@goodandready/dsh-remote-workspace 0.3.8 → 0.3.9

package/lib/routes/terminal.js

@@ -1,6 +1,25 @@
 import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { normalizeTerminalFont } from '../terminal-font.js';
 
 export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
+
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/terminal/font',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      try {
+        const body = await readBody(req);
+        const fontFamily = await store.setTerminalFont(body.fontFamily);
+        writeJson(res, 200, { ok: true, terminalFontFamily: fontFamily });
+      } catch (err) {
+        const status = err.code === 'INVALID_FONT' ? 400 : 500;
+        writeJson(res, status, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /terminal/font');
+
   // 13. POST /dsh-remote-workspace/terminal/create
   sctx.effect(() => webServer.register({
     kind: 'exact',

package/lib/ssh-config-parser.js

@@ -2,45 +2,121 @@ import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 
+function expandHome(value) {
+  if (value.startsWith('~')) return path.join(os.homedir(), value.slice(1));
+  return value;
+}
+
+function defaultExpandInclude(pattern, baseDir) {
+  const expanded = expandHome(pattern);
+  const full = path.isAbsolute(expanded) ? expanded : path.join(baseDir, expanded);
+  if (full.includes('*') || full.includes('?')) {
+    return fs.globSync(full, { windowsPathsNoEscape: true })
+      .filter((file) => {
+        try { return fs.statSync(file).isFile(); } catch { return false; }
+      })
+      .sort();
+  }
+  return fs.existsSync(full) ? [full] : [];
+}
+
 export class SshConfigParser {
   /**
-   * Parse ssh config string into DSH remote profiles
    * @param {string} text
-   * @returns {Array<any>}
+   * @param {{ baseDir?: string, expandInclude?: Function, readFile?: Function, seen?: Set<string>, knownIds?: Set<string> }} [options]
    */
-  static parse(text) {
-    if (!text || typeof text !== 'string') return [];
+  static parse(text, options = {}) {
+    return this.parseReport(text, options).profiles;
+  }
 
-    const lines = text.split('\n');
+  static parseReport(text, options = {}) {
+    const baseDir = options.baseDir || path.join(os.homedir(), '.ssh');
+    const expandInclude = options.expandInclude || ((pattern) => defaultExpandInclude(pattern, baseDir));
+    const readFile = options.readFile || ((file) => fs.readFileSync(file, 'utf8'));
+    const seen = options.seen || new Set();
+    const known = options.knownIds || new Set();
     const profiles = [];
+    const skipped = [];
     let current = null;
 
-    for (let rawLine of lines) {
+    const pushCurrent = () => {
+      if (!current || !current.host) {
+        current = null;
+        return;
+      }
+      if (known.has(current.id)) {
+        skipped.push({ name: current.name, reason: 'duplicate' });
+      } else {
+        known.add(current.id);
+        profiles.push(current);
+      }
+      current = null;
+    };
+
+    const lines = String(text || '').split('\n');
+    for (const rawLine of lines) {
       const line = rawLine.trim();
       if (!line || line.startsWith('#')) continue;
-
-      // Key Value pair (can be separated by whitespace or '=')
       const match = line.match(/^(\w+)(?:\s+|=)(.+)$/);
       if (!match) continue;
-
       const key = match[1].toLowerCase();
       const val = match[2].trim().replace(/^["']|["']$/g, '');
 
-      if (key === 'host') {
-        // Skip wildcards like Host *
-        if (val === '*' || val.includes('*') || val.includes('?')) {
-          current = null;
+      if (key === 'include') {
+        pushCurrent();
+        const files = expandInclude(val, baseDir);
+        if (!files.length) {
+          skipped.push({ name: val, reason: 'missing-include' });
           continue;
         }
-
-        if (current && current.host) {
-          profiles.push(current);
+        for (const file of files) {
+          const abs = path.resolve(file);
+          if (seen.has(abs)) {
+            skipped.push({ name: abs, reason: 'duplicate' });
+            continue;
+          }
+          seen.add(abs);
+          let nested = '';
+          try { nested = readFile(abs); } catch {
+            skipped.push({ name: abs, reason: 'missing-include' });
+            continue;
+          }
+          const child = this.parseReport(nested, {
+            baseDir: path.dirname(abs),
+            expandInclude: options.expandInclude,
+            readFile,
+            seen,
+            knownIds: known
+          });
+          profiles.push(...child.profiles);
+          skipped.push(...child.skipped);
         }
+        continue;
+      }
+
+      if (key === 'match') {
+        pushCurrent();
+        skipped.push({ name: val, reason: 'match' });
+        continue;
+      }
 
+      if (key === 'host') {
+        pushCurrent();
+        const names = val.split(/\s+/).filter(Boolean);
+        const concrete = [];
+        for (const name of names) {
+          if (name === '*' || name.includes('*') || name.includes('?')) {
+            skipped.push({ name, reason: 'wildcard' });
+          } else {
+            concrete.push(name);
+          }
+        }
+        if (!concrete.length) continue;
+        const name = concrete[0];
         current = {
-          id: `ssh-cfg-${val.toLowerCase().replace(/[^a-z0-9_-]/g, '-')}`,
-          name: val,
-          host: val,
+          id: `ssh-cfg-${name.toLowerCase().replace(/[^a-z0-9_-]/g, '-')}`,
+          name,
+          host: name,
           port: 22,
           username: os.userInfo().username || 'root',
           authType: 'key',
@@ -48,42 +124,28 @@ export class SshConfigParser {
           remoteProjectDir: '/root',
           jumpHostId: ''
         };
-      } else if (current) {
-        if (key === 'hostname') {
-          current.host = val;
-        } else if (key === 'user') {
-          current.username = val;
-        } else if (key === 'port') {
-          const p = parseInt(val, 10);
-          if (p > 0 && p < 65536) current.port = p;
-        } else if (key === 'identityfile') {
-          current.authType = 'key';
-          current.privateKey = val;
-        } else if (key === 'proxyjump') {
-          current.jumpHostId = val;
-        }
+        continue;
       }
-    }
 
-    if (current && current.host) {
-      profiles.push(current);
+      if (!current) continue;
+      if (key === 'hostname') current.host = val;
+      else if (key === 'user') current.username = val;
+      else if (key === 'port') {
+        const port = parseInt(val, 10);
+        if (port > 0 && port < 65536) current.port = port;
+      } else if (key === 'identityfile') {
+        current.authType = 'key';
+        current.privateKey = val;
+      } else if (key === 'proxyjump') current.jumpHostId = val;
+      else if (key === 'proxycommand') current.proxyCommand = val;
     }
-
-    return profiles;
+    pushCurrent();
+    return { profiles, skipped };
   }
 
-  /**
-   * Load local default ~/.ssh/config if exists
-   */
   static readDefaultConfig() {
     const configPath = path.join(os.homedir(), '.ssh', 'config');
-    if (fs.existsSync(configPath)) {
-      try {
-        return fs.readFileSync(configPath, 'utf8');
-      } catch {
-        return '';
-      }
-    }
-    return '';
+    if (!fs.existsSync(configPath)) return '';
+    try { return fs.readFileSync(configPath, 'utf8'); } catch { return ''; }
   }
 }

package/lib/ssh-service.js

@@ -2,6 +2,10 @@ import { Client } from 'ssh2';
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
+import { expandProxyCommand, openProxyCommand } from './proxy-command.js';
+import { openJumpChain, resolveJumpHops } from './jump-chain.js';
+import { resolveAgentEndpoint } from './agent-endpoint.js';
+import { runWithReconnect } from './exec-retry.js';
 
 /**
  * Utility to strip ANSI escape sequences from terminal output for clean LLM ingestion
@@ -25,6 +29,11 @@ export class SshService {
     this.sftpSessions = new Map();
     /** @type {Map<string, any>} */
     this.terminalSessions = new Map();
+    /** @type {Map<string, { view: any, finish: Function, timer: NodeJS.Timeout }>} */
+    this.authPrompts = new Map();
+    /** @type {Map<string, { lastUsed: number, inFlight: number, pinned: boolean }>} */
+    this.connMeta = new Map();
+    this.idleTimeoutMs = 30 * 60 * 1000;
     this.getJumpProfile = null;
   }
 
@@ -51,6 +60,86 @@ export class SshService {
     this.getJumpProfile = resolver;
   }
 
+
+  touch(profileId) {
+    if (!profileId) return;
+    const meta = this.connMeta.get(profileId) || { lastUsed: 0, inFlight: 0, pinned: false };
+    meta.lastUsed = Date.now();
+    this.connMeta.set(profileId, meta);
+  }
+
+  bumpInFlight(profileId, delta) {
+    if (!profileId) return;
+    const meta = this.connMeta.get(profileId) || { lastUsed: Date.now(), inFlight: 0, pinned: false };
+    meta.inFlight = Math.max(0, (meta.inFlight || 0) + delta);
+    meta.lastUsed = Date.now();
+    this.connMeta.set(profileId, meta);
+  }
+
+  setPinned(profileId, pinned) {
+    if (!profileId) return;
+    const meta = this.connMeta.get(profileId) || { lastUsed: Date.now(), inFlight: 0, pinned: false };
+    meta.pinned = Boolean(pinned);
+    this.connMeta.set(profileId, meta);
+  }
+
+  sweepIdle(now = Date.now()) {
+    const closed = [];
+    for (const [id] of this.connections) {
+      const meta = this.connMeta.get(id) || { lastUsed: now, inFlight: 0, pinned: false };
+      if (meta.pinned || meta.inFlight > 0) continue;
+      if (now - meta.lastUsed < this.idleTimeoutMs) continue;
+      this.disconnect(id);
+      this.connMeta.delete(id);
+      closed.push(id);
+    }
+    return closed;
+  }
+
+  connectDedicated(profile, sock) {
+    const hydrated = this.vaultService ? this.vaultService.hydrateProfile(profile) : profile;
+    return this._dial(hydrated, sock, null, false);
+  }
+
+  beginKeyboardPrompt(profileId, view, finish, timeoutMs = 60000) {
+    const id = profileId || '';
+    this.clearKeyboardPrompt(id);
+    const timer = setTimeout(() => {
+      if (!this.authPrompts.has(id)) return;
+      this.authPrompts.delete(id);
+      try { finish([]); } catch { /* the attempt already ended */ }
+    }, timeoutMs);
+    timer.unref?.();
+    this.authPrompts.set(id, { view, finish, timer });
+  }
+
+  listKeyboardPrompts() {
+    return [...this.authPrompts.entries()].map(([profileId, pending]) => ({
+      profileId,
+      instructions: pending.view.instructions,
+      prompts: pending.view.prompts
+    }));
+  }
+
+  submitKeyboardPrompt(profileId, answers) {
+    const pending = this.authPrompts.get(profileId || '');
+    if (!pending) return false;
+    clearTimeout(pending.timer);
+    this.authPrompts.delete(profileId || '');
+    const values = Array.isArray(answers) ? answers.map((item) => String(item ?? '')) : [];
+    pending.finish(values);
+    return true;
+  }
+
+  clearKeyboardPrompt(profileId) {
+    const pending = this.authPrompts.get(profileId || '');
+    if (!pending) return;
+    clearTimeout(pending.timer);
+    this.authPrompts.delete(profileId || '');
+  }
+
+
+
   resolvePrivateKey(profile) {
     if (profile.privateKey && profile.privateKey.trim()) {
       return profile.privateKey;
@@ -78,27 +167,49 @@ export class SshService {
 
     const existing = this.connections.get(connId);
     if (existing && existing._sock && !existing._sock.destroyed) {
+      this.touch(connId);
       return existing;
     }
 
     this.connections.delete(connId);
     this.sftpSessions.delete(connId);
 
-    // If jumpHost is configured, obtain socket through the jump host first
+    // ProxyCommand replaces a direct TCP socket. A jump host is used only when no command is set.
     let sock = undefined;
-    if (profile.jumpHostId && this.getJumpProfile) {
-      const jumpProfile = this.getJumpProfile(profile.jumpHostId);
-      if (jumpProfile) {
-        const jumpConn = await this.getConnection(jumpProfile);
-        sock = await new Promise((resolve, reject) => {
-          jumpConn.forwardOut('127.0.0.1', 0, profile.host, profile.port || 22, (err, stream) => {
-            if (err) return reject(new Error(`ProxyJump via ${jumpProfile.host} failed: ${err.message}`));
-            resolve(stream);
-          });
+    let releaseTransport = null;
+    const proxyCommand = typeof profile.proxyCommand === 'string' ? profile.proxyCommand.trim() : '';
+    if (proxyCommand) {
+      const expanded = expandProxyCommand(proxyCommand, {
+        host: profile.host,
+        port: profile.port || 22,
+        user: profile.username || 'root',
+        alias: profile.name || profile.id || ''
+      });
+      const opened = openProxyCommand(expanded);
+      sock = opened.sock;
+      releaseTransport = opened.stop;
+    } else {
+      const hopIds = resolveJumpHops(profile);
+      if (hopIds.length && this.getJumpProfile) {
+        const hopProfiles = hopIds.map((id) => {
+          const hop = this.getJumpProfile(id);
+          if (!hop) throw new Error(`Jump host "${id}" was not found`);
+          return hop;
+        });
+        const opened = await openJumpChain(profile, hopProfiles, {
+          connectPooled: (hop) => this.getConnection(hop),
+          connectDedicated: (hop, stream) => this.connectDedicated(hop, stream)
         });
+        sock = opened.sock;
+        releaseTransport = opened.release;
       }
     }
 
+    return this._dial(profile, sock, releaseTransport, true);
+  }
+
+  _dial(profile, sock, releaseTransport, pool) {
+    const connId = profile.id;
     return new Promise((resolve, reject) => {
       const conn = new Client();
       const connConfig = {
@@ -107,7 +218,8 @@ export class SshService {
         username: profile.username || 'root',
         keepaliveInterval: 15000,
         keepaliveCountMax: 3,
-        readyTimeout: 20000
+        readyTimeout: 20000,
+        tryKeyboard: true
       };
 
       if (sock) {
@@ -117,7 +229,8 @@ export class SshService {
       if (profile.authType === 'password') {
         connConfig.password = profile.password || '';
       } else if (profile.authType === 'agent') {
-        connConfig.agent = process.env.SSH_AUTH_SOCK;
+        const agent = resolveAgentEndpoint(profile);
+        if (agent) connConfig.agent = agent;
       } else {
         const privateKey = this.resolvePrivateKey(profile);
         if (privateKey) {
@@ -130,20 +243,39 @@ export class SshService {
         }
       }
 
+      conn.on('keyboard-interactive', (_name, instructions, _lang, prompts, finish) => {
+        this.beginKeyboardPrompt(profile.id, {
+          instructions: String(instructions || ''),
+          prompts: (prompts || []).map((item) => ({
+            prompt: String(item.prompt || ''),
+            echo: Boolean(item.echo)
+          }))
+        }, finish);
+      });
+
       conn.on('ready', () => {
-        this.connections.set(connId, conn);
+        if (pool && connId) {
+          this.connections.set(connId, conn);
+          this.touch(connId);
+        }
         resolve(conn);
       });
 
       conn.on('error', (err) => {
-        this.connections.delete(connId);
-        this.sftpSessions.delete(connId);
+        if (releaseTransport) releaseTransport();
+        if (pool) {
+          this.connections.delete(connId);
+          this.sftpSessions.delete(connId);
+        }
         reject(err);
       });
 
       conn.on('close', () => {
-        this.connections.delete(connId);
-        this.sftpSessions.delete(connId);
+        if (releaseTransport) releaseTransport();
+        if (pool && this.connections.get(connId) === conn) {
+          this.connections.delete(connId);
+          this.sftpSessions.delete(connId);
+        }
       });
 
       conn.connect(connConfig);
@@ -201,6 +333,17 @@ export class SshService {
   }
 
   async exec(profile, command, optionsOrCwd = null, legacyOnData = null) {
+    const idempotent = !(optionsOrCwd && typeof optionsOrCwd === 'object' && optionsOrCwd.idempotent === false);
+    return runWithReconnect(
+      () => this.execAttempt(profile, command, optionsOrCwd, legacyOnData),
+      {
+        idempotent,
+        onRetry: () => this.disconnect(profile && profile.id)
+      }
+    );
+  }
+
+  async execAttempt(profile, command, optionsOrCwd = null, legacyOnData = null) {
     let cwd = null;
     let onData = legacyOnData;
     let pty = false;
@@ -217,7 +360,14 @@ export class SshService {
       cleanAnsi = Boolean(optionsOrCwd.cleanAnsi);
     }
 
-    const conn = await this.getConnection(profile);
+    this.bumpInFlight(profile.id, 1);
+    let conn;
+    try {
+    conn = await this.getConnection(profile);
+    } catch (err) {
+      this.bumpInFlight(profile.id, -1);
+      throw err;
+    }
     const shellCmd = cwd ? `cd ${JSON.stringify(cwd)} && ${command}` : command;
 
     const execOptions = {};
@@ -233,7 +383,10 @@ export class SshService {
       let timer = null;
 
       conn.exec(shellCmd, execOptions, (err, stream) => {
-        if (err) return reject(err);
+        if (err) {
+          this.bumpInFlight(profile.id, -1);
+          return reject(err);
+        }
         let stdout = '';
         let stderr = '';
 
@@ -244,7 +397,8 @@ export class SshService {
               stream.close();
             } catch (err) { /* best-effort cleanup */ }
             const errTimeout = new Error(`Command timed out after ${timeoutMs / 1000}s: ${command}`);
-            errTimeout.code = 'ETIMEDOUT';
+            errTimeout.code = 'COMMAND_TIMEOUT';
+            errTimeout.commandTimeout = true;
             errTimeout.stdout = cleanAnsi ? stripAnsi(stdout) : stdout;
             errTimeout.stderr = cleanAnsi ? stripAnsi(stderr) : stderr;
             reject(errTimeout);
@@ -265,6 +419,7 @@ export class SshService {
 
         stream.on('close', (code, signal) => {
           if (timer) clearTimeout(timer);
+          this.bumpInFlight(profile.id, -1);
           resolve({
             code: code ?? 0,
             signal,
@@ -316,7 +471,7 @@ export class SshService {
     if (typeof options === 'number') {
       options = { cols: options, rows: arguments[2] };
     }
-    const conn = await this.getConnection(profile);
+    const conn = await this.connectDedicated(profile);
     const cols = options.cols || 80;
     const rows = options.rows || 24;
     const term = options.term || 'xterm-256color';
@@ -340,7 +495,10 @@ export class SshService {
             try { stream.setWindow(r, c, 0, 0); } catch (err) { /* best-effort cleanup */ }
           },
           close() {
+            if (session.closed) return;
+            session.closed = true;
             try { stream.end(); } catch (err) { /* best-effort cleanup */ }
+            try { conn.end(); } catch (err) { /* best-effort cleanup */ }
           }
         };
 
@@ -354,6 +512,7 @@ export class SshService {
         });
 
         stream.on('close', () => {
+          session.close();
           this.terminalSessions.delete(sessionId);
         });
 

package/lib/terminal-font.js

@@ -0,0 +1,12 @@
+const FONT_PATTERN = /^[A-Za-z0-9 ,."'_-]{1,80}$/;
+
+export function normalizeTerminalFont(value) {
+  const text = String(value || '').trim();
+  if (!text) return '';
+  if (!FONT_PATTERN.test(text)) {
+    const err = new Error('Terminal font contains unsupported characters');
+    err.code = 'INVALID_FONT';
+    throw err;
+  }
+  return text;
+}

package/lib/tools.js

@@ -1,6 +1,8 @@
 import { defineTool } from '@deepseek-ai/dsh-tools';
+import { renderHostTable } from './host-projection.js';
+import { filterClusterProfiles, runCluster } from './cluster-service.js';
 
-export function registerRemoteTools(ctx, sshService, remoteFs, mirrorSync, tunnelService, getActiveProfile, getProfileById, dockerService, diagnoseService, envService, tarSyncService) {
+export function registerRemoteTools(ctx, sshService, remoteFs, mirrorSync, tunnelService, getActiveProfile, getProfileById, dockerService, diagnoseService, envService, tarSyncService, listProfiles = null) {
   if (!ctx.tools || typeof ctx.tools.register !== 'function') {
     return;
   }
@@ -323,5 +325,54 @@ export function registerRemoteTools(ctx, sshService, remoteFs, mirrorSync, tunne
         }
       }
     }));
+
+  ctx.tools.register(defineTool({
+    name: 'remote_cluster',
+    description: 'Run one command on many hosts filtered by alias, environment, or tags',
+    parameters: {
+      command: { type: 'string', required: true, description: 'Shell command to run on each selected host' },
+      environment: { type: 'string', description: 'Only hosts in this environment' },
+      tags: { type: 'string', description: 'Comma-separated tags; every tag must match' },
+      aliases: { type: 'string', description: 'Comma-separated host ids or names' },
+      maxWorkers: { type: 'number', description: 'Parallel host limit, default 8' }
+    },
+    output: genericOutput,
+    async execute(args) {
+      const profiles = typeof listProfiles === 'function' ? (listProfiles() || []) : [];
+      const selected = filterClusterProfiles(profiles, {
+        environment: args.environment,
+        tags: String(args.tags || '').split(',').map((item) => item.trim()).filter(Boolean),
+        aliases: String(args.aliases || '').split(',').map((item) => item.trim()).filter(Boolean)
+      });
+      const results = await runCluster(selected, args.command, {
+        maxWorkers: args.maxWorkers,
+        exec: (profile, command) => sshService.exec(profile, command, { timeout: 60, cleanAnsi: true })
+      });
+      return { count: results.length, results };
+    }
+  }));
+
+  ctx.tools.register(defineTool({
+    name: 'remote_hosts',
+    description: 'List configured remote hosts as a compact table without secrets or bastion commands',
+    parameters: {
+      query: { type: 'string', required: true, description: 'Text matched against alias, host, environment, or tags. Pass an empty string to list every host.' }
+    },
+    output: {
+      schema: { type: 'object', additionalProperties: true },
+      render: (_args, value) => ({ type: 'text', content: value && value.table ? value.table : '' })
+    },
+    async execute(args) {
+      const profiles = typeof listProfiles === 'function' ? (listProfiles() || []) : [];
+      const query = String(args.query || '').trim().toLowerCase();
+      const matched = query
+        ? profiles.filter((profile) => {
+            const haystack = [profile.name, profile.host, profile.environment, ...(profile.tags || [])].join(' ').toLowerCase();
+            return haystack.includes(query);
+          })
+        : profiles;
+      return { count: matched.length, table: renderHostTable(matched) };
+    }
+  }));
   }
 }

package/lib/tunnel-service.js

@@ -93,6 +93,7 @@ export class TunnelService {
 
       server.listen(localPort, '127.0.0.1', () => {
         this.activeTunnels.set(tunnelId, tunnelMeta);
+        if (this.sshService.setPinned) this.sshService.setPinned(profile.id, true);
         resolve({
           success: true,
           tunnelId,
@@ -111,6 +112,8 @@ export class TunnelService {
       tunnel.server.close();
     } catch (err) { /* best-effort cleanup */ }
     this.activeTunnels.delete(tunnelId);
+    const stillPinned = [...this.activeTunnels.values()].some((item) => item.profileId === tunnel.profileId);
+    if (!stillPinned && this.sshService.setPinned) this.sshService.setPinned(tunnel.profileId, false);
     return true;
   }
 

package/lib/types.js

@@ -6,11 +6,18 @@
  * @property {number} port
  * @property {string} username
  * @property {'key'|'password'|'agent'} authType
+ * @property {string} [agentPath]
  * @property {string} [privateKeyPath]
  * @property {string} [privateKey]
  * @property {string} [passphrase]
  * @property {string} [password]
  * @property {string} [jumpHost]
+ * @property {string[]} [jumpHosts]
+ * @property {string} [proxyCommand]
+ * @property {string} [environment]
+ * @property {string[]} [tags]
+ * @property {string} [location]
+ * @property {string} [description]
  * @property {string} [remoteWorkspace]
  * @property {string} [localMirrorPath]
  * @property {number} [lastPingMs]

package/lib/workspace-mount.js

@@ -0,0 +1,5 @@
+export function attachWorkspaceNode(column, node) {
+  if (!column || !node || typeof column.appendChild !== 'function') return false;
+  if (node.parentElement !== column) column.appendChild(node);
+  return node.parentElement === column;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-remote-workspace",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "description": "Enterprise Remote Workspace Plugin for DeepSeek Harness: SSH2 connection pool, SFTP operations, 3-way conflict-aware mirror sync, port forwarding, and native DSH UI.",
   "type": "module",
   "main": "lib/index.js",