@linxin666/dsh-ssh 0.3.5 → 0.3.9

package/src/client/panel/TerminalTab.tsx

@@ -36,6 +36,13 @@ type TerminalStatus =
   | { kind: 'exited'; alias: string; detail?: string }
   | { kind: 'error'; detail: string }
 
+/** In-flight 2FA challenge prompts. */
+interface AuthPromptState {
+  name: string
+  instructions: string
+  prompts: Array<{ prompt: string; echo: boolean }>
+}
+
 /** Injected-once guard for the xterm stylesheet (one tag per page load). */
 let xtermCssInjected = false
 
@@ -60,6 +67,8 @@ export function TerminalTab({ api, presetAlias, requestId, terminalFont }: Termi
   const [hosts, setHosts] = useState<SshHostSummary[]>([])
   const [alias, setAlias] = useState(presetAlias ?? '')
   const [status, setStatus] = useState<TerminalStatus>({ kind: 'idle' })
+  const [authPrompt, setAuthPrompt] = useState<AuthPromptState | undefined>(undefined)
+  const [authInputs, setAuthInputs] = useState<string[]>([])
   const containerRef = useRef<HTMLDivElement | null>(null)
   const termRef = useRef<Terminal | null>(null)
   const fitRef = useRef<FitAddon | null>(null)
@@ -103,12 +112,15 @@ export function TerminalTab({ api, presetAlias, requestId, terminalFont }: Termi
   }, [presetAlias, requestId])
 
   const teardown = (): void => {
+    setAuthPrompt(undefined)
+    setAuthInputs([])
     const connection = connRef.current
     connRef.current = null
     if (connection !== null) {
       connection.onReady = undefined
       connection.onOutput = undefined
       connection.onExit = undefined
+      connection.onAuthPrompt = undefined
       connection.close()
     }
     // Release the xterm input subscription explicitly and dispose the
@@ -182,11 +194,21 @@ export function TerminalTab({ api, presetAlias, requestId, terminalFont }: Termi
     connRef.current = connection
     let settled = false
     dataSubRef.current = term.onData(data => { connection.send(data) })
-    connection.onReady = () => { setStatus({ kind: 'connected', alias: target }) }
+    connection.onAuthPrompt = (name, instructions, prompts) => {
+      setAuthPrompt({ name, instructions, prompts })
+      setAuthInputs(prompts.map(() => ''))
+    }
+    connection.onReady = () => {
+      setAuthPrompt(undefined)
+      setAuthInputs([])
+      setStatus({ kind: 'connected', alias: target })
+    }
     connection.onOutput = data => { term.write(data) }
     connection.onExit = (_code, error) => {
       if (settled) return
       settled = true
+      setAuthPrompt(undefined)
+      setAuthInputs([])
       dataSubRef.current?.dispose()
       dataSubRef.current = null
       term.options.disableStdin = true
@@ -201,6 +223,13 @@ export function TerminalTab({ api, presetAlias, requestId, terminalFont }: Termi
     setStatus({ kind: 'idle' })
   }
 
+  const submitAuth = (e?: React.FormEvent): void => {
+    e?.preventDefault()
+    if (connRef.current === null || authPrompt === undefined) return
+    connRef.current.sendAuthResponse(authInputs)
+    setAuthPrompt(undefined)
+  }
+
   const active = status.kind === 'connecting' || status.kind === 'connected'
 
   return (
@@ -224,6 +253,37 @@ export function TerminalTab({ api, presetAlias, requestId, terminalFont }: Termi
         {status.kind === 'idle' && (
           <div className={css.termPlaceholder}>{hosts.length === 0 ? tt('hosts.empty') : tt('terminal.placeholder')}</div>
         )}
+        {authPrompt !== undefined && (
+          <div className={css.modalBackdrop} style={{ position: 'absolute', zIndex: 10 }}>
+            <form className={css.modalCard} style={{ maxWidth: 420 }} onSubmit={submitAuth}>
+              <div className={css.modalHeader}>
+                <h3 className={css.modalTitle}>{authPrompt.name || tt('terminal.auth.title')}</h3>
+              </div>
+              <p className={css.hint}>{authPrompt.instructions || tt('terminal.auth.hint')}</p>
+              {authPrompt.prompts.map((p, idx) => (
+                <label key={idx} className={css.field}>
+                  <span className={css.fieldLabel}>{p.prompt.trim() || tt('terminal.auth.title')}</span>
+                  <input
+                    autoFocus={idx === 0}
+                    className={css.input}
+                    type={p.echo ? 'text' : 'password'}
+                    placeholder={tt('terminal.auth.placeholder')}
+                    value={authInputs[idx] ?? ''}
+                    onChange={event => {
+                      const next = [...authInputs]
+                      next[idx] = event.target.value
+                      setAuthInputs(next)
+                    }}
+                  />
+                </label>
+              ))}
+              <div className={css.modalFooter}>
+                <button type="button" className={css.ghostButton} onClick={disconnect}>{tt('terminal.auth.cancel')}</button>
+                <button type="submit" className={css.primaryButton}>{tt('terminal.auth.submit')}</button>
+              </div>
+            </form>
+          </div>
+        )}
       </div>
     </div>
   )

package/src/dsh-home.ts

@@ -39,4 +39,4 @@ export function resolveDshHome(env: NodeJS.ProcessEnv = process.env, home: strin
 /** Resolve the DSH home directory from the live environment. */
 export function dshHome(): string {
   return resolveDshHome()
-}
+}

package/src/engine/connection-pool.ts

@@ -70,6 +70,7 @@ export function buildConnectConfig(entry: SshHostEntry, sock: ConnectConfig['soc
     readyTimeout: opts.connectTimeoutMs,
     keepaliveInterval: opts.keepaliveIntervalMs,
     keepaliveCountMax: 3,
+    tryKeyboard: true,
   }
   if (sock !== undefined) config.sock = sock
   if (entry.auth.kind === 'password') {
@@ -103,8 +104,17 @@ export function resolveAgentPath(agentPath?: string): string | undefined {
   return undefined
 }
 
+/** Keyboard-interactive handler callback for 2FA / dynamic prompt flow. */
+export type KeyboardInteractiveHandler = (
+  name: string,
+  instructions: string,
+  instructionsLang: string,
+  prompts: Array<{ prompt: string; echo: boolean }>,
+  finish: (responses: string[]) => void,
+) => void
+
 /** Connect one ssh2 client (resolve on ready, reject on error/close). */
-export function connectClient(config: ConnectConfig): Promise<Client> {
+export function connectClient(config: ConnectConfig, onKeyboardInteractive?: KeyboardInteractiveHandler): Promise<Client> {
   return new Promise((resolve, reject) => {
     const client = new Client()
     let settled = false
@@ -119,6 +129,18 @@ export function connectClient(config: ConnectConfig): Promise<Client> {
       settled = true
       resolve(client)
     })
+    client.on('keyboard-interactive', (name, instructions, instructionsLang, prompts, finish) => {
+      if (onKeyboardInteractive !== undefined) {
+        onKeyboardInteractive(name, instructions, instructionsLang, prompts.map(p => ({ prompt: p.prompt, echo: Boolean(p.echo) })), finish)
+        return
+      }
+      // Step 1: Automatic PAM password fallback: if a password is configured and all prompts ask for password
+      if (config.password !== undefined && prompts.length > 0 && prompts.every(p => /password/i.test(p.prompt))) {
+        finish(prompts.map(() => config.password as string))
+        return
+      }
+      fail(new Error('Authentication failed (keyboard-interactive): ' + (prompts.map(p => p.prompt.trim()).join(', ') || 'unsupported interactive challenge')))
+    })
     // Keep an error listener attached after the handshake: when TCP connects
     // but the handshake drops, ssh2 can emit a second 'error' after a single
     // once-listener is gone, which would surface as an unhandled 'error' event.
@@ -152,7 +174,11 @@ export function appendOutput(target: { text: string; truncated: boolean }, chunk
  * order, each forwarding a stream to the next destination, ending with the
  * target client. Shared by the pool and standalone shell sessions.
  */
-export async function connectChain(engine: PoolEngine, entry: SshHostEntry): Promise<{ client: Client; hops: Client[] }> {
+export async function connectChain(
+  engine: PoolEngine,
+  entry: SshHostEntry,
+  onKeyboardInteractive?: KeyboardInteractiveHandler,
+): Promise<{ client: Client; hops: Client[] }> {
   const hops: Client[] = []
   let sock: ConnectConfig['sock']
   const chain = entry.proxyJump
@@ -163,7 +189,7 @@ export async function connectChain(engine: PoolEngine, entry: SshHostEntry): Pro
       if (hop === undefined) {
         throw new Error('proxyJump alias \'' + hopAlias + '\' not found — create it first')
       }
-      const hopClient = await connectClient(buildConnectConfig(hop, sock, engine.opts))
+      const hopClient = await connectClient(buildConnectConfig(hop, sock, engine.opts), onKeyboardInteractive)
       hops.push(hopClient)
       const next = index + 1 < chain.length ? engine.store.find(chain[index + 1]) : undefined
       const nextHost = next !== undefined ? next.host : entry.host
@@ -187,7 +213,7 @@ export async function connectChain(engine: PoolEngine, entry: SshHostEntry): Pro
   }
   let target: Client | undefined
   try {
-    target = await connectClient(buildConnectConfig(entry, sock, engine.opts))
+    target = await connectClient(buildConnectConfig(entry, sock, engine.opts), onKeyboardInteractive)
     return { client: target, hops }
   } catch (error) {
     for (const client of hops) client.end()

package/src/engine/pty.ts

@@ -4,7 +4,7 @@
  * output delivery.
  */
 
-import { connectChain, type PoolEngine } from './connection-pool.ts'
+import { connectChain, type KeyboardInteractiveHandler, type PoolEngine } from './connection-pool.ts'
 
 /** A live PTY shell session. */
 export interface ShellSession {
@@ -29,10 +29,15 @@ export interface ShellSession {
  * The shell is a long-lived exclusive stream: it uses its own connection so
  * closing it can never tear down a pooled exec/tunnel sharing the alias.
  */
-export async function openShell(engine: PoolEngine, alias: string, size: { cols: number; rows: number }): Promise<ShellSession> {
+export async function openShell(
+  engine: PoolEngine,
+  alias: string,
+  size: { cols: number; rows: number },
+  onKeyboardInteractive?: KeyboardInteractiveHandler,
+): Promise<ShellSession> {
   const entry = engine.store.find(alias)
   if (entry === undefined) throw new Error('alias \'' + alias + '\' not found — add it first')
-  const { client, hops } = await connectChain(engine, entry)
+  const { client, hops } = await connectChain(engine, entry, onKeyboardInteractive)
   return await new Promise<ShellSession>((resolve, reject) => {
     client.shell({ term: 'xterm-256color', cols: size.cols, rows: size.rows }, (error, stream) => {
       if (error !== undefined) {

package/src/engine.ts

@@ -14,6 +14,7 @@ import {
   disposeRecord,
   sweepPool,
   type EngineOptions,
+  type KeyboardInteractiveHandler,
   type PoolRecord,
 } from './engine/connection-pool.ts'
 import { openShell, type ShellSession } from './engine/pty.ts'
@@ -21,7 +22,7 @@ import { download, ls, upload } from './engine/sftp.ts'
 import { listTunnels, startTunnel, stopAllTunnels, stopTunnel, type TunnelRecord } from './engine/tunnel.ts'
 import { cluster } from './engine/cluster.ts'
 
-export type { EngineOptions } from './engine/connection-pool.ts'
+export type { EngineOptions, KeyboardInteractiveHandler } from './engine/connection-pool.ts'
 export type { ShellSession } from './engine/pty.ts'
 export type { PoolRecord } from './engine/connection-pool.ts'
 export type { TunnelRecord } from './engine/tunnel.ts'
@@ -92,8 +93,12 @@ export class SshEngine {
   // -------------------------------------------------------------- shell
 
   /** Open a PTY shell session for the web terminal (standalone connection). */
-  async openShell(alias: string, size: { cols: number; rows: number }): Promise<ShellSession> {
-    return openShell(this, alias, size)
+  async openShell(
+    alias: string,
+    size: { cols: number; rows: number },
+    onKeyboardInteractive?: KeyboardInteractiveHandler,
+  ): Promise<ShellSession> {
+    return openShell(this, alias, size, onKeyboardInteractive)
   }
 
   // -------------------------------------------------------------- sftp

package/src/index.ts

@@ -9,7 +9,7 @@
  */
 
 import type { Context } from '@deepseek-ai/cordis'
-import { installSettingsSection, settingsNamespace } from '@deepseek-ai/dsh-settings'
+import type { SettingsNamespace } from '@deepseek-ai/dsh-settings'
 import z from 'schemastery'
 import type {} from '@deepseek-ai/dsh-host-webserver'
 import type {} from '@deepseek-ai/dsh-system-prompt'
@@ -31,7 +31,7 @@ export const inject = ['webServer', 'tools', 'systemPrompt']
  * surface edits. Spelled here rather than imported: the browser half spells
  * the same value and must not depend on a Host package.
  */
-export const SSH_SETTINGS_NAMESPACE = settingsNamespace('dsh-ssh')
+export const SSH_SETTINGS_NAMESPACE = 'dsh-ssh' as SettingsNamespace
 
 /** Plugin config, validated by the same-named schemastery schema. */
 export interface Config {
@@ -77,18 +77,28 @@ function applyImpl(ctx: Context, config?: Config): void {
   // The live source the surfaces read: the settings section once the web
   // settings surface is served, the composition entry otherwise.
   let current: () => Config = () => config ?? {}
+  let isSettingsBound = false
+
+  const store = new HostStore()
+  const engine = new SshEngine(store)
+  ctx.effect(() => () => { engine.dispose() }, 'dsh-ssh: engine')
+
   const resolve = (): Config => {
     const value = current()
+    let enabled = value.enabled ?? true
+    // When dsh-ssh was seeded with enabled: false (e.g. from an aggregate profile line),
+    // but the user has never explicitly configured settings (not bound yet)
+    // AND already has active host records in dsh-ssh.json, keep the plugin enabled so
+    // existing users are not broken upon upgrade (#1250).
+    if (enabled === false && !isSettingsBound && store.list().length > 0) {
+      enabled = true
+    }
     return {
       announceToAgent: value.announceToAgent ?? DEFAULT_ANNOUNCE,
-      enabled: value.enabled ?? true,
+      enabled,
     }
   }
 
-  const store = new HostStore()
-  const engine = new SshEngine(store)
-  ctx.effect(() => () => { engine.dispose() }, 'dsh-ssh: engine')
-
   // The /api/dsh-ssh route family + terminal upgrade.
   const { routes, upgrade } = makeRoutes({ store, engine })
   let disposeRoutes: (() => void) | undefined
@@ -152,15 +162,18 @@ function applyImpl(ctx: Context, config?: Config): void {
     )
   }
 
-  installSettingsSection(ctx, SSH_SETTINGS_NAMESPACE, Config, config ?? {}, {
-    setSource: (source) => {
-      current = source
-      sync()
-    },
-    onChange: sync,
+  ctx.inject(['settings'], (settingsCtx) => {
+    settingsCtx.settings.installSection(ctx, SSH_SETTINGS_NAMESPACE, Config, config ?? {}, {
+      setSource: (source) => {
+        isSettingsBound = true
+        current = source
+        sync()
+      },
+      onChange: sync,
+    })
   })
 
   // Initial registration from the composition entry (covers deployments with
-  // no settings service, whose installSettingsSection never fires its hooks).
+  // no settings service, whose installSection never fires its hooks).
   sync()
 }

package/src/protocol.ts

@@ -167,10 +167,17 @@ export type TerminalServerFrame =
   | { type: 'ready'; alias: string }
   | { type: 'output'; data: string }
   | { type: 'exit'; code: number | null; error?: string }
+  | {
+      type: 'auth_prompt'
+      name: string
+      instructions: string
+      prompts: Array<{ prompt: string; echo: boolean }>
+    }
 
 export type TerminalClientFrame =
   | { type: 'input'; data: string }
   | { type: 'resize'; cols: number; rows: number }
+  | { type: 'auth_response'; responses: string[] }
 
 /** Route paths the client calls (shared literals). */
 export const SSH_API_BASE = '/api/dsh-ssh' as const

package/src/routes.ts

@@ -15,7 +15,7 @@ import { tmpdir } from 'node:os'
 import { randomBytes } from 'node:crypto'
 import { WebSocket, WebSocketServer } from 'ws'
 import type { WebRoute, WebUpgradeRoute } from '@deepseek-ai/dsh-host-webserver'
-import type { SshEngine, ShellSession } from './engine.ts'
+import type { SshEngine, ShellSession, KeyboardInteractiveHandler } from './engine.ts'
 import { readJsonBody, writeJson } from './http.ts'
 import { isLoopbackRequest } from './loopback.ts'
 import { SSH_API, type HostPayload, type TerminalClientFrame, type TerminalServerFrame } from './protocol.ts'
@@ -466,6 +466,7 @@ const maxUploadBytes = deps.maxUploadBytes ?? MAX_UPLOAD_BYTES
         let session: ShellSession | undefined
         let closed = false
         let paused = false
+        let pendingAuthFinish: ((responses: string[]) => void) | undefined
         // Resume the shell once the socket's send buffer drains below the
         // low-water mark (transport backpressure).
         const resume = (): void => {
@@ -483,14 +484,38 @@ const maxUploadBytes = deps.maxUploadBytes ?? MAX_UPLOAD_BYTES
           }
         }
         const closeSession = (): void => {
+          if (pendingAuthFinish !== undefined) {
+            const fn = pendingAuthFinish
+            pendingAuthFinish = undefined
+            try { fn([]) } catch { /* ignore */ }
+          }
           const opened = session
           session = undefined
           if (opened !== undefined) opened.close()
         }
+
+        const onKeyboardInteractive: KeyboardInteractiveHandler = (name, instructions, _lang, prompts, finish) => {
+          const entry = store.find(alias)
+          // Auto-answer password if configured and prompt is a password request
+          if (entry?.auth.kind === 'password' && entry.auth.password !== undefined && prompts.length > 0 && prompts.every(p => /password/i.test(p.prompt))) {
+            const password = entry.auth.password
+            finish(prompts.map(() => password))
+            return
+          }
+          // Interactive 2FA prompt sent to the client terminal
+          pendingAuthFinish = finish
+          sendFrame({
+            type: 'auth_prompt',
+            name,
+            instructions,
+            prompts: prompts.map(p => ({ prompt: p.prompt, echo: p.echo })),
+          })
+        }
+
         engine.openShell(alias, {
           cols: Number.isFinite(cols) ? cols : 80,
           rows: Number.isFinite(rows) ? rows : 24,
-        }).then((opened) => {
+        }, onKeyboardInteractive).then((opened) => {
           if (ws.readyState !== WebSocket.OPEN) {
             opened.close()
             return
@@ -519,6 +544,12 @@ const maxUploadBytes = deps.maxUploadBytes ?? MAX_UPLOAD_BYTES
             session?.send(frame.data)
           } else if (frame.type === 'resize') {
             session?.resize(Math.max(2, frame.cols), Math.max(1, frame.rows))
+          } else if (frame.type === 'auth_response') {
+            if (pendingAuthFinish !== undefined) {
+              const fn = pendingAuthFinish
+              pendingAuthFinish = undefined
+              fn(frame.responses)
+            }
           }
         })
         ws.on('close', () => {