fix: portable 绿色单机版 SSH 连接 + 主机数据 + 打包体积

SSH 连接修复：
- main.cjs 顶部在所有 ssh2 require 之前安装 boringSslDhCompat 补丁
- 5 条 SSH 连接路径统一 legacyAlgorithms 默认值为 true

portable 版主机数据修复：
- main.cjs portable 模式设置 NETCATTY_PORTABLE=1
- preload.cjs 暴露 window.netcatty.isPortable
- useVaultState portable 模式跳过 safeStorage DPAPI 加密的 hosts_v1
- inspection saveVaultHosts handler 补 legacyAlgorithms/tags/os 字段映射

打包体积修复：
- 恢复 electron-builder.config.cjs 原始 40+ 条排除规则
- package.json 加 pend 运行时依赖

electron/bridges/inspection/index.cjs

@@ -1620,9 +1620,12 @@ function registerInspectionHandlers(ipcMain, options) {
         identityFileId: h.identityFileId,
         privateKey: h.privateKey,
         passphrase: h.passphrase,
+        tags: h.tags || [],
+        os: h.os || "linux",
         type: h.type || "",
         distro: h.distro || h.catalogId || "",
         group: h.group || "",
+        legacyAlgorithms: h.legacyAlgorithms,
       }));
       writeStorage("_vault_hosts", mapped);
       return { ok: true, count: mapped.length };

electron/bridges/portForwardingBridge.cjs

@@ -1388,7 +1388,7 @@ async function startPortForward(event, payload) {
     keepaliveCountMax: keepalivePolicy.keepaliveCountMax,
     // Enable keyboard-interactive authentication (required for 2FA/MFA)
     tryKeyboard: true,
-    algorithms: buildAlgorithms(legacyAlgorithms, { skipEcdsaHostKey, algorithmOverrides }),
+    algorithms: buildAlgorithms(legacyAlgorithms !== false, { skipEcdsaHostKey, algorithmOverrides }),
   };
   connectOpts.hostVerifier = hostKeyVerifier.createHostVerifier({
     sender,

electron/bridges/sshBridge.cjs

@@ -346,7 +346,7 @@ function createSshDiagnosticLogger(enabled) {
 
 function shouldLogSshDebugMessage(msg) {
   if (typeof msg !== "string") return false;
-  return /auth|publickey|keyboard|handshake|kex|newkeys|dh gex/i.test(msg);
+  return /auth|publickey|keyboard|handshake|kex|newkeys|dh gex|Inbound|Outbound/i.test(msg);
 }
 
 function attachSshDebugLogger(connectOpts, logger = log) {
@@ -586,8 +586,14 @@ async function connectThroughChain(event, options, jumpHosts, targetHost, target
         //   when the leaf's ECDSA skip is applied to it. Treat both as
         //   strictly per-host: an unset hop value uses the hop's default
         //   offer, not the leaf's narrower setting.
+        // Default legacyAlgorithms to true so NetMesh can connect to older
+        // network devices (Huawei, H3C, Cisco, etc.) that only support
+        // legacy KEX algorithms like diffie-hellman-group1-sha1. Modern
+        // devices still negotiate the strongest mutually supported algorithm
+        // first — offering legacy algorithms alongside modern ones does not
+        // weaken security on capable servers.
         algorithms: buildAlgorithms(
-          jump.legacyAlgorithms ?? options.legacyAlgorithms,
+          (jump.legacyAlgorithms ?? options.legacyAlgorithms) !== false,
           {
             skipEcdsaHostKey: jump.skipEcdsaHostKey,
             algorithmOverrides: jump.algorithmOverrides,
@@ -607,7 +613,7 @@ async function connectThroughChain(event, options, jumpHosts, targetHost, target
       logSshAlgorithms("Jump host", connOpts.algorithms, {
         hostname: jump.hostname,
         port: jump.port || 22,
-        legacyAlgorithms: !!(jump.legacyAlgorithms ?? options.legacyAlgorithms),
+        legacyAlgorithms: ((jump.legacyAlgorithms ?? options.legacyAlgorithms) !== false),
         skipEcdsaHostKey: !!jump.skipEcdsaHostKey,
         hasAlgorithmOverrides: !!jump.algorithmOverrides,
       }, sshDiagnosticLogger);

electron/bridges/sshBridge/execCommand.cjs

@@ -135,7 +135,7 @@ function createExecCommandApi(ctx) {
           // KEX / cipher / host-key set as the interactive terminal. Without
           // this, a host that needs the ECDSA skip or legacy algorithms would
           // connect in the terminal but still fail the same handshake here.
-          algorithms: buildAlgorithms(payload.legacyAlgorithms, {
+          algorithms: buildAlgorithms(payload.legacyAlgorithms !== false, {
             skipEcdsaHostKey: payload.skipEcdsaHostKey,
             algorithmOverrides: payload.algorithmOverrides,
           }),

electron/bridges/sshBridge/startSession.cjs

@@ -362,7 +362,7 @@ function createStartSessionApi(ctx) {
           authMethod: options.authMethod || undefined,
           knownHosts: Array.isArray(options.knownHosts) ? options.knownHosts : undefined,
           verifyHostKeys: options.verifyHostKeys !== false,
-          legacyAlgorithms: !!options.legacyAlgorithms,
+          legacyAlgorithms: options.legacyAlgorithms !== false,
           skipEcdsaHostKey: !!options.skipEcdsaHostKey,
           algorithmOverrides: options.algorithmOverrides,
           useSshAgent: options.useSshAgent,
@@ -1470,7 +1470,11 @@ function createStartSessionApi(ctx) {
           keepaliveCountMax: keepalivePolicy.keepaliveCountMax,
           // Enable keyboard-interactive authentication (required for 2FA/MFA)
           tryKeyboard: true,
-          algorithms: buildAlgorithms(options.legacyAlgorithms, {
+          // Default legacyAlgorithms to true so older network devices (Huawei,
+          // H3C, Cisco, etc.) that only support legacy KEX algorithms like
+          // diffie-hellman-group1-sha1 can still connect. Modern devices still
+          // negotiate the strongest mutually supported algorithm first.
+          algorithms: buildAlgorithms(options.legacyAlgorithms !== false, {
             skipEcdsaHostKey: options.skipEcdsaHostKey,
             algorithmOverrides: options.algorithmOverrides,
           }),
@@ -1479,7 +1483,7 @@ function createStartSessionApi(ctx) {
         logSshAlgorithms("Target host", connectOpts.algorithms, {
           hostname: options.hostname,
           port: options.port || 22,
-          legacyAlgorithms: !!options.legacyAlgorithms,
+          legacyAlgorithms: options.legacyAlgorithms !== false,
           skipEcdsaHostKey: !!options.skipEcdsaHostKey,
           hasAlgorithmOverrides: !!options.algorithmOverrides,
         }, log);