dsh-vpn-ops

When an AI assistant steps into VPN operations, the real question is not what it can do but where it can do it, with which credentials, and under what constraints. dsh-vpn-ops locks the model's scope to a pre-reviewed allowlist: it can only pick a configured targetId and clientId, and it cannot supply a host, credential, remote path, package URL, or shell command of its own accord. Every remote process is spawned via an argv array with no local shell in the picture; the remote side runs a fixed helper shipped inside the reviewed package; strict host-key checking and public-key-only SSH are mandatory.

The bundle registers eight typed tools that form a full operational loop for WireGuard and VLESS Reality: allowlist check, preflight, status read, local plan generation, remote apply, verification, rollback, and client-key export. Each apply requires a fresh persisted plan and the exact confirmation string returned by plan; backups are written before the first managed-file change and auto-restored on transaction failure. Client secrets never surface as tool values—they are streamed into mode-0600 local files, and the caller receives only paths, sizes, and SHA-256 digests. The npm package ships no preinstall, install, postinstall, prepare, or prepack lifecycle scripts, removing a supply-chain attack surface.

It is built for operators who already run Debian or Ubuntu with systemd and Xray, and who want DSH's AI assistance for day-to-day VPN changes without granting the model any arbitrary remote execution power. The plugin deliberately does not install OS packages, call firewall-provider APIs, manage DNS, or handle certificates—those remain the operator's established control plane. dsh-vpn-ops handles what it is designed for: auditable, repeatable, rollback-safe configuration changes inside a strict, safety-gated boundary.