dsh-vpn 0.1.10 → 0.1.11

package/README.md

@@ -38,12 +38,13 @@ dsh plugin --profile web add dsh-vpn
 3. 在「节点二维码」里点「刷新二维码」，用手机或电脑上的客户端扫码导入。
 4. 服务器防火墙的端口由插件自动放行，不用手动操作；安装完成后提示框会列出放行了哪些端口。
 
-**密钥登录**：服务器只允许密钥登录（或者你不想保存密码）时，把「登录方式」选成「密钥」。插件会生成一把专用钥匙（纯 JS 生成，不需要本机的 ssh-keygen），页面上显示它的公钥，任选一种办法放到服务器上：
+**密钥登录**：服务器只允许密钥登录时，把「登录方式」选成「密钥」。插件按这个顺序尝试登录，哪把被服务器认可就用哪把：
 
-- A. 粘到服务商后台的「SSH 密钥」里，重装系统时勾选它（新机器推荐）；
-- B. 已经能登录服务器的（网页控制台或别的终端），复制页面上的一行命令粘贴执行。
+1. 你自己粘贴的私钥（展开「改用我自己已有的私钥」，支持带密码短语的私钥）；
+2. 本机已有的钥匙：`~/.ssh/config`（含 `config.d`）里为这台服务器配置的 `IdentityFile`，dsh-vps-manager 的 `~/.ssh/dsh_vps_ed25519`，以及 `~/.ssh/id_ed25519`、`id_ecdsa`、`id_rsa`；
+3. 插件的专用钥匙（纯 JS 生成，不需要本机的 ssh-keygen）。
 
-放好后点「保存」和「测试连接」。已经有自己的私钥、服务器上也放好了对应公钥的，展开「改用我自己已有的私钥」粘贴进去即可（支持带密码短语的私钥）。用非 root 用户时，「sudo 密码」一栏填该用户的 sudo 密码；root 或免密 sudo 不用填。
+**已经用 dsh-vps-manager 管理的服务器不需要再放任何公钥**：它的钥匙已经在服务器上，直接点「检查已有安装」或「测试连接」即可，页面会列出本机找到的钥匙，测试连接成功后会说明用的是哪一把。本机钥匙都不被认可时，再把页面上显示的专用钥匙公钥放到服务器上（服务商后台的「SSH 密钥」，或在能登录的服务器上执行页面给出的一行命令）。私钥只在本机 dsh 里读取，不会发给页面；带密码短语的本机私钥会跳过。用非 root 用户时，「sudo 密码」一栏填该用户的 sudo 密码；root 或免密 sudo 不用填。
 
 **找回已有节点**：重装过 dsh 或 dsh-vpn 后，本地保存的设置会丢失，但 VPS 上的节点还在运行。在 VPN 设置里填好服务器 IP、端口、用户名和密码（或选密钥登录），**不用先保存**，直接点登录方式下面的「检查已有安装」：插件登录服务器读取仍在运行的节点，显示原来的二维码（链接和以前完全一样，已经导入手机或电脑客户端的配置继续可用），按服务器上的实际情况勾选协议和证书类型，并自动保存设置。登录失败时什么都不保存，填的内容也不会被清掉。
 

package/lib/client.js

@@ -51,7 +51,7 @@ var vpnApi = {
   getSettings: () => post("/settings/get"),
   saveSettings: (form) => post("/settings/save", form),
   /** Public half of the plugin's dedicated key and the line that installs it. */
-  sshKey: () => post("/ssh-key"),
+  sshKey: (host = "") => post("/ssh-key", { host }),
   forgetHostKey: () => post("/host-key/forget"),
   test: () => post("/test"),
   status: () => post("/status"),
@@ -97,6 +97,11 @@ var zh = {
   sudoPassword: "sudo \u5BC6\u7801\uFF08\u9009\u586B\uFF09",
   sudoPasswordEmpty: "\u7528 root \u6216\u514D\u5BC6 sudo \u65F6\u4E0D\u7528\u586B",
   keyIntro: "\u7528\u63D2\u4EF6\u7684\u4E13\u7528\u94A5\u5319\u767B\u5F55\u3002\u628A\u4E0B\u9762\u7684\u516C\u94A5\u653E\u5230\u670D\u52A1\u5668\u4E0A\uFF0C\u4EFB\u9009\u4E00\u79CD\u529E\u6CD5\uFF1A",
+  keyIntroFallback: "\u5982\u679C\u670D\u52A1\u5668\u4E0D\u8BA4\u4E0A\u9762\u7684\u94A5\u5319\uFF0C\u518D\u7528\u63D2\u4EF6\u7684\u4E13\u7528\u94A5\u5319\uFF1A\u628A\u4E0B\u9762\u7684\u516C\u94A5\u653E\u5230\u670D\u52A1\u5668\u4E0A\uFF0C\u4EFB\u9009\u4E00\u79CD\u529E\u6CD5\uFF1A",
+  localKeysFound: "\u672C\u673A\u5DF2\u6709\u7684\u94A5\u5319\uFF08\u4F1A\u5148\u7528\u5B83\u4EEC\u767B\u5F55\uFF09",
+  localKeysHint: "\u5305\u62EC ~/.ssh/config \u91CC\u4E3A\u8FD9\u53F0\u670D\u52A1\u5668\u914D\u7F6E\u7684\u94A5\u5319\u3001dsh-vps-manager \u7684 ~/.ssh/dsh_vps_ed25519 \u548C ~/.ssh/id_*\u3002\u670D\u52A1\u5668\u8BA4\u53EF\u5176\u4E2D\u4EFB\u4F55\u4E00\u628A\uFF0C\u5C31\u4E0D\u7528\u518D\u653E\u516C\u94A5\uFF0C\u76F4\u63A5\u70B9\u300C\u68C0\u67E5\u5DF2\u6709\u5B89\u88C5\u300D\u6216\u300C\u6D4B\u8BD5\u8FDE\u63A5\u300D\u3002\u79C1\u94A5\u53EA\u5728\u672C\u673A dsh \u91CC\u8BFB\u53D6\uFF0C\u4E0D\u4F1A\u53D1\u7ED9\u9875\u9762\u3002",
+  testOkKey: "\uFF08\u7528 {key} \u767B\u5F55\uFF09",
+  dedicatedKey: "\u63D2\u4EF6\u4E13\u7528\u94A5\u5319",
   keyWayConsole: "A. \u670D\u52A1\u5546\u540E\u53F0\u6DFB\u52A0\uFF08\u65B0\u673A\u5668\u63A8\u8350\uFF09",
   keyWayConsoleHint: "\u7C98\u5230\u670D\u52A1\u5546\u7684\u300CSSH \u5BC6\u94A5\u300D\u91CC\uFF0C\u91CD\u88C5\u7CFB\u7EDF\u65F6\u52FE\u9009\u5B83\u3002",
   keyWayCommand: "B. \u5DF2\u7ECF\u80FD\u767B\u5F55\uFF08\u7F51\u9875\u63A7\u5236\u53F0\u6216\u522B\u7684\u7EC8\u7AEF\uFF09",
@@ -228,6 +233,11 @@ var en = {
   sudoPassword: "sudo password (optional)",
   sudoPasswordEmpty: "Not needed for root or passwordless sudo",
   keyIntro: "Log in with the plugin's dedicated key. Put the public key below on the server, either way:",
+  keyIntroFallback: "If the server accepts none of the keys above, use the plugin's dedicated key: put the public key below on the server, either way:",
+  localKeysFound: "Keys already on this computer (tried first)",
+  localKeysHint: "The keys ~/.ssh/config names for this server, dsh-vps-manager's ~/.ssh/dsh_vps_ed25519 and ~/.ssh/id_*. If the server accepts any of them, nothing needs to be added: click Find existing install or Test connection. Private keys are read only by dsh on this computer and never sent to the page.",
+  testOkKey: " (logged in with {key})",
+  dedicatedKey: "the plugin's dedicated key",
   keyWayConsole: "A. Add it in your provider's console (recommended for new machines)",
   keyWayConsoleHint: `Paste it into your provider's "SSH keys" and select it when reinstalling the OS.`,
   keyWayCommand: "B. If you can already log in (web console or another terminal)",
@@ -1176,17 +1186,26 @@ function KeyPanel({ t, api, form, saved, set, setForm }) {
   const [own, setOwn] = (0, import_react.useState)(ownStored);
   (0, import_react.useEffect)(() => {
     let live = true;
-    void api.sshKey().then((r) => {
-      if (live && r.ok) setKey(r);
-    });
+    const timer = setTimeout(() => {
+      void api.sshKey(form.host).then((r) => {
+        if (live && r.ok) setKey(r);
+      });
+    }, 300);
     return () => {
       live = false;
+      clearTimeout(timer);
     };
-  }, [api]);
+  }, [api, form.host]);
+  const local = key?.localKeys ?? [];
   const preparing = t("working");
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keypanel dshvpn-wide", children: [
+    local.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard dshvpn-success", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("localKeysFound") }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { children: local.join("\n") }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("localKeysHint") })
+    ] }),
     !own && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "dshvpn-muted", children: t("keyIntro") }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "dshvpn-muted", children: local.length > 0 ? t("keyIntroFallback") : t("keyIntro") }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard", children: [
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("keyWayConsole") }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("keyWayConsoleHint") }),
@@ -1518,7 +1537,9 @@ ${t("cloudHint")}`;
           onClick: () => {
             void op("test", api.test, (r) => {
               void refreshSettings();
-              return { tone: "success", text: t("testOk", { system: String(r.result?.system ?? "") }) };
+              const k = r.result?.key;
+              const used = typeof k === "string" ? t("testOkKey", { key: k === "own" ? t("ownKey") : k === "dsh-vpn" ? t("dedicatedKey") : k }) : "";
+              return { tone: "success", text: `${t("testOk", { system: String(r.result?.system ?? "") })}${used}` };
             });
           },
           children: t("test")

package/lib/index.js

@@ -20199,22 +20199,36 @@ function fingerprint(key) {
 }
 var STDERR_TAIL = 8e3;
 var SshSession = class _SshSession {
-  constructor(client, hostKey) {
+  constructor(client, hostKey, keyLabel) {
     this.client = client;
     this.hostKey = hostKey;
+    this.keyLabel = keyLabel;
   }
   client;
   hostKey;
+  keyLabel;
   static async open(target, signal, timeoutMs = 2e4) {
     signal.throwIfAborted();
     const client = new import_ssh2.Client();
     let seen;
+    const keys = target.keys ?? [];
+    let tried = -1;
     const config = {
       host: target.host,
       port: target.port,
       username: target.username,
-      // Exactly one method: the key, or the password. Never keyboard-interactive or agents.
-      ...target.privateKey ? { privateKey: target.privateKey, ...target.passphrase ? { passphrase: target.passphrase } : {} } : { password: target.password },
+      // Keys in order, or the password: one kind only, never keyboard-interactive or agents.
+      ...keys.length > 0 ? {
+        authHandler: (_left, _partial, next) => {
+          tried += 1;
+          const k = keys[tried];
+          if (!k) {
+            next(false);
+            return;
+          }
+          next({ type: "publickey", username: target.username, key: k.key, ...k.passphrase ? { passphrase: k.passphrase } : {} });
+        }
+      } : { password: target.password },
       readyTimeout: timeoutMs,
       tryKeyboard: false,
       hostVerifier: (key) => {
@@ -20230,7 +20244,7 @@ var SshSession = class _SshSession {
       signal.addEventListener("abort", onAbort, { once: true });
       client.once("ready", () => {
         signal.removeEventListener("abort", onAbort);
-        resolve(new _SshSession(client, seen ?? ""));
+        resolve(new _SshSession(client, seen ?? "", keys[tried]?.label));
       });
       client.once("error", (err) => {
         signal.removeEventListener("abort", onAbort);
@@ -20242,7 +20256,11 @@ var SshSession = class _SshSession {
             { expected: target.hostKey, actual: seen }
           ));
         } else if (err.level === "client-authentication") {
-          reject(target.privateKey ? new SshError("key_rejected", `SSH login failed: ${target.username}@${target.host} did not accept the key`) : new SshError("auth_failed", "SSH login failed: wrong username or password"));
+          reject(keys.length > 0 ? new SshError(
+            "key_rejected",
+            `SSH login failed: ${target.username}@${target.host} accepted none of: ${keys.map((k) => k.label).join(", ")}`,
+            { tried: keys.map((k) => k.label).join("\n") }
+          ) : new SshError("auth_failed", "SSH login failed: wrong username or password"));
         } else if (err.level === "client-timeout") {
           reject(new SshError("timeout", `timed out connecting to ${target.host}:${target.port}`));
         } else {
@@ -20472,9 +20490,10 @@ function apiHandlers(service, uiLang, onUiLang, updater) {
       return { ok: true, settings: publicView(saved) };
     },
     // The dedicated key's public half and the line that installs it; never the private key.
-    "/ssh-key": async () => {
+    "/ssh-key": async (body) => {
       const { publicKey } = await service.keys.get();
-      return { ok: true, publicKey, command: authorizedKeysCommand(publicKey) };
+      const host = typeof body.host === "string" ? body.host.trim() : "";
+      return { ok: true, publicKey, command: authorizedKeysCommand(publicKey), localKeys: host ? service.localKeyLabels(host) : [] };
     },
     "/host-key/forget": async () => {
       await service.store.update((cur) => cur && { ...cur, hostKey: void 0 });
@@ -20588,11 +20607,17 @@ var NotConfiguredError = class extends Error {
     this.name = "NotConfiguredError";
   }
 };
-async function targetOf(s, keys) {
+async function targetOf(s, keys, local = () => []) {
   const base = { host: s.host, port: s.port, username: s.username, password: s.password, hostKey: s.hostKey };
   if (s.auth !== "key") return base;
-  if (s.privateKey !== void 0) return { ...base, privateKey: s.privateKey, passphrase: s.passphrase };
-  return { ...base, privateKey: (await keys.get()).privateKey };
+  const list = [];
+  if (s.privateKey !== void 0) list.push({ key: s.privateKey, passphrase: s.passphrase, label: "own" });
+  try {
+    list.push(...local(s.host));
+  } catch {
+  }
+  list.push({ key: (await keys.get()).privateKey, label: "dsh-vpn" });
+  return { ...base, keys: list };
 }
 function resolveProtocols(requested, fallback) {
   const list = requested && requested.length > 0 ? [...new Set(requested)] : [...fallback];
@@ -20616,6 +20641,14 @@ var VpnService = class {
   config;
   keys;
   queue = Promise.resolve();
+  /** Labels of this computer's keys that key login would try for `host` (no key material). */
+  localKeyLabels(host) {
+    try {
+      return (this.config.localKeys?.(host) ?? []).map((k) => k.label);
+    } catch {
+      return [];
+    }
+  }
   async settings() {
     const s = await this.store.get();
     if (!s) throw new NotConfiguredError();
@@ -20645,7 +20678,7 @@ var VpnService = class {
   }
   /** Run the script against `s` (stored or not); throws SSH and config errors. */
   async runOn(s, action, args, signal) {
-    const res = await runVpnScript(action, args, await targetOf(s, this.keys), signal, this.config.timeoutMs);
+    const res = await runVpnScript(action, args, await targetOf(s, this.keys, this.config.localKeys), signal, this.config.timeoutMs);
     if (!res.result) {
       const sudo = /incorrect password|a password is required|not in the sudoers|may not run sudo/i.test(res.log);
       return {
@@ -20745,7 +20778,7 @@ var VpnService = class {
       let session;
       try {
         const s = await this.settings();
-        session = await SshSession.open(await targetOf(s, this.keys), signal);
+        session = await SshSession.open(await targetOf(s, this.keys, this.config.localKeys), signal);
         const asRoot = s.username === "root";
         const cmd = `echo "uid=$(${asRoot ? "" : `sudo -S -p '' `}id -u)"; echo "sys=$(uname -srm)"`;
         const res = await session.exec(cmd, asRoot ? "" : `${s.password}
@@ -20757,7 +20790,7 @@ var VpnService = class {
         return {
           ok: root,
           ...root ? {} : { error: "sudo_failed", message: `cannot become root as ${s.username}: ${res.stderr.trim()}` },
-          result: { hostKey: session.hostKey, system, root }
+          result: { hostKey: session.hostKey, system, root, ...session.keyLabel ? { key: session.keyLabel } : {} }
         };
       } catch (err) {
         return failure(err);
@@ -20895,14 +20928,95 @@ function notConfiguredMessage(lang) {
   return lang === "zh" ? "\u5C1A\u672A\u914D\u7F6E\u670D\u52A1\u5668\u3002\u8BF7\u70B9 dsh \u5DE6\u4E0B\u89D2\u300C\u8BBE\u7F6E\u300D\u2192\u300CVPN \u8BBE\u7F6E\u300D\uFF0C\u586B\u5199\u670D\u52A1\u5668 IP\u3001\u7AEF\u53E3\u3001\u7528\u6237\u540D\u548C\u5BC6\u7801\u3002" : "No server configured. Open dsh Settings (bottom left) \u2192 VPN and fill in the server IP, port, username and password first.";
 }
 
+// src/local-keys.ts
+import { readdirSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { isAbsolute, join } from "node:path";
+var DEFAULT_KEYS = ["dsh_vps_ed25519", "id_ed25519", "id_ecdsa", "id_rsa"];
+function readText(file) {
+  try {
+    return readFileSync(file, "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function configTexts(sshDir) {
+  const texts = [];
+  const main = readText(join(sshDir, "config"));
+  if (main !== void 0) texts.push(main);
+  let names = [];
+  try {
+    names = readdirSync(join(sshDir, "config.d")).sort();
+  } catch {
+  }
+  for (const name2 of names) {
+    const t = readText(join(sshDir, "config.d", name2));
+    if (t !== void 0) texts.push(t);
+  }
+  return texts;
+}
+function identityFilesFor(host, sshDir, home) {
+  const files = [];
+  for (const text of configTexts(sshDir)) {
+    let patterns = [];
+    let hostName;
+    let identities = [];
+    const flush = () => {
+      const literal = patterns.filter((p) => !/[*?!]/.test(p));
+      if (literal.length > 0 && (hostName === host || literal.includes(host))) {
+        files.push(...identities);
+      }
+    };
+    for (const raw of text.split("\n")) {
+      const line = raw.replace(/\s+#.*$/, "").trim();
+      const m = /^(\w+)\s*=?\s*(.+)$/.exec(line);
+      if (!m || line.startsWith("#")) continue;
+      const key = m[1].toLowerCase();
+      const value = m[2].trim().replace(/^"(.*)"$/, "$1");
+      if (key === "host" || key === "match") {
+        flush();
+        patterns = key === "host" ? value.split(/\s+/) : [];
+        hostName = void 0;
+        identities = [];
+      } else if (key === "hostname") {
+        hostName = value;
+      } else if (key === "identityfile") {
+        const expanded = value.startsWith("~/") ? join(home, value.slice(2)) : value;
+        identities.push(isAbsolute(expanded) ? expanded : join(sshDir, expanded));
+      }
+    }
+    flush();
+  }
+  return files;
+}
+function localKeysFor(host, opts = {}) {
+  const home = opts.home ?? homedir();
+  const sshDir = opts.sshDir ?? join(home, ".ssh");
+  const paths = [...identityFilesFor(host, sshDir, home), ...DEFAULT_KEYS.map((n) => join(sshDir, n))];
+  const keys = [];
+  for (const path of [...new Set(paths)]) {
+    const key = readText(path);
+    if (key === void 0 || !key.includes("PRIVATE KEY")) continue;
+    let problem;
+    try {
+      problem = privateKeyProblem(key);
+    } catch {
+      problem = "unreadable";
+    }
+    if (problem) continue;
+    keys.push({ key, label: path.startsWith(home) ? `~${path.slice(home.length)}` : path });
+  }
+  return keys;
+}
+
 // src/update.ts
-import { readFileSync } from "node:fs";
+import { readFileSync as readFileSync2 } from "node:fs";
 var PACKAGE_NAME = "dsh-vpn";
 var MIN_RELEASE_AGE_MS = 24 * 60 * 60 * 1e3;
 var NPM_REGISTRY = "https://registry.npmjs.org/";
 function currentVersion() {
   try {
-    const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    const pkg = JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : "0.0.0";
   } catch {
     return "0.0.0";
@@ -21056,7 +21170,7 @@ function toToolValue(r, uiLang) {
 function apply(ctx, config) {
   const service = new VpnService(
     new CredentialSettingsStore(ctx),
-    { timeoutMs: config.timeoutMs, acmeProvider: config.acmeProvider },
+    { timeoutMs: config.timeoutMs, acmeProvider: config.acmeProvider, localKeys: (host) => localKeysFor(host) },
     new CredentialKeyStore(ctx)
   );
   const uiLang = new UiLang();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vpn",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "DeepSeek Harness plugin: deploy an encrypted VPN (sing-box) to your own VPS in one click, to protect your connections and privacy on untrusted networks",
   "keywords": [
     "anytls",