fix34: устранён import-time баг i18n, усилен SSH tunnel policy и doctor warning

orchestrator/src/commands/doctor.ts

@@ -1,10 +1,61 @@
 import type { ReconfigureContext, ReconfigureOptions } from "../types/context";
 import { readText } from "../lib/fs";
-import { setOperationContext, step, stepDone } from "../lib/log";
+import { info, setOperationContext, step, stepDone } from "../lib/log";
 import { parseRuntimeEnv } from "../config/env";
 import { preflight } from "../steps/preflight";
 import { smoke } from "../steps/smoke";
 import { readInstalledHysteriaVersion, readPackageValue } from "../lib/packageMeta";
+import { run } from "../lib/process";
+
+function hasPermitOpenForLocalUi(value: string): boolean {
+  const normalized = value.trim().toLowerCase();
+  if (!normalized) {
+    return false;
+  }
+  if (normalized === "any") {
+    return true;
+  }
+  return normalized.split(/\s+/).includes("127.0.0.1:8080") || normalized.split(/\s+/).includes("localhost:8080");
+}
+
+async function checkSshForwardingForLocalUi(uiBindHost: string): Promise<void> {
+  if (uiBindHost !== "127.0.0.1") {
+    return;
+  }
+
+  try {
+    const sshdConfigText = await run`sshd -T`;
+    const lines = sshdConfigText.split(/\r?\n/);
+    const effective = new Map<string, string>();
+    for (const line of lines) {
+      const normalized = line.trim();
+      if (!normalized) {
+        continue;
+      }
+      const separator = normalized.indexOf(" ");
+      if (separator <= 0) {
+        continue;
+      }
+      const key = normalized.slice(0, separator).trim();
+      const value = normalized.slice(separator + 1).trim();
+      effective.set(key, value);
+    }
+
+    const allowTcpForwarding = (effective.get("allowtcpforwarding") || "").toLowerCase();
+    const permitOpen = effective.get("permitopen") || "";
+
+    const forwardingEnabled = allowTcpForwarding === "yes" || allowTcpForwarding === "all" || allowTcpForwarding === "local";
+    const permitOpenValid = hasPermitOpenForLocalUi(permitOpen);
+
+    if (!forwardingEnabled || !permitOpenValid) {
+      info(
+        "WARNING: UI is local-only, but SSH local forwarding is disabled or restricted (allowtcpforwarding/permitopen). Verify sshd policy for 127.0.0.1:8080 tunnel access."
+      );
+    }
+  } catch {
+    info("WARNING: unable to read effective sshd config via `sshd -T`; skipping SSH forwarding advisory check.");
+  }
+}
 
 export async function doctor(options: ReconfigureOptions): Promise<void> {
   setOperationContext(`doctor-${Date.now().toString(36)}`);
@@ -24,6 +75,9 @@ export async function doctor(options: ReconfigureOptions): Promise<void> {
   step("doctor preflight");
   await preflight(context);
   stepDone("doctor preflight");
+
+  await checkSshForwardingForLocalUi(context.config.uiBindHost);
+
   step("doctor smoke");
   await smoke(context);
   stepDone("doctor smoke");