@goodandready/dsh-remote-workspace 0.3.0 → 0.3.2

package/lib/diagnose-service.js

@@ -0,0 +1,57 @@
+export class DiagnoseService {
+  /**
+   * @param {import('./ssh-service.js').SshService} sshService
+   */
+  constructor(sshService) {
+    this.sshService = sshService;
+  }
+
+  /**
+   * Diagnose system aspects on remote host
+   * @param {any} profile
+   * @param {'ports'|'disk'|'memory'|'oom_killer'|'service_logs'} category
+   * @param {string} [target] optional port, service name, or path
+   */
+  async diagnose(profile, category, target = '') {
+    if (!profile || !profile.host) throw new Error('Invalid profile');
+
+    let cmd = '';
+    switch (category) {
+      case 'ports': {
+        const filter = target ? `grep ':${target} '` : 'cat';
+        cmd = `(ss -tulpn 2>/dev/null || netstat -tulpn 2>/dev/null || lsof -i -P -n 2>/dev/null) | ${filter} | head -n 40`;
+        break;
+      }
+      case 'disk': {
+        const path = target || '/';
+        cmd = `df -h ${path} 2>/dev/null; echo "---TOP 10 DIRS---"; du -ahx ${path} 2>/dev/null | sort -rh | head -n 10`;
+        break;
+      }
+      case 'memory': {
+        cmd = `free -h 2>/dev/null || free -m; echo "---TOP 10 PROCESSES BY RAM---"; ps aux --sort=-%mem 2>/dev/null | head -n 11`;
+        break;
+      }
+      case 'oom_killer': {
+        cmd = `(dmesg -T 2>/dev/null || dmesg 2>/dev/null) | grep -i -E 'oom|out of memory|killed process' | tail -n 25 || echo "No OOM events detected"`;
+        break;
+      }
+      case 'service_logs': {
+        if (!target) throw new Error('Target service name required for service_logs');
+        const safeName = target.replace(/[^a-zA-Z0-9_.-]/g, '');
+        cmd = `(journalctl -u ${safeName} -n 40 --no-pager 2>/dev/null || pm2 logs ${safeName} --lines 40 --nostream 2>/dev/null || tail -n 40 /var/log/${safeName}.log 2>/dev/null || echo "No logs found for ${safeName}")`;
+        break;
+      }
+      default:
+        throw new Error(`Unsupported diagnosis category: ${category}`);
+    }
+
+    const res = await this.sshService.exec(profile, cmd);
+    const code = res.code !== undefined ? res.code : (res.exitCode !== undefined ? res.exitCode : 0);
+    return {
+      ok: code === 0,
+      category,
+      target: target || null,
+      output: (res.stdout || res.stderr || '').trim()
+    };
+  }
+}

package/lib/docker-service.js

@@ -38,7 +38,7 @@ export class DockerService {
           ports: item.Ports || '',
           created: item.CreatedAt || item.Created || ''
         });
-      } catch (_) {}
+      } catch (err) { /* best-effort cleanup */ }
     }
 
     return {

package/lib/env-service.js

@@ -0,0 +1,122 @@
+export class EnvService {
+  /**
+   * @param {import('./remote-fs-service.js').RemoteFsService} remoteFsService
+   */
+  constructor(remoteFsService) {
+    this.remoteFsService = remoteFsService;
+  }
+
+  /**
+   * Parse .env text into structured entries (preserving comments and order)
+   * @param {string} text
+   */
+  parseEnv(text) {
+    if (!text) return [];
+    const lines = text.split('\n');
+    const result = [];
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      const trimmed = line.trim();
+      if (!trimmed) {
+        result.push({ type: 'empty', raw: line });
+        continue;
+      }
+      if (trimmed.startsWith('#')) {
+        result.push({ type: 'comment', raw: line });
+        continue;
+      }
+
+      const eqIdx = line.indexOf('=');
+      if (eqIdx === -1) {
+        result.push({ type: 'raw', raw: line });
+        continue;
+      }
+
+      const key = line.slice(0, eqIdx).trim();
+      let val = line.slice(eqIdx + 1);
+      // Check if value is wrapped in quotes
+      let isQuoted = false;
+      const valTrimmed = val.trim();
+      if ((valTrimmed.startsWith('"') && valTrimmed.endsWith('"')) ||
+          (valTrimmed.startsWith("'") && valTrimmed.endsWith("'"))) {
+        isQuoted = true;
+        val = valTrimmed.slice(1, -1);
+      }
+
+      result.push({
+        type: 'var',
+        key,
+        value: val,
+        isQuoted,
+        raw: line
+      });
+    }
+
+    return result;
+  }
+
+  /**
+   * Read and parse remote .env file
+   */
+  async readEnv(profile, filePath) {
+    const content = await this.remoteFsService.readFile(profile, filePath);
+    const parsed = this.parseEnv(content);
+    return {
+      filePath,
+      entries: parsed,
+      raw: content
+    };
+  }
+
+  /**
+   * Set or update variable in remote .env file atomically
+   */
+  async setEnvVar(profile, filePath, key, value) {
+    if (!key || typeof key !== 'string') throw new Error('Key must be non-empty string');
+
+    let currentContent = '';
+    try {
+      currentContent = await this.remoteFsService.readFile(profile, filePath);
+    } catch {
+      currentContent = '';
+    }
+
+    const lines = currentContent ? currentContent.split('\n') : [];
+    let updated = false;
+    const newLines = [];
+
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed.startsWith('#') && trimmed.includes('=')) {
+        const k = trimmed.slice(0, trimmed.indexOf('=')).trim();
+        if (k === key) {
+          // Quote if contains spaces or special symbols
+          const formattedVal = (value.includes(' ') || value.includes('\n')) ? `"${value}"` : value;
+          newLines.push(`${key}=${formattedVal}`);
+          updated = true;
+          continue;
+        }
+      }
+      newLines.push(line);
+    }
+
+    if (!updated) {
+      const formattedVal = (value.includes(' ') || value.includes('\n')) ? `"${value}"` : value;
+      if (newLines.length > 0 && newLines[newLines.length - 1].trim() !== '') {
+        newLines.push('');
+      }
+      newLines.push(`${key}=${formattedVal}`);
+    }
+
+    const finalContent = newLines.join('\n');
+    await this.remoteFsService.writeFile(profile, filePath, finalContent);
+
+    return {
+      ok: true,
+      filePath,
+      key,
+      updated
+    };
+  }
+}

package/lib/index.js

@@ -7,6 +7,10 @@ import { TunnelService } from './tunnel-service.js';
 import { DockerService } from './docker-service.js';
 import { HealthService } from './health-service.js';
 import { WatcherService } from './watcher-service.js';
+import { TarSyncService } from './tar-sync-service.js';
+import { DiagnoseService } from './diagnose-service.js';
+import { EnvService } from './env-service.js';
+import { AlertService } from './alert-service.js';
 import { registerRemoteTools } from './tools.js';
 import { registerApiRoutes } from './routes.js';
 
@@ -33,7 +37,8 @@ export const Config = z.object({
     jumpHostId: z.string().default('')
   })).default([]).description('List of configured remote machines and workspaces.'),
   activeProfileId: z.string().default('').description('ID of active remote profile.'),
-  autoSyncActive: z.boolean().default(false).description('Whether Live Auto-Sync watcher is enabled.')
+  autoSyncActive: z.boolean().default(false).description('Whether Live Auto-Sync watcher is enabled.'),
+  alertMonitoringActive: z.boolean().default(false).description('Whether background anomaly alerts are monitored.')
 });
 
 export function apply(ctx, config = {}) {
@@ -42,7 +47,8 @@ export function apply(ctx, config = {}) {
   let currentConfig = {
     profiles: Array.isArray(cfg.profiles) ? cfg.profiles : [],
     activeProfileId: cfg.activeProfileId || null,
-    autoSyncActive: Boolean(cfg.autoSyncActive)
+    autoSyncActive: Boolean(cfg.autoSyncActive),
+    alertMonitoringActive: Boolean(cfg.alertMonitoringActive)
   };
 
   const vaultService = new VaultService();
@@ -53,6 +59,10 @@ export function apply(ctx, config = {}) {
   const dockerService = new DockerService(sshService);
   const healthService = new HealthService(sshService);
   const watcherService = new WatcherService();
+  const tarSyncService = new TarSyncService(sshService);
+  const diagnoseService = new DiagnoseService(sshService);
+  const envService = new EnvService(remoteFs);
+  const alertService = new AlertService(ctx, healthService, dockerService);
 
   // Migrate any existing plain passwords into vault upon start
   for (const p of currentConfig.profiles) {
@@ -72,6 +82,19 @@ export function apply(ctx, config = {}) {
     }
   }
 
+  const persistConfig = async (actionLabel) => {
+    if (settingsApi?.replace) {
+      try {
+        await settingsApi.replace(Config(currentConfig));
+      } catch (err) {
+        if (ctx.logger?.warn) {
+          ctx.logger.warn(`[dsh-remote-workspace] Failed to persist config after ${actionLabel}: ${err.message}`);
+        }
+        throw new Error(`Failed to save configuration: ${err.message}`);
+      }
+    }
+  };
+
   const store = {
     vault: vaultService,
     getRawProfiles() { return currentConfig.profiles || []; },
@@ -95,9 +118,7 @@ export function apply(ctx, config = {}) {
         if (enabled) watcherService.start(active, mirrorSync);
         else watcherService.stop(active.id);
       }
-      if (settingsApi?.replace) {
-        try { await settingsApi.replace(Config(currentConfig)); } catch (_) {}
-      }
+      await persistConfig('update');
     },
     async saveProfile(rawP) {
       const list = [...(currentConfig.profiles || [])];
@@ -130,9 +151,7 @@ export function apply(ctx, config = {}) {
         currentConfig.activeProfileId = p.id;
       }
       sshService.invalidate(p.id);
-      if (settingsApi?.replace) {
-        try { await settingsApi.replace(Config(currentConfig)); } catch (_) {}
-      }
+      await persistConfig('update');
     },
     async deleteProfile(id) {
       watcherService.stop(id);
@@ -142,9 +161,7 @@ export function apply(ctx, config = {}) {
       }
       vaultService.deleteProfileSecrets(id);
       sshService.disconnect(id);
-      if (settingsApi?.replace) {
-        try { await settingsApi.replace(Config(currentConfig)); } catch (_) {}
-      }
+      await persistConfig('update');
     },
     async setActiveId(id) {
       currentConfig.activeProfileId = id;
@@ -153,13 +170,34 @@ export function apply(ctx, config = {}) {
         const active = store.getActiveProfile();
         if (active) watcherService.start(active, mirrorSync);
       }
-      if (settingsApi?.replace) {
-        try { await settingsApi.replace(Config(currentConfig)); } catch (_) {}
-      }
+      await persistConfig('update');
     }
   };
 
   sshService.setJumpProfileResolver((jumpId) => store.getProfile(jumpId));
+  sshService.setProfileResolver((id) => store.getProfile(id));
+
+  const safeProfilesService = {
+    list() {
+      return (store.getProfiles() || []).map((p) => ({
+        id: p.id,
+        name: p.name || p.host,
+        host: p.host,
+        port: p.port || 22,
+        username: p.username || 'root',
+        authType: p.authType || 'key'
+      }));
+    },
+    get(id) {
+      return store.getProfile(id);
+    },
+    getActiveId() {
+      return store.getActiveId();
+    },
+    getActive() {
+      return store.getActiveProfile();
+    }
+  };
 
   // If autoSync was enabled on restart, resume watcher for active profile
   if (currentConfig.autoSyncActive && currentConfig.activeProfileId) {
@@ -179,6 +217,7 @@ export function apply(ctx, config = {}) {
       if (Array.isArray(snap.profiles)) currentConfig.profiles = snap.profiles;
       if (snap.activeProfileId !== undefined) currentConfig.activeProfileId = snap.activeProfileId;
       if (snap.autoSyncActive !== undefined) currentConfig.autoSyncActive = snap.autoSyncActive;
+      if (snap.alertMonitoringActive !== undefined) currentConfig.alertMonitoringActive = snap.alertMonitoringActive;
     }
     sctx.effect(() => () => {
       settingsApi = null;
@@ -193,6 +232,12 @@ export function apply(ctx, config = {}) {
   ctx.provide('remoteDocker');
   ctx.provide('remoteHealth');
   ctx.provide('remoteWatcher');
+  ctx.provide('remoteTarSync');
+  ctx.provide('remoteDiagnose');
+  ctx.provide('remoteEnv');
+  ctx.provide('remoteAlert');
+  ctx.provide('remoteProfiles');
+  ctx.remoteProfiles = safeProfilesService;
 
   ctx.remoteSsh = sshService;
   ctx.remoteFs = remoteFs;
@@ -202,6 +247,10 @@ export function apply(ctx, config = {}) {
   ctx.remoteDocker = dockerService;
   ctx.remoteHealth = healthService;
   ctx.remoteWatcher = watcherService;
+  ctx.remoteTarSync = tarSyncService;
+  ctx.remoteDiagnose = diagnoseService;
+  ctx.remoteEnv = envService;
+  ctx.remoteAlert = alertService;
 
   // Tools registration
   registerRemoteTools(
@@ -212,14 +261,32 @@ export function apply(ctx, config = {}) {
     tunnelService,
     () => store.getActiveProfile(),
     (id) => store.getProfile(id),
-    dockerService
+    dockerService,
+    diagnoseService,
+    envService,
+    tarSyncService
   );
 
   // API Routes
-  registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelService, store, dockerService, healthService, watcherService);
+  registerApiRoutes(
+    ctx,
+    sshService,
+    remoteFs,
+    mirrorSync,
+    tunnelService,
+    store,
+    dockerService,
+    healthService,
+    watcherService,
+    diagnoseService,
+    envService,
+    tarSyncService,
+    alertService
+  );
 
   // Cleanup on unload
   ctx.on('dispose', () => {
+    alertService.stop();
     watcherService.stopAll();
     tunnelService.stopAll();
     sshService.disconnectAll();

package/lib/mirror-sync-service.js

@@ -51,7 +51,7 @@ export class MirrorSyncService {
     if (fs.existsSync(snapshotFile)) {
       try {
         lastSnapshot = JSON.parse(fs.readFileSync(snapshotFile, 'utf8'));
-      } catch (_) {}
+      } catch (err) { /* best-effort cleanup */ }
     }
 
     const conflicts = [];
@@ -172,7 +172,7 @@ export class MirrorSyncService {
     if (fs.existsSync(snapshotFile)) {
       try {
         snapshot = JSON.parse(fs.readFileSync(snapshotFile, 'utf8'));
-      } catch (_) {}
+      } catch (err) { /* best-effort cleanup */ }
     }
 
     const pushed = [];

package/lib/routes/docker.js

@@ -0,0 +1,85 @@
+import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+
+export function registerDockerRoutes(sctx, webServer, { dockerService, healthService, store }) {
+  // 21. GET /dsh-remote-workspace/health
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/health',
+    handler: async (req, res) => {
+      if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
+      try {
+        const url = new URL(req.url, 'http://localhost');
+        const profileId = url.searchParams.get('profileId');
+        const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'No active profile' });
+
+        const health = await healthService.getHealth(profile);
+        writeJson(res, 200, { ok: true, health });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /health');
+
+  // 22. GET /dsh-remote-workspace/docker/list
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/docker/list',
+    handler: async (req, res) => {
+      if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
+      try {
+        const url = new URL(req.url, 'http://localhost');
+        const profileId = url.searchParams.get('profileId');
+        const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'No active profile' });
+
+        const result = await dockerService.listContainers(profile, true);
+        writeJson(res, 200, { ok: true, ...result });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /docker/list');
+
+  // 23. POST /dsh-remote-workspace/docker/action
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/docker/action',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { profileId, containerId, action } = await readBody(req);
+        const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'No active profile' });
+        if (!containerId || !action) return writeJson(res, 400, { ok: false, error: 'containerId and action required' });
+
+        const result = await dockerService.containerAction(profile, containerId, action);
+        writeJson(res, 200, { ok: result.success, ...result });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /docker/action');
+
+  // 24. POST /dsh-remote-workspace/docker/logs
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/docker/logs',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { profileId, containerId, tail } = await readBody(req);
+        const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'No active profile' });
+        if (!containerId) return writeJson(res, 400, { ok: false, error: 'containerId required' });
+
+        const result = await dockerService.containerLogs(profile, containerId, tail || 100);
+        writeJson(res, 200, { ok: result.success, ...result });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /docker/logs');
+}

package/lib/routes/env.js

@@ -0,0 +1,60 @@
+import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+
+export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService, sshService, store }) {
+  // 10. POST /dsh-remote-workspace/env/view
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/env/view',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { profileId, remotePath } = await readBody(req);
+        const profile = store.getProfile(profileId);
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+        const result = await envService.readRemoteEnv(sshService, profile, remotePath);
+        writeJson(res, 200, { ok: true, ...result });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /env/view');
+
+  // 11. POST /dsh-remote-workspace/env/save
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/env/save',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { profileId, remotePath, content } = await readBody(req);
+        const profile = store.getProfile(profileId);
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+        const result = await envService.saveRemoteEnv(sshService, profile, remotePath, content);
+        writeJson(res, 200, { ok: true, ...result });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /env/save');
+
+  // 12. POST /dsh-remote-workspace/diagnose
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/diagnose',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { profileId, checks } = await readBody(req);
+        const profile = store.getProfile(profileId);
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+        const results = await diagnoseService.diagnose(sshService, profile, checks);
+        writeJson(res, 200, { ok: true, results });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /diagnose');
+}

package/lib/routes/files.js

@@ -0,0 +1,88 @@
+import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+
+export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshService }) {
+  // 7. POST /dsh-remote-workspace/browse
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/browse',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { profileId, remotePath } = await readBody(req);
+        const profile = store.getProfile(profileId);
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+        const items = await remoteFs.list(profile, remotePath || profile.remotePath || '.');
+        writeJson(res, 200, { ok: true, items });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /browse');
+
+  // 8. POST /dsh-remote-workspace/file/view
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/file/view',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { profileId, filePath } = await readBody(req);
+        const profile = store.getProfile(profileId);
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+        const stat = await remoteFs.stat(profile, filePath);
+        if (stat.size > 2 * 1024 * 1024) {
+          return writeJson(res, 400, { ok: false, error: 'File exceeds 2MB preview limit' });
+        }
+        const buf = await remoteFs.readFile(profile, filePath);
+        writeJson(res, 200, { ok: true, content: buf.toString('utf8'), size: stat.size });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /file/view');
+
+  // 9. POST /dsh-remote-workspace/file/save
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/file/save',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { profileId, filePath, content } = await readBody(req);
+        const profile = store.getProfile(profileId);
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+        await remoteFs.writeFile(profile, filePath, Buffer.from(content, 'utf8'));
+        writeJson(res, 200, { ok: true });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /file/save');
+
+  // 26. POST /dsh-remote-workspace/transfer
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/transfer',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { sourceProfileId, sourcePath, destProfileId, destPath } = await readBody(req);
+        const srcProfile = sourceProfileId ? store.getProfile(sourceProfileId) : store.getActiveProfile();
+        const destProfile = store.getProfile(destProfileId);
+
+        if (!srcProfile) return writeJson(res, 404, { ok: false, error: 'Source profile not found' });
+        if (!destProfile) return writeJson(res, 404, { ok: false, error: 'Destination profile not found' });
+        if (!sourcePath || !destPath) return writeJson(res, 400, { ok: false, error: 'sourcePath and destPath required' });
+
+        const result = await sshService.transferFileBetweenHosts(srcProfile, sourcePath, destProfile, destPath);
+        writeJson(res, 200, { ok: result.success, ...result });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /transfer');
+}

package/lib/routes/helpers.js

@@ -0,0 +1,40 @@
+export function writeJson(res, statusCode, body) {
+  if (typeof res.setHeader === 'function') {
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.statusCode = statusCode;
+  } else if (typeof res.writeHead === 'function') {
+    res.writeHead(statusCode, { 'Content-Type': 'application/json; charset=utf-8' });
+  } else {
+    res.statusCode = statusCode;
+  }
+  res.end(JSON.stringify(body));
+}
+
+export function readBody(req) {
+  return new Promise((resolve, reject) => {
+    let body = '';
+    req.on('data', (chunk) => { body += chunk.toString(); });
+    req.on('end', () => {
+      try {
+        resolve(body ? JSON.parse(body) : {});
+      } catch (err) {
+        reject(err);
+      }
+    });
+    req.on('error', reject);
+  });
+}
+
+export function isTrustedSettingsRequest(req) {
+  const rawAuth = req.headers['authorization'];
+  if (typeof rawAuth === 'string' && rawAuth.startsWith('Bearer ')) return true;
+  const cookieHeader = req.headers['cookie'];
+  if (typeof cookieHeader === 'string' && (cookieHeader.includes('token=') || cookieHeader.includes('dsh_token='))) {
+    return true;
+  }
+  const secFetch = req.headers['sec-fetch-site'];
+  if (secFetch === 'same-origin') return true;
+  const ip = req.socket?.remoteAddress || '';
+  if (ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1') return true;
+  return false;
+}