@linxin666/dsh-ssh 0.2.4 → 0.2.5

package/lib/types/client/locales.d.ts

@@ -57,6 +57,7 @@ export declare const zh: {
     readonly 'form.passphrase': "密钥口令";
     readonly 'form.password': "密码";
     readonly 'form.passwordHint': "明文保存在 ~/.dsh/dsh-ssh.json（本机私有文件）";
+    readonly 'form.passwordRequired': "密码认证需要填写密码。";
     readonly 'form.proxyJump': "跳板机别名";
     readonly 'form.proxyJumpHint': "逗号分隔的本地主机别名，按顺序连接";
     readonly 'form.description': "备注";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-ssh",
   "description": "Remote SSH operations for the dsh web GUI: host config store (~/.dsh/dsh-ssh.json, import from ~/.ssh/config), a persistent ssh2 connection pool with jump-host support, exec / PTY web terminal / SFTP transfer / local port-forward tunnels / cluster execution, plus agent tools (ssh_list, ssh_exec, ssh_upload, ssh_download, ssh_tunnel, ssh_cluster). Hot-pluggable — mounted via ~/.dsh/cordis.patch.yml + a profile node_modules symlink, no dsh source changes.",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"

package/src/client/api.ts

@@ -34,6 +34,17 @@ export class SshApiError extends Error {
   }
 }
 
+/** Extract the `.error` message from a JSON error body; undefined when absent. */
+function extractError(text: string): string | undefined {
+  if (text === '') return undefined
+  try {
+    const parsed = JSON.parse(text) as { error?: unknown } | null
+    return typeof parsed?.error === 'string' ? parsed.error : undefined
+  } catch {
+    return undefined
+  }
+}
+
 /** Parse a JSON response or throw an SshApiError. */
 async function readJson<T>(response: Response): Promise<T> {
   let body: unknown
@@ -219,7 +230,9 @@ export class SshApi {
       body: file,
     })
     if (!response.ok || response.body === null) {
-      throw new SshApiError(`upload failed: HTTP ${response.status}`)
+      const text = await response.text().catch(() => '')
+      const error = extractError(text)
+      throw new SshApiError(error ?? `upload failed: HTTP ${response.status}`)
     }
     const reader = response.body.getReader()
     const decoder = new TextDecoder()
@@ -268,7 +281,8 @@ export class SshApi {
     const response = await fetch(SSH_API.download + query({ alias, remotePath }))
     if (!response.ok || response.body === null) {
       const text = await response.text().catch(() => '')
-      throw new SshApiError(text !== '' && text.startsWith('{') ? text : `download failed: HTTP ${response.status}`)
+      const error = extractError(text)
+      throw new SshApiError(error ?? `download failed: HTTP ${response.status}`)
     }
     const total = Number(response.headers.get('content-length') ?? '0')
     const disposition = response.headers.get('content-disposition') ?? ''

package/src/client/locales.ts

@@ -60,6 +60,7 @@ export const zh = {
   'form.passphrase': '密钥口令',
   'form.password': '密码',
   'form.passwordHint': '明文保存在 ~/.dsh/dsh-ssh.json（本机私有文件）',
+  'form.passwordRequired': '密码认证需要填写密码。',
   'form.proxyJump': '跳板机别名',
   'form.proxyJumpHint': '逗号分隔的本地主机别名，按顺序连接',
   'form.description': '备注',
@@ -203,6 +204,7 @@ export const en: Record<keyof typeof zh, string> = {
   'form.passphrase': 'Key passphrase',
   'form.password': 'Password',
   'form.passwordHint': 'Stored in plaintext in ~/.dsh/dsh-ssh.json (private local file)',
+  'form.passwordRequired': 'Password auth requires a password.',
   'form.proxyJump': 'Jump host aliases',
   'form.proxyJumpHint': 'Comma-separated local aliases, chained in order',
   'form.description': 'Description',

package/src/client/panel/HostFormDialog.tsx

@@ -92,6 +92,12 @@ export function HostFormDialog({ api, editing, onClose, onSaved }: HostFormDialo
       setError(tt('form.portInvalid'))
       return
     }
+    // A password-auth host needs a password on create; when editing, a blank
+    // secret field preserves the stored credential instead.
+    if (editing == null && form.authKind === 'password' && form.password === '') {
+      setError(tt('form.passwordRequired'))
+      return
+    }
     // Secrets are never echoed back by the API: when editing and the secret
     // fields are left empty, the auth block is omitted so the stored
     // authentication is preserved.