dsh-ssh-vault 0.0.0-stage → 2.0.0

package/CHANGELOG.md

@@ -0,0 +1,404 @@
+# Changelog
+
+**English** | [简体中文](CHANGELOG.zh-CN.md)
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project adheres to
+[Semantic Versioning](https://semver.org/).
+
+
+
+## [2.0.0] - 2026-10-25
+
+### Removed
+
+- **Linux and macOS support is gone — by declaration and by code.** The vault data key relies on
+  Windows DPAPI and the `SSH_ASKPASS` helper is a Windows `.cmd`; off Windows the previous code
+  silently wrote the data key to `key.json` as plaintext. That is a security downgrade, not support.
+  The package now declares `os: ["win32"]`, so installation is rejected elsewhere, and both
+  `apply()` and the `Vault` constructor refuse to run.
+
+### Changed
+
+- **Everything says Windows only**: `package.json` description and `meta`, `locale/{en,zh}.json`,
+  the marketplace entry, and both READMEs (overview, requirements, limitations, FAQ).
+- The new `lib/platform.js` owns the supported-platform list, friendly platform names, and the
+  refusal message; `test/platform.mjs` pins the declaration to `package.json`.
+- `test/host-apply.mjs` exercises the refusal path when the suite runs on a non-Windows host.
+- Regression cover for the settings-route fence: the settings-API suite checks 401/403 bodies and
+  no-store headers, that rejection happens **before** method and body handling, that a rejected
+  request never writes to the vault, and that the integration wiring passes the host `connection`
+  service through (`test/vault-api.mjs`, `test/host-apply.mjs`). 321 tests total.
+- The marketplace entry points at the v2.0.0 tarball.
+
+### Fixed
+
+- **The README promised Linux/macOS while the implementation could only degrade there.** The
+  documentation/code mismatch is closed in the honest direction: no plaintext fallback exists on
+  any platform, and unsupported platforms fail loudly at install and at load.
+- **The settings routes now cross the Host Connection trust fence.** Every `/ssh-vault/*` request
+  first asks `ctx.connection.requestRejection(req)` — the same Host/Origin check and browser-
+  session authentication used by `/api` — before it looks at the method, the body or the vault.
+  Rejected requests get `401`/`403` and cannot read host data, trigger a probe, or even learn
+  whether an action exists. A vault-and-credential endpoint should not rely solely on the
+  surrounding server, as the review pointed out.
+- **Re-uploading a private key for an existing host no longer fails on Windows.** The previous
+  upload's copy is hardened with `icacls` into a user-read-only ACL, which also denies the write
+  needed to overwrite it. The save path now resets the file's ACL (`icacls /reset` on Windows,
+  chmod 0600 elsewhere) before rewriting, so the second upload lands.
+
+## [1.15.0] - 2026-10-24
+
+### Added
+
+- **The plugin follows the DSH interface language.** With DSH switched to English, the
+  Settings page, the `/` menu entries, the in-conversation SSH cards, `/hosts` results,
+  transport diagnostics and Settings-API errors are English too; switching back changes them
+  immediately, with no page reload or restart.
+  - The Client half registers an `ssh-vault` dictionary with the host's locale service, so
+    slot-rendered copy tracks the active locale.
+  - The Host half reads `locale.preference` from the host settings document (the value the
+    language picker persists) and follows `settings/document-updated`; `Accept-Language` is
+    used only when no explicit preference exists.
+  - Model-facing definitions — tool names, descriptions and parameter schemas — stay in
+    English, because they are part of the model interface rather than the UI.
+- `test/i18n.mjs`, `test/host-apply.mjs` and `test/client-smoke.mjs` cover dictionary
+  completeness (placeholder parity, no untranslated English entries), the host activation and
+  locale-switch path, and the client slot/dictionary wiring.
+
+### Changed
+
+- Host-side copy moved into `lib/i18n.js` plus `lib/locales/ssh.js`; the Chinese values are
+  byte-for-byte the previous strings, so existing behaviour and tests are unchanged.
+- **`/hosts` is re-registered only when the interface language changes.** The command's
+  `description` and `input.hint` are static strings captured at registration; timers never
+  touch the definition (that was the historical cause of a composer losing its command
+  context mid-typing), but a locale switch is a deliberate Settings action with no command
+  being typed, so replacing the definition there is safe.
+- The `/hosts` hint now says that pressing Enter again lists the hosts, which makes the
+  two-step menu-pick behaviour explicit.
+
+### Fixed
+
+- **A bare `/hosts` no longer appears to hang.** On a cold health cache the command used to
+  probe every host sequentially with the 15s settings timeout, so five unreachable hosts meant
+  up to 75 seconds of no visible result — and the result then landed above a message the user
+  had sent in the meantime. Probes now run in parallel with a 4s budget for the list form.
+- **`/hosts` results are visible before the first message.** DSH classifies a transcript
+  containing only command rows as an inactive view, so in a brand-new conversation the command
+  ran and logged its result but nothing rendered; the cards only appeared (above the new
+  message) once the first prompt was sent. The plugin now mirrors those command nodes —
+  including the running state — in the composer dock while the session is still blank, and
+  steps aside as soon as the transcript has real content.
+
+## [1.14.2] - 2026-10-19
+
+### Fixed
+
+- **PowerShell error output is plain text again.** -OutputFormat Text governs stdout only:
+  powershell.exe still serialized the error stream as CLIXML onto stderr and echoed the
+  entire script back as error context, burying real messages under XML. The script now merges
+  the error stream into stdout itself and flattens each ErrorRecord to a single
+  [error] … line, with Out-String -Stream keeping object and table output intact.
+
+## [1.14.1] - 2026-10-19
+
+### Fixed
+
+- **PowerShell no longer floods stderr with CLIXML.** Once the script moved to
+  `-EncodedCommand`, PowerShell serialized its progress stream into CLIXML and wrote that to
+  stderr, burying real errors under a wall of XML. The script now sets
+  `\Continue = 'SilentlyContinue'` and the invocation passes -OutputFormat Text.
+
+## [1.14.0] - 2026-10-19
+
+### Fixed
+
+- **Multi-line PowerShell no longer fails silently.** `-Command -` reads stdin line by line,
+  so a here-string (`@'…'@`) or a `foreach (…) {…}` block was split apart mid-parse. The
+  resulting syntax errors did not come back as a non-zero exit, so the caller was told the
+  command had run when it had not. PowerShell targets now receive the whole script through
+  `-EncodedCommand` (Base64 UTF-16LE) and are parsed in one pass; `[Console]::OutputEncoding`
+  is fixed at the head of the script so non-ASCII output stays readable.
+- **`ssh_transfer` no longer misattributes a broken connection.** The path hint fired even
+  when the transfer died on a connection reset, sending diagnosis toward the wrong layer.
+- **Account lock is now a named cause.** Windows OpenSSH disconnects a locked account outright
+  instead of returning `Permission denied`, so "port open, banner fine, still cannot connect"
+  previously pointed only at firewalls. It now names account lock as a candidate and says how
+  to check it (`net user` on Windows, `faillock` on Linux).
+
+### Added
+
+- **Connections to the same host are serialised.** Every call opens a fresh SSH connection; a
+  burst of them, especially concurrent `scp`, trips sshd's connection limits and accumulates
+  failed-auth counters toward an account lock. Background jobs stay outside the queue so a
+  long task cannot block that host for everything else.
+- `ssh_transfer` creates the local parent directory before a download.
+- A warning before commands that change account state or lockout policy, since locking the
+  management account also kills key-based login.
+
+### Changed
+
+- `shellArgv` takes the script and returns `-EncodedCommand` for PowerShell; POSIX and `cmd`
+  targets still receive their script over stdin.
+
+## [1.13.0] - 2026-10-17
+
+### Added
+
+- **`/hosts` distinguishes commands from prose.** Text after the semicolon that reads as
+  natural language is no longer executed as shell; the command stops and hands the sentence
+  back to the conversation, because command output never reaches the model.
+- `scripts/dhcp-reserve-kali.ps1`, an idempotent helper that pins a VM's MAC to a fixed
+  address in VMware's DHCP configuration.
+
+### Changed
+
+- **Documentation rewritten.** Both READMEs are now reference documents rather than a
+  narrative of the build-out, with badges, a Mermaid data-flow diagram, and sections for
+  architecture, extension points, lifecycle, limits and the security boundary.
+- **English is the primary language for every top-level document.** `CHANGELOG`,
+  `CONTRIBUTING` and `SECURITY` used to carry Chinese in the unsuffixed `.md` with English in
+  an `.en.md`; all three now match the README convention — bare name is English, the
+  translation carries the `.zh-CN` suffix.
+
+## [1.12.3] - 2026-10-17
+
+### Fixed
+
+- The section label in a `/hosts` card is centred, instead of lining up with a failure badge
+  on the right.
+
+## [1.12.2] - 2026-10-17
+
+### Fixed
+
+- **Each `/hosts` card lights its own status.** Both cards previously read one flag derived
+  from the whole command, so a reachable host with a failing command turned the connectivity
+  card red as well.
+
+## [1.12.1] - 2026-10-17
+
+### Added
+
+- `/hosts` output splits into two cards: reachability and command execution.
+
+## [1.12.0] - 2026-10-17
+
+### Added
+
+- **The text after the semicolon is executed on every reachable host.** `/hosts kali; apt
+  update` probes kali and then runs the command there. A command starting with `sudo` primes
+  the sudo cache from the vault first, so a non-interactive session does not wait for a
+  password until the timeout.
+
+## [1.11.1] - 2026-10-17
+
+### Fixed
+
+- The full-width comma `，` separates host aliases, alongside the ASCII one.
+
+## [1.11.0] - 2026-10-17
+
+### Added
+
+- **A connection can be renamed from the settings form.** Credentials, private-key path,
+  note and tags move with it. The host writes the new record before removing the old one, so
+  a failure in between leaves a duplicate rather than a lost configuration.
+
+## [1.10.1] - 2026-10-17
+
+### Changed
+
+- The `/hosts` output is plain text again, and a single dot in the card header carries the
+  outcome. Emoji circles duplicated what that dot already said, and read worse.
+
+## [1.10.0] - 2026-10-17
+
+### Added
+
+- **`/hosts` has its own terminal row**, taken from the `conversation.chat.commandview` slot.
+  The generic command card folded its output into an unstyled `<pre>` and hid it behind a
+  disclosure.
+- The full-width semicolon `；` ends the argument list, alongside the ASCII one.
+
+## [1.9.6] - 2026-10-17
+
+### Changed
+
+- `/hosts` output uses coloured dots rather than check, cross and question marks, which read
+  as verdicts instead of status.
+
+## [1.9.5] - 2026-10-17
+
+### Fixed
+
+- **Arguments are parsed as comma-separated aliases ending at a semicolon.** Splitting on
+  whitespace turned every word after the alias into a host lookup, so a trailing note
+  produced several failed lookups and repeated the same error.
+- Unknown aliases are resolved against the vault first and reported once, instead of being
+  folded in with real connection failures.
+
+## [1.9.4] - 2026-10-17
+
+### Changed
+
+- **The `/ssh` command is now `/hosts`.** The composer is a Lexical editor whose plain text
+  nodes are subject to browser spellcheck; `ssh` is not a dictionary word and got underlined,
+  while `hosts` is.
+
+## [1.9.3] - 2026-10-17
+
+### Fixed
+
+- **The command is registered once and never re-registered.** Re-registering disposes the
+  current definition, and the composer holds it while the user types arguments — swapping it
+  out broke input (backspace stopped working) and needed a UI restart.
+
+## [1.9.2] - 2026-10-17
+
+### Fixed
+
+- **The health dot follows every test.** The card's "Test connection" button updated only the
+  detail area and never the dot, so a successful test left it red; editing a connection did
+  not re-test it either, because the automatic sweep keyed off the alias list, which a change
+  of address does not alter.
+
+## [1.9.1] - 2026-10-17
+
+### Fixed
+
+- **The settings probe times out at 15 seconds, not 8.** A probe really connects over SSH, and
+  a host that is up without a listening `sshd` burns the whole window in TCP connect.
+- A timeout is reported as a timeout, naming the two likely causes (port closed, address
+  changed) instead of surfacing as a bare `(no output)` that looks like a plugin failure.
+
+## [1.9.0] - 2026-10-17
+
+### Added
+
+- The `/ssh` input hint lists the hosts that answered the last health check, and running it
+  with no arguments prints the hosts split into online and offline.
+
+## [1.8.0] - 2026-10-17
+
+### Added
+
+- **Each connection is probed when its card appears**, and the card carries a status dot:
+  grey before the check, yellow while it runs, green on success, red on failure. Checks run
+  serially so a batch of concurrent SSH connections cannot pile onto one unreachable host.
+
+## [1.7.1] - 2026-10-17
+
+### Fixed
+
+- The terminal header shows the exit status. A non-zero remote exit is a normal return for
+  these tools rather than an error, so a failed command looked identical to a successful one.
+
+## [1.7.0] - 2026-10-17
+
+### Added
+
+- **SSH tool calls render as a scrollable terminal in the conversation**, registered on
+  `tool.call.toolview` for `ssh_run`, `ssh_probe` and `ssh_transfer`. None of those key names
+  were occupied, so nothing shipped is shadowed.
+
+## [1.6.9] - 2026-10-17
+
+### Fixed
+
+- Tool output falls back to a `console`-fenced code block. `presentCall` / `presentResult` —
+  the documented terminal-card hooks — turned out to have no consumer anywhere in the
+  installed tree, so they cannot be the sole presentation path.
+
+## [1.6.8] - 2026-10-17
+
+### Added
+
+- `presentCall` / `presentResult` hooks on the three terminal-style tools. See 1.6.9 and
+  1.7.0: these hooks have no consumer in this DSH version, and real presentation arrived
+  through a slot.
+
+## [1.6.7] - 2026-10-17
+
+### Added
+
+- **Uploaded private keys are restricted and pre-checked.** The browser inspects the chosen
+  file before uploading anything and rejects a public key, a PuTTY `.ppk`, a file without a
+  PEM header, or an implausibly large file. The host requires an actual PEM header instead of
+  merely containing the words `PRIVATE KEY`.
+- The key form gained a passphrase field, for a key that is itself encrypted.
+
+## [1.6.6] - 2026-10-17
+
+### Fixed
+
+- The result of "Open in file manager" is reported beside the button. The failure message used
+  to appear only at the top of the page, so pressing the button looked like it did nothing.
+
+## [1.6.5] - 2026-10-17
+
+### Fixed
+
+- The edit form expands under its own card instead of at the top of the page, which used to
+  push the card being edited out of view.
+
+## [1.6.4] - 2026-10-17
+
+### Added
+
+- The vault path sits on its own line with an "Open in file manager" button, backed by an
+  `openVault` route that accepts no path argument at all — it can only open the plugin's own
+  vault directory.
+
+## [1.6.3] - 2026-10-17
+
+### Fixed
+
+- The vault metadata line no longer wraps at its full-width separators.
+- The plugin version is read per request rather than cached, so a client-only change cannot
+  leave the displayed version one release behind.
+
+## [1.6.2] - 2026-10-17
+
+### Fixed
+
+- **The settings route is registered at `/ssh-vault` without a trailing slash.**
+  `kind: 'prefix'` matches the registered path or that path plus a slash, so registering
+  `/ssh-vault/` meant `/ssh-vault/list` matched neither and every request fell through to the
+  fallback handler.
+
+## [1.6.1] - 2026-10-17
+
+### Fixed
+
+- Secondary buttons use the host's own button tokens. The earlier version guessed at token
+  semantics and produced light-on-light buttons in the dark theme.
+
+## [1.6.0] - 2026-10-17
+
+### Added
+
+- **Connection management in Settings**: list, add, edit and delete hosts, with password or
+  private-key authentication and a one-click connection test. A password entered there travels
+  in a same-origin POST body and never enters the session log.
+- **The `/ssh` command**: list hosts, or probe one or several by alias.
+- `test/vault-api.mjs`, pinning the settings API's validation, masking and response shape.
+
+## [1.5.0] - 2026-10-16
+
+### Added
+
+- Encrypted SSH host vault: AES-256-GCM with the data key protected by DPAPI on Windows or
+  derived from a master passphrase via scrypt elsewhere.
+- Model-facing tools `ssh_hosts`, `ssh_run`, `ssh_transfer` and `ssh_probe`, all addressing
+  hosts by alias only.
+- Background job support for commands that outlive one tool call.
+- A private `known_hosts` inside the vault directory with `HashKnownHosts` enabled, so the
+  user's `~/.ssh` is never touched.
+- Offline password entry through `scripts/set-secret.mjs`.
+
+### Security
+
+- A password reaches the local ssh client only through `SSH_ASKPASS`, and a remote `sudo` is
+  primed over stdin; neither appears on a command line or in a process list.