dsh-remote 0.8.53 → 0.8.60

package/lib/credential.js

@@ -12,7 +12,7 @@
 //             $DSH_HOME/remote-workspaces/.secrets/
 //   linux   → `secret-tool` (libsecret / gnome-keyring), optional
 //   else    → unsupported (plain)
-import { execFile } from 'node:child_process'
+import { spawn } from 'node:child_process'
 import { mkdirSync, writeFileSync, readFileSync, unlinkSync } from 'node:fs'
 import { join as joinPath } from 'node:path'
 
@@ -26,12 +26,60 @@ const TIMEOUT = 8000
 // harmless on PowerShell 7, where the type is already available.
 const PS_SECURITY_ASSEMBLY = 'Add-Type -AssemblyName System.Security -ErrorAction SilentlyContinue;'
 
+/**
+ * Run a helper and resolve with its trimmed stdout.
+ *
+ * WHY `spawn` and not `execFile(..., { input })`: measured on a real Ubuntu box
+ * with a real gnome-keyring, `secret-tool store` given its password through
+ * `execFile`'s `input` option **never saw EOF**, blocked on the read, and was
+ * killed by this timeout — so on Linux "encrypt the password" always failed after
+ * 8 seconds with the useless message "Command failed: secret-tool store …" (empty
+ * stderr) and the credential was dropped. The same command with an explicitly
+ * ended stdin (`spawn` + `stdin.end()`, or `sh -c '… < file'`) finishes in ~20ms.
+ * Nothing in this module needs the extra `execFile` machinery, so stdin is now
+ * always closed explicitly and the child's stderr is carried on the error (the old
+ * path dropped it, which is why the failure had no reason attached).
+ */
 function run(bin, args, input) {
   return new Promise((resolve, reject) => {
-    execFile(bin, args, { timeout: TIMEOUT, maxBuffer: 1 << 20, ...(input != null ? { input } : {}) }, (err, stdout, stderr) => {
-      if (err) return reject(err)
-      resolve(String(stdout || '').trim())
+    let child
+    try {
+      child = spawn(bin, args, { stdio: ['pipe', 'pipe', 'pipe'] })
+    } catch (err) {
+      reject(err)
+      return
+    }
+    let out = ''
+    let errOut = ''
+    let settled = false
+    const timer = setTimeout(() => {
+      if (settled) return
+      settled = true
+      try { child.kill('SIGTERM') } catch { /* already gone */ }
+      const err = new Error(`${bin} timed out after ${TIMEOUT}ms`)
+      err.stderr = errOut
+      err.code = 'ETIMEDOUT'
+      reject(err)
+    }, TIMEOUT)
+    const done = (err, value) => {
+      if (settled) return
+      settled = true
+      clearTimeout(timer)
+      if (err) reject(err); else resolve(value)
+    }
+    child.on('error', (err) => done(err))
+    child.on('close', (code) => {
+      if (code === 0) return done(null, out.trim())
+      const err = new Error(`${bin} exited with ${code}${errOut.trim() ? ': ' + errOut.trim().slice(0, 300) : ''}`)
+      err.code = code
+      err.stderr = errOut
+      done(err)
     })
+    child.stdout.on('data', (d) => { out += d })
+    child.stderr.on('data', (d) => { errOut += d })
+    // Always end stdin: a helper that reads a secret from stdin needs EOF, and one
+    // that does not must not inherit an open pipe.
+    try { child.stdin.end(input == null ? '' : String(input)) } catch { /* closed early */ }
   })
 }
 
@@ -105,17 +153,43 @@ export async function saveSecret(machineId, password, secretsDir) {
 
 /** Decide where a machine password is persisted (issue #30).
  *
- * The contract the settings UI relies on: a password is NEVER dropped. When the
- * requested OS store fails (missing DPAPI assembly, locked keychain, absent
- * secret-tool), this falls back to plaintext in machines.json and reports
- * `warning: 'secret-store-failed'` so the caller can tell the user instead of
- * silently saving a credential-less machine.
+ * The contract the settings UI relies on: a password is NEVER silently dropped.
+ * Historically that guarantee was upheld by falling back to PLAINTEXT in
+ * machines.json, which is a bad trade in one specific way: the user asked for
+ * encryption, the store failed, and the secret ended up less protected than if
+ * they had never asked. Worse, a locked keychain / missing secret-tool is
+ * exactly the moment when quietly writing a password to a world-readable file
+ * on disk is most likely to go unnoticed.
  *
- * `save` is injectable so the fallback is unit-testable on any platform.
+ * So the fallback is a POLICY, not a fixed behaviour (`onStoreFailure`):
  *
+ *   `refuse`  (default) — do not store the password at all. The machine is
+ *             saved WITHOUT a credential and the caller reports how to fix the
+ *             store; the user retypes (or connects) and nothing lands in
+ *             plaintext by accident. `stored: 'none'` makes that explicit.
+ *   `plain`   — the legacy behaviour: write it to machines.json and raise
+ *             `warning: 'secret-store-failed'`. Opt-in only, for users who
+ *             genuinely prefer a working machine over the storage guarantee.
+ *
+ * An explicit `backend: 'plain'` still means plain by REQUEST (the user turned
+ * encryption off), and is unaffected by this policy.
+ *
+ * `save` is injectable so both paths are unit-testable on any platform.
+ *
+ * @param {object} arg
+ * @param {string} arg.backend - the platform backend name ('keychain'|'windows'|'secret'|'plain').
+ * @param {string} arg.machineId
+ * @param {string} arg.password
+ * @param {string} [arg.secretsDir]
+ * @param {'refuse'|'plain'} [arg.onStoreFailure] - see above.
+ * @param {Function} [arg.save] - injectable secure-store writer.
  * @returns {Promise<{stored:'secret'|'plain'|'none', credentialBackend:string, password:string, warning:string, error:string}>}
  */
-export async function persistPassword({ backend, machineId, password, secretsDir, save = saveSecret }) {
+export async function persistPassword({
+  backend, machineId, password, secretsDir,
+  onStoreFailure = 'refuse',
+  save = saveSecret,
+}) {
   const pw = password == null ? '' : String(password)
   const want = backend && backend !== 'plain' ? backend : 'plain'
   if (!pw) return { stored: 'none', credentialBackend: want, password: '', warning: '', error: '' }
@@ -129,12 +203,24 @@ export async function persistPassword({ backend, machineId, password, secretsDir
   if (res && res.ok) {
     return { stored: 'secret', credentialBackend: res.backend || want, password: '', warning: '', error: '' }
   }
+  const error = String((res && res.error) || '') || 'secret store write failed'
+  if (onStoreFailure === 'plain') {
+    return {
+      stored: 'plain',
+      credentialBackend: 'plain',
+      password: pw,
+      warning: 'secret-store-failed',
+      error,
+    }
+  }
+  // Default: refuse. Nothing is written, and the caller surfaces the store
+  // failure plus the platform-specific repair hint instead of a silent downgrade.
   return {
-    stored: 'plain',
-    credentialBackend: 'plain',
-    password: pw,
-    warning: 'secret-store-failed',
-    error: String((res && res.error) || '') || 'secret store write failed',
+    stored: 'none',
+    credentialBackend: want,
+    password: '',
+    warning: 'secret-store-refused',
+    error,
   }
 }
 

package/lib/errors.js

@@ -24,10 +24,22 @@ export function classifyError(err, opts = {}) {
       raw: msg,
     }
   }
+  // Checked BEFORE the generic `no credentials` branch: the actionable failure
+  // there is "this process has no ssh-agent", not "you forgot to configure a
+  // credential". Telling a Windows user to "set a password or a privateKeyPath"
+  // when they already ticked 使用 SSH agent is how a config page gets a
+  // reputation for lying.
+  if (/no SSH agent available|SSH_AUTH_SOCK/i.test(msg)) {
+    return {
+      category: 'credentials',
+      hint: `SSH agent 不可用${where}：这台机器勾选了「使用 SSH agent」，但 DSH 宿主进程里没有 SSH_AUTH_SOCK（Windows 默认没有 agent 服务）。要么在启动 DSH 之前把 agent 跑起来并导出 SSH_AUTH_SOCK（或用 Pageant），要么取消勾选 agent 并给这台机器保存密码/私钥。`,
+      raw: msg,
+    }
+  }
   if (/no credentials/i.test(msg)) {
     return {
       category: 'credentials',
-      hint: `缺少凭据：请设置 password 或 privateKeyPath（私钥只在显式提供时使用），或为该机器启用 SSH agent。`,
+      hint: `缺少凭据${where}：这台机器没有可用密码、私钥或 agent。请在「远程工作区」设置里填密码（或用私钥路径 / 勾选 agent）后保存；若你确信已经填过，说明保存时密码没有真正落盘（看保存后是否弹出密钥库失败警告），重新填写并保存即可，可用「测试连接」当场验证。`,
       raw: msg,
     }
   }
@@ -38,6 +50,18 @@ export function classifyError(err, opts = {}) {
       raw: msg,
     }
   }
+  // ssh2 reports a socket that dies DURING the handshake as the bare string
+  // "Connection lost before handshake" — no host, no cause, no advice. That is
+  // the message a user sees when the port is open but nothing speaks SSH on it,
+  // or when a firewall/security group cuts the connection after the TCP accept;
+  // it is indistinguishable from "wrong credentials" unless it is classified.
+  if (/connection lost before handshake|handshake failed|no matching (key exchange|host key|cipher)/i.test(msg)) {
+    return {
+      category: 'network',
+      hint: `SSH 握手未完成${where}：TCP 连上了但 SSH 握手没走完——端口上没有跑 sshd、连接被防火墙/安全组拒绝、或远端只支持不兼容的加密算法。确认 host/port 指向 sshd，必要时换端口或让运维放行。`,
+      raw: msg,
+    }
+  }
   if (/ECONNREFUSED|connection refused/i.test(msg)) {
     return {
       category: 'network',
@@ -78,10 +102,17 @@ export function classifyError(err, opts = {}) {
   return { category: 'other', hint: msg, raw: msg }
 }
 
-/** One-line friendly message: hint (+ raw when it adds information). */
+/** One-line friendly message: hint (+ raw when it adds information).
+ *
+ *  An UNCLASSIFIED failure still gets the host appended: "Connection lost before
+ *  handshake" or a raw errno on its own leaves the user unable to tell WHICH
+ *  machine failed, which is the one thing a multi-machine plugin must never hide. */
 export function friendlyMessage(err, opts = {}) {
   const c = classifyError(err, opts)
-  if (c.category === 'other') return c.raw
+  const where = opts.host ? ` (${opts.host}:${opts.port || 22})` : ''
+  if (c.category === 'other') {
+    return where && !c.raw.includes(opts.host) ? `${c.raw}${where}` : c.raw
+  }
   if (c.raw && c.raw !== c.hint) return `${c.hint}（原始错误：${c.raw}）`
   return c.hint
 }