dsh-remote 0.8.54 → 0.8.60

package/lib/credential.js

@@ -12,7 +12,7 @@
 //             $DSH_HOME/remote-workspaces/.secrets/
 //   linux   → `secret-tool` (libsecret / gnome-keyring), optional
 //   else    → unsupported (plain)
-import { execFile } from 'node:child_process'
+import { spawn } from 'node:child_process'
 import { mkdirSync, writeFileSync, readFileSync, unlinkSync } from 'node:fs'
 import { join as joinPath } from 'node:path'
 
@@ -26,12 +26,60 @@ const TIMEOUT = 8000
 // harmless on PowerShell 7, where the type is already available.
 const PS_SECURITY_ASSEMBLY = 'Add-Type -AssemblyName System.Security -ErrorAction SilentlyContinue;'
 
+/**
+ * Run a helper and resolve with its trimmed stdout.
+ *
+ * WHY `spawn` and not `execFile(..., { input })`: measured on a real Ubuntu box
+ * with a real gnome-keyring, `secret-tool store` given its password through
+ * `execFile`'s `input` option **never saw EOF**, blocked on the read, and was
+ * killed by this timeout — so on Linux "encrypt the password" always failed after
+ * 8 seconds with the useless message "Command failed: secret-tool store …" (empty
+ * stderr) and the credential was dropped. The same command with an explicitly
+ * ended stdin (`spawn` + `stdin.end()`, or `sh -c '… < file'`) finishes in ~20ms.
+ * Nothing in this module needs the extra `execFile` machinery, so stdin is now
+ * always closed explicitly and the child's stderr is carried on the error (the old
+ * path dropped it, which is why the failure had no reason attached).
+ */
 function run(bin, args, input) {
   return new Promise((resolve, reject) => {
-    execFile(bin, args, { timeout: TIMEOUT, maxBuffer: 1 << 20, ...(input != null ? { input } : {}) }, (err, stdout, stderr) => {
-      if (err) return reject(err)
-      resolve(String(stdout || '').trim())
+    let child
+    try {
+      child = spawn(bin, args, { stdio: ['pipe', 'pipe', 'pipe'] })
+    } catch (err) {
+      reject(err)
+      return
+    }
+    let out = ''
+    let errOut = ''
+    let settled = false
+    const timer = setTimeout(() => {
+      if (settled) return
+      settled = true
+      try { child.kill('SIGTERM') } catch { /* already gone */ }
+      const err = new Error(`${bin} timed out after ${TIMEOUT}ms`)
+      err.stderr = errOut
+      err.code = 'ETIMEDOUT'
+      reject(err)
+    }, TIMEOUT)
+    const done = (err, value) => {
+      if (settled) return
+      settled = true
+      clearTimeout(timer)
+      if (err) reject(err); else resolve(value)
+    }
+    child.on('error', (err) => done(err))
+    child.on('close', (code) => {
+      if (code === 0) return done(null, out.trim())
+      const err = new Error(`${bin} exited with ${code}${errOut.trim() ? ': ' + errOut.trim().slice(0, 300) : ''}`)
+      err.code = code
+      err.stderr = errOut
+      done(err)
     })
+    child.stdout.on('data', (d) => { out += d })
+    child.stderr.on('data', (d) => { errOut += d })
+    // Always end stdin: a helper that reads a secret from stdin needs EOF, and one
+    // that does not must not inherit an open pipe.
+    try { child.stdin.end(input == null ? '' : String(input)) } catch { /* closed early */ }
   })
 }
 

package/lib/errors.js

@@ -24,10 +24,22 @@ export function classifyError(err, opts = {}) {
       raw: msg,
     }
   }
+  // Checked BEFORE the generic `no credentials` branch: the actionable failure
+  // there is "this process has no ssh-agent", not "you forgot to configure a
+  // credential". Telling a Windows user to "set a password or a privateKeyPath"
+  // when they already ticked 使用 SSH agent is how a config page gets a
+  // reputation for lying.
+  if (/no SSH agent available|SSH_AUTH_SOCK/i.test(msg)) {
+    return {
+      category: 'credentials',
+      hint: `SSH agent 不可用${where}：这台机器勾选了「使用 SSH agent」，但 DSH 宿主进程里没有 SSH_AUTH_SOCK（Windows 默认没有 agent 服务）。要么在启动 DSH 之前把 agent 跑起来并导出 SSH_AUTH_SOCK（或用 Pageant），要么取消勾选 agent 并给这台机器保存密码/私钥。`,
+      raw: msg,
+    }
+  }
   if (/no credentials/i.test(msg)) {
     return {
       category: 'credentials',
-      hint: `缺少凭据：请设置 password 或 privateKeyPath（私钥只在显式提供时使用），或为该机器启用 SSH agent。`,
+      hint: `缺少凭据${where}：这台机器没有可用密码、私钥或 agent。请在「远程工作区」设置里填密码（或用私钥路径 / 勾选 agent）后保存；若你确信已经填过，说明保存时密码没有真正落盘（看保存后是否弹出密钥库失败警告），重新填写并保存即可，可用「测试连接」当场验证。`,
       raw: msg,
     }
   }
@@ -38,6 +50,18 @@ export function classifyError(err, opts = {}) {
       raw: msg,
     }
   }
+  // ssh2 reports a socket that dies DURING the handshake as the bare string
+  // "Connection lost before handshake" — no host, no cause, no advice. That is
+  // the message a user sees when the port is open but nothing speaks SSH on it,
+  // or when a firewall/security group cuts the connection after the TCP accept;
+  // it is indistinguishable from "wrong credentials" unless it is classified.
+  if (/connection lost before handshake|handshake failed|no matching (key exchange|host key|cipher)/i.test(msg)) {
+    return {
+      category: 'network',
+      hint: `SSH 握手未完成${where}：TCP 连上了但 SSH 握手没走完——端口上没有跑 sshd、连接被防火墙/安全组拒绝、或远端只支持不兼容的加密算法。确认 host/port 指向 sshd，必要时换端口或让运维放行。`,
+      raw: msg,
+    }
+  }
   if (/ECONNREFUSED|connection refused/i.test(msg)) {
     return {
       category: 'network',
@@ -78,10 +102,17 @@ export function classifyError(err, opts = {}) {
   return { category: 'other', hint: msg, raw: msg }
 }
 
-/** One-line friendly message: hint (+ raw when it adds information). */
+/** One-line friendly message: hint (+ raw when it adds information).
+ *
+ *  An UNCLASSIFIED failure still gets the host appended: "Connection lost before
+ *  handshake" or a raw errno on its own leaves the user unable to tell WHICH
+ *  machine failed, which is the one thing a multi-machine plugin must never hide. */
 export function friendlyMessage(err, opts = {}) {
   const c = classifyError(err, opts)
-  if (c.category === 'other') return c.raw
+  const where = opts.host ? ` (${opts.host}:${opts.port || 22})` : ''
+  if (c.category === 'other') {
+    return where && !c.raw.includes(opts.host) ? `${c.raw}${where}` : c.raw
+  }
   if (c.raw && c.raw !== c.hint) return `${c.hint}（原始错误：${c.raw}）`
   return c.hint
 }

package/lib/index.js

@@ -58,7 +58,7 @@ import {
 import { registerDeploySkill, buildInvestigatePrompt, SKILL_NAME } from './web-deploy-skill.js'
 import { selfDir, diskVersion, LOADED_VERSION, gtVersion, fetchLatestVersion, applyUpdate, persistUpdateMode, readUpdateMode, reloadSelf, scheduleSelfReload, lastSelfReload, isInstalledCopy } from './update.js'
 import { sendHeartbeat, pseudonym, heartbeatUrl, hasPersistedId, installIdPath } from './telemetry.js'
-import { loadMachines as _loadMachines, saveMachines as _saveMachines, sanitizeMachine as _sanitizeMachine, applyMachine as _applyMachine, machineId as _machineId, normalizeMachineGroup, filterMachinesByGroup } from './registry.js'
+import { loadMachines as _loadMachines, saveMachines as _saveMachines, sanitizeMachine as _sanitizeMachine, applyMachine as _applyMachine, machineId as _machineId, normalizeMachineGroup, filterMachinesByGroup, resolveProbeCredentials } from './registry.js'
 import { registerHttpTransports } from './http-transport.js'
 import { SshPool, ActivePool, createPool } from './pool.js'
 import { isSystemOpenSshBackend, sshBinaryAvailable, resolveSshBinary } from './openssh.js'
@@ -1495,6 +1495,29 @@ export async function apply(ctx, config) {
       err.httpStatus = 403
       throw err
     }
+    // No session context: fall back to the ACTIVE machine. Boot restore runs on
+    // `setImmediate`, so a request that arrives first would see `config.host`
+    // still empty even though the registry already names a current machine —
+    // apply it here instead of answering "no machine" to a user who HAS one.
+    if (!String(config.host || '').trim()) {
+      const m = activeMachine()
+      if (m && m.host) {
+        try { await applyActiveMachine() } catch { /* reported below */ }
+      }
+    }
+    // Still nothing: answer with the REAL reason. Falling through used to hand the
+    // caller the un-configured pool, whose first command failed with
+    // "no credentials: set a password, a privateKeyPath…" — i.e. a missing
+    // *selection* was reported as a missing *credential*, which sends people to the
+    // wrong settings page.
+    if (!String(config.host || '').trim()) {
+      const err = new Error(
+        '当前没有活动远程机：请先在「远程工作区」设置里选择或连接一台机器。'
+        + '（保存的机器只是备用连接，不会自动成为当前机器。）',
+      )
+      err.httpStatus = 409
+      throw err
+    }
     return {
       pool,
       ws: wsPath(),
@@ -3199,6 +3222,13 @@ export async function apply(ctx, config) {
     })
   const pickLocalNative = async () => {
     const platform = process.platform
+    // Escape hatch for non-interactive hosts and for the test suite: opening a
+    // real OS folder dialog from a request handler means the REQUEST waits for a
+    // human. In a headless host (or CI) that is a hang nobody can see or cancel —
+    // the route then falls back to its browse capability / "type the path" hint.
+    if (String(process.env.DSH_REMOTE_NO_NATIVE_DIALOG || '') && process.env.DSH_REMOTE_NO_NATIVE_DIALOG !== '0') {
+      throw new Error('已禁用本机目录选择器对话框（DSH_REMOTE_NO_NATIVE_DIALOG）—— 请直接在输入框填本地路径')
+    }
     if (platform === 'darwin') {
       return runPick('osascript', ['-e', 'set selectedFolder to choose folder with prompt "Select Workspace Directory"', '-e', 'POSIX path of selectedFolder'])
     }
@@ -3622,8 +3652,20 @@ export async function apply(ctx, config) {
                 port: Number(body.port) || 22,
                 username: String(body.username || '').trim() || 'root',
                 password: '',
-                privateKeyPath: String(body.privateKeyPath || '').trim(),
-                passphrase: body.passphrase || '',
+                // An OMITTED `privateKeyPath` keeps the stored one; an explicit
+                // empty string clears it (that is what the form sends when the user
+                // empties the box). A partial update from an API/agent caller used
+                // to silently wipe the key path, leaving a machine that can only
+                // fail to authenticate — the same data-loss class as the passphrase.
+                privateKeyPath: body.privateKeyPath === undefined
+                  ? String((prev && prev.privateKeyPath) || '')
+                  : String(body.privateKeyPath || '').trim(),
+                // An EMPTY passphrase from the form means "unchanged", not
+                // "delete it": the value is never echoed back to the browser, so
+                // an edit that touched any other field used to silently wipe a
+                // saved private-key passphrase (and the next connect then failed
+                // with "no passphrase given" for a key that had been working).
+                passphrase: String(body.passphrase || (prev && prev.passphrase) || ''),
                 workspace: String(body.workspace || '').trim(),
                 hostKeyMode: body.hostKeyMode || '',
                 useAgent: !!body.useAgent,
@@ -3649,13 +3691,20 @@ export async function apply(ctx, config) {
                   description: body.description === undefined ? (prev && prev.description) : body.description,
                   tags: body.tags === undefined ? (prev && prev.tags) : body.tags,
                 }),
-                proxy: body.proxy && body.proxy.host ? {
-                  host: String(body.proxy.host),
-                  port: Number(body.proxy.port) || 22,
-                  username: String(body.proxy.username || '').trim(),
-                  password: String(body.proxy.password || ''),
-                  privateKeyPath: String(body.proxy.privateKeyPath || '').trim(),
-                } : undefined,
+                // A jump host the form did not mention is KEPT (omitted ≠
+                // removed), and a jump PASSWORD the form did not re-supply is
+                // kept too: the settings page never receives it back, so an edit
+                // used to strip the bastion credential and the machine could
+                // only fail at connect time.
+                proxy: body.proxy === undefined
+                  ? (prev && prev.proxy && prev.proxy.host ? prev.proxy : undefined)
+                  : (body.proxy && body.proxy.host ? {
+                      host: String(body.proxy.host),
+                      port: Number(body.proxy.port) || 22,
+                      username: String(body.proxy.username || '').trim(),
+                      password: String(body.proxy.password || (prev && prev.proxy && prev.proxy.password) || ''),
+                      privateKeyPath: String(body.proxy.privateKeyPath || '').trim(),
+                    } : undefined),
                 credentialBackend: credBackend,
                 recentWorkspaces: prev && prev.recentWorkspaces ? prev.recentWorkspaces : [],
                 lastConnectedAt: prev && prev.lastConnectedAt ? prev.lastConnectedAt : null,
@@ -3677,12 +3726,33 @@ export async function apply(ctx, config) {
                 })
                 rec.credentialBackend = persisted.credentialBackend
                 rec.password = persisted.password
+                // Record WHERE the secret ended up, so the settings page can say
+                // "已保存" for a keychain machine too (its record carries an
+                // empty `password` by design).
+                rec.secretStored = persisted.stored === 'secret'
                 if (persisted.warning) {
                   warning = persisted.warning
                   warningDetail = persisted.error
                 }
-              } else if (prev && prev.password) {
-                rec.password = prev.password
+              } else if (prev) {
+                // No password typed: keep whatever the machine already had —
+                // the plaintext copy AND the keychain flag. Turning the
+                // "加密保存密码" checkbox OFF is handled next: it must actually
+                // MOVE the secret, or the checkbox is a lie.
+                rec.password = prev.password || ''
+                rec.secretStored = prev.secretStored
+                const prevKeychain = prev.credentialBackend && prev.credentialBackend !== 'plain'
+                if (credBackend === 'plain' && prevKeychain) {
+                  try {
+                    const existing = await machinePassword(prev)
+                    if (existing) {
+                      rec.password = existing
+                      rec.secretStored = false
+                      rec.credentialBackend = 'plain'
+                      await deleteSecret(id, secretsDir()).catch(() => {})
+                    }
+                  } catch { /* keep the keychain copy; the next connect still works */ }
+                }
               }
               if (i >= 0) machines[i] = rec; else machines.push(rec)
               // Issue #13: saving a machine must NOT make it the active
@@ -3788,17 +3858,46 @@ export async function apply(ctx, config) {
         let body = {}
         try {
           body = parseJsonObject(await readBody(req))
+          // ── The probe must dial with the credentials a REAL connect would use.
+          //
+          // Stored secrets never travel back to the browser (see
+          // sanitizeMachine), so "编辑一台已经连接成功的机器 → 点测试连接" posted an
+          // EMPTY password while the machine itself connected fine through the
+          // pool's keychain/plaintext resolver. Every such probe died with
+          // `no credentials: set a password, a privateKeyPath, or enable
+          // useAgent to connect` — the error said "you configured nothing" about
+          // a machine that was visibly working.
+          //
+          // So: resolve the saved record (by id when the form is editing one,
+          // else by identity) and merge — form values override, blanks fall back
+          // to the stored record. The resolved password is then ALSO exposed as a
+          // lazy resolver so an OS-keychain machine behaves exactly like a real
+          // connect (read on demand, never logged).
+          const savedRec = (() => {
+            const byId = body.id ? machines[machineIndex(String(body.id))] : null
+            if (byId) return byId
+            // No id (a fresh form that happens to match a saved machine): match on
+            // the identity the form is about to dial.
+            const hit = machineRecordFor({
+              host: String(body.host || ''),
+              port: Number(body.port) || 22,
+              username: String(body.username || ''),
+            })
+            return hit || null
+          })()
+          const savedPassword = savedRec ? await machinePassword(savedRec) : ''
+          const cred = resolveProbeCredentials(body, savedRec, savedPassword)
           // Issue #38: "test" on an ssh-config ALIAS resolves the alias first —
           // the form holds the alias name, not the host it points at.
-          const probeBackend = String(body.backend || config.backend || 'native')
+          const probeBackend = String(cred.backend || config.backend || 'native')
           const probeIsOpenssh = isSystemOpenSshBackend({ backend: probeBackend })
           const aliasTarget = body.useSshConfig
             ? resolveMachineSshConfig({
                 host: String(body.host || ''),
                 port: Number(body.port) || 22,
                 username: String(body.username || ''),
-                privateKeyPath: String(body.privateKeyPath || ''),
-                proxy: body.proxy,
+                privateKeyPath: String(cred.privateKeyPath || ''),
+                proxy: cred.proxy,
                 useSshConfig: true,
               }, { text: sshConfigText() })
             : null
@@ -3818,19 +3917,24 @@ export async function apply(ctx, config) {
             host: probeTarget && !probeIsOpenssh ? probeTarget.host : String(body.host || config.host),
             port: (probeTarget && !probeIsOpenssh && probeTarget.port) ? probeTarget.port : (Number(body.port) || config.port),
             username: (probeTarget && !probeIsOpenssh && probeTarget.username) ? probeTarget.username : String(body.username || config.username),
-            password: String(body.password || ''),
-            privateKeyPath: (probeTarget && !probeIsOpenssh && probeTarget.privateKeyPath) ? probeTarget.privateKeyPath : String(body.privateKeyPath || config.privateKeyPath),
-            passphrase: String(body.passphrase || ''),
-            proxy: (probeTarget && !probeIsOpenssh && probeTarget.proxy) ? probeTarget.proxy : (body.proxy && body.proxy.host ? {
-              host: String(body.proxy.host),
-              port: Number(body.proxy.port) || 22,
-              username: String(body.proxy.username || ''),
-              password: String(body.proxy.password || ''),
-              privateKeyPath: String(body.proxy.privateKeyPath || ''),
-            } : undefined),
+            password: cred.password,
+            privateKeyPath: (probeTarget && !probeIsOpenssh && probeTarget.privateKeyPath) ? probeTarget.privateKeyPath : String(cred.privateKeyPath || config.privateKeyPath),
+            passphrase: cred.passphrase,
+            // Auth METHOD flags come from the merge too: a machine that
+            // authenticates through an agent or keyboard-interactive used to be
+            // probed with `useAgent: false`, i.e. with no auth method at all.
+            useAgent: cred.useAgent,
+            keyboardInteractive: cred.keyboardInteractive,
+            ...(cred.hostKeyMode ? { hostKeyMode: cred.hostKeyMode } : {}),
+            ...(cred.sshBinary ? { sshBinary: cred.sshBinary } : {}),
+            proxy: (probeTarget && !probeIsOpenssh && probeTarget.proxy) ? probeTarget.proxy : cred.proxy,
             connectTimeoutMs: Math.min(Math.max(Number(body.connectTimeoutMs) || config.connectTimeoutMs, 2000), 30000),
             commandTimeoutMs: 10000,
           }, { knownHostsFile })
+          // Same lazy resolution the active pool uses: if the merged password was
+          // empty because the secret lives in the OS keychain, the pool asks again
+          // at dial time instead of failing with "no credentials".
+          probe.passwordResolver = async () => machinePassword(savedRec || {})
           const started = Date.now()
           await probe.connect()
           await probe.exec('true', { timeoutMs: 10000 })
@@ -3853,6 +3957,9 @@ export async function apply(ctx, config) {
             platform: probe.platform,
             shell: probe.shellMode,
             gitBash: probe.gitBashPath || '',
+            // Tell the UI whether the probe leaned on the SAVED credential: with
+            // an empty password box, "测试成功" otherwise looks impossible.
+            usedSavedCredential: cred.usedSavedCredential,
             // Issue #38: tell the settings page where an alias resolved to (and
             // anything the plugin could not honour, e.g. a multi-hop ProxyJump).
             alias: aliasTarget ? { name: aliasTarget.alias, host: aliasTarget.host, port: aliasTarget.port, user: aliasTarget.username, warnings: aliasTarget.warnings } : null,
@@ -3903,11 +4010,23 @@ export async function apply(ctx, config) {
           const body = JSON.parse((await readBody(req)) || '{}')
           const action = String(body.action || '')
           if (action === 'define') {
+            // Validate the port HERE, not at start time: `listen(0)` would silently
+            // pick an ephemeral port and the user would be looking at a forward
+            // that listens nowhere they asked for. The settings UI cannot produce
+            // this, but the HTTP API (and therefore an agent) can.
+            const listenPort = Number(body.listenPort)
+            if (!Number.isInteger(listenPort) || listenPort < 1 || listenPort > 65535) {
+              return sendJson(res, 400, { ok: false, error: 'listenPort 必须是 1–65535 的整数' })
+            }
+            const targetPort = Number(body.targetPort) || listenPort
+            if (!Number.isInteger(targetPort) || targetPort < 1 || targetPort > 65535) {
+              return sendJson(res, 400, { ok: false, error: 'targetPort 必须是 1–65535 的整数' })
+            }
             const d = forwards.define({
               direction: body.direction === 'reverse' ? 'reverse' : 'local',
-              listenPort: Number(body.listenPort),
+              listenPort,
               targetHost: body.targetHost || '127.0.0.1',
-              targetPort: Number(body.targetPort) || Number(body.listenPort),
+              targetPort,
               autoStart: !!body.autoStart,
               machineId: store.currentId,
             })
@@ -4286,7 +4405,16 @@ export async function apply(ctx, config) {
           if (!home) return sendJson(res, 200, { ok: true, home: null, hint: 'Windows 远程暂不支持 ~ 解析，请直接输入绝对路径' })
           return sendJson(res, 200, { ok: true, home })
         } catch (err) {
-          return sendJson(res, 200, { ok: true, home: null, error: String((err && err.message) || err) })
+          // `ok:false` — reporting `ok:true` WITH an `error` is a contradiction:
+          // any caller that trusts `ok` treats "could not resolve the home
+          // directory" as success. The picker only reads `home`, so it still falls
+          // back to `hint`/`error` exactly as before.
+          return sendJson(res, 200, {
+            ok: false,
+            home: null,
+            hint: 'Windows 远程暂不支持 ~ 解析，请直接输入绝对路径',
+            error: String((err && err.message) || err),
+          })
         }
       },
     },