dsh-remote 0.8.9 → 0.8.10

package/lib/credential.js

@@ -1,107 +1,107 @@
-// dsh-remote — optional OS-keychain password storage.
-// Machines keep their password in the OS credential store instead of the
-// plaintext machines.json when the user enables "加密保存密码" per machine.
-// Every backend is best-effort: any failure resolves to {ok:false} and the
-// caller falls back to plaintext (the feature must never block connecting).
-//
-// Backends:
-//   darwin  → `security` (login keychain, generic password)
-//   win32   → DPAPI via PowerShell (CurrentUser scope), files under
-//             $DSH_HOME/remote-workspaces/.secrets/
-//   linux   → `secret-tool` (libsecret / gnome-keyring), optional
-//   else    → unsupported (plain)
-import { execFile } from 'node:child_process'
-import { mkdirSync, writeFileSync, readFileSync, unlinkSync } from 'node:fs'
-import { join as joinPath } from 'node:path'
-
-const SERVICE = 'dsh-remote'
-const TIMEOUT = 8000
-
-function run(bin, args, input) {
-  return new Promise((resolve, reject) => {
-    execFile(bin, args, { timeout: TIMEOUT, maxBuffer: 1 << 20, ...(input != null ? { input } : {}) }, (err, stdout, stderr) => {
-      if (err) return reject(err)
-      resolve(String(stdout || '').trim())
-    })
-  })
-}
-
-export function platformBackend() {
-  if (process.platform === 'darwin') return 'keychain'
-  if (process.platform === 'win32') return 'windows'
-  return 'secret' // linux (secret-tool may be absent → falls back)
-}
-
-function account(machineId) {
-  // Only machine ids are stored; sanitize just in case.
-  return String(machineId || '').replace(/[^a-zA-Z0-9._-]/g, '_')
-}
-
-/** Save a password to the OS store. Resolves {ok, backend} — ok:false on any
- * failure (caller falls back to plaintext). */
-export async function saveSecret(machineId, password, secretsDir) {
-  const acc = account(machineId)
-  try {
-    if (process.platform === 'darwin') {
-      await run('security', ['add-generic-password', '-U', '-s', SERVICE, '-a', acc, '-w', String(password)])
-      return { ok: true, backend: 'keychain' }
-    }
-    if (process.platform === 'win32') {
-      // DPAPI-encrypt and store under the harness home.
-      const script =
-        `$p='${String(password).replace(/'/g, "''")}';` +
-        `$s=[System.Security.Cryptography.ProtectedData]::Protect([Text.Encoding]::UTF8.GetBytes($p),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);` +
-        `[Convert]::ToBase64String($s)`
-      const b64 = await run('powershell', ['-NoProfile', '-STA', '-Command', script])
-      if (!b64) return { ok: false, backend: 'windows' }
-      mkdirSync(secretsDir || '.', { recursive: true })
-      writeFileSync(joinPath(secretsDir || '.', acc + '.bin'), b64, 'utf8')
-      return { ok: true, backend: 'windows' }
-    }
-    if (process.platform === 'linux') {
-      await run('secret-tool', ['store', '--label=' + SERVICE, 'service', SERVICE, 'account', acc], String(password) + '\n')
-      return { ok: true, backend: 'secret' }
-    }
-  } catch { /* fall through */ }
-  return { ok: false, backend: platformBackend() }
-}
-
-/** Fetch a stored password. Resolves string|null. */
-export async function getSecret(machineId, secretsDir) {
-  const acc = account(machineId)
-  try {
-    if (process.platform === 'darwin') {
-      return await run('security', ['find-generic-password', '-s', SERVICE, '-a', acc, '-w'])
-    }
-    if (process.platform === 'win32') {
-      const b64 = readFileSync(joinPath(secretsDir || '.', acc + '.bin'), 'utf8').trim()
-      if (!b64) return null
-      const script =
-        `$s=[Convert]::FromBase64String('${b64}');` +
-        `[Text.Encoding]::UTF8.GetString([System.Security.Cryptography.ProtectedData]::Unprotect($s,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))`
-      return await run('powershell', ['-NoProfile', '-STA', '-Command', script])
-    }
-    if (process.platform === 'linux') {
-      return await run('secret-tool', ['lookup', 'service', SERVICE, 'account', acc])
-    }
-  } catch { /* fall through */ }
-  return null
-}
-
-/** Delete a stored password (idempotent). */
-export async function deleteSecret(machineId, secretsDir) {
-  const acc = account(machineId)
-  try {
-    if (process.platform === 'darwin') {
-      await run('security', ['delete-generic-password', '-s', SERVICE, '-a', acc]).catch(() => {})
-      return
-    }
-    if (process.platform === 'win32') {
-      try { unlinkSync(joinPath(secretsDir || '.', acc + '.bin')) } catch { /* absent */ }
-      return
-    }
-    if (process.platform === 'linux') {
-      await run('secret-tool', ['clear', 'service', SERVICE, 'account', acc]).catch(() => {})
-    }
-  } catch { /* best effort */ }
-}
+// dsh-remote — optional OS-keychain password storage.
+// Machines keep their password in the OS credential store instead of the
+// plaintext machines.json when the user enables "加密保存密码" per machine.
+// Every backend is best-effort: any failure resolves to {ok:false} and the
+// caller falls back to plaintext (the feature must never block connecting).
+//
+// Backends:
+//   darwin  → `security` (login keychain, generic password)
+//   win32   → DPAPI via PowerShell (CurrentUser scope), files under
+//             $DSH_HOME/remote-workspaces/.secrets/
+//   linux   → `secret-tool` (libsecret / gnome-keyring), optional
+//   else    → unsupported (plain)
+import { execFile } from 'node:child_process'
+import { mkdirSync, writeFileSync, readFileSync, unlinkSync } from 'node:fs'
+import { join as joinPath } from 'node:path'
+
+const SERVICE = 'dsh-remote'
+const TIMEOUT = 8000
+
+function run(bin, args, input) {
+  return new Promise((resolve, reject) => {
+    execFile(bin, args, { timeout: TIMEOUT, maxBuffer: 1 << 20, ...(input != null ? { input } : {}) }, (err, stdout, stderr) => {
+      if (err) return reject(err)
+      resolve(String(stdout || '').trim())
+    })
+  })
+}
+
+export function platformBackend() {
+  if (process.platform === 'darwin') return 'keychain'
+  if (process.platform === 'win32') return 'windows'
+  return 'secret' // linux (secret-tool may be absent → falls back)
+}
+
+function account(machineId) {
+  // Only machine ids are stored; sanitize just in case.
+  return String(machineId || '').replace(/[^a-zA-Z0-9._-]/g, '_')
+}
+
+/** Save a password to the OS store. Resolves {ok, backend} — ok:false on any
+ * failure (caller falls back to plaintext). */
+export async function saveSecret(machineId, password, secretsDir) {
+  const acc = account(machineId)
+  try {
+    if (process.platform === 'darwin') {
+      await run('security', ['add-generic-password', '-U', '-s', SERVICE, '-a', acc, '-w', String(password)])
+      return { ok: true, backend: 'keychain' }
+    }
+    if (process.platform === 'win32') {
+      // DPAPI-encrypt and store under the harness home.
+      const script =
+        `$p='${String(password).replace(/'/g, "''")}';` +
+        `$s=[System.Security.Cryptography.ProtectedData]::Protect([Text.Encoding]::UTF8.GetBytes($p),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);` +
+        `[Convert]::ToBase64String($s)`
+      const b64 = await run('powershell', ['-NoProfile', '-STA', '-Command', script])
+      if (!b64) return { ok: false, backend: 'windows' }
+      mkdirSync(secretsDir || '.', { recursive: true })
+      writeFileSync(joinPath(secretsDir || '.', acc + '.bin'), b64, 'utf8')
+      return { ok: true, backend: 'windows' }
+    }
+    if (process.platform === 'linux') {
+      await run('secret-tool', ['store', '--label=' + SERVICE, 'service', SERVICE, 'account', acc], String(password) + '\n')
+      return { ok: true, backend: 'secret' }
+    }
+  } catch { /* fall through */ }
+  return { ok: false, backend: platformBackend() }
+}
+
+/** Fetch a stored password. Resolves string|null. */
+export async function getSecret(machineId, secretsDir) {
+  const acc = account(machineId)
+  try {
+    if (process.platform === 'darwin') {
+      return await run('security', ['find-generic-password', '-s', SERVICE, '-a', acc, '-w'])
+    }
+    if (process.platform === 'win32') {
+      const b64 = readFileSync(joinPath(secretsDir || '.', acc + '.bin'), 'utf8').trim()
+      if (!b64) return null
+      const script =
+        `$s=[Convert]::FromBase64String('${b64}');` +
+        `[Text.Encoding]::UTF8.GetString([System.Security.Cryptography.ProtectedData]::Unprotect($s,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))`
+      return await run('powershell', ['-NoProfile', '-STA', '-Command', script])
+    }
+    if (process.platform === 'linux') {
+      return await run('secret-tool', ['lookup', 'service', SERVICE, 'account', acc])
+    }
+  } catch { /* fall through */ }
+  return null
+}
+
+/** Delete a stored password (idempotent). */
+export async function deleteSecret(machineId, secretsDir) {
+  const acc = account(machineId)
+  try {
+    if (process.platform === 'darwin') {
+      await run('security', ['delete-generic-password', '-s', SERVICE, '-a', acc]).catch(() => {})
+      return
+    }
+    if (process.platform === 'win32') {
+      try { unlinkSync(joinPath(secretsDir || '.', acc + '.bin')) } catch { /* absent */ }
+      return
+    }
+    if (process.platform === 'linux') {
+      await run('secret-tool', ['clear', 'service', SERVICE, 'account', acc]).catch(() => {})
+    }
+  } catch { /* best effort */ }
+}

package/lib/errors.js

@@ -1,78 +1,78 @@
-// dsh-remote — SSH/SFTP error classification → actionable hints.
-// Pure function so it is unit-testable and reused by tools, slash commands,
-// the test-connect route and the settings UI.
-
-/** Classify an error thrown by the ssh pool / sftp wrapper.
- * @returns {{ category: 'auth'|'network'|'hostkey'|'timeout'|'sftp'|'credentials'|'other', hint: string, raw: string }}
- */
-export function classifyError(err, opts = {}) {
-  const msg = String((err && err.message) || err || '')
-  const { host, port } = opts
-  const where = host ? ` (${host}:${port || 22})` : ''
-
-  if (/host key/i.test(msg) && /(change|mismatch|fingerprint|verify|unknown host)/i.test(msg)) {
-    return {
-      category: 'hostkey',
-      hint: `主机指纹校验失败${where}：可能遭遇中间人攻击，或该主机重装/更换过密钥。确认无异常后执行 /remote-forget-key 重新信任。`,
-      raw: msg,
-    }
-  }
-  if (/permission denied|all configured authentication methods failed|authentication failed/i.test(msg)) {
-    return {
-      category: 'auth',
-      hint: `认证失败${where}：检查用户名/密码/私钥路径，私钥是否设了 passphrase；若公司机器要求 OTP/动态码，请确认机器配置了 keyboard-interactive 或对应密码。`,
-      raw: msg,
-    }
-  }
-  if (/no credentials/i.test(msg)) {
-    return {
-      category: 'credentials',
-      hint: `缺少凭据：请设置 password 或 privateKeyPath（私钥只在显式提供时使用），或为该机器启用 SSH agent。`,
-      raw: msg,
-    }
-  }
-  if (/ENOTFOUND|EAI_AGAIN|getaddrinfo/i.test(msg)) {
-    return {
-      category: 'network',
-      hint: `主机不可达${where}：检查 host 拼写 / IP / DNS；内网机器可能需要走跳板机（配置 proxy）或 VPN。`,
-      raw: msg,
-    }
-  }
-  if (/ECONNREFUSED|connection refused/i.test(msg)) {
-    return {
-      category: 'network',
-      hint: `连接被拒绝${where}：确认端口 ${port || 22} 正确、远端 sshd 在监听；检查防火墙/安全组是否放行。`,
-      raw: msg,
-    }
-  }
-  if (/sftp operation timed out|sftp failed|readdir|writeFile|fastGet|fastPut/i.test(msg)) {
-    return {
-      category: 'sftp',
-      hint: `SFTP 操作失败：可能是远端磁盘/权限问题或服务器卡死（已自动超时保护）。检查目标路径权限。`,
-      raw: msg,
-    }
-  }
-  if (/ETIMEDOUT|timed out|timeout/i.test(msg)) {
-    return {
-      category: 'timeout',
-      hint: `连接/操作超时${where}：检查端口、防火墙、路由；或调大 connectTimeoutMs / commandTimeoutMs。`,
-      raw: msg,
-    }
-  }
-  if (/cannot read private key/i.test(msg)) {
-    return {
-      category: 'credentials',
-      hint: `无法读取私钥文件：检查 privateKeyPath 是否存在、当前用户是否有读取权限。`,
-      raw: msg,
-    }
-  }
-  return { category: 'other', hint: msg, raw: msg }
-}
-
-/** One-line friendly message: hint (+ raw when it adds information). */
-export function friendlyMessage(err, opts = {}) {
-  const c = classifyError(err, opts)
-  if (c.category === 'other') return c.raw
-  if (c.raw && c.raw !== c.hint) return `${c.hint}（原始错误：${c.raw}）`
-  return c.hint
-}
+// dsh-remote — SSH/SFTP error classification → actionable hints.
+// Pure function so it is unit-testable and reused by tools, slash commands,
+// the test-connect route and the settings UI.
+
+/** Classify an error thrown by the ssh pool / sftp wrapper.
+ * @returns {{ category: 'auth'|'network'|'hostkey'|'timeout'|'sftp'|'credentials'|'other', hint: string, raw: string }}
+ */
+export function classifyError(err, opts = {}) {
+  const msg = String((err && err.message) || err || '')
+  const { host, port } = opts
+  const where = host ? ` (${host}:${port || 22})` : ''
+
+  if (/host key/i.test(msg) && /(change|mismatch|fingerprint|verify|unknown host)/i.test(msg)) {
+    return {
+      category: 'hostkey',
+      hint: `主机指纹校验失败${where}：可能遭遇中间人攻击，或该主机重装/更换过密钥。确认无异常后执行 /remote-forget-key 重新信任。`,
+      raw: msg,
+    }
+  }
+  if (/permission denied|all configured authentication methods failed|authentication failed/i.test(msg)) {
+    return {
+      category: 'auth',
+      hint: `认证失败${where}：检查用户名/密码/私钥路径，私钥是否设了 passphrase；若公司机器要求 OTP/动态码，请确认机器配置了 keyboard-interactive 或对应密码。`,
+      raw: msg,
+    }
+  }
+  if (/no credentials/i.test(msg)) {
+    return {
+      category: 'credentials',
+      hint: `缺少凭据：请设置 password 或 privateKeyPath（私钥只在显式提供时使用），或为该机器启用 SSH agent。`,
+      raw: msg,
+    }
+  }
+  if (/ENOTFOUND|EAI_AGAIN|getaddrinfo/i.test(msg)) {
+    return {
+      category: 'network',
+      hint: `主机不可达${where}：检查 host 拼写 / IP / DNS；内网机器可能需要走跳板机（配置 proxy）或 VPN。`,
+      raw: msg,
+    }
+  }
+  if (/ECONNREFUSED|connection refused/i.test(msg)) {
+    return {
+      category: 'network',
+      hint: `连接被拒绝${where}：确认端口 ${port || 22} 正确、远端 sshd 在监听；检查防火墙/安全组是否放行。`,
+      raw: msg,
+    }
+  }
+  if (/sftp operation timed out|sftp failed|readdir|writeFile|fastGet|fastPut/i.test(msg)) {
+    return {
+      category: 'sftp',
+      hint: `SFTP 操作失败：可能是远端磁盘/权限问题或服务器卡死（已自动超时保护）。检查目标路径权限。`,
+      raw: msg,
+    }
+  }
+  if (/ETIMEDOUT|timed out|timeout/i.test(msg)) {
+    return {
+      category: 'timeout',
+      hint: `连接/操作超时${where}：检查端口、防火墙、路由；或调大 connectTimeoutMs / commandTimeoutMs。`,
+      raw: msg,
+    }
+  }
+  if (/cannot read private key/i.test(msg)) {
+    return {
+      category: 'credentials',
+      hint: `无法读取私钥文件：检查 privateKeyPath 是否存在、当前用户是否有读取权限。`,
+      raw: msg,
+    }
+  }
+  return { category: 'other', hint: msg, raw: msg }
+}
+
+/** One-line friendly message: hint (+ raw when it adds information). */
+export function friendlyMessage(err, opts = {}) {
+  const c = classifyError(err, opts)
+  if (c.category === 'other') return c.raw
+  if (c.raw && c.raw !== c.hint) return `${c.hint}（原始错误：${c.raw}）`
+  return c.hint
+}