@twinsearth/dsh-2xray 0.2.9 → 0.2.10

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.2.10 — 2026-10-29
+
+### 更新
+
+- 设置页新增「检测更新 / 立即更新 / 自动更新」。
+- 检测：读取 npm registry 的 `latest` 并做 semver 比较。
+- 立即更新：下载 tarball、校验 sha512（或 sha1）、解压并以 rename + 回滚方式替换插件目录；返回「重启 DSH 生效」。
+- 自动更新：`updates.auto` 开启后，启动 5 秒检查并安装；默认关闭，不自动重启应用。
+- 新增鉴权接口 `GET/POST /api/xray/update`，状态同时出现在 `xray_status.update`。
+
 ## 0.2.9 — 2026-10-29
 
 ### 内核分发

package/README.md

@@ -334,6 +334,16 @@ v0.2.0 提供两个入口，互不替代：
 
 维护者用 `tools/build-core-packages.mjs` 从官方 zip 生成平台包；`.github/workflows/core-packages.yml` 会在具备 `NPM_TOKEN` secret 时自动下载、校验并发布各平台包。
 
+## 更新
+
+设置页 2Xray 里有三个入口：
+
+- **检测更新**：查询 npm 上的 `latest`，显示当前/最新版本。
+- **立即更新**：下载并校验 npm tarball（sha512），原子替换插件目录；**重启 DSH 后生效**。
+- **自动更新**：启动 5 秒后检查并安装新版本（默认关闭；同样需要重启）。
+
+Host API：`GET/POST /api/xray/update`（走 `ctx.connection.fetch` 鉴权围栏）。
+
 ## 路由模式与黑白名单
 
 - `global`（默认）：全部流量走 2Xray。

package/index.js

@@ -8,6 +8,7 @@ import { ControlClient } from './lib/control/client.js'
 import { installTools } from './lib/tools.js'
 import { LogBuffer } from './lib/logbuf.js'
 import { Monitor } from './lib/monitor.js'
+import { checkForUpdate, installUpdate, ownVersion } from './lib/update.js'
 
 export const name = 'dsh-2xray'
 
@@ -120,6 +121,29 @@ export function apply(ctx, rawConfig) {
     logger,
   })
 
+  const updateState = {
+    current: ownVersion(),
+    latest: null,
+    available: false,
+    checkedAt: null,
+    auto: config.updates?.auto === true,
+    restartRequired: false,
+    error: null,
+  }
+  let updateFlight = null
+  const checkUpdate = async () => {
+    if (updateFlight) return updateFlight
+    updateFlight = checkForUpdate({ current: updateState.current })
+      .then((info) => {
+        Object.assign(updateState, info, { auto: config.updates?.auto === true, error: info.error ?? null })
+        return info
+      })
+      .finally(() => {
+        updateFlight = null
+      })
+    return updateFlight
+  }
+
   // Authenticated status/log feed for the browser panel. Optional service: a
   // profile without `connection` keeps the proxy and the tools, it only loses
   // the live panel data.
@@ -147,6 +171,7 @@ export function apply(ctx, rawConfig) {
                     proxied,
                     vpnName: node?.id ?? snapshot.activeNode ?? null,
                     probe: monitor.snapshot(),
+                    update: updateState,
                   },
                   logs: page.items,
                   cursor: page.cursor,
@@ -176,12 +201,60 @@ export function apply(ctx, rawConfig) {
             }),
           'dsh-2xray: switch api',
         )
+        child.effect(
+          () =>
+            child.connection.fetch.register({
+              path: '/api/xray/update',
+              methods: ['GET', 'POST'],
+              requestBody: 'buffered',
+              fetch: async (request) => {
+                try {
+                  if (request.method === 'GET') {
+                    const url = new URL(request.url)
+                    const stale = !updateState.checkedAt || Date.now() - updateState.checkedAt > 600_000
+                    if (stale || url.searchParams.get('refresh') === '1') await checkUpdate()
+                    return Response.json({ ok: true, update: updateState })
+                  }
+                  const body = await request.json().catch(() => ({}))
+                  if (body.action === 'install') {
+                    const info = updateState.available ? updateState : await checkUpdate()
+                    if (!info.available) return Response.json({ ok: false, error: '已是最新版本', update: updateState }, { status: 409 })
+                    const result = await installUpdate(info, { logger })
+                    updateState.restartRequired = result.ok === true
+                    updateState.latest = info.latest
+                    return Response.json({ ok: result.ok, update: updateState, result })
+                  }
+                  await checkUpdate()
+                  return Response.json({ ok: true, update: updateState })
+                } catch (error) {
+                  return Response.json({ ok: false, error: String(error?.message ?? error) }, { status: 400 })
+                }
+              },
+            }),
+          'dsh-2xray: update api',
+        )
       } catch (error) {
         logger.warn(`状态 API 注册失败：${String(error)}`)
       }
     })
   }
 
+  // Opt-in auto-update: check once per start and install a newer tarball.
+  // Loading the new code still requires a DSH restart, so this never restarts
+  // the app behind the user's back.
+  if (config.updates?.auto) {
+    const timer = setTimeout(() => {
+      ;(async () => {
+        const info = await checkUpdate()
+        if (!info.available) return
+        const result = await installUpdate(info, { logger })
+        updateState.restartRequired = result.ok === true
+        if (result.ok) logger.info(`自动更新完成：${info.latest}；重启 DSH 后生效`)
+      })().catch((error) => logger.warn(`自动更新检查失败：${String(error)}`))
+    }, 5000)
+    timer.unref?.()
+  }
+
   const dispose = ctx.effect(
     () => async () => {
       await supervisor.stop()

package/lib/client.js

@@ -316,6 +316,9 @@ window.__ModuleLoader__.load({
       const [routingMode, setRoutingMode] = React.useState(value.routing?.mode ?? 'global')
       const [whitelist, setWhitelist] = React.useState((value.routing?.whitelist ?? []).join('\n'))
       const [blacklist, setBlacklist] = React.useState((value.routing?.blacklist ?? []).join('\n'))
+      const [autoUpdate, setAutoUpdate] = React.useState(value.updates?.auto === true)
+      const [updateInfo, setUpdateInfo] = React.useState(null)
+      const [updateBusy, setUpdateBusy] = React.useState('')
       const [message, setMessage] = React.useState('')
       const [kind, setKind] = React.useState('')
       const [busy, setBusy] = React.useState(false)
@@ -329,6 +332,47 @@ window.__ModuleLoader__.load({
         setKind(tone || '')
       }
 
+      const loadUpdate = async (refresh = false) => {
+        try {
+          const response = await fetch(new URL(`api/xray/update${refresh ? '?refresh=1' : ''}`, document.baseURI), {
+            credentials: 'same-origin',
+            headers: { accept: 'application/json' },
+          })
+          const data = await response.json()
+          if (data.update) setUpdateInfo(data.update)
+          return data
+        } catch (error) {
+          say('检查更新失败：' + (error.message || error), 'error')
+          return null
+        }
+      }
+
+      const installNow = async () => {
+        setUpdateBusy('install')
+        try {
+          const response = await fetch(new URL('api/xray/update', document.baseURI), {
+            method: 'POST',
+            credentials: 'same-origin',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ action: 'install' }),
+          })
+          const data = await response.json()
+          if (data.update) setUpdateInfo(data.update)
+          say(
+            data.ok ? `已下载 ${data.update?.latest ?? '新版本'}，重启 DSH 后生效。` : '更新失败：' + (data.error || '未知错误'),
+            data.ok ? 'ok' : 'error',
+          )
+        } catch (error) {
+          say('更新失败：' + (error.message || error), 'error')
+        } finally {
+          setUpdateBusy('')
+        }
+      }
+
+      React.useEffect(() => {
+        loadUpdate(false)
+      }, [])
+
       const applyDecoded = (text) => {
         const trimmed = String(text || '').trim()
         if (!trimmed) return
@@ -426,6 +470,7 @@ window.__ModuleLoader__.load({
             { path: ['routing', 'mode'], value: routingMode },
             { path: ['routing', 'whitelist'], value: splitList(whitelist) },
             { path: ['routing', 'blacklist'], value: splitList(blacklist) },
+            { path: ['updates', 'auto'], value: autoUpdate },
           ]
           if (binaryPath.trim()) fields.push({ path: ['binary', 'path'], value: binaryPath.trim() })
           const numericPort = Number(port)
@@ -483,6 +528,26 @@ window.__ModuleLoader__.load({
             placeholder: 'deepseek.com\napi.deepseek.com',
             onChange: (event) => setBlacklist(event.target.value),
           })),
+        h('div', { style: { ...C.cardHead, marginTop: 14 } }, '更新'),
+        h('div', { style: { display: 'flex', gap: 8, flexWrap: 'wrap', alignItems: 'center' } },
+          h('button', {
+            type: 'button',
+            style: C.btn,
+            onClick: () => loadUpdate(true),
+          }, '检测更新'),
+          h('button', {
+            type: 'button',
+            style: C.primaryBtn,
+            disabled: updateBusy === 'install' || !updateInfo?.available,
+            onClick: installNow,
+          }, updateBusy === 'install' ? '更新中…' : '立即更新'),
+          h('label', { style: { fontSize: 12.5, display: 'flex', alignItems: 'center', gap: 6 } },
+            h('input', { type: 'checkbox', checked: autoUpdate, onChange: (event) => setAutoUpdate(event.target.checked) }), '自动更新')),
+        h('div', { style: { ...C.muted, fontSize: 12, marginTop: 6 } },
+          updateInfo
+            ? `当前 ${updateInfo.current} · 最新 ${updateInfo.latest ?? '未知'}${updateInfo.available ? '（可更新）' : '（已是最新）'}` +
+              (updateInfo.restartRequired ? ' · 已下载，重启 DSH 生效' : '')
+            : '点击「检测更新」查询 npm 上的最新版本'),
         h(Field, { label: 'xray 可执行文件路径（留空自动查找）' },
           h('input', { style: { ...C.input, fontFamily: 'ui-monospace, Consolas, monospace' }, value: binaryPath, placeholder: '例如 D:\\v2rayN\\...\\bin\\xray\\xray.exe', onChange: (event) => setBinaryPath(event.target.value) })),
         h(Field, { label: '本地 HTTP 入站端口' },

package/lib/config.js

@@ -69,6 +69,7 @@ export const DEFAULT_CONFIG = {
     balancerTag: 'active',
     timeoutMs: 3000,
   },
+  updates: { auto: false },
   binary: { path: '', dataDir: '' },
   lifecycle: {
     startTimeoutMs: 15000,
@@ -350,6 +351,9 @@ export function normalizeConfig(raw) {
     merged.noProxy = [...new Set([...existing, ...merged.routing.blacklist])].join(',')
   }
 
+  merged.updates = merged.updates ?? {}
+  merged.updates.auto = asBool(merged.updates.auto, false)
+
   const control = merged.control
   control.enabled = asBool(control.enabled, false)
   control.host = asString(control.host, '127.0.0.1')

package/lib/schema.js

@@ -107,4 +107,10 @@ export const Config = Schema.object({
       .description('强制直连的域名（优先于白名单与分流）。')
       .volatile(),
   }),
+  updates: Schema.object({
+    auto: Schema.boolean()
+      .default(false)
+      .description('启动时检查 npm 上的新版本并自动安装；重启 DSH 后生效。')
+      .volatile(),
+  }),
 })

package/lib/update.js

@@ -0,0 +1,144 @@
+import { createHash } from 'node:crypto'
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const PACKAGE_ROOT = fileURLToPath(new URL('../', import.meta.url))
+const PACKAGE_NAME = '@twinsearth/dsh-2xray'
+const REGISTRY = 'https://registry.npmjs.org'
+
+function readOwnVersion() {
+  try {
+    return JSON.parse(readFileSync(join(PACKAGE_ROOT, 'package.json'), 'utf8')).version
+  } catch {
+    return '0.0.0'
+  }
+}
+
+/** Numeric semver comparison; a prerelease sorts before the release. */
+export function compareVersions(left, right) {
+  const parse = (value) => {
+    const [core, pre] = String(value).replace(/^v/, '').split('-', 2)
+    const parts = core.split('.').map((part) => Number.parseInt(part, 10) || 0)
+    return { parts, pre: pre ?? '' }
+  }
+  const a = parse(left)
+  const b = parse(right)
+  for (let index = 0; index < 3; index++) {
+    if (a.parts[index] !== b.parts[index]) return a.parts[index] > b.parts[index] ? 1 : -1
+  }
+  if (a.pre === b.pre) return 0
+  if (a.pre === '') return 1
+  if (b.pre === '') return -1
+  return a.pre > b.pre ? 1 : -1
+}
+
+export function checkForUpdate({ current = readOwnVersion(), registry = REGISTRY, packageName = PACKAGE_NAME } = {}) {
+  return fetch(`${registry}/${encodeURIComponent(packageName)}/latest`, {
+    headers: { accept: 'application/json', 'cache-control': 'no-cache' },
+    signal: AbortSignal.timeout(15000),
+  })
+    .then(async (response) => {
+      if (!response.ok) throw new Error(`registry HTTP ${response.status}`)
+      const meta = await response.json()
+      const latest = String(meta.version ?? '')
+      if (!latest) throw new Error('registry response has no version')
+      return {
+        current,
+        latest,
+        available: compareVersions(latest, current) > 0,
+        checkedAt: Date.now(),
+        tarball: meta.dist?.tarball,
+        integrity: meta.dist?.integrity,
+        shasum: meta.dist?.shasum,
+      }
+    })
+    .catch((error) => ({ current, latest: null, available: false, error: String(error.message ?? error), checkedAt: Date.now() }))
+}
+
+function verify(bytes, { integrity, shasum }) {
+  if (integrity?.startsWith('sha512-')) {
+    const actual = 'sha512-' + createHash('sha512').update(bytes).digest('base64')
+    return actual === integrity
+  }
+  if (shasum) {
+    return createHash('sha1').update(bytes).digest('hex') === shasum
+  }
+  return false
+}
+
+function extractTarball(file, destination) {
+  const attempts = [
+    ['tar', ['-xzf', file, '-C', destination]],
+    ['tar', ['-xf', file, '-C', destination]],
+  ]
+  for (const [command, argv] of attempts) {
+    if (spawnSync(command, argv, { stdio: 'ignore' }).status === 0) return true
+  }
+  return false
+}
+
+function copyTree(source, target) {
+  mkdirSync(target, { recursive: true })
+  for (const entry of readdirSync(source, { withFileTypes: true })) {
+    const from = join(source, entry.name)
+    const to = join(target, entry.name)
+    if (entry.isDirectory()) copyTree(from, to)
+    else if (entry.isFile()) copyFileSync(from, to)
+  }
+}
+
+/**
+ * Install a newer tarball over the running package directory. The swap is
+ * rename-based with a rollback copy, and the caller must restart DSH: the
+ * already-loaded modules keep running the old code.
+ */
+export async function installUpdate(info, { packageRoot = PACKAGE_ROOT, logger } = {}) {
+  if (!info?.available || !info.tarball) return { ok: false, error: 'no update available' }
+  const workspace = mkdtempSync(join(tmpdir(), 'dsh-2xray-update-'))
+  const target = packageRoot
+  const backup = `${target}.bak-${Date.now()}`
+  try {
+    const response = await fetch(info.tarball, { redirect: 'follow', signal: AbortSignal.timeout(180000) })
+    if (!response.ok) throw new Error(`tarball HTTP ${response.status}`)
+    const bytes = Buffer.from(await response.arrayBuffer())
+    if (!verify(bytes, info)) throw new Error('tarball integrity check failed')
+    const archive = join(workspace, 'package.tgz')
+    writeFileSync(archive, bytes)
+    const extracted = join(workspace, 'out')
+    mkdirSync(extracted, { recursive: true })
+    if (!extractTarball(archive, extracted)) throw new Error('could not extract tarball')
+    const packageDir = join(extracted, 'package')
+    if (!existsSync(join(packageDir, 'package.json'))) throw new Error('tarball has no package/ directory')
+    renameSync(target, backup)
+    try {
+      copyTree(packageDir, target)
+    } catch (error) {
+      rmSync(target, { recursive: true, force: true })
+      renameSync(backup, target)
+      throw error
+    }
+    rmSync(backup, { recursive: true, force: true })
+    logger?.info?.(`已更新到 ${info.latest}，重启 DSH 后生效`)
+    return { ok: true, version: info.latest, restartRequired: true }
+  } catch (error) {
+    logger?.error?.(`更新失败：${String(error.message ?? error)}`)
+    return { ok: false, error: String(error.message ?? error) }
+  } finally {
+    rmSync(workspace, { recursive: true, force: true })
+  }
+}
+
+export function ownVersion() {
+  return readOwnVersion()
+}
+
+export function packageSize(path) {
+  try {
+    return statSync(path).size
+  } catch {
+    return 0
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/dsh-2xray",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "private": false,
   "description": "DSH-2Xray: supervises xray-core and routes DSH process-wide HTTP(S) traffic through its local inbound, with optional multi-node gRPC control plane",
   "type": "module",

package/test/update.test.js

@@ -0,0 +1,41 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { checkForUpdate, compareVersions } from '../lib/update.js'
+
+test('compareVersions orders releases and prereleases', () => {
+  assert.equal(compareVersions('0.2.9', '0.2.8'), 1)
+  assert.equal(compareVersions('0.2.8', '0.2.9'), -1)
+  assert.equal(compareVersions('0.2.9', '0.2.9'), 0)
+  assert.equal(compareVersions('0.2.10', '0.2.9'), 1)
+  assert.equal(compareVersions('0.3.0-rc.1', '0.3.0'), -1)
+})
+
+test('checkForUpdate reads the registry latest and flags an update', async () => {
+  const original = globalThis.fetch
+  globalThis.fetch = async (url) => ({
+    ok: true,
+    async json() {
+      return { version: '9.9.9', dist: { tarball: 'https://example.test/pkg.tgz', integrity: 'sha512-abc', shasum: 'abc' } }
+    },
+  })
+  try {
+    const info = await checkForUpdate({ current: '0.2.9' })
+    assert.equal(info.latest, '9.9.9')
+    assert.equal(info.available, true)
+    assert.equal(info.tarball, 'https://example.test/pkg.tgz')
+  } finally {
+    globalThis.fetch = original
+  }
+})
+
+test('checkForUpdate fails closed on a registry error', async () => {
+  const original = globalThis.fetch
+  globalThis.fetch = async () => ({ ok: false, status: 503 })
+  try {
+    const info = await checkForUpdate({ current: '0.2.9' })
+    assert.equal(info.available, false)
+    assert.match(info.error, /503/)
+  } finally {
+    globalThis.fetch = original
+  }
+})