dsh-remote 0.7.5 → 0.8.2

package/lib/credential.js

@@ -0,0 +1,107 @@
+// dsh-remote — optional OS-keychain password storage.
+// Machines keep their password in the OS credential store instead of the
+// plaintext machines.json when the user enables "加密保存密码" per machine.
+// Every backend is best-effort: any failure resolves to {ok:false} and the
+// caller falls back to plaintext (the feature must never block connecting).
+//
+// Backends:
+//   darwin  → `security` (login keychain, generic password)
+//   win32   → DPAPI via PowerShell (CurrentUser scope), files under
+//             $DSH_HOME/remote-workspaces/.secrets/
+//   linux   → `secret-tool` (libsecret / gnome-keyring), optional
+//   else    → unsupported (plain)
+import { execFile } from 'node:child_process'
+import { mkdirSync, writeFileSync, readFileSync, unlinkSync } from 'node:fs'
+import { join as joinPath } from 'node:path'
+
+const SERVICE = 'dsh-remote'
+const TIMEOUT = 8000
+
+function run(bin, args, input) {
+  return new Promise((resolve, reject) => {
+    execFile(bin, args, { timeout: TIMEOUT, maxBuffer: 1 << 20, ...(input != null ? { input } : {}) }, (err, stdout, stderr) => {
+      if (err) return reject(err)
+      resolve(String(stdout || '').trim())
+    })
+  })
+}
+
+export function platformBackend() {
+  if (process.platform === 'darwin') return 'keychain'
+  if (process.platform === 'win32') return 'windows'
+  return 'secret' // linux (secret-tool may be absent → falls back)
+}
+
+function account(machineId) {
+  // Only machine ids are stored; sanitize just in case.
+  return String(machineId || '').replace(/[^a-zA-Z0-9._-]/g, '_')
+}
+
+/** Save a password to the OS store. Resolves {ok, backend} — ok:false on any
+ * failure (caller falls back to plaintext). */
+export async function saveSecret(machineId, password, secretsDir) {
+  const acc = account(machineId)
+  try {
+    if (process.platform === 'darwin') {
+      await run('security', ['add-generic-password', '-U', '-s', SERVICE, '-a', acc, '-w', String(password)])
+      return { ok: true, backend: 'keychain' }
+    }
+    if (process.platform === 'win32') {
+      // DPAPI-encrypt and store under the harness home.
+      const script =
+        `$p='${String(password).replace(/'/g, "''")}';` +
+        `$s=[System.Security.Cryptography.ProtectedData]::Protect([Text.Encoding]::UTF8.GetBytes($p),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);` +
+        `[Convert]::ToBase64String($s)`
+      const b64 = await run('powershell', ['-NoProfile', '-STA', '-Command', script])
+      if (!b64) return { ok: false, backend: 'windows' }
+      mkdirSync(secretsDir || '.', { recursive: true })
+      writeFileSync(joinPath(secretsDir || '.', acc + '.bin'), b64, 'utf8')
+      return { ok: true, backend: 'windows' }
+    }
+    if (process.platform === 'linux') {
+      await run('secret-tool', ['store', '--label=' + SERVICE, 'service', SERVICE, 'account', acc], String(password) + '\n')
+      return { ok: true, backend: 'secret' }
+    }
+  } catch { /* fall through */ }
+  return { ok: false, backend: platformBackend() }
+}
+
+/** Fetch a stored password. Resolves string|null. */
+export async function getSecret(machineId, secretsDir) {
+  const acc = account(machineId)
+  try {
+    if (process.platform === 'darwin') {
+      return await run('security', ['find-generic-password', '-s', SERVICE, '-a', acc, '-w'])
+    }
+    if (process.platform === 'win32') {
+      const b64 = readFileSync(joinPath(secretsDir || '.', acc + '.bin'), 'utf8').trim()
+      if (!b64) return null
+      const script =
+        `$s=[Convert]::FromBase64String('${b64}');` +
+        `[Text.Encoding]::UTF8.GetString([System.Security.Cryptography.ProtectedData]::Unprotect($s,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))`
+      return await run('powershell', ['-NoProfile', '-STA', '-Command', script])
+    }
+    if (process.platform === 'linux') {
+      return await run('secret-tool', ['lookup', 'service', SERVICE, 'account', acc])
+    }
+  } catch { /* fall through */ }
+  return null
+}
+
+/** Delete a stored password (idempotent). */
+export async function deleteSecret(machineId, secretsDir) {
+  const acc = account(machineId)
+  try {
+    if (process.platform === 'darwin') {
+      await run('security', ['delete-generic-password', '-s', SERVICE, '-a', acc]).catch(() => {})
+      return
+    }
+    if (process.platform === 'win32') {
+      try { unlinkSync(joinPath(secretsDir || '.', acc + '.bin')) } catch { /* absent */ }
+      return
+    }
+    if (process.platform === 'linux') {
+      await run('secret-tool', ['clear', 'service', SERVICE, 'account', acc]).catch(() => {})
+    }
+  } catch { /* best effort */ }
+}

package/lib/errors.js

@@ -0,0 +1,78 @@
+// dsh-remote — SSH/SFTP error classification → actionable hints.
+// Pure function so it is unit-testable and reused by tools, slash commands,
+// the test-connect route and the settings UI.
+
+/** Classify an error thrown by the ssh pool / sftp wrapper.
+ * @returns {{ category: 'auth'|'network'|'hostkey'|'timeout'|'sftp'|'credentials'|'other', hint: string, raw: string }}
+ */
+export function classifyError(err, opts = {}) {
+  const msg = String((err && err.message) || err || '')
+  const { host, port } = opts
+  const where = host ? ` (${host}:${port || 22})` : ''
+
+  if (/host key/i.test(msg) && /(change|mismatch|fingerprint|verify|unknown host)/i.test(msg)) {
+    return {
+      category: 'hostkey',
+      hint: `主机指纹校验失败${where}：可能遭遇中间人攻击，或该主机重装/更换过密钥。确认无异常后执行 /remote-forget-key 重新信任。`,
+      raw: msg,
+    }
+  }
+  if (/permission denied|all configured authentication methods failed|authentication failed/i.test(msg)) {
+    return {
+      category: 'auth',
+      hint: `认证失败${where}：检查用户名/密码/私钥路径，私钥是否设了 passphrase；若公司机器要求 OTP/动态码，请确认机器配置了 keyboard-interactive 或对应密码。`,
+      raw: msg,
+    }
+  }
+  if (/no credentials/i.test(msg)) {
+    return {
+      category: 'credentials',
+      hint: `缺少凭据：请设置 password 或 privateKeyPath（私钥只在显式提供时使用），或为该机器启用 SSH agent。`,
+      raw: msg,
+    }
+  }
+  if (/ENOTFOUND|EAI_AGAIN|getaddrinfo/i.test(msg)) {
+    return {
+      category: 'network',
+      hint: `主机不可达${where}：检查 host 拼写 / IP / DNS；内网机器可能需要走跳板机（配置 proxy）或 VPN。`,
+      raw: msg,
+    }
+  }
+  if (/ECONNREFUSED|connection refused/i.test(msg)) {
+    return {
+      category: 'network',
+      hint: `连接被拒绝${where}：确认端口 ${port || 22} 正确、远端 sshd 在监听；检查防火墙/安全组是否放行。`,
+      raw: msg,
+    }
+  }
+  if (/sftp operation timed out|sftp failed|readdir|writeFile|fastGet|fastPut/i.test(msg)) {
+    return {
+      category: 'sftp',
+      hint: `SFTP 操作失败：可能是远端磁盘/权限问题或服务器卡死（已自动超时保护）。检查目标路径权限。`,
+      raw: msg,
+    }
+  }
+  if (/ETIMEDOUT|timed out|timeout/i.test(msg)) {
+    return {
+      category: 'timeout',
+      hint: `连接/操作超时${where}：检查端口、防火墙、路由；或调大 connectTimeoutMs / commandTimeoutMs。`,
+      raw: msg,
+    }
+  }
+  if (/cannot read private key/i.test(msg)) {
+    return {
+      category: 'credentials',
+      hint: `无法读取私钥文件：检查 privateKeyPath 是否存在、当前用户是否有读取权限。`,
+      raw: msg,
+    }
+  }
+  return { category: 'other', hint: msg, raw: msg }
+}
+
+/** One-line friendly message: hint (+ raw when it adds information). */
+export function friendlyMessage(err, opts = {}) {
+  const c = classifyError(err, opts)
+  if (c.category === 'other') return c.raw
+  if (c.raw && c.raw !== c.hint) return `${c.hint}（原始错误：${c.raw}）`
+  return c.hint
+}

package/lib/forwards.js

@@ -0,0 +1,219 @@
+// dsh-remote — SSH port forwarding manager (local & reverse tunnels).
+//
+// Local forward: listen on 127.0.0.1:<listenPort> → every connection is
+// piped through the SSH channel to <targetHost>:<targetPort> on the remote.
+// Reverse forward: ask the remote to listen on 127.0.0.1:<listenPort> and pipe
+// incoming connections back to <targetHost>:<targetPort> on the LOCAL side
+// (ssh2 `forwardIn` + the client `tcpip` event; requires AllowTcpForwarding on
+// the remote sshd).
+//
+// Definitions persist in forwards.json; forwards become active only while the
+// SSH connection is up (auto-restart on connect when `autoStart: true`), and
+// every tunnel is torn down when the pool disconnects — reverse tunnels are
+// never auto-restarted (they would re-expose a local port without asking).
+import net from 'node:net'
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs'
+import path from 'node:path'
+
+export class ForwardManager {
+  /** @param {object} pool SshPool (needs .connect() returning the ssh2 client). */
+  constructor(pool, { file } = {}) {
+    this.pool = pool
+    this.file = file || null
+    this.defs = this._load()
+    this.servers = new Map() // id → { server | remoteListen, sockets:Set, client }
+    this.client = null
+    this.onTcpip = null
+    this.onClose = null
+    this.attach = this.attach.bind(this)
+  }
+
+  _load() {
+    if (!this.file) return []
+    try {
+      const j = JSON.parse(readFileSync(this.file, 'utf8'))
+      if (Array.isArray(j.defs)) return j.defs
+    } catch {}
+    return []
+  }
+
+  _save() {
+    if (!this.file) return
+    try {
+      mkdirSync(path.dirname(this.file), { recursive: true })
+      writeFileSync(this.file, JSON.stringify({ defs: this.defs }, null, 2))
+    } catch {}
+  }
+
+  /** Called by the pool after a successful connect: restore autoStart tunnels. */
+  attach(client) {
+    if (this.client === client) return
+    this.client = client
+    this.onTcpip = (info, accept, reject) => this._handleTcpip(info, accept, reject)
+    client.on('tcpip', this.onTcpip)
+    this.onClose = () => this.stopAll()
+    client.on('close', this.onClose)
+    for (const d of this.defs) {
+      if (d.autoStart && d.direction === 'local' && !this.servers.has(d.id)) {
+        this.start(d).catch(() => {})
+      }
+    }
+  }
+
+  detach() {
+    this.stopAll()
+    if (this.client) {
+      if (this.onTcpip) this.client.removeListener('tcpip', this.onTcpip)
+      if (this.onClose) this.client.removeListener('close', this.onClose)
+    }
+    this.client = null
+    this.onTcpip = null
+    this.onClose = null
+  }
+
+  list() {
+    return this.defs.map((d) => ({
+      id: d.id,
+      direction: d.direction,
+      listenPort: d.listenPort,
+      targetHost: d.targetHost,
+      targetPort: d.targetPort,
+      machineId: d.machineId || null,
+      autoStart: !!d.autoStart,
+      active: this.servers.has(d.id),
+    }))
+  }
+
+  _defId() {
+    return 'fwd-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2, 6)
+  }
+
+  /** Create a forward definition (persisted). Does NOT start it. */
+  define({ direction = 'local', listenPort, targetHost, targetPort, autoStart = false, machineId } = {}) {
+    const d = {
+      id: this._defId(),
+      direction: direction === 'reverse' ? 'reverse' : 'local',
+      listenPort: Number(listenPort),
+      targetHost: String(targetHost || '127.0.0.1'),
+      targetPort: Number(targetPort),
+      autoStart: !!autoStart,
+      machineId: machineId || null,
+    }
+    this.defs.push(d)
+    this._save()
+    return d
+  }
+
+  remove(id) {
+    this.stop(id)
+    const i = this.defs.findIndex((d) => d.id === id)
+    if (i >= 0) { this.defs.splice(i, 1); this._save(); return true }
+    return false
+  }
+
+  async start(def) {
+    const d = this.defs.find((x) => x.id === def.id) || def
+    if (this.servers.has(d.id)) return { ok: true, active: true }
+    let client = await this.pool.connect()
+    if (!this.client) this.attach(client)
+    if (this.client !== client) {
+      // The pool reconnected while we were connecting — retry on the live client.
+      client = this.client
+    }
+    try {
+      if (d.direction === 'reverse') {
+        await this._startReverse(d, client)
+      } else {
+        await this._startLocal(d, client)
+      }
+      return { ok: true, active: true }
+    } catch (err) {
+      return { ok: false, error: String((err && err.message) || err) }
+    }
+  }
+
+  _startLocal(d, client) {
+    return new Promise((resolve, reject) => {
+      const server = net.createServer((socket) => {
+        client.forwardOut('127.0.0.1', 0, d.targetHost, d.targetPort, (err, channel) => {
+          if (err) { socket.destroy(); return }
+          socket.pipe(channel)
+          channel.pipe(socket)
+          const kill = () => { try { socket.destroy() } catch {}; try { channel.close() } catch {} }
+          socket.on('error', kill)
+          channel.on('error', kill)
+          socket.on('close', kill)
+          channel.on('close', kill)
+        })
+      })
+      server.on('error', (e) => reject(new Error(`本地转发 ${d.listenPort} 启动失败: ${e.message}`)))
+      server.listen(d.listenPort, '127.0.0.1', () => {
+        this.servers.set(d.id, { kind: 'local', server, sockets: new Set(), client })
+        resolve()
+      })
+    })
+  }
+
+  _startReverse(d, client) {
+    return new Promise((resolve, reject) => {
+      // ssh2 calls the remote TCP listen API `forwardIn` (NOT openssh_forwardIn,
+      // which in ssh2 >= 1.16 is stream-local only).
+      if (typeof client.forwardIn !== 'function') {
+        return reject(new Error('此 ssh2 版本不支持反向转发 (forwardIn)'))
+      }
+      client.forwardIn('127.0.0.1', d.listenPort, (err) => {
+        if (err) return reject(new Error(`远端监听 ${d.listenPort} 失败: ${(err && err.message) || err}`))
+        this.servers.set(d.id, { kind: 'reverse', sockets: new Set(), client })
+        resolve()
+      })
+    })
+  }
+
+  _handleTcpip(info, accept, reject) {
+    for (const entry of this.servers.values()) {
+      if (entry.kind === 'reverse' && Number(info.destPort) === Number(this._defFor(entry).listenPort)) {
+        const channel = accept()
+        const socket = net.connect({ host: this._defFor(entry).targetHost, port: this._defFor(entry).targetPort })
+        socket.pipe(channel)
+        channel.pipe(socket)
+        entry.sockets.add(socket)
+        const kill = () => {
+          try { socket.destroy() } catch {}
+          try { channel.close() } catch {}
+          entry.sockets.delete(socket)
+        }
+        socket.on('error', kill)
+        channel.on('error', kill)
+        socket.on('close', kill)
+        return
+      }
+    }
+    reject()
+  }
+
+  _defFor(entry) {
+    for (const d of this.defs) {
+      if (this.servers.has(d.id) && this.servers.get(d.id) === entry) return d
+    }
+    return { listenPort: 0, targetHost: '127.0.0.1', targetPort: 0 }
+  }
+
+  stop(id) {
+    const entry = this.servers.get(id)
+    if (!entry) return
+    try {
+      if (entry.kind === 'local') {
+        entry.server.close()
+        for (const s of entry.sockets) { try { s.destroy() } catch {} }
+      } else if (entry.client && typeof entry.client.unforwardIn === 'function') {
+        const d = this._defFor(entry)
+        entry.client.unforwardIn('127.0.0.1', d.listenPort, () => {})
+      }
+    } catch {}
+    this.servers.delete(id)
+  }
+
+  stopAll() {
+    for (const id of [...this.servers.keys()]) this.stop(id)
+  }
+}

package/lib/hostkey.js

@@ -0,0 +1,48 @@
+// dsh-remote — host-key fingerprint helpers (TOFU). Pure functions split out
+// of lib/index.js so the ssh2 hostVerifier contract (raw Buffer blob since
+// ssh2 v1.17) is unit-tested against the REAL wire shape — the v0.6.7 bug
+// class ("mock object hid a contract drift") must not regress.
+import { createHash } from 'node:crypto'
+
+/**
+ * Extract the SSH host-key algorithm name from a raw SSH host-key blob
+ * (SSH wire format: `uint32 len` + algorithm string + key data).
+ */
+export function blobAlgorithm(blob) {
+  if (!Buffer.isBuffer(blob) || blob.length < 4) return ''
+  try {
+    const len = blob.readUInt32BE(0)
+    return blob.toString('utf8', 4, 4 + len)
+  } catch {
+    return ''
+  }
+}
+
+/**
+ * SHA-256 fingerprint (base64) of an ssh2 host-key blob, like `SHA256:…`
+ * in a known_hosts file (without the `SHA256:` prefix).
+ *
+ * ssh2 v1.17 passes hostVerifier the RAW host-key blob Buffer (the SSH
+ * wire-format `string(algo) string(keydata)`), NOT the old `{ algo, hash }`
+ * object. Fingerprinting `key.hash` on a raw Buffer crashed with "The 'data'
+ * argument must be of type string or an instance of Buffer…" on EVERY connect
+ * (v0.6.6 bug). Accept both shapes defensively.
+ */
+export function keyFingerprint(key) {
+  const blob = Buffer.isBuffer(key) ? key : (key && key.hash)
+  if (!blob) throw new Error('host key missing (hostVerifier received no key blob)')
+  return createHash('sha256').update(blob).digest('base64')
+}
+
+/** Build a fake-but-wire-shaped host-key blob for tests:
+ * `string(algo) string(32 bytes)`. */
+export function makeKeyBlob(algo, seed) {
+  const algoBuf = Buffer.from(algo, 'utf8')
+  const data = Buffer.alloc(32, seed || 1)
+  const blob = Buffer.alloc(4 + algoBuf.length + 4 + data.length)
+  blob.writeUInt32BE(algoBuf.length, 0)
+  algoBuf.copy(blob, 4)
+  blob.writeUInt32BE(data.length, 4 + algoBuf.length)
+  data.copy(blob, 8 + algoBuf.length)
+  return blob
+}

package/lib/ignore.js

@@ -0,0 +1,123 @@
+// dsh-remote — gitignore-style ignore matcher for mirror sync / remote search.
+import { readFileSync } from 'node:fs'
+//
+// Deliberately a SUBSET of gitignore semantics (documented, no surprises):
+//   - blank lines and `#` comments are skipped
+//   - `!` negation is NOT supported (later rules never un-ignore)
+//   - a trailing `/` matches directories only (and everything under them)
+//   - a pattern containing `/` (or starting with `/`) is anchored to the
+//     workspace root; otherwise it matches the basename at ANY depth
+//   - `*` matches any run of chars except `/`; `**` matches any run incl. `/`;
+//     `?` matches one char except `/`
+//   - character classes (`[abc]`) are not supported (treated literally)
+
+/** Convert one glob segment to a regex source (no `/` crossing). A leading
+ * double-star-slash (`**` + `/`) matches zero or more directories (gitignore). */
+function globToRe(glob) {
+  let out = ''
+  let i = 0
+  const s = String(glob)
+  if (s.startsWith('**/')) { out = '(?:.*/)?'; i = 3 }
+  while (i < s.length) {
+    const c = s[i]
+    if (c === '*') {
+      if (s[i + 1] === '*') { out += '.*'; i += 2; continue }
+      out += '[^/]*'; i++; continue
+    }
+    if (c === '?') { out += '[^/]'; i++; continue }
+    if ('\\^$+{}[]()|.'.includes(c)) out += '\\' + c
+    else out += c
+    i++
+  }
+  return out
+}
+
+/**
+ * Compile a list of ignore patterns into a matcher.
+ * @param {string[]|string} patterns lines or an array of lines
+ * @returns {(relPath: string, isDir?: boolean) => boolean} true = ignored.
+ *   `relPath` is POSIX-style ('/' separated, no leading '/').
+ */
+export function compileIgnore(patterns) {
+  const rules = []
+  const lines = Array.isArray(patterns) ? patterns : String(patterns || '').split('\n')
+  for (let raw of lines) {
+    let line = String(raw || '').trim()
+    if (!line || line.startsWith('#')) continue
+    let dirOnly = false
+    if (line.endsWith('/')) { dirOnly = true; line = line.slice(0, -1) }
+    let anchored = line.startsWith('/')
+    if (anchored) line = line.slice(1)
+    if (!line) continue
+    const hasSlash = line.includes('/')
+    const isAnchored = anchored || hasSlash
+    const segRe = globToRe(line)
+    let re
+    if (isAnchored) {
+      // Root-anchored: match the full path from the root.
+      re = dirOnly
+        ? new RegExp('^' + segRe + '(/.*)?$')
+        : new RegExp('^' + segRe + '$')
+    } else {
+      // Basename at any depth; a dir pattern also covers everything under it.
+      re = dirOnly
+        ? new RegExp('(^|/)' + segRe + '(/|$)')
+        : new RegExp('(^|/)' + segRe + '$')
+    }
+    rules.push({ re, dirOnly })
+  }
+  return function isIgnored(relPath, isDir) {
+    const rel = String(relPath || '').replace(/^\/+/, '').replace(/\\/g, '/')
+    if (!rel) return false
+    for (const r of rules) {
+      if (r.re.test(rel)) return true
+    }
+    return false
+  }
+}
+
+/** Built-in defaults: never pull/push these into/from a mirror. */
+export const DEFAULT_IGNORE = [
+  '.git/',
+  '.svn/',
+  '.hg/',
+  'node_modules/',
+  'target/',
+  'dist/',
+  'build/',
+  '.venv/',
+  'venv/',
+  '__pycache__/',
+  '.idea/',
+  '.vscode/',
+  '*.o',
+  '*.a',
+  '*.so',
+  '*.dylib',
+  '*.exe',
+  '*.dll',
+  '*.class',
+  '*.jar',
+  '*.log',
+  '*.tmp',
+  '.DS_Store',
+  'Thumbs.db',
+  '.dsh-remote-meta.json',
+  '.dsh-remote-sync-state.json',
+]
+
+/**
+ * Load the user ignore file (gitignore syntax) and merge with defaults.
+ * Returns `{ patterns, fromFile }`.
+ */
+export function loadIgnore(ignoreFile) {
+  let fromFile = []
+  if (ignoreFile) {
+    try {
+      const text = readFileSync(ignoreFile, 'utf8')
+      fromFile = text.split('\n').map((l) => l.trim()).filter((l) => l && !l.startsWith('#'))
+    } catch { /* missing file → defaults only */ }
+  }
+  const patterns = DEFAULT_IGNORE.concat(fromFile)
+  return { patterns, fromFile, matcher: compileIgnore(patterns) }
+}