dsh-vpn 0.1.10 → 0.1.12

package/README.md

@@ -38,12 +38,13 @@ dsh plugin --profile web add dsh-vpn
 3. 在「节点二维码」里点「刷新二维码」，用手机或电脑上的客户端扫码导入。
 4. 服务器防火墙的端口由插件自动放行，不用手动操作；安装完成后提示框会列出放行了哪些端口。
 
-**密钥登录**：服务器只允许密钥登录（或者你不想保存密码）时，把「登录方式」选成「密钥」。插件会生成一把专用钥匙（纯 JS 生成，不需要本机的 ssh-keygen），页面上显示它的公钥，任选一种办法放到服务器上：
+**密钥登录**：服务器只允许密钥登录时，把「登录方式」选成「密钥」。插件按这个顺序尝试登录，哪把被服务器认可就用哪把：
 
-- A. 粘到服务商后台的「SSH 密钥」里，重装系统时勾选它（新机器推荐）；
-- B. 已经能登录服务器的（网页控制台或别的终端），复制页面上的一行命令粘贴执行。
+1. 你自己粘贴的私钥（展开「改用我自己已有的私钥」，支持带密码短语的私钥）；
+2. 本机已有的钥匙：`~/.ssh/config`（含 `config.d`）里为这台服务器配置的 `IdentityFile`，dsh-vps-manager 的 `~/.ssh/dsh_vps_ed25519`，以及 `~/.ssh/id_ed25519`、`id_ecdsa`、`id_rsa`；
+3. 插件的专用钥匙（纯 JS 生成，不需要本机的 ssh-keygen）。
 
-放好后点「保存」和「测试连接」。已经有自己的私钥、服务器上也放好了对应公钥的，展开「改用我自己已有的私钥」粘贴进去即可（支持带密码短语的私钥）。用非 root 用户时，「sudo 密码」一栏填该用户的 sudo 密码；root 或免密 sudo 不用填。
+**已经用 dsh-vps-manager 管理的服务器不需要再放任何公钥**：它的钥匙已经在服务器上。填好 IP，「登录方式」选「密钥」，页面会列出本机找到的钥匙，点这张卡片右上角的「使用」就登录了（不用先保存，登录成功后自动保存）。卡片随后一直显示「已登录：用哪把钥匙登录 用户@服务器」，之后安装、检查和刷新二维码都优先用这把钥匙；改了 IP、端口或用户名，登录状态自动作废。本机钥匙都不被认可时，再把页面上显示的专用钥匙公钥放到服务器上（服务商后台的「SSH 密钥」，或在能登录的服务器上执行页面给出的一行命令）。私钥只在本机 dsh 里读取，不会发给页面；带密码短语的本机私钥会跳过。用非 root 用户时，「sudo 密码」一栏填该用户的 sudo 密码；root 或免密 sudo 不用填。
 
 **找回已有节点**：重装过 dsh 或 dsh-vpn 后，本地保存的设置会丢失，但 VPS 上的节点还在运行。在 VPN 设置里填好服务器 IP、端口、用户名和密码（或选密钥登录），**不用先保存**，直接点登录方式下面的「检查已有安装」：插件登录服务器读取仍在运行的节点，显示原来的二维码（链接和以前完全一样，已经导入手机或电脑客户端的配置继续可用），按服务器上的实际情况勾选协议和证书类型，并自动保存设置。登录失败时什么都不保存，填的内容也不会被清掉。
 

package/lib/client.js

@@ -51,9 +51,11 @@ var vpnApi = {
   getSettings: () => post("/settings/get"),
   saveSettings: (form) => post("/settings/save", form),
   /** Public half of the plugin's dedicated key and the line that installs it. */
-  sshKey: () => post("/ssh-key"),
+  sshKey: (host = "") => post("/ssh-key", { host }),
   forgetHostKey: () => post("/host-key/forget"),
   test: () => post("/test"),
+  /** Log in with keys (local ones first) using the form as typed; saved once it works. */
+  login: (form) => post("/login", form),
   status: () => post("/status"),
   links: () => post("/links"),
   /** Find an earlier installation on the server and adopt its protocols and certificate mode. */
@@ -97,6 +99,15 @@ var zh = {
   sudoPassword: "sudo \u5BC6\u7801\uFF08\u9009\u586B\uFF09",
   sudoPasswordEmpty: "\u7528 root \u6216\u514D\u5BC6 sudo \u65F6\u4E0D\u7528\u586B",
   keyIntro: "\u7528\u63D2\u4EF6\u7684\u4E13\u7528\u94A5\u5319\u767B\u5F55\u3002\u628A\u4E0B\u9762\u7684\u516C\u94A5\u653E\u5230\u670D\u52A1\u5668\u4E0A\uFF0C\u4EFB\u9009\u4E00\u79CD\u529E\u6CD5\uFF1A",
+  keyIntroFallback: "\u5982\u679C\u670D\u52A1\u5668\u4E0D\u8BA4\u4E0A\u9762\u7684\u94A5\u5319\uFF0C\u518D\u7528\u63D2\u4EF6\u7684\u4E13\u7528\u94A5\u5319\uFF1A\u628A\u4E0B\u9762\u7684\u516C\u94A5\u653E\u5230\u670D\u52A1\u5668\u4E0A\uFF0C\u4EFB\u9009\u4E00\u79CD\u529E\u6CD5\uFF1A",
+  localKeysFound: "\u672C\u673A\u5DF2\u6709\u7684\u94A5\u5319\uFF08\u4F1A\u5148\u7528\u5B83\u4EEC\u767B\u5F55\uFF09",
+  useKey: "\u4F7F\u7528",
+  relogin: "\u91CD\u65B0\u767B\u5F55",
+  loggingIn: "\u767B\u5F55\u4E2D\u2026",
+  loggedIn: "\u2713 \u5DF2\u767B\u5F55\uFF1A\u7528 {key} \u767B\u5F55 {user}@{host}\uFF08{time}\uFF09\u3002\u4E4B\u540E\u5B89\u88C5\u3001\u68C0\u67E5\u548C\u5237\u65B0\u4E8C\u7EF4\u7801\u90FD\u4F1A\u5148\u7528\u8FD9\u628A\u94A5\u5319\u3002",
+  localKeysHint: "\u5305\u62EC ~/.ssh/config \u91CC\u4E3A\u8FD9\u53F0\u670D\u52A1\u5668\u914D\u7F6E\u7684\u94A5\u5319\u3001dsh-vps-manager \u7684 ~/.ssh/dsh_vps_ed25519 \u548C ~/.ssh/id_*\u3002\u670D\u52A1\u5668\u8BA4\u53EF\u5176\u4E2D\u4EFB\u4F55\u4E00\u628A\uFF0C\u5C31\u4E0D\u7528\u518D\u653E\u516C\u94A5\uFF0C\u70B9\u53F3\u4E0A\u89D2\u300C\u4F7F\u7528\u300D\u5373\u53EF\u767B\u5F55\u3002\u79C1\u94A5\u53EA\u5728\u672C\u673A dsh \u91CC\u8BFB\u53D6\uFF0C\u4E0D\u4F1A\u53D1\u7ED9\u9875\u9762\u3002",
+  testOkKey: "\uFF08\u7528 {key} \u767B\u5F55\uFF09",
+  dedicatedKey: "\u63D2\u4EF6\u4E13\u7528\u94A5\u5319",
   keyWayConsole: "A. \u670D\u52A1\u5546\u540E\u53F0\u6DFB\u52A0\uFF08\u65B0\u673A\u5668\u63A8\u8350\uFF09",
   keyWayConsoleHint: "\u7C98\u5230\u670D\u52A1\u5546\u7684\u300CSSH \u5BC6\u94A5\u300D\u91CC\uFF0C\u91CD\u88C5\u7CFB\u7EDF\u65F6\u52FE\u9009\u5B83\u3002",
   keyWayCommand: "B. \u5DF2\u7ECF\u80FD\u767B\u5F55\uFF08\u7F51\u9875\u63A7\u5236\u53F0\u6216\u522B\u7684\u7EC8\u7AEF\uFF09",
@@ -228,6 +239,15 @@ var en = {
   sudoPassword: "sudo password (optional)",
   sudoPasswordEmpty: "Not needed for root or passwordless sudo",
   keyIntro: "Log in with the plugin's dedicated key. Put the public key below on the server, either way:",
+  keyIntroFallback: "If the server accepts none of the keys above, use the plugin's dedicated key: put the public key below on the server, either way:",
+  localKeysFound: "Keys already on this computer (tried first)",
+  useKey: "Use",
+  relogin: "Log in again",
+  loggingIn: "Logging in\u2026",
+  loggedIn: "\u2713 Logged in: {user}@{host} with {key} ({time}). Install, find and refresh will use this key first.",
+  localKeysHint: "The keys ~/.ssh/config names for this server, dsh-vps-manager's ~/.ssh/dsh_vps_ed25519 and ~/.ssh/id_*. If the server accepts any of them, nothing needs to be added: click Use at the top right to log in. Private keys are read only by dsh on this computer and never sent to the page.",
+  testOkKey: " (logged in with {key})",
+  dedicatedKey: "the plugin's dedicated key",
   keyWayConsole: "A. Add it in your provider's console (recommended for new machines)",
   keyWayConsoleHint: `Paste it into your provider's "SSH keys" and select it when reinstalling the OS.`,
   keyWayCommand: "B. If you can already log in (web console or another terminal)",
@@ -385,6 +405,8 @@ var STYLES = `
   color: inherit; background: transparent; border: 1px solid var(--dsw-alias-border-l2, rgba(127,127,127,.3)); }
 .dshvpn-detect { display: flex; align-items: center; flex-wrap: wrap; gap: 10px; padding-top: 4px; }
 .dshvpn-detect small { flex: 1; min-width: 220px; }
+.dshvpn-keycard-head { display: flex; align-items: center; justify-content: space-between; gap: 10px; }
+.dshvpn-loggedin { font-size: 13px; color: var(--dsw-alias-state-success-primary, #2f855a); }
 .dshvpn-section { display: flex; flex-direction: column; gap: 16px; }
 .dshvpn-section-head h2 { margin: 0; font-size: 18px; font-weight: 600; }
 .dshvpn-title-row { display: flex; align-items: center; flex-wrap: wrap; gap: 10px; margin-bottom: 4px; }
@@ -1170,23 +1192,64 @@ function Copyable({ text, label, t }) {
     }, children: copied ? t("copied") : label })
   ] });
 }
-function KeyPanel({ t, api, form, saved, set, setForm }) {
+function KeyPanel({ t, api, form, saved, set, setForm, disabled, onLoggedIn }) {
+  const [logging, setLogging] = (0, import_react.useState)(false);
+  const [loginError, setLoginError] = (0, import_react.useState)(null);
+  const loggedIn = saved.loginKey !== null && saved.host === form.host.trim() && saved.port === form.port && saved.username === form.username.trim();
+  const keyName = (label) => label === "own" ? t("ownKey") : label === "dsh-vpn" ? t("dedicatedKey") : label;
+  const login = async () => {
+    setLogging(true);
+    setLoginError(null);
+    const r = await api.login(form);
+    setLogging(false);
+    if (r.ok) onLoggedIn(r.settings);
+    else setLoginError(errorText(t, r));
+  };
   const [key, setKey] = (0, import_react.useState)(null);
   const ownStored = saved.hasPrivateKey && !form.clearPrivateKey;
   const [own, setOwn] = (0, import_react.useState)(ownStored);
   (0, import_react.useEffect)(() => {
     let live = true;
-    void api.sshKey().then((r) => {
-      if (live && r.ok) setKey(r);
-    });
+    const timer = setTimeout(() => {
+      void api.sshKey(form.host).then((r) => {
+        if (live && r.ok) setKey(r);
+      });
+    }, 300);
     return () => {
       live = false;
+      clearTimeout(timer);
     };
-  }, [api]);
+  }, [api, form.host]);
+  const local = key?.localKeys ?? [];
   const preparing = t("working");
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keypanel dshvpn-wide", children: [
-    !own && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "dshvpn-muted", children: t("keyIntro") }),
+    (local.length > 0 || loggedIn) && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard dshvpn-success", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard-head", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("localKeysFound") }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          import_dsh_client_ui_primitives.Button,
+          {
+            size: "sm",
+            variant: loggedIn ? "outline" : "primary",
+            disabled: disabled || logging || form.host.trim() === "",
+            onClick: () => {
+              void login();
+            },
+            children: logging ? t("loggingIn") : loggedIn ? t("relogin") : t("useKey")
+          }
+        )
+      ] }),
+      loggedIn ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "dshvpn-loggedin", children: t("loggedIn", {
+        key: keyName(saved.loginKey),
+        user: saved.username,
+        host: saved.host,
+        time: saved.loggedInAt ? new Date(saved.loggedInAt).toLocaleString() : ""
+      }) }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { children: local.join("\n") }),
+      loginError && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "dshvpn-notice dshvpn-error", children: loginError }),
+      !loggedIn && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("localKeysHint") })
+    ] }),
+    !own && !loggedIn && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "dshvpn-muted", children: local.length > 0 ? t("keyIntroFallback") : t("keyIntro") }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard", children: [
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("keyWayConsole") }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("keyWayConsoleHint") }),
@@ -1428,7 +1491,22 @@ ${t("cloudHint")}`;
             /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: m === "key" ? t("authKey") : t("authPassword") })
           ] }, m)) })
         ] }),
-        form.auth === "key" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(KeyPanel, { t, api, form, saved, set, setForm }),
+        form.auth === "key" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          KeyPanel,
+          {
+            t,
+            api,
+            form,
+            saved,
+            set,
+            setForm,
+            disabled,
+            onLoggedIn: (v) => {
+              setSaved(v);
+              setForm(formOf(v));
+            }
+          }
+        ),
         /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-wide dshvpn-detect", children: [
           /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Button, { variant: "primary", disabled: disabled || form.host.trim() === "", onClick: () => {
             void detect();
@@ -1518,7 +1596,9 @@ ${t("cloudHint")}`;
           onClick: () => {
             void op("test", api.test, (r) => {
               void refreshSettings();
-              return { tone: "success", text: t("testOk", { system: String(r.result?.system ?? "") }) };
+              const k = r.result?.key;
+              const used = typeof k === "string" ? t("testOkKey", { key: k === "own" ? t("ownKey") : k === "dsh-vpn" ? t("dedicatedKey") : k }) : "";
+              return { tone: "success", text: `${t("testOk", { system: String(r.result?.system ?? "") })}${used}` };
             });
           },
           children: t("test")

package/lib/index.js

@@ -20199,22 +20199,36 @@ function fingerprint(key) {
 }
 var STDERR_TAIL = 8e3;
 var SshSession = class _SshSession {
-  constructor(client, hostKey) {
+  constructor(client, hostKey, keyLabel) {
     this.client = client;
     this.hostKey = hostKey;
+    this.keyLabel = keyLabel;
   }
   client;
   hostKey;
+  keyLabel;
   static async open(target, signal, timeoutMs = 2e4) {
     signal.throwIfAborted();
     const client = new import_ssh2.Client();
     let seen;
+    const keys = target.keys ?? [];
+    let tried = -1;
     const config = {
       host: target.host,
       port: target.port,
       username: target.username,
-      // Exactly one method: the key, or the password. Never keyboard-interactive or agents.
-      ...target.privateKey ? { privateKey: target.privateKey, ...target.passphrase ? { passphrase: target.passphrase } : {} } : { password: target.password },
+      // Keys in order, or the password: one kind only, never keyboard-interactive or agents.
+      ...keys.length > 0 ? {
+        authHandler: (_left, _partial, next) => {
+          tried += 1;
+          const k = keys[tried];
+          if (!k) {
+            next(false);
+            return;
+          }
+          next({ type: "publickey", username: target.username, key: k.key, ...k.passphrase ? { passphrase: k.passphrase } : {} });
+        }
+      } : { password: target.password },
       readyTimeout: timeoutMs,
       tryKeyboard: false,
       hostVerifier: (key) => {
@@ -20230,7 +20244,7 @@ var SshSession = class _SshSession {
       signal.addEventListener("abort", onAbort, { once: true });
       client.once("ready", () => {
         signal.removeEventListener("abort", onAbort);
-        resolve(new _SshSession(client, seen ?? ""));
+        resolve(new _SshSession(client, seen ?? "", keys[tried]?.label));
       });
       client.once("error", (err) => {
         signal.removeEventListener("abort", onAbort);
@@ -20242,7 +20256,11 @@ var SshSession = class _SshSession {
             { expected: target.hostKey, actual: seen }
           ));
         } else if (err.level === "client-authentication") {
-          reject(target.privateKey ? new SshError("key_rejected", `SSH login failed: ${target.username}@${target.host} did not accept the key`) : new SshError("auth_failed", "SSH login failed: wrong username or password"));
+          reject(keys.length > 0 ? new SshError(
+            "key_rejected",
+            `SSH login failed: ${target.username}@${target.host} accepted none of: ${keys.map((k) => k.label).join(", ")}`,
+            { tried: keys.map((k) => k.label).join("\n") }
+          ) : new SshError("auth_failed", "SSH login failed: wrong username or password"));
         } else if (err.level === "client-timeout") {
           reject(new SshError("timeout", `timed out connecting to ${target.host}:${target.port}`));
         } else {
@@ -20352,7 +20370,9 @@ var EMPTY_VIEW = {
   protocols: [...DEFAULT_PROTOCOLS],
   certMode: "self",
   linkAddress: "",
-  hostKey: null
+  hostKey: null,
+  loginKey: null,
+  loggedInAt: null
 };
 function publicView(s) {
   if (!s) return EMPTY_VIEW;
@@ -20367,7 +20387,9 @@ function publicView(s) {
     protocols: s.protocols,
     certMode: s.certMode,
     linkAddress: s.linkAddress ?? "",
-    hostKey: s.hostKey ?? null
+    hostKey: s.hostKey ?? null,
+    loginKey: s.auth === "key" ? s.loginKey ?? null : null,
+    loggedInAt: s.auth === "key" ? s.loggedInAt ?? null : null
   };
 }
 function applyInput(current, input) {
@@ -20418,7 +20440,9 @@ function applyInput(current, input) {
     protocols,
     certMode,
     linkAddress: linkAddress || void 0,
-    hostKey: sameMachine ? current.hostKey : void 0
+    hostKey: sameMachine ? current.hostKey : void 0,
+    // A login is remembered only for the same machine and user.
+    ...sameMachine && current.username === username && auth === "key" && current.loginKey ? { loginKey: current.loginKey, loggedInAt: current.loggedInAt } : {}
   };
 }
 var MemoryKeyStore = class {
@@ -20472,15 +20496,22 @@ function apiHandlers(service, uiLang, onUiLang, updater) {
       return { ok: true, settings: publicView(saved) };
     },
     // The dedicated key's public half and the line that installs it; never the private key.
-    "/ssh-key": async () => {
+    "/ssh-key": async (body) => {
       const { publicKey } = await service.keys.get();
-      return { ok: true, publicKey, command: authorizedKeysCommand(publicKey) };
+      const host = typeof body.host === "string" ? body.host.trim() : "";
+      return { ok: true, publicKey, command: authorizedKeysCommand(publicKey), localKeys: host ? service.localKeyLabels(host) : [] };
     },
     "/host-key/forget": async () => {
       await service.store.update((cur) => cur && { ...cur, hostKey: void 0 });
       return { ok: true, settings: publicView(await service.store.get()) };
     },
     "/test": (_body, signal) => service.test(signal),
+    // 「使用」 on the local-keys card: key login with the form as typed; saved once it works.
+    "/login": async (body, signal) => {
+      const candidate = applyInput(await service.store.get(), { ...body, auth: "key" });
+      const r = await service.test(signal, candidate);
+      return r.ok ? { ...r, settings: publicView(await service.store.get()) } : r;
+    },
     "/status": (_body, signal) => service.status(signal),
     "/links": (_body, signal) => service.links(signal),
     // With form fields: try them as they are (no save needed first); they are
@@ -20588,11 +20619,19 @@ var NotConfiguredError = class extends Error {
     this.name = "NotConfiguredError";
   }
 };
-async function targetOf(s, keys) {
+async function targetOf(s, keys, local = () => []) {
   const base = { host: s.host, port: s.port, username: s.username, password: s.password, hostKey: s.hostKey };
   if (s.auth !== "key") return base;
-  if (s.privateKey !== void 0) return { ...base, privateKey: s.privateKey, passphrase: s.passphrase };
-  return { ...base, privateKey: (await keys.get()).privateKey };
+  const list = [];
+  if (s.privateKey !== void 0) list.push({ key: s.privateKey, passphrase: s.passphrase, label: "own" });
+  try {
+    list.push(...local(s.host));
+  } catch {
+  }
+  list.push({ key: (await keys.get()).privateKey, label: "dsh-vpn" });
+  const last = list.findIndex((k) => k.label === s.loginKey);
+  if (last > 0) list.unshift(...list.splice(last, 1));
+  return { ...base, keys: list };
 }
 function resolveProtocols(requested, fallback) {
   const list = requested && requested.length > 0 ? [...new Set(requested)] : [...fallback];
@@ -20616,6 +20655,14 @@ var VpnService = class {
   config;
   keys;
   queue = Promise.resolve();
+  /** Labels of this computer's keys that key login would try for `host` (no key material). */
+  localKeyLabels(host) {
+    try {
+      return (this.config.localKeys?.(host) ?? []).map((k) => k.label);
+    } catch {
+      return [];
+    }
+  }
   async settings() {
     const s = await this.store.get();
     if (!s) throw new NotConfiguredError();
@@ -20645,7 +20692,7 @@ var VpnService = class {
   }
   /** Run the script against `s` (stored or not); throws SSH and config errors. */
   async runOn(s, action, args, signal) {
-    const res = await runVpnScript(action, args, await targetOf(s, this.keys), signal, this.config.timeoutMs);
+    const res = await runVpnScript(action, args, await targetOf(s, this.keys, this.config.localKeys), signal, this.config.timeoutMs);
     if (!res.result) {
       const sudo = /incorrect password|a password is required|not in the sudoers|may not run sudo/i.test(res.log);
       return {
@@ -20738,26 +20785,37 @@ var VpnService = class {
   }
   /**
    * Log in, report who we are and whether root is reachable. Pins the host key
-   * on success, so the settings page can show it for the user to compare.
+   * and, for key login, remembers which key worked. With `candidate` (the
+   * settings page's 「使用」 on a local key) the form is tried as it is and
+   * stored only once the login works.
    */
-  test(signal) {
+  test(signal, candidate) {
     return this.exclusive(async () => {
       let session;
       try {
-        const s = await this.settings();
-        session = await SshSession.open(await targetOf(s, this.keys), signal);
+        const s = candidate ?? await this.settings();
+        session = await SshSession.open(await targetOf(s, this.keys, this.config.localKeys), signal);
         const asRoot = s.username === "root";
         const cmd = `echo "uid=$(${asRoot ? "" : `sudo -S -p '' `}id -u)"; echo "sys=$(uname -srm)"`;
         const res = await session.exec(cmd, asRoot ? "" : `${s.password}
 `, signal);
         const uid = /^uid=(.*)$/m.exec(res.stdout)?.[1];
         const system = /^sys=(.*)$/m.exec(res.stdout)?.[1] ?? "";
-        await this.pin(s, session.hostKey);
         const root = uid === "0";
+        const hostKey = session.hostKey;
+        const login = s.auth === "key" && session.keyLabel ? { loginKey: session.keyLabel, loggedInAt: (/* @__PURE__ */ new Date()).toISOString() } : {};
+        if (candidate) {
+          if (root) await this.store.update(() => ({ ...candidate, hostKey: candidate.hostKey ?? (hostKey || void 0), ...login }));
+        } else {
+          await this.pin(s, hostKey);
+          if (root && login.loginKey) {
+            await this.store.update((cur) => cur && cur.host === s.host && cur.port === s.port && cur.username === s.username ? { ...cur, ...login } : void 0);
+          }
+        }
         return {
           ok: root,
           ...root ? {} : { error: "sudo_failed", message: `cannot become root as ${s.username}: ${res.stderr.trim()}` },
-          result: { hostKey: session.hostKey, system, root }
+          result: { hostKey, system, root, ...session.keyLabel ? { key: session.keyLabel } : {} }
         };
       } catch (err) {
         return failure(err);
@@ -20789,7 +20847,9 @@ function parse(payload) {
     protocols: protocols.length > 0 ? protocols : ["reality", "hy2"],
     certMode: p.certMode === "ip" ? "ip" : "self",
     linkAddress: typeof p.linkAddress === "string" ? p.linkAddress : void 0,
-    hostKey: typeof p.hostKey === "string" ? p.hostKey : void 0
+    hostKey: typeof p.hostKey === "string" ? p.hostKey : void 0,
+    loginKey: typeof p.loginKey === "string" ? p.loginKey : void 0,
+    loggedInAt: typeof p.loggedInAt === "string" ? p.loggedInAt : void 0
   };
 }
 var toPayload = (s) => JSON.parse(JSON.stringify(s));
@@ -20895,14 +20955,95 @@ function notConfiguredMessage(lang) {
   return lang === "zh" ? "\u5C1A\u672A\u914D\u7F6E\u670D\u52A1\u5668\u3002\u8BF7\u70B9 dsh \u5DE6\u4E0B\u89D2\u300C\u8BBE\u7F6E\u300D\u2192\u300CVPN \u8BBE\u7F6E\u300D\uFF0C\u586B\u5199\u670D\u52A1\u5668 IP\u3001\u7AEF\u53E3\u3001\u7528\u6237\u540D\u548C\u5BC6\u7801\u3002" : "No server configured. Open dsh Settings (bottom left) \u2192 VPN and fill in the server IP, port, username and password first.";
 }
 
+// src/local-keys.ts
+import { readdirSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { isAbsolute, join } from "node:path";
+var DEFAULT_KEYS = ["dsh_vps_ed25519", "id_ed25519", "id_ecdsa", "id_rsa"];
+function readText(file) {
+  try {
+    return readFileSync(file, "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function configTexts(sshDir) {
+  const texts = [];
+  const main = readText(join(sshDir, "config"));
+  if (main !== void 0) texts.push(main);
+  let names = [];
+  try {
+    names = readdirSync(join(sshDir, "config.d")).sort();
+  } catch {
+  }
+  for (const name2 of names) {
+    const t = readText(join(sshDir, "config.d", name2));
+    if (t !== void 0) texts.push(t);
+  }
+  return texts;
+}
+function identityFilesFor(host, sshDir, home) {
+  const files = [];
+  for (const text of configTexts(sshDir)) {
+    let patterns = [];
+    let hostName;
+    let identities = [];
+    const flush = () => {
+      const literal = patterns.filter((p) => !/[*?!]/.test(p));
+      if (literal.length > 0 && (hostName === host || literal.includes(host))) {
+        files.push(...identities);
+      }
+    };
+    for (const raw of text.split("\n")) {
+      const line = raw.replace(/\s+#.*$/, "").trim();
+      const m = /^(\w+)\s*=?\s*(.+)$/.exec(line);
+      if (!m || line.startsWith("#")) continue;
+      const key = m[1].toLowerCase();
+      const value = m[2].trim().replace(/^"(.*)"$/, "$1");
+      if (key === "host" || key === "match") {
+        flush();
+        patterns = key === "host" ? value.split(/\s+/) : [];
+        hostName = void 0;
+        identities = [];
+      } else if (key === "hostname") {
+        hostName = value;
+      } else if (key === "identityfile") {
+        const expanded = value.startsWith("~/") ? join(home, value.slice(2)) : value;
+        identities.push(isAbsolute(expanded) ? expanded : join(sshDir, expanded));
+      }
+    }
+    flush();
+  }
+  return files;
+}
+function localKeysFor(host, opts = {}) {
+  const home = opts.home ?? homedir();
+  const sshDir = opts.sshDir ?? join(home, ".ssh");
+  const paths = [...identityFilesFor(host, sshDir, home), ...DEFAULT_KEYS.map((n) => join(sshDir, n))];
+  const keys = [];
+  for (const path of [...new Set(paths)]) {
+    const key = readText(path);
+    if (key === void 0 || !key.includes("PRIVATE KEY")) continue;
+    let problem;
+    try {
+      problem = privateKeyProblem(key);
+    } catch {
+      problem = "unreadable";
+    }
+    if (problem) continue;
+    keys.push({ key, label: path.startsWith(home) ? `~${path.slice(home.length)}` : path });
+  }
+  return keys;
+}
+
 // src/update.ts
-import { readFileSync } from "node:fs";
+import { readFileSync as readFileSync2 } from "node:fs";
 var PACKAGE_NAME = "dsh-vpn";
 var MIN_RELEASE_AGE_MS = 24 * 60 * 60 * 1e3;
 var NPM_REGISTRY = "https://registry.npmjs.org/";
 function currentVersion() {
   try {
-    const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    const pkg = JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : "0.0.0";
   } catch {
     return "0.0.0";
@@ -21056,7 +21197,7 @@ function toToolValue(r, uiLang) {
 function apply(ctx, config) {
   const service = new VpnService(
     new CredentialSettingsStore(ctx),
-    { timeoutMs: config.timeoutMs, acmeProvider: config.acmeProvider },
+    { timeoutMs: config.timeoutMs, acmeProvider: config.acmeProvider, localKeys: (host) => localKeysFor(host) },
     new CredentialKeyStore(ctx)
   );
   const uiLang = new UiLang();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vpn",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "DeepSeek Harness plugin: deploy an encrypted VPN (sing-box) to your own VPS in one click, to protect your connections and privacy on untrusted networks",
   "keywords": [
     "anytls",