@goodandready/dsh-server-monitor 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 GoodAndReady
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files, to deal in the Software
+without restriction, including without limitation the rights to use, copy,
+modify, merge, publish, distribute, sublicense, and/or sell copies of the
+Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED AS IS, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,116 @@
+# @goodandready/dsh-server-monitor
+![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)
+![npm version](https://img.shields.io/npm/v/@goodandready/dsh-server-monitor)
+[English](README.md) · [简体中文](README.zh.md) · [Русский](README.ru.md)
+
+A standalone, read-only Linux server monitor for the DeepSeek Harness sidebar. This package owns its server profiles and credentials; it does not depend on `dsh-remote-workspace` or reuse another plugin’s connection settings.
+
+## MVP scope
+
+- Add and manage multiple Linux SSH profiles.
+- Connect with an SSH private key (inline or server-side key path) or password authentication.
+- Show current host, CPU, memory, swap, disk, process, container, network, and listening-port data.
+- Refresh every 15 seconds while the sidebar is visible.
+- Read-only monitoring: the plugin does not manage remote services, processes, or containers. History, charts, and alerts are not part of the MVP.
+
+## Credential boundary
+
+Credentials belong to this plugin and are stored in its private vault on the DSH host. On POSIX hosts the plugin enforces and verifies owner-only mode `0600`, and stops if that permission cannot be established. Secret values are not written to DSH settings or returned to the browser; profile APIs expose only masked values and presence flags. A configured private-key path is read on the DSH host.
+
+## Development checks
+
+Run the same checks used by Gitea Actions:
+
+```sh
+npm ci
+npm test
+```
+
+Tests use mocked SSH connections and do not connect to real servers. The Gitea Actions workflow runs these commands for pushes and pull requests.
+
+## Languages
+
+The plugin UI ships English and Chinese dictionaries and uses the DSH locale service, allowing `dsh-russian-lang` to supply Russian translations. See [README.zh.md](README.zh.md) and [README.ru.md](README.ru.md).
+## Requirements
+
+- A DSH web profile with the plugin installed and SSH reachability from DSH to each Linux host.
+- A remote account allowed to run standard read-only system commands. Docker/Podman data requires permission to query that runtime.
+- A private-key path must be readable by the DSH service account on the DSH host.
+
+## Install
+
+Replace `web` with your DSH profile:
+
+```sh
+dsh plugin --profile web add @goodandready/dsh-server-monitor
+```
+
+Follow the CLI prompts. In the plugin settings card, add a server, choose key or password authentication, test the connection, and save. Open **Server Monitor** in the sidebar. Remove with `dsh plugin --profile web remove @goodandready/dsh-server-monitor`.
+
+## Configuration
+
+Manage profiles in the DSH settings card. Settings contain connection metadata only: do not place passwords, private-key contents, or passphrases in settings or config files.
+
+| Field | Type | Default | Meaning |
+| --- | --- | --- | --- |
+| `profiles` | array | `[]` | Plugin-owned SSH profiles. |
+| `profiles[].id` | string | generated | Stable profile ID. |
+| `profiles[].name` | string | empty | Display name. |
+| `profiles[].host` | string | empty | Linux host reachable from DSH. |
+| `profiles[].port` | number | `22` | SSH port. |
+| `profiles[].username` | string | `root` | Remote account; prefer restricted permissions. |
+| `profiles[].authType` | string | `key` | `key` or `password`. |
+| `profiles[].privateKeyPath` | string | empty | Optional key path on the DSH host. |
+| `activeProfileId` | string | empty | Selected profile ID. |
+
+The settings card stores secret values in the plugin-owned vault on the DSH host. POSIX vault operations require verified owner-only permissions (`0600`).
+
+## Collected data
+
+The bounded, read-only collector reports host/OS/kernel/CPU, load and uptime, memory and swap, mounted filesystem usage, up to 12 CPU-heavy processes, running Docker or Podman containers, network byte/packet counters, and listening TCP/UDP ports (`ss`, falling back to `netstat`). A section can be empty if a command, runtime, or permission is unavailable.
+
+## Architecture
+
+```mermaid
+flowchart LR
+  UI[DSH sidebar] --> Client[Plugin client]
+  Client --> Routes[Trusted local routes]
+  Routes --> Settings[Profiles]
+  Routes --> Vault[Credential vault]
+  Routes --> SSH[SSH service]
+  SSH --> Linux[Read-only Linux collector]
+  Linux --> Snapshot[Current snapshot]
+  Snapshot --> Client
+```
+
+| Module | Responsibility |
+| --- | --- |
+| `lib/index.js` | Cordis registration, settings, service lifecycle. |
+| `lib/client.js` | Sidebar/settings UI; pauses polling while hidden. |
+| `lib/routes.js` | Trusted-request checks, profile operations, snapshot cache. |
+| `lib/profile.js` | Profile normalization and validation. |
+| `lib/vault-service.js` | Credential storage and POSIX permission verification. |
+| `lib/ssh-service.js` | SSH authentication, bounded commands, reuse and cleanup. |
+| `lib/linux-collector.js` | Linux collection and snapshot parsing. |
+
+## Internal HTTP routes
+
+These DSH-client routes are protected by a trusted-request check; they are not a public or remote-management API.
+
+| Method | Path | Purpose |
+| --- | --- | --- |
+| GET | `/dsh-server-monitor/state` | Sanitized profiles and selected ID. |
+| GET | `/dsh-server-monitor/snapshot?profileId=<id>` | Current snapshot; defaults to active profile. |
+| POST | `/dsh-server-monitor/profiles/save` | Create/update a profile. |
+| POST | `/dsh-server-monitor/profiles/delete` | Delete profile and stored secrets. |
+| POST | `/dsh-server-monitor/profiles/active` | Select active profile. |
+| POST | `/dsh-server-monitor/test` | Test SSH connection. |
+
+Snapshots are cached per profile for 15 seconds from collection start; concurrent requests share a collection. Save/delete invalidates that profile’s cache.
+
+## Security and support
+
+The plugin owns its SSH credentials, never returns secrets to the browser, and only runs read-only monitoring commands. Linux only; history, charts, alerts, and remote actions are not in the MVP.
+
+- Issues: [GitHub Issues](https://github.com/GooDAnDReaDY/dsh-server-monitor/issues)
+- License: [MIT](LICENSE)

package/README.ru.md

@@ -0,0 +1,116 @@
+# @goodandready/dsh-server-monitor
+![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)
+![npm version](https://img.shields.io/npm/v/@goodandready/dsh-server-monitor)
+[English](README.md) · [简体中文](README.zh.md) · [Русский](README.ru.md)
+
+Независимый плагин мониторинга Linux-серверов только для чтения в боковой панели DeepSeek Harness. Он хранит собственные профили и учётные данные и не зависит от `dsh-remote-workspace` или подключений других плагинов.
+
+## Объём MVP
+
+- Добавление и управление несколькими Linux SSH-профилями.
+- Подключение по приватному SSH-ключу (содержимое или путь на хосте DSH) либо по паролю.
+- Текущие сведения о хосте, CPU, памяти, swap, дисках, процессах, контейнерах, сети и слушающих портах.
+- Обновление каждые 15 секунд, пока боковая панель видима.
+- Только чтение: плагин не управляет удалёнными службами, процессами и контейнерами. История, графики и оповещения не входят в MVP.
+
+## Граница хранения секретов
+
+Учётные данные принадлежат этому плагину и хранятся в его отдельном хранилище на хосте DSH. В POSIX-системах плагин устанавливает и проверяет права только для владельца (`0600`); если обеспечить их не удаётся, операция прекращается. Секреты не записываются в настройки DSH и не возвращаются браузеру: API отдаёт только маскированные значения и признаки наличия секрета. Файл приватного ключа читается на хосте DSH.
+
+## Проверки разработки
+
+Запустите те же проверки, что выполняет Gitea Actions:
+
+```sh
+npm ci
+npm test
+```
+
+Тесты используют имитацию SSH и не подключаются к реальным серверам. Gitea Actions запускает эти команды при push и создании pull request.
+
+## Языки
+
+В интерфейсе есть английский и китайский словари; используется locale-сервис DSH, чтобы `dsh-russian-lang` мог предоставить русский перевод. См. также [README.md](README.md) и [README.zh.md](README.zh.md).
+## Требования
+
+- Профиль DSH web с плагином; хост DSH должен иметь SSH-доступ к Linux-серверам.
+- Удалённой учётной записи нужны права на стандартные команды только для чтения; для контейнеров необходим доступ к Docker/Podman.
+- Файл приватного ключа должен находиться на хосте DSH и читаться системной учётной записью DSH.
+
+## Установка
+
+Замените `web` на имя используемого профиля DSH:
+
+```sh
+dsh plugin --profile web add @goodandready/dsh-server-monitor
+```
+
+Следуйте подсказкам CLI. В карточке настроек добавьте сервер, выберите ключ или пароль, проверьте подключение и сохраните профиль. Затем откройте **Server Monitor** в боковой панели. Удаление: `dsh plugin --profile web remove @goodandready/dsh-server-monitor`.
+
+## Справочник настроек
+
+Управляйте профилями в карточке DSH. Настройки содержат только параметры подключения: не записывайте пароли, приватные ключи и парольные фразы в настройки или конфиги.
+
+| Поле | Тип | По умолчанию | Описание |
+| --- | --- | --- | --- |
+| `profiles` | массив | `[]` | Профили SSH плагина. |
+| `profiles[].id` | строка | генерируется | Постоянный ID профиля. |
+| `profiles[].name` | строка | пусто | Отображаемое имя. |
+| `profiles[].host` | строка | пусто | Linux-хост, доступный из DSH. |
+| `profiles[].port` | число | `22` | SSH-порт. |
+| `profiles[].username` | строка | `root` | Удалённая учётная запись; предпочтительны ограниченные права. |
+| `profiles[].authType` | строка | `key` | `key` или `password`. |
+| `profiles[].privateKeyPath` | строка | пусто | Необязательный путь к ключу на хосте DSH. |
+| `activeProfileId` | строка | пусто | ID выбранного профиля. |
+
+Секреты сохраняются в хранилище плагина на хосте DSH. В POSIX-системах права файла должны быть проверены как доступные только владельцу (`0600`).
+
+## Собираемые данные
+
+Сборщик только для чтения получает сведения о хосте/ОС/ядре/CPU, нагрузке и времени работы, памяти и swap, файловых системах, до 12 процессов с высокой загрузкой CPU, запущенных Docker/Podman, сетевых счётчиках и слушающих TCP/UDP-портах (`ss` или запасной вариант `netstat`). Раздел может быть пустым при недоступности команды, runtime или прав.
+
+## Архитектура
+
+```mermaid
+flowchart LR
+  UI[Боковая панель DSH] --> Client[Клиент плагина]
+  Client --> Routes[Доверенные локальные маршруты]
+  Routes --> Settings[Профили]
+  Routes --> Vault[Хранилище секретов]
+  Routes --> SSH[SSH-служба]
+  SSH --> Linux[Сборщик Linux только для чтения]
+  Linux --> Snapshot[Текущий снимок]
+  Snapshot --> Client
+```
+
+| Модуль | Ответственность |
+| --- | --- |
+| `lib/index.js` | Регистрация Cordis, настройки и жизненный цикл служб. |
+| `lib/client.js` | Интерфейс боковой панели/настроек; пауза опроса при скрытой странице. |
+| `lib/routes.js` | Проверка доверенного запроса, профили и кэш снимков. |
+| `lib/profile.js` | Нормализация и проверка профилей. |
+| `lib/vault-service.js` | Хранение секретов и проверка POSIX-прав. |
+| `lib/ssh-service.js` | SSH-аутентификация, ограниченные команды и очистка. |
+| `lib/linux-collector.js` | Сбор данных Linux и разбор снимка. |
+
+## Внутренние HTTP-маршруты
+
+Маршруты предназначены для клиента DSH и защищены проверкой доверенного запроса; это не публичный API управления.
+
+| Метод | Путь | Назначение |
+| --- | --- | --- |
+| GET | `/dsh-server-monitor/state` | Очищенные профили и выбранный ID. |
+| GET | `/dsh-server-monitor/snapshot?profileId=<id>` | Снимок; по умолчанию активный профиль. |
+| POST | `/dsh-server-monitor/profiles/save` | Создать/изменить профиль. |
+| POST | `/dsh-server-monitor/profiles/delete` | Удалить профиль и секреты. |
+| POST | `/dsh-server-monitor/profiles/active` | Выбрать профиль. |
+| POST | `/dsh-server-monitor/test` | Проверить SSH. |
+
+Снимки кэшируются по профилю на 15 секунд; параллельные запросы используют один сбор. Сохранение/удаление сбрасывает кэш.
+
+## Безопасность, поддержка и лицензия
+
+Плагин самостоятельно хранит SSH-учётные данные и выполняет только мониторинг на чтение. Поддерживается только Linux; история, графики, оповещения и удалённые действия не входят в MVP.
+
+- Ошибки и предложения: [GitHub Issues](https://github.com/GooDAnDReaDY/dsh-server-monitor/issues)
+- Лицензия: [MIT](LICENSE)

package/README.zh.md

@@ -0,0 +1,116 @@
+# @goodandready/dsh-server-monitor
+![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)
+![npm version](https://img.shields.io/npm/v/@goodandready/dsh-server-monitor)
+[English](README.md) · [简体中文](README.zh.md) · [Русский](README.ru.md)
+
+适用于 DeepSeek Harness 侧边栏的独立、只读 Linux 服务器监控插件。插件自行管理服务器配置和凭据，不依赖 `dsh-remote-workspace`，也不会复用其他插件的连接配置。
+
+## MVP 范围
+
+- 添加和管理多个 Linux SSH 配置。
+- 支持 SSH 私钥（内联内容或 DSH 主机上的密钥路径）以及密码认证。
+- 显示主机、CPU、内存、交换空间、磁盘、进程、容器、网络和监听端口的当前状态。
+- 侧边栏可见时每 15 秒刷新一次。
+- 只读监控：不会管理远程服务、进程或容器。历史记录、图表和告警不属于 MVP。
+
+## 凭据边界
+
+凭据由本插件独立管理，保存在 DSH 主机上的专属保险库中。在 POSIX 主机上，插件会设置并验证仅所有者可访问的 `0600` 权限；无法确保权限时会停止操作。密钥不会写入 DSH 设置，也不会通过 API 返回给浏览器；配置接口只返回掩码和是否已保存的信息。私钥路径在 DSH 主机上读取。
+
+## 开发测试
+
+执行与 Gitea Actions 相同的检查：
+
+```sh
+npm ci
+npm test
+```
+
+测试使用模拟 SSH 连接，不会连接真实服务器。Gitea Actions 会在推送和拉取请求时执行这些命令。
+
+## 语言
+
+界面内置英语和中文词典，并使用 DSH locale 服务，以便由 `dsh-russian-lang` 提供俄语翻译。另见 [README.md](README.md) 和 [README.ru.md](README.ru.md)。
+## 环境要求
+
+- 已安装插件的 DSH web 配置，且 DSH 主机可通过 SSH 访问 Linux 服务器。
+- 远程账户可运行常见只读系统命令；容器数据需要有权查询 Docker/Podman。
+- 私钥路径必须指向 DSH 主机上可由 DSH 服务账户读取的文件。
+
+## 安装
+
+将 `web` 替换为所用的 DSH 配置：
+
+```sh
+dsh plugin --profile web add @goodandready/dsh-server-monitor
+```
+
+按 CLI 提示操作。在插件设置卡片中添加服务器，选择密钥或密码认证，测试并保存，然后在侧边栏打开 **Server Monitor**。卸载：`dsh plugin --profile web remove @goodandready/dsh-server-monitor`。
+
+## 配置参考
+
+请在 DSH 设置卡片中管理配置。设置仅包含连接元数据；不要将密码、私钥内容或口令写入设置或配置文件。
+
+| 字段 | 类型 | 默认值 | 说明 |
+| --- | --- | --- | --- |
+| `profiles` | 数组 | `[]` | 本插件管理的 SSH 配置。 |
+| `profiles[].id` | 字符串 | 自动生成 | 稳定配置 ID。 |
+| `profiles[].name` | 字符串 | 空 | 显示名称。 |
+| `profiles[].host` | 字符串 | 空 | DSH 可访问的 Linux 主机。 |
+| `profiles[].port` | 数字 | `22` | SSH 端口。 |
+| `profiles[].username` | 字符串 | `root` | 远程账户；建议限制权限。 |
+| `profiles[].authType` | 字符串 | `key` | `key` 或 `password`。 |
+| `profiles[].privateKeyPath` | 字符串 | 空 | DSH 主机上的可选密钥路径。 |
+| `activeProfileId` | 字符串 | 空 | 活动配置 ID。 |
+
+秘密值保存在 DSH 主机上由插件管理的保险库中。POSIX 系统要求文件权限验证为仅所有者可访问（`0600`）。
+
+## 采集内容
+
+有界只读采集器获取主机/操作系统/内核/CPU、负载和运行时间、内存与 swap、文件系统使用情况、最多 12 个 CPU 占用靠前的进程、运行中的 Docker 或 Podman 容器、网络计数器及 TCP/UDP 监听端口（使用 `ss`，否则回退到 `netstat`）。命令、运行时或权限不可用时，相应区块可能为空。
+
+## 架构
+
+```mermaid
+flowchart LR
+  UI[DSH 侧边栏] --> Client[插件客户端]
+  Client --> Routes[可信本地路由]
+  Routes --> Settings[服务器配置]
+  Routes --> Vault[凭据保险库]
+  Routes --> SSH[SSH 服务]
+  SSH --> Linux[只读 Linux 采集器]
+  Linux --> Snapshot[当前快照]
+  Snapshot --> Client
+```
+
+| 模块 | 职责 |
+| --- | --- |
+| `lib/index.js` | Cordis 注册、设置集成和服务生命周期。 |
+| `lib/client.js` | 侧边栏/设置界面；页面隐藏时暂停轮询。 |
+| `lib/routes.js` | 可信请求校验、配置操作、快照缓存。 |
+| `lib/profile.js` | 配置规范化和校验。 |
+| `lib/vault-service.js` | 凭据保存及 POSIX 权限验证。 |
+| `lib/ssh-service.js` | SSH 认证、有界命令、连接复用和清理。 |
+| `lib/linux-collector.js` | Linux 数据采集和快照解析。 |
+
+## 内部 HTTP 路由
+
+这些路由供 DSH 客户端使用并受可信请求检查保护，不是公开或远程管理 API。
+
+| 方法 | 路径 | 用途 |
+| --- | --- | --- |
+| GET | `/dsh-server-monitor/state` | 清理后的配置和所选 ID。 |
+| GET | `/dsh-server-monitor/snapshot?profileId=<id>` | 当前快照；默认活动配置。 |
+| POST | `/dsh-server-monitor/profiles/save` | 新建/更新配置。 |
+| POST | `/dsh-server-monitor/profiles/delete` | 删除配置和凭据。 |
+| POST | `/dsh-server-monitor/profiles/active` | 选择活动配置。 |
+| POST | `/dsh-server-monitor/test` | 测试 SSH 连接。 |
+
+快照按配置缓存 15 秒，并发请求共享同一次采集；保存或删除会清除该配置缓存。
+
+## 安全、支持与许可证
+
+插件独立管理 SSH 凭据，不将秘密返回浏览器，仅运行只读监控命令。仅支持 Linux；MVP 不含历史、图表、告警或远程操作。
+
+- 问题和建议：[GitHub Issues](https://github.com/GooDAnDReaDY/dsh-server-monitor/issues)
+- 许可证：[MIT](LICENSE)

package/cordis.patch.yml

@@ -0,0 +1,3 @@
+- insert:
+    - id: dsh-server-monitor
+      name: '@goodandready/dsh-server-monitor'

package/lib/client.js

@@ -0,0 +1,199 @@
+window.__ModuleLoader__.load({
+  id: '@goodandready/dsh-server-monitor',
+  factory: (require) => {
+    var module = { exports: {} };
+    const React = require('react');
+    const NS = 'dsh-server-monitor';
+    const API = '/dsh-server-monitor';
+
+    const en = {
+      title: 'Server Monitor', subtitle: 'Read-only Linux server status',
+      servers: 'Servers', guideDescription: 'Read-only Linux server status',
+      add: 'Add server', save: 'Save server', delete: 'Delete', test: 'Test connection',
+      refresh: 'Refresh', active: 'Active', connected: 'Online', offline: 'Offline', partial: 'Partial',
+      noServers: 'No servers configured yet.', noSnapshot: 'No snapshot available.',
+      name: 'Name', host: 'Host', port: 'Port', username: 'Username', auth: 'Authentication',
+      key: 'Private key', password: 'Password', passphrase: 'Key passphrase', keyPath: 'Key path',
+      keyHint: 'The key is stored only in this plugin vault.', keepSecret: 'Leave empty to keep stored value',
+      system: 'System', resources: 'Resources', disks: 'Disks', processes: 'Top processes', containers: 'Containers',
+      network: 'Network', ports: 'Listening ports', hostname: 'Hostname', os: 'OS', kernel: 'Kernel',
+      architecture: 'Architecture', cpu: 'CPU', uptime: 'Uptime', load: 'Load average', memory: 'Memory', swap: 'Swap',
+      used: 'used', available: 'available', filesystem: 'Filesystem', mount: 'Mount', command: 'Command',
+      state: 'State', image: 'Image', interface: 'Interface', rx: 'RX', tx: 'TX', protocol: 'Protocol',
+      address: 'Address', error: 'Error', loading: 'Loading…', unavailable: 'Unavailable', saved: 'Saved', confirmDelete: 'Delete this server profile?', cancel: 'Cancel',
+      saving: 'Saving…', testing: 'Testing…', select: 'Select server'
+    };
+    const zh = {
+      title: '服务器监控', subtitle: '只读 Linux 服务器状态',
+      servers: '服务器', guideDescription: '只读 Linux 服务器状态',
+      add: '添加服务器', save: '保存服务器', delete: '删除', test: '测试连接',
+      refresh: '刷新', active: '当前', connected: '在线', offline: '离线', partial: '部分可用',
+      noServers: '尚未配置服务器。', noSnapshot: '暂无状态快照。',
+      name: '名称', host: '主机', port: '端口', username: '用户名', auth: '认证方式',
+      key: '私钥', password: '密码', passphrase: '密钥口令', keyPath: '密钥路径',
+      keyHint: '密钥只存储在此插件的保险库中。', keepSecret: '留空以保留已存储的值',
+      system: '系统', resources: '资源', disks: '磁盘', processes: '高负载进程', containers: '容器',
+      network: '网络', ports: '监听端口', hostname: '主机名', os: '操作系统', kernel: '内核',
+      architecture: '架构', cpu: 'CPU', uptime: '运行时间', load: '平均负载', memory: '内存', swap: '交换分区',
+      used: '已用', available: '可用', filesystem: '文件系统', mount: '挂载点', command: '命令',
+      state: '状态', image: '镜像', interface: '接口', rx: '接收', tx: '发送', protocol: '协议',
+      address: '地址', error: '错误', loading: '加载中…', unavailable: '不可用', saved: '已保存', confirmDelete: '删除此服务器配置？', cancel: '取消',
+      saving: '保存中…', testing: '测试中…', select: '选择服务器'
+    };
+
+    function labels(ctx) {
+      const translate = ctx?.locale?.bind ? ctx.locale.bind(NS) : (key) => en[key] || key;
+      return new Proxy({}, { get: (_target, key) => typeof key === 'symbol' ? undefined : translate(String(key)) });
+    }
+    function text(value, fallback = '—') { return value === undefined || value === null || value === '' ? fallback : String(value); }
+    function pct(value) { return `${Math.round(Number(value) || 0)}%`; }
+    function formatMb(value) { const mb = Number(value) || 0; return mb >= 1024 ? `${(mb / 1024).toFixed(1)} GB` : `${Math.round(mb)} MB`; }
+    async function request(path, options = {}) {
+      const response = await fetch(API + path, { credentials: 'same-origin', ...options, headers: { 'Content-Type': 'application/json', ...(options.headers || {}) } });
+      const body = await response.json().catch(() => ({}));
+      if (!response.ok || body.ok === false) throw new Error(body.error || `HTTP ${response.status}`);
+      return body;
+    }
+    function ensureCss() {
+      if (typeof document === 'undefined' || document.getElementById('dsh-server-monitor-css')) return;
+      const style = document.createElement('style');
+      style.id = 'dsh-server-monitor-css';
+      style.dataset.dshPlugin = NS;
+      style.textContent = `
+.dsm-root{display:flex;flex-direction:column;gap:12px;padding:4px 0 18px;color:var(--dsw-alias-label-primary)}
+.dsm-card{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);border-radius:10px;padding:12px;display:flex;flex-direction:column;gap:10px}
+.dsm-head{display:flex;align-items:flex-start;justify-content:space-between;gap:8px}.dsm-title{font-size:15px;font-weight:700}.dsm-sub{font-size:11px;color:var(--dsw-alias-label-secondary);margin-top:3px}
+.dsm-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(110px,1fr));gap:7px}.dsm-stat{border:1px solid var(--dsw-alias-border-l2);border-radius:7px;padding:8px;background:var(--dsw-alias-bg-layer-2);min-width:0}.dsm-val{font-size:13px;font-weight:650;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.dsm-label{font-size:10px;color:var(--dsw-alias-label-secondary);margin-top:3px}
+.dsm-section{display:flex;flex-direction:column;gap:6px}.dsm-section-title{font-size:12px;font-weight:650}.dsm-table{width:100%;border-collapse:collapse;font-size:11px}.dsm-table th,.dsm-table td{text-align:left;padding:5px 4px;border-bottom:1px solid var(--dsw-alias-border-l2);vertical-align:top}.dsm-table th{color:var(--dsw-alias-label-secondary);font-weight:550}.dsm-muted{color:var(--dsw-alias-label-secondary);font-size:11px}.dsm-badge{font-size:10px;border:1px solid var(--dsw-alias-border-l2);border-radius:999px;padding:2px 7px;white-space:nowrap}.dsm-ok{color:var(--dsw-alias-state-success-primary)}.dsm-warn{color:var(--dsw-alias-state-warning-primary)}.dsm-err{color:var(--dsw-alias-state-error-primary)}
+.dsm-btn{appearance:none;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);border-radius:7px;padding:5px 9px;font:inherit;font-size:11px;cursor:pointer}.dsm-btn:disabled{opacity:.55;cursor:not-allowed}.dsm-btn-primary{background:var(--dsw-alias-label-primary);color:var(--dsw-alias-bg-layer-3);border-color:transparent}.dsm-row{display:flex;align-items:center;gap:7px;flex-wrap:wrap}.dsm-field{display:flex;flex-direction:column;gap:4px;min-width:140px;flex:1}.dsm-field label{font-size:11px;color:var(--dsw-alias-label-secondary)}.dsm-input{height:30px;box-sizing:border-box;width:100%;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);border-radius:7px;padding:0 8px;font:inherit;font-size:12px}.dsm-input:focus{outline:none;border-color:var(--dsw-alias-state-brand-primary)}.dsm-form-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(160px,1fr));gap:9px}.dsm-error{padding:8px;border:1px solid var(--dsw-alias-state-error-primary);border-radius:7px;color:var(--dsw-alias-state-error-primary);font-size:11px}.dsm-progress{height:5px;background:var(--dsw-alias-bg-layer-1);border-radius:4px;overflow:hidden;margin-top:5px}.dsm-progress>span{display:block;height:100%;background:var(--dsw-alias-state-brand-primary)}
+`;
+      document.head.appendChild(style);
+    }
+    function useMonitor(ctx) {
+      const [state, setState] = React.useState({ profiles: [], activeId: '', snapshot: null, loading: true, error: '' });
+      const refresh = React.useCallback(async (profileId) => {
+        try {
+          const selected = profileId || state.activeId;
+          const base = await request('/state');
+          const id = selected || base.activeId || base.profiles[0]?.id || '';
+          const snapshot = id ? (await request(`/snapshot?profileId=${encodeURIComponent(id)}`)).snapshot : null;
+          setState({ profiles: base.profiles || [], activeId: id, snapshot, loading: false, error: '' });
+        } catch (error) { setState((old) => ({ ...old, loading: false, error: error.message })); }
+      }, [state.activeId]);
+      React.useEffect(() => { const doc = typeof document === 'undefined' ? null : document; refresh(); const tick = () => { if (!doc || !doc.hidden) refresh(); }; const timer = setInterval(tick, 15000); const onVisibility = () => { if (!doc?.hidden) refresh(); }; doc?.addEventListener?.('visibilitychange', onVisibility); return () => { clearInterval(timer); doc?.removeEventListener?.('visibilitychange', onVisibility); }; }, []);
+      return { state, refresh };
+    }
+    function Badge({ status, t }) { const cls = status === 'ready' ? 'dsm-ok' : status === 'partial' ? 'dsm-warn' : 'dsm-err'; const label = status === 'ready' ? t.connected : status === 'partial' ? t.partial : t.offline; return React.createElement('span', { className: `dsm-badge ${cls}` }, label); }
+    function Stat({ label, value }) { return React.createElement('div', { className: 'dsm-stat' }, React.createElement('div', { className: 'dsm-val' }, text(value)), React.createElement('div', { className: 'dsm-label' }, label)); }
+    function ResourceBar({ label, resource }) { const percent = resource?.percent || 0; return React.createElement('div', { className: 'dsm-stat' }, React.createElement('div', { className: 'dsm-val' }, `${formatMb(resource?.usedMb)} / ${formatMb(resource?.totalMb)}`), React.createElement('div', { className: 'dsm-label' }, `${label} · ${pct(percent)}`), React.createElement('div', { className: 'dsm-progress' }, React.createElement('span', { style: { width: `${Math.min(100, Math.max(0, percent))}%` } })) ); }
+    function SnapshotView({ snapshot, t }) {
+      if (!snapshot) return React.createElement('div', { className: 'dsm-muted' }, t.noSnapshot);
+      const i = snapshot.identity || {}; const s = snapshot.system || {};
+      return React.createElement(React.Fragment, null,
+        React.createElement('div', { className: 'dsm-card' }, React.createElement('div', { className: 'dsm-head' }, React.createElement('div', null, React.createElement('div', { className: 'dsm-title' }, t.system), React.createElement('div', { className: 'dsm-sub' }, text(i.hostname), ' · ', snapshot.timestamp ? new Date(snapshot.timestamp).toLocaleTimeString() : '—')), React.createElement(Badge, { status: snapshot.status, t })), React.createElement('div', { className: 'dsm-grid' }, React.createElement(Stat, { label: t.os, value: i.os }), React.createElement(Stat, { label: t.kernel, value: i.kernel }), React.createElement(Stat, { label: t.architecture, value: i.architecture }), React.createElement(Stat, { label: t.cpu, value: `${text(i.cpuModel)} · ${i.cpuCores || 0}` }), React.createElement(Stat, { label: t.uptime, value: text(s.uptime) }), React.createElement(Stat, { label: t.load, value: (s.loadAverage || []).join(' · ') || '—' }))),
+        React.createElement('div', { className: 'dsm-card' }, React.createElement('div', { className: 'dsm-section-title' }, t.resources), React.createElement('div', { className: 'dsm-grid' }, React.createElement(ResourceBar, { label: t.memory, resource: s.memory }), React.createElement(ResourceBar, { label: t.swap, resource: s.swap }))),
+        React.createElement(ListSection, { title: t.disks, rows: snapshot.disks, columns: [t.filesystem, t.mount, t.used], render: (row) => [row.filesystem, row.mount, `${formatMb(row.usedMb)} / ${formatMb(row.totalMb)} (${pct(row.percent)})`] }),
+        React.createElement(ListSection, { title: t.processes, rows: snapshot.processes, columns: ['PID', t.command, 'CPU', 'RAM'], render: (row) => [row.pid, row.command, pct(row.cpuPercent), pct(row.memoryPercent)] }),
+        React.createElement(ListSection, { title: t.containers, rows: snapshot.containers, columns: [t.name, t.image, t.state], render: (row) => [row.name, row.image, row.state || row.status], empty: t.unavailable }),
+        React.createElement(ListSection, { title: t.network, rows: snapshot.network?.interfaces, columns: [t.interface, t.rx, t.tx], render: (row) => [row.name, `${row.rxBytes} B`, `${row.txBytes} B`] }),
+        React.createElement(ListSection, { title: t.ports, rows: snapshot.ports, columns: [t.protocol, t.address, t.port], render: (row) => [row.protocol, row.address, row.port] })
+      );
+    }
+    function ListSection({ title, rows = [], columns, render, empty = '—' }) { return React.createElement('div', { className: 'dsm-card dsm-section' }, React.createElement('div', { className: 'dsm-section-title' }, title), rows.length ? React.createElement('table', { className: 'dsm-table' }, React.createElement('thead', null, React.createElement('tr', null, columns.map((item) => React.createElement('th', { key: item }, item)))), React.createElement('tbody', null, rows.slice(0, 10).map((row, index) => React.createElement('tr', { key: row.id || row.pid || row.name || index }, render(row).map((item, itemIndex) => React.createElement('td', { key: itemIndex }, text(item))))))) : React.createElement('div', { className: 'dsm-muted' }, empty)); }
+    function MonitorPane({ ctx }) {
+      ensureCss();
+      const t = labels(ctx);
+      const { state, refresh } = useMonitor(ctx);
+      const [selected, setSelected] = React.useState('');
+      const id = selected || state.activeId;
+      const profile = state.profiles.find((item) => item.id === id);
+      const header = React.createElement('div', { className: 'dsm-card' },
+        React.createElement('div', { className: 'dsm-head' },
+          React.createElement('div', null,
+            React.createElement('div', { className: 'dsm-title' }, t.title),
+            React.createElement('div', { className: 'dsm-sub' }, profile ? `${profile.name} · ${profile.username}@${profile.host}` : t.noServers)
+          ),
+          React.createElement('button', { className: 'dsm-btn', type: 'button', onClick: () => refresh(id) }, t.refresh)
+        ),
+        state.profiles.length ? React.createElement('select', {
+          className: 'dsm-input', value: id,
+          onChange: (event) => { setSelected(event.target.value); refresh(event.target.value); }
+        }, state.profiles.map((item) => React.createElement('option', { key: item.id, value: item.id }, item.name))) : null
+      );
+      const body = state.loading ? React.createElement('div', { className: 'dsm-muted' }, t.loading)
+        : state.error ? React.createElement('div', { className: 'dsm-error' }, state.error)
+          : React.createElement(SnapshotView, { snapshot: state.snapshot, t });
+      return React.createElement('div', { className: 'dsm-root' }, header, body);
+    }
+    function SettingsCard({ ctx }) {
+      ensureCss();
+      const t = labels(ctx);
+      const [state, setState] = React.useState({ profiles: [], activeId: '' });
+      const [draft, setDraft] = React.useState(null);
+      const [busy, setBusy] = React.useState(false);
+      const [error, setError] = React.useState('');
+      const [testResult, setTestResult] = React.useState('');
+      const load = React.useCallback(() => request('/state').then(setState).catch((e) => setError(e.message)), []);
+      React.useEffect(() => { load(); }, [load]);
+      const edit = (profile) => setDraft({ ...(profile || { id: '', name: '', host: '', port: 22, username: 'root', authType: 'key', privateKeyPath: '' }), password: '', privateKey: '', passphrase: '' });
+      const field = (key, label, type = 'text') => React.createElement('div', { className: 'dsm-field' },
+        React.createElement('label', null, label),
+        React.createElement('input', { className: 'dsm-input', type, value: draft?.[key] ?? '', onChange: (event) => setDraft((old) => ({ ...old, [key]: type === 'number' ? Number(event.target.value) : event.target.value })) })
+      );
+      const save = async () => {
+        setBusy(true); setError('');
+        try { await request('/profiles/save', { method: 'POST', body: JSON.stringify(draft) }); setDraft(null); await load(); }
+        catch (e) { setError(e.message); } finally { setBusy(false); }
+      };
+      const testConnection = async () => {
+        setBusy(true); setError(''); setTestResult('');
+        try { const result = await request('/test', { method: 'POST', body: JSON.stringify({ profile: draft }) }); setTestResult(`${t.connected}: ${result.os || ''} · ${result.latencyMs || 0} ms`); }
+        catch (e) { setError(e.message); } finally { setBusy(false); }
+      };
+      const profileRows = state.profiles.map((profile) => React.createElement('div', { className: 'dsm-row', key: profile.id },
+        React.createElement('button', { className: 'dsm-btn', type: 'button', onClick: () => edit(profile) }, profile.name),
+        React.createElement('span', { className: 'dsm-muted' }, `${profile.username}@${profile.host}:${profile.port}`),
+        state.activeId === profile.id ? React.createElement('span', { className: 'dsm-badge dsm-ok' }, t.active) : null,
+        React.createElement('button', { className: 'dsm-btn', type: 'button', onClick: async () => { if (typeof window !== 'undefined' && !window.confirm(`${t.confirmDelete} ${profile.name}`)) return; await request('/profiles/delete', { method: 'POST', body: JSON.stringify({ id: profile.id }) }); load(); } }, t.delete)
+      ));
+      const form = draft ? React.createElement('div', { className: 'dsm-card' },
+        React.createElement('div', { className: 'dsm-section-title' }, t.add),
+        React.createElement('div', { className: 'dsm-form-grid' },
+          field('name', t.name), field('host', t.host), field('port', t.port, 'number'), field('username', t.username),
+          field('privateKeyPath', t.keyPath), field('privateKey', t.key, 'password'), field('passphrase', t.passphrase, 'password'), field('password', t.password, 'password'), React.createElement('div', { className: 'dsm-field' }, React.createElement('label', null, t.auth), React.createElement('select', { className: 'dsm-input', value: draft?.authType || 'key', onChange: (event) => setDraft((old) => ({ ...old, authType: event.target.value })) }, React.createElement('option', { value: 'key' }, t.key), React.createElement('option', { value: 'password' }, t.password)))
+        ),
+        React.createElement('div', { className: 'dsm-muted' }, t.keyHint, ' · ', t.keepSecret),
+        React.createElement('div', { className: 'dsm-row' },
+          React.createElement('button', { className: 'dsm-btn', type: 'button', disabled: busy, onClick: testConnection }, busy ? t.testing : t.test),
+          React.createElement('button', { className: 'dsm-btn dsm-btn-primary', type: 'button', disabled: busy, onClick: save }, busy ? t.saving : t.save),
+          React.createElement('button', { className: 'dsm-btn', type: 'button', onClick: () => setDraft(null) }, t.cancel)
+        ),
+        testResult ? React.createElement('div', { className: 'dsm-muted' }, testResult) : null
+      ) : null;
+      return React.createElement('div', { className: 'dsm-root' },
+        React.createElement('div', { className: 'dsm-card' },
+          React.createElement('div', { className: 'dsm-head' },
+            React.createElement('div', null, React.createElement('div', { className: 'dsm-title' }, t.title), React.createElement('div', { className: 'dsm-sub' }, t.subtitle)),
+            React.createElement('button', { className: 'dsm-btn dsm-btn-primary', type: 'button', onClick: () => edit(null) }, t.add)
+          ),
+          state.profiles.length ? profileRows : React.createElement('div', { className: 'dsm-muted' }, t.noServers)
+        ),
+        form,
+        error ? React.createElement('div', { className: 'dsm-error' }, error) : null
+      );
+    }
+    function register(ctx) {
+      const registerLocale = () => ctx.locale?.register?.(NS, { en, zh });
+      if (ctx.effect) ctx.effect(registerLocale, 'dsh-server-monitor: dictionaries');
+      else registerLocale();
+      const registerSettings = () => ctx.slots?.register?.({ name: 'settings.plugin.item', key: NS, locale: NS, inject: () => ({ ctx }) }, SettingsCard);
+      try { if (ctx.slots?.inject) ctx.slots.inject('settings.plugin.item', registerSettings); else registerSettings(); } catch (error) { console.warn('[dsh-server-monitor] settings slot registration failed', error); }
+      try { ctx.inject?.(['sidebarRightTabs'], (sctx) => { const tabs = sctx?.sidebarRightTabs; if (!tabs?.register) return; const t = labels(ctx); const definition = { id: '@goodandready/dsh-server-monitor', kind: 'server-monitor', priority: 'extension', title: () => t.servers, guide: [{ order: 40, title: () => t.title, description: () => t.guideDescription, icon: () => React.createElement('span', null, '◫') }] }; const registerTab = () => tabs.register(definition); if (sctx.effect) sctx.effect(registerTab); else registerTab(); const registerPane = () => ctx.slots?.register?.({ name: 'sidebar.right.pane.tab', key: '@goodandready/dsh-server-monitor', locale: NS, inject: () => ({ ctx }) }, MonitorPane); if (ctx.slots?.inject) ctx.slots.inject('sidebar.right.pane.tab', registerPane); else registerPane(); }); } catch (error) { console.warn('[dsh-server-monitor] native sidebar registration failed', error); }
+      try { ctx.inject?.(['betterSidebar'], (sctx) => { const service = sctx?.betterSidebar; if (!service?.registerTab) return; const registerTab = () => service.registerTab({ id: 'dsh-server-monitor:tab', title: () => labels(ctx).servers, icon: () => React.createElement('span', null, '◫'), order: 40, component: ({ scope }) => React.createElement(MonitorPane, { ctx, scope }) }); if (sctx.effect) sctx.effect(registerTab); else registerTab(); }); } catch (error) { console.warn('[dsh-server-monitor] legacy sidebar registration failed', error); }
+    }
+    module.exports.inject = ['slots', 'locale'];
+    module.exports.apply = register;
+    module.exports._test = { en, zh, labels, register };
+    return module.exports;
+  }
+});