@deepseek-ai/dsh-ssh 0.2.0-rc.2 → 0.2.1-alpha.2

package/README.i18n.yaml

@@ -18,11 +18,11 @@
   en: 8fbb876fefb42f3c
   zh: ddd38f747088e032
 /deepseek-ai-dsh-ssh/use-this-package/deployment-prerequisites:
-  en: 2c1bea2f0de4d928
-  zh: aab17df22231b6a6
+  en: 9be90e9dad103726
+  zh: af9e050b0ab50d04
 /deepseek-ai-dsh-ssh/understand-the-implementation:
-  en: 745134e2c519e805
-  zh: c2cfa395fca03d44
+  en: 01fedb6b36ac94af
+  zh: 9353c40acd9075d8
 /deepseek-ai-dsh-ssh/further-exploration:
   en: 1d179b90a32af26b
   zh: 683cf3c0085147e1
@@ -36,5 +36,5 @@
   en: c173949c197e6deb
   zh: a951c8cfeca150ab
 /deepseek-ai-dsh-ssh/known-limitations-and-deferred-work/dev-note:
-  en: 6ca4f1d4b4810fff
-  zh: e42f580ca971972b
+  en: e67f633dc6fe7773
+  zh: 8ec3e73528ddb1a6

package/README.md

@@ -31,20 +31,21 @@ Compose this service with [`fs-ssh`](../fs-ssh/README.md), [`subprocess-ssh`](..
 
 Both endpoints require Linux or macOS. The local `ssh` command must support connection multiplexing and Unix-socket forwarding; the server must permit that forwarding. Configure the alias, credentials and known-host entry before startup: the service enables `BatchMode`, requires strict host-key checking, disables agent forwarding and adds no interactive authentication flow.
 
-Install the built helper and its matching runtime dependencies on the remote host. Keep Node, helper, bootstrap and their dependencies outside the workspace and writable temporary roots. They must also remain outside a backend’s replaced temporary tree, such as bwrap’s private `/tmp`; the workspace may still be under `/tmp`. Digest verification detects an unexpected installed artifact after helper startup; it does not make writable deployment files safe to execute or authenticate a malicious SSH host.
+Install an [SSH helper executable archive](../ssh-helper-runtime/README.md), or the built helper script with its matching Node dependencies. Keep the runtime outside the workspace and writable temporary roots. They must also remain outside a backend’s replaced temporary tree, such as bwrap’s private `/tmp`; the workspace may still be under `/tmp`. Digest verification detects an unexpected installed artifact after helper startup; it does not make writable deployment files safe to execute or authenticate a malicious SSH host.
 
 | Field | Default | Meaning |
 |---|---|---|
 | `host` | required | Existing OpenSSH host alias |
-| `node`, `helper`, `workspace` | required | Absolute remote Node executable, bundled helper entry and default workspace |
+| `launch` | required | `{ kind: "executable" }`, or `{ kind: "node-script", node: "/absolute/node" }` |
+| `helper`, `workspace` | required | Absolute remote helper entry and default workspace |
 | `helperHash` | required | Lowercase SHA-256 of the installed helper entry |
-| `bootstrapPath`, `bootstrapHash` | omitted | Paired remote PTC entry and its lowercase SHA-256 |
+| `launch.bootstrapPath`, `launch.bootstrapHash` | omitted | Paired remote PTC script and digest; only for `node-script` |
 | `requestTimeoutMs` | `30000` | Connection and administrative-request deadline, from 1 through 2,147,483,647 ms |
 | `maxFrameBytes` | `67108864` | Per-message JSON payload ceiling, at most 64 MiB |
 | `maxPending` | `128` | Ordinary outstanding requests; heartbeat and bounded cleanup requests have reserved capacity |
 | `leaseMs` | `30000` | Helper heartbeat lease, from 3000 to 600000 ms |
 
-For PTC, configure both bootstrap fields and pass the verified `ctx.ssh.nodeExecutable` and `ctx.ssh.bootstrapPath` to [`NodePtcRuntime`](../../ptc-runtime/ptc-runtime-node/README.md). Basic filesystem and Bash use may omit the pair. The `bootstrapPath` getter refuses an unconfigured PTC deployment.
+Pass the verified `ctx.ssh.ptcLaunch` as the `launch` configuration of [`NodePtcRuntime`](../../ptc-runtime/ptc-runtime-node/README.md). Executable deployments include their worker. Script deployments require both bootstrap fields for PTC; filesystem and Bash use may omit them. The getter refuses an unconfigured script bootstrap. The client rejects mismatched protocol versions, runtime kinds and helper digests before readiness.
 
 -----
 
@@ -64,7 +65,7 @@ Failed startup and process results release their reservations after native quies
 
 For terminals opting into shell activity observation, root exit retains the reservation and its remaining work. Activity RPC continues to reach the provider; explicit termination awaits quiescence before releasing endpoints and recording the completed result. Helper connection disposal and lease expiry retain their existing termination authority.
 
-The helper starts with `--disable-sigusr1`, so a same-user process signal cannot open its Node debugger.
+The connection disables the helper’s SIGUSR1 debugger activation: the script invocation uses `--disable-sigusr1`, and the executable invocation supplies that flag through `NODE_OPTIONS`.
 
 </details>
 
@@ -101,6 +102,6 @@ This provider contributes no request-prefix content. Its consumers own model-vis
 <details>
 <summary>Working context for maintainers — click to expand</summary>
 
-No invariant companion is published. Wire validation and the owning filesystem, subprocess and sandbox providers enforce the observable obligations; this adapter adds no independently observed state relation.
+None.
 
 </details>

package/README.zh.md

@@ -31,20 +31,21 @@ kind: "package-reference"
 
 两端均需运行 Linux 或 macOS。本地 `ssh` 命令必须支持连接复用与 Unix 套接字转发，服务器也必须允许该转发。启动前配置主机别名、凭据与已知主机记录：本服务启用 `BatchMode`、要求严格检查主机密钥、禁用认证代理转发，且不提供交互认证流程。
 
-在远端主机安装已构建的辅助程序及其匹配的运行依赖。Node、辅助程序、引导程序及其依赖必须位于工作区和可写临时目录之外，也必须位于后端会替换的临时目录树之外，例如 bwrap 的私有 `/tmp`；工作区仍可位于 `/tmp` 下。摘要校验在辅助程序启动后发现非预期的已安装产物；它不能保证可写部署文件的执行安全，也不能认证恶意 SSH 主机。
+安装 [SSH helper 可执行文件发行包](../ssh-helper-runtime/README.zh.md)，或已构建的 helper 脚本及其匹配的 Node 依赖。运行时必须位于工作区和可写临时目录之外，也必须位于后端会替换的临时目录树之外，例如 bwrap 的私有 `/tmp`；工作区仍可位于 `/tmp` 下。摘要校验在辅助程序启动后发现非预期的已安装产物；它不能保证可写部署文件的执行安全，也不能认证恶意 SSH 主机。
 
 | 字段 | 默认值 | 含义 |
 |---|---|---|
 | `host` | 必填 | 已有的 OpenSSH 主机别名 |
-| `node`、`helper`、`workspace` | 必填 | 远端 Node 可执行文件、辅助程序打包入口和默认工作区的绝对路径 |
+| `launch` | 必填 | `{ kind: "executable" }`，或 `{ kind: "node-script", node: "/absolute/node" }` |
+| `helper`、`workspace` | 必填 | 远端 helper 入口和默认工作区的绝对路径 |
 | `helperHash` | 必填 | 已安装辅助程序入口的小写 SHA-256 |
-| `bootstrapPath`、`bootstrapHash` | 省略 | 成对提供的远端 PTC 入口及其小写 SHA-256 |
+| `launch.bootstrapPath`、`launch.bootstrapHash` | 省略 | 成对提供的远端 PTC 脚本及摘要；仅用于 `node-script` |
 | `requestTimeoutMs` | `30000` | 连接与管理请求的截止时限，范围为 1 至 2,147,483,647 毫秒 |
 | `maxFrameBytes` | `67108864` | 每条 JSON 消息的负载上限，最大为 64 MiB |
 | `maxPending` | `128` | 普通未完成请求的数量上限；心跳与有界清理请求使用预留容量 |
 | `leaseMs` | `30000` | 辅助进程心跳租期，范围为 3000 至 600000 毫秒 |
 
-使用 PTC 时，配置两个引导字段，并将验证后的 `ctx.ssh.nodeExecutable` 与 `ctx.ssh.bootstrapPath` 传给 [`NodePtcRuntime`](../../ptc-runtime/ptc-runtime-node/README.zh.md)。仅使用文件系统和 Bash 时可以省略这对字段。未配置 PTC 部署时，`bootstrapPath` getter 会拒绝访问。
+将验证后的 `ctx.ssh.ptcLaunch` 作为 [`NodePtcRuntime`](../../ptc-runtime/ptc-runtime-node/README.zh.md) 的 `launch` 配置。可执行文件部署包含 worker；脚本部署使用 PTC 时需要两个引导字段，仅使用文件系统和 Bash 时可以省略。脚本引导未配置时，getter 会拒绝访问。客户端在就绪前拒绝不匹配的协议版本、运行形式和 helper 摘要。
 
 -----
 
@@ -64,7 +65,7 @@ OpenSSH 主连接承载私有管理 RPC。每条程序流使用独立转发的 U
 
 终端启用 shell 活动观察时，根进程退出会保留 reservation 及其剩余工作。活动 RPC 继续访问 provider；明确终止时先等待进程范围完全停稳，再释放端点并记录完成结果。helper 连接卸载和租约到期仍保留原有的终止权限。
 
-辅助程序以 `--disable-sigusr1` 启动，因此同用户进程发送的信号无法开启其 Node 调试器。
+连接会禁用 helper 的 SIGUSR1 调试器激活：脚本调用使用 `--disable-sigusr1`，可执行文件调用通过 `NODE_OPTIONS` 提供该标志。
 
 </details>
 
@@ -101,6 +102,6 @@ OpenSSH 主连接承载私有管理 RPC。每条程序流使用独立转发的 U
 <details>
 <summary>维护者工作上下文 — 点击展开</summary>
 
-本包不发布不变式伴随入口。消息校验及所属文件系统、子进程和沙箱提供方执行可观察的约束；此适配器没有增加可独立观察的状态关系。
+无。
 
 </details>

package/lib/helper.js

@@ -1,5 +1,5 @@
-import { a as SshRpcPeer, t as RemoteOperationError } from "./protocol-C43fD--H.js";
-import { S as textStreamIdSchema, _ as remotePath, a as environmentSchema, b as targetSchema, d as outputSnapshotFrameLimit, g as processIdSchema, l as intentSchema, m as policySchema, r as editSchema, v as spawnSchema } from "./schemas-l5hGvwBb.js";
+import { a as SshRpcPeer, t as RemoteOperationError } from "./protocol-CDhW_IHU.js";
+import { S as textStreamIdSchema, _ as remotePath, a as environmentSchema, b as targetSchema, d as outputSnapshotFrameLimit, g as processIdSchema, l as intentSchema, m as policySchema, r as editSchema, v as spawnSchema } from "./schemas-BD3YbDxe.js";
 import { t as SSH_STREAM_TLS_OPTIONS } from "./stream-security-DJlQsPG-.js";
 import { chmod, mkdir, mkdtemp, rm } from "node:fs/promises";
 import { join } from "node:path";
@@ -8,10 +8,10 @@ import { z } from "zod";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { createServer } from "node:tls";
 import { fileURLToPath } from "node:url";
+import { isSea } from "node:sea";
 import { readFileSync } from "node:fs";
 import { FsError } from "@deepseek-ai/dsh-fs";
 import { SandboxedFileSystem } from "@deepseek-ai/dsh-fs-sandbox";
-import { SubprocessExecutableNotFoundError } from "@deepseek-ai/dsh-subprocess";
 import { LocalSubprocessRuntime } from "@deepseek-ai/dsh-subprocess-local";
 import { LocalSandboxProvider } from "@deepseek-ai/dsh-sandbox-local";
 import { SandboxPolicyService } from "@deepseek-ai/dsh-sandbox-policy";
@@ -605,21 +605,23 @@ async function runSshHelper(transport) {
 		if (method === "hello") {
 			if (initialized) throw new Error("SSH helper handshake already completed");
 			const input = z.object({
-				protocol: z.literal(1),
+				protocol: z.literal(2),
 				workspace: remotePath,
 				leaseMs: z.number().int().min(3e3).max(6e5),
 				bootstrapPath: remotePath.optional()
 			}).strict().parse(raw);
+			if (transport.kind === "executable" && input.bootstrapPath !== void 0) throw new Error("Executable SSH helper uses its embedded PTC bootstrap");
 			workspace = ctx.fs.processPath(await ctx.fs.resolve(input.workspace, { signal }));
 			leaseMs = input.leaseMs;
 			initialized = true;
 			touchLease();
 			return {
-				protocol: 1,
+				protocol: 2,
 				hash: createHash("sha256").update(readFileSync(transport.entryPath)).digest("hex"),
+				kind: transport.kind,
 				platform: process.platform,
 				nodeVersion: process.version,
-				node: process.execPath,
+				executable: process.execPath,
 				root,
 				workspace,
 				...input.bootstrapPath === void 0 ? {} : { bootstrapHash: createHash("sha256").update(readFileSync(input.bootstrapPath)).digest("hex") }
@@ -673,7 +675,7 @@ async function runSshHelper(transport) {
 			try {
 				return await ctx.subprocess.resolveExecutable(input.command, env, signal);
 			} catch (error) {
-				if (error instanceof SubprocessExecutableNotFoundError) throw new RemoteOperationError(error.message, "SUBPROCESS_EXECUTABLE_NOT_FOUND");
+				if (typeof error === "object" && error !== null && "name" in error && error.name === "SubprocessExecutableNotFoundError" && "message" in error && typeof error.message === "string") throw new RemoteOperationError(error.message, "SUBPROCESS_EXECUTABLE_NOT_FOUND");
 				throw error;
 			}
 		}
@@ -822,10 +824,12 @@ for (const signal of [
 ]) process.once(signal, stop);
 try {
 	if (process.argv.length !== 2) throw new Error("SSH helper accepts no command arguments");
+	const packaged = isSea();
 	await runSshHelper({
 		input: process.stdin,
 		output: process.stdout,
-		entryPath: fileURLToPath(import.meta.url),
+		entryPath: packaged ? process.execPath : fileURLToPath(import.meta.url),
+		kind: packaged ? "executable" : "node-script",
 		signal: controller.signal
 	});
 } catch (error) {

package/lib/index.js

@@ -1,5 +1,5 @@
-import { a as SshRpcPeer } from "./protocol-C43fD--H.js";
-import { s as helloSchema } from "./schemas-l5hGvwBb.js";
+import { a as SshRpcPeer } from "./protocol-CDhW_IHU.js";
+import { s as helloSchema } from "./schemas-BD3YbDxe.js";
 import { n as authenticateStream } from "./stream-security-DJlQsPG-.js";
 import { execFile, spawn } from "node:child_process";
 import { mkdtemp, rm } from "node:fs/promises";
@@ -8,18 +8,22 @@ import { createConnection } from "node:net";
 import { Service } from "@deepseek-ai/cordis";
 import schema from "@deepseek-ai/schemastery";
 import { z } from "zod";
+import { assertNever } from "@deepseek-ai/dsh-util-values";
 //#region lib/types/index.js
 /** OpenSSH connection owner for one version-matched POSIX helper and its independent forwarded streams. */
 /** One non-reconnecting SSH session; loss invalidates all active operations. */
 var SshConnection = class extends Service {
 	static Config = schema.object({
 		host: schema.string().required(),
-		node: schema.string().required(),
 		helper: schema.string().required(),
+		launch: schema.union([schema.object({
+			kind: schema.const("node-script").required(),
+			node: schema.string().required(),
+			bootstrapPath: schema.string(),
+			bootstrapHash: schema.string()
+		}), schema.object({ kind: schema.const("executable").required() })]).required(),
 		helperHash: schema.string().required(),
 		workspace: schema.string().required(),
-		bootstrapPath: schema.string(),
-		bootstrapHash: schema.string(),
 		requestTimeoutMs: schema.number().default(3e4),
 		maxFrameBytes: schema.number().default(64 * 1024 * 1024),
 		maxPending: schema.number().default(128),
@@ -46,17 +50,20 @@ var SshConnection = class extends Service {
 		if (process.platform !== "linux" && process.platform !== "darwin") throw new Error("SSH runtime requires a POSIX client");
 		this.config = z.object({
 			host: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_.@-]*$/),
-			node: z.string().startsWith("/"),
+			launch: z.discriminatedUnion("kind", [z.object({
+				kind: z.literal("node-script"),
+				node: z.string().startsWith("/"),
+				bootstrapPath: z.string().startsWith("/").optional(),
+				bootstrapHash: z.string().regex(/^[0-9a-f]{64}$/).optional()
+			}).strict().refine((value) => value.bootstrapPath === void 0 === (value.bootstrapHash === void 0), "bootstrapPath and bootstrapHash must be paired"), z.object({ kind: z.literal("executable") }).strict()]),
 			helper: z.string().startsWith("/"),
 			helperHash: z.string().regex(/^[0-9a-f]{64}$/),
 			workspace: z.string().startsWith("/"),
 			requestTimeoutMs: z.number().int().positive().max(2147483647),
-			bootstrapPath: z.string().startsWith("/").optional(),
-			bootstrapHash: z.string().regex(/^[0-9a-f]{64}$/).optional(),
 			maxFrameBytes: z.number().int().positive().max(64 * 1024 * 1024),
 			maxPending: z.number().int().positive().max(128),
 			leaseMs: z.number().int().min(3e3).max(6e5)
-		}).refine((value) => value.bootstrapPath === void 0 === (value.bootstrapHash === void 0), "bootstrapPath and bootstrapHash must be paired").parse(config);
+		}).strict().parse(config);
 		this.ready = this.start();
 		this.ready.catch((error) => {
 			this.fail(error);
@@ -67,15 +74,25 @@ var SshConnection = class extends Service {
 	async [Service.init]() {
 		await this.ready;
 	}
-	/** Verified remote Node executable for the paired PTC runtime. */
-	get nodeExecutable() {
+	/** Verified remote PTC launch configuration; script deployments require a verified bootstrap. */
+	get ptcLaunch() {
 		if (this.remote === void 0) throw new Error("SSH helper is not ready");
-		return this.remote.node;
-	}
-	/** Verified preinstalled PTC entry; unconfigured runtimes fail before program execution. */
-	get bootstrapPath() {
-		if (this.remote === void 0 || this.config.bootstrapPath === void 0) throw new Error("SSH PTC requires a verified bootstrapPath and bootstrapHash");
-		return this.config.bootstrapPath;
+		const launch = this.config.launch;
+		switch (launch.kind) {
+			case "executable": return {
+				kind: "embedded",
+				executable: this.remote.executable
+			};
+			case "node-script":
+				if (launch.bootstrapPath === void 0) throw new Error("SSH PTC requires a verified bootstrapPath and bootstrapHash");
+				return {
+					kind: "node-script",
+					executable: this.remote.executable,
+					bootstrapPath: launch.bootstrapPath
+				};
+			/* v8 ignore next -- Config parsing admits only these two launch kinds. */
+			default: return assertNever(launch);
+		}
 	}
 	/**
 	* Send a helper operation; cancellation never replays an ambiguous mutation.
@@ -285,11 +302,26 @@ var SshConnection = class extends Service {
 		this.directory = await mkdtemp("/tmp/dsh-ssh-");
 		if (this.closed) throw new Error("SSH connection closed before startup");
 		const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
-		const command = [
-			this.config.node,
-			"--disable-sigusr1",
-			this.config.helper
-		].map(quote).join(" ");
+		const launch = this.config.launch;
+		let command;
+		let bootstrapPath;
+		let bootstrapHash;
+		switch (launch.kind) {
+			case "node-script":
+				command = [
+					launch.node,
+					"--disable-sigusr1",
+					this.config.helper
+				].map(quote).join(" ");
+				bootstrapPath = launch.bootstrapPath;
+				bootstrapHash = launch.bootstrapHash;
+				break;
+			case "executable":
+				command = `NODE_OPTIONS='--disable-sigusr1' ${quote(this.config.helper)}`;
+				break;
+			/* v8 ignore next -- Config parsing admits only these two launch kinds. */
+			default: return assertNever(launch);
+		}
 		const child = spawn("ssh", [
 			"-T",
 			"-M",
@@ -335,13 +367,14 @@ var SshConnection = class extends Service {
 			this.fail(error);
 		});
 		const hello = await rpc.request("hello", {
-			protocol: 1,
+			protocol: 2,
 			workspace: this.config.workspace,
 			leaseMs: this.config.leaseMs,
-			...this.config.bootstrapPath === void 0 ? {} : { bootstrapPath: this.config.bootstrapPath }
+			...bootstrapPath === void 0 ? {} : { bootstrapPath }
 		}, helloSchema, AbortSignal.timeout(this.config.requestTimeoutMs));
 		if (hello.hash !== this.config.helperHash) throw new Error("SSH helper digest differs from the configured artifact");
-		if (hello.bootstrapHash !== this.config.bootstrapHash) throw new Error("SSH PTC bootstrap digest differs from the configured artifact");
+		if (hello.kind !== launch.kind) throw new Error("SSH helper runtime differs from the configured launch kind");
+		if (hello.bootstrapHash !== bootstrapHash) throw new Error("SSH PTC bootstrap digest differs from the configured artifact");
 		this.remote = hello;
 		let heartbeatPending;
 		this.heartbeat = setInterval(() => {

package/lib/{protocol-C43fD--H.js → protocol-CDhW_IHU.js}

@@ -4,7 +4,7 @@ import { EventEmitter } from "node:events";
 //#region lib/types/protocol.js
 /** Bounded, versioned requests between an SSH client and its private remote helper. */
 /** Wire version shared by the installed helper and client package. */
-const SSH_PROTOCOL_VERSION = 1;
+const SSH_PROTOCOL_VERSION = 2;
 /** Maximum prepared or running process handles owned by one helper. */
 const SSH_MAX_PROCESS_HANDLES = 128;
 /** Maximum open text iterators owned by one helper. */

package/lib/protocol.js

@@ -1,2 +1,2 @@
-import { a as SshRpcPeer, i as SSH_PROTOCOL_VERSION, n as SSH_MAX_PROCESS_HANDLES, r as SSH_MAX_TEXT_STREAMS, t as RemoteOperationError } from "./protocol-C43fD--H.js";
+import { a as SshRpcPeer, i as SSH_PROTOCOL_VERSION, n as SSH_MAX_PROCESS_HANDLES, r as SSH_MAX_TEXT_STREAMS, t as RemoteOperationError } from "./protocol-CDhW_IHU.js";
 export { RemoteOperationError, SSH_MAX_PROCESS_HANDLES, SSH_MAX_TEXT_STREAMS, SSH_PROTOCOL_VERSION, SshRpcPeer };

package/lib/{schemas-l5hGvwBb.js → schemas-BD3YbDxe.js}

@@ -1,3 +1,4 @@
+import "./protocol-CDhW_IHU.js";
 import { z } from "zod";
 //#region lib/types/schemas.js
 /** Strict JSON validation for SSH helper requests and remote observations. */
@@ -114,11 +115,12 @@ const spawnSchema = z.object({
 }).strict().refine((value) => value.stdio === void 0 !== (value.terminal === void 0), "select ordinary or terminal execution");
 /** Connection handshake binds sockets and workspace to one helper process. */
 const helloSchema = z.object({
-	protocol: z.literal(1),
+	protocol: z.literal(2),
 	hash: z.string().regex(/^[0-9a-f]{64}$/),
+	kind: z.enum(["node-script", "executable"]),
 	platform: z.enum(["linux", "darwin"]),
 	nodeVersion: z.string(),
-	node: remotePath,
+	executable: remotePath,
 	root: remotePath,
 	workspace: remotePath,
 	bootstrapHash: z.string().regex(/^[0-9a-f]{64}$/).optional()

package/lib/schemas.js

@@ -1,2 +1,2 @@
-import { C as writeResultSchema, S as textStreamIdSchema, _ as remotePath, a as environmentSchema, b as targetSchema, c as infoSchema, d as outputSnapshotFrameLimit, f as outputSnapshotSchema, g as processIdSchema, h as preparedSchema, i as entriesSchema, l as intentSchema, m as policySchema, n as editResultSchema, o as foregroundSchema, p as pathInfoSchema, r as editSchema, s as helloSchema, t as doneSchema, u as outcomeSchema, v as spawnSchema, x as terminalActivitySchema, y as streamEndpointSchema } from "./schemas-l5hGvwBb.js";
+import { C as writeResultSchema, S as textStreamIdSchema, _ as remotePath, a as environmentSchema, b as targetSchema, c as infoSchema, d as outputSnapshotFrameLimit, f as outputSnapshotSchema, g as processIdSchema, h as preparedSchema, i as entriesSchema, l as intentSchema, m as policySchema, n as editResultSchema, o as foregroundSchema, p as pathInfoSchema, r as editSchema, s as helloSchema, t as doneSchema, u as outcomeSchema, v as spawnSchema, x as terminalActivitySchema, y as streamEndpointSchema } from "./schemas-BD3YbDxe.js";
 export { doneSchema, editResultSchema, editSchema, entriesSchema, environmentSchema, foregroundSchema, helloSchema, infoSchema, intentSchema, outcomeSchema, outputSnapshotFrameLimit, outputSnapshotSchema, pathInfoSchema, policySchema, preparedSchema, processIdSchema, remotePath, spawnSchema, streamEndpointSchema, targetSchema, terminalActivitySchema, textStreamIdSchema, writeResultSchema };

package/lib/types/helper.d.ts

@@ -7,6 +7,8 @@ export interface HelperTransport {
     output: Writable;
     /** Installed entry whose digest is compared by the client. */
     entryPath: string;
+    /** Whether the installed entry includes its own Node and worker runtime. */
+    kind: 'node-script' | 'executable';
     /** Process termination joins the same cleanup as transport loss. */
     signal: AbortSignal;
 }

package/lib/types/index.d.ts

@@ -5,22 +5,32 @@ import schema from '@deepseek-ai/schemastery';
 import { z } from 'zod';
 import { helloSchema, type SshStreamEndpoint } from './schemas.ts';
 type Hello = z.infer<typeof helloSchema>;
+/** Installed helper invocation; script deployments may also install a PTC bootstrap. */
+export type HelperLaunch = {
+    /** Run the installed script with a separately installed Node executable. */
+    kind: 'node-script';
+    /** Absolute remote Node executable. */
+    node: string;
+    /** Absolute remote PTC bootstrap; requires bootstrapHash. */
+    bootstrapPath?: string;
+    /** Lowercase SHA-256 of bootstrapPath; requires that path. */
+    bootstrapHash?: string;
+} | {
+    /** Run the helper executable with its embedded Node and PTC worker. */
+    kind: 'executable';
+};
 /** Deployment-owned SSH identity and installed helper; no model argument selects these values. */
 export interface Config {
     /** OpenSSH host alias, including its existing user, key and known-host configuration. */
     host: string;
-    /** Absolute remote Node executable. */
-    node: string;
+    /** Explicit script or self-contained executable invocation. */
+    launch: HelperLaunch;
     /** Absolute path to the installed, bundled helper entry. */
     helper: string;
     /** SHA-256 of that bundled helper; mismatches refuse the connection. */
     helperHash: string;
     /** Absolute remote default workspace. */
     workspace: string;
-    /** Optional preinstalled built PTC entry, paired with its expected digest. */
-    bootstrapPath?: string;
-    /** SHA-256 of bootstrapPath; both fields must be supplied together. */
-    bootstrapHash?: string;
     /** Connection and administrative-request deadline, at most 2,147,483,647 milliseconds. */
     requestTimeoutMs?: number;
     /** Maximum JSON payload bytes per helper request or response. */
@@ -57,10 +67,15 @@ export declare class SshConnection extends Service {
     constructor(ctx: Context, config: Config);
     /** Hold plugin readiness until the remote identity and helper digest are verified. */
     [Service.init](): Promise<void>;
-    /** Verified remote Node executable for the paired PTC runtime. */
-    get nodeExecutable(): string;
-    /** Verified preinstalled PTC entry; unconfigured runtimes fail before program execution. */
-    get bootstrapPath(): string;
+    /** Verified remote PTC launch configuration; script deployments require a verified bootstrap. */
+    get ptcLaunch(): {
+        kind: 'embedded';
+        executable: string;
+    } | {
+        kind: 'node-script';
+        executable: string;
+        bootstrapPath: string;
+    };
     /**
      * Send a helper operation; cancellation never replays an ambiguous mutation.
      * @param method - the private helper operation.

package/lib/types/protocol.d.ts

@@ -3,7 +3,7 @@ import { EventEmitter } from 'node:events';
 import type { Readable, Writable } from 'node:stream';
 import { z } from 'zod';
 /** Wire version shared by the installed helper and client package. */
-export declare const SSH_PROTOCOL_VERSION = 1;
+export declare const SSH_PROTOCOL_VERSION = 2;
 /** Maximum prepared or running process handles owned by one helper. */
 export declare const SSH_MAX_PROCESS_HANDLES = 128;
 /** Maximum open text iterators owned by one helper. */

package/lib/types/schemas.d.ts

@@ -126,14 +126,18 @@ export declare const spawnSchema: z.ZodObject<{
 }, z.core.$strict>;
 /** Connection handshake binds sockets and workspace to one helper process. */
 export declare const helloSchema: z.ZodObject<{
-    protocol: z.ZodLiteral<1>;
+    protocol: z.ZodLiteral<2>;
     hash: z.ZodString;
+    kind: z.ZodEnum<{
+        executable: "executable";
+        "node-script": "node-script";
+    }>;
     platform: z.ZodEnum<{
         linux: "linux";
         darwin: "darwin";
     }>;
     nodeVersion: z.ZodString;
-    node: z.ZodString;
+    executable: z.ZodString;
     root: z.ZodString;
     workspace: z.ZodString;
     bootstrapHash: z.ZodOptional<z.ZodString>;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-ssh",
   "description": "Shared OpenSSH connection and versioned POSIX remote helper",
-  "version": "0.2.0-rc.2",
+  "version": "0.2.1-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -45,39 +45,41 @@
   ],
   "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/cordis": "~4.0.4",
-    "@deepseek-ai/dsh-fs": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs-local": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-subprocess": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs-sandbox": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-subprocess-local": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-session-projection": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox-local": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-brand": "0.2.0-rc.2"
+    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
+    "@deepseek-ai/dsh-fs": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-fs-local": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-fs-sandbox": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-subprocess-local": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-sandbox-local": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-session-projection": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-brand": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-util-values": "0.2.1-alpha.2"
   },
   "dependencies": {
-    "zod": "^4.4.3",
-    "@deepseek-ai/schemastery": "~3.18.4"
+    "@deepseek-ai/schemastery": "~3.18.5-alpha.1",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "~4.0.4",
-    "@deepseek-ai/dsh-fs": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs-local": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs-sandbox": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-subprocess": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-subprocess-local": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox-local": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-session-projection": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-ptc-runtime-node": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs-ssh": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-subprocess-ssh": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox-ssh": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-lsp": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-lsp-stdio": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-brand": "0.2.0-rc.2"
+    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
+    "@deepseek-ai/dsh-fs": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-fs-local": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-fs-sandbox": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-subprocess-local": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-sandbox-local": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-session-projection": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-ptc-runtime-node": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-fs-ssh": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-subprocess-ssh": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-sandbox-ssh": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-lsp": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-lsp-stdio": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-brand": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-util-values": "0.2.1-alpha.2"
   }
 }