dsh-vps 1.4.3 → 1.5.0

package/README.en.md

@@ -8,7 +8,7 @@
   <a href="LICENSE"><img src="https://img.shields.io/github/license/AIcivilization/deepseek-harness-vps" alt="MIT license"></a>
   <a href="https://www.npmjs.com/package/dsh-vps"><img src="https://img.shields.io/npm/v/dsh-vps" alt="npm version"></a>
   <img src="https://img.shields.io/badge/platform-Ubuntu%2022.04%2B%20%2F%20Debian%2012%2B-blue" alt="Platform: Ubuntu 22.04+ / Debian 12+">
-  <img src="https://img.shields.io/badge/DeepSeek%20Harness-0.1.5--rc.2-4176E6" alt="DeepSeek Harness 0.1.5-rc.2">
+  <img src="https://img.shields.io/badge/DeepSeek%20Harness-0.1.7--rc.1-4176E6" alt="DeepSeek Harness 0.1.7-rc.1">
   <img src="https://img.shields.io/badge/runtime%20dependencies-0-brightgreen" alt="Runtime dependencies: 0">
   <img src="https://img.shields.io/badge/Docker-not%20required-orange" alt="No Docker required">
   <img src="https://img.shields.io/github/stars/AIcivilization/deepseek-harness-vps?style=social" alt="star">
@@ -21,6 +21,16 @@
 
 ---
 
+> **This is a VPS deployment tool for DSH, not a plugin you install inside DSH. Run the one-command install below on your VPS and it sets up DSH itself, complete with a login page.**
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps/main/install.sh | sudo bash -s
+```
+
+With a domain, or behind the GFW, append arguments at the end, e.g. `bash -s -- --domain dsh.example.com --mirror cn`. See [Install](#install) below.
+
+---
+
 ## Overview
 
 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (DSH) trusts the operator's own browser only: its privileged interfaces — settings, API keys, plugin management — sit behind a browser-trust fence, and a plain reverse proxy to the public internet leaves those pages dead.
@@ -80,7 +90,7 @@ dsh-vps puts a zero-dependency login gateway (dsh-gate) in front of DSH: public
 
 - Ubuntu 22.04+ / Debian 12+ (root)
 - 2 vCPU / 2 GB RAM or better; ports 80/443 open
-- A domain gives you automatic HTTPS; a public IP with a self-signed certificate works too
+- A domain gives you automatic HTTPS (point its A record at the server first); a public IP with a self-signed certificate works too
 
 ---
 
@@ -93,12 +103,47 @@ curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps
 
 Add `--mirror cn` if you're behind the GFW (Node and DSH come from npmmirror).
 
-Or install through npm, running exactly the scripts shipped in this package (pinned, no network fetch):
+No domain yet? Drop `--domain` and use the public IP:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps/main/install.sh | sudo bash -s
+```
+
+The certificate then comes from Caddy's internal CA, so the browser warns "Not secure / certificate not trusted". That is expected — proceed anyway. Add a domain in the wizard later and Caddy switches to a real certificate.
+
+Or install through npm, running exactly the scripts shipped in this package (pinned, no network fetch; needs Node 22+ on the machine):
 
 ```bash
 npx dsh-vps-install install --domain dsh.example.com
 ```
 
+To pin a release instead of `main`, replace `main` with the version tag and point later gateway fetches at the same tag:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps/v1.4.3/install.sh \
+  | sudo DSHVPS_RAW_BASE=https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps/v1.4.3 bash -s -- --domain dsh.example.com
+```
+
+If the final self-check reports that DSH is not ready yet, the setup link is still printed; the page shows startup progress and the actual error. Troubleshoot with `journalctl -u dsh-gate -n 80 --no-pager`.
+
+## Update
+
+**DSH itself follows official releases.** The gateway checks npm for the newest official version (the higher of the `latest` and `next` channels) every 6 hours. When a newer one exists, a prompt appears in the bottom-right corner of the DSH page; click "Upgrade now" and confirm. It backs up, installs the new version and runs a self-check, rolling back to the previous version automatically if the check fails — about 1–3 minutes in all. "Later" silences that version. From the server you can also run:
+
+```bash
+sudo dsh-vps upgrade            # the version verified by this project
+sudo dsh-vps upgrade --latest   # the latest official release (same as "Upgrade now")
+sudo dsh-vps rollback           # back to the previous version
+```
+
+**Updating the gateway itself** (login page, proxy):
+
+```bash
+sudo dsh-vps update-gate
+```
+
+Machines installed before v1.5.0: run the one-command install above once more to get the in-page upgrade prompt (it enters repair/update mode; accounts and data are kept).
+
 ## Uninstall
 
 ```bash
@@ -106,13 +151,13 @@ curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps
   | sudo bash -s -- --yes
 ```
 
-Removes the service, install directory, Caddy site block and the DSH data directory, packing a backup to `/root/dsh-vps-uninstall-<timestamp>.tar.gz` first. `--keep-data` keeps the DSH data, `--purge-caddy` removes Caddy as well. Uninstall then install again gives you a clean environment.
+Removes the service, install directory, Caddy site block and the DSH data directory, packing a backup (Caddyfile included) to `/root/dsh-vps-uninstall-<timestamp>.tar.gz` first. The Caddyfile you had before installing is restored, and only a wg0 created by `dsh-vps vpn` is removed — your own WireGuard setup is left alone. `--keep-data` keeps the DSH data, `--purge-caddy` removes Caddy as well. Uninstall then install again gives you a clean environment.
 
 ---
 
 ## First run
 
-Installation prints a **setup link carrying a one-time token** — open it to reach the wizard: admin username/password → (optional) domain, DeepSeek API key & bundled plugins → log in. The wizard only answers to holders of the token, and the token is voided once setup completes. Lost the link? Print it again:
+Installation prints a **setup link carrying a one-time token** — open it to reach the wizard (opening the bare IP or domain only shows a "setup token required" page, by design): admin username/password → (optional) domain, DeepSeek API key & bundled plugins → log in. The wizard only answers to holders of the token, and the token is voided once setup completes. Lost the link? Print it again:
 
 ```bash
 sudo dsh-vps setup-url
@@ -120,7 +165,7 @@ sudo dsh-vps setup-url
 
 Skipping the API key is fine; you can add it later via the "Add API key" prompt or Settings → Models → DeepSeek.
 
-The checked plugins install in the background (tens of seconds) and DSH restarts to activate them. Two of them:
+The checked plugins install in the background (tens of seconds), always at their latest npm version, and DSH restarts to activate them. Two of them:
 
 - **dsh-market**: browse, search and install community plugins and themes from Settings. Everything else is left to you — add whatever you want from the marketplace afterwards
 - **dsh-vps-manager**: manage this very VPS from inside DSH — `/vps-` queries that skip the model and cost no tokens, a terminal in the conversation, AI operations confirmed by risk level, and a recipe library. Add this machine under Settings → VPS Manager (SSH key login)
@@ -167,7 +212,7 @@ sudo dsh-vps update-gate   # pull and restart the gateway code itself (no git re
 sudo dsh-vps ownshost on   # apply the settings-page patch (restores settings on a public domain)
 sudo dsh-vps selfcheck     # run the regression self-check (login / RPC / WebSocket / session)
 sudo dsh-vps rollback      # switch back to the previous DSH version
-sudo dsh-vps reset-admin   # emergency reset if you lose the admin password (re-runs the wizard, new token)
+sudo dsh-vps reset-admin   # emergency reset if you lose the admin password (re-runs the wizard, new token, signs out every session)
 sudo dsh-vps setup-url     # re-print the setup link with its one-time token
 sudo dsh-vps backup        # back up data (keeps the latest 3)
 sudo dsh-vps vpn setup macbook  # build a WireGuard tunnel and switch to "tunnel only"

package/README.md

@@ -9,7 +9,7 @@
   <a href="LICENSE"><img src="https://img.shields.io/github/license/AIcivilization/deepseek-harness-vps" alt="MIT 许可证"></a>
   <a href="https://www.npmjs.com/package/dsh-vps"><img src="https://img.shields.io/npm/v/dsh-vps" alt="npm 版本"></a>
   <img src="https://img.shields.io/badge/platform-Ubuntu%2022.04%2B%20%2F%20Debian%2012%2B-blue" alt="平台：Ubuntu 22.04+ / Debian 12+">
-  <img src="https://img.shields.io/badge/DeepSeek%20Harness-0.1.5--rc.2-4176E6" alt="DeepSeek Harness 0.1.5-rc.2">
+  <img src="https://img.shields.io/badge/DeepSeek%20Harness-0.1.7--rc.1-4176E6" alt="DeepSeek Harness 0.1.7-rc.1">
   <img src="https://img.shields.io/badge/runtime%20dependencies-0-brightgreen" alt="运行时依赖：0">
   <img src="https://img.shields.io/badge/Docker-not%20required-orange" alt="无需 Docker">
   <img src="https://img.shields.io/github/stars/AIcivilization/deepseek-harness-vps?style=social" alt="star">
@@ -22,6 +22,16 @@
 
 ---
 
+> **这是 DSH 的 VPS 部署工具，不是在 DSH 里安装的插件，在 VPS 上执行下面的一键安装命令，它会装好带登录界面的 DSH 本身。**
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps/main/install.sh | sudo bash -s
+```
+
+有域名、在国内网络时，在末尾追加参数，例如 `bash -s -- --domain dsh.example.com --mirror cn`，详见下方[安装](#安装)。
+
+---
+
 ## 简介
 
 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)（DSH）默认只认本机浏览器：它的特权接口（设置、API Key、插件管理）受浏览器信任围栏保护，直接反代到公网后这些页面全部失效。
@@ -85,7 +95,7 @@ dsh-vps puts a zero-dependency login gateway (dsh-gate) in front of DSH: public
 
 - Ubuntu 22.04+ / Debian 12+（root）
 - 2C2G 以上，端口 80/443 开放
-- 有域名即可自动 HTTPS；暂无域名也能先用公网 IP + 自签证书
+- 有域名即可自动 HTTPS（先把 A 记录解析到本机）；暂无域名也能先用公网 IP + 自签证书
 
 ---
 
@@ -103,12 +113,47 @@ curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps
   | sudo bash -s -- --domain dsh.example.com --mirror cn
 ```
 
-走 npm 也行，装的是这个包自带的同一份脚本（版本固定，不联网拉取）：
+还没有域名？去掉 `--domain` 即可，按公网 IP 访问：
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps/main/install.sh | sudo bash -s
+```
+
+此时证书由 Caddy 内置 CA 自签，浏览器会提示「不安全 / 证书不受信任」，属预期现象，选择继续访问即可。之后在向导里填上域名，Caddy 自动换成正式证书。
+
+走 npm 也行，装的是这个包自带的同一份脚本（版本固定，不联网拉取；需本机已有 Node 22+）：
 
 ```bash
 npx dsh-vps-install install --domain dsh.example.com
 ```
 
+想固定在某个发布版本（而非 `main`），把地址里的 `main` 换成版本 tag，并让后续拉取的网关文件也用同一版本：
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps/v1.4.3/install.sh \
+  | sudo DSHVPS_RAW_BASE=https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps/v1.4.3 bash -s -- --domain dsh.example.com
+```
+
+安装末尾的自检若报「DSH 尚未就绪」，设置链接照样会打印；页面会显示启动进度与具体错误，排障见 `journalctl -u dsh-gate -n 80 --no-pager`。
+
+## 更新
+
+**DSH 本身跟随官方版本升级。** 网关每 6 小时检查一次 npm 上的官方最新版（正式渠道 latest 与预览渠道 next 中较新的一个），有新版本时 DSH 页面右下角弹出提示，点「立即升级」并确认即可：自动备份 → 安装新版 → 自检，自检不通过自动回滚到原版本，全程约 1–3 分钟。点「稍后」则这个版本不再提示。也可以在服务器上手动执行：
+
+```bash
+sudo dsh-vps upgrade            # 升到本项目验证过的版本
+sudo dsh-vps upgrade --latest   # 升到官方最新版（与页面上的「立即升级」相同）
+sudo dsh-vps rollback           # 切回上一个版本
+```
+
+**网关（登录页、代理）自身的更新**：
+
+```bash
+sudo dsh-vps update-gate
+```
+
+v1.5.0 之前安装的机器，重跑一次上方的一键安装命令即可获得页面升级提示（进入修复/更新模式，账号与数据保留）。
+
 ## 卸载
 
 ```bash
@@ -116,13 +161,13 @@ curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps
   | sudo bash -s -- --yes
 ```
 
-删除服务、安装目录、Caddy 站点块与 DSH 数据目录，删除前打包备份到 `/root/dsh-vps-uninstall-<时间戳>.tar.gz`。`--keep-data` 保留 DSH 数据，`--purge-caddy` 连 Caddy 一起移除。卸载完再跑安装命令即为全新环境。
+删除服务、安装目录、Caddy 站点块与 DSH 数据目录，删除前打包备份（含 Caddyfile）到 `/root/dsh-vps-uninstall-<时间戳>.tar.gz`。安装前原有的 Caddyfile 会被还原；WireGuard 只移除 `dsh-vps vpn` 建的 wg0，你自己的隧道配置不动。`--keep-data` 保留 DSH 数据，`--purge-caddy` 连 Caddy 一起移除。卸载完再跑安装命令即为全新环境。
 
 ---
 
 ## 首次使用
 
-安装结束时终端会打印一条**带一次性令牌的初始设置链接**，浏览器打开它进入向导：填管理员用户名/密码 → （可选）域名、DeepSeek API Key 与预置插件 → 登录即用。向导只对持有令牌的人开放，令牌在设置完成后自动作废。链接丢了随时重取：
+安装结束时终端会打印一条**带一次性令牌的初始设置链接**，浏览器打开它进入向导（直接打开 IP 或域名只会看到「需要启动令牌」页，这是有意的）：填管理员用户名/密码 → （可选）域名、DeepSeek API Key 与预置插件 → 登录即用。向导只对持有令牌的人开放，令牌在设置完成后自动作废。链接丢了随时重取：
 
 ```bash
 sudo dsh-vps setup-url
@@ -130,7 +175,7 @@ sudo dsh-vps setup-url
 
 API Key 跳过也无妨，登录后仍可在「添加 API Key」引导或 设置 → 模型 → DeepSeek 中补填。
 
-勾选的插件在后台安装（约几十秒），装完 DSH 自动重启生效，共两款：
+勾选的插件在后台安装（约几十秒），始终取 npm 上的最新版本，装完 DSH 自动重启生效，共两款：
 
 - **dsh-market**：设置页内浏览、搜索、一键安装社区插件与主题。其余插件留给你自己挑，装好后在市场里按需添加
 - **dsh-vps-manager**：在 DSH 里直接管理这台 VPS——`/vps-` 系列查询命令不经过模型、不花 token，对话内嵌终端，AI 操作按风险分级确认，另有运维菜谱库。需在 设置 → VPS Manager 中添加本机（SSH 密钥登录）
@@ -177,7 +222,7 @@ sudo dsh-vps update-gate   # 拉取并重启网关自身代码（安装目录非
 sudo dsh-vps ownshost on   # 应用设置页可用性补丁（公网域名下恢复设置页）
 sudo dsh-vps selfcheck     # 跑一遍回归自检（登录 / RPC / WebSocket / 会话）
 sudo dsh-vps rollback      # 切回上一 DSH 版本
-sudo dsh-vps reset-admin   # 忘记管理员密码时的应急重置（重新走向导并换发令牌）
+sudo dsh-vps reset-admin   # 忘记管理员密码时的应急重置（重新走向导并换发令牌，已登录的会话全部失效）
 sudo dsh-vps setup-url     # 重新打印带一次性令牌的初始设置链接
 sudo dsh-vps backup        # 备份数据（保留最近 3 份）
 sudo dsh-vps vpn setup macbook  # 建 WireGuard 隧道并切到「仅隧道可访问」

package/bin/dsh-vps

@@ -14,6 +14,8 @@
 #   tunnel              仅我可访问：SSH 本地端口转发（零安装，打印用法）
 #   backup              打包 DSH_HOME + state 到 backups/（保留最近 3 份）
 #   selfcheck           手动触发升级回归自检探针
+#   install-units       安装浏览器一键升级所需的 systemd 单元（install.sh / update-gate 调用）
+#   upgrade-run         执行浏览器发起的升级请求（由 dsh-vps-upgrade.service 以 root 调用）
 
 set -euo pipefail
 
@@ -30,9 +32,13 @@ VERSIONS_URL="${DSHVPS_VERSIONS_URL:-$RAW_BASE/versions.json}"
 # ——2026-09-22 上游漏发 rc.3 的 dsh-client-ui-sidebar-documentpreview 就导致过 ETARGET。
 # 同日 03:46 的 cordis 系列新版本同样与 rc.2 不兼容（HMR 服务缺失致启动崩溃），故取 03:40。
 # 升级 latest_verified 时必须同步推后这个值。
-DEFAULT_RESOLVE_BEFORE="${DSHVPS_RESOLVE_BEFORE:-2026-09-22T03:40:00Z}"
+DEFAULT_RESOLVE_BEFORE="${DSHVPS_RESOLVE_BEFORE:-2026-09-24T08:20:00Z}"
 VERSIONS_CACHE="$ROOT/state/versions.cache.json"
 NPM_REGISTRY="${DSHVPS_NPM_REGISTRY:-}"
+# 安装时选了 --mirror cn：升级也走 npmmirror，与首次安装同源
+if [[ -z "$NPM_REGISTRY" && -f "$ROOT/state/config.json" ]] && grep -q '"mirror": *"cn"' "$ROOT/state/config.json"; then
+	NPM_REGISTRY="https://registry.npmmirror.com"
+fi
 
 log()  { printf '\033[1;32m[dsh-vps]\033[0m %s\n' "$*"; }
 warn() { printf '\033[1;33m[dsh-vps]\033[0m %s\n' "$*" >&2; }
@@ -92,11 +98,21 @@ cmd_update_gate() {
 		rm -f "$sb"
 		warn "gate/site-block.js 未更新（保留现有版本）"
 	fi
+	# dsh-vps 自身：先写临时文件再 rename，正在执行的旧脚本仍持有旧 inode，不会读到半截新内容
+	local nb="$ROOT/bin/dsh-vps.update"
+	if curl -fsSL --max-time 30 "$RAW_BASE/bin/dsh-vps" -o "$nb" && bash -n "$nb"; then
+		chmod 755 "$nb"
+		mv "$nb" "$ROOT/bin/dsh-vps"
+	else
+		rm -f "$nb"
+		warn "bin/dsh-vps 未更新（保留现有版本）"
+	fi
 	log "重启 $SERVICE ..."
 	systemctl restart "$SERVICE"
 	sleep 3
-	# 静态补丁与 gate 代码同源管理，顺手补齐（幂等）
-	ownshost_apply on >/dev/null 2>&1 || true
+	# 以下都用新版 dsh-vps 执行：静态补丁（含升级提示条）与一键升级单元（幂等）
+	"$ROOT/bin/dsh-vps" ownshost on >/dev/null 2>&1 || true
+	"$ROOT/bin/dsh-vps" install-units || warn "一键升级单元安装失败"
 	if curl -fsS --max-time 3 "$HEALTH_URL" >/dev/null 2>&1; then
 		log "更新完成，gate 已就绪"
 	else
@@ -194,7 +210,7 @@ switch_version() { # $1=版本目录名
 
 cmd_upgrade() {
 	require_root
-	local target="" latest_mode=0 assume_yes=0
+	local target="" latest_mode=0 assume_yes=0 verified_latest=0
 	while [[ $# -gt 0 ]]; do
 		case "$1" in
 		--latest) latest_mode=1; shift ;;
@@ -211,11 +227,44 @@ cmd_upgrade() {
 	local resolve_before="$DEFAULT_RESOLVE_BEFORE"
 
 	if [[ $latest_mode -eq 1 ]]; then
-		warn "--latest：将安装 npm 上未经 dsh-vps 验证的最新版本，可能破坏兼容性（有备份与自动回滚兜底）"
+		warn "--latest：将安装官方最新版（npm latest 与 next 渠道中较新的一个），可能未经 dsh-vps 验证（有备份与自动回滚兜底）"
 		[[ $assume_yes -eq 1 ]] || { read -rp "确认继续？[y/N] " ans; [[ "$ans" == "y" || "$ans" == "Y" ]] || die "已取消"; }
-		local reg_arg=(version)
+		local reg_arg=(dist-tags --json)
 		[[ -n "$NPM_REGISTRY" ]] && reg_arg+=(--registry="$NPM_REGISTRY")
-		target=$(npm view @deepseek-ai/dsh "${reg_arg[@]}" 2>/dev/null) || die "无法查询 npm 最新版本"
+		# 官方同时维护 latest（正式）与 next（预览）两个渠道，取其中版本号更高的；alpha 等内部渠道不取
+		target=$(npm view @deepseek-ai/dsh "${reg_arg[@]}" 2>/dev/null | node -e '
+const t = JSON.parse(require("fs").readFileSync(0, "utf8"));
+const parse = (v) => { const [c, p] = v.split("-", 2); return { c: c.split(".").map(Number), p: p === undefined ? null : p.split(".") }; };
+const cmp = (a, b) => {
+	const x = parse(a), y = parse(b);
+	for (let i = 0; i < 3; i++) if (x.c[i] !== y.c[i]) return x.c[i] - y.c[i];
+	if (x.p === null || y.p === null) return (x.p === null) - (y.p === null);
+	for (let i = 0; i < Math.max(x.p.length, y.p.length); i++) {
+		const p = x.p[i], q = y.p[i];
+		if (p === undefined || q === undefined) return p === undefined ? -1 : 1;
+		const pn = /^\d+$/.test(p), qn = /^\d+$/.test(q);
+		if (pn && qn && +p !== +q) return +p - +q;
+		if (pn !== qn) return pn ? -1 : 1;
+		if (p !== q) return p < q ? -1 : 1;
+	}
+	return 0;
+};
+const c = [t.latest, t.next].filter((v) => typeof v === "string" && /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/.test(v));
+if (!c.length) process.exit(1);
+console.log(c.sort(cmp).pop());
+') || die "无法查询 npm 最新版本"
+		# 官方最新版恰好是我们验证过的版本：用验证时冻结的依赖树，而不是当下重新解析
+		local vt
+		if vt=$(curl -fsSL --max-time 10 "$VERSIONS_URL" 2>/dev/null) \
+			&& [[ "$(printf '%s' "$vt" | sed -n 's/.*"latest_verified": *"\([^"]*\)".*/\1/p' | head -1)" == "$target" ]]; then
+			local vrb
+			vrb=$(printf '%s' "$vt" | sed -n 's/.*"resolve_before": *"\([^"]*\)".*/\1/p' | head -1)
+			if [[ -n "$vrb" ]]; then
+				resolve_before="$vrb"
+				verified_latest=1
+				log "$target 是已验证版本，按验证时的依赖树安装（冻结于 $vrb）"
+			fi
+		fi
 	elif [[ -z "$target" ]]; then
 		# 默认：已验证版本表的 latest_verified
 		local versions
@@ -248,7 +297,7 @@ cmd_upgrade() {
 		local args=(--no-audit --no-fund --loglevel=error)
 		[[ -n "$NPM_REGISTRY" ]] && args+=(--registry="$NPM_REGISTRY")
 		local frozen=1
-		[[ $latest_mode -eq 1 || "$resolve_before" == "none" ]] && frozen=0
+		[[ ($latest_mode -eq 1 && $verified_latest -eq 0) || "$resolve_before" == "none" ]] && frozen=0
 		[[ $frozen -eq 1 ]] && args+=(--before="$resolve_before")
 		if ! npm install --prefix "$prefix" "${args[@]}" "@deepseek-ai/dsh@$target"; then
 			if [[ $frozen -eq 1 ]]; then
@@ -421,15 +470,21 @@ const MARK = "dsh-vps:ownshost";
 const SNIPPET =
 	'<script data-dsh-vps="ownshost">/* ' + MARK +
 	" */window.__DSH_TRANSPORT__=Object.assign(window.__DSH_TRANSPORT__||{},{ownsHost:true});</script>";
+// 升级提示条：同源脚本，由 gate 提供（/gate/ui.js）
+const UI_MARK = "dsh-vps:ui";
+const UI_SNIPPET = '<script data-dsh-vps="' + UI_MARK + '" src="/gate/ui.js" defer></script>';
 let s = fs.readFileSync(file, "utf8");
 const orig = file + ".orig";
 if (mode === "off") {
 	if (fs.existsSync(orig)) fs.copyFileSync(orig, file);
-	else fs.writeFileSync(file, s.split("\n").filter((l) => !l.includes(MARK)).join("\n"));
+	else fs.writeFileSync(file, s.split("\n").filter((l) => !l.includes(MARK) && !l.includes(UI_MARK)).join("\n"));
 	console.log("off");
 	process.exit(0);
 }
-if (s.includes(MARK)) {
+const missing = [];
+if (!s.includes(MARK)) missing.push(SNIPPET);
+if (!s.includes(UI_MARK)) missing.push(UI_SNIPPET);
+if (missing.length === 0) {
 	console.log("present");
 	process.exit(0);
 }
@@ -440,7 +495,7 @@ if (m === null) {
 	process.exit(1);
 }
 const at = m.index + m[0].length;
-fs.writeFileSync(file, s.slice(0, at) + "\n    " + SNIPPET + s.slice(at));
+fs.writeFileSync(file, s.slice(0, at) + missing.map((x) => "\n    " + x).join("") + s.slice(at));
 console.log("patched");
 NODE
 	node "$tmp" "$idx" "$mode" || rc=$?
@@ -883,6 +938,76 @@ EOF
 
 ## endregion
 
+## region: 浏览器一键升级
+
+# 页面上点「立即升级」→ gate（dsh 用户，无特权）只写 state/upgrade.request →
+# systemd path 单元看到文件 → 以 root 跑 dsh-vps upgrade-run。网页拿不到 root，
+# 能触发的只有这一条固定命令：升级到 npm 官方 latest（备份 → 自检 → 失败自动回滚）。
+UPGRADE_REQUEST="$ROOT/state/upgrade.request"
+UPGRADE_STATUS="$ROOT/state/upgrade.status.json"
+UPGRADE_LOG="$ROOT/state/upgrade.log"
+
+cmd_install_units() {
+	require_root
+	cat >/etc/systemd/system/dsh-vps-upgrade.path <<UNIT
+# dsh-vps：监听浏览器发起的 DSH 升级请求（由 dsh-vps install-units 生成）
+[Unit]
+Description=dsh-vps: watch for browser-initiated DSH upgrade requests
+
+[Path]
+PathExists=$UPGRADE_REQUEST
+Unit=dsh-vps-upgrade.service
+
+[Install]
+WantedBy=multi-user.target
+UNIT
+	cat >/etc/systemd/system/dsh-vps-upgrade.service <<UNIT
+# dsh-vps：执行浏览器发起的 DSH 升级（由 dsh-vps install-units 生成）
+[Unit]
+Description=dsh-vps: run a DSH upgrade requested from the browser
+
+[Service]
+Type=oneshot
+ExecStart=$ROOT/bin/dsh-vps upgrade-run
+TimeoutStartSec=30min
+UNIT
+	systemctl daemon-reload
+	systemctl enable --now dsh-vps-upgrade.path >/dev/null 2>&1 || die "启用 dsh-vps-upgrade.path 失败"
+	log "浏览器一键升级已启用（dsh-vps-upgrade.path）"
+}
+
+write_upgrade_status() { # $1=state $2=from $3=to
+	local owner
+	owner=$(stat -c %U "$ROOT/state" 2>/dev/null || echo dsh)
+	printf '{"state":"%s","from":"%s","to":"%s","at":%s}\n' "$1" "$2" "$3" "$(date +%s)000" >"$UPGRADE_STATUS"
+	chown "$owner" "$UPGRADE_STATUS" 2>/dev/null || true
+	chmod 600 "$UPGRADE_STATUS"
+}
+
+cmd_upgrade_run() {
+	require_root
+	# 先删请求文件：path 单元在文件仍存在时会再次触发
+	[[ -f "$UPGRADE_REQUEST" ]] || exit 0
+	rm -f "$UPGRADE_REQUEST"
+	local from to rc=0 owner
+	from=$(current_version)
+	write_upgrade_status running "$from" ""
+	owner=$(stat -c %U "$ROOT/state" 2>/dev/null || echo dsh)
+	: >"$UPGRADE_LOG"
+	chown "$owner" "$UPGRADE_LOG" 2>/dev/null || true
+	chmod 600 "$UPGRADE_LOG"
+	# 独立进程执行：写在 `|| rc=$?` 里的函数/子 shell 会让 set -e 失效，出错也不停
+	"$ROOT/bin/dsh-vps" upgrade --latest --yes >>"$UPGRADE_LOG" 2>&1 || rc=$?
+	to=$(current_version)
+	if [[ $rc -eq 0 ]]; then
+		write_upgrade_status success "$from" "$to"
+	else
+		write_upgrade_status failed "$from" "$to"
+	fi
+}
+
+## endregion
+
 usage() {
 	cat <<'EOF'
 dsh-vps 管理命令
@@ -913,6 +1038,8 @@ reset-admin) shift; cmd_reset_admin "$@" ;;
 setup-url) cmd_setup_url ;;
 backup) cmd_backup ;;
 selfcheck) cmd_selfcheck ;;
+install-units) cmd_install_units ;;
+upgrade-run) cmd_upgrade_run ;;
 vpn) shift; cmd_vpn "$@" ;;
 tunnel) cmd_tunnel ;;
 "" | -h | --help) usage ;;

package/gate/server.js

@@ -94,6 +94,15 @@ const OWNS_HOST_SNIPPET =
 	`<script data-dsh-vps="ownshost">/* ${OWNS_HOST_MARK} */` +
 	"window.__DSH_TRANSPORT__=Object.assign(window.__DSH_TRANSPORT__||{},{ownsHost:true});</script>";
 let ownshostLogged = false;
+// 升级提示条：同源脚本 /gate/ui.js。bin/dsh-vps 的静态补丁同样写入它，两边共用同一标记。
+const UI_MARK = "dsh-vps:ui";
+const UI_SNIPPET = `<script data-dsh-vps="${UI_MARK}" src="/gate/ui.js" defer></script>`;
+
+// DSH 版本检测：跟随官方最新版（npm latest 与 next 渠道中较新的一个）。页面上确认后，gate 只写 state/upgrade.request，
+// 由 root 的 dsh-vps-upgrade.path/.service 执行升级（gate 自身无权改 /opt/dsh-vps/dsh）。
+const DSH_PACKAGE = "@deepseek-ai/dsh";
+const UPDATE_CHECK_INTERVAL_MS = 6 * 3_600_000;
+const SEMVER_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 
 // DSH 的若干特权端点（dsh-market 的 restart / backup 导出 / self-uninstall）要求
 // "直连回环"：只要出现 x-forwarded-for / x-real-ip / forwarded 任一头，
@@ -106,6 +115,16 @@ const FORWARDING_HEADERS = new Set(["forwarded", "x-forwarded-for", "x-real-ip"]
 // 在 gate 之外拉起一个新的 DSH 进程，抢占 3080 端口，gate 的子进程随后
 // EADDRINUSE 且再也抓不到 launchToken → 永久"会话尚未就绪"。
 const MARKET_RESTART_PATHS = new Set(["/dsh-market/restart", "/dsh-market/restart/"]);
+// dshmarket 1.64+ 的 v1 接口：内部直接调用上面那个旧端点（不经 HTTP），必须一起接管
+const MARKET_RESTART_V1_PATHS = new Set(["/dsh-market/api/v1/restart", "/dsh-market/api/v1/restart/"]);
+const MARKET_V1_SCHEMA = "dsh-market/update-api/v1";
+
+// dshmarket 的写操作（安装/更新/卸载/备份导出……）为防 DNS 重绑定，要求 Host 必须是回环地址，
+// Origin 必须与 Host 一致；经 gate 转发时 Host 是公网域名，于是一律 403 "untrusted origin"。
+// gate 已完成登录校验，这里替它做同样的同源检查（Origin 与公网 Host 一致、非跨站），
+// 通过后把 Host/Origin 改写成 DSH 的回环地址再转发。设 GATE_MARKET_LOOPBACK=0 可关闭。
+const MARKET_PREFIX = "/dsh-market/";
+const MARKET_LOOPBACK = process.env.GATE_MARKET_LOOPBACK !== "0";
 // 设 GATE_TAKEOVER_RESTART=0 则放行给 DSH 自己处理（会退回到上面那个坑，仅供对照排障）
 const TAKEOVER_RESTART = process.env.GATE_TAKEOVER_RESTART !== "0";
 
@@ -849,15 +868,18 @@ function collectAndInject(upRes, res, status, respHeaders) {
 			return;
 		}
 		// 静态文件补丁（bin/dsh-vps ownshost on）已经在页面里时不再重复注入
-		if (!body.includes(OWNS_HOST_MARK)) {
+		const missing = [];
+		if (!body.includes(OWNS_HOST_MARK)) missing.push(OWNS_HOST_SNIPPET);
+		if (!body.includes(UI_MARK)) missing.push(UI_SNIPPET);
+		if (missing.length) {
 			// 只有完整的 HTML 文档才改写；找不到 <head> 说明不是文档（片段/JSON 误标），原样转发
 			const at = body.search(/<head\b[^>]*>/i);
 			if (at !== -1) {
 				const end = body.indexOf(">", at) + 1;
-				body = body.slice(0, end) + OWNS_HOST_SNIPPET + body.slice(end);
+				body = body.slice(0, end) + missing.join("") + body.slice(end);
 				if (!ownshostLogged) {
 					ownshostLogged = true;
-					log("injected ownsHost by proxy (静态文件补丁未生效，建议 sudo dsh-vps ownshost on)");
+					log("injected page snippets by proxy (静态文件补丁未生效，建议 sudo dsh-vps ownshost on)");
 				}
 			}
 		}
@@ -889,6 +911,11 @@ function proxyHttp(req, res) {
 	}
 	const cookie = upstreamCookieHeader(req.headers.cookie, authority);
 	if (cookie !== void 0) headers.cookie = cookie;
+	if (MARKET_LOOPBACK && (req.url || "").startsWith(MARKET_PREFIX)) {
+		const loopback = `127.0.0.1:${DSH_PORT}`;
+		headers.host = loopback;
+		if (headers.origin !== void 0) headers.origin = `http://${loopback}`;
+	}
 
 	let responded = false;
 	const upstreamReq = http.request(
@@ -952,6 +979,18 @@ function proxyHttp(req, res) {
 	req.pipe(upstreamReq);
 }
 
+/** 市场请求的同源检查：Origin（若有）须与浏览器访问的公网 Host 一致，且不是跨站请求。 */
+function marketRequestSameOrigin(req) {
+	if (String(req.headers["sec-fetch-site"] || "") === "cross-site") return false;
+	const origin = req.headers.origin;
+	if (origin === void 0) return true; // 同源 GET 导航（如备份下载）不带 Origin
+	try {
+		return new URL(origin).host === requestAuthority(req.headers);
+	} catch {
+		return false;
+	}
+}
+
 function denyUnauthenticated(req, res, pathname) {
 	if (pathname.startsWith("/api")) {
 		sendText(res, 401, "gate authentication required");
@@ -969,15 +1008,16 @@ function denyUnauthenticated(req, res, pathname) {
  * 这里按官方客户端的协议回 202 + ok，然后由 gate 自己重启 DSH 子进程：
  * 子进程是全新的，/dsh-market/status 的 boot id 随之变化，前端会自动 reload。
  */
-function handleMarketRestart(req, res) {
+function handleMarketRestart(req, res, v1) {
 	if (req.method !== "POST") {
 		res.writeHead(405, { allow: "POST", "content-length": "0" });
 		res.end();
 		return;
 	}
-	log("market restart requested; gate takes over");
+	log(`market restart requested${v1 ? " (v1)" : ""}; gate takes over`);
+	const result = { ok: true, managedBy: "dsh-gate", note: "由 gate 重启 DSH 子进程" };
 	res.writeHead(202, { "content-type": "application/json", "cache-control": "no-store" });
-	res.end(JSON.stringify({ ok: true, managedBy: "dsh-gate", note: "由 gate 重启 DSH 子进程" }));
+	res.end(JSON.stringify(v1 ? { schema: MARKET_V1_SCHEMA, result } : result));
 	// 让 202 先落地，再动手（客户端随后轮询 /dsh-market/status 等 boot id 变化）
 	setTimeout(() => restartDsh("market restart"), 300);
 }
@@ -1573,6 +1613,229 @@ async function handleSetup(req, res) {
 	res.end();
 }
 
+//#region DSH 版本检测与浏览器一键升级
+
+const update = { latest: null, checkedAt: 0, error: null };
+
+function upgradeRequestPath() {
+	return path.join(STATE_DIR, "upgrade.request");
+}
+
+function currentDshVersion() {
+	try {
+		const v = fs.readlinkSync(path.join(GATE_HOME, "dsh", "current"));
+		return SEMVER_PATTERN.test(v) ? v : null;
+	} catch {
+		return null;
+	}
+}
+
+/** semver 比较（含预发布段）：a>b 返回正数。 */
+function compareVersions(a, b) {
+	const split = (v) => {
+		const [core, pre] = v.split("-", 2);
+		return { core: core.split(".").map(Number), pre: pre === void 0 ? null : pre.split(".") };
+	};
+	const x = split(a);
+	const y = split(b);
+	for (let i = 0; i < 3; i++) if (x.core[i] !== y.core[i]) return x.core[i] - y.core[i];
+	if (x.pre === null || y.pre === null) return (x.pre === null) - (y.pre === null);
+	for (let i = 0; i < Math.max(x.pre.length, y.pre.length); i++) {
+		const p = x.pre[i];
+		const q = y.pre[i];
+		if (p === void 0 || q === void 0) return p === void 0 ? -1 : 1;
+		const pn = /^\d+$/.test(p);
+		const qn = /^\d+$/.test(q);
+		if (pn && qn && Number(p) !== Number(q)) return Number(p) - Number(q);
+		if (pn !== qn) return pn ? -1 : 1;
+		if (p !== q) return p < q ? -1 : 1;
+	}
+	return 0;
+}
+
+/** 官方 latest（正式）与 next（预览）两个渠道中版本号更高的一个；alpha 等内部渠道不取。 */
+function newestDshVersion() {
+	return new Promise((resolve) => {
+		const url = `${npmRegistry()}/-/package/${encodeURIComponent(DSH_PACKAGE).replace(/^%40/, "@")}/dist-tags`;
+		const req = https.get(url, { headers: { accept: "application/json" }, timeout: 10_000 }, (res) => {
+			const chunks = [];
+			res.on("data", (c) => chunks.push(c));
+			res.on("end", () => {
+				try {
+					const tags = res.statusCode === 200 ? JSON.parse(Buffer.concat(chunks).toString("utf8")) : {};
+					const candidates = [tags.latest, tags.next].filter((v) => typeof v === "string" && SEMVER_PATTERN.test(v));
+					resolve(candidates.length ? candidates.sort(compareVersions).pop() : null);
+				} catch {
+					resolve(null);
+				}
+			});
+		});
+		req.on("timeout", () => req.destroy());
+		req.on("error", () => resolve(null));
+	});
+}
+
+async function checkDshLatest() {
+	const v = await newestDshVersion();
+	update.checkedAt = Date.now();
+	if (v) {
+		if (v !== update.latest) log(`dsh latest on registry: ${v} (running ${currentDshVersion() || "unknown"})`);
+		update.latest = v;
+		update.error = null;
+	} else {
+		update.error = "无法查询 npm 最新版本";
+	}
+}
+
+function readUpgradeStatus() {
+	try {
+		const st = JSON.parse(fs.readFileSync(path.join(STATE_DIR, "upgrade.status.json"), "utf8"));
+		return st && typeof st.state === "string" ? st : null;
+	} catch {
+		return null;
+	}
+}
+
+function updateInfo() {
+	const current = currentDshVersion();
+	const latest = update.latest;
+	return {
+		current,
+		latest,
+		available: Boolean(current && latest && compareVersions(latest, current) > 0),
+		checkedAt: update.checkedAt || null,
+		error: update.error,
+		requested: fs.existsSync(upgradeRequestPath()),
+		status: readUpgradeStatus(),
+	};
+}
+
+/** GET：更新状态；POST：请求升级到官方最新版（写请求文件，交给 root 的 path 单元）。 */
+async function handleUpdate(req, res, user) {
+	const json = (status, body) => {
+		res.writeHead(status, { "content-type": "application/json", "cache-control": "no-store" });
+		res.end(JSON.stringify(body));
+	};
+	if (req.method === "GET") return json(200, updateInfo());
+	if (req.method !== "POST") return json(405, { error: "method not allowed" });
+	// 触发的是 root 操作：必须是本站页面发起（fetch POST 必带 Origin）
+	const origin = req.headers.origin;
+	let sameOrigin = false;
+	try {
+		sameOrigin = origin !== void 0 && new URL(origin).host === requestAuthority(req.headers);
+	} catch {
+		/* 非法 Origin */
+	}
+	if (!sameOrigin || String(req.headers["sec-fetch-site"] || "") === "cross-site") return json(403, { error: "cross-origin request refused" });
+	await checkDshLatest(); // 以点击时的最新结果为准
+	const info = updateInfo();
+	if (info.requested || (info.status && info.status.state === "running")) return json(409, { error: "升级已在进行中" });
+	if (!info.available) return json(409, { error: "已是最新版本" });
+	fs.writeFileSync(upgradeRequestPath(), JSON.stringify({ target: info.latest, from: info.current, by: user, at: Date.now() }) + "\n", { mode: 0o600 });
+	log(`upgrade requested from browser by ${user}: ${info.current} -> ${info.latest}`);
+	return json(202, { ok: true, from: info.current, to: info.latest });
+}
+
+// 注入 DSH 页面的升级提示条（同源脚本，无外部依赖）。
+// 只做提示与确认；真正的升级由 root 服务执行，失败会自动回滚。
+const UI_JS = `(function () {
+	if (window.top !== window || document.getElementById("dshvps-update")) return;
+	var KEY = "dshvps-update-dismissed";
+	function store(k, v) { try { if (v === undefined) return localStorage.getItem(k); localStorage.setItem(k, v); } catch (e) { return null; } }
+	var box, timer, busy = false, asked = false;
+	function el(tag, css, text) { var n = document.createElement(tag); if (css) n.style.cssText = css; if (text) n.textContent = text; return n; }
+	var BTN = "margin-left:8px;padding:5px 12px;border-radius:7px;border:1px solid #2a3547;cursor:pointer;font:inherit;";
+	function render(msg, actions) {
+		if (!box) {
+			box = el("div", "position:fixed;right:16px;bottom:16px;z-index:2147483647;max-width:min(420px,calc(100vw - 32px));" +
+				"padding:12px 14px;border-radius:10px;background:#11161f;color:#dbe2ea;border:1px solid #2a3547;" +
+				"box-shadow:0 8px 30px rgba(0,0,0,.35);font:13px/1.6 system-ui,-apple-system,'Segoe UI',sans-serif");
+			box.id = "dshvps-update";
+			document.body.appendChild(box);
+		}
+		box.textContent = "";
+		box.appendChild(el("div", "", msg));
+		if (actions && actions.length) {
+			var row = el("div", "margin-top:8px;text-align:right");
+			actions.forEach(function (a) {
+				var b = el("button", BTN + (a.primary ? "background:#2563eb;color:#fff;border-color:#2563eb" : "background:#0d1219;color:#dbe2ea"), a.label);
+				b.onclick = a.onClick;
+				row.appendChild(b);
+			});
+			box.appendChild(row);
+		}
+	}
+	function hide() { if (box) { box.remove(); box = null; } }
+	function get() { return fetch("/gate/update", { cache: "no-store", credentials: "same-origin" }).then(function (r) { if (!r.ok) throw new Error(String(r.status)); return r.json(); }); }
+	function poll() {
+		get().then(function (u) {
+			var st = u.status;
+			if (u.requested || (st && st.state === "running")) {
+				render("正在升级 DeepSeek Harness" + (u.latest ? " 到 " + u.latest : "") + "…（约 1–3 分钟，期间页面会短暂不可用，请勿关闭）");
+				return;
+			}
+			if (st && asked && st.state === "success") {
+				render("升级完成（" + st.from + " → " + st.to + "），正在刷新…");
+				clearInterval(timer);
+				setTimeout(function () { location.reload(); }, 1500);
+				return;
+			}
+			if (st && asked && st.state === "failed") {
+				clearInterval(timer);
+				render("升级未成功，已自动回滚到 " + (st.to || st.from) + "，当前可继续使用。详情：sudo cat /opt/dsh-vps/state/upgrade.log", [{ label: "知道了", onClick: hide }]);
+				return;
+			}
+		}).catch(function () {
+			if (asked) render("正在升级，DeepSeek Harness 重启中…");
+		});
+	}
+	function start() {
+		if (busy) return;
+		if (!window.confirm("升级期间 DeepSeek Harness 会重启，约 1–3 分钟不可用。\\n升级前自动备份；新版本自检不通过会自动回滚到当前版本。\\n\\n确认升级？")) return;
+		busy = true;
+		fetch("/gate/update", { method: "POST", credentials: "same-origin" }).then(function (r) {
+			return r.json().then(function (b) { if (!r.ok) throw new Error(b.error || String(r.status)); return b; });
+		}).then(function () {
+			asked = true;
+			store("dshvps-update-asked", String(Date.now()));
+			render("已提交升级请求，等待开始…");
+			timer = setInterval(poll, 3000);
+		}).catch(function (e) {
+			busy = false;
+			render("无法开始升级：" + e.message, [{ label: "关闭", onClick: hide }]);
+		});
+	}
+	function init() {
+		// 升级过程中刷新了页面：继续跟进，完成后给出结果
+		var t = Number(store("dshvps-update-asked") || 0);
+		asked = t > 0 && Date.now() - t < 30 * 60000;
+		get().then(function (u) {
+			var st = u.status;
+			if (u.requested || (st && st.state === "running")) { asked = true; timer = setInterval(poll, 3000); poll(); return; }
+			if (asked && st && st.at > t) { store("dshvps-update-asked", "0"); if (st.state === "failed") poll(); return; }
+			if (!u.available || store(KEY) === u.latest) return;
+			render("DeepSeek Harness 有新版本 " + u.latest + "（当前 " + u.current + "）", [
+				{ label: "稍后", onClick: function () { store(KEY, u.latest); hide(); } },
+				{ label: "立即升级", primary: true, onClick: start },
+			]);
+		}).catch(function () {});
+	}
+	if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", init);
+	else init();
+})();
+`;
+
+function handleUiJs(req, res) {
+	res.writeHead(200, {
+		"content-type": "text/javascript; charset=utf-8",
+		"cache-control": "no-cache",
+		"x-content-type-options": "nosniff",
+	});
+	res.end(req.method === "HEAD" ? void 0 : UI_JS);
+}
+
+//#endregion
+
 /** 升级回归自检（dsh-vps upgrade 调用）：健康 + token 兑换 + 登录态 credentials/describe 探针。 */
 async function handleSelfcheck(req, res) {
 	const report = {
@@ -1645,6 +1908,7 @@ function main() {
 				if (pathname === "/logout") return handleLogout(req, res);
 				if (pathname === "/gate/health") return handleHealthGuarded(req, res);
 				if (pathname === "/gate/selfcheck") return handleSelfcheckGuarded(req, res);
+				if (pathname === "/gate/ui.js") return handleUiJs(req, res);
 				if (pathname === "/setup") return handleSetup(req, res);
 				if (!loadAdmin()) {
 					// 尚未完成初始设置：浏览器导航导向导，/api 保持 401
@@ -1662,11 +1926,18 @@ function main() {
 					sendText(res, 503, "gate not configured: admin account missing (run `dsh-vps reset-admin`)");
 					return;
 				}
-				if (!sessionUser(req)) {
+				const user = sessionUser(req);
+				if (!user) {
 					denyUnauthenticated(req, res, pathname);
 					return;
 				}
-				if (TAKEOVER_RESTART && MARKET_RESTART_PATHS.has(pathname)) return handleMarketRestart(req, res);
+				if (pathname === "/gate/update") return handleUpdate(req, res, user);
+				if (pathname.startsWith(MARKET_PREFIX) && !marketRequestSameOrigin(req)) {
+					sendText(res, 403, "cross-origin market request refused by gate");
+					return;
+				}
+				if (TAKEOVER_RESTART && MARKET_RESTART_PATHS.has(pathname)) return handleMarketRestart(req, res, false);
+				if (TAKEOVER_RESTART && MARKET_RESTART_V1_PATHS.has(pathname)) return handleMarketRestart(req, res, true);
 				proxyHttp(req, res);
 			})
 			.catch((err) => {
@@ -1682,6 +1953,10 @@ function main() {
 
 	spawnDshWithPreflight();
 
+	// DSH 新版本检测：启动 1 分钟后查一次，之后每 6 小时一次
+	setTimeout(() => checkDshLatest().catch(() => {}), 60_000).unref();
+	setInterval(() => checkDshLatest().catch(() => {}), UPDATE_CHECK_INTERVAL_MS).unref();
+
 	// DSH Cookie 续期：剩余有效期 < 24h 时用同一 launchToken 重新兑换
 	setInterval(() => {
 		if (dsh.cookie && dsh.cookie.expiresAt <= Date.now()) {

package/install.sh

@@ -16,7 +16,7 @@ set -euo pipefail
 
 ## region: 常量与参数
 
-DSH_VERSION="0.1.5-rc.2" # 钉住版本（设计文档 §10 已验证版本表，勿随意改）
+DSH_VERSION="0.1.7-rc.1" # 钉住版本（设计文档 §10 已验证版本表，勿随意改）
 # 只钉顶层包版本是不够的：DSH 各子包的依赖是 ^0.1.5-rc.2 这类浮动范围，上游一发新的
 # 预发布波次，解析结果就整体漂上去。2026-09-22 上游发了 0.1.5-rc.3 波次，但漏发了
 # dsh-client-ui-sidebar-documentpreview，于是 ETARGET 装不上。用 --before 把解析冻结在
@@ -24,8 +24,9 @@ DSH_VERSION="0.1.5-rc.2" # 钉住版本（设计文档 §10 已验证版本表
 # 注意：同一天 03:46 上游还先发了一批 cordis 系列（cordis 4.0.3 / cordis-plugin-hmr 1.0.18 等），
 # 与 rc.2 不兼容——web profile 启动即报 "user patch-layer watching requires the Cordis HMR service"。
 # 冻结点必须早于这一批，所以是 03:40 而不是 05:00。
+# 之后升到 0.1.7-rc.1（npm next 渠道），冻结点 2026-09-24T08:20Z——该时刻解析出的依赖树已逐包比对、实测通过。
 # 设为 none 可关闭冻结。
-DSH_RESOLVE_BEFORE="${DSH_RESOLVE_BEFORE:-2026-09-22T03:40:00Z}"
+DSH_RESOLVE_BEFORE="${DSH_RESOLVE_BEFORE:-2026-09-24T08:20:00Z}"
 INSTALL_ROOT="/opt/dsh-vps"
 DSH_USER="dsh"
 DSH_HOME_DIR="/home/dsh/.dsh"
@@ -391,6 +392,8 @@ EOF
 	systemctl enable dsh-gate >/dev/null 2>&1
 	systemctl restart dsh-gate
 	log "dsh-gate.service 已启动（DSH_TRUSTED_HOST=${trusted}）"
+	# 浏览器一键升级：DSH 有新版本时页面提示，确认后由 root 服务执行升级
+	"$INSTALL_ROOT/bin/dsh-vps" install-units || warn "一键升级单元安装失败（不影响使用，可稍后 sudo dsh-vps install-units）"
 }
 
 ## endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vps",
-  "version": "1.4.3",
+  "version": "1.5.0",
   "description": "Ship DeepSeek Harness to your own VPS: one command installs a zero-dependency login gateway, automatic HTTPS through Caddy, systemd supervision, and optional WireGuard-only access.",
   "keywords": [
     "deepseek-harness",

package/uninstall.sh

@@ -108,6 +108,9 @@ log "步骤 2/6：停止并移除 $SERVICE"
 systemctl stop "$SERVICE" 2>/dev/null || true
 systemctl disable "$SERVICE" 2>/dev/null || true
 rm -f "$UNIT_FILE"
+# 浏览器一键升级单元
+systemctl disable --now dsh-vps-upgrade.path 2>/dev/null || true
+rm -f /etc/systemd/system/dsh-vps-upgrade.path /etc/systemd/system/dsh-vps-upgrade.service
 systemctl daemon-reload 2>/dev/null || true
 systemctl reset-failed "$SERVICE" 2>/dev/null || true
 

package/versions.json

@@ -1,8 +1,22 @@
 {
-  "latest_verified": "0.1.5-rc.2",
-  "resolve_before": "2026-09-22T03:40:00Z",
+  "latest_verified": "0.1.7-rc.1",
+  "resolve_before": "2026-09-24T08:20:00Z",
   "updated_at": "2026-09-24",
   "versions": [
+    {
+      "dsh": "0.1.7-rc.1",
+      "min_gate": "1.5.0",
+      "verified_at": "2026-09-24",
+      "resolve_before": "2026-09-24T08:20:00Z",
+      "notes": "npm next 渠道。会话兑换 / 向导写 API Key / 升级自检 / ownsHost（网页端逻辑未变）/ 插件市场经网关安装 全部实测通过"
+    },
+    {
+      "dsh": "0.1.5-rc.3",
+      "min_gate": "1.4.4",
+      "verified_at": "2026-09-24",
+      "resolve_before": "2026-09-24T08:00:00Z",
+      "notes": "会话兑换 / 向导写 API Key / 升级自检 / ownsHost 补丁 / 插件市场经网关安装 全部实测通过"
+    },
     {
       "dsh": "0.1.5-rc.2",
       "min_gate": "0.1.0",