@artenx/dshb 0.0.5 → 0.1.0

package/lib/exec-ssh/executor.js

@@ -0,0 +1,212 @@
+import { REMOTE_RUNNER_COMMAND, encodeRunnerPayload } from "./runner.js";
+import { homedir } from "node:os";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+//#region src/exec-ssh/executor.ts
+var SshExecutor = class {
+	connection;
+	nodeId;
+	audit;
+	sftpCache = null;
+	constructor(connection, nodeId = "unknown", audit) {
+		this.connection = connection;
+		this.nodeId = nodeId;
+		this.audit = audit;
+	}
+	async exec(argv, cwd, env = {}, stdinData) {
+		const client = await this.connection.getClient();
+		const body = encodeRunnerPayload({
+			argv,
+			cwd,
+			env
+		});
+		const input = stdinData ? Buffer.concat([body, stdinData]) : body;
+		return new Promise((resolve, reject) => {
+			client.exec(REMOTE_RUNNER_COMMAND, (err, channel) => {
+				if (err) {
+					reject(err);
+					return;
+				}
+				const stdout = [];
+				const stderr = [];
+				channel.stdout.on("data", (chunk) => stdout.push(chunk));
+				channel.stderr.on("data", (chunk) => stderr.push(chunk));
+				channel.on("close", (code, signal) => {
+					this.audit?.("exec", argv.join(" "), `code=${code ?? 0}`);
+					resolve({
+						code: code ?? 0,
+						signal,
+						stdout: Buffer.concat(stdout).toString("utf8"),
+						stderr: Buffer.concat(stderr).toString("utf8")
+					});
+				});
+				channel.on("error", reject);
+				channel.end(input);
+			});
+		});
+	}
+	async sftp() {
+		if (this.sftpCache) return this.sftpCache;
+		const client = await this.connection.getClient();
+		this.sftpCache = new Promise((resolve, reject) => {
+			client.sftp((err, sftp) => {
+				if (err) reject(err);
+				else resolve(sftp);
+			});
+		});
+		return this.sftpCache;
+	}
+	async readFile(path) {
+		const sftp = await this.sftp();
+		return new Promise((resolve, reject) => {
+			sftp.readFile(path, (err, data) => err ? reject(err) : resolve(data));
+		});
+	}
+	async writeFile(path, content) {
+		const sftp = await this.sftp();
+		const tmp = `${path}.dshb-tmp-${process.pid}-${Date.now()}`;
+		return new Promise((resolve, reject) => {
+			sftp.writeFile(tmp, content, (writeErr) => {
+				if (writeErr) {
+					reject(writeErr);
+					return;
+				}
+				sftp.ext_openssh_rename(tmp, path, (renameErr) => {
+					if (renameErr) reject(renameErr);
+					else {
+						this.audit?.("write", path, "ok");
+						resolve();
+					}
+				});
+			});
+		});
+	}
+	async listDir(path) {
+		const sftp = await this.sftp();
+		return new Promise((resolve, reject) => {
+			sftp.readdir(path, (err, list) => {
+				if (err) {
+					reject(err);
+					return;
+				}
+				resolve(list.map((e) => ({
+					name: e.filename,
+					isDir: e.attrs.isDirectory(),
+					isFile: e.attrs.isFile(),
+					isSymlink: e.attrs.isSymbolicLink(),
+					size: Number(e.attrs.size),
+					mtime: e.attrs.mtime * 1e3
+				})));
+			});
+		});
+	}
+	async stat(path) {
+		const sftp = await this.sftp();
+		return new Promise((resolve) => {
+			sftp.stat(path, (err, stats) => {
+				if (err) {
+					resolve(void 0);
+					return;
+				}
+				resolve({
+					size: Number(stats.size),
+					mtime: stats.mtime * 1e3,
+					isDirectory: stats.isDirectory(),
+					isFile: stats.isFile()
+				});
+			});
+		});
+	}
+	async mkdir(path) {
+		const sftp = await this.sftp();
+		return new Promise((resolve, reject) => {
+			sftp.mkdir(path, (err) => err ? reject(err) : resolve());
+		});
+	}
+	async remove(path) {
+		const sftp = await this.sftp();
+		return new Promise((resolve, reject) => {
+			sftp.unlink(path, (err) => {
+				if (err) reject(err);
+				else {
+					this.audit?.("remove", path, "ok");
+					resolve();
+				}
+			});
+		});
+	}
+	async rename(src, dest) {
+		const sftp = await this.sftp();
+		return new Promise((resolve, reject) => {
+			sftp.ext_openssh_rename(src, dest, (err) => {
+				if (err) reject(err);
+				else {
+					this.audit?.("move", `${src} -> ${dest}`, "ok");
+					resolve();
+				}
+			});
+		});
+	}
+	async ensureRg() {
+		if ((await this.exec([
+			"sh",
+			"-c",
+			"command -v rg || echo \"__DShB_RG_MISSING__\""
+		], "/")).stdout.includes("__DShB_RG_MISSING__")) {
+			const localRg = process.env.DSHB_LOCAL_RG ?? findLocalRg();
+			if (!localRg) return;
+			const remoteRgDir = "~/.dshb/bin";
+			await this.exec([
+				"mkdir",
+				"-p",
+				remoteRgDir
+			], "/");
+			const remoteRg = `${remoteRgDir}/rg`;
+			const content = readFileSync(localRg);
+			await this.writeFile(remoteRg, content);
+			await this.exec([
+				"chmod",
+				"+x",
+				remoteRg
+			], "/");
+		}
+	}
+	async pty(argv, cwd, _env, cols, rows) {
+		const client = await this.connection.getClient();
+		const q = (s) => `'${s.replace(/'/g, "'\\''")}'`;
+		const cmdParts = argv.map(q);
+		const command = `bash -c 'cd "$0" && exec env -i HOME="$HOME" PATH="\${PATH:-/usr/local/bin:/usr/bin:/bin}" "$@"' ${q(cwd)} ${cmdParts.join(" ")}`;
+		return new Promise((resolve, reject) => {
+			client.exec(command, { pty: {
+				cols,
+				rows,
+				term: "xterm-256color"
+			} }, (err, channel) => {
+				if (err) {
+					reject(err);
+					return;
+				}
+				resolve({
+					channel,
+					onData: (cb) => channel.on("data", cb),
+					resize: (c, r) => channel.setWindow(c, r, 0, 0),
+					kill: () => channel.close()
+				});
+			});
+		});
+	}
+};
+function findLocalRg() {
+	const candidates = [
+		join(homedir(), ".dsh", "node_modules", ".bin", "rg"),
+		join(homedir(), ".dsh", "node_modules", "@vscode", "ripgrep", "bin", "rg"),
+		join(homedir(), "go", "bin", "rg"),
+		"/usr/local/bin/rg",
+		"/usr/bin/rg"
+	];
+	for (const c of candidates) if (existsSync(c)) return c;
+}
+//#endregion
+export { SshExecutor };
+
+//# sourceMappingURL=executor.js.map

package/lib/exec-ssh/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","names":[],"sources":["../../src/exec-ssh/executor.ts"],"sourcesContent":["import { existsSync, readFileSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\nimport { encodeRunnerPayload, REMOTE_RUNNER_COMMAND, type RunnerPayload } from './runner.js'\nimport type { SshConnection } from './connection.js'\n\nexport interface ExecResult {\n  code: number\n  signal?: string\n  stdout: string\n  stderr: string\n}\n\nexport class SshExecutor {\n  private sftpCache: Promise<import('ssh2').SFTPWrapper> | null = null\n\n  constructor(\n    private readonly connection: SshConnection,\n    private readonly nodeId = 'unknown',\n    private readonly audit?: (op: string, target: string, result: string) => void,\n  ) {}\n\n  async exec(argv: string[], cwd: string, env: Record<string, string> = {}, stdinData?: Buffer): Promise<ExecResult> {\n    const client = await this.connection.getClient()\n    const payload: RunnerPayload = { argv, cwd, env }\n    const body = encodeRunnerPayload(payload)\n    const input = stdinData ? Buffer.concat([body, stdinData]) : body\n    return new Promise((resolve, reject) => {\n      client.exec(REMOTE_RUNNER_COMMAND, (err, channel) => {\n        if (err) {\n          reject(err)\n          return\n        }\n        const stdout: Buffer[] = []\n        const stderr: Buffer[] = []\n        channel.stdout.on('data', (chunk: Buffer) => stdout.push(chunk))\n        channel.stderr.on('data', (chunk: Buffer) => stderr.push(chunk))\n        channel.on('close', (code: number, signal: string) => {\n          this.audit?.('exec', argv.join(' '), `code=${code ?? 0}`)\n          resolve({\n            code: code ?? 0,\n            signal,\n            stdout: Buffer.concat(stdout).toString('utf8'),\n            stderr: Buffer.concat(stderr).toString('utf8'),\n          })\n        })\n        channel.on('error', reject)\n        channel.end(input)\n      })\n    })\n  }\n\n  async sftp(): Promise<import('ssh2').SFTPWrapper> {\n    if (this.sftpCache) return this.sftpCache\n    const client = await this.connection.getClient()\n    this.sftpCache = new Promise((resolve, reject) => {\n      client.sftp((err, sftp) => {\n        if (err) reject(err)\n        else resolve(sftp)\n      })\n    })\n    return this.sftpCache\n  }\n\n  async readFile(path: string): Promise<Buffer> {\n    const sftp = await this.sftp()\n    return new Promise((resolve, reject) => {\n      sftp.readFile(path, (err, data) => (err ? reject(err) : resolve(data)))\n    })\n  }\n\n  async writeFile(path: string, content: Buffer | string): Promise<void> {\n    const sftp = await this.sftp()\n    const tmp = `${path}.dshb-tmp-${process.pid}-${Date.now()}`\n    return new Promise((resolve, reject) => {\n      sftp.writeFile(tmp, content, (writeErr) => {\n        if (writeErr) {\n          reject(writeErr)\n          return\n        }\n        sftp.ext_openssh_rename(tmp, path, (renameErr) => {\n          if (renameErr) reject(renameErr)\n          else {\n            this.audit?.('write', path, 'ok')\n            resolve()\n          }\n        })\n      })\n    })\n  }\n\n  async listDir(path: string): Promise<Array<{ name: string; isDir: boolean; isFile: boolean; isSymlink: boolean; size: number; mtime: number }>> {\n    const sftp = await this.sftp()\n    return new Promise((resolve, reject) => {\n      sftp.readdir(path, (err, list) => {\n        if (err) {\n          reject(err)\n          return\n        }\n        resolve(\n          list.map((e) => ({\n            name: e.filename,\n            isDir: e.attrs.isDirectory(),\n            isFile: e.attrs.isFile(),\n            isSymlink: e.attrs.isSymbolicLink(),\n            size: Number(e.attrs.size),\n            mtime: e.attrs.mtime * 1000,\n          })),\n        )\n      })\n    })\n  }\n\n  async stat(path: string): Promise<{ size: number; mtime: number; isDirectory: boolean; isFile: boolean } | undefined> {\n    const sftp = await this.sftp()\n    return new Promise((resolve) => {\n      sftp.stat(path, (err, stats) => {\n        if (err) {\n          resolve(undefined)\n          return\n        }\n        resolve({ size: Number(stats.size), mtime: stats.mtime * 1000, isDirectory: stats.isDirectory(), isFile: stats.isFile() })\n      })\n    })\n  }\n\n  async mkdir(path: string): Promise<void> {\n    const sftp = await this.sftp()\n    return new Promise((resolve, reject) => {\n      sftp.mkdir(path, (err) => (err ? reject(err) : resolve()))\n    })\n  }\n\n  async remove(path: string): Promise<void> {\n    const sftp = await this.sftp()\n    return new Promise((resolve, reject) => {\n      sftp.unlink(path, (err) => {\n        if (err) reject(err)\n        else {\n          this.audit?.('remove', path, 'ok')\n          resolve()\n        }\n      })\n    })\n  }\n\n  async rename(src: string, dest: string): Promise<void> {\n    const sftp = await this.sftp()\n    return new Promise((resolve, reject) => {\n      sftp.ext_openssh_rename(src, dest, (err) => {\n        if (err) reject(err)\n        else {\n          this.audit?.('move', `${src} -> ${dest}`, 'ok')\n          resolve()\n        }\n      })\n    })\n  }\n\n  async ensureRg(): Promise<void> {\n    const result = await this.exec(['sh', '-c', 'command -v rg || echo \"__DShB_RG_MISSING__\"'], '/')\n    if (result.stdout.includes('__DShB_RG_MISSING__')) {\n      const localRg = process.env.DSHB_LOCAL_RG ?? findLocalRg()\n      if (!localRg) return\n      const remoteRgDir = '~/.dshb/bin'\n      await this.exec(['mkdir', '-p', remoteRgDir], '/')\n      const remoteRg = `${remoteRgDir}/rg`\n      const content = readFileSync(localRg)\n      await this.writeFile(remoteRg, content)\n      await this.exec(['chmod', '+x', remoteRg], '/')\n    }\n  }\n\n  async pty(argv: string[], cwd: string, _env: Record<string, string>, cols: number, rows: number): Promise<{ channel: import('ssh2').ClientChannel; onData: (cb: (chunk: Buffer) => void) => void; resize: (cols: number, rows: number) => void; kill: () => void }> {\n    const client = await this.connection.getClient()\n    const q = (s: string) => `'${s.replace(/'/g, \"'\\\\''\")}'`\n    const cmdParts = argv.map(q)\n    const command = `bash -c 'cd \"$0\" && exec env -i HOME=\"$HOME\" PATH=\"\\${PATH:-/usr/local/bin:/usr/bin:/bin}\" \"$@\"' ${q(cwd)} ${cmdParts.join(' ')}`\n    return new Promise((resolve, reject) => {\n      client.exec(\n        command,\n        { pty: { cols, rows, term: 'xterm-256color' } },\n        (err, channel) => {\n          if (err) {\n            reject(err)\n            return\n          }\n          resolve({\n            channel,\n            onData: (cb) => channel.on('data', cb),\n            resize: (c, r) => channel.setWindow(c, r, 0, 0),\n            kill: () => channel.close(),\n          })\n        },\n      )\n    })\n  }\n}\n\nfunction findLocalRg(): string | undefined {\n  const candidates = [\n    join(homedir(), '.dsh', 'node_modules', '.bin', 'rg'),\n    join(homedir(), '.dsh', 'node_modules', '@vscode', 'ripgrep', 'bin', 'rg'),\n    join(homedir(), 'go', 'bin', 'rg'),\n    '/usr/local/bin/rg',\n    '/usr/bin/rg',\n  ]\n  for (const c of candidates) if (existsSync(c)) return c\n  return undefined\n}\n"],"mappings":";;;;;AAaA,IAAa,cAAb,MAAyB;CAIJ;CACA;CACA;CALnB,YAAgE;CAEhE,YACE,YACA,SAA0B,WAC1B,OACA;EAHiB,KAAA,aAAA;EACA,KAAA,SAAA;EACA,KAAA,QAAA;CAChB;CAEH,MAAM,KAAK,MAAgB,KAAa,MAA8B,CAAC,GAAG,WAAyC;EACjH,MAAM,SAAS,MAAM,KAAK,WAAW,UAAU;EAE/C,MAAM,OAAO,oBAAoB;GADA;GAAM;GAAK;EACL,CAAC;EACxC,MAAM,QAAQ,YAAY,OAAO,OAAO,CAAC,MAAM,SAAS,CAAC,IAAI;EAC7D,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,OAAO,KAAK,wBAAwB,KAAK,YAAY;IACnD,IAAI,KAAK;KACP,OAAO,GAAG;KACV;IACF;IACA,MAAM,SAAmB,CAAC;IAC1B,MAAM,SAAmB,CAAC;IAC1B,QAAQ,OAAO,GAAG,SAAS,UAAkB,OAAO,KAAK,KAAK,CAAC;IAC/D,QAAQ,OAAO,GAAG,SAAS,UAAkB,OAAO,KAAK,KAAK,CAAC;IAC/D,QAAQ,GAAG,UAAU,MAAc,WAAmB;KACpD,KAAK,QAAQ,QAAQ,KAAK,KAAK,GAAG,GAAG,QAAQ,QAAQ,GAAG;KACxD,QAAQ;MACN,MAAM,QAAQ;MACd;MACA,QAAQ,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,MAAM;MAC7C,QAAQ,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,MAAM;KAC/C,CAAC;IACH,CAAC;IACD,QAAQ,GAAG,SAAS,MAAM;IAC1B,QAAQ,IAAI,KAAK;GACnB,CAAC;EACH,CAAC;CACH;CAEA,MAAM,OAA4C;EAChD,IAAI,KAAK,WAAW,OAAO,KAAK;EAChC,MAAM,SAAS,MAAM,KAAK,WAAW,UAAU;EAC/C,KAAK,YAAY,IAAI,SAAS,SAAS,WAAW;GAChD,OAAO,MAAM,KAAK,SAAS;IACzB,IAAI,KAAK,OAAO,GAAG;SACd,QAAQ,IAAI;GACnB,CAAC;EACH,CAAC;EACD,OAAO,KAAK;CACd;CAEA,MAAM,SAAS,MAA+B;EAC5C,MAAM,OAAO,MAAM,KAAK,KAAK;EAC7B,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,KAAK,SAAS,OAAO,KAAK,SAAU,MAAM,OAAO,GAAG,IAAI,QAAQ,IAAI,CAAE;EACxE,CAAC;CACH;CAEA,MAAM,UAAU,MAAc,SAAyC;EACrE,MAAM,OAAO,MAAM,KAAK,KAAK;EAC7B,MAAM,MAAM,GAAG,KAAK,YAAY,QAAQ,IAAI,GAAG,KAAK,IAAI;EACxD,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,KAAK,UAAU,KAAK,UAAU,aAAa;IACzC,IAAI,UAAU;KACZ,OAAO,QAAQ;KACf;IACF;IACA,KAAK,mBAAmB,KAAK,OAAO,cAAc;KAChD,IAAI,WAAW,OAAO,SAAS;UAC1B;MACH,KAAK,QAAQ,SAAS,MAAM,IAAI;MAChC,QAAQ;KACV;IACF,CAAC;GACH,CAAC;EACH,CAAC;CACH;CAEA,MAAM,QAAQ,MAAkI;EAC9I,MAAM,OAAO,MAAM,KAAK,KAAK;EAC7B,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,KAAK,QAAQ,OAAO,KAAK,SAAS;IAChC,IAAI,KAAK;KACP,OAAO,GAAG;KACV;IACF;IACA,QACE,KAAK,KAAK,OAAO;KACf,MAAM,EAAE;KACR,OAAO,EAAE,MAAM,YAAY;KAC3B,QAAQ,EAAE,MAAM,OAAO;KACvB,WAAW,EAAE,MAAM,eAAe;KAClC,MAAM,OAAO,EAAE,MAAM,IAAI;KACzB,OAAO,EAAE,MAAM,QAAQ;IACzB,EAAE,CACJ;GACF,CAAC;EACH,CAAC;CACH;CAEA,MAAM,KAAK,MAA2G;EACpH,MAAM,OAAO,MAAM,KAAK,KAAK;EAC7B,OAAO,IAAI,SAAS,YAAY;GAC9B,KAAK,KAAK,OAAO,KAAK,UAAU;IAC9B,IAAI,KAAK;KACP,QAAQ,KAAA,CAAS;KACjB;IACF;IACA,QAAQ;KAAE,MAAM,OAAO,MAAM,IAAI;KAAG,OAAO,MAAM,QAAQ;KAAM,aAAa,MAAM,YAAY;KAAG,QAAQ,MAAM,OAAO;IAAE,CAAC;GAC3H,CAAC;EACH,CAAC;CACH;CAEA,MAAM,MAAM,MAA6B;EACvC,MAAM,OAAO,MAAM,KAAK,KAAK;EAC7B,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,KAAK,MAAM,OAAO,QAAS,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAE;EAC3D,CAAC;CACH;CAEA,MAAM,OAAO,MAA6B;EACxC,MAAM,OAAO,MAAM,KAAK,KAAK;EAC7B,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,KAAK,OAAO,OAAO,QAAQ;IACzB,IAAI,KAAK,OAAO,GAAG;SACd;KACH,KAAK,QAAQ,UAAU,MAAM,IAAI;KACjC,QAAQ;IACV;GACF,CAAC;EACH,CAAC;CACH;CAEA,MAAM,OAAO,KAAa,MAA6B;EACrD,MAAM,OAAO,MAAM,KAAK,KAAK;EAC7B,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,KAAK,mBAAmB,KAAK,OAAO,QAAQ;IAC1C,IAAI,KAAK,OAAO,GAAG;SACd;KACH,KAAK,QAAQ,QAAQ,GAAG,IAAI,MAAM,QAAQ,IAAI;KAC9C,QAAQ;IACV;GACF,CAAC;EACH,CAAC;CACH;CAEA,MAAM,WAA0B;EAE9B,KAAI,MADiB,KAAK,KAAK;GAAC;GAAM;GAAM;EAA6C,GAAG,GAAG,EAAA,CACpF,OAAO,SAAS,qBAAqB,GAAG;GACjD,MAAM,UAAU,QAAQ,IAAI,iBAAiB,YAAY;GACzD,IAAI,CAAC,SAAS;GACd,MAAM,cAAc;GACpB,MAAM,KAAK,KAAK;IAAC;IAAS;IAAM;GAAW,GAAG,GAAG;GACjD,MAAM,WAAW,GAAG,YAAY;GAChC,MAAM,UAAU,aAAa,OAAO;GACpC,MAAM,KAAK,UAAU,UAAU,OAAO;GACtC,MAAM,KAAK,KAAK;IAAC;IAAS;IAAM;GAAQ,GAAG,GAAG;EAChD;CACF;CAEA,MAAM,IAAI,MAAgB,KAAa,MAA8B,MAAc,MAAiL;EAClQ,MAAM,SAAS,MAAM,KAAK,WAAW,UAAU;EAC/C,MAAM,KAAK,MAAc,IAAI,EAAE,QAAQ,MAAM,OAAO,EAAE;EACtD,MAAM,WAAW,KAAK,IAAI,CAAC;EAC3B,MAAM,UAAU,oGAAoG,EAAE,GAAG,EAAE,GAAG,SAAS,KAAK,GAAG;EAC/I,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,OAAO,KACL,SACA,EAAE,KAAK;IAAE;IAAM;IAAM,MAAM;GAAiB,EAAE,IAC7C,KAAK,YAAY;IAChB,IAAI,KAAK;KACP,OAAO,GAAG;KACV;IACF;IACA,QAAQ;KACN;KACA,SAAS,OAAO,QAAQ,GAAG,QAAQ,EAAE;KACrC,SAAS,GAAG,MAAM,QAAQ,UAAU,GAAG,GAAG,GAAG,CAAC;KAC9C,YAAY,QAAQ,MAAM;IAC5B,CAAC;GACH,CACF;EACF,CAAC;CACH;AACF;AAEA,SAAS,cAAkC;CACzC,MAAM,aAAa;EACjB,KAAK,QAAQ,GAAG,QAAQ,gBAAgB,QAAQ,IAAI;EACpD,KAAK,QAAQ,GAAG,QAAQ,gBAAgB,WAAW,WAAW,OAAO,IAAI;EACzE,KAAK,QAAQ,GAAG,MAAM,OAAO,IAAI;EACjC;EACA;CACF;CACA,KAAK,MAAM,KAAK,YAAY,IAAI,WAAW,CAAC,GAAG,OAAO;AAExD"}

package/lib/exec-ssh/fs-provider.d.ts

@@ -0,0 +1,50 @@
+import { SshExecutor } from "./executor.js";
+//#region src/exec-ssh/fs-provider.d.ts
+declare class SshFileSystem {
+  private readonly executor;
+  constructor(executor: SshExecutor);
+  resolve(path: string): Promise<string>;
+  processPath(target: string): string;
+  fileUrl(target: string): string;
+  contains(parent: string, child: string): boolean;
+  stat(target: string, _signal?: AbortSignal): Promise<{
+    size: number;
+    mtime: number;
+    isDirectory: boolean;
+    isFile: boolean;
+  } | undefined>;
+  lstat(path: string, _opts?: {
+    cwd?: string;
+  }, _signal?: AbortSignal): Promise<{
+    size: number;
+    mtime: number;
+    isDirectory: boolean;
+    isFile: boolean;
+  } | undefined>;
+  readText(target: string, _signal?: AbortSignal): Promise<string>;
+  streamText(target: string, _signal?: AbortSignal): Promise<AsyncIterable<string>>;
+  readBytes(target: string, _signal: AbortSignal | undefined, maxBytes: number): Promise<Uint8Array>;
+  listDir(target: string, _signal?: AbortSignal): Promise<Array<{
+    name: string;
+    path: string;
+    isDirectory: boolean;
+    isFile: boolean;
+    isSymlink: boolean;
+    size: number;
+    mtime: number;
+  }>>;
+  writeText(target: string, content: string, _expected?: unknown, _signal?: AbortSignal, _policy?: unknown): Promise<{
+    operation: 'create' | 'update';
+    version: string;
+    before: string | null;
+    after: string;
+  }>;
+  editText(target: string, edit: unknown, _expected?: unknown, _signal?: AbortSignal, _policy?: unknown): Promise<{
+    version: string;
+    before: string;
+    after: string;
+  }>;
+}
+//#endregion
+export { SshFileSystem };
+//# sourceMappingURL=fs-provider.d.ts.map

package/lib/exec-ssh/fs-provider.js

@@ -0,0 +1,92 @@
+//#region src/exec-ssh/fs-provider.ts
+var SshFileSystem = class {
+	executor;
+	constructor(executor) {
+		this.executor = executor;
+	}
+	async resolve(path) {
+		return path;
+	}
+	processPath(target) {
+		return target;
+	}
+	fileUrl(target) {
+		return `file://${target}`;
+	}
+	contains(parent, child) {
+		return child === parent || child.startsWith(`${parent}/`);
+	}
+	async stat(target, _signal) {
+		return this.executor.stat(target);
+	}
+	async lstat(path, _opts, _signal) {
+		return this.executor.stat(path);
+	}
+	async readText(target, _signal) {
+		return (await this.executor.readFile(target)).toString("utf8");
+	}
+	async streamText(target, _signal) {
+		const text = (await this.executor.readFile(target)).toString("utf8");
+		return (async function* () {
+			yield text;
+		})();
+	}
+	async readBytes(target, _signal, maxBytes) {
+		const slice = (await this.executor.readFile(target)).subarray(0, maxBytes);
+		return new Uint8Array(slice.buffer, slice.byteOffset, slice.byteLength);
+	}
+	async listDir(target, _signal) {
+		return (await this.executor.listDir(target)).map((e) => ({
+			name: e.name,
+			path: `${target}/${e.name}`,
+			isDirectory: e.isDir,
+			isFile: e.isFile,
+			isSymlink: e.isSymlink,
+			size: e.size,
+			mtime: e.mtime
+		}));
+	}
+	async writeText(target, content, _expected, _signal, _policy) {
+		const normalizeLf = (s) => s.replace(/\r\n/g, "\n");
+		const beforeInfo = await this.executor.stat(target);
+		let before = null;
+		if (beforeInfo?.isFile) try {
+			before = normalizeLf((await this.executor.readFile(target)).toString("utf8"));
+		} catch {
+			before = null;
+		}
+		const after = normalizeLf(content);
+		await this.executor.writeFile(target, content);
+		const afterInfo = await this.executor.stat(target);
+		const version = `${afterInfo?.size ?? content.length}:${afterInfo?.mtime ?? Date.now()}`;
+		return {
+			operation: before === null ? "create" : "update",
+			version,
+			before,
+			after
+		};
+	}
+	async editText(target, edit, _expected, _signal, _policy) {
+		const normalizeLf = (s) => s.replace(/\r\n/g, "\n");
+		const before = normalizeLf((await this.executor.readFile(target)).toString("utf8"));
+		const req = edit;
+		const oldString = normalizeLf(String(req.oldString ?? ""));
+		if (oldString.length === 0) throw new Error("edit oldString must be non-empty");
+		const newString = normalizeLf(String(req.newString ?? ""));
+		const matches = before.split(oldString).length - 1;
+		if (matches === 0) throw new Error("edit oldString not found in file");
+		if (!req.replaceAll && matches !== 1) throw new Error(`edit oldString matched ${matches} times; expected exactly one`);
+		const after = req.replaceAll ? before.split(oldString).join(newString) : before.replace(oldString, newString);
+		await this.executor.writeFile(target, after);
+		const afterInfo = await this.executor.stat(target);
+		return {
+			version: `${afterInfo?.size ?? after.length}:${afterInfo?.mtime ?? Date.now()}`,
+			before,
+			after
+		};
+	}
+};
+//#endregion
+export { SshFileSystem };
+
+//# sourceMappingURL=fs-provider.js.map

package/lib/exec-ssh/fs-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-provider.js","names":[],"sources":["../../src/exec-ssh/fs-provider.ts"],"sourcesContent":["import type { SshExecutor } from './executor.js'\n\nexport class SshFileSystem {\n  constructor(private readonly executor: SshExecutor) {}\n\n  async resolve(path: string): Promise<string> {\n    return path\n  }\n\n  processPath(target: string): string {\n    return target\n  }\n\n  fileUrl(target: string): string {\n    return `file://${target}`\n  }\n\n  contains(parent: string, child: string): boolean {\n    return child === parent || child.startsWith(`${parent}/`)\n  }\n\n  async stat(target: string, _signal?: AbortSignal): Promise<{ size: number; mtime: number; isDirectory: boolean; isFile: boolean } | undefined> {\n    return this.executor.stat(target)\n  }\n\n  async lstat(path: string, _opts?: { cwd?: string }, _signal?: AbortSignal): Promise<{ size: number; mtime: number; isDirectory: boolean; isFile: boolean } | undefined> {\n    return this.executor.stat(path)\n  }\n\n  async readText(target: string, _signal?: AbortSignal): Promise<string> {\n    const data = await this.executor.readFile(target)\n    return data.toString('utf8')\n  }\n\n  async streamText(target: string, _signal?: AbortSignal): Promise<AsyncIterable<string>> {\n    const data = await this.executor.readFile(target)\n    const text = data.toString('utf8')\n    return (async function* () {\n      yield text\n    })()\n  }\n\n  async readBytes(target: string, _signal: AbortSignal | undefined, maxBytes: number): Promise<Uint8Array> {\n    const data = await this.executor.readFile(target)\n    const slice = data.subarray(0, maxBytes)\n    return new Uint8Array(slice.buffer, slice.byteOffset, slice.byteLength)\n  }\n\n  async listDir(target: string, _signal?: AbortSignal): Promise<Array<{ name: string; path: string; isDirectory: boolean; isFile: boolean; isSymlink: boolean; size: number; mtime: number }>> {\n    const entries = await this.executor.listDir(target)\n    return entries.map((e) => ({\n      name: e.name,\n      path: `${target}/${e.name}`,\n      isDirectory: e.isDir,\n      isFile: e.isFile,\n      isSymlink: e.isSymlink,\n      size: e.size,\n      mtime: e.mtime,\n    }))\n  }\n\n  async writeText(target: string, content: string, _expected?: unknown, _signal?: AbortSignal, _policy?: unknown): Promise<{ operation: 'create' | 'update'; version: string; before: string | null; after: string }> {\n    const normalizeLf = (s: string) => s.replace(/\\r\\n/g, '\\n')\n    const beforeInfo = await this.executor.stat(target)\n    let before: string | null = null\n    if (beforeInfo?.isFile) {\n      try {\n        before = normalizeLf((await this.executor.readFile(target)).toString('utf8'))\n      } catch {\n        before = null\n      }\n    }\n    const after = normalizeLf(content)\n    await this.executor.writeFile(target, content)\n    const afterInfo = await this.executor.stat(target)\n    const version = `${afterInfo?.size ?? content.length}:${afterInfo?.mtime ?? Date.now()}`\n    return { operation: before === null ? 'create' : 'update', version, before, after }\n  }\n\n  async editText(target: string, edit: unknown, _expected?: unknown, _signal?: AbortSignal, _policy?: unknown): Promise<{ version: string; before: string; after: string }> {\n    const normalizeLf = (s: string) => s.replace(/\\r\\n/g, '\\n')\n    const before = normalizeLf((await this.executor.readFile(target)).toString('utf8'))\n    const req = edit as { oldString: string; newString: string; replaceAll: boolean }\n    const oldString = normalizeLf(String(req.oldString ?? ''))\n    if (oldString.length === 0) throw new Error('edit oldString must be non-empty')\n    const newString = normalizeLf(String(req.newString ?? ''))\n    const matches = before.split(oldString).length - 1\n    if (matches === 0) throw new Error('edit oldString not found in file')\n    if (!req.replaceAll && matches !== 1) throw new Error(`edit oldString matched ${matches} times; expected exactly one`)\n    const after = req.replaceAll ? before.split(oldString).join(newString) : before.replace(oldString, newString)\n    await this.executor.writeFile(target, after)\n    const afterInfo = await this.executor.stat(target)\n    const version = `${afterInfo?.size ?? after.length}:${afterInfo?.mtime ?? Date.now()}`\n    return { version, before, after }\n  }\n}\n"],"mappings":";AAEA,IAAa,gBAAb,MAA2B;CACI;CAA7B,YAAY,UAAwC;EAAvB,KAAA,WAAA;CAAwB;CAErD,MAAM,QAAQ,MAA+B;EAC3C,OAAO;CACT;CAEA,YAAY,QAAwB;EAClC,OAAO;CACT;CAEA,QAAQ,QAAwB;EAC9B,OAAO,UAAU;CACnB;CAEA,SAAS,QAAgB,OAAwB;EAC/C,OAAO,UAAU,UAAU,MAAM,WAAW,GAAG,OAAO,EAAE;CAC1D;CAEA,MAAM,KAAK,QAAgB,SAAoH;EAC7I,OAAO,KAAK,SAAS,KAAK,MAAM;CAClC;CAEA,MAAM,MAAM,MAAc,OAA0B,SAAoH;EACtK,OAAO,KAAK,SAAS,KAAK,IAAI;CAChC;CAEA,MAAM,SAAS,QAAgB,SAAwC;EAErE,QAAO,MADY,KAAK,SAAS,SAAS,MAAM,EAAA,CACpC,SAAS,MAAM;CAC7B;CAEA,MAAM,WAAW,QAAgB,SAAuD;EAEtF,MAAM,QAAO,MADM,KAAK,SAAS,SAAS,MAAM,EAAA,CAC9B,SAAS,MAAM;EACjC,QAAQ,mBAAmB;GACzB,MAAM;EACR,EAAA,CAAG;CACL;CAEA,MAAM,UAAU,QAAgB,SAAkC,UAAuC;EAEvG,MAAM,SAAQ,MADK,KAAK,SAAS,SAAS,MAAM,EAAA,CAC7B,SAAS,GAAG,QAAQ;EACvC,OAAO,IAAI,WAAW,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU;CACxE;CAEA,MAAM,QAAQ,QAAgB,SAA+J;EAE3L,QAAO,MADe,KAAK,SAAS,QAAQ,MAAM,EAAA,CACnC,KAAK,OAAO;GACzB,MAAM,EAAE;GACR,MAAM,GAAG,OAAO,GAAG,EAAE;GACrB,aAAa,EAAE;GACf,QAAQ,EAAE;GACV,WAAW,EAAE;GACb,MAAM,EAAE;GACR,OAAO,EAAE;EACX,EAAE;CACJ;CAEA,MAAM,UAAU,QAAgB,SAAiB,WAAqB,SAAuB,SAAuH;EAClN,MAAM,eAAe,MAAc,EAAE,QAAQ,SAAS,IAAI;EAC1D,MAAM,aAAa,MAAM,KAAK,SAAS,KAAK,MAAM;EAClD,IAAI,SAAwB;EAC5B,IAAI,YAAY,QACd,IAAI;GACF,SAAS,aAAa,MAAM,KAAK,SAAS,SAAS,MAAM,EAAA,CAAG,SAAS,MAAM,CAAC;EAC9E,QAAQ;GACN,SAAS;EACX;EAEF,MAAM,QAAQ,YAAY,OAAO;EACjC,MAAM,KAAK,SAAS,UAAU,QAAQ,OAAO;EAC7C,MAAM,YAAY,MAAM,KAAK,SAAS,KAAK,MAAM;EACjD,MAAM,UAAU,GAAG,WAAW,QAAQ,QAAQ,OAAO,GAAG,WAAW,SAAS,KAAK,IAAI;EACrF,OAAO;GAAE,WAAW,WAAW,OAAO,WAAW;GAAU;GAAS;GAAQ;EAAM;CACpF;CAEA,MAAM,SAAS,QAAgB,MAAe,WAAqB,SAAuB,SAAgF;EACxK,MAAM,eAAe,MAAc,EAAE,QAAQ,SAAS,IAAI;EAC1D,MAAM,SAAS,aAAa,MAAM,KAAK,SAAS,SAAS,MAAM,EAAA,CAAG,SAAS,MAAM,CAAC;EAClF,MAAM,MAAM;EACZ,MAAM,YAAY,YAAY,OAAO,IAAI,aAAa,EAAE,CAAC;EACzD,IAAI,UAAU,WAAW,GAAG,MAAM,IAAI,MAAM,kCAAkC;EAC9E,MAAM,YAAY,YAAY,OAAO,IAAI,aAAa,EAAE,CAAC;EACzD,MAAM,UAAU,OAAO,MAAM,SAAS,CAAC,CAAC,SAAS;EACjD,IAAI,YAAY,GAAG,MAAM,IAAI,MAAM,kCAAkC;EACrE,IAAI,CAAC,IAAI,cAAc,YAAY,GAAG,MAAM,IAAI,MAAM,0BAA0B,QAAQ,6BAA6B;EACrH,MAAM,QAAQ,IAAI,aAAa,OAAO,MAAM,SAAS,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,QAAQ,WAAW,SAAS;EAC5G,MAAM,KAAK,SAAS,UAAU,QAAQ,KAAK;EAC3C,MAAM,YAAY,MAAM,KAAK,SAAS,KAAK,MAAM;EAEjD,OAAO;GAAE,SAAA,GADU,WAAW,QAAQ,MAAM,OAAO,GAAG,WAAW,SAAS,KAAK,IAAI;GACjE;GAAQ;EAAM;CAClC;AACF"}

package/lib/exec-ssh/index.d.ts

@@ -0,0 +1,16 @@
+import { c as classifySshError, i as SshErrorCategory, l as toConnectionError, o as SshSecrets, r as SshConnectionError, s as SshTarget } from "../connection-sIX25pkS.js";
+import { SshConnectionPool } from "./connection-pool.js";
+import { scrubEnv, shouldScrubVar } from "./env-scrub.js";
+import { SshExecutor } from "./executor.js";
+import { SshFileSystem } from "./fs-provider.js";
+import { SshShellExecutor, SshSubprocessRuntime } from "./process-provider.js";
+import { SshExecutionWorld, SshNodeConfig, SshWorldRegistry } from "./world.js";
+import { REMOTE_RUNNER_COMMAND, REMOTE_RUNNER_SCRIPT, encodeRunnerPayload } from "./runner.js";
+import { Context } from "@deepseek-ai/cordis";
+//#region src/exec-ssh/index.d.ts
+declare const name = "dshb-exec-ssh";
+declare const inject: string[];
+declare function apply(ctx: Context): void;
+//#endregion
+export { REMOTE_RUNNER_COMMAND, REMOTE_RUNNER_SCRIPT, type SshConnectionError, SshConnectionPool, type SshErrorCategory, SshExecutionWorld, SshExecutor, SshFileSystem, type SshNodeConfig, type SshSecrets, SshShellExecutor, SshSubprocessRuntime, type SshTarget, SshWorldRegistry, apply, classifySshError, encodeRunnerPayload, inject, name, scrubEnv, shouldScrubVar, toConnectionError };
+//# sourceMappingURL=index.d.ts.map

package/lib/exec-ssh/index.js

@@ -0,0 +1,30 @@
+import { sharedWorldResolver } from "../router/resolve.js";
+import { classifySshError, toConnectionError } from "./connection.js";
+import { SshConnectionPool } from "./connection-pool.js";
+import { REMOTE_RUNNER_COMMAND, REMOTE_RUNNER_SCRIPT, encodeRunnerPayload } from "./runner.js";
+import { SshExecutor } from "./executor.js";
+import { SshFileSystem } from "./fs-provider.js";
+import { SshShellExecutor, SshSubprocessRuntime } from "./process-provider.js";
+import { SshExecutionWorld, SshWorldRegistry } from "./world.js";
+import { scrubEnv, shouldScrubVar } from "./env-scrub.js";
+//#region src/exec-ssh/index.ts
+const name = "dshb-exec-ssh";
+const inject = ["nodeRegistry"];
+function apply(ctx) {
+	const pool = new SshConnectionPool(ctx);
+	const nodeRegistry = ctx.get("nodeRegistry");
+	const audit = ctx.get("dshbAudit");
+	const worlds = new SshWorldRegistry(pool, nodeRegistry, audit ? (id, op, t, r) => audit.log(id, op, t, r) : void 0);
+	ctx.provide("dshbSshPool", pool);
+	ctx.provide("dshbSshWorlds", worlds);
+	ctx.provide("dshbWorlds", { ensure: (nodeId) => worlds.ensure(nodeId) });
+	sharedWorldResolver().setRegistry({ get: (nodeId) => {
+		const node = nodeRegistry?.get(nodeId);
+		if (node && (node.type === "remote-docker" || node.type === "local-docker")) return void 0;
+		return worlds.get(nodeId);
+	} });
+}
+//#endregion
+export { REMOTE_RUNNER_COMMAND, REMOTE_RUNNER_SCRIPT, SshConnectionPool, SshExecutionWorld, SshExecutor, SshFileSystem, SshShellExecutor, SshSubprocessRuntime, SshWorldRegistry, apply, classifySshError, encodeRunnerPayload, inject, name, scrubEnv, shouldScrubVar, toConnectionError };
+
+//# sourceMappingURL=index.js.map

package/lib/exec-ssh/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../src/exec-ssh/index.ts"],"sourcesContent":["import type { Context } from '@deepseek-ai/cordis'\nimport { sharedWorldResolver } from '../router/resolve.js'\nimport { SshConnectionPool } from './connection-pool.js'\nimport { SshWorldRegistry } from './world.js'\n\nexport const name = 'dshb-exec-ssh'\n\nexport const inject = ['nodeRegistry']\n\nexport function apply(ctx: Context): void {\n  const pool = new SshConnectionPool(ctx)\n  const nodeRegistry = ctx.get('nodeRegistry') as ConstructorParameters<typeof SshWorldRegistry>[1]\n  const audit = ctx.get('dshbAudit') as { log(nodeId: string, op: string, target: string, result: string): void } | undefined\n  const worlds = new SshWorldRegistry(pool, nodeRegistry, audit ? (id, op, t, r) => audit.log(id, op, t, r) : undefined)\n  ctx.provide('dshbSshPool', pool)\n  ctx.provide('dshbSshWorlds', worlds)\n  ctx.provide('dshbWorlds', {\n    ensure: (nodeId: string) => worlds.ensure(nodeId),\n  })\n  sharedWorldResolver().setRegistry({\n    get: (nodeId: string) => {\n      const node = nodeRegistry?.get(nodeId)\n      if (node && (node.type === 'remote-docker' || node.type === 'local-docker')) return undefined\n      return worlds.get(nodeId)\n    },\n  })\n}\n\nexport { SshConnectionPool } from './connection-pool.js'\nexport { classifySshError, toConnectionError } from './connection.js'\nexport type { SshConnectionError, SshErrorCategory, SshTarget, SshSecrets } from './connection.js'\nexport { shouldScrubVar, scrubEnv } from './env-scrub.js'\nexport { SshExecutor } from './executor.js'\nexport { SshFileSystem } from './fs-provider.js'\nexport { SshShellExecutor, SshSubprocessRuntime } from './process-provider.js'\nexport { SshExecutionWorld, SshWorldRegistry } from './world.js'\nexport type { SshNodeConfig } from './world.js'\nexport { encodeRunnerPayload, REMOTE_RUNNER_COMMAND, REMOTE_RUNNER_SCRIPT } from './runner.js'\n"],"mappings":";;;;;;;;;;AAKA,MAAa,OAAO;AAEpB,MAAa,SAAS,CAAC,cAAc;AAErC,SAAgB,MAAM,KAAoB;CACxC,MAAM,OAAO,IAAI,kBAAkB,GAAG;CACtC,MAAM,eAAe,IAAI,IAAI,cAAc;CAC3C,MAAM,QAAQ,IAAI,IAAI,WAAW;CACjC,MAAM,SAAS,IAAI,iBAAiB,MAAM,cAAc,SAAS,IAAI,IAAI,GAAG,MAAM,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,KAAA,CAAS;CACrH,IAAI,QAAQ,eAAe,IAAI;CAC/B,IAAI,QAAQ,iBAAiB,MAAM;CACnC,IAAI,QAAQ,cAAc,EACxB,SAAS,WAAmB,OAAO,OAAO,MAAM,EAClD,CAAC;CACD,oBAAoB,CAAC,CAAC,YAAY,EAChC,MAAM,WAAmB;EACvB,MAAM,OAAO,cAAc,IAAI,MAAM;EACrC,IAAI,SAAS,KAAK,SAAS,mBAAmB,KAAK,SAAS,iBAAiB,OAAO,KAAA;EACpF,OAAO,OAAO,IAAI,MAAM;CAC1B,EACF,CAAC;AACH"}

package/lib/exec-ssh/process-provider.d.ts

@@ -0,0 +1,20 @@
+import { SshExecutor } from "./executor.js";
+import { SubprocessHandle, SubprocessSpawnSpec, SubprocessTerminalHandle, SubprocessTerminalSpawnSpec } from "@deepseek-ai/dsh-subprocess";
+import { ShellExecRequest, ShellExecSpec, ShellProcess, ShellRunResult } from "@deepseek-ai/dsh-shell";
+//#region src/exec-ssh/process-provider.d.ts
+declare class SshShellExecutor {
+  private readonly executor;
+  constructor(executor: SshExecutor);
+  resolve(request: ShellExecRequest): ShellExecSpec;
+  run(spec: ShellExecSpec): Promise<ShellRunResult>;
+  start(spec: ShellExecSpec): ShellProcess;
+}
+declare class SshSubprocessRuntime {
+  private readonly executor;
+  constructor(executor: SshExecutor);
+  spawn(spec: SubprocessSpawnSpec): SubprocessHandle;
+  spawnTerminal(spec: SubprocessTerminalSpawnSpec): Promise<SubprocessTerminalHandle>;
+}
+//#endregion
+export { SshShellExecutor, SshSubprocessRuntime };
+//# sourceMappingURL=process-provider.d.ts.map

package/lib/exec-ssh/process-provider.js

@@ -0,0 +1,75 @@
+//#region src/exec-ssh/process-provider.ts
+var SshShellExecutor = class {
+	executor;
+	constructor(executor) {
+		this.executor = executor;
+	}
+	resolve(request) {
+		return {
+			command: request.command,
+			workdir: request.workdir ?? "/",
+			timeoutMs: request.timeoutMs ?? 6e4,
+			stdoutMaxBytes: request.stdoutMaxBytes ?? 1048576,
+			signal: request.signal,
+			stdin: request.stdin,
+			env: request.env,
+			sandboxPolicy: request.sandboxPolicy
+		};
+	}
+	async run(spec) {
+		const result = await this.executor.exec([
+			"sh",
+			"-c",
+			spec.command
+		], spec.workdir, spec.env ?? {}, spec.stdin !== void 0 ? Buffer.from(spec.stdin) : void 0);
+		const collect = (text) => ({
+			text,
+			truncated: false
+		});
+		return {
+			exitCode: result.code,
+			signal: result.signal ?? null,
+			timedOut: false,
+			aborted: false,
+			timeoutMs: spec.timeoutMs,
+			stdout: collect(result.stdout),
+			stderr: collect(result.stderr)
+		};
+	}
+	start(spec) {
+		return {
+			pid: -1,
+			done: this.run(spec),
+			kill: () => {}
+		};
+	}
+};
+var SshSubprocessRuntime = class {
+	executor;
+	constructor(executor) {
+		this.executor = executor;
+	}
+	spawn(spec) {
+		return {
+			pid: -1,
+			done: this.executor.exec(spec.argv, spec.cwd, spec.env ?? {}).then((r) => ({
+				exitCode: r.code,
+				signal: r.signal ?? null
+			})),
+			kill: () => {}
+		};
+	}
+	async spawnTerminal(spec) {
+		const pty = await this.executor.pty(spec.argv, spec.cwd, spec.env ?? {}, spec.cols ?? 80, spec.rows ?? 24);
+		return {
+			write: (data) => pty.channel.stdin.write(data),
+			resize: (cols, rows) => pty.resize(cols, rows),
+			onData: (cb) => pty.onData((chunk) => cb(chunk.toString("utf8"))),
+			kill: () => pty.kill()
+		};
+	}
+};
+//#endregion
+export { SshShellExecutor, SshSubprocessRuntime };
+
+//# sourceMappingURL=process-provider.js.map

package/lib/exec-ssh/process-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-provider.js","names":[],"sources":["../../src/exec-ssh/process-provider.ts"],"sourcesContent":["import type { ShellExecRequest, ShellExecSpec, ShellProcess, ShellRunResult } from '@deepseek-ai/dsh-shell'\nimport type { CollectedOutput, SubprocessHandle, SubprocessSpawnSpec, SubprocessTerminalHandle, SubprocessTerminalSpawnSpec } from '@deepseek-ai/dsh-subprocess'\nimport type { SshExecutor } from './executor.js'\n\nexport class SshShellExecutor {\n  constructor(private readonly executor: SshExecutor) {}\n\n  resolve(request: ShellExecRequest): ShellExecSpec {\n    return {\n      command: request.command,\n      workdir: request.workdir ?? '/',\n      timeoutMs: request.timeoutMs ?? 60_000,\n      stdoutMaxBytes: request.stdoutMaxBytes ?? 1024 * 1024,\n      signal: request.signal,\n      stdin: request.stdin,\n      env: request.env,\n      sandboxPolicy: request.sandboxPolicy,\n    } as ShellExecSpec\n  }\n\n  async run(spec: ShellExecSpec): Promise<ShellRunResult> {\n    const result = await this.executor.exec(['sh', '-c', spec.command], spec.workdir, (spec.env ?? {}) as Record<string, string>, spec.stdin !== undefined ? Buffer.from(spec.stdin) : undefined)\n    const collect = (text: string): CollectedOutput => ({ text, truncated: false })\n    return {\n      exitCode: result.code,\n      signal: (result.signal ?? null) as NodeJS.Signals | null,\n      timedOut: false,\n      aborted: false,\n      timeoutMs: spec.timeoutMs,\n      stdout: collect(result.stdout),\n      stderr: collect(result.stderr),\n    } as unknown as ShellRunResult\n  }\n\n  start(spec: ShellExecSpec): ShellProcess {\n    const promise = this.run(spec)\n    const proc: ShellProcess = {\n      pid: -1,\n      done: promise,\n      kill: () => {\n        void promise\n      },\n    } as unknown as ShellProcess\n    return proc\n  }\n}\n\nexport class SshSubprocessRuntime {\n  constructor(private readonly executor: SshExecutor) {}\n\n  spawn(spec: SubprocessSpawnSpec): SubprocessHandle {\n    const promise = this.executor.exec(spec.argv as string[], spec.cwd, (spec.env ?? {}) as Record<string, string>)\n    const handle: SubprocessHandle = {\n      pid: -1,\n      done: promise.then((r) => ({ exitCode: r.code, signal: (r.signal ?? null) as NodeJS.Signals | null })),\n      kill: () => {\n        void promise\n      },\n    } as unknown as SubprocessHandle\n    return handle\n  }\n\n  async spawnTerminal(spec: SubprocessTerminalSpawnSpec): Promise<SubprocessTerminalHandle> {\n    const pty = await this.executor.pty(spec.argv as string[], spec.cwd, (spec.env ?? {}) as Record<string, string>, (spec as { cols?: number }).cols ?? 80, (spec as { rows?: number }).rows ?? 24)\n    const handle: SubprocessTerminalHandle = {\n      write: (data: string) => pty.channel.stdin.write(data),\n      resize: (cols: number, rows: number) => pty.resize(cols, rows),\n      onData: (cb: (data: string) => void) => pty.onData((chunk) => cb(chunk.toString('utf8'))),\n      kill: () => pty.kill(),\n    } as unknown as SubprocessTerminalHandle\n    return handle\n  }\n}\n"],"mappings":";AAIA,IAAa,mBAAb,MAA8B;CACC;CAA7B,YAAY,UAAwC;EAAvB,KAAA,WAAA;CAAwB;CAErD,QAAQ,SAA0C;EAChD,OAAO;GACL,SAAS,QAAQ;GACjB,SAAS,QAAQ,WAAW;GAC5B,WAAW,QAAQ,aAAa;GAChC,gBAAgB,QAAQ,kBAAkB;GAC1C,QAAQ,QAAQ;GAChB,OAAO,QAAQ;GACf,KAAK,QAAQ;GACb,eAAe,QAAQ;EACzB;CACF;CAEA,MAAM,IAAI,MAA8C;EACtD,MAAM,SAAS,MAAM,KAAK,SAAS,KAAK;GAAC;GAAM;GAAM,KAAK;EAAO,GAAG,KAAK,SAAU,KAAK,OAAO,CAAC,GAA8B,KAAK,UAAU,KAAA,IAAY,OAAO,KAAK,KAAK,KAAK,IAAI,KAAA,CAAS;EAC5L,MAAM,WAAW,UAAmC;GAAE;GAAM,WAAW;EAAM;EAC7E,OAAO;GACL,UAAU,OAAO;GACjB,QAAS,OAAO,UAAU;GAC1B,UAAU;GACV,SAAS;GACT,WAAW,KAAK;GAChB,QAAQ,QAAQ,OAAO,MAAM;GAC7B,QAAQ,QAAQ,OAAO,MAAM;EAC/B;CACF;CAEA,MAAM,MAAmC;EASvC,OAAO;GANL,KAAK;GACL,MAHc,KAAK,IAAI,IAGX;GACZ,YAAY,CAEZ;EAEQ;CACZ;AACF;AAEA,IAAa,uBAAb,MAAkC;CACH;CAA7B,YAAY,UAAwC;EAAvB,KAAA,WAAA;CAAwB;CAErD,MAAM,MAA6C;EASjD,OAAO;GANL,KAAK;GACL,MAHc,KAAK,SAAS,KAAK,KAAK,MAAkB,KAAK,KAAM,KAAK,OAAO,CAAC,CAGpE,CAAC,CAAC,MAAM,OAAO;IAAE,UAAU,EAAE;IAAM,QAAS,EAAE,UAAU;GAA+B,EAAE;GACrG,YAAY,CAEZ;EAEU;CACd;CAEA,MAAM,cAAc,MAAsE;EACxF,MAAM,MAAM,MAAM,KAAK,SAAS,IAAI,KAAK,MAAkB,KAAK,KAAM,KAAK,OAAO,CAAC,GAA+B,KAA2B,QAAQ,IAAK,KAA2B,QAAQ,EAAE;EAO/L,OAAO;GALL,QAAQ,SAAiB,IAAI,QAAQ,MAAM,MAAM,IAAI;GACrD,SAAS,MAAc,SAAiB,IAAI,OAAO,MAAM,IAAI;GAC7D,SAAS,OAA+B,IAAI,QAAQ,UAAU,GAAG,MAAM,SAAS,MAAM,CAAC,CAAC;GACxF,YAAY,IAAI,KAAK;EAEX;CACd;AACF"}

package/lib/exec-ssh/runner.d.ts

@@ -0,0 +1,13 @@
+//#region src/exec-ssh/runner.d.ts
+interface RunnerPayload {
+  argv: string[];
+  cwd: string;
+  env: Record<string, string>;
+}
+declare function encodeRunnerPayload(payload: RunnerPayload): Buffer;
+declare const REMOTE_RUNNER_SCRIPT = "set -u\nif ! command -v base64 >/dev/null 2>&1; then echo \"runner: base64 not found\" >&2; exit 127; fi\ndec() {\n  printf '%s' \"$1\" | base64 -d 2>/dev/null || printf '%s' \"$1\" | base64 -D 2>/dev/null\n}\nreadline_crlf() {\n  IFS= read -r line\n  line=${line%$'\\r'}\n}\nreadline_crlf\ncwd=$(dec \"$line\")\nreadline_crlf\nargc=$(dec \"$line\")\nargv=()\ni=0\nwhile [ \"$i\" -lt \"$argc\" ]; do\n  readline_crlf\n  argv+=(\"$(dec \"$line\")\")\n  i=$((i + 1))\ndone\nreadline_crlf\nenvc=$(dec \"$line\")\nenv_vars=()\ni=0\nwhile [ \"$i\" -lt \"$envc\" ]; do\n  readline_crlf\n  kv=$(dec \"$line\")\n  k=${kv%%=*}\n  v=${kv#*=}\n  env_vars+=(\"$k=$v\")\n  i=$((i + 1))\ndone\nreadline_crlf\n[ \"$line\" = \".\" ] || { echo \"runner: protocol error\" >&2; exit 126; }\ncd \"$cwd\" 2>/dev/null || { echo \"runner: cwd not found: $cwd\" >&2; exit 126; }\nexec env -i HOME=\"$HOME\" PATH=\"${PATH:-/usr/local/bin:/usr/bin:/bin}\" ${env_vars[@]+\"${env_vars[@]}\"} \"${argv[@]}\"\n";
+declare const REMOTE_RUNNER_COMMAND: string;
+declare function isRunnerSafe(command: string): boolean;
+//#endregion
+export { REMOTE_RUNNER_COMMAND, REMOTE_RUNNER_SCRIPT, RunnerPayload, encodeRunnerPayload, isRunnerSafe };
+//# sourceMappingURL=runner.d.ts.map

package/lib/exec-ssh/runner.js

@@ -0,0 +1,62 @@
+//#region src/exec-ssh/runner.ts
+function encodeLine(value) {
+	return Buffer.from(`${value}\n`, "utf8").toString("base64");
+}
+function encodeRunnerPayload(payload) {
+	const lines = [];
+	lines.push(encodeLine(payload.cwd));
+	lines.push(encodeLine(String(payload.argv.length)));
+	for (const arg of payload.argv) lines.push(encodeLine(arg));
+	const envEntries = Object.entries(payload.env);
+	lines.push(encodeLine(String(envEntries.length)));
+	for (const [k, v] of envEntries) lines.push(encodeLine(`${k}=${v}`));
+	lines.push(".");
+	return Buffer.from(`${lines.join("\n")}\n`, "utf8");
+}
+const RUNNER_SCRIPT = `set -u
+if ! command -v base64 >/dev/null 2>&1; then echo "runner: base64 not found" >&2; exit 127; fi
+dec() {
+  printf '%s' "$1" | base64 -d 2>/dev/null || printf '%s' "$1" | base64 -D 2>/dev/null
+}
+readline_crlf() {
+  IFS= read -r line
+  line=\${line%$'\\r'}
+}
+readline_crlf
+cwd=$(dec "$line")
+readline_crlf
+argc=$(dec "$line")
+argv=()
+i=0
+while [ "$i" -lt "$argc" ]; do
+  readline_crlf
+  argv+=("$(dec "$line")")
+  i=$((i + 1))
+done
+readline_crlf
+envc=$(dec "$line")
+env_vars=()
+i=0
+while [ "$i" -lt "$envc" ]; do
+  readline_crlf
+  kv=$(dec "$line")
+  k=\${kv%%=*}
+  v=\${kv#*=}
+  env_vars+=("$k=$v")
+  i=$((i + 1))
+done
+readline_crlf
+[ "$line" = "." ] || { echo "runner: protocol error" >&2; exit 126; }
+cd "$cwd" 2>/dev/null || { echo "runner: cwd not found: $cwd" >&2; exit 126; }
+exec env -i HOME="$HOME" PATH="\${PATH:-/usr/local/bin:/usr/bin:/bin}" \${env_vars[@]+"\${env_vars[@]}"} "\${argv[@]}"
+`;
+const RUNNER_SCRIPT_B64 = Buffer.from(RUNNER_SCRIPT, "utf8").toString("base64");
+const REMOTE_RUNNER_SCRIPT = RUNNER_SCRIPT;
+const REMOTE_RUNNER_COMMAND = `bash -c "$(echo ${RUNNER_SCRIPT_B64} | base64 -d)"`;
+function isRunnerSafe(command) {
+	return command === REMOTE_RUNNER_COMMAND || command.includes(RUNNER_SCRIPT_B64);
+}
+//#endregion
+export { REMOTE_RUNNER_COMMAND, REMOTE_RUNNER_SCRIPT, encodeRunnerPayload, isRunnerSafe };
+
+//# sourceMappingURL=runner.js.map

package/lib/exec-ssh/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","names":[],"sources":["../../src/exec-ssh/runner.ts"],"sourcesContent":["export interface RunnerPayload {\n  argv: string[]\n  cwd: string\n  env: Record<string, string>\n}\n\nfunction encodeLine(value: string): string {\n  return Buffer.from(`${value}\\n`, 'utf8').toString('base64')\n}\n\nexport function encodeRunnerPayload(payload: RunnerPayload): Buffer {\n  const lines: string[] = []\n  lines.push(encodeLine(payload.cwd))\n  lines.push(encodeLine(String(payload.argv.length)))\n  for (const arg of payload.argv) lines.push(encodeLine(arg))\n  const envEntries = Object.entries(payload.env)\n  lines.push(encodeLine(String(envEntries.length)))\n  for (const [k, v] of envEntries) lines.push(encodeLine(`${k}=${v}`))\n  lines.push('.')\n  return Buffer.from(`${lines.join('\\n')}\\n`, 'utf8')\n}\n\nconst RUNNER_SCRIPT = `set -u\nif ! command -v base64 >/dev/null 2>&1; then echo \"runner: base64 not found\" >&2; exit 127; fi\ndec() {\n  printf '%s' \"$1\" | base64 -d 2>/dev/null || printf '%s' \"$1\" | base64 -D 2>/dev/null\n}\nreadline_crlf() {\n  IFS= read -r line\n  line=\\${line%$'\\\\r'}\n}\nreadline_crlf\ncwd=$(dec \"$line\")\nreadline_crlf\nargc=$(dec \"$line\")\nargv=()\ni=0\nwhile [ \"$i\" -lt \"$argc\" ]; do\n  readline_crlf\n  argv+=(\"$(dec \"$line\")\")\n  i=$((i + 1))\ndone\nreadline_crlf\nenvc=$(dec \"$line\")\nenv_vars=()\ni=0\nwhile [ \"$i\" -lt \"$envc\" ]; do\n  readline_crlf\n  kv=$(dec \"$line\")\n  k=\\${kv%%=*}\n  v=\\${kv#*=}\n  env_vars+=(\"$k=$v\")\n  i=$((i + 1))\ndone\nreadline_crlf\n[ \"$line\" = \".\" ] || { echo \"runner: protocol error\" >&2; exit 126; }\ncd \"$cwd\" 2>/dev/null || { echo \"runner: cwd not found: $cwd\" >&2; exit 126; }\nexec env -i HOME=\"$HOME\" PATH=\"\\${PATH:-/usr/local/bin:/usr/bin:/bin}\" \\${env_vars[@]+\"\\${env_vars[@]}\"} \"\\${argv[@]}\"\n`\n\nconst RUNNER_SCRIPT_B64 = Buffer.from(RUNNER_SCRIPT, 'utf8').toString('base64')\n\nexport const REMOTE_RUNNER_SCRIPT = RUNNER_SCRIPT\n\nexport const REMOTE_RUNNER_COMMAND = `bash -c \"$(echo ${RUNNER_SCRIPT_B64} | base64 -d)\"`\n\nexport function isRunnerSafe(command: string): boolean {\n  return command === REMOTE_RUNNER_COMMAND || command.includes(RUNNER_SCRIPT_B64)\n}\n"],"mappings":";AAMA,SAAS,WAAW,OAAuB;CACzC,OAAO,OAAO,KAAK,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,SAAS,QAAQ;AAC5D;AAEA,SAAgB,oBAAoB,SAAgC;CAClE,MAAM,QAAkB,CAAC;CACzB,MAAM,KAAK,WAAW,QAAQ,GAAG,CAAC;CAClC,MAAM,KAAK,WAAW,OAAO,QAAQ,KAAK,MAAM,CAAC,CAAC;CAClD,KAAK,MAAM,OAAO,QAAQ,MAAM,MAAM,KAAK,WAAW,GAAG,CAAC;CAC1D,MAAM,aAAa,OAAO,QAAQ,QAAQ,GAAG;CAC7C,MAAM,KAAK,WAAW,OAAO,WAAW,MAAM,CAAC,CAAC;CAChD,KAAK,MAAM,CAAC,GAAG,MAAM,YAAY,MAAM,KAAK,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC;CACnE,MAAM,KAAK,GAAG;CACd,OAAO,OAAO,KAAK,GAAG,MAAM,KAAK,IAAI,EAAE,KAAK,MAAM;AACpD;AAEA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCtB,MAAM,oBAAoB,OAAO,KAAK,eAAe,MAAM,CAAC,CAAC,SAAS,QAAQ;AAE9E,MAAa,uBAAuB;AAEpC,MAAa,wBAAwB,mBAAmB,kBAAkB;AAE1E,SAAgB,aAAa,SAA0B;CACrD,OAAO,YAAY,yBAAyB,QAAQ,SAAS,iBAAiB;AAChF"}