From 168c88593d3a82cf0c1161b514a26bda9fe244ab Mon Sep 17 00:00:00 2001
From: JianFeeeee <root@qq.com>
Date: Tue, 25 Aug 2026 23:48:20 +0800
Subject: [PATCH] =?UTF-8?q?fix(remotedevice):=20WS=20=E6=8F=A1=E6=89=8B=20?=
 =?UTF-8?q?Accept=20=E6=94=B9=E7=94=A8=20SHA-1=EF=BC=88RFC6455=20=E5=90=88?=
 =?UTF-8?q?=E8=A7=84=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

wsAccept 误用 sha256 计算 Sec-WebSocket-Accept，RFC6455 §4.2.2 规定
必须为 base64(SHA1(key + GUID))。后果：所有标准 WS 客户端（浏览器/
Electron/各语言标准库）校验 Accept 失败后立即断开连接，设备永远无法
完成 hello 注册——devicedetect 恒返回空列表，核心看不到任何设备，
而设备端本地授权状态正常，形成'已授权但核心看不见'的表象。

验证：openssl sha1 对照 + 干净实例端到端握手 Accept 完全一致。
---
 internal/plugins/remotedevice/registry.go | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/internal/plugins/remotedevice/registry.go b/internal/plugins/remotedevice/registry.go
index 73c4bba..f2f57b6 100644
--- a/internal/plugins/remotedevice/registry.go
+++ b/internal/plugins/remotedevice/registry.go
@@ -2,7 +2,7 @@ package remotedevice
 
 import (
 	"bufio"
-	"crypto/sha256"
+	"crypto/sha1" // RFC6455 规定 Sec-WebSocket-Accept 必须用 SHA-1，勿改
 	"encoding/base64"
 	"encoding/binary"
 	"encoding/json"
@@ -372,8 +372,12 @@ func (r *Registry) deliverResult(reqID string, res map[string]interface{}) {
 
 const wsGUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11"
 
+// wsAccept 计算 RFC6455 §4.2.2 握手响应值：base64(SHA1(key + GUID))。
+// 注意必须用 SHA-1——这是协议规定而非安全选择；此前误用 SHA-256 导致
+// 所有标准 WS 客户端（浏览器/Electron/各语言标准库）校验 Accept 失败
+// 后立即断开，设备永远无法完成 hello 注册（devicedetect 恒为空）。
 func wsAccept(key string) string {
-	h := sha256.Sum256([]byte(key + wsGUID))
+	h := sha1.Sum([]byte(key + wsGUID))
 	return base64.StdEncoding.EncodeToString(h[:])
 }