dsh-remote 0.8.42 → 0.8.45

package/lib/forwards.js

@@ -14,11 +14,17 @@
 import net from 'node:net'
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs'
 import path from 'node:path'
+import { forwardOutChannel } from './pool.js'
 
 export class ForwardManager {
-  /** @param {object} pool SshPool (needs .connect() returning the ssh2 client). */
-  constructor(pool, { file } = {}) {
+  /** @param {object} pool SshPool (needs .connect() returning the ssh2 client).
+   *  @param {object} [opts] - `file` (persistence) and `net` (a `node:net`
+   *    compatible module, so the listener's connection handler — the path the
+   *    issue #54 crash travelled — can be driven from a unit test without
+   *    binding a real port). */
+  constructor(pool, { file, net: netModule } = {}) {
     this.pool = pool
+    this.net = netModule || net
     this.file = file || null
     this.defs = this._load()
     this.servers = new Map() // id → { server | remoteListen, sockets:Set, client }
@@ -134,9 +140,17 @@ export class ForwardManager {
 
   _startLocal(d, client) {
     return new Promise((resolve, reject) => {
-      const server = net.createServer((socket) => {
-        client.forwardOut('127.0.0.1', 0, d.targetHost, d.targetPort, (err, channel) => {
-          if (err) { socket.destroy(); return }
+      const server = this.net.createServer((socket) => {
+        // ssh2's forwardOut reports a dead connection by THROWING
+        // (`if (!this._sock || !isWritable(this._sock)) throw new Error('Not
+        // connected')`) and never calls the callback, so a callback-only error
+        // path cannot guard this call. Uncaught, the throw escapes net.Server's
+        // connection handler and kills the whole host process — the exact fatal
+        // stack of issue #54, found in WebAttach and reachable here too for a
+        // user-defined local forward. `attach()` does register a `close`
+        // listener that calls stopAll(), but a request can arrive in the window
+        // between the connection dying and that event.
+        forwardOutChannel(client, { dstHost: d.targetHost, dstPort: d.targetPort }).then((channel) => {
           socket.pipe(channel)
           channel.pipe(socket)
           const kill = () => { try { socket.destroy() } catch {}; try { channel.close() } catch {} }
@@ -144,6 +158,9 @@ export class ForwardManager {
           channel.on('error', kill)
           socket.on('close', kill)
           channel.on('close', kill)
+        }).catch(() => {
+          // A dead tunnel is a UI state, not a reason to exit.
+          try { socket.destroy() } catch { /* already gone */ }
         })
       })
       server.on('error', (e) => reject(new Error(`本地转发 ${d.listenPort} 启动失败: ${e.message}`)))
@@ -155,6 +172,22 @@ export class ForwardManager {
   }
 
   _startReverse(d, client) {
+    // The system-OpenSSH backend (issue #51) cannot do ssh2's two-phase
+    // `forwardIn` + `tcpip`: the `ssh -R` CLI needs the final target as an
+    // argument, so it exposes `reverseForward()` instead. Prefer it when
+    // present — otherwise every reverse tunnel would fail on that backend.
+    if (typeof client.reverseForward === 'function') {
+      return client.reverseForward({
+        bindHost: '127.0.0.1',
+        listenPort: d.listenPort,
+        targetHost: d.targetHost,
+        targetPort: d.targetPort,
+      }).then((handle) => {
+        this.servers.set(d.id, { kind: 'reverse-cli', handle, client })
+      }).catch((err) => {
+        throw new Error(`远端监听 ${d.listenPort} 失败: ${(err && err.message) || err}`)
+      })
+    }
     return new Promise((resolve, reject) => {
       // ssh2 calls the remote TCP listen API `forwardIn` (NOT openssh_forwardIn,
       // which in ssh2 >= 1.16 is stream-local only).
@@ -170,10 +203,13 @@ export class ForwardManager {
   }
 
   _handleTcpip(info, accept, reject) {
+    // Only the ssh2 backend reaches here: `ssh -R` handles the remote listener
+    // and its targets entirely inside the CLI, so a 'reverse-cli' entry never
+    // produces a 'tcpip' event.
     for (const entry of this.servers.values()) {
       if (entry.kind === 'reverse' && Number(info.destPort) === Number(this._defFor(entry).listenPort)) {
         const channel = accept()
-        const socket = net.connect({ host: this._defFor(entry).targetHost, port: this._defFor(entry).targetPort })
+        const socket = this.net.connect({ host: this._defFor(entry).targetHost, port: this._defFor(entry).targetPort })
         socket.pipe(channel)
         channel.pipe(socket)
         entry.sockets.add(socket)
@@ -205,6 +241,9 @@ export class ForwardManager {
       if (entry.kind === 'local') {
         entry.server.close()
         for (const s of entry.sockets) { try { s.destroy() } catch {} }
+      } else if (entry.kind === 'reverse-cli') {
+        // The `ssh -R` child IS the tunnel: killing it closes the remote listener.
+        if (entry.handle && typeof entry.handle.close === 'function') entry.handle.close()
       } else if (entry.client && typeof entry.client.unforwardIn === 'function') {
         const d = this._defFor(entry)
         entry.client.unforwardIn('127.0.0.1', d.listenPort, () => {})

package/lib/index.js

@@ -52,7 +52,8 @@ import { selfDir, diskVersion, LOADED_VERSION, gtVersion, fetchLatestVersion, ap
 import { sendHeartbeat, pseudonym, heartbeatUrl, hasPersistedId, installIdPath } from './telemetry.js'
 import { loadMachines as _loadMachines, saveMachines as _saveMachines, sanitizeMachine as _sanitizeMachine, applyMachine as _applyMachine, machineId as _machineId } from './registry.js'
 import { registerHttpTransports } from './http-transport.js'
-import { SshPool } from './pool.js'
+import { SshPool, ActivePool, createPool } from './pool.js'
+import { isSystemOpenSshBackend, sshBinaryAvailable, resolveSshBinary } from './openssh.js'
 import { createFsRoutes } from './routes-fs.js'
 import { listDirStructured, removeRemoteTree } from './remote-fs.js'
 
@@ -110,6 +111,17 @@ export const Config = z.object({
   useAgent: z.boolean().default(false),
   /** Allow keyboard-interactive auth (OTP/MFA chains) using the configured password. */
   keyboardInteractive: z.boolean().default(false),
+  /** SSH transport backend (issue #51):
+   *  `native` (default) speaks SSH through ssh2 — password / private key /
+   *  ssh-agent / keyboard-interactive;
+   *  `openssh` delegates to the LOCAL `ssh` executable, which is the only way to
+   *  reach hosts that allow GSSAPI/Kerberos (kinit) or that rely on other
+   *  OpenSSH-only `~/.ssh/config` features (ProxyCommand, PKCS11Provider,
+   *  ControlMaster, Match blocks). See lib/openssh.js for the trade-offs. */
+  backend: z.string().default('native'),
+  /** The `ssh` executable the `openssh` backend drives (PATH name or a full
+   *  path). Ignored by the native backend. */
+  sshBinary: z.string().default(''),
   /** Jump host / bastion: connect through this machine first. All fields have
    * defaults so this works on schemastery versions without `.optional()`; an
    * empty `host` means "no jump host". */
@@ -316,7 +328,9 @@ function encodeText(s, enc) {
 // ── apply ─────────────────────────────────────────────────────────────────
 
 export async function apply(ctx, config) {
-  const pool = new SshPool(config, { knownHostsFile })
+  // The ACTIVE pool: a delegating facade, because `backend` is per machine and
+  // the plugin must keep ONE long-lived object to hang its hooks on (issue #51).
+  const pool = new ActivePool(config, { knownHostsFile })
   ctx.effect(() => () => pool.close(), 'dsh-remote.close')
 
   migrateLegacyData()
@@ -395,6 +409,50 @@ export async function apply(ctx, config) {
     }
   }
 
+  /**
+   * The CONNECT target for a pool, given a machine's RESOLVED connect identity
+   * (i.e. a record that already passed through withSshConfig()).
+   *
+   * Issue #38 resolves an alias machine into concrete host/user/port/key values
+   * because the native backend has to dial them itself. Issue #51's
+   * system-OpenSSH backend must NOT do that: it hands the name to `ssh`, and ssh
+   * matches its `Host` blocks against exactly the name it was given. Passing the
+   * resolved HostName instead would stop `Host myalias` blocks from matching and
+   * silently drop the very settings (GSSAPIAuthentication=yes, ProxyCommand,
+   * PKCS11Provider, Match blocks) that make this backend worth choosing. For an
+   * alias machine on that backend the ALIAS is therefore the connect target, no
+   * -l/-p/-i of our own is emitted, and ~/.ssh/config stays the single source of
+   * truth for that machine (which is also exactly what issue #50 asks for).
+   *
+   * @param {object} eff - a record after withSshConfig() (`sshAlias` present for
+   *   alias machines).
+   * @returns {{host: string, port: number, username: string, privateKeyPath: string, proxy: object|undefined, aliasNative: boolean}}
+   */
+  const connectTargetFor = (eff) => {
+    const aliasNative = !!(eff && eff.useSshConfig && isSystemOpenSshBackend(eff))
+    if (!aliasNative) {
+      return {
+        host: String((eff && eff.host) || ''),
+        port: Number((eff && eff.port) || 0) || 22,
+        username: String((eff && eff.username) || ''),
+        privateKeyPath: String((eff && eff.privateKeyPath) || ''),
+        proxy: eff && eff.proxy,
+        aliasNative: false,
+      }
+    }
+    const alias = String((eff && (eff.sshAlias || eff.host)) || '')
+    return {
+      // The alias itself; ssh expands HostName/User/Port/IdentityFile and every
+      // other directive while matching that Host block.
+      host: alias,
+      port: 0,            // 0 → no -p is emitted, so Port comes from the config
+      username: '',       // '' → no -l is emitted, so User comes from the config
+      privateKeyPath: '', // '' → no -i is emitted, so IdentityFile comes from it
+      proxy: undefined,   // a ProxyJump written in the config is honoured by ssh
+      aliasNative: true,
+    }
+  }
+
   /** The alias a machine was saved as ('' for a machine with literal values). */
   const aliasOf = (m) => (m && m.sshAlias) || (m && m.useSshConfig ? String(m.host || '') : '')
 
@@ -482,6 +540,9 @@ export async function apply(ctx, config) {
     passphrase: c.passphrase, workspace: c.workspace,
     useAgent: c.useAgent, keyboardInteractive: c.keyboardInteractive,
     proxy: c.proxy, hostKeyMode: c.hostKeyMode,
+    // Issue #51: the backend is part of the target identity, so a machine switch
+    // between backends must be seen as a change by setTarget.
+    backend: c.backend, sshBinary: c.sshBinary,
   })
 
   /** Fingerprint of the machine record last applied to the shared pool config.
@@ -513,6 +574,17 @@ export async function apply(ctx, config) {
     // OLD connection alive across a machine switch (issue #25 hazard).
     const previous = targetFields(config)
     applyMachine(config, { ...m, password: pw || m.password || '' })
+    // Issue #51: an ssh-config alias on the system-OpenSSH backend connects AS
+    // the alias, so ssh — not the plugin — expands HostName/User/Port/
+    // IdentityFile/ProxyJump, and the `Host` block keeps matching.
+    const t = connectTargetFor(m)
+    if (t.aliasNative) {
+      config.host = t.host
+      config.port = 22
+      config.username = ''
+      config.privateKeyPath = ''
+      config.proxy = undefined
+    }
     pool.setTarget(targetFields(config), previous)
     lastAppliedMachine = appliedFingerprint()
   }
@@ -596,28 +668,36 @@ export async function apply(ctx, config) {
     // effect for an existing session instead of dialing the stale address.
     const rec = machineRecordFor(target)
     const eff = rec ? withSshConfig(rec) : null
-    const host = (eff && eff.host) || target.host
-    const port = Number((eff && eff.port) || target.port) || 22
-    const username = (eff && eff.username) || target.username || 'root'
+    // Issue #51: on the system-OpenSSH backend an alias machine connects AS its
+    // alias so ~/.ssh/config (not the registry) supplies host/user/port/key.
+    const t = connectTargetFor(eff || target)
+    const host = t.aliasNative ? t.host : ((eff && eff.host) || target.host)
+    const port = t.aliasNative ? 0 : (Number((eff && eff.port) || target.port) || 22)
+    const username = t.aliasNative ? '' : ((eff && eff.username) || target.username || 'root')
     const existing = machinePools.get(key)
     if (existing) {
       syncTunables(existing.config)
-      // Re-point a live pool whose resolved identity moved (setTarget closes the
-      // connection, so only do it when something actually changed).
-      if (existing.config.host !== host || Number(existing.config.port) !== port || (existing.config.username || '') !== username) {
-        existing.setTarget({ host, port, username })
-      }
-      // Re-read credentials and per-machine policy from the registry: editing a
-      // machine in the settings page must reach a pool created earlier, and a
-      // pool holding a stale password would keep failing to reconnect.
+      // Credentials and per-machine policy are re-read from the registry BEFORE
+      // re-pointing: editing a machine in the settings page must reach a pool
+      // created earlier, and a pool holding a stale password would keep failing
+      // to reconnect. The backend belongs in this group too — ActivePool picks
+      // its delegate class from `config.backend` during setTarget/_sync, so
+      // assigning it afterwards would hand the OLD backend the new target.
       if (eff) {
         existing.config.password = eff.password || ''
-        existing.config.privateKeyPath = eff.privateKeyPath || ''
+        existing.config.privateKeyPath = t.aliasNative ? '' : (eff.privateKeyPath || '')
         existing.config.passphrase = eff.passphrase || ''
         existing.config.useAgent = !!eff.useAgent
         existing.config.keyboardInteractive = !!eff.keyboardInteractive
-        existing.config.proxy = eff.proxy || undefined
+        existing.config.proxy = t.aliasNative ? undefined : (eff.proxy || undefined)
         existing.config.hostKeyMode = eff.hostKeyMode || config.hostKeyMode
+        existing.config.backend = eff.backend || config.backend
+        existing.config.sshBinary = (typeof eff.sshBinary === 'string') ? eff.sshBinary : config.sshBinary
+      }
+      // Re-point a live pool whose resolved identity moved (setTarget closes the
+      // connection, so only do it when something actually changed).
+      if (existing.config.host !== host || Number(existing.config.port) !== port || (existing.config.username || '') !== username) {
+        existing.setTarget({ host, port, username })
       }
       return existing
     }
@@ -627,17 +707,22 @@ export async function apply(ctx, config) {
       port,
       username,
       password: (eff && eff.password) || '',
-      privateKeyPath: (eff && eff.privateKeyPath) || '',
+      privateKeyPath: t.aliasNative ? '' : ((eff && eff.privateKeyPath) || ''),
       passphrase: (eff && eff.passphrase) || '',
       useAgent: eff ? !!eff.useAgent : !!config.useAgent,
       keyboardInteractive: eff ? !!eff.keyboardInteractive : !!config.keyboardInteractive,
-      proxy: (eff && eff.proxy) || undefined,
+      proxy: t.aliasNative ? undefined : ((eff && eff.proxy) || undefined),
       hostKeyMode: (eff && eff.hostKeyMode) || config.hostKeyMode,
+      // Issue #51: the transport backend is a per-machine choice — an
+      // enterprise Kerberos host needs `openssh` while its neighbours stay on
+      // the native backend.
+      backend: (eff && eff.backend) || config.backend,
+      sshBinary: (eff && typeof eff.sshBinary === 'string') ? eff.sshBinary : config.sshBinary,
       // Identity-pinned pools never carry the shared active workspace: a
       // session passes its own mirror-resolved remote path explicitly.
       workspace: '',
     })
-    const created = new SshPool(poolConfig, { knownHostsFile })
+    const created = new ActivePool(poolConfig, { knownHostsFile })
     // Keychain-backed passwords resolve against THIS pool's machine record.
     created.passwordResolver = async () => machinePassword(eff || { id: '', password: poolConfig.password })
     machinePools.set(key, created)
@@ -961,6 +1046,69 @@ export async function apply(ctx, config) {
    *  without consulting the mutable active-machine state, so a concurrent
    *  session switching machines cannot redirect this session's commands. */
   const resolveMirrorForLocal = (local) => resolveMirror(local, remoteWorkspacesRoot())
+
+  /**
+   * The whole local-mirror registry with each mirror's recorded remote origin
+   * (issue #49).
+   *
+   * The sidebar's Session rows need to know, for EVERY visible row, whether that
+   * session is a remote one and which host it is bound to. Asking
+   * `/resolve-mirror` per row would issue one HTTP request per row and would
+   * also depend on the host still knowing that session id; instead the client
+   * already holds each row's cwd (the sessions snapshot) and matches it against
+   * this directory list locally, so the whole sidebar costs ONE request.
+   *
+   * Mirrors whose meta is missing/unparsable (or has no `host`) are SKIPPED
+   * rather than guessed at — the same rule `resolveMirror()` applies, and for
+   * the same reason: labelling a session with a host it is not bound to is
+   * worse than showing no badge at all.
+   *
+   * @returns {Array<{dir: string, host: string, port: number, username: string,
+   *   remotePath: string, alias: string, name: string}>} one entry per mirror.
+   */
+  const mirrorRegistry = () => {
+    const out = []
+    const root = remoteWorkspacesRoot()
+    if (!existsSync(root)) return out
+    let hostDirs = []
+    try { hostDirs = readdirSync(root) } catch { return out }
+    for (const hostDir of hostDirs) {
+      const hostPath = path.join(root, hostDir)
+      if (!statSync(hostPath, { throwIfNoEntry: false })?.isDirectory?.()) continue
+      let entries = []
+      try { entries = readdirSync(hostPath) } catch { continue }
+      for (const entry of entries) {
+        const dir = path.join(hostPath, entry)
+        const metaPath = path.join(dir, '.dsh-remote-meta.json')
+        if (!existsSync(metaPath)) continue
+        try {
+          const meta = JSON.parse(readFileSync(metaPath, 'utf8'))
+          if (!meta || !meta.host) continue
+          const origin = {
+            host: String(meta.host),
+            port: Number(meta.port) || 22,
+            username: String(meta.username || ''),
+            alias: String(meta.alias || ''),
+          }
+          const rec = machineRecordFor(origin)
+          out.push({
+            dir: path.resolve(dir),
+            host: origin.host,
+            port: origin.port,
+            username: origin.username,
+            remotePath: String(meta.remotePath || ''),
+            alias: origin.alias,
+            // A saved machine's display name, when this mirror resolves to one:
+            // the UI prefers the friendly name over the raw address in its
+            // tooltip (the row itself shows the address, which is what the
+            // reader asked for).
+            name: rec && rec.name ? String(rec.name) : '',
+          })
+        } catch { /* unparsable meta → not a usable binding */ }
+      }
+    }
+    return out
+  }
   if (config.autoPush && wsPath()) {
     startAutoPush(mirrorDirFor(wsPath(), config.host, config.username, config.port))
   }
@@ -1350,7 +1498,7 @@ export async function apply(ctx, config) {
     defineTool({
       name: 'rw_connect',
       description:
-        'Connect SSH to a remote host for remote workspace work. Two ways (issue #48): (1) pass machineId to connect with a machine ALREADY SAVED in the registry (list them with rw_machines) — every stored setting applies: password/keychain password, privateKeyPath + passphrase, useAgent, keyboardInteractive, proxy, hostKeyMode, and ~/.ssh/config aliases; or (2) pass host plus any of username/port/password/privateKeyPath/passphrase/useAgent/keyboardInteractive/hostKeyMode/name. Defaults to saving the machine to the registry (save=false keeps it as a temporary connection). Once connected, call rw_pick_workspace to pick the workspace directory this session should work in. With useSshConfig=true, `host` is an ALIAS from ~/.ssh/config and every value (HostName/user/port/IdentityFile/ProxyJump) is read from that file at connect time. A failed connection is reported as an error message — it never takes the plugin down.',
+        'Connect SSH to a remote host for remote workspace work. Two ways (issue #48): (1) pass machineId to connect with a machine ALREADY SAVED in the registry (list them with rw_machines) — every stored setting applies: password/keychain password, privateKeyPath + passphrase, useAgent, keyboardInteractive, proxy, hostKeyMode, backend, and ~/.ssh/config aliases; or (2) pass host plus any of username/port/password/privateKeyPath/passphrase/useAgent/keyboardInteractive/hostKeyMode/backend/name. Defaults to saving the machine to the registry (save=false keeps it as a temporary connection). Once connected, call rw_pick_workspace to pick the workspace directory this session should work in. With useSshConfig=true, `host` is an ALIAS from ~/.ssh/config and every value (HostName/user/port/IdentityFile/ProxyJump) is read from that file at connect time. For a host that only accepts GSSAPI/Kerberos (issue #51), pass backend="openssh" (with useSshConfig=true) so the local ssh — which holds your kinit ticket — performs the login. A failed connection is reported as an error message — it never takes the plugin down.',
       parameters: {
         host: { type: 'string', description: 'Remote host IP or hostname (or a ~/.ssh/config alias with useSshConfig=true). Required unless machineId is given.' },
         machineId: { type: 'string', description: 'Connect with a saved machine from the registry (see rw_machines): all its stored settings apply and it becomes the current machine. host/other fields are not needed.' },
@@ -1362,6 +1510,8 @@ export async function apply(ctx, config) {
         useAgent: { type: 'boolean', description: 'Authenticate via the local SSH agent (SSH_AUTH_SOCK) instead of password/key' },
         keyboardInteractive: { type: 'boolean', description: 'Enable keyboard-interactive auth (OTP/动态码 prompts answered with the configured password)' },
         hostKeyMode: { type: 'string', description: 'Host-key policy for this machine: ask | strict | off (default from config)' },
+        backend: { type: 'string', description: 'SSH transport backend (issue #51): "native" (default) uses the built-in ssh2 client (password / private key / agent / keyboard-interactive); "openssh" drives the LOCAL ssh command, which is the only way to reach hosts that require GSSAPI/Kerberos (log in once with kinit) and which honours the whole of ~/.ssh/config (ProxyCommand, PKCS11Provider, Match blocks). Prefer "openssh" together with useSshConfig=true so the alias and its settings stay the single source of truth.' },
+        sshBinary: { type: 'string', description: 'Path (or PATH name) of the ssh executable the "openssh" backend drives — default "ssh"' },
         name: { type: 'string', description: 'Display name for a newly saved machine (default: the host)' },
         useSshConfig: { type: 'boolean', description: 'Treat `host` as a ~/.ssh/config Host alias; resolve host/user/port/key/proxy from that file (issue #38)' },
         save: { type: 'boolean', description: 'Save this machine to the registry and make it current (default true)' },
@@ -1403,10 +1553,21 @@ export async function apply(ctx, config) {
           if (args.keyboardInteractive !== undefined) rec.keyboardInteractive = !!args.keyboardInteractive
           if (args.hostKeyMode) rec.hostKeyMode = String(args.hostKeyMode)
           if (args.name) rec.name = String(args.name)
+          // Issue #51: pick the transport backend. `openssh` is what reaches
+          // GSSAPI/Kerberos-only hosts, and with useSshConfig=true the alias is
+          // handed to ssh verbatim so ~/.ssh/config stays the single source.
+          if (args.backend) rec.backend = args.backend === 'openssh' ? 'openssh' : 'native'
+          if (args.sshBinary !== undefined) rec.sshBinary = String(args.sshBinary)
+          // Issue #54: the per-machine `dsh web` command is settable by hand too,
+          // not only by the deploy flow (the README told users to set it and the
+          // settings UI offered nowhere to type it).
+          if (args.webAttachCommand !== undefined) rec.webAttachCommand = String(args.webAttachCommand)
           if (useSshConfig) rec.useSshConfig = true
           // An alias connection must dial the RESOLVED identity (~/.ssh/config),
-          // while the registry keeps the alias itself.
+          // while the registry keeps the alias itself — EXCEPT on the
+          // system-OpenSSH backend, where ssh resolves the alias itself.
           const eff = useSshConfig ? withSshConfig(rec) : rec
+          const ct = connectTargetFor(eff)
           if (args.save !== false) {
             // Upsert into the registry and make it the current machine so the
             // settings UI and the tools always agree on who is active.
@@ -1439,15 +1600,19 @@ export async function apply(ctx, config) {
             // cached client — same reconnect-probe reasoning as /connect).
             pool.invalidate()
             pool.setTarget({
-              host: eff.host, port: Number(eff.port) || port || 22, username: eff.username || user,
-              password: rec.password, privateKeyPath: eff.privateKeyPath || '',
+              // connectTargetFor: on the system-OpenSSH backend an alias machine
+              // dials the alias, not the values it expands to.
+              host: ct.host, port: ct.aliasNative ? 22 : (Number(eff.port) || port || 22), username: ct.aliasNative ? '' : (eff.username || user),
+              password: rec.password, privateKeyPath: ct.privateKeyPath,
               // Explicit (non-undefined) values so a stale passphrase/agent flag
               // from a previous target cannot leak into this connection.
               passphrase: eff.passphrase || '',
               useAgent: !!rec.useAgent,
               keyboardInteractive: !!rec.keyboardInteractive,
               hostKeyMode: rec.hostKeyMode || config.hostKeyMode,
-              proxy: eff.proxy,
+              proxy: ct.proxy,
+              backend: rec.backend || config.backend,
+              sshBinary: rec.sshBinary !== undefined ? rec.sshBinary : config.sshBinary,
               workspace: config.workspace,
             })
           }
@@ -1492,13 +1657,18 @@ export async function apply(ctx, config) {
           if (m.privateKeyPath) auth.push(`key:${m.privateKeyPath}${m.passphrase ? ' (passphrase set)' : ''}`)
           if (m.useAgent) auth.push('agent')
           if (m.keyboardInteractive) auth.push('keyboard-interactive')
+          // Issue #51: say which transport will be used — on `openssh` the
+          // credentials may come entirely from ~/.ssh/config (GSSAPI/kinit), so
+          // "auth: NONE" would be actively misleading there.
+          const backend = m.backend === 'openssh' ? 'openssh' : 'native'
+          if (backend === 'openssh') auth.push('openssh backend (~/.ssh/config: GSSAPI/key/agent)')
           let via = ''
           if (m.useSshConfig) {
             const eff = withSshConfig(m)
             via = `  alias→${eff.username || ''}@${eff.host}:${Number(eff.port) || 22}`
           }
           const ws = m.workspace ? `  workspace=${m.workspace}` : ''
-          return `- ${m.id}  "${m.name || m.host}"  ${m.username || ''}@${m.host}:${Number(m.port) || 22}${via}${cur}\n    auth: ${auth.join(' + ') || 'NONE (connect will fail — add credentials)'}${ws}`
+          return `- ${m.id}  "${m.name || m.host}"  [${backend}]  ${m.username || ''}@${m.host}:${Number(m.port) || 22}${via}${cur}\n    auth: ${auth.join(' + ') || 'NONE (connect will fail — add credentials)'}${ws}`
         })
         return { text: lines.join('\n') + '\n\nconnect with rw_connect(machineId=<id>) to reuse a machine\'s full stored settings.' }
       },
@@ -2570,6 +2740,27 @@ export async function apply(ctx, config) {
         }
       },
     },
+    {
+      // Every local mirror with its recorded remote origin (issue #49).
+      //
+      // The sidebar paints a "this session is remote" mark on a Session row, so
+      // it needs the same mapping for every visible row. One directory listing
+      // answers all of them: the client matches each row's own cwd (which it
+      // already has in the sessions snapshot) against these mirror dirs, and a
+      // row whose cwd is inside a mirror is a remote session bound to that
+      // mirror's host. Never consults the mutable active machine — a saved
+      // machine that happens to be "current" must not label a local session.
+      kind: 'exact',
+      path: '/dsh-remote/bindings',
+      handler: async (req, res) => {
+        if (req.method !== 'GET') return sendJson(res, 405, { error: 'method not allowed' })
+        try {
+          return sendJson(res, 200, { mirrors: mirrorRegistry() })
+        } catch (err) {
+          return sendJson(res, 500, { error: String((err && err.message) || err) })
+        }
+      },
+    },
     {
       kind: 'exact',
       path: '/dsh-remote/connect',
@@ -2786,6 +2977,19 @@ export async function apply(ctx, config) {
                 hostKeyMode: body.hostKeyMode || '',
                 useAgent: !!body.useAgent,
                 keyboardInteractive: !!body.keyboardInteractive,
+                // Issue #51: the transport backend is per machine. `native` is
+                // the default, so an unknown value is not persisted as-is.
+                backend: body.backend === 'openssh' ? 'openssh' : 'native',
+                sshBinary: String(body.sshBinary || '').trim(),
+                // Issue #54: the per-machine `dsh web` launch command was only
+                // ever writable by the deploy flow or by hand-editing
+                // machines.json — the README told users to set it and the
+                // settings UI offered nowhere to type it. It is an ordinary
+                // machine field now; empty means "fall back to the global
+                // webAttachCommand".
+                webAttachCommand: body.webAttachCommand === undefined
+                  ? String((prev && prev.webAttachCommand) || '')
+                  : String(body.webAttachCommand || '').trim(),
                 proxy: body.proxy && body.proxy.host ? {
                   host: String(body.proxy.host),
                   port: Number(body.proxy.port) || 22,
@@ -2880,6 +3084,8 @@ export async function apply(ctx, config) {
           body = parseJsonObject(await readBody(req))
           // Issue #38: "test" on an ssh-config ALIAS resolves the alias first —
           // the form holds the alias name, not the host it points at.
+          const probeBackend = String(body.backend || config.backend || 'native')
+          const probeIsOpenssh = isSystemOpenSshBackend({ backend: probeBackend })
           const aliasTarget = body.useSshConfig
             ? resolveMachineSshConfig({
                 host: String(body.host || ''),
@@ -2890,15 +3096,20 @@ export async function apply(ctx, config) {
                 useSshConfig: true,
               }, { text: sshConfigText() })
             : null
-          const probe = new SshPool({
+          // Issue #51: on the system-OpenSSH backend an alias is handed to `ssh`
+          // VERBATIM (see connectTargetFor) — resolving it here would stop the
+          // `Host` block from matching, so the ~/.ssh/config settings the probe
+          // is supposed to validate would be silently skipped.
+          const probe = createPool({
             ...config,
-            host: aliasTarget ? aliasTarget.host : String(body.host || config.host),
-            port: aliasTarget ? aliasTarget.port : (Number(body.port) || config.port),
-            username: aliasTarget ? aliasTarget.username : String(body.username || config.username),
+            backend: probeBackend,
+            host: aliasTarget && !probeIsOpenssh ? aliasTarget.host : String(body.host || config.host),
+            port: aliasTarget && !probeIsOpenssh ? aliasTarget.port : (Number(body.port) || config.port),
+            username: aliasTarget && !probeIsOpenssh ? aliasTarget.username : String(body.username || config.username),
             password: String(body.password || ''),
-            privateKeyPath: aliasTarget ? aliasTarget.privateKeyPath : String(body.privateKeyPath || config.privateKeyPath),
+            privateKeyPath: (aliasTarget && !probeIsOpenssh) ? aliasTarget.privateKeyPath : String(body.privateKeyPath || config.privateKeyPath),
             passphrase: String(body.passphrase || ''),
-            proxy: aliasTarget && aliasTarget.proxy ? aliasTarget.proxy : (body.proxy && body.proxy.host ? {
+            proxy: (aliasTarget && !probeIsOpenssh && aliasTarget.proxy) ? aliasTarget.proxy : (body.proxy && body.proxy.host ? {
               host: String(body.proxy.host),
               port: Number(body.proxy.port) || 22,
               username: String(body.proxy.username || ''),
@@ -3254,12 +3465,17 @@ export async function apply(ctx, config) {
             if (live) { try { await live.close() } catch { /* already torn down */ } }
             const machine = machines.find((m) => m.id === machineId)
             if (!machine) return sendJson(res, 404, { ok: false, error: `机器不存在：${machineId}` })
+            const attachPool = poolForMachine(identityOf(machine))
             const attach = new WebAttach({
               localPortStart: config.webAttachPortStart,
+              // Issue #54: follow the chosen pool's lifecycle so a dropped SSH
+              // connection degrades to "disconnected" and then self-heals,
+              // instead of leaving a dead client that crashes the host process.
+              trackPool: true,
             })
             try {
               await attach.open({
-                pool: poolForMachine(identityOf(machine)),
+                pool: attachPool,
                 machineId,
                 command: String(body.command || '').trim() || webAttachCommandFor(machine),
                 profile: 'web',