dsh-vpn 0.1.3 → 0.1.5

package/README.md

@@ -1,6 +1,17 @@
 # dsh-vpn
 
-[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 插件：在 dsh 里填好 VPS 的 IP、端口、用户名和密码，一键部署 sing-box，然后扫二维码导入代理客户端。
+[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 插件：在**你自己的 VPS** 上一键部署加密的 VPN 服务，保护你的网络连接安全。在 dsh 里填好 VPS 的 IP、端口、用户名和密码，一键部署 sing-box，然后扫二维码导入手机或电脑上的客户端。
+
+## 用途：保护你的网络安全
+
+- **加密你的网络流量。** 在公共 Wi-Fi（咖啡馆、机场、酒店）等不可信网络上，你设备和服务器之间的全部流量都经过加密，别人无法窃听或篡改。
+- **保护隐私。** 同一网络上的其他人和网络运营方看不到你访问的内容。
+- **服务器由你自己掌控。** 服务部署在你自己的 VPS 上，不经过任何第三方 VPN 服务商，数据只在你的设备和你的服务器之间传输。
+- **默认安全的配置。** 协议之间的密钥各自独立、随机生成；推荐的 IP 证书让客户端正常校验服务器身份，防止中间人攻击。
+
+请在遵守所在地法律法规和服务器提供商服务条款的前提下使用。
+
+## 特性
 
 - **不依赖本机的 ssh 命令**：内置纯 JS 的 SSH 客户端（[ssh2](https://github.com/mscdex/ssh2)），用密码登录。
 - **两种用法**：在设置页点按钮，或者直接对 agent 说“帮我装个节点”。
@@ -27,6 +38,14 @@ dsh plugin --profile web add dsh-vpn
 3. 在「节点二维码」里点「刷新二维码」，用手机或电脑上的客户端扫码导入。
 4. 服务器防火墙的端口由插件自动放行，不用手动操作；安装完成后提示框会列出放行了哪些端口。
 
+## 语言
+
+整个插件的语言跟随 dsh 的界面语言（「设置 → 通用设置 → 语言」），目前支持 dsh 提供的中文和 English：
+
+- 设置页切换语言后立即生效。
+- agent 安装、卸载前的审批提示，以及 agent 收到的提示，也使用同一种语言。浏览器端会把 dsh 当前的界面语言告诉插件，插件把它保存下来，dsh 重启后仍然沿用。
+- 只有从来没有打开过 dsh 网页界面时（例如纯命令行运行），才临时使用电脑的系统语言。
+
 ## 防火墙
 
 安装时插件会检测 VPS 上启用的防火墙，自动放行所选协议的端口（使用 IP 证书时还有 TCP 80）：
@@ -65,7 +84,7 @@ IP 证书由 sing-box 1.14 内置的 ACME 向 Let's Encrypt 申请（[2026 年
 | 接口鉴权 | 设置页的接口挂在 dsh 自己的 `/api` 下，复用 dsh 的登录 cookie 和防跨站、防 DNS rebinding 检查 |
 | 主机指纹 | 首次连接时记录 SSH 主机指纹，之后指纹变化就拒绝连接，防止中间人截获密码 |
 | sudo | 非 root 用户用 `sudo -S`：密码只经 stdin 传入，不会出现在命令行，也不会传给脚本 |
-| agent 操作 | agent 安装或卸载前会弹出审批，提示语言跟随电脑系统语言，并写明目标服务器、协议，以及是否重新生成密钥 |
+| agent 操作 | agent 安装或卸载前会弹出审批，写明目标服务器、协议，以及是否重新生成密钥 |
 | 证书 | 推荐用 IP 证书，所有协议都正常校验；自签模式下 Hysteria2 锁定指纹，TUIC 和 AnyTLS 会标注“需跳过证书校验” |
 
 ## 组成
@@ -101,20 +120,12 @@ DSH_SRC=/path/to/deepseek-harness pnpm typecheck   # 对照 dsh 源码做宿主
 
 npm 上的 `@deepseek-ai/*` 包版本过旧，所以 `build` 不做类型检查，类型检查对照 dsh 源码单独进行。
 
-## 发布
-
-推送与 `package.json` 版本号一致的标签，GitHub Actions 会先跑测试，再发布到 npm。需要在仓库 Secrets 里配置 `NPM_TOKEN`。仓库是私有的，npm 不支持为私有仓库生成来源证明（provenance），所以发布时不带来源证明：
-
-```bash
-git tag v0.1.0 && git push origin v0.1.0
-```
-
 端到端测试会在目标机器上**安装再卸载**，并用 sing-box 客户端实测每种协议的连通性。本地可以用 [Lima](https://lima-vm.io) 虚拟机：
 
 ```bash
 limactl start --name=vps --vm-type=vz --network=vzNAT --set '.mounts=[]' template:ubuntu-24.04
 # 在虚拟机里开启 sshd 的密码登录并设置密码，然后：
-DSH_VPN_E2E_HOST=192.168.64.2 DSH_VPN_E2E_USER=root DSH_VPN_E2E_PASSWORD=… pnpm test:e2e
+DSH_VPN_E2E_HOST=<测试虚拟机 IP> DSH_VPN_E2E_USER=root DSH_VPN_E2E_PASSWORD=… pnpm test:e2e
 ```
 
 防火墙测试会依次启用 ufw、firewalld、iptables、nftables，**只能在测试虚拟机上运行**：
@@ -132,6 +143,14 @@ DSH_VPN_E2E_ACME=https://localhost:14000/dir DSH_VPN_E2E_HOST=… pnpm test:e2e
 
 在插件配置里设置 `acmeProvider`，就可以让插件改用 Pebble 或其他 ACME 服务器。
 
+## 发布
+
+推送与 `package.json` 版本号一致的标签，GitHub Actions 会先跑测试，再发布到 npm。需要在仓库 Secrets 里配置 `NPM_TOKEN`。仓库是私有的，npm 不支持为私有仓库生成来源证明（provenance），所以发布时不带来源证明：
+
+```bash
+git tag v0.1.0 && git push origin v0.1.0
+```
+
 ## TODO
 
 - [ ] SSH 私钥登录

package/assets/vpn-ops.md

@@ -1,6 +1,10 @@
 # vpn-ops
 
-Deploy and operate a personal sing-box server on the user's VPS. The plugin logs in over SSH with the password saved in dsh Settings (bottom-left gear) → VPN 设置. No local ssh client is needed.
+Deploy and operate a personal, encrypted VPN (sing-box) on the user's own VPS. The plugin logs in over SSH with the password saved in dsh Settings (bottom-left gear) → VPN 设置. No local ssh client is needed.
+
+## Purpose
+
+This is a security and privacy tool. It encrypts all traffic between the user's devices and a server they control, so connections stay private on untrusted networks such as public Wi-Fi, without relying on a third-party VPN provider. Describe it in those terms, and remind the user to use it in line with local laws and their server provider's terms of service.
 
 ## Workflow
 
@@ -19,11 +23,11 @@ The settings page offers **self-signed** (default) or **IP certificate** (recomm
 
 | id | Name | Transport | Notes |
 |---|---|---|---|
-| `reality` | VLESS Reality | TCP | Default. Hardest to detect. |
+| `reality` | VLESS Reality | TCP | Default. Strong encryption; the handshake looks like ordinary HTTPS to a well-known website, which keeps usage private. |
 | `hy2` | Hysteria2 | UDP | Default. Fast on lossy links; the link pins the certificate. |
 | `tuic` | TUIC v5 | UDP | With a self-signed cert, clients skip verification; with an IP certificate, they verify normally. |
 | `anytls` | AnyTLS | TCP | Same as TUIC. |
-| `ss` | Shadowsocks 2022 | TCP+UDP | Widely supported; no TLS disguise. |
+| `ss` | Shadowsocks 2022 | TCP+UDP | Widely supported, modern AEAD encryption, no TLS layer. |
 
 ## Troubleshooting
 
@@ -31,7 +35,7 @@ The settings page offers **self-signed** (default) or **IP certificate** (recomm
 |---|---|---|
 | `auth_failed` | Wrong username or password | User fixes it on the settings page |
 | `host_key_mismatch` | Server reinstalled or replaced, or a man-in-the-middle | Ask whether the server was reinstalled. Only then may the user click 重置指纹 (Reset fingerprint) |
-| `connect_failed` / `timeout` | Wrong IP or port, SSH blocked, server down | Check the IP and SSH port on the settings page |
+| `connect_failed` / `timeout` | Wrong IP or port, SSH not reachable, server down | Check the IP and SSH port on the settings page |
 | `sudo_failed` | User is not root and lacks sudo, or the sudo password differs | Use root, or grant sudo |
 | `no_systemd` | Container or OpenRC VPS | Not supported yet |
 | `download_failed` | VPS cannot reach GitHub | Retry later |
@@ -39,8 +43,8 @@ The settings page offers **self-signed** (default) or **IP certificate** (recomm
 | `port80_in_use` | Another program (nginx, …) holds port 80 | Stop it, or use self-signed |
 | Status says the certificate expires within 24 h or has expired | Renewal failing | Open TCP 80; an expired certificate breaks every TLS protocol |
 | Installed and active, but the client times out | Cloud security group (the VPS firewall is handled automatically) | Open the ports from `result.firewall.opened` in the cloud console |
-| Reality fails, others work | SNI site blocked | Reinstall with another SNI (future option) |
-| UDP protocols fail, TCP works | ISP blocks or throttles UDP | Use Reality or AnyTLS |
-| Everything stopped after working | IP blocked | `vpn_install` with `regenerate: true` for new ports; if it is still blocked, the IP must change |
+| Reality fails, others work | The Reality handshake site (SNI) is unreachable from the server | Reinstall with another SNI (future option) |
+| UDP protocols fail, TCP works | The current network drops or rate-limits UDP (common on some Wi-Fi and mobile networks) | Use Reality or AnyTLS |
+| Everything stopped after working | The server IP or its ports are no longer reachable from the user's network | `vpn_install` with `regenerate: true` for new ports; if it is still unreachable, check with the server provider |
 
 Never paste passwords, private keys or the state file into chat. Share links are secrets too: show them only to the user.

package/lib/client.js

@@ -55,7 +55,9 @@ var vpnApi = {
   status: () => post("/status"),
   links: () => post("/links"),
   install: (regenerate) => post("/install", { regenerate }),
-  uninstall: () => post("/uninstall")
+  uninstall: () => post("/uninstall"),
+  /** Tell the host which language dsh's UI shows (approval prompts follow it). */
+  reportUiLocale: (locale) => post("/ui-locale", { locale })
 };
 
 // src/client/locales.ts
@@ -63,7 +65,7 @@ var NS = "dsh-vpn";
 var zh = {
   title: "VPN \u8282\u70B9",
   nav: "VPN \u8BBE\u7F6E",
-  description: "\u5728\u4F60\u7684 VPS \u4E0A\u4E00\u952E\u90E8\u7F72 sing-box\uFF0C\u5E76\u7528\u4E8C\u7EF4\u7801\u5BFC\u5165\u624B\u673A\u6216\u7535\u8111\u4E0A\u7684\u4EE3\u7406\u5BA2\u6237\u7AEF\u3002",
+  description: "\u5728\u4F60\u81EA\u5DF1\u7684 VPS \u4E0A\u4E00\u952E\u90E8\u7F72\u52A0\u5BC6 VPN\uFF0C\u4FDD\u62A4\u4F60\u5728\u516C\u5171 Wi-Fi \u7B49\u7F51\u7EDC\u4E2D\u7684\u8FDE\u63A5\u5B89\u5168\u548C\u9690\u79C1\uFF1B\u626B\u7801\u5373\u53EF\u5BFC\u5165\u624B\u673A\u6216\u7535\u8111\u4E0A\u7684\u5BA2\u6237\u7AEF\u3002",
   serverSection: "\u670D\u52A1\u5668",
   host: "\u670D\u52A1\u5668 IP \u6216\u57DF\u540D",
   hostHint: "\u4F60\u8D2D\u4E70\u7684 VPS \u7684\u516C\u7F51\u5730\u5740\u3002",
@@ -154,7 +156,7 @@ var zh = {
 var en = {
   title: "VPN node",
   nav: "VPN",
-  description: "Deploy sing-box to your VPS in one click and import it into proxy apps by scanning QR codes.",
+  description: "Deploy an encrypted VPN to your own VPS in one click to keep your connections private and secure on networks like public Wi-Fi; import it into client apps by scanning QR codes.",
   serverSection: "Server",
   host: "Server IP or domain",
   hostHint: "Public address of your VPS.",
@@ -1400,6 +1402,17 @@ function apply(ctx) {
       style.remove();
     };
   }, "dsh-vpn: styles");
+  const reportLocale = (locale, attempt = 0) => {
+    void vpnApi.reportUiLocale(locale).then((r) => {
+      if (!r.ok && attempt < 3) setTimeout(() => {
+        reportLocale(locale, attempt + 1);
+      }, 2e3 * (attempt + 1));
+    });
+  };
+  reportLocale(ctx.locale.getSnapshot().active);
+  ctx.on("locale/change", (snapshot) => {
+    reportLocale(snapshot.active);
+  });
   const t = ctx.locale.bind(NS);
   ctx.slots.inject("settings.section", () => ctx.slots.register({
     name: "settings.section",

package/lib/index.js

@@ -20264,8 +20264,13 @@ function json(status, value) {
     headers: { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" }
   });
 }
-function apiHandlers(service) {
+function apiHandlers(service, uiLang, onUiLang) {
   return {
+    "/ui-locale": async (body) => {
+      if (typeof body.locale !== "string" || body.locale.length > 35) return { ok: false, error: "bad_request", message: "locale must be a string" };
+      if (uiLang?.set(body.locale)) onUiLang?.();
+      return { ok: true, lang: uiLang?.get() };
+    },
     "/settings/get": async () => ({ ok: true, settings: publicView(await service.store.get()) }),
     "/settings/save": async (body) => {
       let saved;
@@ -20305,8 +20310,8 @@ async function handle(handler, request) {
     return json(500, { ok: false, error: "internal", message: err instanceof Error ? err.message : String(err) });
   }
 }
-function registerApi(ctx, service) {
-  for (const [path, handler] of Object.entries(apiHandlers(service))) {
+function registerApi(ctx, service, uiLang, onUiLang) {
+  for (const [path, handler] of Object.entries(apiHandlers(service, uiLang, onUiLang))) {
     ctx.effect(() => ctx.connection.fetch.register({
       path: `${API_BASE}${path}`,
       methods: ["POST"],
@@ -20672,6 +20677,15 @@ var CredentialSettingsStore = class {
     });
   }
 };
+var UI_LANG_KEY = credentialKey("dsh-vpn", "ui-locale");
+async function readUiLang(ctx) {
+  const record = await ctx.credentials.readRecord(UI_LANG_KEY);
+  const lang = record?.kind === "grant" ? record.payload?.lang : void 0;
+  return lang === "zh" || lang === "en" ? lang : void 0;
+}
+async function writeUiLang(ctx, lang) {
+  await ctx.credentials.modifyRecord(UI_LANG_KEY, async () => ({ kind: "grant", payload: { lang } }));
+}
 
 // src/i18n.ts
 import { execFileSync } from "node:child_process";
@@ -20696,6 +20710,26 @@ var cached;
 function osLang() {
   return cached ??= detectOsLang();
 }
+var UiLang = class {
+  current;
+  constructor(initial) {
+    this.current = initial;
+  }
+  /** @returns true when the value changed (worth persisting). */
+  set(tag) {
+    const next = fromTag(tag) ?? "en";
+    if (next === this.current) return false;
+    this.current = next;
+    return true;
+  }
+  get() {
+    return this.current ?? osLang();
+  }
+  /** Explicitly reported (not the OS fallback). */
+  get reported() {
+    return this.current;
+  }
+};
 var protocolNames = (ids, sep) => ids.map((id) => PROTOCOLS.find((p) => p.id === id)?.name ?? id).join(sep);
 var TLS_PROTOCOLS = ["hy2", "tuic", "anytls"];
 function installPrompt(lang, p) {
@@ -20738,8 +20772,8 @@ var OUTPUT = {
     ].join("\n")
   }]
 };
-function toToolValue(r) {
-  const message = r.error === "not_configured" ? notConfiguredMessage(osLang()) : r.message;
+function toToolValue(r, uiLang) {
+  const message = r.error === "not_configured" ? notConfiguredMessage(uiLang.get()) : r.message;
   return {
     ok: r.ok,
     ...r.error ? { error: r.error } : {},
@@ -20749,6 +20783,16 @@ function toToolValue(r) {
 }
 function apply(ctx, config) {
   const service = new VpnService(new CredentialSettingsStore(ctx), { timeoutMs: config.timeoutMs, acmeProvider: config.acmeProvider });
+  const uiLang = new UiLang();
+  readUiLang(ctx).then((lang) => {
+    if (lang && !uiLang.reported) uiLang.set(lang);
+  }, () => {
+  });
+  const persistUiLang = () => {
+    const lang = uiLang.reported;
+    if (lang) writeUiLang(ctx, lang).catch(() => {
+    });
+  };
   ctx.tools.register(defineTool({
     name: "vpn_install",
     description: `Install or reconfigure sing-box on the VPS configured in dsh Settings \u2192 VPN, then return share links. Opens the ports in the VPS firewall automatically (result.firewall). Idempotent: rerunning keeps existing keys and ports unless \`regenerate\` is set. Protocols: ${PROTOCOL_IDS.join(", ")}; omit to use the ones selected in settings.`,
@@ -20762,7 +20806,7 @@ function apply(ctx, config) {
     },
     output: OUTPUT,
     async execute(args, exec) {
-      return toToolValue(await service.install({ protocols: args.protocols, regenerate: args.regenerate }, exec.signal));
+      return toToolValue(await service.install({ protocols: args.protocols, regenerate: args.regenerate }, exec.signal), uiLang);
     }
   }));
   ctx.tools.register(defineTool({
@@ -20770,21 +20814,21 @@ function apply(ctx, config) {
     description: "Report whether sing-box is installed, running and listening on the configured VPS.",
     parameters: {},
     output: OUTPUT,
-    execute: async (_args, exec) => toToolValue(await service.status(exec.signal))
+    execute: async (_args, exec) => toToolValue(await service.status(exec.signal), uiLang)
   }));
   ctx.tools.register(defineTool({
     name: "vpn_links",
     description: "Return the share links (vless://, hysteria2://, \u2026) of the installed server. Tell the user they can scan QR codes in dsh Settings \u2192 VPN (\u5237\u65B0\u4E8C\u7EF4\u7801).",
     parameters: {},
     output: OUTPUT,
-    execute: async (_args, exec) => toToolValue(await service.links(exec.signal))
+    execute: async (_args, exec) => toToolValue(await service.links(exec.signal), uiLang)
   }));
   ctx.tools.register(defineTool({
     name: "vpn_uninstall",
     description: "Stop and remove sing-box, its config and credentials from the configured VPS.",
     parameters: {},
     output: OUTPUT,
-    execute: async (_args, exec) => toToolValue(await service.uninstall(exec.signal))
+    execute: async (_args, exec) => toToolValue(await service.uninstall(exec.signal), uiLang)
   }));
   if (config.confirm) {
     ctx.on("tools/pre-execute", async (exec, next) => {
@@ -20792,7 +20836,7 @@ function apply(ctx, config) {
       if (decision.kind !== "allow" || exec.name !== "vpn_install" && exec.name !== "vpn_uninstall") return decision;
       const s = await service.store.get();
       if (!s) return decision;
-      const lang = osLang();
+      const lang = uiLang.get();
       const target = `${s.host}:${s.port}`;
       if (exec.name === "vpn_uninstall") return { kind: "ask", reason: uninstallPrompt(lang, target) };
       const args = exec.arguments;
@@ -20809,7 +20853,7 @@ function apply(ctx, config) {
     });
   }
   ctx.inject(["connection"], (webCtx) => {
-    registerApi(webCtx, service);
+    registerApi(webCtx, service, uiLang, persistUiLang);
   });
 }
 export {

package/lib/skill.js

@@ -19,7 +19,7 @@ var RESOURCE_BASE = {
 };
 var CANDIDATE = {
   name: "vpn-ops",
-  description: "Deploy, inspect and troubleshoot a personal sing-box proxy (VLESS-Reality + Hysteria2) on a VPS over ssh. Use when the user wants to set up a VPN/proxy node on a server, get node links, or fix a node that stopped working.",
+  description: "Deploy, inspect and troubleshoot a personal encrypted VPN (sing-box) on the user's own VPS over ssh, to protect their connections on untrusted networks. Use when the user wants to set up a VPN/proxy node on a server, get node links, or fix a node that stopped working.",
   invocation: { modelInvocable: true, userInvocable: true },
   provider: PROVIDER_NAME,
   source: "bundled",

package/package.json

@@ -1,15 +1,18 @@
 {
   "name": "dsh-vpn",
-  "version": "0.1.3",
-  "description": "DeepSeek Harness plugin: one-click sing-box deployment to a VPS over SSH, with a settings page and QR codes",
+  "version": "0.1.5",
+  "description": "DeepSeek Harness plugin: deploy an encrypted VPN (sing-box) to your own VPS in one click, to protect your connections and privacy on untrusted networks",
   "keywords": [
+    "anytls",
     "dsh-plugin",
-    "sing-box",
-    "reality",
+    "encryption",
     "hysteria2",
-    "tuic",
-    "anytls",
+    "privacy",
+    "reality",
+    "security",
     "shadowsocks",
+    "sing-box",
+    "tuic",
     "vpn"
   ],
   "license": "MIT",