dsh-vpn 0.1.7 → 0.1.9

package/README.md

@@ -1,6 +1,6 @@
 # dsh-vpn
 
-[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 插件：在**你自己的 VPS** 上一键部署加密的 VPN 服务，保护你的网络连接安全。在 dsh 里填好 VPS 的 IP、端口、用户名和密码，一键部署 sing-box，然后扫二维码导入手机或电脑上的客户端。
+[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 插件：在**你自己的 VPS** 上一键部署加密的 VPN 服务，保护你的网络连接安全。在 dsh 里填好 VPS 的 IP、端口、用户名和密码（或用密钥登录），一键部署 sing-box，然后扫二维码导入手机或电脑上的客户端。
 
 ## 用途：保护你的网络安全
 
@@ -13,7 +13,7 @@
 
 ## 特性
 
-- **不依赖本机的 ssh 命令**：内置纯 JS 的 SSH 客户端（[ssh2](https://github.com/mscdex/ssh2)），用密码登录。
+- **不依赖本机的 ssh 命令**：内置纯 JS 的 SSH 客户端（[ssh2](https://github.com/mscdex/ssh2)），支持密码登录和密钥登录。
 - **两种用法**：在设置页点按钮，或者直接对 agent 说“帮我装个节点”。
 - **五种协议可选**：VLESS Reality、Hysteria2（默认）、TUIC v5、AnyTLS、Shadowsocks 2022。
 - **免域名的正规证书**：可选 Let's Encrypt 为服务器 IP 签发的证书，所有客户端都能正常校验证书。
@@ -33,12 +33,19 @@ dsh plugin --profile web add dsh-vpn
 
 在 VPN 设置里：
 
-1. 填写服务器 IP、SSH 端口、用户名、密码，点「保存」和「测试连接」。
+1. 填写服务器 IP、SSH 端口、用户名、密码，点「保存」和「测试连接」。服务器只允许密钥登录的，见下面的「密钥登录」。
 2. 勾选要安装的协议，选择证书类型（推荐「IP 证书」），保存后点「安装 / 更新」。
 3. 在「节点二维码」里点「刷新二维码」，用手机或电脑上的客户端扫码导入。
 4. 服务器防火墙的端口由插件自动放行，不用手动操作；安装完成后提示框会列出放行了哪些端口。
 
-**找回已有节点**：如果重装过 dsh 或 dsh-vpn，本地保存的设置会丢失，但 VPS 上的节点还在。重新填写服务器 IP、端口、用户名和密码后点「保存」，插件会自动检查这台服务器上是否已有安装（也可以随时点「检查已有安装」）。找到后直接显示原来的节点二维码，并按服务器上的实际情况勾选协议和证书类型，已经导入手机或电脑客户端的配置可以继续使用，不用重新扫码。
+**密钥登录**：服务器只允许密钥登录（或者你不想保存密码）时，把「登录方式」选成「密钥」。插件会生成一把专用钥匙（纯 JS 生成，不需要本机的 ssh-keygen），页面上显示它的公钥，任选一种办法放到服务器上：
+
+- A. 粘到服务商后台的「SSH 密钥」里，重装系统时勾选它（新机器推荐）；
+- B. 已经能登录服务器的（网页控制台或别的终端），复制页面上的一行命令粘贴执行。
+
+放好后点「保存」和「测试连接」。已经有自己的私钥、服务器上也放好了对应公钥的，展开「改用我自己已有的私钥」粘贴进去即可（支持带密码短语的私钥）。用非 root 用户时，「sudo 密码」一栏填该用户的 sudo 密码；root 或免密 sudo 不用填。
+
+**找回已有节点**：重装过 dsh 或 dsh-vpn 后，本地保存的设置会丢失，但 VPS 上的节点还在运行。在 VPN 设置里填好服务器 IP、端口、用户名和密码（或选密钥登录），**不用先保存**，直接点登录方式下面的「检查已有安装」：插件登录服务器读取仍在运行的节点，显示原来的二维码（链接和以前完全一样，已经导入手机或电脑客户端的配置继续可用），按服务器上的实际情况勾选协议和证书类型，并自动保存设置。登录失败时什么都不保存，填的内容也不会被清掉。
 
 页面第一行显示插件版本，有新版本时旁边会提示，点「更新」即可升级插件，重启 dsh 后生效（需要 dsh 0.2 及以上；更早的版本请在「设置 → 插件」中更新）。为了供应链安全，发布不足 24 小时的新版本会等满 24 小时再提供更新。
 
@@ -84,7 +91,8 @@ IP 证书由 sing-box 1.14 内置的 ACME 向 Let's Encrypt 申请（[2026 年
 
 | 方面 | 做法 |
 |---|---|
-| 密码存储 | 存在 dsh 凭据库（`$DSH_HOME/.credentials.yaml`，权限 0600），不写进配置文件；浏览器只能写入，读不回来 |
+| 密码和私钥 | 存在 dsh 凭据库（`$DSH_HOME/.credentials.yaml`，权限 0600），不写进配置文件；浏览器只能写入，读不回来（专用钥匙只向页面提供公钥） |
+| 登录方式 | 只用你选定的一种：选了密钥就只用密钥，不会退回密码；不使用键盘交互登录或 ssh-agent |
 | 接口鉴权 | 设置页的接口挂在 dsh 自己的 `/api` 下，复用 dsh 的登录 cookie 和防跨站、防 DNS rebinding 检查 |
 | 主机指纹 | 首次连接时记录 SSH 主机指纹，之后指纹变化就拒绝连接，防止中间人截获密码 |
 | sudo | 非 root 用户用 `sudo -S`：密码只经 stdin 传入，不会出现在命令行，也不会传给脚本 |

package/assets/vpn-ops.md

@@ -1,6 +1,6 @@
 # vpn-ops
 
-Deploy and operate a personal, encrypted VPN (sing-box) on the user's own VPS. The plugin logs in over SSH with the password saved in dsh Settings (bottom-left gear) → VPN 设置. No local ssh client is needed.
+Deploy and operate a personal, encrypted VPN (sing-box) on the user's own VPS. The plugin logs in over SSH with the password or key saved in dsh Settings (bottom-left gear) → VPN 设置. No local ssh client is needed.
 
 ## Purpose
 
@@ -33,7 +33,8 @@ The settings page offers **self-signed** (default) or **IP certificate** (recomm
 
 | Error / symptom | Likely cause | What to do |
 |---|---|---|
-| `auth_failed` | Wrong username or password | User fixes it on the settings page |
+| `auth_failed` | Wrong username or password, or the server only allows key login | User fixes it on the settings page (Login method → Key) |
+| `key_rejected` | The server did not accept the key | User puts the public key shown on the settings page into authorized_keys |
 | `host_key_mismatch` | Server reinstalled or replaced, or a man-in-the-middle | Ask whether the server was reinstalled. Only then may the user click 重置指纹 (Reset fingerprint) |
 | `connect_failed` / `timeout` | Wrong IP or port, SSH not reachable, server down | Check the IP and SSH port on the settings page |
 | `sudo_failed` | User is not root and lacks sudo, or the sudo password differs | Use root, or grant sudo |

package/lib/client.js

@@ -50,12 +50,14 @@ async function post(path, body = {}) {
 var vpnApi = {
   getSettings: () => post("/settings/get"),
   saveSettings: (form) => post("/settings/save", form),
+  /** Public half of the plugin's dedicated key and the line that installs it. */
+  sshKey: () => post("/ssh-key"),
   forgetHostKey: () => post("/host-key/forget"),
   test: () => post("/test"),
   status: () => post("/status"),
   links: () => post("/links"),
   /** Find an earlier installation on the server and adopt its protocols and certificate mode. */
-  detect: () => post("/detect"),
+  detect: (form) => post("/detect", form ?? {}),
   install: (regenerate) => post("/install", { regenerate }),
   uninstall: () => post("/uninstall"),
   /** Installed version; with `check`, also the newest release on npm. */
@@ -89,6 +91,26 @@ var zh = {
   port: "SSH \u7AEF\u53E3",
   username: "\u7528\u6237\u540D",
   usernameHint: "\u5EFA\u8BAE\u7528 root\uFF1B\u5176\u4ED6\u7528\u6237\u9700\u8981\u6709 sudo \u6743\u9650\u3002",
+  authMethod: "\u767B\u5F55\u65B9\u5F0F",
+  authPassword: "\u5BC6\u7801",
+  authKey: "\u5BC6\u94A5\uFF08\u670D\u52A1\u5668\u53EA\u5141\u8BB8\u5BC6\u94A5\u767B\u5F55\u65F6\u9009\u8FD9\u4E2A\uFF09",
+  sudoPassword: "sudo \u5BC6\u7801\uFF08\u9009\u586B\uFF09",
+  sudoPasswordEmpty: "\u7528 root \u6216\u514D\u5BC6 sudo \u65F6\u4E0D\u7528\u586B",
+  keyIntro: "\u7528\u63D2\u4EF6\u7684\u4E13\u7528\u94A5\u5319\u767B\u5F55\u3002\u628A\u4E0B\u9762\u7684\u516C\u94A5\u653E\u5230\u670D\u52A1\u5668\u4E0A\uFF0C\u4EFB\u9009\u4E00\u79CD\u529E\u6CD5\uFF1A",
+  keyWayConsole: "A. \u670D\u52A1\u5546\u540E\u53F0\u6DFB\u52A0\uFF08\u65B0\u673A\u5668\u63A8\u8350\uFF09",
+  keyWayConsoleHint: "\u7C98\u5230\u670D\u52A1\u5546\u7684\u300CSSH \u5BC6\u94A5\u300D\u91CC\uFF0C\u91CD\u88C5\u7CFB\u7EDF\u65F6\u52FE\u9009\u5B83\u3002",
+  keyWayCommand: "B. \u5DF2\u7ECF\u80FD\u767B\u5F55\uFF08\u7F51\u9875\u63A7\u5236\u53F0\u6216\u522B\u7684\u7EC8\u7AEF\uFF09",
+  keyWayCommandHint: "\u4EE5 {user} \u8EAB\u4EFD\u767B\u5F55\u670D\u52A1\u5668\uFF0C\u7C98\u8D34\u6267\u884C\u8FD9\u4E00\u884C\u3002",
+  keyThen: "\u653E\u597D\u540E\u70B9\u300C\u4FDD\u5B58\u300D\uFF0C\u518D\u70B9\u300C\u6D4B\u8BD5\u8FDE\u63A5\u300D\u3002",
+  copyPublicKey: "\u590D\u5236\u516C\u94A5",
+  copyCommand: "\u590D\u5236\u547D\u4EE4",
+  ownKeyToggle: "\u6539\u7528\u6211\u81EA\u5DF1\u5DF2\u6709\u7684\u79C1\u94A5",
+  ownKeyBack: "\u6539\u56DE\u63D2\u4EF6\u4E13\u7528\u94A5\u5319",
+  ownKey: "\u6211\u81EA\u5DF1\u7684\u79C1\u94A5",
+  ownKeyHint: "\u7C98\u8D34 OpenSSH \u6216 PEM \u683C\u5F0F\u7684\u79C1\u94A5\uFF08\u670D\u52A1\u5668\u4E0A\u5DF2\u7ECF\u653E\u4E86\u5B83\u5BF9\u5E94\u7684\u516C\u94A5\uFF09\u3002\u53EA\u4FDD\u5B58\u5728\u672C\u673A dsh \u7684\u51ED\u636E\u5E93\u91CC\uFF0C\u4E0D\u4F1A\u663E\u793A\u56DE\u9875\u9762\u3002",
+  ownKeySaved: "\u5DF2\u4FDD\u5B58\uFF08\u7559\u7A7A\u5219\u4E0D\u4FEE\u6539\uFF09",
+  passphrase: "\u79C1\u94A5\u5BC6\u7801\u77ED\u8BED\uFF08\u9009\u586B\uFF09",
+  passphraseHint: "\u79C1\u94A5\u6CA1\u6709\u52A0\u5BC6\u5C31\u4E0D\u7528\u586B",
   password: "\u5BC6\u7801",
   passwordSaved: "\u5DF2\u4FDD\u5B58\uFF08\u7559\u7A7A\u5219\u4E0D\u4FEE\u6539\uFF09",
   passwordEmpty: "\u767B\u5F55 VPS \u7684\u5BC6\u7801",
@@ -135,6 +157,8 @@ var zh = {
   qrSection: "\u8282\u70B9\u4E8C\u7EF4\u7801",
   qrHint: "\u7528 v2rayN\u3001NekoBox\u3001Shadowrocket\u3001sing-box\u3001Clash Meta \u7B49\u5BA2\u6237\u7AEF\u626B\u63CF\u5BFC\u5165\u3002\u4E8C\u7EF4\u7801\u7B49\u540C\u4E8E\u5BC6\u7801\uFF0C\u8BF7\u52FF\u5916\u4F20\u3002",
   detect: "\u68C0\u67E5\u5DF2\u6709\u5B89\u88C5",
+  detecting: "\u6B63\u5728\u8BFB\u53D6\u670D\u52A1\u5668\u2026",
+  detectHint: "\u91CD\u88C5\u8FC7 dsh \u6216\u672C\u63D2\u4EF6\uFF1F\u586B\u597D\u4E0A\u9762\u7684\u767B\u5F55\u4FE1\u606F\u76F4\u63A5\u70B9\u8FD9\u91CC\uFF08\u4E0D\u7528\u5148\u4FDD\u5B58\uFF09\uFF0C\u4F1A\u767B\u5F55\u670D\u52A1\u5668\u8BFB\u53D6\u4ECD\u5728\u8FD0\u884C\u7684\u8282\u70B9\uFF0C\u663E\u793A\u539F\u6765\u7684\u4E8C\u7EF4\u7801\uFF0C\u5E76\u81EA\u52A8\u4FDD\u5B58\u8BBE\u7F6E\u3002",
   detectFound: "\u5DF2\u627E\u5230\u4E4B\u524D\u7684\u5B89\u88C5\uFF1Asing-box {version}\uFF0C\u534F\u8BAE\uFF1A{protocols}\uFF08{cert}\uFF09\u3002\u8282\u70B9\u4E8C\u7EF4\u7801\u5DF2\u663E\u793A\u5728\u4E0B\u65B9\uFF0C\u539F\u6709\u7684\u5BA2\u6237\u7AEF\u914D\u7F6E\u53EF\u4EE5\u7EE7\u7EED\u4F7F\u7528\u3002",
   detectSynced: "\u5DF2\u6309\u670D\u52A1\u5668\u4E0A\u7684\u5B9E\u9645\u60C5\u51B5\u66F4\u65B0\u4E86\u534F\u8BAE\u52FE\u9009\u548C\u8BC1\u4E66\u7C7B\u578B\u3002",
   detectNone: "\u8FD9\u53F0\u670D\u52A1\u5668\u4E0A\u6CA1\u6709\u627E\u5230\u4E4B\u524D\u7684\u5B89\u88C5\uFF0C\u53EF\u4EE5\u76F4\u63A5\u70B9\u300C\u5B89\u88C5 / \u66F4\u65B0\u300D\u3002",
@@ -152,7 +176,8 @@ var zh = {
   fwStatus: "\u670D\u52A1\u5668\u9632\u706B\u5899\uFF08{backend}\uFF09\u5DF2\u653E\u884C {count} \u4E2A\u7AEF\u53E3\uFF0C\u91CD\u542F\u540E\u81EA\u52A8\u6062\u590D\u3002",
   cloudHint: "\u5982\u679C\u4E91\u670D\u52A1\u5546\u6709\u5B89\u5168\u7EC4\uFF08\u963F\u91CC\u4E91\u3001\u817E\u8BAF\u4E91\u3001AWS \u7B49\uFF09\uFF0C\u8FD9\u4E9B\u7AEF\u53E3\u8FD8\u9700\u5728\u5176\u63A7\u5236\u53F0\u653E\u884C\u3002",
   "err.not_configured": "\u8BF7\u5148\u586B\u5199\u5E76\u4FDD\u5B58\u670D\u52A1\u5668\u4FE1\u606F\u3002",
-  "err.auth_failed": "SSH \u767B\u5F55\u5931\u8D25\uFF1A\u7528\u6237\u540D\u6216\u5BC6\u7801\u9519\u8BEF\u3002",
+  "err.auth_failed": "SSH \u767B\u5F55\u5931\u8D25\uFF1A\u7528\u6237\u540D\u6216\u5BC6\u7801\u9519\u8BEF\u3002\u5982\u679C\u670D\u52A1\u5668\u53EA\u5141\u8BB8\u5BC6\u94A5\u767B\u5F55\uFF0C\u8BF7\u628A\u300C\u767B\u5F55\u65B9\u5F0F\u300D\u6539\u6210\u300C\u5BC6\u94A5\u300D\u3002",
+  "err.key_rejected": "SSH \u767B\u5F55\u5931\u8D25\uFF1A\u670D\u52A1\u5668\u6CA1\u6709\u63A5\u53D7\u8FD9\u628A\u94A5\u5319\u3002\u8BF7\u786E\u8BA4\u516C\u94A5\u5DF2\u653E\u5230\u8BE5\u7528\u6237\u7684 ~/.ssh/authorized_keys \u91CC\uFF0C\u7528\u6237\u540D\u586B\u5199\u6B63\u786E\u3002",
   "err.host_key_mismatch": "\u670D\u52A1\u5668\u6307\u7EB9\u4E0E\u4E0A\u6B21\u4E0D\u540C\uFF0C\u5DF2\u62D2\u7EDD\u8FDE\u63A5\u3002\u5982\u679C\u4F60\u91CD\u88C5\u4E86\u7CFB\u7EDF\u6216\u6362\u4E86\u673A\u5668\uFF0C\u8BF7\u70B9\u300C\u91CD\u7F6E\u6307\u7EB9\u300D\u540E\u91CD\u8BD5\u3002",
   "err.connect_failed": "\u65E0\u6CD5\u8FDE\u63A5\u670D\u52A1\u5668\uFF1A{message}",
   "err.timeout": "\u64CD\u4F5C\u8D85\u65F6\u3002",
@@ -170,6 +195,8 @@ var zh = {
   "field.port": "SSH \u7AEF\u53E3\u9700\u5728 1\u201365535 \u4E4B\u95F4\u3002",
   "field.username": "\u7528\u6237\u540D\u683C\u5F0F\u4E0D\u6B63\u786E\u3002",
   "field.password": "\u8BF7\u586B\u5199\u5BC6\u7801\u3002",
+  "field.auth": "\u767B\u5F55\u65B9\u5F0F\u4E0D\u6B63\u786E\u3002",
+  "field.privateKey": "\u79C1\u94A5\u65E0\u6CD5\u4F7F\u7528\uFF1A\u683C\u5F0F\u4E0D\u5BF9\uFF0C\u6216\u8005\u5BC6\u7801\u77ED\u8BED\u4E0D\u6B63\u786E\u3002",
   "field.protocols": "\u8BF7\u81F3\u5C11\u52FE\u9009\u4E00\u4E2A\u534F\u8BAE\u3002",
   "field.linkAddress": "\u8282\u70B9\u5730\u5740\u683C\u5F0F\u4E0D\u6B63\u786E\u3002",
   "field.certMode": "IP \u8BC1\u4E66\u9700\u8981\u7528 IP \u5730\u5740\u4F5C\u4E3A\u8282\u70B9\u5730\u5740\uFF1A\u8BF7\u628A\u300C\u8282\u70B9\u5730\u5740\u300D\u7559\u7A7A\uFF08\u4F7F\u7528\u670D\u52A1\u5668 IP\uFF09\u6216\u586B\u5199 IP\uFF0C\u6216\u6539\u7528\u81EA\u7B7E\u8BC1\u4E66\u3002"
@@ -195,6 +222,26 @@ var en = {
   port: "SSH port",
   username: "Username",
   usernameHint: "root is recommended; other users need sudo.",
+  authMethod: "Login method",
+  authPassword: "Password",
+  authKey: "Key (choose this if the server only allows key login)",
+  sudoPassword: "sudo password (optional)",
+  sudoPasswordEmpty: "Not needed for root or passwordless sudo",
+  keyIntro: "Log in with the plugin's dedicated key. Put the public key below on the server, either way:",
+  keyWayConsole: "A. Add it in your provider's console (recommended for new machines)",
+  keyWayConsoleHint: `Paste it into your provider's "SSH keys" and select it when reinstalling the OS.`,
+  keyWayCommand: "B. If you can already log in (web console or another terminal)",
+  keyWayCommandHint: "Log in to the server as {user} and paste and run this line.",
+  keyThen: "Then click Save, then Test connection.",
+  copyPublicKey: "Copy public key",
+  copyCommand: "Copy command",
+  ownKeyToggle: "Use my own existing private key instead",
+  ownKeyBack: "Back to the plugin's dedicated key",
+  ownKey: "My own private key",
+  ownKeyHint: "Paste an OpenSSH or PEM private key whose public key is already on the server. It is kept only in dsh's local credential store and never shown again.",
+  ownKeySaved: "Saved (leave blank to keep)",
+  passphrase: "Key passphrase (optional)",
+  passphraseHint: "Leave empty if the key is not encrypted",
   password: "Password",
   passwordSaved: "Saved (leave blank to keep)",
   passwordEmpty: "Password for the VPS",
@@ -241,6 +288,8 @@ var en = {
   qrSection: "Node QR codes",
   qrHint: "Scan with v2rayN, NekoBox, Shadowrocket, sing-box, Clash Meta and similar apps. A QR code is as secret as a password.",
   detect: "Find existing install",
+  detecting: "Reading the server\u2026",
+  detectHint: "Reinstalled dsh or this plugin? Fill in the login details above and click here (no need to save first): it logs in, reads the node that is still running, shows its QR codes and saves the settings.",
   detectFound: "Found an earlier installation: sing-box {version}, protocols: {protocols} ({cert}). Its QR codes are shown below; clients you already set up keep working.",
   detectSynced: "The protocol selection and certificate type now match the server.",
   detectNone: "No earlier installation was found on this server. Click Install / Update to set one up.",
@@ -258,7 +307,8 @@ var en = {
   fwStatus: "Server firewall ({backend}) has {count} ports opened; re-applied after reboots.",
   cloudHint: "If your cloud provider has a security group (Aliyun, Tencent Cloud, AWS\u2026), also open these ports in its console.",
   "err.not_configured": "Fill in and save the server details first.",
-  "err.auth_failed": "SSH login failed: wrong username or password.",
+  "err.auth_failed": "SSH login failed: wrong username or password. If the server only allows key login, set Login method to Key.",
+  "err.key_rejected": "SSH login failed: the server did not accept the key. Check that the public key is in that user's ~/.ssh/authorized_keys and the username is right.",
   "err.host_key_mismatch": 'The server fingerprint changed, so the connection was refused. If you reinstalled or replaced the server, click "Reset fingerprint" and retry.',
   "err.connect_failed": "Cannot connect to the server: {message}",
   "err.timeout": "The operation timed out.",
@@ -276,6 +326,8 @@ var en = {
   "field.port": "The SSH port must be 1\u201365535.",
   "field.username": "The username is not valid.",
   "field.password": "Enter the password.",
+  "field.auth": "Unknown login method.",
+  "field.privateKey": "The private key cannot be used: wrong format or wrong passphrase.",
   "field.protocols": "Select at least one protocol.",
   "field.linkAddress": "The node address is not valid.",
   "field.certMode": 'An IP certificate needs an IP address as the node address: leave "Node address" empty (uses the server IP) or enter an IP, or use self-signed.'
@@ -317,6 +369,22 @@ var STYLES = `
 .dshvpn-qr { background: #fff; padding: 6px; border-radius: 6px; line-height: 0; align-self: center; }
 .dshvpn-qr svg { width: 180px; height: 180px; }
 .dshvpn-link { display: block; max-width: 100%; max-height: 3.2em; overflow: hidden; color: var(--dsw-alias-label-secondary, #666); }
+.dshvpn-auth { display: flex; flex-direction: column; gap: 6px; }
+.dshvpn-auth-options { display: flex; flex-wrap: wrap; gap: 18px; }
+.dshvpn-grid .dshvpn-auth-options label.dshvpn-radio { display: inline-flex; flex-direction: row; align-items: center; gap: 6px; }
+.dshvpn-auth-options .dshvpn-radio input { margin: 0; }
+.dshvpn-keypanel { display: flex; flex-direction: column; gap: 10px; }
+.dshvpn-keypanel p { margin: 0; }
+.dshvpn-keycard { display: flex; flex-direction: column; gap: 6px; padding: 12px; border-radius: 10px;
+  border: 1px solid var(--dsw-alias-border-l2, rgba(127,127,127,.3)); }
+.dshvpn-copyable { display: flex; align-items: flex-start; gap: 8px; }
+.dshvpn-copyable code { flex: 1; min-width: 0; font-size: 12px; word-break: break-all; white-space: pre-wrap; padding: 6px 8px; border-radius: 6px;
+  background: var(--dsw-alias-bg-layer-2, rgba(127,127,127,.12)); }
+.dshvpn-disclosure { align-self: flex-start; border: none; background: transparent; color: inherit; padding: 0; cursor: pointer; font-size: 12.5px; opacity: .75; }
+.dshvpn-textarea { width: 100%; box-sizing: border-box; font: 12px ui-monospace, SFMono-Regular, Menlo, monospace; padding: 8px; border-radius: 8px; resize: vertical;
+  color: inherit; background: transparent; border: 1px solid var(--dsw-alias-border-l2, rgba(127,127,127,.3)); }
+.dshvpn-detect { display: flex; align-items: center; flex-wrap: wrap; gap: 10px; padding-top: 4px; }
+.dshvpn-detect small { flex: 1; min-width: 220px; }
 .dshvpn-section { display: flex; flex-direction: column; gap: 16px; }
 .dshvpn-section-head h2 { margin: 0; font-size: 18px; font-weight: 600; }
 .dshvpn-title-row { display: flex; align-items: center; flex-wrap: wrap; gap: 10px; margin-bottom: 4px; }
@@ -1044,6 +1112,7 @@ var import_jsx_runtime = require("react/jsx-runtime");
 var ERROR_KEYS = /* @__PURE__ */ new Set([
   "not_configured",
   "auth_failed",
+  "key_rejected",
   "host_key_mismatch",
   "connect_failed",
   "timeout",
@@ -1057,16 +1126,28 @@ var ERROR_KEYS = /* @__PURE__ */ new Set([
   "port80_in_use",
   "cert_failed"
 ]);
-var FIELD_KEYS = /* @__PURE__ */ new Set(["host", "port", "username", "password", "protocols", "linkAddress", "certMode"]);
+var FIELD_KEYS = /* @__PURE__ */ new Set(["host", "port", "username", "password", "auth", "privateKey", "protocols", "linkAddress", "certMode"]);
 function errorText(t, f) {
   if (f.error === "invalid" && f.field !== void 0 && FIELD_KEYS.has(f.field)) return t(`field.${f.field}`);
   const key = ERROR_KEYS.has(f.error) ? `err.${f.error}` : "err.other";
   return t(key, { message: f.message ?? f.error });
 }
 function formOf(s) {
-  return { host: s.host, port: s.port, username: s.username, password: "", protocols: [...s.protocols], certMode: s.certMode, linkAddress: s.linkAddress };
+  return {
+    host: s.host,
+    port: s.port,
+    username: s.username,
+    password: "",
+    auth: s.auth,
+    privateKey: "",
+    passphrase: "",
+    clearPrivateKey: false,
+    protocols: [...s.protocols],
+    certMode: s.certMode,
+    linkAddress: s.linkAddress
+  };
 }
-var sameForm = (a, b) => a.host === b.host && a.port === b.port && a.username === b.username && a.password === b.password && a.linkAddress === b.linkAddress && a.certMode === b.certMode && a.protocols.join() === [...b.protocols].join();
+var sameForm = (a, b) => a.host === b.host && a.port === b.port && a.username === b.username && a.password === b.password && a.auth === b.auth && a.privateKey === b.privateKey && a.passphrase === b.passphrase && a.clearPrivateKey === b.clearPrivateKey && a.linkAddress === b.linkAddress && a.certMode === b.certMode && a.protocols.join() === [...b.protocols].join();
 function Checkbox({ label, checked, disabled, onChange }) {
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "dshvpn-checkbox", children: [
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", { type: "checkbox", checked, disabled, onChange: (e) => {
@@ -1075,6 +1156,93 @@ function Checkbox({ label, checked, disabled, onChange }) {
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: label })
   ] });
 }
+function Copyable({ text, label, t }) {
+  const [copied, setCopied] = (0, import_react.useState)(false);
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-copyable", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { children: text }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Button, { size: "sm", variant: "outline", onClick: () => {
+      void (0, import_dsh_client_ui_primitives.writeClipboard)(text).then(() => {
+        setCopied(true);
+        setTimeout(() => {
+          setCopied(false);
+        }, 1500);
+      });
+    }, children: copied ? t("copied") : label })
+  ] });
+}
+function KeyPanel({ t, api, form, saved, set, setForm }) {
+  const [key, setKey] = (0, import_react.useState)(null);
+  const ownStored = saved.hasPrivateKey && !form.clearPrivateKey;
+  const [own, setOwn] = (0, import_react.useState)(ownStored);
+  (0, import_react.useEffect)(() => {
+    let live = true;
+    void api.sshKey().then((r) => {
+      if (live && r.ok) setKey(r);
+    });
+    return () => {
+      live = false;
+    };
+  }, [api]);
+  const preparing = t("working");
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keypanel dshvpn-wide", children: [
+    !own && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "dshvpn-muted", children: t("keyIntro") }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("keyWayConsole") }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("keyWayConsoleHint") }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Copyable, { t, text: key?.publicKey ?? preparing, label: t("copyPublicKey") })
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("keyWayCommand") }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("keyWayCommandHint", { user: form.username || "root" }) }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Copyable, { t, text: key?.command ?? preparing, label: t("copyCommand") })
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("keyThen") })
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", className: "dshvpn-disclosure", onClick: () => {
+      if (own) {
+        setOwn(false);
+        setForm({ ...form, privateKey: "", passphrase: "", clearPrivateKey: saved.hasPrivateKey });
+      } else {
+        setOwn(true);
+        setForm({ ...form, clearPrivateKey: false });
+      }
+    }, children: own ? `\u25BE ${t("ownKeyBack")}` : `\u25B8 ${t("ownKeyToggle")}` }),
+    own && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-keycard", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("ownKey") }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("ownKeyHint") }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+        "textarea",
+        {
+          className: "dshvpn-textarea",
+          rows: 5,
+          spellCheck: false,
+          autoComplete: "off",
+          value: form.privateKey,
+          placeholder: ownStored ? t("ownKeySaved") : "-----BEGIN OPENSSH PRIVATE KEY-----",
+          onChange: (e) => {
+            set("privateKey", e.target.value);
+          }
+        }
+      ),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: t("passphrase") }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          import_dsh_client_ui_primitives.Input,
+          {
+            type: "password",
+            value: form.passphrase,
+            autoComplete: "new-password",
+            placeholder: t("passphraseHint"),
+            onChange: (e) => {
+              set("passphrase", e.target.value);
+            }
+          }
+        )
+      ] })
+    ] })
+  ] });
+}
 function QrCard({ item, t }) {
   const [copied, setCopied] = (0, import_react.useState)(false);
   const info = PROTOCOLS.find((p) => p.id === item.id);
@@ -1143,12 +1311,12 @@ function VpnSettingsPage({ view, t, api }) {
       setBusy(null);
     }
   }
-  const detect = async () => {
-    await op("detect", api.detect, (r) => {
-      const res = r.result ?? {};
+  const detect = async (fromForm = true) => {
+    const r = await op("detect", () => api.detect(fromForm ? form : void 0), (r2) => {
+      const res = r2.result ?? {};
       if (res.installed !== true) return { tone: "info", text: t("detectNone") };
-      if (r.links) {
-        setLinks(r.links);
+      if (r2.links) {
+        setLinks(r2.links);
         setRefreshedAt(/* @__PURE__ */ new Date());
       }
       const protocols = (res.protocols ?? []).map((id) => PROTOCOLS.find((p) => p.id === id)?.name ?? id).join("\u3001");
@@ -1157,10 +1325,12 @@ function VpnSettingsPage({ view, t, api }) {
       return { tone: "success", text: res.synced === true ? `${text}
 ${t("detectSynced")}` : text };
     });
-    const s = await api.getSettings();
-    if (s.ok) {
-      setSaved(s.settings);
-      setForm(formOf(s.settings));
+    if (r.ok || r.links) {
+      const s = await api.getSettings();
+      if (s.ok) {
+        setSaved(s.settings);
+        setForm(formOf(s.settings));
+      }
     }
   };
   const save = async () => {
@@ -1170,7 +1340,7 @@ ${t("detectSynced")}` : text };
       setForm(formOf(r2.settings));
       return { tone: "success", text: t("saved") };
     });
-    if (r.ok && first) await detect();
+    if (r.ok && first) await detect(false);
   };
   const refreshSettings = async () => {
     const r = await api.getSettings();
@@ -1232,20 +1402,36 @@ ${t("cloudHint")}`;
           /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("usernameHint") })
         ] }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: t("password") }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: form.auth === "key" ? t("sudoPassword") : t("password") }),
           /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
             import_dsh_client_ui_primitives.Input,
             {
               type: "password",
               value: form.password,
               autoComplete: "new-password",
-              placeholder: saved.hasPassword ? t("passwordSaved") : t("passwordEmpty"),
+              placeholder: saved.hasPassword ? t("passwordSaved") : form.auth === "key" ? t("sudoPasswordEmpty") : t("passwordEmpty"),
               onChange: (e) => {
                 set("password", e.target.value);
               }
             }
           )
         ] }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-wide dshvpn-auth", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: t("authMethod") }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "dshvpn-auth-options", children: ["password", "key"].map((m) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "dshvpn-radio", children: [
+            /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", { type: "radio", name: "dshvpn-auth", checked: form.auth === m, disabled, onChange: () => {
+              set("auth", m);
+            } }),
+            /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: m === "key" ? t("authKey") : t("authPassword") })
+          ] }, m)) })
+        ] }),
+        form.auth === "key" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(KeyPanel, { t, api, form, saved, set, setForm }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-wide dshvpn-detect", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Button, { variant: "primary", disabled: disabled || form.host.trim() === "", onClick: () => {
+            void detect();
+          }, children: busy === "detect" ? t("detecting") : t("detect") }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("detectHint") })
+        ] }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "dshvpn-wide", children: [
           /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: t("linkAddress") }),
           /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Input, { value: form.linkAddress, placeholder: form.host, onChange: (e) => {
@@ -1334,9 +1520,6 @@ ${t("cloudHint")}`;
           children: t("test")
         }
       ),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Button, { variant: "outline", disabled: disabled || needsSave, onClick: () => {
-        void detect();
-      }, children: busy === "detect" ? t("working") : t("detect") }),
       dirty && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-warn", children: t("unsaved") })
     ] }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { children: [

package/lib/index.js

@@ -20164,6 +20164,150 @@ var require_lib2 = __commonJS({
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import Schema from "@deepseek-ai/schemastery";
 
+// src/ssh.ts
+var import_ssh2 = __toESM(require_lib2(), 1);
+import { createHash } from "node:crypto";
+var SshError = class extends Error {
+  constructor(code, message, details = {}) {
+    super(message);
+    this.code = code;
+    this.details = details;
+    this.name = "SshError";
+  }
+  code;
+  details;
+};
+function privateKeyProblem(key, passphrase) {
+  const parsed = import_ssh2.utils.parseKey(key, passphrase || void 0);
+  const first = Array.isArray(parsed) ? parsed[0] : parsed;
+  if (first instanceof Error) return first.message;
+  if (!first || !first.isPrivateKey()) return "not a private key";
+  return void 0;
+}
+function generateKeyPair(comment) {
+  for (let i = 0; i < 20; i++) {
+    const k = import_ssh2.utils.generateKeyPairSync("ed25519", { comment });
+    try {
+      if (privateKeyProblem(k.private) === void 0) return { privateKey: k.private, publicKey: k.public.trim() };
+    } catch {
+    }
+  }
+  throw new Error("could not generate a usable SSH key");
+}
+function fingerprint(key) {
+  return `SHA256:${createHash("sha256").update(key).digest("base64").replace(/=+$/, "")}`;
+}
+var STDERR_TAIL = 8e3;
+var SshSession = class _SshSession {
+  constructor(client, hostKey) {
+    this.client = client;
+    this.hostKey = hostKey;
+  }
+  client;
+  hostKey;
+  static async open(target, signal, timeoutMs = 2e4) {
+    signal.throwIfAborted();
+    const client = new import_ssh2.Client();
+    let seen;
+    const config = {
+      host: target.host,
+      port: target.port,
+      username: target.username,
+      // Exactly one method: the key, or the password. Never keyboard-interactive or agents.
+      ...target.privateKey ? { privateKey: target.privateKey, ...target.passphrase ? { passphrase: target.passphrase } : {} } : { password: target.password },
+      readyTimeout: timeoutMs,
+      tryKeyboard: false,
+      hostVerifier: (key) => {
+        seen = fingerprint(key);
+        return target.hostKey === void 0 || target.hostKey === seen;
+      }
+    };
+    return await new Promise((resolve, reject) => {
+      const onAbort = () => {
+        client.end();
+        reject(new SshError("cancelled", "cancelled"));
+      };
+      signal.addEventListener("abort", onAbort, { once: true });
+      client.once("ready", () => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(new _SshSession(client, seen ?? ""));
+      });
+      client.once("error", (err) => {
+        signal.removeEventListener("abort", onAbort);
+        client.end();
+        if (target.hostKey !== void 0 && seen !== void 0 && seen !== target.hostKey) {
+          reject(new SshError(
+            "host_key_mismatch",
+            `host key changed: expected ${target.hostKey}, got ${seen}`,
+            { expected: target.hostKey, actual: seen }
+          ));
+        } else if (err.level === "client-authentication") {
+          reject(target.privateKey ? new SshError("key_rejected", `SSH login failed: ${target.username}@${target.host} did not accept the key`) : new SshError("auth_failed", "SSH login failed: wrong username or password"));
+        } else if (err.level === "client-timeout") {
+          reject(new SshError("timeout", `timed out connecting to ${target.host}:${target.port}`));
+        } else {
+          reject(new SshError("connect_failed", `cannot connect to ${target.host}:${target.port}: ${err.message}`));
+        }
+      });
+      client.connect(config);
+    });
+  }
+  /** Run one command; `stdin` is written then closed. Never uses a pty. */
+  async exec(command, stdin, signal) {
+    signal.throwIfAborted();
+    const stream = await new Promise((resolve, reject) => {
+      this.client.exec(command, (err, s) => {
+        if (err) reject(err);
+        else resolve(s);
+      });
+    });
+    let stdout = "";
+    let stderr = "";
+    stream.setEncoding("utf8");
+    stream.on("data", (chunk) => {
+      stdout += chunk;
+    });
+    stream.stderr.setEncoding("utf8");
+    stream.stderr.on("data", (chunk) => {
+      stderr = (stderr + chunk).slice(-STDERR_TAIL);
+    });
+    let cleanup = () => {
+    };
+    try {
+      const code = await new Promise((resolve, reject) => {
+        const onAbort = () => {
+          reject(signal.reason ?? new SshError("cancelled", "cancelled"));
+          stream.close();
+          this.client.end();
+        };
+        const onGone = () => {
+          reject(new SshError("connect_failed", "connection closed during command"));
+        };
+        cleanup = () => {
+          signal.removeEventListener("abort", onAbort);
+          this.client.off("close", onGone);
+        };
+        if (signal.aborted) {
+          onAbort();
+          return;
+        }
+        signal.addEventListener("abort", onAbort, { once: true });
+        this.client.once("close", onGone);
+        stream.once("close", (c) => {
+          resolve(c ?? null);
+        });
+        stream.end(stdin);
+      });
+      return { code, stdout, stderr };
+    } finally {
+      cleanup();
+    }
+  }
+  close() {
+    this.client.end();
+  }
+};
+
 // src/protocols.ts
 var PROTOCOLS = [
   { id: "reality", name: "VLESS Reality", transport: "TCP", insecureLink: false, defaultSelected: true },
@@ -20203,6 +20347,8 @@ var EMPTY_VIEW = {
   port: 22,
   username: "root",
   hasPassword: false,
+  auth: "password",
+  hasPrivateKey: false,
   protocols: [...DEFAULT_PROTOCOLS],
   certMode: "self",
   linkAddress: "",
@@ -20216,6 +20362,8 @@ function publicView(s) {
     port: s.port,
     username: s.username,
     hasPassword: s.password !== "",
+    auth: s.auth,
+    hasPrivateKey: s.privateKey !== void 0,
     protocols: s.protocols,
     certMode: s.certMode,
     linkAddress: s.linkAddress ?? "",
@@ -20229,8 +20377,23 @@ function applyInput(current, input) {
   if (!Number.isInteger(port) || port < 1 || port > 65535) throw new SettingsError("port", "port must be 1-65535");
   const username = String(input.username ?? "").trim();
   if (!USERNAME.test(username)) throw new SettingsError("username", `invalid username: ${username}`);
+  const auth = input.auth ?? current?.auth ?? "password";
+  if (auth !== "password" && auth !== "key") throw new SettingsError("auth", `unknown login method: ${auth}`);
   const password = input.password ? String(input.password) : current?.password ?? "";
-  if (password === "") throw new SettingsError("password", "password is required");
+  if (auth === "password" && password === "") throw new SettingsError("password", "password is required");
+  let privateKey = input.clearPrivateKey ? void 0 : current?.privateKey;
+  let passphrase = input.clearPrivateKey ? void 0 : current?.passphrase;
+  if (input.privateKey && String(input.privateKey).trim() !== "") {
+    privateKey = `${String(input.privateKey).trim()}
+`;
+    passphrase = input.passphrase ? String(input.passphrase) : void 0;
+  } else if (input.passphrase && privateKey) {
+    passphrase = String(input.passphrase);
+  }
+  if (privateKey !== void 0) {
+    const problem = privateKeyProblem(privateKey, passphrase);
+    if (problem) throw new SettingsError("privateKey", `unusable private key: ${problem}`);
+  }
   if (!Array.isArray(input.protocols)) throw new SettingsError("protocols", "protocols must be a list");
   const protocols = [...new Set(input.protocols)];
   if (protocols.length === 0) throw new SettingsError("protocols", "select at least one protocol");
@@ -20249,12 +20412,29 @@ function applyInput(current, input) {
     port,
     username,
     password,
+    auth,
+    privateKey,
+    passphrase,
     protocols,
     certMode,
     linkAddress: linkAddress || void 0,
     hostKey: sameMachine ? current.hostKey : void 0
   };
 }
+var MemoryKeyStore = class {
+  constructor(make) {
+    this.make = make;
+  }
+  make;
+  pair;
+  get() {
+    return Promise.resolve(this.pair ??= this.make());
+  }
+};
+function authorizedKeysCommand(publicKey) {
+  const safe = publicKey.trim().replace(/'/g, "'\\''");
+  return `mkdir -p ~/.ssh && chmod 700 ~/.ssh && { grep -qxF '${safe}' ~/.ssh/authorized_keys 2>/dev/null || echo '${safe}' >> ~/.ssh/authorized_keys; } && chmod 600 ~/.ssh/authorized_keys`;
+}
 
 // src/api.ts
 var API_BASE = "/api/dsh-vpn";
@@ -20291,6 +20471,11 @@ function apiHandlers(service, uiLang, onUiLang, updater) {
       });
       return { ok: true, settings: publicView(saved) };
     },
+    // The dedicated key's public half and the line that installs it; never the private key.
+    "/ssh-key": async () => {
+      const { publicKey } = await service.keys.get();
+      return { ok: true, publicKey, command: authorizedKeysCommand(publicKey) };
+    },
     "/host-key/forget": async () => {
       await service.store.update((cur) => cur && { ...cur, hostKey: void 0 });
       return { ok: true, settings: publicView(await service.store.get()) };
@@ -20298,7 +20483,12 @@ function apiHandlers(service, uiLang, onUiLang, updater) {
     "/test": (_body, signal) => service.test(signal),
     "/status": (_body, signal) => service.status(signal),
     "/links": (_body, signal) => service.links(signal),
-    "/detect": (_body, signal) => service.detect(signal),
+    // With form fields: try them as they are (no save needed first); they are
+    // stored only once the login works.
+    "/detect": async (body, signal) => {
+      if (typeof body.host !== "string") return service.detect(signal);
+      return service.detect(signal, applyInput(await service.store.get(), body));
+    },
     "/install": (body, signal) => service.install({ regenerate: body.regenerate === true }, signal),
     "/uninstall": (_body, signal) => service.uninstall(signal)
   };
@@ -20335,135 +20525,6 @@ function registerApi(ctx, service, uiLang, onUiLang, updater) {
 
 // src/remote.ts
 import { readFile } from "node:fs/promises";
-
-// src/ssh.ts
-var import_ssh2 = __toESM(require_lib2(), 1);
-import { createHash } from "node:crypto";
-var SshError = class extends Error {
-  constructor(code, message, details = {}) {
-    super(message);
-    this.code = code;
-    this.details = details;
-    this.name = "SshError";
-  }
-  code;
-  details;
-};
-function fingerprint(key) {
-  return `SHA256:${createHash("sha256").update(key).digest("base64").replace(/=+$/, "")}`;
-}
-var STDERR_TAIL = 8e3;
-var SshSession = class _SshSession {
-  constructor(client, hostKey) {
-    this.client = client;
-    this.hostKey = hostKey;
-  }
-  client;
-  hostKey;
-  static async open(target, signal, timeoutMs = 2e4) {
-    signal.throwIfAborted();
-    const client = new import_ssh2.Client();
-    let seen;
-    const config = {
-      host: target.host,
-      port: target.port,
-      username: target.username,
-      password: target.password,
-      readyTimeout: timeoutMs,
-      // Password only: never fall back to keyboard-interactive prompts or agents.
-      tryKeyboard: false,
-      hostVerifier: (key) => {
-        seen = fingerprint(key);
-        return target.hostKey === void 0 || target.hostKey === seen;
-      }
-    };
-    return await new Promise((resolve, reject) => {
-      const onAbort = () => {
-        client.end();
-        reject(new SshError("cancelled", "cancelled"));
-      };
-      signal.addEventListener("abort", onAbort, { once: true });
-      client.once("ready", () => {
-        signal.removeEventListener("abort", onAbort);
-        resolve(new _SshSession(client, seen ?? ""));
-      });
-      client.once("error", (err) => {
-        signal.removeEventListener("abort", onAbort);
-        client.end();
-        if (target.hostKey !== void 0 && seen !== void 0 && seen !== target.hostKey) {
-          reject(new SshError(
-            "host_key_mismatch",
-            `host key changed: expected ${target.hostKey}, got ${seen}`,
-            { expected: target.hostKey, actual: seen }
-          ));
-        } else if (err.level === "client-authentication") {
-          reject(new SshError("auth_failed", "SSH login failed: wrong username or password"));
-        } else if (err.level === "client-timeout") {
-          reject(new SshError("timeout", `timed out connecting to ${target.host}:${target.port}`));
-        } else {
-          reject(new SshError("connect_failed", `cannot connect to ${target.host}:${target.port}: ${err.message}`));
-        }
-      });
-      client.connect(config);
-    });
-  }
-  /** Run one command; `stdin` is written then closed. Never uses a pty. */
-  async exec(command, stdin, signal) {
-    signal.throwIfAborted();
-    const stream = await new Promise((resolve, reject) => {
-      this.client.exec(command, (err, s) => {
-        if (err) reject(err);
-        else resolve(s);
-      });
-    });
-    let stdout = "";
-    let stderr = "";
-    stream.setEncoding("utf8");
-    stream.on("data", (chunk) => {
-      stdout += chunk;
-    });
-    stream.stderr.setEncoding("utf8");
-    stream.stderr.on("data", (chunk) => {
-      stderr = (stderr + chunk).slice(-STDERR_TAIL);
-    });
-    let cleanup = () => {
-    };
-    try {
-      const code = await new Promise((resolve, reject) => {
-        const onAbort = () => {
-          reject(signal.reason ?? new SshError("cancelled", "cancelled"));
-          stream.close();
-          this.client.end();
-        };
-        const onGone = () => {
-          reject(new SshError("connect_failed", "connection closed during command"));
-        };
-        cleanup = () => {
-          signal.removeEventListener("abort", onAbort);
-          this.client.off("close", onGone);
-        };
-        if (signal.aborted) {
-          onAbort();
-          return;
-        }
-        signal.addEventListener("abort", onAbort, { once: true });
-        this.client.once("close", onGone);
-        stream.once("close", (c) => {
-          resolve(c ?? null);
-        });
-        stream.end(stdin);
-      });
-      return { code, stdout, stderr };
-    } finally {
-      cleanup();
-    }
-  }
-  close() {
-    this.client.end();
-  }
-};
-
-// src/remote.ts
 var SCRIPT_URL = new URL("../scripts/vpn.sh", import.meta.url);
 var RESULT_PREFIX = "DSH_VPN_RESULT=";
 var LOG_TAIL = 4e3;
@@ -20527,8 +20588,11 @@ var NotConfiguredError = class extends Error {
     this.name = "NotConfiguredError";
   }
 };
-function targetOf(s) {
-  return { host: s.host, port: s.port, username: s.username, password: s.password, hostKey: s.hostKey };
+async function targetOf(s, keys) {
+  const base = { host: s.host, port: s.port, username: s.username, password: s.password, hostKey: s.hostKey };
+  if (s.auth !== "key") return base;
+  if (s.privateKey !== void 0) return { ...base, privateKey: s.privateKey, passphrase: s.passphrase };
+  return { ...base, privateKey: (await keys.get()).privateKey };
 }
 function resolveProtocols(requested, fallback) {
   const list = requested && requested.length > 0 ? [...new Set(requested)] : [...fallback];
@@ -20543,12 +20607,14 @@ function failure(err) {
   return { ok: false, error: "internal", message: err instanceof Error ? err.message : String(err) };
 }
 var VpnService = class {
-  constructor(store, config) {
+  constructor(store, config, keys = new MemoryKeyStore(() => generateKeyPair("dsh-vpn"))) {
     this.store = store;
     this.config = config;
+    this.keys = keys;
   }
   store;
   config;
+  keys;
   queue = Promise.resolve();
   async settings() {
     const s = await this.store.get();
@@ -20569,31 +20635,42 @@ var VpnService = class {
     return this.exclusive(async () => {
       try {
         const s = await this.settings();
-        const res = await runVpnScript(action, args(s), targetOf(s), signal, this.config.timeoutMs);
-        await this.pin(s, res.hostKey);
-        if (!res.result) {
-          const sudo = /incorrect password|a password is required|not in the sudoers|may not run sudo/i.test(res.log);
-          return {
-            ok: false,
-            error: sudo ? "sudo_failed" : "no_result",
-            message: sudo ? `sudo refused for ${s.username}: ${res.log}` : `script did not report a result (exit ${res.exitCode}): ${res.log}`,
-            log: res.log
-          };
-        }
-        const r = res.result;
-        return {
-          ok: r.ok === true,
-          ...typeof r.error === "string" ? { error: r.error } : {},
-          ...typeof r.message === "string" ? { message: r.message } : {},
-          result: r,
-          ...r.links ? { links: r.links } : {},
-          log: res.log
-        };
+        const { op, hostKey } = await this.runOn(s, action, args(s), signal);
+        await this.pin(s, hostKey);
+        return op;
       } catch (err) {
         return failure(err);
       }
     });
   }
+  /** Run the script against `s` (stored or not); throws SSH and config errors. */
+  async runOn(s, action, args, signal) {
+    const res = await runVpnScript(action, args, await targetOf(s, this.keys), signal, this.config.timeoutMs);
+    if (!res.result) {
+      const sudo = /incorrect password|a password is required|not in the sudoers|may not run sudo/i.test(res.log);
+      return {
+        hostKey: res.hostKey,
+        op: {
+          ok: false,
+          error: sudo ? "sudo_failed" : "no_result",
+          message: sudo ? `sudo refused for ${s.username}: ${res.log}` : `script did not report a result (exit ${res.exitCode}): ${res.log}`,
+          log: res.log
+        }
+      };
+    }
+    const r = res.result;
+    return {
+      hostKey: res.hostKey,
+      op: {
+        ok: r.ok === true,
+        ...typeof r.error === "string" ? { error: r.error } : {},
+        ...typeof r.message === "string" ? { message: r.message } : {},
+        result: r,
+        ...r.links ? { links: r.links } : {},
+        log: res.log
+      }
+    };
+  }
   install(opts, signal) {
     return this.run("install", (s) => {
       const protocols = resolveProtocols(opts.protocols, s.protocols);
@@ -20617,32 +20694,44 @@ var VpnService = class {
     return this.run("links", (s) => ["--server", s.linkAddress ?? s.host], signal);
   }
   /**
-   * Find an existing installation (e.g. after dsh-vpn was removed and its local
-   * settings lost): read the server's protocols, certificate mode and links,
-   * and adopt the protocols and certificate mode into local settings so a
-   * later 安装 / 更新 keeps the node as it is.
+   * Find an existing installation (e.g. dsh or dsh-vpn was reinstalled and the
+   * local settings are gone, but the node still runs). `candidate` is what the
+   * settings page holds, saved or not: it is stored only once login works, with
+   * the server's protocols and certificate mode adopted so that a later
+   * 安装 / 更新 keeps the node, its keys and its links as they are.
    */
-  async detect(signal) {
-    const status = await this.status(signal);
-    if (!status.ok || status.result?.installed !== true) return status.ok ? { ok: true, result: { installed: false } } : status;
-    const r = status.result;
-    const protocols = String(r.protocols ?? "").split(",").filter(isProtocolId);
-    const mode = r.cert?.mode;
-    const certMode = mode === "ip" || mode === "self" ? mode : void 0;
-    let synced = false;
-    await this.store.update((cur) => {
-      if (!cur) return void 0;
-      const next = { ...cur, ...protocols.length > 0 ? { protocols } : {}, ...certMode ? { certMode } : {} };
-      synced = next.certMode !== cur.certMode || next.protocols.join() !== cur.protocols.join();
-      return synced ? next : void 0;
+  detect(signal, candidate) {
+    return this.exclusive(async () => {
+      try {
+        const s = candidate ?? await this.settings();
+        const status = await this.runOn(s, "status", [], signal);
+        if (!status.op.ok) return status.op;
+        const r = status.op.result ?? {};
+        const installed = r.installed === true;
+        const protocols = installed ? String(r.protocols ?? "").split(",").filter(isProtocolId) : [];
+        const mode = r.cert?.mode;
+        const certMode = installed && (mode === "ip" || mode === "self") ? mode : void 0;
+        const before = candidate ?? s;
+        const next = {
+          ...before,
+          ...protocols.length > 0 ? { protocols } : {},
+          ...certMode ? { certMode } : {},
+          hostKey: before.hostKey ?? (status.hostKey || void 0)
+        };
+        const synced = next.certMode !== before.certMode || next.protocols.join() !== before.protocols.join();
+        await this.store.update((cur) => candidate || cur ? next : void 0);
+        if (!installed) return { ok: true, result: { installed: false } };
+        const links = await this.runOn(next, "links", ["--server", next.linkAddress ?? next.host], signal);
+        return {
+          ok: links.op.ok,
+          ...links.op.error ? { error: links.op.error, message: links.op.message } : {},
+          result: { installed: true, active: r.active, version: r.version, protocols, certMode, synced },
+          ...links.op.links ? { links: links.op.links } : {}
+        };
+      } catch (err) {
+        return failure(err);
+      }
     });
-    const links = await this.links(signal);
-    return {
-      ok: links.ok,
-      ...links.error ? { error: links.error, message: links.message } : {},
-      result: { installed: true, active: r.active, version: r.version, protocols, certMode, synced },
-      ...links.links ? { links: links.links } : {}
-    };
   }
   uninstall(signal) {
     return this.run("uninstall", () => [], signal);
@@ -20656,7 +20745,7 @@ var VpnService = class {
       let session;
       try {
         const s = await this.settings();
-        session = await SshSession.open(targetOf(s), signal);
+        session = await SshSession.open(await targetOf(s, this.keys), signal);
         const asRoot = s.username === "root";
         const cmd = `echo "uid=$(${asRoot ? "" : `sudo -S -p '' `}id -u)"; echo "sys=$(uname -srm)"`;
         const res = await session.exec(cmd, asRoot ? "" : `${s.password}
@@ -20694,6 +20783,9 @@ function parse(payload) {
     port: p.port,
     username: p.username,
     password: p.password,
+    auth: p.auth === "key" ? "key" : "password",
+    privateKey: typeof p.privateKey === "string" ? p.privateKey : void 0,
+    passphrase: typeof p.passphrase === "string" ? p.passphrase : void 0,
     protocols: protocols.length > 0 ? protocols : ["reality", "hy2"],
     certMode: p.certMode === "ip" ? "ip" : "self",
     linkAddress: typeof p.linkAddress === "string" ? p.linkAddress : void 0,
@@ -20717,6 +20809,26 @@ var CredentialSettingsStore = class {
     });
   }
 };
+var SSH_KEY = credentialKey("dsh-vpn", "ssh-key");
+var CredentialKeyStore = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  async get() {
+    let pair;
+    await this.ctx.credentials.modifyRecord(SSH_KEY, async (record) => {
+      const p = record?.kind === "grant" ? record.payload : null;
+      if (typeof p?.privateKey === "string" && typeof p.publicKey === "string") {
+        pair = { privateKey: p.privateKey, publicKey: p.publicKey };
+        return void 0;
+      }
+      pair = generateKeyPair("dsh-vpn");
+      return { kind: "grant", payload: { ...pair } };
+    });
+    return pair;
+  }
+};
 var UI_LANG_KEY = credentialKey("dsh-vpn", "ui-locale");
 async function readUiLang(ctx) {
   const record = await ctx.credentials.readRecord(UI_LANG_KEY);
@@ -20942,7 +21054,11 @@ function toToolValue(r, uiLang) {
   };
 }
 function apply(ctx, config) {
-  const service = new VpnService(new CredentialSettingsStore(ctx), { timeoutMs: config.timeoutMs, acmeProvider: config.acmeProvider });
+  const service = new VpnService(
+    new CredentialSettingsStore(ctx),
+    { timeoutMs: config.timeoutMs, acmeProvider: config.acmeProvider },
+    new CredentialKeyStore(ctx)
+  );
   const uiLang = new UiLang();
   readUiLang(ctx).then((lang) => {
     if (lang && !uiLang.reported) uiLang.set(lang);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vpn",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "DeepSeek Harness plugin: deploy an encrypted VPN (sing-box) to your own VPS in one click, to protect your connections and privacy on untrusted networks",
   "keywords": [
     "anytls",