忘了 Tabby 保存的 SSH 密码？从 Windows 凭据管理器里找回来

# Tabby / Windows 凭据快速查看：列出凭据，按序号复制密码。
# 用法：powershell -ExecutionPolicy Bypass -File .\tabby-cred.ps1
# 也可整段粘贴到 PowerShell；之后可直接调用 Show-WinCred -Filter 192.168 / -Show
# 注意：脚本只用空格缩进、不用 here-string，避免粘贴时 Tab 补全和 '@ 必须顶格导致错位。

if (-not ('WinCredTool' -as [type])) {
    $src = @(
        'using System;'
        'using System.Collections.Generic;'
        'using System.ComponentModel;'
        'using System.Runtime.InteropServices;'
        'using System.Text;'
        'public class WinCredEntry {'
        '    public string Target; public string UserName; public int Type; public DateTime LastWritten;'
        '}'
        'public static class WinCredTool {'
        '    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]'
        '    struct CREDENTIAL {'
        '        public int Flags; public int Type; public string TargetName; public string Comment;'
        '        public long LastWritten; public int CredentialBlobSize; public IntPtr CredentialBlob;'
        '        public int Persist; public int AttributeCount; public IntPtr Attributes;'
        '        public string TargetAlias; public string UserName;'
        '    }'
        '    [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]'
        '    static extern bool CredEnumerate(string filter, int flags, out int count, out IntPtr creds);'
        '    [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]'
        '    static extern bool CredRead(string target, int type, int flags, out IntPtr cred);'
        '    [DllImport("advapi32.dll")]'
        '    static extern void CredFree(IntPtr buffer);'
        '    public static List<WinCredEntry> List() {'
        '        var result = new List<WinCredEntry>();'
        '        int count; IntPtr creds;'
        '        if (!CredEnumerate(null, 0, out count, out creds)) {'
        '            int err = Marshal.GetLastWin32Error();'
        '            if (err == 1168) return result;'
        '            throw new Win32Exception(err);'
        '        }'
        '        try {'
        '            for (int i = 0; i < count; i++) {'
        '                IntPtr p = Marshal.ReadIntPtr(creds, i * IntPtr.Size);'
        '                var c = (CREDENTIAL)Marshal.PtrToStructure(p, typeof(CREDENTIAL));'
        '                result.Add(new WinCredEntry { Target = c.TargetName, UserName = c.UserName, Type = c.Type,'
        '                    LastWritten = DateTime.FromFileTime(c.LastWritten) });'
        '            }'
        '        } finally { CredFree(creds); }'
        '        return result;'
        '    }'
        '    public static string Read(string target, int type) {'
        '        IntPtr p;'
        '        if (!CredRead(target, type, 0, out p)) throw new Win32Exception(Marshal.GetLastWin32Error());'
        '        try {'
        '            var c = (CREDENTIAL)Marshal.PtrToStructure(p, typeof(CREDENTIAL));'
        '            if (c.CredentialBlob == IntPtr.Zero || c.CredentialBlobSize <= 0) return "";'
        '            var blob = new byte[c.CredentialBlobSize];'
        '            Marshal.Copy(c.CredentialBlob, blob, 0, blob.Length);'
        '            return Decode(blob);'
        '        } finally { CredFree(p); }'
        '    }'
        '    static string Decode(byte[] b) {'
        '        // Tabby(keytar) 存 UTF-8；Windows 自己存的通用凭据多为 UTF-16'
        '        if (b.Length >= 2 && b.Length % 2 == 0) {'
        '            int zeros = 0;'
        '            for (int i = 1; i < b.Length; i += 2) if (b[i] == 0) zeros++;'
        '            if (zeros * 2 >= b.Length / 2) return Encoding.Unicode.GetString(b);'
        '        }'
        '        return Encoding.UTF8.GetString(b);'
        '    }'
        '}'
    ) -join "`n"
    Add-Type -TypeDefinition $src
}

function Show-WinCred {
    param(
        [string]$Filter = 'ssh@',  # Tabby 的目标名形如 ssh@主机:端口/用户名
        [switch]$Show              # 直接显示密码，默认只复制到剪贴板
    )
    $typeNames = @{ 1 = '通用'; 2 = '域密码'; 3 = '域证书'; 4 = '域可见' }
    while ($true) {
        $all = [WinCredTool]::List()
        $list = @($all | Where-Object { -not $Filter -or $_.Target -like "*$Filter*" -or $_.UserName -like "*$Filter*" } |
            Sort-Object Target)
        Write-Host ''
        Write-Host ("筛选：'{0}'  匹配 {1} / 共 {2} 条" -f $Filter, $list.Count, @($all).Count) -ForegroundColor Cyan
        for ($i = 0; $i -lt $list.Count; $i++) {
            $c = $list[$i]
            $t = $typeNames[$c.Type]; if (-not $t) { $t = "类型$($c.Type)" }
            Write-Host ("[{0,2}] {1,-24} {2}  ({3}, {4:yyyy-MM-dd})" -f ($i + 1), $c.UserName, $c.Target, $t, $c.LastWritten)
        }
        $in = (Read-Host '输入序号取密码；/关键字 重新筛选（单独 / 显示全部）；直接回车退出').Trim()
        if (-not $in) { return }
        if ($in.StartsWith('/')) { $Filter = $in.Substring(1).Trim(); continue }
        $n = 0
        if (-not [int]::TryParse($in, [ref]$n) -or $n -lt 1 -or $n -gt $list.Count) {
            Write-Host "无效序号：$in" -ForegroundColor Yellow
            continue
        }
        $c = $list[$n - 1]
        try {
            $secret = [WinCredTool]::Read($c.Target, $c.Type)
        } catch {
            Write-Host "读取失败：$($_.Exception.Message)" -ForegroundColor Red
            Write-Host '域密码类凭据系统不允许读出明文；另外必须用保存它的那个 Windows 用户运行。'
            continue
        }
        if ($Show) {
            Write-Host "$($c.UserName) @ $($c.Target)"
            Write-Host $secret -ForegroundColor Green
        } else {
            Set-Clipboard -Value $secret
            Write-Host "已复制 $($c.UserName) 的密码（$($secret.Length) 位）到剪贴板。" -ForegroundColor Green
            [void](Read-Host '粘贴完后按回车清空剪贴板')
            cmd /c 'echo off | clip'
            Write-Host '剪贴板已清空。'
        }
        $secret = $null
    }
}

Show-WinCred