@linxin666/dsh-ssh 0.3.2 → 0.3.4

package/lib/index.js

@@ -3,6 +3,7 @@ import { closeSync, createReadStream, createWriteStream, existsSync, lstatSync,
 import { Client } from "ssh2";
 import { homedir, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { isAbsolute as isAbsolute$1, join as join$1 } from "node:path/posix";
 import { createServer } from "node:net";
 import { unlink } from "node:fs/promises";
 import { randomBytes } from "node:crypto";
@@ -1031,8 +1032,9 @@ var import_lib = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((export
 */
 /** Expand a leading ~ (or ~user) in a path, platform-style. */
 function expandHome$1(path, home = homedir()) {
+	const j = home.startsWith("/") ? join$1 : join;
 	if (path === "~") return home;
-	if (path.startsWith("~/") || path.startsWith("~\\")) return join(home, path.slice(2));
+	if (path.startsWith("~/") || path.startsWith("~\\")) return j(home, path.slice(2));
 	return path;
 }
 /**
@@ -1042,12 +1044,15 @@ function expandHome$1(path, home = homedir()) {
 * @returns the absolute DSH home path.
 */
 function resolveDshHome(env = process.env, home = homedir()) {
+	const isPosix = home.startsWith("/");
+	const j = isPosix ? join$1 : join;
+	const isAbs = isPosix ? isAbsolute$1 : isAbsolute;
 	const raw = env.DSH_HOME;
 	if (raw !== void 0 && raw.trim() !== "") {
 		const expanded = expandHome$1(raw.trim(), home);
-		return isAbsolute(expanded) ? expanded : join(process.cwd(), expanded);
+		return isAbs(expanded) ? expanded : j(process.cwd(), expanded);
 	}
-	return join(home, ".dsh");
+	return j(home, ".dsh");
 }
 /** Resolve the DSH home directory from the live environment. */
 function dshHome() {
@@ -1773,7 +1778,7 @@ function walkLocalDir(root) {
 			const stat = lstatSync(full);
 			if (stat.isSymbolicLink()) continue;
 			if (stat.isDirectory()) visit(full);
-			else if (stat.isFile()) files.push(relative(root, full));
+			else if (stat.isFile()) files.push(relative(root, full).replaceAll("\\", "/"));
 		}
 	};
 	visit(root);
@@ -3455,7 +3460,7 @@ function sshClusterTool(engine) {
 //#region src/mount-once.ts
 /**
 * Host single-instance guard shared by the plugin family. The family bundle
-* (dsh-web-ui-all / dsh-skins) namespaces every child row id (web-ui-*), so
+* (dsh-web-all / dsh-skins) namespaces every child row id (web-ui-*), so
 * the loader accepts a standalone install of the same package side by side;
 * without this guard the second instance would still re-register the same
 * webserver routes, tools, settings namespaces, and system-prompt sections
@@ -3468,7 +3473,7 @@ function sshClusterTool(engine) {
 * `ctx.effect` runs its callback immediately and treats the callback's
 * return value as the fiber disposer, so the unmarker is returned, not run.
 */
-const MOUNTED = Symbol.for("dsh-web-ui.mounted-plugins");
+const MOUNTED = Symbol.for("dsh-web.mounted-plugins");
 function mountedSet() {
 	const registry = globalThis;
 	return registry[MOUNTED] ??= /* @__PURE__ */ new Set();
@@ -3518,7 +3523,7 @@ const DEFAULT_ANNOUNCE = false;
 /** Order of the announcement section within the tool-guidance band. */
 const SECTION_ORDER = 150;
 /** Model-facing announcement: plugin presence, capabilities, and limits. */
-const SSH_GUIDANCE = "本机已安装 dsh-ssh 插件（DSH 远程 SSH 运维）：侧边栏「SSH」入口；在 dsh-web-ui 插件全家桶仓库（packages/dsh-ssh）统一维护。能力：主机配置存 $DSH_HOME/dsh-ssh.json（默认 ~/.dsh）（可从 ~/.ssh/config 导入）；持久连接池复用长连接（空闲 30 分钟自动断开）；ssh_list 列出主机、ssh_exec 执行远程命令、ssh_upload/ssh_download 传输文件、ssh_tunnel 本地端口转发（访问远程数据库/内网服务）、ssh_cluster 集群并发执行；支持密钥/密码/ssh-agent 认证、passphrase 密钥与 ProxyJump 跳板机；Web 终端走 WebSocket。限制：主机操作由用户在 GUI 中配置后 agent 方可使用；密码以明文存在用户主目录私有文件（权限 0600）；命令输出原样返回、可能含敏感信息；断线重连可能重放非幂等命令；传输/执行消耗真实远程资源，先确认再操作。路径区分：本机（dsh host）上的文件与命令一律用本地工具（read / write / edit / bash），ssh_* 工具只针对远程主机上的路径。用户提到「SSH / 远程服务器 / 服务器操作 / 跳板机 / 隧道 / 部署 / 上传下载」时即指本插件，请据此协作。";
+const SSH_GUIDANCE = "本机已安装 dsh-ssh 插件（DSH 远程 SSH 运维）：侧边栏「SSH」入口；在 dsh-web 插件全家桶仓库（packages/dsh-ssh）统一维护。能力：主机配置存 $DSH_HOME/dsh-ssh.json（默认 ~/.dsh）（可从 ~/.ssh/config 导入）；持久连接池复用长连接（空闲 30 分钟自动断开）；ssh_list 列出主机、ssh_exec 执行远程命令、ssh_upload/ssh_download 传输文件、ssh_tunnel 本地端口转发（访问远程数据库/内网服务）、ssh_cluster 集群并发执行；支持密钥/密码/ssh-agent 认证、passphrase 密钥与 ProxyJump 跳板机；Web 终端走 WebSocket。限制：主机操作由用户在 GUI 中配置后 agent 方可使用；密码以明文存在用户主目录私有文件（权限 0600）；命令输出原样返回、可能含敏感信息；断线重连可能重放非幂等命令；传输/执行消耗真实远程资源，先确认再操作。路径区分：本机（dsh host）上的文件与命令一律用本地工具（read / write / edit / bash），ssh_* 工具只针对远程主机上的路径。用户提到「SSH / 远程服务器 / 服务器操作 / 跳板机 / 隧道 / 部署 / 上传下载」时即指本插件，请据此协作。";
 /**
 * Mount the SSH engine, routes, tools, and announcement.
 * @param ctx - host plugin context carrying webServer/tools/systemPrompt.

package/lib/types/client/index.d.ts

@@ -15,7 +15,7 @@ import { type SshKey } from './locales.ts';
 declare module '@deepseek-ai/cordis' {
     interface Context {
         /**
-         * Optional rc.6 compatibility binder provided by dsh-web-ui-settings;
+         * Optional rc.6 compatibility binder provided by dsh-web-settings;
          * absent when that group plugin is not installed, so callers fall back to
          * the official settings scope.
          */

package/lib/types/client/telemetry.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Anonymous install telemetry shared by the DSH Web UI family plugins.
+ *
+ * Once per UTC day per browser, each wired plugin sends one heartbeat to
+ * the dsh-market edge API listing its package name (and version when known).
+ * The payload carries no conversation data and no identifiers beyond a random
+ * UUID generated in localStorage; the server hashes it with a deployment salt
+ * before storage and never persists IP addresses. Sends are fire-and-forget:
+ * failures stay silent and simply retry on a later mount or day. The system
+ * is documented in docs/telemetry.md.
+ */
+export type TelemetryChannel = 'market' | 'npm' | 'unknown';
+export interface TelemetryItem {
+    /** npm package name or asset id, e.g. "@linxin666/dsh-pet" or "skin:harbor". */
+    name: string;
+    /** Installed version when known; omitted otherwise. */
+    version?: string;
+    /** Install channel when determinable (market = Workshop install). */
+    channel?: TelemetryChannel;
+}
+/**
+ * Fire the daily heartbeat for the given items at most once per UTC day per
+ * browser. Never throws and never blocks the caller. Items without an explicit
+ * version inherit the bundle's baked build version.
+ */
+export declare function reportDailyHeartbeat(items: readonly TelemetryItem[]): void;

package/lib/types/http.d.ts

@@ -10,7 +10,7 @@
  * edit this shared source and re-run the sync instead of editing a copy.
  * Consumer code is migrated onto it in follow-up waves; no call site changes
  * belong in the same change as its introduction.
- * @module dsh-web-ui-shared/host/http
+ * @module dsh-web-shared/host/http
  */
 import type { IncomingMessage, OutgoingHttpHeaders, ServerResponse } from 'node:http';
 /**

package/lib/types/index.d.ts

@@ -38,7 +38,7 @@ export interface Config {
 }
 export declare const Config: z<Config>;
 /** Model-facing announcement: plugin presence, capabilities, and limits. */
-export declare const SSH_GUIDANCE = "\u672C\u673A\u5DF2\u5B89\u88C5 dsh-ssh \u63D2\u4EF6\uFF08DSH \u8FDC\u7A0B SSH \u8FD0\u7EF4\uFF09\uFF1A\u4FA7\u8FB9\u680F\u300CSSH\u300D\u5165\u53E3\uFF1B\u5728 dsh-web-ui \u63D2\u4EF6\u5168\u5BB6\u6876\u4ED3\u5E93\uFF08packages/dsh-ssh\uFF09\u7EDF\u4E00\u7EF4\u62A4\u3002\u80FD\u529B\uFF1A\u4E3B\u673A\u914D\u7F6E\u5B58 $DSH_HOME/dsh-ssh.json\uFF08\u9ED8\u8BA4 ~/.dsh\uFF09\uFF08\u53EF\u4ECE ~/.ssh/config \u5BFC\u5165\uFF09\uFF1B\u6301\u4E45\u8FDE\u63A5\u6C60\u590D\u7528\u957F\u8FDE\u63A5\uFF08\u7A7A\u95F2 30 \u5206\u949F\u81EA\u52A8\u65AD\u5F00\uFF09\uFF1Bssh_list \u5217\u51FA\u4E3B\u673A\u3001ssh_exec \u6267\u884C\u8FDC\u7A0B\u547D\u4EE4\u3001ssh_upload/ssh_download \u4F20\u8F93\u6587\u4EF6\u3001ssh_tunnel \u672C\u5730\u7AEF\u53E3\u8F6C\u53D1\uFF08\u8BBF\u95EE\u8FDC\u7A0B\u6570\u636E\u5E93/\u5185\u7F51\u670D\u52A1\uFF09\u3001ssh_cluster \u96C6\u7FA4\u5E76\u53D1\u6267\u884C\uFF1B\u652F\u6301\u5BC6\u94A5/\u5BC6\u7801/ssh-agent \u8BA4\u8BC1\u3001passphrase \u5BC6\u94A5\u4E0E ProxyJump \u8DF3\u677F\u673A\uFF1BWeb \u7EC8\u7AEF\u8D70 WebSocket\u3002\u9650\u5236\uFF1A\u4E3B\u673A\u64CD\u4F5C\u7531\u7528\u6237\u5728 GUI \u4E2D\u914D\u7F6E\u540E agent \u65B9\u53EF\u4F7F\u7528\uFF1B\u5BC6\u7801\u4EE5\u660E\u6587\u5B58\u5728\u7528\u6237\u4E3B\u76EE\u5F55\u79C1\u6709\u6587\u4EF6\uFF08\u6743\u9650 0600\uFF09\uFF1B\u547D\u4EE4\u8F93\u51FA\u539F\u6837\u8FD4\u56DE\u3001\u53EF\u80FD\u542B\u654F\u611F\u4FE1\u606F\uFF1B\u65AD\u7EBF\u91CD\u8FDE\u53EF\u80FD\u91CD\u653E\u975E\u5E42\u7B49\u547D\u4EE4\uFF1B\u4F20\u8F93/\u6267\u884C\u6D88\u8017\u771F\u5B9E\u8FDC\u7A0B\u8D44\u6E90\uFF0C\u5148\u786E\u8BA4\u518D\u64CD\u4F5C\u3002\u8DEF\u5F84\u533A\u5206\uFF1A\u672C\u673A\uFF08dsh host\uFF09\u4E0A\u7684\u6587\u4EF6\u4E0E\u547D\u4EE4\u4E00\u5F8B\u7528\u672C\u5730\u5DE5\u5177\uFF08read / write / edit / bash\uFF09\uFF0Cssh_* \u5DE5\u5177\u53EA\u9488\u5BF9\u8FDC\u7A0B\u4E3B\u673A\u4E0A\u7684\u8DEF\u5F84\u3002\u7528\u6237\u63D0\u5230\u300CSSH / \u8FDC\u7A0B\u670D\u52A1\u5668 / \u670D\u52A1\u5668\u64CD\u4F5C / \u8DF3\u677F\u673A / \u96A7\u9053 / \u90E8\u7F72 / \u4E0A\u4F20\u4E0B\u8F7D\u300D\u65F6\u5373\u6307\u672C\u63D2\u4EF6\uFF0C\u8BF7\u636E\u6B64\u534F\u4F5C\u3002";
+export declare const SSH_GUIDANCE = "\u672C\u673A\u5DF2\u5B89\u88C5 dsh-ssh \u63D2\u4EF6\uFF08DSH \u8FDC\u7A0B SSH \u8FD0\u7EF4\uFF09\uFF1A\u4FA7\u8FB9\u680F\u300CSSH\u300D\u5165\u53E3\uFF1B\u5728 dsh-web \u63D2\u4EF6\u5168\u5BB6\u6876\u4ED3\u5E93\uFF08packages/dsh-ssh\uFF09\u7EDF\u4E00\u7EF4\u62A4\u3002\u80FD\u529B\uFF1A\u4E3B\u673A\u914D\u7F6E\u5B58 $DSH_HOME/dsh-ssh.json\uFF08\u9ED8\u8BA4 ~/.dsh\uFF09\uFF08\u53EF\u4ECE ~/.ssh/config \u5BFC\u5165\uFF09\uFF1B\u6301\u4E45\u8FDE\u63A5\u6C60\u590D\u7528\u957F\u8FDE\u63A5\uFF08\u7A7A\u95F2 30 \u5206\u949F\u81EA\u52A8\u65AD\u5F00\uFF09\uFF1Bssh_list \u5217\u51FA\u4E3B\u673A\u3001ssh_exec \u6267\u884C\u8FDC\u7A0B\u547D\u4EE4\u3001ssh_upload/ssh_download \u4F20\u8F93\u6587\u4EF6\u3001ssh_tunnel \u672C\u5730\u7AEF\u53E3\u8F6C\u53D1\uFF08\u8BBF\u95EE\u8FDC\u7A0B\u6570\u636E\u5E93/\u5185\u7F51\u670D\u52A1\uFF09\u3001ssh_cluster \u96C6\u7FA4\u5E76\u53D1\u6267\u884C\uFF1B\u652F\u6301\u5BC6\u94A5/\u5BC6\u7801/ssh-agent \u8BA4\u8BC1\u3001passphrase \u5BC6\u94A5\u4E0E ProxyJump \u8DF3\u677F\u673A\uFF1BWeb \u7EC8\u7AEF\u8D70 WebSocket\u3002\u9650\u5236\uFF1A\u4E3B\u673A\u64CD\u4F5C\u7531\u7528\u6237\u5728 GUI \u4E2D\u914D\u7F6E\u540E agent \u65B9\u53EF\u4F7F\u7528\uFF1B\u5BC6\u7801\u4EE5\u660E\u6587\u5B58\u5728\u7528\u6237\u4E3B\u76EE\u5F55\u79C1\u6709\u6587\u4EF6\uFF08\u6743\u9650 0600\uFF09\uFF1B\u547D\u4EE4\u8F93\u51FA\u539F\u6837\u8FD4\u56DE\u3001\u53EF\u80FD\u542B\u654F\u611F\u4FE1\u606F\uFF1B\u65AD\u7EBF\u91CD\u8FDE\u53EF\u80FD\u91CD\u653E\u975E\u5E42\u7B49\u547D\u4EE4\uFF1B\u4F20\u8F93/\u6267\u884C\u6D88\u8017\u771F\u5B9E\u8FDC\u7A0B\u8D44\u6E90\uFF0C\u5148\u786E\u8BA4\u518D\u64CD\u4F5C\u3002\u8DEF\u5F84\u533A\u5206\uFF1A\u672C\u673A\uFF08dsh host\uFF09\u4E0A\u7684\u6587\u4EF6\u4E0E\u547D\u4EE4\u4E00\u5F8B\u7528\u672C\u5730\u5DE5\u5177\uFF08read / write / edit / bash\uFF09\uFF0Cssh_* \u5DE5\u5177\u53EA\u9488\u5BF9\u8FDC\u7A0B\u4E3B\u673A\u4E0A\u7684\u8DEF\u5F84\u3002\u7528\u6237\u63D0\u5230\u300CSSH / \u8FDC\u7A0B\u670D\u52A1\u5668 / \u670D\u52A1\u5668\u64CD\u4F5C / \u8DF3\u677F\u673A / \u96A7\u9053 / \u90E8\u7F72 / \u4E0A\u4F20\u4E0B\u8F7D\u300D\u65F6\u5373\u6307\u672C\u63D2\u4EF6\uFF0C\u8BF7\u636E\u6B64\u534F\u4F5C\u3002";
 /**
  * Mount the SSH engine, routes, tools, and announcement.
  * @param ctx - host plugin context carrying webServer/tools/systemPrompt.

package/lib/types/loopback.d.ts

@@ -7,7 +7,7 @@
  * Semantics: RFC 5735 IPv4 127/8, ::1, IPv4-mapped ::ffff:127/8 (matching the
  * remote-web-ui gate), localhost hostnames, plus the browser same-origin
  * markers (sec-fetch-site and Origin) for the request-level fence.
- * @module dsh-web-ui-shared/host/loopback
+ * @module dsh-web-shared/host/loopback
  */
 import type { IncomingMessage } from 'node:http';
 /** IPv4 127/8 predicate (four decimal octets, first == 127). */

package/lib/types/mount-once.d.ts

@@ -1,6 +1,6 @@
 /**
  * Host single-instance guard shared by the plugin family. The family bundle
- * (dsh-web-ui-all / dsh-skins) namespaces every child row id (web-ui-*), so
+ * (dsh-web-all / dsh-skins) namespaces every child row id (web-ui-*), so
  * the loader accepts a standalone install of the same package side by side;
  * without this guard the second instance would still re-register the same
  * webserver routes, tools, settings namespaces, and system-prompt sections

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-ssh",
   "description": "Remote SSH operations for the dsh web GUI: host config store (~/.dsh/dsh-ssh.json, import from ~/.ssh/config), a persistent ssh2 connection pool with jump-host support, exec / PTY web terminal / SFTP transfer / local port-forward tunnels / cluster execution, plus agent tools (ssh_list, ssh_exec, ssh_upload, ssh_download, ssh_tunnel, ssh_cluster). Hot-pluggable — mounted via ~/.dsh/cordis.patch.yml + a profile node_modules symlink, no dsh source changes.",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
@@ -89,7 +89,7 @@
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "https://github.com/zhu1090093659/dsh-web-ui.git"
+    "url": "https://github.com/zhu1090093659/dsh-web.git"
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json && tsdown",

package/src/client/index.ts

@@ -23,6 +23,7 @@ import { mountPanel } from './mount.tsx'
 import { PanelController } from './panel/controller.ts'
 import type { TerminalFontSource } from './panel/helpers.ts'
 import { mountSidebarEntry } from './sidebar-entry.ts'
+import { reportDailyHeartbeat } from './telemetry.ts'
 
 /** Locale namespace this plugin owns. */
 const NS = 'dsh-ssh'
@@ -39,7 +40,7 @@ interface SshClientSettings {
 declare module '@deepseek-ai/cordis' {
   interface Context {
     /**
-     * Optional rc.6 compatibility binder provided by dsh-web-ui-settings;
+     * Optional rc.6 compatibility binder provided by dsh-web-settings;
      * absent when that group plugin is not installed, so callers fall back to
      * the official settings scope.
      */
@@ -73,6 +74,10 @@ export type { SshKey } from './locales.ts'
  * @param ctx - client root context (locale service).
  */
 export function apply(ctx: ClientContext): void {
+  // Anonymous install heartbeat (docs/telemetry.md): one beat per browser per
+  // UTC day, package name only, silent failure.
+  reportDailyHeartbeat([{ name: '@linxin666/dsh-ssh' }])
+
   ctx.effect(() => {
     try {
       return ctx.locale.register(NS, { zh, en })

package/src/client/panel/SshPanel.tsx

@@ -57,7 +57,7 @@ export function SshPanel({ controller, api, terminalFont }: SshPanelProps) {
   return (
     <div className={css.panel} data-dsh-plugin="ssh">
       <div className={css.panelHeader}>
-        {/* Shared hook: dsh-web-ui-all offsets center-view back controls beside the collapsed mobile sidebar. */}
+        {/* Shared hook: dsh-web-all offsets center-view back controls beside the collapsed mobile sidebar. */}
         <button
           type="button"
           className={`${css.ghostButton} ${css.backButton}`}

package/src/client/telemetry.ts

@@ -0,0 +1,105 @@
+// Generated by scripts/sync-shared.mjs from shared/client/telemetry.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Anonymous install telemetry shared by the DSH Web UI family plugins.
+ *
+ * Once per UTC day per browser, each wired plugin sends one heartbeat to
+ * the dsh-market edge API listing its package name (and version when known).
+ * The payload carries no conversation data and no identifiers beyond a random
+ * UUID generated in localStorage; the server hashes it with a deployment salt
+ * before storage and never persists IP addresses. Sends are fire-and-forget:
+ * failures stay silent and simply retry on a later mount or day. The system
+ * is documented in docs/telemetry.md.
+ */
+
+export type TelemetryChannel = 'market' | 'npm' | 'unknown'
+
+export interface TelemetryItem {
+  /** npm package name or asset id, e.g. "@linxin666/dsh-pet" or "skin:harbor". */
+  name: string
+  /** Installed version when known; omitted otherwise. */
+  version?: string
+  /** Install channel when determinable (market = Workshop install). */
+  channel?: TelemetryChannel
+}
+
+const VISITOR_KEY = 'dsh-web-ui-telemetry-visitor'
+const DAY_KEY_PREFIX = 'dsh-web-ui-telemetry-day:'
+const ENDPOINT = 'https://dsh-market.com/api/telemetry/event'
+
+// Baked into each client bundle by shared/tsdown.client.ts (the package's own
+// package.json version at build time). Undefined in dev/test builds.
+declare const __DSH_PKG_VERSION__: string | undefined
+
+/** The building package's version, when the bundle carries it. */
+function bakedVersion(): string | undefined {
+  try {
+    return typeof __DSH_PKG_VERSION__ === 'string' && __DSH_PKG_VERSION__ !== ''
+      ? __DSH_PKG_VERSION__
+      : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/** Read or lazily create the anonymous visitor id; null when storage is unavailable. */
+function visitorId(): string | null {
+  try {
+    const existing = localStorage.getItem(VISITOR_KEY)
+    if (existing && /^[A-Za-z0-9_-]{16,64}$/.test(existing)) return existing
+    const fresh = crypto.randomUUID().replaceAll('-', '')
+    localStorage.setItem(VISITOR_KEY, fresh)
+    return fresh
+  } catch {
+    // Storage unavailable (privacy mode, sandboxed frame): report nothing.
+    return null
+  }
+}
+
+/** Drop stale per-day dedup keys so localStorage does not grow forever. */
+function pruneDayKeys(today: string): void {
+  try {
+    for (let index = localStorage.length - 1; index >= 0; index -= 1) {
+      const key = localStorage.key(index)
+      if (key !== null && key.startsWith(DAY_KEY_PREFIX) && key !== DAY_KEY_PREFIX + today) {
+        localStorage.removeItem(key)
+      }
+    }
+  } catch { /* best effort */ }
+}
+
+/**
+ * Fire the daily heartbeat for the given items at most once per UTC day per
+ * browser. Never throws and never blocks the caller. Items without an explicit
+ * version inherit the bundle's baked build version.
+ */
+export function reportDailyHeartbeat(items: readonly TelemetryItem[]): void {
+  try {
+    if (items.length === 0) return
+    const today = new Date().toISOString().slice(0, 10)
+    // Automation contexts (CDP-driven QA browsers, fresh isolated profiles)
+    // mint a new visitor id per run and would inflate instance counts.
+    if (navigator.webdriver) return
+    if (localStorage.getItem(DAY_KEY_PREFIX + today) !== null) return
+    const visitor = visitorId()
+    if (visitor === null) return
+    pruneDayKeys(today)
+    const payloadItems = items.map((item) => {
+      const out: Record<string, string> = { name: item.name }
+      const version = item.version ?? bakedVersion()
+      if (version !== undefined) out.version = version
+      if (item.channel !== undefined) out.channel = item.channel
+      return out
+    })
+    const body = JSON.stringify({ kind: 'heartbeat', visitor, items: payloadItems })
+    void fetch(ENDPOINT, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body,
+      keepalive: true,
+    }).then((response) => {
+      // Mark the day only after an accepted send, so offline browsers retry
+      // on a later mount instead of going dark until tomorrow.
+      if (response.ok) localStorage.setItem(DAY_KEY_PREFIX + today, '1')
+    }).catch(() => { /* unreachable endpoint: stay silent */ })
+  } catch { /* never break the host UI over telemetry */ }
+}

package/src/dsh-home.ts

@@ -7,11 +7,14 @@
 
 import { homedir } from 'node:os'
 import { isAbsolute, join } from 'node:path'
+import { isAbsolute as posixIsAbsolute, join as posixJoin } from 'node:path/posix'
 
 /** Expand a leading ~ (or ~user) in a path, platform-style. */
 export function expandHome(path: string, home: string = homedir()): string {
+  const isPosix = home.startsWith('/')
+  const j = isPosix ? posixJoin : join
   if (path === '~') return home
-  if (path.startsWith('~/') || path.startsWith('~\\')) return join(home, path.slice(2))
+  if (path.startsWith('~/') || path.startsWith('~\\')) return j(home, path.slice(2))
   return path
 }
 
@@ -22,12 +25,15 @@ export function expandHome(path: string, home: string = homedir()): string {
  * @returns the absolute DSH home path.
  */
 export function resolveDshHome(env: NodeJS.ProcessEnv = process.env, home: string = homedir()): string {
+  const isPosix = home.startsWith('/')
+  const j = isPosix ? posixJoin : join
+  const isAbs = isPosix ? posixIsAbsolute : isAbsolute
   const raw = env.DSH_HOME
   if (raw !== undefined && raw.trim() !== '') {
     const expanded = expandHome(raw.trim(), home)
-    return isAbsolute(expanded) ? expanded : join(process.cwd(), expanded)
+    return isAbs(expanded) ? expanded : j(process.cwd(), expanded)
   }
-  return join(home, '.dsh')
+  return j(home, '.dsh')
 }
 
 /** Resolve the DSH home directory from the live environment. */

package/src/engine/sftp.ts

@@ -22,7 +22,7 @@ export function walkLocalDir(root: string): string[] {
       const stat = lstatSync(full)
       if (stat.isSymbolicLink()) continue
       if (stat.isDirectory()) visit(full)
-      else if (stat.isFile()) files.push(relative(root, full))
+      else if (stat.isFile()) files.push(relative(root, full).replaceAll('\\', '/'))
     }
   }
   visit(root)

package/src/http.ts

@@ -11,7 +11,7 @@
  * edit this shared source and re-run the sync instead of editing a copy.
  * Consumer code is migrated onto it in follow-up waves; no call site changes
  * belong in the same change as its introduction.
- * @module dsh-web-ui-shared/host/http
+ * @module dsh-web-shared/host/http
  */
 
 import type { IncomingMessage, OutgoingHttpHeaders, ServerResponse } from 'node:http'

package/src/index.ts

@@ -64,7 +64,7 @@ const DEFAULT_ANNOUNCE = false
 const SECTION_ORDER = 150
 
 /** Model-facing announcement: plugin presence, capabilities, and limits. */
-export const SSH_GUIDANCE = '本机已安装 dsh-ssh 插件（DSH 远程 SSH 运维）：侧边栏「SSH」入口；在 dsh-web-ui 插件全家桶仓库（packages/dsh-ssh）统一维护。能力：主机配置存 $DSH_HOME/dsh-ssh.json（默认 ~/.dsh）（可从 ~/.ssh/config 导入）；持久连接池复用长连接（空闲 30 分钟自动断开）；ssh_list 列出主机、ssh_exec 执行远程命令、ssh_upload/ssh_download 传输文件、ssh_tunnel 本地端口转发（访问远程数据库/内网服务）、ssh_cluster 集群并发执行；支持密钥/密码/ssh-agent 认证、passphrase 密钥与 ProxyJump 跳板机；Web 终端走 WebSocket。限制：主机操作由用户在 GUI 中配置后 agent 方可使用；密码以明文存在用户主目录私有文件（权限 0600）；命令输出原样返回、可能含敏感信息；断线重连可能重放非幂等命令；传输/执行消耗真实远程资源，先确认再操作。路径区分：本机（dsh host）上的文件与命令一律用本地工具（read / write / edit / bash），ssh_* 工具只针对远程主机上的路径。用户提到「SSH / 远程服务器 / 服务器操作 / 跳板机 / 隧道 / 部署 / 上传下载」时即指本插件，请据此协作。'
+export const SSH_GUIDANCE = '本机已安装 dsh-ssh 插件（DSH 远程 SSH 运维）：侧边栏「SSH」入口；在 dsh-web 插件全家桶仓库（packages/dsh-ssh）统一维护。能力：主机配置存 $DSH_HOME/dsh-ssh.json（默认 ~/.dsh）（可从 ~/.ssh/config 导入）；持久连接池复用长连接（空闲 30 分钟自动断开）；ssh_list 列出主机、ssh_exec 执行远程命令、ssh_upload/ssh_download 传输文件、ssh_tunnel 本地端口转发（访问远程数据库/内网服务）、ssh_cluster 集群并发执行；支持密钥/密码/ssh-agent 认证、passphrase 密钥与 ProxyJump 跳板机；Web 终端走 WebSocket。限制：主机操作由用户在 GUI 中配置后 agent 方可使用；密码以明文存在用户主目录私有文件（权限 0600）；命令输出原样返回、可能含敏感信息；断线重连可能重放非幂等命令；传输/执行消耗真实远程资源，先确认再操作。路径区分：本机（dsh host）上的文件与命令一律用本地工具（read / write / edit / bash），ssh_* 工具只针对远程主机上的路径。用户提到「SSH / 远程服务器 / 服务器操作 / 跳板机 / 隧道 / 部署 / 上传下载」时即指本插件，请据此协作。'
 
 /**
  * Mount the SSH engine, routes, tools, and announcement.

package/src/loopback.ts

@@ -8,7 +8,7 @@
  * Semantics: RFC 5735 IPv4 127/8, ::1, IPv4-mapped ::ffff:127/8 (matching the
  * remote-web-ui gate), localhost hostnames, plus the browser same-origin
  * markers (sec-fetch-site and Origin) for the request-level fence.
- * @module dsh-web-ui-shared/host/loopback
+ * @module dsh-web-shared/host/loopback
  */
 
 import type { IncomingMessage } from 'node:http'

package/src/mount-once.ts

@@ -1,7 +1,7 @@
 // Generated by scripts/sync-shared.mjs from shared/host/mount-once.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
 /**
  * Host single-instance guard shared by the plugin family. The family bundle
- * (dsh-web-ui-all / dsh-skins) namespaces every child row id (web-ui-*), so
+ * (dsh-web-all / dsh-skins) namespaces every child row id (web-ui-*), so
  * the loader accepts a standalone install of the same package side by side;
  * without this guard the second instance would still re-register the same
  * webserver routes, tools, settings namespaces, and system-prompt sections
@@ -15,7 +15,7 @@
  * return value as the fiber disposer, so the unmarker is returned, not run.
  */
 
-const MOUNTED = Symbol.for('dsh-web-ui.mounted-plugins')
+const MOUNTED = Symbol.for('dsh-web.mounted-plugins')
 
 interface MountRegistry {
   [MOUNTED]?: Set<string>