chore: release v0.7.9

Author: DarkDo11

package.json

@@ -1,7 +1,7 @@
 {
   "name": "nodenet",
   "private": true,
-  "version": "0.7.8",
+  "version": "0.7.9",
   "type": "module",
   "scripts": {
     "dev": "vite",

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nodenet"
-version = "0.7.8"
+version = "0.7.9"
 description = "macOS desktop VPN server controller and monitor"
 authors = ["NodeNet"]
 edition = "2021"

src-tauri/src/commands.rs

@@ -922,6 +922,7 @@ pub fn list_ssh_public_keys() -> Result<Vec<String>, String> {
 #[tauri::command]
 pub fn read_ssh_public_key(path: String) -> Result<String, String> {
     let path = expand_public_key_path(&path)?;
+    let path = validate_public_key_path(path)?;
     fs::read_to_string(path).map_err(|error| error.to_string())
 }
 
@@ -1252,9 +1253,13 @@ fn first_u16(line: &str) -> Option<u16> {
 /// epoch-ms timestamps (frontend MetricPoint format saved to local disk).
 fn latest_timestamps(cache: &Value) -> HashMap<String, i64> {
     let mut since = HashMap::new();
-    let Some(obj) = cache.as_object() else { return since };
+    let Some(obj) = cache.as_object() else {
+        return since;
+    };
     for (server_id, history) in obj {
-        let Some(arr) = history.as_array() else { continue };
+        let Some(arr) = history.as_array() else {
+            continue;
+        };
         let latest_ms = arr
             .iter()
             .filter_map(|point| {
@@ -1281,7 +1286,9 @@ fn merge_cache_delta(base: &mut Value, delta: Value) {
         return;
     };
     for (server_id, new_points) in delta_obj {
-        let Some(new_arr) = new_points.as_array() else { continue };
+        let Some(new_arr) = new_points.as_array() else {
+            continue;
+        };
         if new_arr.is_empty() {
             continue;
         }
@@ -1307,6 +1314,28 @@ fn expand_public_key_path(path: &str) -> Result<PathBuf, String> {
     Ok(PathBuf::from(trimmed))
 }
 
+fn validate_public_key_path(path: PathBuf) -> Result<PathBuf, String> {
+    if path.extension().and_then(|extension| extension.to_str()) != Some("pub") {
+        return Err("SSH public key must be a .pub file".to_string());
+    }
+
+    let base_dirs = directories::BaseDirs::new()
+        .ok_or_else(|| "unable to resolve user directories".to_string())?;
+    let ssh_dir = base_dirs.home_dir().join(".ssh");
+    let ssh_dir = fs::canonicalize(&ssh_dir).map_err(|error| error.to_string())?;
+    let path = fs::canonicalize(&path).map_err(|error| error.to_string())?;
+
+    if !path.starts_with(&ssh_dir) {
+        return Err("SSH public key must be inside ~/.ssh".to_string());
+    }
+
+    if !path.is_file() {
+        return Err("SSH public key path must be a file".to_string());
+    }
+
+    Ok(path)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

src-tauri/src/config.rs

@@ -151,6 +151,9 @@ pub fn upsert_server(mut server: ServerConfig) -> Result<AppConfig> {
 pub fn delete_server(server_id: &str) -> Result<AppConfig> {
     let mut config = load_config()?;
     config.servers.retain(|server| server.id != server_id);
+    if config.monitor_server_id.as_deref() == Some(server_id) {
+        config.monitor_server_id = None;
+    }
     save_config(&config)?;
     Ok(config)
 }
@@ -178,6 +181,9 @@ pub fn upsert_bastion(mut bastion: BastionConfig) -> Result<AppConfig> {
 pub fn delete_bastion(bastion_id: &str) -> Result<AppConfig> {
     let mut config = load_config()?;
     config.bastions.retain(|bastion| bastion.id != bastion_id);
+    if config.monitor_bastion_id.as_deref() == Some(bastion_id) {
+        config.monitor_bastion_id = None;
+    }
     save_config(&config)?;
     Ok(config)
 }

src-tauri/src/keychain.rs

@@ -49,7 +49,11 @@ pub async fn read_password(
         .context("failed to execute security find-generic-password")?;
 
     if !output.status.success() {
-        return Ok(None);
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        if stderr.contains("could not be found") {
+            return Ok(None);
+        }
+        return Err(anyhow!("keychain read failed: {}", stderr.trim()));
     }
 
     let password = String::from_utf8_lossy(&output.stdout).trim().to_string();

src-tauri/src/monitor.rs

@@ -193,9 +193,7 @@ pub async fn ping_from_monitor(
         .map(|value| value.round().max(0.0) as u128);
     let status = if !is_online {
         "offline"
-    } else if ping_ms.is_some_and(|value| value > 1_000) {
-        "warning"
-    } else if is_transient_failure {
+    } else if ping_ms.is_some_and(|value| value > 1_000) || is_transient_failure {
         "warning"
     } else {
         "online"
@@ -1182,10 +1180,7 @@ fn shell_single_quote(value: &str) -> String {
 /// `since` maps server IDs to the last known timestamp in milliseconds.
 /// Returns a JSON object with the same shape as the full metrics cache,
 /// containing only the new points for each server.
-pub async fn fetch_metrics_delta(
-    app: &AppHandle,
-    since: &HashMap<String, i64>,
-) -> Result<Value> {
+pub async fn fetch_metrics_delta(app: &AppHandle, since: &HashMap<String, i64>) -> Result<Value> {
     let config = load_config()?;
     let Some(monitor) = monitor_server(&config)? else {
         return Ok(Value::Object(Default::default()));

src-tauri/src/ssh.rs

@@ -157,9 +157,7 @@ async fn reap_stale_connections() {
             .filter_map(|(key, conn)| {
                 conn.try_lock()
                     .ok()
-                    .filter(|c| {
-                        c.last_used.elapsed() >= Duration::from_secs(SSH_IDLE_TIMEOUT_SECS)
-                    })
+                    .filter(|c| c.last_used.elapsed() >= Duration::from_secs(SSH_IDLE_TIMEOUT_SECS))
                     .map(|_| key.clone())
             })
             .collect()
@@ -660,9 +658,9 @@ async fn execute_streaming_once(
         .await
         .context("ssh stderr stream task failed")??;
 
-    // Exit 255 means SSH itself failed (connection lost/refused), not the remote command.
-    // For streaming commands the output was already shown live; only surface SSH-level errors.
-    if status.code() == Some(255) {
+    // The output was already shown live; the final event only needs to carry
+    // command failure state back to the UI.
+    if !status.success() {
         bail!("ssh command failed with status {status}");
     }
 
@@ -1156,17 +1154,31 @@ fn create_askpass_script(
     let bastion_host = server.bastion_host.as_deref().unwrap_or_default();
     let target_secret = target_secret.unwrap_or_default();
     let bastion_secret = bastion_secret.unwrap_or(target_secret);
-    fs::write(
-        &path,
-        format!(
-            "#!/bin/sh\nprompt=\"$1\"\ncase \"$prompt\" in\n  *{}*|*{}*) printf '%s\\n' {} ;;\n  *) printf '%s\\n' {} ;;\nesac\n",
-            shell_case_pattern(&bastion_account),
-            shell_case_pattern(bastion_host),
-            shell_single_quote(bastion_secret),
-            shell_single_quote(target_secret)
-        ),
-    )
-    .with_context(|| format!("failed to write askpass script {}", path.display()))?;
+    let script = format!(
+        "#!/bin/sh\nprompt=\"$1\"\ncase \"$prompt\" in\n  *{}*|*{}*) printf '%s\\n' {} ;;\n  *) printf '%s\\n' {} ;;\nesac\n",
+        shell_case_pattern(&bastion_account),
+        shell_case_pattern(bastion_host),
+        shell_single_quote(bastion_secret),
+        shell_single_quote(target_secret)
+    );
+
+    #[cfg(unix)]
+    {
+        use std::{io::Write, os::unix::fs::OpenOptionsExt};
+        let mut file = fs::OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .mode(0o700)
+            .open(&path)
+            .with_context(|| format!("failed to create askpass script {}", path.display()))?;
+        file.write_all(script.as_bytes())
+            .with_context(|| format!("failed to write askpass script {}", path.display()))?;
+    }
+    #[cfg(not(unix))]
+    {
+        fs::write(&path, script)
+            .with_context(|| format!("failed to write askpass script {}", path.display()))?;
+    }
 
     #[cfg(unix)]
     {

src-tauri/src/terminal.rs

@@ -579,13 +579,10 @@ fn verify_known_host(
             return Ok(());
         }
 
-        return Err(std::io::Error::new(
-            std::io::ErrorKind::Other,
-            format!(
-                "SSH host key for '{host_key}' has changed. \
+        return Err(std::io::Error::other(format!(
+            "SSH host key for '{host_key}' has changed. \
                 If the server was reinstalled, remove it from Settings → Known Hosts."
-            ),
-        )
+        ))
         .into());
     }
 

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "../node_modules/@tauri-apps/cli/config.schema.json",
   "productName": "NodeNet",
-  "version": "0.7.8",
+  "version": "0.7.9",
   "identifier": "com.nodenet.app",
   "build": {
     "beforeDevCommand": "pnpm dev",

src/components/SetupPresets.tsx

@@ -18,13 +18,13 @@ interface SshKeyPair {
 
 type PresetId =
   | "install3xui"
+  | "sshKey"
   | "ipReputation"
   | "bbr"
   | "benchmark"
   | "region"
   | "hardenSsh"
-  | "ufw"
-  | "sshKey";
+  | "ufw";
 
 interface PresetItem {
   id: PresetId;
@@ -36,6 +36,13 @@ interface PresetItem {
 }
 
 const presets: PresetItem[] = [
+  {
+    id: "sshKey",
+    name: "Copy SSH public key",
+    description: "Adds a selected ~/.ssh public key to authorized_keys on the server.",
+    command: "",
+    recommended: true,
+  },
   {
     id: "install3xui",
     name: "Install 3x-ui panel",
@@ -79,9 +86,9 @@ const presets: PresetItem[] = [
   {
     id: "hardenSsh",
     name: "Harden SSH",
-    description: "Disables password auth, enables public key auth, and restarts SSH.",
+    description: "Requires an authorized key, disables password auth, and restarts SSH.",
     command:
-      "for file in /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf; do [ -f \"$file\" ] || continue; sed -i -E 's/^[#[:space:]]*PasswordAuthentication[[:space:]]+.*/PasswordAuthentication no/' \"$file\"; sed -i -E 's/^[#[:space:]]*PubkeyAuthentication[[:space:]]+.*/PubkeyAuthentication yes/' \"$file\"; sed -i -E 's/^[#[:space:]]*KbdInteractiveAuthentication[[:space:]]+.*/KbdInteractiveAuthentication no/' \"$file\"; done; printf 'PasswordAuthentication no\\nPubkeyAuthentication yes\\nKbdInteractiveAuthentication no\\n' > /etc/ssh/sshd_config.d/99-nodenet-hardening.conf && sshd -t && systemctl restart ssh",
+      "test -s ~/.ssh/authorized_keys || { echo 'No SSH public key found in ~/.ssh/authorized_keys. Run Copy SSH public key first.' >&2; exit 1; }; for file in /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf; do [ -f \"$file\" ] || continue; sed -i -E 's/^[#[:space:]]*PasswordAuthentication[[:space:]]+.*/PasswordAuthentication no/' \"$file\"; sed -i -E 's/^[#[:space:]]*PubkeyAuthentication[[:space:]]+.*/PubkeyAuthentication yes/' \"$file\"; sed -i -E 's/^[#[:space:]]*KbdInteractiveAuthentication[[:space:]]+.*/KbdInteractiveAuthentication no/' \"$file\"; done; printf 'PasswordAuthentication no\\nPubkeyAuthentication yes\\nKbdInteractiveAuthentication no\\n' > /etc/ssh/sshd_config.d/99-nodenet-hardening.conf && sshd -t && (systemctl restart ssh || systemctl restart sshd)",
     recommended: true,
   },
   {
@@ -92,13 +99,6 @@ const presets: PresetItem[] = [
     recommended: true,
     outputWindow: true,
   },
-  {
-    id: "sshKey",
-    name: "Copy SSH public key",
-    description: "Adds a selected ~/.ssh public key to authorized_keys on the server.",
-    command: "",
-    recommended: true,
-  },
 ];
 
 export default function SetupPresets({ server, onPanelInfoSaved, onServerUpdated, onDone }: SetupPresetsProps) {
@@ -147,7 +147,7 @@ export default function SetupPresets({ server, onPanelInfoSaved, onServerUpdated
     setNewKeyName(`nodenet_${server.id}_ed25519`);
   }, [server.id]);
 
-  const runPreset = async (preset: PresetItem) => {
+  const runPreset = async (preset: PresetItem, rethrow = false) => {
     setError("");
     setMessage("");
     setRunning(preset.id);
@@ -175,7 +175,11 @@ export default function SetupPresets({ server, onPanelInfoSaved, onServerUpdated
         setShowPanelCredentialPrompt(true);
       }
     } catch (err) {
-      setError(err instanceof Error ? err.message : String(err));
+      const error = err instanceof Error ? err : new Error(String(err));
+      setError(error.message);
+      if (rethrow) {
+        throw error;
+      }
     } finally {
       setRunning(null);
     }
@@ -188,7 +192,7 @@ export default function SetupPresets({ server, onPanelInfoSaved, onServerUpdated
     try {
       for (const preset of presets) {
         if (selected[preset.id]) {
-          await runPreset(preset);
+          await runPreset(preset, true);
         }
       }
       if (selected.install3xui) {
@@ -207,16 +211,18 @@ export default function SetupPresets({ server, onPanelInfoSaved, onServerUpdated
         throw new Error("Your management IP is required before configuring UFW.");
       }
       const ip = shellQuote(managementIp.trim());
+      const sshPort = Math.max(1, Math.min(65535, Math.round(server.sshPort || 22)));
       return [
         "if ! command -v ufw >/dev/null 2>&1; then apt-get update && apt-get install -y ufw; fi",
-        `ufw allow from ${ip} to any port 22`,
-        "ufw delete allow 22/tcp || true",
+        `ufw allow from ${ip} to any port ${sshPort}`,
+        `ufw delete allow ${sshPort}/tcp || true`,
+        sshPort === 22 ? "" : "ufw delete allow 22/tcp || true",
         "ufw allow 65333/tcp",
         "ufw allow 443/tcp",
         "yes | ufw enable",
         "ufw reload",
         "ufw status verbose",
-      ].join(" && ");
+      ].filter(Boolean).join(" && ");
     }
 
     if (preset.id === "sshKey") {