@linxin666/dsh-ssh 0.1.18 → 0.1.20

package/lib/types/client/locales.d.ts

@@ -2,133 +2,133 @@
  * dsh-ssh surface copy: zh is the key source, en mirrors every key.
  */
 export declare const zh: {
-    readonly 'entry.label': "SSH";
-    readonly 'entry.tooltip': "远程 SSH 运维面板";
-    readonly 'panel.title': "远程 SSH";
-    readonly 'tab.hosts': "主机";
-    readonly 'tab.terminal': "终端";
-    readonly 'tab.transfer': "传输";
-    readonly 'tab.tunnels': "隧道";
-    readonly 'tab.cluster': "集群";
-    readonly 'hosts.empty': "尚未配置主机。点击「新增主机」添加，或从 ~/.ssh/config 导入。";
-    readonly 'hosts.add': "新增主机";
-    readonly 'hosts.import': "导入 ~/.ssh/config";
-    readonly 'hosts.search': "搜索别名 / 描述 / 标签…";
-    readonly 'hosts.col.alias': "别名";
-    readonly 'hosts.col.host': "主机";
-    readonly 'hosts.col.user': "用户";
-    readonly 'hosts.col.auth': "认证";
-    readonly 'hosts.col.environment': "环境";
-    readonly 'hosts.col.tags': "标签";
-    readonly 'hosts.col.description': "备注";
-    readonly 'hosts.col.actions': "操作";
-    readonly 'hosts.test': "测试";
-    readonly 'hosts.edit': "编辑";
-    readonly 'hosts.delete': "删除";
-    readonly 'hosts.deleteConfirm': "确定删除主机「{alias}」？将同时停止其隧道。";
-    readonly 'hosts.imported': "解析 {parsed} 个配置块，新增 {added} 台主机，跳过 {skipped} 个。";
-    readonly 'hosts.testing': "连接测试中…";
-    readonly 'hosts.testOk': "连接成功（{latency} ms）";
-    readonly 'hosts.testFail': "连接失败：{error}";
-    readonly 'hosts.connected': "连接";
-    readonly 'hosts.notConnected': "未连接";
-    readonly 'form.title.create': "新增主机";
-    readonly 'form.title.edit': "编辑主机 {alias}";
-    readonly 'form.alias': "别名";
-    readonly 'form.aliasHint': "小写字母、数字与单连字符，操作时使用";
-    readonly 'form.host': "主机地址";
-    readonly 'form.port': "端口";
-    readonly 'form.user': "用户名";
-    readonly 'form.auth': "认证方式";
-    readonly 'form.auth.key': "密钥";
-    readonly 'form.auth.password': "密码";
-    readonly 'form.authKeepHint': "编辑时密钥/密码留空将保留原认证方式与已存凭据；如需更换认证方式请填写新凭据。";
-    readonly 'form.keyPath': "私钥路径";
-    readonly 'form.keyPathHint': "如 ~/.ssh/id_ed25519";
-    readonly 'form.passphrase': "密钥口令";
-    readonly 'form.password': "密码";
-    readonly 'form.passwordHint': "明文保存在 ~/.dsh/dsh-ssh.json（本机私有文件）";
-    readonly 'form.proxyJump': "跳板机别名";
-    readonly 'form.proxyJumpHint': "逗号分隔的本地主机别名，按顺序连接";
-    readonly 'form.description': "备注";
-    readonly 'form.environment': "环境";
-    readonly 'form.environmentHint': "如 development / production";
-    readonly 'form.tags': "标签";
-    readonly 'form.tagsHint': "逗号分隔";
-    readonly 'form.location': "位置";
-    readonly 'form.save': "保存";
-    readonly 'form.cancel': "取消";
-    readonly 'form.required': "请填写必填字段：别名、主机地址、用户名。";
-    readonly 'form.portInvalid': "端口必须是 1-65535 之间的整数。";
-    readonly 'terminal.selectHost': "选择主机";
-    readonly 'terminal.connect': "连接";
-    readonly 'terminal.disconnect': "断开";
-    readonly 'terminal.placeholder': "选择主机后点击「连接」打开远程终端。";
-    readonly 'terminal.connecting': "正在连接…";
-    readonly 'terminal.ready': "终端已连接（{alias}）";
-    readonly 'terminal.exited': "终端已退出（{alias}）";
-    readonly 'terminal.error': "终端错误：{error}";
-    readonly 'transfer.selectHost': "选择主机";
-    readonly 'transfer.remotePath': "远程路径";
-    readonly 'transfer.remotePathHint': "如 /tmp/ 或 /home/user/app.tar.gz";
-    readonly 'transfer.upload': "上传";
-    readonly 'transfer.uploading': "正在上传 {file}…";
-    readonly 'transfer.download': "下载";
-    readonly 'transfer.downloading': "正在下载…";
-    readonly 'transfer.done': "完成：{bytes} 字节";
-    readonly 'transfer.failed': "传输失败：{error}";
-    readonly 'transfer.browseRemote': "浏览远程目录";
-    readonly 'transfer.refresh': "刷新";
-    readonly 'transfer.name': "名称";
-    readonly 'transfer.upLevel': "上级目录";
-    readonly 'transfer.size': "大小";
-    readonly 'transfer.modified': "修改时间";
-    readonly 'transfer.bytes': "{value} B";
-    readonly 'transfer.kib': "{value} KB";
-    readonly 'transfer.mib': "{value} MB";
-    readonly 'transfer.gib': "{value} GB";
-    readonly 'transfer.percent': "{value}%";
-    readonly 'transfer.speed': "{value}/s";
-    readonly 'transfer.dir': "目录";
-    readonly 'transfer.file': "文件";
-    readonly 'tunnel.empty': "没有活跃的隧道。";
-    readonly 'tunnel.start': "新建隧道";
-    readonly 'tunnel.alias': "主机别名";
-    readonly 'tunnel.remotePort': "远程端口";
-    readonly 'tunnel.remoteHost': "远程主机";
-    readonly 'tunnel.remoteHostHint': "默认 127.0.0.1（服务器自身）";
-    readonly 'tunnel.localPort': "本地端口";
-    readonly 'tunnel.localPortHint': "留空自动分配";
-    readonly 'tunnel.stop': "停止";
-    readonly 'tunnel.stopAll': "全部停止";
-    readonly 'tunnel.stopAllConfirm': "确定停止全部隧道吗？";
-    readonly 'tunnel.row': "{alias}: 127.0.0.1:{localPort} -> {remoteHost}:{remotePort}";
-    readonly 'tunnel.started': "隧道已建立：127.0.0.1:{localPort}";
-    readonly 'tunnel.failed': "隧道启动失败：{error}";
-    readonly 'cluster.command': "命令";
-    readonly 'cluster.run': "执行";
-    readonly 'cluster.confirm': "确定在匹配的主机上执行该命令吗？该操作会真实运行在远程服务器上。";
-    readonly 'cluster.aliases': "主机别名（逗号分隔，留空为全部）";
-    readonly 'cluster.environment': "环境过滤";
-    readonly 'cluster.tags': "标签过滤（逗号分隔）";
-    readonly 'cluster.results': "执行结果";
-    readonly 'cluster.empty': "输入命令后点击「执行」。";
-    readonly 'cluster.noMatch': "没有匹配的主机。";
-    readonly 'cluster.ok': "成功";
-    readonly 'cluster.fail': "失败";
-    readonly 'cluster.timeout': "超时";
-    readonly 'cluster.col.alias': "主机";
-    readonly 'cluster.col.status': "状态";
-    readonly 'cluster.col.exit': "退出码";
-    readonly 'cluster.col.stdout': "标准输出";
-    readonly 'cluster.col.stderr': "标准错误";
-    readonly 'cluster.col.error': "错误";
-    readonly 'cluster.col.duration': "耗时";
-    readonly 'common.loading': "加载中…";
-    readonly 'common.error': "出错：{error}";
-    readonly 'common.refresh': "刷新";
-    readonly 'common.close': "关闭";
-    readonly 'common.confirm': "确定";
+    readonly 'entry.label': 'SSH';
+    readonly 'entry.tooltip': '远程 SSH 运维面板';
+    readonly 'panel.title': '远程 SSH';
+    readonly 'panel.backToConversation': '返回会话';
+    readonly 'tab.hosts': '主机';
+    readonly 'tab.terminal': '终端';
+    readonly 'tab.transfer': '传输';
+    readonly 'tab.tunnels': '隧道';
+    readonly 'tab.cluster': '集群';
+    readonly 'hosts.empty': '尚未配置主机。点击「新增主机」添加，或从 ~/.ssh/config 导入。';
+    readonly 'hosts.add': '新增主机';
+    readonly 'hosts.import': '导入 ~/.ssh/config';
+    readonly 'hosts.search': '搜索别名 / 描述 / 标签…';
+    readonly 'hosts.col.alias': '别名';
+    readonly 'hosts.col.host': '主机';
+    readonly 'hosts.col.user': '用户';
+    readonly 'hosts.col.auth': '认证';
+    readonly 'hosts.col.environment': '环境';
+    readonly 'hosts.col.tags': '标签';
+    readonly 'hosts.col.description': '备注';
+    readonly 'hosts.col.actions': '操作';
+    readonly 'hosts.test': '测试';
+    readonly 'hosts.edit': '编辑';
+    readonly 'hosts.delete': '删除';
+    readonly 'hosts.deleteConfirm': '确定删除主机「{alias}」？将同时停止其隧道。';
+    readonly 'hosts.imported': '解析 {parsed} 个配置块，新增 {added} 台主机，跳过 {skipped} 个。';
+    readonly 'hosts.testing': '连接测试中…';
+    readonly 'hosts.testOk': '连接成功（{latency} ms）';
+    readonly 'hosts.testFail': '连接失败：{error}';
+    readonly 'hosts.connected': '连接';
+    readonly 'hosts.notConnected': '未连接';
+    readonly 'form.title.create': '新增主机';
+    readonly 'form.title.edit': '编辑主机 {alias}';
+    readonly 'form.alias': '别名';
+    readonly 'form.aliasHint': '小写字母、数字与单连字符，操作时使用';
+    readonly 'form.host': '主机地址';
+    readonly 'form.port': '端口';
+    readonly 'form.user': '用户名';
+    readonly 'form.auth': '认证方式';
+    readonly 'form.auth.key': '密钥';
+    readonly 'form.auth.password': '密码';
+    readonly 'form.authKeepHint': '编辑时密钥/密码留空将保留原认证方式与已存凭据；如需更换认证方式请填写新凭据。';
+    readonly 'form.keyPath': '私钥路径';
+    readonly 'form.keyPathHint': '如 ~/.ssh/id_ed25519';
+    readonly 'form.passphrase': '密钥口令';
+    readonly 'form.password': '密码';
+    readonly 'form.passwordHint': '明文保存在 ~/.dsh/dsh-ssh.json（本机私有文件）';
+    readonly 'form.proxyJump': '跳板机别名';
+    readonly 'form.proxyJumpHint': '逗号分隔的本地主机别名，按顺序连接';
+    readonly 'form.description': '备注';
+    readonly 'form.environment': '环境';
+    readonly 'form.environmentHint': '如 development / production';
+    readonly 'form.tags': '标签';
+    readonly 'form.tagsHint': '逗号分隔';
+    readonly 'form.location': '位置';
+    readonly 'form.save': '保存';
+    readonly 'form.cancel': '取消';
+    readonly 'form.required': '请填写必填字段：别名、主机地址、用户名。';
+    readonly 'form.portInvalid': '端口必须是 1-65535 之间的整数。';
+    readonly 'terminal.selectHost': '选择主机';
+    readonly 'terminal.connect': '连接';
+    readonly 'terminal.disconnect': '断开';
+    readonly 'terminal.placeholder': '选择主机后点击「连接」打开远程终端。';
+    readonly 'terminal.connecting': '正在连接…';
+    readonly 'terminal.ready': '终端已连接（{alias}）';
+    readonly 'terminal.exited': '终端已退出（{alias}）';
+    readonly 'terminal.error': '终端错误：{error}';
+    readonly 'transfer.selectHost': '选择主机';
+    readonly 'transfer.remotePath': '远程路径';
+    readonly 'transfer.remotePathHint': '如 /tmp/ 或 /home/user/app.tar.gz';
+    readonly 'transfer.upload': '上传';
+    readonly 'transfer.uploading': '正在上传 {file}…';
+    readonly 'transfer.download': '下载';
+    readonly 'transfer.downloading': '正在下载…';
+    readonly 'transfer.done': '完成：{bytes} 字节';
+    readonly 'transfer.failed': '传输失败：{error}';
+    readonly 'transfer.browseRemote': '浏览远程目录';
+    readonly 'transfer.refresh': '刷新';
+    readonly 'transfer.name': '名称';
+    readonly 'transfer.upLevel': '上级目录';
+    readonly 'transfer.size': '大小';
+    readonly 'transfer.modified': '修改时间';
+    readonly 'transfer.bytes': '{value} B';
+    readonly 'transfer.kib': '{value} KB';
+    readonly 'transfer.mib': '{value} MB';
+    readonly 'transfer.gib': '{value} GB';
+    readonly 'transfer.percent': '{value}%';
+    readonly 'transfer.speed': '{value}/s';
+    readonly 'transfer.dir': '目录';
+    readonly 'transfer.file': '文件';
+    readonly 'tunnel.empty': '没有活跃的隧道。';
+    readonly 'tunnel.start': '新建隧道';
+    readonly 'tunnel.alias': '主机别名';
+    readonly 'tunnel.remotePort': '远程端口';
+    readonly 'tunnel.remoteHost': '远程主机';
+    readonly 'tunnel.remoteHostHint': '默认 127.0.0.1（服务器自身）';
+    readonly 'tunnel.localPort': '本地端口';
+    readonly 'tunnel.localPortHint': '留空自动分配';
+    readonly 'tunnel.stop': '停止';
+    readonly 'tunnel.stopAll': '全部停止';
+    readonly 'tunnel.stopAllConfirm': '确定停止全部隧道吗？';
+    readonly 'tunnel.row': '{alias}: 127.0.0.1:{localPort} -> {remoteHost}:{remotePort}';
+    readonly 'tunnel.started': '隧道已建立：127.0.0.1:{localPort}';
+    readonly 'tunnel.failed': '隧道启动失败：{error}';
+    readonly 'cluster.command': '命令';
+    readonly 'cluster.run': '执行';
+    readonly 'cluster.confirm': '确定在匹配的主机上执行该命令吗？该操作会真实运行在远程服务器上。';
+    readonly 'cluster.aliases': '主机别名（逗号分隔，留空为全部）';
+    readonly 'cluster.environment': '环境过滤';
+    readonly 'cluster.tags': '标签过滤（逗号分隔）';
+    readonly 'cluster.results': '执行结果';
+    readonly 'cluster.empty': '输入命令后点击「执行」。';
+    readonly 'cluster.noMatch': '没有匹配的主机。';
+    readonly 'cluster.ok': '成功';
+    readonly 'cluster.fail': '失败';
+    readonly 'cluster.timeout': '超时';
+    readonly 'cluster.col.alias': '主机';
+    readonly 'cluster.col.status': '状态';
+    readonly 'cluster.col.exit': '退出码';
+    readonly 'cluster.col.stdout': '标准输出';
+    readonly 'cluster.col.stderr': '标准错误';
+    readonly 'cluster.col.error': '错误';
+    readonly 'cluster.col.duration': '耗时';
+    readonly 'common.loading': '加载中…';
+    readonly 'common.error': '出错：{error}';
+    readonly 'common.refresh': '刷新';
+    readonly 'common.confirm': '确定';
 };
 export declare const en: Record<keyof typeof zh, string>;
 /** Locale key union. */

package/lib/types/engine/connection-pool.d.ts

@@ -47,7 +47,7 @@ export interface PoolEngine {
     readonly acquireQueue: Map<string, Promise<PoolRecord>>;
 }
 /** Build the ssh2 connect config for one entry (key read from disk). */
-export declare function buildConnectConfig(entry: SshHostEntry, sock?: ConnectConfig['sock']): ConnectConfig;
+export declare function buildConnectConfig(entry: SshHostEntry, sock: ConnectConfig['sock'] | undefined, opts: Required<EngineOptions>): ConnectConfig;
 /** Connect one ssh2 client (resolve on ready, reject on error/close). */
 export declare function connectClient(config: ConnectConfig): Promise<Client>;
 /** Cap captured output at the configured byte budget (marks truncation). */
@@ -72,6 +72,8 @@ export declare function acquire(engine: PoolEngine, alias: string): Promise<Pool
  * is torn down — the connection belongs to someone else now.
  */
 export declare function disposeRecord(engine: PoolEngine, alias: string, record?: PoolRecord): void;
+/** End one record's client and hop chain (best-effort, safe to repeat). */
+export declare function endRecordChain(record: PoolRecord): void;
 /** Close connections idle beyond the threshold (skips pinned and in-flight). */
 export declare function sweepPool(engine: PoolEngine): void;
 /**

package/lib/types/engine/tunnel.d.ts

@@ -5,12 +5,14 @@
  */
 import { type Server as NetServer, type Socket } from 'node:net';
 import type { TunnelInfo } from '../protocol.ts';
-import { type PoolEngine } from './connection-pool.ts';
-/** One active tunnel record (server + pinned client + live sockets). */
+import { type PoolEngine, type PoolRecord } from './connection-pool.ts';
+/** One active tunnel record (server + pinned connection + live sockets). */
 export interface TunnelRecord {
     info: TunnelInfo;
     server: NetServer;
     alias: string;
+    /** The pooled connection this tunnel pins; siblings on one alias may share it. */
+    record: PoolRecord;
     sockets: Set<Socket>;
 }
 /** The engine slice the tunnel module needs (adds the tunnel registry). */

package/lib/types/engine.d.ts

@@ -74,6 +74,13 @@ export declare class SshEngine {
     stopTunnel(id: string): boolean;
     /** Stop all tunnels (optionally for one alias). */
     stopAllTunnels(alias?: string): number;
+    /**
+     * Drop every live artifact bound to one alias: stop its tunnels and close
+     * the pooled connection. Host entries that are deleted or whose connection
+     * fields change must never keep serving a stale, previously authenticated
+     * connection — the next operation re-connects from the current config.
+     */
+    dropAlias(alias: string): void;
     /** Probe connectivity: connect, run `true`, close. */
     test(alias: string): Promise<TestResult>;
     /** Close every pooled connection and tunnel. */

package/lib/types/index.d.ts

@@ -37,4 +37,6 @@ export declare const SSH_GUIDANCE = "\u672C\u673A\u5DF2\u5B89\u88C5 dsh-ssh \u63
  * @param ctx - host plugin context carrying webServer/tools/systemPrompt.
  * @param config - resolved plugin config (schema defaults applied by the loader).
  */
-export declare function apply(ctx: Context, config?: Config): void;
+export declare const apply: typeof applyImpl;
+declare function applyImpl(ctx: Context, config?: Config): void;
+export {};

package/lib/types/loopback.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Loopback trust fence shared by the host route families: socket address,
+ * Host header, and browser same-origin markers. Packages receive this file as
+ * a generated copy via scripts/sync-shared.mjs; edit the shared source and
+ * re-run the sync instead of editing a copy.
+ *
+ * Semantics: RFC 5735 IPv4 127/8, ::1, IPv4-mapped ::ffff:127/8 (matching the
+ * remote-web-ui gate), localhost hostnames, plus the browser same-origin
+ * markers (sec-fetch-site and Origin) for the request-level fence.
+ * @module dsh-web-ui-shared/host/loopback
+ */
+import type { IncomingMessage } from 'node:http';
+/** IPv4 127/8 predicate (four decimal octets, first == 127). */
+export declare function isIPv4Loopback(v4: string): boolean;
+/** Whether a socket remote address names the loopback range (127/8, ::1, IPv4-mapped). */
+export declare function isLoopbackAddress(address: string | undefined): boolean;
+/** Whether a normalized URL hostname names the loopback authority (localhost, [::1], 127/8). */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Request-level trust fence: a loopback socket address AND a loopback Host
+ * header, plus browser same-origin markers. The socket address is
+ * authoritative; X-Forwarded-For is never trusted.
+ */
+export declare function isLoopbackRequest(request: IncomingMessage): boolean;

package/lib/types/mount-once.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Host single-instance guard shared by the plugin family. The family bundle
+ * (dsh-web-ui-all / dsh-skins) namespaces every child row id (web-ui-*), so
+ * the loader accepts a standalone install of the same package side by side;
+ * without this guard the second instance would still re-register the same
+ * webserver routes, tools, settings namespaces, and system-prompt sections
+ * and fail the boot. mountOnce makes the second host apply a no-op for the
+ * lifetime of the first instance (the browser half is already deduped by
+ * package name in the client module host).
+ *
+ * The registry rides a global symbol so two module instances of the same
+ * package (npm copy vs repository link) still share one verdict. cordis
+ * `ctx.effect` runs its callback immediately and treats the callback's
+ * return value as the fiber disposer, so the unmarker is returned, not run.
+ */
+/**
+ * Wrap a cordis plugin apply so the package runs at most once per process.
+ * The first mount registers normally and unmarks when its fiber disposes;
+ * any later mount of the same package name is a no-op.
+ * @param packageName - npm package identity shared by every install source.
+ * @param fn - the original plugin apply.
+ * @returns an apply of the same shape.
+ */
+export declare function mountOnce<T extends (...args: any[]) => unknown>(packageName: string, fn: T): T;

package/lib/types/protocol.d.ts

@@ -164,7 +164,7 @@ export type TerminalClientFrame = {
     rows: number;
 };
 /** Route paths the client calls (shared literals). */
-export declare const SSH_API_BASE: "/api/dsh-ssh";
+export declare const SSH_API_BASE: '/api/dsh-ssh';
 export declare const SSH_API: {
     readonly hosts: string;
     readonly importSshConfig: string;

package/lib/types/routes.d.ts

@@ -17,6 +17,8 @@ export interface SshRoutesDeps {
     engine: SshEngine;
     /** Temp dir for upload/download staging (tests inject a sandbox). */
     stagingDir?: string;
+    /** Upload byte cap override (tests); defaults to MAX_UPLOAD_BYTES. */
+    maxUploadBytes?: number;
 }
 /**
  * Build every /api/dsh-ssh route (exact paths) plus the terminal upgrade.

package/lib/types/store.d.ts

@@ -47,6 +47,12 @@ export declare class HostStore {
      */
     importFromSshConfig(): ImportResult;
     private skippedNames;
+    /**
+     * Last parsed store keyed by file identity. list/find ride every acquire
+     * and GUI refresh; re-reading and re-parsing the whole file each call is
+     * wasted work when the file has not changed. Any save invalidates.
+     */
+    private cache;
     private load;
     private save;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-ssh",
   "description": "Remote SSH operations for the dsh web GUI: host config store (~/.dsh/dsh-ssh.json, import from ~/.ssh/config), a persistent ssh2 connection pool with jump-host support, exec / PTY web terminal / SFTP transfer / local port-forward tunnels / cluster execution, plus agent tools (ssh_list, ssh_exec, ssh_upload, ssh_download, ssh_tunnel, ssh_cluster). Hot-pluggable — mounted via ~/.dsh/cordis.patch.yml + a profile node_modules symlink, no dsh source changes.",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"

package/src/client/locales.ts

@@ -6,6 +6,7 @@ export const zh = {
   'entry.label': 'SSH',
   'entry.tooltip': '远程 SSH 运维面板',
   'panel.title': '远程 SSH',
+  'panel.backToConversation': '返回会话',
   'tab.hosts': '主机',
   'tab.terminal': '终端',
   'tab.transfer': '传输',
@@ -135,7 +136,6 @@ export const zh = {
   'common.loading': '加载中…',
   'common.error': '出错：{error}',
   'common.refresh': '刷新',
-  'common.close': '关闭',
   'common.confirm': '确定',
 } as const
 
@@ -143,6 +143,7 @@ export const en: Record<keyof typeof zh, string> = {
   'entry.label': 'SSH',
   'entry.tooltip': 'Remote SSH operations panel',
   'panel.title': 'Remote SSH',
+  'panel.backToConversation': 'Back to chat',
   'tab.hosts': 'Hosts',
   'tab.terminal': 'Terminal',
   'tab.transfer': 'Transfer',
@@ -265,7 +266,6 @@ export const en: Record<keyof typeof zh, string> = {
   'common.loading': 'Loading…',
   'common.error': 'Error: {error}',
   'common.refresh': 'Refresh',
-  'common.close': 'Close',
   'common.confirm': 'Confirm',
 }
 

package/src/client/panel/SshPanel.tsx

@@ -55,8 +55,16 @@ export function SshPanel({ controller, api }: SshPanelProps) {
   return (
     <div className={css.panel}>
       <div className={css.panelHeader}>
+        <button
+          type="button"
+          className={`${css.ghostButton} ${css.backButton}`}
+          aria-label={tt('panel.backToConversation')}
+          onClick={() => { controller.close() }}
+        >
+          <span aria-hidden="true">‹</span>
+          <span>{tt('panel.backToConversation')}</span>
+        </button>
         <h2 className={css.panelTitle}>{tt('panel.title')}</h2>
-        <button type="button" className={css.iconButton} title={tt('common.close')} aria-label={tt('common.close')} onClick={() => { controller.close() }}>x</button>
       </div>
       <div className={css.tabBar} role="tablist">
         {TABS.map(tab => (

package/src/client/panel/panel.module.css

@@ -133,6 +133,12 @@ html[data-dsh-ssh-active]:not([data-dsh-taskboard-active]) [class*='centerCol']
   white-space: nowrap;
 }
 
+.backButton {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+}
+
 /* --- tab bar ------------------------------------------------------------------ */
 
 .tabBar {

package/src/engine/connection-pool.ts

@@ -62,13 +62,13 @@ export interface PoolEngine {
 }
 
 /** Build the ssh2 connect config for one entry (key read from disk). */
-export function buildConnectConfig(entry: SshHostEntry, sock?: ConnectConfig['sock']): ConnectConfig {
+export function buildConnectConfig(entry: SshHostEntry, sock: ConnectConfig['sock'] | undefined, opts: Required<EngineOptions>): ConnectConfig {
   const config: ConnectConfig = {
     host: entry.host,
     port: entry.port,
     username: entry.user,
-    readyTimeout: 15_000,
-    keepaliveInterval: 15_000,
+    readyTimeout: opts.connectTimeoutMs,
+    keepaliveInterval: opts.keepaliveIntervalMs,
     keepaliveCountMax: 3,
   }
   if (sock !== undefined) config.sock = sock
@@ -147,7 +147,7 @@ export async function connectChain(engine: PoolEngine, entry: SshHostEntry): Pro
       for (const client of hops) client.end()
       throw new Error('proxyJump alias \'' + hopAlias + '\' not found — create it first')
     }
-    const hopClient = await connectClient(buildConnectConfig(hop, sock))
+    const hopClient = await connectClient(buildConnectConfig(hop, sock, engine.opts))
     hops.push(hopClient)
     const next = index + 1 < chain.length ? engine.store.find(chain[index + 1]) : undefined
     const nextHost = next !== undefined ? next.host : entry.host
@@ -165,7 +165,7 @@ export async function connectChain(engine: PoolEngine, entry: SshHostEntry): Pro
   }
   let target: Client | undefined
   try {
-    target = await connectClient(buildConnectConfig(entry, sock))
+    target = await connectClient(buildConnectConfig(entry, sock, engine.opts))
     return { client: target, hops }
   } catch (error) {
     for (const client of hops) client.end()
@@ -213,8 +213,13 @@ export function disposeRecord(engine: PoolEngine, alias: string, record?: PoolRe
   if (record !== undefined && current !== record) return
   if (current === undefined) return
   engine.pool.delete(alias)
-  try { current.client.end() } catch { /* already closed */ }
-  for (const hop of current.hops) {
+  endRecordChain(current)
+}
+
+/** End one record's client and hop chain (best-effort, safe to repeat). */
+export function endRecordChain(record: PoolRecord): void {
+  try { record.client.end() } catch { /* already closed */ }
+  for (const hop of record.hops) {
     try { hop.end() } catch { /* already closed */ }
   }
 }
@@ -247,6 +252,14 @@ export async function withClient<T>(engine: PoolEngine, alias: string, fn: (clie
       const result = await fn(record.client)
       record.idleAt = Date.now()
       return result
+    } catch (error) {
+      lastError = error
+      // Retry only when the connection actually broke mid-flight: drop the
+      // corpse and let the next attempt reconnect (a reconnect may replay a
+      // non-idempotent command — the documented trade-off). A failure on a
+      // healthy connection is a logic error and is rethrown, not replayed.
+      if (!record.broken) throw error
+      disposeRecord(engine, alias, record)
     } finally {
       record.inFlight -= 1
     }
@@ -297,8 +310,15 @@ export async function execCommand(engine: PoolEngine, alias: string, command: st
           if (settled) return
           settled = true
           clearTimeout(timer)
+          if (typeof code !== 'number' && !timedOut) {
+            // The channel closed without an exit status: the connection
+            // dropped mid-flight. Reject so withClient can reconnect and
+            // retry within the attempt budget.
+            reject(new Error('ssh: connection lost mid-flight (channel closed without an exit status)'))
+            return
+          }
           resolve({
-            success: code === 0 && !timedOut,
+            success: code === 0,
             exitCode: code,
             timedOut,
             stdout: stdout.text,