dsh-vps 1.4.3 → 1.4.4

package/README.en.md

@@ -21,6 +21,16 @@
 
 ---
 
+> **This is a VPS deployment tool for DSH, not a plugin you install inside DSH. Run the one-command install below on your VPS and it sets up DSH itself, complete with a login page.**
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps/main/install.sh | sudo bash -s
+```
+
+With a domain, or behind the GFW, append arguments at the end, e.g. `bash -s -- --domain dsh.example.com --mirror cn`. See [Install](#install) below.
+
+---
+
 ## Overview
 
 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (DSH) trusts the operator's own browser only: its privileged interfaces — settings, API keys, plugin management — sit behind a browser-trust fence, and a plain reverse proxy to the public internet leaves those pages dead.
@@ -80,7 +90,7 @@ dsh-vps puts a zero-dependency login gateway (dsh-gate) in front of DSH: public
 
 - Ubuntu 22.04+ / Debian 12+ (root)
 - 2 vCPU / 2 GB RAM or better; ports 80/443 open
-- A domain gives you automatic HTTPS; a public IP with a self-signed certificate works too
+- A domain gives you automatic HTTPS (point its A record at the server first); a public IP with a self-signed certificate works too
 
 ---
 
@@ -93,12 +103,43 @@ curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps
 
 Add `--mirror cn` if you're behind the GFW (Node and DSH come from npmmirror).
 
-Or install through npm, running exactly the scripts shipped in this package (pinned, no network fetch):
+No domain yet? Drop `--domain` and use the public IP:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps/main/install.sh | sudo bash -s
+```
+
+The certificate then comes from Caddy's internal CA, so the browser warns "Not secure / certificate not trusted". That is expected — proceed anyway. Add a domain in the wizard later and Caddy switches to a real certificate.
+
+Or install through npm, running exactly the scripts shipped in this package (pinned, no network fetch; needs Node 22+ on the machine):
 
 ```bash
 npx dsh-vps-install install --domain dsh.example.com
 ```
 
+To pin a release instead of `main`, replace `main` with the version tag and point later gateway fetches at the same tag:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps/v1.4.3/install.sh \
+  | sudo DSHVPS_RAW_BASE=https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps/v1.4.3 bash -s -- --domain dsh.example.com
+```
+
+If the final self-check reports that DSH is not ready yet, the setup link is still printed; the page shows startup progress and the actual error. Troubleshoot with `journalctl -u dsh-gate -n 80 --no-pager`.
+
+## Update
+
+Update the gateway code on an installed machine:
+
+```bash
+sudo dsh-vps update-gate
+```
+
+Machines installed with v1.4.1 or earlier that crash on start with `user patch-layer watching requires the Cordis HMR service` got a wrong dependency freeze point (it pulled in cordis releases incompatible with DSH 0.1.5-rc.2). Delete the DSH directory and run the install command again; accounts and data are kept:
+
+```bash
+sudo systemctl stop dsh-gate && sudo rm -rf /opt/dsh-vps/dsh/0.1.5-rc.2
+```
+
 ## Uninstall
 
 ```bash
@@ -106,13 +147,13 @@ curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps
   | sudo bash -s -- --yes
 ```
 
-Removes the service, install directory, Caddy site block and the DSH data directory, packing a backup to `/root/dsh-vps-uninstall-<timestamp>.tar.gz` first. `--keep-data` keeps the DSH data, `--purge-caddy` removes Caddy as well. Uninstall then install again gives you a clean environment.
+Removes the service, install directory, Caddy site block and the DSH data directory, packing a backup (Caddyfile included) to `/root/dsh-vps-uninstall-<timestamp>.tar.gz` first. The Caddyfile you had before installing is restored, and only a wg0 created by `dsh-vps vpn` is removed — your own WireGuard setup is left alone. `--keep-data` keeps the DSH data, `--purge-caddy` removes Caddy as well. Uninstall then install again gives you a clean environment.
 
 ---
 
 ## First run
 
-Installation prints a **setup link carrying a one-time token** — open it to reach the wizard: admin username/password → (optional) domain, DeepSeek API key & bundled plugins → log in. The wizard only answers to holders of the token, and the token is voided once setup completes. Lost the link? Print it again:
+Installation prints a **setup link carrying a one-time token** — open it to reach the wizard (opening the bare IP or domain only shows a "setup token required" page, by design): admin username/password → (optional) domain, DeepSeek API key & bundled plugins → log in. The wizard only answers to holders of the token, and the token is voided once setup completes. Lost the link? Print it again:
 
 ```bash
 sudo dsh-vps setup-url
@@ -120,7 +161,7 @@ sudo dsh-vps setup-url
 
 Skipping the API key is fine; you can add it later via the "Add API key" prompt or Settings → Models → DeepSeek.
 
-The checked plugins install in the background (tens of seconds) and DSH restarts to activate them. Two of them:
+The checked plugins install in the background (tens of seconds), always at their latest npm version, and DSH restarts to activate them. Two of them:
 
 - **dsh-market**: browse, search and install community plugins and themes from Settings. Everything else is left to you — add whatever you want from the marketplace afterwards
 - **dsh-vps-manager**: manage this very VPS from inside DSH — `/vps-` queries that skip the model and cost no tokens, a terminal in the conversation, AI operations confirmed by risk level, and a recipe library. Add this machine under Settings → VPS Manager (SSH key login)
@@ -167,7 +208,7 @@ sudo dsh-vps update-gate   # pull and restart the gateway code itself (no git re
 sudo dsh-vps ownshost on   # apply the settings-page patch (restores settings on a public domain)
 sudo dsh-vps selfcheck     # run the regression self-check (login / RPC / WebSocket / session)
 sudo dsh-vps rollback      # switch back to the previous DSH version
-sudo dsh-vps reset-admin   # emergency reset if you lose the admin password (re-runs the wizard, new token)
+sudo dsh-vps reset-admin   # emergency reset if you lose the admin password (re-runs the wizard, new token, signs out every session)
 sudo dsh-vps setup-url     # re-print the setup link with its one-time token
 sudo dsh-vps backup        # back up data (keeps the latest 3)
 sudo dsh-vps vpn setup macbook  # build a WireGuard tunnel and switch to "tunnel only"

package/README.md

@@ -22,6 +22,16 @@
 
 ---
 
+> **这是 DSH 的 VPS 部署工具，不是在 DSH 里安装的插件，在 VPS 上执行下面的一键安装命令，它会装好带登录界面的 DSH 本身。**
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps/main/install.sh | sudo bash -s
+```
+
+有域名、在国内网络时，在末尾追加参数，例如 `bash -s -- --domain dsh.example.com --mirror cn`，详见下方[安装](#安装)。
+
+---
+
 ## 简介
 
 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)（DSH）默认只认本机浏览器：它的特权接口（设置、API Key、插件管理）受浏览器信任围栏保护，直接反代到公网后这些页面全部失效。
@@ -85,7 +95,7 @@ dsh-vps puts a zero-dependency login gateway (dsh-gate) in front of DSH: public
 
 - Ubuntu 22.04+ / Debian 12+（root）
 - 2C2G 以上，端口 80/443 开放
-- 有域名即可自动 HTTPS；暂无域名也能先用公网 IP + 自签证书
+- 有域名即可自动 HTTPS（先把 A 记录解析到本机）；暂无域名也能先用公网 IP + 自签证书
 
 ---
 
@@ -103,12 +113,43 @@ curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps
   | sudo bash -s -- --domain dsh.example.com --mirror cn
 ```
 
-走 npm 也行，装的是这个包自带的同一份脚本（版本固定，不联网拉取）：
+还没有域名？去掉 `--domain` 即可，按公网 IP 访问：
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps/main/install.sh | sudo bash -s
+```
+
+此时证书由 Caddy 内置 CA 自签，浏览器会提示「不安全 / 证书不受信任」，属预期现象，选择继续访问即可。之后在向导里填上域名，Caddy 自动换成正式证书。
+
+走 npm 也行，装的是这个包自带的同一份脚本（版本固定，不联网拉取；需本机已有 Node 22+）：
 
 ```bash
 npx dsh-vps-install install --domain dsh.example.com
 ```
 
+想固定在某个发布版本（而非 `main`），把地址里的 `main` 换成版本 tag，并让后续拉取的网关文件也用同一版本：
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps/v1.4.3/install.sh \
+  | sudo DSHVPS_RAW_BASE=https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps/v1.4.3 bash -s -- --domain dsh.example.com
+```
+
+安装末尾的自检若报「DSH 尚未就绪」，设置链接照样会打印；页面会显示启动进度与具体错误，排障见 `journalctl -u dsh-gate -n 80 --no-pager`。
+
+## 更新
+
+已安装的机器更新网关代码：
+
+```bash
+sudo dsh-vps update-gate
+```
+
+用 v1.4.1 及更早版本装出、启动即报 `user patch-layer watching requires the Cordis HMR service` 的机器，是当时依赖冻结点有误（装进了与 DSH 0.1.5-rc.2 不兼容的 cordis 新版本）。删掉 DSH 目录后重跑安装命令即可修复，账号与数据保留：
+
+```bash
+sudo systemctl stop dsh-gate && sudo rm -rf /opt/dsh-vps/dsh/0.1.5-rc.2
+```
+
 ## 卸载
 
 ```bash
@@ -116,13 +157,13 @@ curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps
   | sudo bash -s -- --yes
 ```
 
-删除服务、安装目录、Caddy 站点块与 DSH 数据目录，删除前打包备份到 `/root/dsh-vps-uninstall-<时间戳>.tar.gz`。`--keep-data` 保留 DSH 数据，`--purge-caddy` 连 Caddy 一起移除。卸载完再跑安装命令即为全新环境。
+删除服务、安装目录、Caddy 站点块与 DSH 数据目录，删除前打包备份（含 Caddyfile）到 `/root/dsh-vps-uninstall-<时间戳>.tar.gz`。安装前原有的 Caddyfile 会被还原；WireGuard 只移除 `dsh-vps vpn` 建的 wg0，你自己的隧道配置不动。`--keep-data` 保留 DSH 数据，`--purge-caddy` 连 Caddy 一起移除。卸载完再跑安装命令即为全新环境。
 
 ---
 
 ## 首次使用
 
-安装结束时终端会打印一条**带一次性令牌的初始设置链接**，浏览器打开它进入向导：填管理员用户名/密码 → （可选）域名、DeepSeek API Key 与预置插件 → 登录即用。向导只对持有令牌的人开放，令牌在设置完成后自动作废。链接丢了随时重取：
+安装结束时终端会打印一条**带一次性令牌的初始设置链接**，浏览器打开它进入向导（直接打开 IP 或域名只会看到「需要启动令牌」页，这是有意的）：填管理员用户名/密码 → （可选）域名、DeepSeek API Key 与预置插件 → 登录即用。向导只对持有令牌的人开放，令牌在设置完成后自动作废。链接丢了随时重取：
 
 ```bash
 sudo dsh-vps setup-url
@@ -130,7 +171,7 @@ sudo dsh-vps setup-url
 
 API Key 跳过也无妨，登录后仍可在「添加 API Key」引导或 设置 → 模型 → DeepSeek 中补填。
 
-勾选的插件在后台安装（约几十秒），装完 DSH 自动重启生效，共两款：
+勾选的插件在后台安装（约几十秒），始终取 npm 上的最新版本，装完 DSH 自动重启生效，共两款：
 
 - **dsh-market**：设置页内浏览、搜索、一键安装社区插件与主题。其余插件留给你自己挑，装好后在市场里按需添加
 - **dsh-vps-manager**：在 DSH 里直接管理这台 VPS——`/vps-` 系列查询命令不经过模型、不花 token，对话内嵌终端，AI 操作按风险分级确认，另有运维菜谱库。需在 设置 → VPS Manager 中添加本机（SSH 密钥登录）
@@ -177,7 +218,7 @@ sudo dsh-vps update-gate   # 拉取并重启网关自身代码（安装目录非
 sudo dsh-vps ownshost on   # 应用设置页可用性补丁（公网域名下恢复设置页）
 sudo dsh-vps selfcheck     # 跑一遍回归自检（登录 / RPC / WebSocket / 会话）
 sudo dsh-vps rollback      # 切回上一 DSH 版本
-sudo dsh-vps reset-admin   # 忘记管理员密码时的应急重置（重新走向导并换发令牌）
+sudo dsh-vps reset-admin   # 忘记管理员密码时的应急重置（重新走向导并换发令牌，已登录的会话全部失效）
 sudo dsh-vps setup-url     # 重新打印带一次性令牌的初始设置链接
 sudo dsh-vps backup        # 备份数据（保留最近 3 份）
 sudo dsh-vps vpn setup macbook  # 建 WireGuard 隧道并切到「仅隧道可访问」

package/gate/server.js

@@ -106,6 +106,16 @@ const FORWARDING_HEADERS = new Set(["forwarded", "x-forwarded-for", "x-real-ip"]
 // 在 gate 之外拉起一个新的 DSH 进程，抢占 3080 端口，gate 的子进程随后
 // EADDRINUSE 且再也抓不到 launchToken → 永久"会话尚未就绪"。
 const MARKET_RESTART_PATHS = new Set(["/dsh-market/restart", "/dsh-market/restart/"]);
+// dshmarket 1.64+ 的 v1 接口：内部直接调用上面那个旧端点（不经 HTTP），必须一起接管
+const MARKET_RESTART_V1_PATHS = new Set(["/dsh-market/api/v1/restart", "/dsh-market/api/v1/restart/"]);
+const MARKET_V1_SCHEMA = "dsh-market/update-api/v1";
+
+// dshmarket 的写操作（安装/更新/卸载/备份导出……）为防 DNS 重绑定，要求 Host 必须是回环地址，
+// Origin 必须与 Host 一致；经 gate 转发时 Host 是公网域名，于是一律 403 "untrusted origin"。
+// gate 已完成登录校验，这里替它做同样的同源检查（Origin 与公网 Host 一致、非跨站），
+// 通过后把 Host/Origin 改写成 DSH 的回环地址再转发。设 GATE_MARKET_LOOPBACK=0 可关闭。
+const MARKET_PREFIX = "/dsh-market/";
+const MARKET_LOOPBACK = process.env.GATE_MARKET_LOOPBACK !== "0";
 // 设 GATE_TAKEOVER_RESTART=0 则放行给 DSH 自己处理（会退回到上面那个坑，仅供对照排障）
 const TAKEOVER_RESTART = process.env.GATE_TAKEOVER_RESTART !== "0";
 
@@ -889,6 +899,11 @@ function proxyHttp(req, res) {
 	}
 	const cookie = upstreamCookieHeader(req.headers.cookie, authority);
 	if (cookie !== void 0) headers.cookie = cookie;
+	if (MARKET_LOOPBACK && (req.url || "").startsWith(MARKET_PREFIX)) {
+		const loopback = `127.0.0.1:${DSH_PORT}`;
+		headers.host = loopback;
+		if (headers.origin !== void 0) headers.origin = `http://${loopback}`;
+	}
 
 	let responded = false;
 	const upstreamReq = http.request(
@@ -952,6 +967,18 @@ function proxyHttp(req, res) {
 	req.pipe(upstreamReq);
 }
 
+/** 市场请求的同源检查：Origin（若有）须与浏览器访问的公网 Host 一致，且不是跨站请求。 */
+function marketRequestSameOrigin(req) {
+	if (String(req.headers["sec-fetch-site"] || "") === "cross-site") return false;
+	const origin = req.headers.origin;
+	if (origin === void 0) return true; // 同源 GET 导航（如备份下载）不带 Origin
+	try {
+		return new URL(origin).host === requestAuthority(req.headers);
+	} catch {
+		return false;
+	}
+}
+
 function denyUnauthenticated(req, res, pathname) {
 	if (pathname.startsWith("/api")) {
 		sendText(res, 401, "gate authentication required");
@@ -969,15 +996,16 @@ function denyUnauthenticated(req, res, pathname) {
  * 这里按官方客户端的协议回 202 + ok，然后由 gate 自己重启 DSH 子进程：
  * 子进程是全新的，/dsh-market/status 的 boot id 随之变化，前端会自动 reload。
  */
-function handleMarketRestart(req, res) {
+function handleMarketRestart(req, res, v1) {
 	if (req.method !== "POST") {
 		res.writeHead(405, { allow: "POST", "content-length": "0" });
 		res.end();
 		return;
 	}
-	log("market restart requested; gate takes over");
+	log(`market restart requested${v1 ? " (v1)" : ""}; gate takes over`);
+	const result = { ok: true, managedBy: "dsh-gate", note: "由 gate 重启 DSH 子进程" };
 	res.writeHead(202, { "content-type": "application/json", "cache-control": "no-store" });
-	res.end(JSON.stringify({ ok: true, managedBy: "dsh-gate", note: "由 gate 重启 DSH 子进程" }));
+	res.end(JSON.stringify(v1 ? { schema: MARKET_V1_SCHEMA, result } : result));
 	// 让 202 先落地，再动手（客户端随后轮询 /dsh-market/status 等 boot id 变化）
 	setTimeout(() => restartDsh("market restart"), 300);
 }
@@ -1666,7 +1694,12 @@ function main() {
 					denyUnauthenticated(req, res, pathname);
 					return;
 				}
-				if (TAKEOVER_RESTART && MARKET_RESTART_PATHS.has(pathname)) return handleMarketRestart(req, res);
+				if (pathname.startsWith(MARKET_PREFIX) && !marketRequestSameOrigin(req)) {
+					sendText(res, 403, "cross-origin market request refused by gate");
+					return;
+				}
+				if (TAKEOVER_RESTART && MARKET_RESTART_PATHS.has(pathname)) return handleMarketRestart(req, res, false);
+				if (TAKEOVER_RESTART && MARKET_RESTART_V1_PATHS.has(pathname)) return handleMarketRestart(req, res, true);
 				proxyHttp(req, res);
 			})
 			.catch((err) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vps",
-  "version": "1.4.3",
+  "version": "1.4.4",
   "description": "Ship DeepSeek Harness to your own VPS: one command installs a zero-dependency login gateway, automatic HTTPS through Caddy, systemd supervision, and optional WireGuard-only access.",
   "keywords": [
     "deepseek-harness",