dsh-ssh-manage 0.3.3 → 0.3.5

package/README.en.md

@@ -25,7 +25,7 @@
 - **Host management** — scan the config, groups, tags, favorites, notes, latency and host inspection;
 - **Interactive terminal** — ssh2 allocates a PTY, xterm.js renders it, with colors, arrow keys, full-screen programs such as `vim`/`top`, and window resizing;
 - **Day-to-day operations** — batch commands, SFTP browse/mkdir/rename/delete/upload/download, connection tests;
-- **Credentials** — one AES-256-GCM encrypted password per host, never written to `~/.ssh/config` and never returned to the browser;
+- **Credentials** — one AES-256-GCM encrypted password per host, never written to `~/.ssh/config`; passwords are not returned to the browser by default, but Show password decrypts one on demand in the current page and auto-hides it after 30 seconds;
 - **Agent tool** — `ssh_manager` exposes the same capabilities to the model.
 
 No more jumping between a terminal and DSH, and no need to remember where each host lives in the config file.
@@ -60,7 +60,7 @@ No more jumping between a terminal and DSH, and no need to remember where each h
 ### Credentials and data
 
 - Passwords are AES-256-GCM encrypted in the plugin state directory and unlocked automatically at startup; no master password, no system Keychain.
-- Passwords are only used for SSH password authentication (also compatible with hosts that only offer keyboard-interactive). They are never written to `~/.ssh/config`, command arguments, logs or responses.
+- Passwords are only used for SSH password authentication (also compatible with hosts that only offer keyboard-interactive). They are never written to `~/.ssh/config`, command arguments or logs. They are not returned by default; Show password explicitly decrypts one into the current page for 30 seconds and it is never exposed through the Agent tool.
 - Ciphertext and key live in the same user directory, so this mainly protects against accidental file reads, not against malicious processes running as the same user.
 - Groups, tags, favorites, notes and inspection data live in `hosts.json`; passwords live in `vault.json`; configuration changes are snapshotted to the backup directory.
 
@@ -96,16 +96,16 @@ Creating a host requires alias, hostname and password. The password is not writt
 
 ### From npm (recommended)
 
-npm package: [`dsh-ssh-manage`](https://www.npmjs.com/package/dsh-ssh-manage) (current version `0.3.3`).
+npm package: [`dsh-ssh-manage`](https://www.npmjs.com/package/dsh-ssh-manage) (current version `0.3.5`).
 
 ```text
-plugin_manager action=install_bundle target=dsh-ssh-manage@0.3.3
+plugin_manager action=install_bundle target=dsh-ssh-manage@0.3.5
 ```
 
 Or with the DSH CLI:
 
 ```bash
-dsh plugin add dsh-ssh-manage@0.3.3
+dsh plugin add dsh-ssh-manage@0.3.5
 ```
 
 After installation, refresh the Web page; the sidebar shows an "SSH Hosts" entry with id `dsh-ssh-manage`.

package/README.md

@@ -25,7 +25,7 @@
 - **主机管理**：扫描配置、分组、标签、收藏、备注、连接延迟、主机巡检；
 - **交互式终端**：ssh2 分配 PTY，xterm.js 渲染，支持彩色输出、方向键、`vim`/`top` 等全屏程序和窗口自适应；
 - **日常运维**：批量命令、SFTP 目录浏览 / 新建 / 重命名 / 删除 / 上传 / 下载、测试连接；
-- **凭据管理**：每台主机保存一份 AES-256-GCM 加密密码，不写进 `~/.ssh/config`，也不返回给浏览器；
+- **凭据管理**：每台主机保存一份 AES-256-GCM 加密密码，不写进 `~/.ssh/config`；默认不返回浏览器，在主机详情点“显示密码”时才按需解密到当前页面，30 秒后自动隐藏；
 - **Agent 工具**：`ssh_manager` 把同一套能力开放给模型。
 
 不用再在终端和 DSH 之间来回切换，也不用记每个主机在配置文件里的位置。
@@ -60,7 +60,7 @@
 ### 凭据与数据
 
 - 密码使用 AES-256-GCM 加密保存在插件自己的状态目录，插件启动时自动解锁，不需要每次输入主密码，也不使用系统 Keychain。
-- 密码只用于 SSH password authentication，同时兼容只提供 keyboard-interactive 的主机；不会写入 `~/.ssh/config`、命令参数、日志或返回给浏览器。
+- 密码只用于 SSH password authentication，同时兼容只提供 keyboard-interactive 的主机；不会写入 `~/.ssh/config`、命令参数或日志。默认不返回浏览器；仅在你主动点击“显示密码”时按需解密到当前页面，30 秒后自动隐藏，且不会通过 Agent 工具返回。
 - 密码密文与本地密钥位于同一用户目录，主要防止文件被直接误读，不能抵御同一用户下的恶意进程。
 - 主机分组、标签、收藏、备注、巡检结果保存在 `hosts.json`；密码保存在 `vault.json`；删除/修改配置前写入备份目录。
 
@@ -98,16 +98,16 @@
 
 ### 从 npm 安装（推荐）
 
-npm 包：[`dsh-ssh-manage`](https://www.npmjs.com/package/dsh-ssh-manage)（当前版本 `0.3.3`）。
+npm 包：[`dsh-ssh-manage`](https://www.npmjs.com/package/dsh-ssh-manage)（当前版本 `0.3.5`）。
 
 ```text
-plugin_manager action=install_bundle target=dsh-ssh-manage@0.3.3
+plugin_manager action=install_bundle target=dsh-ssh-manage@0.3.5
 ```
 
 或使用 DSH CLI：
 
 ```bash
-dsh plugin add dsh-ssh-manage@0.3.3
+dsh plugin add dsh-ssh-manage@0.3.5
 ```
 
 安装后刷新 Web 页面，左侧栏会出现「SSH 主机」入口，入口 id 为 `dsh-ssh-manage`。

package/client.js

@@ -209,7 +209,13 @@ window.__ModuleLoader__.load({
       'drawer.details.password': ['密码', 'Password'],
       'drawer.details.savePassword': ['保存密码', 'Save password'],
       'drawer.details.clearPassword': ['清除密码', 'Clear password'],
-      'drawer.details.passwordHint': ['密码使用 AES-256-GCM 加密保存在本机，不会回传到浏览器。', 'Passwords are AES-256-GCM encrypted on this machine and never returned to the browser.'],
+      'drawer.details.passwordHint': ['密码使用 AES-256-GCM 加密保存在本机；点击“显示密码”可在当前页面临时明文查看，30 秒后自动隐藏。', 'Passwords are AES-256-GCM encrypted at rest; use Show password to reveal one temporarily on this page (auto-hides after 30 seconds).'],
+      'drawer.details.reveal': ['显示密码', 'Show password'],
+      'drawer.details.hide': ['隐藏密码', 'Hide password'],
+      'drawer.details.copyPassword': ['复制密码', 'Copy password'],
+      'drawer.details.passwordCopied': ['密码已复制', 'Password copied'],
+      'drawer.details.revealWarning': ['密码已明文显示；注意旁人、录屏和截图，30 秒后自动隐藏。', 'The password is visible in plain text; watch for onlookers, screen recording and screenshots. It hides after 30 seconds.'],
+      'drawer.details.revealFailed': ['无法显示密码：{message}', 'Could not reveal the password: {message}'],
       'drawer.details.system': ['主机信息', 'System'],
       'drawer.details.detect': ['检测信息', 'Detect'],
       'drawer.details.detecting': ['检测中…', 'Detecting…'],
@@ -783,6 +789,25 @@ window.__ModuleLoader__.load({
       )
     }
 
+    function IconEye({ size = 14 }) {
+      return h(
+        Svg,
+        { size },
+        h(P, { d: 'M2.5 12s3.6-6.2 9.5-6.2S21.5 12 21.5 12s-3.6 6.2-9.5 6.2S2.5 12 2.5 12Z' }),
+        h('circle', { cx: 12, cy: 12, r: 3, stroke: 'currentColor', strokeWidth: 1.5 }),
+      )
+    }
+
+    function IconEyeOff({ size = 14 }) {
+      return h(
+        Svg,
+        { size },
+        h(P, { d: 'M3 3l18 18' }),
+        h(P, { d: 'M10.6 6.1A10.7 10.7 0 0 1 12 6c5.9 0 9.5 6 9.5 6a17 17 0 0 1-3.1 3.6M6.4 6.8C3.9 8.7 2.5 12 2.5 12s3.6 6 9.5 6a10.9 10.9 0 0 0 4.5-1' }),
+        h(P, { d: 'M9.9 9.9a3 3 0 0 0 4.2 4.2' }),
+      )
+    }
+
     function IconEraser({ size = 15 }) {
       return h(
         Svg,
@@ -4432,20 +4457,71 @@ window.__ModuleLoader__.load({
     }
 
     function DetailsView({ model, host, onEdit, onDelete }) {
-      const { t, localeId, isPending, testHost, inspectHost, savePassword, removePassword } = model
+      const { t, notify, localeId, isPending, testHost, inspectHost, savePassword, removePassword } = model
       const [password, setPassword] = React.useState('')
       const [saving, setSaving] = React.useState(false)
+      const [revealedPassword, setRevealedPassword] = React.useState('')
+      const [revealing, setRevealing] = React.useState(false)
+      const revealTimer = React.useRef(null)
       const credential = credentialInfo(host, t)
       const testing = isPending(`test:${host.host}`)
       const inspecting = isPending(`inspect:${host.host}`)
       const hasSystem = Boolean(host.system || host.cpuCores || host.memoryGB || host.diskGB || host.latencyMs)
 
+      const hideRevealed = () => {
+        if (revealTimer.current) {
+          clearTimeout(revealTimer.current)
+          revealTimer.current = null
+        }
+        setRevealedPassword('')
+      }
+
+      React.useEffect(() => {
+        hideRevealed()
+        return () => {
+          if (revealTimer.current) clearTimeout(revealTimer.current)
+        }
+      }, [host.host])
+
+      async function toggleReveal() {
+        if (revealedPassword) {
+          hideRevealed()
+          return
+        }
+        if (revealing || host.passwordConfigured !== true) return
+        setRevealing(true)
+        try {
+          const value = await callAction('credential/reveal', { host: host.host })
+          const revealed = String(value?.password ?? '')
+          if (!revealed) return
+          setRevealedPassword(revealed)
+          if (revealTimer.current) clearTimeout(revealTimer.current)
+          revealTimer.current = setTimeout(() => {
+            revealTimer.current = null
+            setRevealedPassword('')
+          }, 30_000)
+        } catch (failure) {
+          notify(t('drawer.details.revealFailed', { message: errorMessage(failure) }), 'error')
+        } finally {
+          setRevealing(false)
+        }
+      }
+
+      async function copyRevealed() {
+        if (!revealedPassword) return
+        const copied = await copyTextToClipboard(revealedPassword)
+        notify(copied ? t('drawer.details.passwordCopied') : t('drawer.details.revealFailed', { message: t('terminal.copyFailed') }), copied ? 'success' : 'error')
+      }
+
       async function submitPassword() {
         if (!password || saving) return
         setSaving(true)
         const ok = await savePassword(host, password)
         setSaving(false)
-        if (ok) setPassword('')
+        if (ok) {
+          setPassword('')
+          hideRevealed()
+        }
       }
 
       return h(
@@ -4487,6 +4563,30 @@ window.__ModuleLoader__.load({
             h('h3', { className: 'ssh-sectionTitle' }, t('drawer.details.credentials')),
             h(Badge, { tone: credential.tone }, credential.label),
           ),
+          h(
+            'div',
+            { className: 'ssh-credentialReveal' },
+            h(
+              Button,
+              {
+                size: 'sm',
+                variant: 'ghost',
+                onClick: () => void toggleReveal(),
+                disabled: revealing || (!host.passwordConfigured && !revealedPassword),
+              },
+              revealing ? h(Spinner, { size: 12 }) : revealedPassword ? h(IconEyeOff, { size: 13 }) : h(IconEye, { size: 13 }),
+              revealedPassword ? t('drawer.details.hide') : t('drawer.details.reveal'),
+            ),
+            revealedPassword
+              ? h('code', { className: 'ssh-revealValue' }, revealedPassword)
+              : null,
+            revealedPassword
+              ? h(IconButton, { title: t('drawer.details.copyPassword'), onClick: () => void copyRevealed() }, h(IconCopy, { size: 14 }))
+              : null,
+          ),
+          revealedPassword
+            ? h('div', { className: 'ssh-sectionHint ssh-revealWarning' }, h(IconEye, { size: 12 }), h('span', null, t('drawer.details.revealWarning')))
+            : null,
           h(
             'div',
             { className: 'ssh-credentialRow' },
@@ -4508,7 +4608,7 @@ window.__ModuleLoader__.load({
             host.passwordConfigured
               ? h(
                   Button,
-                  { size: 'sm', variant: 'dangerGhost', onClick: () => void removePassword(host) },
+                  { size: 'sm', variant: 'dangerGhost', onClick: () => { hideRevealed(); void removePassword(host) } },
                   t('drawer.details.clearPassword'),
                 )
               : null,
@@ -5627,6 +5727,9 @@ body.ssh-col-resizing,body.ssh-col-resizing *{cursor:col-resize!important;user-s
 .ssh-kvValue{color:var(--ssh-text-2);min-width:0;word-break:break-word}
 .ssh-kvValue.mono{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:11px}
 .ssh-sectionHint{font-size:11.5px;color:var(--ssh-text-3);line-height:1.65}
+.ssh-credentialReveal{display:flex;align-items:center;gap:8px;flex-wrap:wrap;margin-bottom:2px}
+.ssh-revealValue{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:12px;padding:5px 8px;border:.5px solid var(--ssh-border-strong);border-radius:6px;background:var(--ssh-layer-3);color:var(--ssh-text);word-break:break-all;user-select:all}
+.ssh-revealWarning{display:flex;align-items:flex-start;gap:5px;color:var(--ssh-warn)}
 .ssh-tags{display:flex;gap:5px;flex-wrap:wrap}
 .ssh-detailsActions{display:flex;gap:8px;padding-top:2px}
 .ssh-credentialRow{display:flex;align-items:center;gap:6px}

package/index.js

@@ -167,6 +167,12 @@ export async function runAction(paths, action, params = {}) {
     }
     case 'credential/delete':
       return await removePassword(paths, requireString(params, 'host'))
+    case 'credential/reveal': {
+      const host = await findHost(paths, params.host)
+      const password = await getPassword(paths, host.host)
+      if (!password) throw new Error('No password is stored for this host')
+      return { password }
+    }
     case 'host/metadata': {
       const alias = requireString(params, 'host')
       await findHost(paths, alias)

package/lib/ssh-client.js

@@ -1,7 +1,16 @@
 import path from 'node:path'
-import { Client } from 'ssh2'
+import { createRequire } from 'node:module'
 import { verifyHostKey } from './known-hosts.js'
 
+// DSH Host bundles/loads plugins in a variety of Node ESM/CJS interop modes.
+// Resolve the CJS ssh2 export explicitly so `Client` is always a constructor.
+const require = createRequire(import.meta.url)
+const ssh2 = require('ssh2')
+const Client = ssh2.Client ?? ssh2.default?.Client
+if (typeof Client !== 'function') {
+  throw new Error('ssh2 is unavailable: Client export is missing from the installed ssh2 module')
+}
+
 const DEFAULT_TIMEOUT = 15_000
 const MAX_OUTPUT_BYTES = 1024 * 1024
 const MAX_FILE_BYTES = 10 * 1024 * 1024

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-ssh-manage",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "A DSH sidebar plugin for managing SSH host profiles with a real interactive PTY terminal.",
   "license": "MIT",
   "private": false,