@linxin666/dsh-ssh 0.1.19 → 0.1.20

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   node scripts/verify-docs.mjs --write <dir>
-README.md: ab9bd6b8b9dfe08a1be7f7dbb3bcd41d086659e0
-README.zh.md: 3972324c8541d87d0603de64be7817f32d3e98ad
+README.md: 0ec42622377937f15e508d4b28a95688f511f5e5
+README.zh.md: 8a5de44f200457cef7d01c94162b8bc3a5af1c5e

package/README.md

@@ -23,6 +23,7 @@ Built on the capability list of [badseal/ssh-skill](https://github.com/badseal/s
 - All `/api/dsh-ssh/*` routes are loopback-only (with same-origin checks) — the interfaces that execute commands against remote servers are not exposed to the LAN.
 - Passwords / key passphrases are stored in plain text in `~/.dsh/dsh-ssh.json`, file mode 0600, directory 0700 (the same trust model as ssh-skill writing passwords into ssh-config comments).
 - Tunnels only listen on `127.0.0.1`.
+- Deleting a host or changing its connection fields (host / port / user / auth / proxyJump) immediately closes that alias's pooled connection and tunnels; later operations reconnect with the new configuration and never reuse a connection authenticated with the old credentials.
 - Before the Agent uses a tool, the host must first be configured in the GUI (or imported from ~/.ssh/config).
 - `ssh_upload` / `ssh_download` read/write arbitrary local paths on this machine with host-process privileges (not through the bash sandbox) — same host-local-path semantics as ssh-skill, be aware of that permission surface.
 - The remote output of exec / cluster is returned verbatim (not sanitized); a command like `env` may bring secrets from the remote environment back into the conversation log.

package/README.zh.md

@@ -23,6 +23,7 @@
 - 所有 `/api/dsh-ssh/*` 路由仅限 loopback 访问（含同源校验）——对远程服务器执行命令的接口不会暴露给局域网。
 - 密码 / 密钥口令以明文保存在 `~/.dsh/dsh-ssh.json`，文件权限 0600、目录 0700（与 ssh-skill 把密码写进 ssh-config 注释同一信任模型）。
 - 隧道只监听 `127.0.0.1`。
+- 删除主机或修改其连接字段（host / port / user / auth / proxyJump）会立即断开该别名的池化连接与隧道，后续操作按新配置重新建连，不会复用旧凭据的已认证连接。
 - Agent 使用工具前，主机需先在 GUI 中配置（或从 ~/.ssh/config 导入）。
 - `ssh_upload` / `ssh_download` 以宿主进程权限直接读写本机任意路径（不经 bash 沙箱）——与 ssh-skill 的宿主本地路径语义一致，注意该权限面。
 - exec / cluster 的远程输出原样返回（不脱敏），命令如 `env` 可能把远端环境中的密钥带回对话记录。

package/lib/index.js

@@ -1,5 +1,5 @@
 import { installSettingsSection, settingsNamespace } from "@deepseek-ai/dsh-settings";
-import { createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { Client } from "ssh2";
 import { homedir, tmpdir } from "node:os";
 import { basename, dirname, join, relative, resolve } from "node:path";
@@ -1272,16 +1272,35 @@ var HostStore = class {
 		};
 	}
 	skippedNames = /* @__PURE__ */ new Set();
+	/**
+	* Last parsed store keyed by file identity. list/find ride every acquire
+	* and GUI refresh; re-reading and re-parsing the whole file each call is
+	* wasted work when the file has not changed. Any save invalidates.
+	*/
+	cache;
 	load() {
-		if (!existsSync(this.path)) return {
-			version: FORMAT_VERSION,
-			hosts: []
-		};
+		let stats;
+		try {
+			stats = statSync(this.path);
+		} catch {
+			this.cache = void 0;
+			return {
+				version: FORMAT_VERSION,
+				hosts: []
+			};
+		}
+		if (this.cache !== void 0 && this.cache.mtimeMs === stats.mtimeMs && this.cache.size === stats.size) return this.cache.file;
 		try {
 			const parsed = JSON.parse(readFileSync(this.path, "utf8"));
 			if (typeof parsed !== "object" || parsed === null || !Array.isArray(parsed.hosts)) throw new Error("store file shape invalid");
+			this.cache = {
+				mtimeMs: stats.mtimeMs,
+				size: stats.size,
+				file: parsed
+			};
 			return parsed;
 		} catch {
+			this.cache = void 0;
 			try {
 				renameSync(this.path, `${this.path}.corrupt-${Date.now()}`);
 			} catch {}
@@ -1303,6 +1322,7 @@ var HostStore = class {
 			mode: 384
 		});
 		renameSync(tmp, this.path);
+		this.cache = void 0;
 	}
 };
 /** Expand a leading `~` in a filesystem path. */
@@ -1473,10 +1493,14 @@ function disposeRecord(engine, alias, record) {
 	if (record !== void 0 && current !== record) return;
 	if (current === void 0) return;
 	engine.pool.delete(alias);
+	endRecordChain(current);
+}
+/** End one record's client and hop chain (best-effort, safe to repeat). */
+function endRecordChain(record) {
 	try {
-		current.client.end();
+		record.client.end();
 	} catch {}
-	for (const hop of current.hops) try {
+	for (const hop of record.hops) try {
 		hop.end();
 	} catch {}
 }
@@ -1503,6 +1527,10 @@ async function withClient(engine, alias, fn, attempts = 3) {
 			const result = await fn(record.client);
 			record.idleAt = Date.now();
 			return result;
+		} catch (error) {
+			lastError = error;
+			if (!record.broken) throw error;
+			disposeRecord(engine, alias, record);
 		} finally {
 			record.inFlight -= 1;
 		}
@@ -1560,8 +1588,12 @@ async function execCommand(engine, alias, command, timeoutMs) {
 					if (settled) return;
 					settled = true;
 					clearTimeout(timer);
+					if (typeof code !== "number" && !timedOut) {
+						reject(/* @__PURE__ */ new Error("ssh: connection lost mid-flight (channel closed without an exit status)"));
+						return;
+					}
 					resolve({
-						success: code === 0 && !timedOut,
+						success: code === 0,
 						exitCode: code,
 						timedOut,
 						stdout: stdout.text,
@@ -1673,7 +1705,8 @@ function walkLocalDir(root) {
 	const visit = (dir) => {
 		for (const name of readdirSync(dir)) {
 			const full = join(dir, name);
-			const stat = statSync(full);
+			const stat = lstatSync(full);
+			if (stat.isSymbolicLink()) continue;
 			if (stat.isDirectory()) visit(full);
 			else if (stat.isFile()) files.push(relative(root, full));
 		}
@@ -1797,40 +1830,41 @@ function ensureRemoteDir(sftp, remote) {
 		walk(0);
 	});
 }
-function fastPut(sftp, src, dst, concurrency, onProgress) {
+/** One fastPut/fastGet transfer with throttled progress (the two directions share everything but the verb). */
+function fastTransfer(sftp, kind, src, dst, concurrency, onProgress) {
 	return new Promise((resolve, reject) => {
+		const file = kind === "put" ? dst : src;
+		const finalSize = () => statSync(kind === "put" ? src : dst).size;
 		let last = 0;
 		let lastEmit = 0;
 		const started = Date.now();
-		onProgress?.({
+		if (kind === "put") onProgress?.({
 			phase: "transferring",
-			file: dst,
+			file,
 			transferred: 0,
 			total: statSync(src).size,
 			percent: 0
 		});
-		sftp.fastPut(src, dst, {
-			concurrency,
-			step: (transferred, _chunk, total) => {
-				const now = Date.now();
-				if (now - lastEmit < 100 && transferred < total) return;
-				lastEmit = now;
-				const elapsed = (now - started) / 1e3;
-				onProgress?.({
-					phase: "transferring",
-					file: dst,
-					transferred,
-					total,
-					percent: total > 0 ? Math.round(transferred / total * 1e3) / 10 : 0,
-					speedBps: elapsed > 0 ? Math.round((transferred - last) / elapsed) : void 0
-				});
-				last = transferred;
-			}
-		}, (error) => {
+		const step = (transferred, _chunk, total) => {
+			const now = Date.now();
+			if (now - lastEmit < 100 && transferred < total) return;
+			lastEmit = now;
+			const elapsed = (now - started) / 1e3;
+			onProgress?.({
+				phase: "transferring",
+				file,
+				transferred,
+				total,
+				percent: total > 0 ? Math.round(transferred / total * 1e3) / 10 : 0,
+				speedBps: elapsed > 0 ? Math.round((transferred - last) / elapsed) : void 0
+			});
+			last = transferred;
+		};
+		const done = (error) => {
 			if (error !== void 0) {
 				onProgress?.({
 					phase: "error",
-					file: dst,
+					file,
 					transferred: 0,
 					total: 0,
 					percent: 0,
@@ -1840,61 +1874,29 @@ function fastPut(sftp, src, dst, concurrency, onProgress) {
 			} else {
 				onProgress?.({
 					phase: "done",
-					file: dst,
-					transferred: statSync(src).size,
-					total: statSync(src).size,
+					file,
+					transferred: finalSize(),
+					total: finalSize(),
 					percent: 100
 				});
 				resolve();
 			}
-		});
+		};
+		if (kind === "put") sftp.fastPut(src, dst, {
+			concurrency,
+			step
+		}, done);
+		else sftp.fastGet(src, dst, {
+			concurrency,
+			step
+		}, done);
 	});
 }
+function fastPut(sftp, src, dst, concurrency, onProgress) {
+	return fastTransfer(sftp, "put", src, dst, concurrency, onProgress);
+}
 function fastGet(sftp, src, dst, concurrency, onProgress) {
-	return new Promise((resolve, reject) => {
-		let last = 0;
-		let lastEmit = 0;
-		const started = Date.now();
-		sftp.fastGet(src, dst, {
-			concurrency,
-			step: (transferred, _chunk, total) => {
-				const now = Date.now();
-				if (now - lastEmit < 100 && transferred < total) return;
-				lastEmit = now;
-				const elapsed = (now - started) / 1e3;
-				onProgress?.({
-					phase: "transferring",
-					file: src,
-					transferred,
-					total,
-					percent: total > 0 ? Math.round(transferred / total * 1e3) / 10 : 0,
-					speedBps: elapsed > 0 ? Math.round((transferred - last) / elapsed) : void 0
-				});
-				last = transferred;
-			}
-		}, (error) => {
-			if (error !== void 0) {
-				onProgress?.({
-					phase: "error",
-					file: src,
-					transferred: 0,
-					total: 0,
-					percent: 0,
-					error: String(error)
-				});
-				reject(error);
-			} else {
-				onProgress?.({
-					phase: "done",
-					file: src,
-					transferred: statSync(dst).size,
-					total: statSync(dst).size,
-					percent: 100
-				});
-				resolve();
-			}
-		});
-	});
+	return fastTransfer(sftp, "get", src, dst, concurrency, onProgress);
 }
 //#endregion
 //#region src/engine/tunnel.ts
@@ -1920,7 +1922,9 @@ async function startTunnel(engine, alias, options) {
 		state: "connecting",
 		startedAt: Date.now()
 	};
-	const record = await acquire(engine, alias);
+	const existing = engine.pool.get(alias);
+	if (existing !== void 0 && existing.broken) disposeRecord(engine, alias, existing);
+	const record = engine.pool.get(alias) ?? await acquire(engine, alias);
 	const client = record.client;
 	const sockets = /* @__PURE__ */ new Set();
 	const server = createServer((socket) => {
@@ -1968,6 +1972,7 @@ async function startTunnel(engine, alias, options) {
 		info,
 		server,
 		alias,
+		record,
 		sockets
 	});
 	return info;
@@ -1988,7 +1993,8 @@ function stopTunnel(engine, id) {
 		socket.destroy();
 	} catch {}
 	tunnel.sockets.clear();
-	disposeRecord(engine, tunnel.alias);
+	if (![...engine.tunnels.values()].some((candidate) => candidate.record === tunnel.record)) if (engine.pool.get(tunnel.alias) === tunnel.record) disposeRecord(engine, tunnel.alias, tunnel.record);
+	else endRecordChain(tunnel.record);
 	return true;
 }
 /** Stop all tunnels (optionally for one alias). */
@@ -2116,6 +2122,16 @@ var SshEngine = class {
 	stopAllTunnels(alias) {
 		return stopAllTunnels(this, alias);
 	}
+	/**
+	* Drop every live artifact bound to one alias: stop its tunnels and close
+	* the pooled connection. Host entries that are deleted or whose connection
+	* fields change must never keep serving a stale, previously authenticated
+	* connection — the next operation re-connects from the current config.
+	*/
+	dropAlias(alias) {
+		stopAllTunnels(this, alias);
+		disposeRecord(this, alias);
+	}
 	/** Probe connectivity: connect, run `true`, close. */
 	async test(alias) {
 		const started = Date.now();
@@ -2266,6 +2282,7 @@ function queryParam(url, name) {
 function makeRoutes(deps) {
 	const { store, engine } = deps;
 	const staging = deps.stagingDir ?? join(tmpdir(), "dsh-ssh-uploads");
+	const maxUploadBytes = deps.maxUploadBytes ?? MAX_UPLOAD_BYTES;
 	mkdirSync(staging, { recursive: true });
 	/** Guard helper: fence + method check. */
 	const guard = (req, res, method) => {
@@ -2326,6 +2343,14 @@ function makeRoutes(deps) {
 						}
 						try {
 							const entry = store.update(alias, body);
+							const patch = body;
+							if ([
+								"host",
+								"port",
+								"user",
+								"auth",
+								"proxyJump"
+							].some((key) => patch[key] !== void 0)) engine.dropAlias(alias);
 							writeJson(res, 200, { host: store.summarize(entry) });
 						} catch (error) {
 							writeJson(res, 400, { error: error instanceof Error ? error.message : String(error) });
@@ -2334,7 +2359,7 @@ function makeRoutes(deps) {
 					}
 					if (method === "DELETE") {
 						try {
-							engine.stopAllTunnels(alias);
+							engine.dropAlias(alias);
 							store.delete(alias);
 							writeJson(res, 200, { ok: true });
 						} catch (error) {
@@ -2503,7 +2528,7 @@ function makeRoutes(deps) {
 						return;
 					}
 					const declared = Number(req.headers["content-length"]);
-					if (Number.isFinite(declared) && declared > MAX_UPLOAD_BYTES) {
+					if (Number.isFinite(declared) && declared > maxUploadBytes) {
 						writeJson(res, 413, { error: "upload body too large" });
 						return;
 					}
@@ -2550,6 +2575,16 @@ function makeRoutes(deps) {
 					res.on("close", () => {
 						if (!res.writableEnded) fail("connection closed");
 					});
+					let received = 0;
+					req.on("data", (chunk) => {
+						received += chunk.byteLength;
+						if (received > maxUploadBytes) {
+							fail("upload body too large");
+							try {
+								req.destroy();
+							} catch {}
+						}
+					});
 					req.pipe(sink);
 					sink.on("finish", async () => {
 						if (settled) return;
@@ -3301,6 +3336,47 @@ function sshClusterTool(engine) {
 	});
 }
 //#endregion
+//#region src/mount-once.ts
+/**
+* Host single-instance guard shared by the plugin family. The family bundle
+* (dsh-web-ui-all / dsh-skins) namespaces every child row id (web-ui-*), so
+* the loader accepts a standalone install of the same package side by side;
+* without this guard the second instance would still re-register the same
+* webserver routes, tools, settings namespaces, and system-prompt sections
+* and fail the boot. mountOnce makes the second host apply a no-op for the
+* lifetime of the first instance (the browser half is already deduped by
+* package name in the client module host).
+*
+* The registry rides a global symbol so two module instances of the same
+* package (npm copy vs repository link) still share one verdict. cordis
+* `ctx.effect` runs its callback immediately and treats the callback's
+* return value as the fiber disposer, so the unmarker is returned, not run.
+*/
+const MOUNTED = Symbol.for("dsh-web-ui.mounted-plugins");
+function mountedSet() {
+	const registry = globalThis;
+	return registry[MOUNTED] ??= /* @__PURE__ */ new Set();
+}
+/**
+* Wrap a cordis plugin apply so the package runs at most once per process.
+* The first mount registers normally and unmarks when its fiber disposes;
+* any later mount of the same package name is a no-op.
+* @param packageName - npm package identity shared by every install source.
+* @param fn - the original plugin apply.
+* @returns an apply of the same shape.
+*/
+function mountOnce(packageName, fn) {
+	return ((...args) => {
+		const mounted = mountedSet();
+		if (mounted.has(packageName)) return;
+		mounted.add(packageName);
+		args[0]?.effect?.(() => () => {
+			mounted.delete(packageName);
+		});
+		return fn(...args);
+	});
+}
+//#endregion
 //#region src/index.ts
 /** Stable cordis plugin name. */
 const name = "ssh";
@@ -3331,7 +3407,8 @@ const SSH_GUIDANCE = "本机已安装 dsh-ssh 插件（DSH 远程 SSH 运维）
 * @param ctx - host plugin context carrying webServer/tools/systemPrompt.
 * @param config - resolved plugin config (schema defaults applied by the loader).
 */
-function apply(ctx, config) {
+const apply = mountOnce("@linxin666/dsh-ssh", applyImpl);
+function applyImpl(ctx, config) {
 	let current = () => config ?? {};
 	const resolve = () => {
 		const value = current();

package/lib/types/client/locales.d.ts

@@ -2,133 +2,133 @@
  * dsh-ssh surface copy: zh is the key source, en mirrors every key.
  */
 export declare const zh: {
-    readonly 'entry.label': "SSH";
-    readonly 'entry.tooltip': "远程 SSH 运维面板";
-    readonly 'panel.title': "远程 SSH";
-    readonly 'panel.backToConversation': "返回会话";
-    readonly 'tab.hosts': "主机";
-    readonly 'tab.terminal': "终端";
-    readonly 'tab.transfer': "传输";
-    readonly 'tab.tunnels': "隧道";
-    readonly 'tab.cluster': "集群";
-    readonly 'hosts.empty': "尚未配置主机。点击「新增主机」添加，或从 ~/.ssh/config 导入。";
-    readonly 'hosts.add': "新增主机";
-    readonly 'hosts.import': "导入 ~/.ssh/config";
-    readonly 'hosts.search': "搜索别名 / 描述 / 标签…";
-    readonly 'hosts.col.alias': "别名";
-    readonly 'hosts.col.host': "主机";
-    readonly 'hosts.col.user': "用户";
-    readonly 'hosts.col.auth': "认证";
-    readonly 'hosts.col.environment': "环境";
-    readonly 'hosts.col.tags': "标签";
-    readonly 'hosts.col.description': "备注";
-    readonly 'hosts.col.actions': "操作";
-    readonly 'hosts.test': "测试";
-    readonly 'hosts.edit': "编辑";
-    readonly 'hosts.delete': "删除";
-    readonly 'hosts.deleteConfirm': "确定删除主机「{alias}」？将同时停止其隧道。";
-    readonly 'hosts.imported': "解析 {parsed} 个配置块，新增 {added} 台主机，跳过 {skipped} 个。";
-    readonly 'hosts.testing': "连接测试中…";
-    readonly 'hosts.testOk': "连接成功（{latency} ms）";
-    readonly 'hosts.testFail': "连接失败：{error}";
-    readonly 'hosts.connected': "连接";
-    readonly 'hosts.notConnected': "未连接";
-    readonly 'form.title.create': "新增主机";
-    readonly 'form.title.edit': "编辑主机 {alias}";
-    readonly 'form.alias': "别名";
-    readonly 'form.aliasHint': "小写字母、数字与单连字符，操作时使用";
-    readonly 'form.host': "主机地址";
-    readonly 'form.port': "端口";
-    readonly 'form.user': "用户名";
-    readonly 'form.auth': "认证方式";
-    readonly 'form.auth.key': "密钥";
-    readonly 'form.auth.password': "密码";
-    readonly 'form.authKeepHint': "编辑时密钥/密码留空将保留原认证方式与已存凭据；如需更换认证方式请填写新凭据。";
-    readonly 'form.keyPath': "私钥路径";
-    readonly 'form.keyPathHint': "如 ~/.ssh/id_ed25519";
-    readonly 'form.passphrase': "密钥口令";
-    readonly 'form.password': "密码";
-    readonly 'form.passwordHint': "明文保存在 ~/.dsh/dsh-ssh.json（本机私有文件）";
-    readonly 'form.proxyJump': "跳板机别名";
-    readonly 'form.proxyJumpHint': "逗号分隔的本地主机别名，按顺序连接";
-    readonly 'form.description': "备注";
-    readonly 'form.environment': "环境";
-    readonly 'form.environmentHint': "如 development / production";
-    readonly 'form.tags': "标签";
-    readonly 'form.tagsHint': "逗号分隔";
-    readonly 'form.location': "位置";
-    readonly 'form.save': "保存";
-    readonly 'form.cancel': "取消";
-    readonly 'form.required': "请填写必填字段：别名、主机地址、用户名。";
-    readonly 'form.portInvalid': "端口必须是 1-65535 之间的整数。";
-    readonly 'terminal.selectHost': "选择主机";
-    readonly 'terminal.connect': "连接";
-    readonly 'terminal.disconnect': "断开";
-    readonly 'terminal.placeholder': "选择主机后点击「连接」打开远程终端。";
-    readonly 'terminal.connecting': "正在连接…";
-    readonly 'terminal.ready': "终端已连接（{alias}）";
-    readonly 'terminal.exited': "终端已退出（{alias}）";
-    readonly 'terminal.error': "终端错误：{error}";
-    readonly 'transfer.selectHost': "选择主机";
-    readonly 'transfer.remotePath': "远程路径";
-    readonly 'transfer.remotePathHint': "如 /tmp/ 或 /home/user/app.tar.gz";
-    readonly 'transfer.upload': "上传";
-    readonly 'transfer.uploading': "正在上传 {file}…";
-    readonly 'transfer.download': "下载";
-    readonly 'transfer.downloading': "正在下载…";
-    readonly 'transfer.done': "完成：{bytes} 字节";
-    readonly 'transfer.failed': "传输失败：{error}";
-    readonly 'transfer.browseRemote': "浏览远程目录";
-    readonly 'transfer.refresh': "刷新";
-    readonly 'transfer.name': "名称";
-    readonly 'transfer.upLevel': "上级目录";
-    readonly 'transfer.size': "大小";
-    readonly 'transfer.modified': "修改时间";
-    readonly 'transfer.bytes': "{value} B";
-    readonly 'transfer.kib': "{value} KB";
-    readonly 'transfer.mib': "{value} MB";
-    readonly 'transfer.gib': "{value} GB";
-    readonly 'transfer.percent': "{value}%";
-    readonly 'transfer.speed': "{value}/s";
-    readonly 'transfer.dir': "目录";
-    readonly 'transfer.file': "文件";
-    readonly 'tunnel.empty': "没有活跃的隧道。";
-    readonly 'tunnel.start': "新建隧道";
-    readonly 'tunnel.alias': "主机别名";
-    readonly 'tunnel.remotePort': "远程端口";
-    readonly 'tunnel.remoteHost': "远程主机";
-    readonly 'tunnel.remoteHostHint': "默认 127.0.0.1（服务器自身）";
-    readonly 'tunnel.localPort': "本地端口";
-    readonly 'tunnel.localPortHint': "留空自动分配";
-    readonly 'tunnel.stop': "停止";
-    readonly 'tunnel.stopAll': "全部停止";
-    readonly 'tunnel.stopAllConfirm': "确定停止全部隧道吗？";
-    readonly 'tunnel.row': "{alias}: 127.0.0.1:{localPort} -> {remoteHost}:{remotePort}";
-    readonly 'tunnel.started': "隧道已建立：127.0.0.1:{localPort}";
-    readonly 'tunnel.failed': "隧道启动失败：{error}";
-    readonly 'cluster.command': "命令";
-    readonly 'cluster.run': "执行";
-    readonly 'cluster.confirm': "确定在匹配的主机上执行该命令吗？该操作会真实运行在远程服务器上。";
-    readonly 'cluster.aliases': "主机别名（逗号分隔，留空为全部）";
-    readonly 'cluster.environment': "环境过滤";
-    readonly 'cluster.tags': "标签过滤（逗号分隔）";
-    readonly 'cluster.results': "执行结果";
-    readonly 'cluster.empty': "输入命令后点击「执行」。";
-    readonly 'cluster.noMatch': "没有匹配的主机。";
-    readonly 'cluster.ok': "成功";
-    readonly 'cluster.fail': "失败";
-    readonly 'cluster.timeout': "超时";
-    readonly 'cluster.col.alias': "主机";
-    readonly 'cluster.col.status': "状态";
-    readonly 'cluster.col.exit': "退出码";
-    readonly 'cluster.col.stdout': "标准输出";
-    readonly 'cluster.col.stderr': "标准错误";
-    readonly 'cluster.col.error': "错误";
-    readonly 'cluster.col.duration': "耗时";
-    readonly 'common.loading': "加载中…";
-    readonly 'common.error': "出错：{error}";
-    readonly 'common.refresh': "刷新";
-    readonly 'common.confirm': "确定";
+    readonly 'entry.label': 'SSH';
+    readonly 'entry.tooltip': '远程 SSH 运维面板';
+    readonly 'panel.title': '远程 SSH';
+    readonly 'panel.backToConversation': '返回会话';
+    readonly 'tab.hosts': '主机';
+    readonly 'tab.terminal': '终端';
+    readonly 'tab.transfer': '传输';
+    readonly 'tab.tunnels': '隧道';
+    readonly 'tab.cluster': '集群';
+    readonly 'hosts.empty': '尚未配置主机。点击「新增主机」添加，或从 ~/.ssh/config 导入。';
+    readonly 'hosts.add': '新增主机';
+    readonly 'hosts.import': '导入 ~/.ssh/config';
+    readonly 'hosts.search': '搜索别名 / 描述 / 标签…';
+    readonly 'hosts.col.alias': '别名';
+    readonly 'hosts.col.host': '主机';
+    readonly 'hosts.col.user': '用户';
+    readonly 'hosts.col.auth': '认证';
+    readonly 'hosts.col.environment': '环境';
+    readonly 'hosts.col.tags': '标签';
+    readonly 'hosts.col.description': '备注';
+    readonly 'hosts.col.actions': '操作';
+    readonly 'hosts.test': '测试';
+    readonly 'hosts.edit': '编辑';
+    readonly 'hosts.delete': '删除';
+    readonly 'hosts.deleteConfirm': '确定删除主机「{alias}」？将同时停止其隧道。';
+    readonly 'hosts.imported': '解析 {parsed} 个配置块，新增 {added} 台主机，跳过 {skipped} 个。';
+    readonly 'hosts.testing': '连接测试中…';
+    readonly 'hosts.testOk': '连接成功（{latency} ms）';
+    readonly 'hosts.testFail': '连接失败：{error}';
+    readonly 'hosts.connected': '连接';
+    readonly 'hosts.notConnected': '未连接';
+    readonly 'form.title.create': '新增主机';
+    readonly 'form.title.edit': '编辑主机 {alias}';
+    readonly 'form.alias': '别名';
+    readonly 'form.aliasHint': '小写字母、数字与单连字符，操作时使用';
+    readonly 'form.host': '主机地址';
+    readonly 'form.port': '端口';
+    readonly 'form.user': '用户名';
+    readonly 'form.auth': '认证方式';
+    readonly 'form.auth.key': '密钥';
+    readonly 'form.auth.password': '密码';
+    readonly 'form.authKeepHint': '编辑时密钥/密码留空将保留原认证方式与已存凭据；如需更换认证方式请填写新凭据。';
+    readonly 'form.keyPath': '私钥路径';
+    readonly 'form.keyPathHint': '如 ~/.ssh/id_ed25519';
+    readonly 'form.passphrase': '密钥口令';
+    readonly 'form.password': '密码';
+    readonly 'form.passwordHint': '明文保存在 ~/.dsh/dsh-ssh.json（本机私有文件）';
+    readonly 'form.proxyJump': '跳板机别名';
+    readonly 'form.proxyJumpHint': '逗号分隔的本地主机别名，按顺序连接';
+    readonly 'form.description': '备注';
+    readonly 'form.environment': '环境';
+    readonly 'form.environmentHint': '如 development / production';
+    readonly 'form.tags': '标签';
+    readonly 'form.tagsHint': '逗号分隔';
+    readonly 'form.location': '位置';
+    readonly 'form.save': '保存';
+    readonly 'form.cancel': '取消';
+    readonly 'form.required': '请填写必填字段：别名、主机地址、用户名。';
+    readonly 'form.portInvalid': '端口必须是 1-65535 之间的整数。';
+    readonly 'terminal.selectHost': '选择主机';
+    readonly 'terminal.connect': '连接';
+    readonly 'terminal.disconnect': '断开';
+    readonly 'terminal.placeholder': '选择主机后点击「连接」打开远程终端。';
+    readonly 'terminal.connecting': '正在连接…';
+    readonly 'terminal.ready': '终端已连接（{alias}）';
+    readonly 'terminal.exited': '终端已退出（{alias}）';
+    readonly 'terminal.error': '终端错误：{error}';
+    readonly 'transfer.selectHost': '选择主机';
+    readonly 'transfer.remotePath': '远程路径';
+    readonly 'transfer.remotePathHint': '如 /tmp/ 或 /home/user/app.tar.gz';
+    readonly 'transfer.upload': '上传';
+    readonly 'transfer.uploading': '正在上传 {file}…';
+    readonly 'transfer.download': '下载';
+    readonly 'transfer.downloading': '正在下载…';
+    readonly 'transfer.done': '完成：{bytes} 字节';
+    readonly 'transfer.failed': '传输失败：{error}';
+    readonly 'transfer.browseRemote': '浏览远程目录';
+    readonly 'transfer.refresh': '刷新';
+    readonly 'transfer.name': '名称';
+    readonly 'transfer.upLevel': '上级目录';
+    readonly 'transfer.size': '大小';
+    readonly 'transfer.modified': '修改时间';
+    readonly 'transfer.bytes': '{value} B';
+    readonly 'transfer.kib': '{value} KB';
+    readonly 'transfer.mib': '{value} MB';
+    readonly 'transfer.gib': '{value} GB';
+    readonly 'transfer.percent': '{value}%';
+    readonly 'transfer.speed': '{value}/s';
+    readonly 'transfer.dir': '目录';
+    readonly 'transfer.file': '文件';
+    readonly 'tunnel.empty': '没有活跃的隧道。';
+    readonly 'tunnel.start': '新建隧道';
+    readonly 'tunnel.alias': '主机别名';
+    readonly 'tunnel.remotePort': '远程端口';
+    readonly 'tunnel.remoteHost': '远程主机';
+    readonly 'tunnel.remoteHostHint': '默认 127.0.0.1（服务器自身）';
+    readonly 'tunnel.localPort': '本地端口';
+    readonly 'tunnel.localPortHint': '留空自动分配';
+    readonly 'tunnel.stop': '停止';
+    readonly 'tunnel.stopAll': '全部停止';
+    readonly 'tunnel.stopAllConfirm': '确定停止全部隧道吗？';
+    readonly 'tunnel.row': '{alias}: 127.0.0.1:{localPort} -> {remoteHost}:{remotePort}';
+    readonly 'tunnel.started': '隧道已建立：127.0.0.1:{localPort}';
+    readonly 'tunnel.failed': '隧道启动失败：{error}';
+    readonly 'cluster.command': '命令';
+    readonly 'cluster.run': '执行';
+    readonly 'cluster.confirm': '确定在匹配的主机上执行该命令吗？该操作会真实运行在远程服务器上。';
+    readonly 'cluster.aliases': '主机别名（逗号分隔，留空为全部）';
+    readonly 'cluster.environment': '环境过滤';
+    readonly 'cluster.tags': '标签过滤（逗号分隔）';
+    readonly 'cluster.results': '执行结果';
+    readonly 'cluster.empty': '输入命令后点击「执行」。';
+    readonly 'cluster.noMatch': '没有匹配的主机。';
+    readonly 'cluster.ok': '成功';
+    readonly 'cluster.fail': '失败';
+    readonly 'cluster.timeout': '超时';
+    readonly 'cluster.col.alias': '主机';
+    readonly 'cluster.col.status': '状态';
+    readonly 'cluster.col.exit': '退出码';
+    readonly 'cluster.col.stdout': '标准输出';
+    readonly 'cluster.col.stderr': '标准错误';
+    readonly 'cluster.col.error': '错误';
+    readonly 'cluster.col.duration': '耗时';
+    readonly 'common.loading': '加载中…';
+    readonly 'common.error': '出错：{error}';
+    readonly 'common.refresh': '刷新';
+    readonly 'common.confirm': '确定';
 };
 export declare const en: Record<keyof typeof zh, string>;
 /** Locale key union. */

package/lib/types/engine/connection-pool.d.ts

@@ -72,6 +72,8 @@ export declare function acquire(engine: PoolEngine, alias: string): Promise<Pool
  * is torn down — the connection belongs to someone else now.
  */
 export declare function disposeRecord(engine: PoolEngine, alias: string, record?: PoolRecord): void;
+/** End one record's client and hop chain (best-effort, safe to repeat). */
+export declare function endRecordChain(record: PoolRecord): void;
 /** Close connections idle beyond the threshold (skips pinned and in-flight). */
 export declare function sweepPool(engine: PoolEngine): void;
 /**

package/lib/types/engine/tunnel.d.ts

@@ -5,12 +5,14 @@
  */
 import { type Server as NetServer, type Socket } from 'node:net';
 import type { TunnelInfo } from '../protocol.ts';
-import { type PoolEngine } from './connection-pool.ts';
-/** One active tunnel record (server + pinned client + live sockets). */
+import { type PoolEngine, type PoolRecord } from './connection-pool.ts';
+/** One active tunnel record (server + pinned connection + live sockets). */
 export interface TunnelRecord {
     info: TunnelInfo;
     server: NetServer;
     alias: string;
+    /** The pooled connection this tunnel pins; siblings on one alias may share it. */
+    record: PoolRecord;
     sockets: Set<Socket>;
 }
 /** The engine slice the tunnel module needs (adds the tunnel registry). */

package/lib/types/engine.d.ts

@@ -74,6 +74,13 @@ export declare class SshEngine {
     stopTunnel(id: string): boolean;
     /** Stop all tunnels (optionally for one alias). */
     stopAllTunnels(alias?: string): number;
+    /**
+     * Drop every live artifact bound to one alias: stop its tunnels and close
+     * the pooled connection. Host entries that are deleted or whose connection
+     * fields change must never keep serving a stale, previously authenticated
+     * connection — the next operation re-connects from the current config.
+     */
+    dropAlias(alias: string): void;
     /** Probe connectivity: connect, run `true`, close. */
     test(alias: string): Promise<TestResult>;
     /** Close every pooled connection and tunnel. */

package/lib/types/index.d.ts

@@ -37,4 +37,6 @@ export declare const SSH_GUIDANCE = "\u672C\u673A\u5DF2\u5B89\u88C5 dsh-ssh \u63
  * @param ctx - host plugin context carrying webServer/tools/systemPrompt.
  * @param config - resolved plugin config (schema defaults applied by the loader).
  */
-export declare function apply(ctx: Context, config?: Config): void;
+export declare const apply: typeof applyImpl;
+declare function applyImpl(ctx: Context, config?: Config): void;
+export {};

package/lib/types/mount-once.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Host single-instance guard shared by the plugin family. The family bundle
+ * (dsh-web-ui-all / dsh-skins) namespaces every child row id (web-ui-*), so
+ * the loader accepts a standalone install of the same package side by side;
+ * without this guard the second instance would still re-register the same
+ * webserver routes, tools, settings namespaces, and system-prompt sections
+ * and fail the boot. mountOnce makes the second host apply a no-op for the
+ * lifetime of the first instance (the browser half is already deduped by
+ * package name in the client module host).
+ *
+ * The registry rides a global symbol so two module instances of the same
+ * package (npm copy vs repository link) still share one verdict. cordis
+ * `ctx.effect` runs its callback immediately and treats the callback's
+ * return value as the fiber disposer, so the unmarker is returned, not run.
+ */
+/**
+ * Wrap a cordis plugin apply so the package runs at most once per process.
+ * The first mount registers normally and unmarks when its fiber disposes;
+ * any later mount of the same package name is a no-op.
+ * @param packageName - npm package identity shared by every install source.
+ * @param fn - the original plugin apply.
+ * @returns an apply of the same shape.
+ */
+export declare function mountOnce<T extends (...args: any[]) => unknown>(packageName: string, fn: T): T;

package/lib/types/protocol.d.ts

@@ -164,7 +164,7 @@ export type TerminalClientFrame = {
     rows: number;
 };
 /** Route paths the client calls (shared literals). */
-export declare const SSH_API_BASE: "/api/dsh-ssh";
+export declare const SSH_API_BASE: '/api/dsh-ssh';
 export declare const SSH_API: {
     readonly hosts: string;
     readonly importSshConfig: string;

package/lib/types/routes.d.ts

@@ -17,6 +17,8 @@ export interface SshRoutesDeps {
     engine: SshEngine;
     /** Temp dir for upload/download staging (tests inject a sandbox). */
     stagingDir?: string;
+    /** Upload byte cap override (tests); defaults to MAX_UPLOAD_BYTES. */
+    maxUploadBytes?: number;
 }
 /**
  * Build every /api/dsh-ssh route (exact paths) plus the terminal upgrade.

package/lib/types/store.d.ts

@@ -47,6 +47,12 @@ export declare class HostStore {
      */
     importFromSshConfig(): ImportResult;
     private skippedNames;
+    /**
+     * Last parsed store keyed by file identity. list/find ride every acquire
+     * and GUI refresh; re-reading and re-parsing the whole file each call is
+     * wasted work when the file has not changed. Any save invalidates.
+     */
+    private cache;
     private load;
     private save;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-ssh",
   "description": "Remote SSH operations for the dsh web GUI: host config store (~/.dsh/dsh-ssh.json, import from ~/.ssh/config), a persistent ssh2 connection pool with jump-host support, exec / PTY web terminal / SFTP transfer / local port-forward tunnels / cluster execution, plus agent tools (ssh_list, ssh_exec, ssh_upload, ssh_download, ssh_tunnel, ssh_cluster). Hot-pluggable — mounted via ~/.dsh/cordis.patch.yml + a profile node_modules symlink, no dsh source changes.",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"

package/src/engine/connection-pool.ts

@@ -213,8 +213,13 @@ export function disposeRecord(engine: PoolEngine, alias: string, record?: PoolRe
   if (record !== undefined && current !== record) return
   if (current === undefined) return
   engine.pool.delete(alias)
-  try { current.client.end() } catch { /* already closed */ }
-  for (const hop of current.hops) {
+  endRecordChain(current)
+}
+
+/** End one record's client and hop chain (best-effort, safe to repeat). */
+export function endRecordChain(record: PoolRecord): void {
+  try { record.client.end() } catch { /* already closed */ }
+  for (const hop of record.hops) {
     try { hop.end() } catch { /* already closed */ }
   }
 }
@@ -247,6 +252,14 @@ export async function withClient<T>(engine: PoolEngine, alias: string, fn: (clie
       const result = await fn(record.client)
       record.idleAt = Date.now()
       return result
+    } catch (error) {
+      lastError = error
+      // Retry only when the connection actually broke mid-flight: drop the
+      // corpse and let the next attempt reconnect (a reconnect may replay a
+      // non-idempotent command — the documented trade-off). A failure on a
+      // healthy connection is a logic error and is rethrown, not replayed.
+      if (!record.broken) throw error
+      disposeRecord(engine, alias, record)
     } finally {
       record.inFlight -= 1
     }
@@ -297,8 +310,15 @@ export async function execCommand(engine: PoolEngine, alias: string, command: st
           if (settled) return
           settled = true
           clearTimeout(timer)
+          if (typeof code !== 'number' && !timedOut) {
+            // The channel closed without an exit status: the connection
+            // dropped mid-flight. Reject so withClient can reconnect and
+            // retry within the attempt budget.
+            reject(new Error('ssh: connection lost mid-flight (channel closed without an exit status)'))
+            return
+          }
           resolve({
-            success: code === 0 && !timedOut,
+            success: code === 0,
             exitCode: code,
             timedOut,
             stdout: stdout.text,

package/src/engine/sftp.ts

@@ -4,7 +4,7 @@
  * released exactly once so sshd's MaxSessions cap is never exhausted.
  */
 
-import { existsSync, mkdirSync, readdirSync, statSync } from 'node:fs'
+import { existsSync, lstatSync, mkdirSync, readdirSync, statSync } from 'node:fs'
 import { dirname, join, relative, resolve as resolvePath } from 'node:path'
 import { Client, type SFTPWrapper } from 'ssh2'
 import type { RemoteDirEntry, TransferProgress } from '../protocol.ts'
@@ -16,7 +16,11 @@ export function walkLocalDir(root: string): string[] {
   const visit = (dir: string): void => {
     for (const name of readdirSync(dir)) {
       const full = join(dir, name)
-      const stat = statSync(full)
+      // lstat, not stat: a symlink must never be followed — a link cycle
+      // (ln -s . self) recurses forever under stat, and a link to a file
+      // would silently upload the target's bytes.
+      const stat = lstatSync(full)
+      if (stat.isSymbolicLink()) continue
       if (stat.isDirectory()) visit(full)
       else if (stat.isFile()) files.push(relative(root, full))
     }
@@ -169,13 +173,20 @@ function ensureRemoteDir(sftp: SFTPWrapper, remote: string): Promise<void> {
   })
 }
 
-function fastPut(sftp: SFTPWrapper, src: string, dst: string, concurrency: number, onProgress?: (progress: TransferProgress) => void): Promise<void> {
+/** One fastPut/fastGet transfer with throttled progress (the two directions share everything but the verb). */
+function fastTransfer(sftp: SFTPWrapper, kind: 'put' | 'get', src: string, dst: string, concurrency: number, onProgress?: (progress: TransferProgress) => void): Promise<void> {
   return new Promise((resolve, reject) => {
+    // Progress frames name the destination on upload, the source on download;
+    // the final size comes from the local side of the transfer.
+    const file = kind === 'put' ? dst : src
+    const finalSize = (): number => statSync(kind === 'put' ? src : dst).size
     let last = 0
     let lastEmit = 0
     const started = Date.now()
-    onProgress?.({ phase: 'transferring', file: dst, transferred: 0, total: statSync(src).size, percent: 0 })
-    sftp.fastPut(src, dst, { concurrency, step: (transferred: number, _chunk: number, total: number) => {
+    if (kind === 'put') {
+      onProgress?.({ phase: 'transferring', file, transferred: 0, total: statSync(src).size, percent: 0 })
+    }
+    const step = (transferred: number, _chunk: number, total: number): void => {
       const now = Date.now()
       // Throttle: high-speed links fire one callback per chunk; the UI only
       // needs ~10 frames per second.
@@ -184,52 +195,32 @@ function fastPut(sftp: SFTPWrapper, src: string, dst: string, concurrency: numbe
       const elapsed = (now - started) / 1000
       onProgress?.({
         phase: 'transferring',
-        file: dst,
+        file,
         transferred,
         total,
         percent: total > 0 ? Math.round((transferred / total) * 1000) / 10 : 0,
         speedBps: elapsed > 0 ? Math.round((transferred - last) / elapsed) : undefined,
       })
       last = transferred
-    } }, (error) => {
+    }
+    const done = (error: unknown): void => {
       if (error !== undefined) {
-        onProgress?.({ phase: 'error', file: dst, transferred: 0, total: 0, percent: 0, error: String(error) })
+        onProgress?.({ phase: 'error', file, transferred: 0, total: 0, percent: 0, error: String(error) })
         reject(error)
       } else {
-        onProgress?.({ phase: 'done', file: dst, transferred: statSync(src).size, total: statSync(src).size, percent: 100 })
+        onProgress?.({ phase: 'done', file, transferred: finalSize(), total: finalSize(), percent: 100 })
         resolve()
       }
-    })
+    }
+    if (kind === 'put') sftp.fastPut(src, dst, { concurrency, step }, done)
+    else sftp.fastGet(src, dst, { concurrency, step }, done)
   })
 }
 
+function fastPut(sftp: SFTPWrapper, src: string, dst: string, concurrency: number, onProgress?: (progress: TransferProgress) => void): Promise<void> {
+  return fastTransfer(sftp, 'put', src, dst, concurrency, onProgress)
+}
+
 function fastGet(sftp: SFTPWrapper, src: string, dst: string, concurrency: number, onProgress?: (progress: TransferProgress) => void): Promise<void> {
-  return new Promise((resolve, reject) => {
-    let last = 0
-    let lastEmit = 0
-    const started = Date.now()
-    sftp.fastGet(src, dst, { concurrency, step: (transferred: number, _chunk: number, total: number) => {
-      const now = Date.now()
-      if (now - lastEmit < 100 && transferred < total) return
-      lastEmit = now
-      const elapsed = (now - started) / 1000
-      onProgress?.({
-        phase: 'transferring',
-        file: src,
-        transferred,
-        total,
-        percent: total > 0 ? Math.round((transferred / total) * 1000) / 10 : 0,
-        speedBps: elapsed > 0 ? Math.round((transferred - last) / elapsed) : undefined,
-      })
-      last = transferred
-    } }, (error) => {
-      if (error !== undefined) {
-        onProgress?.({ phase: 'error', file: src, transferred: 0, total: 0, percent: 0, error: String(error) })
-        reject(error)
-      } else {
-        onProgress?.({ phase: 'done', file: src, transferred: statSync(dst).size, total: statSync(dst).size, percent: 100 })
-        resolve()
-      }
-    })
-  })
+  return fastTransfer(sftp, 'get', src, dst, concurrency, onProgress)
 }

package/src/engine/tunnel.ts

@@ -6,13 +6,15 @@
 
 import { createServer, type Server as NetServer, type Socket } from 'node:net'
 import type { TunnelInfo } from '../protocol.ts'
-import { acquire, disposeRecord, type PoolEngine } from './connection-pool.ts'
+import { acquire, disposeRecord, endRecordChain, type PoolEngine, type PoolRecord } from './connection-pool.ts'
 
-/** One active tunnel record (server + pinned client + live sockets). */
+/** One active tunnel record (server + pinned connection + live sockets). */
 export interface TunnelRecord {
   info: TunnelInfo
   server: NetServer
   alias: string
+  /** The pooled connection this tunnel pins; siblings on one alias may share it. */
+  record: PoolRecord
   sockets: Set<Socket>
 }
 
@@ -48,7 +50,12 @@ export async function startTunnel(
     state: 'connecting',
     startedAt: Date.now(),
   }
-  const record = await acquire(engine, alias)
+  // Reuse the live pooled connection when one exists so sibling tunnels on
+  // one alias multiplex over it (and no orphaned connection leaks); recycle
+  // a broken one first.
+  const existing = engine.pool.get(alias)
+  if (existing !== undefined && existing.broken) disposeRecord(engine, alias, existing)
+  const record = engine.pool.get(alias) ?? (await acquire(engine, alias))
   const client = record.client
   const sockets = new Set<Socket>()
   const server = createServer((socket) => {
@@ -89,7 +96,7 @@ export async function startTunnel(
   const address = server.address()
   info.localPort = typeof address === 'object' && address !== null ? address.port : 0
   info.state = 'forwarding'
-  engine.tunnels.set(id, { info, server, alias, sockets })
+  engine.tunnels.set(id, { info, server, alias, record, sockets })
   return info
 }
 
@@ -108,7 +115,14 @@ export function stopTunnel(engine: TunnelEngine, id: string): boolean {
     try { socket.destroy() } catch { /* already closed */ }
   }
   tunnel.sockets.clear()
-  disposeRecord(engine, tunnel.alias)
+  // Sibling tunnels on the same alias share the pinned connection: release it
+  // only once the last tunnel using it is gone. A record the pool has since
+  // replaced (e.g. after a broken-connection recycle) is ended directly.
+  const shared = [...engine.tunnels.values()].some(candidate => candidate.record === tunnel.record)
+  if (!shared) {
+    if (engine.pool.get(tunnel.alias) === tunnel.record) disposeRecord(engine, tunnel.alias, tunnel.record)
+    else endRecordChain(tunnel.record)
+  }
   return true
 }
 

package/src/engine.ts

@@ -135,6 +135,17 @@ export class SshEngine {
     return stopAllTunnels(this, alias)
   }
 
+  /**
+   * Drop every live artifact bound to one alias: stop its tunnels and close
+   * the pooled connection. Host entries that are deleted or whose connection
+   * fields change must never keep serving a stale, previously authenticated
+   * connection — the next operation re-connects from the current config.
+   */
+  dropAlias(alias: string): void {
+    stopAllTunnels(this, alias)
+    disposeRecord(this, alias)
+  }
+
   // ------------------------------------------------------------- misc
 
   /** Probe connectivity: connect, run `true`, close. */

package/src/index.ts

@@ -18,6 +18,7 @@ import { SshEngine } from './engine.ts'
 import { makeRoutes } from './routes.ts'
 import { HostStore } from './store.ts'
 import { sshClusterTool, sshDownloadTool, sshExecTool, sshListTool, sshTunnelTool, sshUploadTool } from './tools.ts'
+import { mountOnce } from './mount-once.ts'
 
 /** Stable cordis plugin name. */
 export const name = 'ssh'
@@ -62,7 +63,9 @@ export const SSH_GUIDANCE = '本机已安装 dsh-ssh 插件（DSH 远程 SSH 运
  * @param ctx - host plugin context carrying webServer/tools/systemPrompt.
  * @param config - resolved plugin config (schema defaults applied by the loader).
  */
-export function apply(ctx: Context, config?: Config): void {
+export const apply = mountOnce('@linxin666/dsh-ssh', applyImpl)
+
+function applyImpl(ctx: Context, config?: Config): void {
   // The live source the surfaces read: the settings section once the web
   // settings surface is served, the composition entry otherwise.
   let current: () => Config = () => config ?? {}

package/src/mount-once.ts

@@ -0,0 +1,48 @@
+// Generated by scripts/sync-shared.mjs from shared/host/mount-once.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Host single-instance guard shared by the plugin family. The family bundle
+ * (dsh-web-ui-all / dsh-skins) namespaces every child row id (web-ui-*), so
+ * the loader accepts a standalone install of the same package side by side;
+ * without this guard the second instance would still re-register the same
+ * webserver routes, tools, settings namespaces, and system-prompt sections
+ * and fail the boot. mountOnce makes the second host apply a no-op for the
+ * lifetime of the first instance (the browser half is already deduped by
+ * package name in the client module host).
+ *
+ * The registry rides a global symbol so two module instances of the same
+ * package (npm copy vs repository link) still share one verdict. cordis
+ * `ctx.effect` runs its callback immediately and treats the callback's
+ * return value as the fiber disposer, so the unmarker is returned, not run.
+ */
+
+const MOUNTED = Symbol.for('dsh-web-ui.mounted-plugins')
+
+interface MountRegistry {
+  [MOUNTED]?: Set<string>
+}
+
+function mountedSet(): Set<string> {
+  const registry = globalThis as MountRegistry
+  return (registry[MOUNTED] ??= new Set())
+}
+
+/**
+ * Wrap a cordis plugin apply so the package runs at most once per process.
+ * The first mount registers normally and unmarks when its fiber disposes;
+ * any later mount of the same package name is a no-op.
+ * @param packageName - npm package identity shared by every install source.
+ * @param fn - the original plugin apply.
+ * @returns an apply of the same shape.
+ */
+export function mountOnce<T extends (...args: any[]) => unknown>(packageName: string, fn: T): T {
+  return ((...args: unknown[]) => {
+    const mounted = mountedSet()
+    if (mounted.has(packageName)) return
+    mounted.add(packageName)
+    const ctx = args[0] as { effect?: (effect: () => unknown) => unknown } | undefined
+    ctx?.effect?.(() => () => {
+      mounted.delete(packageName)
+    })
+    return fn(...args)
+  }) as T
+}

package/src/routes.ts

@@ -78,6 +78,8 @@ export interface SshRoutesDeps {
   engine: SshEngine
   /** Temp dir for upload/download staging (tests inject a sandbox). */
   stagingDir?: string
+/** Upload byte cap override (tests); defaults to MAX_UPLOAD_BYTES. */
+maxUploadBytes?: number
 }
 
 /**
@@ -88,6 +90,7 @@ export interface SshRoutesDeps {
 export function makeRoutes(deps: SshRoutesDeps): { routes: WebRoute[]; upgrade: WebUpgradeRoute } {
   const { store, engine } = deps
   const staging = deps.stagingDir ?? join(tmpdir(), 'dsh-ssh-uploads')
+const maxUploadBytes = deps.maxUploadBytes ?? MAX_UPLOAD_BYTES
   // The upload route stages request bodies here; it must exist before the
   // first request (a missing dir would hang the first upload forever).
   mkdirSync(staging, { recursive: true })
@@ -154,6 +157,13 @@ export function makeRoutes(deps: SshRoutesDeps): { routes: WebRoute[]; upgrade:
           }
           try {
             const entry = store.update(alias, body as unknown as Partial<HostPayload>)
+            // Connection-relevant changes invalidate the pooled connection:
+            // without this the pool would keep running commands on the old
+            // host/credentials until the idle sweep (up to 30 min later).
+            const patch = body as Record<string, unknown>
+            if (['host', 'port', 'user', 'auth', 'proxyJump'].some(key => patch[key] !== undefined)) {
+              engine.dropAlias(alias)
+            }
             writeJson(res, 200, { host: store.summarize(entry) })
           } catch (error) {
             writeJson(res, 400, { error: error instanceof Error ? error.message : String(error) })
@@ -162,7 +172,7 @@ export function makeRoutes(deps: SshRoutesDeps): { routes: WebRoute[]; upgrade:
         }
         if (method === 'DELETE') {
           try {
-            engine.stopAllTunnels(alias)
+            engine.dropAlias(alias)
             store.delete(alias)
             writeJson(res, 200, { ok: true })
           } catch (error) {
@@ -329,7 +339,7 @@ export function makeRoutes(deps: SshRoutesDeps): { routes: WebRoute[]; upgrade:
           return
         }
         const declared = Number(req.headers['content-length'])
-        if (Number.isFinite(declared) && declared > MAX_UPLOAD_BYTES) {
+        if (Number.isFinite(declared) && declared > maxUploadBytes) {
           writeJson(res, 413, { error: 'upload body too large' })
           return
         }
@@ -365,6 +375,17 @@ export function makeRoutes(deps: SshRoutesDeps): { routes: WebRoute[]; upgrade:
         req.on('aborted', () => fail('upload aborted by the client'))
         res.on('error', () => fail('response stream closed'))
         res.on('close', () => { if (!res.writableEnded) fail('connection closed') })
+        // The content-length pre-check above can be bypassed by chunked or
+        // header-less requests: count the bytes as they actually arrive and
+        // abort the moment the cap is exceeded.
+        let received = 0
+        req.on('data', (chunk: Buffer) => {
+          received += chunk.byteLength
+          if (received > maxUploadBytes) {
+            fail('upload body too large')
+            try { req.destroy() } catch { /* closed */ }
+          }
+        })
         req.pipe(sink)
         sink.on('finish', async () => {
           if (settled) return

package/src/store.ts

@@ -6,7 +6,7 @@
  * as ssh-skill's annotated ssh-config comments; document it, never log it.
  */
 
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
 import type { HostPayload, ImportResult, SshHostEntry, SshHostSummary } from './protocol.ts'
@@ -306,18 +306,36 @@ export class HostStore {
 
   private skippedNames = new Set<string>()
 
+  /**
+   * Last parsed store keyed by file identity. list/find ride every acquire
+   * and GUI refresh; re-reading and re-parsing the whole file each call is
+   * wasted work when the file has not changed. Any save invalidates.
+   */
+  private cache: { mtimeMs: number; size: number; file: StoreFile } | undefined
+
   private load(): StoreFile {
-    if (!existsSync(this.path)) return { version: FORMAT_VERSION, hosts: [] }
+    let stats: { mtimeMs: number; size: number }
+    try {
+      stats = statSync(this.path)
+    } catch {
+      this.cache = undefined
+      return { version: FORMAT_VERSION, hosts: [] }
+    }
+    if (this.cache !== undefined && this.cache.mtimeMs === stats.mtimeMs && this.cache.size === stats.size) {
+      return this.cache.file
+    }
     try {
       const parsed = JSON.parse(readFileSync(this.path, 'utf8')) as StoreFile
       if (typeof parsed !== 'object' || parsed === null || !Array.isArray(parsed.hosts)) {
         throw new Error('store file shape invalid')
       }
+      this.cache = { mtimeMs: stats.mtimeMs, size: stats.size, file: parsed }
       return parsed
     } catch {
       // A corrupt store must not brick the plugin — and must not be silently
       // overwritten by the next save: rename it aside for manual recovery
       // (the plugin then starts from an empty list).
+      this.cache = undefined
       try {
         renameSync(this.path, `${this.path}.corrupt-${Date.now()}`)
       } catch { /* best effort */ }
@@ -333,6 +351,7 @@ export class HostStore {
     // tmp file carries the 0600 mode through the rename.
     writeFileSync(tmp, JSON.stringify(file, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 })
     renameSync(tmp, this.path)
+    this.cache = undefined
   }
 }