@goodandready/dsh-remote-workspace 0.1.0 → 0.1.1

package/lib/index.js

@@ -14,11 +14,11 @@ export const inject = ['tools'];
 
 export const Config = z.object({
   profiles: z.array(z.object({
-    id: z.string(),
-    name: z.string(),
-    host: z.string(),
+    id: z.string().default(''),
+    name: z.string().default(''),
+    host: z.string().default(''),
     port: z.number().default(22),
-    username: z.string(),
+    username: z.string().default('root'),
     authType: z.string().default('key'),
     privateKeyPath: z.string().default(''),
     privateKey: z.string().default(''),
@@ -38,6 +38,11 @@ export function apply(ctx, config = {}) {
     activeProfileId: cfg.activeProfileId || null
   };
 
+  const sshService = new SshService(ctx);
+  const remoteFs = new RemoteFsService(sshService);
+  const mirrorSync = new MirrorSyncService(remoteFs, sshService);
+  const tunnelService = new TunnelService(sshService);
+
   const store = {
     getProfiles() { return currentConfig.profiles || []; },
     getProfile(id) { return (currentConfig.profiles || []).find((p) => p.id === id); },
@@ -52,8 +57,9 @@ export function apply(ctx, config = {}) {
       if (!currentConfig.activeProfileId && list.length === 1) {
         currentConfig.activeProfileId = p.id;
       }
+      sshService.invalidate(p.id);
       if (settingsApi?.replace) {
-        await settingsApi.replace(Config(currentConfig));
+        try { await settingsApi.replace(Config(currentConfig)); } catch (_) {}
       }
     },
     async deleteProfile(id) {
@@ -61,23 +67,27 @@ export function apply(ctx, config = {}) {
       if (currentConfig.activeProfileId === id) {
         currentConfig.activeProfileId = currentConfig.profiles[0]?.id || null;
       }
+      sshService.disconnect(id);
       if (settingsApi?.replace) {
-        await settingsApi.replace(Config(currentConfig));
+        try { await settingsApi.replace(Config(currentConfig)); } catch (_) {}
       }
     },
     async setActiveId(id) {
       currentConfig.activeProfileId = id;
       if (settingsApi?.replace) {
-        await settingsApi.replace(Config(currentConfig));
+        try { await settingsApi.replace(Config(currentConfig)); } catch (_) {}
       }
     }
   };
 
   // Register settings namespace if settings service is available
   ctx.inject(['settings'], (sctx) => {
-    const scope = sctx.settings.register(NS, Config, { base: cfg });
+    const settingsService = sctx.get ? (sctx.get('settings') ?? sctx.settings) : sctx.settings;
+    if (!settingsService || typeof settingsService.register !== 'function') return;
+
+    const scope = settingsService.register(NS, Config, { base: cfg });
     settingsApi = scope;
-    const snap = scope.get();
+    const snap = scope.get ? scope.get() : null;
     if (snap) {
       if (Array.isArray(snap.profiles)) currentConfig.profiles = snap.profiles;
       if (snap.activeProfileId !== undefined) currentConfig.activeProfileId = snap.activeProfileId;
@@ -87,11 +97,6 @@ export function apply(ctx, config = {}) {
     });
   });
 
-  const sshService = new SshService(ctx);
-  const remoteFs = new RemoteFsService(sshService);
-  const mirrorSync = new MirrorSyncService(remoteFs, sshService);
-  const tunnelService = new TunnelService(sshService);
-
   ctx.provide('remoteSsh');
   ctx.provide('remoteFs');
   ctx.provide('remoteSync');

package/lib/mirror-sync-service.js

@@ -57,22 +57,28 @@ export class MirrorSyncService {
     const updated = [];
     const newSnapshot = { ...lastSnapshot };
 
-    // Find remote files using find over ssh for speed
-    const findCmd = `find . -maxdepth 5 -type f ! -path '*/.*' ! -path '*/node_modules/*' -printf '%P\\t%s\\t%T@\\n'`;
+    // Try GNU find with printf first; fallback to standard find if unsupported
+    let findCmd = `find . -maxdepth 5 -type f ! -path '*/.*' ! -path '*/node_modules/*' -printf '%P\\t%s\\t%T@\\n' 2>/dev/null || find . -maxdepth 5 -type f ! -path '*/.*' ! -path '*/node_modules/*'`;
     const execRes = await this.sshService.exec(profile, findCmd, remoteDir);
-    if (execRes.code !== 0) {
-      throw new Error(`Failed to scan remote dir: ${execRes.stderr}`);
+    if (execRes.code !== 0 && !execRes.stdout.trim()) {
+      throw new Error(`Failed to scan remote dir: ${execRes.stderr || 'No response from remote host'}`);
     }
 
     const lines = execRes.stdout.split('\n').filter(Boolean);
     for (const line of lines) {
-      const [relPath] = line.split('\t');
+      let relPath = line.split('\t')[0].trim();
+      if (relPath.startsWith('./')) relPath = relPath.slice(2);
       if (!relPath || this.isIgnored(relPath)) continue;
 
       const remoteFullPath = path.posix.join(remoteDir, relPath);
       const localFullPath = path.join(localDir, relPath);
 
-      const remoteContent = await this.remoteFs.readFile(profile, remoteFullPath, 'utf8');
+      let remoteContent = '';
+      try {
+        remoteContent = await this.remoteFs.readFile(profile, remoteFullPath, 'utf8');
+      } catch (err) {
+        continue; // skip unreadable files
+      }
       const remoteHash = this.computeHash(remoteContent);
       const baseHash = lastSnapshot[relPath];
 
@@ -117,6 +123,16 @@ export class MirrorSyncService {
    * 3-way conflict aware push: Local Mirror -> Remote
    */
   async push(profile, localDir, remoteDir, force = false, dryRun = false) {
+    if (!fs.existsSync(localDir)) {
+      fs.mkdirSync(localDir, { recursive: true });
+      return {
+        success: true,
+        pushed: [],
+        conflicts: [],
+        dryRun
+      };
+    }
+
     const snapshotFile = path.join(localDir, '.dsh-sync-snapshot.json');
     let snapshot = {};
     if (fs.existsSync(snapshotFile)) {

package/lib/routes.js

@@ -1,11 +1,11 @@
-function writeJson(res, code, data) {
+export function writeJson(res, code, data) {
   try {
-    res.writeHead(code, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+    res.writeHead(code, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' });
     res.end(JSON.stringify(data));
   } catch {}
 }
 
-function readBody(req, maxBytes = 256 * 1024) {
+export function readBody(req, maxBytes = 256 * 1024) {
   return new Promise((resolve, reject) => {
     const chunks = [];
     let size = 0;
@@ -30,14 +30,22 @@ function readBody(req, maxBytes = 256 * 1024) {
   });
 }
 
+/** Reject cross-site writes. LAN / reverse-proxy UIs are allowed. */
+export function isTrustedSettingsRequest(request) {
+  return request.headers['sec-fetch-site'] !== 'cross-site';
+}
+
 export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelService, store) {
   ctx.inject(['webServer'], (sctx) => {
+    const webServer = sctx.get ? (sctx.get('webServer') ?? sctx.webServer) : sctx.webServer;
+    if (!webServer || typeof webServer.register !== 'function') return;
+
     // 1. GET /dsh-remote-workspace/state
-    sctx.effect(() => sctx.webServer.register({
+    sctx.effect(() => webServer.register({
       kind: 'exact',
       path: '/dsh-remote-workspace/state',
       handler: async (req, res) => {
-        if (req.method !== 'GET') return writeJson(res, 405, { error: 'GET only' });
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
         const profiles = store.getProfiles();
         const activeId = store.getActiveId();
         const tunnels = tunnelService.listActiveTunnels();
@@ -46,16 +54,18 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
     }), 'dsh-remote-workspace: /state');
 
     // 2. POST /dsh-remote-workspace/profiles/save
-    sctx.effect(() => sctx.webServer.register({
+    sctx.effect(() => webServer.register({
       kind: 'exact',
       path: '/dsh-remote-workspace/profiles/save',
       handler: async (req, res) => {
-        if (req.method !== 'POST') return writeJson(res, 405, { error: 'POST only' });
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
         try {
           const profile = await readBody(req);
           if (!profile.id || !profile.host) {
             return writeJson(res, 400, { ok: false, error: 'ID and Host are required' });
           }
+          sshService.invalidate(profile.id);
           await store.saveProfile(profile);
           writeJson(res, 200, { ok: true, profile });
         } catch (err) {
@@ -65,14 +75,16 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
     }), 'dsh-remote-workspace: /profiles/save');
 
     // 3. POST /dsh-remote-workspace/profiles/delete
-    sctx.effect(() => sctx.webServer.register({
+    sctx.effect(() => webServer.register({
       kind: 'exact',
       path: '/dsh-remote-workspace/profiles/delete',
       handler: async (req, res) => {
-        if (req.method !== 'POST') return writeJson(res, 405, { error: 'POST only' });
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
         try {
           const { id } = await readBody(req);
           if (!id) return writeJson(res, 400, { ok: false, error: 'ID is required' });
+          sshService.disconnect(id);
           await store.deleteProfile(id);
           writeJson(res, 200, { ok: true });
         } catch (err) {
@@ -82,11 +94,12 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
     }), 'dsh-remote-workspace: /profiles/delete');
 
     // 4. POST /dsh-remote-workspace/profiles/active
-    sctx.effect(() => sctx.webServer.register({
+    sctx.effect(() => webServer.register({
       kind: 'exact',
       path: '/dsh-remote-workspace/profiles/active',
       handler: async (req, res) => {
-        if (req.method !== 'POST') return writeJson(res, 405, { error: 'POST only' });
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
         try {
           const { id } = await readBody(req);
           await store.setActiveId(id || null);
@@ -98,11 +111,12 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
     }), 'dsh-remote-workspace: /profiles/active');
 
     // 5. POST /dsh-remote-workspace/test
-    sctx.effect(() => sctx.webServer.register({
+    sctx.effect(() => webServer.register({
       kind: 'exact',
       path: '/dsh-remote-workspace/test',
       handler: async (req, res) => {
-        if (req.method !== 'POST') return writeJson(res, 405, { error: 'POST only' });
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
         try {
           const body = await readBody(req);
           const profile = body.profile || (body.id ? store.getProfile(body.id) : body);
@@ -110,7 +124,14 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
             return writeJson(res, 400, { ok: false, error: 'Invalid profile configuration' });
           }
           const result = await sshService.testConnection(profile);
-          writeJson(res, 200, { ok: result.success, ...result });
+          writeJson(res, 200, {
+            ok: result.success,
+            success: result.success,
+            latency: result.latency,
+            latencyMs: result.latency,
+            os: result.os,
+            remoteOs: result.os
+          });
         } catch (err) {
           writeJson(res, 200, { ok: false, error: err.message });
         }
@@ -118,11 +139,12 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
     }), 'dsh-remote-workspace: /test');
 
     // 6. POST /dsh-remote-workspace/browse
-    sctx.effect(() => sctx.webServer.register({
+    sctx.effect(() => webServer.register({
       kind: 'exact',
       path: '/dsh-remote-workspace/browse',
       handler: async (req, res) => {
-        if (req.method !== 'POST') return writeJson(res, 405, { error: 'POST only' });
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
         try {
           const body = await readBody(req);
           const profile = body.profile || (body.profileId ? store.getProfile(body.profileId) : store.getActiveProfile());
@@ -139,17 +161,18 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
     }), 'dsh-remote-workspace: /browse');
 
     // 7. POST /dsh-remote-workspace/sync
-    sctx.effect(() => sctx.webServer.register({
+    sctx.effect(() => webServer.register({
       kind: 'exact',
       path: '/dsh-remote-workspace/sync',
       handler: async (req, res) => {
-        if (req.method !== 'POST') return writeJson(res, 405, { error: 'POST only' });
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
         try {
           const { profileId, direction } = await readBody(req);
-          const profile = store.getProfile(profileId) || store.getActiveProfile();
+          const profile = (profileId ? store.getProfile(profileId) : null) || store.getActiveProfile();
           if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
           if (!profile.remoteWorkspace || !profile.localMirrorPath) {
-            return writeJson(res, 400, { ok: false, error: 'Both remoteWorkspace and localMirrorPath must be set' });
+            return writeJson(res, 400, { ok: false, error: 'Both remoteWorkspace and localMirrorPath must be configured' });
           }
           const resSync = direction === 'push'
             ? await mirrorSync.push(profile, profile.localMirrorPath, profile.remoteWorkspace)
@@ -160,5 +183,47 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
         }
       }
     }), 'dsh-remote-workspace: /sync');
+
+    // 8. POST /dsh-remote-workspace/tunnels/start
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/tunnels/start',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+        try {
+          const { profileId, localPort, targetHost, remotePort } = await readBody(req);
+          const profile = (profileId ? store.getProfile(profileId) : null) || store.getActiveProfile();
+          if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+          const lPort = parseInt(localPort, 10);
+          const rPort = parseInt(remotePort, 10);
+          if (!lPort || !rPort) {
+            return writeJson(res, 400, { ok: false, error: 'Valid localPort and remotePort required' });
+          }
+          const result = await tunnelService.startLocalTunnel(profile, lPort, targetHost || '127.0.0.1', rPort);
+          writeJson(res, 200, { ok: result.success, ...result });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /tunnels/start');
+
+    // 9. POST /dsh-remote-workspace/tunnels/stop
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/tunnels/stop',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+        try {
+          const { tunnelId } = await readBody(req);
+          if (!tunnelId) return writeJson(res, 400, { ok: false, error: 'tunnelId required' });
+          const stopped = tunnelService.stopTunnel(tunnelId);
+          writeJson(res, 200, { ok: stopped });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /tunnels/stop');
   });
 }

package/lib/ssh-service.js

@@ -20,13 +20,15 @@ export class SshService {
       return profile.privateKey;
     }
     if (profile.privateKeyPath) {
-      let resolvedPath = profile.privateKeyPath;
+      let resolvedPath = profile.privateKeyPath.trim();
       if (resolvedPath.startsWith('~')) {
         resolvedPath = path.join(os.homedir(), resolvedPath.slice(1));
       }
-      if (fs.existsSync(resolvedPath)) {
-        return fs.readFileSync(resolvedPath, 'utf8');
-      }
+      try {
+        if (fs.existsSync(resolvedPath)) {
+          return fs.readFileSync(resolvedPath, 'utf8');
+        }
+      } catch (_) {}
     }
     return undefined;
   }
@@ -53,7 +55,7 @@ export class SshService {
       };
 
       if (profile.authType === 'password') {
-        connConfig.password = profile.password;
+        connConfig.password = profile.password || '';
       } else if (profile.authType === 'agent') {
         connConfig.agent = process.env.SSH_AUTH_SOCK;
       } else {
@@ -92,6 +94,10 @@ export class SshService {
    * Test connection and measure ping / detect OS
    */
   async testConnection(profile) {
+    // Invalidate any existing connection for this profile id to ensure fresh credentials are used
+    if (profile.id) {
+      this.disconnect(profile.id);
+    }
     const start = Date.now();
     const conn = await this.getConnection(profile);
     const latency = Date.now() - start;
@@ -99,12 +105,25 @@ export class SshService {
     return new Promise((resolve) => {
       conn.exec('uname -s -r -m || ver', (err, stream) => {
         if (err) {
-          return resolve({ success: true, latency, os: 'Unknown' });
+          return resolve({
+            success: true,
+            latency,
+            latencyMs: latency,
+            os: 'Unknown',
+            remoteOs: 'Unknown'
+          });
         }
         let output = '';
         stream.on('data', (d) => { output += d.toString(); });
         stream.on('close', () => {
-          resolve({ success: true, latency, os: output.trim() });
+          const osStr = output.trim() || 'Unknown';
+          resolve({
+            success: true,
+            latency,
+            latencyMs: latency,
+            os: osStr,
+            remoteOs: osStr
+          });
         });
       });
     });
@@ -157,10 +176,14 @@ export class SshService {
     });
   }
 
+  invalidate(profileId) {
+    this.disconnect(profileId);
+  }
+
   disconnect(profileId) {
     const conn = this.connections.get(profileId);
     if (conn) {
-      conn.end();
+      try { conn.end(); } catch (_) {}
       this.connections.delete(profileId);
       this.sftpSessions.delete(profileId);
     }

package/lib/tunnel-service.js

@@ -6,7 +6,7 @@ export class TunnelService {
    */
   constructor(sshService) {
     this.sshService = sshService;
-    /** @type {Map<string, { server?: net.Server, profileId: string, localPort: number, remotePort: number }>} */
+    /** @type {Map<string, { server?: net.Server, profileId: string, localPort: number, targetHost: string, remotePort: number }>} */
     this.activeTunnels = new Map();
   }
 
@@ -16,7 +16,7 @@ export class TunnelService {
   async startLocalTunnel(profile, localPort, targetHost = '127.0.0.1', targetPort) {
     const tunnelId = `${profile.id}:${localPort}->${targetPort}`;
     if (this.activeTunnels.has(tunnelId)) {
-      return { success: true, message: 'Tunnel already active', tunnelId };
+      return { success: true, message: 'Tunnel already active', tunnelId, localPort, remotePort: targetPort };
     }
 
     const conn = await this.sshService.getConnection(profile);
@@ -30,27 +30,34 @@ export class TunnelService {
           targetPort,
           (err, stream) => {
             if (err) {
-              socket.destroy();
+              try { socket.destroy(); } catch (_) {}
               return;
             }
+            stream.on('error', () => {
+              try { socket.destroy(); } catch (_) {}
+            });
+            socket.on('error', () => {
+              try { stream.destroy(); } catch (_) {}
+            });
             socket.pipe(stream).pipe(socket);
           }
         );
       });
 
+      server.on('error', (err) => {
+        this.activeTunnels.delete(tunnelId);
+        reject(err);
+      });
+
       server.listen(localPort, '127.0.0.1', () => {
         this.activeTunnels.set(tunnelId, {
           server,
           profileId: profile.id,
           localPort,
+          targetHost,
           remotePort: targetPort
         });
-        resolve({ success: true, tunnelId, localPort, targetPort });
-      });
-
-      server.on('error', (err) => {
-        this.activeTunnels.delete(tunnelId);
-        reject(err);
+        resolve({ success: true, tunnelId, localPort, targetHost, remotePort: targetPort });
       });
     });
   }
@@ -61,7 +68,9 @@ export class TunnelService {
   stopTunnel(tunnelId) {
     const tunnel = this.activeTunnels.get(tunnelId);
     if (tunnel && tunnel.server) {
-      tunnel.server.close();
+      try {
+        tunnel.server.close();
+      } catch (_) {}
       this.activeTunnels.delete(tunnelId);
       return true;
     }
@@ -73,6 +82,7 @@ export class TunnelService {
       id,
       profileId: t.profileId,
       localPort: t.localPort,
+      targetHost: t.targetHost || '127.0.0.1',
       remotePort: t.remotePort
     }));
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-remote-workspace",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Enterprise Remote Workspace Plugin for DeepSeek Harness: SSH2 connection pool, SFTP operations, 3-way conflict-aware mirror sync, port forwarding, and native DSH UI.",
   "type": "module",
   "main": "lib/index.js",