dsh-mobile 0.4.5 → 0.4.7

package/docs/README.md

@@ -8,10 +8,13 @@
 | --- | --- | --- |
 | [Cloudflare 命名隧道](CLOUDFLARE_TUNNEL.md) | [Cloudflare named tunnel](CLOUDFLARE_TUNNEL.en.md) | 用 Cloudflare 账号令牌把 cloudflared 从随机快速隧道换成固定公网域名 |
 | [自建 FRP 使用指南](SELF_HOSTED_FRP.md) | [Self-hosted FRP guide](SELF_HOSTED_FRP.en.md) | 已有 VPS 时用 frps + Caddy 自建远程通道，避开公共隧道带宽限制 |
+| [接入你既有的 frps](ATTACH_EXISTING_FRPS.md) | [Attach to an existing frps](ATTACH_EXISTING_FRPS.en.md) | 复用 VPS 上已运行的 frps，不自动修改服务器；可选公开 CA + Caddy 或自签 CA + TCP 透传，须核对监听与证书有效期。 |
 | [自有 HTTPS 反向代理](SELF_HOSTED_ORIGIN.md) | [Own HTTPS reverse proxy](SELF_HOSTED_ORIGIN.en.md) | 复用已有的 Lucky / Nginx / Caddy 公网 HTTPS 入口，无需隧道组件 |
 
 > 命名隧道与两个自建提供方都要求手机端走 App 的**远程访问**扫码流程；`SELF_HOSTED_ORIGIN.en.md` 是精简版，字段表与排错清单以中文版为准。
 
+> 既有 frps 接入从 0.4.6 起提供；其中自签入口需要 0.4.6 Android App，旧版不能配对。
+
 ## 验证记录 / Verification records
 
 | 文档 | 内容 |

package/docs/SELF_HOSTED_FRP.en.md

@@ -2,6 +2,8 @@
 
 [中文指南](SELF_HOSTED_FRP.md)
 
+This page covers managed deployment, in which the plugin installs frps and Caddy. If your VPS already runs frps, version 0.4.6 can attach to it directly; see the [attachment guide](ATTACH_EXISTING_FRPS.en.md).
+
 Self-hosted FRP is for users who already operate a VPS and want to avoid the bandwidth limits of public tunnels. The phone reaches Caddy on the VPS over HTTPS, crosses the encrypted FRP tunnel, and then reaches DSH on the computer. FRP only transports the request; DSH pairing is still required.
 
 ```text
@@ -18,7 +20,7 @@ Android app
 - **Domain mode**: use your own public domain; Caddy obtains and renews the certificate automatically.
 - **Public IPv4 mode**: use the VPS public IPv4 address directly. The plugin uses Certbot to request a roughly six-day Let's Encrypt IP certificate and installs a daily renewal timer. Documentation ranges such as `203.0.113.10`, private addresses, and other reserved addresses are rejected; enter a real routable public IP.
 
-The custom remote-origin flow requires Android app 0.3.3 or later. Older supported apps continue to work with LAN, cpolar, and Tailscale.
+The publicly trusted entry in this guide requires Android app 0.3.3 or later for custom remote origins. Self-signed passthrough requires the 0.4.6 app with remote CA pinning; older apps cannot use that entry and continue to work with LAN, cpolar, and Tailscale.
 
 ## Manual deployment vs automatic deployment
 

package/docs/SELF_HOSTED_FRP.md

@@ -2,6 +2,12 @@
 
 [English guide](SELF_HOSTED_FRP.en.md)
 
+本页介绍托管部署（插件安装 frps 与 Caddy）。
+
+> **已经有一台跑着 frps 的 VPS？** 从 0.4.6 起可直接接入，见 [接入你既有的 frps](ATTACH_EXISTING_FRPS.md)：
+> 插件不装不改你的 frps、**零 SSH**；还提供**完全不用公开证书**的自签穿透档（frps 只做 TCP 透传，
+> 网关自己终止 TLS，证书有效期与更换要求见专门指南）。
+
 自建 FRP 适合已有 VPS、希望避开公共隧道带宽限制的用户。手机经 VPS 上的 Caddy 进入加密 FRP 隧道，再到达电脑上的 DSH；FRP 只负责传输，仍需完成 DSH 配对才能进入。
 
 ```text
@@ -18,7 +24,7 @@
 - **域名模式**：公开地址是自己的域名，Caddy 自动申请并续期证书。
 - **公网 IPv4 模式**：公开地址直接是 VPS 公网 IPv4（例如你自己的 VPS 地址），插件用 Certbot 申请约 6 天有效的 Let's Encrypt IP 证书，并安装每日自动续期定时器。注意：文档示例地址（如 `203.0.113.10`）和内网、保留地址会被拒绝，必须填写真实可路由的公网 IP。
 
-需要 Android App 0.3.3 或更高版本（远程自定义入口）；旧版 App 仍可用局域网、cpolar 和 Tailscale。
+本页的公开证书入口需要 Android App 0.3.3 或更高版本（远程自定义入口）。自签穿透档需要 0.4.6 Android App 固定远程 CA；旧版 App 不支持该档，仍可使用局域网、cpolar 和 Tailscale。
 
 ## 手动部署 vs 自动部署
 

package/lib/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { homedir, networkInterfaces } from "node:os";
-import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve, win32 } from "node:path";
 import { X509Certificate, createPrivateKey, createPublicKey } from "node:crypto";
 import { execFile } from "node:child_process";
 import { generate } from "selfsigned";
@@ -34,8 +34,13 @@ function execFileText(file, args, options = {}) {
 //#endregion
 //#region src/private-file.ts
 let userSidTask;
+function windowsSystemTool(name) {
+	const systemRoot = process.env.SystemRoot ?? process.env.WINDIR;
+	if (systemRoot === void 0 || !win32.isAbsolute(systemRoot)) throw new Error("Windows system root is unavailable");
+	return win32.join(systemRoot, "System32", name);
+}
 async function currentWindowsUserSid() {
-	userSidTask ??= execFileText("whoami.exe", [
+	userSidTask ??= execFileText(windowsSystemTool("whoami.exe"), [
 		"/user",
 		"/fo",
 		"csv",
@@ -58,11 +63,12 @@ async function currentWindowsUserSid() {
 async function restrictPrivateFile(file, mode = 384) {
 	await chmod(file, mode);
 	if (process.platform !== "win32") return;
-	await execFileText("icacls.exe", [
+	const userSid = await currentWindowsUserSid();
+	await execFileText(windowsSystemTool("icacls.exe"), [
 		file,
 		"/inheritance:r",
 		"/grant:r",
-		`*${await currentWindowsUserSid()}:(F)`,
+		`*${userSid}:(F)`,
 		"*S-1-5-18:(F)",
 		"*S-1-5-32-544:(F)",
 		"/remove:g",
@@ -279,17 +285,38 @@ async function ensureManagedCa(setup, legacy) {
 	await Promise.all([restrictPrivateFile(setup.caCertFile), restrictPrivateFile(setup.caKeyFile)]);
 	return assertMatchingCa(certPem, keyPem);
 }
-/** Sign and atomically install a server leaf for the interface's current address. */
-async function refreshManagedServerCertificate(setup, address) {
-	await Promise.all([restrictPrivateFile(setup.tls.caCertFile), restrictPrivateFile(setup.tls.caKeyFile)]);
-	const [caCert, caKey] = await Promise.all([readFile(setup.tls.caCertFile, "utf8"), readFile(setup.tls.caKeyFile, "utf8")]);
+function subjectAltNames(target) {
+	const names = [];
+	for (const ip of target.ipAddresses ?? []) names.push({
+		type: 7,
+		ip
+	});
+	for (const dns of target.dnsNames ?? []) names.push({
+		type: 2,
+		value: dns
+	});
+	if (names.length === 0) throw new Error("managed TLS leaf needs at least one server name");
+	return names;
+}
+/**
+* Sign one server leaf with an existing self-signed CA and install it privately.
+*
+* Both the LAN listener and the self-signed FRP ingress use this one path, so a
+* certificate can never be produced by two divergent code paths. IP entries are
+* required for console addresses (`type: 7`), DNS entries (`type: 2`) cover named
+* hosts; the Android client accepts either through its pinned CA.
+*/
+async function issueServerCertificate(authority, target, output, lifetimeDays = 397) {
+	const altNames = subjectAltNames(target);
+	await Promise.all([restrictPrivateFile(authority.caCertFile), restrictPrivateFile(authority.caKeyFile)]);
+	const [caCert, caKey] = await Promise.all([readFile(authority.caCertFile, "utf8"), readFile(authority.caKeyFile, "utf8")]);
 	assertMatchingCa(caCert, caKey);
 	const now = /* @__PURE__ */ new Date();
 	const notAfter = new Date(now);
-	notAfter.setDate(notAfter.getDate() + 397);
+	notAfter.setDate(notAfter.getDate() + lifetimeDays);
 	const server = await generate([{
 		name: "commonName",
-		value: "DeepSeek Harness Mobile"
+		value: target.commonName
 	}], {
 		keyType: "ec",
 		curve: "P-256",
@@ -317,14 +344,24 @@ async function refreshManagedServerCertificate(setup, address) {
 			},
 			{
 				name: "subjectAltName",
-				altNames: [{
-					type: 7,
-					ip: address
-				}]
+				altNames
 			}
 		]
 	});
-	await Promise.all([atomicWrite(setup.tls.certFile, server.cert), atomicWrite(setup.tls.keyFile, server.private)]);
+	await Promise.all([atomicWrite(output.certFile, server.cert), atomicWrite(output.keyFile, server.private)]);
+}
+/** Sign and atomically install a server leaf for the interface's current address. */
+async function refreshManagedServerCertificate(setup, address) {
+	await issueServerCertificate({
+		caCertFile: setup.tls.caCertFile,
+		caKeyFile: setup.tls.caKeyFile
+	}, {
+		commonName: "DeepSeek Harness Mobile",
+		ipAddresses: [address]
+	}, {
+		certFile: setup.tls.certFile,
+		keyFile: setup.tls.keyFile
+	});
 }
 //#endregion
 //#region src/lan-setup.ts