@goodandready/dsh-remote-workspace 0.3.6 → 0.3.7

package/lib/mirror-sync-service.js

@@ -11,6 +11,7 @@ export class MirrorSyncService {
     this.remoteFs = remoteFs;
     this.sshService = sshService;
     this.defaultIgnore = [
+      '.dsh-sync-snapshot.json',
       '.git',
       'node_modules',
       '.worktrees',
@@ -96,7 +97,7 @@ export class MirrorSyncService {
         baseRemoteSize === remoteSize
       ) {
         // Check if local was modified
-        const localContent = fs.readFileSync(localFullPath, 'utf8');
+        const localContent = fs.readFileSync(localFullPath);
         const localHash = this.computeHash(localContent);
         if (localHash === baseHash) {
           // File unchanged on both ends
@@ -107,7 +108,7 @@ export class MirrorSyncService {
       // Download content only when potentially changed
       let remoteContent = '';
       try {
-        remoteContent = await this.remoteFs.readFile(profile, remoteFullPath, 'utf8');
+        remoteContent = await this.remoteFs.readFile(profile, remoteFullPath, null);
       } catch (err) {
         continue; // skip unreadable files
       }
@@ -130,7 +131,7 @@ export class MirrorSyncService {
         updated.push(relPath);
         if (!dryRun) {
           fs.mkdirSync(path.dirname(localFullPath), { recursive: true });
-          fs.writeFileSync(localFullPath, remoteContent, 'utf8');
+          fs.writeFileSync(localFullPath, remoteContent);
         }
       }
 
@@ -195,11 +196,12 @@ export class MirrorSyncService {
     };
 
     const localFiles = walkLocal(localDir, localDir);
+    const createdDirs = new Set(['.', '/', '']);
     for (const rel of localFiles) {
       const localFull = path.join(localDir, rel);
       const remoteFull = path.posix.join(remoteDir, rel.replace(/\\/g, '/'));
       const stat = fs.statSync(localFull);
-      const content = fs.readFileSync(localFull, 'utf8');
+      const content = fs.readFileSync(localFull);
       const localHash = this.computeHash(content);
 
       const baseEntry = snapshot[rel];
@@ -211,8 +213,11 @@ export class MirrorSyncService {
 
       if (!dryRun) {
         const parent = path.posix.dirname(remoteFull);
-        await this.remoteFs.mkdir(profile, parent);
-        await this.remoteFs.writeFile(profile, remoteFull, content, 'utf8');
+        if (!createdDirs.has(parent)) {
+          await this.remoteFs.mkdir(profile, parent);
+          createdDirs.add(parent);
+        }
+        await this.remoteFs.writeFile(profile, remoteFull, content);
       }
       pushed.push(rel);
 

package/lib/remote-fs-service.js

@@ -33,6 +33,10 @@ export class RemoteFsService {
   /**
    * Read directory entries with in-memory TTL cache
    */
+  async list(profile, remotePath, bypassCache = false) {
+    return this.listDir(profile, remotePath, bypassCache);
+  }
+
   async listDir(profile, remotePath, bypassCache = false) {
     const key = this.cacheKey(profile.id, 'list', remotePath);
     if (!bypassCache) {

package/lib/routes/docker.js

@@ -7,6 +7,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
     path: '/dsh-remote-workspace/health',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
       try {
         const url = new URL(req.url, 'http://localhost');
         const profileId = url.searchParams.get('profileId');
@@ -27,6 +28,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
     path: '/dsh-remote-workspace/docker/list',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
       try {
         const url = new URL(req.url, 'http://localhost');
         const profileId = url.searchParams.get('profileId');

package/lib/routes/files.js

@@ -9,11 +9,24 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
       if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
       try {
-        const { profileId, remotePath } = await readBody(req);
-        const profile = store.getProfile(profileId);
+        const body = await readBody(req);
+        let profile = null;
+        if (body.profileId) {
+          profile = store.getProfile(body.profileId);
+        } else if (typeof body.profile === 'string') {
+          profile = store.getProfile(body.profile);
+        } else if (body.profile && typeof body.profile === 'object' && body.profile.host) {
+          profile = body.profile;
+        } else if (body.profile?.id) {
+          profile = store.getProfile(body.profile.id);
+        } else {
+          profile = store.getActiveProfile();
+        }
         if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
-        const items = await remoteFs.list(profile, remotePath || profile.remotePath || '.');
-        writeJson(res, 200, { ok: true, items });
+
+        const targetPath = body.remotePath || body.path || profile.remoteWorkspace || profile.remotePath || '.';
+        const entries = await remoteFs.listDir(profile, targetPath);
+        writeJson(res, 200, { ok: true, entries, items: entries, currentPath: targetPath });
       } catch (err) {
         writeJson(res, 500, { ok: false, error: err.message });
       }

package/lib/routes/helpers.js

@@ -25,14 +25,56 @@ export function readBody(req) {
   });
 }
 
+export function parseCookies(cookieHeader) {
+  const cookies = {};
+  if (typeof cookieHeader !== 'string') return cookies;
+  for (const pair of cookieHeader.split(';')) {
+    const idx = pair.indexOf('=');
+    if (idx !== -1) {
+      const key = pair.slice(0, idx).trim();
+      const val = pair.slice(idx + 1).trim();
+      cookies[key] = decodeURIComponent(val);
+    }
+  }
+  return cookies;
+}
+
 export function isTrustedSettingsRequest(req) {
+  const secFetch = req.headers['sec-fetch-site'];
+  // Fail-closed: unconditionally reject cross-site and cross-origin requests
+  if (secFetch && secFetch !== 'same-origin') {
+    return false;
+  }
+
+  // If origin is present, ensure it matches the request host
+  const origin = req.headers['origin'];
+  const host = req.headers['host'];
+  if (origin && host) {
+    try {
+      const url = new URL(origin);
+      if (url.host !== host) {
+        return false;
+      }
+    } catch {
+      return false;
+    }
+  }
+
   const rawAuth = req.headers['authorization'];
-  if (typeof rawAuth === 'string' && rawAuth.startsWith('Bearer ')) return true;
   const cookieHeader = req.headers['cookie'];
-  if (typeof cookieHeader === 'string' && (cookieHeader.includes('token=') || cookieHeader.includes('dsh_token='))) {
-    return true;
+  const expectedToken = process.env.DSH_AUTH_TOKEN || process.env.DSH_TOKEN;
+
+  if (expectedToken) {
+    if (typeof rawAuth === 'string' && rawAuth.startsWith('Bearer ')) {
+      const token = rawAuth.slice(7).trim();
+      if (token && token === expectedToken) return true;
+    }
+    if (typeof cookieHeader === 'string') {
+      const cookies = parseCookies(cookieHeader);
+      const token = cookies['token'] || cookies['dsh_token'];
+      if (token && token === expectedToken) return true;
+    }
   }
-  const secFetch = req.headers['sec-fetch-site'];
   if (secFetch === 'same-origin') return true;
   const ip = req.socket?.remoteAddress || '';
   if (ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1') return true;

package/lib/routes/profiles.js

@@ -1,6 +1,15 @@
 import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
 import { SshConfigParser } from '../ssh-config-parser.js';
 
+function maskProfile(p) {
+  if (!p || typeof p !== 'object') return p;
+  const masked = { ...p };
+  if (masked.password) masked.password = '••••••••';
+  if (masked.privateKey) masked.privateKey = '••••••••';
+  if (masked.passphrase) masked.passphrase = '••••••••';
+  return masked;
+}
+
 export function registerProfileRoutes(sctx, webServer, { store, sshService, alertService, tunnelService }) {
   // 1. GET /dsh-remote-workspace/state
   sctx.effect(() => webServer.register({
@@ -8,13 +17,14 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/state',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
       try {
         const profiles = store.getProfiles();
         const activeId = store.getActiveId() || (profiles[0]?.id || '');
         const tunnels = tunnelService.listActiveTunnels();
         const autoSync = store.isAutoSyncEnabled ? store.isAutoSyncEnabled() : false;
         const alerts = alertService ? alertService.getAlerts() : [];
-        const sanitized = profiles.map((p) => (store.vault ? store.vault.sanitizeProfile(p) : p));
+        const sanitized = profiles.map((p) => (store.vault ? store.vault.sanitizeProfile(p) : maskProfile(p)));
         writeJson(res, 200, { ok: true, activeId, profiles: sanitized, tunnels, autoSync, alerts });
       } catch (err) {
         writeJson(res, 500, { ok: false, error: err.message });
@@ -36,7 +46,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
         }
         sshService.invalidate(profile.id);
         await store.saveProfile(profile);
-        const sanitized = store.vault ? store.vault.sanitizeProfile(profile) : profile;
+        const sanitized = store.vault ? store.vault.sanitizeProfile(profile) : maskProfile(profile);
         writeJson(res, 200, { ok: true, profile: sanitized });
       } catch (err) {
         writeJson(res, 500, { ok: false, error: err.message });

package/lib/routes/terminal.js

@@ -10,9 +10,9 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
       if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
       try {
         const { profileId, cols, rows } = await readBody(req);
-        const profile = store.getProfile(profileId);
+        const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
         if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
-        const session = await sshService.createTerminalSession(profile, cols || 80, rows || 24);
+        const session = await sshService.createTerminalSession(profile, { cols: cols || 80, rows: rows || 24 });
         writeJson(res, 200, { ok: true, sessionId: session.id });
       } catch (err) {
         writeJson(res, 500, { ok: false, error: err.message });
@@ -50,6 +50,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
     path: '/dsh-remote-workspace/terminal/stream',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
       try {
         const url = new URL(req.url, 'http://localhost');
         const sessionId = url.searchParams.get('sessionId');

package/lib/routes/tunnels.js

@@ -49,6 +49,7 @@ export function registerTunnelRoutes(sctx, webServer, { tunnelService, store })
     path: '/dsh-remote-workspace/tunnels/telemetry',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
       try {
         writeJson(res, 200, { ok: true, tunnels: tunnelService.listActiveTunnels() });
       } catch (err) {

package/lib/ssh-service.js

@@ -313,6 +313,9 @@ export class SshService {
   }
 
   async createTerminalSession(profile, options = {}) {
+    if (typeof options === 'number') {
+      options = { cols: options, rows: arguments[2] };
+    }
     const conn = await this.getConnection(profile);
     const cols = options.cols || 80;
     const rows = options.rows || 24;

package/lib/tar-sync-service.js

@@ -2,6 +2,11 @@ import { spawn } from 'node:child_process';
 import path from 'node:path';
 import fs from 'node:fs';
 
+export function shellQuote(arg) {
+  if (typeof arg !== 'string') arg = String(arg || '');
+  return "'" + arg.replace(/'/g, "'\\''") + "'";
+}
+
 export class TarSyncService {
   /**
    * @param {import('./ssh-service.js').SshService} sshService
@@ -17,11 +22,13 @@ export class TarSyncService {
    */
   async pullTar(profile, remoteDir, localDir) {
     if (!profile) throw new Error('No profile provided');
+    if (!remoteDir || typeof remoteDir !== 'string') throw new Error('remoteDir must be a non-empty string');
     fs.mkdirSync(localDir, { recursive: true });
 
     const client = await this.sshService.getConnection(profile);
     return new Promise((resolve, reject) => {
-      const remoteCmd = `tar --exclude='.git' --exclude='node_modules' -czf - -C "${remoteDir}" .`;
+      const safeRemoteDir = shellQuote(remoteDir);
+      const remoteCmd = `tar --exclude='.git' --exclude='node_modules' -czf - -C ${safeRemoteDir} .`;
       client.exec(remoteCmd, (err, stream) => {
         if (err) return reject(err);
 
@@ -52,14 +59,16 @@ export class TarSyncService {
    */
   async pushTar(profile, localDir, remoteDir) {
     if (!profile) throw new Error('No profile provided');
+    if (!remoteDir || typeof remoteDir !== 'string') throw new Error('remoteDir must be a non-empty string');
     if (!fs.existsSync(localDir)) throw new Error(`Local dir does not exist: ${localDir}`);
 
+    const safeRemoteDir = shellQuote(remoteDir);
     const client = await this.sshService.getConnection(profile);
     // Ensure remoteDir exists
-    await this.sshService.exec(profile, `mkdir -p "${remoteDir}"`);
+    await this.sshService.exec(profile, `mkdir -p ${safeRemoteDir}`);
 
     return new Promise((resolve, reject) => {
-      const remoteCmd = `tar -xzf - -C "${remoteDir}"`;
+      const remoteCmd = `tar -xzf - -C ${safeRemoteDir}`;
       client.exec(remoteCmd, (err, stream) => {
         if (err) return reject(err);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-remote-workspace",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "Enterprise Remote Workspace Plugin for DeepSeek Harness: SSH2 connection pool, SFTP operations, 3-way conflict-aware mirror sync, port forwarding, and native DSH UI.",
   "type": "module",
   "main": "lib/index.js",