@goodandready/dsh-remote-workspace 0.3.1 → 0.3.3

package/lib/docker-service.js

@@ -38,7 +38,7 @@ export class DockerService {
           ports: item.Ports || '',
           created: item.CreatedAt || item.Created || ''
         });
-      } catch (_) {}
+      } catch (err) { /* best-effort cleanup */ }
     }
 
     return {

package/lib/index.js

@@ -82,6 +82,19 @@ export function apply(ctx, config = {}) {
     }
   }
 
+  const persistConfig = async (actionLabel) => {
+    if (settingsApi?.replace) {
+      try {
+        await settingsApi.replace(Config(currentConfig));
+      } catch (err) {
+        if (ctx.logger?.warn) {
+          ctx.logger.warn(`[dsh-remote-workspace] Failed to persist config after ${actionLabel}: ${err.message}`);
+        }
+        throw new Error(`Failed to save configuration: ${err.message}`);
+      }
+    }
+  };
+
   const store = {
     vault: vaultService,
     getRawProfiles() { return currentConfig.profiles || []; },
@@ -105,9 +118,7 @@ export function apply(ctx, config = {}) {
         if (enabled) watcherService.start(active, mirrorSync);
         else watcherService.stop(active.id);
       }
-      if (settingsApi?.replace) {
-        try { await settingsApi.replace(Config(currentConfig)); } catch (_) {}
-      }
+      await persistConfig('update');
     },
     async saveProfile(rawP) {
       const list = [...(currentConfig.profiles || [])];
@@ -140,9 +151,7 @@ export function apply(ctx, config = {}) {
         currentConfig.activeProfileId = p.id;
       }
       sshService.invalidate(p.id);
-      if (settingsApi?.replace) {
-        try { await settingsApi.replace(Config(currentConfig)); } catch (_) {}
-      }
+      await persistConfig('update');
     },
     async deleteProfile(id) {
       watcherService.stop(id);
@@ -152,9 +161,7 @@ export function apply(ctx, config = {}) {
       }
       vaultService.deleteProfileSecrets(id);
       sshService.disconnect(id);
-      if (settingsApi?.replace) {
-        try { await settingsApi.replace(Config(currentConfig)); } catch (_) {}
-      }
+      await persistConfig('update');
     },
     async setActiveId(id) {
       currentConfig.activeProfileId = id;
@@ -163,13 +170,34 @@ export function apply(ctx, config = {}) {
         const active = store.getActiveProfile();
         if (active) watcherService.start(active, mirrorSync);
       }
-      if (settingsApi?.replace) {
-        try { await settingsApi.replace(Config(currentConfig)); } catch (_) {}
-      }
+      await persistConfig('update');
     }
   };
 
   sshService.setJumpProfileResolver((jumpId) => store.getProfile(jumpId));
+  sshService.setProfileResolver((id) => store.getProfile(id));
+
+  const safeProfilesService = {
+    list() {
+      return (store.getProfiles() || []).map((p) => ({
+        id: p.id,
+        name: p.name || p.host,
+        host: p.host,
+        port: p.port || 22,
+        username: p.username || 'root',
+        authType: p.authType || 'key'
+      }));
+    },
+    get(id) {
+      return store.getProfile(id);
+    },
+    getActiveId() {
+      return store.getActiveId();
+    },
+    getActive() {
+      return store.getActiveProfile();
+    }
+  };
 
   // If autoSync was enabled on restart, resume watcher for active profile
   if (currentConfig.autoSyncActive && currentConfig.activeProfileId) {
@@ -208,6 +236,8 @@ export function apply(ctx, config = {}) {
   ctx.provide('remoteDiagnose');
   ctx.provide('remoteEnv');
   ctx.provide('remoteAlert');
+  ctx.provide('remoteProfiles');
+  ctx.remoteProfiles = safeProfilesService;
 
   ctx.remoteSsh = sshService;
   ctx.remoteFs = remoteFs;

package/lib/mirror-sync-service.js

@@ -51,7 +51,7 @@ export class MirrorSyncService {
     if (fs.existsSync(snapshotFile)) {
       try {
         lastSnapshot = JSON.parse(fs.readFileSync(snapshotFile, 'utf8'));
-      } catch (_) {}
+      } catch (err) { /* best-effort cleanup */ }
     }
 
     const conflicts = [];
@@ -172,7 +172,7 @@ export class MirrorSyncService {
     if (fs.existsSync(snapshotFile)) {
       try {
         snapshot = JSON.parse(fs.readFileSync(snapshotFile, 'utf8'));
-      } catch (_) {}
+      } catch (err) { /* best-effort cleanup */ }
     }
 
     const pushed = [];

package/lib/routes/docker.js

@@ -0,0 +1,85 @@
+import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+
+export function registerDockerRoutes(sctx, webServer, { dockerService, healthService, store }) {
+  // 21. GET /dsh-remote-workspace/health
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/health',
+    handler: async (req, res) => {
+      if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
+      try {
+        const url = new URL(req.url, 'http://localhost');
+        const profileId = url.searchParams.get('profileId');
+        const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'No active profile' });
+
+        const health = await healthService.getHealth(profile);
+        writeJson(res, 200, { ok: true, health });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /health');
+
+  // 22. GET /dsh-remote-workspace/docker/list
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/docker/list',
+    handler: async (req, res) => {
+      if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
+      try {
+        const url = new URL(req.url, 'http://localhost');
+        const profileId = url.searchParams.get('profileId');
+        const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'No active profile' });
+
+        const result = await dockerService.listContainers(profile, true);
+        writeJson(res, 200, { ok: true, ...result });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /docker/list');
+
+  // 23. POST /dsh-remote-workspace/docker/action
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/docker/action',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { profileId, containerId, action } = await readBody(req);
+        const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'No active profile' });
+        if (!containerId || !action) return writeJson(res, 400, { ok: false, error: 'containerId and action required' });
+
+        const result = await dockerService.containerAction(profile, containerId, action);
+        writeJson(res, 200, { ok: result.success, ...result });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /docker/action');
+
+  // 24. POST /dsh-remote-workspace/docker/logs
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/docker/logs',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { profileId, containerId, tail } = await readBody(req);
+        const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'No active profile' });
+        if (!containerId) return writeJson(res, 400, { ok: false, error: 'containerId required' });
+
+        const result = await dockerService.containerLogs(profile, containerId, tail || 100);
+        writeJson(res, 200, { ok: result.success, ...result });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /docker/logs');
+}

package/lib/routes/env.js

@@ -0,0 +1,60 @@
+import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+
+export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService, sshService, store }) {
+  // 10. POST /dsh-remote-workspace/env/view
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/env/view',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { profileId, remotePath } = await readBody(req);
+        const profile = store.getProfile(profileId);
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+        const result = await envService.readRemoteEnv(sshService, profile, remotePath);
+        writeJson(res, 200, { ok: true, ...result });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /env/view');
+
+  // 11. POST /dsh-remote-workspace/env/save
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/env/save',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { profileId, remotePath, content } = await readBody(req);
+        const profile = store.getProfile(profileId);
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+        const result = await envService.saveRemoteEnv(sshService, profile, remotePath, content);
+        writeJson(res, 200, { ok: true, ...result });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /env/save');
+
+  // 12. POST /dsh-remote-workspace/diagnose
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/diagnose',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { profileId, checks } = await readBody(req);
+        const profile = store.getProfile(profileId);
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+        const results = await diagnoseService.diagnose(sshService, profile, checks);
+        writeJson(res, 200, { ok: true, results });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /diagnose');
+}

package/lib/routes/files.js

@@ -0,0 +1,88 @@
+import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+
+export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshService }) {
+  // 7. POST /dsh-remote-workspace/browse
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/browse',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { profileId, remotePath } = await readBody(req);
+        const profile = store.getProfile(profileId);
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+        const items = await remoteFs.list(profile, remotePath || profile.remotePath || '.');
+        writeJson(res, 200, { ok: true, items });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /browse');
+
+  // 8. POST /dsh-remote-workspace/file/view
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/file/view',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { profileId, filePath } = await readBody(req);
+        const profile = store.getProfile(profileId);
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+        const stat = await remoteFs.stat(profile, filePath);
+        if (stat.size > 2 * 1024 * 1024) {
+          return writeJson(res, 400, { ok: false, error: 'File exceeds 2MB preview limit' });
+        }
+        const buf = await remoteFs.readFile(profile, filePath);
+        writeJson(res, 200, { ok: true, content: buf.toString('utf8'), size: stat.size });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /file/view');
+
+  // 9. POST /dsh-remote-workspace/file/save
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/file/save',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { profileId, filePath, content } = await readBody(req);
+        const profile = store.getProfile(profileId);
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+        await remoteFs.writeFile(profile, filePath, Buffer.from(content, 'utf8'));
+        writeJson(res, 200, { ok: true });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /file/save');
+
+  // 26. POST /dsh-remote-workspace/transfer
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/transfer',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { sourceProfileId, sourcePath, destProfileId, destPath } = await readBody(req);
+        const srcProfile = sourceProfileId ? store.getProfile(sourceProfileId) : store.getActiveProfile();
+        const destProfile = store.getProfile(destProfileId);
+
+        if (!srcProfile) return writeJson(res, 404, { ok: false, error: 'Source profile not found' });
+        if (!destProfile) return writeJson(res, 404, { ok: false, error: 'Destination profile not found' });
+        if (!sourcePath || !destPath) return writeJson(res, 400, { ok: false, error: 'sourcePath and destPath required' });
+
+        const result = await sshService.transferFileBetweenHosts(srcProfile, sourcePath, destProfile, destPath);
+        writeJson(res, 200, { ok: result.success, ...result });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /transfer');
+}

package/lib/routes/helpers.js

@@ -0,0 +1,40 @@
+export function writeJson(res, statusCode, body) {
+  if (typeof res.setHeader === 'function') {
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.statusCode = statusCode;
+  } else if (typeof res.writeHead === 'function') {
+    res.writeHead(statusCode, { 'Content-Type': 'application/json; charset=utf-8' });
+  } else {
+    res.statusCode = statusCode;
+  }
+  res.end(JSON.stringify(body));
+}
+
+export function readBody(req) {
+  return new Promise((resolve, reject) => {
+    let body = '';
+    req.on('data', (chunk) => { body += chunk.toString(); });
+    req.on('end', () => {
+      try {
+        resolve(body ? JSON.parse(body) : {});
+      } catch (err) {
+        reject(err);
+      }
+    });
+    req.on('error', reject);
+  });
+}
+
+export function isTrustedSettingsRequest(req) {
+  const rawAuth = req.headers['authorization'];
+  if (typeof rawAuth === 'string' && rawAuth.startsWith('Bearer ')) return true;
+  const cookieHeader = req.headers['cookie'];
+  if (typeof cookieHeader === 'string' && (cookieHeader.includes('token=') || cookieHeader.includes('dsh_token='))) {
+    return true;
+  }
+  const secFetch = req.headers['sec-fetch-site'];
+  if (secFetch === 'same-origin') return true;
+  const ip = req.socket?.remoteAddress || '';
+  if (ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1') return true;
+  return false;
+}

package/lib/routes/profiles.js

@@ -0,0 +1,141 @@
+import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { SshConfigParser } from '../ssh-config-parser.js';
+
+export function registerProfileRoutes(sctx, webServer, { store, sshService, alertService, tunnelService }) {
+  // 1. GET /dsh-remote-workspace/state
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/state',
+    handler: async (req, res) => {
+      if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
+      try {
+        const profiles = store.getProfiles();
+        const activeId = store.getActiveId() || (profiles[0]?.id || '');
+        const tunnels = tunnelService.listActiveTunnels();
+        const autoSync = store.isAutoSyncEnabled ? store.isAutoSyncEnabled() : false;
+        const alerts = alertService ? alertService.getAlerts() : [];
+        const sanitized = profiles.map((p) => (store.vault ? store.vault.sanitizeProfile(p) : p));
+        writeJson(res, 200, { ok: true, activeId, profiles: sanitized, tunnels, autoSync, alerts });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /state');
+
+  // 2. POST /dsh-remote-workspace/profiles/save
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/profiles/save',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const profile = await readBody(req);
+        if (!profile.id || !profile.host) {
+          return writeJson(res, 400, { ok: false, error: 'ID and Host are required' });
+        }
+        sshService.invalidate(profile.id);
+        await store.saveProfile(profile);
+        const sanitized = store.vault ? store.vault.sanitizeProfile(profile) : profile;
+        writeJson(res, 200, { ok: true, profile: sanitized });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /profiles/save');
+
+  // 3. POST /dsh-remote-workspace/profiles/delete
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/profiles/delete',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { id } = await readBody(req);
+        if (!id) return writeJson(res, 400, { ok: false, error: 'ID is required' });
+        sshService.disconnect(id);
+        await store.deleteProfile(id);
+        writeJson(res, 200, { ok: true });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /profiles/delete');
+
+  // 4. POST /dsh-remote-workspace/profiles/active
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/profiles/active',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { id } = await readBody(req);
+        if (!id) return writeJson(res, 400, { ok: false, error: 'ID is required' });
+        await store.setActiveId(id);
+        writeJson(res, 200, { ok: true, activeId: id });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /profiles/active');
+
+  // 5. POST /dsh-remote-workspace/profiles/import-ssh-config
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/profiles/import-ssh-config',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { content } = await readBody(req);
+        if (!content || typeof content !== 'string') {
+          return writeJson(res, 400, { ok: false, error: 'SSH config content is required' });
+        }
+        const importedProfiles = SshConfigParser.parse(content);
+        for (const p of importedProfiles) {
+          await store.saveProfile(p);
+        }
+        writeJson(res, 200, { ok: true, count: importedProfiles.length, profiles: importedProfiles });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /profiles/import-ssh-config');
+
+  // 6. POST /dsh-remote-workspace/test
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/test',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const profile = await readBody(req);
+        if (!profile.host) return writeJson(res, 400, { ok: false, error: 'Host is required' });
+
+        const existing = store.getProfile(profile.id);
+        const effectiveProfile = {
+          ...profile,
+          password: profile.password && profile.password !== '••••••••'
+            ? profile.password
+            : (existing?.password || ''),
+          privateKey: profile.privateKey && profile.privateKey !== '••••••••'
+            ? profile.privateKey
+            : (existing?.privateKey || ''),
+          passphrase: profile.passphrase && profile.passphrase !== '••••••••'
+            ? profile.passphrase
+            : (existing?.passphrase || '')
+        };
+
+        const result = await sshService.testConnection(effectiveProfile);
+        const latencyMs = result.latency !== undefined ? result.latency : (result.latencyMs ?? 0);
+        const remoteOs = result.os !== undefined ? result.os : (result.remoteOs ?? 'Linux/Unix');
+        writeJson(res, 200, { ok: true, latency: latencyMs, latencyMs, os: remoteOs, remoteOs });
+      } catch (err) {
+        writeJson(res, 200, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /test');
+}

package/lib/routes/sync.js

@@ -0,0 +1,52 @@
+import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+
+export function registerSyncRoutes(sctx, webServer, { mirrorSync, tarSyncService, watcherService, store }) {
+  // 17. POST /dsh-remote-workspace/sync
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/sync',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { profileId, direction, force, mode } = await readBody(req);
+        const profile = (profileId ? store.getProfile(profileId) : null) || store.getActiveProfile();
+        if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+        if (!profile.remoteWorkspace || !profile.localMirrorPath) {
+          return writeJson(res, 400, { ok: false, error: 'Both remoteWorkspace and localMirrorPath must be configured' });
+        }
+
+        if (mode === 'tarball' && tarSyncService) {
+          const resTar = direction === 'push'
+            ? await tarSyncService.pushTar(profile, profile.localMirrorPath, profile.remoteWorkspace)
+            : await tarSyncService.pullTar(profile, profile.remoteWorkspace, profile.localMirrorPath);
+          return writeJson(res, 200, { ok: true, ...resTar });
+        }
+
+        const resSync = direction === 'push'
+          ? await mirrorSync.push(profile, profile.localMirrorPath, profile.remoteWorkspace, Boolean(force))
+          : await mirrorSync.pull(profile, profile.remoteWorkspace, profile.localMirrorPath);
+        writeJson(res, 200, { ok: resSync.success, ...resSync });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /sync');
+
+  // 25. POST /dsh-remote-workspace/watcher/toggle
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/watcher/toggle',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { enabled } = await readBody(req);
+        await store.setAutoSyncEnabled(Boolean(enabled));
+        writeJson(res, 200, { ok: true, autoSync: store.isAutoSyncEnabled() });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /watcher/toggle');
+}