@goodandready/dsh-remote-workspace 0.1.1 → 0.3.0

package/lib/docker-service.js

@@ -0,0 +1,93 @@
+export class DockerService {
+  /**
+   * @param {import('./ssh-service.js').SshService} sshService
+   */
+  constructor(sshService) {
+    this.sshService = sshService;
+  }
+
+  /**
+   * List active or all containers with JSON formatting
+   */
+  async listContainers(profile, all = true) {
+    // Detect docker or podman
+    const flag = all ? '-a' : '';
+    // Format as line-delimited JSON or tabbed format
+    const cmd = `docker ps ${flag} --format '{{json .}}' 2>/dev/null || podman ps ${flag} --format '{{json .}}' 2>/dev/null`;
+    const res = await this.sshService.exec(profile, cmd);
+
+    if (res.code !== 0 && !res.stdout.trim()) {
+      return {
+        available: false,
+        error: res.stderr || 'Docker not found or daemon not running',
+        containers: []
+      };
+    }
+
+    const containers = [];
+    const lines = res.stdout.split('\n').filter(Boolean);
+    for (const line of lines) {
+      try {
+        const item = JSON.parse(line);
+        containers.push({
+          id: item.ID || item.Id || '',
+          names: item.Names || item.Name || '',
+          image: item.Image || '',
+          status: item.Status || '',
+          state: (item.State || '').toLowerCase(),
+          ports: item.Ports || '',
+          created: item.CreatedAt || item.Created || ''
+        });
+      } catch (_) {}
+    }
+
+    return {
+      available: true,
+      containers
+    };
+  }
+
+  /**
+   * Container action: start, stop, restart, pause, unpause
+   */
+  async containerAction(profile, containerId, action) {
+    const validActions = ['start', 'stop', 'restart', 'pause', 'unpause', 'rm'];
+    if (!validActions.includes(action)) {
+      throw new Error(`Invalid container action: ${action}`);
+    }
+    const cmd = `docker ${action} ${JSON.stringify(containerId)} 2>/dev/null || podman ${action} ${JSON.stringify(containerId)}`;
+    const res = await this.sshService.exec(profile, cmd);
+    return {
+      success: res.code === 0,
+      stdout: res.stdout.trim(),
+      stderr: res.stderr.trim()
+    };
+  }
+
+  /**
+   * Fetch container logs
+   */
+  async containerLogs(profile, containerId, tail = 100) {
+    const cmd = `docker logs --tail ${tail} ${JSON.stringify(containerId)} 2>&1 || podman logs --tail ${tail} ${JSON.stringify(containerId)} 2>&1`;
+    const res = await this.sshService.exec(profile, cmd);
+    return {
+      success: res.code === 0,
+      logs: res.stdout || res.stderr || ''
+    };
+  }
+
+  /**
+   * Docker compose lifecycle
+   */
+  async composeAction(profile, cwd, action = 'ps') {
+    const valid = ['up -d', 'down', 'ps', 'restart', 'pull'];
+    const safeAction = valid.includes(action) ? action : 'ps';
+    const cmd = `docker compose ${safeAction} 2>/dev/null || docker-compose ${safeAction} 2>/dev/null || podman-compose ${safeAction}`;
+    const res = await this.sshService.exec(profile, cmd, cwd);
+    return {
+      success: res.code === 0,
+      stdout: res.stdout,
+      stderr: res.stderr
+    };
+  }
+}

package/lib/health-service.js

@@ -0,0 +1,117 @@
+export class HealthService {
+  /**
+   * @param {import('./ssh-service.js').SshService} sshService
+   */
+  constructor(sshService) {
+    this.sshService = sshService;
+    /** @type {Map<string, { data: any, expiresAt: number }>} */
+    this.cache = new Map();
+    this.cacheTtlMs = 4000;
+  }
+
+  async getHealth(profile, bypassCache = false) {
+    if (!profile || !profile.host) {
+      throw new Error('Invalid profile');
+    }
+
+    const cacheKey = profile.id;
+    if (!bypassCache) {
+      const cached = this.cache.get(cacheKey);
+      if (cached && cached.expiresAt > Date.now()) {
+        return cached.data;
+      }
+    }
+
+    // Single compact shell command to gather all stats at once:
+    // 1. uptime (load averages)
+    // 2. memory (free -m)
+    // 3. disk usage (df -k /)
+    // 4. cpu info (cores & idle via /proc/stat or top)
+    const probeCmd = `
+echo "---UPTIME---"
+uptime 2>/dev/null || true
+echo "---MEM---"
+free -m 2>/dev/null || true
+echo "---DISK---"
+df -m / 2>/dev/null || df -m . 2>/dev/null || true
+echo "---CPU---"
+grep 'cpu ' /proc/stat 2>/dev/null || true
+`;
+
+    const res = await this.sshService.exec(profile, probeCmd);
+    const text = res.stdout || '';
+
+    const uptimeMatch = text.match(/---UPTIME---\n([\s\S]*?)(?=---MEM---)/);
+    const memMatch = text.match(/---MEM---\n([\s\S]*?)(?=---DISK---)/);
+    const diskMatch = text.match(/---DISK---\n([\s\S]*?)(?=---CPU---)/);
+
+    // 1. Parse Uptime & Load Avg
+    let uptimeStr = 'Unknown';
+    let loadAvg = [0, 0, 0];
+    if (uptimeMatch) {
+      const upLine = uptimeMatch[1].trim();
+      const loadMatch = upLine.match(/load average[s]?:\s*([\d.]+),?\s*([\d.]+),?\s*([\d.]+)/);
+      if (loadMatch) {
+        loadAvg = [parseFloat(loadMatch[1]), parseFloat(loadMatch[2]), parseFloat(loadMatch[3])];
+      }
+      const upPart = upLine.match(/up\s+(.*?),\s+\d+\s+user/);
+      if (upPart) uptimeStr = upPart[1];
+      else uptimeStr = upLine.split(',')[0] || 'Online';
+    }
+
+    // 2. Parse Memory
+    let memTotal = 0;
+    let memUsed = 0;
+    let memPercent = 0;
+    if (memMatch) {
+      const memLines = memMatch[1].trim().split('\n');
+      for (const line of memLines) {
+        if (line.startsWith('Mem:')) {
+          const parts = line.split(/\s+/);
+          memTotal = parseInt(parts[1], 10) || 0;
+          memUsed = parseInt(parts[2], 10) || 0;
+          if (memTotal > 0) {
+            memPercent = Math.round((memUsed / memTotal) * 100);
+          }
+          break;
+        }
+      }
+    }
+
+    // 3. Parse Disk
+    let diskTotal = 0;
+    let diskUsed = 0;
+    let diskPercent = 0;
+    if (diskMatch) {
+      const diskLines = diskMatch[1].trim().split('\n');
+      if (diskLines.length > 1) {
+        const parts = diskLines[1].split(/\s+/);
+        diskTotal = parseInt(parts[1], 10) || 0;
+        diskUsed = parseInt(parts[2], 10) || 0;
+        const pStr = parts[4] || '';
+        diskPercent = parseInt(pStr.replace('%', ''), 10) || (diskTotal > 0 ? Math.round((diskUsed / diskTotal) * 100) : 0);
+      }
+    }
+
+    const result = {
+      ok: true,
+      timestamp: Date.now(),
+      uptime: uptimeStr,
+      loadAverage: loadAvg,
+      cpuLoad: Math.min(100, Math.round(loadAvg[0] * 25)), // Normalized approx representation
+      memory: {
+        totalMb: memTotal,
+        usedMb: memUsed,
+        percent: memPercent
+      },
+      disk: {
+        totalMb: diskTotal,
+        usedMb: diskUsed,
+        percent: diskPercent
+      }
+    };
+
+    this.cache.set(cacheKey, { data: result, expiresAt: Date.now() + this.cacheTtlMs });
+    return result;
+  }
+}

package/lib/index.js

@@ -1,8 +1,12 @@
 import z from '@deepseek-ai/schemastery';
+import { VaultService } from './vault-service.js';
 import { SshService } from './ssh-service.js';
 import { RemoteFsService } from './remote-fs-service.js';
 import { MirrorSyncService } from './mirror-sync-service.js';
 import { TunnelService } from './tunnel-service.js';
+import { DockerService } from './docker-service.js';
+import { HealthService } from './health-service.js';
+import { WatcherService } from './watcher-service.js';
 import { registerRemoteTools } from './tools.js';
 import { registerApiRoutes } from './routes.js';
 
@@ -25,9 +29,11 @@ export const Config = z.object({
     passphrase: z.string().default(''),
     password: z.string().default(''),
     remoteWorkspace: z.string().default(''),
-    localMirrorPath: z.string().default('')
+    localMirrorPath: z.string().default(''),
+    jumpHostId: z.string().default('')
   })).default([]).description('List of configured remote machines and workspaces.'),
-  activeProfileId: z.string().default('').description('ID of active remote profile.')
+  activeProfileId: z.string().default('').description('ID of active remote profile.'),
+  autoSyncActive: z.boolean().default(false).description('Whether Live Auto-Sync watcher is enabled.')
 });
 
 export function apply(ctx, config = {}) {
@@ -35,24 +41,90 @@ export function apply(ctx, config = {}) {
   let settingsApi = null;
   let currentConfig = {
     profiles: Array.isArray(cfg.profiles) ? cfg.profiles : [],
-    activeProfileId: cfg.activeProfileId || null
+    activeProfileId: cfg.activeProfileId || null,
+    autoSyncActive: Boolean(cfg.autoSyncActive)
   };
 
-  const sshService = new SshService(ctx);
+  const vaultService = new VaultService();
+  const sshService = new SshService(ctx, vaultService);
   const remoteFs = new RemoteFsService(sshService);
   const mirrorSync = new MirrorSyncService(remoteFs, sshService);
   const tunnelService = new TunnelService(sshService);
+  const dockerService = new DockerService(sshService);
+  const healthService = new HealthService(sshService);
+  const watcherService = new WatcherService();
+
+  // Migrate any existing plain passwords into vault upon start
+  for (const p of currentConfig.profiles) {
+    if (p.id && (p.password || p.privateKey || p.passphrase)) {
+      if (p.password && p.password !== '••••••••') {
+        vaultService.setProfileSecrets(p.id, { password: p.password });
+        p.password = '';
+      }
+      if (p.privateKey && p.privateKey !== '••••••••') {
+        vaultService.setProfileSecrets(p.id, { privateKey: p.privateKey });
+        p.privateKey = '';
+      }
+      if (p.passphrase && p.passphrase !== '••••••••') {
+        vaultService.setProfileSecrets(p.id, { passphrase: p.passphrase });
+        p.passphrase = '';
+      }
+    }
+  }
 
   const store = {
-    getProfiles() { return currentConfig.profiles || []; },
-    getProfile(id) { return (currentConfig.profiles || []).find((p) => p.id === id); },
+    vault: vaultService,
+    getRawProfiles() { return currentConfig.profiles || []; },
+    getProfiles() {
+      return (currentConfig.profiles || []).map((p) => vaultService.sanitizeProfile(p));
+    },
+    getProfile(id) {
+      const p = (currentConfig.profiles || []).find((x) => x.id === id);
+      return p ? vaultService.hydrateProfile(p) : undefined;
+    },
     getActiveId() { return currentConfig.activeProfileId; },
-    getActiveProfile() { return (currentConfig.profiles || []).find((p) => p.id === currentConfig.activeProfileId); },
-    async saveProfile(p) {
+    getActiveProfile() {
+      const p = (currentConfig.profiles || []).find((x) => x.id === currentConfig.activeProfileId);
+      return p ? vaultService.hydrateProfile(p) : undefined;
+    },
+    isAutoSyncEnabled() { return Boolean(currentConfig.autoSyncActive); },
+    async setAutoSyncEnabled(enabled) {
+      currentConfig.autoSyncActive = Boolean(enabled);
+      const active = store.getActiveProfile();
+      if (active) {
+        if (enabled) watcherService.start(active, mirrorSync);
+        else watcherService.stop(active.id);
+      }
+      if (settingsApi?.replace) {
+        try { await settingsApi.replace(Config(currentConfig)); } catch (_) {}
+      }
+    },
+    async saveProfile(rawP) {
       const list = [...(currentConfig.profiles || [])];
+      const p = { ...rawP };
+
+      const secretsToUpdate = {};
+      if (p.password !== undefined && p.password !== '••••••••') {
+        secretsToUpdate.password = p.password;
+      }
+      if (p.privateKey !== undefined && p.privateKey !== '••••••••') {
+        secretsToUpdate.privateKey = p.privateKey;
+      }
+      if (p.passphrase !== undefined && p.passphrase !== '••••••••') {
+        secretsToUpdate.passphrase = p.passphrase;
+      }
+      if (Object.keys(secretsToUpdate).length > 0) {
+        vaultService.setProfileSecrets(p.id, secretsToUpdate);
+      }
+
+      p.password = '';
+      p.privateKey = '';
+      p.passphrase = '';
+
       const idx = list.findIndex((x) => x.id === p.id);
       if (idx >= 0) list[idx] = { ...list[idx], ...p };
       else list.push(p);
+
       currentConfig.profiles = list;
       if (!currentConfig.activeProfileId && list.length === 1) {
         currentConfig.activeProfileId = p.id;
@@ -63,10 +135,12 @@ export function apply(ctx, config = {}) {
       }
     },
     async deleteProfile(id) {
+      watcherService.stop(id);
       currentConfig.profiles = (currentConfig.profiles || []).filter((p) => p.id !== id);
       if (currentConfig.activeProfileId === id) {
         currentConfig.activeProfileId = currentConfig.profiles[0]?.id || null;
       }
+      vaultService.deleteProfileSecrets(id);
       sshService.disconnect(id);
       if (settingsApi?.replace) {
         try { await settingsApi.replace(Config(currentConfig)); } catch (_) {}
@@ -74,12 +148,25 @@ export function apply(ctx, config = {}) {
     },
     async setActiveId(id) {
       currentConfig.activeProfileId = id;
+      if (currentConfig.autoSyncActive) {
+        watcherService.stopAll();
+        const active = store.getActiveProfile();
+        if (active) watcherService.start(active, mirrorSync);
+      }
       if (settingsApi?.replace) {
         try { await settingsApi.replace(Config(currentConfig)); } catch (_) {}
       }
     }
   };
 
+  sshService.setJumpProfileResolver((jumpId) => store.getProfile(jumpId));
+
+  // If autoSync was enabled on restart, resume watcher for active profile
+  if (currentConfig.autoSyncActive && currentConfig.activeProfileId) {
+    const active = store.getActiveProfile();
+    if (active) watcherService.start(active, mirrorSync);
+  }
+
   // Register settings namespace if settings service is available
   ctx.inject(['settings'], (sctx) => {
     const settingsService = sctx.get ? (sctx.get('settings') ?? sctx.settings) : sctx.settings;
@@ -91,6 +178,7 @@ export function apply(ctx, config = {}) {
     if (snap) {
       if (Array.isArray(snap.profiles)) currentConfig.profiles = snap.profiles;
       if (snap.activeProfileId !== undefined) currentConfig.activeProfileId = snap.activeProfileId;
+      if (snap.autoSyncActive !== undefined) currentConfig.autoSyncActive = snap.autoSyncActive;
     }
     sctx.effect(() => () => {
       settingsApi = null;
@@ -101,20 +189,38 @@ export function apply(ctx, config = {}) {
   ctx.provide('remoteFs');
   ctx.provide('remoteSync');
   ctx.provide('remoteTunnel');
+  ctx.provide('remoteVault');
+  ctx.provide('remoteDocker');
+  ctx.provide('remoteHealth');
+  ctx.provide('remoteWatcher');
 
   ctx.remoteSsh = sshService;
   ctx.remoteFs = remoteFs;
   ctx.remoteSync = mirrorSync;
   ctx.remoteTunnel = tunnelService;
+  ctx.remoteVault = vaultService;
+  ctx.remoteDocker = dockerService;
+  ctx.remoteHealth = healthService;
+  ctx.remoteWatcher = watcherService;
 
   // Tools registration
-  registerRemoteTools(ctx, sshService, remoteFs, mirrorSync, tunnelService, () => store.getActiveProfile());
+  registerRemoteTools(
+    ctx,
+    sshService,
+    remoteFs,
+    mirrorSync,
+    tunnelService,
+    () => store.getActiveProfile(),
+    (id) => store.getProfile(id),
+    dockerService
+  );
 
   // API Routes
-  registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelService, store);
+  registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelService, store, dockerService, healthService, watcherService);
 
   // Cleanup on unload
   ctx.on('dispose', () => {
+    watcherService.stopAll();
     tunnelService.stopAll();
     sshService.disconnectAll();
   });

package/lib/mirror-sync-service.js

@@ -41,7 +41,8 @@ export class MirrorSyncService {
   }
 
   /**
-   * 3-way conflict aware pull: Remote -> Local Mirror
+   * Fast Delta-based 3-way conflict aware pull: Remote -> Local Mirror
+   * Uses file size and modification time to avoid downloading unchanged files.
    */
   async pull(profile, remoteDir, localDir, dryRun = false) {
     fs.mkdirSync(localDir, { recursive: true });
@@ -57,8 +58,8 @@ export class MirrorSyncService {
     const updated = [];
     const newSnapshot = { ...lastSnapshot };
 
-    // Try GNU find with printf first; fallback to standard find if unsupported
-    let findCmd = `find . -maxdepth 5 -type f ! -path '*/.*' ! -path '*/node_modules/*' -printf '%P\\t%s\\t%T@\\n' 2>/dev/null || find . -maxdepth 5 -type f ! -path '*/.*' ! -path '*/node_modules/*'`;
+    // Efficient remote scan with filename, size, and mtime
+    const findCmd = `find . -maxdepth 5 -type f ! -path '*/.*' ! -path '*/node_modules/*' -printf '%P\\t%s\\t%T@\\n' 2>/dev/null || find . -maxdepth 5 -type f ! -path '*/.*' ! -path '*/node_modules/*'`;
     const execRes = await this.sshService.exec(profile, findCmd, remoteDir);
     if (execRes.code !== 0 && !execRes.stdout.trim()) {
       throw new Error(`Failed to scan remote dir: ${execRes.stderr || 'No response from remote host'}`);
@@ -66,13 +67,44 @@ export class MirrorSyncService {
 
     const lines = execRes.stdout.split('\n').filter(Boolean);
     for (const line of lines) {
-      let relPath = line.split('\t')[0].trim();
+      const parts = line.split('\t');
+      let relPath = parts[0].trim();
       if (relPath.startsWith('./')) relPath = relPath.slice(2);
       if (!relPath || this.isIgnored(relPath)) continue;
 
+      const remoteSize = parts.length > 1 ? parseInt(parts[1], 10) : null;
+      const remoteMtime = parts.length > 2 ? parseFloat(parts[2]) : null;
+
       const remoteFullPath = path.posix.join(remoteDir, relPath);
       const localFullPath = path.join(localDir, relPath);
 
+      const baseEntry = lastSnapshot[relPath];
+      const baseHash = typeof baseEntry === 'object' ? baseEntry?.hash : baseEntry;
+      const baseRemoteMtime = typeof baseEntry === 'object' ? baseEntry?.remoteMtime : null;
+      const baseRemoteSize = typeof baseEntry === 'object' ? baseEntry?.remoteSize : null;
+
+      let localExists = fs.existsSync(localFullPath);
+      let localStat = localExists ? fs.statSync(localFullPath) : null;
+
+      // Delta Fast Path: if remote size & mtime match previous snapshot and local is unmodified
+      if (
+        localExists &&
+        baseHash &&
+        baseRemoteMtime &&
+        remoteMtime &&
+        Math.abs(remoteMtime - baseRemoteMtime) < 0.01 &&
+        baseRemoteSize === remoteSize
+      ) {
+        // Check if local was modified
+        const localContent = fs.readFileSync(localFullPath, 'utf8');
+        const localHash = this.computeHash(localContent);
+        if (localHash === baseHash) {
+          // File unchanged on both ends
+          continue;
+        }
+      }
+
+      // Download content only when potentially changed
       let remoteContent = '';
       try {
         remoteContent = await this.remoteFs.readFile(profile, remoteFullPath, 'utf8');
@@ -80,11 +112,10 @@ export class MirrorSyncService {
         continue; // skip unreadable files
       }
       const remoteHash = this.computeHash(remoteContent);
-      const baseHash = lastSnapshot[relPath];
 
       let localContent = null;
       let localHash = null;
-      if (fs.existsSync(localFullPath)) {
+      if (localExists) {
         localContent = fs.readFileSync(localFullPath, 'utf8');
         localHash = this.computeHash(localContent);
       }
@@ -100,11 +131,14 @@ export class MirrorSyncService {
         if (!dryRun) {
           fs.mkdirSync(path.dirname(localFullPath), { recursive: true });
           fs.writeFileSync(localFullPath, remoteContent, 'utf8');
-          newSnapshot[relPath] = remoteHash;
         }
-      } else {
-        newSnapshot[relPath] = remoteHash;
       }
+
+      newSnapshot[relPath] = {
+        hash: remoteHash,
+        remoteSize,
+        remoteMtime
+      };
     }
 
     if (!dryRun) {
@@ -120,7 +154,7 @@ export class MirrorSyncService {
   }
 
   /**
-   * 3-way conflict aware push: Local Mirror -> Remote
+   * Fast Delta-based 3-way conflict aware push: Local Mirror -> Remote
    */
   async push(profile, localDir, remoteDir, force = false, dryRun = false) {
     if (!fs.existsSync(localDir)) {
@@ -164,22 +198,29 @@ export class MirrorSyncService {
     for (const rel of localFiles) {
       const localFull = path.join(localDir, rel);
       const remoteFull = path.posix.join(remoteDir, rel.replace(/\\/g, '/'));
+      const stat = fs.statSync(localFull);
       const content = fs.readFileSync(localFull, 'utf8');
       const localHash = this.computeHash(content);
-      const baseHash = snapshot[rel];
+
+      const baseEntry = snapshot[rel];
+      const baseHash = typeof baseEntry === 'object' ? baseEntry?.hash : baseEntry;
 
       if (baseHash && baseHash === localHash && !force) {
         continue; // Unchanged locally
       }
 
       if (!dryRun) {
-        // Ensure remote parent dir exists
         const parent = path.posix.dirname(remoteFull);
         await this.remoteFs.mkdir(profile, parent);
         await this.remoteFs.writeFile(profile, remoteFull, content, 'utf8');
-        snapshot[rel] = localHash;
       }
       pushed.push(rel);
+
+      snapshot[rel] = {
+        hash: localHash,
+        localSize: stat.size,
+        localMtime: stat.mtimeMs
+      };
     }
 
     if (!dryRun) {

package/lib/remote-fs-service.js

@@ -6,12 +6,42 @@ export class RemoteFsService {
    */
   constructor(sshService) {
     this.sshService = sshService;
+    /** @type {Map<string, { data: any, expiresAt: number }>} */
+    this.cache = new Map();
+    this.cacheTtlMs = 15000; // 15 seconds
+  }
+
+  cacheKey(profileId, action, remotePath) {
+    return `${profileId}:${action}:${remotePath}`;
+  }
+
+  invalidateCache(profileId, subPath = null) {
+    if (!profileId) {
+      this.cache.clear();
+      return;
+    }
+    const prefix = subPath ? `${profileId}:` : `${profileId}:`;
+    for (const key of this.cache.keys()) {
+      if (key.startsWith(prefix)) {
+        if (!subPath || key.includes(subPath)) {
+          this.cache.delete(key);
+        }
+      }
+    }
   }
 
   /**
-   * Read directory entries
+   * Read directory entries with in-memory TTL cache
    */
-  async listDir(profile, remotePath) {
+  async listDir(profile, remotePath, bypassCache = false) {
+    const key = this.cacheKey(profile.id, 'list', remotePath);
+    if (!bypassCache) {
+      const cached = this.cache.get(key);
+      if (cached && cached.expiresAt > Date.now()) {
+        return cached.data;
+      }
+    }
+
     const sftp = await this.sshService.getSftp(profile);
     return new Promise((resolve, reject) => {
       sftp.readdir(remotePath, (err, list) => {
@@ -24,25 +54,36 @@ export class RemoteFsService {
           mtime: item.attrs.mtime,
           permissions: (item.attrs.mode & 0o777).toString(8)
         }));
+        this.cache.set(key, { data: entries, expiresAt: Date.now() + this.cacheTtlMs });
         resolve(entries);
       });
     });
   }
 
   /**
-   * Stat remote path
+   * Stat remote path with cache
    */
-  async stat(profile, remotePath) {
+  async stat(profile, remotePath, bypassCache = false) {
+    const key = this.cacheKey(profile.id, 'stat', remotePath);
+    if (!bypassCache) {
+      const cached = this.cache.get(key);
+      if (cached && cached.expiresAt > Date.now()) {
+        return cached.data;
+      }
+    }
+
     const sftp = await this.sshService.getSftp(profile);
     return new Promise((resolve, reject) => {
       sftp.stat(remotePath, (err, stats) => {
         if (err) return reject(err);
-        resolve({
+        const res = {
           isDirectory: (stats.mode & 0o40000) !== 0,
           isFile: (stats.mode & 0o100000) !== 0,
           size: stats.size,
           mtime: stats.mtime
-        });
+        };
+        this.cache.set(key, { data: res, expiresAt: Date.now() + this.cacheTtlMs });
+        resolve(res);
       });
     });
   }
@@ -64,6 +105,14 @@ export class RemoteFsService {
     });
   }
 
+  /**
+   * Get raw SFTP readable stream
+   */
+  async createReadStream(profile, remotePath) {
+    const sftp = await this.sshService.getSftp(profile);
+    return sftp.createReadStream(remotePath);
+  }
+
   /**
    * Atomic file write using temp file and rename
    */
@@ -82,10 +131,10 @@ export class RemoteFsService {
     return new Promise((resolve, reject) => {
       sftp.rename(tempPath, remotePath, (err) => {
         if (err) {
-          // If rename fails, try unlink temp
           sftp.unlink(tempPath, () => {});
           return reject(err);
         }
+        this.invalidateCache(profile.id, path.posix.dirname(remotePath));
         resolve({ success: true, bytes: data.length });
       });
     });
@@ -100,6 +149,7 @@ export class RemoteFsService {
     if (res.code !== 0) {
       throw new Error(`Failed to create remote dir ${remotePath}: ${res.stderr}`);
     }
+    this.invalidateCache(profile.id);
     return { success: true };
   }
 
@@ -112,6 +162,7 @@ export class RemoteFsService {
     if (res.code !== 0) {
       throw new Error(`Failed to remove remote path ${remotePath}: ${res.stderr}`);
     }
+    this.invalidateCache(profile.id);
     return { success: true };
   }
 }