dsh-scnet 0.6.10 → 0.6.12

package/README.md

@@ -4,15 +4,17 @@
 
 DSH-SCNet (`dsh-scnet` on npm) is a community-maintained DSH bundle for operating Supercomputing Network (SCNet). It packages the source [`scnet-hpc`](https://github.com/lql341/scnet-hpc) Skill, profile-aware utilities, and bounded tools for SSH, Slurm, OpenAPI files, regional resources, and Notebook discovery.
 
-Current release: **0.6.10**
+Current release: **0.6.12**
 
 <!-- scnet-release:start -->
-## 0.6.10 highlights
-
-- Coordinate the synchronized downstream DSH release with a protocol-neutral one-shot loopback
-  OAuth callback listener, fixed-path validation, timeout cleanup, and generic browser responses.
-- Keep the canonical Skill endpoint-neutral; no SCNet issuer, endpoint, client ID, scope, or
-  credential is embedded in this release.
+## 0.6.12 highlights
+
+- Make first-time AK/SK setup explicit: validate pasted values, hide both keys, show their source,
+  and read back saved credentials before confirming persistence.
+- Support Windows Credential Manager and explain macOS Keychain, Linux keyring requirements,
+  PowerShell session scope, and the Windows/WSL2 boundary.
+- Preview SSH key installation and effective configuration, document cluster usernames and
+  key expiry, and add onboarding tests across Linux, macOS and Windows.
 <!-- scnet-release:end -->
 
 > This is an independent community project. It is compatible with DeepSeek Harness but is not an official DeepSeek product and does not imply endorsement, partnership, or authorization by DeepSeek.

package/README_CN.md

@@ -4,15 +4,17 @@
 
 <p align="center">在 DeepSeek Harness 里操作超算互联网（SCNet）：配置 SSH、管理 Slurm 作业、查询 OpenAPI 区域和文件、检查 Notebook 资源与实例，并保留海光 DCU/DTK 诊断能力。</p>
 
-当前版本：**0.6.10**
+当前版本：**0.6.12**
 
 <!-- scnet-release:start -->
-## 0.6.10 更新
-
-- 协调下游 DSH 发布协议无关的一次性 loopback OAuth 回调监听器，包含固定路径校验、
-  超时清理和不暴露回调细节的通用浏览器响应。
-- canonical Skill 继续保持 endpoint 无关；本版本不嵌入 SCNet issuer、endpoint、client ID、
-  scope 或任何凭证。
+## 0.6.12 更新
+
+- 优化首次 AK/SK 配置：检查粘贴错误、隐藏双密钥、显示实际来源，保存后读回验证，
+  明确区分区域元数据与凭据持久保存。
+- 支持 Windows 凭据管理器，解释 macOS Keychain、Linux 密钥环依赖、PowerShell 会话
+  作用域与 Windows/WSL2 环境隔离。
+- 提前展示 SSH 私钥安装计划与实际配置，补充集群用户名、密钥有效期和 Windows OpenSSH
+  指引，并增加 Linux、macOS、Windows 三平台配置回归测试。
 <!-- scnet-release:end -->
 
 > 本项目是独立维护的社区项目，与 DeepSeek Harness 兼容，但不是 DeepSeek 官方产品，也不表示 DeepSeek 对本项目提供背书、合作或授权。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-scnet",
-  "version": "0.6.10",
+  "version": "0.6.12",
   "description": "Community DeepSeek Harness bundle for SCNet SSH and OpenAPI jobs, files, Notebook resources, Slurm diagnostics, and Hygon DCU/DTK guidance.",
   "type": "module",
   "main": "./index.mjs",

package/skills/scnet-hpc/SKILL.md

@@ -11,6 +11,13 @@ available through the API. Never silently switch backends.
 
 ## First use and selection
 
+- On first use or missing credentials, read `references/first-use.md` and explain in the user's
+  language what is needed, where to obtain it, and the next local command before starting setup.
+  Prefer OpenAPI (platform username + AK/SK); request SSH credentials only for SSH operations.
+  Explain-only/offline work needs no credentials. Reuse working configuration without re-entry.
+- Never request AK/SK or private-key contents in chat. Give a command using the resolved absolute
+  Skill path so users can enter secrets in their own terminal; do not launch hidden prompts in
+  an agent tool session. Read `references/openapi.md` or `references/setup.md` for backend details.
 - Run `scripts/setup.sh new|modify|status|reset` for explicit configuration lifecycle.
   OpenAPI setup requires Python 3. With no saved preference, default to OpenAPI; credentials
   can come from environment variables or the supported OS credential store.

package/skills/scnet-hpc/VERSION

@@ -1 +1 @@
-0.6.10
+0.6.12

package/skills/scnet-hpc/references/first-use.md

@@ -0,0 +1,84 @@
+# 首次使用：准备什么、从哪里获取
+
+首次介绍或缺少凭据时，先按用户当前任务说明下面的信息，再给本机配置命令。
+使用用户的语言；已经可用的配置直接复用，说明用法或离线准备无需先配置凭据。
+
+## 先选需要的连接方式
+
+| 现在要做什么 | 推荐方式 | 用户需要准备 |
+| --- | --- | --- |
+| 查询队列、文件或管理标准 HPC 作业 | OpenAPI（默认） | SCNet 平台用户名、AK、SK |
+| 安装环境、编译、执行远程 shell、API 未覆盖的操作 | SSH | 目标集群、集群/Linux 用户名、下载的 SSH 私钥文件路径 |
+| 阅读说明、讨论参数、离线准备作业内容 | 暂不连接 | 无需凭据 |
+
+不要求用户同时准备两套凭据。平台账号需要已开通目标区域资源；只有 AK/SK 并不会开通资源。
+若还没有账号或资源，参考[SCNet 新手指南](https://www.scnet.cn/help/docs/mainsite/hpc/beginner-guide/)。
+
+## OpenAPI：三个输入从哪里来
+
+登录 SCNet，进入 **个人中心 → 访问控制**，生成并下载授权码文件。
+按[官方 AK/SK 说明](https://www.scnet.cn/ac/openapi/doc/2.0/api/safecertification/get-user-tokens-aksk.html)对应填写：
+
+| 向导里的字段 | 填什么 |
+| --- | --- |
+| 平台用户名 | SCNet 平台用户名，不是区域内的 Linux 用户名或账号密码 |
+| AccessKey / AK | 下载文件中 `Accesskey` 列的值 |
+| SecretKey / SK | 同一份文件中 `Secretkey` 列的值 |
+
+每次仅复制一个值，不复制列名、整行表格或 `export` / `$env:` 赋值命令。
+这里使用 HPC OpenAPI 授权码，不使用模型服务的 API Key。用户无需手填区域 ID、调度器 ID
+或接口地址；认证后向导会发现已授权区域，再让用户选择。
+
+AK/SK 只在用户自己的终端输入，两个字段都隐藏，输入时不显示星号是正常现象。
+不要求用户把授权码文件、密钥或带密钥的截图发到聊天。
+
+## SSH：下载什么、核对什么
+
+在 SCNet 控制台选择目标区域，进入 **命令行 E-Shell → 左上角 SSH 连接**，下载私钥，
+同时记录连接域名和端口。下载文件可能以 `_rsa.txt` 结尾，`.txt` 本身不代表文件选错。
+参见[官方 SSH 下载步骤](https://www2.scnet.cn/help/docs/mainsite/hpc/advanced-guide/advanced-efile/index.html)。
+
+- 集群用户名取该区域实际 Linux 用户名；可在网页 E-Shell 中运行 `whoami` 核对。
+- 私钥字段填本机下载文件的路径，保留原文件，不填私钥正文，也不选 `.pub` 公钥。
+- 主机和端口默认来自所选 `clusters/<集群>.conf`；与控制台不一致时先处理 profile，避免连错目标。
+- SSH 私钥和 AK/SK 不互通。配置、保存位置、有效期及 Windows OpenSSH 步骤见
+  [连接配置详解](setup.md)。
+
+## 给用户能直接运行的本机命令
+
+Agent 应将下面的 `<Skill目录>` 替换为实际安装目录的绝对路径，保留引号，按用户系统提供
+一组命令。交互向导必须在用户可见且可输入的本机终端运行，不能在 Agent 后台工具里等待秘密输入。
+
+Windows PowerShell（OpenAPI）：
+
+```powershell
+python "<Skill目录>/scripts/scnet.py" setup new --mode openapi
+python "<Skill目录>/scripts/scnet.py" setup status
+python "<Skill目录>/scripts/scnet.py" doctor
+```
+
+macOS / Linux（OpenAPI）：
+
+```bash
+python3 "<Skill目录>/scripts/scnet.py" setup new --mode openapi
+python3 "<Skill目录>/scripts/scnet.py" setup status
+python3 "<Skill目录>/scripts/scnet.py" doctor
+```
+
+已有配置需更换凭据时，用 `setup modify --mode openapi`。SSH 自动安装在 macOS/Linux/WSL2
+使用 `python3 "<Skill目录>/scripts/scnet.py" setup new --mode ssh`，然后选择目标集群。
+Windows 原生使用 OpenAPI 无需 WSL2；SSH 自动安装需要 WSL2 或按连接详解手工配置。
+
+保存提示要与本机相符：Windows 用系统凭据管理器，macOS 用系统 Keychain，Linux 用
+`secret-tool`（Ubuntu/Debian 的 `libsecret-tools`）和已解锁的会话密钥环。
+无密钥环的服务器可用宿主秘密注入；完整示例与 PowerShell 会话范围见 [OpenAPI 说明](openapi.md)。
+
+`setup status` 查看实际凭据来源及配置状态；`doctor` 只读检查认证和连接。
+区域配置完成不等于凭据已保存；不能仅凭 setup 成功就宣称以后不需要提供凭据。
+
+## 首次介绍示例
+
+> 建议先用 OpenAPI 配置查询和作业管理。你需要 SCNet 平台用户名，以及“个人中心 →
+> 访问控制”下载文件中的 Accesskey、Secretkey 两项。请只在本机终端向导里填写，
+> 不要发到聊天。我会给你当前安装目录对应的命令，完成后用 status 和 doctor 检查。
+> 如需远程编译或装环境，再到目标区域的“命令行 E-Shell → SSH 连接”下载 SSH 私钥。

package/skills/scnet-hpc/references/openapi.md

@@ -26,10 +26,48 @@ Obtain AK/SK from the SCNet website:
 3. Open **Access Control / 访问控制**.
 4. Generate and download the authorization file containing AccessKey and SecretKey.
 
+Use the platform username for `user`, the downloaded file's `Accesskey` column for AK,
+and its `Secretkey` column for SK. Copy each value separately, without column labels or shell
+assignments. These credentials differ from both cluster/Linux usernames and model-service API keys.
+For the initial user briefing and commands that work outside the Skill directory, read
+[first-use.md](first-use.md).
+
 Official instructions:
 <https://www.scnet.cn/ac/openapi/doc/2.0/api/safecertification/get-user-tokens-aksk.html>
 
-Preferred environment variables:
+## Guided first-time setup
+
+Run `python3 scripts/scnet.py setup new --mode openapi` on macOS/Linux, or
+`python scripts/scnet.py setup new --mode openapi` in Windows PowerShell.
+Use `setup modify --mode openapi` to replace credentials for an existing setup.
+
+Copy only each field's value, one at a time: platform login user, AccessKey, then SecretKey.
+The cluster/Linux username is discovered later and may differ. Both key inputs are invisible;
+surrounding quotes are removed, while pasted shell assignments, multiline values, and invisible
+characters are rejected with a retry. The wizard does not display either key.
+
+| Environment | Where persistent AK/SK are stored | Dependency and recovery |
+|---|---|---|
+| macOS | Login user's Keychain, service `scnet-hpc-openapi` | Built-in `security`; allow access/unlock when prompted; find the item in Keychain Access |
+| Linux desktop | Secret Service, service `scnet-hpc-openapi` | Ubuntu/Debian: `sudo apt install libsecret-tools`; a running, unlocked keyring and session D-Bus are also needed |
+| Linux headless / CI | Host-injected environment | No `libsecret-tools` required for API calls; installing the package alone does not create a working keyring |
+| Native Windows | Current user's Windows Credential Manager, Generic Credential `scnet-hpc-openapi` | Built in; manage through Control Panel > Credential Manager > Windows Credentials |
+| WSL2 | Linux credentials inside WSL2 | Windows Credential Manager and Windows environment changes are not automatically shared |
+
+Saving is optional and happens after authentication. A saved item is read back before persistence is
+reported as verified. If saving fails or is declined, **region setup is not credential persistence**:
+the panel records `not_saved` and explains how to provide credentials for subsequent commands.
+Use `setup status` for metadata and the actual credential source visible to the current process;
+use `doctor --no-network` for local checks or `doctor` for a read-only connection check.
+`setup reset` can delete the credential-store item separately from region metadata.
+
+### Environment injection
+
+Set all three variables together. A partial set is rejected instead of mixing one account's
+username/key with another account's saved credential set. Environment values take precedence over
+the system store; clear stale overrides after saving replacement credentials.
+
+Bash/Zsh, in the same terminal that will launch the client:
 
 ```bash
 export SCNET_OPENAPI_USER="<platform-user>"
@@ -37,10 +75,31 @@ export SCNET_OPENAPI_ACCESS_KEY="<access-key>"
 export SCNET_OPENAPI_SECRET_KEY="<secret-key>"
 ```
 
+PowerShell, in the same window that will launch the client:
+
+```powershell
+$env:SCNET_OPENAPI_USER = "<platform-user>"
+$env:SCNET_OPENAPI_ACCESS_KEY = "<access-key>"
+$env:SCNET_OPENAPI_SECRET_KEY = "<secret-key>"
+python scripts/scnet.py --backend openapi doctor
+```
+
+These `$env:` assignments last only for the current PowerShell session and its subsequently launched
+children. Already-running desktop applications do not receive them. Prefer the interactive wizard and
+Windows Credential Manager for daily desktop use. Do not use plaintext shell profiles, `setx`, or
+checked-in environment files as the default credential store. Commands containing real secrets may
+be recorded in shell history; host-managed secret injection avoids manual command entry.
+
+To stop overriding the store in PowerShell:
+
+```powershell
+Remove-Item Env:SCNET_OPENAPI_USER,Env:SCNET_OPENAPI_ACCESS_KEY,Env:SCNET_OPENAPI_SECRET_KEY -ErrorAction SilentlyContinue
+```
+
 The client signs the canonical AK/timestamp/user JSON with HMAC-SHA256 when requesting
 region tokens. Tokens are reused from a permission-restricted disk cache for up to four hours
 when available; an expired or unavailable cache triggers authentication. The setup panel can store the
-platform credential set in macOS Keychain or Linux Secret Service; otherwise use environment
+platform credential set in macOS Keychain, Linux Secret Service, or Windows Credential Manager; otherwise use environment
 variables. Region IDs, region users, schedulers, and home paths are discovered and cached as
 non-secret metadata.
 

package/skills/scnet-hpc/references/setup.md

@@ -3,6 +3,64 @@
 集群的主机名、端口等参数来自 `clusters/<集群短名>.conf`。
 本文用 `<集群>`、`<主机名>`、`<端口>` 表示从 profile 读出的值。
 
+## 首次配置前先分清三件事
+
+1. **凭据**：在控制台选择目标区域，进入“命令行 E-Shell → 左上角 SSH 连接”，下载私钥并
+   记录域名和端口（[官方步骤](https://www2.scnet.cn/help/docs/mainsite/hpc/advanced-guide/advanced-efile/index.html)）。
+   它与 OpenAPI 的 AK/SK 不同；保留原始文件，可能以 `_rsa.txt` 结尾，不要选择 `.pub` 公钥。
+2. **用户名**：填写区域内的集群/Linux 用户名，不一定等于 SCNet 平台登录名；文件名只作为
+   自动推断线索，不确定时在该区域网页 E-Shell 中执行 `whoami` 核对。
+3. **运行环境**：macOS/Linux/WSL2 可运行自动安装脚本。Windows 原生 OpenSSH 的配置和
+   WSL2 里的 `~/.ssh` 不共享，在哪个环境运行作业工具，就在该环境配置 SSH。
+
+在 macOS/Linux/WSL2 运行 `./scripts/setup.sh new --backend ssh`，或
+`python3 scripts/scnet.py setup new --mode ssh`。路径带空格时可使用外层引号；向导只需要路径，
+不要粘贴私钥正文。安装前会显示主机、端口、目标位置，安装后显示实际生效的 `ssh -G` 参数。
+
+安装位置为 `~/.ssh/id_rsa_<集群>`，配置为 `~/.ssh/config`。不同的旧私钥先备份；只更新
+本工具管理的 Host 块，其他已有 Host 保留。保留旧 Host 时，务必核对实际 IdentityFile
+是否指向新密钥。`--skip-connect` 只保存元数据，不代表私钥已安装或连接已验证。
+
+私钥有口令时先执行 `ssh-add <私钥文件路径>`；如果无法解析但没有设置口令，重新下载原始
+文件，不要把损坏的格式误认为“有口令”。`Permission denied` 还可能表示私钥过期、用户名
+不匹配或 IP 白名单限制，不只是输入错误。
+
+## Windows 原生 OpenSSH（手工配置）
+
+若使用完整 Bash 工作流，优先在 WSL2 运行上方安装向导。若只使用 Python SSH backend，
+可手工配置 Windows OpenSSH，然后运行 `python scripts/scnet.py setup modify --mode ssh`
+接管已有别名；这不会让 Bash 安装脚本变成 Windows 原生脚本。
+
+1. 在 PowerShell 执行 `Get-Command ssh,scp,ssh-keygen`，确认 Windows OpenSSH 客户端已安装。
+2. 把下载的私钥复制到 `$env:USERPROFILE\.ssh\id_rsa_<集群>`；路径可自选，但需与配置一致。
+3. 对复制的目标私钥限制访问权限（下方路径占位符需替换）：
+
+```powershell
+$sshKeyPath = "$env:USERPROFILE\.ssh\id_rsa_<集群>"
+$sshIdentity = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
+icacls $sshKeyPath /inheritance:r
+icacls $sshKeyPath /grant:r "${sshIdentity}:(R)"
+notepad "$env:USERPROFILE\.ssh\config"
+```
+
+在编辑器里追加以下块，替换为 profile 和账号中的实际值，保存为无 BOM 的 UTF-8 文本；
+保留已有无关的 Host 配置。Windows 不添加 `UseKeychain` 和 Unix socket 连接复用选项：
+
+```text
+Host <集群>
+  HostName <主机名>
+  Port <端口>
+  User <集群用户名>
+  IdentityFile ~/.ssh/id_rsa_<集群>
+  IdentitiesOnly yes
+  ServerAliveInterval 60
+  ServerAliveCountMax 3
+```
+
+先执行 `ssh -G <集群>` 核对 `hostname/user/port/identityfile`，再执行 `ssh <集群>`。
+首次主机指纹请与平台提供的指纹核对。口令私钥需要当前环境的 ssh-agent，Windows 中的
+`ssh-add` 与 WSL2 中的 ssh-agent 也互相独立。
+
 ## 手工配置
 
 ```bash

package/skills/scnet-hpc/scripts/_common.sh

@@ -53,10 +53,12 @@ refresh_live_node_count() {
     [ -n "${CLUSTER_ID:-}" ] || return 0
     [ -n "${PARTITION:-}" ] || return 0
 
-    local live
+    # Live metadata is optional; a failed SSH probe must not trigger callers'
+    # errexit/pipefail settings or discard the existing profile/cache value.
+    local live=""
     live=$(ssh -o BatchMode=yes -o ConnectTimeout=10 -o ServerAliveInterval=15 -o ServerAliveCountMax=2 \
         "$CLUSTER_ID" "scontrol show partition ${PARTITION}" 2>/dev/null \
-        | tr ' ' '\n' | sed -n 's/^TotalNodes=//p' | head -1)
+        | tr ' ' '\n' | sed -n 's/^TotalNodes=//p' | head -1) || live=""
 
     if [[ "$live" =~ ^[0-9]+$ ]] && [ "$live" -gt 0 ]; then
         NODE_COUNT="$live"

package/skills/scnet-hpc/scripts/scnet.py

@@ -34,6 +34,8 @@ from scnet_credentials import (
     CredentialError,
     delete_openapi_credentials,
     load_openapi_credentials,
+    load_secure_credentials,
+    normalize_credential,
     secure_store_name,
     store_openapi_credentials,
 )
@@ -414,6 +416,78 @@ def _ask_secret(prompt: str) -> str:
     return getpass.getpass(f"{prompt}: ").strip()
 
 
+def _ask_credential(label: str, *, secret: bool = False, default: str = "") -> str:
+    while True:
+        value = _ask_secret(label) if secret else _ask(label, default)
+        try:
+            return normalize_credential(value, label)
+        except CredentialError as exc:
+            print(f"输入未通过检查：{exc}")
+
+
+def _credential_help() -> None:
+    provider = secure_store_name()
+    print("\n凭据保存方式（AK/SK 与 SSH 私钥是两套独立凭据）：")
+    if provider == "Windows Credential Manager":
+        print("Windows：可保存到当前用户的 Windows 凭据管理器，无需安装额外工具。")
+        print("查看/删除：控制面板 → 凭据管理器 → Windows 凭据 → 普通凭据 → scnet-hpc-openapi。")
+    elif provider == "macOS Keychain":
+        print("macOS：使用系统自带 Keychain，无需安装依赖；系统可能提示解锁或授权访问。")
+        print("可在“钥匙串访问”搜索 scnet-hpc-openapi 查看或删除。")
+    elif provider == "Secret Service":
+        print("Linux：已找到 secret-tool；保存时还需要运行且已解锁的 Secret Service 密钥环。")
+        print("仅安装 libsecret-tools 不保证密钥环可用，无桌面/无 D-Bus 的服务器可使用环境变量。")
+    else:
+        print("当前没有可用的系统凭据工具；仍可校验 AK/SK，但不会自动持久保存。")
+        print("Ubuntu/Debian：sudo apt install libsecret-tools；还需桌面密钥环服务运行并解锁。")
+    print("环境变量优先于系统凭据库；config.json/openapi.json 只保存账号与区域等非敏感信息。")
+    print("PowerShell 的 $env: 设置仅对当前会话及其子进程生效，已启动的桌面应用不会自动获得。")
+
+
+def _print_environment_help() -> None:
+    if platform.system() == "Windows":
+        print("在运行本程序的同一个 PowerShell 中注入；以下占位符需替换为真实值：")
+        print('$env:SCNET_OPENAPI_USER = "<平台用户名>"')
+        print('$env:SCNET_OPENAPI_ACCESS_KEY = "<AccessKey>"')
+        print('$env:SCNET_OPENAPI_SECRET_KEY = "<SecretKey>"')
+        print("关闭窗口后失效；日常桌面使用建议重新配置并选择系统凭据库。")
+    else:
+        print("在运行本程序的同一个 Bash/Zsh 中注入，或使用宿主的秘密注入功能：")
+        print('export SCNET_OPENAPI_USER="<平台用户名>"')
+        print('export SCNET_OPENAPI_ACCESS_KEY="<AccessKey>"')
+        print('export SCNET_OPENAPI_SECRET_KEY="<SecretKey>"')
+    print("命令中的秘密可能进入 shell 历史；不要把 AK/SK 写入仓库、普通配置或聊天。")
+
+
+def _private_key_path(value: str) -> Path:
+    value = value.strip()
+    if "PRIVATE KEY" in value or "\n" in value or "\r" in value:
+        raise BackendError("这里只接受私钥文件路径，不接受私钥正文。")
+    if len(value) >= 2 and value[0] == value[-1] and value[0] in "\"'":
+        value = value[1:-1]
+    path = Path(value).expanduser()
+    if not value or path.suffix == ".pub":
+        raise BackendError("请选择私钥文件路径，不要选择 .pub 公钥。")
+    return path
+
+
+def _ssh_setup_help(cluster: str, profile: Mapping[str, str]) -> None:
+    print("\nSSH 私钥获取：SCNet 控制台选择目标区域 → 命令行 E-Shell → 左上角 SSH 连接。")
+    print("下载原始私钥文件（可能以 _rsa.txt 结尾），记录页面上的域名和端口，与下方目标核对。")
+    print("官方步骤：https://www2.scnet.cn/help/docs/mainsite/hpc/advanced-guide/advanced-efile/index.html")
+    print("AK/SK 授权码不能用于 SSH。集群用户名可在该区域网页 E-Shell 运行 whoami 核对。")
+    print("输入文件路径即可（支持空格和外层引号），不要粘贴私钥正文，也不要选择 .pub 公钥。")
+    print(f"连接目标：{profile.get('SSH_HOST')}:{profile.get('SSH_PORT', '22')}，别名 {cluster}。")
+    print("用户名是该区域的集群/Linux 用户名，可能与 OpenAPI 平台账号不同。")
+    print(f"自动安装位置：{Path.home() / '.ssh' / ('id_rsa_' + cluster)}")
+    print(f"SSH 配置文件：{Path.home() / '.ssh/config'}")
+    print("不同的旧私钥会备份；已有非本工具管理的 Host 块会保留，不会自动改写。")
+    if platform.system() == "Windows":
+        print("Windows 原生 OpenSSH 与 WSL2 的 ~/.ssh 互相独立；自动安装脚本需在 WSL2 内执行。")
+        print("已有 Windows OpenSSH 配置可用 setup modify 接管；手工安装步骤见 references/setup.md。")
+    print("若私钥设有口令，先用 ssh-add 加载；连接失败还需检查有效期、端口及平台 IP 白名单。")
+
+
 def _ask_yes_no(prompt: str, default: bool = True) -> bool:
     hint = "Y/n" if default else "y/N"
     answer = input(f"{prompt} [{hint}]: ").strip().lower()
@@ -706,10 +780,16 @@ def _print_terminal_help() -> None:
                 "Linux：使用 ↑/↓ 和 Enter，也可输入编号；"
                 "Ctrl+C 可取消。敏感输入不会回显。"
             )
+    elif system == "Windows":
+        print("Windows：输入编号并按 Enter 选择；Ctrl+C 可取消。敏感输入不会回显。")
+        print("OpenAPI 配置可直接运行 Python，并保存到 Windows 凭据管理器；无需 Bash。")
+        print("SSH 自动安装及完整 shell 脚本环境请使用 WSL2。")
     print()
 
 
 def _run_setup_ssh(cluster: str, key_path: str, username: str) -> None:
+    if platform.system() == "Windows":
+        raise BackendError("Windows 原生环境无法执行 SSH 自动安装脚本；请在 WSL2 中运行 setup，或按 references/setup.md 配置 Windows OpenSSH。")
     script = REPO_ROOT / "scripts" / "setup-ssh.sh"
     command = [str(script), "--cluster", cluster, key_path, username]
     try:
@@ -873,8 +953,10 @@ def _resolved_ssh_connection(
     }
 
 
-def _ssh_key_metadata(cluster: str, source: str, username: str) -> dict[str, Any]:
-    installed = Path.home() / ".ssh" / f"id_rsa_{cluster}"
+def _ssh_key_metadata(
+    cluster: str, source: str, username: str, *, installed_path: str | None = None
+) -> dict[str, Any]:
+    installed = Path(installed_path).expanduser() if installed_path else Path.home() / ".ssh" / f"id_rsa_{cluster}"
     metadata: dict[str, Any] = {
         "username": username,
         "key_path": str(installed),
@@ -925,7 +1007,7 @@ def _print_setup_status(config: Mapping[str, Any]) -> None:
             expiry = profile.get("key_expires_at") or "未知"
             print(
                 f"  - {name}: user={profile.get('username') or '未知'}, "
-                f"key_expires={expiry}"
+                f"key={profile.get('key_path') or '未安装/未记录'}, key_expires={expiry}"
             )
     configured_names = set(clusters) if isinstance(clusters, dict) else set()
     for item in list_profiles(REPO_ROOT):
@@ -956,6 +1038,11 @@ def _print_setup_status(config: Mapping[str, Any]) -> None:
             f"OpenAPI：user={openapi.get('platform_user') or '未知'}, "
             f"provider={openapi.get('credential_provider') or '环境变量'}"
         )
+        try:
+            active_credentials, active_provider = load_openapi_credentials()
+            print(f"  当前进程实际凭据来源：{active_provider if active_credentials else '未检测到凭据（区域缓存不等于已认证）'}")
+        except CredentialError as exc:
+            print(f"  当前凭据检查失败：{exc}")
         print(f"  已发现区域：{len(regions)}，已启用区域：{len(enabled)}")
         for region_id in enabled:
             region = regions.get(str(region_id), {})
@@ -1117,6 +1204,7 @@ def setup_panel(
         selected_cluster = cluster
         result["cluster"] = cluster
         _, profile = load_profile(REPO_ROOT, cluster)
+        _ssh_setup_help(cluster, profile)
         existing_profile = existing_clusters.get(cluster, {})
         if not isinstance(existing_profile, dict):
             existing_profile = {}
@@ -1133,17 +1221,19 @@ def setup_panel(
         key_path = ""
         if not skip_connect:
             detected_key = str(existing_profile.get("key_path") or "")
+            if platform.system() == "Windows" and not detected_connection:
+                raise BackendError("尚未检测到 Windows OpenSSH 连接。请先按 references/setup.md 手工配置，或在 WSL2 运行 SSH 安装向导。")
             if action == "modify" and detected_key:
                 rotate = _ask_yes_no(
                     "是否轮换为新的 SSH 私钥？", default=False
                 )
                 key_path = (
-                    str(Path(_ask("新私钥文件路径")).expanduser())
+                    str(_private_key_path(_ask("新私钥文件路径")))
                     if rotate
                     else detected_key
                 )
             else:
-                key_path = str(Path(_ask("私钥文件路径")).expanduser())
+                key_path = str(_private_key_path(_ask("私钥文件路径")))
             if not key_path or not Path(key_path).is_file():
                 raise BackendError(f"找不到私钥文件: {key_path}")
         detected_user = _detect_ssh_username(
@@ -1155,6 +1245,9 @@ def setup_panel(
         )
         if not username:
             raise BackendError("无法自动探测 SSH 用户名，请手工输入")
+        if not re.fullmatch(r"[A-Za-z0-9._-]+", username):
+            raise BackendError("集群用户名包含空白或不支持的字符，请只填写用户名。")
+        print(f"配置摘要：集群={cluster}，用户={username}，私钥={key_path or '未安装（skip-connect）'}")
         clusters = dict(existing_clusters)
         clusters[cluster] = {**existing_profile, "username": username}
         result["ssh"] = {"clusters": clusters}
@@ -1174,6 +1267,8 @@ def setup_panel(
             if not _ask_yes_no(prompt, default=True):
                 print("已跳过 SSH 写入；可稍后单独运行 setup-ssh.sh。")
             elif adopted:
+                if username != detected_connection.get("username"):
+                    raise BackendError("接管时输入的用户名与现有 SSH 别名不同；请先修改 ~/.ssh/config，再重新运行 setup。")
                 completed = subprocess.run(
                     [
                         "ssh",
@@ -1195,7 +1290,7 @@ def setup_panel(
                     )
                 clusters[cluster] = {
                     **existing_profile,
-                    **_ssh_key_metadata(cluster, key_path, username),
+                    **_ssh_key_metadata(cluster, key_path, username, installed_path=key_path),
                     "adopted": True,
                 }
             else:
@@ -1231,8 +1326,16 @@ def setup_panel(
                 "官方说明：https://www.scnet.cn/ac/openapi/doc/2.0/"
                 "api/safecertification/get-user-tokens-aksk.html"
             )
-            print("SecretKey 输入时不会显示字符或星号，这是正常现象。\n")
-            saved_credentials, saved_provider = load_openapi_credentials()
+            _credential_help()
+            print("字段对应：平台用户名 = SCNet 平台用户名；AK = 下载文件的 Accesskey 列；SK = Secretkey 列。")
+            print("无需填写区域 ID 或接口地址，认证后自动发现已授权区域；账号需已开通区域资源。")
+            print("\n请依次复制平台用户名、AccessKey、SecretKey 的值；不需要输入 export 或 $env: 命令。")
+            print("AccessKey 和 SecretKey 都不会显示字符或星号；外层引号会自动去除。\n")
+            try:
+                saved_credentials, saved_provider = load_openapi_credentials()
+            except CredentialError as exc:
+                print(f"现有凭据无法使用：{exc}")
+                saved_credentials, saved_provider = None, None
             use_saved = bool(saved_credentials) and _ask_yes_no(
                 f"检测到 {saved_provider} 中的 OpenAPI 凭据，是否使用？",
                 default=True,
@@ -1243,14 +1346,17 @@ def setup_panel(
                 access_key = saved_credentials["access_key"]
                 secret_key = saved_credentials["secret_key"]
             else:
-                api_user = _ask(
+                api_user = _ask_credential(
                     "平台用户名",
-                    str(existing_openapi.get("platform_user") or ""),
+                    default=str(existing_openapi.get("platform_user") or ""),
                 )
-                access_key = _ask_secret("AccessKey")
-                secret_key = _ask_secret("SecretKey")
-                if not api_user or not access_key or not secret_key:
-                    raise BackendError("AK/SK 配置不完整")
+                while True:
+                    access_key = _ask_credential("AccessKey", secret=True)
+                    secret_key = _ask_credential("SecretKey", secret=True)
+                    if access_key != secret_key:
+                        break
+                    print("AccessKey 与 SecretKey 完全相同，可能重复粘贴了同一个字段，请重新输入。")
+            print(f"账号：{api_user}；AK/SK 已读取且不回显。下一步只读校验认证并发现授权区域。")
             backend_instance, previous = _with_openapi_credentials(
                 {},
                 user=api_user,
@@ -1328,8 +1434,8 @@ def setup_panel(
                 selected = enabled_contexts[selected_index]
             finally:
                 _restore_environment(previous)
-            stored_provider = saved_provider
-            if entered_credentials and secure_store_name():
+            stored_provider = saved_provider if use_saved else None
+            if (entered_credentials or saved_provider == "environment") and secure_store_name():
                 if _ask_yes_no(
                     f"是否将 AK/SK 保存到 {secure_store_name()}？",
                     default=True,
@@ -1338,10 +1444,22 @@ def setup_panel(
                         provider = store_openapi_credentials(
                             api_user, access_key, secret_key
                         )
+                        expected = {"user": api_user, "access_key": access_key, "secret_key": secret_key}
+                        if load_secure_credentials() != expected:
+                            raise CredentialError("保存后读回校验失败；尚不能确认凭据已持久保存。")
                         stored_provider = provider
                         print(f"OpenAPI 凭据已保存到 {provider}。")
                     except CredentialError as exc:
                         print(f"无法保存到安全凭据库：{exc}")
+            if stored_provider is None:
+                print("凭据未保存：本次认证已完成，但后续命令仍需注入环境变量或重新保存 AK/SK。")
+                _print_environment_help()
+            elif stored_provider == "environment":
+                print("凭据来源：当前进程环境变量；未另存到系统凭据库，重启后需由宿主重新注入。")
+            else:
+                print(f"持久保存已验证：{stored_provider}；条目名 scnet-hpc-openapi。")
+                if any(os.environ.get(key) for key in ("SCNET_OPENAPI_USER", "SCNET_OPENAPI_ACCESS_KEY", "SCNET_OPENAPI_SECRET_KEY")):
+                    print("注意：当前 shell 仍有环境变量，它们优先于刚保存的凭据；请清除旧变量后运行 doctor。")
             selected_schedulers = selected.get("schedulers") or []
             default_scheduler = (
                 selected_schedulers[0].get("id")
@@ -1350,7 +1468,7 @@ def setup_panel(
             )
             result["openapi"] = {
                 "platform_user": api_user,
-                "credential_provider": stored_provider,
+                "credential_provider": stored_provider or "not_saved",
                 "default_region_id": selected["region_id"],
                 "enabled_region_ids": [
                     item["region_id"] for item in enabled_contexts
@@ -1371,7 +1489,7 @@ def setup_panel(
                 },
             }
             print(
-                "\nHPC OpenAPI 配置完成：\n"
+                "\nHPC OpenAPI 区域选择结果（凭据状态见上方）：\n"
                 f"  默认区域：{selected.get('name') or selected['region_id']}"
                 f" ({selected['region_id']})\n"
                 f"  区域用户：{selected.get('username')}\n"
@@ -1386,11 +1504,10 @@ def setup_panel(
     path = save_user_config(result)
     print(f"\n已保存非敏感配置：{path}")
     print("后续可用 `python3 scripts/scnet.py config` 查看。")
-    if configure_openapi and not secure_store_name():
-        print("系统没有可用安全凭据库；请通过环境变量注入 AK/SK。")
     doctor_cluster = selected_cluster or str(current.get("cluster") or "")
     suffix = f" --cluster {shlex.quote(doctor_cluster)}" if doctor_cluster else ""
-    print(f"下一步：python3 scripts/scnet.py{suffix} doctor")
+    interpreter = "python" if platform.system() == "Windows" else "python3"
+    print(f"下一步：{interpreter} scripts/scnet.py --backend {default_backend}{suffix} doctor")
     return result
 
 
@@ -1411,12 +1528,19 @@ def doctor_report(
     try:
         path = config_path()
         if path.is_file():
-            mode = path.stat().st_mode & 0o777
-            add(
-                "user_config",
-                mode & 0o077 == 0,
-                f"{path} mode={mode:03o}",
-            )
+            if os.name == "posix":
+                mode = path.stat().st_mode & 0o777
+                add(
+                    "user_config",
+                    mode & 0o077 == 0,
+                    f"{path} mode={mode:03o}",
+                )
+            else:
+                add(
+                    "user_config",
+                    True,
+                    f"{path}（非 POSIX，跳过 mode 检查；未验证 ACL）",
+                )
         else:
             add("user_config", False, f"{path} 不存在；先运行 setup")
     except OSError as exc:
@@ -1446,18 +1570,29 @@ def doctor_report(
         if alias and shutil.which("ssh"):
             completed = subprocess.run(
                 ["ssh", "-G", alias],
-                stdout=subprocess.DEVNULL,
+                stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE,
                 text=True,
                 check=False,
             )
-            add(
-                "ssh_config",
-                completed.returncode == 0,
-                f"alias={alias}"
-                if completed.returncode == 0
-                else completed.stderr.strip(),
+            resolved = {}
+            for line in completed.stdout.splitlines():
+                field, _, value = line.partition(" ")
+                if field in {"hostname", "port", "user", "identityfile"}:
+                    resolved.setdefault(field, value)
+            config_ok = (
+                completed.returncode == 0
+                and resolved.get("hostname") == profile.get("SSH_HOST")
+                and resolved.get("port") == str(profile.get("SSH_PORT") or "22")
             )
+            detail = (
+                f"alias={alias}, host={resolved.get('hostname', '未知')}, "
+                f"port={resolved.get('port', '未知')}, user={resolved.get('user', '未知')}, "
+                f"key={resolved.get('identityfile', '未配置')}"
+            )
+            if not config_ok:
+                detail += "; 别名未解析到 profile 的主机/端口，请检查当前环境的 ~/.ssh/config"
+            add("ssh_config", config_ok, detail)
             if not no_network:
                 completed = subprocess.run(
                     [
@@ -1523,7 +1658,11 @@ def doctor_report(
 
     elif backend_name == "openapi":
         has_token = bool(os.environ.get("SCNET_OPENAPI_TOKEN"))
-        credentials, credential_provider = load_openapi_credentials()
+        try:
+            credentials, credential_provider = load_openapi_credentials()
+        except CredentialError as exc:
+            credentials, credential_provider = None, None
+            add("credential_store", False, str(exc))
         has_aksk = bool(credentials)
         add(
             "openapi_credentials",
@@ -1533,7 +1672,7 @@ def doctor_report(
             else (
                 f"检测到 AK/SK（{credential_provider}）"
                 if has_aksk
-                else "未检测到 OpenAPI 凭据"
+                else "未检测到可用凭据；运行 setup new/modify --mode openapi，或同时注入三项环境变量"
             ),
         )
         openapi_config = user_config.get("openapi", {})
@@ -1743,7 +1882,10 @@ def main(argv: list[str] | None = None) -> int:
         if args.operation == "doctor" and not data.get("ok", False):
             return 1
         return 0
-    except BackendError as exc:
+    except (KeyboardInterrupt, EOFError):
+        print("\n已取消输入；未完成的配置请重新运行 setup。", file=sys.stderr)
+        return 130
+    except (BackendError, CredentialError) as exc:
         if args.json:
             print(
                 json.dumps(

package/skills/scnet-hpc/scripts/scnet_config.py

@@ -89,8 +89,9 @@ def save_user_config(data: dict[str, Any]) -> Path:
         prefix=".config.", suffix=".tmp", dir=str(path.parent)
     )
     try:
-        os.fchmod(fd, 0o600)
         with os.fdopen(fd, "w", encoding="utf-8") as stream:
+            if os.name == "posix":
+                os.fchmod(stream.fileno(), 0o600)
             json.dump(clean, stream, ensure_ascii=False, indent=2, sort_keys=True)
             stream.write("\n")
         os.replace(temporary, path)
@@ -110,8 +111,9 @@ def _save_json_sidecar(path: Path, data: dict[str, Any]) -> Path:
         prefix=f".{path.stem}.", suffix=".tmp", dir=str(path.parent)
     )
     try:
-        os.fchmod(fd, 0o600)
         with os.fdopen(fd, "w", encoding="utf-8") as stream:
+            if os.name == "posix":
+                os.fchmod(stream.fileno(), 0o600)
             json.dump(clean, stream, ensure_ascii=False, indent=2, sort_keys=True)
             stream.write("\n")
         os.replace(temporary, path)

package/skills/scnet-hpc/scripts/scnet_credentials.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import json
 import os
 import platform
+import re
 import shutil
 import subprocess
 from typing import Any
@@ -17,6 +18,90 @@ class CredentialError(RuntimeError):
     """A user-facing credential-store failure."""
 
 
+def _credential_command(command: list[str], **options: Any) -> subprocess.CompletedProcess:
+    try:
+        return subprocess.run(command, timeout=30, **options)
+    except (OSError, subprocess.TimeoutExpired):
+        # TimeoutExpired includes argv, which contains the Keychain payload.
+        raise CredentialError("系统凭据操作失败或超时；请检查密钥环服务及解锁状态后重试。") from None
+
+
+def normalize_credential(value: str, label: str) -> str:
+    """Accept surrounding paste quotes, but never echo a credential in an error."""
+    value = value.strip().lstrip("\ufeff")
+    if len(value) >= 2 and (value[0], value[-1]) in {
+        ('"', '"'), ("'", "'"), ("“", "”"), ("‘", "’")
+    }:
+        value = value[1:-1].strip()
+    if not value:
+        raise CredentialError(f"{label} 不能为空，请只粘贴对应字段的值。")
+    if re.match(r"(?i)^(export\s|\$env:|SCNET_OPENAPI_|(?:AccessKey|SecretKey)\s*[:=])", value):
+        raise CredentialError(f"{label} 收到了变量赋值或字段名；请只粘贴值，不要粘贴整行命令。")
+    if any(character.isspace() or ord(character) < 32 or character in "\u200b\ufeff\u200e\u200f" for character in value):
+        raise CredentialError(f"{label} 含空白、换行或不可见字符，请重新复制单个字段。")
+    return value
+
+
+def _windows_credential(action: str, payload: str = "", user: str = "") -> str | bool | None:
+    """Use the current Windows user's Generic Credential store, without extra packages."""
+    import ctypes
+    from ctypes import wintypes
+
+    class Credential(ctypes.Structure):
+        _fields_ = [
+            ("Flags", wintypes.DWORD), ("Type", wintypes.DWORD),
+            ("TargetName", wintypes.LPWSTR), ("Comment", wintypes.LPWSTR),
+            ("LastWritten", wintypes.FILETIME), ("CredentialBlobSize", wintypes.DWORD),
+            ("CredentialBlob", ctypes.POINTER(ctypes.c_ubyte)),
+            ("Persist", wintypes.DWORD), ("AttributeCount", wintypes.DWORD),
+            ("Attributes", ctypes.c_void_p), ("TargetAlias", wintypes.LPWSTR),
+            ("UserName", wintypes.LPWSTR),
+        ]
+
+    api = ctypes.WinDLL("Advapi32.dll", use_last_error=True)
+    pointer = ctypes.POINTER(Credential)
+    api.CredReadW.argtypes = [wintypes.LPCWSTR, wintypes.DWORD, wintypes.DWORD, ctypes.POINTER(pointer)]
+    api.CredReadW.restype = wintypes.BOOL
+    api.CredWriteW.argtypes = [pointer, wintypes.DWORD]
+    api.CredWriteW.restype = wintypes.BOOL
+    api.CredDeleteW.argtypes = [wintypes.LPCWSTR, wintypes.DWORD, wintypes.DWORD]
+    api.CredDeleteW.restype = wintypes.BOOL
+    api.CredFree.argtypes = [ctypes.c_void_p]
+    api.CredFree.restype = None
+
+    if action == "read":
+        item = pointer()
+        success = api.CredReadW(SERVICE, 1, 0, ctypes.byref(item))
+        if success:
+            try:
+                return ctypes.string_at(item.contents.CredentialBlob, item.contents.CredentialBlobSize).decode("utf-8")
+            finally:
+                api.CredFree(item)
+    elif action == "write":
+        encoded = payload.encode("utf-8")
+        if len(encoded) > 2560:
+            raise CredentialError("凭据超出 Windows 凭据管理器容量，请检查是否粘贴了整个文件。")
+        buffer = (ctypes.c_ubyte * len(encoded)).from_buffer_copy(encoded)
+        item = Credential()
+        item.Type, item.TargetName, item.UserName = 1, SERVICE, user
+        item.CredentialBlobSize, item.CredentialBlob = len(encoded), buffer
+        item.Persist = 2  # CRED_PERSIST_LOCAL_MACHINE: same user, across logon sessions.
+        success = api.CredWriteW(ctypes.byref(item), 0)
+    elif action == "delete":
+        success = api.CredDeleteW(SERVICE, 1, 0)
+    else:
+        raise ValueError("unknown credential operation")
+    if success:
+        return True
+    error = ctypes.get_last_error()
+    if error == 1168 and action in {"read", "delete"}:
+        return None
+    raise CredentialError(
+        f"Windows 凭据管理器{action}失败（错误码 {error}）；"
+        "请在已登录的桌面用户会话运行，或使用环境变量注入。"
+    )
+
+
 def _valid(data: Any) -> bool:
     return isinstance(data, dict) and all(
         isinstance(data.get(key), str) and data[key]
@@ -30,10 +115,17 @@ def environment_credentials() -> dict[str, str] | None:
         "access_key": os.environ.get("SCNET_OPENAPI_ACCESS_KEY", ""),
         "secret_key": os.environ.get("SCNET_OPENAPI_SECRET_KEY", ""),
     }
-    return data if _valid(data) else None
+    if not any(data.values()):
+        return None
+    missing = [name for name, value in data.items() if not value]
+    if missing:
+        raise CredentialError("OpenAPI 环境变量不完整；请同时设置 USER、ACCESS_KEY、SECRET_KEY，或清除这组三个变量后使用系统凭据库。")
+    return {key: normalize_credential(value, key) for key, value in data.items()}
 
 
 def secure_store_name() -> str | None:
+    if platform.system() == "Windows":
+        return "Windows Credential Manager"
     if platform.system() == "Darwin" and shutil.which("security"):
         return "macOS Keychain"
     if shutil.which("secret-tool"):
@@ -43,19 +135,28 @@ def secure_store_name() -> str | None:
 
 def load_secure_credentials() -> dict[str, str] | None:
     provider = secure_store_name()
+    if provider == "Windows Credential Manager":
+        payload = _windows_credential("read")
+        if payload is None:
+            return None
+        try:
+            data = json.loads(payload)
+        except (ValueError, TypeError):
+            raise CredentialError("Windows 中已保存的 OpenAPI 凭据格式无效，请运行 setup modify --mode openapi 重新配置。") from None
+        return data if _valid(data) else None
     if provider == "macOS Keychain":
         command = ["security", "find-generic-password", "-s", SERVICE, "-w"]
     elif provider == "Secret Service":
         command = ["secret-tool", "lookup", "service", SERVICE]
     else:
         return None
-    completed = subprocess.run(
-        command,
-        text=True,
-        stdout=subprocess.PIPE,
-        stderr=subprocess.DEVNULL,
-        check=False,
-    )
+    try:
+        completed = subprocess.run(
+            command, text=True, stdout=subprocess.PIPE,
+            stderr=subprocess.DEVNULL, check=False, timeout=30,
+        )
+    except (OSError, subprocess.TimeoutExpired):
+        raise CredentialError(f"无法读取 {provider}；请检查密钥环服务是否运行并已解锁。") from None
     if completed.returncode != 0 or not completed.stdout.strip():
         return None
     try:
@@ -79,14 +180,17 @@ def store_openapi_credentials(
     user: str, access_key: str, secret_key: str
 ) -> str:
     data = {
-        "user": user,
-        "access_key": access_key,
-        "secret_key": secret_key,
+        "user": normalize_credential(user, "平台用户名"),
+        "access_key": normalize_credential(access_key, "AccessKey"),
+        "secret_key": normalize_credential(secret_key, "SecretKey"),
     }
     if not _valid(data):
         raise CredentialError("OpenAPI credentials are incomplete")
     payload = json.dumps(data, ensure_ascii=False, separators=(",", ":"))
     provider = secure_store_name()
+    if provider == "Windows Credential Manager":
+        _windows_credential("write", payload, data["user"])
+        return provider
     if provider == "macOS Keychain":
         command = [
             "security",
@@ -99,7 +203,7 @@ def store_openapi_credentials(
             "-w",
             payload,
         ]
-        completed = subprocess.run(
+        completed = _credential_command(
             command,
             stdout=subprocess.DEVNULL,
             stderr=subprocess.PIPE,
@@ -116,7 +220,7 @@ def store_openapi_credentials(
             "user",
             user,
         ]
-        completed = subprocess.run(
+        completed = _credential_command(
             command,
             input=payload,
             stdout=subprocess.DEVNULL,
@@ -131,20 +235,22 @@ def store_openapi_credentials(
         )
     if completed.returncode != 0:
         raise CredentialError(
-            completed.stderr.strip() or f"failed to write {provider}"
+            f"无法写入 {provider}（exit={completed.returncode}）；请检查密钥环服务及解锁状态。"
         )
     return str(provider)
 
 
 def delete_openapi_credentials() -> tuple[bool, str | None]:
     provider = secure_store_name()
+    if provider == "Windows Credential Manager":
+        return bool(_windows_credential("delete")), provider
     if provider == "macOS Keychain":
         command = ["security", "delete-generic-password", "-s", SERVICE]
     elif provider == "Secret Service":
         command = ["secret-tool", "clear", "service", SERVICE]
     else:
         return False, None
-    completed = subprocess.run(
+    completed = _credential_command(
         command,
         stdout=subprocess.DEVNULL,
         stderr=subprocess.PIPE,
@@ -156,5 +262,5 @@ def delete_openapi_credentials() -> tuple[bool, str | None]:
     if load_secure_credentials() is None:
         return False, provider
     raise CredentialError(
-        completed.stderr.strip() or f"failed to clear {provider}"
+        f"无法清除 {provider}（exit={completed.returncode}），请检查解锁状态。"
     )

package/skills/scnet-hpc/scripts/scnet_sdk/client.py

@@ -14,7 +14,7 @@ from urllib.parse import urlencode, urlsplit, urlunsplit
 from urllib.request import Request, urlopen
 
 from scnet_backends.base import BackendContext, BackendError
-from scnet_credentials import load_openapi_credentials
+from scnet_credentials import CredentialError, load_openapi_credentials
 from scnet_version import VERSION
 
 
@@ -215,16 +215,13 @@ class SCNetClient:
             ]
             return self._regions_cache
 
-        credentials, _ = load_openapi_credentials()
-        user = self.env("SCNET_OPENAPI_USER") or (
-            credentials.get("user") if credentials else None
-        )
-        access_key = self.env("SCNET_OPENAPI_ACCESS_KEY") or (
-            credentials.get("access_key") if credentials else None
-        )
-        secret_key = self.env("SCNET_OPENAPI_SECRET_KEY") or (
-            credentials.get("secret_key") if credentials else None
-        )
+        try:
+            credentials, _ = load_openapi_credentials()
+        except CredentialError as exc:
+            raise BackendError(str(exc)) from None
+        user = credentials.get("user") if credentials else None
+        access_key = credentials.get("access_key") if credentials else None
+        secret_key = credentials.get("secret_key") if credentials else None
         missing = [
             name
             for name, value in (

package/skills/scnet-hpc/scripts/setup-ssh.sh

@@ -48,6 +48,7 @@ if [ -z "$USER_NAME" ] && [ -n "${KEY_NAME_MARKER:-}" ]; then
     esac
 fi
 [ -n "$USER_NAME" ] || die "无法从文件名推断用户名，请作为最后一个参数传入"
+[[ "$USER_NAME" =~ ^[A-Za-z0-9._-]+$ ]] || die "远端用户名包含空白或不安全字符"
 
 echo "==> 集群: ${CLUSTER_ID} (${CLUSTER_DESC:-$SSH_HOST})"
 echo "==> 用户名: ${USER_NAME}"
@@ -75,12 +76,12 @@ if [ "$(uname -s)" = "Darwin" ]; then
 fi
 info "$KEY_DST (600)"
 
-if ssh-keygen -y -f "$KEY_DST" > "$KEY_DST.pub" 2>/dev/null; then
+if ssh-keygen -y -P '' -f "$KEY_DST" > "$KEY_DST.pub" 2>/dev/null; then
     chmod 644 "$KEY_DST.pub"
     info "$(ssh-keygen -lf "$KEY_DST" 2>/dev/null | awk '{print $1, $2, $4}')"
 else
     rm -f "$KEY_DST.pub"
-    info "私钥有 passphrase，跳过公钥推导"
+    info "无法用空口令解析私钥：如有口令，请先运行 ssh-add；如未设置口令，请检查文件是否损坏。"
 fi
 
 # ---------------------------------------------------------------- config
@@ -166,6 +167,9 @@ EOF
 fi
 
 # ---------------------------------------------------------------- 验证
+echo "==> 实际生效的 SSH 参数（来自 ssh -G；不显示私钥内容）"
+ssh -G "$CLUSTER_ID" 2>/dev/null \
+    | awk '$1 == "hostname" || $1 == "user" || $1 == "port" || $1 == "identityfile" { print "  " $0 }'
 echo "==> 测试连接"
 if out=$(ssh -o BatchMode=yes -o ConnectTimeout=20 \
              -o StrictHostKeyChecking=accept-new \

package/skills/scnet-hpc/scripts/setup.sh

@@ -365,6 +365,11 @@ case "$(uname -s)" in
             printf '%s\n' "Linux：使用 ↑/↓ 和 Enter，也可输入编号；Ctrl+C 可取消。" >&2
         fi
         ;;
+    MINGW*|MSYS*|CYGWIN*)
+        printf '%s\n' \
+            "Windows：OpenAPI 可在 PowerShell 中运行 python scripts/scnet.py setup，并使用系统凭据管理器。" \
+            "SSH 自动安装请在 WSL2 内运行；WSL2 与 Windows OpenSSH 的私钥目录互相独立。" >&2
+        ;;
 esac
 printf '\n' >&2
 
@@ -478,8 +483,16 @@ if [ "$BACKEND" = both ]; then
 fi
 
 if [ "$BACKEND" = ssh ] || [ "$BACKEND" = both ]; then
+    printf '%s\n' \
+        "SSH 使用从目标集群控制台下载的私钥文件，不是 AK/SK 授权码，也不是 .pub 公钥。" \
+        "用户名应为集群/Linux 用户名；输入私钥文件路径，不要粘贴文件正文。" \
+        "将安装到 $HOME/.ssh/id_rsa_${CLUSTER_ID}，配置 $HOME/.ssh/config；不同旧私钥会备份。" \
+        "已有非本工具管理的 Host 块会保留；口令私钥请先 ssh-add，过期密钥需重新下载。" >&2
     if [ "$SKIP_CONNECT" = no ]; then
         SSH_KEY="${SSH_KEY:-$(ask "私钥文件路径")}"
+        case "$SSH_KEY" in
+            \"*\"|\'*\') SSH_KEY="${SSH_KEY:1:${#SSH_KEY}-2}" ;;
+        esac
         SSH_KEY="${SSH_KEY/#\~/$HOME}"
         [ -f "$SSH_KEY" ] || die "找不到私钥文件: $SSH_KEY"
     fi