dsh-remote 0.8.54 → 0.8.60

package/lib/registry.js

@@ -58,15 +58,129 @@ export function saveMachines(file, list, currentId, keepCurrentKey = true) {
   writeFileSync(file, JSON.stringify(payload, null, 2))
 }
 
-/** Strip secrets before sending a machine to the client. */
+/**
+ * Does this record actually HAVE a password the plugin can use?
+ *
+ * `passwordSet` used to be `!!m.password`, i.e. "a PLAINTEXT password exists in
+ * machines.json". A machine whose password lives in the OS keychain stores
+ * `password: ''` (by design — issue #30), so it reported `passwordSet: false`
+ * and the settings page showed an empty password box with no indication that a
+ * credential was saved. That is the difference between "the plugin forgot my
+ * password" and "the plugin has it and will not echo it".
+ *
+ * `secretStored` is written by the save route from the keychain result, so new
+ * records carry the truth. Records saved before that flag existed only carry the
+ * backend name, which is the best evidence available for them (a non-plain
+ * backend means a secret was meant to live in the OS store).
+ *
+ * @param {object} m - a registry record.
+ * @returns {boolean}
+ */
+export function hasStoredPassword(m) {
+  if (!m) return false
+  if (m.password) return true
+  if (m.secretStored === true) return true
+  if (m.secretStored === undefined && m.credentialBackend && m.credentialBackend !== 'plain') return true
+  return false
+}
+
+/** Strip secrets before sending a machine to the client.
+ *
+ *  Secrets never round-trip to the browser: a password is replaced by
+ *  `passwordSet`, and the private-key `passphrase` — which IS stored in the
+ *  record — is replaced by `passphraseSet`. Both flags exist so the settings form
+ *  can say "已保存（••••••••），留空 = 不修改" instead of showing an empty box that
+ *  looks like the plugin lost the value. */
 export function sanitizeMachine(m) {
   if (!m) return m
-  const { password, proxy, ...rest } = m
-  const out = { ...rest, passwordSet: !!(m.password && m.password.length) }
-  if (proxy) out.proxy = { ...proxy, password: proxy.password ? '' : undefined, passwordSet: !!(proxy.password && proxy.password.length) }
+  const { password, passphrase, proxy, ...rest } = m
+  const out = {
+    ...rest,
+    passwordSet: hasStoredPassword(m),
+    passphraseSet: !!(passphrase && String(passphrase).length),
+  }
+  if (proxy) {
+    out.proxy = {
+      ...proxy,
+      password: proxy.password ? '' : undefined,
+      passwordSet: !!(proxy.password && proxy.password.length),
+    }
+  }
   return out
 }
 
+/**
+ * Resolve the credentials a TEST probe must dial with (issue: "编辑已连接机器 → 测试
+ * 连接" always failed with `no credentials`).
+ *
+ * The settings form never receives stored secrets, so an edit-then-test posted an
+ * EMPTY password while a real connect (which resolves the keychain/plain secret
+ * through the pool's `passwordResolver`) worked fine. The probe therefore has to
+ * be a MERGE: the form is an override layer, and anything it leaves blank falls
+ * back to what is stored for that machine.
+ *
+ * Rules, deliberately one-way (a form value never gets discarded):
+ *   · a non-empty form string wins;
+ *   · an empty/absent form string keeps the stored value;
+ *   · booleans (`useAgent`, `keyboardInteractive`) are taken from the form when
+ *     the form actually supplied a boolean, otherwise from the record — the
+ *     probe must exercise the SAME auth method the machine will use;
+ *   · a jump-host (`proxy`) password the form did not re-supply is carried over
+ *     from the stored proxy, otherwise a bastion-protected machine "fails to
+ *     test" for a reason that has nothing to do with the target.
+ *
+ * @param {object} body - the probe request body (form values).
+ * @param {object|null} rec - the saved machine record, if any.
+ * @param {string} [storedPassword] - the record's resolvable password (may come
+ *   from the OS keychain, hence the separate argument).
+ * @returns {{password:string,passphrase:string,privateKeyPath:string,useAgent:boolean,
+ *   keyboardInteractive:boolean,hostKeyMode:string,sshBinary:string,backend:string,
+ *   proxy:object|undefined,usedSavedCredential:boolean}}
+ */
+export function resolveProbeCredentials(body = {}, rec = null, storedPassword = '') {
+  const form = body || {}
+  const saved = rec || {}
+  const str = (v) => (v === undefined || v === null ? '' : String(v))
+  const pick = (formVal, storedVal) => {
+    const f = str(formVal).trim()
+    return f !== '' ? str(formVal) : str(storedVal)
+  }
+  const pickBool = (formVal, storedVal) => (typeof formVal === 'boolean' ? formVal : !!storedVal)
+
+  const formPassword = str(form.password)
+  const password = formPassword !== '' ? formPassword : str(storedPassword)
+  const formProxy = form.proxy && form.proxy.host ? form.proxy : null
+  const savedProxy = saved.proxy && saved.proxy.host ? saved.proxy : null
+  const baseProxy = formProxy || savedProxy
+  const proxy = baseProxy
+    ? {
+        host: String(baseProxy.host),
+        port: Number(baseProxy.port) || 22,
+        username: str(baseProxy.username),
+        password: formProxy && str(formProxy.password) !== ''
+          ? str(formProxy.password)
+          : str(savedProxy && savedProxy.password),
+        privateKeyPath: str(baseProxy.privateKeyPath),
+      }
+    : undefined
+
+  return {
+    password,
+    passphrase: pick(form.passphrase, saved.passphrase),
+    privateKeyPath: pick(form.privateKeyPath, saved.privateKeyPath),
+    useAgent: pickBool(form.useAgent, saved.useAgent),
+    keyboardInteractive: pickBool(form.keyboardInteractive, saved.keyboardInteractive),
+    hostKeyMode: pick(form.hostKeyMode, saved.hostKeyMode),
+    sshBinary: pick(form.sshBinary, saved.sshBinary),
+    backend: pick(form.backend, saved.backend) || 'native',
+    proxy,
+    // True when the form could not supply the credential and the stored one had
+    // to be used — the UI says so, because "测试成功" with an empty password box
+    // is otherwise indistinguishable from a form-only probe.
+    usedSavedCredential: formPassword === '' && password !== '',
+  }
+}
+
 /** Machine grouping metadata (host organisation).
  *
  *  A flat list does not survive contact with reality: once a user has a dozen

package/lib/routes-fs.js

@@ -37,7 +37,17 @@ export function createFsRoutes({
       path: '/dsh-remote/ls',
       handler: async (req, res) => {
         try {
-          const hint = requestSessionHint(req)
+          // A POST body counts. This route used to read the session hint from the
+          // QUERY STRING only, so `POST /ls {sessionId}` silently listed the ACTIVE
+          // machine instead of the caller's — the wrong-host hazard issue #25 is
+          // about, reachable through the API even though the browser always uses
+          // GET. `/read`, `/write` and `/fs` already honoured the body; now this one
+          // does too, and `path` may come from either place.
+          let body = {}
+          if (req.method === 'POST') {
+            try { body = JSON.parse((await readBody(req)) || '{}') } catch { body = {} }
+          }
+          const hint = requestSessionHint(req, body)
           const b = await bindOrReply(req, res, hint)
           if (!b) return
           // Identity echo (external-switch defense): name the machine this
@@ -53,7 +63,9 @@ export function createFsRoutes({
           }
           await b.pool.detect()
           const q = new URL(req.url, 'http://localhost').searchParams
-          const raw = q.get('path') ? decodeURIComponent(q.get('path')) : (b.ws || '')
+          const raw = q.get('path')
+            ? decodeURIComponent(q.get('path'))
+            : (body.path ? String(body.path) : (b.ws || ''))
           const canon = normalizeRemotePath(raw)
           const win = b.pool.platform === 'windows'
           if (canon === '/' || raw === '' || raw === '/') {

package/lib/web-deploy.js

@@ -595,7 +595,13 @@ function q(s) {
  */
 export function buildInstallPlan(spec) {
   const facts = spec.facts || {}
-  const prefix = String(spec.prefix || '').replace(/\/+$/, '')
+  const prefix = String(spec.prefix || '').trim().replace(/\/+$/, '')
+  // An empty prefix emits `mkdir -p ''` / `cd ''` / `--prefix ''`: commands that
+  // either fail confusingly or (worse) touch the filesystem root. Refuse to build
+  // such a plan at all — the caller must resolve a prefix first.
+  if (!prefix || prefix === '/') {
+    throw new Error('buildInstallPlan: refusing to build a plan without a private install prefix')
+  }
   const version = String(spec.version || DEFAULT_INSTALL_VERSION)
   const registry = String(spec.registry || '')
   const env = spec.env && typeof spec.env === 'object' ? spec.env : undefined

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-remote",
-  "version": "0.8.54",
-  "description": "Remote-work assistant for DeepSeek Harness: connect SSH (password/key/agent/keyboard-interactive/proxy jump), pick a remote workspace, operate on it with 22 rw_* tools (incl. rw_edit/rw_stat/rw_mkdir/rw_remove/rw_move/rw_forward), conflict-aware mirror sync, one-click remote dsh deploy + web UI attach, port forwarding, optional side-bar remote file editing, audit log, keychain passwords.",
+  "version": "0.8.60",
+  "description": "Remote-work assistant for DeepSeek Harness: connect SSH (password/key/agent/keyboard-interactive, multi-hop ProxyJump), pick a remote workspace, operate on it with 22 rw_* tools, conflict-aware mirror sync, an embedded PTY terminal, one-click remote dsh deploy + web UI attach, port forwarding, host grouping, remote sandbox fencing, audit log, keychain passwords.",
   "license": "MIT",
   "author": "flymysql <flyphp@outlook.com>",
   "readme": "README.md",
@@ -17,6 +17,8 @@
   "keywords": [
     "deepseek-harness",
     "dsh",
+    "sandbox",
+    "terminal",
     "dsh-plugin",
     "remote",
     "ssh",
@@ -90,6 +92,8 @@
     "semver": "^7.8.5"
   },
   "scripts": {
-    "test": "node --import ./test/setup-telemetry-off.mjs --test --test-timeout=20000 --test-force-exit"
+    "test": "node --import ./test/setup-telemetry-off.mjs --test --test-timeout=40000 --test-force-exit",
+    "test:coverage": "node scripts/coverage-union.mjs",
+    "test:coverage:gate": "node scripts/coverage-union.mjs --gate 70"
   }
 }