@linxin666/dsh-ssh 0.3.24 → 0.4.1

package/lib/types/client/index.d.ts

@@ -11,20 +11,7 @@
  * cordis loading needs plus types only — all value exports stay internal.
  */
 import type { Context as ClientContext } from '@deepseek-ai/cordis';
-import type { SettingsScope, SettingsScopeSpec } from '@deepseek-ai/dsh-client-ui-settings/client';
 import { type SshKey } from './locales.ts';
-declare module '@deepseek-ai/cordis' {
-    interface Context {
-        /**
-         * Optional rc.6 compatibility binder provided by dsh-web-settings;
-         * absent when that group plugin is not installed, so callers fall back to
-         * the official settings scope.
-         */
-        webUiSettings?: {
-            bind<S>(spec: SettingsScopeSpec<S>): SettingsScope<S>;
-        };
-    }
-}
 declare module '@deepseek-ai/dsh-client-ui-slots' {
     interface LocaleNamespaceMap {
         /** dsh-ssh surface copy. */

package/lib/types/client/settings-binding.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Settings reader of the dsh-ssh browser half.
+ *
+ * The plugin's browser half owns one preference: the xterm `fontFamily` the
+ * panel applies to its terminals. Under the 0.1.7 settings model that field
+ * belongs to the plugin's own profile entry (its Cordis Config schema), and
+ * the browser surface addresses settings as one form per profile entry id — so
+ * the entry has to be resolved before its section can be read:
+ *
+ * - the family binder (`ctx.get('webUiSettings')`, published while
+ *   dsh-web-settings is loaded) resolves the dsh-ssh namespace to its entry id
+ *   through the Host bridge and hands back the native shared form;
+ * - without that group the shared configuration forms serve the form directly,
+ *   and the entry is recognised by the one field this plugin's own schema
+ *   declares: the entry whose resolved section carries `terminalFontFamily`.
+ */
+import type { Context as ClientContext } from '@deepseek-ai/cordis';
+import type { ConfigForm, ConfigFormSnapshot } from '@deepseek-ai/dsh-client-ui-settings/client';
+/** Domain-owned description of one settings namespace a family surface binds. */
+export interface ConfigFormSpec<T> {
+    /** Settings namespace the surface edits. */
+    namespace: string;
+    /**
+     * Narrow one wire section; undefined keeps the section the Host resolved.
+     * The shared form already validates against the namespace's serialized
+     * schema, so a decoder exists only to narrow beyond it.
+     */
+    decode?: (section: unknown) => T | undefined;
+}
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        /**
+         * Optional family settings binder provided by dsh-web-settings; absent when
+         * that group plugin is not installed, so callers fall back to the shared
+         * configuration forms service (`ctx.configForms`).
+         */
+        webUiSettings?: {
+            bind<S>(spec: ConfigFormSpec<S>): ConfigForm<S>;
+        };
+    }
+}
+/** The read face this plugin needs from its own settings entry. */
+export interface SettingsReader<T> {
+    /** @returns the current snapshot (stable reference until the next change). */
+    getSnapshot(): ConfigFormSnapshot<T>;
+    /** Observe snapshot replacements. */
+    subscribe(listener: () => void): () => void;
+}
+/** A reader plus the release of every subscription it installed. */
+export interface SettingsBinding<T> extends SettingsReader<T> {
+    /** Release the reader's subscriptions; later calls are no-ops. */
+    dispose(): void;
+}
+/**
+ * Bind this plugin's settings reader.
+ * @param ctx - client context carrying the family binder and/or the shared forms service.
+ * @param namespace - the family settings namespace this plugin owns.
+ * @param field - the field this plugin's own schema declares, used to recognise its entry when the family binder is absent.
+ * @returns the reader and the release of its subscriptions.
+ */
+export declare function bindSettingsReader<T>(ctx: ClientContext, namespace: string, field: string): SettingsBinding<T>;

package/lib/types/client/sidebar-entry-core.d.ts

@@ -1,29 +1,3 @@
-/**
- * One trailing action button seated at the entry row's right edge (e.g. a
- * refresh command or a collapse chevron). Rows with actions switch from the
- * classic single-button structure to a container with a main button plus the
- * action buttons (nested interactive elements are invalid HTML); rows without
- * actions keep the classic structure untouched.
- */
-export interface SidebarEntryAction {
-    /** Stable id stamped as data-dsh-entry-action="<id>" (CSS hooks and tests). */
-    id: string;
-    /** Inline icon markup while the row is active (always, when inactiveIcon is unset). */
-    icon: string;
-    /**
-     * Optional icon while the row is inactive. Setting it makes the action a
-     * state mirror (a collapse chevron): the core swaps the icon and stamps
-     * aria-expanded on every active-state change. Requires the active bridge.
-     */
-    inactiveIcon?: string;
-    /** Localized accessible label (aria-label + title); receives the active state. */
-    label(active: boolean): string;
-    /**
-     * Click handler; receives the button so the caller can drive transient
-     * affordances (a refresh cooldown) without a re-render.
-     */
-    onClick(button: HTMLButtonElement): void;
-}
 /** Per-package configuration for one sidebar entry row. */
 export interface SidebarEntryOptions {
     /** Full attribute name identifying the injected row (idempotency key), e.g. 'data-dsh-ssh-entry'. */
@@ -57,12 +31,6 @@ export interface SidebarEntryOptions {
     };
     /** Click action (open/toggle the owning panel). */
     onToggle(): void;
-    /**
-     * Optional trailing action buttons at the row's right edge. Requires the
-     * package CSS to seat entryMain / entryAction; empty keeps the classic
-     * single-button row.
-     */
-    actions?: readonly SidebarEntryAction[];
     /** Family-block position: 'before' inserts ahead of sibling plugin rows, 'after' behind them. */
     position: 'before' | 'after';
     /**

package/lib/types/http.d.ts

@@ -1,7 +1,9 @@
 /**
  * Shared JSON body/response helpers for the host route families: one strict
  * bounded body reader, one lenient bounded body reader, one JSON object
- * narrow, and one JSON writer. Previously these were copy-pasted across the
+ * narrow, one JSON writer, and the outbound request-init helper that keeps a
+ * host fetch body decodable (withIdentityEncoding). Previously the readers
+ * were copy-pasted across the
  * package route files (routes.ts, update-routes.ts, mobile-api.ts, and each
  * family's route module) with drifting contracts: body caps ranging 4 KiB to
  * 1 MiB and four distinct overflow behaviors (reject, undefined, null, throw).
@@ -34,6 +36,21 @@ export declare function readJsonBody(req: IncomingMessage, opts?: {
 }): Promise<unknown | null>;
 /** Narrow a value to a JSON object, or undefined when it is not one. */
 export declare function asJsonObject(value: unknown): Record<string, unknown> | undefined;
+/**
+ * Request init that asks a remote origin for an uncompressed body.
+ *
+ * The DSH host boots `@deepseek-ai/dsh-http-proxy`, whose top-level import of
+ * the npm `undici` copy replaces the legacy `undici.globalDispatcher.1` slot
+ * Node's built-in `fetch()` reads. That cross-major wrapper drops the
+ * `content-encoding` header and automatic decompression, so a plain fetch
+ * resolves to raw gzip/brotli/zstd bytes — compressed noise no JSON or text
+ * consumer can read. Every host fetch that parses a remote body must request
+ * identity encoding. Caller headers survive; `accept-encoding` is forced to
+ * `identity` because a caller value has no decoder behind it in this host.
+ * @param init - the caller's request init (signal, headers, method, ...).
+ * @returns a copy with `accept-encoding: identity` merged in.
+ */
+export declare function withIdentityEncoding(init?: RequestInit): RequestInit;
 /**
  * Write one JSON response. Default headers are the family defaults
  * (content-type and referrer-policy); caller headers are appended or

package/lib/types/index.d.ts

@@ -8,23 +8,27 @@
  * no dsh source changes.
  */
 import type { Context } from '@deepseek-ai/cordis';
-import type { SettingsNamespace } from '@deepseek-ai/dsh-settings';
-import z from 'schemastery';
+import z from '@deepseek-ai/schemastery';
 /** Stable cordis plugin name. */
 export declare const name = "ssh";
 /** Services required before the SSH surfaces can mount. */
 export declare const inject: string[];
-/**
- * Settings namespace of the SSH capability — the section the web settings
- * surface edits. Spelled here rather than imported: the browser half spells
- * the same value and must not depend on a Host package.
- */
-export declare const SSH_SETTINGS_NAMESPACE: SettingsNamespace;
-/** Plugin config, validated by the same-named schemastery schema. */
+declare module '@deepseek-ai/cordis' {
+    interface Events {
+        /**
+         * Volatile config values were committed into the running instance without a
+         * remount (cordis-plugin-loader); dispatched to the owning fiber only.
+         * @param paths - the changed config paths, as key arrays.
+         * @mode emit
+         */
+        'loader/volatile-update'(paths: readonly (readonly string[])[]): void;
+    }
+}
+/** Plugin config as a profile patch declares it, before schema resolution. */
 export interface Config {
     /**
-     * When true (default), a system-prompt section announces the SSH plugin to
-     * every agent (tools + host store). Set false to keep it silent.
+     * When true, a system-prompt section announces the SSH plugin to every agent
+     * (tools + host store). Off by default to keep prompts clean.
      */
     announceToAgent?: boolean;
     /** Master switch for the plugin (routes, tools, prompt section). */
@@ -37,7 +41,36 @@ export interface Config {
      */
     terminalFontFamily?: string;
 }
-export declare const Config: z<Config>;
+/** The stable reference a `volatile()` config field resolves to; its owner updates it in place. */
+interface ConfigRef<T> {
+    /** @returns the field's current value. */
+    get(): T;
+}
+/** One resolved config field: a live reference, or a plain value from a hand-built context. */
+type ConfigField<T> = ConfigRef<T> | T;
+/** The config the Host hands to {@link apply} — the runtime face of {@link Config}. */
+export interface ResolvedConfig {
+    announceToAgent?: ConfigField<boolean>;
+    enabled?: ConfigField<boolean>;
+    terminalFontFamily?: ConfigField<string>;
+}
+/**
+ * Plugin config schema. Under the 0.1.7 settings model this schema IS the
+ * entry's settings page: the Host derives one form per profile entry from it
+ * and serves it through the shared configuration forms. Every field is
+ * `volatile()`, which is what puts it on that page and what lets an edit reach
+ * a running instance without a remount: the loader commits the new value into
+ * the field's reference and announces `loader/volatile-update` on this fiber.
+ */
+export declare const Config: z<Schemastery.ObjectS<NoInfer<{
+    announceToAgent: z<boolean, boolean, "volatile-defined">;
+    enabled: z<boolean, boolean, "volatile-defined">;
+    terminalFontFamily: z<string, string, "volatile-defined">;
+}>>, Schemastery.ObjectT<NoInfer<{
+    announceToAgent: z<boolean, boolean, "volatile-defined">;
+    enabled: z<boolean, boolean, "volatile-defined">;
+    terminalFontFamily: z<string, string, "volatile-defined">;
+}>>, "plain">;
 /** Model-facing announcement: plugin presence, capabilities, and limits. */
 export declare const SSH_GUIDANCE = "\u672C\u673A\u5DF2\u5B89\u88C5 dsh-ssh \u63D2\u4EF6\uFF08DSH \u8FDC\u7A0B SSH \u8FD0\u7EF4\uFF09\uFF1A\u4FA7\u8FB9\u680F\u300CSSH\u300D\u5165\u53E3\uFF1B\u5728 dsh-web \u63D2\u4EF6\u5168\u5BB6\u6876\u4ED3\u5E93\uFF08packages/dsh-ssh\uFF09\u7EDF\u4E00\u7EF4\u62A4\u3002\u80FD\u529B\uFF1A\u4E3B\u673A\u914D\u7F6E\u5B58 $DSH_HOME/dsh-ssh.json\uFF08\u9ED8\u8BA4 ~/.dsh\uFF09\uFF08\u53EF\u4ECE ~/.ssh/config \u5BFC\u5165\uFF09\uFF1B\u6301\u4E45\u8FDE\u63A5\u6C60\u590D\u7528\u957F\u8FDE\u63A5\uFF08\u7A7A\u95F2 30 \u5206\u949F\u81EA\u52A8\u65AD\u5F00\uFF09\uFF1Bssh_list \u5217\u51FA\u4E3B\u673A\u3001ssh_exec \u6267\u884C\u8FDC\u7A0B\u547D\u4EE4\u3001ssh_upload/ssh_download \u4F20\u8F93\u6587\u4EF6\u3001ssh_tunnel \u672C\u5730\u7AEF\u53E3\u8F6C\u53D1\uFF08\u8BBF\u95EE\u8FDC\u7A0B\u6570\u636E\u5E93/\u5185\u7F51\u670D\u52A1\uFF09\u3001ssh_cluster \u6309 aliases/environment/tags \u81F3\u5C11\u4E00\u79CD\u975E\u7A7A selector \u7B5B\u9009\u540E\u96C6\u7FA4\u5E76\u53D1\u6267\u884C\uFF1B\u652F\u6301\u5BC6\u94A5/\u5BC6\u7801/ssh-agent \u8BA4\u8BC1\u3001passphrase \u5BC6\u94A5\u3001ProxyJump \u8DF3\u677F\u673A\uFF08\u522B\u540D\u6216 [user@]host[:port] \u5730\u5740\uFF09\u4E0E OpenSSH \u8BED\u4E49\u7684 ProxyCommand\uFF08\u8DF3\u8FC7\u5821\u5792\u673A\u5BA2\u6237\u7AEF\u573A\u666F\uFF0C\u53EA\u80FD\u7531\u7528\u6237\u5728 GUI \u914D\u7F6E\uFF0Cagent \u4E0D\u53EF\u5199\uFF09\uFF1BWeb \u7EC8\u7AEF\u8D70 WebSocket\u3002\u9650\u5236\uFF1A\u4E3B\u673A\u64CD\u4F5C\u7531\u7528\u6237\u5728 GUI \u4E2D\u914D\u7F6E\u540E agent \u65B9\u53EF\u4F7F\u7528\uFF1B\u5BC6\u7801\u4EE5\u660E\u6587\u5B58\u5728\u7528\u6237\u4E3B\u76EE\u5F55\u79C1\u6709\u6587\u4EF6\uFF08\u6743\u9650 0600\uFF09\uFF1B\u547D\u4EE4\u8F93\u51FA\u539F\u6837\u8FD4\u56DE\u3001\u53EF\u80FD\u542B\u654F\u611F\u4FE1\u606F\uFF1B\u65AD\u7EBF\u91CD\u8FDE\u53EF\u80FD\u91CD\u653E\u975E\u5E42\u7B49\u547D\u4EE4\uFF1B\u4F20\u8F93/\u6267\u884C\u6D88\u8017\u771F\u5B9E\u8FDC\u7A0B\u8D44\u6E90\uFF0C\u5148\u786E\u8BA4\u518D\u64CD\u4F5C\u3002\u8DEF\u5F84\u533A\u5206\uFF1A\u672C\u673A\uFF08dsh host\uFF09\u4E0A\u7684\u6587\u4EF6\u4E0E\u547D\u4EE4\u4E00\u5F8B\u7528\u672C\u5730\u5DE5\u5177\uFF08read / write / edit / bash\uFF09\uFF0Cssh_* \u5DE5\u5177\u53EA\u9488\u5BF9\u8FDC\u7A0B\u4E3B\u673A\u4E0A\u7684\u8DEF\u5F84\u3002\u7528\u6237\u63D0\u5230\u300CSSH / \u8FDC\u7A0B\u670D\u52A1\u5668 / \u670D\u52A1\u5668\u64CD\u4F5C / \u8DF3\u677F\u673A / \u96A7\u9053 / \u90E8\u7F72 / \u4E0A\u4F20\u4E0B\u8F7D\u300D\u65F6\u5373\u6307\u672C\u63D2\u4EF6\uFF0C\u8BF7\u636E\u6B64\u534F\u4F5C\u3002";
 /**
@@ -46,5 +79,5 @@ export declare const SSH_GUIDANCE = "\u672C\u673A\u5DF2\u5B89\u88C5 dsh-ssh \u63
  * @param config - resolved plugin config (schema defaults applied by the loader).
  */
 export declare const apply: typeof applyImpl;
-declare function applyImpl(ctx: Context, config?: Config): void;
+declare function applyImpl(ctx: Context, config?: ResolvedConfig): void;
 export {};

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@linxin666/dsh-ssh",
   "description": "Remote SSH operations for the dsh web GUI: host config store (~/.dsh/dsh-ssh.json, import from ~/.ssh/config), a persistent ssh2 connection pool with jump-host support, exec / PTY web terminal / SFTP transfer / local port-forward tunnels / cluster execution, plus agent tools (ssh_list, ssh_exec, ssh_upload, ssh_download, ssh_tunnel, ssh_cluster). Hot-pluggable — mounted via ~/.dsh/cordis.patch.yml + a profile node_modules symlink, no dsh source changes.",
-  "version": "0.3.24",
+  "version": "0.4.1",
+  "icon": "icon.svg",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
@@ -26,7 +27,7 @@
   },
   "dsh": {
     "engines": {
-      "dsh": ">=0.1.5-rc.1"
+      "dsh": ">=0.1.7-rc.1"
     },
     "bundle": {
       "patch": "./cordis.patch.yml"
@@ -41,42 +42,43 @@
     }
   },
   "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.4",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
     "ssh2": "^1.17.0",
     "ws": "^8.18.0"
   },
   "peerDependencies": {
+    "@deepseek-ai/dsh": ">=0.1.7-rc.1",
     "react": "^18.2.0",
     "react-dom": "^18.2.0"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-client-connection": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-locale": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-llm": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-scope": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-settings": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-timeout": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-tools": "^0.1.5-rc.1",
+    "@deepseek-ai/cordis": "^4.0.4",
+    "@deepseek-ai/dsh-client-connection": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-locale": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-scope": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-settings": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-system-prompt": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-timeout": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-tools": "^0.1.7-rc.1",
     "@types/node": "^22.20.0",
     "@types/react": "~18.3.1",
     "@types/react-dom": "^18.3.5",
     "@types/ssh2": "^1.15.5",
     "@types/ws": "^8.5.13",
-    "@vitest/coverage-v8": "^3.2.7",
+    "@vitest/coverage-v8": "^4.1.11",
     "jsdom": "^25.0.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
-    "schemastery": "^3.18.0",
     "tsdown": "0.22.2",
     "typescript": "~5.7.2",
-    "vitest": "^3.0.0"
+    "vitest": "^4.1.11"
   },
   "files": [
     "lib/**/*.js",
@@ -85,7 +87,8 @@
     "lib/**/*.d.ts.map",
     "src",
     "cordis.patch.yml",
-    "README.md"
+    "README.md",
+    "icon.svg"
   ],
   "license": "Apache-2.0",
   "repository": {

package/src/client/index.ts

@@ -11,10 +11,9 @@
  * cordis loading needs plus types only — all value exports stay internal.
  */
 import type { Context as ClientContext } from '@deepseek-ai/cordis'
-import type { SettingsScope, SettingsScopeSpec } from '@deepseek-ai/dsh-client-ui-settings/client'
 // Type-only: pulls the locale plugin's Context merge (ctx.locale).
 import type {} from '@deepseek-ai/dsh-client-locale/client'
-// Type-only: pulls the settings-surface Context merge (ctx.settingsScope).
+// Type-only: pulls the shared-forms Context merge (ctx.configForms).
 import type {} from '@deepseek-ai/dsh-client-ui-settings/client'
 // Type-only: pulls the ctx.slots merge (the renderer owns the slot registry since 0.1.2).
 import type {} from '@deepseek-ai/dsh-client-ui-renderer/client'
@@ -26,31 +25,27 @@ import { mountPanel } from './mount.tsx'
 import { PanelController } from './panel/controller.ts'
 import type { TerminalFontSource } from './panel/helpers.ts'
 import { setRuntimeTranslate } from './panel/helpers.ts'
+import { bindSettingsReader } from './settings-binding.ts'
 import { mountSidebarEntry } from './sidebar-entry.ts'
 import { reportDailyHeartbeat } from './telemetry.ts'
 
 /** Locale namespace this plugin owns. */
 const NS = 'dsh-ssh'
 
-/** Settings namespace the terminal-font preference lives in (issue #577). */
+/**
+ * Family settings namespace the terminal-font preference is addressed by
+ * (issue #577); dsh-web-settings maps it to the owning profile entry id.
+ */
 const SETTINGS_NS = 'dsh-ssh'
 
-/** The dsh-ssh settings surface the browser half reads. */
+/** The dsh-ssh settings section the browser half reads. */
 interface SshClientSettings {
   /** User-configured xterm fontFamily; empty/undefined means the CSS chain. */
   terminalFontFamily?: string
 }
 
-declare module '@deepseek-ai/cordis' {
-  interface Context {
-    /**
-     * Optional rc.6 compatibility binder provided by dsh-web-settings;
-     * absent when that group plugin is not installed, so callers fall back to
-     * the official settings scope.
-     */
-    webUiSettings?: { bind<S>(spec: SettingsScopeSpec<S>): SettingsScope<S> }
-  }
-}
+/** The one field this plugin's own Config schema declares (its entry identity on the shared settings surface). */
+const TERMINAL_FONT_FIELD = 'terminalFontFamily' satisfies keyof SshClientSettings
 
 declare module '@deepseek-ai/dsh-client-ui-slots' {
   interface LocaleNamespaceMap {
@@ -60,7 +55,7 @@ declare module '@deepseek-ai/dsh-client-ui-slots' {
 }
 
 /** Required services (fiber inject waiting — the runtime must be up first). */
-export const inject = ['slots', 'locale', 'settingsScope']
+export const inject = ['slots', 'locale', 'configForms']
 
 /** Type-only surface (export discipline: no value exports beyond the plugin contract). */
 export type { PanelControllerSnapshot } from './panel/controller.ts'
@@ -97,18 +92,19 @@ export function apply(ctx: ClientContext): void {
 
   const controller = new PanelController()
   const api = new SshApi()
-  // Live terminal-font preference (issue #577): the settings namespace is
-  // edited by the host-registered GUI section; the panel re-applies changes
-  // to open terminals without a reconnect.
-  const binder = ctx.get('webUiSettings') ?? ctx.settingsScope
-  const scope = binder.bind<SshClientSettings>({ namespace: SETTINGS_NS })
+  // Live terminal-font preference (issue #577): the field lives in this
+  // plugin's own profile entry, whose settings page the Host generates from
+  // the plugin Config schema; the panel re-applies a change to open terminals
+  // without a reconnect.
+  const settings = bindSettingsReader<SshClientSettings>(ctx, SETTINGS_NS, TERMINAL_FONT_FIELD)
   const terminalFont: TerminalFontSource = {
     get: () => {
-      const snapshot = scope.getSnapshot()
+      const snapshot = settings.getSnapshot()
       return snapshot.status === 'ready' ? snapshot.value?.terminalFontFamily : undefined
     },
-    subscribe: (listener) => scope.subscribe(listener),
+    subscribe: (listener) => settings.subscribe(listener),
   }
+  ctx.effect(() => () => { settings.dispose() }, 'dsh-ssh: settings binding')
   const disposers: Array<() => void> = []
   try {
     disposers.push(mountSidebarEntry(controller, ctx.locale))

package/src/client/panel/panel.module.css

@@ -48,20 +48,27 @@ html[data-dsh-ssh-active]:not([data-dsh-taskboard-active]) [class*='centerCol']
 
 /* --- sidebar entry row ------------------------------------------------------- */
 
+/* Same geometry as the shell's own panel rows (SidebarRoot .panelRow): 2px
+   inset with a 12px radius, 8px content padding, 36px row, 14/22 type, and the
+   primary ink — so an injected row and an official row line up column for
+   column instead of each carrying its own box. */
 .entry {
   box-sizing: border-box;
   display: flex;
   align-items: center;
   gap: 8px;
-  width: 100%;
   min-height: 36px;
-  padding: 0 10px;
+  padding: 7px 8px;
+  margin: 0 2px;
   background: transparent;
   border: none;
-  border-radius: 8px;
-  color: var(--dsw-alias-label-secondary);
+  border-radius: 12px;
+  color: var(--dsw-alias-label-primary);
   cursor: pointer;
-  font-size: 13px;
+  font: inherit;
+  font-size: 14px;
+  line-height: 22px;
+  text-align: left;
   white-space: nowrap;
 }
 
@@ -76,19 +83,21 @@ html[data-dsh-ssh-active]:not([data-dsh-taskboard-active]) [class*='centerCol']
   font-weight: 600;
 }
 
+/* Icon box matches the shell's panel glyph exactly (16px), so the glyph column
+   and the label column land on the official rows' x positions. */
 .entryIcon {
   display: inline-flex;
   align-items: center;
   justify-content: center;
-  width: 24px;
-  height: 24px;
+  width: 16px;
+  height: 16px;
   flex: none;
 }
 
 .entryIcon svg {
   display: block;
-  width: 18px;
-  height: 18px;
+  width: 16px;
+  height: 16px;
 }
 
 .entryLabel {
@@ -96,7 +105,9 @@ html[data-dsh-ssh-active]:not([data-dsh-taskboard-active]) [class*='centerCol']
   text-overflow: ellipsis;
 }
 
-/* Collapsed rail: icon-only, centered, matching the shell's 56px rail. */
+/* Collapsed rail: icon-only, centered, matching the shell's 56px rail. The
+   shell asks its own panel rows for an 18px glyph on the rail, so the icon box
+   and the svg step up together with the 12px rail radius. */
 :global([data-dsh-frame][data-sidebar-collapsed]) .entry,
 :global([data-sidebar-collapsed]) .entry {
   justify-content: center;
@@ -104,7 +115,15 @@ html[data-dsh-ssh-active]:not([data-dsh-taskboard-active]) [class*='centerCol']
   width: 36px;
   min-height: 36px;
   margin: 0 auto 12px;
-  border-radius: 50%;
+  border-radius: 12px;
+}
+
+:global([data-dsh-frame][data-sidebar-collapsed]) .entryIcon,
+:global([data-sidebar-collapsed]) .entryIcon,
+:global([data-dsh-frame][data-sidebar-collapsed]) .entryIcon svg,
+:global([data-sidebar-collapsed]) .entryIcon svg {
+  width: 18px;
+  height: 18px;
 }
 
 :global([data-dsh-frame][data-sidebar-collapsed]) .entryLabel,