@goodandready/dsh-remote-workspace 0.1.1 → 0.2.0

package/lib/index.js

@@ -1,4 +1,5 @@
 import z from '@deepseek-ai/schemastery';
+import { VaultService } from './vault-service.js';
 import { SshService } from './ssh-service.js';
 import { RemoteFsService } from './remote-fs-service.js';
 import { MirrorSyncService } from './mirror-sync-service.js';
@@ -38,21 +39,73 @@ export function apply(ctx, config = {}) {
     activeProfileId: cfg.activeProfileId || null
   };
 
-  const sshService = new SshService(ctx);
+  const vaultService = new VaultService();
+  const sshService = new SshService(ctx, vaultService);
   const remoteFs = new RemoteFsService(sshService);
   const mirrorSync = new MirrorSyncService(remoteFs, sshService);
   const tunnelService = new TunnelService(sshService);
 
+  // Migrate any existing plain passwords into vault upon start
+  for (const p of currentConfig.profiles) {
+    if (p.id && (p.password || p.privateKey || p.passphrase)) {
+      if (p.password && p.password !== '••••••••') {
+        vaultService.setProfileSecrets(p.id, { password: p.password });
+        p.password = '';
+      }
+      if (p.privateKey && p.privateKey !== '••••••••') {
+        vaultService.setProfileSecrets(p.id, { privateKey: p.privateKey });
+        p.privateKey = '';
+      }
+      if (p.passphrase && p.passphrase !== '••••••••') {
+        vaultService.setProfileSecrets(p.id, { passphrase: p.passphrase });
+        p.passphrase = '';
+      }
+    }
+  }
+
   const store = {
-    getProfiles() { return currentConfig.profiles || []; },
-    getProfile(id) { return (currentConfig.profiles || []).find((p) => p.id === id); },
+    vault: vaultService,
+    getRawProfiles() { return currentConfig.profiles || []; },
+    getProfiles() {
+      return (currentConfig.profiles || []).map((p) => vaultService.sanitizeProfile(p));
+    },
+    getProfile(id) {
+      const p = (currentConfig.profiles || []).find((x) => x.id === id);
+      return p ? vaultService.hydrateProfile(p) : undefined;
+    },
     getActiveId() { return currentConfig.activeProfileId; },
-    getActiveProfile() { return (currentConfig.profiles || []).find((p) => p.id === currentConfig.activeProfileId); },
-    async saveProfile(p) {
+    getActiveProfile() {
+      const p = (currentConfig.profiles || []).find((x) => x.id === currentConfig.activeProfileId);
+      return p ? vaultService.hydrateProfile(p) : undefined;
+    },
+    async saveProfile(rawP) {
       const list = [...(currentConfig.profiles || [])];
+      const p = { ...rawP };
+
+      // Save secret credentials into isolated .env file if provided
+      const secretsToUpdate = {};
+      if (p.password !== undefined && p.password !== '••••••••') {
+        secretsToUpdate.password = p.password;
+      }
+      if (p.privateKey !== undefined && p.privateKey !== '••••••••') {
+        secretsToUpdate.privateKey = p.privateKey;
+      }
+      if (p.passphrase !== undefined && p.passphrase !== '••••••••') {
+        secretsToUpdate.passphrase = p.passphrase;
+      }
+      if (Object.keys(secretsToUpdate).length > 0) {
+        vaultService.setProfileSecrets(p.id, secretsToUpdate);
+      }
+
+      // Do NOT keep raw secrets in public config
+      p.password = '';
+      p.privateKey = '';
+      p.passphrase = '';
+
       const idx = list.findIndex((x) => x.id === p.id);
       if (idx >= 0) list[idx] = { ...list[idx], ...p };
       else list.push(p);
+
       currentConfig.profiles = list;
       if (!currentConfig.activeProfileId && list.length === 1) {
         currentConfig.activeProfileId = p.id;
@@ -67,6 +120,7 @@ export function apply(ctx, config = {}) {
       if (currentConfig.activeProfileId === id) {
         currentConfig.activeProfileId = currentConfig.profiles[0]?.id || null;
       }
+      vaultService.deleteProfileSecrets(id);
       sshService.disconnect(id);
       if (settingsApi?.replace) {
         try { await settingsApi.replace(Config(currentConfig)); } catch (_) {}
@@ -101,11 +155,13 @@ export function apply(ctx, config = {}) {
   ctx.provide('remoteFs');
   ctx.provide('remoteSync');
   ctx.provide('remoteTunnel');
+  ctx.provide('remoteVault');
 
   ctx.remoteSsh = sshService;
   ctx.remoteFs = remoteFs;
   ctx.remoteSync = mirrorSync;
   ctx.remoteTunnel = tunnelService;
+  ctx.remoteVault = vaultService;
 
   // Tools registration
   registerRemoteTools(ctx, sshService, remoteFs, mirrorSync, tunnelService, () => store.getActiveProfile());

package/lib/mirror-sync-service.js

@@ -41,7 +41,8 @@ export class MirrorSyncService {
   }
 
   /**
-   * 3-way conflict aware pull: Remote -> Local Mirror
+   * Fast Delta-based 3-way conflict aware pull: Remote -> Local Mirror
+   * Uses file size and modification time to avoid downloading unchanged files.
    */
   async pull(profile, remoteDir, localDir, dryRun = false) {
     fs.mkdirSync(localDir, { recursive: true });
@@ -57,8 +58,8 @@ export class MirrorSyncService {
     const updated = [];
     const newSnapshot = { ...lastSnapshot };
 
-    // Try GNU find with printf first; fallback to standard find if unsupported
-    let findCmd = `find . -maxdepth 5 -type f ! -path '*/.*' ! -path '*/node_modules/*' -printf '%P\\t%s\\t%T@\\n' 2>/dev/null || find . -maxdepth 5 -type f ! -path '*/.*' ! -path '*/node_modules/*'`;
+    // Efficient remote scan with filename, size, and mtime
+    const findCmd = `find . -maxdepth 5 -type f ! -path '*/.*' ! -path '*/node_modules/*' -printf '%P\\t%s\\t%T@\\n' 2>/dev/null || find . -maxdepth 5 -type f ! -path '*/.*' ! -path '*/node_modules/*'`;
     const execRes = await this.sshService.exec(profile, findCmd, remoteDir);
     if (execRes.code !== 0 && !execRes.stdout.trim()) {
       throw new Error(`Failed to scan remote dir: ${execRes.stderr || 'No response from remote host'}`);
@@ -66,13 +67,44 @@ export class MirrorSyncService {
 
     const lines = execRes.stdout.split('\n').filter(Boolean);
     for (const line of lines) {
-      let relPath = line.split('\t')[0].trim();
+      const parts = line.split('\t');
+      let relPath = parts[0].trim();
       if (relPath.startsWith('./')) relPath = relPath.slice(2);
       if (!relPath || this.isIgnored(relPath)) continue;
 
+      const remoteSize = parts.length > 1 ? parseInt(parts[1], 10) : null;
+      const remoteMtime = parts.length > 2 ? parseFloat(parts[2]) : null;
+
       const remoteFullPath = path.posix.join(remoteDir, relPath);
       const localFullPath = path.join(localDir, relPath);
 
+      const baseEntry = lastSnapshot[relPath];
+      const baseHash = typeof baseEntry === 'object' ? baseEntry?.hash : baseEntry;
+      const baseRemoteMtime = typeof baseEntry === 'object' ? baseEntry?.remoteMtime : null;
+      const baseRemoteSize = typeof baseEntry === 'object' ? baseEntry?.remoteSize : null;
+
+      let localExists = fs.existsSync(localFullPath);
+      let localStat = localExists ? fs.statSync(localFullPath) : null;
+
+      // Delta Fast Path: if remote size & mtime match previous snapshot and local is unmodified
+      if (
+        localExists &&
+        baseHash &&
+        baseRemoteMtime &&
+        remoteMtime &&
+        Math.abs(remoteMtime - baseRemoteMtime) < 0.01 &&
+        baseRemoteSize === remoteSize
+      ) {
+        // Check if local was modified
+        const localContent = fs.readFileSync(localFullPath, 'utf8');
+        const localHash = this.computeHash(localContent);
+        if (localHash === baseHash) {
+          // File unchanged on both ends
+          continue;
+        }
+      }
+
+      // Download content only when potentially changed
       let remoteContent = '';
       try {
         remoteContent = await this.remoteFs.readFile(profile, remoteFullPath, 'utf8');
@@ -80,11 +112,10 @@ export class MirrorSyncService {
         continue; // skip unreadable files
       }
       const remoteHash = this.computeHash(remoteContent);
-      const baseHash = lastSnapshot[relPath];
 
       let localContent = null;
       let localHash = null;
-      if (fs.existsSync(localFullPath)) {
+      if (localExists) {
         localContent = fs.readFileSync(localFullPath, 'utf8');
         localHash = this.computeHash(localContent);
       }
@@ -100,11 +131,14 @@ export class MirrorSyncService {
         if (!dryRun) {
           fs.mkdirSync(path.dirname(localFullPath), { recursive: true });
           fs.writeFileSync(localFullPath, remoteContent, 'utf8');
-          newSnapshot[relPath] = remoteHash;
         }
-      } else {
-        newSnapshot[relPath] = remoteHash;
       }
+
+      newSnapshot[relPath] = {
+        hash: remoteHash,
+        remoteSize,
+        remoteMtime
+      };
     }
 
     if (!dryRun) {
@@ -120,7 +154,7 @@ export class MirrorSyncService {
   }
 
   /**
-   * 3-way conflict aware push: Local Mirror -> Remote
+   * Fast Delta-based 3-way conflict aware push: Local Mirror -> Remote
    */
   async push(profile, localDir, remoteDir, force = false, dryRun = false) {
     if (!fs.existsSync(localDir)) {
@@ -164,22 +198,29 @@ export class MirrorSyncService {
     for (const rel of localFiles) {
       const localFull = path.join(localDir, rel);
       const remoteFull = path.posix.join(remoteDir, rel.replace(/\\/g, '/'));
+      const stat = fs.statSync(localFull);
       const content = fs.readFileSync(localFull, 'utf8');
       const localHash = this.computeHash(content);
-      const baseHash = snapshot[rel];
+
+      const baseEntry = snapshot[rel];
+      const baseHash = typeof baseEntry === 'object' ? baseEntry?.hash : baseEntry;
 
       if (baseHash && baseHash === localHash && !force) {
         continue; // Unchanged locally
       }
 
       if (!dryRun) {
-        // Ensure remote parent dir exists
         const parent = path.posix.dirname(remoteFull);
         await this.remoteFs.mkdir(profile, parent);
         await this.remoteFs.writeFile(profile, remoteFull, content, 'utf8');
-        snapshot[rel] = localHash;
       }
       pushed.push(rel);
+
+      snapshot[rel] = {
+        hash: localHash,
+        localSize: stat.size,
+        localMtime: stat.mtimeMs
+      };
     }
 
     if (!dryRun) {

package/lib/remote-fs-service.js

@@ -6,12 +6,42 @@ export class RemoteFsService {
    */
   constructor(sshService) {
     this.sshService = sshService;
+    /** @type {Map<string, { data: any, expiresAt: number }>} */
+    this.cache = new Map();
+    this.cacheTtlMs = 15000; // 15 seconds
+  }
+
+  cacheKey(profileId, action, remotePath) {
+    return `${profileId}:${action}:${remotePath}`;
+  }
+
+  invalidateCache(profileId, subPath = null) {
+    if (!profileId) {
+      this.cache.clear();
+      return;
+    }
+    const prefix = subPath ? `${profileId}:` : `${profileId}:`;
+    for (const key of this.cache.keys()) {
+      if (key.startsWith(prefix)) {
+        if (!subPath || key.includes(subPath)) {
+          this.cache.delete(key);
+        }
+      }
+    }
   }
 
   /**
-   * Read directory entries
+   * Read directory entries with in-memory TTL cache
    */
-  async listDir(profile, remotePath) {
+  async listDir(profile, remotePath, bypassCache = false) {
+    const key = this.cacheKey(profile.id, 'list', remotePath);
+    if (!bypassCache) {
+      const cached = this.cache.get(key);
+      if (cached && cached.expiresAt > Date.now()) {
+        return cached.data;
+      }
+    }
+
     const sftp = await this.sshService.getSftp(profile);
     return new Promise((resolve, reject) => {
       sftp.readdir(remotePath, (err, list) => {
@@ -24,25 +54,36 @@ export class RemoteFsService {
           mtime: item.attrs.mtime,
           permissions: (item.attrs.mode & 0o777).toString(8)
         }));
+        this.cache.set(key, { data: entries, expiresAt: Date.now() + this.cacheTtlMs });
         resolve(entries);
       });
     });
   }
 
   /**
-   * Stat remote path
+   * Stat remote path with cache
    */
-  async stat(profile, remotePath) {
+  async stat(profile, remotePath, bypassCache = false) {
+    const key = this.cacheKey(profile.id, 'stat', remotePath);
+    if (!bypassCache) {
+      const cached = this.cache.get(key);
+      if (cached && cached.expiresAt > Date.now()) {
+        return cached.data;
+      }
+    }
+
     const sftp = await this.sshService.getSftp(profile);
     return new Promise((resolve, reject) => {
       sftp.stat(remotePath, (err, stats) => {
         if (err) return reject(err);
-        resolve({
+        const res = {
           isDirectory: (stats.mode & 0o40000) !== 0,
           isFile: (stats.mode & 0o100000) !== 0,
           size: stats.size,
           mtime: stats.mtime
-        });
+        };
+        this.cache.set(key, { data: res, expiresAt: Date.now() + this.cacheTtlMs });
+        resolve(res);
       });
     });
   }
@@ -64,6 +105,14 @@ export class RemoteFsService {
     });
   }
 
+  /**
+   * Get raw SFTP readable stream
+   */
+  async createReadStream(profile, remotePath) {
+    const sftp = await this.sshService.getSftp(profile);
+    return sftp.createReadStream(remotePath);
+  }
+
   /**
    * Atomic file write using temp file and rename
    */
@@ -82,10 +131,10 @@ export class RemoteFsService {
     return new Promise((resolve, reject) => {
       sftp.rename(tempPath, remotePath, (err) => {
         if (err) {
-          // If rename fails, try unlink temp
           sftp.unlink(tempPath, () => {});
           return reject(err);
         }
+        this.invalidateCache(profile.id, path.posix.dirname(remotePath));
         resolve({ success: true, bytes: data.length });
       });
     });
@@ -100,6 +149,7 @@ export class RemoteFsService {
     if (res.code !== 0) {
       throw new Error(`Failed to create remote dir ${remotePath}: ${res.stderr}`);
     }
+    this.invalidateCache(profile.id);
     return { success: true };
   }
 
@@ -112,6 +162,7 @@ export class RemoteFsService {
     if (res.code !== 0) {
       throw new Error(`Failed to remove remote path ${remotePath}: ${res.stderr}`);
     }
+    this.invalidateCache(profile.id);
     return { success: true };
   }
 }