dsh-vps 1.4.4 → 1.5.0

package/README.en.md

@@ -8,7 +8,7 @@
   <a href="LICENSE"><img src="https://img.shields.io/github/license/AIcivilization/deepseek-harness-vps" alt="MIT license"></a>
   <a href="https://www.npmjs.com/package/dsh-vps"><img src="https://img.shields.io/npm/v/dsh-vps" alt="npm version"></a>
   <img src="https://img.shields.io/badge/platform-Ubuntu%2022.04%2B%20%2F%20Debian%2012%2B-blue" alt="Platform: Ubuntu 22.04+ / Debian 12+">
-  <img src="https://img.shields.io/badge/DeepSeek%20Harness-0.1.5--rc.2-4176E6" alt="DeepSeek Harness 0.1.5-rc.2">
+  <img src="https://img.shields.io/badge/DeepSeek%20Harness-0.1.7--rc.1-4176E6" alt="DeepSeek Harness 0.1.7-rc.1">
   <img src="https://img.shields.io/badge/runtime%20dependencies-0-brightgreen" alt="Runtime dependencies: 0">
   <img src="https://img.shields.io/badge/Docker-not%20required-orange" alt="No Docker required">
   <img src="https://img.shields.io/github/stars/AIcivilization/deepseek-harness-vps?style=social" alt="star">
@@ -128,18 +128,22 @@ If the final self-check reports that DSH is not ready yet, the setup link is sti
 
 ## Update
 
-Update the gateway code on an installed machine:
+**DSH itself follows official releases.** The gateway checks npm for the newest official version (the higher of the `latest` and `next` channels) every 6 hours. When a newer one exists, a prompt appears in the bottom-right corner of the DSH page; click "Upgrade now" and confirm. It backs up, installs the new version and runs a self-check, rolling back to the previous version automatically if the check fails — about 1–3 minutes in all. "Later" silences that version. From the server you can also run:
 
 ```bash
-sudo dsh-vps update-gate
+sudo dsh-vps upgrade            # the version verified by this project
+sudo dsh-vps upgrade --latest   # the latest official release (same as "Upgrade now")
+sudo dsh-vps rollback           # back to the previous version
 ```
 
-Machines installed with v1.4.1 or earlier that crash on start with `user patch-layer watching requires the Cordis HMR service` got a wrong dependency freeze point (it pulled in cordis releases incompatible with DSH 0.1.5-rc.2). Delete the DSH directory and run the install command again; accounts and data are kept:
+**Updating the gateway itself** (login page, proxy):
 
 ```bash
-sudo systemctl stop dsh-gate && sudo rm -rf /opt/dsh-vps/dsh/0.1.5-rc.2
+sudo dsh-vps update-gate
 ```
 
+Machines installed before v1.5.0: run the one-command install above once more to get the in-page upgrade prompt (it enters repair/update mode; accounts and data are kept).
+
 ## Uninstall
 
 ```bash

package/README.md

@@ -9,7 +9,7 @@
   <a href="LICENSE"><img src="https://img.shields.io/github/license/AIcivilization/deepseek-harness-vps" alt="MIT 许可证"></a>
   <a href="https://www.npmjs.com/package/dsh-vps"><img src="https://img.shields.io/npm/v/dsh-vps" alt="npm 版本"></a>
   <img src="https://img.shields.io/badge/platform-Ubuntu%2022.04%2B%20%2F%20Debian%2012%2B-blue" alt="平台：Ubuntu 22.04+ / Debian 12+">
-  <img src="https://img.shields.io/badge/DeepSeek%20Harness-0.1.5--rc.2-4176E6" alt="DeepSeek Harness 0.1.5-rc.2">
+  <img src="https://img.shields.io/badge/DeepSeek%20Harness-0.1.7--rc.1-4176E6" alt="DeepSeek Harness 0.1.7-rc.1">
   <img src="https://img.shields.io/badge/runtime%20dependencies-0-brightgreen" alt="运行时依赖：0">
   <img src="https://img.shields.io/badge/Docker-not%20required-orange" alt="无需 Docker">
   <img src="https://img.shields.io/github/stars/AIcivilization/deepseek-harness-vps?style=social" alt="star">
@@ -138,18 +138,22 @@ curl -fsSL https://raw.githubusercontent.com/AIcivilization/deepseek-harness-vps
 
 ## 更新
 
-已安装的机器更新网关代码：
+**DSH 本身跟随官方版本升级。** 网关每 6 小时检查一次 npm 上的官方最新版（正式渠道 latest 与预览渠道 next 中较新的一个），有新版本时 DSH 页面右下角弹出提示，点「立即升级」并确认即可：自动备份 → 安装新版 → 自检，自检不通过自动回滚到原版本，全程约 1–3 分钟。点「稍后」则这个版本不再提示。也可以在服务器上手动执行：
 
 ```bash
-sudo dsh-vps update-gate
+sudo dsh-vps upgrade            # 升到本项目验证过的版本
+sudo dsh-vps upgrade --latest   # 升到官方最新版（与页面上的「立即升级」相同）
+sudo dsh-vps rollback           # 切回上一个版本
 ```
 
-用 v1.4.1 及更早版本装出、启动即报 `user patch-layer watching requires the Cordis HMR service` 的机器，是当时依赖冻结点有误（装进了与 DSH 0.1.5-rc.2 不兼容的 cordis 新版本）。删掉 DSH 目录后重跑安装命令即可修复，账号与数据保留：
+**网关（登录页、代理）自身的更新**：
 
 ```bash
-sudo systemctl stop dsh-gate && sudo rm -rf /opt/dsh-vps/dsh/0.1.5-rc.2
+sudo dsh-vps update-gate
 ```
 
+v1.5.0 之前安装的机器，重跑一次上方的一键安装命令即可获得页面升级提示（进入修复/更新模式，账号与数据保留）。
+
 ## 卸载
 
 ```bash

package/bin/dsh-vps

@@ -14,6 +14,8 @@
 #   tunnel              仅我可访问：SSH 本地端口转发（零安装，打印用法）
 #   backup              打包 DSH_HOME + state 到 backups/（保留最近 3 份）
 #   selfcheck           手动触发升级回归自检探针
+#   install-units       安装浏览器一键升级所需的 systemd 单元（install.sh / update-gate 调用）
+#   upgrade-run         执行浏览器发起的升级请求（由 dsh-vps-upgrade.service 以 root 调用）
 
 set -euo pipefail
 
@@ -30,9 +32,13 @@ VERSIONS_URL="${DSHVPS_VERSIONS_URL:-$RAW_BASE/versions.json}"
 # ——2026-09-22 上游漏发 rc.3 的 dsh-client-ui-sidebar-documentpreview 就导致过 ETARGET。
 # 同日 03:46 的 cordis 系列新版本同样与 rc.2 不兼容（HMR 服务缺失致启动崩溃），故取 03:40。
 # 升级 latest_verified 时必须同步推后这个值。
-DEFAULT_RESOLVE_BEFORE="${DSHVPS_RESOLVE_BEFORE:-2026-09-22T03:40:00Z}"
+DEFAULT_RESOLVE_BEFORE="${DSHVPS_RESOLVE_BEFORE:-2026-09-24T08:20:00Z}"
 VERSIONS_CACHE="$ROOT/state/versions.cache.json"
 NPM_REGISTRY="${DSHVPS_NPM_REGISTRY:-}"
+# 安装时选了 --mirror cn：升级也走 npmmirror，与首次安装同源
+if [[ -z "$NPM_REGISTRY" && -f "$ROOT/state/config.json" ]] && grep -q '"mirror": *"cn"' "$ROOT/state/config.json"; then
+	NPM_REGISTRY="https://registry.npmmirror.com"
+fi
 
 log()  { printf '\033[1;32m[dsh-vps]\033[0m %s\n' "$*"; }
 warn() { printf '\033[1;33m[dsh-vps]\033[0m %s\n' "$*" >&2; }
@@ -92,11 +98,21 @@ cmd_update_gate() {
 		rm -f "$sb"
 		warn "gate/site-block.js 未更新（保留现有版本）"
 	fi
+	# dsh-vps 自身：先写临时文件再 rename，正在执行的旧脚本仍持有旧 inode，不会读到半截新内容
+	local nb="$ROOT/bin/dsh-vps.update"
+	if curl -fsSL --max-time 30 "$RAW_BASE/bin/dsh-vps" -o "$nb" && bash -n "$nb"; then
+		chmod 755 "$nb"
+		mv "$nb" "$ROOT/bin/dsh-vps"
+	else
+		rm -f "$nb"
+		warn "bin/dsh-vps 未更新（保留现有版本）"
+	fi
 	log "重启 $SERVICE ..."
 	systemctl restart "$SERVICE"
 	sleep 3
-	# 静态补丁与 gate 代码同源管理，顺手补齐（幂等）
-	ownshost_apply on >/dev/null 2>&1 || true
+	# 以下都用新版 dsh-vps 执行：静态补丁（含升级提示条）与一键升级单元（幂等）
+	"$ROOT/bin/dsh-vps" ownshost on >/dev/null 2>&1 || true
+	"$ROOT/bin/dsh-vps" install-units || warn "一键升级单元安装失败"
 	if curl -fsS --max-time 3 "$HEALTH_URL" >/dev/null 2>&1; then
 		log "更新完成，gate 已就绪"
 	else
@@ -194,7 +210,7 @@ switch_version() { # $1=版本目录名
 
 cmd_upgrade() {
 	require_root
-	local target="" latest_mode=0 assume_yes=0
+	local target="" latest_mode=0 assume_yes=0 verified_latest=0
 	while [[ $# -gt 0 ]]; do
 		case "$1" in
 		--latest) latest_mode=1; shift ;;
@@ -211,11 +227,44 @@ cmd_upgrade() {
 	local resolve_before="$DEFAULT_RESOLVE_BEFORE"
 
 	if [[ $latest_mode -eq 1 ]]; then
-		warn "--latest：将安装 npm 上未经 dsh-vps 验证的最新版本，可能破坏兼容性（有备份与自动回滚兜底）"
+		warn "--latest：将安装官方最新版（npm latest 与 next 渠道中较新的一个），可能未经 dsh-vps 验证（有备份与自动回滚兜底）"
 		[[ $assume_yes -eq 1 ]] || { read -rp "确认继续？[y/N] " ans; [[ "$ans" == "y" || "$ans" == "Y" ]] || die "已取消"; }
-		local reg_arg=(version)
+		local reg_arg=(dist-tags --json)
 		[[ -n "$NPM_REGISTRY" ]] && reg_arg+=(--registry="$NPM_REGISTRY")
-		target=$(npm view @deepseek-ai/dsh "${reg_arg[@]}" 2>/dev/null) || die "无法查询 npm 最新版本"
+		# 官方同时维护 latest（正式）与 next（预览）两个渠道，取其中版本号更高的；alpha 等内部渠道不取
+		target=$(npm view @deepseek-ai/dsh "${reg_arg[@]}" 2>/dev/null | node -e '
+const t = JSON.parse(require("fs").readFileSync(0, "utf8"));
+const parse = (v) => { const [c, p] = v.split("-", 2); return { c: c.split(".").map(Number), p: p === undefined ? null : p.split(".") }; };
+const cmp = (a, b) => {
+	const x = parse(a), y = parse(b);
+	for (let i = 0; i < 3; i++) if (x.c[i] !== y.c[i]) return x.c[i] - y.c[i];
+	if (x.p === null || y.p === null) return (x.p === null) - (y.p === null);
+	for (let i = 0; i < Math.max(x.p.length, y.p.length); i++) {
+		const p = x.p[i], q = y.p[i];
+		if (p === undefined || q === undefined) return p === undefined ? -1 : 1;
+		const pn = /^\d+$/.test(p), qn = /^\d+$/.test(q);
+		if (pn && qn && +p !== +q) return +p - +q;
+		if (pn !== qn) return pn ? -1 : 1;
+		if (p !== q) return p < q ? -1 : 1;
+	}
+	return 0;
+};
+const c = [t.latest, t.next].filter((v) => typeof v === "string" && /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/.test(v));
+if (!c.length) process.exit(1);
+console.log(c.sort(cmp).pop());
+') || die "无法查询 npm 最新版本"
+		# 官方最新版恰好是我们验证过的版本：用验证时冻结的依赖树，而不是当下重新解析
+		local vt
+		if vt=$(curl -fsSL --max-time 10 "$VERSIONS_URL" 2>/dev/null) \
+			&& [[ "$(printf '%s' "$vt" | sed -n 's/.*"latest_verified": *"\([^"]*\)".*/\1/p' | head -1)" == "$target" ]]; then
+			local vrb
+			vrb=$(printf '%s' "$vt" | sed -n 's/.*"resolve_before": *"\([^"]*\)".*/\1/p' | head -1)
+			if [[ -n "$vrb" ]]; then
+				resolve_before="$vrb"
+				verified_latest=1
+				log "$target 是已验证版本，按验证时的依赖树安装（冻结于 $vrb）"
+			fi
+		fi
 	elif [[ -z "$target" ]]; then
 		# 默认：已验证版本表的 latest_verified
 		local versions
@@ -248,7 +297,7 @@ cmd_upgrade() {
 		local args=(--no-audit --no-fund --loglevel=error)
 		[[ -n "$NPM_REGISTRY" ]] && args+=(--registry="$NPM_REGISTRY")
 		local frozen=1
-		[[ $latest_mode -eq 1 || "$resolve_before" == "none" ]] && frozen=0
+		[[ ($latest_mode -eq 1 && $verified_latest -eq 0) || "$resolve_before" == "none" ]] && frozen=0
 		[[ $frozen -eq 1 ]] && args+=(--before="$resolve_before")
 		if ! npm install --prefix "$prefix" "${args[@]}" "@deepseek-ai/dsh@$target"; then
 			if [[ $frozen -eq 1 ]]; then
@@ -421,15 +470,21 @@ const MARK = "dsh-vps:ownshost";
 const SNIPPET =
 	'<script data-dsh-vps="ownshost">/* ' + MARK +
 	" */window.__DSH_TRANSPORT__=Object.assign(window.__DSH_TRANSPORT__||{},{ownsHost:true});</script>";
+// 升级提示条：同源脚本，由 gate 提供（/gate/ui.js）
+const UI_MARK = "dsh-vps:ui";
+const UI_SNIPPET = '<script data-dsh-vps="' + UI_MARK + '" src="/gate/ui.js" defer></script>';
 let s = fs.readFileSync(file, "utf8");
 const orig = file + ".orig";
 if (mode === "off") {
 	if (fs.existsSync(orig)) fs.copyFileSync(orig, file);
-	else fs.writeFileSync(file, s.split("\n").filter((l) => !l.includes(MARK)).join("\n"));
+	else fs.writeFileSync(file, s.split("\n").filter((l) => !l.includes(MARK) && !l.includes(UI_MARK)).join("\n"));
 	console.log("off");
 	process.exit(0);
 }
-if (s.includes(MARK)) {
+const missing = [];
+if (!s.includes(MARK)) missing.push(SNIPPET);
+if (!s.includes(UI_MARK)) missing.push(UI_SNIPPET);
+if (missing.length === 0) {
 	console.log("present");
 	process.exit(0);
 }
@@ -440,7 +495,7 @@ if (m === null) {
 	process.exit(1);
 }
 const at = m.index + m[0].length;
-fs.writeFileSync(file, s.slice(0, at) + "\n    " + SNIPPET + s.slice(at));
+fs.writeFileSync(file, s.slice(0, at) + missing.map((x) => "\n    " + x).join("") + s.slice(at));
 console.log("patched");
 NODE
 	node "$tmp" "$idx" "$mode" || rc=$?
@@ -883,6 +938,76 @@ EOF
 
 ## endregion
 
+## region: 浏览器一键升级
+
+# 页面上点「立即升级」→ gate（dsh 用户，无特权）只写 state/upgrade.request →
+# systemd path 单元看到文件 → 以 root 跑 dsh-vps upgrade-run。网页拿不到 root，
+# 能触发的只有这一条固定命令：升级到 npm 官方 latest（备份 → 自检 → 失败自动回滚）。
+UPGRADE_REQUEST="$ROOT/state/upgrade.request"
+UPGRADE_STATUS="$ROOT/state/upgrade.status.json"
+UPGRADE_LOG="$ROOT/state/upgrade.log"
+
+cmd_install_units() {
+	require_root
+	cat >/etc/systemd/system/dsh-vps-upgrade.path <<UNIT
+# dsh-vps：监听浏览器发起的 DSH 升级请求（由 dsh-vps install-units 生成）
+[Unit]
+Description=dsh-vps: watch for browser-initiated DSH upgrade requests
+
+[Path]
+PathExists=$UPGRADE_REQUEST
+Unit=dsh-vps-upgrade.service
+
+[Install]
+WantedBy=multi-user.target
+UNIT
+	cat >/etc/systemd/system/dsh-vps-upgrade.service <<UNIT
+# dsh-vps：执行浏览器发起的 DSH 升级（由 dsh-vps install-units 生成）
+[Unit]
+Description=dsh-vps: run a DSH upgrade requested from the browser
+
+[Service]
+Type=oneshot
+ExecStart=$ROOT/bin/dsh-vps upgrade-run
+TimeoutStartSec=30min
+UNIT
+	systemctl daemon-reload
+	systemctl enable --now dsh-vps-upgrade.path >/dev/null 2>&1 || die "启用 dsh-vps-upgrade.path 失败"
+	log "浏览器一键升级已启用（dsh-vps-upgrade.path）"
+}
+
+write_upgrade_status() { # $1=state $2=from $3=to
+	local owner
+	owner=$(stat -c %U "$ROOT/state" 2>/dev/null || echo dsh)
+	printf '{"state":"%s","from":"%s","to":"%s","at":%s}\n' "$1" "$2" "$3" "$(date +%s)000" >"$UPGRADE_STATUS"
+	chown "$owner" "$UPGRADE_STATUS" 2>/dev/null || true
+	chmod 600 "$UPGRADE_STATUS"
+}
+
+cmd_upgrade_run() {
+	require_root
+	# 先删请求文件：path 单元在文件仍存在时会再次触发
+	[[ -f "$UPGRADE_REQUEST" ]] || exit 0
+	rm -f "$UPGRADE_REQUEST"
+	local from to rc=0 owner
+	from=$(current_version)
+	write_upgrade_status running "$from" ""
+	owner=$(stat -c %U "$ROOT/state" 2>/dev/null || echo dsh)
+	: >"$UPGRADE_LOG"
+	chown "$owner" "$UPGRADE_LOG" 2>/dev/null || true
+	chmod 600 "$UPGRADE_LOG"
+	# 独立进程执行：写在 `|| rc=$?` 里的函数/子 shell 会让 set -e 失效，出错也不停
+	"$ROOT/bin/dsh-vps" upgrade --latest --yes >>"$UPGRADE_LOG" 2>&1 || rc=$?
+	to=$(current_version)
+	if [[ $rc -eq 0 ]]; then
+		write_upgrade_status success "$from" "$to"
+	else
+		write_upgrade_status failed "$from" "$to"
+	fi
+}
+
+## endregion
+
 usage() {
 	cat <<'EOF'
 dsh-vps 管理命令
@@ -913,6 +1038,8 @@ reset-admin) shift; cmd_reset_admin "$@" ;;
 setup-url) cmd_setup_url ;;
 backup) cmd_backup ;;
 selfcheck) cmd_selfcheck ;;
+install-units) cmd_install_units ;;
+upgrade-run) cmd_upgrade_run ;;
 vpn) shift; cmd_vpn "$@" ;;
 tunnel) cmd_tunnel ;;
 "" | -h | --help) usage ;;

package/gate/server.js

@@ -94,6 +94,15 @@ const OWNS_HOST_SNIPPET =
 	`<script data-dsh-vps="ownshost">/* ${OWNS_HOST_MARK} */` +
 	"window.__DSH_TRANSPORT__=Object.assign(window.__DSH_TRANSPORT__||{},{ownsHost:true});</script>";
 let ownshostLogged = false;
+// 升级提示条：同源脚本 /gate/ui.js。bin/dsh-vps 的静态补丁同样写入它，两边共用同一标记。
+const UI_MARK = "dsh-vps:ui";
+const UI_SNIPPET = `<script data-dsh-vps="${UI_MARK}" src="/gate/ui.js" defer></script>`;
+
+// DSH 版本检测：跟随官方最新版（npm latest 与 next 渠道中较新的一个）。页面上确认后，gate 只写 state/upgrade.request，
+// 由 root 的 dsh-vps-upgrade.path/.service 执行升级（gate 自身无权改 /opt/dsh-vps/dsh）。
+const DSH_PACKAGE = "@deepseek-ai/dsh";
+const UPDATE_CHECK_INTERVAL_MS = 6 * 3_600_000;
+const SEMVER_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 
 // DSH 的若干特权端点（dsh-market 的 restart / backup 导出 / self-uninstall）要求
 // "直连回环"：只要出现 x-forwarded-for / x-real-ip / forwarded 任一头，
@@ -859,15 +868,18 @@ function collectAndInject(upRes, res, status, respHeaders) {
 			return;
 		}
 		// 静态文件补丁（bin/dsh-vps ownshost on）已经在页面里时不再重复注入
-		if (!body.includes(OWNS_HOST_MARK)) {
+		const missing = [];
+		if (!body.includes(OWNS_HOST_MARK)) missing.push(OWNS_HOST_SNIPPET);
+		if (!body.includes(UI_MARK)) missing.push(UI_SNIPPET);
+		if (missing.length) {
 			// 只有完整的 HTML 文档才改写；找不到 <head> 说明不是文档（片段/JSON 误标），原样转发
 			const at = body.search(/<head\b[^>]*>/i);
 			if (at !== -1) {
 				const end = body.indexOf(">", at) + 1;
-				body = body.slice(0, end) + OWNS_HOST_SNIPPET + body.slice(end);
+				body = body.slice(0, end) + missing.join("") + body.slice(end);
 				if (!ownshostLogged) {
 					ownshostLogged = true;
-					log("injected ownsHost by proxy (静态文件补丁未生效，建议 sudo dsh-vps ownshost on)");
+					log("injected page snippets by proxy (静态文件补丁未生效，建议 sudo dsh-vps ownshost on)");
 				}
 			}
 		}
@@ -1601,6 +1613,229 @@ async function handleSetup(req, res) {
 	res.end();
 }
 
+//#region DSH 版本检测与浏览器一键升级
+
+const update = { latest: null, checkedAt: 0, error: null };
+
+function upgradeRequestPath() {
+	return path.join(STATE_DIR, "upgrade.request");
+}
+
+function currentDshVersion() {
+	try {
+		const v = fs.readlinkSync(path.join(GATE_HOME, "dsh", "current"));
+		return SEMVER_PATTERN.test(v) ? v : null;
+	} catch {
+		return null;
+	}
+}
+
+/** semver 比较（含预发布段）：a>b 返回正数。 */
+function compareVersions(a, b) {
+	const split = (v) => {
+		const [core, pre] = v.split("-", 2);
+		return { core: core.split(".").map(Number), pre: pre === void 0 ? null : pre.split(".") };
+	};
+	const x = split(a);
+	const y = split(b);
+	for (let i = 0; i < 3; i++) if (x.core[i] !== y.core[i]) return x.core[i] - y.core[i];
+	if (x.pre === null || y.pre === null) return (x.pre === null) - (y.pre === null);
+	for (let i = 0; i < Math.max(x.pre.length, y.pre.length); i++) {
+		const p = x.pre[i];
+		const q = y.pre[i];
+		if (p === void 0 || q === void 0) return p === void 0 ? -1 : 1;
+		const pn = /^\d+$/.test(p);
+		const qn = /^\d+$/.test(q);
+		if (pn && qn && Number(p) !== Number(q)) return Number(p) - Number(q);
+		if (pn !== qn) return pn ? -1 : 1;
+		if (p !== q) return p < q ? -1 : 1;
+	}
+	return 0;
+}
+
+/** 官方 latest（正式）与 next（预览）两个渠道中版本号更高的一个；alpha 等内部渠道不取。 */
+function newestDshVersion() {
+	return new Promise((resolve) => {
+		const url = `${npmRegistry()}/-/package/${encodeURIComponent(DSH_PACKAGE).replace(/^%40/, "@")}/dist-tags`;
+		const req = https.get(url, { headers: { accept: "application/json" }, timeout: 10_000 }, (res) => {
+			const chunks = [];
+			res.on("data", (c) => chunks.push(c));
+			res.on("end", () => {
+				try {
+					const tags = res.statusCode === 200 ? JSON.parse(Buffer.concat(chunks).toString("utf8")) : {};
+					const candidates = [tags.latest, tags.next].filter((v) => typeof v === "string" && SEMVER_PATTERN.test(v));
+					resolve(candidates.length ? candidates.sort(compareVersions).pop() : null);
+				} catch {
+					resolve(null);
+				}
+			});
+		});
+		req.on("timeout", () => req.destroy());
+		req.on("error", () => resolve(null));
+	});
+}
+
+async function checkDshLatest() {
+	const v = await newestDshVersion();
+	update.checkedAt = Date.now();
+	if (v) {
+		if (v !== update.latest) log(`dsh latest on registry: ${v} (running ${currentDshVersion() || "unknown"})`);
+		update.latest = v;
+		update.error = null;
+	} else {
+		update.error = "无法查询 npm 最新版本";
+	}
+}
+
+function readUpgradeStatus() {
+	try {
+		const st = JSON.parse(fs.readFileSync(path.join(STATE_DIR, "upgrade.status.json"), "utf8"));
+		return st && typeof st.state === "string" ? st : null;
+	} catch {
+		return null;
+	}
+}
+
+function updateInfo() {
+	const current = currentDshVersion();
+	const latest = update.latest;
+	return {
+		current,
+		latest,
+		available: Boolean(current && latest && compareVersions(latest, current) > 0),
+		checkedAt: update.checkedAt || null,
+		error: update.error,
+		requested: fs.existsSync(upgradeRequestPath()),
+		status: readUpgradeStatus(),
+	};
+}
+
+/** GET：更新状态；POST：请求升级到官方最新版（写请求文件，交给 root 的 path 单元）。 */
+async function handleUpdate(req, res, user) {
+	const json = (status, body) => {
+		res.writeHead(status, { "content-type": "application/json", "cache-control": "no-store" });
+		res.end(JSON.stringify(body));
+	};
+	if (req.method === "GET") return json(200, updateInfo());
+	if (req.method !== "POST") return json(405, { error: "method not allowed" });
+	// 触发的是 root 操作：必须是本站页面发起（fetch POST 必带 Origin）
+	const origin = req.headers.origin;
+	let sameOrigin = false;
+	try {
+		sameOrigin = origin !== void 0 && new URL(origin).host === requestAuthority(req.headers);
+	} catch {
+		/* 非法 Origin */
+	}
+	if (!sameOrigin || String(req.headers["sec-fetch-site"] || "") === "cross-site") return json(403, { error: "cross-origin request refused" });
+	await checkDshLatest(); // 以点击时的最新结果为准
+	const info = updateInfo();
+	if (info.requested || (info.status && info.status.state === "running")) return json(409, { error: "升级已在进行中" });
+	if (!info.available) return json(409, { error: "已是最新版本" });
+	fs.writeFileSync(upgradeRequestPath(), JSON.stringify({ target: info.latest, from: info.current, by: user, at: Date.now() }) + "\n", { mode: 0o600 });
+	log(`upgrade requested from browser by ${user}: ${info.current} -> ${info.latest}`);
+	return json(202, { ok: true, from: info.current, to: info.latest });
+}
+
+// 注入 DSH 页面的升级提示条（同源脚本，无外部依赖）。
+// 只做提示与确认；真正的升级由 root 服务执行，失败会自动回滚。
+const UI_JS = `(function () {
+	if (window.top !== window || document.getElementById("dshvps-update")) return;
+	var KEY = "dshvps-update-dismissed";
+	function store(k, v) { try { if (v === undefined) return localStorage.getItem(k); localStorage.setItem(k, v); } catch (e) { return null; } }
+	var box, timer, busy = false, asked = false;
+	function el(tag, css, text) { var n = document.createElement(tag); if (css) n.style.cssText = css; if (text) n.textContent = text; return n; }
+	var BTN = "margin-left:8px;padding:5px 12px;border-radius:7px;border:1px solid #2a3547;cursor:pointer;font:inherit;";
+	function render(msg, actions) {
+		if (!box) {
+			box = el("div", "position:fixed;right:16px;bottom:16px;z-index:2147483647;max-width:min(420px,calc(100vw - 32px));" +
+				"padding:12px 14px;border-radius:10px;background:#11161f;color:#dbe2ea;border:1px solid #2a3547;" +
+				"box-shadow:0 8px 30px rgba(0,0,0,.35);font:13px/1.6 system-ui,-apple-system,'Segoe UI',sans-serif");
+			box.id = "dshvps-update";
+			document.body.appendChild(box);
+		}
+		box.textContent = "";
+		box.appendChild(el("div", "", msg));
+		if (actions && actions.length) {
+			var row = el("div", "margin-top:8px;text-align:right");
+			actions.forEach(function (a) {
+				var b = el("button", BTN + (a.primary ? "background:#2563eb;color:#fff;border-color:#2563eb" : "background:#0d1219;color:#dbe2ea"), a.label);
+				b.onclick = a.onClick;
+				row.appendChild(b);
+			});
+			box.appendChild(row);
+		}
+	}
+	function hide() { if (box) { box.remove(); box = null; } }
+	function get() { return fetch("/gate/update", { cache: "no-store", credentials: "same-origin" }).then(function (r) { if (!r.ok) throw new Error(String(r.status)); return r.json(); }); }
+	function poll() {
+		get().then(function (u) {
+			var st = u.status;
+			if (u.requested || (st && st.state === "running")) {
+				render("正在升级 DeepSeek Harness" + (u.latest ? " 到 " + u.latest : "") + "…（约 1–3 分钟，期间页面会短暂不可用，请勿关闭）");
+				return;
+			}
+			if (st && asked && st.state === "success") {
+				render("升级完成（" + st.from + " → " + st.to + "），正在刷新…");
+				clearInterval(timer);
+				setTimeout(function () { location.reload(); }, 1500);
+				return;
+			}
+			if (st && asked && st.state === "failed") {
+				clearInterval(timer);
+				render("升级未成功，已自动回滚到 " + (st.to || st.from) + "，当前可继续使用。详情：sudo cat /opt/dsh-vps/state/upgrade.log", [{ label: "知道了", onClick: hide }]);
+				return;
+			}
+		}).catch(function () {
+			if (asked) render("正在升级，DeepSeek Harness 重启中…");
+		});
+	}
+	function start() {
+		if (busy) return;
+		if (!window.confirm("升级期间 DeepSeek Harness 会重启，约 1–3 分钟不可用。\\n升级前自动备份；新版本自检不通过会自动回滚到当前版本。\\n\\n确认升级？")) return;
+		busy = true;
+		fetch("/gate/update", { method: "POST", credentials: "same-origin" }).then(function (r) {
+			return r.json().then(function (b) { if (!r.ok) throw new Error(b.error || String(r.status)); return b; });
+		}).then(function () {
+			asked = true;
+			store("dshvps-update-asked", String(Date.now()));
+			render("已提交升级请求，等待开始…");
+			timer = setInterval(poll, 3000);
+		}).catch(function (e) {
+			busy = false;
+			render("无法开始升级：" + e.message, [{ label: "关闭", onClick: hide }]);
+		});
+	}
+	function init() {
+		// 升级过程中刷新了页面：继续跟进，完成后给出结果
+		var t = Number(store("dshvps-update-asked") || 0);
+		asked = t > 0 && Date.now() - t < 30 * 60000;
+		get().then(function (u) {
+			var st = u.status;
+			if (u.requested || (st && st.state === "running")) { asked = true; timer = setInterval(poll, 3000); poll(); return; }
+			if (asked && st && st.at > t) { store("dshvps-update-asked", "0"); if (st.state === "failed") poll(); return; }
+			if (!u.available || store(KEY) === u.latest) return;
+			render("DeepSeek Harness 有新版本 " + u.latest + "（当前 " + u.current + "）", [
+				{ label: "稍后", onClick: function () { store(KEY, u.latest); hide(); } },
+				{ label: "立即升级", primary: true, onClick: start },
+			]);
+		}).catch(function () {});
+	}
+	if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", init);
+	else init();
+})();
+`;
+
+function handleUiJs(req, res) {
+	res.writeHead(200, {
+		"content-type": "text/javascript; charset=utf-8",
+		"cache-control": "no-cache",
+		"x-content-type-options": "nosniff",
+	});
+	res.end(req.method === "HEAD" ? void 0 : UI_JS);
+}
+
+//#endregion
+
 /** 升级回归自检（dsh-vps upgrade 调用）：健康 + token 兑换 + 登录态 credentials/describe 探针。 */
 async function handleSelfcheck(req, res) {
 	const report = {
@@ -1673,6 +1908,7 @@ function main() {
 				if (pathname === "/logout") return handleLogout(req, res);
 				if (pathname === "/gate/health") return handleHealthGuarded(req, res);
 				if (pathname === "/gate/selfcheck") return handleSelfcheckGuarded(req, res);
+				if (pathname === "/gate/ui.js") return handleUiJs(req, res);
 				if (pathname === "/setup") return handleSetup(req, res);
 				if (!loadAdmin()) {
 					// 尚未完成初始设置：浏览器导航导向导，/api 保持 401
@@ -1690,10 +1926,12 @@ function main() {
 					sendText(res, 503, "gate not configured: admin account missing (run `dsh-vps reset-admin`)");
 					return;
 				}
-				if (!sessionUser(req)) {
+				const user = sessionUser(req);
+				if (!user) {
 					denyUnauthenticated(req, res, pathname);
 					return;
 				}
+				if (pathname === "/gate/update") return handleUpdate(req, res, user);
 				if (pathname.startsWith(MARKET_PREFIX) && !marketRequestSameOrigin(req)) {
 					sendText(res, 403, "cross-origin market request refused by gate");
 					return;
@@ -1715,6 +1953,10 @@ function main() {
 
 	spawnDshWithPreflight();
 
+	// DSH 新版本检测：启动 1 分钟后查一次，之后每 6 小时一次
+	setTimeout(() => checkDshLatest().catch(() => {}), 60_000).unref();
+	setInterval(() => checkDshLatest().catch(() => {}), UPDATE_CHECK_INTERVAL_MS).unref();
+
 	// DSH Cookie 续期：剩余有效期 < 24h 时用同一 launchToken 重新兑换
 	setInterval(() => {
 		if (dsh.cookie && dsh.cookie.expiresAt <= Date.now()) {

package/install.sh

@@ -16,7 +16,7 @@ set -euo pipefail
 
 ## region: 常量与参数
 
-DSH_VERSION="0.1.5-rc.2" # 钉住版本（设计文档 §10 已验证版本表，勿随意改）
+DSH_VERSION="0.1.7-rc.1" # 钉住版本（设计文档 §10 已验证版本表，勿随意改）
 # 只钉顶层包版本是不够的：DSH 各子包的依赖是 ^0.1.5-rc.2 这类浮动范围，上游一发新的
 # 预发布波次，解析结果就整体漂上去。2026-09-22 上游发了 0.1.5-rc.3 波次，但漏发了
 # dsh-client-ui-sidebar-documentpreview，于是 ETARGET 装不上。用 --before 把解析冻结在
@@ -24,8 +24,9 @@ DSH_VERSION="0.1.5-rc.2" # 钉住版本（设计文档 §10 已验证版本表
 # 注意：同一天 03:46 上游还先发了一批 cordis 系列（cordis 4.0.3 / cordis-plugin-hmr 1.0.18 等），
 # 与 rc.2 不兼容——web profile 启动即报 "user patch-layer watching requires the Cordis HMR service"。
 # 冻结点必须早于这一批，所以是 03:40 而不是 05:00。
+# 之后升到 0.1.7-rc.1（npm next 渠道），冻结点 2026-09-24T08:20Z——该时刻解析出的依赖树已逐包比对、实测通过。
 # 设为 none 可关闭冻结。
-DSH_RESOLVE_BEFORE="${DSH_RESOLVE_BEFORE:-2026-09-22T03:40:00Z}"
+DSH_RESOLVE_BEFORE="${DSH_RESOLVE_BEFORE:-2026-09-24T08:20:00Z}"
 INSTALL_ROOT="/opt/dsh-vps"
 DSH_USER="dsh"
 DSH_HOME_DIR="/home/dsh/.dsh"
@@ -391,6 +392,8 @@ EOF
 	systemctl enable dsh-gate >/dev/null 2>&1
 	systemctl restart dsh-gate
 	log "dsh-gate.service 已启动（DSH_TRUSTED_HOST=${trusted}）"
+	# 浏览器一键升级：DSH 有新版本时页面提示，确认后由 root 服务执行升级
+	"$INSTALL_ROOT/bin/dsh-vps" install-units || warn "一键升级单元安装失败（不影响使用，可稍后 sudo dsh-vps install-units）"
 }
 
 ## endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vps",
-  "version": "1.4.4",
+  "version": "1.5.0",
   "description": "Ship DeepSeek Harness to your own VPS: one command installs a zero-dependency login gateway, automatic HTTPS through Caddy, systemd supervision, and optional WireGuard-only access.",
   "keywords": [
     "deepseek-harness",

package/uninstall.sh

@@ -108,6 +108,9 @@ log "步骤 2/6：停止并移除 $SERVICE"
 systemctl stop "$SERVICE" 2>/dev/null || true
 systemctl disable "$SERVICE" 2>/dev/null || true
 rm -f "$UNIT_FILE"
+# 浏览器一键升级单元
+systemctl disable --now dsh-vps-upgrade.path 2>/dev/null || true
+rm -f /etc/systemd/system/dsh-vps-upgrade.path /etc/systemd/system/dsh-vps-upgrade.service
 systemctl daemon-reload 2>/dev/null || true
 systemctl reset-failed "$SERVICE" 2>/dev/null || true
 

package/versions.json

@@ -1,8 +1,22 @@
 {
-  "latest_verified": "0.1.5-rc.2",
-  "resolve_before": "2026-09-22T03:40:00Z",
+  "latest_verified": "0.1.7-rc.1",
+  "resolve_before": "2026-09-24T08:20:00Z",
   "updated_at": "2026-09-24",
   "versions": [
+    {
+      "dsh": "0.1.7-rc.1",
+      "min_gate": "1.5.0",
+      "verified_at": "2026-09-24",
+      "resolve_before": "2026-09-24T08:20:00Z",
+      "notes": "npm next 渠道。会话兑换 / 向导写 API Key / 升级自检 / ownsHost（网页端逻辑未变）/ 插件市场经网关安装 全部实测通过"
+    },
+    {
+      "dsh": "0.1.5-rc.3",
+      "min_gate": "1.4.4",
+      "verified_at": "2026-09-24",
+      "resolve_before": "2026-09-24T08:00:00Z",
+      "notes": "会话兑换 / 向导写 API Key / 升级自检 / ownsHost 补丁 / 插件市场经网关安装 全部实测通过"
+    },
     {
       "dsh": "0.1.5-rc.2",
       "min_gate": "0.1.0",