dsh-remote 0.8.53 → 0.8.60

package/lib/index.js

@@ -41,6 +41,9 @@ import { syncTree, pushTree, loadSyncState, saveSyncState, pushOneFile } from '.
 import { createInstructionIndex, formatInstructionIndex } from './instructions.js'
 import { resolveExecTimeout, formatExecResult, startExecJob, execWithOptionalPromotion } from './exec-job.js'
 import { createInjectionTracker, refreshTouched, buildInstructionMessage } from './instructions-dynamic.js'
+import { REMOTE_SANDBOX_MODES, checkRemoteSandbox, remoteSandboxDenial } from './remote-sandbox.js'
+import { createTerminalManager } from './terminal.js'
+import { createTerminalRoutes } from './routes-term.js'
 import { searchRemote } from './search.js'
 import { installTerminalShell } from './remote-shell.js'
 import { resolveMirror, poolKey, lookupSessionCwd, encodeSegmentSafe, readSessionHeaderCwd, requestSessionHint } from './binding.js'
@@ -55,7 +58,7 @@ import {
 import { registerDeploySkill, buildInvestigatePrompt, SKILL_NAME } from './web-deploy-skill.js'
 import { selfDir, diskVersion, LOADED_VERSION, gtVersion, fetchLatestVersion, applyUpdate, persistUpdateMode, readUpdateMode, reloadSelf, scheduleSelfReload, lastSelfReload, isInstalledCopy } from './update.js'
 import { sendHeartbeat, pseudonym, heartbeatUrl, hasPersistedId, installIdPath } from './telemetry.js'
-import { loadMachines as _loadMachines, saveMachines as _saveMachines, sanitizeMachine as _sanitizeMachine, applyMachine as _applyMachine, machineId as _machineId } from './registry.js'
+import { loadMachines as _loadMachines, saveMachines as _saveMachines, sanitizeMachine as _sanitizeMachine, applyMachine as _applyMachine, machineId as _machineId, normalizeMachineGroup, filterMachinesByGroup, resolveProbeCredentials } from './registry.js'
 import { registerHttpTransports } from './http-transport.js'
 import { SshPool, ActivePool, createPool } from './pool.js'
 import { isSystemOpenSshBackend, sshBinaryAvailable, resolveSshBinary } from './openssh.js'
@@ -277,6 +280,24 @@ export const Config = z.object({
    *  inside a mirror) always sees all tools, and an invalid value falls back
    *  to `bootstrap`. (schemastery 3.18 has no .enum — validated in code.) */
   localTools: z.string().default('bootstrap'),
+  /** Remote sandbox fence (parity with the local session sandbox).
+   *
+   *  `inherit` (default) reads the SAME `ctx.sandboxPolicy` the local tools use
+   *  and applies it to remote operations: read-only refuses remote writes and
+   *  commands, workspace-write fences remote writes to the workspace root,
+   *  danger-full-access allows everything. `off` restores the pre-0.8.54
+   *  behaviour (no fence) for deployments whose remotes enforce their own
+   *  boundary. A per-call `sandbox_permissions: 'danger-full-access'` also
+   *  works, but only when the composition advertises escalation. */
+  remoteSandbox: z.string().default('inherit'),
+  /** What to do when the OS secure store refuses a password.
+   *
+   *  `refuse` (default): never write a password to machines.json. The machine is
+   *  saved without a credential and the UI reports the store failure plus the
+   *  repair hint -- you asked for encryption, so silently downgrading to
+   *  plaintext is the one outcome you did not ask for.
+   *  `plain`: the pre-0.8.54 fallback (write it and warn). */
+  credentialFallback: z.string().default('refuse'),
 })
 
 // ── shell / path helpers (pure implementations in lib/paths.js) ───────────
@@ -1029,6 +1050,28 @@ export async function apply(ctx, config) {
       return null
     }
   }
+  /**
+   * One-line-per-group inventory of the saved machines: which environments,
+   * locations and tags exist. This is what makes the filters discoverable — a
+   * user who has never set a label sees nothing to filter by, so the empty
+   * result reports what IS there.
+   *
+   * @param {Array<object>} list
+   * @returns {string} '' when no machine carries any label.
+   */
+  const groupSummary = (list) => {
+    const envs = new Map(); const locs = new Map(); const tags = new Map()
+    const bump = (map, key) => { if (key) map.set(key, (map.get(key) || 0) + 1) }
+    for (const m of Array.isArray(list) ? list : []) {
+      if (!m) continue
+      bump(envs, m.environment)
+      bump(locs, m.location)
+      for (const t of (Array.isArray(m.tags) ? m.tags : [])) bump(tags, t)
+    }
+    const fmt = (label, map) => (map.size ? `  ${label}: ` + [...map.entries()].map(([k, n]) => `${k} (${n})`).join(', ') : '')
+    return [fmt('environment', envs), fmt('location', locs), fmt('tags', tags)].filter(Boolean).join('\n')
+  }
+
   const readAudit = (limit) => {
     try {
       const text = readFileSync(auditFile(), 'utf8')
@@ -1159,6 +1202,12 @@ export async function apply(ctx, config) {
   // already delivered, plus the sweep throttle. See the tools/result hook below.
   const instructionTracker = createInjectionTracker()
 
+  // Embedded interactive terminal sessions (P1). Host-owned PTY channels; the
+  // browser polls for output. Disposed with the plugin fiber so an unload hangs
+  // up every remote shell.
+  const terminals = createTerminalManager()
+  ctx.effect(() => () => { try { terminals.dispose() } catch { /* already gone */ } }, 'dsh-remote.terminals')
+
   /**
    * The core's user-message factory, when this composition exposes one.
    *
@@ -1446,6 +1495,29 @@ export async function apply(ctx, config) {
       err.httpStatus = 403
       throw err
     }
+    // No session context: fall back to the ACTIVE machine. Boot restore runs on
+    // `setImmediate`, so a request that arrives first would see `config.host`
+    // still empty even though the registry already names a current machine —
+    // apply it here instead of answering "no machine" to a user who HAS one.
+    if (!String(config.host || '').trim()) {
+      const m = activeMachine()
+      if (m && m.host) {
+        try { await applyActiveMachine() } catch { /* reported below */ }
+      }
+    }
+    // Still nothing: answer with the REAL reason. Falling through used to hand the
+    // caller the un-configured pool, whose first command failed with
+    // "no credentials: set a password, a privateKeyPath…" — i.e. a missing
+    // *selection* was reported as a missing *credential*, which sends people to the
+    // wrong settings page.
+    if (!String(config.host || '').trim()) {
+      const err = new Error(
+        '当前没有活动远程机：请先在「远程工作区」设置里选择或连接一台机器。'
+        + '（保存的机器只是备用连接，不会自动成为当前机器。）',
+      )
+      err.httpStatus = 409
+      throw err
+    }
     return {
       pool,
       ws: wsPath(),
@@ -1542,6 +1614,69 @@ export async function apply(ctx, config) {
     return b
   }
 
+  // ── remote sandbox semantics ──────────────────────────────────────────────
+  // A local session is confined by ctx.sandboxPolicy; a REMOTE command used to
+  // run under no policy at all, so a read-only session could mutate any file on
+  // any reachable host. `ctx.sandbox.confine()` cannot help here — it wraps argv
+  // for a spawn on THIS machine, while the process we start lives on the other
+  // end of an SSH channel. So the fence is applied at the tool boundary, using
+  // the SAME resolved policy the local tools consume (see lib/remote-sandbox.js
+  // for the threat model: containment, not a security boundary).
+  //
+  // Optional by design: a composition without ctx.sandboxPolicy (a minimal
+  // embedding, a test double, an agentless call) keeps the pre-existing
+  // unconfined behaviour instead of failing to load, and `remoteSandbox` config
+  // can switch the fence off for deployments whose remotes enforce their own.
+  const remoteSandboxEnabled = () => config.remoteSandbox !== 'off'
+
+  /**
+   * Resolve the sandbox mode for one tool call.
+   *
+   * Reads the core policy service when present; otherwise honours the plugin's
+   * own `remoteSandbox` fallback (`inherit` ⇒ danger-full-access, i.e. the old
+   * unconfined behaviour). Any resolution failure is treated as read-only — fail
+   * closed, never open.
+   *
+   * @param {object} [exec] - the tool run context.
+   * @returns {string} the mode name.
+   */
+  const sandboxModeFor = (exec) => {
+    if (!remoteSandboxEnabled()) return 'danger-full-access'
+    try {
+      const svc = ctx.get('sandboxPolicy')
+      if (svc && typeof svc.resolve === 'function') {
+        const session = exec && exec.agent ? exec.agent.session : undefined
+        const resolved = svc.resolve(session ? { session } : {})
+        if (resolved && REMOTE_SANDBOX_MODES.includes(resolved.mode)) return resolved.mode
+      }
+    } catch { /* fall through to the configured default */ }
+    const fallback = String(config.remoteSandbox || 'inherit')
+    return REMOTE_SANDBOX_MODES.includes(fallback) ? fallback : 'danger-full-access'
+  }
+
+  /**
+   * Assert that one remote operation is permitted, throwing the official denial
+   * shape when it is not.
+   *
+   * @param {object} exec - the tool run context.
+   * @param {'read'|'write'|'exec'|'tunnel'|'connect'} operation
+   * @param {object} [opts]
+   * @param {string} [opts.path] - the remote path a `write` targets.
+   * @param {string} [opts.tool] - tool name for the message.
+   */
+  const requireRemoteSandbox = (exec, operation, opts = {}) => {
+    if (!remoteSandboxEnabled()) return
+    const mode = sandboxModeFor(exec)
+    if (mode === 'danger-full-access') return
+    const b = (() => { try { return bindingFor(exec) } catch { return null } })()
+    const workspaceRoot = (b && b.ws) || ''
+    const verdict = checkRemoteSandbox({ mode, operation, path: opts.path, workspaceRoot })
+    if (verdict.allowed) return
+    const err = remoteSandboxDenial(verdict)
+    if (opts.tool) err.message = `${opts.tool}: ${err.message}`
+    throw err
+  }
+
   /**
    * Binding for a tool that takes an explicit absolute remote path: it needs a
    * resolvable MACHINE but not a workspace root. A local session is refused for
@@ -1849,6 +1984,9 @@ export async function apply(ctx, config) {
           if (args.passphrase !== undefined) rec.passphrase = String(args.passphrase)
           if (args.useAgent !== undefined) rec.useAgent = !!args.useAgent
           if (args.keyboardInteractive !== undefined) rec.keyboardInteractive = !!args.keyboardInteractive
+          // Group labels (host organisation): merge-only, so a partial call
+          // never wipes existing labels.
+          { const g = normalizeMachineGroup(args); for (const k of Object.keys(g)) rec[k] = g[k] }
           if (args.hostKeyMode) rec.hostKeyMode = String(args.hostKeyMode)
           if (args.name) rec.name = String(args.name)
           // Issue #51: pick the transport backend. `openssh` is what reaches
@@ -1941,14 +2079,30 @@ export async function apply(ctx, config) {
     defineTool({
       name: 'rw_machines',
       description:
-        'List the machines saved in the registry, secrets stripped: id, name, host/port/username, auth method flags (password / key + whether a passphrase is set / agent / keyboard-interactive), ssh-config alias resolution, workspace, and which one is current. Then pass rw_connect(machineId=<id>) to connect with a machine\'s full stored settings — the fix for "the agent cannot retype the whole config" (issue #48).',
-      parameters: {},
+        'List the machines saved in the registry, secrets stripped: id, name, host/port/username, auth method flags, ssh-config alias resolution, workspace, grouping labels (environment / tags / location), and which one is current. Optional filters (environment / tags / location / query) narrow the list - useful once you have many machines. Pass rw_connect(machineId=<id>) to connect with the full stored settings of a machine (issue #48).',
+      parameters: {
+        environment: { type: 'string', description: 'Only machines in this environment (e.g. prod, staging)' },
+        location: { type: 'string', description: 'Only machines in this location (e.g. shanghai, gpu-lab)' },
+        tags: { type: 'string', description: 'Only machines carrying ANY of these tags (comma or space separated)' },
+        query: { type: 'string', description: 'Free-text match over name/host/user/environment/location/description/tags' },
+      },
       output: textOut,
-      async execute() {
+      async execute(args = {}) {
         if (!machines.length) {
           return { text: 'No saved machines yet — add one in Settings → 远程工作区, or connect with rw_connect(host=..., save defaults to true).' }
         }
-        const lines = machines.map((m) => {
+        // Group filters (host organisation): a flat list stops being usable once
+        // a user has a dozen machines, and picking the wrong one on a destructive
+        // tool is how accidents happen.
+        const filtered = filterMachinesByGroup(machines, {
+          environment: args.environment, location: args.location, tags: args.tags, query: args.query,
+        })
+        const anyFilter = !!(args.environment || args.location || args.tags || args.query)
+        if (anyFilter && !filtered.length) {
+          const groups = groupSummary(machines)
+          return { text: 'No machine matches that filter.' + (groups ? '\n\nAvailable groups:\n' + groups : '') }
+        }
+        const rows = filtered.map((m) => {
           const cur = store.currentId === m.id ? '  [CURRENT]' : ''
           const auth = []
           if (m.password || (m.credentialBackend && m.credentialBackend !== 'plain')) auth.push('password')
@@ -1966,9 +2120,19 @@ export async function apply(ctx, config) {
             via = `  alias→${eff.username || ''}@${eff.host}:${Number(eff.port) || 22}`
           }
           const ws = m.workspace ? `  workspace=${m.workspace}` : ''
-          return `- ${m.id}  "${m.name || m.host}"  [${backend}]  ${m.username || ''}@${m.host}:${Number(m.port) || 22}${via}${cur}\n    auth: ${auth.join(' + ') || 'NONE (connect will fail — add credentials)'}${ws}`
+          // Grouping labels, shown inline so a wrong-host pick is visible.
+          const meta = []
+          if (m.environment) meta.push('env=' + m.environment)
+          if (m.location) meta.push('loc=' + m.location)
+          if (Array.isArray(m.tags) && m.tags.length) meta.push('tags=' + m.tags.join(','))
+          if (m.description) meta.push(m.description)
+          const group = meta.length ? '\n    ' + meta.join('  ') : ''
+          return `- ${m.id}  "${m.name || m.host}"  [${backend}]  ${m.username || ''}@${m.host}:${Number(m.port) || 22}${via}${cur}\n    auth: ${auth.join(' + ') || 'NONE (connect will fail — add credentials)'}${ws}${group}`
         })
-        return { text: lines.join('\n') + '\n\nconnect with rw_connect(machineId=<id>) to reuse a machine\'s full stored settings.' }
+        const suffix = anyFilter
+          ? `\n\n${rows.length} of ${machines.length} machine(s) match. connect with rw_connect(machineId=<id>).`
+          : '\n\nconnect with rw_connect(machineId=<id>) to reuse a machine\'s full stored settings.'
+        return { text: rows.join('\n') + suffix }
       },
     }),
 
@@ -2257,6 +2421,8 @@ export async function apply(ctx, config) {
       output: okOut,
       async execute(args, exec) {
         const b = requireMachine(exec, 'rw_write_file')
+        // Remote sandbox fence: a write must be permitted by this session's resolved mode.
+        requireRemoteSandbox(exec, 'write', { tool: 'rw_write_file', path: String(args.path || '') })
         const p = resolveRemoteArg(b, args.path)
         if (!p || p === '/') throw new Error('rw_write_file: a file path is required')
         const content = String(args.content == null ? '' : args.content)
@@ -2294,6 +2460,8 @@ export async function apply(ctx, config) {
       output: okOut,
       async execute(args, exec) {
         const b = requireMachine(exec, 'rw_edit')
+        // Remote sandbox fence: a write must be permitted by this session's resolved mode.
+        requireRemoteSandbox(exec, 'write', { tool: 'rw_edit', path: String(args.path || args.file_path || '') })
         // Presence must be checked on the RAW argument, not on the resolved
         // path: resolveRemoteArg falls back to the workspace root for an empty
         // string, so `!p` would never fire and a pathless rw_edit would silently
@@ -2372,6 +2540,8 @@ export async function apply(ctx, config) {
       output: okOut,
       async execute(args, exec) {
         const b = requireMachine(exec, 'rw_append')
+        // Remote sandbox fence: a write must be permitted by this session's resolved mode.
+        requireRemoteSandbox(exec, 'write', { tool: 'rw_append', path: String(args.path || '') })
         const p = resolveRemoteArg(b, args.path)
         if (!p || p === '/') throw new Error('rw_append: a file path is required')
         const sftp = await b.pool.sftp()
@@ -2395,6 +2565,8 @@ export async function apply(ctx, config) {
       output: textOut,
       async execute(args, exec) {
         const b = requireMachine(exec, 'rw_mkdir')
+        // Remote sandbox fence: a write must be permitted by this session's resolved mode.
+        requireRemoteSandbox(exec, 'write', { tool: 'rw_mkdir', path: String(args.path || '') })
         const p = resolveRemoteArg(b, args.path)
         if (!p || p === '/') throw new Error('rw_mkdir: a directory path is required')
         const sftp = await b.pool.sftp()
@@ -2415,6 +2587,8 @@ export async function apply(ctx, config) {
       output: okOut,
       async execute(args, exec) {
         const b = requireMachine(exec, 'rw_remove')
+        // Remote sandbox fence: a write must be permitted by this session's resolved mode.
+        requireRemoteSandbox(exec, 'write', { tool: 'rw_remove', path: String(args.path || '') })
         const p = resolveRemoteArg(b, args.path)
         if (!p || p === '/') throw new Error('rw_remove: a path is required')
         const sftp = await b.pool.sftp()
@@ -2443,6 +2617,8 @@ export async function apply(ctx, config) {
       output: textOut,
       async execute(args, exec) {
         const b = requireMachine(exec, 'rw_move')
+        // Remote sandbox fence: a write must be permitted by this session's resolved mode.
+        requireRemoteSandbox(exec, 'write', { tool: 'rw_move', path: String(args.source || args.path || '') })
         const p = resolveRemoteArg(b, args.path)
         const d = resolveRemoteArg(b, args.dest)
         if (!p || !d || p === '/') throw new Error('rw_move: both path and dest are required')
@@ -2470,6 +2646,8 @@ export async function apply(ctx, config) {
       output: textOut,
       async execute(args, exec) {
         const b = requireBinding(exec, 'rw_exec')
+        // Remote sandbox fence: commands change remote state.
+        requireRemoteSandbox(exec, 'exec', { tool: 'rw_exec' })
         const cmd = String(args.command || '')
         if (!cmd) throw new Error('rw_exec: command is required')
         const ws = b.ws
@@ -2642,6 +2820,8 @@ export async function apply(ctx, config) {
       output: okOut,
       async execute(args, exec) {
         const b = requireMachine(exec, 'rw_upload')
+        // Remote sandbox fence: a write must be permitted by this session's resolved mode.
+        requireRemoteSandbox(exec, 'write', { tool: 'rw_upload', path: String(args.path || '') })
         const rp = resolveRemoteArg(b, args.path)
         const lp = String(args.localPath || '')
         if (!rp || rp === '/' || !lp) throw new Error('rw_upload: both localPath and a remote path are required')
@@ -2726,9 +2906,11 @@ export async function apply(ctx, config) {
         remove: { type: 'boolean', description: 'Remove an existing forward by listenPort (default false)' },
       },
       output: textOut,
-      async execute(args) {
+      async execute(args, exec) {
         const port = Number(args.listenPort)
         if (!port || port < 1 || port > 65535) throw new Error('rw_forward: a valid listenPort is required')
+        // Remote sandbox fence: a forward opens a network path into the remote.
+        requireRemoteSandbox(exec, 'tunnel', { tool: 'rw_forward' })
         const dir = args.direction === 'reverse' ? 'reverse' : 'local'
         const existing = forwards.list().find((f) => Number(f.listenPort) === port && f.direction === dir)
         if (args.remove) {
@@ -3040,6 +3222,13 @@ export async function apply(ctx, config) {
     })
   const pickLocalNative = async () => {
     const platform = process.platform
+    // Escape hatch for non-interactive hosts and for the test suite: opening a
+    // real OS folder dialog from a request handler means the REQUEST waits for a
+    // human. In a headless host (or CI) that is a hang nobody can see or cancel —
+    // the route then falls back to its browse capability / "type the path" hint.
+    if (String(process.env.DSH_REMOTE_NO_NATIVE_DIALOG || '') && process.env.DSH_REMOTE_NO_NATIVE_DIALOG !== '0') {
+      throw new Error('已禁用本机目录选择器对话框（DSH_REMOTE_NO_NATIVE_DIALOG）—— 请直接在输入框填本地路径')
+    }
     if (platform === 'darwin') {
       return runPick('osascript', ['-e', 'set selectedFolder to choose folder with prompt "Select Workspace Directory"', '-e', 'POSIX path of selectedFolder'])
     }
@@ -3278,6 +3467,15 @@ export async function apply(ctx, config) {
       sendJson, readBody, resolveRequestBinding, decodeBuf, encodeText, audit, config, mirrorDirFor,
     }),
 
+    // Embedded terminal (P1): one host-owned PTY session per machine, polled.
+    ...createTerminalRoutes({
+      sendJson, readBody, resolveRequestBinding, terminals,
+      // The machine fence: a session is identified by the mirror-recorded
+      // origin, so a terminal opened on host A can never be driven from a
+      // request bound to host B.
+      machineKey: (b) => poolKey({ host: b.host, port: b.port, username: b.username }),
+    }),
+
     {
       kind: 'exact',
       path: '/dsh-remote/workspace',
@@ -3454,8 +3652,20 @@ export async function apply(ctx, config) {
                 port: Number(body.port) || 22,
                 username: String(body.username || '').trim() || 'root',
                 password: '',
-                privateKeyPath: String(body.privateKeyPath || '').trim(),
-                passphrase: body.passphrase || '',
+                // An OMITTED `privateKeyPath` keeps the stored one; an explicit
+                // empty string clears it (that is what the form sends when the user
+                // empties the box). A partial update from an API/agent caller used
+                // to silently wipe the key path, leaving a machine that can only
+                // fail to authenticate — the same data-loss class as the passphrase.
+                privateKeyPath: body.privateKeyPath === undefined
+                  ? String((prev && prev.privateKeyPath) || '')
+                  : String(body.privateKeyPath || '').trim(),
+                // An EMPTY passphrase from the form means "unchanged", not
+                // "delete it": the value is never echoed back to the browser, so
+                // an edit that touched any other field used to silently wipe a
+                // saved private-key passphrase (and the next connect then failed
+                // with "no passphrase given" for a key that had been working).
+                passphrase: String(body.passphrase || (prev && prev.passphrase) || ''),
                 workspace: String(body.workspace || '').trim(),
                 hostKeyMode: body.hostKeyMode || '',
                 useAgent: !!body.useAgent,
@@ -3473,13 +3683,28 @@ export async function apply(ctx, config) {
                 webAttachCommand: body.webAttachCommand === undefined
                   ? String((prev && prev.webAttachCommand) || '')
                   : String(body.webAttachCommand || '').trim(),
-                proxy: body.proxy && body.proxy.host ? {
-                  host: String(body.proxy.host),
-                  port: Number(body.proxy.port) || 22,
-                  username: String(body.proxy.username || '').trim(),
-                  password: String(body.proxy.password || ''),
-                  privateKeyPath: String(body.proxy.privateKeyPath || '').trim(),
-                } : undefined,
+                // Group labels (host organisation). Merge-only: a request that
+                // omits them keeps the stored values instead of wiping them.
+                ...normalizeMachineGroup({
+                  environment: body.environment === undefined ? (prev && prev.environment) : body.environment,
+                  location: body.location === undefined ? (prev && prev.location) : body.location,
+                  description: body.description === undefined ? (prev && prev.description) : body.description,
+                  tags: body.tags === undefined ? (prev && prev.tags) : body.tags,
+                }),
+                // A jump host the form did not mention is KEPT (omitted ≠
+                // removed), and a jump PASSWORD the form did not re-supply is
+                // kept too: the settings page never receives it back, so an edit
+                // used to strip the bastion credential and the machine could
+                // only fail at connect time.
+                proxy: body.proxy === undefined
+                  ? (prev && prev.proxy && prev.proxy.host ? prev.proxy : undefined)
+                  : (body.proxy && body.proxy.host ? {
+                      host: String(body.proxy.host),
+                      port: Number(body.proxy.port) || 22,
+                      username: String(body.proxy.username || '').trim(),
+                      password: String(body.proxy.password || (prev && prev.proxy && prev.proxy.password) || ''),
+                      privateKeyPath: String(body.proxy.privateKeyPath || '').trim(),
+                    } : undefined),
                 credentialBackend: credBackend,
                 recentWorkspaces: prev && prev.recentWorkspaces ? prev.recentWorkspaces : [],
                 lastConnectedAt: prev && prev.lastConnectedAt ? prev.lastConnectedAt : null,
@@ -3497,15 +3722,37 @@ export async function apply(ctx, config) {
                   machineId: id,
                   password: body.password,
                   secretsDir: secretsDir(),
+                  onStoreFailure: config.credentialFallback === 'plain' ? 'plain' : 'refuse',
                 })
                 rec.credentialBackend = persisted.credentialBackend
                 rec.password = persisted.password
+                // Record WHERE the secret ended up, so the settings page can say
+                // "已保存" for a keychain machine too (its record carries an
+                // empty `password` by design).
+                rec.secretStored = persisted.stored === 'secret'
                 if (persisted.warning) {
                   warning = persisted.warning
                   warningDetail = persisted.error
                 }
-              } else if (prev && prev.password) {
-                rec.password = prev.password
+              } else if (prev) {
+                // No password typed: keep whatever the machine already had —
+                // the plaintext copy AND the keychain flag. Turning the
+                // "加密保存密码" checkbox OFF is handled next: it must actually
+                // MOVE the secret, or the checkbox is a lie.
+                rec.password = prev.password || ''
+                rec.secretStored = prev.secretStored
+                const prevKeychain = prev.credentialBackend && prev.credentialBackend !== 'plain'
+                if (credBackend === 'plain' && prevKeychain) {
+                  try {
+                    const existing = await machinePassword(prev)
+                    if (existing) {
+                      rec.password = existing
+                      rec.secretStored = false
+                      rec.credentialBackend = 'plain'
+                      await deleteSecret(id, secretsDir()).catch(() => {})
+                    }
+                  } catch { /* keep the keychain copy; the next connect still works */ }
+                }
               }
               if (i >= 0) machines[i] = rec; else machines.push(rec)
               // Issue #13: saving a machine must NOT make it the active
@@ -3611,17 +3858,46 @@ export async function apply(ctx, config) {
         let body = {}
         try {
           body = parseJsonObject(await readBody(req))
+          // ── The probe must dial with the credentials a REAL connect would use.
+          //
+          // Stored secrets never travel back to the browser (see
+          // sanitizeMachine), so "编辑一台已经连接成功的机器 → 点测试连接" posted an
+          // EMPTY password while the machine itself connected fine through the
+          // pool's keychain/plaintext resolver. Every such probe died with
+          // `no credentials: set a password, a privateKeyPath, or enable
+          // useAgent to connect` — the error said "you configured nothing" about
+          // a machine that was visibly working.
+          //
+          // So: resolve the saved record (by id when the form is editing one,
+          // else by identity) and merge — form values override, blanks fall back
+          // to the stored record. The resolved password is then ALSO exposed as a
+          // lazy resolver so an OS-keychain machine behaves exactly like a real
+          // connect (read on demand, never logged).
+          const savedRec = (() => {
+            const byId = body.id ? machines[machineIndex(String(body.id))] : null
+            if (byId) return byId
+            // No id (a fresh form that happens to match a saved machine): match on
+            // the identity the form is about to dial.
+            const hit = machineRecordFor({
+              host: String(body.host || ''),
+              port: Number(body.port) || 22,
+              username: String(body.username || ''),
+            })
+            return hit || null
+          })()
+          const savedPassword = savedRec ? await machinePassword(savedRec) : ''
+          const cred = resolveProbeCredentials(body, savedRec, savedPassword)
           // Issue #38: "test" on an ssh-config ALIAS resolves the alias first —
           // the form holds the alias name, not the host it points at.
-          const probeBackend = String(body.backend || config.backend || 'native')
+          const probeBackend = String(cred.backend || config.backend || 'native')
           const probeIsOpenssh = isSystemOpenSshBackend({ backend: probeBackend })
           const aliasTarget = body.useSshConfig
             ? resolveMachineSshConfig({
                 host: String(body.host || ''),
                 port: Number(body.port) || 22,
                 username: String(body.username || ''),
-                privateKeyPath: String(body.privateKeyPath || ''),
-                proxy: body.proxy,
+                privateKeyPath: String(cred.privateKeyPath || ''),
+                proxy: cred.proxy,
                 useSshConfig: true,
               }, { text: sshConfigText() })
             : null
@@ -3641,19 +3917,24 @@ export async function apply(ctx, config) {
             host: probeTarget && !probeIsOpenssh ? probeTarget.host : String(body.host || config.host),
             port: (probeTarget && !probeIsOpenssh && probeTarget.port) ? probeTarget.port : (Number(body.port) || config.port),
             username: (probeTarget && !probeIsOpenssh && probeTarget.username) ? probeTarget.username : String(body.username || config.username),
-            password: String(body.password || ''),
-            privateKeyPath: (probeTarget && !probeIsOpenssh && probeTarget.privateKeyPath) ? probeTarget.privateKeyPath : String(body.privateKeyPath || config.privateKeyPath),
-            passphrase: String(body.passphrase || ''),
-            proxy: (probeTarget && !probeIsOpenssh && probeTarget.proxy) ? probeTarget.proxy : (body.proxy && body.proxy.host ? {
-              host: String(body.proxy.host),
-              port: Number(body.proxy.port) || 22,
-              username: String(body.proxy.username || ''),
-              password: String(body.proxy.password || ''),
-              privateKeyPath: String(body.proxy.privateKeyPath || ''),
-            } : undefined),
+            password: cred.password,
+            privateKeyPath: (probeTarget && !probeIsOpenssh && probeTarget.privateKeyPath) ? probeTarget.privateKeyPath : String(cred.privateKeyPath || config.privateKeyPath),
+            passphrase: cred.passphrase,
+            // Auth METHOD flags come from the merge too: a machine that
+            // authenticates through an agent or keyboard-interactive used to be
+            // probed with `useAgent: false`, i.e. with no auth method at all.
+            useAgent: cred.useAgent,
+            keyboardInteractive: cred.keyboardInteractive,
+            ...(cred.hostKeyMode ? { hostKeyMode: cred.hostKeyMode } : {}),
+            ...(cred.sshBinary ? { sshBinary: cred.sshBinary } : {}),
+            proxy: (probeTarget && !probeIsOpenssh && probeTarget.proxy) ? probeTarget.proxy : cred.proxy,
             connectTimeoutMs: Math.min(Math.max(Number(body.connectTimeoutMs) || config.connectTimeoutMs, 2000), 30000),
             commandTimeoutMs: 10000,
           }, { knownHostsFile })
+          // Same lazy resolution the active pool uses: if the merged password was
+          // empty because the secret lives in the OS keychain, the pool asks again
+          // at dial time instead of failing with "no credentials".
+          probe.passwordResolver = async () => machinePassword(savedRec || {})
           const started = Date.now()
           await probe.connect()
           await probe.exec('true', { timeoutMs: 10000 })
@@ -3676,6 +3957,9 @@ export async function apply(ctx, config) {
             platform: probe.platform,
             shell: probe.shellMode,
             gitBash: probe.gitBashPath || '',
+            // Tell the UI whether the probe leaned on the SAVED credential: with
+            // an empty password box, "测试成功" otherwise looks impossible.
+            usedSavedCredential: cred.usedSavedCredential,
             // Issue #38: tell the settings page where an alias resolved to (and
             // anything the plugin could not honour, e.g. a multi-hop ProxyJump).
             alias: aliasTarget ? { name: aliasTarget.alias, host: aliasTarget.host, port: aliasTarget.port, user: aliasTarget.username, warnings: aliasTarget.warnings } : null,
@@ -3726,11 +4010,23 @@ export async function apply(ctx, config) {
           const body = JSON.parse((await readBody(req)) || '{}')
           const action = String(body.action || '')
           if (action === 'define') {
+            // Validate the port HERE, not at start time: `listen(0)` would silently
+            // pick an ephemeral port and the user would be looking at a forward
+            // that listens nowhere they asked for. The settings UI cannot produce
+            // this, but the HTTP API (and therefore an agent) can.
+            const listenPort = Number(body.listenPort)
+            if (!Number.isInteger(listenPort) || listenPort < 1 || listenPort > 65535) {
+              return sendJson(res, 400, { ok: false, error: 'listenPort 必须是 1–65535 的整数' })
+            }
+            const targetPort = Number(body.targetPort) || listenPort
+            if (!Number.isInteger(targetPort) || targetPort < 1 || targetPort > 65535) {
+              return sendJson(res, 400, { ok: false, error: 'targetPort 必须是 1–65535 的整数' })
+            }
             const d = forwards.define({
               direction: body.direction === 'reverse' ? 'reverse' : 'local',
-              listenPort: Number(body.listenPort),
+              listenPort,
               targetHost: body.targetHost || '127.0.0.1',
-              targetPort: Number(body.targetPort) || Number(body.listenPort),
+              targetPort,
               autoStart: !!body.autoStart,
               machineId: store.currentId,
             })
@@ -4109,7 +4405,16 @@ export async function apply(ctx, config) {
           if (!home) return sendJson(res, 200, { ok: true, home: null, hint: 'Windows 远程暂不支持 ~ 解析，请直接输入绝对路径' })
           return sendJson(res, 200, { ok: true, home })
         } catch (err) {
-          return sendJson(res, 200, { ok: true, home: null, error: String((err && err.message) || err) })
+          // `ok:false` — reporting `ok:true` WITH an `error` is a contradiction:
+          // any caller that trusts `ok` treats "could not resolve the home
+          // directory" as success. The picker only reads `home`, so it still falls
+          // back to `hint`/`error` exactly as before.
+          return sendJson(res, 200, {
+            ok: false,
+            home: null,
+            hint: 'Windows 远程暂不支持 ~ 解析，请直接输入绝对路径',
+            error: String((err && err.message) || err),
+          })
         }
       },
     },