dsh-ssh-vault 0.0.0-stage → 2.0.0

package/lib/vault.js

@@ -0,0 +1,397 @@
+/**
+ * 加密保险库（vault）—— 用 AES-256-GCM 保护 SSH 主机清单。
+ *
+ * 设计要点：
+ * - 主机地址、端口、账号、口令全部位于密文内部，磁盘上只留下 `vault.json` 的
+ *   `iv` / `tag` / `data` 三段 base64，不出现任何明文。
+ * - 数据密钥（DEK）为 32 字节随机数，其保护方式由 `keyProtection` 决定：
+ *     · `dpapi`（默认）—— 用 Windows DPAPI 以当前用户身份加密后写入 `key.json`，
+ *       文件被复制到其他机器或其他用户下都无法解开；
+ *     · `file` —— 直接写入 `key.json`，安全边界等同于文件系统权限；
+ *     · `passphrase` —— 由用户主口令经 scrypt 派生，磁盘上不保存密钥材料。
+ * - GCM 的附加认证数据（AAD）绑定格式版本，避免密文被降级重放。
+ *
+ * @module dsh-ssh-vault/vault
+ */
+
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto'
+import { spawn } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import path from 'node:path'
+import { t } from './i18n.js'
+import { assertSupportedPlatform } from './platform.js'
+
+/** 保险库格式版本；同时参与 AAD 计算。 */
+export const VAULT_VERSION = 1
+/** AES-256 密钥长度（字节）。 */
+const KEY_BYTES = 32
+/** GCM 推荐 IV 长度（字节）。 */
+const IV_BYTES = 12
+/** scrypt 盐长度（字节）。 */
+const SALT_BYTES = 16
+/** GCM 认证标签长度（字节）。 */
+const TAG_BYTES = 16
+/** 绑定到密文的附加认证数据。 */
+const AAD = Buffer.from('dsh-ssh-vault:v1', 'utf8')
+/** scrypt 参数：约 32 MiB 内存开销，兼顾强度与启动延迟。 */
+const SCRYPT = { N: 16384, r: 8, p: 1, maxmem: 64 * 1024 * 1024 }
+
+/** 默认保险库目录：优先使用 DSH_HOME，保持与 Harness 其他私有数据同处一地。 */
+export function defaultVaultDir() {
+  const home = process.env.DSH_HOME ?? path.join(homedir(), '.dsh')
+  return path.join(home, 'ssh-vault')
+}
+
+/**
+ * 用 Windows DPAPI 保护一段数据（仅当前用户可解密）。
+ * @param data - 待保护的原始字节。
+ * @returns base64 形式的受保护数据。
+ */
+async function dpapiProtect(data) {
+  return runPowerShell(
+    "Add-Type -AssemblyName System.Security;"
+    + "$in=[Console]::In.ReadToEnd().Trim();"
+    + "$b=[Convert]::FromBase64String($in);"
+    + "$p=[System.Security.Cryptography.ProtectedData]::Protect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);"
+    + "[Console]::Out.Write([Convert]::ToBase64String($p))",
+    data.toString('base64'),
+  )
+}
+
+/**
+ * 解除 DPAPI 保护。
+ * @param payload - base64 形式的受保护数据。
+ * @returns 原始字节。
+ */
+async function dpapiUnprotect(payload) {
+  const out = await runPowerShell(
+    "Add-Type -AssemblyName System.Security;"
+    + "$in=[Console]::In.ReadToEnd().Trim();"
+    + "$b=[Convert]::FromBase64String($in);"
+    + "$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);"
+    + "[Console]::Out.Write([Convert]::ToBase64String($p))",
+    payload,
+  )
+  return Buffer.from(out.trim(), 'base64')
+}
+
+/**
+ * 通过 stdin 传入数据并执行一段 Windows PowerShell，避免任何命令行转义问题。
+ * @param script - PowerShell 脚本，从 stdin 读取输入。
+ * @param input - 写入子进程 stdin 的文本。
+ * @returns 子进程的标准输出。
+ */
+function runPowerShell(script, input) {
+  return new Promise((resolve, reject) => {
+    const systemRoot = process.env.SystemRoot ?? 'C:\\Windows'
+    const exe = path.join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe')
+    const child = spawn(exe, ['-NoProfile', '-NonInteractive', '-Command', script], {
+      stdio: ['pipe', 'pipe', 'pipe'],
+      windowsHide: true,
+    })
+    let stdout = ''
+    let stderr = ''
+    const timer = setTimeout(() => {
+      child.kill()
+      reject(new Error(t('vault.dpapiTimeout')))
+    }, 15000)
+    child.stdout.setEncoding('utf8')
+    child.stderr.setEncoding('utf8')
+    child.stdout.on('data', (chunk) => { stdout += chunk })
+    child.stderr.on('data', (chunk) => { stderr += chunk })
+    child.on('error', (error) => {
+      clearTimeout(timer)
+      reject(error)
+    })
+    child.on('close', (code) => {
+      clearTimeout(timer)
+      if (code === 0 && stdout.trim().length > 0) resolve(stdout)
+      else reject(new Error(t('vault.dpapiFailed', { code, output: stderr.trim() || t('vault.noOutput') })))
+    })
+    child.stdin.end(input)
+  })
+}
+
+/**
+ * 对主机地址做脱敏，只保留网络前缀。
+ * @param host - 原始地址。
+ * @returns 形如 `192.168.*.*` 的掩码。
+ */
+export function maskHost(host) {
+  if (typeof host !== 'string' || host.length === 0) return '(unknown)'
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) {
+    const parts = host.split('.')
+    return `${parts[0]}.${parts[1]}.*.*`
+  }
+  const dot = host.indexOf('.')
+  if (dot > 0) return `${host.slice(0, dot)}.${'*'.repeat(Math.max(1, host.length - dot - 1))}`
+  return `${host.slice(0, 2)}${'*'.repeat(Math.max(1, host.length - 2))}`
+}
+
+/**
+ * 对账号名做脱敏，保留首字符。
+ * @param user - 原始账号。
+ * @returns 掩码后的账号。
+ */
+export function maskUser(user) {
+  if (typeof user !== 'string' || user.length === 0) return '(unknown)'
+  if (user.length <= 2) return `${user[0]}*`
+  return `${user[0]}${'*'.repeat(Math.min(user.length - 1, 4))}`
+}
+
+/**
+ * 加密保险库。所有主机记录都以密文形式保存在一个文件中，读取时才在内存解密。
+ */
+export class Vault {
+  #dir
+  #keyProtection
+  #masterPassword
+  #logger
+  #key = null
+  #mode = null
+  #hosts = null
+  #chain = Promise.resolve()
+
+  /**
+   * @param options - 保险库配置。
+   * @param options.dir - 保险库目录。
+   * @param options.keyProtection - 数据密钥的保护方式。
+   * @param options.masterPassword - `passphrase` 模式下的主口令。
+   * @param options.logger - 可选的日志接口。
+   */
+  constructor({ dir, keyProtection = 'dpapi', masterPassword, logger } = {}) {
+    // 运行期兜底：非 Windows 上继续构造会在 #loadKey 里退化成明文 key.json。
+    // 直接拒绝，比「能跑但密钥明文落盘」诚实。
+    assertSupportedPlatform()
+    this.#dir = dir ?? defaultVaultDir()
+    this.#keyProtection = keyProtection
+    this.#masterPassword = masterPassword
+    this.#logger = logger
+  }
+
+  /** 保险库目录（其中包含密文、密钥与 askpass 辅助脚本）。 */
+  get dir() {
+    return this.#dir
+  }
+
+  /** 当前数据密钥的保护方式，初始化后可用。 */
+  get keyMode() {
+    return this.#mode
+  }
+
+  #file(name) {
+    return path.join(this.#dir, name)
+  }
+
+  async #ensureDir() {
+    await mkdir(this.#dir, { recursive: true })
+  }
+
+  /** 载入或首次创建数据密钥。 */
+  async #loadKey() {
+    if (this.#key !== null) return
+    await this.#ensureDir()
+    const keyPath = this.#file('key.json')
+    if (existsSync(keyPath)) {
+      const stored = JSON.parse(await readFile(keyPath, 'utf8'))
+      if (stored.mode === 'passphrase') {
+        if (typeof this.#masterPassword !== 'string' || this.#masterPassword.length === 0) {
+          throw new Error(t('vault.masterPasswordMissing'))
+        }
+        this.#key = scryptSync(this.#masterPassword, Buffer.from(stored.salt, 'base64'), KEY_BYTES, SCRYPT)
+      } else if (stored.mode === 'dpapi') {
+        try {
+          this.#key = await dpapiUnprotect(stored.payload)
+        } catch (error) {
+          throw new Error(t('vault.dpapiUnwrapFailed', {
+            message: error instanceof Error ? error.message : String(error),
+          }))
+        }
+      } else {
+        this.#key = Buffer.from(stored.payload, 'base64')
+      }
+      this.#mode = stored.mode
+      return
+    }
+    // 首次运行：生成数据密钥并按既定方式保护。
+    const key = randomBytes(KEY_BYTES)
+    let record
+    if (this.#keyProtection === 'passphrase') {
+      if (typeof this.#masterPassword !== 'string' || this.#masterPassword.length === 0) {
+        throw new Error(t('vault.masterPasswordRequired'))
+      }
+      const salt = randomBytes(SALT_BYTES)
+      record = { version: VAULT_VERSION, mode: 'passphrase', salt: salt.toString('base64') }
+      await writeFile(keyPath, `${JSON.stringify(record, null, 2)}\n`, 'utf8')
+      this.#key = scryptSync(this.#masterPassword, salt, KEY_BYTES, SCRYPT)
+      this.#mode = 'passphrase'
+      return
+    }
+    if (this.#keyProtection === 'dpapi') {
+      try {
+        const payload = await dpapiProtect(key)
+        record = { version: VAULT_VERSION, mode: 'dpapi', payload }
+        await writeFile(keyPath, `${JSON.stringify(record, null, 2)}\n`, 'utf8')
+        this.#key = key
+        this.#mode = 'dpapi'
+        return
+      } catch (error) {
+        // DPAPI 不可用时降级为明文密钥文件，并明确告知使用者当前安全边界。
+        this.#logger?.warn?.(t('vault.dpapiUnavailable', {
+          message: error instanceof Error ? error.message : String(error),
+        }))
+      }
+    }
+    record = { version: VAULT_VERSION, mode: 'file', payload: key.toString('base64') }
+    await writeFile(keyPath, `${JSON.stringify(record, null, 2)}\n`, 'utf8')
+    this.#key = key
+    this.#mode = 'file'
+  }
+
+  /** 读取并解密主机清单。 */
+  async #loadHosts() {
+    if (this.#hosts !== null) return this.#hosts
+    await this.#loadKey()
+    const vaultPath = this.#file('vault.json')
+    if (!existsSync(vaultPath)) {
+      this.#hosts = { version: VAULT_VERSION, hosts: {} }
+      return this.#hosts
+    }
+    const envelope = JSON.parse(await readFile(vaultPath, 'utf8'))
+    const decipher = createDecipheriv('aes-256-gcm', this.#key, Buffer.from(envelope.iv, 'base64'))
+    decipher.setAAD(AAD)
+    decipher.setAuthTag(Buffer.from(envelope.tag, 'base64'))
+    let plain
+    try {
+      plain = Buffer.concat([decipher.update(Buffer.from(envelope.data, 'base64')), decipher.final()])
+    } catch {
+      throw new Error(t('vault.decryptFailed'))
+    }
+    const parsed = JSON.parse(plain.toString('utf8'))
+    this.#hosts = { version: VAULT_VERSION, hosts: parsed.hosts ?? {} }
+    return this.#hosts
+  }
+
+  /** 原子地把主机清单加密落盘。 */
+  async #storeHosts() {
+    await this.#loadKey()
+    const iv = randomBytes(IV_BYTES)
+    const cipher = createCipheriv('aes-256-gcm', this.#key, iv)
+    cipher.setAAD(AAD)
+    const plain = Buffer.from(JSON.stringify(this.#hosts), 'utf8')
+    const data = Buffer.concat([cipher.update(plain), cipher.final()])
+    const tag = cipher.getAuthTag()
+    const envelope = {
+      version: VAULT_VERSION,
+      alg: 'aes-256-gcm',
+      iv: iv.toString('base64'),
+      tag: tag.toString('base64'),
+      data: data.toString('base64'),
+    }
+    const target = this.#file('vault.json')
+    const temp = this.#file(`vault.json.${process.pid}.tmp`)
+    await writeFile(temp, `${JSON.stringify(envelope)}\n`, 'utf8')
+    await rename(temp, target)
+  }
+
+  /**
+   * 在保险库锁内执行一次读改写，避免并发工具调用互相覆盖。
+   * @param fn - 收到当前主机表并返回结果的操作。
+   * @returns 操作结果。
+   */
+  #locked(fn) {
+    const run = this.#chain.then(fn, fn)
+    this.#chain = run.then(() => undefined, () => undefined)
+    return run
+  }
+
+  /**
+   * 列出全部主机记录（含明文，仅供插件内部使用，调用方负责脱敏）。
+   * @returns 主机记录数组。
+   */
+  async list() {
+    return this.#locked(async () => {
+      const data = await this.#loadHosts()
+      return Object.values(data.hosts).sort((a, b) => a.alias.localeCompare(b.alias))
+    })
+  }
+
+  /**
+   * 读取一台主机。
+   * @param alias - 主机别名。
+   * @returns 主机记录，不存在时为 `undefined`。
+   */
+  async get(alias) {
+    return this.#locked(async () => {
+      const data = await this.#loadHosts()
+      return data.hosts[alias]
+    })
+  }
+
+  /**
+   * 新增或整体替换一台主机。
+   * @param record - 完整的主机记录，至少包含 `alias`。
+   * @returns 写入后的记录。
+   */
+  async put(record) {
+    return this.#locked(async () => {
+      const data = await this.#loadHosts()
+      const now = new Date().toISOString()
+      const previous = data.hosts[record.alias]
+      const next = {
+        ...record,
+        createdAt: previous?.createdAt ?? now,
+        updatedAt: now,
+      }
+      data.hosts[record.alias] = next
+      await this.#storeHosts()
+      return next
+    })
+  }
+
+  /**
+   * 删除一台主机。
+   * @param alias - 主机别名。
+   * @returns 是否确实删除了记录。
+   */
+  async remove(alias) {
+    return this.#locked(async () => {
+      const data = await this.#loadHosts()
+      if (data.hosts[alias] === undefined) return false
+      delete data.hosts[alias]
+      await this.#storeHosts()
+      return true
+    })
+  }
+
+  /**
+   * 就地更新一台主机的部分字段（口令等敏感字段始终整体替换）。
+   * @param alias - 主机别名。
+   * @param patch - 需要覆盖的字段。
+   * @returns 更新后的记录，主机不存在时为 `undefined`。
+   */
+  async patch(alias, patch) {
+    return this.#locked(async () => {
+      const data = await this.#loadHosts()
+      const previous = data.hosts[alias]
+      if (previous === undefined) return undefined
+      const next = { ...previous, ...patch, alias, updatedAt: new Date().toISOString() }
+      data.hosts[alias] = next
+      await this.#storeHosts()
+      return next
+    })
+  }
+
+  /** 保险库中 `known_hosts` 文件的路径（OpenSSH 主机密钥记录）。 */
+  get knownHostsPath() {
+    return this.#file('known_hosts')
+  }
+
+  /** 等待目录就绪，供需要写入辅助脚本的调用方使用。 */
+  async ensureDir() {
+    await this.#ensureDir()
+    return this.#dir
+  }
+}

package/locale/en.json

@@ -0,0 +1,4 @@
+{
+  "title": "SSH Vault (Windows)",
+  "description": "Windows-only: connect to remote hosts over SSH with the host address, port, account, and password kept in an encrypted vault."
+}

package/locale/zh.json

@@ -0,0 +1,4 @@
+{
+  "title": "SSH 保险库（Windows）",
+  "description": "仅支持 Windows：在加密保险库中保存主机地址、端口、账号与口令，让智能体通过别名安全地连接远端主机。"
+}

package/package.json

@@ -1,6 +1,77 @@
 {
   "name": "dsh-ssh-vault",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "2.0.0",
+  "type": "module",
+  "description": "Encrypted SSH host vault and model-facing SSH tools for the DeepSeek Harness — Windows only",
+  "os": [
+    "win32"
+  ],
+  "license": "MIT",
+  "author": "scientificmaniac",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/scientificmaniac/dsh-ssh-vault.git"
+  },
+  "bugs": {
+    "url": "https://github.com/scientificmaniac/dsh-ssh-vault/issues"
+  },
+  "homepage": "https://github.com/scientificmaniac/dsh-ssh-vault#readme",
+  "keywords": [
+    "dsh",
+    "deepseek-harness",
+    "cordis-plugin",
+    "ssh",
+    "vault",
+    "encryption"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "test": "node test/platform.mjs && node test/diagnose.mjs && node test/unit.mjs && node test/background.mjs && node test/vault-api.mjs && node test/i18n.mjs && node test/host-apply.mjs && node test/client-smoke.mjs",
+    "test:live": "node test/live.mjs",
+    "test:self": "node test/selftest.mjs"
+  },
+  "exports": {
+    ".": "./index.js",
+    "./client": "./client.js",
+    "./package.json": "./package.json",
+    "./locale/*.json": "./locale/*.json"
+  },
+  "files": [
+    "index.js",
+    "client.js",
+    "lib",
+    "scripts",
+    "locale",
+    "cordis.patch.yml",
+    "icon.svg",
+    "assets",
+    "README.md",
+    "README.zh-CN.md",
+    "CHANGELOG.md",
+    "CHANGELOG.zh-CN.md",
+    "CONTRIBUTING.md",
+    "CONTRIBUTING.zh-CN.md",
+    "SECURITY.md",
+    "SECURITY.zh-CN.md",
+    "LICENSE"
+  ],
+  "icon": "./icon.svg",
+  "meta": {
+    "title": "SSH Vault (Windows)",
+    "description": "Connect to remote hosts over SSH from Windows with the host address, port, account, and password kept in an encrypted vault."
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true,
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-settings"
+      ]
+    }
+  }
+}

package/scripts/dhcp-reserve-kali.ps1

@@ -0,0 +1,81 @@
+#Requires -RunAsAdministrator
+<#
+.SYNOPSIS
+    给 Kali 虚拟机做 VMware DHCP 地址保留（固定租约）。
+
+.DESCRIPTION
+    把 kali 的 MAC 地址钉死到 192.0.2.150，这样 VMware 的 DHCP 每次都会把同一个地址
+    发给它，不会因为 DHCP 池重新分配而漂移。
+
+    脚本可重复运行：已经存在同名 host 块时会更新而不是重复追加。
+
+.PARAMETER Mac
+    Kali eth0 的 MAC 地址。默认 00:0c:29:00:00:01（示例值，请按实际填写）。
+
+.PARAMETER Address
+    要保留的地址。默认 192.0.2.150。
+
+.PARAMETER HostName
+    配置文件里的条目名，仅作标识，不影响行为。
+
+.NOTES
+    VMware 在增删虚拟网卡时会重写 vmnetdhcp.conf，那时需要重新运行本脚本。
+#>
+[CmdletBinding()]
+param(
+    [string]$Mac = '00:0c:29:00:00:01',
+    [string]$Address = '192.0.2.150',
+    [string]$HostName = 'kali'
+)
+
+$ErrorActionPreference = 'Stop'
+
+$conf = Join-Path $env:ProgramData 'VMware\vmnetdhcp.conf'
+if (-not (Test-Path $conf)) {
+    throw "找不到 VMware DHCP 配置：$conf"
+}
+
+# 1. 先备份。保留最近几份即可，避免堆满目录。
+$stamp = Get-Date -Format 'yyyyMMdd-HHmmss'
+$backup = "$conf.bak-$stamp"
+Copy-Item -LiteralPath $conf -Destination $backup -Force
+Write-Host "已备份配置到 $backup" -ForegroundColor Green
+
+$text = Get-Content -LiteralPath $conf -Raw
+$blockPattern = "(?ms)^[ \t]*host[ \t]+$([regex]::Escape($HostName))[ \t]*\{.*?^[ \t]*\}[ \t]*\r?\n?"
+
+# 2. 已经有了就替换，保证幂等。
+$newBlock = @"
+host $HostName {
+    hardware ethernet $Mac;
+    fixed-address $Address;
+}
+"@
+
+if ($text -match $blockPattern) {
+    $text = [regex]::Replace($text, $blockPattern, ($newBlock + "`r`n"), 1)
+    Write-Host "已更新既有的 host $HostName 条目" -ForegroundColor Yellow
+} else {
+    if (-not $text.EndsWith("`n")) { $text += "`r`n" }
+    $text += "`r`n# DHCP 保留：$HostName（$Mac -> $Address），由 dhcp-reserve-kali.ps1 添加`r`n"
+    $text += $newBlock
+    Write-Host "已追加 host $HostName 条目" -ForegroundColor Yellow
+}
+
+Set-Content -LiteralPath $conf -Value $text -NoNewline -Encoding utf8
+
+# 3. 重启 DHCP 服务让新配置生效。
+$service = Get-Service -Name 'VMnetDHCP' -ErrorAction SilentlyContinue
+if ($null -eq $service) {
+    Write-Warning '没找到 VMnetDHCP 服务，配置已写入但需要手动重启 VMware DHCP。'
+} else {
+    Restart-Service -Name 'VMnetDHCP' -Force
+    Write-Host '已重启 VMnetDHCP 服务' -ForegroundColor Green
+}
+
+Write-Host ''
+Write-Host '完成。接下来在 Kali 里释放并重新获取租约：' -ForegroundColor Cyan
+Write-Host '    sudo dhclient -r eth0 && sudo dhclient eth0'
+Write-Host '    ip -4 addr show eth0'
+Write-Host ''
+Write-Host "预期拿到 $Address。" -ForegroundColor Cyan

package/scripts/make-market-icon.py

@@ -0,0 +1,63 @@
+"""生成 dsh-market 用的位图图标（180x180 PNG）。
+
+市场卡片约 96px 显示，所以图形必须是大色块、少细节。主题是「加密的 SSH 通道」：
+深色圆角底 + 终端提示符 + 一把锁，用几何图形画，不依赖任何字体文件。
+"""
+from PIL import Image, ImageDraw
+
+SIZE = 180
+SCALE = 2  # 先画 2 倍再缩小，边缘更干净
+S = SIZE * SCALE
+
+
+def rounded_rect(draw, box, radius, fill):
+    draw.rounded_rectangle(box, radius=radius, fill=fill)
+
+
+img = Image.new("RGBA", (S, S), (0, 0, 0, 0))
+d = ImageDraw.Draw(img)
+
+# —— 底板：深色圆角方块 ——
+rounded_rect(d, [0, 0, S - 1, S - 1], radius=40 * SCALE, fill=(22, 24, 30, 255))
+
+# —— 终端窗口：比底板略小的圆角矩形，稍亮一档 ——
+pad = 26 * SCALE
+win = [pad, pad + 6 * SCALE, S - pad, S - pad]
+rounded_rect(d, win, radius=14 * SCALE, fill=(32, 36, 46, 255))
+
+# 窗口标题栏三个点
+dot_r = 4 * SCALE
+dot_y = win[1] + 12 * SCALE
+for i, color in enumerate([(255, 95, 86), (255, 189, 46), (39, 201, 63)]):
+    cx = win[0] + (14 + i * 14) * SCALE
+    d.ellipse([cx - dot_r, dot_y - dot_r, cx + dot_r, dot_y + dot_r], fill=color)
+
+# —— 提示符 ">" ——
+accent = (86, 182, 255)
+cx, cy = win[0] + 26 * SCALE, win[1] + 44 * SCALE
+d.line([cx, cy, cx + 13 * SCALE, cy + 13 * SCALE], fill=accent, width=6 * SCALE)
+d.line([cx + 13 * SCALE, cy + 13 * SCALE, cx, cy + 26 * SCALE], fill=accent, width=6 * SCALE)
+# 光标下划线
+d.line([cx + 19 * SCALE, cy + 26 * SCALE, cx + 38 * SCALE, cy + 26 * SCALE],
+       fill=accent, width=6 * SCALE)
+
+# —— 锁：压在终端右下角，表示"加密" ——
+lw, lh = 40 * SCALE, 34 * SCALE
+lx, ly = S - pad - lw + 14 * SCALE, win[3] - lh + 10 * SCALE
+shackle_w = 22 * SCALE
+shackle_top = ly - 16 * SCALE
+shackle_x = lx + (lw - shackle_w) // 2
+d.arc([shackle_x, shackle_top, shackle_x + shackle_w, ly + 8 * SCALE],
+      start=180, end=360, fill=(255, 199, 89), width=6 * SCALE)
+
+lock_fill = (255, 199, 89)
+rounded_rect(d, [lx, ly, lx + lw, ly + lh], radius=6 * SCALE, fill=lock_fill)
+# 锁孔：圆 + 竖槽
+k_cx, k_cy = lx + lw // 2, ly + lh // 2 - 2 * SCALE
+d.ellipse([k_cx - 4 * SCALE, k_cy - 4 * SCALE, k_cx + 4 * SCALE, k_cy + 4 * SCALE],
+          fill=(32, 36, 46, 255))
+d.line([k_cx, k_cy, k_cx, k_cy + 9 * SCALE], fill=(32, 36, 46, 255), width=4 * SCALE)
+
+img = img.resize((SIZE, SIZE), Image.LANCZOS)
+img.save("assets/icon-180.png", "PNG")
+print("wrote assets/icon-180.png", img.size)