dsh-vpn 0.1.11 → 0.1.13

package/README.md

@@ -35,7 +35,7 @@ dsh plugin --profile web add dsh-vpn
 
 1. 填写服务器 IP、SSH 端口、用户名、密码，点「保存」和「测试连接」。服务器只允许密钥登录的，见下面的「密钥登录」。
 2. 勾选要安装的协议，选择证书类型（推荐「IP 证书」），保存后点「安装 / 更新」。
-3. 在「节点二维码」里点「刷新二维码」，用手机或电脑上的客户端扫码导入。
+3. 在「节点二维码」里点「刷新二维码」，用手机或电脑上的客户端扫码导入。用 **sing-box 官方客户端**（Mac 版 SFM、iPhone 版 SFI、Android 版 SFA、Windows 版 SFW，1.14 及以上）的，点二维码上方的「下载配置文件」，在客户端里「新建配置 → 导入本地文件」，一次导入全部节点。官方客户端不能扫单条链接的二维码，用这个配置文件即可；配置里 TUIC 和 AnyTLS 已写入证书锁定，不需要跳过证书校验，默认自动选择延迟最低的节点。
 4. 服务器防火墙的端口由插件自动放行，不用手动操作；安装完成后提示框会列出放行了哪些端口。
 
 **密钥登录**：服务器只允许密钥登录时，把「登录方式」选成「密钥」。插件按这个顺序尝试登录，哪把被服务器认可就用哪把：
@@ -44,7 +44,7 @@ dsh plugin --profile web add dsh-vpn
 2. 本机已有的钥匙：`~/.ssh/config`（含 `config.d`）里为这台服务器配置的 `IdentityFile`，dsh-vps-manager 的 `~/.ssh/dsh_vps_ed25519`，以及 `~/.ssh/id_ed25519`、`id_ecdsa`、`id_rsa`；
 3. 插件的专用钥匙（纯 JS 生成，不需要本机的 ssh-keygen）。
 
-**已经用 dsh-vps-manager 管理的服务器不需要再放任何公钥**：它的钥匙已经在服务器上，直接点「检查已有安装」或「测试连接」即可，页面会列出本机找到的钥匙，测试连接成功后会说明用的是哪一把。本机钥匙都不被认可时，再把页面上显示的专用钥匙公钥放到服务器上（服务商后台的「SSH 密钥」，或在能登录的服务器上执行页面给出的一行命令）。私钥只在本机 dsh 里读取，不会发给页面；带密码短语的本机私钥会跳过。用非 root 用户时，「sudo 密码」一栏填该用户的 sudo 密码；root 或免密 sudo 不用填。
+**已经用 dsh-vps-manager 管理的服务器不需要再放任何公钥**：它的钥匙已经在服务器上。填好 IP，「登录方式」选「密钥」，页面会列出本机找到的钥匙，点这张卡片右上角的「使用」就登录了（不用先保存，登录成功后自动保存）。卡片随后一直显示「已登录：用哪把钥匙登录 用户@服务器」，之后安装、检查和刷新二维码都优先用这把钥匙；改了 IP、端口或用户名，登录状态自动作废。本机钥匙都不被认可时，再把页面上显示的专用钥匙公钥放到服务器上（服务商后台的「SSH 密钥」，或在能登录的服务器上执行页面给出的一行命令）。私钥只在本机 dsh 里读取，不会发给页面；带密码短语的本机私钥会跳过。用非 root 用户时，「sudo 密码」一栏填该用户的 sudo 密码；root 或免密 sudo 不用填。
 
 **找回已有节点**：重装过 dsh 或 dsh-vpn 后，本地保存的设置会丢失，但 VPS 上的节点还在运行。在 VPN 设置里填好服务器 IP、端口、用户名和密码（或选密钥登录），**不用先保存**，直接点登录方式下面的「检查已有安装」：插件登录服务器读取仍在运行的节点，显示原来的二维码（链接和以前完全一样，已经导入手机或电脑客户端的配置继续可用），按服务器上的实际情况勾选协议和证书类型，并自动保存设置。登录失败时什么都不保存，填的内容也不会被清掉。
 

package/lib/client.js

@@ -54,6 +54,8 @@ var vpnApi = {
   sshKey: (host = "") => post("/ssh-key", { host }),
   forgetHostKey: () => post("/host-key/forget"),
   test: () => post("/test"),
+  /** Log in with keys (local ones first) using the form as typed; saved once it works. */
+  login: (form) => post("/login", form),
   status: () => post("/status"),
   links: () => post("/links"),
   /** Find an earlier installation on the server and adopt its protocols and certificate mode. */
@@ -99,7 +101,11 @@ var zh = {
   keyIntro: "\u7528\u63D2\u4EF6\u7684\u4E13\u7528\u94A5\u5319\u767B\u5F55\u3002\u628A\u4E0B\u9762\u7684\u516C\u94A5\u653E\u5230\u670D\u52A1\u5668\u4E0A\uFF0C\u4EFB\u9009\u4E00\u79CD\u529E\u6CD5\uFF1A",
   keyIntroFallback: "\u5982\u679C\u670D\u52A1\u5668\u4E0D\u8BA4\u4E0A\u9762\u7684\u94A5\u5319\uFF0C\u518D\u7528\u63D2\u4EF6\u7684\u4E13\u7528\u94A5\u5319\uFF1A\u628A\u4E0B\u9762\u7684\u516C\u94A5\u653E\u5230\u670D\u52A1\u5668\u4E0A\uFF0C\u4EFB\u9009\u4E00\u79CD\u529E\u6CD5\uFF1A",
   localKeysFound: "\u672C\u673A\u5DF2\u6709\u7684\u94A5\u5319\uFF08\u4F1A\u5148\u7528\u5B83\u4EEC\u767B\u5F55\uFF09",
-  localKeysHint: "\u5305\u62EC ~/.ssh/config \u91CC\u4E3A\u8FD9\u53F0\u670D\u52A1\u5668\u914D\u7F6E\u7684\u94A5\u5319\u3001dsh-vps-manager \u7684 ~/.ssh/dsh_vps_ed25519 \u548C ~/.ssh/id_*\u3002\u670D\u52A1\u5668\u8BA4\u53EF\u5176\u4E2D\u4EFB\u4F55\u4E00\u628A\uFF0C\u5C31\u4E0D\u7528\u518D\u653E\u516C\u94A5\uFF0C\u76F4\u63A5\u70B9\u300C\u68C0\u67E5\u5DF2\u6709\u5B89\u88C5\u300D\u6216\u300C\u6D4B\u8BD5\u8FDE\u63A5\u300D\u3002\u79C1\u94A5\u53EA\u5728\u672C\u673A dsh \u91CC\u8BFB\u53D6\uFF0C\u4E0D\u4F1A\u53D1\u7ED9\u9875\u9762\u3002",
+  useKey: "\u4F7F\u7528",
+  relogin: "\u91CD\u65B0\u767B\u5F55",
+  loggingIn: "\u767B\u5F55\u4E2D\u2026",
+  loggedIn: "\u2713 \u5DF2\u767B\u5F55\uFF1A\u7528 {key} \u767B\u5F55 {user}@{host}\uFF08{time}\uFF09\u3002\u4E4B\u540E\u5B89\u88C5\u3001\u68C0\u67E5\u548C\u5237\u65B0\u4E8C\u7EF4\u7801\u90FD\u4F1A\u5148\u7528\u8FD9\u628A\u94A5\u5319\u3002",
+  localKeysHint: "\u5305\u62EC ~/.ssh/config \u91CC\u4E3A\u8FD9\u53F0\u670D\u52A1\u5668\u914D\u7F6E\u7684\u94A5\u5319\u3001dsh-vps-manager \u7684 ~/.ssh/dsh_vps_ed25519 \u548C ~/.ssh/id_*\u3002\u670D\u52A1\u5668\u8BA4\u53EF\u5176\u4E2D\u4EFB\u4F55\u4E00\u628A\uFF0C\u5C31\u4E0D\u7528\u518D\u653E\u516C\u94A5\uFF0C\u70B9\u53F3\u4E0A\u89D2\u300C\u4F7F\u7528\u300D\u5373\u53EF\u767B\u5F55\u3002\u79C1\u94A5\u53EA\u5728\u672C\u673A dsh \u91CC\u8BFB\u53D6\uFF0C\u4E0D\u4F1A\u53D1\u7ED9\u9875\u9762\u3002",
   testOkKey: "\uFF08\u7528 {key} \u767B\u5F55\uFF09",
   dedicatedKey: "\u63D2\u4EF6\u4E13\u7528\u94A5\u5319",
   keyWayConsole: "A. \u670D\u52A1\u5546\u540E\u53F0\u6DFB\u52A0\uFF08\u65B0\u673A\u5668\u63A8\u8350\uFF09",
@@ -160,7 +166,11 @@ var zh = {
   uninstalled: "\u5DF2\u5378\u8F7D\u3002",
   working: "\u6267\u884C\u4E2D\u2026",
   qrSection: "\u8282\u70B9\u4E8C\u7EF4\u7801",
-  qrHint: "\u7528 v2rayN\u3001NekoBox\u3001Shadowrocket\u3001sing-box\u3001Clash Meta \u7B49\u5BA2\u6237\u7AEF\u626B\u63CF\u5BFC\u5165\u3002\u4E8C\u7EF4\u7801\u7B49\u540C\u4E8E\u5BC6\u7801\uFF0C\u8BF7\u52FF\u5916\u4F20\u3002",
+  qrHint: "\u7528 Shadowrocket\uFF08\u5C0F\u706B\u7BAD\uFF09\u3001v2rayN\u3001NekoBox\u3001Clash Meta \u7B49\u5BA2\u6237\u7AEF\u626B\u63CF\u5BFC\u5165\u3002sing-box \u5B98\u65B9\u5BA2\u6237\u7AEF\u8BF7\u7528\u4E0B\u9762\u7684\u914D\u7F6E\u6587\u4EF6\u3002\u4E8C\u7EF4\u7801\u548C\u914D\u7F6E\u6587\u4EF6\u90FD\u7B49\u540C\u4E8E\u5BC6\u7801\uFF0C\u8BF7\u52FF\u5916\u4F20\u3002",
+  profileTitle: "sing-box \u5B98\u65B9\u5BA2\u6237\u7AEF\u914D\u7F6E",
+  profileDownload: "\u4E0B\u8F7D\u914D\u7F6E\u6587\u4EF6",
+  profileCopy: "\u590D\u5236\u914D\u7F6E",
+  profileHint: "\u4E00\u6B21\u5BFC\u5165\u5168\u90E8\u8282\u70B9\uFF0C\u9002\u7528\u4E8E sing-box \u5B98\u65B9\u5BA2\u6237\u7AEF 1.14 \u53CA\u4EE5\u4E0A\uFF08Mac \u7248 SFM\u3001iPhone \u7248 SFI\u3001Android \u7248 SFA\u3001Windows \u7248 SFW\uFF09\u3002\u5728\u5BA2\u6237\u7AEF\u91CC\u300C\u65B0\u5EFA\u914D\u7F6E \u2192 \u5BFC\u5165\u672C\u5730\u6587\u4EF6\u300D\u9009\u62E9 {file}\uFF08\u624B\u673A\u53EF\u4EE5\u7528\u9694\u7A7A\u6295\u9001\u6216\u6587\u4EF6 App \u4F20\u8FC7\u53BB\uFF09\u3002TUIC \u548C AnyTLS \u5DF2\u5199\u5165\u8BC1\u4E66\u9501\u5B9A\uFF0C\u4E0D\u9700\u8981\u8DF3\u8FC7\u8BC1\u4E66\u6821\u9A8C\uFF1B\u9ED8\u8BA4\u81EA\u52A8\u9009\u62E9\u5EF6\u8FDF\u6700\u4F4E\u7684\u8282\u70B9\u3002",
   detect: "\u68C0\u67E5\u5DF2\u6709\u5B89\u88C5",
   detecting: "\u6B63\u5728\u8BFB\u53D6\u670D\u52A1\u5668\u2026",
   detectHint: "\u91CD\u88C5\u8FC7 dsh \u6216\u672C\u63D2\u4EF6\uFF1F\u586B\u597D\u4E0A\u9762\u7684\u767B\u5F55\u4FE1\u606F\u76F4\u63A5\u70B9\u8FD9\u91CC\uFF08\u4E0D\u7528\u5148\u4FDD\u5B58\uFF09\uFF0C\u4F1A\u767B\u5F55\u670D\u52A1\u5668\u8BFB\u53D6\u4ECD\u5728\u8FD0\u884C\u7684\u8282\u70B9\uFF0C\u663E\u793A\u539F\u6765\u7684\u4E8C\u7EF4\u7801\uFF0C\u5E76\u81EA\u52A8\u4FDD\u5B58\u8BBE\u7F6E\u3002",
@@ -235,7 +245,11 @@ var en = {
   keyIntro: "Log in with the plugin's dedicated key. Put the public key below on the server, either way:",
   keyIntroFallback: "If the server accepts none of the keys above, use the plugin's dedicated key: put the public key below on the server, either way:",
   localKeysFound: "Keys already on this computer (tried first)",
-  localKeysHint: "The keys ~/.ssh/config names for this server, dsh-vps-manager's ~/.ssh/dsh_vps_ed25519 and ~/.ssh/id_*. If the server accepts any of them, nothing needs to be added: click Find existing install or Test connection. Private keys are read only by dsh on this computer and never sent to the page.",
+  useKey: "Use",
+  relogin: "Log in again",
+  loggingIn: "Logging in\u2026",
+  loggedIn: "\u2713 Logged in: {user}@{host} with {key} ({time}). Install, find and refresh will use this key first.",
+  localKeysHint: "The keys ~/.ssh/config names for this server, dsh-vps-manager's ~/.ssh/dsh_vps_ed25519 and ~/.ssh/id_*. If the server accepts any of them, nothing needs to be added: click Use at the top right to log in. Private keys are read only by dsh on this computer and never sent to the page.",
   testOkKey: " (logged in with {key})",
   dedicatedKey: "the plugin's dedicated key",
   keyWayConsole: "A. Add it in your provider's console (recommended for new machines)",
@@ -296,7 +310,11 @@ var en = {
   uninstalled: "Uninstalled.",
   working: "Working\u2026",
   qrSection: "Node QR codes",
-  qrHint: "Scan with v2rayN, NekoBox, Shadowrocket, sing-box, Clash Meta and similar apps. A QR code is as secret as a password.",
+  qrHint: "Scan with Shadowrocket, v2rayN, NekoBox, Clash Meta and similar apps. For the official sing-box apps use the profile below. QR codes and the profile are as secret as a password.",
+  profileTitle: "Profile for the official sing-box apps",
+  profileDownload: "Download profile",
+  profileCopy: "Copy profile",
+  profileHint: "All nodes in one import, for the official sing-box apps 1.14+ (SFM on Mac, SFI on iPhone, SFA on Android, SFW on Windows). In the app choose New Profile \u2192 Import local file and pick {file} (send it to a phone with AirDrop or the Files app). TUIC and AnyTLS have their certificates pinned, so nothing skips verification; the fastest node is chosen automatically.",
   detect: "Find existing install",
   detecting: "Reading the server\u2026",
   detectHint: "Reinstalled dsh or this plugin? Fill in the login details above and click here (no need to save first): it logs in, reads the node that is still running, shows its QR codes and saves the settings.",
@@ -395,6 +413,9 @@ var STYLES = `
   color: inherit; background: transparent; border: 1px solid var(--dsw-alias-border-l2, rgba(127,127,127,.3)); }
 .dshvpn-detect { display: flex; align-items: center; flex-wrap: wrap; gap: 10px; padding-top: 4px; }
 .dshvpn-detect small { flex: 1; min-width: 220px; }
+.dshvpn-keycard-head { display: flex; align-items: center; justify-content: space-between; gap: 10px; }
+.dshvpn-loggedin { font-size: 13px; color: var(--dsw-alias-state-success-primary, #2f855a); }
+.dshvpn-profile { margin: 10px 0 4px; }
 .dshvpn-section { display: flex; flex-direction: column; gap: 16px; }
 .dshvpn-section-head h2 { margin: 0; font-size: 18px; font-weight: 600; }
 .dshvpn-title-row { display: flex; align-items: center; flex-wrap: wrap; gap: 10px; margin-bottom: 4px; }
@@ -1106,6 +1127,106 @@ function renderSVG(data, options = {}) {
   return svg;
 }
 
+// src/client-profile.ts
+var NAMES = {
+  reality: "VLESS Reality",
+  hy2: "Hysteria2",
+  tuic: "TUIC v5",
+  anytls: "AnyTLS",
+  ss: "Shadowsocks 2022"
+};
+function base64UrlDecode(value) {
+  const b64 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const bin = atob(b64 + "=".repeat((4 - b64.length % 4) % 4));
+  return new TextDecoder().decode(Uint8Array.from(bin, (c) => c.charCodeAt(0)));
+}
+function outboundOf(item) {
+  const u = new URL(item.link);
+  const q = Object.fromEntries(u.searchParams);
+  const server = u.hostname.replace(/^\[|\]$/g, "");
+  const port = Number(u.port);
+  const user = decodeURIComponent(u.username);
+  const tls = (alpn) => ({
+    enabled: true,
+    server_name: q.sni,
+    ...alpn ? { alpn } : {},
+    ...item.pubkey_sha256 ? { certificate_public_key_sha256: [item.pubkey_sha256] } : {}
+  });
+  switch (item.id) {
+    case "reality":
+      return {
+        type: "vless",
+        server,
+        server_port: port,
+        uuid: user,
+        flow: q.flow,
+        tls: { enabled: true, server_name: q.sni, utls: { enabled: true, fingerprint: q.fp }, reality: { enabled: true, public_key: q.pbk, short_id: q.sid } }
+      };
+    case "hy2":
+      return { type: "hysteria2", server, server_port: port, password: user, tls: tls(["h3"]) };
+    case "tuic":
+      return {
+        type: "tuic",
+        server,
+        server_port: port,
+        uuid: user,
+        password: decodeURIComponent(u.password),
+        congestion_control: "bbr",
+        tls: tls(["h3"])
+      };
+    case "anytls":
+      return { type: "anytls", server, server_port: port, password: user, tls: tls() };
+    case "ss": {
+      const [method, ...rest] = base64UrlDecode(user).split(":");
+      return { type: "shadowsocks", server, server_port: port, method, password: rest.join(":") };
+    }
+  }
+}
+var AUTO_TAG = "\u81EA\u52A8\u9009\u62E9 Auto";
+var SELECT_TAG = "\u8282\u70B9\u9009\u62E9 Select";
+function singBoxProfile(links) {
+  const nodes = links.items.map((item) => ({ ...outboundOf(item), tag: `${NAMES[item.id]} \xB7 dsh-vpn` }));
+  const tags = nodes.map((n) => n.tag);
+  return {
+    log: { level: "warn" },
+    dns: {
+      servers: [
+        { type: "tls", tag: "dns-remote", server: "1.1.1.1", detour: SELECT_TAG },
+        { type: "local", tag: "dns-local" }
+      ],
+      final: "dns-remote"
+    },
+    inbounds: [{
+      type: "tun",
+      tag: "tun-in",
+      address: ["172.19.0.1/30", "fdfe:dcba:9876::1/126"],
+      auto_route: true,
+      strict_route: true,
+      stack: "mixed"
+    }],
+    outbounds: [
+      { type: "selector", tag: SELECT_TAG, outbounds: [AUTO_TAG, ...tags], default: AUTO_TAG },
+      { type: "urltest", tag: AUTO_TAG, outbounds: tags },
+      ...nodes,
+      { type: "direct", tag: "direct" }
+    ],
+    route: {
+      rules: [
+        { action: "sniff" },
+        { protocol: "dns", action: "hijack-dns" },
+        { ip_is_private: true, outbound: "direct" }
+      ],
+      final: SELECT_TAG,
+      auto_detect_interface: true,
+      default_domain_resolver: "dns-local"
+    },
+    experimental: { cache_file: { enabled: true } }
+  };
+}
+function profileFileName(links) {
+  return `dsh-vpn-${links.server.replace(/[^0-9a-z.-]/gi, "_")}.json`;
+}
+
 // src/protocols.ts
 var PROTOCOLS = [
   { id: "reality", name: "VLESS Reality", transport: "TCP", insecureLink: false, defaultSelected: true },
@@ -1180,7 +1301,19 @@ function Copyable({ text, label, t }) {
     }, children: copied ? t("copied") : label })
   ] });
 }
-function KeyPanel({ t, api, form, saved, set, setForm }) {
+function KeyPanel({ t, api, form, saved, set, setForm, disabled, onLoggedIn }) {
+  const [logging, setLogging] = (0, import_react.useState)(false);
+  const [loginError, setLoginError] = (0, import_react.useState)(null);
+  const loggedIn = saved.loginKey !== null && saved.host === form.host.trim() && saved.port === form.port && saved.username === form.username.trim();
+  const keyName = (label) => label === "own" ? t("ownKey") : label === "dsh-vpn" ? t("dedicatedKey") : label;
+  const login = async () => {
+    setLogging(true);
+    setLoginError(null);
+    const r = await api.login(form);
+    setLogging(false);
+    if (r.ok) onLoggedIn(r.settings);
+    else setLoginError(errorText(t, r));
+  };
   const [key, setKey] = (0, import_react.useState)(null);
   const ownStored = saved.hasPrivateKey && !form.clearPrivateKey;
   const [own, setOwn] = (0, import_react.useState)(ownStored);
@@ -1199,12 +1332,32 @@ function KeyPanel({ t, api, form, saved, set, setForm }) {
   const local = key?.localKeys ?? [];
   const preparing = t("working");
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keypanel dshvpn-wide", children: [
-    local.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard dshvpn-success", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("localKeysFound") }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { children: local.join("\n") }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("localKeysHint") })
+    (local.length > 0 || loggedIn) && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard dshvpn-success", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard-head", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("localKeysFound") }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          import_dsh_client_ui_primitives.Button,
+          {
+            size: "sm",
+            variant: loggedIn ? "outline" : "primary",
+            disabled: disabled || logging || form.host.trim() === "",
+            onClick: () => {
+              void login();
+            },
+            children: logging ? t("loggingIn") : loggedIn ? t("relogin") : t("useKey")
+          }
+        )
+      ] }),
+      loggedIn ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "dshvpn-loggedin", children: t("loggedIn", {
+        key: keyName(saved.loginKey),
+        user: saved.username,
+        host: saved.host,
+        time: saved.loggedInAt ? new Date(saved.loggedInAt).toLocaleString() : ""
+      }) }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { children: local.join("\n") }),
+      loginError && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "dshvpn-notice dshvpn-error", children: loginError }),
+      !loggedIn && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("localKeysHint") })
     ] }),
-    !own && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+    !own && !loggedIn && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "dshvpn-muted", children: local.length > 0 ? t("keyIntroFallback") : t("keyIntro") }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard", children: [
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("keyWayConsole") }),
@@ -1262,6 +1415,39 @@ function KeyPanel({ t, api, form, saved, set, setForm }) {
     ] })
   ] });
 }
+function ProfileCard({ links, t }) {
+  const [copied, setCopied] = (0, import_react.useState)(false);
+  const text = (0, import_react.useMemo)(() => JSON.stringify(singBoxProfile(links), null, 2), [links]);
+  const download = () => {
+    const url = URL.createObjectURL(new Blob([text], { type: "application/json" }));
+    const a = document.createElement("a");
+    a.href = url;
+    a.download = profileFileName(links);
+    document.body.append(a);
+    a.click();
+    a.remove();
+    setTimeout(() => {
+      URL.revokeObjectURL(url);
+    }, 1e4);
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard dshvpn-profile", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard-head", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("profileTitle") }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { className: "dshvpn-actions", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Button, { size: "sm", variant: "primary", onClick: download, children: t("profileDownload") }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Button, { size: "sm", variant: "outline", onClick: () => {
+          void (0, import_dsh_client_ui_primitives.writeClipboard)(text).then(() => {
+            setCopied(true);
+            setTimeout(() => {
+              setCopied(false);
+            }, 1500);
+          });
+        }, children: copied ? t("copied") : t("profileCopy") })
+      ] })
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("profileHint", { file: profileFileName(links) }) })
+  ] });
+}
 function QrCard({ item, t }) {
   const [copied, setCopied] = (0, import_react.useState)(false);
   const info = PROTOCOLS.find((p) => p.id === item.id);
@@ -1447,7 +1633,22 @@ ${t("cloudHint")}`;
             /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: m === "key" ? t("authKey") : t("authPassword") })
           ] }, m)) })
         ] }),
-        form.auth === "key" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(KeyPanel, { t, api, form, saved, set, setForm }),
+        form.auth === "key" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          KeyPanel,
+          {
+            t,
+            api,
+            form,
+            saved,
+            set,
+            setForm,
+            disabled,
+            onLoggedIn: (v) => {
+              setSaved(v);
+              setForm(formOf(v));
+            }
+          }
+        ),
         /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-wide dshvpn-detect", children: [
           /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Button, { variant: "primary", disabled: disabled || form.host.trim() === "", onClick: () => {
             void detect();
@@ -1639,7 +1840,10 @@ ${fw.backend === "none" ? t("fwNone") : t("fwStatus", { backend: fw.backend, cou
         ] })
       ] }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("qrHint") }),
-      links ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "dshvpn-qr-grid", children: links.items.map((item) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(QrCard, { item, t }, item.id)) }) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-qr-empty", children: [
+      links ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ProfileCard, { links, t }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "dshvpn-qr-grid", children: links.items.map((item) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(QrCard, { item, t }, item.id)) })
+      ] }) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-qr-empty", children: [
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "dshvpn-qr-empty-icon", "aria-hidden": "true", children: "\u25A6" }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: needsSave ? t("qrNeedsSave") : t("qrEmpty") }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_dsh_client_ui_primitives.Button, { variant: "primary", className: "dshvpn-refresh dshvpn-refresh-lg", disabled: disabled || needsSave, onClick: () => {

package/lib/index.js

@@ -20370,7 +20370,9 @@ var EMPTY_VIEW = {
   protocols: [...DEFAULT_PROTOCOLS],
   certMode: "self",
   linkAddress: "",
-  hostKey: null
+  hostKey: null,
+  loginKey: null,
+  loggedInAt: null
 };
 function publicView(s) {
   if (!s) return EMPTY_VIEW;
@@ -20385,7 +20387,9 @@ function publicView(s) {
     protocols: s.protocols,
     certMode: s.certMode,
     linkAddress: s.linkAddress ?? "",
-    hostKey: s.hostKey ?? null
+    hostKey: s.hostKey ?? null,
+    loginKey: s.auth === "key" ? s.loginKey ?? null : null,
+    loggedInAt: s.auth === "key" ? s.loggedInAt ?? null : null
   };
 }
 function applyInput(current, input) {
@@ -20436,7 +20440,9 @@ function applyInput(current, input) {
     protocols,
     certMode,
     linkAddress: linkAddress || void 0,
-    hostKey: sameMachine ? current.hostKey : void 0
+    hostKey: sameMachine ? current.hostKey : void 0,
+    // A login is remembered only for the same machine and user.
+    ...sameMachine && current.username === username && auth === "key" && current.loginKey ? { loginKey: current.loginKey, loggedInAt: current.loggedInAt } : {}
   };
 }
 var MemoryKeyStore = class {
@@ -20500,6 +20506,12 @@ function apiHandlers(service, uiLang, onUiLang, updater) {
       return { ok: true, settings: publicView(await service.store.get()) };
     },
     "/test": (_body, signal) => service.test(signal),
+    // 「使用」 on the local-keys card: key login with the form as typed; saved once it works.
+    "/login": async (body, signal) => {
+      const candidate = applyInput(await service.store.get(), { ...body, auth: "key" });
+      const r = await service.test(signal, candidate);
+      return r.ok ? { ...r, settings: publicView(await service.store.get()) } : r;
+    },
     "/status": (_body, signal) => service.status(signal),
     "/links": (_body, signal) => service.links(signal),
     // With form fields: try them as they are (no save needed first); they are
@@ -20617,6 +20629,8 @@ async function targetOf(s, keys, local = () => []) {
   } catch {
   }
   list.push({ key: (await keys.get()).privateKey, label: "dsh-vpn" });
+  const last = list.findIndex((k) => k.label === s.loginKey);
+  if (last > 0) list.unshift(...list.splice(last, 1));
   return { ...base, keys: list };
 }
 function resolveProtocols(requested, fallback) {
@@ -20771,13 +20785,15 @@ var VpnService = class {
   }
   /**
    * Log in, report who we are and whether root is reachable. Pins the host key
-   * on success, so the settings page can show it for the user to compare.
+   * and, for key login, remembers which key worked. With `candidate` (the
+   * settings page's 「使用」 on a local key) the form is tried as it is and
+   * stored only once the login works.
    */
-  test(signal) {
+  test(signal, candidate) {
     return this.exclusive(async () => {
       let session;
       try {
-        const s = await this.settings();
+        const s = candidate ?? await this.settings();
         session = await SshSession.open(await targetOf(s, this.keys, this.config.localKeys), signal);
         const asRoot = s.username === "root";
         const cmd = `echo "uid=$(${asRoot ? "" : `sudo -S -p '' `}id -u)"; echo "sys=$(uname -srm)"`;
@@ -20785,12 +20801,21 @@ var VpnService = class {
 `, signal);
         const uid = /^uid=(.*)$/m.exec(res.stdout)?.[1];
         const system = /^sys=(.*)$/m.exec(res.stdout)?.[1] ?? "";
-        await this.pin(s, session.hostKey);
         const root = uid === "0";
+        const hostKey = session.hostKey;
+        const login = s.auth === "key" && session.keyLabel ? { loginKey: session.keyLabel, loggedInAt: (/* @__PURE__ */ new Date()).toISOString() } : {};
+        if (candidate) {
+          if (root) await this.store.update(() => ({ ...candidate, hostKey: candidate.hostKey ?? (hostKey || void 0), ...login }));
+        } else {
+          await this.pin(s, hostKey);
+          if (root && login.loginKey) {
+            await this.store.update((cur) => cur && cur.host === s.host && cur.port === s.port && cur.username === s.username ? { ...cur, ...login } : void 0);
+          }
+        }
         return {
           ok: root,
           ...root ? {} : { error: "sudo_failed", message: `cannot become root as ${s.username}: ${res.stderr.trim()}` },
-          result: { hostKey: session.hostKey, system, root, ...session.keyLabel ? { key: session.keyLabel } : {} }
+          result: { hostKey, system, root, ...session.keyLabel ? { key: session.keyLabel } : {} }
         };
       } catch (err) {
         return failure(err);
@@ -20822,7 +20847,9 @@ function parse(payload) {
     protocols: protocols.length > 0 ? protocols : ["reality", "hy2"],
     certMode: p.certMode === "ip" ? "ip" : "self",
     linkAddress: typeof p.linkAddress === "string" ? p.linkAddress : void 0,
-    hostKey: typeof p.hostKey === "string" ? p.hostKey : void 0
+    hostKey: typeof p.hostKey === "string" ? p.hostKey : void 0,
+    loginKey: typeof p.loginKey === "string" ? p.loginKey : void 0,
+    loggedInAt: typeof p.loggedInAt === "string" ? p.loggedInAt : void 0
   };
 }
 var toPayload = (s) => JSON.parse(JSON.stringify(s));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vpn",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "DeepSeek Harness plugin: deploy an encrypted VPN (sing-box) to your own VPS in one click, to protect your connections and privacy on untrusted networks",
   "keywords": [
     "anytls",