dsh-remote 0.8.54 → 0.8.61

package/lib/client.js

@@ -36,13 +36,30 @@ window.__ModuleLoader__.load({
     const L = {
       zh: {
         'settings.title': '远程工作区（dsh-remote）',
-        'settings.intro': '维护多台 SSH 机器（密码/私钥/agent/跳板机/钥匙串）。路径在新建/选择工作区时选：「本机」走系统文件夹对话框；「远程」选一台机器在远程目录中选择。',
-        'settings.machines': '已配置的机器',
-        'settings.noMachines': '还没有机器。在下方添加。',
+        'settings.intro': '下面直接列出 ~/.ssh/config 里的机器：点「连接」，再选一个远程目录就能开始。没有的机器可以手动添加（密码 / 私钥 / 跳板机）。',
+        'settings.noMachines': '还没有保存的机器 —— 上面列出的是 ~/.ssh/config 里的主机，点「连接」即可。',
+        // ── issue #73：首屏就是 ssh 配置里的主机列表（像 VSCode Remote-SSH）──
+        'settings.pickHost': '选择远程机器',
+        'settings.hostListSource': '来自 ~/.ssh/config',
+        'settings.hostListLoading': '正在读取 ~/.ssh/config…',
+        'settings.hostListRefresh': '刷新',
+        'settings.hostListRefreshHint': '重新读取 ~/.ssh/config（改完文件点这里，不用重开设置页）',
+        'settings.hostListEmpty': '没在 {file} 里找到主机。配好 ssh（Host 段）后点「刷新」，或在下面手动添加一台。',
+        'settings.hostConnect': '连接',
+        'settings.hostConnecting': '连接中…',
+        'settings.hostConnectHint': '连上并设为当前机器（之后就能选远程目录）',
+        'settings.hostConnected': '已连接 · {latency}',
+        'settings.hostConnectedHint': '已连接，选择要打开的远程目录即可开始工作。',
+        'settings.hostFillForm': '填表',
+        'settings.hostFillFormHint': '需要密码或单独覆盖参数时，把它填进下方表单',
+        'settings.badgeKey': '私钥',
+        'settings.openWorkspace': '选目录',
+        'settings.openWorkspaceHint': '在这台机器上选一个远程目录作为工作区',
+        'settings.workspaceOpened': '已打开远程工作区：{path}',
+        'settings.addMachineManual': '手动添加（密码 / 私钥 / 跳板机）',
         'settings.current': '当前',
         'settings.edit': '编辑',
         'settings.delete': '删除',
-        'settings.setCurrent': '设为当前',
         'settings.currentMachine': '当前远程机：{name}',
         'settings.clearCurrent': '取消设为当前（active remote = none）',
         'settings.noActive': '当前没有活动远程机：保存的机器只是备用连接，不会自动进入会话上下文（本地会话不受影响）。',
@@ -66,13 +83,8 @@ window.__ModuleLoader__.load({
         'settings.webAttachCmdPlaceholder': '留空 = 用全局 webAttachCommand（默认 dsh）',
         'settings.webAttachCmdHint': '远端 dsh 不在 SSH 登录 PATH 时（私有前缀 / nvm 装的 node）填它的绝对路径，例如 /home/you/.nvm/versions/node/v22.19.0/bin/node /home/you/.dsh-remote/dsh/node_modules/@deepseek-ai/dsh/lib/bin.js。留空则用全局的 webAttachCommand。',
         'settings.sshImport': '从 ~/.ssh/config 导入',
-        'settings.sshCollapse': '收起',
-        'settings.sshNoEntries': '~/.ssh/config 里没有可导入的 Host 条目',
-        'settings.sshUseAlias': '用别名（不复制）',
-        'settings.sshCopyFields': '复制字段',
-        'settings.sshAliasHint': '别名模式：机器只记住「{alias}」这个名字，主机/用户/端口/私钥/跳板每次连接都从 ~/.ssh/config 实时解析（改配置立刻生效）。',
-        'settings.useSshConfig': '使用 ~/.ssh/config 别名（只存别名，不存副本）',
-        'settings.useSshConfigHint': '留空或保持默认的字段（用户 root、端口 22、私钥、跳板）将从 ~/.ssh/config 实时解析；填了非默认值则覆盖。',
+        'settings.useSshConfig': 'Host 名来自 ~/.ssh/config（主机栏填 Host 名即可）',
+        'settings.useSshConfigHint': '连的时候会按 ~/.ssh/config 里这个 Host 的实际配置去连（用户/端口/私钥/跳板机都从文件读，改文件就生效）；这里留空即可。',
         'settings.saveWritesSshConfig': '保存时会把 主机/用户/端口/私钥 写入 ~/.ssh/config 的受管块（# dsh-remote: managed 标记）；此后该文件优先——直接改它立即生效。',
         'settings.sshResolvedTo': '→ {user}@{host}:{port}',
         'settings.sshResolvedNone': '~/.ssh/config 中没有匹配「{alias}」的 Host 条目',
@@ -83,6 +95,23 @@ window.__ModuleLoader__.load({
         'settings.port': '端口',
         'settings.user': '用户',
         'settings.password': '密码',
+        // 密码框永远是空的（宿主不会把密文/明文回传），所以「有没有存过密码」
+        // 只能靠 placeholder 表达：星号 = 已保存。空框 + 中性提示会让人以为
+        // 插件把密码弄丢了。
+        'settings.passwordPlaceholder': 'SSH 密码（隐藏输入；不用密码可留空）',
+        'settings.secretSavedPlaceholder': '••••••••••••（已保存，留空 = 不修改）',
+        'settings.secretSavedHint': '已保存密码 ••••••••••••（出于安全不回显）：留空保存 = 沿用已保存的密码，填新值 = 覆盖。',
+        'settings.passphraseSavedHint': '已保存私钥 passphrase ••••••••••••：留空保存 = 沿用，填新值 = 覆盖。',
+        'settings.proxyPwdSavedHint': '已保存跳板机密码 ••••••••••••：留空保存 = 沿用，填新值 = 覆盖。',
+        'settings.noCredentialHint': '⚠️ 这台机器还没有任何凭据（密码 / 私钥 / agent 都没填），连接会报「缺少凭据」。',
+        'settings.testUsedSaved': '（本次测试使用了已保存的密码）',
+        'settings.testHint': '用上面的配置测试连接；留空的密码/私钥/passphrase 会自动沿用已保存的值',
+        'settings.testNeedsHost': '先填写主机地址才能测试',
+        // 灰按钮必须能解释自己：用户「点了没反应」时唯一能拿到的线索就是 hover 提示。
+        'settings.saveNeedsHost': '先填写主机地址才能保存',
+        'settings.saveHint': '保存这台机器（留空的密码/私钥/passphrase 沿用已保存的值）',
+        'settings.fwdNeedsPort': '先填写本地监听端口才能添加转发',
+        'settings.fwdAddHint': '添加一条端口转发',
         'settings.advCollapse': '▲ 收起高级配置',
         'settings.advExpand': '▼ 高级配置（私钥 / 跳板机 / agent 等）',
         'settings.privateKey': '私钥路径',
@@ -144,6 +173,8 @@ window.__ModuleLoader__.load({
         'settings.deployInstall': '部署并验证',
         'settings.deployInstalling': '正在部署…',
         'settings.deployConfirm': '将在远端私有目录安装 dsh（不写系统目录、不改 PATH、不覆盖用户在用的版本）。继续？',
+        'settings.deployNeedsMachine': '先选择一台机器才能部署',
+        'settings.deployInstallHint': '在远端私有目录安装 dsh 并验证（不覆盖用户在用的版本）',
         'settings.deployInvestigate': '让 AI 排查',
         'settings.deployInvestigating': '正在创建排查会话…',
         'settings.deployOk': '远端环境可用',
@@ -152,7 +183,6 @@ window.__ModuleLoader__.load({
         'settings.deploySteps': '安装步骤',
         'settings.deployDone': '部署完成，已记录该机器使用的 dsh',
         'settings.deployFailed': '部署失败',
-        'settings.deployResumed': '已有部署任务在运行，已恢复显示其进度',
         'settings.deployTaskTitle': '部署任务',
         'settings.deployTaskRunning': '进行中',
         'settings.deployTaskDone': '已完成',
@@ -183,7 +213,6 @@ window.__ModuleLoader__.load({
         'settings.added': '已添加 — 可设为当前',
         'settings.secretStoreFailed': '密码未能写入系统密钥库（{msg}），已按 credentialFallback=plain 回退为明文保存在 machines.json。',
         'settings.secretStoreRefused': '密码未能写入系统密钥库（{msg}），已放弃保存该密码（不会以明文落盘）。修复密钥库后重新保存，或把 credentialFallback 设为 plain 以接受明文回退。',
-        'settings.switched': '已切换为当前远程机',
         'settings.cleared': '已取消当前远程机 — 本地会话不再自动使用远程上下文',
         'settings.filledSsh': '已从 ~/.ssh/config 填入（仅引用私钥路径，不读取内容）',
         'settings.workspaceSwitched': '已切换到工作区 {path}',
@@ -208,7 +237,6 @@ window.__ModuleLoader__.load({
         'settings.updateModeSet': '更新模式已设为「{mode}」',
         'settings.updateModeSaveFail': '模式保存失败: {msg}',
         'settings.deleteConfirm': '确定删除这台机器？',
-        'settings.sshReadFail': '读取 ~/.ssh/config 失败: {msg}',
         'settings.delFail': '删除失败: {msg}',
         'settings.addFail': '保存失败: {msg}',
         'settings.modeAuto': '自动',
@@ -328,13 +356,29 @@ window.__ModuleLoader__.load({
       },
       en: {
         'settings.title': 'Remote workspace (dsh-remote)',
-        'settings.intro': 'Manage multiple SSH machines (password / private key / agent / proxy jump / keychain). Pick a path when creating/selecting a workspace: "Local" opens the system folder dialog; "Remote" picks a machine and a directory on it.',
-        'settings.machines': 'Configured machines',
-        'settings.noMachines': 'No machines yet. Add one below.',
+        'settings.intro': 'Your ~/.ssh/config hosts are listed below: click Connect, then pick a remote folder. Anything not in that file can be added manually (password / key / jump host).',
+        'settings.noMachines': 'No saved machines yet — the list above comes from ~/.ssh/config; click 连接 to use one.',
+        'settings.pickHost': 'Choose a remote machine',
+        'settings.hostListSource': 'from ~/.ssh/config',
+        'settings.hostListLoading': 'Reading ~/.ssh/config…',
+        'settings.hostListRefresh': 'Refresh',
+        'settings.hostListRefreshHint': 'Re-read ~/.ssh/config (no need to reopen this page)',
+        'settings.hostListEmpty': 'No hosts found in {file}. Add Host blocks to your ssh config and hit Refresh, or add a machine manually below.',
+        'settings.hostConnect': 'Connect',
+        'settings.hostConnecting': 'Connecting…',
+        'settings.hostConnectHint': 'Connect and make it the current machine (then pick a remote folder)',
+        'settings.hostConnected': 'Connected · {latency}',
+        'settings.hostConnectedHint': 'Connected — pick the remote folder to start working.',
+        'settings.hostFillForm': 'Fill form',
+        'settings.hostFillFormHint': 'Needs a password or per-machine overrides? Load it into the form below',
+        'settings.badgeKey': 'key',
+        'settings.openWorkspace': 'Folder',
+        'settings.openWorkspaceHint': 'Pick a remote folder on this machine as the workspace',
+        'settings.workspaceOpened': 'Opened remote workspace: {path}',
+        'settings.addMachineManual': 'Add manually (password / key / jump host)',
         'settings.current': 'current',
         'settings.edit': 'Edit',
         'settings.delete': 'Delete',
-        'settings.setCurrent': 'Set as current',
         'settings.currentMachine': 'Current remote: {name}',
         'settings.clearCurrent': 'Clear current (active remote = none)',
         'settings.noActive': 'No active remote machine: saved machines are standby connections and never enter a session context automatically (local sessions are unaffected).',
@@ -356,13 +400,8 @@ window.__ModuleLoader__.load({
         'settings.webAttachCmdPlaceholder': 'Empty = the global webAttachCommand (default: dsh)',
         'settings.webAttachCmdHint': 'Set the absolute path when the remote dsh is not on the SSH login PATH (a private prefix, or node installed with nvm), e.g. /home/you/.nvm/versions/node/v22.19.0/bin/node /home/you/.dsh-remote/dsh/node_modules/@deepseek-ai/dsh/lib/bin.js. Empty falls back to the global webAttachCommand.',
         'settings.sshImport': 'Import from ~/.ssh/config',
-        'settings.sshCollapse': 'Collapse',
-        'settings.sshNoEntries': 'No importable Host entries in ~/.ssh/config',
-        'settings.sshUseAlias': 'Use alias (no copy)',
-        'settings.sshCopyFields': 'Copy fields',
-        'settings.sshAliasHint': 'Alias mode: the machine remembers only the name "{alias}"; host/user/port/key/jump host are resolved from ~/.ssh/config at every connect, so editing that file takes effect immediately.',
-        'settings.useSshConfig': 'Use a ~/.ssh/config alias (keep the alias, not a copy)',
-        'settings.useSshConfigHint': 'Fields left empty or at their default (user root, port 22, key, jump host) come from ~/.ssh/config at connect time; a non-default value overrides it.',
+        'settings.useSshConfig': 'Host name comes from ~/.ssh/config (put the Host name in 主机)',
+        'settings.useSshConfigHint': 'Connecting follows that Host block in ~/.ssh/config (user / port / key / jump host are read from the file, so editing it takes effect). Leave the other fields empty.',
         'settings.saveWritesSshConfig': 'Saving writes host/user/port/key into a managed block in ~/.ssh/config (marked # dsh-remote: managed); the file then takes precedence — edit it directly and it takes effect at once.',
         'settings.sshResolvedTo': '→ {user}@{host}:{port}',
         'settings.sshResolvedNone': 'no ~/.ssh/config block matches "{alias}"',
@@ -373,6 +412,19 @@ window.__ModuleLoader__.load({
         'settings.port': 'Port',
         'settings.user': 'User',
         'settings.password': 'Password',
+        'settings.passwordPlaceholder': 'SSH password (hidden; leave blank if unused)',
+        'settings.secretSavedPlaceholder': '•••••••••••• (saved — leave blank to keep)',
+        'settings.secretSavedHint': 'A password is saved (••••••••••••) and is never echoed back for safety: leave the box empty to keep it, type a new value to replace it.',
+        'settings.passphraseSavedHint': 'A private-key passphrase is saved (••••••••••••): leave the box empty to keep it, type a new value to replace it.',
+        'settings.proxyPwdSavedHint': 'A jump-host password is saved (••••••••••••): leave the box empty to keep it, type a new value to replace it.',
+        'settings.noCredentialHint': '⚠️ This machine has no credential yet (no password, private key or agent) — connecting will fail with "no credentials".',
+        'settings.testUsedSaved': '(this test used the saved password)',
+        'settings.testHint': 'Probe with the values above; a blank password/key/passphrase falls back to the saved one',
+        'settings.testNeedsHost': 'Fill in the host before testing',
+        'settings.saveNeedsHost': 'Fill in the host before saving',
+        'settings.saveHint': 'Save this machine (a blank password/key/passphrase keeps the saved one)',
+        'settings.fwdNeedsPort': 'Fill in the local listen port before adding a forward',
+        'settings.fwdAddHint': 'Add a port forward',
         'settings.advCollapse': '▲ Collapse advanced config',
         'settings.advExpand': '▼ Advanced (private key / proxy jump / agent, etc.)',
         'settings.privateKey': 'Private key path',
@@ -434,6 +486,8 @@ window.__ModuleLoader__.load({
         'settings.deployInstall': 'Deploy & verify',
         'settings.deployInstalling': 'Deploying…',
         'settings.deployConfirm': 'Install dsh into a private directory on the remote (no system directory, no PATH change, no replacing the version in use). Continue?',
+        'settings.deployNeedsMachine': 'Pick a machine before deploying',
+        'settings.deployInstallHint': 'Install dsh into a private directory on the remote and verify it',
         'settings.deployInvestigate': 'Let the AI investigate',
         'settings.deployInvestigating': 'Creating a session…',
         'settings.deployOk': 'Remote environment is usable',
@@ -442,7 +496,6 @@ window.__ModuleLoader__.load({
         'settings.deploySteps': 'Install steps',
         'settings.deployDone': 'Deployed; this machine now records the dsh it uses',
         'settings.deployFailed': 'Deploy failed',
-        'settings.deployResumed': 'A deploy is already running — re-attached to its progress',
         'settings.deployTaskTitle': 'Deploy task',
         'settings.deployTaskRunning': 'running',
         'settings.deployTaskDone': 'done',
@@ -473,7 +526,6 @@ window.__ModuleLoader__.load({
         'settings.added': 'Added — you can set it as current',
         'settings.secretStoreFailed': 'The OS keychain refused the password ({msg}); credentialFallback=plain wrote it to machines.json in plaintext.',
         'settings.secretStoreRefused': 'The OS keychain refused the password ({msg}); the password was NOT saved (it will not be written to disk in plaintext). Repair the keychain and save again, or set credentialFallback to plain to accept the plaintext fallback.',
-        'settings.switched': 'Switched to current remote machine',
         'settings.cleared': 'Cleared current remote — local sessions no longer use remote context automatically',
         'settings.filledSsh': 'Filled from ~/.ssh/config (only references the private key path, never reads its content)',
         'settings.workspaceSwitched': 'Switched to workspace {path}',
@@ -498,7 +550,6 @@ window.__ModuleLoader__.load({
         'settings.updateModeSet': 'Update mode set to "{mode}"',
         'settings.updateModeSaveFail': 'Failed to save mode: {msg}',
         'settings.deleteConfirm': 'Delete this machine?',
-        'settings.sshReadFail': 'Failed to read ~/.ssh/config: {msg}',
         'settings.delFail': 'Delete failed: {msg}',
         'settings.addFail': 'Save failed: {msg}',
         'settings.modeAuto': 'Auto',
@@ -930,6 +981,11 @@ window.__ModuleLoader__.load({
         // Issue #38: alias mode — `host` is a ~/.ssh/config Host name and the
         // resolved values are never copied into the registry.
         useSshConfig: false,
+        // Secrets never come back from the host (it strips them), so the form
+        // tracks only WHETHER one is saved: the boxes then show
+        // "••••••••（已保存）" instead of looking empty, which is the difference
+        // between "the plugin remembered my password" and "the plugin lost it".
+        passwordSet: false, passphraseSet: false, proxyPasswordSet: false,
       })
       const [busy, setBusy] = React.useState(false)
       const [msg, setMsg] = React.useState('')
@@ -938,7 +994,6 @@ window.__ModuleLoader__.load({
       const [forwards, setForwards] = React.useState([])
       const [fwdForm, setFwdForm] = React.useState({ listenPort: '', targetHost: '127.0.0.1', targetPort: '', direction: 'local', autoStart: false })
       const [auditLines, setAuditLines] = React.useState([])
-      const [sshEntries, setSshEntries] = React.useState(null)
       const [workspaces, setWorkspaces] = React.useState([])
       const [advOpen, setAdvOpen] = React.useState(false) // 高级配置折叠
       const [fwdOpen, setFwdOpen] = React.useState(true)
@@ -962,16 +1017,48 @@ window.__ModuleLoader__.load({
       // is the object the poll keeps fresh; it survives because the work runs
       // on the host, not in this tab.
       const [deployTask, setDeployTask] = React.useState(null)
+      // Issue #73: the FIRST thing the page shows is the host list from
+      // ~/.ssh/config (the way VSCode Remote-SSH does it), not a form. These hold
+      // that list, the row currently connecting, the per-row result, and the
+      // "pick a folder" step that follows a successful connect.
+      const [sshHosts, setSshHosts] = React.useState(null) // null = not loaded yet
+      const [sshFile, setSshFile] = React.useState('')
+      const [connectingKey, setConnectingKey] = React.useState('')
+      const [rowState, setRowState] = React.useState({}) // key → { ok, text }
+      const [manualOpen, setManualOpen] = React.useState(false)
+      const [dirPick, setDirPick] = React.useState(null) // { machineId } while the picker is open
       // session's machine", which the host resolves from the session binding.
       React.useEffect(() => { ensureChromeCss() }, [])
 
+      /** Load the ~/.ssh/config host list (cheap: the host reads a local file). */
+      const loadSshHosts = () => api('GET', '/dsh-remote/ssh-config')
+        .then((r) => {
+          setSshHosts(Array.isArray(r && r.entries) ? r.entries : [])
+          setSshFile(String((r && r.file) || ''))
+        })
+        .catch(() => setSshHosts([]))
+      React.useEffect(() => { loadSshHosts() }, [])
+
+      const setRow = (key, next) => setRowState((prev) => ({ ...prev, [key]: next }))
+
       const testConn = () => {
         if (!form.host.trim() || tst === 'testing') return
         setTst('testing'); setErr(''); setMsg('')
         api('POST', '/dsh-remote/test-connect', {
+          // `id` lets the host resolve THIS machine's saved credential: the form
+          // cannot send the password back (the host strips secrets), so without
+          // it "编辑一台连得上的机器 → 测试连接" always failed with
+          // 「缺少凭据」 even though connecting worked.
+          id: form.id || undefined,
           host: form.host, port: Number(form.port) || 22, username: form.username || 'root',
           password: form.password, privateKeyPath: form.privateKeyPath, passphrase: form.passphrase,
           useSshConfig: !!form.useSshConfig,
+          // Auth METHOD flags: a probe that ignores them tests a different
+          // authentication than the machine will use.
+          useAgent: !!form.useAgent,
+          keyboardInteractive: !!form.keyboardInteractive,
+          hostKeyMode: form.hostKeyMode || undefined,
+          sshBinary: form.sshBinary || undefined,
           // Issue #51: the probe must exercise the SAME backend the machine will
           // use — a host reachable only via GSSAPI fails the native probe.
           backend: form.backend || 'native',
@@ -981,6 +1068,9 @@ window.__ModuleLoader__.load({
             if (r && r.ok) {
               const shellTag = r.platform === 'windows' ? (r.gitBash ? tr('settings.shellWin') : tr('settings.shellWinNoGit')) : (r.platform === 'posix' ? tr('settings.shellPosix') : '')
               setTst('ok'); setMsg(r.latencyMs != null ? tr('settings.connOkWith', { user: r.user, host: r.host, latency: r.latencyMs, shell: shellTag }) : tr('settings.connOk'))
+              // Say WHEN the probe used the saved credential: an empty password
+              // box next to "连接成功" is otherwise indistinguishable from magic.
+              if (r.usedSavedCredential) setMsg((m) => m + ' ' + tr('settings.testUsedSaved'))
               // Issue #38: show where an alias resolved to (and what could not
               // be honoured), instead of leaving the user guessing.
               if (r.alias) {
@@ -1112,9 +1202,10 @@ window.__ModuleLoader__.load({
             if (t.status === 'running' || t.status === 'queued') {
               setDeployBusy('install')
             } else if (deployBusy === 'install') {
-              // The task settled since the last poll.
+              // The task settled since the last poll. The panel renders the task
+              // itself (steps + result), so only the FAILURE needs to reach the
+              // error line — there is no separate "message" state any more.
               setDeployBusy('')
-              if (t.status === 'done') setDeployMsg(tr('settings.deployDone'))
               if (t.status === 'failed') setDeployErr(t.error || tr('settings.deployFailed'))
             }
           }
@@ -1123,7 +1214,11 @@ window.__ModuleLoader__.load({
         .catch(() => null)
 
       const deployAction = (action, machineId, extra) => {
-        setDeployBusy(action); setDeployErr(''); setDeployMsg('')
+        // No `setDeployMsg` here: the state it referred to was removed when the
+        // panel started rendering the host-side task, but these calls stayed — the
+        // whole deploy panel threw `ReferenceError: setDeployMsg is not defined`
+        // the instant a button was clicked (found by test/ui-deploy-flow.test.js).
+        setDeployBusy(action); setDeployErr('')
         return api('POST', '/dsh-remote/web-attach', { action, machineId, ...(extra || {}) })
           .then((r) => {
             if (action === 'probe') setDeploy({ kind: 'probe', ...r, at: Date.now() })
@@ -1131,7 +1226,6 @@ window.__ModuleLoader__.load({
               // The task is running on the host NOW. Adopt it immediately so the
               // steps appear without waiting for the first poll tick.
               if (r && r.task) setDeployTask(r.task)
-              if (r && r.resumed) setDeployMsg(tr('settings.deployResumed'))
             }
             if (action === 'investigate') setDeploy({ kind: 'investigate', ...r, at: Date.now() })
             return r
@@ -1166,13 +1260,18 @@ window.__ModuleLoader__.load({
           webAttachCommand: m.webAttachCommand || '',
           id: m.id,
           useSshConfig: !!m.useSshConfig,
+          // "which secrets are already saved" — the boxes stay empty on purpose,
+          // their placeholders show the dots.
+          passwordSet: !!m.passwordSet,
+          passphraseSet: !!m.passphraseSet,
+          proxyPasswordSet: !!(m.proxy && m.proxy.passwordSet),
         })
         // 编辑时若该机器用了高级配置(私钥/agent/跳板/钥匙串/系统 OpenSSH 后端),自动展开折叠区
         if (m.privateKeyPath || m.useAgent || m.keyboardInteractive || m.workspace || (m.proxy && m.proxy.host) || m.backend === 'openssh' || m.webAttachCommand || (m.credentialBackend && m.credentialBackend !== 'plain')) {
           setAdvOpen(true)
         }
       }
-      const clearForm = () => setForm({ name: '', host: '', port: '22', username: 'root', password: '', privateKeyPath: '', passphrase: '', workspace: '', hostKeyMode: '', useAgent: false, keyboardInteractive: false, encryptPassword: false, proxyHost: '', proxyPort: '22', proxyUser: '', proxyPassword: '', proxyKey: '', backend: 'native', sshBinary: '', webAttachCommand: '', id: '', useSshConfig: false })
+      const clearForm = () => setForm({ name: '', host: '', port: '22', username: 'root', password: '', privateKeyPath: '', passphrase: '', workspace: '', hostKeyMode: '', useAgent: false, keyboardInteractive: false, encryptPassword: false, proxyHost: '', proxyPort: '22', proxyUser: '', proxyPassword: '', proxyKey: '', backend: 'native', sshBinary: '', webAttachCommand: '', id: '', useSshConfig: false, passwordSet: false, passphraseSet: false, proxyPasswordSet: false })
       const save = (action) => {
         setBusy(true); setErr(''); setMsg('')
         if (action === 'delete') {
@@ -1188,9 +1287,34 @@ window.__ModuleLoader__.load({
           backend: form.backend || 'native', sshBinary: form.sshBinary || '',
           // Issue #54: the per-machine remote-dsh command for Web UI attach.
           webAttachCommand: form.webAttachCommand || '',
-          proxy: form.proxyHost ? { host: form.proxyHost, port: Number(form.proxyPort) || 22, username: form.proxyUser || '', password: form.proxyPassword || '', privateKeyPath: form.proxyKey || '' } : undefined,
+          // `proxy: null` (NOT `undefined`) when the jump-host field is empty:
+          // JSON.stringify drops undefined keys, so `undefined` reads as "not
+          // mentioned" and the host would KEEP a stored jump host — the field
+          // could never be cleared. `null` states "this machine has no jump host".
+          proxy: form.proxyHost ? { host: form.proxyHost, port: Number(form.proxyPort) || 22, username: form.proxyUser || '', password: form.proxyPassword || '', privateKeyPath: form.proxyKey || '' } : null,
         }).then((r) => {
-          refresh(); clearForm()
+          refresh()
+          // Keep the form BOUND to the machine that was just saved instead of
+          // wiping it. The old code called clearForm(), which emptied `host` —
+          // and the 测试连接 button requires a host, so "保存后想立刻验证" was
+          // impossible: the button went dead the moment the save succeeded. The
+          // secret inputs are cleared (the host strips them anyway) while the
+          // *_Set flags tell the placeholders a credential is stored.
+          const rec = r && r.machine
+          if (rec && rec.id) {
+            setForm((f) => ({
+              ...f,
+              id: rec.id,
+              password: '', passphrase: '', proxyPassword: '',
+              passwordSet: !!rec.passwordSet,
+              passphraseSet: !!rec.passphraseSet,
+              proxyPasswordSet: !!(rec.proxy && rec.proxy.passwordSet),
+              encryptPassword: !!(rec.credentialBackend && rec.credentialBackend !== 'plain'),
+            }))
+            setTst('')
+          } else {
+            clearForm()
+          }
           // Issue #30: "加密保存密码"失败时服务端回退明文并带警告 —— 不能再静默
           // 保存一台没有凭据的机器（那会让之后每次连接都失败且没有原因）。
           if (r && r.warning === 'secret-store-failed') setErr(tr('settings.secretStoreFailed', { msg: r.warningDetail || 'unknown' }))
@@ -1201,40 +1325,65 @@ window.__ModuleLoader__.load({
           else setMsg(form.id ? tr('settings.saved') : tr('settings.added'))
         }).catch((e) => setErr(String((e && e.message) || e))).finally(() => setBusy(false))
       }
-      const useNow = (id) => { setBusy(true); api('POST', '/dsh-remote/current', { id }).then((r) => { setCurrentId(r.currentId); setMsg(tr('settings.switched')) }).catch((e) => setErr(String((e && e.message) || e))).finally(() => setBusy(false)) }
       // Issue #13: "active remote = none" — saved machines stay, but no machine
       // is current, so local sessions are never dragged into a remote context.
       const clearCurrent = () => { setBusy(true); api('POST', '/dsh-remote/current', { id: '' }).then((r) => { setCurrentId(''); setMsg(tr('settings.cleared')) }).catch((e) => setErr(String((e && e.message) || e))).finally(() => setBusy(false)) }
       const del = (id) => { if (window.confirm(tr('settings.deleteConfirm'))) { api('POST', '/dsh-remote/machines', { action: 'delete', id }).then(refresh).then(() => setMsg(tr('settings.deleted'))).catch((e) => setErr(String((e && e.message) || e))) } }
 
-      const importSsh = () => {
-        api('GET', '/dsh-remote/ssh-config').then((r) => setSshEntries(r && r.present ? (r.entries || []) : []))
-          .catch((e) => setErr(tr('settings.sshReadFail', { msg: String((e && e.message) || e) })))
-      }
-      // Issue #38, primary action: save the machine as an ALIAS. Nothing from
-      // ~/.ssh/config is copied into the registry — the host/user/port/key/jump
-      // host are re-read at every connect, so editing that file is enough.
-      const useSshAlias = (e) => {
-        setForm({
-          ...form,
-          name: e.host, host: e.host, port: '22', username: 'root',
-          privateKeyPath: '', passphrase: '', useSshConfig: true,
-        })
-        setSshEntries(null)
-        setMsg(tr('settings.sshAliasHint', { alias: e.host }))
-      }
-      // Legacy/escape hatch: materialise the current values as a normal machine
-      // (for users who want to override them individually).
+      // Issue #73: the manual form's escape hatch from the host list. A host that
+      // needs a password (or any per-machine override) is filled into the form
+      // instead of being adopted as an alias — one click, no jargon, and the form
+      // opens with the values already in place.
       const applySshEntry = (e) => {
+        const alias = String(e.alias || e.host)
         setForm({
           ...form,
-          name: e.host, host: e.hostName || e.host, port: String(e.port || 22),
+          name: alias, host: e.hostName || alias, port: String(e.port || 22),
           username: e.user || 'root', privateKeyPath: e.identityFile || '', useSshConfig: false,
         })
-        setSshEntries(null)
+        setManualOpen(true)
         setMsg(tr('settings.filledSsh'))
       }
 
+      /**
+       * Issue #73: connect to one row of the host list.
+       *
+       * One click does what the user means by "connect": adopt the host (for a
+       * ~/.ssh/config entry this upserts the alias machine — the host does it, so
+       * there is no duplicate and no form), make it current, then PROBE it so the
+       * row can say whether it really works. A failure stays on the row it belongs
+       * to instead of in a panel-level error the user has to correlate.
+       */
+      const connectHost = (entry) => {
+        const key = entry.key
+        if (connectingKey) return
+        setConnectingKey(key); setErr(''); setMsg('')
+        setRow(key, { pending: true, text: tr('settings.hostConnecting') })
+        const activate = entry.machineId
+          ? api('POST', '/dsh-remote/current', { id: entry.machineId })
+          : api('POST', '/dsh-remote/machines', { action: 'from-ssh-config', alias: entry.alias })
+        activate
+          .then((r) => {
+            const id = (r && r.currentId) || entry.machineId
+            setCurrentId(id)
+            refresh()
+            return api('POST', '/dsh-remote/test-connect', { id, host: entry.host, port: entry.port, username: entry.username || 'root' })
+              .then((probe) => ({ id, probe }))
+          })
+          .then(({ id, probe }) => {
+            if (probe && probe.ok) {
+              setRow(key, { ok: true, text: tr('settings.hostConnected', { latency: probe.latencyMs != null ? probe.latencyMs + 'ms' : '?' }) })
+              setMsg(tr('settings.hostConnectedHint'))
+              // Next step in the VSCode-shaped flow: pick the remote folder.
+              setDirPick({ machineId: id })
+            } else {
+              setRow(key, { ok: false, text: (probe && probe.error) || tr('settings.connFail') })
+            }
+          })
+          .catch((e) => setRow(key, { ok: false, text: String((e && e.message) || e) }))
+          .finally(() => setConnectingKey(''))
+      }
+
       const setWorkspaceNow = (p) => {
         api('POST', '/dsh-remote/workspace', { path: p })
           .then(() => setMsg(tr('settings.workspaceSwitched', { path: p })))
@@ -1267,12 +1416,74 @@ window.__ModuleLoader__.load({
         extra || null,
       )
 
+      // Issue #73: hosts from ~/.ssh/config that are NOT saved yet — they are the
+      // first thing the page shows, because that is the whole list a VSCode
+      // Remote-SSH user expects. A saved alias machine hides its file entry (the row
+      // below it is the same host, with the actions that belong to a saved machine).
+      const savedAliases = new Set(machines.filter((m) => m.useSshConfig).map((m) => String(m.host)))
+      const discovered = (sshHosts || []).filter((h) => !savedAliases.has(String(h.alias || h.host)))
+
+      /** The inline result of a connect attempt, shown on its own row. */
+      const rowResult = (key) => {
+        const st = rowState[key]
+        if (!st) return null
+        return React.createElement('div', {
+          style: {
+            fontSize: 11, marginTop: 2, lineHeight: 1.5, wordBreak: 'break-all',
+            color: st.pending ? T.muted : st.ok ? T.ok : T.danger,
+          },
+        }, (st.pending ? '… ' : st.ok ? '✓ ' : '✗ ') + st.text)
+      }
+
       return React.createElement('div', { style: { padding: 16, display: 'flex', flexDirection: 'column', gap: 12, maxWidth: 860 } },
         React.createElement('div', { style: { fontSize: 16, fontWeight: 650, letterSpacing: '-0.01em' } }, tr('settings.title')),
         React.createElement('div', { style: { fontSize: 12, opacity: 0.8, lineHeight: 1.55 } },
           tr('settings.intro')),
         React.createElement('div', { style: boxS },
-          React.createElement('div', { style: { marginBottom: 8, fontSize: 13, fontWeight: 600 } }, tr('settings.machines')),
+          React.createElement('div', { style: { display: 'flex', alignItems: 'center', gap: 8, marginBottom: 6, flexWrap: 'wrap' } },
+            React.createElement('div', { style: { fontSize: 13, fontWeight: 600 } }, tr('settings.pickHost')),
+            React.createElement('span', { style: { fontSize: 11, opacity: 0.6 } }, tr('settings.hostListSource')),
+            React.createElement('button', {
+              type: 'button', className: 'dsh-rw-btn',
+              style: { ...buttonS, fontSize: 11, padding: '2px 8px', marginLeft: 'auto' },
+              onClick: () => loadSshHosts(),
+              title: tr('settings.hostListRefreshHint'),
+            }, tr('settings.hostListRefresh'))),
+          // A) ~/.ssh/config 里的主机：一行一个「连接」（点一下 = 采用 + 设为当前 + 探测）
+          sshHosts === null
+            ? React.createElement('div', { style: { fontSize: 12, opacity: 0.6 } }, tr('settings.hostListLoading'))
+            : (discovered.length
+              ? discovered.map((h) => {
+                const alias = String(h.alias || h.host)
+                const key = 'ssh:' + alias
+                const target = (h.user ? h.user + '@' : '') + (h.hostName || alias) + (Number(h.port) && Number(h.port) !== 22 ? ':' + h.port : '')
+                return React.createElement('div', { key, className: 'dsh-rw-row', style: { display: 'flex', gap: 8, alignItems: 'center', paddingTop: 6, paddingBottom: 6, borderBottom: '1px solid ' + T.border, flexWrap: 'wrap' } },
+                  React.createElement('div', { style: { flex: 1, fontSize: 13, minWidth: 180 } },
+                    React.createElement('div', { style: { display: 'flex', gap: 6, alignItems: 'center', flexWrap: 'wrap' } },
+                      React.createElement('span', { style: { fontWeight: 600 } }, alias),
+                      React.createElement('code', { style: { fontSize: 12, opacity: 0.75 } }, target),
+                      h.proxyJump ? pill('', tr('settings.badgeProxy')) : null,
+                      h.identityFile ? pill('', tr('settings.badgeKey')) : null),
+                    rowResult(key)),
+                  React.createElement('div', { style: { display: 'flex', gap: 6, flexShrink: 0 } },
+                    React.createElement('button', {
+                      type: 'button', className: 'dsh-rw-btn', style: { ...buttonS, fontSize: 11, padding: '2px 8px' },
+                      onClick: () => applySshEntry(h),
+                      title: tr('settings.hostFillFormHint'),
+                    }, tr('settings.hostFillForm')),
+                    React.createElement('button', {
+                      type: 'button', className: 'dsh-rw-btn dsh-rw-primary',
+                      style: { ...primaryBtnS, padding: '4px 12px', whiteSpace: 'nowrap' },
+                      disabled: !!connectingKey,
+                      title: tr('settings.hostConnectHint'),
+                      onClick: () => connectHost({ key, alias, host: alias, port: Number(h.port) || 22, username: h.user || '', useSshConfig: true }),
+                    }, connectingKey === key ? tr('settings.hostConnecting') : tr('settings.hostConnect'))))
+              })
+              : (sshHosts.length
+                ? null
+                : React.createElement('div', { style: { fontSize: 11, opacity: 0.65, lineHeight: 1.6, marginBottom: 6 } },
+                    tr('settings.hostListEmpty', { file: sshFile || '~/.ssh/config' })))),
+          // B) 已保存的机器：连接 / 打开工作区 / 编辑 / 删除
           machines.length
             ? machines.map((m) => React.createElement('div', { key: m.id, className: 'dsh-rw-row', style: { display: 'flex', gap: 8, alignItems: 'center', paddingTop: 8, paddingBottom: 8, borderBottom: '1px solid ' + T.border, flexWrap: 'wrap' } },
                 React.createElement('div', { style: { flex: 1, fontSize: 13, minWidth: 180 } },
@@ -1299,11 +1510,32 @@ window.__ModuleLoader__.load({
                   // the plugin had to trim) must be visible, not silent.
                   (m.sshConfigResolved && m.sshConfigResolved.warnings && m.sshConfigResolved.warnings.length)
                     ? React.createElement('div', { style: { fontSize: 11, color: T.warn, marginTop: 2 } }, tr('settings.sshResolvedWarn', { msg: m.sshConfigResolved.warnings.join(' ') }))
-                    : null),
+                    : null,
+                  rowResult('machine:' + m.id)),
                 React.createElement('div', { style: { display: 'flex', gap: 6, flexShrink: 0 } },
                   React.createElement('button', { type: 'button', className: 'dsh-rw-btn', style: buttonS, onClick: () => startEdit(m) }, tr('settings.edit')),
                   React.createElement('button', { type: 'button', className: 'dsh-rw-btn', style: buttonS, onClick: () => del(m.id) }, tr('settings.delete')),
-                  React.createElement('button', { type: 'button', className: 'dsh-rw-btn' + (m.id === currentId ? '' : ' dsh-rw-primary'), style: { ...(m.id === currentId ? buttonS : primaryBtnS), padding: '6px 10px', whiteSpace: 'nowrap' }, onClick: () => useNow(m.id), disabled: m.id === currentId }, tr('settings.setCurrent')))))
+                  React.createElement('button', {
+                    type: 'button', className: 'dsh-rw-btn',
+                    style: { ...buttonS, padding: '6px 10px', whiteSpace: 'nowrap' },
+                    title: tr('settings.openWorkspaceHint'),
+                    onClick: () => setDirPick({ machineId: m.id }),
+                  }, tr('settings.openWorkspace')),
+                  React.createElement('button', {
+                    type: 'button', className: 'dsh-rw-btn dsh-rw-primary',
+                    style: { ...primaryBtnS, padding: '6px 12px', whiteSpace: 'nowrap' },
+                    disabled: !!connectingKey,
+                    title: tr('settings.hostConnectHint'),
+                    onClick: () => connectHost({
+                      key: 'machine:' + m.id,
+                      alias: m.host,
+                      machineId: m.id,
+                      host: m.host,
+                      port: Number(m.port) || 22,
+                      username: m.username || '',
+                      useSshConfig: !!m.useSshConfig,
+                    }),
+                  }, connectingKey === 'machine:' + m.id ? tr('settings.hostConnecting') : tr('settings.hostConnect')))))
             : React.createElement('div', { style: { opacity: 0.6, fontSize: 12 } }, tr('settings.noMachines')),
           currentId
             ? React.createElement('div', { style: { display: 'flex', gap: 8, alignItems: 'center', paddingTop: 10, fontSize: 12, color: T.ok } },
@@ -1311,18 +1543,12 @@ window.__ModuleLoader__.load({
                 React.createElement('button', { type: 'button', className: 'dsh-rw-btn', style: { ...buttonS, padding: '2px 8px', fontSize: 12, marginLeft: 'auto' }, onClick: clearCurrent }, tr('settings.clearCurrent')))
             : React.createElement('div', { style: { paddingTop: 10, fontSize: 12, opacity: 0.6 } }, tr('settings.noActive')),
           ),
+        // Issue #73: the manual form is the SECONDARY path now — collapsed by
+        // default, and only forced open while editing a saved machine. Everything
+        // it can do (password / key / jump host / keychain / system-OpenSSH) stays.
         React.createElement('div', { style: boxS },
-          React.createElement('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center', marginBottom: 6 } },
-            React.createElement('div', { style: { fontSize: 13, fontWeight: 600 } }, form.id ? tr('settings.editMachine') : tr('settings.addMachine')),
-            React.createElement('button', { type: 'button', className: 'dsh-rw-btn', style: { ...buttonS, fontSize: 12, padding: '3px 8px' }, onClick: () => (sshEntries ? setSshEntries(null) : importSsh()) }, sshEntries ? tr('settings.sshCollapse') : tr('settings.sshImport'))),
-          sshEntries ? React.createElement('div', { style: { marginBottom: 8, maxHeight: 200, overflowY: 'auto', border: '1px solid ' + T.border, borderRadius: T.radius } },
-            sshEntries.length ? sshEntries.map((e) => React.createElement('div', { key: e.host, className: 'dsh-rw-list-item', style: { padding: '6px 10px', fontSize: 12, borderBottom: '1px solid ' + T.border, display: 'flex', gap: 8, alignItems: 'center' } },
-              React.createElement('div', { onClick: () => useSshAlias(e), style: { flex: 1, cursor: 'pointer' }, title: tr('settings.sshUseAlias') },
-                e.host + '  →  ' + (e.hostName || '?') + (e.user ? '  (' + e.user + ')' : '') + (e.identityFile ? '  [key]' : '') + (e.proxyJump ? '  ⛳' : '')),
-              React.createElement('button', { type: 'button', className: 'dsh-rw-btn', style: { ...buttonS, fontSize: 11, padding: '2px 8px', whiteSpace: 'nowrap' }, onClick: () => useSshAlias(e) }, tr('settings.sshUseAlias')),
-              React.createElement('button', { type: 'button', className: 'dsh-rw-btn', style: { ...buttonS, fontSize: 11, padding: '2px 8px', whiteSpace: 'nowrap', opacity: 0.8 }, onClick: () => applySshEntry(e) }, tr('settings.sshCopyFields'))))
-              : React.createElement('div', { style: { padding: 8, fontSize: 12, opacity: 0.6 } }, tr('settings.sshNoEntries')))
-          : null,
+          sectionToggle(manualOpen || !!form.id, setManualOpen, form.id ? tr('settings.editMachine') : tr('settings.addMachineManual')),
+          (manualOpen || form.id) ? React.createElement(React.Fragment, null,
           row(tr('settings.name'), React.createElement('input', { className: 'dsh-rw-input', value: form.name, onChange: setF('name'), placeholder: tr('settings.name') + ' (e.g. build-server)', style: inputS }), 'n'),
           row(tr('settings.host'), React.createElement('input', { className: 'dsh-rw-input', value: form.host, onChange: setF('host'), placeholder: form.useSshConfig ? tr('settings.sshImport') + ' Host 别名' : 'IP or hostname', style: inputS }), 'h'),
           row(tr('settings.useSshConfig'), React.createElement('input', { type: 'checkbox', checked: !!form.useSshConfig, onChange: setFb('useSshConfig') }), 'sshc'),
@@ -1344,7 +1570,31 @@ window.__ModuleLoader__.load({
           })() : null,
           row(tr('settings.port'), React.createElement('input', { className: 'dsh-rw-input', value: form.port, onChange: setF('port'), placeholder: '22', style: { ...inputS, width: 70 } }), 'p'),
           row(tr('settings.user'), React.createElement('input', { className: 'dsh-rw-input', value: form.username, onChange: setF('username'), placeholder: 'root', style: inputS }), 'u'),
-          row(tr('settings.password'), React.createElement('input', { className: 'dsh-rw-input', type: 'password', value: form.password, onChange: setF('password'), placeholder: 'SSH password (hidden)', style: inputS }), 'w'),
+          // The password box is EMPTY by design (the host never echoes a secret
+          // back) — but an empty box with a neutral placeholder reads as "this
+          // machine has no password", which is exactly the wrong conclusion to
+          // reach while debugging a connection. When a secret IS stored, the
+          // placeholder shows dots and says what an empty box will do.
+          row(tr('settings.password'), React.createElement('input', {
+            className: 'dsh-rw-input',
+            type: 'password',
+            value: form.password,
+            onChange: setF('password'),
+            placeholder: form.passwordSet ? tr('settings.secretSavedPlaceholder') : tr('settings.passwordPlaceholder'),
+            style: inputS,
+            title: form.passwordSet ? tr('settings.secretSavedHint') : '',
+          }), 'w'),
+          form.passwordSet
+            ? React.createElement('div', { style: { marginLeft: LABEL_W + 8, marginBottom: 8, fontSize: 11, lineHeight: 1.5, color: T.ok } },
+                tr('settings.secretSavedHint'))
+            : null,
+          // A machine with NO credential of any kind cannot connect, and the error
+          // it produces ("缺少凭据") blames the user's configuration. Say it here,
+          // while the form is open, instead of after a failed connect.
+          (!form.passwordSet && !form.password && !form.privateKeyPath.trim() && !form.useAgent && !form.keyboardInteractive)
+            ? React.createElement('div', { style: { marginLeft: LABEL_W + 8, marginBottom: 8, fontSize: 11, lineHeight: 1.5, color: T.warn } },
+                tr('settings.noCredentialHint'))
+            : null,
           // 高级配置折叠开关
           React.createElement('button', {
             type: 'button',
@@ -1371,7 +1621,10 @@ window.__ModuleLoader__.load({
               ? row(tr('settings.sshBinary'), React.createElement('input', { value: form.sshBinary || '', onChange: setF('sshBinary'), placeholder: tr('settings.sshBinaryPlaceholder'), style: inputS }), 'sb')
               : null,
             row(tr('settings.privateKey'), React.createElement('input', { value: form.privateKeyPath, onChange: setF('privateKeyPath'), placeholder: 'Empty = password or agent', style: inputS }), 'k'),
-            row(tr('settings.passphrase'), React.createElement('input', { type: 'password', value: form.passphrase, onChange: setF('passphrase'), placeholder: 'Encrypted private key passphrase', style: inputS }), 'pp'),
+            row(tr('settings.passphrase'), React.createElement('input', { type: 'password', value: form.passphrase, onChange: setF('passphrase'), placeholder: form.passphraseSet ? tr('settings.secretSavedPlaceholder') : 'Encrypted private key passphrase', style: inputS, title: form.passphraseSet ? tr('settings.secretSavedHint') : '' }), 'pp'),
+            form.passphraseSet
+              ? React.createElement('div', { style: { marginLeft: LABEL_W + 8, marginBottom: 8, fontSize: 11, lineHeight: 1.5, color: T.ok } }, tr('settings.passphraseSavedHint'))
+              : null,
             row(tr('settings.workspace'), React.createElement('input', { value: form.workspace, onChange: setF('workspace'), placeholder: 'Optional: default remote dir for this machine', style: inputS }), 'ws'),
             row(tr('settings.hostKeyMode'), React.createElement('select', { value: form.hostKeyMode, onChange: setF('hostKeyMode'), style: { ...inputS, maxWidth: 220 } },
               React.createElement('option', { value: '' }, tr('settings.hkDefault')),
@@ -1389,7 +1642,7 @@ window.__ModuleLoader__.load({
             row(tr('settings.proxyPortUser'), React.createElement('div', { style: { display: 'flex', gap: 6, flex: 1, flexWrap: 'wrap' } },
               React.createElement('input', { value: form.proxyPort, onChange: setF('proxyPort'), placeholder: 'Port (22)', style: { ...inputS, minWidth: 90, maxWidth: 120 } }),
               React.createElement('input', { value: form.proxyUser, onChange: setF('proxyUser'), placeholder: 'Jump user', style: { ...inputS, minWidth: 140 } }),
-              React.createElement('input', { type: 'password', value: form.proxyPassword, onChange: setF('proxyPassword'), placeholder: 'Jump password', style: { ...inputS, minWidth: 140 } })), 'pu'),
+              React.createElement('input', { type: 'password', value: form.proxyPassword, onChange: setF('proxyPassword'), placeholder: form.proxyPasswordSet ? tr('settings.secretSavedPlaceholder') : 'Jump password', style: { ...inputS, minWidth: 140 }, title: form.proxyPasswordSet ? tr('settings.proxyPwdSavedHint') : '' })), 'pu'),
             row(tr('settings.proxyKey'), React.createElement('input', { value: form.proxyKey, onChange: setF('proxyKey'), placeholder: 'Jump private key path (optional)', style: inputS }), 'pk'),
             // Issue #54: where "远程 DSH 界面" gets its remote dsh. The README
             // pointed at `webAttachCommand` and there was no field for it.
@@ -1400,10 +1653,11 @@ window.__ModuleLoader__.load({
             msg ? React.createElement('span', { style: { color: T.ok, fontSize: 12, marginRight: 'auto' } }, msg) : null,
             form.id ? React.createElement('button', { type: 'button', className: 'dsh-rw-btn', style: buttonS, onClick: () => save('delete') }, tr('settings.delete')) : null,
             React.createElement('button', { type: 'button', className: 'dsh-rw-btn', style: buttonS, onClick: () => { clearForm(); setErr(''); setTst('idle'); setAdvOpen(false) } }, form.id ? tr('settings.cancelEdit') : tr('settings.clear')),
-            React.createElement('button', { type: 'button', className: 'dsh-rw-btn', style: { ...buttonS, fontFamily: 'monospace', whiteSpace: 'nowrap' }, onClick: testConn, disabled: busy || !form.host.trim() || tst === 'testing' },
+            React.createElement('button', { type: 'button', className: 'dsh-rw-btn', style: { ...buttonS, fontFamily: 'monospace', whiteSpace: 'nowrap' }, onClick: testConn, disabled: busy || !form.host.trim() || tst === 'testing', title: form.host.trim() ? tr('settings.testHint') : tr('settings.testNeedsHost') },
               tst === 'testing' ? tr('settings.testing') : tst === 'ok' ? tr('settings.testOk') : tr('settings.testConn')),
-            React.createElement('button', { type: 'button', className: 'dsh-rw-btn dsh-rw-primary', style: primaryBtnS, onClick: () => save(form.id ? 'update' : 'add'), disabled: busy || !form.host.trim() }, busy ? tr('settings.saving') : tr('settings.save')),
+            React.createElement('button', { type: 'button', className: 'dsh-rw-btn dsh-rw-primary', style: primaryBtnS, onClick: () => save(form.id ? 'update' : 'add'), disabled: busy || !form.host.trim(), title: form.host.trim() ? tr('settings.saveHint') : tr('settings.saveNeedsHost') }, busy ? tr('settings.saving') : tr('settings.save')),
           ),
+          ) : null,
         ),
         // 快捷切换工作区（该机器的最近工作区）
         workspaces.length ? React.createElement('div', { style: boxS },
@@ -1563,7 +1817,11 @@ window.__ModuleLoader__.load({
             // reason to run. The host action re-probes internally anyway, so it is
             // safe to offer directly; clicking it is the explicit consent.
             React.createElement('button', { type: 'button', className: 'dsh-rw-btn dsh-rw-primary', style: { ...primaryBtnS, marginTop: 6 },
-              disabled: !webAttachMachine,
+              // A RUNNING task also disables the button: the comment below always
+              // said a second click must not restart anything, but the prop only
+              // checked the machine — so a double click re-POSTed the install.
+              disabled: !webAttachMachine || !!deployBusy,
+              title: webAttachMachine ? tr('settings.deployInstallHint') : tr('settings.deployNeedsMachine'),
               onClick: () => { if (window.confirm(tr('settings.deployConfirm'))) deployAction('install', webAttachMachine, { confirm: true }) } },
               // While a task runs, the button is the RESUME affordance (disabled
               // — the poll renders live state; a second click must not restart).
@@ -1605,7 +1863,7 @@ window.__ModuleLoader__.load({
               React.createElement('input', { className: 'dsh-rw-input', value: fwdForm.targetPort, onChange: (e) => setFwdForm({ ...fwdForm, targetPort: e.target.value }), placeholder: tr('settings.fwdTargetPort'), style: { ...inputS, maxWidth: 90 } }),
               React.createElement('label', { style: { fontSize: 12, display: 'flex', gap: 4, alignItems: 'center' } },
                 React.createElement('input', { type: 'checkbox', checked: fwdForm.autoStart, onChange: (e) => setFwdForm({ ...fwdForm, autoStart: e.target.checked }) }), tr('settings.fwdAuto')),
-              React.createElement('button', { type: 'button', className: 'dsh-rw-btn dsh-rw-primary', style: primaryBtnS, onClick: fwdDefine, disabled: !fwdForm.listenPort }, tr('settings.fwdAdd'))),
+              React.createElement('button', { type: 'button', className: 'dsh-rw-btn dsh-rw-primary', style: primaryBtnS, onClick: fwdDefine, disabled: !fwdForm.listenPort, title: fwdForm.listenPort ? tr('settings.fwdAddHint') : tr('settings.fwdNeedsPort') }, tr('settings.fwdAdd'))),
           ) : null,
         ),
         // 审计日志
@@ -1659,6 +1917,29 @@ window.__ModuleLoader__.load({
           React.createElement('a', { href: 'https://github.com/flymysql/dsh-remote/issues/new', target: '_blank', rel: 'noopener noreferrer', style: { color: 'inherit' } }, tr('settings.feedback')),
           React.createElement('span', { style: { marginLeft: 'auto', opacity: 0.5 } }, 'dsh-remote v' + (upd && upd.current ? upd.current : '?.?.?')),
         ),
+        // Issue #73, step 2 of the VSCode-shaped flow: after 连接, pick the remote
+        // folder. Reuses the SAME picker the sidebar uses (one implementation, so
+        // the two entry points cannot drift), and committing it goes through
+        // /dsh-remote/mirror — the route that actually creates the mirror.
+        dirPick
+          ? React.createElement(DirPicker, {
+            open: true,
+            busy: false,
+            onPicked: (picked) => {
+              const target = dirPick.machineId
+              setDirPick(null)
+              if (!picked) return
+              api('POST', '/dsh-remote/mirror', { path: picked, machineId: target })
+                .then((r) => {
+                  setMsg(tr('settings.workspaceOpened', { path: picked }))
+                  refresh()
+                  if (r && r.localMirror) setWorkspaces((w) => (w.includes(picked) ? w : [picked, ...w]))
+                })
+                .catch((e) => setErr(String((e && e.message) || e)))
+            },
+            onCancel: () => setDirPick(null),
+          })
+          : null,
       )
     }
 
@@ -3730,4 +4011,4 @@ window.__ModuleLoader__.load({
     exports.apply = apply
     return module.exports
   },
-})
+})