agent-ssh-cli 0.1.1 → 0.1.3

package/README.md

@@ -12,7 +12,7 @@
   <a href="https://nodejs.org/"><img src="https://img.shields.io/badge/Node.js-%3E%3D18-339933?logo=node.js&logoColor=white" alt="Node.js >=18"></a>
   <a href="https://www.npmjs.com/"><img src="https://img.shields.io/badge/npm-%3E%3D8-CB3837?logo=npm&logoColor=white" alt="npm >=8"></a>
   <a href="https://github.com/sleepinginsummer/agent-ssh-cli"><img src="https://img.shields.io/badge/Windows-MacOS-0078D6?labelColor=0078D6&color=C0C0C0" alt="Windows/MacOS"></a>
-  <a href="https://github.com/sleepinginsummer/agent-ssh-cli/releases"><img src="https://img.shields.io/badge/release-v0.1.0-blue" alt="release v0.1.0"></a>
+  <a href="https://github.com/sleepinginsummer/agent-ssh-cli/releases"><img src="https://img.shields.io/badge/release-v0.1.3-blue" alt="release v0.1.3"></a>
   <a href="https://github.com/sleepinginsummer/agent-ssh-cli/pulls"><img src="https://img.shields.io/badge/PRs-welcome-brightgreen" alt="PRs welcome"></a>
 </p>
 
@@ -153,6 +153,12 @@ agentsshcli list
 
 ## 卸载和清理
 
+更新到最新版：
+
+```bash
+npm install -g agent-ssh-cli@latest
+```
+
 ```bash
 npm uninstall -g agent-ssh-cli
 npm cache clean --force

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-ssh-cli",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "基于 CLI 的 SSH 代理工具，按 ssh-mcp-server 的能力一一映射",
   "type": "module",
   "engines": {

package/src/config.js

@@ -6,6 +6,7 @@ import { fileURLToPath } from "node:url";
 
 const DEFAULT_CONFIG_DIR = ".agent-ssh-cli";
 const DEFAULT_CONFIG_FILE = "config.json";
+const configCache = new Map();
 
 function isNonEmptyString(value) {
   return typeof value === "string" && value.trim() !== "";
@@ -23,7 +24,10 @@ function ensureRegexArray(patterns, fieldName, index) {
       throw new Error(`ssh-config.json 第 ${index + 1} 项的 ${fieldName} 必须只包含非空字符串`);
     }
     try {
-      return new RegExp(pattern), pattern;
+      return {
+        pattern,
+        regex: new RegExp(pattern)
+      };
     } catch (error) {
       throw new Error(`ssh-config.json 第 ${index + 1} 项的 ${fieldName} 含有非法正则: ${pattern}，${error.message}`);
     }
@@ -110,7 +114,13 @@ export function getDefaultConfigPath() {
 }
 
 export function loadConfig(configPath = getDefaultConfigPath()) {
-  const raw = fs.readFileSync(configPath, "utf8");
+  const resolvedConfigPath = path.resolve(configPath);
+  const stat = fs.statSync(resolvedConfigPath);
+  const cached = configCache.get(resolvedConfigPath);
+  if (cached && cached.mtimeMs === stat.mtimeMs && cached.size === stat.size) {
+    return cached.configs;
+  }
+  const raw = fs.readFileSync(resolvedConfigPath, "utf8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -131,6 +141,11 @@ export function loadConfig(configPath = getDefaultConfigPath()) {
     }
     seenNames.add(config.name);
   }
+  configCache.set(resolvedConfigPath, {
+    mtimeMs: stat.mtimeMs,
+    size: stat.size,
+    configs
+  });
   return configs;
 }
 

package/src/daemon-client.js

@@ -39,8 +39,8 @@ function connectSocket(socketPath, timeoutMs = DAEMON_REQUEST_TIMEOUT_MS) {
   });
 }
 
-function spawnDaemon(socketPath) {
-  const child = spawn(process.execPath, [getDaemonEntryPath(), "--socket", socketPath], {
+function spawnDaemon(socketPath, configPath) {
+  const child = spawn(process.execPath, [getDaemonEntryPath(), "--socket", socketPath, "--config", path.resolve(configPath)], {
     detached: true,
     stdio: "ignore"
   });
@@ -63,7 +63,7 @@ async function waitForDaemon(socketPath) {
   throw new Error(`启动 SSH 缓存进程失败: ${lastError?.message || "未知错误"}`);
 }
 
-async function ensureDaemon(socketPath) {
+async function ensureDaemon(socketPath, configPath) {
   try {
     const socket = await connectSocket(socketPath, 500);
     socket.end();
@@ -76,13 +76,13 @@ async function ensureDaemon(socketPath) {
       unlinkSocketPath(socketPath);
     }
   }
-  spawnDaemon(socketPath);
+  spawnDaemon(socketPath, configPath);
   await waitForDaemon(socketPath);
 }
 
 export async function requestDaemon(configPath, request) {
   const socketPath = getSocketPath(configPath);
-  await ensureDaemon(socketPath);
+  await ensureDaemon(socketPath, configPath);
   const socket = await connectSocket(socketPath);
   socket.setEncoding("utf8");
 

package/src/ssh-client.js

@@ -1,12 +1,39 @@
 import fs from "node:fs";
+import net from "node:net";
+import { pipeline } from "node:stream/promises";
 import { Client } from "ssh2";
 
+const SOCKS5_VERSION = 0x05;
+const SOCKS5_CONNECT_COMMAND = 0x01;
+const SOCKS5_RESERVED = 0x00;
+const SOCKS5_AUTH_NONE = 0x00;
+const SOCKS5_AUTH_PASSWORD = 0x02;
+const SOCKS5_AUTH_UNACCEPTABLE = 0xff;
+const SOCKS5_ADDRESS_IPV4 = 0x01;
+const SOCKS5_ADDRESS_DOMAIN = 0x03;
+const SOCKS5_ADDRESS_IPV6 = 0x04;
+const SOCKS5_REPLY_SUCCESS = 0x00;
+
+function getCompiledPattern(pattern, label) {
+  if (pattern instanceof RegExp) {
+    return pattern;
+  }
+  if (pattern?.regex instanceof RegExp) {
+    return pattern.regex;
+  }
+  try {
+    return new RegExp(pattern?.pattern || pattern);
+  } catch (error) {
+    throw new Error(`${label} 正则非法: ${pattern?.pattern || pattern}，${error.message}`);
+  }
+}
+
 function compilePatterns(patterns, label) {
   return (patterns || []).map((pattern) => {
     try {
-      return new RegExp(pattern);
+      return getCompiledPattern(pattern, label);
     } catch (error) {
-      throw new Error(`${label} 正则非法: ${pattern}，${error.message}`);
+      throw new Error(error.message);
     }
   });
 }
@@ -23,12 +50,201 @@ export function validateCommand(connection, command) {
   }
 }
 
-function createConnectConfig(connection) {
+function parseSocksProxy(proxy) {
+  const value = proxy.includes("://") ? proxy : `socks5://${proxy}`;
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch (error) {
+    throw new Error(`socksProxy 格式非法: ${proxy}，${error.message}`);
+  }
+  if (parsed.protocol !== "socks5:") {
+    throw new Error("socksProxy 仅支持 socks5:// 协议");
+  }
+  if (!parsed.hostname || !parsed.port) {
+    throw new Error("socksProxy 必须包含代理主机和端口");
+  }
+  const port = Number(parsed.port);
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+    throw new Error("socksProxy 端口非法");
+  }
+  const username = decodeURIComponent(parsed.username);
+  const password = decodeURIComponent(parsed.password);
+  if ((username && !password) || (!username && password)) {
+    throw new Error("socksProxy 用户名和密码必须同时提供");
+  }
+  return {
+    host: parsed.hostname,
+    port,
+    username: username || undefined,
+    password: password || undefined
+  };
+}
+
+function readExactly(socket, length) {
+  return new Promise((resolve, reject) => {
+    let buffer = Buffer.alloc(0);
+    const cleanup = () => {
+      socket.removeListener("data", onData);
+      socket.removeListener("error", onError);
+      socket.removeListener("close", onClose);
+    };
+    const onError = (error) => {
+      cleanup();
+      reject(error);
+    };
+    const onClose = () => {
+      cleanup();
+      reject(new Error("SOCKS5 代理连接提前关闭"));
+    };
+    const onData = (chunk) => {
+      buffer = Buffer.concat([buffer, chunk]);
+      if (buffer.length < length) {
+        return;
+      }
+      const result = buffer.subarray(0, length);
+      const rest = buffer.subarray(length);
+      cleanup();
+      if (rest.length > 0) {
+        socket.unshift(rest);
+      }
+      resolve(result);
+    };
+    socket.on("data", onData);
+    socket.once("error", onError);
+    socket.once("close", onClose);
+  });
+}
+
+function writeAll(socket, data) {
+  return new Promise((resolve, reject) => {
+    socket.write(data, (error) => {
+      if (error) {
+        reject(error);
+        return;
+      }
+      resolve();
+    });
+  });
+}
+
+function connectTcp(host, port) {
+  return new Promise((resolve, reject) => {
+    const socket = net.createConnection({ host, port });
+    const cleanup = () => {
+      socket.removeListener("error", onError);
+    };
+    const onError = (error) => {
+      cleanup();
+      reject(error);
+    };
+    socket.once("connect", () => {
+      cleanup();
+      resolve(socket);
+    });
+    socket.once("error", onError);
+  });
+}
+
+function encodeTargetAddress(host) {
+  const ipVersion = net.isIP(host);
+  if (ipVersion === 4) {
+    return Buffer.concat([Buffer.from([SOCKS5_ADDRESS_IPV4]), Buffer.from(host.split(".").map(Number))]);
+  }
+  const hostBuffer = Buffer.from(host, "utf8");
+  if (hostBuffer.length > 255) {
+    throw new Error("SOCKS5 目标主机名过长");
+  }
+  return Buffer.concat([Buffer.from([SOCKS5_ADDRESS_DOMAIN, hostBuffer.length]), hostBuffer]);
+}
+
+async function authenticateSocksProxy(socket, proxyConfig) {
+  const methods = proxyConfig.username ? [SOCKS5_AUTH_PASSWORD] : [SOCKS5_AUTH_NONE];
+  await writeAll(socket, Buffer.from([SOCKS5_VERSION, methods.length, ...methods]));
+  const response = await readExactly(socket, 2);
+  if (response[0] !== SOCKS5_VERSION) {
+    throw new Error("SOCKS5 代理响应版本非法");
+  }
+  if (response[1] === SOCKS5_AUTH_UNACCEPTABLE) {
+    throw new Error("SOCKS5 代理不接受当前认证方式");
+  }
+  if (response[1] === SOCKS5_AUTH_NONE) {
+    return;
+  }
+  if (response[1] !== SOCKS5_AUTH_PASSWORD || !proxyConfig.username) {
+    throw new Error("SOCKS5 代理返回了不支持的认证方式");
+  }
+  const usernameBuffer = Buffer.from(proxyConfig.username, "utf8");
+  const passwordBuffer = Buffer.from(proxyConfig.password, "utf8");
+  if (usernameBuffer.length > 255 || passwordBuffer.length > 255) {
+    throw new Error("SOCKS5 用户名或密码过长");
+  }
+  await writeAll(socket, Buffer.concat([
+    Buffer.from([0x01, usernameBuffer.length]),
+    usernameBuffer,
+    Buffer.from([passwordBuffer.length]),
+    passwordBuffer
+  ]));
+  const authResponse = await readExactly(socket, 2);
+  if (authResponse[1] !== 0x00) {
+    throw new Error("SOCKS5 代理认证失败");
+  }
+}
+
+async function readSocksConnectResponse(socket) {
+  const header = await readExactly(socket, 4);
+  if (header[0] !== SOCKS5_VERSION) {
+    throw new Error("SOCKS5 代理响应版本非法");
+  }
+  if (header[1] !== SOCKS5_REPLY_SUCCESS) {
+    throw new Error(`SOCKS5 代理连接目标失败，响应码 ${header[1]}`);
+  }
+  if (header[2] !== SOCKS5_RESERVED) {
+    throw new Error("SOCKS5 代理响应保留字段非法");
+  }
+  if (header[3] === SOCKS5_ADDRESS_IPV4) {
+    await readExactly(socket, 4);
+  } else if (header[3] === SOCKS5_ADDRESS_IPV6) {
+    await readExactly(socket, 16);
+  } else if (header[3] === SOCKS5_ADDRESS_DOMAIN) {
+    const length = (await readExactly(socket, 1))[0];
+    await readExactly(socket, length);
+  } else {
+    throw new Error("SOCKS5 代理响应地址类型非法");
+  }
+  await readExactly(socket, 2);
+}
+
+async function connectSocksProxy(connection) {
+  const proxyConfig = parseSocksProxy(connection.socksProxy);
+  const socket = await connectTcp(proxyConfig.host, proxyConfig.port);
+  try {
+    await authenticateSocksProxy(socket, proxyConfig);
+    const targetAddress = encodeTargetAddress(connection.host);
+    const targetPort = Buffer.alloc(2);
+    targetPort.writeUInt16BE(connection.port);
+    await writeAll(socket, Buffer.concat([
+      Buffer.from([SOCKS5_VERSION, SOCKS5_CONNECT_COMMAND, SOCKS5_RESERVED]),
+      targetAddress,
+      targetPort
+    ]));
+    await readSocksConnectResponse(socket);
+    return socket;
+  } catch (error) {
+    socket.destroy();
+    throw error;
+  }
+}
+
+async function createConnectConfig(connection) {
   const connectConfig = {
     host: connection.host,
     port: connection.port,
     username: connection.username
   };
+  if (connection.socksProxy) {
+    connectConfig.sock = await connectSocksProxy(connection);
+  }
   if (connection.agent) {
     connectConfig.agent = connection.agent;
   } else if (connection.privateKey) {
@@ -46,7 +262,7 @@ function createConnectConfig(connection) {
 
 export async function connectSshClient(connection) {
   const client = new Client();
-  const connectConfig = createConnectConfig(connection);
+  const connectConfig = await createConnectConfig(connection);
   await new Promise((resolve, reject) => {
     client.once("ready", resolve);
     client.once("error", reject);
@@ -77,17 +293,28 @@ export async function executeRemoteCommandWithClient(client, connection, remoteC
     let exitCode;
     let exitSignal;
     let settled = false;
-    const timer = setTimeout(() => {
+    let commandStream;
+    const settle = (callback, value) => {
+      if (settled) {
+        return;
+      }
       settled = true;
-      reject(new Error(`命令执行超时，超过 ${timeout}ms`));
+      clearTimeout(timer);
+      callback(value);
+    };
+    const timer = setTimeout(() => {
+      if (commandStream) {
+        commandStream.close();
+      }
+      settle(reject, new Error(`命令执行超时，超过 ${timeout}ms`));
     }, timeout);
 
     client.exec(remoteCommand, { pty: connection.pty ?? true }, (err, stream) => {
       if (err) {
-        clearTimeout(timer);
-        reject(err);
+        settle(reject, err);
         return;
       }
+      commandStream = stream;
 
       stream.on("data", (chunk) => {
         stdout += chunk.toString();
@@ -100,11 +327,9 @@ export async function executeRemoteCommandWithClient(client, connection, remoteC
         exitSignal = signal;
       });
       stream.on("close", (code, signal) => {
-        clearTimeout(timer);
         if (settled) {
           return;
         }
-        settled = true;
         exitCode = exitCode ?? code;
         exitSignal = exitSignal ?? signal;
         if ((exitCode ?? 0) !== 0 || exitSignal) {
@@ -121,18 +346,13 @@ export async function executeRemoteCommandWithClient(client, connection, remoteC
           if (exitSignal) {
             parts.push(`[signal] ${exitSignal}`);
           }
-          reject(new Error(parts.join("\n") || "命令执行失败"));
+          settle(reject, new Error(parts.join("\n") || "命令执行失败"));
           return;
         }
-        resolve(stdout.trimEnd());
+        settle(resolve, stdout.trimEnd());
       });
       stream.on("error", (streamError) => {
-        clearTimeout(timer);
-        if (settled) {
-          return;
-        }
-        settled = true;
-        reject(streamError);
+        settle(reject, streamError);
       });
     });
   });
@@ -143,37 +363,20 @@ export async function uploadFile(connection, localPath, remotePath) {
 }
 
 export async function uploadFileWithClient(client, localPath, remotePath) {
-  return new Promise((resolve, reject) => {
+  const sftp = await new Promise((resolve, reject) => {
     client.sftp((err, sftp) => {
       if (err) {
         reject(err);
         return;
       }
-      const readStream = fs.createReadStream(localPath);
-      const writeStream = sftp.createWriteStream(remotePath);
-      let closed = false;
-      const cleanup = () => {
-        if (!closed) {
-          closed = true;
-          sftp.end();
-        }
-      };
-
-      readStream.on("error", (readError) => {
-        cleanup();
-        reject(readError);
-      });
-      writeStream.on("error", (writeError) => {
-        cleanup();
-        reject(writeError);
-      });
-      writeStream.on("close", () => {
-        cleanup();
-        resolve();
-      });
-      readStream.pipe(writeStream);
+      resolve(sftp);
     });
   });
+  try {
+    await pipeline(fs.createReadStream(localPath), sftp.createWriteStream(remotePath));
+  } finally {
+    sftp.end();
+  }
 }
 
 export async function downloadFile(connection, remotePath, localPath) {
@@ -181,35 +384,18 @@ export async function downloadFile(connection, remotePath, localPath) {
 }
 
 export async function downloadFileWithClient(client, remotePath, localPath) {
-  return new Promise((resolve, reject) => {
+  const sftp = await new Promise((resolve, reject) => {
     client.sftp((err, sftp) => {
       if (err) {
         reject(err);
         return;
       }
-      const readStream = sftp.createReadStream(remotePath);
-      const writeStream = fs.createWriteStream(localPath);
-      let closed = false;
-      const cleanup = () => {
-        if (!closed) {
-          closed = true;
-          sftp.end();
-        }
-      };
-
-      readStream.on("error", (readError) => {
-        cleanup();
-        reject(readError);
-      });
-      writeStream.on("error", (writeError) => {
-        cleanup();
-        reject(writeError);
-      });
-      writeStream.on("close", () => {
-        cleanup();
-        resolve();
-      });
-      readStream.pipe(writeStream);
+      resolve(sftp);
     });
   });
+  try {
+    await pipeline(sftp.createReadStream(remotePath), fs.createWriteStream(localPath));
+  } finally {
+    sftp.end();
+  }
 }

package/src/ssh-daemon.js

@@ -19,15 +19,22 @@ let lastActivityAt = Date.now();
 let exitTimer;
 let server;
 let socketPath;
+let boundConfigPath;
 
 function parseArgs(argv) {
   const socketIndex = argv.indexOf("--socket");
-  const value = socketIndex === -1 ? undefined : argv[socketIndex + 1];
-  if (!value) {
+  const configIndex = argv.indexOf("--config");
+  const parsedSocketPath = socketIndex === -1 ? undefined : argv[socketIndex + 1];
+  const configPath = configIndex === -1 ? undefined : argv[configIndex + 1];
+  if (!parsedSocketPath) {
     throw new Error("daemon 缺少 --socket 参数");
   }
+  if (!configPath) {
+    throw new Error("daemon 缺少 --config 参数");
+  }
   return {
-    socketPath: value
+    socketPath: parsedSocketPath,
+    configPath: path.resolve(configPath)
   };
 }
 
@@ -47,6 +54,7 @@ function buildConnectionKey(configPath, connection) {
     host: connection.host,
     port: connection.port,
     username: connection.username,
+    socksProxy: connection.socksProxy,
     auth
   });
   return crypto.createHash("sha256").update(raw).digest("hex");
@@ -141,13 +149,17 @@ async function runSerialized(entry, operation) {
 }
 
 async function executeRequest(request) {
+  const requestConfigPath = path.resolve(request.configPath);
+  if (requestConfigPath !== boundConfigPath) {
+    throw new Error("SSH 缓存进程拒绝访问非绑定配置文件");
+  }
   const ttlMs = normalizeCacheTtl(request.cacheTtlMs);
-  const configs = loadConfig(request.configPath);
+  const configs = loadConfig(boundConfigPath);
   const connection = findConnection(configs, request.connectionName);
   if (request.operation === "execute") {
     validateCommand(connection, request.command);
   }
-  const entry = await getPoolEntry(request.configPath, connection, ttlMs);
+  const entry = await getPoolEntry(boundConfigPath, connection, ttlMs);
 
   try {
     if (request.operation === "execute") {
@@ -221,7 +233,9 @@ function shutdown() {
 }
 
 try {
-  ({ socketPath } = parseArgs(process.argv.slice(2)));
+  const parsedArgs = parseArgs(process.argv.slice(2));
+  socketPath = parsedArgs.socketPath;
+  boundConfigPath = parsedArgs.configPath;
   unlinkSocketPath(socketPath);
   server = net.createServer(handleSocket);
   server.listen(socketPath, () => {