
+# nesessionmanager 报 NetworkExtensionErrorDomain Code=6、sysextd 校验失败当场
+# 卸载新扩展，客户端永远建不出 VPN 配置（见 todo #28）。改这里请同步 local_test.sh。
 cat > "${WORK}/app.entitlements" <<PLIST
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -204,6 +210,8 @@ cat > "${WORK}/app.entitlements" <<PLIST
 	<key>com.apple.security.app-sandbox</key><false/>
 	<key>com.apple.security.network.client</key><true/>
 	<key>com.apple.security.network.server</key><true/>
+	<key>com.apple.security.application-groups</key>
+	<array><string>${APP_GROUP}</string></array>
 	<key>keychain-access-groups</key>
 	<array><string>${APP_GROUP}</string></array>
 </dict></plist>
@@ -217,8 +225,12 @@ cat > "${WORK}/sysext.entitlements" <<PLIST
 	<key>com.apple.developer.networking.networkextension</key>
 	<array><string>packet-tunnel-provider-systemextension</string></array>
 	<key>com.apple.security.app-sandbox</key><true/>
+	<!-- 沙箱 sysext 必须显式网络权限才能对外建连/收发(同仓库 PacketTunnel.entitlements)。
+	     曾漏掉这两键 → 隧道扩展被沙箱拒绝出站,连不上节点(v1.1.2 事故,连上隧道但不通)。 -->
+	<key>com.apple.security.network.client</key><true/>
+	<key>com.apple.security.network.server</key><true/>
 	<key>com.apple.security.application-groups</key>
-	<array><string>group.com.pangolin.pangolin</string></array>
+	<array><string>${APP_GROUP}</string></array>
 </dict></plist>
 PLIST

@@ -249,6 +261,32 @@ codesign --force --options runtime --timestamp \
 codesign --verify --deep --strict --verbose=2 "$APP"
 echo "==> compile-macos: signed + verified (${IDENTITY})"

+# ── App Group / NEMachServiceName 一致性闸（读最终签名，不是仓库源文件）──────
+# 规则没上闸 = 没有规则：这道闸就是为 todo #28 那次事故立的，放在公证前，
+# 不一致直接 fail，避免把装不上的包公证并发出去。
+echo "==> compile-macos: verifying App Group / NEMachServiceName consistency"
+codesign -d --entitlements - --xml "$APP" > "${WORK}/app.signed.plist" 2>/dev/null || true
+codesign -d --entitlements - --xml "$SE"  > "${WORK}/se.signed.plist"  2>/dev/null || true
+APP_G="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.application-groups:0' "${WORK}/app.signed.plist" 2>/dev/null || true)"
+SE_G="$(/usr/libexec/PlistBuddy  -c 'Print :com.apple.security.application-groups:0' "${WORK}/se.signed.plist"  2>/dev/null || true)"
+MACH="$(/usr/libexec/PlistBuddy  -c 'Print :NetworkExtension:NEMachServiceName' "${SE}/Contents/Info.plist" 2>/dev/null || true)"
+echo "    app App Group    : ${APP_G:-<missing>}"
+echo "    sysext App Group : ${SE_G:-<missing>}"
+echo "    NEMachServiceName: ${MACH:-<missing>}"
+[ "$APP_G" = "$APP_GROUP" ] || { echo "ERROR: app App Group 应为 ${APP_GROUP}，实为 ${APP_G:-<missing>}" >&2; exit 1; }
+[ "$SE_G"  = "$APP_GROUP" ] || { echo "ERROR: sysext App Group 应为 ${APP_GROUP}，实为 ${SE_G:-<missing>}" >&2; exit 1; }
+case "$MACH" in
+  "${APP_GROUP}"*) ;;
+  *) echo "ERROR: NEMachServiceName(${MACH:-<missing>}) 必须以 App Group(${APP_GROUP}) 为前缀，否则 sysextd 校验失败 Code=6" >&2; exit 1 ;;
+esac
+# 沙箱 sysext 无 network.client/server = 无权对外建连 → 隧道起了也连不上节点(v1.1.2 事故)。
+SE_NC="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.network.client' "${WORK}/se.signed.plist" 2>/dev/null || true)"
+SE_NS="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.network.server' "${WORK}/se.signed.plist" 2>/dev/null || true)"
+echo "    sysext network.client=${SE_NC:-<missing>} network.server=${SE_NS:-<missing>}"
+[ "$SE_NC" = "true" ] || { echo "ERROR: sysext 缺 com.apple.security.network.client —— 沙箱扩展无权出站,隧道连不上节点" >&2; exit 1; }
+[ "$SE_NS" = "true" ] || { echo "ERROR: sysext 缺 com.apple.security.network.server" >&2; exit 1; }
+echo "    OK: ${APP_GROUP}"
+
 # ── [7/7] 公证(notarytool，API key 三件套) + staple + 打包 ──────────────────
 echo "==> compile-macos: notarizing (notarytool submit --wait, ~1-5min)"
 NOTARIZE_ZIP="${WORK}/notarize.zip"
@@ -52,6 +52,18 @@ install -m755 /tmp/pangolin-server "$BIN/pangolin-server"
 install -m755 /tmp/pangolin-agent  "$BIN/pangolin-agent"
 install -m755 /tmp/pangolin-migrate "$BIN/pangolin-migrate"
 install -m755 /tmp/pangolin-nodectl "$BIN/pangolin-nodectl"
+# ── 控制面收口(幂等):HTTP API 只绑 loopback,经 cloudflared 隧道对外,关公网 8080 ──
+# 现网 server.env 曾漂移成 ADDR=:8080(全网卡明文暴露 http://<公网IP>:8080,绕过 CF/TLS)。
+# 这里在重启前把它纠回 127.0.0.1:8080 并撤掉 ufw 放行,随本次部署自动生效——不再手改线上。
+# 幂等:仅当精确匹配公网形态 ADDR=:8080 才改;已收口则跳过。备份原文件。
+if grep -qxF 'ADDR=:8080' /etc/pangolin/server.env; then
+  cp -p /etc/pangolin/server.env "/etc/pangolin/server.env.bak-addr-$TAG"
+  sed -i 's/^ADDR=:8080\$/ADDR=127.0.0.1:8080/' /etc/pangolin/server.env
+  echo "==> deploy-server: ADDR 收口 :8080 -> 127.0.0.1:8080"
+fi
+if command -v ufw >/dev/null 2>&1; then
+  ufw delete allow 8080/tcp >/dev/null 2>&1 || true
+fi
 systemctl start pangolin-server
 systemctl is-active pangolin-server
 REMOTE
@@ -11,6 +11,7 @@
 #   copy    覆盖安装到 /Applications
 #   run     直跑 /Applications 版本(绕 Gatekeeper,实时输出日志,并打印测试账号)
 #   all     依次执行 build → sign → copy → run
+#   macos   一条龙(推荐):递增构建号 → build → App Group 一致性闸 → 公证 → 装 → 跑
 #
 #   ── iOS / iPad 真机(USB 连接;与上面 macOS 流程完全独立)──
 #   ios-devices    列出已连接的 iOS 物理设备(拿 device id)
@@ -23,9 +24,10 @@
 set -euo pipefail

 # ─────────── 配置(按需改)───────────
-# 联调控制面。默认指向联调节点;要装生产地址的包用 env 覆盖:
-#   API_URL=https://api.yanmeiai.com scripts/local_test.sh ipad
-API_URL="${API_URL:-http://103.119.13.48:8080}"
+# 控制面基址。默认生产(Cloudflare Tunnel);8080 已收口只绑 127.0.0.1,公网直连
+# 不再可用——联调自建控制面时用 env 显式覆盖:
+#   API_URL=http://<联调地址>:8080 scripts/local_test.sh macos
+API_URL="${API_URL:-https://api.yanmeiai.com}"
 SIGN_ID="Developer ID Application: Yanmei (beijing) Technology Co., Ltd (BYL4KQHMTN)"
 APP_PROFILE_NAME="Pangolin App DevID"            # 主 app 的 Developer ID 描述文件名
 SE_PROFILE_NAME="Pangolin PacketTunnel DevID"    # PacketTunnel 的描述文件名
@@ -38,8 +40,12 @@ IP_SVC="https://api.ipify.org"                    # 返回纯文本公网 IP
 # 注:DevID profile 已含 system-extension.install + NE(-systemextension 变体);
 #     app/sysext entitlements 与之对齐(见 write_entitlements)。

-# ── iOS/iPad 真机分发(ad-hoc,**公司**证书)────────────────────────────────
 TEAM_ID="BYL4KQHMTN"                              # Yanmei (beijing) Technology Co., Ltd
+# macOS App Group —— 必须是原生格式 <TeamID>.<name>,不是 iOS 的 group. 前缀(CLAUDE.md 铁律)。
+# 主 app 与 sysext 必须落在**同一个**;sysext 的 NEMachServiceName 必须以它为前缀。
+APP_GROUP="${TEAM_ID}.com.pangolin.pangolin"
+
+# ── iOS/iPad 真机分发(ad-hoc,**公司**证书)────────────────────────────────
 IOS_BUNDLE_ID="com.pangolin.pangolinVpn"
 # 期望的签名主体。装机前逐字核对,不符即中止 —— 防止悄悄退回个人开发证书。
 IOS_EXPECT_SIGNER="Apple Distribution: Yanmei (beijing) Technology Co., Ltd (${TEAM_ID})"
@@ -49,6 +55,7 @@ SRC="${BASH_SOURCE[0]}"
 DIR="${SRC%/*}"; [ "$DIR" = "$SRC" ] && DIR="."
 cd "$DIR/.."; REPO_ROOT="$PWD"
 CLIENT="$REPO_ROOT/client"
+PBXPROJ="$CLIENT/macos/Runner.xcodeproj/project.pbxproj"
 APP="$CLIENT/build/macos/Build/Products/Release/pangolin_vpn.app"
 # sysext bundle 名 = 标识符(PRODUCT_NAME=com.pangolin.pangolin.PacketTunnel,见 CLAUDE.md),
 # 不是短名 PacketTunnel.systemextension。
@@ -73,38 +80,96 @@ find_profile(){
  return 1
 }

+# ⚠️ 两份 entitlements 的 application-groups 必须**同值**且等于 $APP_GROUP。
+# 历史事故:sysext 这份曾硬编码成 iOS 的 group. 前缀,与 Info.plist 的
+# NEMachServiceName(<TeamID>. 前缀)对不上 → nesessionmanager 报
+# NetworkExtensionErrorDomain Code=6 → sysextd 校验失败当场卸载新扩展 →
+# VpnChannel.start() 卡在 step① 永远建不出 VPN 配置。改这里务必同步 compile-macos.sh。
 write_entitlements(){
-  cat > "$WORK/app.entitlements" <<'PLIST'
+  cat > "$WORK/app.entitlements" <<PLIST
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0"><dict>
-	<key>com.apple.application-identifier</key><string>BYL4KQHMTN.com.pangolin.pangolin</string>
-	<key>com.apple.developer.team-identifier</key><string>BYL4KQHMTN</string>
+	<key>com.apple.application-identifier</key><string>${TEAM_ID}.com.pangolin.pangolin</string>
+	<key>com.apple.developer.team-identifier</key><string>${TEAM_ID}</string>
 	<key>com.apple.developer.system-extension.install</key><true/>
 	<key>com.apple.developer.networking.networkextension</key>
 	<array><string>packet-tunnel-provider-systemextension</string></array>
 	<key>com.apple.security.app-sandbox</key><false/>
 	<key>com.apple.security.network.client</key><true/>
 	<key>com.apple.security.network.server</key><true/>
+	<key>com.apple.security.application-groups</key>
+	<array><string>${APP_GROUP}</string></array>
 	<key>keychain-access-groups</key>
-	<array><string>BYL4KQHMTN.com.pangolin.pangolin</string></array>
+	<array><string>${TEAM_ID}.com.pangolin.pangolin</string></array>
 </dict></plist>
 PLIST
-  cat > "$WORK/sysext.entitlements" <<'PLIST'
+  cat > "$WORK/sysext.entitlements" <<PLIST
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0"><dict>
-	<key>com.apple.application-identifier</key><string>BYL4KQHMTN.com.pangolin.pangolin.PacketTunnel</string>
-	<key>com.apple.developer.team-identifier</key><string>BYL4KQHMTN</string>
+	<key>com.apple.application-identifier</key><string>${TEAM_ID}.com.pangolin.pangolin.PacketTunnel</string>
+	<key>com.apple.developer.team-identifier</key><string>${TEAM_ID}</string>
 	<key>com.apple.developer.networking.networkextension</key>
 	<array><string>packet-tunnel-provider-systemextension</string></array>
 	<key>com.apple.security.app-sandbox</key><true/>
+	<!-- 沙箱 sysext 必须显式网络权限才能对外建连(同仓库 PacketTunnel.entitlements;
+	     v1.1.2 CI 重签漏掉这两键 → 隧道连不上节点)。 -->
+	<key>com.apple.security.network.client</key><true/>
+	<key>com.apple.security.network.server</key><true/>
 	<key>com.apple.security.application-groups</key>
-	<array><string>group.com.pangolin.pangolin</string></array>
+	<array><string>${APP_GROUP}</string></array>
 </dict></plist>
 PLIST
 }

+# ── App Group 一致性闸(装机前拦截,规则没上闸 = 没有规则)────────────────────
+# 读**最终产物的签名**(不是仓库里的 .entitlements 源文件),因为真正决定成败的是
+# 签进去的那份;Xcode 与重签脚本都可能覆盖它。
+verify_app_group(){
+  [ -d "$APP" ] || die "先 build:找不到 $APP"
+  [ -d "$SE" ]  || die "找不到 sysext: $SE"
+  log "App Group / NEMachServiceName 一致性闸"
+  codesign -d --entitlements - --xml "$APP" > "$WORK/app.ents.plist" 2>/dev/null || true
+  codesign -d --entitlements - --xml "$SE"  > "$WORK/se.ents.plist"  2>/dev/null || true
+  local app_g se_g mach
+  app_g="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.application-groups:0' "$WORK/app.ents.plist" 2>/dev/null || true)"
+  se_g="$(/usr/libexec/PlistBuddy  -c 'Print :com.apple.security.application-groups:0' "$WORK/se.ents.plist"  2>/dev/null || true)"
+  mach="$(/usr/libexec/PlistBuddy  -c 'Print :NetworkExtension:NEMachServiceName' "$SE/Contents/Info.plist" 2>/dev/null || true)"
+  echo "  主 app  App Group : ${app_g:-<缺失>}"
+  echo "  sysext App Group : ${se_g:-<缺失>}"
+  echo "  NEMachServiceName: ${mach:-<缺失>}"
+  [ -n "$app_g" ] || die "主 app 缺 com.apple.security.application-groups —— 与扩展无法共享容器/Mach 通道"
+  [ -n "$se_g" ]  || die "sysext 缺 com.apple.security.application-groups"
+  [ "$app_g" = "$APP_GROUP" ] || die "主 app App Group 应为 $APP_GROUP,实为 $app_g"
+  [ "$se_g"  = "$APP_GROUP" ] || die "sysext App Group 应为 $APP_GROUP,实为 $se_g"
+  case "$mach" in
+    "$APP_GROUP"*) ;;
+    *) die "NEMachServiceName($mach)必须以 App Group($APP_GROUP)为前缀,否则 sysextd 校验失败 Code=6" ;;
+  esac
+  # 沙箱 sysext 无 network.client/server = 无权对外建连 → 隧道起了也连不上节点(v1.1.2 事故)。
+  local se_nc se_ns
+  se_nc="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.network.client' "$WORK/se.ents.plist" 2>/dev/null || true)"
+  se_ns="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.network.server' "$WORK/se.ents.plist" 2>/dev/null || true)"
+  echo "  sysext network.client=${se_nc:-<缺失>} network.server=${se_ns:-<缺失>}"
+  [ "$se_nc" = "true" ] || die "sysext 缺 com.apple.security.network.client —— 沙箱扩展无权出站,隧道连不上节点"
+  [ "$se_ns" = "true" ] || die "sysext 缺 com.apple.security.network.server"
+  echo "  ✅ 一致($APP_GROUP)"
+}
+
+# ── 递增 sysext 的 CFBundleVersion ───────────────────────────────────────
+# PacketTunnel target 不吃 FLUTTER_BUILD_NUMBER,版本号是 project.pbxproj 里写死的
+# CURRENT_PROJECT_VERSION。不递增 → sysextd 视为同版本**不更新**,装上去跑的还是旧扩展
+# (CLAUDE.md「每次构建必递增 CFBundleVersion」)。与 compile-macos.sh 同法 sed 全量替换。
+cmd_bump_build(){
+  local cur next
+  cur="$(grep -m1 -E 'CURRENT_PROJECT_VERSION = [0-9]+;' "$PBXPROJ" | tr -dc '0-9')"
+  [ -n "$cur" ] || die "读不到 CURRENT_PROJECT_VERSION: $PBXPROJ"
+  next=$((cur + 1))
+  sed -i '' -E "s/CURRENT_PROJECT_VERSION = [0-9]+;/CURRENT_PROJECT_VERSION = ${next};/g" "$PBXPROJ"
+  log "sysext 构建号 ${cur} → ${next}"
+}
+
 cs(){ codesign --force --options runtime --timestamp "$@"; }

 cmd_build(){
@@ -386,10 +451,14 @@ case "${1:-}" in
  run)      cmd_run ;;
  # Xcode 工程已配 Developer ID 手动签名(Release 配置),build 即出 DevID 包,无需 sign。
  all)      cmd_build; cmd_notarize; cmd_copy; cmd_run ;;
+  # 装机一条龙。比 all 多两步:①先递增 sysext 构建号(否则 sysextd 不换扩展)
+  # ②公证前过 App Group 一致性闸(不一致直接中止,别浪费 1-5 分钟公证)。
+  macos)    cmd_bump_build; cmd_build; verify_app_group; cmd_notarize; cmd_copy; cmd_run ;;
+  verify)   verify_app_group ;;     # 只跑一致性闸(不构建),排障用
  ks-baseline) cmd_ks_baseline ;;   # ① VPN 断开下记录真实公网 IP
  ks-test)     cmd_ks_test ;;       # ② VPN 连接(killswitch 开)下杀扩展做漏测
  ks-status)   cmd_ks_status ;;     # 看 VPN 状态 + killswitch 配置打点日志
  ios-devices) cmd_ios_devices ;;   # 列出已连接的 iOS 物理设备(拿 device id)
  ipad|ios)    cmd_ipad "${2:-}" ;; # 构建 iOS release 并装到 iPad(可传设备 id/名字子串)
-  *) echo "用法: $0 {all|build|sign|notarize|copy|run|ks-baseline|ks-test|ks-status|ios-devices|ipad [id]}"; exit 2 ;;
+  *) echo "用法: $0 {macos|all|build|sign|verify|notarize|copy|run|ks-baseline|ks-test|ks-status|ios-devices|ipad [id]}"; exit 2 ;;
 esac
@@ -48,14 +48,16 @@ import (
 )

 func main() {
-	listenAddr := flag.String("addr", "", "HTTP listen address (default :8080, overridden by ADDR env)")
+	listenAddr := flag.String("addr", "", "HTTP listen address (default 127.0.0.1:8080, overridden by ADDR env)")
 	flag.Parse()

 	if *listenAddr == "" {
 		if v := os.Getenv("ADDR"); v != "" {
 			*listenAddr = v
 		} else {
-			*listenAddr = ":8080"
+			// 默认只绑 loopback:控制面对外一律经 cloudflared 隧道(见 CLAUDE.md),
+			// 源站不该裸监听公网。要跨主机监听须显式设 ADDR=:8080(明知代价)。
+			*listenAddr = "127.0.0.1:8080"
 		}
 	}

@@ -327,12 +327,12 @@ header .header-meta{color:var(--fg-soft)}
 <header>
  <div class="wrap">
    <h1>feature+windows — 项目 TODO</h1>
-    <div class="header-meta">生成于 2026-08-01 · 真相源 todo/todo.json</div>
+    <div class="header-meta">生成于 2026-08-09 · 真相源 todo/todo.json</div>
    <div class="stats">
-      <div class="stat-pill"><strong>26</strong>全部</div>
-      <div class="stat-pill"><strong>13</strong>待开始</div>
+      <div class="stat-pill"><strong>29</strong>全部</div>
+      <div class="stat-pill"><strong>15</strong>待开始</div>
      <div class="stat-pill"><strong>0</strong>开发中</div>
-      <div class="stat-pill"><strong>5</strong>待验收</div>
+      <div class="stat-pill"><strong>6</strong>待验收</div>
      <div class="stat-pill"><strong>8</strong>已验收</div>
      
    </div>
@@ -376,12 +376,43 @@ header .header-meta{color:var(--fg-soft)}
  
  <div class="section-block" id="section-open">
    <div class="section-title st-open" data-toggle="open">
-      📋 待开始 <span class="s-count">13</span>
+      📋 待开始 <span class="s-count">15</span>
      <span class="s-arrow">▴ 收起</span>
    </div>
    <div class="section-list-wrap " id="list-wrap-open">
      <ul class="todo-list" id="list-open">
        
+    <li class="todo-card s-open"
+        data-id="29"
+        data-level="high"
+        data-status="open"
+        data-tier="2"
+        data-tags="Windows,后端">
+      <div class="card-header">
+        <span class="item-id">#29</span>
+        <span class="item-title">Windows 端 chenxin 设备连接凭据已过期，需重新签发并补过期处理</span>
+        <div class="card-badges">
+          <span class="tag status-badge s-open">待开始</span>
+          <span class="tag t-block">高优 · 紧急</span>
+          <span class="tag tier-2">二级</span>
+          
+          
+        </div>
+      </div>
+      
+      <div class="item-desc">设备 Win·chenxin（devices.id=25，dp_uuid 019f599b-d11a-7763-9099-9935f4b49070，client_version v1.0.72）的 connect_credentials 已于 2026-08-01 18:19 UTC 过期，agent 随后把它从 /etc/sing-box/config.json 的 reality-in users 里清掉了（当前只剩 019f55d6 和 019f8c8f 两个）。客户端对此无感知，持续高频重连，sing-box 一路报 REALITY: processed invalid connection。实测最近 2 小时该出口 IP 124.88.8.196 刷了 1801 条失败日志，占服务端全部握手失败的约 99%，把真正的故障信号淹没了（这次排查 Mac 问题时一度被误导）。处理项：1) 先给该 dp_uuid 重新签发凭据，恢复 chenxin 可用；2) 查清为什么它没像 Mac 那样自动续期成功——Mac 的 019f55d6 已续到 2026-08-09，说明续期链路本身是通的，怀疑 v1.0.72 版本客户端的续期逻辑有缺陷或登录态已失效；3) 客户端在凭据过期时应给出明确提示并做退避重试，而不是无限高频重连；4) 服务端对同一 dp_uuid 的连续握手失败做限频或告警，避免单台故障设备淹没日志。</div>
+      
+      
+      <div class="card-footer">
+        <div class="tag-row"><span class="tag t-tag" data-tag="Windows">Windows</span> <span class="tag t-tag" data-tag="后端">后端</span></div>
+        <div class="item-meta">
+      <span class="tag owner-agent">🤖 agent</span>
+      <span class="meta-date">🕐 2026-08-08</span>
+      
+    </div>
+      </div>
+    </li>
+
    <li class="todo-card s-open"
        data-id="1"
        data-level="mid"
@@ -781,6 +812,37 @@ header .header-meta{color:var(--fg-soft)}
      <span class="tag owner-agent">🤖 agent</span>
      <span class="meta-date">🕐 2026-06-22</span>
      
+    </div>
+      </div>
+    </li>
+
+    <li class="todo-card s-open"
+        data-id="30"
+        data-level="low"
+        data-status="open"
+        data-tier="3"
+        data-tags="前端,iOS,Android,mac,Windows">
+      <div class="card-header">
+        <span class="item-id">#30</span>
+        <span class="item-title">补齐 es/ja/ko/ru 四语的 28 条支付文案（当前回退英文）</span>
+        <div class="card-badges">
+          <span class="tag status-badge s-open">待开始</span>
+          <span class="tag t-low">一般 / 优化</span>
+          <span class="tag tier-3">三级</span>
+          
+          
+        </div>
+      </div>
+      
+      <div class="item-desc">本次为修构建引入了英文兜底机制：主语言改为英语，StringsEs/Ja/Ko/Ru/Zh 一律 extends StringsEn，未覆写的文案自动回退英文，缺翻译不再是编译错误（原先四个语言文件各缺 28 条，直接把 kernel_snapshot 打挂）。构建期由 ci/check-l10n-coverage.mjs 列出缺口，只报 warning 不阻断。当前缺口：es/ja/ko/ru 各缺 28 条，合计 112 处，覆盖率均为 161/189 = 85.2 百分比；en/zh 已 100 百分比。缺的都是支付相关：purchaseTitle, paymentTitle, buyNow, payMethodAlipay, payMethodCrypto, choosePayMethod, proMonthly, proQuarterly, proYearly, perQuarter, perYear, payAmountLabel, payAddressLabel, payNetworkLabel, payExactAmountHint, copied, openAlipay, openAlipayHint, openAlipayFailed, awaitingPayment, paySucceeded, payExpiresAt, payDone, payFailed, payRetry, switchPayMethod, cancelOrder, qrNotSupported。注意红线词规范（禁 VPN/翻墙/科学上网等），文案定位为网络加速/体验优化+隐私，见各 strings 文件头部注释。补齐后 warning 自动消失。</div>
+      
+      
+      <div class="card-footer">
+        <div class="tag-row"><span class="tag t-tag" data-tag="前端">前端</span> <span class="tag t-tag" data-tag="iOS">iOS</span> <span class="tag t-tag" data-tag="Android">Android</span> <span class="tag t-tag" data-tag="mac">mac</span> <span class="tag t-tag" data-tag="Windows">Windows</span></div>
+        <div class="item-meta">
+      <span class="tag owner-agent">🤖 agent</span>
+      <span class="meta-date">🕐 2026-08-08</span>
+      
    </div>
      </div>
    </li>
@@ -800,12 +862,43 @@ header .header-meta{color:var(--fg-soft)}
  </div>
  <div class="section-block" id="section-done">
    <div class="section-title st-done" data-toggle="done">
-      🔍 待验收 <span class="s-count">5</span>
+      🔍 待验收 <span class="s-count">6</span>
      <span class="s-arrow">▴ 收起</span>
    </div>
    <div class="section-list-wrap " id="list-wrap-done">
      <ul class="todo-list" id="list-done">
        
+    <li class="todo-card s-done"
+        data-id="28"
+        data-level="high"
+        data-status="done"
+        data-tier="2"
+        data-tags="mac,CI/CD">
+      <div class="card-header">
+        <span class="item-id">#28</span>
+        <span class="item-title">修复 macOS PacketTunnel 系统扩展 App Group 不一致导致装不上</span>
+        <div class="card-badges">
+          <span class="tag status-badge s-done">待验收</span>
+          <span class="tag t-block">高优 · 紧急</span>
+          <span class="tag tier-2">二级</span>
+          
+          <button class="reject-btn" data-id="28" data-title="修复 macOS PacketTunnel 系统扩展 App Group 不一致导致装不上">拒绝验收</button>
+        </div>
+      </div>
+      
+      <div class="item-desc">根因：scripts/ci/compile-macos.sh 第 221 行把 sysext 的 application-groups 硬编码成 iOS 风格的 group.com.pangolin.pangolin，且第 195-210 行生成的 app.entitlements 完全没有 application-groups 键。二者与扩展 Info.plist 里的 NEMachServiceName（BYL4KQHMTN.com.pangolin.pangolin.PacketTunnel）对不上前缀 —— nesessionmanager 报 NetworkExtensionErrorDomain Code=6，sysextd 校验失败当场卸载刚 staging 的新扩展；VpnChannel.start() 的 step1 activateSystemExtensionIfNeeded 抛 code=9，永远走不到 step2 的 loadOrCreateManager，NETunnelProviderManager 配置建不出来，scutil --nc list 里没有 Pangolin，客户端一个包都发不到服务器（服务端侧该 Mac 出口 IP 的握手尝试数为 0）。这违反了 CLAUDE.md 第 152 行已写明的铁律。注意这两个 entitlements 是 codesign --force 最终覆盖签名用的，仓库里的 .entitlements 源文件只在 Xcode 编译阶段生效，所以线上包坏而本地 all 流程正常。修复：compile-macos.sh 两处改用脚本第 99 行已定义的 APP_GROUP 变量，app.entitlements 补 application-groups。scripts/local_test.sh 的同款硬编码本次已修，并新增 verify_app_group 一致性闸（读最终产物签名，比对两端 App Group 与 NEMachServiceName 前缀）和 macos 一条龙子命令。建议把同样的闸加进 .gitea/workflows/ci.yml。改完需重新构建+公证+替换 api.yanmeiai.com/downloads/pangolin-macos-x64.zip。附带：受影响机器会堆积多个 terminated waiting to uninstall on reboot 的旧扩展（本机 13 个，已 38 天未重启），建议重启清理。</div>
+      
+      
+      <div class="card-footer">
+        <div class="tag-row"><span class="tag t-tag" data-tag="mac">mac</span> <span class="tag t-tag" data-tag="CI/CD">CI/CD</span></div>
+        <div class="item-meta">
+      <span class="tag owner-agent">🤖 agent</span>
+      <span class="meta-date">🕐 2026-08-08</span>
+      
+    </div>
+      </div>
+    </li>
+
    <li class="todo-card s-done"
        data-id="18"
        data-level="mid"
@@ -1,9 +1,9 @@
 {
  "meta": {
    "title": "feature+windows — 项目 TODO",
-    "updated_at": "2026-07-31T16:34:06.427Z"
+    "updated_at": "2026-08-08T16:07:14.004Z"
  },
-  "seq": 27,
+  "seq": 30,
  "items": [
    {
      "id": 1,
@@ -429,6 +429,60 @@
      "done": false,
      "completed_at": null,
      "version": null
+    },
+    {
+      "id": 28,
+      "title": "修复 macOS PacketTunnel 系统扩展 App Group 不一致导致装不上",
+      "desc": "根因：scripts/ci/compile-macos.sh 第 221 行把 sysext 的 application-groups 硬编码成 iOS 风格的 group.com.pangolin.pangolin，且第 195-210 行生成的 app.entitlements 完全没有 application-groups 键。二者与扩展 Info.plist 里的 NEMachServiceName（BYL4KQHMTN.com.pangolin.pangolin.PacketTunnel）对不上前缀 —— nesessionmanager 报 NetworkExtensionErrorDomain Code=6，sysextd 校验失败当场卸载刚 staging 的新扩展；VpnChannel.start() 的 step1 activateSystemExtensionIfNeeded 抛 code=9，永远走不到 step2 的 loadOrCreateManager，NETunnelProviderManager 配置建不出来，scutil --nc list 里没有 Pangolin，客户端一个包都发不到服务器（服务端侧该 Mac 出口 IP 的握手尝试数为 0）。这违反了 CLAUDE.md 第 152 行已写明的铁律。注意这两个 entitlements 是 codesign --force 最终覆盖签名用的，仓库里的 .entitlements 源文件只在 Xcode 编译阶段生效，所以线上包坏而本地 all 流程正常。修复：compile-macos.sh 两处改用脚本第 99 行已定义的 APP_GROUP 变量，app.entitlements 补 application-groups。scripts/local_test.sh 的同款硬编码本次已修，并新增 verify_app_group 一致性闸（读最终产物签名，比对两端 App Group 与 NEMachServiceName 前缀）和 macos 一条龙子命令。建议把同样的闸加进 .gitea/workflows/ci.yml。改完需重新构建+公证+替换 api.yanmeiai.com/downloads/pangolin-macos-x64.zip。附带：受影响机器会堆积多个 terminated waiting to uninstall on reboot 的旧扩展（本机 13 个，已 38 天未重启），建议重启清理。",
+      "level": "high",
+      "tier": 2,
+      "tags": [
+        "mac",
+        "CI/CD"
+      ],
+      "owner": "agent",
+      "status": "done",
+      "created_at": "2026-08-08T01:20:23.304Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
+    },
+    {
+      "id": 29,
+      "title": "Windows 端 chenxin 设备连接凭据已过期，需重新签发并补过期处理",
+      "desc": "设备 Win·chenxin（devices.id=25，dp_uuid 019f599b-d11a-7763-9099-9935f4b49070，client_version v1.0.72）的 connect_credentials 已于 2026-08-01 18:19 UTC 过期，agent 随后把它从 /etc/sing-box/config.json 的 reality-in users 里清掉了（当前只剩 019f55d6 和 019f8c8f 两个）。客户端对此无感知，持续高频重连，sing-box 一路报 REALITY: processed invalid connection。实测最近 2 小时该出口 IP 124.88.8.196 刷了 1801 条失败日志，占服务端全部握手失败的约 99%，把真正的故障信号淹没了（这次排查 Mac 问题时一度被误导）。处理项：1) 先给该 dp_uuid 重新签发凭据，恢复 chenxin 可用；2) 查清为什么它没像 Mac 那样自动续期成功——Mac 的 019f55d6 已续到 2026-08-09，说明续期链路本身是通的，怀疑 v1.0.72 版本客户端的续期逻辑有缺陷或登录态已失效；3) 客户端在凭据过期时应给出明确提示并做退避重试，而不是无限高频重连；4) 服务端对同一 dp_uuid 的连续握手失败做限频或告警，避免单台故障设备淹没日志。",
+      "level": "high",
+      "tier": 2,
+      "tags": [
+        "Windows",
+        "后端"
+      ],
+      "owner": "agent",
+      "status": "open",
+      "created_at": "2026-08-08T01:20:48.075Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
+    },
+    {
+      "id": 30,
+      "title": "补齐 es/ja/ko/ru 四语的 28 条支付文案（当前回退英文）",
+      "desc": "本次为修构建引入了英文兜底机制：主语言改为英语，StringsEs/Ja/Ko/Ru/Zh 一律 extends StringsEn，未覆写的文案自动回退英文，缺翻译不再是编译错误（原先四个语言文件各缺 28 条，直接把 kernel_snapshot 打挂）。构建期由 ci/check-l10n-coverage.mjs 列出缺口，只报 warning 不阻断。当前缺口：es/ja/ko/ru 各缺 28 条，合计 112 处，覆盖率均为 161/189 = 85.2 百分比；en/zh 已 100 百分比。缺的都是支付相关：purchaseTitle, paymentTitle, buyNow, payMethodAlipay, payMethodCrypto, choosePayMethod, proMonthly, proQuarterly, proYearly, perQuarter, perYear, payAmountLabel, payAddressLabel, payNetworkLabel, payExactAmountHint, copied, openAlipay, openAlipayHint, openAlipayFailed, awaitingPayment, paySucceeded, payExpiresAt, payDone, payFailed, payRetry, switchPayMethod, cancelOrder, qrNotSupported。注意红线词规范（禁 VPN/翻墙/科学上网等），文案定位为网络加速/体验优化+隐私，见各 strings 文件头部注释。补齐后 warning 自动消失。",
+      "level": "low",
+      "tier": 3,
+      "tags": [
+        "前端",
+        "iOS",
+        "Android",
+        "mac",
+        "Windows"
+      ],
+      "owner": "agent",
+      "status": "open",
+      "created_at": "2026-08-08T01:41:54.388Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
    }
  ]
 }
@@ -25,6 +25,17 @@ import { makeT } from '../../lib/i18n';
 import { getClient } from '../../lib/api/client';
 import { bilingual } from '../../lib/api/errors';

+/** 站点 basePath(与 next.config.js 一致)。本页用的是 window.location 原生跳转,
+ *  Next 不会自动补 basePath,故绝对路径必须手动加前缀,否则会落到站点根(官网主页)
+ *  而不是用户中心 —— 这正是「点用户中心却跳到主页、还要求重新登录」的根因。 */
+const BASE_PATH = process.env.NEXT_PUBLIC_BASE_PATH ?? '/user';
+
+/** 把本站相对路径补上 basePath(供 window.location 原生跳转用)。 */
+function withBase(path: string): string {
+  const p = path.startsWith('/') ? path : `/${path}`;
+  return `${BASE_PATH}${p}`;
+}
+
 /** redirect 白名单：仅本站相对路径(单个 '/' 开头),其余一律回 '/'。 */
 function safeRedirect(raw: string | null): string {
  if (!raw) return '/';
@@ -45,14 +56,15 @@ export default function SsoPage() {
    const redirect = safeRedirect(params.get('redirect'));

    // 票据只用一次,立刻从地址栏抹掉,不留浏览器历史(与 jiu 一致)。
+    // 原生 history/location 不吃 Next 的 basePath,须手动补,否则地址与跳转都会漂到站点根。
    try {
-      window.history.replaceState(null, '', '/sso/');
+      window.history.replaceState(null, '', withBase('/sso/'));
    } catch {
      /* ignore */
    }

    if (!ticket) {
-      window.location.replace('/');
+      window.location.replace(withBase('/'));
      return;
    }

@@ -61,14 +73,14 @@ export default function SsoPage() {
      .exchangeWebTicket(ticket)
      .then(() => {
        if (!alive) return;
-        window.location.replace(redirect);
+        window.location.replace(withBase(redirect));
      })
      .catch((e) => {
        if (!alive) return;
        setMsg(bilingual(e, lang));
        setFailed(true);
        setTimeout(() => {
-          window.location.replace('/');
+          window.location.replace(withBase('/'));
        }, 1500);
      });
Author	SHA1	Message	Date
wangjia	def3bb34b8	fix(server): 控制面 8080 收口——默认绑 loopback + 部署时幂等纠偏 ADDR/ufw Deploy Server / deploy-server (push) Successful in 4m33s Details Deploy Site / deploy-site (push) Successful in 2m19s Details Deploy Client / build-windows (push) Successful in 1m39s Details Deploy Client / build-android (push) Successful in 3m49s Details Deploy Client / build-macos (push) Failing after 1m47s Details Deploy Client / build-ios (push) Failing after 16m18s Details Deploy Client / release-deploy (push) Successful in 1m39s Details 现网 server.env 漂移成 ADDR=:8080(全网卡),ufw 又放行 8080 → 控制面 API 明文裸奔公网(http://<IP>:8080),绕过 cloudflared/CF 的 TLS 层。两处硬化: - main.go:ADDR 未设时默认由 :8080 改 127.0.0.1:8080(防御纵深;跨主机监听须显式设 ADDR) - deploy-server.sh:部署重启前幂等把 ADDR=:8080 纠回 127.0.0.1:8080(备份原文件)+ 撤 ufw allow 8080/tcp。收口随 server-v* 发版自动落地,不再手改线上。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD	2026-08-09 10:02:10 +08:00
wangjia	bb031a04c1	fix(client/web): 语言跟随系统 + SSO 落地补 basePath + 移除账户页续费按钮 - 语言(#1):LocaleNotifier 首启无用户选择时读设备 locale(zh/ja/ko/ru/es 命中对应语种,余回退英文),原来恒为固定默认 en、从不看系统语言。用户显式切换仍持久化优先。 - 用户中心 SSO(#3):usercenter 运行在 basePath=/user,但 /sso 落地页用原生 window.location.replace('/') 跳转(Next 不补 basePath)→ 落到站点根=官网主页, 且换票已建立的会话看起来像未登录。改为 withBase() 统一补 /user 前缀,兑票成功直达 /user/ 且保持登录态。(服务端 issue/exchange 流程实测均 200,非后端问题) - 账户页(#4):移除"续费/升级"按钮(免费卡片 + PRO 横幅两处)及其未用组件;购买入口仍由"购买套餐"行保留,不影响下单路径。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD	2026-08-09 09:42:25 +08:00
wangjia	e7e59a786d	fix(client): 默认 UI 品牌文案统一英文 Pangolin(窗口标题/托盘/安装包名/macOS 菜单栏) 默认 UI 语言是英文,但窗口标题(windowManager.setTitle)、MaterialApp title、托盘 tooltip 与右键菜单、Windows 安装包显示名、macOS CFBundleName 硬编码中文, 中英混排。统一改英文品牌名;iOS 桌面图标名(CFBundleDisplayName=穿山甲)按市场定位保留。托盘菜单文案后续可接 l10n(现契约无 tray 键)。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD	2026-08-09 01:43:39 +08:00
wangjia	b59101abf1	chore(scripts): local_test 默认 API 改指生产域名(8080 公网收口后旧默认失效) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD	2026-08-09 00:54:03 +08:00
wangjia	0ddcc5e935	fix(client/macos): CI 重签 sysext entitlements 补 network.client/server + 闸断言 Deploy Client / build-windows (push) Successful in 1m43s Details Deploy Client / build-android (push) Successful in 5m13s Details Deploy Client / build-macos (push) Successful in 6m53s Details Deploy Client / build-ios (push) Failing after 12m28s Details Deploy Client / release-deploy (push) Successful in 2m6s Details v1.1.2 事故第二弹:inside-out 重签的 sysext heredoc 漏了 com.apple.security.network.client/server —— 沙箱扩展无权对外建连, 隧道起了也连不上节点(本地 Xcode 直签用仓库 PacketTunnel.entitlements 带这两键,故 local_test 流程正常,唯 CI 包不通)。 - compile-macos.sh / local_test.sh cmd_sign:sysext heredoc 补两键(与仓库源文件对齐) - 公证前一致性闸扩展:断言 sysext 最终签名 network.client/server=true,重签丢键即 fail - 已本地验证:对 v1.1.2 发布包用新 entitlements 重签,读回签名两键在位 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD	2026-08-09 00:49:05 +08:00
wangjia	0c6957fcb5	chore(todo): #28 App Group 修复已发版 client-v1.1.2,标 done 待验收 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD	2026-08-09 00:07:14 +08:00
wangjia	6a4da3e164	chore(todo): 记 #28 App Group 事故复盘 + #29 chenxin 凭据过期 + #30 四语支付文案缺口 Deploy Client / build-windows (push) Successful in 1m43s Details Deploy Client / build-android (push) Successful in 6m57s Details Deploy Client / build-macos (push) Successful in 8m43s Details Deploy Client / build-ios (push) Successful in 4m53s Details Deploy Client / release-deploy (push) Successful in 2m6s Details Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD	2026-08-08 23:41:36 +08:00
wangjia	77302cfa7a	fix(client/macos): CI 重签 App Group 修回 macOS 原生格式 + 公证前一致性闸 compile-macos.sh 的 sysext entitlements 曾硬编码 iOS 风格 group. 前缀,且主 app entitlements 缺 application-groups —— 与 NEMachServiceName 前缀对不上, nesessionmanager 报 Code=6,sysextd 当场卸载新扩展,线上包永远建不出 VPN 配置 (本地 Xcode 直签流程正常,故长期未察觉;详见 todo #28)。 - compile-macos.sh: 两处 entitlements 改用 ${APP_GROUP};公证前加一致性闸 (读最终签名核对 app/sysext App Group 与 NEMachServiceName 前缀,不一致即 fail) - local_test.sh: 同款修复 + verify_app_group 闸 + cmd_bump_build 自动递增 sysext 构建号 + macos 一条龙子命令(bump→build→闸→公证→装→跑) - pbxproj: CURRENT_PROJECT_VERSION 53→55(本地已构建两次,保持单调) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD	2026-08-08 23:41:36 +08:00
wangjia	79830cb43f	fix(ci): client release-deploy 加 if 守卫,mac/ios 抖失败不阻发布 Deploy Client / build-windows (push) Successful in 1m42s Details Deploy Client / build-android (push) Successful in 5m8s Details Deploy Client / build-macos (push) Successful in 8m3s Details Deploy Client / build-ios (push) Successful in 4m59s Details Deploy Client / release-deploy (push) Successful in 2m2s Details run 239:android/windows/macos 全绿、ios 在 Checkout 阶段 git fetch git.51yanmei.com 走 frps 超时挂掉(非 iOS 构建问题;run 238 同代码 fetch 碰巧成功)。因上一版把 build-ios 加进 release-deploy 的 needs,而 gitea 里 continue-on-error 的 job 失败仍会 skip 下游 needs → release-deploy 被跳过。修:needs 保留四平台(等全部完成、不抢跑 → 收齐已上传产物),但加 `if: always() && needs.build-android.result == 'success'` —— 只要 android (稳定 floor)成功即发布,mac/ios/windows 的瞬断失败不再 skip release-deploy, download-artifact 收当时存在的产物照发。 yaml 校验通过。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A79VtQA1BwTuQN1ThpvYpo	2026-08-03 00:17:53 +08:00
wangjia	fdc13ea06c	fix(ci): client release-deploy 挪到 nas runner + 等全平台构建 Deploy Client / build-windows (push) Successful in 1m41s Details Deploy Client / build-android (push) Successful in 4m40s Details Deploy Client / build-macos (push) Successful in 7m30s Details Deploy Client / build-ios (push) Failing after 11m51s Details Deploy Client / release-deploy (push) Has been skipped Details client-v1.1.1 首跑:4 平台 build 全绿,但 release-deploy 卡在「Release → Forgejo」curl exit 28(超时,3m3s=release_ensure 60s×3 重试耗尽)。根因: release-deploy `runs-on: mac`(mac-pangolin-2)访问 git.51yanmei.com 走 frps 隧道 → 抖断。deploy-server/deploy-site 同类 Forgejo release 步跑在 ubuntu-latest(nas act_runner,与 gitea 同机/同网)稳定通过(server 仅 13s)。 - runs-on: mac → ubuntu-latest:release-deploy 全为网络/SSH 步骤(下载产物/ 传 Forgejo/SSH pangolin1/通知),无 mac 专属需求,挪到 nas runner 走本地。 - needs: [build-android] → [build-android, build-windows, build-macos, build-ios]: 等全部平台 build 完再发布,修旧竞态(只等 android → macos/ios 产物没传就发布漏平台)。macos/ios 保留 continue-on-error,失败不阻断已成功平台。 - 更新过时注释(原称 Apple secret 未配 / needs 仅 android+windows)。 yaml 校验通过。build 四平台本身已在 run 639 全绿,本次只修发布环节。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A79VtQA1BwTuQN1ThpvYpo	2026-08-01 23:47:29 +08:00