fix: redirect expired sessions to login

web/src/App.tsx

@@ -45,7 +45,8 @@ function RequireAuth({ children }: { children: ReactElement }) {
   const location = useLocation();
   if (!ready) return <LoadingScreen />;
   if (!isAuthenticated) {
-    return <Navigate to={`/login?redirect=${encodeURIComponent(location.pathname)}`} replace />;
+    const redirect = `${location.pathname}${location.search}${location.hash}`;
+    return <Navigate to={`/login?redirect=${encodeURIComponent(redirect)}`} replace />;
   }
   return children;
 }

web/src/api.ts

@@ -9,6 +9,18 @@ import { tl } from "./lib/i18n";
 
 const CSRF_KEY = "vocat.csrf";
 
+// Authenticated pages and same-origin plugin frames share this signal. Clear
+// the mutation token immediately so a revoked session cannot leave stale auth
+// state behind in the browser.
+export function notifyUnauthorized() {
+  try {
+    sessionStorage.removeItem(CSRF_KEY);
+  } catch {
+    /* ignore unavailable storage */
+  }
+  window.dispatchEvent(new Event("vocat:unauthorized"));
+}
+
 function isMutation(method: string) {
   return !["GET", "HEAD", "OPTIONS"].includes(method.toUpperCase());
 }
@@ -94,14 +106,17 @@ export async function api<T>(path: string, options: RequestOptions = {}): Promis
         : JSON.stringify(snakeize(options.body)),
   });
 
-  if (options.raw) return response as T;
+  if (options.raw) {
+    if (response.status === 401) notifyUnauthorized();
+    return response as T;
+  }
   const contentType = response.headers.get("content-type") || "";
   const payload = contentType.includes("application/json")
     ? await response.json()
     : { message: await response.text() };
   const normalized = camelize<Record<string, unknown>>(payload);
   if (!response.ok) {
-    if (response.status === 401) window.dispatchEvent(new Event("vocat:unauthorized"));
+    if (response.status === 401) notifyUnauthorized();
     const nested = normalized.error;
     const detail = nested && typeof nested === "object"
       ? {

web/src/components/devices/shared.ts

@@ -3,6 +3,7 @@ import { message } from "../ui";
 import type { DeviceDetail, DeviceModem, ModemPnn } from "./types";
 import { tl } from "../../lib/i18n";
 import { lookupCarrier } from "../../lib/carrier";
+import { notifyUnauthorized } from "../../api";
 
 /* ---------------------------------------------------------------------------
  * Lifecycle / status helpers (ported from the VoHive reference).
@@ -283,6 +284,7 @@ export async function readEventStream(
     credentials: "include",
     signal: handlers.signal,
   });
+  if (response.status === 401) notifyUnauthorized();
   if (!response.ok) throw new Error((await response.text()) || `HTTP ${response.status}`);
   if (!response.body) throw new Error("No stream body");
 

web/src/pages/SettingsPage.tsx

@@ -271,9 +271,12 @@ export default function SettingsPage() {
     if (!confirmed) return;
     setApplyingUpdate(true);
     try {
-      const data = await api<{ message?: string }>("/system/update/apply", { method: "POST", body: {} });
+      const data = await api<{ message?: string; reauthenticationRequired?: boolean }>("/system/update/apply", { method: "POST", body: {} });
       message.success(data?.message || t("正在更新..."));
-      window.setTimeout(() => window.location.reload(), 5000);
+      window.setTimeout(() => {
+        if (data?.reauthenticationRequired) window.location.replace("/login");
+        else window.location.reload();
+      }, 1500);
     } catch (e) {
       message.error(e instanceof Error ? e.message : t("应用更新失败"));
     } finally {

web/src/store/auth.tsx

@@ -62,6 +62,15 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     }
   }, []);
 
+  useEffect(() => {
+    const unauthorized = () => {
+      setUser(null);
+      setReady(true);
+    };
+    window.addEventListener("vocat:unauthorized", unauthorized);
+    return () => window.removeEventListener("vocat:unauthorized", unauthorized);
+  }, []);
+
   useEffect(() => {
     void refresh();
   }, [refresh]);