dsh-vpn 0.1.12 → 0.1.14

package/README.md

@@ -35,7 +35,7 @@ dsh plugin --profile web add dsh-vpn
 
 1. 填写服务器 IP、SSH 端口、用户名、密码，点「保存」和「测试连接」。服务器只允许密钥登录的，见下面的「密钥登录」。
 2. 勾选要安装的协议，选择证书类型（推荐「IP 证书」），保存后点「安装 / 更新」。
-3. 在「节点二维码」里点「刷新二维码」，用手机或电脑上的客户端扫码导入。
+3. 在「节点二维码」里点「刷新二维码」，用手机或电脑上的客户端扫码导入。用 **sing-box 官方客户端**（Mac 版 SFM、iPhone 版 SFI、Android 版 SFA、Windows 版 SFW，1.14 及以上）的，点二维码上方的「下载配置文件」，在客户端首页「配置」卡片右上角点「＋」→「从文件导入」，一次导入全部节点（第一次启动时按提示允许安装网络扩展）。官方客户端不能扫单条链接的二维码，用这个配置文件即可；配置里 TUIC 和 AnyTLS 已写入证书锁定，不需要跳过证书校验，默认自动选择延迟最低的节点。
 4. 服务器防火墙的端口由插件自动放行，不用手动操作；安装完成后提示框会列出放行了哪些端口。
 
 **密钥登录**：服务器只允许密钥登录时，把「登录方式」选成「密钥」。插件按这个顺序尝试登录，哪把被服务器认可就用哪把：

package/lib/client.js

@@ -166,7 +166,11 @@ var zh = {
   uninstalled: "\u5DF2\u5378\u8F7D\u3002",
   working: "\u6267\u884C\u4E2D\u2026",
   qrSection: "\u8282\u70B9\u4E8C\u7EF4\u7801",
-  qrHint: "\u7528 v2rayN\u3001NekoBox\u3001Shadowrocket\u3001sing-box\u3001Clash Meta \u7B49\u5BA2\u6237\u7AEF\u626B\u63CF\u5BFC\u5165\u3002\u4E8C\u7EF4\u7801\u7B49\u540C\u4E8E\u5BC6\u7801\uFF0C\u8BF7\u52FF\u5916\u4F20\u3002",
+  qrHint: "\u7528 Shadowrocket\uFF08\u5C0F\u706B\u7BAD\uFF09\u3001v2rayN\u3001NekoBox\u3001Clash Meta \u7B49\u5BA2\u6237\u7AEF\u626B\u63CF\u5BFC\u5165\u3002sing-box \u5B98\u65B9\u5BA2\u6237\u7AEF\u8BF7\u7528\u4E0B\u9762\u7684\u914D\u7F6E\u6587\u4EF6\u3002\u4E8C\u7EF4\u7801\u548C\u914D\u7F6E\u6587\u4EF6\u90FD\u7B49\u540C\u4E8E\u5BC6\u7801\uFF0C\u8BF7\u52FF\u5916\u4F20\u3002",
+  profileTitle: "sing-box \u5B98\u65B9\u5BA2\u6237\u7AEF\u914D\u7F6E",
+  profileDownload: "\u4E0B\u8F7D\u914D\u7F6E\u6587\u4EF6",
+  profileCopy: "\u590D\u5236\u914D\u7F6E",
+  profileHint: "\u4E00\u6B21\u5BFC\u5165\u5168\u90E8\u8282\u70B9\uFF0C\u9002\u7528\u4E8E sing-box \u5B98\u65B9\u5BA2\u6237\u7AEF 1.14 \u53CA\u4EE5\u4E0A\uFF08Mac \u7248 SFM\u3001iPhone \u7248 SFI\u3001Android \u7248 SFA\u3001Windows \u7248 SFW\uFF09\u3002\u5728\u5BA2\u6237\u7AEF\u9996\u9875\u300C\u914D\u7F6E\u300D\u5361\u7247\u53F3\u4E0A\u89D2\u70B9\u300C\uFF0B\u300D\u2192\u300C\u4ECE\u6587\u4EF6\u5BFC\u5165\u300D\uFF0C\u9009\u62E9 {file}\uFF08\u624B\u673A\u53EF\u4EE5\u7528\u9694\u7A7A\u6295\u9001\u6216\u6587\u4EF6 App \u4F20\u8FC7\u53BB\uFF09\u3002\u7B2C\u4E00\u6B21\u542F\u52A8\u65F6\u6309\u63D0\u793A\u5141\u8BB8\u5B89\u88C5\u7F51\u7EDC\u6269\u5C55\u3002TUIC \u548C AnyTLS \u5DF2\u5199\u5165\u8BC1\u4E66\u9501\u5B9A\uFF0C\u4E0D\u9700\u8981\u8DF3\u8FC7\u8BC1\u4E66\u6821\u9A8C\uFF1B\u9ED8\u8BA4\u81EA\u52A8\u9009\u62E9\u5EF6\u8FDF\u6700\u4F4E\u7684\u8282\u70B9\u3002",
   detect: "\u68C0\u67E5\u5DF2\u6709\u5B89\u88C5",
   detecting: "\u6B63\u5728\u8BFB\u53D6\u670D\u52A1\u5668\u2026",
   detectHint: "\u91CD\u88C5\u8FC7 dsh \u6216\u672C\u63D2\u4EF6\uFF1F\u586B\u597D\u4E0A\u9762\u7684\u767B\u5F55\u4FE1\u606F\u76F4\u63A5\u70B9\u8FD9\u91CC\uFF08\u4E0D\u7528\u5148\u4FDD\u5B58\uFF09\uFF0C\u4F1A\u767B\u5F55\u670D\u52A1\u5668\u8BFB\u53D6\u4ECD\u5728\u8FD0\u884C\u7684\u8282\u70B9\uFF0C\u663E\u793A\u539F\u6765\u7684\u4E8C\u7EF4\u7801\uFF0C\u5E76\u81EA\u52A8\u4FDD\u5B58\u8BBE\u7F6E\u3002",
@@ -306,7 +310,11 @@ var en = {
   uninstalled: "Uninstalled.",
   working: "Working\u2026",
   qrSection: "Node QR codes",
-  qrHint: "Scan with v2rayN, NekoBox, Shadowrocket, sing-box, Clash Meta and similar apps. A QR code is as secret as a password.",
+  qrHint: "Scan with Shadowrocket, v2rayN, NekoBox, Clash Meta and similar apps. For the official sing-box apps use the profile below. QR codes and the profile are as secret as a password.",
+  profileTitle: "Profile for the official sing-box apps",
+  profileDownload: "Download profile",
+  profileCopy: "Copy profile",
+  profileHint: "All nodes in one import, for the official sing-box apps 1.14+ (SFM on Mac, SFI on iPhone, SFA on Android, SFW on Windows). In the app, tap + at the top right of the Profile card on the Dashboard \u2192 Import from File, and pick {file} (send it to a phone with AirDrop or the Files app). Allow the network extension when asked on first start. TUIC and AnyTLS have their certificates pinned, so nothing skips verification; the fastest node is chosen automatically.",
   detect: "Find existing install",
   detecting: "Reading the server\u2026",
   detectHint: "Reinstalled dsh or this plugin? Fill in the login details above and click here (no need to save first): it logs in, reads the node that is still running, shows its QR codes and saves the settings.",
@@ -407,6 +415,7 @@ var STYLES = `
 .dshvpn-detect small { flex: 1; min-width: 220px; }
 .dshvpn-keycard-head { display: flex; align-items: center; justify-content: space-between; gap: 10px; }
 .dshvpn-loggedin { font-size: 13px; color: var(--dsw-alias-state-success-primary, #2f855a); }
+.dshvpn-profile { margin: 10px 0 4px; }
 .dshvpn-section { display: flex; flex-direction: column; gap: 16px; }
 .dshvpn-section-head h2 { margin: 0; font-size: 18px; font-weight: 600; }
 .dshvpn-title-row { display: flex; align-items: center; flex-wrap: wrap; gap: 10px; margin-bottom: 4px; }
@@ -1118,6 +1127,106 @@ function renderSVG(data, options = {}) {
   return svg;
 }
 
+// src/client-profile.ts
+var NAMES = {
+  reality: "VLESS Reality",
+  hy2: "Hysteria2",
+  tuic: "TUIC v5",
+  anytls: "AnyTLS",
+  ss: "Shadowsocks 2022"
+};
+function base64UrlDecode(value) {
+  const b64 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const bin = atob(b64 + "=".repeat((4 - b64.length % 4) % 4));
+  return new TextDecoder().decode(Uint8Array.from(bin, (c) => c.charCodeAt(0)));
+}
+function outboundOf(item) {
+  const u = new URL(item.link);
+  const q = Object.fromEntries(u.searchParams);
+  const server = u.hostname.replace(/^\[|\]$/g, "");
+  const port = Number(u.port);
+  const user = decodeURIComponent(u.username);
+  const tls = (alpn) => ({
+    enabled: true,
+    server_name: q.sni,
+    ...alpn ? { alpn } : {},
+    ...item.pubkey_sha256 ? { certificate_public_key_sha256: [item.pubkey_sha256] } : {}
+  });
+  switch (item.id) {
+    case "reality":
+      return {
+        type: "vless",
+        server,
+        server_port: port,
+        uuid: user,
+        flow: q.flow,
+        tls: { enabled: true, server_name: q.sni, utls: { enabled: true, fingerprint: q.fp }, reality: { enabled: true, public_key: q.pbk, short_id: q.sid } }
+      };
+    case "hy2":
+      return { type: "hysteria2", server, server_port: port, password: user, tls: tls(["h3"]) };
+    case "tuic":
+      return {
+        type: "tuic",
+        server,
+        server_port: port,
+        uuid: user,
+        password: decodeURIComponent(u.password),
+        congestion_control: "bbr",
+        tls: tls(["h3"])
+      };
+    case "anytls":
+      return { type: "anytls", server, server_port: port, password: user, tls: tls() };
+    case "ss": {
+      const [method, ...rest] = base64UrlDecode(user).split(":");
+      return { type: "shadowsocks", server, server_port: port, method, password: rest.join(":") };
+    }
+  }
+}
+var AUTO_TAG = "\u81EA\u52A8\u9009\u62E9 Auto";
+var SELECT_TAG = "\u8282\u70B9\u9009\u62E9 Select";
+function singBoxProfile(links) {
+  const nodes = links.items.map((item) => ({ ...outboundOf(item), tag: `${NAMES[item.id]} \xB7 dsh-vpn` }));
+  const tags = nodes.map((n) => n.tag);
+  return {
+    log: { level: "warn" },
+    dns: {
+      servers: [
+        { type: "tls", tag: "dns-remote", server: "1.1.1.1", detour: SELECT_TAG },
+        { type: "local", tag: "dns-local" }
+      ],
+      final: "dns-remote"
+    },
+    inbounds: [{
+      type: "tun",
+      tag: "tun-in",
+      address: ["172.19.0.1/30", "fdfe:dcba:9876::1/126"],
+      auto_route: true,
+      strict_route: true,
+      stack: "mixed"
+    }],
+    outbounds: [
+      { type: "selector", tag: SELECT_TAG, outbounds: [AUTO_TAG, ...tags], default: AUTO_TAG },
+      { type: "urltest", tag: AUTO_TAG, outbounds: tags },
+      ...nodes,
+      { type: "direct", tag: "direct" }
+    ],
+    route: {
+      rules: [
+        { action: "sniff" },
+        { protocol: "dns", action: "hijack-dns" },
+        { ip_is_private: true, outbound: "direct" }
+      ],
+      final: SELECT_TAG,
+      auto_detect_interface: true,
+      default_domain_resolver: "dns-local"
+    },
+    experimental: { cache_file: { enabled: true } }
+  };
+}
+function profileFileName(links) {
+  return `dsh-vpn-${links.server.replace(/[^0-9a-z.-]/gi, "_")}.json`;
+}
+
 // src/protocols.ts
 var PROTOCOLS = [
   { id: "reality", name: "VLESS Reality", transport: "TCP", insecureLink: false, defaultSelected: true },
@@ -1306,6 +1415,39 @@ function KeyPanel({ t, api, form, saved, set, setForm, disabled, onLoggedIn }) {
     ] })
   ] });
 }
+function ProfileCard({ links, t }) {
+  const [copied, setCopied] = (0, import_react.useState)(false);
+  const text = (0, import_react.useMemo)(() => JSON.stringify(singBoxProfile(links), null, 2), [links]);
+  const download = () => {
+    const url = URL.createObjectURL(new Blob([text], { type: "application/json" }));
+    const a = document.createElement("a");
+    a.href = url;
+    a.download = profileFileName(links);
+    document.body.append(a);
+    a.click();
+    a.remove();
+    setTimeout(() => {
+      URL.revokeObjectURL(url);
+    }, 1e4);
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard dshvpn-profile", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard-head", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("profileTitle") }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { className: "dshvpn-actions", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Button, { size: "sm", variant: "primary", onClick: download, children: t("profileDownload") }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Button, { size: "sm", variant: "outline", onClick: () => {
+          void (0, import_dsh_client_ui_primitives.writeClipboard)(text).then(() => {
+            setCopied(true);
+            setTimeout(() => {
+              setCopied(false);
+            }, 1500);
+          });
+        }, children: copied ? t("copied") : t("profileCopy") })
+      ] })
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("profileHint", { file: profileFileName(links) }) })
+  ] });
+}
 function QrCard({ item, t }) {
   const [copied, setCopied] = (0, import_react.useState)(false);
   const info = PROTOCOLS.find((p) => p.id === item.id);
@@ -1698,7 +1840,10 @@ ${fw.backend === "none" ? t("fwNone") : t("fwStatus", { backend: fw.backend, cou
         ] })
       ] }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("qrHint") }),
-      links ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "dshvpn-qr-grid", children: links.items.map((item) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(QrCard, { item, t }, item.id)) }) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-qr-empty", children: [
+      links ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ProfileCard, { links, t }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "dshvpn-qr-grid", children: links.items.map((item) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(QrCard, { item, t }, item.id)) })
+      ] }) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-qr-empty", children: [
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "dshvpn-qr-empty-icon", "aria-hidden": "true", children: "\u25A6" }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: needsSave ? t("qrNeedsSave") : t("qrEmpty") }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_dsh_client_ui_primitives.Button, { variant: "primary", className: "dshvpn-refresh dshvpn-refresh-lg", disabled: disabled || needsSave, onClick: () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vpn",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "DeepSeek Harness plugin: deploy an encrypted VPN (sing-box) to your own VPS in one click, to protect your connections and privacy on untrusted networks",
   "keywords": [
     "anytls",