2026.10.27 同日开源 · GitHub + Gitee · GPLv3 Released 2026-10-27 · GitHub + Gitee · GPLv3

一条协议，五个项目

One protocol. Five projects.

把 AI Agent 的“最后一公里”——够得着——做成可自托管的基础设施。

Turning the last mile of AI agents — reachability — into self-hostable infrastructure.

内网穿透内核、浏览器终端中台、Chrome 扩展 API、DSH 控制面桥接、零安装项目站。
同一套二进制协议，四种完全不同的客户端形态。

A tunnel core, a terminal platform, a Chrome extension API, a DSH control-plane bridge and a zero-install site.
One binary protocol, four radically different client forms.

查看五个项目 → Explore the projects → GitHub @dtnsman
5
同日开源的仓库
repos in one day
1
共用二进制协议
shared protocol
69
Browser Proxy 端点
Browser Proxy endpoints
185
单仓库自动化测试
tests in one repo
0第三方3rd-party
流量中转节点
third-party relays
Open Source Matrix

同一天，五块拼图

Five pieces of one puzzle

四个产品，一个内核。每一个都能单独用，合起来是一条从“本机”到“公网可调用”的完整链路。

Four products, one core. Each works alone; together they form a complete path from “local” to “callable from anywhere”.

🌐
01 / CORE

DTNS HTTP Tunnel

dtns-http-proxy · 隧道内核tunnel core

可嵌入的 HTTP / WebSocket 内网穿透协议与服务端实现。一条 WebSocket 复用多条域名隧道，二进制帧原样透传。

An embeddable HTTP / WebSocket tunneling protocol and server. One WebSocket multiplexes many domain tunnels; binary frames pass through untouched.

  • 协议实现单文件、零依赖，Node / 扩展 / 网页都能跑
  • Host 即路由，一个服务端按域名分流多条隧道
  • 双向信用窗口，内存上界与传输量无关
  • Single-file, zero-dependency protocol for Node, extensions and web pages
  • Host-based routing: one server, many tunnels
  • Two-way credit windows keep memory bounded
Node.js ≥ 18 :18385 WSS :18386 HTTP v1 / v2
GitHub Gitee

剩余四个项目，全部构建在它的协议与隧道能力之上。

The other four projects are all built on this protocol.

🖥️
02 / TERMINAL

IBBot PTY Manager

ibbot-pty · 终端中台terminal platform

浏览器里的多主机终端面板 + 可嵌入 SDK + 内置穿透。多终端订阅、断线回放、local / ssh 双后端、500MB 文件通道。

A multi-host terminal panel in the browser, with an embeddable SDK and built-in tunneling. Multi-terminal subscriptions, replay on reconnect, local/ssh backends, 500MB file channel.

  • 单个 WebSocket 按 termId 订阅，切标签不重连
  • 环形缓冲回放，弱网下 16ms 合并、积压丢旧保新
  • 浏览器内 Agent 暴露 REST + WS，LLM 可直接驱动
  • One WebSocket, per-termId subscriptions, no reconnect on tab switch
  • Ring-buffer replay; 16ms coalescing and drop-oldest under pressure
  • In-browser agent exposes REST + WS for LLM-driven terminals
node-pty UMD / ESM / CJS :10310 GPLv3
GitHub Gitee

一个网页标签页，就是一台服务器。

One browser tab is one server.

🧭
03 / BROWSER

DTNS Browser Proxy

dtns-ai-browser · 浏览器即 APIbrowser as API

装一个 Chrome 扩展，把你已登录的浏览器变成 69 个 HTTP 端点。不用公网 IP、不用 Playwright、不用把 Cookie 交给第三方。

Install a Chrome extension and your logged-in browser becomes 69 HTTP endpoints. No public IP, no Playwright, no cookies handed to third parties.

  • 真实登录态：扫码、短信、SSO、硬件密钥照常可用
  • 纯 HTTP + JSON，curl、Go、Java、n8n 都能接
  • 185 个测试用例、94.14% 行覆盖率、68/69 路由真机联调
  • Real login state: QR, SMS, SSO and hardware keys keep working
  • Plain HTTP + JSON — curl, Go, Java, n8n all connect
  • 185 tests, 94.14% line coverage, 68/69 routes live-tested
Chrome MV3 69 endpoints CDP binary frames
GitHub Gitee

别的方案给你一台新浏览器；这里是你手上这台。

Others give you a new browser; this lends you the one you already use.

🔌
04 / BRIDGE

dsh-bridge

DeepSeek Harness → REST + SSE

把本机 DSH 控制面桥接成任何设备、任何脚本都能调用的 HTTP / SSE API，附 Android 多主机客户端 DSH-Hosts。

Bridges the local DeepSeek Harness control plane into an HTTP / SSE API any device or script can call, with the DSH-Hosts Android client.

  • 运行时只依赖一个 ws，零框架、零数据库
  • 任务 / 会话 / 工作区 / 终端 / Job 全套端点
  • 内建隧道，clientId 持久化，手机上的旧链接不失效
  • Only one runtime dependency (ws); no framework, no database
  • Tasks, sessions, workspaces, terminals and jobs
  • Built-in tunnel with persistent clientId — old phone links keep working
REST + SSE :10998 Android APK GPLv3
GitHub Gitee

它不替代 DSH，而是把桌面软件变成可被程序调用的服务。

It doesn’t replace DSH; it turns a desktop app into a service.

⚡
05 / ZERO-INSTALL

DTNS HTTP Proxy Site

dtns-http-proxy-site · 零安装入口zero-install entry

项目站 + 浏览器标签页 Agent：打开一个网页，隧道就通了。URL 即凭证，零依赖 SDK 带 Express 风格路由与 WebSocket。

Project site plus an in-tab agent: open a page and the tunnel is up. The URL is the credential; the zero-dependency SDK offers Express-style routing and WebSocket.

  • 无管理员权限、禁止装软件的机器也能当出口
  • 页面即 API，自动生成 OpenAPI 3 描述
  • WebSocket 双工、SSE 流式、背压一并透传
  • Works on machines where installing software is impossible
  • The page is the API, with generated OpenAPI 3
  • WebSocket duplex, SSE streaming and backpressure included
zero-dep SDK OpenAPI 3 tab as client
在线体验Live demo GitHub Gitee

浏览器就是客户端，打开即用，关掉即离线。

The browser is the client: open to connect, close to go offline.

Why

为什么是“一条协议 + 四个产品”

Why one protocol and four products

AI 已经会写代码、会规划、会调用工具。真正卡住它的是另一件事：够不着。

AI can already write code, plan and call tools. What still blocks it is simpler: it cannot reach things.

01

缺的不是智商，是入口

Not intelligence — access

它够不着你正登录着的浏览器、公司内网的机器、桌面上的 DSH，也够不着那台没有管理员权限的电脑。

It cannot reach your logged-in browser, an intranet machine, the DSH on your desktop, or a laptop without admin rights.

02

现有方案都假设“你能装东西”

Existing tools assume you can install things

frp 要 frpc 常驻，ngrok 要 agent，云浏览器要你交出登录态。它们的共同前提是：目标机器上可以跑一个进程。

frp needs a daemon, ngrok needs an agent, cloud browsers want your credentials. All assume a process may run on the target machine.

03

把“客户端”从安装变成打开

From “install” to “open”

协议是零依赖的 JavaScript：能跑进 Node 进程、Chrome 扩展的 service worker，也能跑在一个普通网页标签页里。

The protocol is dependency-free JavaScript: it runs in Node, in a Chrome MV3 service worker, even in an ordinary browser tab.

One protocol · four client forms
Callers
服务器 / 脚本 / n8n / Dify / LLM Agent / 手机
Servers / scripts / n8n / Dify / LLM agents / phones
curl HTTP SSE WebSocket
HTTP / WebSocket
Public VPS · self-hosted
Nginx（TLS）→ DTNS Tunnel Server
Nginx (TLS) → DTNS Tunnel Server
:18386 HTTP · :18385 WSS · Host 路由 / Host routing
one multiplexed WSS · binary frames v1/v2
Clients · pick any
Node 进程 · Chrome MV3 扩展 · 浏览器标签页
Node process · Chrome MV3 extension · browser tab
ibbot-pty dtns-ai-browser dsh-bridge proxy-site
local loopback
Local capability
终端 :10310 · Chrome 标签页 · DSH :10998 · 本地站点 :3016
PTY :10310 · Chrome tabs · DSH :10998 · local site :3016

同一套服务端按 Host 分发，四个产品各占一个域名前缀：browser2.*、pty.*、dsh.*、dtns-proxy.*。不需要为每个产品单独部署一套服务端。

One server routes by Host; each product owns a prefix — browser2.*, pty.*, dsh.*, dtns-proxy.*. No separate deployment per product.

Protocol Core

协议内核：四个不常见的选择

Four uncommon choices in the core

🧩

可嵌入，而不是常驻守护进程

Embeddable, not a daemon

编解码只依赖 Node 内置的 crypto，可以整体复制进任何 JS 运行时。隧道能力不再和一个二进制绑死。

Codec depends only on Node’s built-in crypto and can be copied into any JS runtime. Tunneling is no longer welded to a binary.

🚏

一条连接，多条隧道

One connection, many tunnels

客户端只维持一条 WebSocket，所有隧道复用它；服务端按请求的 Host 查注册表。加一个服务，只加一段配置。

A client holds one WebSocket; all tunnels share it. The server matches Host against a registry. Add a service, add a config block.

📦

原样透传，不是尽力而为

Passthrough, not best effort

二进制帧搬运请求与响应，WebSocket 升级、双向帧、关闭码与 SSE 分块都不被截断或缓冲。

Binary frames carry requests and responses verbatim: upgrades, duplex frames, close codes and SSE chunks arrive intact.

🔀

版本协商，升级不停机

Version negotiation, no downtime

服务端在 welcome 帧声明版本，v2 修掉了多 Set-Cookie 合并与状态码截断；同一个服务端同时服务 v1 / v2 客户端。

The server declares its version in the welcome frame. v2 fixes merged Set-Cookie headers and truncated status codes; v1 and v2 clients coexist.

1 MB
单向上行 / 下行信用窗口
per-direction credit window
256 KB
流式分块上限
stream chunk ceiling
13 B
二进制固定帧头
fixed binary header
500 MB
PTY 单文件上传上限
max single-file upload
Comparison

它和 ngrok / frp / cloudflared 有什么不同

How it differs from ngrok / frp / cloudflared

不比工程质量，只比形态差异。选型请以各项目官方文档为准。

Not a quality contest — only a difference in form. Check each project’s docs before choosing.

维度Dimension DTNS HTTP Tunnel ngrok frp cloudflared
形态Form 可嵌入协议 + 自托管Embeddable + self-host SaaS + 常驻 agentSaaS + resident agent 自托管，frpc 常驻Self-host, resident frpc SaaS + 守护进程SaaS + daemon
固定自有域名Own fixed domain 配置即得Config it 免费版自动分配Auto-assigned (free) 支持Yes 需接入 CFCF-hosted DNS
能嵌进浏览器 / 扩展Embeds in browser / extension ✓ ✗ ✗ ✗
流量是否经第三方Third-party traffic 否No 是Yes 否No 是Yes
需要第三方账号Third-party account 否No 是Yes 否No 是Yes
SSE / 流式不缓冲Unbuffered SSE ✓ ✓ ✓ ✓
许可证License GPLv3 闭源Closed Apache-2.0 Apache-2.0

竞品信息基于其公开文档与常见部署形态整理（2026-10），额度与限制以官方当前政策为准。

Competitor details compiled from public docs and common deployment forms (2026-10); quotas and limits are subject to their official policies.

Boundaries

把边界写在 README 里

Boundaries, written down

开源不是“看起来很强”，而是把能做什么、不能做什么都讲清楚。

Open source isn’t looking strong — it’s stating plainly what it does and doesn’t do.

已经做了的

What is handled

  • 仓库内 config.js 全部是空白示例，不含真实域名、密钥或隧道信息
  • .gitignore 排除运行时密钥、server-id 与私有配置
  • 站点与 dsh-bridge 默认只监听 127.0.0.1
  • 文件通道做 safeRelPath 校验，拒绝 ..、盘符与空字节
  • Agent 输出自动脱敏 Token，CSP 与安全响应头齐备
  • Every config.js in the repos is a blank example — no real domains, keys or tunnel IDs
  • .gitignore excludes runtime secrets, server-id and private config
  • The site and dsh-bridge bind to 127.0.0.1 by default
  • File channel validates safeRelPath and rejects .., drive letters and NUL bytes
  • Agent output redacts tokens; CSP and security headers are set

需要你注意的

What you must handle

  • 隧道服务端未内置接入鉴权，生产环境请前置 Nginx、IP 白名单或 Basic Auth
  • ibbot-pty 是单密钥模型，没有多用户与 RBAC
  • dsh-bridge 的 HTTP 层无入站鉴权，且会自动应答 DSH 审批瀑布
  • 浏览器标签页关闭即离线；不适合 7×24 常驻
  • 只做 HTTP / WebSocket，不支持 UDP 与 P2P 打洞
  • The tunnel server has no built-in inbound auth; front it with Nginx, IP allowlists or Basic Auth
  • ibbot-pty uses a single key — no multi-user or RBAC
  • dsh-bridge has no inbound auth and auto-answers the DSH approval waterfall
  • A closed tab goes offline; not for 24×7 service
  • HTTP / WebSocket only — no UDP or P2P hole punching

“不适用场景”写得和“功能特性”一样长，是这几个仓库最值得读的部分。

“When not to use it” is as long as “features” — and that is the most valuable part.

Get Started

三分钟，跑起来

Up and running in three minutes

bash · dtns-http-proxy 
# 1. 公网服务器：启动隧道服务端
git clone https://github.com/dtnsman/dtns-http-proxy.git
cd dtns-http-proxy/server
npm install && npm start

# 2. 内网机器：启动客户端并登记隧道
cd dtns-http-proxy/client
npm install && npm start

# 3. 生产环境：Nginx 终止 TLS，记得关缓冲
location /tunnel {
  proxy_pass http://127.0.0.1:18385;
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";
  proxy_buffering off;
}
  • 什么都不想装？ Don’t want to install anything? 打开 dtns-proxy.html.dtns.top/agent.html，标签页自动注册一条隧道。 Open dtns-proxy.html.dtns.top/agent.html; the tab registers a tunnel for you.
  • 想看终端面板？ Want the terminal panel? cd ibbot-pty/server && npm install && npm start，再用浏览器打开 client/demo-hosts.html。 cd ibbot-pty/server && npm install && npm start, then open client/demo-hosts.html.
  • 想驱动自己的浏览器？ Want to drive your own browser? 在 chrome://extensions/ 加载 dtns-ai-browser/extension，然后 curl 那个 browser2.* 地址。 Load dtns-ai-browser/extension in chrome://extensions/, then curl the browser2.* URL.

五个仓库，全部 GPLv3

Five repositories, all GPLv3

可以商用，可以修改，可以自托管。分发衍生作品时，请以相同许可证开源，并保留版权声明。

Use commercially, modify, self-host. If you distribute derivatives, keep it GPLv3 and keep the notices.

GitHub · @dtnsman Gitee · @dtnsman 从内核开始 →Start with the core →

如果这些项目帮你省下了一天，一颗 Star 是最好的感谢。

If these projects saved you a day, a star is the best thank-you.