@goodandready/dsh-remote-workspace 0.3.7 → 0.3.9

package/lib/cluster-service.js

@@ -0,0 +1,57 @@
+export function filterClusterProfiles(profiles, filter = {}) {
+  const aliases = new Set((filter.aliases || []).map((item) => String(item)));
+  const tags = (filter.tags || []).map((item) => String(item).toLowerCase()).filter(Boolean);
+  const environment = String(filter.environment || '').trim().toLowerCase();
+  return (profiles || []).filter((profile) => {
+    if (aliases.size && !aliases.has(String(profile.id)) && !aliases.has(String(profile.name || ''))) return false;
+    if (environment && String(profile.environment || '').toLowerCase() !== environment) return false;
+    if (tags.length) {
+      const have = (Array.isArray(profile.tags) ? profile.tags : []).map((item) => String(item).toLowerCase());
+      if (!tags.every((tag) => have.includes(tag))) return false;
+    }
+    return true;
+  });
+}
+
+export async function runCluster(profiles, command, options = {}) {
+  const list = profiles || [];
+  if (!list.length) return [];
+  const limit = Math.max(1, Math.min(Number(options.maxWorkers) || 8, list.length));
+  const exec = options.exec;
+  const results = new Array(list.length);
+  let cursor = 0;
+  const worker = async () => {
+    while (cursor < list.length) {
+      const index = cursor;
+      cursor += 1;
+      const profile = list[index];
+      const started = Date.now();
+      try {
+        const res = await exec(profile, command);
+        results[index] = {
+          alias: profile.name || profile.id || '',
+          host: profile.host || '',
+          success: (res.code ?? 0) === 0,
+          exitCode: res.code ?? 0,
+          durationMs: Date.now() - started,
+          stdout: res.stdout || '',
+          stderr: res.stderr || '',
+          error: ''
+        };
+      } catch (err) {
+        results[index] = {
+          alias: profile.name || profile.id || '',
+          host: profile.host || '',
+          success: false,
+          exitCode: null,
+          durationMs: Date.now() - started,
+          stdout: '',
+          stderr: '',
+          error: err && err.message ? err.message : 'failed'
+        };
+      }
+    }
+  };
+  await Promise.all(Array.from({ length: limit }, () => worker()));
+  return results;
+}

package/lib/exec-retry.js

@@ -0,0 +1,24 @@
+export function isRetryableConnectionError(err) {
+  if (!err || err.commandTimeout) return false;
+  if (err.stdout) return false;
+  const code = err.code || '';
+  if (['ECONNRESET', 'ETIMEDOUT', 'EHOSTUNREACH', 'ENOTFOUND', 'EPIPE'].includes(code)) return true;
+  return /connection reset|not connected|No response from server|socket hang up/i.test(String(err.message || ''));
+}
+
+export async function runWithReconnect(run, options = {}) {
+  const attempts = options.idempotent === false ? 1 : 3;
+  const wait = options.wait || ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  let lastError = null;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      return await run();
+    } catch (err) {
+      lastError = err;
+      if (attempt >= attempts || !isRetryableConnectionError(err)) throw err;
+      if (options.onRetry) options.onRetry(err, attempt);
+      await wait(50 * attempt);
+    }
+  }
+  throw lastError;
+}

package/lib/file-transfer.js

@@ -0,0 +1,56 @@
+const MAX_BYTES = 512 * 1024 * 1024;
+
+export function transferPercent(loaded, total) {
+  const done = Number(loaded) || 0;
+  const size = Number(total) || 0;
+  if (size <= 0) return 0;
+  return Math.max(0, Math.min(100, Math.round((done / size) * 100)));
+}
+
+export function attachmentName(filePath) {
+  const base = String(filePath || '').split('/').filter(Boolean).pop() || 'download';
+  const clean = base.replace(/[\r\n"\\]/g, '');
+  if (!clean || clean === '.' || clean === '..') return 'download';
+  return clean.slice(0, 180);
+}
+
+export function contentDisposition(filePath) {
+  const name = attachmentName(filePath);
+  const ascii = name.replace(/[^\x20-\x7E]/g, '_') || 'download';
+  return `attachment; filename="${ascii}"; filename*=UTF-8''${encodeURIComponent(name)}`;
+}
+
+export function pipeWithProgress(source, dest) {
+  return new Promise((resolve, reject) => {
+    let loaded = 0;
+    let settled = false;
+    const finish = (err) => {
+      if (settled) return;
+      settled = true;
+      if (err) reject(err);
+      else resolve(loaded);
+    };
+    source.on('data', (chunk) => {
+      loaded += chunk.length;
+      if (loaded > MAX_BYTES) {
+        const err = new Error('File exceeds the 512MB transfer limit');
+        err.code = 'LIMIT';
+        source.destroy();
+        dest.destroy();
+        finish(err);
+      }
+    });
+    source.on('error', finish);
+    dest.on('error', finish);
+    dest.on('finish', () => finish());
+    source.on('aborted', () => {
+      const err = new Error('Transfer aborted');
+      err.code = 'ABORTED';
+      dest.destroy();
+      finish(err);
+    });
+    source.pipe(dest);
+  });
+}
+
+export { MAX_BYTES };

package/lib/host-projection.js

@@ -0,0 +1,42 @@
+const SECRET = ['password', 'privateKey', 'privateKeyPath', 'passphrase', 'agentPath', 'proxyCommand'];
+
+/**
+ * One host row safe to place in a model context.
+ * @param {any} profile
+ */
+export function toAgentHostRow(profile) {
+  const jump = Boolean(
+    (typeof profile?.jumpHostId === 'string' && profile.jumpHostId.trim())
+    || (Array.isArray(profile?.jumpHosts) && profile.jumpHosts.length)
+  );
+  const proxy = Boolean(typeof profile?.proxyCommand === 'string' && profile.proxyCommand.trim());
+  const access = [jump ? 'jump' : '', proxy ? 'proxy' : ''].filter(Boolean).join(',') || 'direct';
+  return {
+    alias: String(profile?.name || profile?.id || ''),
+    host: String(profile?.host || ''),
+    port: profile?.port || 22,
+    user: String(profile?.username || ''),
+    auth: String(profile?.authType || 'key'),
+    access,
+    env: String(profile?.environment || ''),
+    tags: Array.isArray(profile?.tags) ? profile.tags.map((item) => String(item)).join(',') : '',
+    description: String(profile?.description || '')
+  };
+}
+
+/**
+ * @param {any[]} profiles
+ */
+export function renderHostTable(profiles) {
+  const header = 'alias | host | port | user | auth | jump/proxy | env | tags | description';
+  const lines = (profiles || []).map((profile) => {
+    const row = toAgentHostRow(profile);
+    return [row.alias, row.host, row.port, row.user, row.auth, row.access, row.env, row.tags, row.description].join(' | ');
+  });
+  return [header, ...lines].join('\n');
+}
+
+export function hostProjectionLeaks(value) {
+  const text = typeof value === 'string' ? value : JSON.stringify(value);
+  return SECRET.some((key) => text.includes(key));
+}

package/lib/index.js

@@ -1,4 +1,5 @@
 import z from '@deepseek-ai/schemastery';
+import { normalizeTerminalFont } from './terminal-font.js';
 import { VaultService } from './vault-service.js';
 import { SshService } from './ssh-service.js';
 import { RemoteFsService } from './remote-fs-service.js';
@@ -28,17 +29,25 @@ export const Config = z.object({
     port: z.number().default(22),
     username: z.string().default('root'),
     authType: z.string().default('key'),
+    agentPath: z.string().default(''),
     privateKeyPath: z.string().default(''),
     privateKey: z.string().default(''),
     passphrase: z.string().default(''),
     password: z.string().default(''),
     remoteWorkspace: z.string().default(''),
     localMirrorPath: z.string().default(''),
-    jumpHostId: z.string().default('')
+    jumpHostId: z.string().default(''),
+    jumpHosts: z.array(z.string()).default([]),
+    proxyCommand: z.string().default(''),
+    environment: z.string().default(''),
+    tags: z.array(z.string()).default([]),
+    location: z.string().default(''),
+    description: z.string().default('')
   })).default([]).description('List of configured remote machines and workspaces.'),
   activeProfileId: z.string().default('').description('ID of active remote profile.'),
   autoSyncActive: z.boolean().default(false).description('Whether Live Auto-Sync watcher is enabled.'),
-  alertMonitoringActive: z.boolean().default(false).description('Whether background anomaly alerts are monitored.')
+  alertMonitoringActive: z.boolean().default(false).description('Whether background anomaly alerts are monitored.'),
+  terminalFontFamily: z.string().default('').description('CSS font family used by the terminal. Empty keeps the default monospace stack.')
 });
 
 export function apply(ctx, config = {}) {
@@ -48,11 +57,14 @@ export function apply(ctx, config = {}) {
     profiles: Array.isArray(cfg.profiles) ? cfg.profiles : [],
     activeProfileId: cfg.activeProfileId || null,
     autoSyncActive: Boolean(cfg.autoSyncActive),
-    alertMonitoringActive: Boolean(cfg.alertMonitoringActive)
+    alertMonitoringActive: Boolean(cfg.alertMonitoringActive),
+    terminalFontFamily: typeof cfg.terminalFontFamily === 'string' ? cfg.terminalFontFamily : ''
   };
 
   const vaultService = new VaultService();
   const sshService = new SshService(ctx, vaultService);
+  const idleTimer = setInterval(() => sshService.sweepIdle(), 60 * 1000);
+  idleTimer.unref?.();
   const remoteFs = new RemoteFsService(sshService);
   const mirrorSync = new MirrorSyncService(remoteFs, sshService);
   const tunnelService = new TunnelService(sshService);
@@ -111,6 +123,12 @@ export function apply(ctx, config = {}) {
       return p ? vaultService.hydrateProfile(p) : undefined;
     },
     isAutoSyncEnabled() { return Boolean(currentConfig.autoSyncActive); },
+    getTerminalFont() { return currentConfig.terminalFontFamily || ''; },
+    async setTerminalFont(fontFamily) {
+      currentConfig.terminalFontFamily = normalizeTerminalFont(fontFamily);
+      await persistConfig('terminal-font');
+      return currentConfig.terminalFontFamily;
+    },
     async setAutoSyncEnabled(enabled) {
       currentConfig.autoSyncActive = Boolean(enabled);
       const active = store.getActiveProfile();
@@ -264,7 +282,8 @@ export function apply(ctx, config = {}) {
     dockerService,
     diagnoseService,
     envService,
-    tarSyncService
+    tarSyncService,
+    () => store.getProfiles()
   );
 
   // API Routes

package/lib/jump-chain.js

@@ -0,0 +1,56 @@
+/**
+ * Jump ids from an explicit list, or from a comma-separated jumpHostId.
+ * @param {any} profile
+ * @returns {string[]}
+ */
+export function resolveJumpHops(profile) {
+  if (Array.isArray(profile?.jumpHosts) && profile.jumpHosts.length) {
+    return profile.jumpHosts.map((item) => String(item).trim()).filter(Boolean);
+  }
+  if (typeof profile?.jumpHostId === 'string' && profile.jumpHostId.trim()) {
+    return profile.jumpHostId.split(',').map((item) => item.trim()).filter(Boolean);
+  }
+  return [];
+}
+
+/**
+ * @param {any} client
+ * @param {string} host
+ * @param {number} port
+ */
+export function forwardOut(client, host, port) {
+  return new Promise((resolve, reject) => {
+    client.forwardOut('127.0.0.1', 0, host, port || 22, (err, stream) => {
+      if (err) reject(err);
+      else resolve(stream);
+    });
+  });
+}
+
+/**
+ * Connect through bastions in order. Only clients created after the first hop
+ * are released with the target; the first hop stays in the shared pool.
+ */
+export async function openJumpChain(target, hopProfiles, deps) {
+  if (!hopProfiles.length) throw new Error('Jump chain is empty');
+  const intermediates = [];
+  const release = () => {
+    for (const extra of intermediates) {
+      try { extra.end(); } catch { /* already closed */ }
+    }
+  };
+  try {
+    let client = await deps.connectPooled(hopProfiles[0]);
+    for (let i = 1; i < hopProfiles.length; i += 1) {
+      const hop = hopProfiles[i];
+      const stream = await forwardOut(client, hop.host, hop.port || 22);
+      client = await deps.connectDedicated(hop, stream);
+      intermediates.push(client);
+    }
+    const sock = await forwardOut(client, target.host, target.port || 22);
+    return { sock, release };
+  } catch (err) {
+    release();
+    throw err;
+  }
+}

package/lib/poll-gate.js

@@ -0,0 +1,5 @@
+export function shouldPoll({ hidden = false, inFlight = false } = {}) {
+  if (hidden) return false;
+  if (inFlight) return false;
+  return true;
+}

package/lib/profile-groups.js

@@ -0,0 +1,60 @@
+export function normalizeTags(value) {
+  if (Array.isArray(value)) return value.map((item) => String(item).trim()).filter(Boolean);
+  return String(value || '').split(',').map((item) => item.trim()).filter(Boolean);
+}
+
+function bucket(map, key, profile) {
+  const name = key || 'ungrouped';
+  if (!map.has(name)) map.set(name, []);
+  map.get(name).push(profile);
+}
+
+export function groupProfiles(profiles, mode) {
+  const list = Array.isArray(profiles) ? profiles : [];
+  if (mode === 'environment') {
+    const map = new Map();
+    for (const profile of list) bucket(map, String(profile.environment || '').trim(), profile);
+    return [...map.entries()].map(([key, items]) => ({ key, items }));
+  }
+  if (mode === 'tag') {
+    const map = new Map();
+    for (const profile of list) {
+      const tags = normalizeTags(profile.tags);
+      if (!tags.length) bucket(map, '', profile);
+      else for (const tag of tags) bucket(map, tag, profile);
+    }
+    return [...map.entries()].map(([key, items]) => ({ key, items }));
+  }
+  return [{ key: 'all', items: list }];
+}
+
+export async function testProfileGroup(profiles, testOne) {
+  const results = [];
+  const queue = [...(profiles || [])];
+  const workers = Array.from({ length: Math.min(4, Math.max(queue.length, 1)) }, async () => {
+    while (queue.length) {
+      const profile = queue.shift();
+      if (!profile) return;
+      const started = Date.now();
+      try {
+        const result = await testOne(profile);
+        results.push({
+          id: profile.id,
+          name: profile.name || profile.host,
+          ok: true,
+          latencyMs: result.latencyMs ?? result.latency ?? (Date.now() - started)
+        });
+      } catch (err) {
+        results.push({
+          id: profile.id,
+          name: profile.name || profile.host,
+          ok: false,
+          error: err && err.message ? err.message : 'Connection failed'
+        });
+      }
+    }
+  });
+  if (!queue.length) return results;
+  await Promise.all(workers);
+  return results;
+}

package/lib/proxy-command.js

@@ -0,0 +1,53 @@
+import { spawn } from 'node:child_process';
+import { Duplex } from 'node:stream';
+
+const TOKEN = /%[%hprn]/g;
+
+/**
+ * Expand OpenSSH ProxyCommand tokens. %% stays a literal percent.
+ * @param {string} template
+ * @param {{ host?: string, port?: number|string, user?: string, alias?: string }} tokens
+ */
+export function expandProxyCommand(template, tokens = {}) {
+  const map = {
+    '%h': String(tokens.host ?? ''),
+    '%p': String(tokens.port ?? ''),
+    '%r': String(tokens.user ?? ''),
+    '%n': String(tokens.alias ?? ''),
+    '%%': '%'
+  };
+  return String(template ?? '').replace(TOKEN, (token) => (token in map ? map[token] : token));
+}
+
+/**
+ * Run a ProxyCommand and expose its stdio as a duplex socket for ssh2.
+ * POSIX uses `$SHELL -c`; Windows uses `cmd.exe /d /s /c`.
+ * @param {string} command
+ */
+export function openProxyCommand(command) {
+  const windows = process.platform === 'win32';
+  const shell = windows ? (process.env.ComSpec || 'cmd.exe') : (process.env.SHELL || '/bin/sh');
+  const args = windows ? ['/d', '/s', '/c', command] : ['-c', command];
+  const child = spawn(shell, args, { stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true });
+  const sock = Duplex.from({ writable: child.stdin, readable: child.stdout });
+  let stopped = false;
+
+  const stop = () => {
+    if (stopped) return;
+    stopped = true;
+    if (child.exitCode !== null || child.signalCode) return;
+    child.kill('SIGTERM');
+    const timer = setTimeout(() => {
+      if (child.exitCode === null && !child.signalCode) child.kill('SIGKILL');
+    }, 2000);
+    timer.unref?.();
+    child.once('exit', () => clearTimeout(timer));
+  };
+
+  sock.on('close', stop);
+  child.on('error', (err) => sock.destroy(err));
+  child.on('exit', () => {
+    if (!sock.destroyed) sock.destroy();
+  });
+  return { sock, child, stop };
+}

package/lib/remote-fs-service.js

@@ -117,6 +117,31 @@ export class RemoteFsService {
     return sftp.createReadStream(remotePath);
   }
 
+  async beginUpload(profile, remotePath) {
+    const sftp = await this.sshService.getSftp(profile);
+    const tempPath = `${remotePath}.dsh-tmp.${Date.now()}`;
+    const stream = sftp.createWriteStream(tempPath);
+    return {
+      stream,
+      commit() {
+        return new Promise((resolve, reject) => {
+          sftp.rename(tempPath, remotePath, (err) => {
+            if (err) {
+              sftp.unlink(tempPath, () => {});
+              return reject(err);
+            }
+            resolve();
+          });
+        });
+      },
+      abort() {
+        return new Promise((resolve) => {
+          sftp.unlink(tempPath, () => resolve());
+        });
+      }
+    };
+  }
+
   /**
    * Atomic file write using temp file and rename
    */

package/lib/routes/files.js

@@ -1,4 +1,24 @@
 import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { contentDisposition, pipeWithProgress, MAX_BYTES } from '../file-transfer.js';
+
+
+function transferTarget(req, store) {
+  const url = new URL(req.url || '/', 'http://localhost');
+  const profileId = url.searchParams.get('profileId') || '';
+  const filePath = url.searchParams.get('filePath') || '';
+  if (!filePath || filePath.length > 1024 || filePath.includes('\0')) {
+    const err = new Error('A file path is required');
+    err.status = 400;
+    throw err;
+  }
+  const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
+  if (!profile) {
+    const err = new Error('Profile not found');
+    err.status = 404;
+    throw err;
+  }
+  return { profile, filePath };
+}
 
 export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshService }) {
   // 7. POST /dsh-remote-workspace/browse
@@ -75,6 +95,61 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
     }
   }), 'dsh-remote-workspace: /file/save');
 
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/file/download',
+    handler: async (req, res) => {
+      if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const { profile, filePath } = transferTarget(req, store);
+        const stat = await remoteFs.stat(profile, filePath);
+        if (!stat.isFile) return writeJson(res, 400, { ok: false, error: 'Only a file can be downloaded' });
+        if (stat.size > MAX_BYTES) return writeJson(res, 413, { ok: false, error: 'File exceeds the 512MB transfer limit' });
+        const stream = await remoteFs.createReadStream(profile, filePath);
+        const stop = () => { try { stream.destroy(); } catch (err) { /* best-effort cleanup */ } };
+        req.on('close', stop);
+        stream.on('error', () => stop());
+        res.writeHead(200, {
+          'Content-Type': 'application/octet-stream',
+          'Content-Length': stat.size,
+          'Content-Disposition': contentDisposition(filePath),
+          'Cache-Control': 'no-store'
+        });
+        stream.pipe(res);
+      } catch (err) {
+        if (!res.headersSent) writeJson(res, err.status || 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /file/download');
+
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/file/upload',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      let upload = null;
+      try {
+        const { profile, filePath } = transferTarget(req, store);
+        upload = await remoteFs.beginUpload(profile, filePath);
+        const bytes = await pipeWithProgress(req, upload.stream);
+        await upload.commit();
+        if (remoteFs.invalidateCache) remoteFs.invalidateCache(profile.id);
+        writeJson(res, 200, { ok: true, bytes });
+      } catch (err) {
+        if (upload) {
+          try { await upload.abort(); } catch (abortErr) { /* best-effort cleanup */ }
+        }
+        if (!res.headersSent) {
+          const status = err.code === 'ABORTED' ? 499 : (err.code === 'LIMIT' ? 413 : (err.status || 500));
+          writeJson(res, status, { ok: false, error: err.message });
+        }
+      }
+    }
+  }), 'dsh-remote-workspace: /file/upload');
+
+
   // 26. POST /dsh-remote-workspace/transfer
   sctx.effect(() => webServer.register({
     kind: 'exact',

package/lib/routes/profiles.js

@@ -1,5 +1,7 @@
 import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
 import { SshConfigParser } from '../ssh-config-parser.js';
+import { testProfileGroup } from '../profile-groups.js';
+import { filterClusterProfiles, runCluster } from '../cluster-service.js';
 
 function maskProfile(p) {
   if (!p || typeof p !== 'object') return p;
@@ -24,8 +26,10 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
         const tunnels = tunnelService.listActiveTunnels();
         const autoSync = store.isAutoSyncEnabled ? store.isAutoSyncEnabled() : false;
         const alerts = alertService ? alertService.getAlerts() : [];
+        const authPrompts = sshService.listKeyboardPrompts ? sshService.listKeyboardPrompts() : [];
         const sanitized = profiles.map((p) => (store.vault ? store.vault.sanitizeProfile(p) : maskProfile(p)));
-        writeJson(res, 200, { ok: true, activeId, profiles: sanitized, tunnels, autoSync, alerts });
+        const terminalFontFamily = store.getTerminalFont ? store.getTerminalFont() : '';
+        writeJson(res, 200, { ok: true, activeId, profiles: sanitized, tunnels, autoSync, alerts, authPrompts, terminalFontFamily });
       } catch (err) {
         writeJson(res, 500, { ok: false, error: err.message });
       }
@@ -99,21 +103,91 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
       if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
       try {
-        const { content } = await readBody(req);
-        if (!content || typeof content !== 'string') {
-          return writeJson(res, 400, { ok: false, error: 'SSH config content is required' });
-        }
-        const importedProfiles = SshConfigParser.parse(content);
-        for (const p of importedProfiles) {
+        const body = await readBody(req);
+        const content = typeof body.content === 'string' && body.content.trim()
+          ? body.content
+          : SshConfigParser.readDefaultConfig();
+        if (!content) return writeJson(res, 400, { ok: false, error: 'SSH config content is required' });
+        const report = SshConfigParser.parseReport(content, { baseDir: body.baseDir });
+        for (const p of report.profiles) {
           await store.saveProfile(p);
         }
-        writeJson(res, 200, { ok: true, count: importedProfiles.length, profiles: importedProfiles });
+        writeJson(res, 200, {
+          ok: true,
+          count: report.profiles.length,
+          profiles: report.profiles,
+          skipped: report.skipped
+        });
       } catch (err) {
         writeJson(res, 500, { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /profiles/import-ssh-config');
 
+
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/auth/keyboard',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const body = await readBody(req);
+        const answers = Array.isArray(body.answers) ? body.answers.slice(0, 20).map((item) => String(item ?? '').slice(0, 256)) : [];
+        const accepted = sshService.submitKeyboardPrompt(body.id || '', answers);
+        if (!accepted) return writeJson(res, 404, { ok: false, error: 'No authentication prompt is waiting' });
+        writeJson(res, 200, { ok: true });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /auth/keyboard');
+
+
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/profiles/test-group',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const body = await readBody(req);
+        const ids = Array.isArray(body.ids) ? body.ids.map((item) => String(item)) : [];
+        const selected = ids.map((id) => store.getProfile(id)).filter(Boolean);
+        const results = await testProfileGroup(selected, (profile) => sshService.testConnection(profile));
+        writeJson(res, 200, { ok: true, results });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /profiles/test-group');
+
+
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/cluster',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const body = await readBody(req);
+        if (!body.command || typeof body.command !== 'string') return writeJson(res, 400, { ok: false, error: 'Command is required' });
+        const selected = filterClusterProfiles(store.getProfiles(), {
+          environment: body.environment,
+          tags: Array.isArray(body.tags) ? body.tags : [],
+          aliases: Array.isArray(body.aliases) ? body.aliases : []
+        });
+        const results = await runCluster(selected, body.command, {
+          maxWorkers: body.maxWorkers,
+          exec: (profile, command) => sshService.exec(profile, command, { timeout: 60, cleanAnsi: true })
+        });
+        writeJson(res, 200, { ok: true, results });
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /cluster');
+
   // 6. POST /dsh-remote-workspace/test
   sctx.effect(() => webServer.register({
     kind: 'exact',