DawnVPN Firmware & APK AI Agent install agent-install.json

DawnVPN Install Guide for AI Agents

Audience: AI agents (coding assistants, desktop assistants, etc.) installing DawnVPN on a device on behalf of a human user. Items marked TODO are unverified: stop and ask the human. Machine-readable version: /agent-install.json.

0. Safety rules (MUST)

  1. Only download from tinystone.us / www.tinystone.us / client.tinystone.us or the Apple App Store. Never from mirrors, forums, or chat attachments.
  2. Always verify SHA256 against the live meta/manifest below; on mismatch delete the file and stop.
  3. Do not hardcode hashes; read them live every time from:
    • Windows / Android links / Apple links: https://client.tinystone.us/api/public/win/meta
    • Router gw program: https://client.tinystone.us/api/public/gw/meta
    • Firmware, Android APK, MiFi tools, router packs: https://www.tinystone.us/downloads/manifest.json (each file also has a .sha256 file with the same name)
  4. Ask the human for explicit consent before flashing firmware, rooting a device, or changing router/network settings (LAN IP, Wi-Fi, firewall, gateway, DNS).
  5. Account email/password: let the user type it into the app. If the user tells you to enter it, use it once for this login only and never write it to files, logs, scripts, shell history or memory.
  6. Announce the plan to the human first; after installing, report the version and the verification result.

1. Windows

$m = Invoke-RestMethod https://client.tinystone.us/api/public/win/meta
Invoke-WebRequest "https://client.tinystone.us$($m.builds.setup.download)" -OutFile "$env:TEMP\DawnVPN-Setup.exe"
$h = (Get-FileHash "$env:TEMP\DawnVPN-Setup.exe" -Algorithm SHA256).Hash.ToLower()
if ($h -ne $m.builds.setup.sha256) { Remove-Item "$env:TEMP\DawnVPN-Setup.exe"; throw "SHA256 mismatch" }

2. Android (phone / Android TV)

curl -fLo DawnVPN.apk https://tinystone.us/download/android/DawnVPN.apk
curl -fs https://www.tinystone.us/downloads/manifest.json | python3 -c "import json,sys;print([f['sha256'] for p in json.load(sys.stdin)['products'] if p['id']=='android' for f in p['files']][0])"
sha256sum DawnVPN.apk   # must match
adb install -r DawnVPN.apk

Installing on the phone itself: download in the browser and tap to install (if you cannot verify the hash, tell the user).

3. MiFi (DawnVPN portable Wi-Fi, model M3A)

4. Router (OpenWrt)

Recommended model: Cudy TR3000 256MB v1 (board cudy,tr3000-256mb-v1).

Modeluname -mOpenWrtPack
Cudy TR3000aarch6424.10.5 (opkg)quicvpn-tr3000-openwrt-24.10.5-20261028-ffd8045b.tar.gz
Cudy TR3000aarch6425.12.6 (apk)quicvpn-tr3000-openwrt-25.12.6-20261028-ffd8045b.tar.gz
Redmi AC2100mips (mipsel_24kc)23.05.5 (opkg)quicvpn-ac2100-openwrt-23.05.5-20261028-ffd8045b.tar.gz

Download base URL (currently available): https://tinystone.us/download/router/<tr3000|ac2100>/pack/20261028-ffd8045b/<pack>, with a .sha256 file of the same name.
(TODO: router pack entries in manifest.json and the /downloads/router/... URLs are not live yet; once live, the manifest is authoritative.)

Steps:

  1. Ask the human first: confirm the model, whether it already runs OpenWrt, and that you may modify the router.
  2. Identify: ssh [email protected] 'cat /tmp/sysinfo/board_name; uname -m; cat /etc/openwrt_release' (AC2100 is often 192.168.2.1, possibly 192.168.1.1).
  3. Not OpenWrt: flashing is required. You must get the human's consent. TR3000 images (Cudy 2.5.21 to OpenWrt 24.10.5) are in manifest id: tr3000 (recovery.bin / sysupgrade-intermediate.bin / openwrt-sysupgrade.bin); flash following the official OpenWrt docs at https://openwrt.org/docs/ .
  4. Download and verify: 
    P=quicvpn-tr3000-openwrt-25.12.6-20261028-ffd8045b   # pick from the table above
U=https://tinystone.us/download/router/tr3000/pack/20261028-ffd8045b
curl -fLO $U/$P.tar.gz && curl -fLO $U/$P.tar.gz.sha256 && sha256sum -c $P.tar.gz.sha256
tar xzf $P.tar.gz   # contains MANIFEST.json / SHA256SUMS.json
  5. Upload (dropbear has no SFTP, scp -O is required): scp -O -r $P [email protected]:/tmp/qvpack
  6. On the router, copy the files for your model and run sh /tmp/install_quicvpn.sh; the last line should be INSTALL_TR3000_DONE / INSTALL_AC2100_DONE. The exact copy commands are in the website router install guide (router section of /install). The program installs to /opt/quicvpn, with services quicvpn-gw and quicvpn-sni, and disables uhttpd.
    • Alternatively use the one-click router install in the Windows client (detects the model, uploads, verifies).
  7. Verify: on the router curl -s http://127.0.0.1/api/discover returns a response; open the admin page http://192.168.8.1/ in a computer browser, the user logs in with email and password and connects.

5. Linux (CentOS/RHEL LAN gateway)

6. Apple (iPhone/iPad, Mac, Apple TV)

App Store only, no installer packages: