Skip to content

PocketShell v1.8.0

Choose a tag to compare

View all tags
@Big-Pony Big-Pony released this 03 Aug 07:15
v1.8.0
1709b64

v1.8.0 — 2026-08-03

变更

  • devices remove 对常驻 Agent 即时生效：Agent 每 3 秒轮询设备表，命令行删除设备后数秒内该设备失去授权、在线连接被断开、推送订阅被清除，无需重启。
  • 应用内更新只从官方仓库安装：POCKETSHELL_UPDATE_REPO 指向其他仓库时，检查更新照常工作，但不再自动替换二进制。

修复

  • devices remove 对运行中的 Agent 无效：命令行删除的设备仍能连接，且 Agent 的下一次心跳会把该设备写回设备表、静默撤销这次删除 → 现在删除立即生效且不会被写回。

移除

  • 网页管理页（/admin、/admin-api/*）：改用命令行 pocketshell-agent pair / devices list / devices remove <指纹>，功能一一对应。
  • POCKETSHELL_ADMIN 环境变量：已不再被读取，保留在配置里不影响启动。

安全

  • 管理页可被公网匿名访问（高危）：管理页唯一的凭证是「请求来自 127.0.0.1」，而同机反向代理（Caddy / Nginx / Cloudflare Tunnel / frp，即部署文档推荐的全部四种）正是从该地址连入，因此公网请求也能通过。任何人 POST /admin-api/pair 即可取得可用配对串，完成配对后获得完整操作员权限 → 管理页整体移除。在 v1.7.x 或更早版本上跑过反向代理部署的用户请自查：<keyDir>/audit.log 中有无自己未触发的 admin_pair_new 事件，以及 pocketshell-agent devices list 中有无不认识的设备。
  • 管理接口 CSRF：管理接口的 POST 端点无 CSRF 防护，可被恶意页面跨域触发 → 随管理页移除一并消失。
  • 文件预览允许任意来源跨域读取：预览响应带 access-control-allow-origin: *，预览地址一旦泄露即可被任意站点跨域读取 → 移除该响应头（App 通过 <img>/<video>/<iframe> 加载，不受影响）。
  • 应用内更新的校验链自引用：二进制与其校验文件来自同一 Release，改写 POCKETSHELL_UPDATE_REPO 即可让 Agent 自动安装任意二进制 → 自动更新限定为官方仓库。

已知问题

  • 预览地址中的令牌仍在 URL 路径里（有效期 30 分钟，响应已带 no-referrer 与 no-store）。改为请求头传递会破坏视频的分段请求，暂不改动。

升级

应用内点更新徽标，或：

curl -fsSL https://raw.githubusercontent.com/Big-Pony/pocketshell/main/install.sh | sh

装成服务的升级后需重启：sudo systemctl restart pocketshell（macOS 上 launchd 会自动拉起）。

升级后如需管理设备，改用命令行（在 Agent 所在机器上执行）：

pocketshell-agent pair                          # 生成配对串
pocketshell-agent devices list                  # 查看已配对设备
pocketshell-agent devices remove <指纹>          # 吊销设备

v1.8.0 — 2026-08-03

Changed

  • devices remove now takes effect on a running Agent: the Agent polls the device registry every 3 seconds, so a device removed from the command line loses its authorization, has its live connection closed, and has its push subscriptions dropped within seconds — no restart required.
  • In-app updates install only from the official repository: with POCKETSHELL_UPDATE_REPO pointing elsewhere, update checks keep working but the binary is no longer replaced automatically.

Fixed

  • devices remove did nothing to a running Agent: a device removed from the command line could still connect, and the Agent's next heartbeat wrote it back into the registry, silently undoing the removal → removal now applies immediately and is not written back.

Removed

  • The web admin page (/admin, /admin-api/*): use pocketshell-agent pair / devices list / devices remove <fingerprint> instead — the commands cover the same functions.
  • The POCKETSHELL_ADMIN environment variable: no longer read; leaving it in a service config does not affect startup.

Security

  • The admin page was reachable anonymously from the public internet (high severity): its only credential was a check that the request came from 127.0.0.1, but a same-host reverse proxy (Caddy / Nginx / Cloudflare Tunnel / frp — all four setups the deployment guide recommends) connects from exactly that address, so requests from the internet passed it too. Anyone could POST /admin-api/pair, obtain a working pairing string, and pair into full operator access → the admin page has been removed entirely. If you ran a reverse-proxied deployment on v1.7.x or earlier, check for unauthorized access: look for admin_pair_new events you did not trigger in <keyDir>/audit.log, and unfamiliar devices in pocketshell-agent devices list.
  • Admin API CSRF: the admin POST endpoints had no CSRF protection and could be triggered cross-origin by a malicious page → gone with the admin page.
  • File previews were readable cross-origin by any site: preview responses carried access-control-allow-origin: *, so a leaked preview URL could be read from any origin → the header has been removed (the app loads previews via <img>/<video>/<iframe>, which are unaffected).
  • The in-app update verification chain was self-referential: the binary and its checksum file come from the same release, so changing POCKETSHELL_UPDATE_REPO was enough to make the Agent install an arbitrary binary → auto-apply is now restricted to the official repository.

Known issues

  • Preview tokens still travel in the URL path (30-minute lifetime; responses carry no-referrer and no-store). Moving them to a request header would break ranged requests for video, so this is unchanged for now.

Upgrade

Tap the update badge in the app, or:

curl -fsSL https://raw.githubusercontent.com/Big-Pony/pocketshell/main/install.sh | sh

If installed as a service, restart after upgrading: sudo systemctl restart pocketshell (launchd restarts it automatically on macOS).

To manage devices after upgrading, use the command line on the Agent host:

pocketshell-agent pair                          # mint a pairing string
pocketshell-agent devices list                  # list paired devices
pocketshell-agent devices remove <fingerprint>  # revoke a device
Assets 7
Loading