@goodandready/dsh-remote-workspace 0.3.9 → 0.3.11

package/README.md

@@ -300,3 +300,15 @@ MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)
 - **`📥 Import from ~/.ssh/config`**: One-click import of hosts, keys, and ProxyJump configurations directly into the encrypted `.env` vault.
 - **`🗃️ Remote Environment Manager (remote_env)`**: Inspect and atomically modify remote `.env` key-values with password masking and structural preservation.
 - **`📡 Background Anomaly Alerts`**: Proactive monitoring of disk (<10% free), memory (<5%), and restarting Docker containers via Cordis event bus (`remote-workspace/alert`).
+
+
+### 14. DSH 0.2.0-rc.1 Alignment & Reliability Hardening (v0.3.11)
+- **`⚙️ DSH 0.2.0-rc.1 Settings Forms`**: Fully volatile `Config` schema leaves and dynamic `whileServed` client registration matching the DSH 0.2.0-rc.1 settings contract (#76).
+- **`🛠️ Environment & Diagnostics Endpoints`**: Fixed service method bindings for `.env` inspection, atomic variable updating, and host diagnostics (#77).
+- **`⏱️ Terminal Session Reaper`**: Automatic background sweeping of idle and abandoned PTY sessions to prevent remote connection exhaustion (#78).
+- **`🛡️ Tunnel Lifecycle Hardening`**: Mutual socket/stream teardown on network disconnect and accurate telemetry counter tracking (#79).
+- **`📦 Tar Stream Resilience`**: Uncaught exception protection for local `tar` extraction and zombie process termination (#80).
+- **`🔒 Shell Command Sanitization`**: Strict numeric validation and POSIX single-quoted escaping across Docker, diagnostics, and remote filesystem operations (#81).
+- **`💾 Binary Stream Sync`**: Raw buffer hashing in `MirrorSyncService.pull` preventing false conflicts and hash corruption on binary files (#82).
+- **`👀 Watcher Error Recovery`**: Automatic `fs.watch` error recovery (`ENOSPC` handling) and per-profile concurrency locking (#83).
+- **`⚡ Tab Visibility Polling Gate`**: Client-side background poll suppression when browser tab is hidden (#84).

package/README.ru.md

@@ -300,3 +300,15 @@ MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)
 - **`📥 Импорт из ~/.ssh/config`**: Автоматическое добавление хостов, ключей и bastion-узлов в зашифрованный `.env` vault.
 - **`🗃️ Менеджер переменных окружения (remote_env)`**: Атомарное изменение и безопасный просмотр удалённых `.env` файлов с маскированием паролей.
 - **`📡 Мониторинг аномалий`**: Оповещение о переполнении диска (<10%), дефиците ОЗУ (<5%) и циклических перезапусках контейнеров через шину событий Cordis (`remote-workspace/alert`).
+
+
+### 14. Совместимость с DSH 0.2.0-rc.1 и комплексное повышение надёжности (v0.3.11)
+- **`⚙️ Формы настроек DSH 0.2.0-rc.1`**: Volatile-свойства схемы `Config` и динамическая регистрация `whileServed` в клиенте (#76).
+- **`🛠️ Исправление маршрутов .env и диагностики`**: Восстановлена работоспособность эндпоинтов просмотра/сохранения `.env` и запуска системной диагностики (#77).
+- **`⏱️ Сборщик простаивающих терминальных сессий`**: Автоматическое завершение брошенных PTY-сессий и освобождение выделенных SSH-каналов (#78).
+- **`🛡️ Защита жизненного цикла туннелей`**: Взаимное закрытие сокетов и потоков при обрыве связи, точный счётчик активных подключений (#79).
+- **`📦 Устойчивость tar-синхронизации`**: Перехват системных ошибок spawn утилиты `tar` и уничтожение зомби-процессов (#80).
+- **`🔒 Экранирование команд shell`**: Строгая валидация числовых параметров и POSIX-экранирование одинарными кавычками в Docker, диагностике и файловых операциях (#81).
+- **`💾 Синхронизация бинарных файлов`**: Чтение сырых Buffer в `MirrorSyncService.pull` без искажений кодировки UTF-8 (#82).
+- **`👀 Устойчивость файлового вотчера`**: Обработка ошибок `fs.watch` (`ENOSPC`) и блокировка параллельных наложений синхронизации (#83).
+- **`⚡ Гейт поллинга по видимости вкладки`**: Отключение фоновых опросов при скрытой вкладке браузера (#84).

package/README.zh.md

@@ -300,3 +300,15 @@ MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)
 - **`📥 导入 ~/.ssh/config`**：快速解析本机已有主机、私钥及跳板机配置至加密 `.env` 保管库。
 - **`🗃️ 远程环境变量管理 (remote_env)`**：支持远程 `.env` 的安全预览与原子化变量修改，自动遮蔽敏感密码。
 - **`📡 异常告警监控`**：当磁盘低于 10%、内存不足 5% 或容器异常重启时，主动触发 Cordis 事件总线 (`remote-workspace/alert`) 告警。
+
+
+### 14. DSH 0.2.0-rc.1 适配与全面可靠性加固 (v0.3.11)
+- **`⚙️ DSH 0.2.0-rc.1 设置表单适配`**: `Config` 字段 volatile 标记及基于 `whileServed` 的客户端注册 (#76)。
+- **`🛠️ 修复环境变量与诊断路由`**: 修复 `.env` 查看/保存及系统诊断的服务方法调用与参数签名 (#77)。
+- **`⏱️ 终端会话自动清理`**: 自动回收无活跃连接且超时的后台 PTY 终端会话与 SSH 连接 (#78)。
+- **`🛡️ 端口转发隧道生命周期加固`**: 连接断开时双向销毁流与套接字，精准维护活跃连接计数 (#79)。
+- **`📦 Tar 流式同步容错增强`**: 捕获本地 `tar` 进程错误并及时清理僵尸进程 (#80)。
+- **`🔒 Shell 命令注入防范与转义`**: 针对 Docker、系统诊断与远程文件系统操作实施严格数值校验与 POSIX 单引号转义 (#81)。
+- **`💾 二进制文件同步哈希修复`**: `MirrorSyncService.pull` 采用原始 Buffer 计算哈希，避免 UTF-8 编码失真 (#82)。
+- **`👀 文件监听器容错与并发锁`**: 监听器异常处理（防 ENOSPC 崩溃）及防止同一主机重复触发并发同步 (#83)。
+- **`⚡ 标签页可见性轮询控制`**: 浏览器标签页隐藏时自动挂起状态轮询 (#84)。

package/lib/client.js

@@ -2280,6 +2280,12 @@ html[data-drw-active] [data-pane=conversation] > *:not([data-drw-view]),html[dat
       )
     }
 
+function shouldPoll({ hidden = false, inFlight = false } = {}) {
+  if (hidden) return false;
+  if (inFlight) return false;
+  return true;
+}
+
     function SettingsView(props) {
       const [activeTab, setActiveTab] = React.useState('profiles')
       const [healthData, setHealthData] = React.useState(null)
@@ -2330,7 +2336,7 @@ html[data-drw-active] [data-pane=conversation] > *:not([data-drw-view]),html[dat
 
       const loadState = async (force) => {
         const hidden = typeof document !== 'undefined' && document.hidden
-        if (!force && (hidden || loadInFlight.current)) return
+        if (!force && !shouldPoll({ hidden, inFlight: loadInFlight.current })) return
         loadInFlight.current = true
         try {
           const res = await fetch('/dsh-remote-workspace/state')
@@ -2876,6 +2882,10 @@ html[data-drw-active] [data-pane=conversation] > *:not([data-drw-view]),html[dat
       const t = props.t || (props.locale === 'zh' ? makeT(zh, en) : makeT(en, zh))
 
       const [conn, setConn] = React.useState('loading')
+      const configForm = (props && props.ctx && props.ctx.configForms && typeof props.ctx.configForms.get === 'function')
+        ? props.ctx.configForms.get(NS)
+        : null;
+
 
       React.useEffect(() => {
         ensureCss()
@@ -3236,23 +3246,20 @@ html[data-drw-active] [data-pane=conversation] > *:not([data-drw-view]),html[dat
         }
       }
 
-      if (ctx.slots && typeof ctx.slots.inject === 'function') {
-        // Plugin-list seat (plugins.item) first: the seat the current core
-        // (0.1.6-alpha.2) renders as the plugin's own page with its configuration.
-        // The label getter runs during page render. A locale-service lookup there
-        // crashes the client batch, so the title is read from the dictionaries
-        // already loaded in this bundle. English is the result when the active
-        // language cannot be read.
-        ctx.slots.inject('plugins.item', () =>
-          ctx.slots.register(
+      const registerPluginSlots = (c) => {
+        if (!c.slots || typeof c.slots.inject !== 'function') return;
+
+        // Plugin-list seat (plugins.item) first
+        c.slots.inject('plugins.item', () =>
+          c.slots.register(
             {
               name: 'plugins.item',
               id: ROW_ID,
               order: 60,
               label: () => {
                 try {
-                  const lang = ctx.locale && typeof ctx.locale.getLocale === 'function'
-                    ? ctx.locale.getLocale()
+                  const lang = c.locale && typeof c.locale.getLocale === 'function'
+                    ? c.locale.getLocale()
                     : ''
                   if (typeof lang === 'string' && (lang === 'zh' || lang.indexOf('zh') === 0)) return zh.title
                 } catch (err) {
@@ -3261,39 +3268,27 @@ html[data-drw-active] [data-pane=conversation] > *:not([data-drw-view]),html[dat
                 return en.title
               },
               locale: NS,
-              inject: () => ({ ctx })
+              inject: () => ({ ctx: c })
             },
-            (props) => React.createElement(PluginCard, Object.assign({}, props, { ctx }))
+            (props) => React.createElement(PluginCard, Object.assign({}, props, { ctx: c }))
           )
-        )
+        );
 
-        // Row seat and the legacy seat stay as fallbacks.
-        ctx.slots.inject('plugins.row.config', () =>
-          ctx.slots.register(
+        // Row seat (plugins.row.config)
+        c.slots.inject('plugins.row.config', () =>
+          c.slots.register(
             {
               name: 'plugins.row.config',
               key: ROW_CONFIG_KEY,
               locale: NS,
-              inject: () => ({ ctx })
-            },
-            (props) => React.createElement(PluginCard, Object.assign({}, props, { ctx }))
-          )
-        )
-
-        ctx.slots.inject('settings.plugin.item', () =>
-          ctx.slots.register(
-            {
-              name: 'settings.plugin.item',
-              key: NS,
-              locale: NS,
-              inject: () => ({ ctx })
+              inject: () => ({ ctx: c })
             },
-            (props) => React.createElement(PluginCard, Object.assign({}, props, { ctx }))
+            (props) => React.createElement(PluginCard, Object.assign({}, props, { ctx: c }))
           )
-        )
+        );
 
-        ctx.slots.inject('conversation.session.header.utilities', () =>
-          ctx.slots.register(
+        c.slots.inject('conversation.session.header.utilities', () =>
+          c.slots.register(
             {
               name: 'conversation.session.header.utilities',
               id: '@goodandready/dsh-remote-workspace',
@@ -3301,11 +3296,26 @@ html[data-drw-active] [data-pane=conversation] > *:not([data-drw-view]),html[dat
             },
             (props) => React.createElement(RemoteWorkspaceChip, props)
           )
-        )
+        );
+      };
+
+      if (ctx.inject && typeof ctx.inject === 'function') {
+        ctx.inject(['configForms'], (c) => {
+          const forms = c.configForms;
+          if (forms && typeof forms.whileServed === 'function') {
+            c.effect(() => forms.whileServed([NS], () => {
+              registerPluginSlots(c);
+            }), 'dsh-remote-workspace: plugins card');
+          } else {
+            registerPluginSlots(c);
+          }
+        });
+      } else {
+        registerPluginSlots(ctx);
       }
     }
 
-    module.exports = { apply, inject: ['slots', 'locale'] }
+    module.exports = { apply, inject: ['slots', 'locale', 'configForms'] }
     return module.exports
 
   },

package/lib/diagnose-service.js

@@ -18,13 +18,14 @@ export class DiagnoseService {
     let cmd = '';
     switch (category) {
       case 'ports': {
-        const filter = target ? `grep ':${target} '` : 'cat';
+        const safePort = target ? String(target).replace(/[^0-9]/g, '') : '';
+        const filter = safePort ? `grep ':${safePort} '` : 'cat';
         cmd = `(ss -tulpn 2>/dev/null || netstat -tulpn 2>/dev/null || lsof -i -P -n 2>/dev/null) | ${filter} | head -n 40`;
         break;
       }
       case 'disk': {
-        const path = target || '/';
-        cmd = `df -h ${path} 2>/dev/null; echo "---TOP 10 DIRS---"; du -ahx ${path} 2>/dev/null | sort -rh | head -n 10`;
+        const safePath = target ? "'" + String(target).replace(/'/g, "'\\''") + "'" : '/';
+        cmd = `df -h ${safePath} 2>/dev/null; echo "---TOP 10 DIRS---"; du -ahx ${safePath} 2>/dev/null | sort -rh | head -n 10`;
         break;
       }
       case 'memory': {

package/lib/docker-service.js

@@ -55,7 +55,8 @@ export class DockerService {
     if (!validActions.includes(action)) {
       throw new Error(`Invalid container action: ${action}`);
     }
-    const cmd = `docker ${action} ${JSON.stringify(containerId)} 2>/dev/null || podman ${action} ${JSON.stringify(containerId)}`;
+    const safeContainerId = "'" + String(containerId || '').replace(/'/g, "'\\''") + "'";
+    const cmd = `docker ${action} ${safeContainerId} 2>/dev/null || podman ${action} ${safeContainerId}`;
     const res = await this.sshService.exec(profile, cmd);
     return {
       success: res.code === 0,
@@ -68,7 +69,9 @@ export class DockerService {
    * Fetch container logs
    */
   async containerLogs(profile, containerId, tail = 100) {
-    const cmd = `docker logs --tail ${tail} ${JSON.stringify(containerId)} 2>&1 || podman logs --tail ${tail} ${JSON.stringify(containerId)} 2>&1`;
+    const safeTail = Math.max(1, Math.min(10000, parseInt(tail, 10) || 100));
+    const safeContainerId = "'" + String(containerId || '').replace(/'/g, "'\\''") + "'";
+    const cmd = `docker logs --tail ${safeTail} ${safeContainerId} 2>&1 || podman logs --tail ${safeTail} ${safeContainerId} 2>&1`;
     const res = await this.sshService.exec(profile, cmd);
     return {
       success: res.code === 0,

package/lib/index.js

@@ -21,6 +21,17 @@ const NS = 'dsh-remote-workspace';
 
 export const inject = ['tools'];
 
+// DSH SettingsForms describe only publishes fields marked volatile. Without them the
+// namespace is omitted and the configuration page stays unavailable.
+if (typeof z.prototype?.volatile !== 'function') {
+  if (z.prototype) {
+    z.prototype.volatile = function volatile() {
+      if (this.meta && this.meta.volatile) return this;
+      return typeof this.extra === 'function' ? this.extra('volatile', true) : this;
+    };
+  }
+}
+
 export const Config = z.object({
   profiles: z.array(z.object({
     id: z.string().default(''),
@@ -43,11 +54,11 @@ export const Config = z.object({
     tags: z.array(z.string()).default([]),
     location: z.string().default(''),
     description: z.string().default('')
-  })).default([]).description('List of configured remote machines and workspaces.'),
-  activeProfileId: z.string().default('').description('ID of active remote profile.'),
-  autoSyncActive: z.boolean().default(false).description('Whether Live Auto-Sync watcher is enabled.'),
-  alertMonitoringActive: z.boolean().default(false).description('Whether background anomaly alerts are monitored.'),
-  terminalFontFamily: z.string().default('').description('CSS font family used by the terminal. Empty keeps the default monospace stack.')
+  })).default([]).description('List of configured remote machines and workspaces.').volatile(),
+  activeProfileId: z.string().default('').description('ID of active remote profile.').volatile(),
+  autoSyncActive: z.boolean().default(false).description('Whether Live Auto-Sync watcher is enabled.').volatile(),
+  alertMonitoringActive: z.boolean().default(false).description('Whether background anomaly alerts are monitored.').volatile(),
+  terminalFontFamily: z.string().default('').description('CSS font family used by the terminal. Empty keeps the default monospace stack.').volatile()
 });
 
 export function apply(ctx, config = {}) {
@@ -223,19 +234,34 @@ export function apply(ctx, config = {}) {
     if (active) watcherService.start(active, mirrorSync);
   }
 
+
+
   // Register settings namespace if settings service is available
   ctx.inject(['settings'], (sctx) => {
     const settingsService = sctx.get ? (sctx.get('settings') ?? sctx.settings) : sctx.settings;
-    if (!settingsService || typeof settingsService.register !== 'function') return;
+    if (!settingsService) return;
 
-    const scope = settingsService.register(NS, Config, { base: cfg });
-    settingsApi = scope;
-    const snap = scope.get ? scope.get() : null;
-    if (snap) {
-      if (Array.isArray(snap.profiles)) currentConfig.profiles = snap.profiles;
-      if (snap.activeProfileId !== undefined) currentConfig.activeProfileId = snap.activeProfileId;
-      if (snap.autoSyncActive !== undefined) currentConfig.autoSyncActive = snap.autoSyncActive;
-      if (snap.alertMonitoringActive !== undefined) currentConfig.alertMonitoringActive = snap.alertMonitoringActive;
+    if (typeof settingsService.register === 'function') {
+      const scope = settingsService.register(NS, Config, { base: cfg });
+      settingsApi = scope;
+      const snap = scope.get ? scope.get() : null;
+      if (snap) {
+        if (Array.isArray(snap.profiles)) currentConfig.profiles = snap.profiles;
+        if (snap.activeProfileId !== undefined) currentConfig.activeProfileId = snap.activeProfileId;
+        if (snap.autoSyncActive !== undefined) currentConfig.autoSyncActive = snap.autoSyncActive;
+        if (snap.alertMonitoringActive !== undefined) currentConfig.alertMonitoringActive = snap.alertMonitoringActive;
+      }
+    } else if (typeof settingsService.configure === 'function') {
+      try {
+        settingsService.configure({ auto: false }, ctx.fiber);
+      } catch (err) { /* best-effort */ }
+      settingsApi = {
+        replace: async (newConfig) => {
+          if (typeof settingsService.replace === 'function') {
+            await settingsService.replace(NS, newConfig);
+          }
+        }
+      };
     }
     sctx.effect(() => () => {
       settingsApi = null;
@@ -305,6 +331,7 @@ export function apply(ctx, config = {}) {
 
   // Cleanup on unload
   ctx.on('dispose', () => {
+    clearInterval(idleTimer);
     alertService.stop();
     watcherService.stopAll();
     tunnelService.stopAll();

package/lib/mirror-sync-service.js

@@ -117,7 +117,7 @@ export class MirrorSyncService {
       let localContent = null;
       let localHash = null;
       if (localExists) {
-        localContent = fs.readFileSync(localFullPath, 'utf8');
+        localContent = fs.readFileSync(localFullPath);
         localHash = this.computeHash(localContent);
       }
 

package/lib/remote-fs-service.js

@@ -1,3 +1,8 @@
+function shellQuote(arg) {
+  if (typeof arg !== 'string') arg = String(arg || '');
+  return "'" + arg.replace(/'/g, "'\\''") + "'";
+}
+
 import path from 'node:path';
 
 export class RemoteFsService {
@@ -173,7 +178,7 @@ export class RemoteFsService {
    * Create remote directory recursively
    */
   async mkdir(profile, remotePath) {
-    const cmd = `mkdir -p ${JSON.stringify(remotePath)}`;
+    const cmd = `mkdir -p ${shellQuote(remotePath)}`;
     const res = await this.sshService.exec(profile, cmd);
     if (res.code !== 0) {
       throw new Error(`Failed to create remote dir ${remotePath}: ${res.stderr}`);
@@ -186,7 +191,7 @@ export class RemoteFsService {
    * Remove remote file or directory
    */
   async remove(profile, remotePath, recursive = false) {
-    const cmd = recursive ? `rm -rf ${JSON.stringify(remotePath)}` : `rm -f ${JSON.stringify(remotePath)}`;
+    const cmd = recursive ? `rm -rf ${shellQuote(remotePath)}` : `rm -f ${shellQuote(remotePath)}`;
     const res = await this.sshService.exec(profile, cmd);
     if (res.code !== 0) {
       throw new Error(`Failed to remove remote path ${remotePath}: ${res.stderr}`);

package/lib/routes/docker.js

@@ -1,4 +1,4 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
 
 export function registerDockerRoutes(sctx, webServer, { dockerService, healthService, store }) {
   // 21. GET /dsh-remote-workspace/health
@@ -7,7 +7,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
     path: '/dsh-remote-workspace/health',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const url = new URL(req.url, 'http://localhost');
         const profileId = url.searchParams.get('profileId');
@@ -17,7 +17,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
         const health = await healthService.getHealth(profile);
         writeJson(res, 200, { ok: true, health });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /health');
@@ -28,7 +28,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
     path: '/dsh-remote-workspace/docker/list',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const url = new URL(req.url, 'http://localhost');
         const profileId = url.searchParams.get('profileId');
@@ -38,7 +38,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
         const result = await dockerService.listContainers(profile, true);
         writeJson(res, 200, { ok: true, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /docker/list');
@@ -49,7 +49,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
     path: '/dsh-remote-workspace/docker/action',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, containerId, action } = await readBody(req);
         const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
@@ -59,7 +59,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
         const result = await dockerService.containerAction(profile, containerId, action);
         writeJson(res, 200, { ok: result.success, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /docker/action');
@@ -70,7 +70,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
     path: '/dsh-remote-workspace/docker/logs',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, containerId, tail } = await readBody(req);
         const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
@@ -80,7 +80,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
         const result = await dockerService.containerLogs(profile, containerId, tail || 100);
         writeJson(res, 200, { ok: result.success, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /docker/logs');

package/lib/routes/env.js

@@ -1,21 +1,22 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, authorizeRequest } from './helpers.js';
 
-export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService, sshService, store }) {
+export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService, sshService, store, remoteFs }) {
   // 10. POST /dsh-remote-workspace/env/view
   sctx.effect(() => webServer.register({
     kind: 'exact',
     path: '/dsh-remote-workspace/env/view',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, remotePath } = await readBody(req);
         const profile = store.getProfile(profileId);
         if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
-        const result = await envService.readRemoteEnv(sshService, profile, remotePath);
+        const targetPath = remotePath || (profile.remoteWorkspace ? `${profile.remoteWorkspace.replace(/\/+$/, '')}/.env` : '.env');
+        const result = await envService.readEnv(profile, targetPath);
         writeJson(res, 200, { ok: true, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /env/view');
@@ -26,15 +27,26 @@ export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService
     path: '/dsh-remote-workspace/env/save',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
-        const { profileId, remotePath, content } = await readBody(req);
+        const { profileId, remotePath, content, key, value } = await readBody(req);
         const profile = store.getProfile(profileId);
         if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
-        const result = await envService.saveRemoteEnv(sshService, profile, remotePath, content);
+        const targetPath = remotePath || (profile.remoteWorkspace ? `${profile.remoteWorkspace.replace(/\/+$/, '')}/.env` : '.env');
+        let result;
+        if (key) {
+          result = await envService.setEnvVar(profile, targetPath, key, value || '');
+        } else if (content !== undefined) {
+          if (remoteFs && typeof remoteFs.writeFile === 'function') {
+            await remoteFs.writeFile(profile, targetPath, content);
+          }
+          result = { ok: true, filePath: targetPath };
+        } else {
+          return writeJson(res, 400, { ok: false, error: 'Either key/value or content is required' });
+        }
         writeJson(res, 200, { ok: true, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /env/save');
@@ -45,15 +57,16 @@ export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService
     path: '/dsh-remote-workspace/diagnose',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
-        const { profileId, checks } = await readBody(req);
+        const { profileId, category, checks, target } = await readBody(req);
         const profile = store.getProfile(profileId);
         if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
-        const results = await diagnoseService.diagnose(sshService, profile, checks);
-        writeJson(res, 200, { ok: true, results });
+        const checkCategory = category || checks || 'memory';
+        const result = await diagnoseService.diagnose(profile, checkCategory, target || '');
+        writeJson(res, 200, { ok: true, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /diagnose');

package/lib/routes/files.js

@@ -1,4 +1,4 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
 import { contentDisposition, pipeWithProgress, MAX_BYTES } from '../file-transfer.js';
 
 
@@ -27,7 +27,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
     path: '/dsh-remote-workspace/browse',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const body = await readBody(req);
         let profile = null;
@@ -48,7 +48,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
         const entries = await remoteFs.listDir(profile, targetPath);
         writeJson(res, 200, { ok: true, entries, items: entries, currentPath: targetPath });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /browse');
@@ -59,7 +59,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
     path: '/dsh-remote-workspace/file/view',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, filePath } = await readBody(req);
         const profile = store.getProfile(profileId);
@@ -71,7 +71,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
         const buf = await remoteFs.readFile(profile, filePath);
         writeJson(res, 200, { ok: true, content: buf.toString('utf8'), size: stat.size });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /file/view');
@@ -82,7 +82,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
     path: '/dsh-remote-workspace/file/save',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, filePath, content } = await readBody(req);
         const profile = store.getProfile(profileId);
@@ -90,7 +90,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
         await remoteFs.writeFile(profile, filePath, Buffer.from(content, 'utf8'));
         writeJson(res, 200, { ok: true });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /file/save');
@@ -100,7 +100,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
     path: '/dsh-remote-workspace/file/download',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profile, filePath } = transferTarget(req, store);
         const stat = await remoteFs.stat(profile, filePath);
@@ -128,7 +128,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
     path: '/dsh-remote-workspace/file/upload',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       let upload = null;
       try {
         const { profile, filePath } = transferTarget(req, store);
@@ -156,7 +156,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
     path: '/dsh-remote-workspace/transfer',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { sourceProfileId, sourcePath, destProfileId, destPath } = await readBody(req);
         const srcProfile = sourceProfileId ? store.getProfile(sourceProfileId) : store.getActiveProfile();
@@ -169,7 +169,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
         const result = await sshService.transferFileBetweenHosts(srcProfile, sourcePath, destProfile, destPath);
         writeJson(res, 200, { ok: result.success, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /transfer');