@linxin666/dsh-ssh 0.1.20 → 0.2.1

package/src/client/sidebar-entry.ts

@@ -1,20 +1,17 @@
 /**
- * Sidebar entry injection.
+ * Sidebar entry injection — package-specific wiring over the shared core.
  *
- * dsh's sidebar shell exposes no slot an external plugin can register into,
- * so — following the task-board precedent of DOM-level extension — the entry
- * row is injected between the shell's New Session button and the workspace
- * browser. The injection self-heals: a MutationObserver watches the sidebar
- * root and re-inserts the row whenever a React re-render displaces it
- * (re-insertion happens in the same frame, before paint, so no flicker).
- *
- * The row is plain DOM (no React tree) so it can never disturb the shell's
- * reconciliation; the panel view it toggles is a separate React root mounted
- * in the center column (see mount.tsx).
+ * The DOM injection / self-healing / idempotency logic lives exactly once in
+ * shared/client/sidebar-entry-core.ts (synced copy); this wrapper supplies the
+ * ssh icon, copy, CSS module, and the panel toggle. The row is plain DOM (no
+ * React tree) so it can never disturb the shell's reconciliation; the panel
+ * view it toggles is a separate React root mounted in the center column
+ * (see mount.tsx).
  */
 import type { PanelController } from './panel/controller.ts'
 import { tt } from './panel/helpers.ts'
 import css from './panel/panel.module.css'
+import { mountSidebarEntry as mountSharedSidebarEntry } from './sidebar-entry-core.ts'
 
 /** Stable data attribute identifying the injected entry row. */
 export const ENTRY_SELECTOR = '[data-dsh-ssh-entry]'
@@ -22,64 +19,6 @@ export const ENTRY_SELECTOR = '[data-dsh-ssh-entry]'
 /** Inline icon (matches the shell's 16px nav-icon look): a terminal prompt glyph. */
 const ICON = '<svg viewBox="0 0 16 16" width="14" height="14" fill="none" stroke="currentColor" stroke-width="1.3" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="2" y="2.5" width="12" height="11" rx="1.5"/><path d="M4.5 5.5l2.5 2.5-2.5 2.5"/><path d="M8.5 10.5h3"/></svg>'
 
-/** Find the sidebar shell root element, or undefined while not yet mounted. */
-function sidebarRoot(): HTMLElement | undefined {
-  const column = document.querySelector<HTMLElement>('[data-pane="sidebar"], [class*="sidebarCol"]')
-  if (column === null) return undefined
-  // Current shells wrap the sidebar UI: column > wrapper > root(logoRow owner).
-  // Prefer the element that owns the logo row — the real sidebar UI root —
-  // and fall back to the column's first child for legacy shells.
-  const logoOwner = column.querySelector<HTMLElement>('[class*="logoRow"]')?.parentElement
-  return logoOwner ?? (column.firstElementChild as HTMLElement | undefined)
-}
-
-/** The New Session button: nested in the logo row on current shells, a direct child on legacy shells. */
-function newSessionButton(root: HTMLElement): HTMLButtonElement | undefined {
-  const nested = root.querySelector<HTMLButtonElement>('button[class*="newSession"]')
-  if (nested !== null) return nested
-  for (const child of root.children) {
-    if (child.tagName === 'BUTTON') return child as HTMLButtonElement
-  }
-  return undefined
-}
-
-/** Build the entry row (a detached button; insert once the shell is up). */
-function createEntry(controller: PanelController): HTMLButtonElement {
-  const entry = document.createElement('button')
-  entry.type = 'button'
-  entry.dataset.dshSshEntry = ''
-  entry.className = css.entry
-  entry.setAttribute('aria-label', tt('entry.label'))
-  entry.setAttribute('title', tt('entry.tooltip'))
-  entry.innerHTML = '<span class="' + css.entryIcon + '">' + ICON + '</span><span class="' + css.entryLabel + '">' + tt('entry.label') + '</span>'
-  entry.addEventListener('click', () => { controller.toggle() })
-  return entry
-}
-
-/** Re-insert the entry after the New Session row (before the browser region). */
-function placeEntry(root: HTMLElement, entry: HTMLButtonElement): boolean {
-  const button = newSessionButton(root)
-  if (button === undefined) return false
-  if (entry.parentElement !== root) {
-    // Position relative to the family block (entries injected by sibling
-    // plugins), never relative to transient logoRow geometry: every family
-    // plugin that self-heals during a re-render then lands in the same
-    // relative order, so the entries cannot swap positions regardless of
-    // observer callback order or of shell wrapper changes. There is no
-    // append-to-end fallback: appending at the end would randomly reorder
-    // the block after a shell re-render.
-    const row = button.closest('[class*="logoRow"]')
-    const base = (row !== null && row.parentElement === root) ? row : button
-    const family = Array.from(root.children).filter(
-      (el): el is HTMLElement => el instanceof HTMLElement && el.matches('[data-dsh-taskboard-entry], [data-dsh-ssh-entry]'),
-    )
-    // ssh sits after the whole family block.
-    const anchor = family.length > 0 ? family[family.length - 1].nextElementSibling : base.nextElementSibling
-    root.insertBefore(entry, anchor)
-  }
-  return true
-}
-
 /**
  * Mount the sidebar entry, waiting for the shell to render and self-healing
  * on later React re-renders.
@@ -87,74 +26,20 @@ function placeEntry(root: HTMLElement, entry: HTMLButtonElement): boolean {
  * @returns disposer removing the entry and its observers.
  */
 export function mountSidebarEntry(controller: PanelController): () => void {
-  const entry = createEntry(controller)
-  let root: HTMLElement | undefined
-  let placed = false
-
-  const tryPlace = (): void => {
-    if (root !== undefined && !root.isConnected) {
-      // The shell rebuilt the sidebar pane (whole-tree teardown); the root
-      // observer is gone with the old tree, so detach it and re-query from
-      // scratch. The new pane is later noticed by the body-level watcher.
-      rootObserver.disconnect()
-      root = undefined
-      placed = false
-    }
-    if (placed) {
-      // Cheap short-circuit: entry still lives in a mountable subtree.
-      if (document.body.contains(entry)) return
-      // Entry was torn down together with the old tree; reset and re-place.
-      rootObserver.disconnect()
-      root = undefined
-      placed = false
-    }
-    root ??= sidebarRoot()
-    if (root === undefined) return
-    placed = placeEntry(root, entry)
-    if (placed) {
-      rootObserver.observe(root, { childList: true, subtree: true })
-    }
-  }
-
-  // Body-level watcher retained as the "whole rebuild" fallback: when the shell
-  // tears down the whole sidebar pane, the root observer is gone with it and
-  // only this body observation can notice the new pane mounting. It is no
-  // longer disconnected after placement; the placed-and-still-mounted case
-  // short-circuits through the cheap document.body.contains(entry) check, so
-  // unrelated app mutations (e.g. chat streaming) cost one contains check
-  // instead of churning the full re-query.
-  const waitObserver = new MutationObserver(() => { tryPlace() })
-  waitObserver.observe(document.body, { childList: true, subtree: true })
-
-  // Self-heal: if a React re-render displaces the row, re-insert it in the
-  // same frame (microtask before paint -> no visible flicker).
-  const rootObserver = new MutationObserver(() => {
-    if (root === undefined || !root.isConnected) {
-      placed = false
-      tryPlace()
-      return
-    }
-    if (!root.contains(entry)) {
-      placed = placeEntry(root, entry)
-    }
+  return mountSharedSidebarEntry({
+    rowAttribute: 'data-dsh-ssh-entry',
+    rowSelector: ENTRY_SELECTOR,
+    plugin: 'ssh',
+    icon: ICON,
+    css,
+    label: () => tt('entry.label'),
+    tooltip: () => tt('entry.tooltip'),
+    onToggle: () => { controller.toggle() },
+    position: 'after',
+    familySelectors: ['[data-dsh-taskboard-entry]', '[data-dsh-ssh-entry]'],
+    active: {
+      subscribe: (listener) => controller.subscribe(listener),
+      isOpen: () => controller.getSnapshot().panelOpen,
+    },
   })
-
-  // Reflect the panel's open state on the row (active highlight). Note: assigning
-  // undefined to dataset.active materializes data-active="undefined" and keeps the
-  // row permanently highlighted — delete the attribute instead.
-  const syncActive = () => {
-    if (controller.getSnapshot().panelOpen) entry.dataset.active = 'true'
-    else delete entry.dataset.active
-  }
-  const unsubscribe = controller.subscribe(syncActive)
-  syncActive()
-
-  tryPlace()
-
-  return () => {
-    waitObserver.disconnect()
-    rootObserver.disconnect()
-    unsubscribe()
-    entry.remove()
-  }
 }

package/src/engine/connection-pool.ts

@@ -140,28 +140,34 @@ export async function connectChain(engine: PoolEngine, entry: SshHostEntry): Pro
   const hops: Client[] = []
   let sock: ConnectConfig['sock']
   const chain = entry.proxyJump
-  for (let index = 0; index < chain.length; index += 1) {
-    const hopAlias = chain[index]
-    const hop = engine.store.find(hopAlias)
-    if (hop === undefined) {
-      for (const client of hops) client.end()
-      throw new Error('proxyJump alias \'' + hopAlias + '\' not found — create it first')
-    }
-    const hopClient = await connectClient(buildConnectConfig(hop, sock, engine.opts))
-    hops.push(hopClient)
-    const next = index + 1 < chain.length ? engine.store.find(chain[index + 1]) : undefined
-    const nextHost = next !== undefined ? next.host : entry.host
-    const nextPort = next !== undefined ? next.port : entry.port
-    sock = await new Promise<ConnectConfig['sock']>((resolve, reject) => {
-      hopClient.forwardOut('127.0.0.1', 0, nextHost, nextPort, (error, stream) => {
-        if (error !== undefined) {
-          for (const client of hops) client.end()
-          reject(error)
-        } else {
-          resolve(stream)
-        }
+  try {
+    for (let index = 0; index < chain.length; index += 1) {
+      const hopAlias = chain[index]
+      const hop = engine.store.find(hopAlias)
+      if (hop === undefined) {
+        throw new Error('proxyJump alias \'' + hopAlias + '\' not found — create it first')
+      }
+      const hopClient = await connectClient(buildConnectConfig(hop, sock, engine.opts))
+      hops.push(hopClient)
+      const next = index + 1 < chain.length ? engine.store.find(chain[index + 1]) : undefined
+      const nextHost = next !== undefined ? next.host : entry.host
+      const nextPort = next !== undefined ? next.port : entry.port
+      sock = await new Promise<ConnectConfig['sock']>((resolve, reject) => {
+        hopClient.forwardOut('127.0.0.1', 0, nextHost, nextPort, (error, stream) => {
+          if (error !== undefined) {
+            reject(error)
+          } else {
+            resolve(stream)
+          }
+        })
       })
-    })
+    }
+  } catch (error) {
+    // A missing alias, a failed hop connect, or a failed forwardOut must all
+    // close the hops already connected, so a failed ProxyJump never leaks a
+    // middle-hop connection.
+    for (const client of hops) client.end()
+    throw error
   }
   let target: Client | undefined
   try {

package/src/routes.ts

@@ -7,7 +7,7 @@
  * deployments must not serve them.
  */
 
-import { createReadStream, createWriteStream, mkdirSync } from 'node:fs'
+import { closeSync, createReadStream, createWriteStream, mkdirSync, openSync } from 'node:fs'
 import { unlink } from 'node:fs/promises'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import { basename, join } from 'node:path'
@@ -93,7 +93,9 @@ export function makeRoutes(deps: SshRoutesDeps): { routes: WebRoute[]; upgrade:
 const maxUploadBytes = deps.maxUploadBytes ?? MAX_UPLOAD_BYTES
   // The upload route stages request bodies here; it must exist before the
   // first request (a missing dir would hang the first upload forever).
-  mkdirSync(staging, { recursive: true })
+  // 0700 keeps in-flight transfers unreadable to other local users (the
+  // staged files below are 0600; downloads are pre-created 0600 as well).
+  mkdirSync(staging, { recursive: true, mode: 0o700 })
 
   /** Guard helper: fence + method check. */
   const guard = (req: IncomingMessage, res: ServerResponse, method: string): boolean => {
@@ -353,7 +355,7 @@ const maxUploadBytes = deps.maxUploadBytes ?? MAX_UPLOAD_BYTES
         }
         // Stage the uploaded bytes, then SFTP them out with progress frames.
         const tmp = join(staging, `upload-${randomBytes(6).toString('hex')}`)
-        const sink = createWriteStream(tmp)
+        const sink = createWriteStream(tmp, { mode: 0o600 })
         let settled = false
         // Every terminal path (sink error, client abort, response loss) must
         // emit a result frame, end the response, and remove the tmp file.
@@ -361,9 +363,22 @@ const maxUploadBytes = deps.maxUploadBytes ?? MAX_UPLOAD_BYTES
           if (settled) return
           settled = true
           emit({ type: 'result', ok: false, error: error instanceof Error ? error.message : String(error) })
-          try { sink.destroy() } catch { /* closed */ }
-          void unlink(tmp).catch(() => undefined)
-          try { res.end() } catch { /* closed */ }
+          // End the response only after the tmp file is gone, and unlink only
+          // after the sink is fully closed: destroying a WriteStream whose
+          // fs.open is still pending lets the open RE-CREATE the file after
+          // an early unlink, leaving staging populated (this raced the
+          // response end and made the byte-cap test flaky).
+          const cleanup = (): void => {
+            void unlink(tmp).catch(() => undefined).finally(() => {
+              try { res.end() } catch { /* closed */ }
+            })
+          }
+          if (sink.destroyed) {
+            cleanup()
+          } else {
+            sink.once('close', cleanup)
+            try { sink.destroy() } catch { cleanup() }
+          }
         }
         const done = (): void => {
           if (settled) return
@@ -379,11 +394,18 @@ const maxUploadBytes = deps.maxUploadBytes ?? MAX_UPLOAD_BYTES
         // header-less requests: count the bytes as they actually arrive and
         // abort the moment the cap is exceeded.
         let received = 0
+        let capped = false
         req.on('data', (chunk: Buffer) => {
           received += chunk.byteLength
-          if (received > maxUploadBytes) {
+          if (received > maxUploadBytes && !capped) {
+            capped = true
             fail('upload body too large')
-            try { req.destroy() } catch { /* closed */ }
+            // Keep the socket alive until the response flush finishes:
+            // destroying the request here races res.end() and the client
+            // sees a hang-up instead of the result frame. Drain the rest of
+            // the body so the socket can close cleanly afterwards.
+            res.on('finish', () => { try { req.destroy() } catch { /* closed */ } })
+            req.resume()
           }
         })
         req.pipe(sink)
@@ -417,6 +439,9 @@ const maxUploadBytes = deps.maxUploadBytes ?? MAX_UPLOAD_BYTES
         }
         const tmp = join(staging, `download-${randomBytes(6).toString('hex')}`)
         try {
+          // Pre-create with 0600: ssh2's fastGet opens the destination with
+          // umask-default permissions and a pre-created file keeps the mode.
+          closeSync(openSync(tmp, 'w', 0o600))
           const outcome = await engine.download(alias, remotePath, tmp)
           res.writeHead(200, {
             'content-type': 'application/octet-stream',