@goodandready/dsh-remote-workspace 0.3.0 → 0.3.2

package/lib/ssh-service.js

@@ -32,6 +32,21 @@ export class SshService {
     this.vaultService = vault;
   }
 
+  setProfileResolver(resolver) {
+    this.profileResolver = resolver;
+  }
+
+  async execById(profileId, command, cwd = null, onData = null) {
+    if (typeof this.profileResolver !== 'function') {
+      throw new Error('Profile resolver not configured on SshService');
+    }
+    const profile = this.profileResolver(profileId);
+    if (!profile) {
+      throw new Error(`Remote profile "${profileId}" not found`);
+    }
+    return this.exec(profile, command, cwd, onData);
+  }
+
   setJumpProfileResolver(resolver) {
     this.getJumpProfile = resolver;
   }
@@ -49,7 +64,7 @@ export class SshService {
         if (fs.existsSync(resolvedPath)) {
           return fs.readFileSync(resolvedPath, 'utf8');
         }
-      } catch (_) {}
+      } catch (err) { /* best-effort cleanup */ }
     }
     return undefined;
   }
@@ -227,7 +242,7 @@ export class SshService {
             try {
               stream.signal('SIGTERM');
               stream.close();
-            } catch (_) {}
+            } catch (err) { /* best-effort cleanup */ }
             const errTimeout = new Error(`Command timed out after ${timeoutMs / 1000}s: ${command}`);
             errTimeout.code = 'ETIMEDOUT';
             errTimeout.stdout = cleanAnsi ? stripAnsi(stdout) : stdout;
@@ -316,13 +331,13 @@ export class SshService {
           buffer: [],
           subscribers: new Set(),
           write(data) {
-            try { stream.write(data); } catch (_) {}
+            try { stream.write(data); } catch (err) { session.status = 'disconnected'; const lost = '\r\n\x1b[31m[Connection lost]\x1b[0m\r\n'; session.buffer.push(lost); for (const sub of session.subscribers) { try { sub(lost); } catch (e) { /* best-effort notify */ } } }
           },
           resize(c, r) {
-            try { stream.setWindow(r, c, 0, 0); } catch (_) {}
+            try { stream.setWindow(r, c, 0, 0); } catch (err) { /* best-effort cleanup */ }
           },
           close() {
-            try { stream.end(); } catch (_) {}
+            try { stream.end(); } catch (err) { /* best-effort cleanup */ }
           }
         };
 
@@ -331,7 +346,7 @@ export class SshService {
           session.buffer.push(chunk);
           if (session.buffer.length > 500) session.buffer.shift();
           for (const sub of session.subscribers) {
-            try { sub(chunk); } catch (_) {}
+            try { sub(chunk); } catch (err) { /* best-effort cleanup */ }
           }
         });
 
@@ -366,7 +381,7 @@ export class SshService {
   disconnect(profileId) {
     const conn = this.connections.get(profileId);
     if (conn) {
-      try { conn.end(); } catch (_) {}
+      try { conn.end(); } catch (err) { /* best-effort cleanup */ }
       this.connections.delete(profileId);
       this.sftpSessions.delete(profileId);
     }
@@ -374,12 +389,12 @@ export class SshService {
 
   disconnectAll() {
     for (const [id, conn] of this.connections.entries()) {
-      try { conn.end(); } catch (_) {}
+      try { conn.end(); } catch (err) { /* best-effort cleanup */ }
     }
     this.connections.clear();
     this.sftpSessions.clear();
     for (const [id, term] of this.terminalSessions.entries()) {
-      try { term.close(); } catch (_) {}
+      try { term.close(); } catch (err) { /* best-effort cleanup */ }
     }
     this.terminalSessions.clear();
   }

package/lib/tar-sync-service.js

@@ -0,0 +1,85 @@
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import fs from 'node:fs';
+
+export class TarSyncService {
+  /**
+   * @param {import('./ssh-service.js').SshService} sshService
+   */
+  constructor(sshService) {
+    this.sshService = sshService;
+  }
+
+  /**
+   * Stream tar archive from Remote to Local directory
+   * Remote runs: tar -czf - -C <remoteDir> .
+   * Local receives stream and runs: tar -xzf - -C <localDir>
+   */
+  async pullTar(profile, remoteDir, localDir) {
+    if (!profile) throw new Error('No profile provided');
+    fs.mkdirSync(localDir, { recursive: true });
+
+    const client = await this.sshService.getConnection(profile);
+    return new Promise((resolve, reject) => {
+      const remoteCmd = `tar --exclude='.git' --exclude='node_modules' -czf - -C "${remoteDir}" .`;
+      client.exec(remoteCmd, (err, stream) => {
+        if (err) return reject(err);
+
+        const localTar = spawn('tar', ['-xzf', '-', '-C', localDir]);
+        let stderr = '';
+        localTar.stderr.on('data', (d) => { stderr += d.toString(); });
+
+        stream.pipe(localTar.stdin);
+
+        localTar.on('close', (code) => {
+          if (code !== 0) {
+            reject(new Error(`Local tar extraction failed (code ${code}): ${stderr}`));
+          } else {
+            resolve({ ok: true, direction: 'pull', remoteDir, localDir });
+          }
+        });
+
+        stream.on('error', reject);
+        localTar.stdin.on('error', reject);
+      });
+    });
+  }
+
+  /**
+   * Stream tar archive from Local to Remote directory
+   * Local runs: tar -czf - -C <localDir> .
+   * Remote receives stream and runs: tar -xzf - -C <remoteDir>
+   */
+  async pushTar(profile, localDir, remoteDir) {
+    if (!profile) throw new Error('No profile provided');
+    if (!fs.existsSync(localDir)) throw new Error(`Local dir does not exist: ${localDir}`);
+
+    const client = await this.sshService.getConnection(profile);
+    // Ensure remoteDir exists
+    await this.sshService.exec(profile, `mkdir -p "${remoteDir}"`);
+
+    return new Promise((resolve, reject) => {
+      const remoteCmd = `tar -xzf - -C "${remoteDir}"`;
+      client.exec(remoteCmd, (err, stream) => {
+        if (err) return reject(err);
+
+        const localTar = spawn('tar', ['--exclude=.git', '--exclude=node_modules', '-czf', '-', '-C', localDir, '.']);
+        let remoteStderr = '';
+        stream.stderr.on('data', (d) => { remoteStderr += d.toString(); });
+
+        localTar.stdout.pipe(stream);
+
+        stream.on('close', (code) => {
+          if (code !== 0) {
+            reject(new Error(`Remote tar extraction failed (code ${code}): ${remoteStderr}`));
+          } else {
+            resolve({ ok: true, direction: 'push', localDir, remoteDir });
+          }
+        });
+
+        stream.on('error', reject);
+        localTar.on('error', reject);
+      });
+    });
+  }
+}

package/lib/tools.js

@@ -1,4 +1,4 @@
-export function registerRemoteTools(ctx, sshService, remoteFs, mirrorSync, tunnelService, getActiveProfile, getProfileById, dockerService) {
+export function registerRemoteTools(ctx, sshService, remoteFs, mirrorSync, tunnelService, getActiveProfile, getProfileById, dockerService, diagnoseService, envService, tarSyncService) {
   if (!ctx.tools || typeof ctx.tools.register !== 'function') {
     return;
   }
@@ -96,9 +96,10 @@ export function registerRemoteTools(ctx, sshService, remoteFs, mirrorSync, tunne
   // 3. remote_sync
   ctx.tools.register({
     name: 'remote_sync',
-    description: 'Perform fast 3-way delta synchronization between local mirror and remote server',
+    description: 'Perform 3-way delta or streaming tarball synchronization between local mirror and remote server',
     parameters: {
       direction: { type: 'string', required: true, description: 'pull (remote -> local) or push (local -> remote)' },
+      mode: { type: 'string', description: 'sync mode: delta (default) or tarball (fast batch stream)' },
       force: { type: 'boolean', description: 'Overwrite conflicts if true (use with caution)' },
       dryRun: { type: 'boolean', description: 'Simulate changes without writing files' }
     },
@@ -110,6 +111,14 @@ export function registerRemoteTools(ctx, sshService, remoteFs, mirrorSync, tunne
         throw new Error('Both remoteWorkspace and localMirrorPath must be configured');
       }
 
+      if (args.mode === 'tarball' && tarSyncService) {
+        if (args.direction === 'pull') {
+          return await tarSyncService.pullTar(profile, profile.remoteWorkspace, profile.localMirrorPath);
+        } else {
+          return await tarSyncService.pushTar(profile, profile.localMirrorPath, profile.remoteWorkspace);
+        }
+      }
+
       if (args.direction === 'pull') {
         return await mirrorSync.pull(profile, profile.remoteWorkspace, profile.localMirrorPath, args.dryRun);
       } else {
@@ -212,7 +221,6 @@ export function registerRemoteTools(ctx, sshService, remoteFs, mirrorSync, tunne
         if (args.action === 'logs') cmd = `pm2 logs ${JSON.stringify(svc)} --lines ${lines} --nostream`;
         else cmd = `pm2 ${args.action} ${JSON.stringify(svc)}`;
       } else {
-        // systemd
         if (args.action === 'logs') cmd = `journalctl -u ${JSON.stringify(svc)} -n ${lines} --no-pager`;
         else if (args.action === 'status') cmd = `systemctl status ${JSON.stringify(svc)} --no-pager`;
         else cmd = `sudo systemctl ${args.action} ${JSON.stringify(svc)} || systemctl ${args.action} ${JSON.stringify(svc)}`;
@@ -247,4 +255,71 @@ export function registerRemoteTools(ctx, sshService, remoteFs, mirrorSync, tunne
       return await sshService.transferFileBetweenHosts(srcProfile, args.sourcePath, destProfile, args.destPath);
     }
   });
+
+  // 8. remote_diagnose (New in v0.3.1)
+  if (diagnoseService) {
+    ctx.tools.register({
+      name: 'remote_diagnose',
+      description: 'Run targeted system health diagnostics on remote host (ports, disk, memory, oom_killer, service_logs)',
+      parameters: {
+        category: {
+          type: 'string',
+          required: true,
+          description: 'Diagnostic aspect: ports, disk, memory, oom_killer, service_logs'
+        },
+        target: {
+          type: 'string',
+          description: 'Optional port number, directory path, or service name to inspect'
+        }
+      },
+      output: genericOutput,
+      async execute(args) {
+        const profile = getActiveProfile();
+        if (!profile) throw new Error('No active remote workspace profile selected');
+        return await diagnoseService.diagnose(profile, args.category, args.target);
+      }
+    });
+  }
+
+  // 9. remote_env (New in v0.3.1)
+  if (envService) {
+    ctx.tools.register({
+      name: 'remote_env',
+      description: 'Inspect and atomically update remote .env files preserving comments and structure',
+      parameters: {
+        action: {
+          type: 'string',
+          required: true,
+          description: 'Action to perform: read or set'
+        },
+        filePath: {
+          type: 'string',
+          required: true,
+          description: 'Path to the .env file on the remote server'
+        },
+        key: {
+          type: 'string',
+          description: 'Environment variable key (required for set)'
+        },
+        value: {
+          type: 'string',
+          description: 'Environment variable value (for set action)'
+        }
+      },
+      output: genericOutput,
+      async execute(args) {
+        const profile = getActiveProfile();
+        if (!profile) throw new Error('No active remote workspace profile selected');
+
+        if (args.action === 'read') {
+          return await envService.readEnv(profile, args.filePath);
+        } else if (args.action === 'set') {
+          if (!args.key) throw new Error('key is required for set action');
+          return await envService.setEnvVar(profile, args.filePath, args.key, args.value || '');
+        } else {
+          throw new Error(`Unknown env action: ${args.action}`);
+        }
+      }
+    });
+  }
 }

package/lib/tunnel-service.js

@@ -109,7 +109,7 @@ export class TunnelService {
     if (!tunnel) return false;
     try {
       tunnel.server.close();
-    } catch (_) {}
+    } catch (err) { /* best-effort cleanup */ }
     this.activeTunnels.delete(tunnelId);
     return true;
   }
@@ -134,7 +134,7 @@ export class TunnelService {
     for (const [id, tunnel] of this.activeTunnels.entries()) {
       try {
         tunnel.server.close();
-      } catch (_) {}
+      } catch (err) { /* best-effort cleanup */ }
     }
     this.activeTunnels.clear();
   }

package/lib/updater-service.js

@@ -0,0 +1,338 @@
+import { spawn } from 'node:child_process'
+import { existsSync, readFileSync } from 'node:fs'
+import { readFile } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { basename, dirname, isAbsolute, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+/**
+ * Host-side one-click updater for @goodandready/dsh-remote-workspace.
+ * Implements the unified DSH plugin updater specification.
+ */
+
+const UPDATE_HEADER = 'x-dsh-plugin-update'
+const UPDATE_TIMEOUT_MS = 10 * 60_000
+const VERSION_CACHE_MS = 5 * 60_000
+let latestCache = undefined
+
+function header(request, name) {
+  const value = request?.headers?.[name]
+  return Array.isArray(value) ? value[0] : value
+}
+
+function isLoopback(value) {
+  const address = value?.toLowerCase().replace(/^\[|\]$/g, '')
+  return (
+    address === 'localhost' ||
+    address === 'localhost.' ||
+    address === '::1' ||
+    address?.startsWith('127.') === true ||
+    address?.startsWith('::ffff:127.') === true
+  )
+}
+
+function isPrivateLan(value) {
+  const address = value?.toLowerCase().replace(/^\[|\]$/g, '')
+  if (!address) return false
+  const ipv4 = address.startsWith('::ffff:') ? address.slice(7) : address
+  return (
+    ipv4.startsWith('192.168.') ||
+    ipv4.startsWith('10.') ||
+    /^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(ipv4)
+  )
+}
+
+export function isTrustedUpdateRequest(request) {
+  if (header(request, UPDATE_HEADER) !== '1') return false
+  const remote = request.socket?.remoteAddress
+  if (!isLoopback(remote) && !isPrivateLan(remote)) return false
+  const site = header(request, 'sec-fetch-site')
+  if (site !== undefined && site !== 'same-origin') return false
+  const origin = header(request, 'origin')
+  const host = header(request, 'host')
+  if (origin === undefined || host === undefined) return false
+  try {
+    const url = new URL(origin)
+    return (
+      (url.protocol === 'http:' || url.protocol === 'https:') &&
+      (isLoopback(url.hostname) || isPrivateLan(url.hostname)) &&
+      url.host === host
+    )
+  } catch (err) { /* best-effort fallback */
+    return false
+  }
+}
+
+function validProfileName(value) {
+  return (
+    typeof value === 'string' &&
+    value !== '' &&
+    value !== '.' &&
+    value !== '..' &&
+    !value.includes('/') &&
+    !value.includes('\\') &&
+    !/[\0-\x1f\x7f]/.test(value)
+  )
+}
+
+function profileNameFromArgv(argv) {
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index]
+    if (arg === '--profile' || arg === '-p') {
+      const next = argv[index + 1]
+      if (validProfileName(next)) return next
+    }
+    if (typeof arg === 'string' && arg.startsWith('--profile=')) {
+      const value = arg.slice('--profile='.length)
+      if (validProfileName(value)) return value
+    }
+  }
+  return undefined
+}
+
+function findDshCliEntry() {
+  const entry = process.argv[1]
+  if (typeof entry !== 'string' || entry === '') return undefined
+  if (!existsSync(entry)) return undefined
+  for (let directory = dirname(entry); ; directory = dirname(directory)) {
+    const manifestPath = resolve(directory, 'package.json')
+    if (existsSync(manifestPath)) {
+      try {
+        const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'))
+        const bin =
+          typeof manifest.bin === 'string'
+            ? manifest.bin
+            : typeof manifest.bin === 'object' && manifest.bin !== null
+              ? manifest.bin.dsh
+              : undefined
+        if (
+          manifest.name === '@deepseek-ai/dsh' &&
+          typeof bin === 'string' &&
+          !isAbsolute(bin) &&
+          resolve(directory, bin) === resolve(entry)
+        ) {
+          return entry
+        }
+      } catch (err) { /* best-effort fallback */
+        // Continue searching parent directories
+      }
+    }
+    const parent = dirname(directory)
+    if (parent === directory) return undefined
+  }
+}
+
+function runtime() {
+  const profileDir = resolve(
+    process.env.DSH_PROFILE_DIR ?? resolve(homedir(), '.dsh', 'profiles', 'web')
+  )
+  const selected = profileNameFromArgv(process.argv)
+  const profileName = validProfileName(selected)
+    ? selected
+    : validProfileName(basename(profileDir))
+      ? basename(profileDir)
+      : 'web'
+  const cliEntry = findDshCliEntry()
+  return cliEntry === undefined ? { profileName, profileDir } : { profileName, profileDir, cliEntry }
+}
+
+function parseSemver(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value)
+  if (match === null) return undefined
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4]?.split('.') ?? [],
+  }
+}
+
+function comparePrerelease(left, right) {
+  if (left.length === 0 || right.length === 0) return left.length === right.length ? 0 : left.length === 0 ? 1 : -1
+  const length = Math.max(left.length, right.length)
+  for (let index = 0; index < length; index += 1) {
+    const a = left[index]
+    const b = right[index]
+    if (a === undefined || b === undefined) return a === b ? 0 : a === undefined ? -1 : 1
+    if (a === b) continue
+    const aNumeric = /^\d+$/.test(a)
+    const bNumeric = /^\d+$/.test(b)
+    if (aNumeric && bNumeric) {
+      const aNumber = BigInt(a)
+      const bNumber = BigInt(b)
+      if (aNumber !== bNumber) return aNumber > bNumber ? 1 : -1
+      continue
+    }
+    if (aNumeric !== bNumeric) return aNumeric ? -1 : 1
+    return a > b ? 1 : -1
+  }
+  return 0
+}
+
+export function isNewerVersion(currentValue, candidateValue) {
+  const current = parseSemver(currentValue)
+  const candidate = parseSemver(candidateValue)
+  if (current === undefined || candidate === undefined) return false
+  for (let index = 0; index < 3; index += 1) {
+    if (candidate.core[index] !== current.core[index]) return candidate.core[index] > current.core[index]
+  }
+  return comparePrerelease(candidate.prerelease, current.prerelease) > 0
+}
+
+async function latestVersion(packageName, registry) {
+  if (
+    latestCache?.packageName === packageName &&
+    latestCache.registry === registry &&
+    Date.now() < latestCache.expiresAt
+  ) {
+    return latestCache.version
+  }
+  try {
+    const response = await fetch(`${registry.replace(/\/$/, '')}/${encodeURIComponent(packageName)}/latest`, {
+      signal: typeof AbortSignal !== 'undefined' && AbortSignal.timeout ? AbortSignal.timeout(8000) : undefined,
+    })
+    if (!response.ok) return undefined
+    const value = await response.json()
+    if (typeof value?.version !== 'string' || value.version === '') return undefined
+    latestCache = { packageName, registry, version: value.version, expiresAt: Date.now() + VERSION_CACHE_MS }
+    return value.version
+  } catch (err) { /* best-effort fallback */
+    return undefined
+  }
+}
+
+async function currentVersion(manifestUrl) {
+  const value = JSON.parse(await readFile(manifestUrl, 'utf8'))
+  if (typeof value?.version !== 'string' || value.version === '') {
+    throw new Error('Cannot read current plugin version.')
+  }
+  return value.version
+}
+
+export async function status(options, target) {
+  const current = await currentVersion(options.manifestUrl)
+  const latest = await latestVersion(options.packageName, options.registry ?? 'https://registry.npmjs.org')
+  return {
+    packageName: options.packageName,
+    currentVersion: current,
+    ...(latest === undefined ? {} : { latestVersion: latest }),
+    latestCheckFailed: latest === undefined,
+    updateAvailable: latest !== undefined && isNewerVersion(current, latest),
+    profileName: target.profileName,
+    canAutoUpdate: target.cliEntry !== undefined,
+  }
+}
+
+async function installExact(target, packageSpec, options) {
+  if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.')
+  await new Promise((resolvePromise, reject) => {
+    const child = spawn(
+      process.execPath,
+      [
+        target.cliEntry,
+        'plugin',
+        '--profile',
+        target.profileName,
+        'add',
+        '--config.minimumReleaseAge=0',
+        packageSpec,
+        `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
+      ],
+      {
+        cwd: target.profileDir,
+        windowsHide: true,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: { ...process.env, NO_COLOR: '1' },
+      }
+    )
+    let detail = ''
+    child.stdout?.on('data', (chunk) => {
+      detail = (detail + String(chunk)).slice(-4000)
+    })
+    child.stderr?.on('data', (chunk) => {
+      detail = (detail + String(chunk)).slice(-4000)
+    })
+    const timer = setTimeout(() => {
+      child.kill()
+      reject(new Error('Update timed out; use the normal DSH update flow.'))
+    }, UPDATE_TIMEOUT_MS)
+    child.once('error', (error) => {
+      clearTimeout(timer)
+      reject(error)
+    })
+    child.once('exit', (code) => {
+      clearTimeout(timer)
+      if (code === 0) resolvePromise()
+      else reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`))
+    })
+  })
+}
+
+function json(response, statusCode, value) {
+  response.writeHead(statusCode, {
+    'content-type': 'application/json; charset=utf-8',
+    'cache-control': 'no-store',
+  })
+  response.end(JSON.stringify(value))
+}
+
+export function registerPluginUpdater(ctx, options) {
+  let installing = false
+  if (typeof ctx?.webServer?.register !== 'function') {
+    ctx?.logger?.warn?.('[dsh-remote-workspace] webServer service unavailable, updater skipped')
+    return () => {}
+  }
+
+  return ctx.webServer.register({
+    kind: 'exact',
+    path: options.endpoint,
+    handler: async (request, response) => {
+      try {
+        const target = runtime()
+        if (request.method === 'GET' || request.method === 'HEAD') {
+          const payload = await status(options, target)
+          response.writeHead(200, {
+            'content-type': 'application/json; charset=utf-8',
+            'cache-control': 'no-store',
+          })
+          response.end(request.method === 'HEAD' ? undefined : JSON.stringify(payload))
+          return
+        }
+        if (request.method !== 'POST') {
+          response.writeHead(405, { allow: 'GET, HEAD, POST' })
+          response.end()
+          return
+        }
+        if (!isTrustedUpdateRequest(request)) {
+          json(response, 403, { error: 'Rejected non-local or cross-origin update request.' })
+          return
+        }
+        if (installing) {
+          json(response, 409, { error: 'This plugin is already updating.' })
+          return
+        }
+        installing = true
+        try {
+          const before = await status(options, target)
+          if (before.latestVersion === undefined) {
+            json(response, 503, { error: 'The latest version is temporarily unavailable.' })
+            return
+          }
+          if (!before.updateAvailable) {
+            json(response, 200, before)
+            return
+          }
+          await installExact(target, `${options.packageName}@${before.latestVersion}`, options)
+          json(response, 200, {
+            ...before,
+            updatedVersion: before.latestVersion,
+            restartRequired: true,
+          })
+        } finally {
+          installing = false
+        }
+      } catch (error) {
+        ctx?.logger?.warn?.(`[dsh-remote-workspace] plugin updater failed: ${String(error)}`)
+        json(response, 503, { error: 'Plugin update failed; see server logs.' })
+      }
+    },
+  })
+}