@goodandready/dsh-remote-workspace 0.3.1 → 0.3.2

package/lib/ssh-service.js

@@ -32,6 +32,21 @@ export class SshService {
     this.vaultService = vault;
   }
 
+  setProfileResolver(resolver) {
+    this.profileResolver = resolver;
+  }
+
+  async execById(profileId, command, cwd = null, onData = null) {
+    if (typeof this.profileResolver !== 'function') {
+      throw new Error('Profile resolver not configured on SshService');
+    }
+    const profile = this.profileResolver(profileId);
+    if (!profile) {
+      throw new Error(`Remote profile "${profileId}" not found`);
+    }
+    return this.exec(profile, command, cwd, onData);
+  }
+
   setJumpProfileResolver(resolver) {
     this.getJumpProfile = resolver;
   }
@@ -49,7 +64,7 @@ export class SshService {
         if (fs.existsSync(resolvedPath)) {
           return fs.readFileSync(resolvedPath, 'utf8');
         }
-      } catch (_) {}
+      } catch (err) { /* best-effort cleanup */ }
     }
     return undefined;
   }
@@ -227,7 +242,7 @@ export class SshService {
             try {
               stream.signal('SIGTERM');
               stream.close();
-            } catch (_) {}
+            } catch (err) { /* best-effort cleanup */ }
             const errTimeout = new Error(`Command timed out after ${timeoutMs / 1000}s: ${command}`);
             errTimeout.code = 'ETIMEDOUT';
             errTimeout.stdout = cleanAnsi ? stripAnsi(stdout) : stdout;
@@ -316,13 +331,13 @@ export class SshService {
           buffer: [],
           subscribers: new Set(),
           write(data) {
-            try { stream.write(data); } catch (_) {}
+            try { stream.write(data); } catch (err) { session.status = 'disconnected'; const lost = '\r\n\x1b[31m[Connection lost]\x1b[0m\r\n'; session.buffer.push(lost); for (const sub of session.subscribers) { try { sub(lost); } catch (e) { /* best-effort notify */ } } }
           },
           resize(c, r) {
-            try { stream.setWindow(r, c, 0, 0); } catch (_) {}
+            try { stream.setWindow(r, c, 0, 0); } catch (err) { /* best-effort cleanup */ }
           },
           close() {
-            try { stream.end(); } catch (_) {}
+            try { stream.end(); } catch (err) { /* best-effort cleanup */ }
           }
         };
 
@@ -331,7 +346,7 @@ export class SshService {
           session.buffer.push(chunk);
           if (session.buffer.length > 500) session.buffer.shift();
           for (const sub of session.subscribers) {
-            try { sub(chunk); } catch (_) {}
+            try { sub(chunk); } catch (err) { /* best-effort cleanup */ }
           }
         });
 
@@ -366,7 +381,7 @@ export class SshService {
   disconnect(profileId) {
     const conn = this.connections.get(profileId);
     if (conn) {
-      try { conn.end(); } catch (_) {}
+      try { conn.end(); } catch (err) { /* best-effort cleanup */ }
       this.connections.delete(profileId);
       this.sftpSessions.delete(profileId);
     }
@@ -374,12 +389,12 @@ export class SshService {
 
   disconnectAll() {
     for (const [id, conn] of this.connections.entries()) {
-      try { conn.end(); } catch (_) {}
+      try { conn.end(); } catch (err) { /* best-effort cleanup */ }
     }
     this.connections.clear();
     this.sftpSessions.clear();
     for (const [id, term] of this.terminalSessions.entries()) {
-      try { term.close(); } catch (_) {}
+      try { term.close(); } catch (err) { /* best-effort cleanup */ }
     }
     this.terminalSessions.clear();
   }

package/lib/tunnel-service.js

@@ -109,7 +109,7 @@ export class TunnelService {
     if (!tunnel) return false;
     try {
       tunnel.server.close();
-    } catch (_) {}
+    } catch (err) { /* best-effort cleanup */ }
     this.activeTunnels.delete(tunnelId);
     return true;
   }
@@ -134,7 +134,7 @@ export class TunnelService {
     for (const [id, tunnel] of this.activeTunnels.entries()) {
       try {
         tunnel.server.close();
-      } catch (_) {}
+      } catch (err) { /* best-effort cleanup */ }
     }
     this.activeTunnels.clear();
   }

package/lib/updater-service.js

@@ -0,0 +1,338 @@
+import { spawn } from 'node:child_process'
+import { existsSync, readFileSync } from 'node:fs'
+import { readFile } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { basename, dirname, isAbsolute, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+/**
+ * Host-side one-click updater for @goodandready/dsh-remote-workspace.
+ * Implements the unified DSH plugin updater specification.
+ */
+
+const UPDATE_HEADER = 'x-dsh-plugin-update'
+const UPDATE_TIMEOUT_MS = 10 * 60_000
+const VERSION_CACHE_MS = 5 * 60_000
+let latestCache = undefined
+
+function header(request, name) {
+  const value = request?.headers?.[name]
+  return Array.isArray(value) ? value[0] : value
+}
+
+function isLoopback(value) {
+  const address = value?.toLowerCase().replace(/^\[|\]$/g, '')
+  return (
+    address === 'localhost' ||
+    address === 'localhost.' ||
+    address === '::1' ||
+    address?.startsWith('127.') === true ||
+    address?.startsWith('::ffff:127.') === true
+  )
+}
+
+function isPrivateLan(value) {
+  const address = value?.toLowerCase().replace(/^\[|\]$/g, '')
+  if (!address) return false
+  const ipv4 = address.startsWith('::ffff:') ? address.slice(7) : address
+  return (
+    ipv4.startsWith('192.168.') ||
+    ipv4.startsWith('10.') ||
+    /^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(ipv4)
+  )
+}
+
+export function isTrustedUpdateRequest(request) {
+  if (header(request, UPDATE_HEADER) !== '1') return false
+  const remote = request.socket?.remoteAddress
+  if (!isLoopback(remote) && !isPrivateLan(remote)) return false
+  const site = header(request, 'sec-fetch-site')
+  if (site !== undefined && site !== 'same-origin') return false
+  const origin = header(request, 'origin')
+  const host = header(request, 'host')
+  if (origin === undefined || host === undefined) return false
+  try {
+    const url = new URL(origin)
+    return (
+      (url.protocol === 'http:' || url.protocol === 'https:') &&
+      (isLoopback(url.hostname) || isPrivateLan(url.hostname)) &&
+      url.host === host
+    )
+  } catch (err) { /* best-effort fallback */
+    return false
+  }
+}
+
+function validProfileName(value) {
+  return (
+    typeof value === 'string' &&
+    value !== '' &&
+    value !== '.' &&
+    value !== '..' &&
+    !value.includes('/') &&
+    !value.includes('\\') &&
+    !/[\0-\x1f\x7f]/.test(value)
+  )
+}
+
+function profileNameFromArgv(argv) {
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index]
+    if (arg === '--profile' || arg === '-p') {
+      const next = argv[index + 1]
+      if (validProfileName(next)) return next
+    }
+    if (typeof arg === 'string' && arg.startsWith('--profile=')) {
+      const value = arg.slice('--profile='.length)
+      if (validProfileName(value)) return value
+    }
+  }
+  return undefined
+}
+
+function findDshCliEntry() {
+  const entry = process.argv[1]
+  if (typeof entry !== 'string' || entry === '') return undefined
+  if (!existsSync(entry)) return undefined
+  for (let directory = dirname(entry); ; directory = dirname(directory)) {
+    const manifestPath = resolve(directory, 'package.json')
+    if (existsSync(manifestPath)) {
+      try {
+        const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'))
+        const bin =
+          typeof manifest.bin === 'string'
+            ? manifest.bin
+            : typeof manifest.bin === 'object' && manifest.bin !== null
+              ? manifest.bin.dsh
+              : undefined
+        if (
+          manifest.name === '@deepseek-ai/dsh' &&
+          typeof bin === 'string' &&
+          !isAbsolute(bin) &&
+          resolve(directory, bin) === resolve(entry)
+        ) {
+          return entry
+        }
+      } catch (err) { /* best-effort fallback */
+        // Continue searching parent directories
+      }
+    }
+    const parent = dirname(directory)
+    if (parent === directory) return undefined
+  }
+}
+
+function runtime() {
+  const profileDir = resolve(
+    process.env.DSH_PROFILE_DIR ?? resolve(homedir(), '.dsh', 'profiles', 'web')
+  )
+  const selected = profileNameFromArgv(process.argv)
+  const profileName = validProfileName(selected)
+    ? selected
+    : validProfileName(basename(profileDir))
+      ? basename(profileDir)
+      : 'web'
+  const cliEntry = findDshCliEntry()
+  return cliEntry === undefined ? { profileName, profileDir } : { profileName, profileDir, cliEntry }
+}
+
+function parseSemver(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value)
+  if (match === null) return undefined
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4]?.split('.') ?? [],
+  }
+}
+
+function comparePrerelease(left, right) {
+  if (left.length === 0 || right.length === 0) return left.length === right.length ? 0 : left.length === 0 ? 1 : -1
+  const length = Math.max(left.length, right.length)
+  for (let index = 0; index < length; index += 1) {
+    const a = left[index]
+    const b = right[index]
+    if (a === undefined || b === undefined) return a === b ? 0 : a === undefined ? -1 : 1
+    if (a === b) continue
+    const aNumeric = /^\d+$/.test(a)
+    const bNumeric = /^\d+$/.test(b)
+    if (aNumeric && bNumeric) {
+      const aNumber = BigInt(a)
+      const bNumber = BigInt(b)
+      if (aNumber !== bNumber) return aNumber > bNumber ? 1 : -1
+      continue
+    }
+    if (aNumeric !== bNumeric) return aNumeric ? -1 : 1
+    return a > b ? 1 : -1
+  }
+  return 0
+}
+
+export function isNewerVersion(currentValue, candidateValue) {
+  const current = parseSemver(currentValue)
+  const candidate = parseSemver(candidateValue)
+  if (current === undefined || candidate === undefined) return false
+  for (let index = 0; index < 3; index += 1) {
+    if (candidate.core[index] !== current.core[index]) return candidate.core[index] > current.core[index]
+  }
+  return comparePrerelease(candidate.prerelease, current.prerelease) > 0
+}
+
+async function latestVersion(packageName, registry) {
+  if (
+    latestCache?.packageName === packageName &&
+    latestCache.registry === registry &&
+    Date.now() < latestCache.expiresAt
+  ) {
+    return latestCache.version
+  }
+  try {
+    const response = await fetch(`${registry.replace(/\/$/, '')}/${encodeURIComponent(packageName)}/latest`, {
+      signal: typeof AbortSignal !== 'undefined' && AbortSignal.timeout ? AbortSignal.timeout(8000) : undefined,
+    })
+    if (!response.ok) return undefined
+    const value = await response.json()
+    if (typeof value?.version !== 'string' || value.version === '') return undefined
+    latestCache = { packageName, registry, version: value.version, expiresAt: Date.now() + VERSION_CACHE_MS }
+    return value.version
+  } catch (err) { /* best-effort fallback */
+    return undefined
+  }
+}
+
+async function currentVersion(manifestUrl) {
+  const value = JSON.parse(await readFile(manifestUrl, 'utf8'))
+  if (typeof value?.version !== 'string' || value.version === '') {
+    throw new Error('Cannot read current plugin version.')
+  }
+  return value.version
+}
+
+export async function status(options, target) {
+  const current = await currentVersion(options.manifestUrl)
+  const latest = await latestVersion(options.packageName, options.registry ?? 'https://registry.npmjs.org')
+  return {
+    packageName: options.packageName,
+    currentVersion: current,
+    ...(latest === undefined ? {} : { latestVersion: latest }),
+    latestCheckFailed: latest === undefined,
+    updateAvailable: latest !== undefined && isNewerVersion(current, latest),
+    profileName: target.profileName,
+    canAutoUpdate: target.cliEntry !== undefined,
+  }
+}
+
+async function installExact(target, packageSpec, options) {
+  if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.')
+  await new Promise((resolvePromise, reject) => {
+    const child = spawn(
+      process.execPath,
+      [
+        target.cliEntry,
+        'plugin',
+        '--profile',
+        target.profileName,
+        'add',
+        '--config.minimumReleaseAge=0',
+        packageSpec,
+        `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
+      ],
+      {
+        cwd: target.profileDir,
+        windowsHide: true,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: { ...process.env, NO_COLOR: '1' },
+      }
+    )
+    let detail = ''
+    child.stdout?.on('data', (chunk) => {
+      detail = (detail + String(chunk)).slice(-4000)
+    })
+    child.stderr?.on('data', (chunk) => {
+      detail = (detail + String(chunk)).slice(-4000)
+    })
+    const timer = setTimeout(() => {
+      child.kill()
+      reject(new Error('Update timed out; use the normal DSH update flow.'))
+    }, UPDATE_TIMEOUT_MS)
+    child.once('error', (error) => {
+      clearTimeout(timer)
+      reject(error)
+    })
+    child.once('exit', (code) => {
+      clearTimeout(timer)
+      if (code === 0) resolvePromise()
+      else reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`))
+    })
+  })
+}
+
+function json(response, statusCode, value) {
+  response.writeHead(statusCode, {
+    'content-type': 'application/json; charset=utf-8',
+    'cache-control': 'no-store',
+  })
+  response.end(JSON.stringify(value))
+}
+
+export function registerPluginUpdater(ctx, options) {
+  let installing = false
+  if (typeof ctx?.webServer?.register !== 'function') {
+    ctx?.logger?.warn?.('[dsh-remote-workspace] webServer service unavailable, updater skipped')
+    return () => {}
+  }
+
+  return ctx.webServer.register({
+    kind: 'exact',
+    path: options.endpoint,
+    handler: async (request, response) => {
+      try {
+        const target = runtime()
+        if (request.method === 'GET' || request.method === 'HEAD') {
+          const payload = await status(options, target)
+          response.writeHead(200, {
+            'content-type': 'application/json; charset=utf-8',
+            'cache-control': 'no-store',
+          })
+          response.end(request.method === 'HEAD' ? undefined : JSON.stringify(payload))
+          return
+        }
+        if (request.method !== 'POST') {
+          response.writeHead(405, { allow: 'GET, HEAD, POST' })
+          response.end()
+          return
+        }
+        if (!isTrustedUpdateRequest(request)) {
+          json(response, 403, { error: 'Rejected non-local or cross-origin update request.' })
+          return
+        }
+        if (installing) {
+          json(response, 409, { error: 'This plugin is already updating.' })
+          return
+        }
+        installing = true
+        try {
+          const before = await status(options, target)
+          if (before.latestVersion === undefined) {
+            json(response, 503, { error: 'The latest version is temporarily unavailable.' })
+            return
+          }
+          if (!before.updateAvailable) {
+            json(response, 200, before)
+            return
+          }
+          await installExact(target, `${options.packageName}@${before.latestVersion}`, options)
+          json(response, 200, {
+            ...before,
+            updatedVersion: before.latestVersion,
+            restartRequired: true,
+          })
+        } finally {
+          installing = false
+        }
+      } catch (error) {
+        ctx?.logger?.warn?.(`[dsh-remote-workspace] plugin updater failed: ${String(error)}`)
+        json(response, 503, { error: 'Plugin update failed; see server logs.' })
+      }
+    },
+  })
+}

package/lib/vault-service.js

@@ -8,6 +8,7 @@ import os from 'node:os';
  */
 export class VaultService {
   constructor(customPath = null) {
+    this.permissionError = null;
     if (customPath) {
       this.envPath = customPath;
     } else {
@@ -17,7 +18,16 @@ export class VaultService {
         if (!fs.existsSync(secretsDir)) {
           fs.mkdirSync(secretsDir, { recursive: true, mode: 0o700 });
         }
-      } catch (_) {}
+        if (fs.existsSync(secretsDir)) {
+          try {
+            fs.chmodSync(secretsDir, 0o700);
+          } catch (chmodErr) {
+            this.permissionError = `Failed to set 0700 permissions on secrets dir: ${chmodErr.message}`;
+          }
+        }
+      } catch (mkdirErr) {
+        this.permissionError = `Failed to initialize secrets directory: ${mkdirErr.message}`;
+      }
       this.envPath = path.join(secretsDir, 'dsh-remote-workspace.env');
     }
     this.ensureEnvFile();
@@ -29,9 +39,23 @@ export class VaultService {
         fs.writeFileSync(this.envPath, '# DSH Remote Workspace Encrypted Secrets Vault\n', { mode: 0o600, encoding: 'utf8' });
       } else {
         // Ensure file permissions are restricted to owner only
-        try { fs.chmodSync(this.envPath, 0o600); } catch (_) {}
+        try {
+          fs.chmodSync(this.envPath, 0o600);
+        } catch (chmodErr) {
+          this.permissionError = `Failed to restrict permissions on ${this.envPath}: ${chmodErr.message}`;
+        }
       }
-    } catch (_) {}
+    } catch (err) {
+      this.permissionError = `Failed to ensure vault file: ${err.message}`;
+    }
+  }
+
+  getPermissionStatus() {
+    return {
+      secure: !this.permissionError,
+      error: this.permissionError,
+      path: this.envPath
+    };
   }
 
   /**
@@ -61,14 +85,14 @@ export class VaultService {
             currentKey = key;
             currentValue = val.slice(1) + '\n';
           } else if (val.startsWith('"') && val.endsWith('"') && val.length >= 2) {
-            store[key] = val.slice(1, -1).replace(/\\n/g, '\n').replace(/\\r/g, '\r');
+            store[key] = val.slice(1, -1).replace(/\\"/g, '"').replace(/\\n/g, '\n').replace(/\\r/g, '\r');
           } else {
             store[key] = val;
           }
         } else {
           if (line.endsWith('"')) {
             currentValue += line.slice(0, -1);
-            store[currentKey] = currentValue.replace(/\\n/g, '\n').replace(/\\r/g, '\r');
+            store[currentKey] = currentValue.replace(/\\"/g, '"').replace(/\\n/g, '\n').replace(/\\r/g, '\r');
             isMultiline = false;
             currentKey = null;
             currentValue = '';

package/lib/watcher-service.js

@@ -59,7 +59,7 @@ export class WatcherService {
             if (this.onSyncCallback) {
               this.onSyncCallback({ profileId: profile.id, syncRes });
             }
-          } catch (_) {}
+          } catch (err) { /* best-effort cleanup */ }
         }, this.debounceMs);
 
         this.debounceTimers.set(profile.id, timer);
@@ -81,7 +81,7 @@ export class WatcherService {
     if (item) {
       try {
         item.watcher.close();
-      } catch (_) {}
+      } catch (err) { /* best-effort cleanup */ }
       this.watchers.delete(profileId);
       return true;
     }
@@ -100,7 +100,7 @@ export class WatcherService {
     for (const [id, item] of this.watchers.entries()) {
       try {
         item.watcher.close();
-      } catch (_) {}
+      } catch (err) { /* best-effort cleanup */ }
       if (this.debounceTimers.has(id)) {
         clearTimeout(this.debounceTimers.get(id));
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-remote-workspace",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Enterprise Remote Workspace Plugin for DeepSeek Harness: SSH2 connection pool, SFTP operations, 3-way conflict-aware mirror sync, port forwarding, and native DSH UI.",
   "type": "module",
   "main": "lib/index.js",
@@ -16,7 +16,7 @@
     "README.md",
     "README.ru.md",
     "README.zh.md",
-    "docs/",
+    "docs/design/DESIGN.md",
     "LICENSE"
   ],
   "scripts": {
@@ -49,7 +49,10 @@
     },
     "client": {
       "platform": "web",
-      "inject": []
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-settings"
+      ]
     }
   },
   "dependencies": {

package/docs/plans/findings.md

@@ -1,19 +0,0 @@
-# findings.md — dsh-remote-workspace
-
-## Ключевые выводы анализа dsh-remote
-1. Преимущество 3-way sync: snapshot хешей предотвращает перезапись изменений при одновременном редактировании на сервере и локально.
-2. Проблема 21 инструмента rw_*: перегружает LLM prompt. В новом плагине объединяем в 4 сбалансированных инструмента: 
-emote_exec, 
-emote_fs, 
-emote_sync, 
-emote_tunnel.
-3. Модульность: вместо спагетти в index.js реализуем 4 отдельных Cordis сервиса.
-4. UI: использование нативных CSS переменных DSH, чистый React, поддержка i18n (EN/RU/ZH).
-
-## Результаты аудита стабильности и UI (Фаза 8)
-1. **Баг localMirrorPath**: в форме профиля отсутствовало поле ввода localMirrorPath, что блокировало синхронизацию зеркала (400 Error).
-2. **Баг рассинхронизации полей testConnection**: бэкенд отдавал latency/os, клиент ожидал latencyMs/
-emoteOs.
-3. **Утечка кэшированных SSH-соединений**: при смене хоста или ключа/пароля в профиле старое соединение с тем же id не сбрасывалось из пула SshService.
-4. **Отсутствие UI для SSH-туннелей**: туннели были поддержаны на бэкенде, но не имели интерфейса в карточке настроек.
-5. **Безопасность API**: отсутствовал фильтр isTrustedSettingsRequest(req) на мутирующих маршрутах.

package/docs/plans/progress.md

@@ -1,15 +0,0 @@
-# progress.md — dsh-remote-workspace
-
-## Журнал выполнения
-- **2026-09-08**:
-  - Создан репозиторий goodandready/dsh-remote-workspace в Gitea.
-  - Создана задача Issue #1: [critical] Initial implementation of dsh-remote-workspace plugin.
-  - Оформлен дизайн-контракт docs/design/DESIGN.md.
-  - Реализованы 4 сервиса и 4 инструмента модели.
-  - Пройдены первые 12 тестов.
-- **2026-09-09**:
-  - Обогащена документация по стандарту dsh-documentation-standard (EN/RU/ZH).
-- **2026-09-10**:
-  - Создано worktree stability-and-clinebot-ui для реализации Фазы 8.
-  - Выполнен детальный аудит стабильности кода и визуального слоя.
-  - Подготовлен и утвержден комплексный план.

package/docs/plans/task_plan.md

@@ -1,21 +0,0 @@
-# task_plan.md — dsh-remote-workspace (v0.3.1)
-
-## Цель
-Реализовать 5 ключевых возможностей в рамках релиза v0.3.1:
-1. Smart Tarball Sync (пакетное ускорение передачи каталогов).
-2. remote_diagnose (комплексный агентский инструмент диагностики сервера).
-3. Import from ~/.ssh/config (парсинг хостов в .env vault).
-4. remote_env & Remote Environment Manager (безопасный редактор .env).
-5. AlertService (фоновый мониторинг аномалий и события Cordis).
-
-## Статус фаз
-- [ ] **Фаза 1**: Backend-сервисы (lib/tar-sync-service.js, lib/diagnose-service.js, lib/ssh-config-parser.js, lib/env-service.js, lib/alert-service.js)
-- [ ] **Фаза 2**: Интеграция в инструменты модели (remote_diagnose, remote_env, smart sync) и API маршруты
-- [ ] **Фаза 3**: Обновление клиентского интерфейса (кнопка импорта SSH, вкладка/модалка .env, индикатор алертов)
-- [ ] **Фаза 4**: Модульные и интеграционные тесты (test/phase4.test.mjs)
-- [ ] **Фаза 5**: Документация (README EN/RU/ZH, DESIGN.md) и проверка лимитов размера (<250 KiB)
-- [ ] **Фаза 6**: Тестовый гейт на MiniPC (dsh-test-plugin) и боевая верификация на MiniAI
-
-## Next Step
-Создание backend-сервисов в lib/.
-EOF