@linxin666/dsh-ssh 0.1.18 → 0.1.20

package/src/engine/sftp.ts

@@ -4,7 +4,7 @@
  * released exactly once so sshd's MaxSessions cap is never exhausted.
  */
 
-import { existsSync, mkdirSync, readdirSync, statSync } from 'node:fs'
+import { existsSync, lstatSync, mkdirSync, readdirSync, statSync } from 'node:fs'
 import { dirname, join, relative, resolve as resolvePath } from 'node:path'
 import { Client, type SFTPWrapper } from 'ssh2'
 import type { RemoteDirEntry, TransferProgress } from '../protocol.ts'
@@ -16,7 +16,11 @@ export function walkLocalDir(root: string): string[] {
   const visit = (dir: string): void => {
     for (const name of readdirSync(dir)) {
       const full = join(dir, name)
-      const stat = statSync(full)
+      // lstat, not stat: a symlink must never be followed — a link cycle
+      // (ln -s . self) recurses forever under stat, and a link to a file
+      // would silently upload the target's bytes.
+      const stat = lstatSync(full)
+      if (stat.isSymbolicLink()) continue
       if (stat.isDirectory()) visit(full)
       else if (stat.isFile()) files.push(relative(root, full))
     }
@@ -169,13 +173,20 @@ function ensureRemoteDir(sftp: SFTPWrapper, remote: string): Promise<void> {
   })
 }
 
-function fastPut(sftp: SFTPWrapper, src: string, dst: string, concurrency: number, onProgress?: (progress: TransferProgress) => void): Promise<void> {
+/** One fastPut/fastGet transfer with throttled progress (the two directions share everything but the verb). */
+function fastTransfer(sftp: SFTPWrapper, kind: 'put' | 'get', src: string, dst: string, concurrency: number, onProgress?: (progress: TransferProgress) => void): Promise<void> {
   return new Promise((resolve, reject) => {
+    // Progress frames name the destination on upload, the source on download;
+    // the final size comes from the local side of the transfer.
+    const file = kind === 'put' ? dst : src
+    const finalSize = (): number => statSync(kind === 'put' ? src : dst).size
     let last = 0
     let lastEmit = 0
     const started = Date.now()
-    onProgress?.({ phase: 'transferring', file: dst, transferred: 0, total: statSync(src).size, percent: 0 })
-    sftp.fastPut(src, dst, { concurrency, step: (transferred: number, _chunk: number, total: number) => {
+    if (kind === 'put') {
+      onProgress?.({ phase: 'transferring', file, transferred: 0, total: statSync(src).size, percent: 0 })
+    }
+    const step = (transferred: number, _chunk: number, total: number): void => {
       const now = Date.now()
       // Throttle: high-speed links fire one callback per chunk; the UI only
       // needs ~10 frames per second.
@@ -184,52 +195,32 @@ function fastPut(sftp: SFTPWrapper, src: string, dst: string, concurrency: numbe
       const elapsed = (now - started) / 1000
       onProgress?.({
         phase: 'transferring',
-        file: dst,
+        file,
         transferred,
         total,
         percent: total > 0 ? Math.round((transferred / total) * 1000) / 10 : 0,
         speedBps: elapsed > 0 ? Math.round((transferred - last) / elapsed) : undefined,
       })
       last = transferred
-    } }, (error) => {
+    }
+    const done = (error: unknown): void => {
       if (error !== undefined) {
-        onProgress?.({ phase: 'error', file: dst, transferred: 0, total: 0, percent: 0, error: String(error) })
+        onProgress?.({ phase: 'error', file, transferred: 0, total: 0, percent: 0, error: String(error) })
         reject(error)
       } else {
-        onProgress?.({ phase: 'done', file: dst, transferred: statSync(src).size, total: statSync(src).size, percent: 100 })
+        onProgress?.({ phase: 'done', file, transferred: finalSize(), total: finalSize(), percent: 100 })
         resolve()
       }
-    })
+    }
+    if (kind === 'put') sftp.fastPut(src, dst, { concurrency, step }, done)
+    else sftp.fastGet(src, dst, { concurrency, step }, done)
   })
 }
 
+function fastPut(sftp: SFTPWrapper, src: string, dst: string, concurrency: number, onProgress?: (progress: TransferProgress) => void): Promise<void> {
+  return fastTransfer(sftp, 'put', src, dst, concurrency, onProgress)
+}
+
 function fastGet(sftp: SFTPWrapper, src: string, dst: string, concurrency: number, onProgress?: (progress: TransferProgress) => void): Promise<void> {
-  return new Promise((resolve, reject) => {
-    let last = 0
-    let lastEmit = 0
-    const started = Date.now()
-    sftp.fastGet(src, dst, { concurrency, step: (transferred: number, _chunk: number, total: number) => {
-      const now = Date.now()
-      if (now - lastEmit < 100 && transferred < total) return
-      lastEmit = now
-      const elapsed = (now - started) / 1000
-      onProgress?.({
-        phase: 'transferring',
-        file: src,
-        transferred,
-        total,
-        percent: total > 0 ? Math.round((transferred / total) * 1000) / 10 : 0,
-        speedBps: elapsed > 0 ? Math.round((transferred - last) / elapsed) : undefined,
-      })
-      last = transferred
-    } }, (error) => {
-      if (error !== undefined) {
-        onProgress?.({ phase: 'error', file: src, transferred: 0, total: 0, percent: 0, error: String(error) })
-        reject(error)
-      } else {
-        onProgress?.({ phase: 'done', file: src, transferred: statSync(dst).size, total: statSync(dst).size, percent: 100 })
-        resolve()
-      }
-    })
-  })
+  return fastTransfer(sftp, 'get', src, dst, concurrency, onProgress)
 }

package/src/engine/tunnel.ts

@@ -6,13 +6,15 @@
 
 import { createServer, type Server as NetServer, type Socket } from 'node:net'
 import type { TunnelInfo } from '../protocol.ts'
-import { acquire, disposeRecord, type PoolEngine } from './connection-pool.ts'
+import { acquire, disposeRecord, endRecordChain, type PoolEngine, type PoolRecord } from './connection-pool.ts'
 
-/** One active tunnel record (server + pinned client + live sockets). */
+/** One active tunnel record (server + pinned connection + live sockets). */
 export interface TunnelRecord {
   info: TunnelInfo
   server: NetServer
   alias: string
+  /** The pooled connection this tunnel pins; siblings on one alias may share it. */
+  record: PoolRecord
   sockets: Set<Socket>
 }
 
@@ -48,7 +50,12 @@ export async function startTunnel(
     state: 'connecting',
     startedAt: Date.now(),
   }
-  const record = await acquire(engine, alias)
+  // Reuse the live pooled connection when one exists so sibling tunnels on
+  // one alias multiplex over it (and no orphaned connection leaks); recycle
+  // a broken one first.
+  const existing = engine.pool.get(alias)
+  if (existing !== undefined && existing.broken) disposeRecord(engine, alias, existing)
+  const record = engine.pool.get(alias) ?? (await acquire(engine, alias))
   const client = record.client
   const sockets = new Set<Socket>()
   const server = createServer((socket) => {
@@ -89,7 +96,7 @@ export async function startTunnel(
   const address = server.address()
   info.localPort = typeof address === 'object' && address !== null ? address.port : 0
   info.state = 'forwarding'
-  engine.tunnels.set(id, { info, server, alias, sockets })
+  engine.tunnels.set(id, { info, server, alias, record, sockets })
   return info
 }
 
@@ -108,7 +115,14 @@ export function stopTunnel(engine: TunnelEngine, id: string): boolean {
     try { socket.destroy() } catch { /* already closed */ }
   }
   tunnel.sockets.clear()
-  disposeRecord(engine, tunnel.alias)
+  // Sibling tunnels on the same alias share the pinned connection: release it
+  // only once the last tunnel using it is gone. A record the pool has since
+  // replaced (e.g. after a broken-connection recycle) is ended directly.
+  const shared = [...engine.tunnels.values()].some(candidate => candidate.record === tunnel.record)
+  if (!shared) {
+    if (engine.pool.get(tunnel.alias) === tunnel.record) disposeRecord(engine, tunnel.alias, tunnel.record)
+    else endRecordChain(tunnel.record)
+  }
   return true
 }
 

package/src/engine.ts

@@ -135,6 +135,17 @@ export class SshEngine {
     return stopAllTunnels(this, alias)
   }
 
+  /**
+   * Drop every live artifact bound to one alias: stop its tunnels and close
+   * the pooled connection. Host entries that are deleted or whose connection
+   * fields change must never keep serving a stale, previously authenticated
+   * connection — the next operation re-connects from the current config.
+   */
+  dropAlias(alias: string): void {
+    stopAllTunnels(this, alias)
+    disposeRecord(this, alias)
+  }
+
   // ------------------------------------------------------------- misc
 
   /** Probe connectivity: connect, run `true`, close. */

package/src/index.ts

@@ -18,6 +18,7 @@ import { SshEngine } from './engine.ts'
 import { makeRoutes } from './routes.ts'
 import { HostStore } from './store.ts'
 import { sshClusterTool, sshDownloadTool, sshExecTool, sshListTool, sshTunnelTool, sshUploadTool } from './tools.ts'
+import { mountOnce } from './mount-once.ts'
 
 /** Stable cordis plugin name. */
 export const name = 'ssh'
@@ -62,7 +63,9 @@ export const SSH_GUIDANCE = '本机已安装 dsh-ssh 插件（DSH 远程 SSH 运
  * @param ctx - host plugin context carrying webServer/tools/systemPrompt.
  * @param config - resolved plugin config (schema defaults applied by the loader).
  */
-export function apply(ctx: Context, config?: Config): void {
+export const apply = mountOnce('@linxin666/dsh-ssh', applyImpl)
+
+function applyImpl(ctx: Context, config?: Config): void {
   // The live source the surfaces read: the settings section once the web
   // settings surface is served, the composition entry otherwise.
   let current: () => Config = () => config ?? {}

package/src/loopback.ts

@@ -0,0 +1,63 @@
+// Generated by scripts/sync-shared.mjs from shared/host/loopback.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Loopback trust fence shared by the host route families: socket address,
+ * Host header, and browser same-origin markers. Packages receive this file as
+ * a generated copy via scripts/sync-shared.mjs; edit the shared source and
+ * re-run the sync instead of editing a copy.
+ *
+ * Semantics: RFC 5735 IPv4 127/8, ::1, IPv4-mapped ::ffff:127/8 (matching the
+ * remote-web-ui gate), localhost hostnames, plus the browser same-origin
+ * markers (sec-fetch-site and Origin) for the request-level fence.
+ * @module dsh-web-ui-shared/host/loopback
+ */
+
+import type { IncomingMessage } from 'node:http'
+
+/** IPv4 127/8 predicate (four decimal octets, first == 127). */
+export function isIPv4Loopback(v4: string): boolean {
+  const parts = v4.split('.')
+  return parts.length === 4
+    && parts[0] === '127'
+    && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255)
+}
+
+/** Whether a socket remote address names the loopback range (127/8, ::1, IPv4-mapped). */
+export function isLoopbackAddress(address: string | undefined): boolean {
+  if (address === undefined) return false
+  const normalized = address.toLowerCase()
+  if (normalized === '::1') return true
+  if (normalized.startsWith('::ffff:')) return isIPv4Loopback(normalized.slice('::ffff:'.length))
+  return isIPv4Loopback(normalized)
+}
+
+/** Whether a normalized URL hostname names the loopback authority (localhost, [::1], 127/8). */
+export function isLoopbackHostname(hostname: string): boolean {
+  if (hostname === 'localhost' || hostname === '[::1]') return true
+  return isIPv4Loopback(hostname)
+}
+
+/**
+ * Request-level trust fence: a loopback socket address AND a loopback Host
+ * header, plus browser same-origin markers. The socket address is
+ * authoritative; X-Forwarded-For is never trusted.
+ */
+export function isLoopbackRequest(request: IncomingMessage): boolean {
+  if (!isLoopbackAddress(request.socket.remoteAddress)) return false
+  const host = request.headers.host
+  if (typeof host !== 'string') return false
+  let hostUrl: URL
+  try {
+    hostUrl = new URL('http://' + host)
+  } catch {
+    return false
+  }
+  if (!isLoopbackHostname(hostUrl.hostname)) return false
+  if (request.headers['sec-fetch-site'] === 'cross-site') return false
+  const origin = request.headers.origin
+  if (origin === undefined) return true
+  try {
+    return new URL(origin).host === hostUrl.host
+  } catch {
+    return false
+  }
+}

package/src/mount-once.ts

@@ -0,0 +1,48 @@
+// Generated by scripts/sync-shared.mjs from shared/host/mount-once.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Host single-instance guard shared by the plugin family. The family bundle
+ * (dsh-web-ui-all / dsh-skins) namespaces every child row id (web-ui-*), so
+ * the loader accepts a standalone install of the same package side by side;
+ * without this guard the second instance would still re-register the same
+ * webserver routes, tools, settings namespaces, and system-prompt sections
+ * and fail the boot. mountOnce makes the second host apply a no-op for the
+ * lifetime of the first instance (the browser half is already deduped by
+ * package name in the client module host).
+ *
+ * The registry rides a global symbol so two module instances of the same
+ * package (npm copy vs repository link) still share one verdict. cordis
+ * `ctx.effect` runs its callback immediately and treats the callback's
+ * return value as the fiber disposer, so the unmarker is returned, not run.
+ */
+
+const MOUNTED = Symbol.for('dsh-web-ui.mounted-plugins')
+
+interface MountRegistry {
+  [MOUNTED]?: Set<string>
+}
+
+function mountedSet(): Set<string> {
+  const registry = globalThis as MountRegistry
+  return (registry[MOUNTED] ??= new Set())
+}
+
+/**
+ * Wrap a cordis plugin apply so the package runs at most once per process.
+ * The first mount registers normally and unmarks when its fiber disposes;
+ * any later mount of the same package name is a no-op.
+ * @param packageName - npm package identity shared by every install source.
+ * @param fn - the original plugin apply.
+ * @returns an apply of the same shape.
+ */
+export function mountOnce<T extends (...args: any[]) => unknown>(packageName: string, fn: T): T {
+  return ((...args: unknown[]) => {
+    const mounted = mountedSet()
+    if (mounted.has(packageName)) return
+    mounted.add(packageName)
+    const ctx = args[0] as { effect?: (effect: () => unknown) => unknown } | undefined
+    ctx?.effect?.(() => () => {
+      mounted.delete(packageName)
+    })
+    return fn(...args)
+  }) as T
+}

package/src/routes.ts

@@ -16,6 +16,7 @@ import { randomBytes } from 'node:crypto'
 import { WebSocket, WebSocketServer } from 'ws'
 import type { WebRoute, WebUpgradeRoute } from '@deepseek-ai/dsh-host-webserver'
 import type { SshEngine, ShellSession } from './engine.ts'
+import { isLoopbackRequest } from './loopback.ts'
 import { SSH_API, type HostPayload, type TerminalClientFrame, type TerminalServerFrame } from './protocol.ts'
 import type { HostStore } from './store.ts'
 
@@ -38,29 +39,6 @@ const BACKPRESSURE_HIGH_WATER = 1024 * 1024
 /** …and resume once it drains below this. */
 const BACKPRESSURE_LOW_WATER = 512 * 1024
 
-/** Loopback literal check plus browser same-origin markers (mirrors the pairing routes' fence). */
-function isLoopbackRequest(request: IncomingMessage): boolean {
-  const address = request.socket.remoteAddress
-  if (address !== '127.0.0.1' && address !== '::1' && address !== '::ffff:127.0.0.1') return false
-  const host = request.headers.host
-  if (typeof host !== 'string') return false
-  let hostUrl: URL
-  try {
-    hostUrl = new URL(`http://${host}`)
-  } catch {
-    return false
-  }
-  if (hostUrl.hostname !== '127.0.0.1' && hostUrl.hostname !== 'localhost' && hostUrl.hostname !== '[::1]') return false
-  if (request.headers['sec-fetch-site'] === 'cross-site') return false
-  const origin = request.headers.origin
-  if (origin === undefined) return true
-  try {
-    return new URL(origin).host === hostUrl.host
-  } catch {
-    return false
-  }
-}
-
 /** One JSON response. */
 function writeJson(res: ServerResponse, status: number, body: unknown): void {
   const payload = JSON.stringify(body)
@@ -100,6 +78,8 @@ export interface SshRoutesDeps {
   engine: SshEngine
   /** Temp dir for upload/download staging (tests inject a sandbox). */
   stagingDir?: string
+/** Upload byte cap override (tests); defaults to MAX_UPLOAD_BYTES. */
+maxUploadBytes?: number
 }
 
 /**
@@ -110,6 +90,7 @@ export interface SshRoutesDeps {
 export function makeRoutes(deps: SshRoutesDeps): { routes: WebRoute[]; upgrade: WebUpgradeRoute } {
   const { store, engine } = deps
   const staging = deps.stagingDir ?? join(tmpdir(), 'dsh-ssh-uploads')
+const maxUploadBytes = deps.maxUploadBytes ?? MAX_UPLOAD_BYTES
   // The upload route stages request bodies here; it must exist before the
   // first request (a missing dir would hang the first upload forever).
   mkdirSync(staging, { recursive: true })
@@ -176,6 +157,13 @@ export function makeRoutes(deps: SshRoutesDeps): { routes: WebRoute[]; upgrade:
           }
           try {
             const entry = store.update(alias, body as unknown as Partial<HostPayload>)
+            // Connection-relevant changes invalidate the pooled connection:
+            // without this the pool would keep running commands on the old
+            // host/credentials until the idle sweep (up to 30 min later).
+            const patch = body as Record<string, unknown>
+            if (['host', 'port', 'user', 'auth', 'proxyJump'].some(key => patch[key] !== undefined)) {
+              engine.dropAlias(alias)
+            }
             writeJson(res, 200, { host: store.summarize(entry) })
           } catch (error) {
             writeJson(res, 400, { error: error instanceof Error ? error.message : String(error) })
@@ -184,7 +172,7 @@ export function makeRoutes(deps: SshRoutesDeps): { routes: WebRoute[]; upgrade:
         }
         if (method === 'DELETE') {
           try {
-            engine.stopAllTunnels(alias)
+            engine.dropAlias(alias)
             store.delete(alias)
             writeJson(res, 200, { ok: true })
           } catch (error) {
@@ -351,7 +339,7 @@ export function makeRoutes(deps: SshRoutesDeps): { routes: WebRoute[]; upgrade:
           return
         }
         const declared = Number(req.headers['content-length'])
-        if (Number.isFinite(declared) && declared > MAX_UPLOAD_BYTES) {
+        if (Number.isFinite(declared) && declared > maxUploadBytes) {
           writeJson(res, 413, { error: 'upload body too large' })
           return
         }
@@ -387,6 +375,17 @@ export function makeRoutes(deps: SshRoutesDeps): { routes: WebRoute[]; upgrade:
         req.on('aborted', () => fail('upload aborted by the client'))
         res.on('error', () => fail('response stream closed'))
         res.on('close', () => { if (!res.writableEnded) fail('connection closed') })
+        // The content-length pre-check above can be bypassed by chunked or
+        // header-less requests: count the bytes as they actually arrive and
+        // abort the moment the cap is exceeded.
+        let received = 0
+        req.on('data', (chunk: Buffer) => {
+          received += chunk.byteLength
+          if (received > maxUploadBytes) {
+            fail('upload body too large')
+            try { req.destroy() } catch { /* closed */ }
+          }
+        })
         req.pipe(sink)
         sink.on('finish', async () => {
           if (settled) return

package/src/store.ts

@@ -6,7 +6,7 @@
  * as ssh-skill's annotated ssh-config comments; document it, never log it.
  */
 
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
 import type { HostPayload, ImportResult, SshHostEntry, SshHostSummary } from './protocol.ts'
@@ -306,18 +306,36 @@ export class HostStore {
 
   private skippedNames = new Set<string>()
 
+  /**
+   * Last parsed store keyed by file identity. list/find ride every acquire
+   * and GUI refresh; re-reading and re-parsing the whole file each call is
+   * wasted work when the file has not changed. Any save invalidates.
+   */
+  private cache: { mtimeMs: number; size: number; file: StoreFile } | undefined
+
   private load(): StoreFile {
-    if (!existsSync(this.path)) return { version: FORMAT_VERSION, hosts: [] }
+    let stats: { mtimeMs: number; size: number }
+    try {
+      stats = statSync(this.path)
+    } catch {
+      this.cache = undefined
+      return { version: FORMAT_VERSION, hosts: [] }
+    }
+    if (this.cache !== undefined && this.cache.mtimeMs === stats.mtimeMs && this.cache.size === stats.size) {
+      return this.cache.file
+    }
     try {
       const parsed = JSON.parse(readFileSync(this.path, 'utf8')) as StoreFile
       if (typeof parsed !== 'object' || parsed === null || !Array.isArray(parsed.hosts)) {
         throw new Error('store file shape invalid')
       }
+      this.cache = { mtimeMs: stats.mtimeMs, size: stats.size, file: parsed }
       return parsed
     } catch {
       // A corrupt store must not brick the plugin — and must not be silently
       // overwritten by the next save: rename it aside for manual recovery
       // (the plugin then starts from an empty list).
+      this.cache = undefined
       try {
         renameSync(this.path, `${this.path}.corrupt-${Date.now()}`)
       } catch { /* best effort */ }
@@ -333,6 +351,7 @@ export class HostStore {
     // tmp file carries the 0600 mode through the rename.
     writeFileSync(tmp, JSON.stringify(file, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 })
     renameSync(tmp, this.path)
+    this.cache = undefined
   }
 }