dsh-pocket 1.0.13 → 1.0.14

package/README.en.md

@@ -4,6 +4,8 @@
 
 <h1 align="center">DSH Pocket</h1>
 
+<p align="center"><a href="README.en.md">English</a> | <a href="README.md">中文</a></p>
+
 <p align="center">
   <a href="https://www.npmjs.com/package/dsh-pocket"><img alt="npm" src="https://img.shields.io/npm/v/dsh-pocket?color=4d6bfe&label=npm"></a>
   <a href="https://www.npmjs.com/package/dsh-pocket"><img alt="downloads" src="https://img.shields.io/npm/dm/dsh-pocket?color=4d6bfe"></a>
@@ -13,8 +15,6 @@
 </p>
 
 > Put **DeepSeek Harness in your pocket**: one package, one settings tab — scan a QR code and your phone shows exactly what's on your computer screen, live, from anywhere.
->
-> [English](README.en.md) | [中文](README.md)
 
 ## What is this
 
@@ -26,8 +26,6 @@
 
 That's what DSH Pocket does: **install it, scan a QR code, and your phone shows and controls the DeepSeek Harness UI in real time — from anywhere.**
 
-> One-liner: `dsh web` only allows local access by default; DSH Pocket puts a proxy in front of it that safely bridges your phone (see [How it works](#-how-it-works)).
-
 What it looks like — the phone shows the exact same UI as your computer, live:
 
 <p align="center">
@@ -79,10 +77,6 @@ On the same page click "**Enable anywhere**" → wait for the tunnel (first run
 
 > Upgrading: `dsh plugin --profile web update dsh-pocket --latest -w` (`--latest` is required across major versions — a `^0.x` range won't auto-jump to 1.x).
 
-## 🧭 How it works
-
-DSH's `/api` browser-trust fence only accepts loopback or `--trusted-host` authorities (and the official build refuses `0.0.0.0` binding to avoid exposing remote code execution to the network). Pocket rewrites every inbound request's `Host` / `Origin` to `127.0.0.1:<dsh-port>`, so the fence always sees loopback — **no dsh configuration changes needed**. The proxy auto-starts with the plugin; the public tunnel is on demand (cloudflared forced to HTTP/2 over TCP 443 to bypass blocked QUIC/UDP).
-
 ## ⚠️ Security (read first)
 
 - **DSH can execute code on your computer.** The QR code / URL is the key — **never share it with anyone**.
@@ -111,17 +105,21 @@ DSH's `/api` browser-trust fence only accepts loopback or `--trusted-host` autho
 Such tools take over all traffic and often cut cloudflared's tunnel-edge connections
 (`*.argotunnel.com`, Cloudflare edge IPs), so the tunnel registers but the data plane never connects.
 
-**Fix (any one of)**:
+**Fix (try in order, lightest first)**:
 
-1. Temporarily **fully quit the proxy** (not just close the window: quit Clash from the menu-bar icon; if a
+1. First **just turn off the proxy's TUN mode** — no need to quit the proxy; this is enough in most cases:
+   - Clash: turn off the "**TUN mode**" toggle in Settings (or right-click the menu-bar icon → uncheck TUN mode)
+   - Surge: turn off "**Enhanced mode**"; v2ray/sing-box: turn off "**virtual NIC / route takeover**"
+   - Then go back to the settings page and click "Enable anywhere" again
+2. If that's not enough, temporarily **fully quit the proxy** (not just close the window: quit Clash from the menu-bar icon; if a
    background service is installed, stop it in the service manager and confirm with `ps aux | grep clash`), then retry.
-2. Add **DIRECT rules** to the proxy for the tunnel domains and Cloudflare edge (Clash example):
+3. Add **DIRECT rules** to the proxy for the tunnel domains and Cloudflare edge (Clash example):
    ```yaml
    - DOMAIN-SUFFIX,argotunnel.com,DIRECT
    - DOMAIN-SUFFIX,trycloudflare.com,DIRECT
    - IP-CIDR,198.41.192.0/24,DIRECT,no-resolve
    ```
-3. If the network really can't reach the tunnel, use **LAN mode**: turn on the phone hotspot → connect the computer to it → scan the LAN QR. Same experience, from anywhere.
+4. If the network really can't reach the tunnel, use **LAN mode**: turn on the phone hotspot → connect the computer to it → scan the LAN QR. Same experience, from anywhere.
 
 **Other causes**: corporate firewalls / campus networks blocking outbound — ask IT to allow it, or use a hotspot.
 

package/README.md

@@ -4,6 +4,8 @@
 
 <h1 align="center">DSH Pocket</h1>
 
+<p align="center"><a href="README.en.md">English</a> | <a href="README.md">中文</a></p>
+
 <p align="center">
   <a href="https://www.npmjs.com/package/dsh-pocket"><img alt="npm" src="https://img.shields.io/npm/v/dsh-pocket?color=4d6bfe&label=npm"></a>
   <a href="https://www.npmjs.com/package/dsh-pocket"><img alt="downloads" src="https://img.shields.io/npm/dm/dsh-pocket?color=4d6bfe"></a>
@@ -13,8 +15,6 @@
 </p>
 
 > 把 **DeepSeek Harness 装进你的口袋**：一个包、一个设置页，手机扫二维码就实时看到电脑上的同一个界面——人在外面也能用。
->
-> [English](README.en.md) | [中文](README.md)
 
 ## 这是什么
 
@@ -26,8 +26,6 @@
 
 DSH Pocket 就是干这个的：**装上它，手机扫个码，就能实时看到并操控电脑上的 DeepSeek Harness 界面**——人在外面也能用。
 
-> 原理一句话：`dsh web` 默认只允许本机访问，DSH Pocket 在它前面加一层代理，把手机访问安全地接入（详见[「原理」](#-原理)）。
-
 实际效果——手机上的界面就是电脑上的界面，实时同步：
 
 <p align="center">
@@ -79,10 +77,6 @@ npx @deepseek-ai/dsh web
 
 > 更新到新版本：`dsh plugin --profile web update dsh-pocket --latest -w`（跨大版本时 `--latest` 是必须的，`^0.x` 范围不会自动升到 1.x）。
 
-## 🧭 原理
-
-DSH 的 `/api` 浏览器信任栅栏只认 loopback 或 `--trusted-host`（官方还禁了 `0.0.0.0` 绑定，防止把远程执行代码暴露给网络）。Pocket 把入站请求的 `Host` / `Origin` 统一改写成 `127.0.0.1:<dsh端口>`，栅栏永远看到 loopback——**不需要改 dsh 的任何配置**。代理随插件自动启动，公网隧道按需开启（cloudflared 强制走 HTTP/2/TCP 443，绕开被网络屏蔽的 QUIC/UDP）。
-
 ## ⚠️ 安全（必读）
 
 - **DSH 能执行你电脑上的代码**。二维码/URL 就是钥匙，**请勿把二维码或 URL 发给任何人**
@@ -111,17 +105,21 @@ DSH 的 `/api` 浏览器信任栅栏只认 loopback 或 `--trusted-host`（官
 这类工具会接管全部流量，并常常把 cloudflared 的隧道边缘连接
 （`*.argotunnel.com`、Cloudflare 边缘 IP）掐断，导致隧道注册成功但数据面连不上。
 
-**解决（三选一）**：
+**解决（从轻到重，按顺序试）**：
 
-1. 临时**彻底退出代理软件**（不只是关界面：Clash 要右键菜单栏图标 → 退出；若装有
+1. 先**只关闭代理的 TUN 模式**，不用退出代理软件——多数情况这一步就够：
+   - Clash：设置里关掉「**TUN 模式**」开关（或右键菜单栏图标 → 取消勾选 TUN 模式）
+   - Surge：关「**增强模式**」；v2ray/sing-box：关「**虚拟网卡/路由接管**」
+   - 然后回设置页重新点「开启公网访问」
+2. 仍不行就**彻底退出代理软件**（不只是关界面：Clash 要右键菜单栏图标 → 退出；若装有
    后台服务还要在服务管理器里停掉，`ps aux | grep clash` 确认进程消失），再重试
-2. 给代理加**直连规则**，放行隧道域名与 Cloudflare 边缘（Clash 规则示例）：
+3. 给代理加**直连规则**，放行隧道域名与 Cloudflare 边缘（Clash 规则示例）：
    ```yaml
    - DOMAIN-SUFFIX,argotunnel.com,DIRECT
    - DOMAIN-SUFFIX,trycloudflare.com,DIRECT
    - IP-CIDR,198.41.192.0/24,DIRECT,no-resolve
    ```
-3. 网络实在不通时，改用**局域网模式**：手机开热点 → 电脑连手机热点 → 扫局域网码，
+4. 网络实在不通时，改用**局域网模式**：手机开热点 → 电脑连手机热点 → 扫局域网码，
    效果完全一样（人在外面也能用）
 
 **其他可能**：企业防火墙/校园网拦截出站；此时请让 IT 放行或改用热点。

package/lib/index.js

@@ -36,9 +36,9 @@ const restartNoticeRel = join('dsh-pocket', 'restarted.json');
 function restartNoticePath() {
   return join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), restartNoticeRel);
 }
-function readRestartNotice() {
+async function readRestartNotice() {
   try {
-    const raw = JSON.parse(readFile(restartNoticePath(), 'utf8'));
+    const raw = JSON.parse(await readFile(restartNoticePath(), 'utf8'));
     if (!raw?.at) return null;
     if (Date.now() - raw.at > 30 * 60 * 1000) return null; // 30 分钟后过期
     return raw;
@@ -162,4 +162,4 @@ export function apply(ctx, config = {}, internals = {}) {
   }, 'dsh-pocket: stop proxy, tunnel and push');
 }
 
-export { name, inject };
+export { name, inject, readRestartNotice };

package/lib/web-rpc.js

@@ -28,7 +28,7 @@ export function installPocketRpc(ctx, { service, push, log = console, runUpdate
     // status 响应：redact 后的服务状态 + 重启提示（重启后 30 分钟内有效）
     const statusPayload = async () => {
       let notice = null;
-      try { notice = restartNotice?.() ?? null; } catch { notice = null; }
+      try { notice = (await restartNotice?.()) ?? null; } catch { notice = null; }
       return ok({ ...redactStatus(await service.status()), restartNotice: notice });
     };
 

package/package.json

@@ -77,5 +77,5 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "version": "1.0.13"
+  "version": "1.0.14"
 }