dsh-app-deploy 0.2.0 → 0.3.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-app-deploy",
-  "version": "0.2.0",
-  "description": "DSH 插件：按环境编排并执行 Gradle 构建、rsync 同步与 SSH 远程命令的部署面板，实时推送日志并保留执行记录。",
+  "version": "0.3.0",
+  "description": "DSH 插件：按环境编排并执行构建（Gradle/Maven/前端）、多 SSH 目标发布、rsync/rclone 同步与远程命令的部署面板，支持连接测试，实时推送日志并保留执行记录。",
   "repository": "btboys/dsh-app-deploy",
   "type": "module",
   "icon": "./icon.svg",

package/server/config.js

@@ -11,22 +11,57 @@ let envs = []
 const MODULE_NAME = { bsFront: 'bs 前端', bsServer: 'bs 服务端', adminFront: 'admin 前端', adminServer: 'admin 服务端' }
 const MODULE_ORDER = ['bsFront', 'bsServer', 'adminFront', 'adminServer']
 
+// 旧 gradle 三字段（gradleTask/key/extraArgs）拼接为通用构建命令
+function cmdFromGradle(g, key, extra) {
+  return ['./gradlew', g, key ? `-Pkey=${key}` : '', extra || ''].filter(Boolean).join(' ')
+}
+
 function defaultModules() {
   return [
-    { id: 'bsFront', name: 'bs 前端', kind: 'front', enabled: true, gradleTask: 'client:client-front:dist', key: '', extraArgs: '', localPath: 'client/client-front/dist/', remotePath: '', postCommand: '', frontEnv: '' },
-    { id: 'bsServer', name: 'bs 服务端', kind: 'server', enabled: true, gradleTask: 'client:client-server:bootJar', key: '', extraArgs: '', localPath: 'client/client-server/build/libs/financial-v5.jar', remotePath: '', postCommand: '', frontEnv: '' },
-    { id: 'adminFront', name: 'admin 前端', kind: 'front', enabled: true, gradleTask: 'admin:admin-front:dist', key: '', extraArgs: '', localPath: 'admin/admin-front/dist/', remotePath: '', postCommand: '', frontEnv: '' },
-    { id: 'adminServer', name: 'admin 服务端', kind: 'server', enabled: true, gradleTask: 'admin:admin-server:bootJar', key: '', extraArgs: '', localPath: 'admin/admin-server/build/libs/financial-admin-v5.jar', remotePath: '', postCommand: '', frontEnv: '' },
+    { id: 'bsFront', name: 'bs 前端', kind: 'front', enabled: true, buildCmd: './gradlew client:client-front:dist', localPath: 'client/client-front/dist/', remotePath: '', postCommand: '', frontEnv: '' },
+    { id: 'bsServer', name: 'bs 服务端', kind: 'server', enabled: true, buildCmd: './gradlew client:client-server:bootJar', localPath: 'client/client-server/build/libs/financial-v5.jar', remotePath: '', postCommand: '', frontEnv: '' },
+    { id: 'adminFront', name: 'admin 前端', kind: 'front', enabled: true, buildCmd: './gradlew admin:admin-front:dist', localPath: 'admin/admin-front/dist/', remotePath: '', postCommand: '', frontEnv: '' },
+    { id: 'adminServer', name: 'admin 服务端', kind: 'server', enabled: true, buildCmd: './gradlew admin:admin-server:bootJar', localPath: 'admin/admin-server/build/libs/financial-admin-v5.jar', remotePath: '', postCommand: '', frontEnv: '' },
   ]
 }
 
+function defaultSsh() {
+  return { id: 'default', name: '默认', host: '', port: 22, user: 'root', password: '', keyFile: '', options: '' }
+}
+
 function templateEnv() {
-  return { id: '', name: '', note: '', group: '', projectPath: defaultProjectPath, jdkHome: '', expTime: '', ssh: { host: '', port: 22, user: 'root', password: '', options: '' }, modules: defaultModules() }
+  return { id: '', name: '', note: '', group: '', projectPath: defaultProjectPath, jdkHome: '', nodeHome: '', nodeOptions: '', pmPath: '', buildEnv: '', expTime: '', sshs: [defaultSsh()], modules: defaultModules() }
 }
 
 // 把 modules 归一化为数组；record 旧格式自动转数组（id 保持 bsFront 等，name 映射），frontEnv.bs/admin 迁移进对应 front 模块
 function isNewSchema(e) {
-  return !!e && typeof e === 'object' && !!e.ssh && typeof e.ssh === 'object'
+  return !!e && typeof e === 'object' && ((!!e.ssh && typeof e.ssh === 'object') || Array.isArray(e.sshs))
+}
+
+function normalizeSsh(raw, i) {
+  return {
+    id: String(raw?.id || (i === 0 ? 'default' : 'ssh' + (i + 1))),
+    name: String(raw?.name || (i === 0 ? '默认' : 'SSH ' + (i + 1))),
+    host: String(raw?.host ?? ''),
+    port: Number(raw?.port) || 22,
+    user: String(raw?.user ?? 'root'),
+    password: String(raw?.password ?? ''),
+    keyFile: String(raw?.keyFile ?? ''),
+    options: String(raw?.options ?? ''),
+  }
+}
+
+// SSH 目标列表：旧格式 env.ssh 单对象自动迁移为单元素数组
+function toSshArray(e) {
+  if (Array.isArray(e?.sshs) && e.sshs.length) return e.sshs.map(normalizeSsh)
+  if (e?.ssh && typeof e.ssh === 'object') return [normalizeSsh(e.ssh, 0)]
+  return [defaultSsh()]
+}
+
+// 模块的发布目标：sshId 为空或不存在时回落到第一个目标
+export function targetFor(env, m) {
+  const list = Array.isArray(env?.sshs) && env.sshs.length ? env.sshs : [defaultSsh()]
+  return list.find((s) => s.id === m?.sshId) || list[0]
 }
 
 // 把 modules 归一化为数组；record 旧格式自动转数组（id 保持 bsFront 等，name 映射），frontEnv.bs/admin 迁移进对应 front 模块
@@ -41,9 +76,8 @@ function toModArray(mods, fe) {
         name: String(raw?.name || MODULE_NAME[id] || id),
         kind: (raw?.kind === 'server' ? 'server' : raw?.kind === 'front' ? 'front' : (id.endsWith('Front') ? 'front' : 'server')),
         enabled: raw?.enabled !== false,
-        gradleTask: String(raw?.gradleTask || ''),
-        key: String(raw?.key || ''),
-        extraArgs: String(raw?.extraArgs || ''),
+        buildCmd: String(raw?.buildCmd || cmdFromGradle(raw?.gradleTask, raw?.key, raw?.extraArgs)),
+        sshId: String(raw?.sshId || ''),
         localPath: String(raw?.localPath || ''),
         remotePath: String(raw?.remotePath || ''),
         postCommand: String(raw?.postCommand || ''),
@@ -59,7 +93,8 @@ function toModArray(mods, fe) {
       out.push({
         id: mk, name: MODULE_NAME[mk] || mk, kind: mk.endsWith('Front') ? 'front' : 'server',
         enabled: m.enabled !== false,
-        gradleTask: String(m.gradleTask || ''), key: String(m.key || ''), extraArgs: String(m.extraArgs || ''),
+        buildCmd: String(m.buildCmd || cmdFromGradle(m.gradleTask, m.key, m.extraArgs)),
+        sshId: String(m.sshId || ''),
         localPath: String(m.localPath || ''), remotePath: String(m.remotePath || ''), postCommand: String(m.postCommand || ''),
         frontEnv: feText,
       })
@@ -74,19 +109,23 @@ function normalizeEnv(e) {
     group: e.group ?? '',
     projectPath: e.projectPath || defaultProjectPath,
     jdkHome: e.jdkHome ?? '',
+    nodeHome: e.nodeHome ?? '',
+    nodeOptions: e.nodeOptions ?? '',
+    pmPath: e.pmPath ?? '',
+    buildEnv: e.buildEnv ?? '',
     expTime: e.expTime ?? '',
-    ssh: { host: e.ssh?.host ?? '', port: Number(e.ssh?.port) || 22, user: e.ssh?.user ?? 'root', password: e.ssh?.password ?? '', options: e.ssh?.options ?? '' },
+    sshs: toSshArray(e),
     modules: toModArray(e.modules, { bs: e.frontEnv?.bs, admin: e.frontEnv?.admin }),
   }
-  // 迁移（幂等）：把 server 模块 extraArgs 里的 -PexpTime=xxx 提取到 env.expTime 并从 extraArgs 移除
+  // 迁移（幂等）：把 server 模块构建命令里的 -PexpTime=xxx 提取到 env.expTime 并移除
   let extracted = ''
   for (const m of env.modules) {
-    if (m.kind !== 'server' || !m.extraArgs) continue
-    const kept = m.extraArgs.trim().split(/\s+/).filter(p => {
+    if (m.kind !== 'server' || !m.buildCmd) continue
+    const kept = m.buildCmd.trim().split(/\s+/).filter(p => {
       if (p.startsWith('-PexpTime=')) { if (!extracted) extracted = p.slice(10); return false }
       return true
     })
-    m.extraArgs = kept.join(' ')
+    m.buildCmd = kept.join(' ')
   }
   if (extracted && !env.expTime) env.expTime = extracted
   return env
@@ -105,7 +144,8 @@ async function loadEnvs() {
   for (const e of raw) {
     if (isNewSchema(e)) {
       const r = e
-      if (!Array.isArray(r.modules) || r.modules.some(m => m?.extraArgs?.toString().includes('-PexpTime='))) migrated = true
+      if (!Array.isArray(r.modules) || r.modules.some(m => m && (m.gradleTask !== undefined || m.extraArgs?.toString().includes('-PexpTime=')))) migrated = true
+      if (!Array.isArray(r.sshs)) migrated = true // env.ssh 单对象 → sshs 数组
       out.push(normalizeEnv(r))
       continue
     }
@@ -156,9 +196,8 @@ export function validateFrontEnv(s) {
 export function frontEnvFile(e, m) {
   const p = (e.projectPath || defaultProjectPath || '').replace(/[\\/]+$/, '')
   if (!p) return null
-  const key = m.key ? '.' + m.key : ''
-  if (m.id === 'bsFront') return path.join(p, 'client/client-front', `.env${key}`)
-  if (m.id === 'adminFront') return path.join(p, 'admin/admin-front', `.env${key}`)
+  if (m.id === 'bsFront') return path.join(p, 'client/client-front', '.env')
+  if (m.id === 'adminFront') return path.join(p, 'admin/admin-front', '.env')
   return null
 }
 
@@ -171,12 +210,32 @@ export function validateEnv(e) {
   if (BAD_PATH.test(e.projectPath)) errs.push('项目路径含非法字符（禁止空格/引号/; & | ` $ 等）')
   if (e.jdkHome && !isAbsPath(e.jdkHome)) errs.push('JDK 路径必须是绝对路径')
   if (e.jdkHome && BAD_PATH.test(e.jdkHome)) errs.push('JDK 路径含非法字符')
-  const s = e.ssh
-  if (!/^[a-zA-Z0-9.-]+$/.test(s.host)) errs.push('SSH host 非法（仅字母/数字/./-）')
-  if (!Number.isInteger(s.port) || s.port < 1 || s.port > 65535) errs.push('SSH port 必须是 1-65535 的整数')
-  if (!/^[a-zA-Z0-9._-]+$/.test(s.user)) errs.push('SSH user 非法')
-  if (BAD_CMD.test(s.options)) errs.push('SSH 自定义选项含非法字符')
-  if (s.password.includes('\n')) errs.push('SSH 密码不能包含换行')
+  if (e.nodeHome && !isAbsPath(e.nodeHome)) errs.push('Node 路径必须是绝对路径')
+  if (e.nodeHome && BAD_PATH.test(e.nodeHome)) errs.push('Node 路径含非法字符')
+  if (e.nodeOptions && BAD_CMD.test(e.nodeOptions)) errs.push('Node options 含非法字符')
+  if (e.pmPath && !isAbsPath(e.pmPath)) errs.push('包管理器路径必须是绝对路径（如 /opt/homebrew/bin/pnpm）')
+  if (e.pmPath && BAD_PATH.test(e.pmPath)) errs.push('包管理器路径含非法字符')
+  if (e.buildEnv) {
+    const be = validateFrontEnv(e.buildEnv)
+    if (be) errs.push('构建环境变量：' + be)
+  }
+  const sshList = Array.isArray(e.sshs) && e.sshs.length ? e.sshs : []
+  if (!sshList.length) errs.push('至少需要一个 SSH 目标')
+  const seenSshId = {}
+  for (const s of sshList) {
+    const tag = s.name || s.id
+    if (!/^[A-Za-z0-9-]+$/.test(s.id)) errs.push(`SSH 目标「${tag}」: ID 只能包含字母/数字/连字符`)
+    else if (seenSshId[s.id]) errs.push(`SSH 目标「${tag}」: ID「${s.id}」重复`)
+    seenSshId[s.id] = true
+    if (!s.name.trim()) errs.push('SSH 目标显示名必填')
+    if (!/^[a-zA-Z0-9.-]+$/.test(s.host)) errs.push(`SSH 目标「${tag}」: host 非法（仅字母/数字/./-）`)
+    if (!Number.isInteger(s.port) || s.port < 1 || s.port > 65535) errs.push(`SSH 目标「${tag}」: port 必须是 1-65535 的整数`)
+    if (!/^[a-zA-Z0-9._-]+$/.test(s.user)) errs.push(`SSH 目标「${tag}」: user 非法`)
+    if (BAD_CMD.test(s.options)) errs.push(`SSH 目标「${tag}」: 自定义选项含非法字符`)
+    if (s.password.includes('\n')) errs.push(`SSH 目标「${tag}」: 密码不能包含换行`)
+    if (s.keyFile && !isAbsPath(s.keyFile)) errs.push(`SSH 目标「${tag}」: 私钥路径必须是绝对路径`)
+    if (s.keyFile && BAD_PATH.test(s.keyFile)) errs.push(`SSH 目标「${tag}」: 私钥路径含非法字符`)
+  }
   if (e.expTime && !/^\d{4}-\d{2}-\d{2}$/.test(e.expTime)) errs.push('过期时间必须是 YYYY-MM-DD')
   if (!Array.isArray(e.modules) || !e.modules.length) errs.push('至少需要一个模块')
   const seenId = {}
@@ -197,9 +256,9 @@ export function validateEnv(e) {
       } catch { errs.push(`${m.name || m.id}: 健康检查 URL 必须是 HTTP/HTTPS 地址，且不能包含用户名或密码`) }
     }
     if (!m.enabled) continue
-    if (!/^[a-zA-Z0-9:_-]+$/.test(m.gradleTask)) errs.push(`${m.name || m.id}: gradle 任务非法`)
-    if (m.key && !/^[a-zA-Z0-9._-]+$/.test(m.key)) errs.push(`${m.name || m.id}: -Pkey 非法`)
-    if (m.extraArgs && BAD_CMD.test(m.extraArgs)) errs.push(`${m.name || m.id}: 额外参数含非法字符`)
+    if (m.sshId && !sshList.some((s) => s.id === m.sshId)) errs.push(`${m.name || m.id}: SSH 目标「${m.sshId}」不存在`)
+    if (!m.buildCmd.trim()) errs.push(`${m.name || m.id}: 构建命令必填（如 ./gradlew …、mvn …、npm run build）`)
+    else if (BAD_CMD.test(m.buildCmd)) errs.push(`${m.name || m.id}: 构建命令含非法字符（禁止引号/; & | \` $ 等）`)
     if (!m.localPath) errs.push(`${m.name || m.id}: 本地产物路径必填`)
     else if (BAD_PATH.test(m.localPath)) errs.push(`${m.name || m.id}: 本地产物路径含非法字符`)
     if (!m.remotePath) errs.push(`${m.name || m.id}: 远程目标路径必填`)

package/server/deployment.js

@@ -1,7 +1,7 @@
 import { spawn } from 'node:child_process'
-import { promises as fsp } from 'node:fs'
+import { promises as fsp, existsSync } from 'node:fs'
 import path from 'node:path'
-import { getEnvs } from './config.js'
+import { getEnvs, targetFor } from './config.js'
 import { getHistory, saveHistory, LOGTAIL_CHARS } from './history.js'
 import { listWorktrees, which, rcloneObscure } from './local-tools.js'
 import { checkHealth } from './health-check.js'
@@ -79,10 +79,54 @@ function runStep(label, args, opts = {}) {
   })
 }
 
+// 测试 SSH 连通性：BatchMode 禁止交互询问（密码仍走 sshpass），10 秒超时；返回 { ok, ms?, error? }
+export async function testSsh(target) {
+  if (!/^[a-zA-Z0-9.-]+$/.test(target.host || '')) return { ok: false, error: 'host 非法' }
+  if (!/^[a-zA-Z0-9._-]+$/.test(target.user || '')) return { ok: false, error: 'user 非法' }
+  const port = Number(target.port) || 22
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return { ok: false, error: 'port 非法' }
+  const args = ['-p', String(port), '-o', 'ConnectTimeout=8', '-o', 'StrictHostKeyChecking=accept-new']
+  // BatchMode 禁止交互询问，但会同时禁掉密码提示导致 sshpass 失效——仅无密码（密钥/agent）时使用
+  if (!target.password) args.push('-o', 'BatchMode=yes')
+  if (target.keyFile) args.push('-i', target.keyFile)
+  if (target.options) args.push(...String(target.options).trim().split(/\s+/).filter(Boolean))
+  args.push(`${target.user}@${target.host}`, 'true')
+  let cmd = 'ssh', cargs = args, env = process.env
+  if (target.password) {
+    if (!(await which('sshpass'))) return { ok: false, error: '本机未安装 sshpass，无法以密码测试（留空密码改用密钥/agent 测试）' }
+    cmd = 'sshpass'
+    cargs = ['-e', 'ssh', ...args]
+    env = { ...process.env, SSHPASS: target.password }
+  }
+  const start = Date.now()
+  return new Promise((resolve) => {
+    let child
+    try {
+      child = spawn(cmd, cargs, { env, shell: IS_WIN, stdio: ['ignore', 'ignore', 'pipe'] })
+    } catch (err) {
+      return resolve({ ok: false, error: String(err) })
+    }
+    let errOut = ''
+    const timer = setTimeout(() => {
+      child.kill()
+      resolve({ ok: false, error: '连接超时（10s）' })
+    }, 10000)
+    child.stderr.on('data', (c) => { errOut += c.toString('utf8') })
+    child.once('error', (err) => { clearTimeout(timer); resolve({ ok: false, error: String(err) }) })
+    child.once('close', (code) => {
+      clearTimeout(timer)
+      if (code === 0) resolve({ ok: true, ms: Date.now() - start })
+      else resolve({ ok: false, error: (errOut.trim().split('\n').pop() || `退出码 ${code}`).slice(0, 300) })
+    })
+  })
+}
+
 // 部署结束后尽力停掉 Gradle daemon：daemon 是常驻 JVM（默认空闲 3 小时才退出），
 // 多次构建复用后类加载器/缓存累积会把堆耗尽（报 "Daemon will expire ... running out of JVM heap space"）。
 // 无 daemon 时 --stop 也返回 0；任何失败都忽略，不影响部署结果。
 async function stopGradleDaemon(env) {
+  // 非 gradle 项目没有 wrapper，跳过（也避免误播"已停止"）
+  if (!existsSync(path.join(env.projectPath, IS_WIN ? 'gradlew.bat' : 'gradlew'))) return
   try {
     const stopEnv = env.jdkHome ? { ...process.env, JAVA_HOME: env.jdkHome } : process.env
     await new Promise((resolve) => {
@@ -178,35 +222,54 @@ async function cleanBuildDir(env, m) {
 
 // 组装 rclone 同步参数（SFTP 后端）：sync 自带 --delete 用于前端镜像，copy 不删用于服务端；
 // 密码用 obscure 混淆值（只进 spawn 参数，不进日志标签）；密钥取 SSH 自定义选项里的 -i
-export function buildRcloneArgs(env, m, local, rclone) {
+export function buildRcloneArgs(target, m, local, rclone) {
   const isFront = m.kind === 'front'
   const args = [isFront ? 'sync' : 'copy', local, `:sftp:${m.remotePath}`,
-    '--sftp-host', env.ssh.host, '--sftp-port', String(env.ssh.port), '--sftp-user', env.ssh.user,
+    '--sftp-host', target.host, '--sftp-port', String(target.port), '--sftp-user', target.user,
     '--stats-one-line', '--stats', '10s', '-v']
   if (isFront) args.push('--exclude', '.user.ini') // 宝塔锁定文件；exclude 同时豁免 sync 的删除
-  if (rclone.pass) args.push('--sftp-pass', rclone.pass)
-  const key = (env.ssh.options || '').match(/(?:^|\s)-i\s+(\S+)/)
-  if (!rclone.pass && key) args.push('--sftp-key-file', key[1])
+  // 密码：优先按目标密码查 obscure 缓存（多目标部署），否则用调用方直接给的 pass
+  const pass = (rclone.cache && target.password) ? rclone.cache.get(target.password) : rclone.pass
+  if (pass) args.push('--sftp-pass', pass)
+  // 私钥：专用 keyFile 字段优先，兼容旧的 options 里 -i 写法
+  const key = target.keyFile || ((target.options || '').match(/(?:^|\s)-i\s+(\S+)/) || [])[1]
+  // 与 ssh/rsync 路径行为一致：私钥可与密码同时存在（rclone 自身会依次尝试）
+  if (key) args.push('--sftp-key-file', key)
   return args
 }
 
 // 返回退出码与失败阶段（清理/构建/同步/远程命令），用于执行记录
 // rclone 非空时用 rclone（SFTP）替代 rsync 同步；rsyncEnv 同时承载 sshpass 的 SSHPASS
-export async function deployModule(env, m, sshBase, dest, sshpass, rclone = null) {
+// target 为模块选中的 SSH 目标（env.sshs 之一）
+export async function deployModule(env, m, target, sshpass, rclone = null) {
+  const sshBase = `ssh -p ${target.port}${target.keyFile ? ' -i ' + target.keyFile : ''}${target.options ? ' ' + target.options : ''}`
+  const dest = `${target.user}@${target.host}`
   // 0. 清理构建目录（恢复原 update-*.sh 行为）
   const c0 = await cleanBuildDir(env, m)
   if (c0 !== 0) return { code: c0, step: '清理' }
 
-  // 1. 构建
-  const buildArgs = [GRADLEW, m.gradleTask]
-  if (m.key) buildArgs.push(`-Pkey=${m.key}`)
-  if (m.extraArgs) buildArgs.push(...m.extraArgs.trim().split(/\s+/).filter(Boolean))
-  if (m.kind === 'server' && env.expTime) buildArgs.push(`-PexpTime=${env.expTime}`)
-  const jdkNote = env.jdkHome ? `（JAVA_HOME=${env.jdkHome}）` : ''
-  const envForGradle = env.jdkHome ? { ...process.env, JAVA_HOME: env.jdkHome } : { ...process.env }
-  // 前端模块：把 frontEnv（KEY=VALUE 多行）注入子进程 env；Vite loadEnv 对 process.env 中 VITE_ 前缀变量优先级最高，会覆盖 .env 文件
-  if (m.kind === 'front') {
-    for (const line of (m.frontEnv || '').split('\n')) {
+  // 1. 构建：通用命令（./gradlew…/mvn…/npm run build…），按空白切分；校验已禁引号与 shell 元字符，无需 shell 拼接
+  const buildArgs = m.buildCmd.trim().split(/\s+/).filter(Boolean)
+  // Windows 上 ./gradlew 无法经 cmd 解析，回退为 gradlew.bat
+  if (IS_WIN && buildArgs[0] === './gradlew') buildArgs[0] = 'gradlew.bat'
+  if (m.kind === 'server' && env.expTime && buildArgs[0].includes('gradle')) buildArgs.push(`-PexpTime=${env.expTime}`)
+  const jdkNote = [env.jdkHome ? `JAVA_HOME=${env.jdkHome}` : '', env.nodeHome ? `Node=${env.nodeHome}` : ''].filter(Boolean).join('，')
+  const noteSuffix = jdkNote ? `（${jdkNote}）` : ''
+  const envForGradle = { ...process.env }
+  if (env.jdkHome) envForGradle.JAVA_HOME = env.jdkHome
+  if (env.nodeHome) {
+    // nodeHome 允许指向安装目录或 bin 目录；加入 PATH 后 npm/npx/node 均可用
+    const bin = /[\\/]bin$/.test(env.nodeHome) ? env.nodeHome : path.join(env.nodeHome, 'bin')
+    envForGradle.PATH = `${bin}${IS_WIN ? ';' : ':'}${envForGradle.PATH || ''}`
+  }
+  if (env.pmPath) {
+    // 包管理器（pnpm/yarn 全局 bin 常在 Node 目录之外）：所在目录加入 PATH 首位
+    envForGradle.PATH = `${path.dirname(env.pmPath)}${IS_WIN ? ';' : ':'}${envForGradle.PATH || ''}`
+  }
+  if (env.nodeOptions) envForGradle.NODE_OPTIONS = env.nodeOptions
+  // 注入 KEY=VALUE 行到构建子进程 env；先环境级 buildEnv，后模块级 frontEnv（后者覆盖前者）
+  const injectEnv = (text) => {
+    for (const line of (text || '').split('\n')) {
       const t = line.trim()
       if (!t || t.startsWith('#')) continue
       const eq = t.indexOf('=')
@@ -215,7 +278,10 @@ export async function deployModule(env, m, sshBase, dest, sshpass, rclone = null
       if (/^[A-Za-z0-9_]+$/.test(k)) envForGradle[k] = v
     }
   }
-  const c1 = await runStep(`[${m.name}] 构建: ${buildArgs.join(' ')} ${jdkNote}`, buildArgs, { cwd: env.projectPath, env: envForGradle, shell: IS_WIN })
+  injectEnv(env.buildEnv)
+  // 前端模块：frontEnv 注入；Vite loadEnv 对 process.env 中 VITE_ 前缀变量优先级最高，会覆盖 .env 文件
+  if (m.kind === 'front') injectEnv(m.frontEnv)
+  const c1 = await runStep(`[${m.name}] 构建: ${buildArgs.join(' ')} ${noteSuffix}`, buildArgs, { cwd: env.projectPath, env: envForGradle, shell: IS_WIN })
   if (c1 !== 0) { broadcast(`[${m.name}] 构建失败，退出码 ${c1}，中止部署\n`); return { code: c1, step: '构建' } }
 
   // 2. 同步：优先 rsync；本机没有时回退 rclone（--delete 仅用于前端模块，与原脚本行为一致）
@@ -224,10 +290,10 @@ export async function deployModule(env, m, sshBase, dest, sshpass, rclone = null
   const isDirLike = /[\\/]$/.test(m.localPath)
   const joined = path.isAbsolute(m.localPath) ? m.localPath : path.join(env.projectPath, m.localPath)
   const local = joined.replace(/[\\/]+$/, '') + (isDirLike ? '/' : '')
-  const rsyncEnv = sshpass ? { ...process.env, SSHPASS: env.ssh.password } : process.env
+  const rsyncEnv = sshpass ? { ...process.env, SSHPASS: target.password } : process.env
   let c2
   if (rclone) {
-    const args = buildRcloneArgs(env, m, local, rclone)
+    const args = buildRcloneArgs(target, m, local, rclone)
     c2 = await runStep(`[${m.name}] rclone ${isFront ? 'sync' : 'copy'} ${local} → :sftp:${m.remotePath}${isFront ? '（镜像 --delete）' : ''}`, [rclone.bin, ...args], {})
   } else {
     const rsyncArgs = ['rsync', '-r', '-t', '-z', '-e', sshpass ? `sshpass -e ${sshBase}` : sshBase]
@@ -241,8 +307,9 @@ export async function deployModule(env, m, sshBase, dest, sshpass, rclone = null
   if (m.postCommand.trim()) {
     const sshArgs = []
     if (sshpass) sshArgs.push('sshpass', '-e')
-    sshArgs.push('ssh', '-p', String(env.ssh.port))
-    if (env.ssh.options) sshArgs.push(...env.ssh.options.trim().split(/\s+/).filter(Boolean))
+    sshArgs.push('ssh', '-p', String(target.port))
+    if (target.keyFile) sshArgs.push('-i', target.keyFile)
+    if (target.options) sshArgs.push(...target.options.trim().split(/\s+/).filter(Boolean))
     sshArgs.push(dest, m.postCommand.trim())
     const c3 = await runStep(`[${m.name}] 远程执行: ${m.postCommand.trim()}`, sshArgs, { env: rsyncEnv })
     if (c3 !== 0) { broadcast(`[${m.name}] 远程命令失败，退出码 ${c3}，中止部署\n`); return { code: c3, step: '远程命令' } }
@@ -261,11 +328,13 @@ async function runDeployment(env, mods) {
     const hasRsync = await which('rsync')
     const rcloneBin = hasRsync ? null : await which('rclone')
     const needSsh = mods.some(m => m.enabled && m.postCommand.trim())
+    // 每个启用的模块按其 sshId 解析发布目标（env.sshs 之一）
+    const usedTargets = [...new Set(mods.filter(m => m.enabled).map(m => targetFor(env, m)))]
     const missing = []
     if (!hasRsync && !rcloneBin) missing.push('rsync（或 rclone）')
     if ((hasRsync || needSsh) && !(await which('ssh'))) missing.push('ssh')
     // sshpass：rsync 密码传输恒需要；rclone 模式自身支持密码，仅「密码 + 远程命令」时才需要
-    const needSshpass = !!env.ssh.password && (hasRsync || needSsh)
+    const needSshpass = usedTargets.some(t => t.password) && (hasRsync || needSsh)
     const sshpass = needSshpass ? await which('sshpass') : null
     if (missing.length) {
       broadcast(`错误: 本机未找到 ${missing.join('、')}（须在 PATH 中）。${IS_WIN ? 'Windows 可安装 rclone 替代 rsync（https://rclone.org），ssh 用系统自带 OpenSSH' : '请先安装 rsync（或 rclone）与 OpenSSH'}\n`)
@@ -276,23 +345,26 @@ async function runDeployment(env, mods) {
         : '错误: 配置了 SSH 密码但本机没有 sshpass。请先安装: brew install hudochenkov/sshpass/sshpass\n')
       code = 127
     } else {
-      const sshBase = `ssh -p ${env.ssh.port}${env.ssh.options ? ' ' + env.ssh.options : ''}`
-      const dest = `${env.ssh.user}@${env.ssh.host}`
-      // rclone 密码认证走 obscure 混淆值（失败立即中止，避免到同步步骤才报错）
+      // rclone 密码认证走 obscure 混淆值（按密码缓存，多目标各自处理；失败立即中止）
+      const passCache = new Map()
       let rclone = null
       if (rcloneBin) {
-        const pass = env.ssh.password ? await rcloneObscure(rcloneBin, env.ssh.password) : null
-        if (env.ssh.password && !pass) {
-          broadcast('错误: rclone obscure 密码处理失败，无法使用密码认证\n')
-          code = 127
-          return finishDeploy(code) // 尚未构建，无需停 daemon
-        }
-        rclone = { bin: rcloneBin, pass }
+        rclone = { bin: rcloneBin, pass: null, cache: passCache }
       }
       code = 0
       for (const m of mods) {
         if (!m.enabled) { broadcast(`[跳过] ${m.name} 已禁用\n`); continue }
-        const res = await deployModule(env, m, sshBase, dest, sshpass, rclone)
+        const target = targetFor(env, m)
+        if (rclone && target.password && !passCache.has(target.password)) {
+          const pass = await rcloneObscure(rcloneBin, target.password)
+          if (!pass) {
+            broadcast(`错误: rclone obscure 密码处理失败（目标 ${target.name}），无法使用密码认证\n`)
+            code = 127
+            break
+          }
+          passCache.set(target.password, pass)
+        }
+        const res = await deployModule(env, m, target, target.password ? sshpass : null, rclone)
         if (res.code !== 0) {
           if (running?.record) { running.record.failedModule = m.name; running.record.failedStep = res.step }
           code = res.code
@@ -332,7 +404,9 @@ export async function handleDeploy(req, res, url) {
   const ordered = env.modules.filter(m => m.enabled && want.has(m.id))
   const mods = orderIds.map(id => ordered.find(m => m.id === id)).filter(m => !!m)
   if (!mods.length) return bad('所选模块在环境中均不可用或已禁用')
-  if (!env.ssh.host || !env.ssh.user) return bad('SSH 配置不完整')
+  // 所选模块涉及的 SSH 目标都必须有 host/user
+  const runTargets = [...new Set(mods.map(m => targetFor(env, m)))]
+  if (runTargets.some(t => !t.host || !t.user)) return bad('SSH 目标配置不完整')
 
   const sseHeaders = { 'content-type': 'text/event-stream', 'cache-control': 'no-cache' }
   const lastEventId = req.headers['last-event-id']

package/server/local-tools.js

@@ -160,10 +160,77 @@ export async function listJdks() {
   return out.sort((a, b) => a.label.localeCompare(b.label))
 }
 
+// 探测本机包管理器可执行文件（npm/pnpm/yarn），返回 [{label, path}]，path 为可执行文件路径
+export async function listPackageManagers() {
+  const home = process.env.HOME || process.env.USERPROFILE || ''
+  const exts = IS_WIN ? ['.exe', '.cmd', '.ps1', ''] : ['']
+  const candidates = []
+  const tryBin = async (dir, name) => {
+    for (const ext of exts) {
+      const p = path.join(dir, name + ext)
+      if (await fileExists(p)) { candidates.push({ label: name, path: p }); return }
+    }
+  }
+  // PATH 中的（which 返回可执行文件全路径）
+  for (const name of ['npm', 'pnpm', 'yarn']) {
+    const w = await which(name).catch(() => '')
+    if (w) candidates.push({ label: name, path: w })
+  }
+  // pnpm/yarn 全局 bin 的常见固定位置（不经 PATH）
+  if (home) {
+    await tryBin(path.join(home, '.local/share/pnpm'), 'pnpm')
+    await tryBin(path.join(home, '.volta/bin'), 'pnpm')
+    await tryBin(path.join(home, '.volta/bin'), 'yarn')
+  }
+  await tryBin('/opt/homebrew/bin', 'pnpm')
+  await tryBin('/usr/local/bin', 'pnpm')
+  await tryBin('/opt/homebrew/bin', 'yarn')
+  // 去重（同路径只留一个）
+  const seen = new Set()
+  return candidates.filter((c) => (seen.has(c.path) ? false : (seen.add(c.path), true)))
+}
+
+// 探测本机已装 Node（nvm / n / fnm / volta / nvm-windows），返回 [{label, path}]，path 为版本目录（含 bin/node）
+export async function listNodes() {
+  const found = new Set()
+  const home = process.env.HOME || process.env.USERPROFILE || ''
+  const scan = async (base) => {
+    try { for (const n of await fsp.readdir(base)) found.add(path.join(base, n)) } catch {}
+  }
+  if (home) {
+    await scan(path.join(home, '.nvm/versions/node'))
+    await scan(path.join(home, '.local/share/fnm/node-versions'))
+    await scan(path.join(home, '.volta/tools/image/node'))
+  }
+  await scan('/usr/local/n/versions/node')
+  await scan('/usr/lib/n/versions/node')
+  if (IS_WIN && process.env.NVM_HOME) await scan(process.env.NVM_HOME)
+  const binName = IS_WIN ? 'node.exe' : 'node'
+  const out = []
+  for (const p of found) {
+    // 支持 <dir>/bin/node、<dir>/node.exe（nvm-windows）、<dir>/installation/bin/node（fnm）
+    for (const cand of [p, path.join(p, 'installation')]) {
+      if (await fileExists(path.join(cand, 'bin', binName)) || await fileExists(path.join(cand, binName))) {
+        const label = path.basename(cand).replace(/^v/, '')
+        out.push({ label, path: cand })
+        break
+      }
+    }
+  }
+  // 版本号倒序，新者在前
+  out.sort((a, b) => b.label.localeCompare(a.label, undefined, { numeric: true }))
+  return out
+}
+
 // 目录浏览：非法/不可读抛出错误，由 RPC 层转成 ok:false
 export async function browseDirectory(args = {}) {
   let p = typeof args.path === 'string' ? args.path : ''
   const showHidden = args.hidden === true || args.hidden === '1' || args.hidden === 1
+  const pickFile = args.file === true || args.file === '1' || args.file === 1
+  // 展开 ~/（私钥选择等场景直接从 ~/.ssh 起步）
+  if (p === '~' || p.startsWith('~/') || p.startsWith('~\\')) {
+    p = path.join(process.env.HOME || process.env.USERPROFILE || '/', p.slice(2))
+  }
   if (!p) p = process.env.HOME || (IS_WIN ? (process.env.USERPROFILE || 'C:\\') : '/')
   if (!path.isAbsolute(p)) throw new Error('必须为绝对路径')
   p = path.resolve(p)
@@ -173,7 +240,10 @@ export async function browseDirectory(args = {}) {
     const dirs = entries.filter(d => d.isDirectory() && (showHidden || !d.name.startsWith('.'))).map(d => d.name).sort().slice(0, 200)
     // 若当前目录属于 git 仓库（含子目录/任意 worktree），列出全部 worktree 供前端切换
     const worktrees = await listWorktrees(p)
-    return { path: p, parent, dirs, worktrees }
+    const out = { path: p, parent, dirs, worktrees }
+    // 文件选择模式（如私钥）：额外列出普通文件
+    if (pickFile) out.files = entries.filter(d => d.isFile() && (showHidden || !d.name.startsWith('.'))).map(d => d.name).sort().slice(0, 200)
+    return out
   } catch {
     throw new Error('目录不可读')
   }

package/server/rpc.js

@@ -1,8 +1,8 @@
 import { promises as fsp } from 'node:fs'
 import { getEnvs, saveEnvs, normalizeEnv, isNewSchema, templateEnv, validateEnv, frontEnvFile, getDefaultProjectPath } from './config.js'
 import { getHistory, replaceHistory, HIST_LIMIT } from './history.js'
-import { activeRecord } from './deployment.js'
-import { listJdks, listWorktrees, readGitInfo, browseDirectory, which } from './local-tools.js'
+import { activeRecord, testSsh } from './deployment.js'
+import { listJdks, listNodes, listPackageManagers, listWorktrees, readGitInfo, browseDirectory, which } from './local-tools.js'
 
 // sshpass 无 Windows 版本；警告文案按平台给出可操作的下一步（保存/导入两处共用）
 const SSHPASS_HINT = process.platform === 'win32'
@@ -31,7 +31,7 @@ const methods = {
     if (i >= 0) envs[i] = env; else envs.push(env)
     await saveEnvs()
     let warning = ''
-    if (env.ssh.password && !(await which('sshpass'))) {
+    if ((env.sshs || []).some(s => s.password) && !(await which('sshpass'))) {
       warning = '已保存，' + SSHPASS_HINT
     }
     return { envs: getEnvs(), warning }
@@ -72,7 +72,7 @@ const methods = {
     await saveEnvs(order.map(id => byId.get(id)))
     const touched = new Set([...added, ...overwritten])
     let warning = ''
-    if (getEnvs().some(e => touched.has(e.id) && e.ssh.password) && !(await which('sshpass'))) {
+    if (getEnvs().some(e => touched.has(e.id) && (e.sshs || []).some(s => s.password)) && !(await which('sshpass'))) {
       warning = '已导入，' + SSHPASS_HINT
     }
     return { envs: getEnvs(), added, overwritten, warning }
@@ -89,6 +89,13 @@ const methods = {
     try { return { text: await fsp.readFile(p, 'utf8') } } catch { return { text: '' } }
   },
   jdks: () => listJdks(),
+  nodes: () => listNodes(),
+  packageManagers: () => listPackageManagers(),
+  // 测试 SSH 连通性：target 直接用表单当前值（无需先保存环境）
+  sshTest: async ({ target } = {}) => {
+    if (!target || typeof target !== 'object') throw new Error('缺少测试目标')
+    return testSsh(target)
+  },
   browse: (args) => browseDirectory(args ?? {}),
   git: async ({ env: id, path: sel } = {}) => {
     const e = getEnvs().find(x => x.id === id)