@goodandready/dsh-remote-workspace 0.3.8 → 0.3.10

package/lib/cluster-service.js

@@ -0,0 +1,57 @@
+export function filterClusterProfiles(profiles, filter = {}) {
+  const aliases = new Set((filter.aliases || []).map((item) => String(item)));
+  const tags = (filter.tags || []).map((item) => String(item).toLowerCase()).filter(Boolean);
+  const environment = String(filter.environment || '').trim().toLowerCase();
+  return (profiles || []).filter((profile) => {
+    if (aliases.size && !aliases.has(String(profile.id)) && !aliases.has(String(profile.name || ''))) return false;
+    if (environment && String(profile.environment || '').toLowerCase() !== environment) return false;
+    if (tags.length) {
+      const have = (Array.isArray(profile.tags) ? profile.tags : []).map((item) => String(item).toLowerCase());
+      if (!tags.every((tag) => have.includes(tag))) return false;
+    }
+    return true;
+  });
+}
+
+export async function runCluster(profiles, command, options = {}) {
+  const list = profiles || [];
+  if (!list.length) return [];
+  const limit = Math.max(1, Math.min(Number(options.maxWorkers) || 8, list.length));
+  const exec = options.exec;
+  const results = new Array(list.length);
+  let cursor = 0;
+  const worker = async () => {
+    while (cursor < list.length) {
+      const index = cursor;
+      cursor += 1;
+      const profile = list[index];
+      const started = Date.now();
+      try {
+        const res = await exec(profile, command);
+        results[index] = {
+          alias: profile.name || profile.id || '',
+          host: profile.host || '',
+          success: (res.code ?? 0) === 0,
+          exitCode: res.code ?? 0,
+          durationMs: Date.now() - started,
+          stdout: res.stdout || '',
+          stderr: res.stderr || '',
+          error: ''
+        };
+      } catch (err) {
+        results[index] = {
+          alias: profile.name || profile.id || '',
+          host: profile.host || '',
+          success: false,
+          exitCode: null,
+          durationMs: Date.now() - started,
+          stdout: '',
+          stderr: '',
+          error: err && err.message ? err.message : 'failed'
+        };
+      }
+    }
+  };
+  await Promise.all(Array.from({ length: limit }, () => worker()));
+  return results;
+}

package/lib/exec-retry.js

@@ -0,0 +1,24 @@
+export function isRetryableConnectionError(err) {
+  if (!err || err.commandTimeout) return false;
+  if (err.stdout) return false;
+  const code = err.code || '';
+  if (['ECONNRESET', 'ETIMEDOUT', 'EHOSTUNREACH', 'ENOTFOUND', 'EPIPE'].includes(code)) return true;
+  return /connection reset|not connected|No response from server|socket hang up/i.test(String(err.message || ''));
+}
+
+export async function runWithReconnect(run, options = {}) {
+  const attempts = options.idempotent === false ? 1 : 3;
+  const wait = options.wait || ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  let lastError = null;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      return await run();
+    } catch (err) {
+      lastError = err;
+      if (attempt >= attempts || !isRetryableConnectionError(err)) throw err;
+      if (options.onRetry) options.onRetry(err, attempt);
+      await wait(50 * attempt);
+    }
+  }
+  throw lastError;
+}

package/lib/file-transfer.js

@@ -0,0 +1,56 @@
+const MAX_BYTES = 512 * 1024 * 1024;
+
+export function transferPercent(loaded, total) {
+  const done = Number(loaded) || 0;
+  const size = Number(total) || 0;
+  if (size <= 0) return 0;
+  return Math.max(0, Math.min(100, Math.round((done / size) * 100)));
+}
+
+export function attachmentName(filePath) {
+  const base = String(filePath || '').split('/').filter(Boolean).pop() || 'download';
+  const clean = base.replace(/[\r\n"\\]/g, '');
+  if (!clean || clean === '.' || clean === '..') return 'download';
+  return clean.slice(0, 180);
+}
+
+export function contentDisposition(filePath) {
+  const name = attachmentName(filePath);
+  const ascii = name.replace(/[^\x20-\x7E]/g, '_') || 'download';
+  return `attachment; filename="${ascii}"; filename*=UTF-8''${encodeURIComponent(name)}`;
+}
+
+export function pipeWithProgress(source, dest) {
+  return new Promise((resolve, reject) => {
+    let loaded = 0;
+    let settled = false;
+    const finish = (err) => {
+      if (settled) return;
+      settled = true;
+      if (err) reject(err);
+      else resolve(loaded);
+    };
+    source.on('data', (chunk) => {
+      loaded += chunk.length;
+      if (loaded > MAX_BYTES) {
+        const err = new Error('File exceeds the 512MB transfer limit');
+        err.code = 'LIMIT';
+        source.destroy();
+        dest.destroy();
+        finish(err);
+      }
+    });
+    source.on('error', finish);
+    dest.on('error', finish);
+    dest.on('finish', () => finish());
+    source.on('aborted', () => {
+      const err = new Error('Transfer aborted');
+      err.code = 'ABORTED';
+      dest.destroy();
+      finish(err);
+    });
+    source.pipe(dest);
+  });
+}
+
+export { MAX_BYTES };

package/lib/host-projection.js

@@ -0,0 +1,42 @@
+const SECRET = ['password', 'privateKey', 'privateKeyPath', 'passphrase', 'agentPath', 'proxyCommand'];
+
+/**
+ * One host row safe to place in a model context.
+ * @param {any} profile
+ */
+export function toAgentHostRow(profile) {
+  const jump = Boolean(
+    (typeof profile?.jumpHostId === 'string' && profile.jumpHostId.trim())
+    || (Array.isArray(profile?.jumpHosts) && profile.jumpHosts.length)
+  );
+  const proxy = Boolean(typeof profile?.proxyCommand === 'string' && profile.proxyCommand.trim());
+  const access = [jump ? 'jump' : '', proxy ? 'proxy' : ''].filter(Boolean).join(',') || 'direct';
+  return {
+    alias: String(profile?.name || profile?.id || ''),
+    host: String(profile?.host || ''),
+    port: profile?.port || 22,
+    user: String(profile?.username || ''),
+    auth: String(profile?.authType || 'key'),
+    access,
+    env: String(profile?.environment || ''),
+    tags: Array.isArray(profile?.tags) ? profile.tags.map((item) => String(item)).join(',') : '',
+    description: String(profile?.description || '')
+  };
+}
+
+/**
+ * @param {any[]} profiles
+ */
+export function renderHostTable(profiles) {
+  const header = 'alias | host | port | user | auth | jump/proxy | env | tags | description';
+  const lines = (profiles || []).map((profile) => {
+    const row = toAgentHostRow(profile);
+    return [row.alias, row.host, row.port, row.user, row.auth, row.access, row.env, row.tags, row.description].join(' | ');
+  });
+  return [header, ...lines].join('\n');
+}
+
+export function hostProjectionLeaks(value) {
+  const text = typeof value === 'string' ? value : JSON.stringify(value);
+  return SECRET.some((key) => text.includes(key));
+}

package/lib/index.js

@@ -1,4 +1,5 @@
 import z from '@deepseek-ai/schemastery';
+import { normalizeTerminalFont } from './terminal-font.js';
 import { VaultService } from './vault-service.js';
 import { SshService } from './ssh-service.js';
 import { RemoteFsService } from './remote-fs-service.js';
@@ -28,17 +29,25 @@ export const Config = z.object({
     port: z.number().default(22),
     username: z.string().default('root'),
     authType: z.string().default('key'),
+    agentPath: z.string().default(''),
     privateKeyPath: z.string().default(''),
     privateKey: z.string().default(''),
     passphrase: z.string().default(''),
     password: z.string().default(''),
     remoteWorkspace: z.string().default(''),
     localMirrorPath: z.string().default(''),
-    jumpHostId: z.string().default('')
+    jumpHostId: z.string().default(''),
+    jumpHosts: z.array(z.string()).default([]),
+    proxyCommand: z.string().default(''),
+    environment: z.string().default(''),
+    tags: z.array(z.string()).default([]),
+    location: z.string().default(''),
+    description: z.string().default('')
   })).default([]).description('List of configured remote machines and workspaces.'),
   activeProfileId: z.string().default('').description('ID of active remote profile.'),
   autoSyncActive: z.boolean().default(false).description('Whether Live Auto-Sync watcher is enabled.'),
-  alertMonitoringActive: z.boolean().default(false).description('Whether background anomaly alerts are monitored.')
+  alertMonitoringActive: z.boolean().default(false).description('Whether background anomaly alerts are monitored.'),
+  terminalFontFamily: z.string().default('').description('CSS font family used by the terminal. Empty keeps the default monospace stack.')
 });
 
 export function apply(ctx, config = {}) {
@@ -48,11 +57,14 @@ export function apply(ctx, config = {}) {
     profiles: Array.isArray(cfg.profiles) ? cfg.profiles : [],
     activeProfileId: cfg.activeProfileId || null,
     autoSyncActive: Boolean(cfg.autoSyncActive),
-    alertMonitoringActive: Boolean(cfg.alertMonitoringActive)
+    alertMonitoringActive: Boolean(cfg.alertMonitoringActive),
+    terminalFontFamily: typeof cfg.terminalFontFamily === 'string' ? cfg.terminalFontFamily : ''
   };
 
   const vaultService = new VaultService();
   const sshService = new SshService(ctx, vaultService);
+  const idleTimer = setInterval(() => sshService.sweepIdle(), 60 * 1000);
+  idleTimer.unref?.();
   const remoteFs = new RemoteFsService(sshService);
   const mirrorSync = new MirrorSyncService(remoteFs, sshService);
   const tunnelService = new TunnelService(sshService);
@@ -111,6 +123,12 @@ export function apply(ctx, config = {}) {
       return p ? vaultService.hydrateProfile(p) : undefined;
     },
     isAutoSyncEnabled() { return Boolean(currentConfig.autoSyncActive); },
+    getTerminalFont() { return currentConfig.terminalFontFamily || ''; },
+    async setTerminalFont(fontFamily) {
+      currentConfig.terminalFontFamily = normalizeTerminalFont(fontFamily);
+      await persistConfig('terminal-font');
+      return currentConfig.terminalFontFamily;
+    },
     async setAutoSyncEnabled(enabled) {
       currentConfig.autoSyncActive = Boolean(enabled);
       const active = store.getActiveProfile();
@@ -264,7 +282,8 @@ export function apply(ctx, config = {}) {
     dockerService,
     diagnoseService,
     envService,
-    tarSyncService
+    tarSyncService,
+    () => store.getProfiles()
   );
 
   // API Routes
@@ -286,6 +305,7 @@ export function apply(ctx, config = {}) {
 
   // Cleanup on unload
   ctx.on('dispose', () => {
+    clearInterval(idleTimer);
     alertService.stop();
     watcherService.stopAll();
     tunnelService.stopAll();

package/lib/jump-chain.js

@@ -0,0 +1,56 @@
+/**
+ * Jump ids from an explicit list, or from a comma-separated jumpHostId.
+ * @param {any} profile
+ * @returns {string[]}
+ */
+export function resolveJumpHops(profile) {
+  if (Array.isArray(profile?.jumpHosts) && profile.jumpHosts.length) {
+    return profile.jumpHosts.map((item) => String(item).trim()).filter(Boolean);
+  }
+  if (typeof profile?.jumpHostId === 'string' && profile.jumpHostId.trim()) {
+    return profile.jumpHostId.split(',').map((item) => item.trim()).filter(Boolean);
+  }
+  return [];
+}
+
+/**
+ * @param {any} client
+ * @param {string} host
+ * @param {number} port
+ */
+export function forwardOut(client, host, port) {
+  return new Promise((resolve, reject) => {
+    client.forwardOut('127.0.0.1', 0, host, port || 22, (err, stream) => {
+      if (err) reject(err);
+      else resolve(stream);
+    });
+  });
+}
+
+/**
+ * Connect through bastions in order. Only clients created after the first hop
+ * are released with the target; the first hop stays in the shared pool.
+ */
+export async function openJumpChain(target, hopProfiles, deps) {
+  if (!hopProfiles.length) throw new Error('Jump chain is empty');
+  const intermediates = [];
+  const release = () => {
+    for (const extra of intermediates) {
+      try { extra.end(); } catch { /* already closed */ }
+    }
+  };
+  try {
+    let client = await deps.connectPooled(hopProfiles[0]);
+    for (let i = 1; i < hopProfiles.length; i += 1) {
+      const hop = hopProfiles[i];
+      const stream = await forwardOut(client, hop.host, hop.port || 22);
+      client = await deps.connectDedicated(hop, stream);
+      intermediates.push(client);
+    }
+    const sock = await forwardOut(client, target.host, target.port || 22);
+    return { sock, release };
+  } catch (err) {
+    release();
+    throw err;
+  }
+}

package/lib/poll-gate.js

@@ -0,0 +1,5 @@
+export function shouldPoll({ hidden = false, inFlight = false } = {}) {
+  if (hidden) return false;
+  if (inFlight) return false;
+  return true;
+}

package/lib/profile-groups.js

@@ -0,0 +1,60 @@
+export function normalizeTags(value) {
+  if (Array.isArray(value)) return value.map((item) => String(item).trim()).filter(Boolean);
+  return String(value || '').split(',').map((item) => item.trim()).filter(Boolean);
+}
+
+function bucket(map, key, profile) {
+  const name = key || 'ungrouped';
+  if (!map.has(name)) map.set(name, []);
+  map.get(name).push(profile);
+}
+
+export function groupProfiles(profiles, mode) {
+  const list = Array.isArray(profiles) ? profiles : [];
+  if (mode === 'environment') {
+    const map = new Map();
+    for (const profile of list) bucket(map, String(profile.environment || '').trim(), profile);
+    return [...map.entries()].map(([key, items]) => ({ key, items }));
+  }
+  if (mode === 'tag') {
+    const map = new Map();
+    for (const profile of list) {
+      const tags = normalizeTags(profile.tags);
+      if (!tags.length) bucket(map, '', profile);
+      else for (const tag of tags) bucket(map, tag, profile);
+    }
+    return [...map.entries()].map(([key, items]) => ({ key, items }));
+  }
+  return [{ key: 'all', items: list }];
+}
+
+export async function testProfileGroup(profiles, testOne) {
+  const results = [];
+  const queue = [...(profiles || [])];
+  const workers = Array.from({ length: Math.min(4, Math.max(queue.length, 1)) }, async () => {
+    while (queue.length) {
+      const profile = queue.shift();
+      if (!profile) return;
+      const started = Date.now();
+      try {
+        const result = await testOne(profile);
+        results.push({
+          id: profile.id,
+          name: profile.name || profile.host,
+          ok: true,
+          latencyMs: result.latencyMs ?? result.latency ?? (Date.now() - started)
+        });
+      } catch (err) {
+        results.push({
+          id: profile.id,
+          name: profile.name || profile.host,
+          ok: false,
+          error: err && err.message ? err.message : 'Connection failed'
+        });
+      }
+    }
+  });
+  if (!queue.length) return results;
+  await Promise.all(workers);
+  return results;
+}

package/lib/proxy-command.js

@@ -0,0 +1,53 @@
+import { spawn } from 'node:child_process';
+import { Duplex } from 'node:stream';
+
+const TOKEN = /%[%hprn]/g;
+
+/**
+ * Expand OpenSSH ProxyCommand tokens. %% stays a literal percent.
+ * @param {string} template
+ * @param {{ host?: string, port?: number|string, user?: string, alias?: string }} tokens
+ */
+export function expandProxyCommand(template, tokens = {}) {
+  const map = {
+    '%h': String(tokens.host ?? ''),
+    '%p': String(tokens.port ?? ''),
+    '%r': String(tokens.user ?? ''),
+    '%n': String(tokens.alias ?? ''),
+    '%%': '%'
+  };
+  return String(template ?? '').replace(TOKEN, (token) => (token in map ? map[token] : token));
+}
+
+/**
+ * Run a ProxyCommand and expose its stdio as a duplex socket for ssh2.
+ * POSIX uses `$SHELL -c`; Windows uses `cmd.exe /d /s /c`.
+ * @param {string} command
+ */
+export function openProxyCommand(command) {
+  const windows = process.platform === 'win32';
+  const shell = windows ? (process.env.ComSpec || 'cmd.exe') : (process.env.SHELL || '/bin/sh');
+  const args = windows ? ['/d', '/s', '/c', command] : ['-c', command];
+  const child = spawn(shell, args, { stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true });
+  const sock = Duplex.from({ writable: child.stdin, readable: child.stdout });
+  let stopped = false;
+
+  const stop = () => {
+    if (stopped) return;
+    stopped = true;
+    if (child.exitCode !== null || child.signalCode) return;
+    child.kill('SIGTERM');
+    const timer = setTimeout(() => {
+      if (child.exitCode === null && !child.signalCode) child.kill('SIGKILL');
+    }, 2000);
+    timer.unref?.();
+    child.once('exit', () => clearTimeout(timer));
+  };
+
+  sock.on('close', stop);
+  child.on('error', (err) => sock.destroy(err));
+  child.on('exit', () => {
+    if (!sock.destroyed) sock.destroy();
+  });
+  return { sock, child, stop };
+}

package/lib/remote-fs-service.js

@@ -117,6 +117,31 @@ export class RemoteFsService {
     return sftp.createReadStream(remotePath);
   }
 
+  async beginUpload(profile, remotePath) {
+    const sftp = await this.sshService.getSftp(profile);
+    const tempPath = `${remotePath}.dsh-tmp.${Date.now()}`;
+    const stream = sftp.createWriteStream(tempPath);
+    return {
+      stream,
+      commit() {
+        return new Promise((resolve, reject) => {
+          sftp.rename(tempPath, remotePath, (err) => {
+            if (err) {
+              sftp.unlink(tempPath, () => {});
+              return reject(err);
+            }
+            resolve();
+          });
+        });
+      },
+      abort() {
+        return new Promise((resolve) => {
+          sftp.unlink(tempPath, () => resolve());
+        });
+      }
+    };
+  }
+
   /**
    * Atomic file write using temp file and rename
    */

package/lib/routes/docker.js

@@ -1,4 +1,4 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
 
 export function registerDockerRoutes(sctx, webServer, { dockerService, healthService, store }) {
   // 21. GET /dsh-remote-workspace/health
@@ -7,7 +7,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
     path: '/dsh-remote-workspace/health',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const url = new URL(req.url, 'http://localhost');
         const profileId = url.searchParams.get('profileId');
@@ -17,7 +17,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
         const health = await healthService.getHealth(profile);
         writeJson(res, 200, { ok: true, health });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /health');
@@ -28,7 +28,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
     path: '/dsh-remote-workspace/docker/list',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const url = new URL(req.url, 'http://localhost');
         const profileId = url.searchParams.get('profileId');
@@ -38,7 +38,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
         const result = await dockerService.listContainers(profile, true);
         writeJson(res, 200, { ok: true, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /docker/list');
@@ -49,7 +49,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
     path: '/dsh-remote-workspace/docker/action',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, containerId, action } = await readBody(req);
         const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
@@ -59,7 +59,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
         const result = await dockerService.containerAction(profile, containerId, action);
         writeJson(res, 200, { ok: result.success, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /docker/action');
@@ -70,7 +70,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
     path: '/dsh-remote-workspace/docker/logs',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, containerId, tail } = await readBody(req);
         const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
@@ -80,7 +80,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
         const result = await dockerService.containerLogs(profile, containerId, tail || 100);
         writeJson(res, 200, { ok: result.success, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /docker/logs');

package/lib/routes/env.js

@@ -1,4 +1,4 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
 
 export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService, sshService, store }) {
   // 10. POST /dsh-remote-workspace/env/view
@@ -7,7 +7,7 @@ export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService
     path: '/dsh-remote-workspace/env/view',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, remotePath } = await readBody(req);
         const profile = store.getProfile(profileId);
@@ -15,7 +15,7 @@ export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService
         const result = await envService.readRemoteEnv(sshService, profile, remotePath);
         writeJson(res, 200, { ok: true, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /env/view');
@@ -26,7 +26,7 @@ export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService
     path: '/dsh-remote-workspace/env/save',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, remotePath, content } = await readBody(req);
         const profile = store.getProfile(profileId);
@@ -34,7 +34,7 @@ export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService
         const result = await envService.saveRemoteEnv(sshService, profile, remotePath, content);
         writeJson(res, 200, { ok: true, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /env/save');
@@ -45,7 +45,7 @@ export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService
     path: '/dsh-remote-workspace/diagnose',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, checks } = await readBody(req);
         const profile = store.getProfile(profileId);
@@ -53,7 +53,7 @@ export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService
         const results = await diagnoseService.diagnose(sshService, profile, checks);
         writeJson(res, 200, { ok: true, results });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /diagnose');