dsh-vpn-panel 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 hanhan9999999999999999999
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,105 @@
-# Temporary Holding Version
+# dsh-vpn-panel
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+在 DSH 的**设置页**里加一个 `VPN` 栏目：一键开关本机代理内核、切换节点、测速、刷新订阅。
+
+它本身不是代理，也不带节点。它做的是把「启动 / 停止本机 mihomo 内核 + 改写 Windows 系统代理」
+这件事搬进 DSH 的面板里，省掉去桌面上点快捷方式。
+
+配套的脚本与配置生成器在 [vpn-toolkit](https://github.com/hanhan9999999999999999999/vpn-toolkit)。
+
+## 声明
+
+本插件是**本地进程管理与界面接入的技术示例，仅供学习与研究使用**。
+
+- 不提供、不内置、也不推荐任何节点、订阅源或可用服务；
+- 不含代理内核，内核与订阅由使用者自行获取；
+- 请遵守所在国家或地区的法律法规，使用后果由使用者自行承担。
+
+## Notice
+
+A technical example of local process management and host-UI integration, provided
+**for study and research only**. No nodes, subscriptions, services or proxy core
+are bundled or endorsed. You are responsible for how you use it and for the laws
+that apply to you.
+
+## 装
+
+```sh
+# 从 npm（发布后）
+dsh plugin --profile desktop add dsh-vpn-panel
+
+# 或者直接从仓库
+dsh plugin --profile desktop add https://github.com/hanhan9999999999999999999/dsh-vpn-panel
+```
+
+装完重启 DSH，**设置 → VPN** 就在左侧栏目里。
+
+## 面板上有什么
+
+- **总开关** — 打开 / 关闭（等价于执行 `vpn-on.ps1` / `vpn-off.ps1`）
+- **状态卡** — 内核是否在跑、系统代理是否指向本机端口、当前节点、节点数、上次测速
+- **节点列表** — 带搜索框，点一行即切换（写 mihomo 的 `手动切换` 组）
+- **四个按钮** — 测下载速度 / 测节点延迟 / 更新订阅节点 / 刷新状态
+- **设置** — 代理端口、控制端口、脚本目录、测速地址、开机自启
+- **日志** — 可折叠，出错时看得到 PowerShell 的真实输出
+
+## 它依赖什么
+
+面板假设 `scriptsDir`（默认 `D:\document\vpn`）下有：
+
+| 文件 | 作用 |
+| --- | --- |
+| `vpn-on.ps1` | 启动内核并打开系统代理 |
+| `vpn-off.ps1` | 停止内核并还原系统代理 |
+| `vpn-refresh.ps1` | 重新抓订阅、重建配置、重启内核 |
+
+这些脚本在 vpn-toolkit 仓库里；目录不同就在面板设置里改 `scriptsDir`。
+另外 `controllerPort`（默认 9090）要对上 mihomo 的 `external-controller`。
+
+## 本机路由（只接受回环访问）
+
+| 方法 | 路径 | 作用 |
+| --- | --- | --- |
+| GET | `/dsh-vpn/status.json` | 内核进程、系统代理、当前节点、节点数、日志尾巴 |
+| POST | `/dsh-vpn/power.json` | `{"on": true}` 开，`{"on": false}` 关 |
+| GET | `/dsh-vpn/nodes.json` | 节点列表（读 `127.0.0.1:9090/proxies`） |
+| POST | `/dsh-vpn/select.json` | `{name}` 切换节点 |
+| GET | `/dsh-vpn/delay.json` | 批量测延迟 |
+| GET | `/dsh-vpn/speed.json` | 经本机代理实测下载速度 |
+| POST | `/dsh-vpn/refresh.json` | 重建配置并重启内核 |
+| GET | `/dsh-vpn/settings.json` | 读设置 |
+| POST | `/dsh-vpn/settings/save.json` | 写设置 |
+
+每个响应都是 JSON；跨站请求与非回环地址直接 403，方法不对 405。
+
+## 设置文件
+
+`%USERPROFILE%\.dsh\vpn-panel.json`：
+
+```json
+{
+  "proxyPort": 7891,
+  "controllerPort": 9090,
+  "scriptsDir": "D:\\document\\vpn",
+  "testUrl": "http://speed.cloudflare.com/__down?bytes=5000000",
+  "autoStart": false
+}
+```
+
+`testUrl` 必须是 `http://`——测速走的是普通 HTTP GET 穿代理，不解 CONNECT。
+`autoStart` 打开后会在 `HKCU\...\Run` 写一个 `DSHVpn` 值，开机自动执行 `vpn-on.ps1`。
+
+## 开发
+
+```sh
+# 宿主端：假 cordis 上下文，起一个端口把路由跑起来
+node test/host-harness.mjs ./src/index.js 51999
+
+# 客户端：假 __ModuleLoader__ + 假 React，验证槽位注册与渲染
+node test/client-sim.cjs
+```
+
+`lib/client.js` 是手写的模块包（`window.__ModuleLoader__.load(...)`），只依赖宿主提供的 `react`，
+没有构建步骤；改完直接重启 DSH 就生效。
+
+MIT.

package/cordis.patch.yml

@@ -0,0 +1,3 @@
+- insert:
+    - id: vpn-panel
+      name: dsh-vpn-panel

package/lib/client.js

@@ -0,0 +1,598 @@
+/**
+ * dsh-vpn-panel — client half.
+ *
+ * Registers a "VPN" entry inside Settings (slot `settings.section`) that talks
+ * to the host routes served by ./src/index.js under /dsh-vpn/*.
+ *
+ * Hand-written bundle: window.__ModuleLoader__ supplies only `react`.
+ */
+window.__ModuleLoader__.load({
+  id: 'dsh-vpn-panel',
+  factory: (require) => {
+    const module = { exports: {} }
+    const React = require('react')
+
+    const h = React.createElement
+    const { useState, useEffect, useRef, useMemo, useCallback } = React
+
+    /* ── styling helpers ───────────────────────────────────────────── */
+
+    const C = {
+      text: 'var(--dsh-text-primary, #e8e8ea)',
+      dim: 'var(--dsh-text-secondary, #9a9aa2)',
+      faint: 'var(--dsh-text-tertiary, #6f6f78)',
+      line: 'var(--dsh-border, rgba(255,255,255,0.10))',
+      card: 'var(--dsh-surface-raised, rgba(255,255,255,0.04))',
+      field: 'var(--dsh-surface-sunken, rgba(0,0,0,0.22))',
+      accent: 'var(--dsh-accent, #5b9dff)',
+      ok: '#43c584',
+      warn: '#e8b44a',
+      bad: '#e5646b',
+    }
+
+    const s = {
+      root: { display: 'flex', flexDirection: 'column', gap: 14, padding: '4px 2px 28px', color: C.text, fontSize: 13, lineHeight: 1.55 },
+      card: { border: '1px solid ' + C.line, borderRadius: 12, background: C.card, padding: 14 },
+      row: { display: 'flex', alignItems: 'center', gap: 10 },
+      spread: { display: 'flex', alignItems: 'center', justifyContent: 'space-between', gap: 10 },
+      label: { color: C.dim, fontSize: 12 },
+      value: { color: C.text, fontSize: 12, fontFamily: 'ui-monospace, SFMono-Regular, Consolas, monospace' },
+      h1: { fontSize: 16, fontWeight: 650, margin: 0, letterSpacing: 0.2 },
+      h2: { fontSize: 12, fontWeight: 650, margin: 0, color: C.dim, letterSpacing: 0.4, textTransform: 'uppercase' },
+      btn: {
+        appearance: 'none',
+        border: '1px solid ' + C.line,
+        background: 'rgba(255,255,255,0.06)',
+        color: C.text,
+        borderRadius: 8,
+        padding: '6px 12px',
+        fontSize: 12,
+        cursor: 'pointer',
+        transition: 'background .15s ease, border-color .15s ease',
+        fontFamily: 'inherit',
+      },
+      btnGhost: { appearance: 'none', border: '1px solid transparent', background: 'transparent', color: C.dim, borderRadius: 8, padding: '5px 8px', fontSize: 12, cursor: 'pointer', fontFamily: 'inherit' },
+      input: {
+        width: '100%',
+        boxSizing: 'border-box',
+        border: '1px solid ' + C.line,
+        background: C.field,
+        color: C.text,
+        borderRadius: 8,
+        padding: '6px 9px',
+        fontSize: 12,
+        fontFamily: 'ui-monospace, SFMono-Regular, Consolas, monospace',
+        outline: 'none',
+      },
+      pill: (color) => ({
+        display: 'inline-flex',
+        alignItems: 'center',
+        gap: 6,
+        padding: '2px 9px',
+        borderRadius: 999,
+        border: '1px solid ' + color + '55',
+        background: color + '18',
+        color,
+        fontSize: 11,
+        fontWeight: 600,
+      }),
+      dot: (color) => ({ width: 7, height: 7, borderRadius: 999, background: color, boxShadow: '0 0 8px ' + color + '99' }),
+      log: {
+        margin: 0,
+        maxHeight: 220,
+        overflow: 'auto',
+        padding: 10,
+        borderRadius: 8,
+        background: C.field,
+        border: '1px solid ' + C.line,
+        fontSize: 11,
+        lineHeight: 1.5,
+        fontFamily: 'ui-monospace, SFMono-Regular, Consolas, monospace',
+        whiteSpace: 'pre-wrap',
+        wordBreak: 'break-all',
+        color: C.dim,
+      },
+      list: { display: 'flex', flexDirection: 'column', gap: 2, maxHeight: 260, overflow: 'auto', marginTop: 8 },
+      item: (active) => ({
+        display: 'flex',
+        alignItems: 'center',
+        justifyContent: 'space-between',
+        gap: 8,
+        padding: '6px 9px',
+        borderRadius: 7,
+        cursor: 'pointer',
+        background: active ? 'rgba(91,157,255,0.14)' : 'transparent',
+        border: '1px solid ' + (active ? 'rgba(91,157,255,0.35)' : 'transparent'),
+      }),
+    }
+
+    /* ── api ───────────────────────────────────────────────────────── */
+
+    async function api(path, method, body) {
+      const init = { method: method || 'GET', headers: {} }
+      if (body !== undefined) {
+        init.headers['content-type'] = 'application/json'
+        init.body = JSON.stringify(body)
+      }
+      const res = await fetch(path, init)
+      let json = null
+      try {
+        json = await res.json()
+      } catch {
+        json = null
+      }
+      if (!json) throw new Error('HTTP ' + res.status)
+      return json
+    }
+
+    const fmtKbps = (n) => (typeof n === 'number' ? n >= 1024 ? (n / 1024).toFixed(2) + ' MB/s' : n + ' KB/s' : '—')
+
+    /* ── small components ──────────────────────────────────────────── */
+
+    function Switch(props) {
+      const { on, disabled, onChange, labels } = props
+      return h(
+        'button',
+        {
+          type: 'button',
+          disabled,
+          onClick: onChange,
+          title: on ? labels[1] : labels[0],
+          style: {
+            appearance: 'none',
+            border: '1px solid ' + (on ? C.ok + '88' : C.line),
+            background: on ? C.ok + '22' : 'rgba(255,255,255,0.05)',
+            borderRadius: 999,
+            width: 54,
+            height: 28,
+            padding: 2,
+            cursor: disabled ? 'default' : 'pointer',
+            opacity: disabled ? 0.55 : 1,
+            transition: 'background .18s ease, border-color .18s ease',
+            display: 'flex',
+            alignItems: 'center',
+          },
+        },
+        h('span', {
+          style: {
+            display: 'block',
+            width: 22,
+            height: 22,
+            borderRadius: 999,
+            background: on ? C.ok : '#7a7a84',
+            transform: on ? 'translateX(26px)' : 'translateX(0px)',
+            transition: 'transform .18s cubic-bezier(.4,.9,.3,1), background .18s ease',
+          },
+        }),
+      )
+    }
+
+    function Row(props) {
+      return h('div', { style: s.spread }, h('span', { style: s.label }, props.k), h('span', { style: s.value }, props.v))
+    }
+
+    /* ── main panel ────────────────────────────────────────────────── */
+
+    function VpnPanel() {
+      const [status, setStatus] = useState(null)
+      const [nodes, setNodes] = useState(null)
+      const [settings, setSettings] = useState(null)
+      const [busy, setBusy] = useState('')
+      const [notice, setNotice] = useState(null)
+      const [speed, setSpeed] = useState(null)
+      const [delays, setDelays] = useState({})
+      const [filter, setFilter] = useState('')
+      const [showLog, setShowLog] = useState(false)
+      const [draft, setDraft] = useState(null)
+      const alive = useRef(true)
+
+      useEffect(() => {
+        alive.current = true
+        return () => {
+          alive.current = false
+        }
+      }, [])
+
+      const pullStatus = useCallback(async () => {
+        try {
+          const st = await api('/dsh-vpn/status.json')
+          if (alive.current) setStatus(st)
+        } catch {}
+      }, [])
+
+      const pullNodes = useCallback(async () => {
+        try {
+          const nd = await api('/dsh-vpn/nodes.json')
+          if (alive.current) setNodes(nd.ok ? nd : null)
+        } catch {
+          if (alive.current) setNodes(null)
+        }
+      }, [])
+
+      useEffect(() => {
+        pullStatus()
+        api('/dsh-vpn/settings.json')
+          .then((r) => {
+            if (!alive.current) return
+            setSettings(r.settings)
+            setDraft(r.settings)
+          })
+          .catch(() => {})
+      }, [pullStatus])
+
+      useEffect(() => {
+        const timer = setInterval(() => {
+          if (!alive.current) return
+          if (!busy) pullStatus()
+        }, 5000)
+        return () => clearInterval(timer)
+      }, [busy, pullStatus])
+
+      useEffect(() => {
+        if (status && status.running) pullNodes()
+        else setNodes(null)
+      }, [status && status.running, pullNodes])
+
+      const toast = (kind, text) => {
+        setNotice({ kind, text })
+        setTimeout(() => {
+          if (alive.current) setNotice((n) => (n && n.text === text ? null : n))
+        }, 6000)
+      }
+
+      const toggle = async () => {
+        const want = !(status && status.running)
+        setBusy(want ? '开启中…' : '关闭中…')
+        setNotice(null)
+        try {
+          const res = await api('/dsh-vpn/power.json', 'POST', { on: want })
+          if (alive.current) {
+            if (res.status) setStatus(res.status)
+            if (res.ok) toast('ok', want ? 'VPN 已开启，系统代理已接管' : 'VPN 已关闭，系统代理已还原')
+            else toast('bad', (res.error || res.log || '操作失败').slice(0, 300))
+          }
+        } catch (err) {
+          if (alive.current) toast('bad', String(err.message || err))
+        } finally {
+          if (alive.current) setBusy('')
+          pullStatus()
+        }
+      }
+
+      const selectNode = async (nodeName) => {
+        setBusy('切换节点…')
+        try {
+          const res = await api('/dsh-vpn/select.json', 'POST', { name: nodeName })
+          if (alive.current) {
+            if (res.ok) toast('ok', '已切换到 ' + nodeName)
+            else toast('bad', res.error || '切换失败')
+          }
+        } catch (err) {
+          if (alive.current) toast('bad', String(err.message || err))
+        } finally {
+          if (alive.current) setBusy('')
+          pullStatus()
+        }
+      }
+
+      const testDelay = async () => {
+        const list = (nodes && nodes.list) || []
+        if (!list.length) return
+        setBusy('测延迟…')
+        try {
+          const sample = list.slice(0, 40)
+          const res = await api('/dsh-vpn/delay.json?names=' + encodeURIComponent(sample.join(',')))
+          if (res.ok && alive.current) {
+            const map = {}
+            for (const r of res.results) map[r.name] = r.delay
+            setDelays((d) => Object.assign({}, d, map))
+            const aliveCount = res.results.filter((r) => r.delay !== null).length
+            toast('ok', `测速完成：${aliveCount}/${res.results.length} 个节点可用`)
+          }
+        } catch (err) {
+          if (alive.current) toast('bad', String(err.message || err))
+        } finally {
+          if (alive.current) setBusy('')
+        }
+      }
+
+      const testSpeed = async () => {
+        setBusy('测速中…')
+        setSpeed(null)
+        try {
+          const res = await api('/dsh-vpn/speed.json')
+          if (alive.current) {
+            setSpeed(res)
+            if (res.ok) toast('ok', '下载速度 ' + fmtKbps(res.kbps))
+            else toast('bad', res.error || '测速失败')
+          }
+        } catch (err) {
+          if (alive.current) toast('bad', String(err.message || err))
+        } finally {
+          if (alive.current) setBusy('')
+        }
+      }
+
+      const refreshSubs = async () => {
+        setBusy('更新订阅…')
+        try {
+          const res = await api('/dsh-vpn/refresh.json', 'POST', {})
+          if (alive.current) {
+            if (res.status) setStatus(res.status)
+            toast(res.ok ? 'ok' : 'bad', res.ok ? '订阅已更新，节点列表已重建' : (res.error || '更新失败'))
+            if (res.log) setShowLog(true)
+          }
+        } catch (err) {
+          if (alive.current) toast('bad', String(err.message || err))
+        } finally {
+          if (alive.current) setBusy('')
+          pullNodes()
+        }
+      }
+
+      const saveSettings = async () => {
+        if (!draft) return
+        setBusy('保存设置…')
+        try {
+          const res = await api('/dsh-vpn/settings/save.json', 'POST', draft)
+          if (alive.current) {
+            if (res.ok) {
+              setSettings(res.settings)
+              setDraft(res.settings)
+              if (res.status) setStatus(res.status)
+              toast('ok', '设置已保存')
+            } else toast('bad', res.error || '保存失败')
+          }
+        } catch (err) {
+          if (alive.current) toast('bad', String(err.message || err))
+        } finally {
+          if (alive.current) setBusy('')
+        }
+      }
+
+      const running = !!(status && status.running)
+      const badge = busy
+        ? { color: C.warn, text: busy }
+        : running
+          ? { color: C.ok, text: status && status.systemProxy ? '已开启 · 全局代理' : '已开启 · 未改系统代理' }
+          : { color: C.faint, text: '未开启' }
+
+      const visibleList = useMemo(() => {
+        const list = (nodes && nodes.list) || []
+        const q = filter.trim().toLowerCase()
+        if (!q) return list
+        return list.filter((n) => String(n).toLowerCase().includes(q))
+      }, [nodes, filter])
+
+      return h(
+        'div',
+        { style: s.root },
+
+        /* header */
+        h(
+          'div',
+          { style: s.spread },
+          h(
+            'div',
+            { style: { display: 'flex', flexDirection: 'column', gap: 3 } },
+            h('h1', { style: s.h1 }, 'VPN'),
+            h('span', { style: { ...s.label, fontSize: 11 } }, '免费节点 · Mihomo 内核 · 本地代理'),
+          ),
+          h('div', { style: s.row }, h('span', { style: s.pill(badge.color) }, h('span', { style: s.dot(badge.color) }), badge.text)),
+        ),
+
+        /* master switch */
+        h(
+          'div',
+          { style: { ...s.card, display: 'flex', alignItems: 'center', justifyContent: 'space-between', gap: 14 } },
+          h(
+            'div',
+            { style: { display: 'flex', flexDirection: 'column', gap: 4 } },
+            h('span', { style: { fontWeight: 600 } }, running ? '代理正在运行' : '代理处于关闭状态'),
+            h(
+              'span',
+              { style: { ...s.label, fontSize: 11 } },
+              running
+                ? 'HTTP/SOCKS 入口 127.0.0.1:' + (status.proxyPort || '—') + ' · 规则分流：国内直连，国外走代理'
+                : '打开后自动选择最快节点，并接管系统代理',
+            ),
+          ),
+          h(Switch, { on: running, disabled: !!busy, onChange: toggle, labels: ['打开 VPN', '关闭 VPN'] }),
+        ),
+
+        /* notice */
+        notice &&
+          h(
+            'div',
+            {
+              style: {
+                border: '1px solid ' + (notice.kind === 'ok' ? C.ok : C.bad) + '55',
+                background: (notice.kind === 'ok' ? C.ok : C.bad) + '14',
+                color: notice.kind === 'ok' ? C.ok : C.bad,
+                borderRadius: 9,
+                padding: '8px 11px',
+                fontSize: 12,
+              },
+            },
+            notice.text,
+          ),
+
+        /* status */
+        h(
+          'div',
+          { style: s.card },
+          h('h2', { style: s.h2 }, '状态'),
+          h('div', { style: { marginTop: 8, display: 'flex', flexDirection: 'column', gap: 5 } },
+            h(Row, { k: '内核进程', v: running ? '运行中 (127.0.0.1:' + status.proxyPort + ')' : '未运行' }),
+            h(Row, { k: '系统代理', v: status && status.systemProxy ? (status.proxyServer || '已开启') : '未接管' }),
+            h(Row, { k: '当前节点', v: (status && status.node) || '—' }),
+            h(Row, { k: '可选节点', v: status && status.nodeCount ? status.nodeCount + ' 个' : '—' }),
+            speed && h(Row, { k: '下载测速', v: speed.ok ? fmtKbps(speed.kbps) + ' · ' + speed.seconds + 's' : '失败：' + (speed.error || '') }),
+          ),
+          h(
+            'div',
+            { style: { display: 'flex', flexWrap: 'wrap', gap: 8, marginTop: 12 } },
+            h('button', { type: 'button', style: s.btn, disabled: !!busy || !running, onClick: testSpeed }, '测下载速度'),
+            h('button', { type: 'button', style: s.btn, disabled: !!busy || !running, onClick: testDelay }, '测节点延迟'),
+            h('button', { type: 'button', style: s.btn, disabled: !!busy, onClick: refreshSubs }, '更新订阅节点'),
+            h('button', { type: 'button', style: s.btn, disabled: !!busy, onClick: () => pullStatus() }, '刷新状态'),
+          ),
+        ),
+
+        /* nodes */
+        running &&
+          h(
+            'div',
+            { style: s.card },
+            h(
+              'div',
+              { style: s.spread },
+              h('h2', { style: s.h2 }, '节点'),
+              h('span', { style: { ...s.label, fontSize: 11 } }, ((nodes && nodes.list) || []).length + ' 个可选'),
+            ),
+            h('input', {
+              style: { ...s.input, marginTop: 10, fontFamily: 'inherit' },
+              placeholder: '筛选节点名称…',
+              value: filter,
+              onChange: (e) => setFilter(e.target.value),
+            }),
+            h(
+              'div',
+              { style: s.list },
+              visibleList.slice(0, 200).map((nodeName) =>
+                h(
+                  'div',
+                  {
+                    key: nodeName,
+                    style: s.item(nodes && nodes.now === nodeName),
+                    onClick: () => !busy && selectNode(nodeName),
+                    title: '点击设为当前节点',
+                  },
+                  h('span', { style: { fontSize: 12, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' } }, nodeName),
+                  h(
+                    'span',
+                    { style: { ...s.label, fontSize: 11, flex: 'none' } },
+                    delays[nodeName] === null ? '超时' : delays[nodeName] ? delays[nodeName] + ' ms' : nodes && nodes.now === nodeName ? '使用中' : '',
+                  ),
+                ),
+              ),
+              !visibleList.length && h('div', { style: { ...s.label, padding: 10 } }, nodes ? '没有匹配的节点' : '节点列表加载中…'),
+            ),
+          ),
+
+        /* settings */
+        draft &&
+          h(
+            'div',
+            { style: s.card },
+            h('h2', { style: s.h2 }, '设置'),
+            h(
+              'div',
+              { style: { marginTop: 10, display: 'grid', gridTemplateColumns: '1fr 1fr', gap: 10 } },
+              h('label', { style: { display: 'flex', flexDirection: 'column', gap: 5 } },
+                h('span', { style: s.label }, '本地代理端口'),
+                h('input', {
+                  style: s.input,
+                  type: 'number',
+                  value: draft.proxyPort,
+                  onChange: (e) => setDraft({ ...draft, proxyPort: Number(e.target.value) || 0 }),
+                }),
+              ),
+              h('label', { style: { display: 'flex', flexDirection: 'column', gap: 5 } },
+                h('span', { style: s.label }, '控制器端口'),
+                h('input', {
+                  style: s.input,
+                  type: 'number',
+                  value: draft.controllerPort,
+                  onChange: (e) => setDraft({ ...draft, controllerPort: Number(e.target.value) || 0 }),
+                }),
+              ),
+            ),
+            h('label', { style: { display: 'flex', flexDirection: 'column', gap: 5, marginTop: 10 } },
+              h('span', { style: s.label }, '脚本目录'),
+              h('input', { style: s.input, value: draft.scriptsDir, onChange: (e) => setDraft({ ...draft, scriptsDir: e.target.value }) }),
+            ),
+            h('label', { style: { display: 'flex', flexDirection: 'column', gap: 5, marginTop: 10 } },
+              h('span', { style: s.label }, '测速地址 (http)'),
+              h('input', { style: s.input, value: draft.testUrl, onChange: (e) => setDraft({ ...draft, testUrl: e.target.value }) }),
+            ),
+            h(
+              'label',
+              { style: { display: 'flex', alignItems: 'center', gap: 8, marginTop: 12, cursor: 'pointer' } },
+              h('input', {
+                type: 'checkbox',
+                checked: !!draft.autoStart,
+                onChange: (e) => setDraft({ ...draft, autoStart: e.target.checked }),
+              }),
+              h('span', { style: { fontSize: 12 } }, '开机自动开启 VPN'),
+            ),
+            h(
+              'div',
+              { style: { display: 'flex', gap: 8, marginTop: 12 } },
+              h('button', { type: 'button', style: { ...s.btn, borderColor: C.accent + '66', background: C.accent + '22' }, disabled: !!busy, onClick: saveSettings }, '保存设置'),
+              h('button', { type: 'button', style: s.btnGhost, onClick: () => setDraft(settings) }, '还原'),
+            ),
+          ),
+
+        /* log */
+        status &&
+          (status.lastLog || status.lastError) &&
+          h(
+            'div',
+            { style: s.card },
+            h(
+              'div',
+              { style: s.spread },
+              h('h2', { style: s.h2 }, '最近日志'),
+              h('button', { type: 'button', style: s.btnGhost, onClick: () => setShowLog(!showLog) }, showLog ? '收起' : '展开'),
+            ),
+            showLog && h('pre', { style: { ...s.log, marginTop: 10 } }, (status.lastLog || '') + (status.lastError ? '\n[error]\n' + status.lastError : '')),
+          ),
+
+        h(
+          'div',
+          { style: { ...s.label, fontSize: 11, display: 'flex', justifyContent: 'space-between' } },
+          h('span', null, '内核：Mihomo · 仅供学习研究，请遵守当地法律法规'),
+          status && status.lastActionAt ? h('span', null, '上次操作 ' + new Date(status.lastActionAt).toLocaleTimeString()) : null,
+        ),
+      )
+    }
+
+    /* ── plugin contract ───────────────────────────────────────────── */
+
+    module.exports = {
+      name: 'vpn-panel',
+      inject: ['slots'],
+      apply(ctx) {
+        ctx.slots.inject('settings.section', () =>
+          ctx.slots.register(
+            {
+              name: 'settings.section',
+              id: 'vpn',
+              order: 60,
+              label: () => 'VPN',
+            },
+            VpnPanel,
+          ),
+        )
+        ctx.slots.inject('settings.section.icon', () =>
+          ctx.slots.register(
+            {
+              name: 'settings.section.icon',
+              id: 'vpn',
+            },
+            () =>
+              h(
+                'svg',
+                { width: 16, height: 16, viewBox: '0 0 24 24', fill: 'none', stroke: 'currentColor', strokeWidth: 1.8, strokeLinecap: 'round', strokeLinejoin: 'round' },
+                h('path', { d: 'M12 3l7 3v6c0 4.2-2.9 7.7-7 9-4.1-1.3-7-4.8-7-9V6l7-3z' }),
+                h('path', { d: 'M9.2 12.2l2 2 3.6-3.9' }),
+              ),
+          ),
+        )
+      },
+    }
+
+    return module.exports
+  },
+})

package/package.json

@@ -1,6 +1,53 @@
-{
-  "name": "dsh-vpn-panel",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{
+    "name":  "dsh-vpn-panel",
+    "version":  "0.1.0",
+    "description":  "DSH Settings section that controls a local proxy core: start/stop, node selection, real download measurement and config rebuild. Ships no nodes or proxy core.",
+    "type":  "module",
+    "main":  "src/index.js",
+    "exports":  {
+                    ".":  "./src/index.js",
+                    "./client":  "./lib/client.js",
+                    "./cordis.patch.yml":  "./cordis.patch.yml",
+                    "./package.json":  "./package.json"
+                },
+    "files":  [
+                  "src",
+                  "lib",
+                  "cordis.patch.yml",
+                  "README.md"
+              ],
+    "dsh":  {
+                "bundle":  {
+                               "patch":  "./cordis.patch.yml"
+                           },
+                "client":  {
+                               "platform":  "web",
+                               "immediately":  true,
+                               "inject":  [
+
+                                          ]
+                           }
+            },
+    "keywords":  [
+                     "dsh-plugin",
+                     "deepseek-harness",
+                     "vpn",
+                     "proxy",
+                     "mihomo"
+                 ],
+    "engines":  {
+                    "node":  "^22.19.0 || \u003e=24.0.0"
+                },
+    "repository":  {
+                       "type":  "git",
+                       "url":  "git+https://github.com/hanhan9999999999999999999/dsh-vpn-panel.git"
+                   },
+    "homepage":  "https://github.com/hanhan9999999999999999999/dsh-vpn-panel#readme",
+    "license":  "MIT",
+    "publishConfig":  {
+                          "access":  "public"
+                      },
+    "bugs":  {
+                 "url":  "https://github.com/hanhan9999999999999999999/dsh-vpn-panel/issues"
+             }
+}

package/src/index.js

@@ -0,0 +1,580 @@
+/**
+ * dsh-vpn-panel — host half.
+ *
+ * Serves a tiny JSON API under /dsh-vpn/* that drives the local mihomo based
+ * free-VPN stack (D:\document\vpn by default) and is consumed by the client
+ * bundle's Settings section:
+ *
+ *   GET  /dsh-vpn/status.json     runtime state (port listening, system proxy, current node)
+ *   POST /dsh-vpn/power.json      { on: true|false }  → vpn-on.ps1 / vpn-off.ps1
+ *   GET  /dsh-vpn/nodes.json      groups + node list from the mihomo controller
+ *   POST /dsh-vpn/select.json     { name } → pin a node in the select group
+ *   GET  /dsh-vpn/delay.json      latency probe for a node subset
+ *   GET  /dsh-vpn/speed.json      real download throughput through the proxy
+ *   POST /dsh-vpn/refresh.json    pull subscriptions + rebuild config + restart
+ *   GET  /dsh-vpn/settings.json   panel settings (ports, scripts dir, autostart)
+ *   POST /dsh-vpn/settings.json   write panel settings
+ *
+ * Everything is loopback-only: the routes exist for the desktop/web client that
+ * runs on this machine, and writes are refused for cross-site or foreign hosts.
+ */
+
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import net from 'node:net'
+import http from 'node:http'
+import { spawn } from 'node:child_process'
+
+export const name = 'vpn-panel'
+export const inject = ['webServer']
+
+const DSH_HOME = process.env.DSH_HOME || path.join(os.homedir(), '.dsh')
+const SETTINGS_FILE = path.join(DSH_HOME, 'vpn-panel.json')
+
+const DEFAULTS = {
+  scriptsDir: 'D:\\document\\vpn',
+  proxyPort: 7891,
+  controllerPort: 9090,
+  autoStart: false,
+  testUrl: 'http://speed.cloudflare.com/__down?bytes=5000000',
+}
+
+function readSettings() {
+  try {
+    const raw = JSON.parse(fs.readFileSync(SETTINGS_FILE, 'utf8'))
+    return { ...DEFAULTS, ...(raw && typeof raw === 'object' ? raw : {}) }
+  } catch {
+    return { ...DEFAULTS }
+  }
+}
+
+function writeSettings(patch) {
+  const next = { ...readSettings(), ...(patch || {}) }
+  // Only known keys, and only sane types — the file is read on every request.
+  const clean = {
+    scriptsDir: String(next.scriptsDir || DEFAULTS.scriptsDir),
+    proxyPort: Number(next.proxyPort) || DEFAULTS.proxyPort,
+    controllerPort: Number(next.controllerPort) || DEFAULTS.controllerPort,
+    autoStart: next.autoStart === true,
+    testUrl: String(next.testUrl || DEFAULTS.testUrl),
+  }
+  try {
+    fs.mkdirSync(path.dirname(SETTINGS_FILE), { recursive: true })
+    fs.writeFileSync(SETTINGS_FILE, JSON.stringify(clean, null, 2), 'utf8')
+  } catch (err) {
+    return { ok: false, error: String((err && err.message) || err) }
+  }
+  return { ok: true, settings: clean }
+}
+
+function isLoopbackHostname(input) {
+  const h = String(input || '').toLowerCase().replace(/^\[/, '').replace(/\]$/, '')
+  if (!h) return false
+  if (h === 'localhost' || h.endsWith('.localhost')) return true
+  if (h === '::1') return true
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(h)
+  return !!m && Number(m[1]) === 127 && [m[2], m[3], m[4]].every((x) => Number(x) <= 255)
+}
+
+function requestRejection(req) {
+  try {
+    const headers = (req && req.headers) || {}
+    let host = null
+    try {
+      host = new URL('http://' + String(headers.host || ''))
+    } catch {
+      return 403
+    }
+    if (!isLoopbackHostname(host.hostname)) return 403
+    const site = String(headers['sec-fetch-site'] || '').toLowerCase()
+    if (site === 'cross-site') return 403
+    const origin = headers.origin
+    if (typeof origin === 'string' && origin && origin !== 'null') {
+      try {
+        if (new URL(origin).host.toLowerCase() !== host.host.toLowerCase()) return 403
+      } catch {
+        return 403
+      }
+    }
+    return null
+  } catch {
+    return 403
+  }
+}
+
+function sendJson(res, code, body) {
+  try {
+    const text = JSON.stringify(body)
+    res.statusCode = code
+    res.setHeader('content-type', 'application/json; charset=utf-8')
+    res.setHeader('cache-control', 'no-store')
+    res.end(text)
+  } catch {
+    try {
+      res.statusCode = 500
+      res.end()
+    } catch {}
+  }
+}
+
+function readBody(req, limit = 64 * 1024) {
+  return new Promise((resolve) => {
+    let size = 0
+    const chunks = []
+    req.on('data', (c) => {
+      size += c.length
+      if (size > limit) {
+        req.destroy()
+        resolve(null)
+        return
+      }
+      chunks.push(c)
+    })
+    req.on('end', () => {
+      const text = Buffer.concat(chunks).toString('utf8')
+      if (!text) return resolve({})
+      try {
+        resolve(JSON.parse(text))
+      } catch {
+        resolve(null)
+      }
+    })
+    req.on('error', () => resolve(null))
+  })
+}
+
+function portOpen(port, host = '127.0.0.1', timeout = 700) {
+  return new Promise((resolve) => {
+    const socket = new net.Socket()
+    let done = false
+    const finish = (ok) => {
+      if (done) return
+      done = true
+      try {
+        socket.destroy()
+      } catch {}
+      resolve(ok)
+    }
+    socket.setTimeout(timeout)
+    socket.once('connect', () => finish(true))
+    socket.once('timeout', () => finish(false))
+    socket.once('error', () => finish(false))
+    try {
+      socket.connect(port, host)
+    } catch {
+      finish(false)
+    }
+  })
+}
+
+function controllerRequest(conf, method, apiPath, body, timeout = 4000) {
+  return new Promise((resolve) => {
+    const payload = body === undefined ? null : Buffer.from(JSON.stringify(body), 'utf8')
+    const req = http.request(
+      {
+        host: '127.0.0.1',
+        port: conf.controllerPort,
+        method,
+        path: apiPath,
+        headers: payload
+          ? { 'content-type': 'application/json', 'content-length': payload.length }
+          : undefined,
+        timeout,
+      },
+      (res) => {
+        const chunks = []
+        res.on('data', (c) => chunks.push(c))
+        res.on('end', () => {
+          const text = Buffer.concat(chunks).toString('utf8')
+          let json = null
+          try {
+            json = text ? JSON.parse(text) : null
+          } catch {
+            json = null
+          }
+          resolve({ ok: res.statusCode >= 200 && res.statusCode < 300, code: res.statusCode, json, text })
+        })
+      },
+    )
+    req.on('timeout', () => {
+      try {
+        req.destroy()
+      } catch {}
+      resolve({ ok: false, code: 0, json: null, text: 'timeout' })
+    })
+    req.on('error', (err) => resolve({ ok: false, code: 0, json: null, text: String(err.message || err) }))
+    if (payload) req.write(payload)
+    req.end()
+  })
+}
+
+const state = {
+  busy: null, // 'on' | 'off' | 'refresh'
+  lastLog: '',
+  lastError: '',
+  lastActionAt: 0,
+}
+
+function runPowerShell(scriptPath, args = [], timeoutMs = 60000) {
+  return new Promise((resolve) => {
+    const exists = (() => {
+      try {
+        return fs.existsSync(scriptPath)
+      } catch {
+        return false
+      }
+    })()
+    if (!exists) return resolve({ ok: false, code: -1, out: '', err: `script not found: ${scriptPath}` })
+    const child = spawn(
+      'powershell.exe',
+      ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', scriptPath, ...args],
+      { windowsHide: true },
+    )
+    let out = ''
+    let err = ''
+    const timer = setTimeout(() => {
+      try {
+        child.kill()
+      } catch {}
+    }, timeoutMs)
+    child.stdout.on('data', (d) => {
+      out += d.toString()
+    })
+    child.stderr.on('data', (d) => {
+      err += d.toString()
+    })
+    child.on('error', (e) => {
+      clearTimeout(timer)
+      resolve({ ok: false, code: -1, out, err: String(e.message || e) })
+    })
+    child.on('close', (code) => {
+      clearTimeout(timer)
+      resolve({ ok: code === 0, code, out, err })
+    })
+  })
+}
+
+function readRegValue(keyPath, valueName) {
+  return new Promise((resolve) => {
+    const child = spawn('reg.exe', ['query', keyPath, '/v', valueName], { windowsHide: true })
+    let out = ''
+    child.stdout.on('data', (d) => {
+      out += d.toString()
+    })
+    child.on('error', () => resolve(null))
+    child.on('close', () => {
+      const m = new RegExp(valueName + '\\s+(REG_\\w+)\\s+(.+)', 'i').exec(out)
+      if (!m) return resolve(null)
+      let value = m[2].trim()
+      // reg.exe prints DWORDs as 0x1 — normalise so callers can compare numbers.
+      if (/^0x[0-9a-f]+$/i.test(value)) value = String(parseInt(value, 16))
+      resolve(value)
+    })
+  })
+}
+
+async function collectStatus(conf) {
+  const listening = await portOpen(conf.proxyPort)
+  const proxyEnable = await readRegValue(
+    'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings',
+    'ProxyEnable',
+  )
+  const proxyServer = await readRegValue(
+    'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings',
+    'ProxyServer',
+  )
+  let group = null
+  let node = null
+  let nodeCount = 0
+  if (listening) {
+    const res = await controllerRequest(conf, 'GET', '/proxies')
+    if (res.ok && res.json && res.json.proxies) {
+      const proxies = res.json.proxies
+      const select = proxies['手动切换']
+      const auto = proxies['自动选择']
+      const target = select || auto
+      if (target) {
+        group = select ? '手动切换' : '自动选择'
+        node = target.now || null
+        nodeCount = Array.isArray(target.all) ? target.all.length : 0
+      } else {
+        nodeCount = Object.keys(proxies).length
+      }
+    }
+  }
+  return {
+    running: listening,
+    proxyPort: conf.proxyPort,
+    controllerPort: conf.controllerPort,
+    scriptsDir: conf.scriptsDir,
+    systemProxy: String(proxyEnable) === '1',
+    proxyServer: proxyServer || '',
+    group,
+    node,
+    nodeCount,
+    busy: state.busy,
+    lastLog: state.lastLog.slice(-4000),
+    lastError: state.lastError,
+    lastActionAt: state.lastActionAt,
+    settings: conf,
+    time: Date.now(),
+  }
+}
+
+/**
+ * Real throughput through the local mixed proxy: plain HTTP GET (no CONNECT),
+ * 6 seconds of streaming after the first byte, hard stop at 20 s overall.
+ * Throughput is measured from the first byte, so slow DNS/connect does not
+ * masquerade as a slow link.
+ */
+function speedThroughProxy(conf, url) {
+  return new Promise((resolve) => {
+    let target
+    try {
+      target = new URL(url)
+    } catch {
+      return resolve({ ok: false, error: 'bad testUrl' })
+    }
+    if (target.protocol !== 'http:') return resolve({ ok: false, error: 'testUrl must be http://' })
+    const started = Date.now()
+    let firstByteAt = null
+    let bytes = 0
+    let done = false
+    let guard = null
+    const finish = (extra) => {
+      if (done) return
+      done = true
+      if (guard) clearTimeout(guard)
+      const span = firstByteAt ? (Date.now() - firstByteAt) / 1000 : (Date.now() - started) / 1000
+      const seconds = Math.max(0.05, span)
+      resolve({
+        ok: bytes > 0,
+        bytes,
+        seconds: Number(seconds.toFixed(2)),
+        kbps: Math.round(bytes / 1024 / seconds),
+        ...extra,
+      })
+    }
+    const req = http.request(
+      {
+        host: '127.0.0.1',
+        port: conf.proxyPort,
+        method: 'GET',
+        path: url,
+        headers: { host: target.host, 'user-agent': 'dsh-vpn-panel', connection: 'close' },
+      },
+      (res) => {
+        if (res.statusCode !== 200) {
+          try {
+            res.destroy()
+          } catch {}
+          return finish({ ok: false, error: 'http ' + res.statusCode })
+        }
+        res.on('data', (chunk) => {
+          if (firstByteAt === null) firstByteAt = Date.now()
+          bytes += chunk.length
+          if (Date.now() - firstByteAt > 6000) {
+            try {
+              req.destroy()
+            } catch {}
+            finish({})
+          }
+        })
+        res.on('end', () => finish({}))
+        res.on('error', () => finish({ partial: true }))
+      },
+    )
+    guard = setTimeout(() => {
+      try {
+        req.destroy()
+      } catch {}
+      finish({ ok: false, error: 'timeout' })
+    }, 20000)
+    req.on('error', (err) => {
+      if (bytes > 0) finish({ partial: true })
+      else finish({ ok: false, error: String(err.message || err) })
+    })
+    req.end()
+  })
+}
+
+export function apply(ctx) {
+  const disposers = []
+  let conf = readSettings()
+
+  const route = (apiPath, method, handler) =>
+    disposers.push(
+      ctx.webServer.register({
+        kind: 'exact',
+        path: apiPath,
+        handler: async (req, res) => {
+          const deny = requestRejection(req)
+          if (deny !== null) return sendJson(res, deny, { ok: false, error: 'forbidden' })
+          const wanted = String(req.method || 'GET').toUpperCase()
+          if (wanted !== method) return sendJson(res, 405, { ok: false, error: 'method not allowed' })
+          try {
+            const body = method === 'POST' ? await readBody(req) : null
+            if (method === 'POST' && body === null) return sendJson(res, 400, { ok: false, error: 'bad json' })
+            const result = await handler(req, body)
+            sendJson(res, result && result.status ? result.status : 200, result && result.body ? result.body : result)
+          } catch (err) {
+            state.lastError = String((err && err.stack) || err)
+            sendJson(res, 500, { ok: false, error: String((err && err.message) || err) })
+          }
+        },
+      }),
+    )
+
+  route('/dsh-vpn/status.json', 'GET', async () => collectStatus(conf))
+
+  route('/dsh-vpn/power.json', 'POST', async (req, body) => {
+    const on = body && body.on === true
+    if (state.busy) return { ok: false, error: `busy: ${state.busy}`, status: collectStatus(conf) }
+    state.busy = on ? 'on' : 'off'
+    state.lastError = ''
+    try {
+      const script = path.join(conf.scriptsDir, on ? 'vpn-on.ps1' : 'vpn-off.ps1')
+      const res = await runPowerShell(script, [], 90000)
+      state.lastLog = (res.out || '') + (res.err ? '\n[stderr]\n' + res.err : '')
+      state.lastActionAt = Date.now()
+      if (!res.ok) state.lastError = (res.err || res.out || `exit ${res.code}`).slice(-2000)
+      const status = await collectStatus(conf)
+      return { ok: res.ok, action: on ? 'on' : 'off', status, log: state.lastLog.slice(-3000) }
+    } finally {
+      state.busy = null
+    }
+  })
+
+  route('/dsh-vpn/nodes.json', 'GET', async () => {
+    if (!(await portOpen(conf.proxyPort))) return { ok: false, error: 'proxy not running' }
+    const res = await controllerRequest(conf, 'GET', '/proxies')
+    if (!res.ok || !res.json) return { ok: false, error: res.text || 'controller error' }
+    const proxies = res.json.proxies || {}
+    const groups = []
+    const nodes = []
+    for (const [key, value] of Object.entries(proxies)) {
+      if (!value || typeof value !== 'object') continue
+      if (value.type === 'Selector' || value.type === 'URLTest' || value.type === 'Fallback') {
+        groups.push({ name: key, type: value.type, now: value.now || null, all: value.all || [] })
+      } else if (value.type && !['Direct', 'Reject', 'Pass', 'Compatible'].includes(value.type)) {
+        const history = Array.isArray(value.history) ? value.history : []
+        const last = history.length ? history[history.length - 1] : null
+        nodes.push({ name: key, type: value.type, delay: last ? last.delay : null })
+      }
+    }
+    const preferred = groups.find((g) => g.name === '手动切换') || groups.find((g) => g.name === '自动选择') || groups[0]
+    return {
+      ok: true,
+      groups,
+      nodes,
+      group: preferred ? preferred.name : null,
+      now: preferred ? preferred.now : null,
+      list: preferred ? preferred.all : nodes.map((n) => n.name),
+    }
+  })
+
+  route('/dsh-vpn/select.json', 'POST', async (req, body) => {
+    const nodeName = body && typeof body.name === 'string' ? body.name : ''
+    if (!nodeName) return { ok: false, error: 'name required' }
+    if (!(await portOpen(conf.proxyPort))) return { ok: false, error: 'proxy not running' }
+    const res = await controllerRequest(conf, 'GET', '/proxies')
+    const proxies = (res.json && res.json.proxies) || {}
+    const groupName = proxies['手动切换'] ? '手动切换' : proxies['自动选择'] ? '自动选择' : null
+    if (!groupName) return { ok: false, error: 'no selectable group' }
+    const put = await controllerRequest(
+      conf,
+      'PUT',
+      '/proxies/' + encodeURIComponent(groupName),
+      { name: nodeName },
+    )
+    return { ok: put.ok, code: put.code, group: groupName, name: nodeName, error: put.ok ? undefined : put.text }
+  })
+
+  route('/dsh-vpn/delay.json', 'GET', async (req) => {
+    if (!(await portOpen(conf.proxyPort))) return { ok: false, error: 'proxy not running' }
+    const url = new URL(req.url || '/', 'http://127.0.0.1')
+    const wanted = String(url.searchParams.get('names') || '')
+      .split(',')
+      .map((s) => s.trim())
+      .filter(Boolean)
+      .slice(0, 60)
+    if (!wanted.length) return { ok: false, error: 'names required' }
+    const probeUrl = 'http://www.gstatic.com/generate_204'
+    const results = []
+    const queue = [...wanted]
+    const worker = async () => {
+      while (queue.length) {
+        const nodeName = queue.shift()
+        const started = Date.now()
+        const res = await controllerRequest(
+          conf,
+          'GET',
+          `/proxies/${encodeURIComponent(nodeName)}/delay?url=${encodeURIComponent(probeUrl)}&timeout=3000`,
+          undefined,
+          5000,
+        )
+        const ms = res.ok && res.json && typeof res.json.delay === 'number' ? res.json.delay : null
+        results.push({ name: nodeName, delay: ms, elapsed: Date.now() - started })
+      }
+    }
+    await Promise.all(Array.from({ length: 8 }, worker))
+    results.sort((a, b) => (a.delay === null ? 99999 : a.delay) - (b.delay === null ? 99999 : b.delay))
+    return { ok: true, results }
+  })
+
+  route('/dsh-vpn/speed.json', 'GET', async () => {
+    if (!(await portOpen(conf.proxyPort))) return { ok: false, error: 'proxy not running' }
+    const result = await speedThroughProxy(conf, conf.testUrl)
+    return result
+  })
+
+  route('/dsh-vpn/refresh.json', 'POST', async () => {
+    if (state.busy) return { ok: false, error: `busy: ${state.busy}` }
+    state.busy = 'refresh'
+    state.lastError = ''
+    try {
+      const res = await runPowerShell(path.join(conf.scriptsDir, 'vpn-refresh.ps1'), [], 20 * 60 * 1000)
+      state.lastLog = (res.out || '') + (res.err ? '\n[stderr]\n' + res.err : '')
+      state.lastActionAt = Date.now()
+      if (!res.ok) state.lastError = (res.err || res.out || `exit ${res.code}`).slice(-2000)
+      return { ok: res.ok, log: state.lastLog.slice(-6000), status: await collectStatus(conf) }
+    } finally {
+      state.busy = null
+    }
+  })
+
+  route('/dsh-vpn/settings.json', 'GET', async () => ({ ok: true, settings: conf }))
+
+  // A separate path on purpose: two handler registrations on one exact path are
+  // order-dependent in the host router, so GET /settings.json must stay unique.
+  route('/dsh-vpn/settings/save.json', 'POST', async (req, body) => {
+    const saved = writeSettings(body || {})
+    if (!saved.ok) return { ok: false, error: saved.error }
+    conf = readSettings()
+    // Autostart rides the per-user Run key, the same way the desktop shortcut does.
+    if (body && typeof body.autoStart === 'boolean') {
+      const runKey = 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run'
+      const command = `powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "${path.join(conf.scriptsDir, 'vpn-on.ps1')}"`
+      await new Promise((resolve) => {
+        const child = body.autoStart
+          ? spawn('reg.exe', ['add', runKey, '/v', 'DSHVpn', '/t', 'REG_SZ', '/d', command, '/f'], { windowsHide: true })
+          : spawn('reg.exe', ['delete', runKey, '/v', 'DSHVpn', '/f'], { windowsHide: true })
+        child.on('close', () => resolve())
+        child.on('error', () => resolve())
+      })
+    }
+    return { ok: true, settings: conf, status: await collectStatus(conf) }
+  })
+
+  const disposeAll = () => {
+    for (const dispose of disposers) {
+      try {
+        dispose()
+      } catch {}
+    }
+    disposers.length = 0
+  }
+  if (typeof ctx.effect === 'function') ctx.effect(() => disposeAll)
+  else if (typeof ctx.on === 'function') ctx.on('dispose', disposeAll)
+}