@linxin666/dsh-ssh 0.1.17 → 0.1.19

package/lib/index.js

@@ -1328,13 +1328,13 @@ const DEFAULTS = {
 	sftpConcurrency: 8
 };
 /** Build the ssh2 connect config for one entry (key read from disk). */
-function buildConnectConfig(entry, sock) {
+function buildConnectConfig(entry, sock, opts) {
 	const config = {
 		host: entry.host,
 		port: entry.port,
 		username: entry.user,
-		readyTimeout: 15e3,
-		keepaliveInterval: 15e3,
+		readyTimeout: opts.connectTimeoutMs,
+		keepaliveInterval: opts.keepaliveIntervalMs,
 		keepaliveCountMax: 3
 	};
 	if (sock !== void 0) config.sock = sock;
@@ -1401,7 +1401,7 @@ async function connectChain(engine, entry) {
 			for (const client of hops) client.end();
 			throw new Error("proxyJump alias '" + hopAlias + "' not found — create it first");
 		}
-		const hopClient = await connectClient(buildConnectConfig(hop, sock));
+		const hopClient = await connectClient(buildConnectConfig(hop, sock, engine.opts));
 		hops.push(hopClient);
 		const next = index + 1 < chain.length ? engine.store.find(chain[index + 1]) : void 0;
 		const nextHost = next !== void 0 ? next.host : entry.host;
@@ -1417,7 +1417,7 @@ async function connectChain(engine, entry) {
 	}
 	let target;
 	try {
-		target = await connectClient(buildConnectConfig(entry, sock));
+		target = await connectClient(buildConnectConfig(entry, sock, engine.opts));
 		return {
 			client: target,
 			hops
@@ -2145,6 +2145,51 @@ var SshEngine = class {
 	}
 };
 //#endregion
+//#region src/loopback.ts
+/** IPv4 127/8 predicate (four decimal octets, first == 127). */
+function isIPv4Loopback(v4) {
+	const parts = v4.split(".");
+	return parts.length === 4 && parts[0] === "127" && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255);
+}
+/** Whether a socket remote address names the loopback range (127/8, ::1, IPv4-mapped). */
+function isLoopbackAddress(address) {
+	if (address === void 0) return false;
+	const normalized = address.toLowerCase();
+	if (normalized === "::1") return true;
+	if (normalized.startsWith("::ffff:")) return isIPv4Loopback(normalized.slice(7));
+	return isIPv4Loopback(normalized);
+}
+/** Whether a normalized URL hostname names the loopback authority (localhost, [::1], 127/8). */
+function isLoopbackHostname(hostname) {
+	if (hostname === "localhost" || hostname === "[::1]") return true;
+	return isIPv4Loopback(hostname);
+}
+/**
+* Request-level trust fence: a loopback socket address AND a loopback Host
+* header, plus browser same-origin markers. The socket address is
+* authoritative; X-Forwarded-For is never trusted.
+*/
+function isLoopbackRequest(request) {
+	if (!isLoopbackAddress(request.socket.remoteAddress)) return false;
+	const host = request.headers.host;
+	if (typeof host !== "string") return false;
+	let hostUrl;
+	try {
+		hostUrl = new URL("http://" + host);
+	} catch {
+		return false;
+	}
+	if (!isLoopbackHostname(hostUrl.hostname)) return false;
+	if (request.headers["sec-fetch-site"] === "cross-site") return false;
+	const origin = request.headers.origin;
+	if (origin === void 0) return true;
+	try {
+		return new URL(origin).host === hostUrl.host;
+	} catch {
+		return false;
+	}
+}
+//#endregion
 //#region src/protocol.ts
 const SSH_API = {
 	hosts: "/api/dsh-ssh/hosts",
@@ -2182,28 +2227,6 @@ const terminalWss = new WebSocketServer({ noServer: true });
 const BACKPRESSURE_HIGH_WATER = 1024 * 1024;
 /** …and resume once it drains below this. */
 const BACKPRESSURE_LOW_WATER = 512 * 1024;
-/** Loopback literal check plus browser same-origin markers (mirrors the pairing routes' fence). */
-function isLoopbackRequest(request) {
-	const address = request.socket.remoteAddress;
-	if (address !== "127.0.0.1" && address !== "::1" && address !== "::ffff:127.0.0.1") return false;
-	const host = request.headers.host;
-	if (typeof host !== "string") return false;
-	let hostUrl;
-	try {
-		hostUrl = new URL(`http://${host}`);
-	} catch {
-		return false;
-	}
-	if (hostUrl.hostname !== "127.0.0.1" && hostUrl.hostname !== "localhost" && hostUrl.hostname !== "[::1]") return false;
-	if (request.headers["sec-fetch-site"] === "cross-site") return false;
-	const origin = request.headers.origin;
-	if (origin === void 0) return true;
-	try {
-		return new URL(origin).host === hostUrl.host;
-	} catch {
-		return false;
-	}
-}
 /** One JSON response. */
 function writeJson(res, status, body) {
 	const payload = JSON.stringify(body);

package/lib/types/client/locales.d.ts

@@ -5,6 +5,7 @@ export declare const zh: {
     readonly 'entry.label': "SSH";
     readonly 'entry.tooltip': "远程 SSH 运维面板";
     readonly 'panel.title': "远程 SSH";
+    readonly 'panel.backToConversation': "返回会话";
     readonly 'tab.hosts': "主机";
     readonly 'tab.terminal': "终端";
     readonly 'tab.transfer': "传输";
@@ -127,7 +128,6 @@ export declare const zh: {
     readonly 'common.loading': "加载中…";
     readonly 'common.error': "出错：{error}";
     readonly 'common.refresh': "刷新";
-    readonly 'common.close': "关闭";
     readonly 'common.confirm': "确定";
 };
 export declare const en: Record<keyof typeof zh, string>;

package/lib/types/engine/connection-pool.d.ts

@@ -47,7 +47,7 @@ export interface PoolEngine {
     readonly acquireQueue: Map<string, Promise<PoolRecord>>;
 }
 /** Build the ssh2 connect config for one entry (key read from disk). */
-export declare function buildConnectConfig(entry: SshHostEntry, sock?: ConnectConfig['sock']): ConnectConfig;
+export declare function buildConnectConfig(entry: SshHostEntry, sock: ConnectConfig['sock'] | undefined, opts: Required<EngineOptions>): ConnectConfig;
 /** Connect one ssh2 client (resolve on ready, reject on error/close). */
 export declare function connectClient(config: ConnectConfig): Promise<Client>;
 /** Cap captured output at the configured byte budget (marks truncation). */

package/lib/types/loopback.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Loopback trust fence shared by the host route families: socket address,
+ * Host header, and browser same-origin markers. Packages receive this file as
+ * a generated copy via scripts/sync-shared.mjs; edit the shared source and
+ * re-run the sync instead of editing a copy.
+ *
+ * Semantics: RFC 5735 IPv4 127/8, ::1, IPv4-mapped ::ffff:127/8 (matching the
+ * remote-web-ui gate), localhost hostnames, plus the browser same-origin
+ * markers (sec-fetch-site and Origin) for the request-level fence.
+ * @module dsh-web-ui-shared/host/loopback
+ */
+import type { IncomingMessage } from 'node:http';
+/** IPv4 127/8 predicate (four decimal octets, first == 127). */
+export declare function isIPv4Loopback(v4: string): boolean;
+/** Whether a socket remote address names the loopback range (127/8, ::1, IPv4-mapped). */
+export declare function isLoopbackAddress(address: string | undefined): boolean;
+/** Whether a normalized URL hostname names the loopback authority (localhost, [::1], 127/8). */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Request-level trust fence: a loopback socket address AND a loopback Host
+ * header, plus browser same-origin markers. The socket address is
+ * authoritative; X-Forwarded-For is never trusted.
+ */
+export declare function isLoopbackRequest(request: IncomingMessage): boolean;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-ssh",
   "description": "Remote SSH operations for the dsh web GUI: host config store (~/.dsh/dsh-ssh.json, import from ~/.ssh/config), a persistent ssh2 connection pool with jump-host support, exec / PTY web terminal / SFTP transfer / local port-forward tunnels / cluster execution, plus agent tools (ssh_list, ssh_exec, ssh_upload, ssh_download, ssh_tunnel, ssh_cluster). Hot-pluggable — mounted via ~/.dsh/cordis.patch.yml + a profile node_modules symlink, no dsh source changes.",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"

package/src/client/locales.ts

@@ -6,6 +6,7 @@ export const zh = {
   'entry.label': 'SSH',
   'entry.tooltip': '远程 SSH 运维面板',
   'panel.title': '远程 SSH',
+  'panel.backToConversation': '返回会话',
   'tab.hosts': '主机',
   'tab.terminal': '终端',
   'tab.transfer': '传输',
@@ -135,7 +136,6 @@ export const zh = {
   'common.loading': '加载中…',
   'common.error': '出错：{error}',
   'common.refresh': '刷新',
-  'common.close': '关闭',
   'common.confirm': '确定',
 } as const
 
@@ -143,6 +143,7 @@ export const en: Record<keyof typeof zh, string> = {
   'entry.label': 'SSH',
   'entry.tooltip': 'Remote SSH operations panel',
   'panel.title': 'Remote SSH',
+  'panel.backToConversation': 'Back to chat',
   'tab.hosts': 'Hosts',
   'tab.terminal': 'Terminal',
   'tab.transfer': 'Transfer',
@@ -265,7 +266,6 @@ export const en: Record<keyof typeof zh, string> = {
   'common.loading': 'Loading…',
   'common.error': 'Error: {error}',
   'common.refresh': 'Refresh',
-  'common.close': 'Close',
   'common.confirm': 'Confirm',
 }
 

package/src/client/panel/SshPanel.tsx

@@ -55,8 +55,16 @@ export function SshPanel({ controller, api }: SshPanelProps) {
   return (
     <div className={css.panel}>
       <div className={css.panelHeader}>
+        <button
+          type="button"
+          className={`${css.ghostButton} ${css.backButton}`}
+          aria-label={tt('panel.backToConversation')}
+          onClick={() => { controller.close() }}
+        >
+          <span aria-hidden="true">‹</span>
+          <span>{tt('panel.backToConversation')}</span>
+        </button>
         <h2 className={css.panelTitle}>{tt('panel.title')}</h2>
-        <button type="button" className={css.iconButton} title={tt('common.close')} aria-label={tt('common.close')} onClick={() => { controller.close() }}>x</button>
       </div>
       <div className={css.tabBar} role="tablist">
         {TABS.map(tab => (

package/src/client/panel/panel.module.css

@@ -133,6 +133,12 @@ html[data-dsh-ssh-active]:not([data-dsh-taskboard-active]) [class*='centerCol']
   white-space: nowrap;
 }
 
+.backButton {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+}
+
 /* --- tab bar ------------------------------------------------------------------ */
 
 .tabBar {

package/src/engine/connection-pool.ts

@@ -62,13 +62,13 @@ export interface PoolEngine {
 }
 
 /** Build the ssh2 connect config for one entry (key read from disk). */
-export function buildConnectConfig(entry: SshHostEntry, sock?: ConnectConfig['sock']): ConnectConfig {
+export function buildConnectConfig(entry: SshHostEntry, sock: ConnectConfig['sock'] | undefined, opts: Required<EngineOptions>): ConnectConfig {
   const config: ConnectConfig = {
     host: entry.host,
     port: entry.port,
     username: entry.user,
-    readyTimeout: 15_000,
-    keepaliveInterval: 15_000,
+    readyTimeout: opts.connectTimeoutMs,
+    keepaliveInterval: opts.keepaliveIntervalMs,
     keepaliveCountMax: 3,
   }
   if (sock !== undefined) config.sock = sock
@@ -147,7 +147,7 @@ export async function connectChain(engine: PoolEngine, entry: SshHostEntry): Pro
       for (const client of hops) client.end()
       throw new Error('proxyJump alias \'' + hopAlias + '\' not found — create it first')
     }
-    const hopClient = await connectClient(buildConnectConfig(hop, sock))
+    const hopClient = await connectClient(buildConnectConfig(hop, sock, engine.opts))
     hops.push(hopClient)
     const next = index + 1 < chain.length ? engine.store.find(chain[index + 1]) : undefined
     const nextHost = next !== undefined ? next.host : entry.host
@@ -165,7 +165,7 @@ export async function connectChain(engine: PoolEngine, entry: SshHostEntry): Pro
   }
   let target: Client | undefined
   try {
-    target = await connectClient(buildConnectConfig(entry, sock))
+    target = await connectClient(buildConnectConfig(entry, sock, engine.opts))
     return { client: target, hops }
   } catch (error) {
     for (const client of hops) client.end()

package/src/loopback.ts

@@ -0,0 +1,63 @@
+// Generated by scripts/sync-shared.mjs from shared/host/loopback.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Loopback trust fence shared by the host route families: socket address,
+ * Host header, and browser same-origin markers. Packages receive this file as
+ * a generated copy via scripts/sync-shared.mjs; edit the shared source and
+ * re-run the sync instead of editing a copy.
+ *
+ * Semantics: RFC 5735 IPv4 127/8, ::1, IPv4-mapped ::ffff:127/8 (matching the
+ * remote-web-ui gate), localhost hostnames, plus the browser same-origin
+ * markers (sec-fetch-site and Origin) for the request-level fence.
+ * @module dsh-web-ui-shared/host/loopback
+ */
+
+import type { IncomingMessage } from 'node:http'
+
+/** IPv4 127/8 predicate (four decimal octets, first == 127). */
+export function isIPv4Loopback(v4: string): boolean {
+  const parts = v4.split('.')
+  return parts.length === 4
+    && parts[0] === '127'
+    && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255)
+}
+
+/** Whether a socket remote address names the loopback range (127/8, ::1, IPv4-mapped). */
+export function isLoopbackAddress(address: string | undefined): boolean {
+  if (address === undefined) return false
+  const normalized = address.toLowerCase()
+  if (normalized === '::1') return true
+  if (normalized.startsWith('::ffff:')) return isIPv4Loopback(normalized.slice('::ffff:'.length))
+  return isIPv4Loopback(normalized)
+}
+
+/** Whether a normalized URL hostname names the loopback authority (localhost, [::1], 127/8). */
+export function isLoopbackHostname(hostname: string): boolean {
+  if (hostname === 'localhost' || hostname === '[::1]') return true
+  return isIPv4Loopback(hostname)
+}
+
+/**
+ * Request-level trust fence: a loopback socket address AND a loopback Host
+ * header, plus browser same-origin markers. The socket address is
+ * authoritative; X-Forwarded-For is never trusted.
+ */
+export function isLoopbackRequest(request: IncomingMessage): boolean {
+  if (!isLoopbackAddress(request.socket.remoteAddress)) return false
+  const host = request.headers.host
+  if (typeof host !== 'string') return false
+  let hostUrl: URL
+  try {
+    hostUrl = new URL('http://' + host)
+  } catch {
+    return false
+  }
+  if (!isLoopbackHostname(hostUrl.hostname)) return false
+  if (request.headers['sec-fetch-site'] === 'cross-site') return false
+  const origin = request.headers.origin
+  if (origin === undefined) return true
+  try {
+    return new URL(origin).host === hostUrl.host
+  } catch {
+    return false
+  }
+}

package/src/routes.ts

@@ -16,6 +16,7 @@ import { randomBytes } from 'node:crypto'
 import { WebSocket, WebSocketServer } from 'ws'
 import type { WebRoute, WebUpgradeRoute } from '@deepseek-ai/dsh-host-webserver'
 import type { SshEngine, ShellSession } from './engine.ts'
+import { isLoopbackRequest } from './loopback.ts'
 import { SSH_API, type HostPayload, type TerminalClientFrame, type TerminalServerFrame } from './protocol.ts'
 import type { HostStore } from './store.ts'
 
@@ -38,29 +39,6 @@ const BACKPRESSURE_HIGH_WATER = 1024 * 1024
 /** …and resume once it drains below this. */
 const BACKPRESSURE_LOW_WATER = 512 * 1024
 
-/** Loopback literal check plus browser same-origin markers (mirrors the pairing routes' fence). */
-function isLoopbackRequest(request: IncomingMessage): boolean {
-  const address = request.socket.remoteAddress
-  if (address !== '127.0.0.1' && address !== '::1' && address !== '::ffff:127.0.0.1') return false
-  const host = request.headers.host
-  if (typeof host !== 'string') return false
-  let hostUrl: URL
-  try {
-    hostUrl = new URL(`http://${host}`)
-  } catch {
-    return false
-  }
-  if (hostUrl.hostname !== '127.0.0.1' && hostUrl.hostname !== 'localhost' && hostUrl.hostname !== '[::1]') return false
-  if (request.headers['sec-fetch-site'] === 'cross-site') return false
-  const origin = request.headers.origin
-  if (origin === undefined) return true
-  try {
-    return new URL(origin).host === hostUrl.host
-  } catch {
-    return false
-  }
-}
-
 /** One JSON response. */
 function writeJson(res: ServerResponse, status: number, body: unknown): void {
   const payload = JSON.stringify(body)