dsh-vpn 0.1.11 → 0.1.12

package/README.md

@@ -44,7 +44,7 @@ dsh plugin --profile web add dsh-vpn
 2. 本机已有的钥匙：`~/.ssh/config`（含 `config.d`）里为这台服务器配置的 `IdentityFile`，dsh-vps-manager 的 `~/.ssh/dsh_vps_ed25519`，以及 `~/.ssh/id_ed25519`、`id_ecdsa`、`id_rsa`；
 3. 插件的专用钥匙（纯 JS 生成，不需要本机的 ssh-keygen）。
 
-**已经用 dsh-vps-manager 管理的服务器不需要再放任何公钥**：它的钥匙已经在服务器上，直接点「检查已有安装」或「测试连接」即可，页面会列出本机找到的钥匙，测试连接成功后会说明用的是哪一把。本机钥匙都不被认可时，再把页面上显示的专用钥匙公钥放到服务器上（服务商后台的「SSH 密钥」，或在能登录的服务器上执行页面给出的一行命令）。私钥只在本机 dsh 里读取，不会发给页面；带密码短语的本机私钥会跳过。用非 root 用户时，「sudo 密码」一栏填该用户的 sudo 密码；root 或免密 sudo 不用填。
+**已经用 dsh-vps-manager 管理的服务器不需要再放任何公钥**：它的钥匙已经在服务器上。填好 IP，「登录方式」选「密钥」，页面会列出本机找到的钥匙，点这张卡片右上角的「使用」就登录了（不用先保存，登录成功后自动保存）。卡片随后一直显示「已登录：用哪把钥匙登录 用户@服务器」，之后安装、检查和刷新二维码都优先用这把钥匙；改了 IP、端口或用户名，登录状态自动作废。本机钥匙都不被认可时，再把页面上显示的专用钥匙公钥放到服务器上（服务商后台的「SSH 密钥」，或在能登录的服务器上执行页面给出的一行命令）。私钥只在本机 dsh 里读取，不会发给页面；带密码短语的本机私钥会跳过。用非 root 用户时，「sudo 密码」一栏填该用户的 sudo 密码；root 或免密 sudo 不用填。
 
 **找回已有节点**：重装过 dsh 或 dsh-vpn 后，本地保存的设置会丢失，但 VPS 上的节点还在运行。在 VPN 设置里填好服务器 IP、端口、用户名和密码（或选密钥登录），**不用先保存**，直接点登录方式下面的「检查已有安装」：插件登录服务器读取仍在运行的节点，显示原来的二维码（链接和以前完全一样，已经导入手机或电脑客户端的配置继续可用），按服务器上的实际情况勾选协议和证书类型，并自动保存设置。登录失败时什么都不保存，填的内容也不会被清掉。
 

package/lib/client.js

@@ -54,6 +54,8 @@ var vpnApi = {
   sshKey: (host = "") => post("/ssh-key", { host }),
   forgetHostKey: () => post("/host-key/forget"),
   test: () => post("/test"),
+  /** Log in with keys (local ones first) using the form as typed; saved once it works. */
+  login: (form) => post("/login", form),
   status: () => post("/status"),
   links: () => post("/links"),
   /** Find an earlier installation on the server and adopt its protocols and certificate mode. */
@@ -99,7 +101,11 @@ var zh = {
   keyIntro: "\u7528\u63D2\u4EF6\u7684\u4E13\u7528\u94A5\u5319\u767B\u5F55\u3002\u628A\u4E0B\u9762\u7684\u516C\u94A5\u653E\u5230\u670D\u52A1\u5668\u4E0A\uFF0C\u4EFB\u9009\u4E00\u79CD\u529E\u6CD5\uFF1A",
   keyIntroFallback: "\u5982\u679C\u670D\u52A1\u5668\u4E0D\u8BA4\u4E0A\u9762\u7684\u94A5\u5319\uFF0C\u518D\u7528\u63D2\u4EF6\u7684\u4E13\u7528\u94A5\u5319\uFF1A\u628A\u4E0B\u9762\u7684\u516C\u94A5\u653E\u5230\u670D\u52A1\u5668\u4E0A\uFF0C\u4EFB\u9009\u4E00\u79CD\u529E\u6CD5\uFF1A",
   localKeysFound: "\u672C\u673A\u5DF2\u6709\u7684\u94A5\u5319\uFF08\u4F1A\u5148\u7528\u5B83\u4EEC\u767B\u5F55\uFF09",
-  localKeysHint: "\u5305\u62EC ~/.ssh/config \u91CC\u4E3A\u8FD9\u53F0\u670D\u52A1\u5668\u914D\u7F6E\u7684\u94A5\u5319\u3001dsh-vps-manager \u7684 ~/.ssh/dsh_vps_ed25519 \u548C ~/.ssh/id_*\u3002\u670D\u52A1\u5668\u8BA4\u53EF\u5176\u4E2D\u4EFB\u4F55\u4E00\u628A\uFF0C\u5C31\u4E0D\u7528\u518D\u653E\u516C\u94A5\uFF0C\u76F4\u63A5\u70B9\u300C\u68C0\u67E5\u5DF2\u6709\u5B89\u88C5\u300D\u6216\u300C\u6D4B\u8BD5\u8FDE\u63A5\u300D\u3002\u79C1\u94A5\u53EA\u5728\u672C\u673A dsh \u91CC\u8BFB\u53D6\uFF0C\u4E0D\u4F1A\u53D1\u7ED9\u9875\u9762\u3002",
+  useKey: "\u4F7F\u7528",
+  relogin: "\u91CD\u65B0\u767B\u5F55",
+  loggingIn: "\u767B\u5F55\u4E2D\u2026",
+  loggedIn: "\u2713 \u5DF2\u767B\u5F55\uFF1A\u7528 {key} \u767B\u5F55 {user}@{host}\uFF08{time}\uFF09\u3002\u4E4B\u540E\u5B89\u88C5\u3001\u68C0\u67E5\u548C\u5237\u65B0\u4E8C\u7EF4\u7801\u90FD\u4F1A\u5148\u7528\u8FD9\u628A\u94A5\u5319\u3002",
+  localKeysHint: "\u5305\u62EC ~/.ssh/config \u91CC\u4E3A\u8FD9\u53F0\u670D\u52A1\u5668\u914D\u7F6E\u7684\u94A5\u5319\u3001dsh-vps-manager \u7684 ~/.ssh/dsh_vps_ed25519 \u548C ~/.ssh/id_*\u3002\u670D\u52A1\u5668\u8BA4\u53EF\u5176\u4E2D\u4EFB\u4F55\u4E00\u628A\uFF0C\u5C31\u4E0D\u7528\u518D\u653E\u516C\u94A5\uFF0C\u70B9\u53F3\u4E0A\u89D2\u300C\u4F7F\u7528\u300D\u5373\u53EF\u767B\u5F55\u3002\u79C1\u94A5\u53EA\u5728\u672C\u673A dsh \u91CC\u8BFB\u53D6\uFF0C\u4E0D\u4F1A\u53D1\u7ED9\u9875\u9762\u3002",
   testOkKey: "\uFF08\u7528 {key} \u767B\u5F55\uFF09",
   dedicatedKey: "\u63D2\u4EF6\u4E13\u7528\u94A5\u5319",
   keyWayConsole: "A. \u670D\u52A1\u5546\u540E\u53F0\u6DFB\u52A0\uFF08\u65B0\u673A\u5668\u63A8\u8350\uFF09",
@@ -235,7 +241,11 @@ var en = {
   keyIntro: "Log in with the plugin's dedicated key. Put the public key below on the server, either way:",
   keyIntroFallback: "If the server accepts none of the keys above, use the plugin's dedicated key: put the public key below on the server, either way:",
   localKeysFound: "Keys already on this computer (tried first)",
-  localKeysHint: "The keys ~/.ssh/config names for this server, dsh-vps-manager's ~/.ssh/dsh_vps_ed25519 and ~/.ssh/id_*. If the server accepts any of them, nothing needs to be added: click Find existing install or Test connection. Private keys are read only by dsh on this computer and never sent to the page.",
+  useKey: "Use",
+  relogin: "Log in again",
+  loggingIn: "Logging in\u2026",
+  loggedIn: "\u2713 Logged in: {user}@{host} with {key} ({time}). Install, find and refresh will use this key first.",
+  localKeysHint: "The keys ~/.ssh/config names for this server, dsh-vps-manager's ~/.ssh/dsh_vps_ed25519 and ~/.ssh/id_*. If the server accepts any of them, nothing needs to be added: click Use at the top right to log in. Private keys are read only by dsh on this computer and never sent to the page.",
   testOkKey: " (logged in with {key})",
   dedicatedKey: "the plugin's dedicated key",
   keyWayConsole: "A. Add it in your provider's console (recommended for new machines)",
@@ -395,6 +405,8 @@ var STYLES = `
   color: inherit; background: transparent; border: 1px solid var(--dsw-alias-border-l2, rgba(127,127,127,.3)); }
 .dshvpn-detect { display: flex; align-items: center; flex-wrap: wrap; gap: 10px; padding-top: 4px; }
 .dshvpn-detect small { flex: 1; min-width: 220px; }
+.dshvpn-keycard-head { display: flex; align-items: center; justify-content: space-between; gap: 10px; }
+.dshvpn-loggedin { font-size: 13px; color: var(--dsw-alias-state-success-primary, #2f855a); }
 .dshvpn-section { display: flex; flex-direction: column; gap: 16px; }
 .dshvpn-section-head h2 { margin: 0; font-size: 18px; font-weight: 600; }
 .dshvpn-title-row { display: flex; align-items: center; flex-wrap: wrap; gap: 10px; margin-bottom: 4px; }
@@ -1180,7 +1192,19 @@ function Copyable({ text, label, t }) {
     }, children: copied ? t("copied") : label })
   ] });
 }
-function KeyPanel({ t, api, form, saved, set, setForm }) {
+function KeyPanel({ t, api, form, saved, set, setForm, disabled, onLoggedIn }) {
+  const [logging, setLogging] = (0, import_react.useState)(false);
+  const [loginError, setLoginError] = (0, import_react.useState)(null);
+  const loggedIn = saved.loginKey !== null && saved.host === form.host.trim() && saved.port === form.port && saved.username === form.username.trim();
+  const keyName = (label) => label === "own" ? t("ownKey") : label === "dsh-vpn" ? t("dedicatedKey") : label;
+  const login = async () => {
+    setLogging(true);
+    setLoginError(null);
+    const r = await api.login(form);
+    setLogging(false);
+    if (r.ok) onLoggedIn(r.settings);
+    else setLoginError(errorText(t, r));
+  };
   const [key, setKey] = (0, import_react.useState)(null);
   const ownStored = saved.hasPrivateKey && !form.clearPrivateKey;
   const [own, setOwn] = (0, import_react.useState)(ownStored);
@@ -1199,12 +1223,32 @@ function KeyPanel({ t, api, form, saved, set, setForm }) {
   const local = key?.localKeys ?? [];
   const preparing = t("working");
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keypanel dshvpn-wide", children: [
-    local.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard dshvpn-success", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("localKeysFound") }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { children: local.join("\n") }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("localKeysHint") })
+    (local.length > 0 || loggedIn) && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard dshvpn-success", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard-head", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("localKeysFound") }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          import_dsh_client_ui_primitives.Button,
+          {
+            size: "sm",
+            variant: loggedIn ? "outline" : "primary",
+            disabled: disabled || logging || form.host.trim() === "",
+            onClick: () => {
+              void login();
+            },
+            children: logging ? t("loggingIn") : loggedIn ? t("relogin") : t("useKey")
+          }
+        )
+      ] }),
+      loggedIn ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "dshvpn-loggedin", children: t("loggedIn", {
+        key: keyName(saved.loginKey),
+        user: saved.username,
+        host: saved.host,
+        time: saved.loggedInAt ? new Date(saved.loggedInAt).toLocaleString() : ""
+      }) }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { children: local.join("\n") }),
+      loginError && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "dshvpn-notice dshvpn-error", children: loginError }),
+      !loggedIn && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("localKeysHint") })
     ] }),
-    !own && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+    !own && !loggedIn && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "dshvpn-muted", children: local.length > 0 ? t("keyIntroFallback") : t("keyIntro") }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard", children: [
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("keyWayConsole") }),
@@ -1447,7 +1491,22 @@ ${t("cloudHint")}`;
             /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: m === "key" ? t("authKey") : t("authPassword") })
           ] }, m)) })
         ] }),
-        form.auth === "key" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(KeyPanel, { t, api, form, saved, set, setForm }),
+        form.auth === "key" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          KeyPanel,
+          {
+            t,
+            api,
+            form,
+            saved,
+            set,
+            setForm,
+            disabled,
+            onLoggedIn: (v) => {
+              setSaved(v);
+              setForm(formOf(v));
+            }
+          }
+        ),
         /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-wide dshvpn-detect", children: [
           /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Button, { variant: "primary", disabled: disabled || form.host.trim() === "", onClick: () => {
             void detect();

package/lib/index.js

@@ -20370,7 +20370,9 @@ var EMPTY_VIEW = {
   protocols: [...DEFAULT_PROTOCOLS],
   certMode: "self",
   linkAddress: "",
-  hostKey: null
+  hostKey: null,
+  loginKey: null,
+  loggedInAt: null
 };
 function publicView(s) {
   if (!s) return EMPTY_VIEW;
@@ -20385,7 +20387,9 @@ function publicView(s) {
     protocols: s.protocols,
     certMode: s.certMode,
     linkAddress: s.linkAddress ?? "",
-    hostKey: s.hostKey ?? null
+    hostKey: s.hostKey ?? null,
+    loginKey: s.auth === "key" ? s.loginKey ?? null : null,
+    loggedInAt: s.auth === "key" ? s.loggedInAt ?? null : null
   };
 }
 function applyInput(current, input) {
@@ -20436,7 +20440,9 @@ function applyInput(current, input) {
     protocols,
     certMode,
     linkAddress: linkAddress || void 0,
-    hostKey: sameMachine ? current.hostKey : void 0
+    hostKey: sameMachine ? current.hostKey : void 0,
+    // A login is remembered only for the same machine and user.
+    ...sameMachine && current.username === username && auth === "key" && current.loginKey ? { loginKey: current.loginKey, loggedInAt: current.loggedInAt } : {}
   };
 }
 var MemoryKeyStore = class {
@@ -20500,6 +20506,12 @@ function apiHandlers(service, uiLang, onUiLang, updater) {
       return { ok: true, settings: publicView(await service.store.get()) };
     },
     "/test": (_body, signal) => service.test(signal),
+    // 「使用」 on the local-keys card: key login with the form as typed; saved once it works.
+    "/login": async (body, signal) => {
+      const candidate = applyInput(await service.store.get(), { ...body, auth: "key" });
+      const r = await service.test(signal, candidate);
+      return r.ok ? { ...r, settings: publicView(await service.store.get()) } : r;
+    },
     "/status": (_body, signal) => service.status(signal),
     "/links": (_body, signal) => service.links(signal),
     // With form fields: try them as they are (no save needed first); they are
@@ -20617,6 +20629,8 @@ async function targetOf(s, keys, local = () => []) {
   } catch {
   }
   list.push({ key: (await keys.get()).privateKey, label: "dsh-vpn" });
+  const last = list.findIndex((k) => k.label === s.loginKey);
+  if (last > 0) list.unshift(...list.splice(last, 1));
   return { ...base, keys: list };
 }
 function resolveProtocols(requested, fallback) {
@@ -20771,13 +20785,15 @@ var VpnService = class {
   }
   /**
    * Log in, report who we are and whether root is reachable. Pins the host key
-   * on success, so the settings page can show it for the user to compare.
+   * and, for key login, remembers which key worked. With `candidate` (the
+   * settings page's 「使用」 on a local key) the form is tried as it is and
+   * stored only once the login works.
    */
-  test(signal) {
+  test(signal, candidate) {
     return this.exclusive(async () => {
       let session;
       try {
-        const s = await this.settings();
+        const s = candidate ?? await this.settings();
         session = await SshSession.open(await targetOf(s, this.keys, this.config.localKeys), signal);
         const asRoot = s.username === "root";
         const cmd = `echo "uid=$(${asRoot ? "" : `sudo -S -p '' `}id -u)"; echo "sys=$(uname -srm)"`;
@@ -20785,12 +20801,21 @@ var VpnService = class {
 `, signal);
         const uid = /^uid=(.*)$/m.exec(res.stdout)?.[1];
         const system = /^sys=(.*)$/m.exec(res.stdout)?.[1] ?? "";
-        await this.pin(s, session.hostKey);
         const root = uid === "0";
+        const hostKey = session.hostKey;
+        const login = s.auth === "key" && session.keyLabel ? { loginKey: session.keyLabel, loggedInAt: (/* @__PURE__ */ new Date()).toISOString() } : {};
+        if (candidate) {
+          if (root) await this.store.update(() => ({ ...candidate, hostKey: candidate.hostKey ?? (hostKey || void 0), ...login }));
+        } else {
+          await this.pin(s, hostKey);
+          if (root && login.loginKey) {
+            await this.store.update((cur) => cur && cur.host === s.host && cur.port === s.port && cur.username === s.username ? { ...cur, ...login } : void 0);
+          }
+        }
         return {
           ok: root,
           ...root ? {} : { error: "sudo_failed", message: `cannot become root as ${s.username}: ${res.stderr.trim()}` },
-          result: { hostKey: session.hostKey, system, root, ...session.keyLabel ? { key: session.keyLabel } : {} }
+          result: { hostKey, system, root, ...session.keyLabel ? { key: session.keyLabel } : {} }
         };
       } catch (err) {
         return failure(err);
@@ -20822,7 +20847,9 @@ function parse(payload) {
     protocols: protocols.length > 0 ? protocols : ["reality", "hy2"],
     certMode: p.certMode === "ip" ? "ip" : "self",
     linkAddress: typeof p.linkAddress === "string" ? p.linkAddress : void 0,
-    hostKey: typeof p.hostKey === "string" ? p.hostKey : void 0
+    hostKey: typeof p.hostKey === "string" ? p.hostKey : void 0,
+    loginKey: typeof p.loginKey === "string" ? p.loginKey : void 0,
+    loggedInAt: typeof p.loggedInAt === "string" ? p.loggedInAt : void 0
   };
 }
 var toPayload = (s) => JSON.parse(JSON.stringify(s));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vpn",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "DeepSeek Harness plugin: deploy an encrypted VPN (sing-box) to your own VPS in one click, to protect your connections and privacy on untrusted networks",
   "keywords": [
     "anytls",