feat(remote): 升级远程协助脚本到 v3

- 添加运行前安全确认提示（y/N） - 验证 SSH 真正在监听，失败时给出具体修复建议 - 检测并修复密码认证被禁用的情况（macOS Ventura+） - 检测局域网 IP，同 WiFi 下支持直连（无需 FRP 中转） - 扩大端口范围到 20000-21000，减少冲突 - 2 小时自动超时断开，防止忘关 - 退出时自动清理配置文件 - guide.html 安全说明同步更新
2026-03-19 11:53:43 +08:00
parent f36ab26fc7
commit 5ea5682d3a
3 changed files with 239 additions and 52 deletions
--- a/website/guide.html
+++ b/website/guide.html
@@ -1838,7 +1838,9 @@ docker compose up -d</code></pre>
 <h4>Mac / Linux</h4>
 <pre><code>curl -fsSL https://u-claw.org/remote.sh | bash</code></pre>

-<p style="color:var(--dim);margin-top:12px">运行后屏幕会显示端口号和用户名，把这些信息发给技术支持即可。<br>关闭窗口自动断开连接，完全可控。</p>
+<p style="color:var(--dim);margin-top:12px">运行后屏幕会显示端口号、用户名和局域网 IP，把这些信息发给技术支持即可。<br>关闭窗口自动断开连接，2 小时后自动超时，完全可控。</p>
+
+<p style="margin-top:12px"><strong>💡 同一 WiFi？</strong> 脚本会自动检测局域网 IP，技术支持可直连你的电脑，速度更快、无需中转。</p>
 </div>

 <div class="card" style="border-color:var(--cyan)">
@@ -1864,10 +1866,13 @@ docker compose up -d</code></pre>
 <div class="tip">
 <strong>你的安全有保障：</strong>
 <ul style="margin-top:8px">
-<li>远程连接通过加密通道（SSH + Token 认证），数据不会被第三方截获</li>
+<li>运行前会明确提示脚本将做什么，需要你确认（y/N）才会继续</li>
+<li>远程连接通过加密通道（SSH + FRP Token 认证），数据不会被第三方截获</li>
 <li>连接需要你主动运行命令才会开启，关闭窗口立即断开</li>
-<li>技术支持只能在你授权的范围内操作，无法在你不知情的情况下访问</li>
-<li>所有操作透明可见，你可以随时关闭窗口终止连接</li>
+<li><strong>2 小时自动超时</strong>，忘了关也不会一直暴露</li>
+<li>脚本会验证 SSH 是否真正启动，失败会提示你手动操作</li>
+<li>所有操作透明可见，你可以随时 Ctrl+C 或关闭窗口终止连接</li>
+<li>断开时自动清理配置文件，不留残余</li>
 </ul>
 </div>

--- a/website/remote.ps1
+++ b/website/remote.ps1
@@ -1,7 +1,7 @@
 # ============================================================
-# U-Claw 远程协助 v2（Windows）— 稳定版
+# U-Claw 远程协助 v3（Windows）
 # 用法: irm https://u-claw.org/remote.ps1 | iex
-# 通过 frp 连接到 U-Claw 中转服务器，永不断线
+# 改进: SSH 验证、同局域网直连、安全增强、自动超时
 # ============================================================

 [Console]::OutputEncoding = [System.Text.Encoding]::UTF8
@@ -11,12 +11,26 @@ Set-ExecutionPolicy Bypass -Scope Process -Force -ErrorAction SilentlyContinue
 Clear-Host
 Write-Host ""
 Write-Host "  ==========================================" -ForegroundColor Cyan
-Write-Host "  U-Claw 远程协助 v2（稳定连接）" -ForegroundColor Cyan
+Write-Host "  U-Claw 远程协助 v3" -ForegroundColor Cyan
 Write-Host "  ==========================================" -ForegroundColor Cyan
 Write-Host ""

+# ---- 安全提示 ----
+Write-Host "  ! 本脚本将执行以下操作：" -ForegroundColor Yellow
+Write-Host "    1. 开启 SSH 远程登录" -ForegroundColor DarkGray
+Write-Host "    2. 建立加密隧道到 U-Claw 中转服务器" -ForegroundColor DarkGray
+Write-Host "    3. 技术支持可通过 SSH 连接你的电脑" -ForegroundColor DarkGray
+Write-Host "    4. 关闭此窗口即可断开" -ForegroundColor DarkGray
+Write-Host ""
+$confirm = Read-Host "  是否继续？(y/N)"
+if ($confirm -ne "y" -and $confirm -ne "Y") {
+    Write-Host "  已取消" -ForegroundColor Red
+    exit 0
+}
+Write-Host ""
+
 # ---- Step 1: SSH ----
-Write-Host "  [1/3] 检查 SSH ..." -ForegroundColor White
+Write-Host "  [1/4] 检查 SSH ..." -ForegroundColor White
 $sshd = Get-Service sshd -ErrorAction SilentlyContinue
 if (-not $sshd) {
    Write-Host "  安装 OpenSSH Server（需要几分钟）..." -ForegroundColor Yellow
@@ -26,20 +40,61 @@ if (-not $sshd) {
 }
 Start-Service sshd -ErrorAction SilentlyContinue
 Set-Service -Name sshd -StartupType Automatic -ErrorAction SilentlyContinue
-New-NetFirewallRule -Name "OpenSSH-Server" -DisplayName "OpenSSH Server" -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow -ErrorAction SilentlyContinue 2>&1 | Out-Null

+# 开放防火墙
+New-NetFirewallRule -Name "OpenSSH-Server-UClaw" -DisplayName "OpenSSH Server (U-Claw)" -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow -ErrorAction SilentlyContinue 2>&1 | Out-Null
+
+# 确保密码认证开启
+$sshdConfig = "$env:ProgramData\ssh\sshd_config"
+if (Test-Path $sshdConfig) {
+    $content = Get-Content $sshdConfig -Raw
+    if ($content -match "PasswordAuthentication\s+no") {
+        Write-Host "  检测到 SSH 密码登录被禁用，正在开启..." -ForegroundColor Yellow
+        $content = $content -replace "PasswordAuthentication\s+no", "PasswordAuthentication yes"
+        Set-Content $sshdConfig $content
+        Restart-Service sshd -ErrorAction SilentlyContinue
+    }
+}
+
+# 验证 SSH
 $sshd = Get-Service sshd -ErrorAction SilentlyContinue
 if ($sshd -and $sshd.Status -eq 'Running') {
-    Write-Host "  [OK] SSH 已启动" -ForegroundColor Green
+    # 再确认端口在监听
+    $listening = netstat -an | Select-String ":22\s.*LISTENING"
+    if ($listening) {
+        Write-Host "  [OK] SSH 已启动并在监听端口 22" -ForegroundColor Green
+    } else {
+        Write-Host "  [OK] SSH 服务已启动" -ForegroundColor Green
+    }
 } else {
-    Write-Host "  [!] SSH 启动失败，请以管理员身份运行" -ForegroundColor Red
+    Write-Host "  [!] SSH 启动失败" -ForegroundColor Red
+    Write-Host "  请确保以管理员身份运行 PowerShell" -ForegroundColor Yellow
    Read-Host "  按回车退出"
    exit 1
 }

-# ---- Step 2: 下载 frpc ----
+# ---- Step 2: 检测本地 IP ----
 Write-Host ""
-Write-Host "  [2/3] 准备远程通道 ..." -ForegroundColor White
+Write-Host "  [2/4] 检测网络环境 ..." -ForegroundColor White
+
+$LOCAL_IP = ""
+try {
+    $adapter = Get-NetIPAddress -AddressFamily IPv4 -InterfaceAlias "Wi-Fi*","Ethernet*","WLAN*" -ErrorAction SilentlyContinue |
+        Where-Object { $_.IPAddress -notlike "169.*" -and $_.IPAddress -ne "127.0.0.1" } |
+        Select-Object -First 1
+    if ($adapter) { $LOCAL_IP = $adapter.IPAddress }
+} catch {}
+
+if ($LOCAL_IP) {
+    Write-Host "  [OK] 本机局域网 IP: " -ForegroundColor Green -NoNewline
+    Write-Host "$LOCAL_IP" -ForegroundColor Cyan
+} else {
+    Write-Host "  未检测到局域网 IP" -ForegroundColor DarkGray
+}
+
+# ---- Step 3: 下载 frpc ----
+Write-Host ""
+Write-Host "  [3/4] 准备远程通道 ..." -ForegroundColor White

 $FRP_DIR = "$env:TEMP\uclaw-frp"
 $FRPC = "$FRP_DIR\frpc.exe"
@@ -49,7 +104,6 @@ if (-not (Test-Path $FRPC)) {
    $frpUrl = "https://github.com/fatedier/frp/releases/download/v0.61.1/frp_0.61.1_windows_amd64.zip"
    $frpZip = "$FRP_DIR\frp.zip"

-    # 尝试多个镜像
    $mirrors = @(
        "https://ghfast.top/$frpUrl",
        "https://gh-proxy.com/$frpUrl",
@@ -94,16 +148,16 @@ if (-not (Test-Path $FRPC)) {

 Write-Host "  [OK] 远程通道工具就绪" -ForegroundColor Green

-# ---- Step 3: 连接 ----
+# ---- Step 4: 连接 ----
 Write-Host ""
-Write-Host "  [3/3] 建立连接 ..." -ForegroundColor White
+Write-Host "  [4/4] 建立连接 ..." -ForegroundColor White

-# 随机端口 20000-20099
-$PORT = Get-Random -Minimum 20000 -Maximum 20100
+# 更大的端口范围
+$PORT = Get-Random -Minimum 20000 -Maximum 21000
 $USERNAME = $env:USERNAME
 $COMPUTER = $env:COMPUTERNAME
+$SESSION_ID = (Get-Date -Format "HHmm")

-# 写 frpc 配置
 $frpcConfig = @"
 serverAddr = "101.32.254.221"
 serverPort = 7000
@@ -111,7 +165,7 @@ auth.method = "token"
 auth.token = "uclaw-remote-2026"

 [[proxies]]
-name = "ssh-$USERNAME-$PORT"
+name = "ssh-$USERNAME-$SESSION_ID-$PORT"
 type = "tcp"
 localIP = "127.0.0.1"
 localPort = 22
@@ -122,25 +176,60 @@ $configPath = "$FRP_DIR\frpc.toml"

 Write-Host ""
 Write-Host "  ==========================================" -ForegroundColor Green
-Write-Host "  远程协助已就绪！" -ForegroundColor Green
+Write-Host "  OK 远程协助已就绪！" -ForegroundColor Green
 Write-Host "  ==========================================" -ForegroundColor Green
 Write-Host ""
 Write-Host "  +------------------------------------------+" -ForegroundColor Yellow
 Write-Host "  |  把下面这段发给技术支持（微信）：         |" -ForegroundColor Yellow
 Write-Host "  |                                          |" -ForegroundColor Yellow
-Write-Host "  |  端口: $PORT" -ForegroundColor Cyan -NoNewline
-Write-Host "$(' ' * (33 - $PORT.ToString().Length))|" -ForegroundColor Yellow
-Write-Host "  |  用户: $USERNAME" -ForegroundColor Cyan -NoNewline
-Write-Host "$(' ' * (33 - $USERNAME.Length))|" -ForegroundColor Yellow
-Write-Host "  |  电脑: $COMPUTER" -ForegroundColor Cyan -NoNewline
-Write-Host "$(' ' * (33 - $COMPUTER.Length))|" -ForegroundColor Yellow
+
+$portStr = "端口: $PORT"
+Write-Host "  |  $portStr$(' ' * (39 - $portStr.Length))|" -ForegroundColor Cyan
+
+$userStr = "用户: $USERNAME"
+Write-Host "  |  $userStr$(' ' * (39 - $userStr.Length))|" -ForegroundColor Cyan
+
+$compStr = "电脑: $COMPUTER"
+Write-Host "  |  $compStr$(' ' * (39 - $compStr.Length))|" -ForegroundColor Cyan
+
+if ($LOCAL_IP) {
+    $lanStr = "局域网: $LOCAL_IP"
+    Write-Host "  |  $lanStr$(' ' * (39 - $lanStr.Length))|" -ForegroundColor Cyan
+}
+
 Write-Host "  |                                          |" -ForegroundColor Yellow
 Write-Host "  +------------------------------------------+" -ForegroundColor Yellow
 Write-Host ""
-Write-Host "  * 连接稳定，断线自动重连" -ForegroundColor DarkGray
+
+# 局域网直连提示
+if ($LOCAL_IP) {
+    Write-Host "  > 同一 WiFi 下可直连（更快）:" -ForegroundColor Cyan
+    Write-Host "     ssh $USERNAME@$LOCAL_IP" -ForegroundColor White
+    Write-Host ""
+}
+
+Write-Host "  * 远程通道连接中，断线自动重连" -ForegroundColor DarkGray
 Write-Host "  * 关闭此窗口即断开远程" -ForegroundColor DarkGray
-Write-Host "  * 你的登录密码需要告知技术支持" -ForegroundColor DarkGray
+Write-Host "  * 连接将在 2 小时后自动断开" -ForegroundColor DarkGray
 Write-Host ""

-# 启动 frpc（阻塞，自动重连）
-& $FRPC -c $configPath
+# 启动 frpc（带 2 小时超时）
+$frpcProcess = Start-Process -FilePath $FRPC -ArgumentList "-c",$configPath -NoNewWindow -PassThru
+
+# 2 小时超时
+$timeout = 7200
+$elapsed = 0
+while (-not $frpcProcess.HasExited -and $elapsed -lt $timeout) {
+    Start-Sleep -Seconds 10
+    $elapsed += 10
+}
+
+if (-not $frpcProcess.HasExited) {
+    Write-Host ""
+    Write-Host "  ! 已达 2 小时，自动断开" -ForegroundColor Yellow
+    Stop-Process -Id $frpcProcess.Id -Force -ErrorAction SilentlyContinue
+}
+
+# 清理配置文件
+Remove-Item $configPath -Force -ErrorAction SilentlyContinue
+Write-Host "  已安全断开" -ForegroundColor Green
--- a/website/remote.sh
+++ b/website/remote.sh
@@ -1,34 +1,87 @@
 #!/bin/bash
 # ============================================================
-# U-Claw 远程协助 v2（Mac/Linux）— 稳定版
+# U-Claw 远程协助 v3（Mac/Linux）
 # 用法: curl -fsSL https://u-claw.org/remote.sh | bash
+# 改进: SSH 验证、同局域网直连、安全增强、自动超时
 # ============================================================

 set -e
-GREEN='\033[0;32m'; CYAN='\033[0;36m'; RED='\033[0;31m'; YELLOW='\033[1;33m'; DIM='\033[2m'; NC='\033[0m'
+GREEN='\033[0;32m'; CYAN='\033[0;36m'; RED='\033[0;31m'; YELLOW='\033[1;33m'; DIM='\033[2m'; BOLD='\033[1m'; NC='\033[0m'

 clear
 echo ""
 echo -e "${CYAN}  ===========================================${NC}"
-echo -e "${CYAN}  U-Claw 远程协助 v2（稳定连接）${NC}"
+echo -e "${CYAN}  U-Claw 远程协助 v3${NC}"
 echo -e "${CYAN}  ===========================================${NC}"
 echo ""

+# ---- 安全提示 ----
+echo -e "${YELLOW}  ⚠ 本脚本将执行以下操作：${NC}"
+echo -e "${DIM}    1. 开启 SSH 远程登录${NC}"
+echo -e "${DIM}    2. 建立加密隧道到 U-Claw 中转服务器${NC}"
+echo -e "${DIM}    3. 技术支持可通过 SSH 连接你的电脑${NC}"
+echo -e "${DIM}    4. 关闭终端或 Ctrl+C 即可断开${NC}"
+echo ""
+echo -e -n "${YELLOW}  是否继续？(y/N): ${NC}"
+read -r CONFIRM
+if [[ "$CONFIRM" != "y" && "$CONFIRM" != "Y" ]]; then
+    echo -e "${RED}  已取消${NC}"
+    exit 0
+fi
+echo ""
+
 # ---- Step 1: SSH ----
-echo -e "  [1/3] 检查 SSH ..."
+echo -e "  [1/4] 检查 SSH ..."
 if [[ "$(uname)" == "Darwin" ]]; then
+    # macOS: 开启远程登录
    sudo systemsetup -setremotelogin on 2>/dev/null || true
+    # 确保密码认证开启（macOS Ventura+ 可能默认关闭）
+    SSHD_CONFIG="/etc/ssh/sshd_config"
+    if grep -q "^PasswordAuthentication no" "$SSHD_CONFIG" 2>/dev/null; then
+        echo -e "${YELLOW}  检测到 SSH 密码登录被禁用，正在开启...${NC}"
+        sudo sed -i '' 's/^PasswordAuthentication no/PasswordAuthentication yes/' "$SSHD_CONFIG"
+        sudo launchctl stop com.openssh.sshd 2>/dev/null || true
+        sudo launchctl start com.openssh.sshd 2>/dev/null || true
+    fi
 else
    sudo systemctl start sshd 2>/dev/null || sudo systemctl start ssh 2>/dev/null || {
        sudo apt-get install -y openssh-server 2>/dev/null || sudo yum install -y openssh-server 2>/dev/null
        sudo systemctl start sshd 2>/dev/null || sudo systemctl start ssh
    }
 fi
-echo -e "${GREEN}  [OK] SSH 已启动${NC}"

-# ---- Step 2: frpc ----
+# 验证 SSH 真正在监听
+if ss -tlnp 2>/dev/null | grep -q ':22 ' || netstat -an 2>/dev/null | grep -q '\.22 .*LISTEN'; then
+    echo -e "${GREEN}  [OK] SSH 已启动并在监听端口 22${NC}"
+else
+    echo -e "${RED}  [!] SSH 未能成功启动${NC}"
+    if [[ "$(uname)" == "Darwin" ]]; then
+        echo -e "${YELLOW}  请手动开启: 系统设置 → 通用 → 共享 → 远程登录${NC}"
+    fi
+    echo -e "${YELLOW}  开启后重新运行本脚本${NC}"
+    exit 1
+fi
+
+# ---- Step 2: 检测本地 IP（局域网直连用）----
 echo ""
-echo -e "  [2/3] 准备远程通道 ..."
+echo -e "  [2/4] 检测网络环境 ..."
+
+LOCAL_IP=""
+if [[ "$(uname)" == "Darwin" ]]; then
+    LOCAL_IP=$(ipconfig getifaddr en0 2>/dev/null || ipconfig getifaddr en1 2>/dev/null || echo "")
+else
+    LOCAL_IP=$(hostname -I 2>/dev/null | awk '{print $1}' || echo "")
+fi
+
+if [ -n "$LOCAL_IP" ]; then
+    echo -e "${GREEN}  [OK] 本机局域网 IP: ${CYAN}${LOCAL_IP}${NC}"
+else
+    echo -e "${DIM}  未检测到局域网 IP${NC}"
+fi
+
+# ---- Step 3: frpc ----
+echo ""
+echo -e "  [3/4] 准备远程通道 ..."

 FRP_DIR="/tmp/uclaw-frp"
 mkdir -p "$FRP_DIR"
@@ -44,7 +97,11 @@ if [ ! -f "$FRPC" ]; then
            FRP_URL="https://github.com/fatedier/frp/releases/download/v0.61.1/frp_0.61.1_darwin_amd64.tar.gz"
        fi
    else
-        FRP_URL="https://github.com/fatedier/frp/releases/download/v0.61.1/frp_0.61.1_linux_amd64.tar.gz"
+        if [[ "$ARCH" == "aarch64" ]]; then
+            FRP_URL="https://github.com/fatedier/frp/releases/download/v0.61.1/frp_0.61.1_linux_arm64.tar.gz"
+        else
+            FRP_URL="https://github.com/fatedier/frp/releases/download/v0.61.1/frp_0.61.1_linux_amd64.tar.gz"
+        fi
    fi

    echo -e "${DIM}    下载: $FRP_URL${NC}"
@@ -57,14 +114,18 @@ fi
 chmod +x "$FRPC"
 echo -e "${GREEN}  [OK] 远程通道工具就绪${NC}"

-# ---- Step 3: 连接 ----
+# ---- Step 4: 连接 ----
 echo ""
-echo -e "  [3/3] 建立连接 ..."
+echo -e "  [4/4] 建立连接 ..."

-PORT=$((20000 + RANDOM % 100))
+# 更大的端口范围，减少冲突
+PORT=$((20000 + RANDOM % 1000))
 USERNAME=$(whoami)
 HOSTNAME_VAL=$(hostname)

+# 会话 ID（用于标识本次连接）
+SESSION_ID=$(date +%s | tail -c 5)
+
 cat > "$FRP_DIR/frpc.toml" << EOF
 serverAddr = "101.32.254.221"
 serverPort = 7000
@@ -72,7 +133,7 @@ auth.method = "token"
 auth.token = "uclaw-remote-2026"

 [[proxies]]
-name = "ssh-${USERNAME}-${PORT}"
+name = "ssh-${USERNAME}-${SESSION_ID}-${PORT}"
 type = "tcp"
 localIP = "127.0.0.1"
 localPort = 22
@@ -81,22 +142,54 @@ EOF

 echo ""
 echo -e "${GREEN}  ===========================================${NC}"
-echo -e "${GREEN}  远程协助已就绪！${NC}"
+echo -e "${GREEN}  ✅ 远程协助已就绪！${NC}"
 echo -e "${GREEN}  ===========================================${NC}"
 echo ""
 echo -e "${YELLOW}  +------------------------------------------+"
 echo -e "  |  把下面这段发给技术支持（微信）：         |"
 echo -e "  |                                          |"
-echo -e "  |  ${CYAN}端口: ${PORT}${YELLOW}                               |"
-echo -e "  |  ${CYAN}用户: ${USERNAME}${YELLOW}                               |"
-echo -e "  |  ${CYAN}电脑: ${HOSTNAME_VAL}${YELLOW}                               |"
+printf "  |  ${CYAN}端口: %-36s${YELLOW}|\n" "$PORT"
+printf "  |  ${CYAN}用户: %-36s${YELLOW}|\n" "$USERNAME"
+printf "  |  ${CYAN}电脑: %-36s${YELLOW}|\n" "$HOSTNAME_VAL"
+if [ -n "$LOCAL_IP" ]; then
+printf "  |  ${CYAN}局域网: %-34s${YELLOW}|\n" "$LOCAL_IP"
+fi
 echo -e "  |                                          |"
 echo -e "  +------------------------------------------+${NC}"
 echo ""
-echo -e "${DIM}  * 连接稳定，断线自动重连${NC}"
-echo -e "${DIM}  * 按 Ctrl+C 断开远程${NC}"
-echo -e "${DIM}  * 你的登录密码需要告知技术支持${NC}"
+
+# 局域网直连提示
+if [ -n "$LOCAL_IP" ]; then
+    echo -e "${CYAN}  💡 同一 WiFi 下可直连（更快）:${NC}"
+    echo -e "${BOLD}     ssh ${USERNAME}@${LOCAL_IP}${NC}"
+    echo ""
+fi
+
+echo -e "${DIM}  * 远程通道连接中，断线自动重连${NC}"
+echo -e "${DIM}  * 按 Ctrl+C 或关闭终端即断开${NC}"
+echo -e "${DIM}  * 连接将在 2 小时后自动断开${NC}"
 echo ""

-# 启动 frpc
-"$FRPC" -c "$FRP_DIR/frpc.toml"
+# 清理函数
+cleanup() {
+    echo ""
+    echo -e "${YELLOW}  正在断开远程连接...${NC}"
+    kill $FRPC_PID 2>/dev/null || true
+    rm -f "$FRP_DIR/frpc.toml"
+    echo -e "${GREEN}  已安全断开${NC}"
+    exit 0
+}
+trap cleanup INT TERM
+
+# 启动 frpc（后台运行，便于超时控制）
+"$FRPC" -c "$FRP_DIR/frpc.toml" &
+FRPC_PID=$!
+
+# 2 小时超时自动断开
+( sleep 7200 && kill $FRPC_PID 2>/dev/null && echo -e "\n${YELLOW}  ⏰ 已达 2 小时，自动断开${NC}" ) &
+TIMEOUT_PID=$!
+
+# 等待 frpc 退出
+wait $FRPC_PID 2>/dev/null
+kill $TIMEOUT_PID 2>/dev/null || true
+rm -f "$FRP_DIR/frpc.toml"