@linxin666/dsh-ssh 0.4.2 → 0.4.3

package/src/client/panel/panel.module.css

@@ -1,139 +1,19 @@
 /**
  * dsh-ssh panel styles. Scoped by the plugin's own data attributes so nothing
  * leaks into the rest of the GUI; colors ride the dsh --dsw-* tokens so the
- * panel follows the active theme (light/dark and skins). The center-column
- * hide rules are attribute-scoped and must stay in this stylesheet (it is
- * imported by mount.tsx, so the styles load with the plugin).
+ * panel follows the active theme (light/dark and skins).
+ *
+ * The panel is a native main-slot page: the shell renders it only while this
+ * panel is selected, so this file carries no visibility rule and no rule over
+ * the conversation column, and the sidebar row is the shell's own panel row,
+ * so there is no injected entry row to style either.
  */
 
-/* --- center-column takeover (global rules, attribute-scoped) ----------------- */
-
-[data-pane='conversation'],
-[class*='centerCol'] {
-  position: relative;
-}
-
-/* The panel container rides inside the conversation grid item as an extra
-   trailing child; hidden unless the panel is active. */
-[data-dsh-ssh-view] {
-  position: absolute;
-  inset: 0;
-  display: none;
-  /* Above the conversation composer (z-index 7 in the 0.1.0-rc.6 shell) so the
-     panel and its modals paint over the input card, mirroring the task board
-     (issue #87). */
-  z-index: 60;
-  /* Opaque backdrop: the conversation subtree stays mounted under the panel.
-     Even if the hide rule below were defeated by a stronger host inline
-     style, this background keeps sticky code-block banners (host z-index 6)
-     from showing through the active panel (issue #100). */
-  background: var(--dsw-alias-bg-base);
-}
-
-/* The center column is single-occupant; the :not() guards keep the two
-   sibling panels (task board / ssh) from fighting over visibility if both
-   activation attributes ever coexist. */
-html[data-dsh-ssh-active]:not([data-dsh-taskboard-active]) [data-dsh-ssh-view] {
-  display: block;
-}
-
-/* While the panel is active, the conversation content underneath is hidden
-   (it stays mounted and stateful). The rule targets both the pane attribute
-   and the center-column class so the chat subtree (including the code-block
-   copy banner, issue #100) stays hidden whichever host container carries it. */
-html[data-dsh-ssh-active]:not([data-dsh-taskboard-active]) [data-pane='conversation'] > :not([data-dsh-ssh-view]),
-html[data-dsh-ssh-active]:not([data-dsh-taskboard-active]) [class*='centerCol'] > :not([data-dsh-ssh-view]) {
-  display: none !important;
-}
-
-/* --- sidebar entry row ------------------------------------------------------- */
-
-/* Same geometry as the shell's own panel rows (SidebarRoot .panelRow): 2px
-   inset with a 12px radius, 8px content padding, 36px row, 14/22 type, and the
-   primary ink — so an injected row and an official row line up column for
-   column instead of each carrying its own box. */
-.entry {
-  box-sizing: border-box;
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  min-height: 36px;
-  padding: 7px 8px;
-  margin: 0 2px;
-  background: transparent;
-  border: none;
-  border-radius: 12px;
-  color: var(--dsw-alias-label-primary);
-  cursor: pointer;
-  font: inherit;
-  font-size: 14px;
-  line-height: 22px;
-  text-align: left;
-  white-space: nowrap;
-}
-
-.entry:hover {
-  background: var(--dsw-alias-interactive-bg-hover);
-  color: var(--dsw-alias-label-primary);
-}
-
-.entry[data-active] {
-  background: var(--dsw-alias-interactive-bg-active);
-  color: var(--dsw-alias-label-primary);
-  font-weight: 600;
-}
-
-/* Icon box matches the shell's panel glyph exactly (16px), so the glyph column
-   and the label column land on the official rows' x positions. */
-.entryIcon {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 16px;
-  height: 16px;
-  flex: none;
-}
-
-.entryIcon svg {
-  display: block;
-  width: 16px;
-  height: 16px;
-}
-
-.entryLabel {
-  overflow: hidden;
-  text-overflow: ellipsis;
-}
-
-/* Collapsed rail: icon-only, centered, matching the shell's 56px rail. The
-   shell asks its own panel rows for an 18px glyph on the rail, so the icon box
-   and the svg step up together with the 12px rail radius. */
-:global([data-dsh-frame][data-sidebar-collapsed]) .entry,
-:global([data-sidebar-collapsed]) .entry {
-  justify-content: center;
-  padding: 0;
-  width: 36px;
-  min-height: 36px;
-  margin: 0 auto 12px;
-  border-radius: 12px;
-}
-
-:global([data-dsh-frame][data-sidebar-collapsed]) .entryIcon,
-:global([data-sidebar-collapsed]) .entryIcon,
-:global([data-dsh-frame][data-sidebar-collapsed]) .entryIcon svg,
-:global([data-sidebar-collapsed]) .entryIcon svg {
-  width: 18px;
-  height: 18px;
-}
-
-:global([data-dsh-frame][data-sidebar-collapsed]) .entryLabel,
-:global([data-sidebar-collapsed]) .entryLabel {
-  display: none;
-}
-
 /* --- panel frame -------------------------------------------------------------- */
 
 .view {
+  height: 100%;
+  min-height: 0;
   overflow: hidden;
 }
 

package/src/engine/terminal-sessions.ts

@@ -0,0 +1,280 @@
+/**
+ * Host-side terminal sessions for the web terminal.
+ *
+ * The PTY shell is owned here, not by the browser view: a view can detach
+ * (panel switch, page unmount, a dropped socket) and reattach by session id
+ * without tearing the remote shell down, which is what makes the terminal
+ * survival property the old DOM takeover used to provide. A session with no
+ * attached socket is reaped after an idle window, and an exited one is kept
+ * for a short grace window so a reattaching view still sees the final screen.
+ */
+import { randomBytes } from 'node:crypto'
+import { WebSocket } from 'ws'
+import type { KeyboardInteractiveHandler } from './connection-pool.ts'
+import type { ShellSession } from './pty.ts'
+import type { TerminalServerFrame } from '../protocol.ts'
+
+/** Pause the shell when an attached socket's send buffer exceeds this… */
+const BACKPRESSURE_HIGH_WATER = 1024 * 1024
+
+/** …and resume once every attached socket drains below this. */
+const BACKPRESSURE_LOW_WATER = 512 * 1024
+
+/** Scrollback retained for a reattaching view (bytes of UTF-8 output). */
+const DEFAULT_MAX_BUFFER_BYTES = 256 * 1024
+
+/** A detached session is reaped after this long. */
+const DEFAULT_IDLE_MS = 10 * 60 * 1000
+
+/** An exited session is kept this long for a reattaching view. */
+const DEFAULT_EXIT_GRACE_MS = 60 * 1000
+
+/** One live terminal session and the sockets currently watching it. */
+interface HostedTerminal {
+  id: string
+  alias: string
+  shell?: ShellSession
+  sockets: Set<WebSocket>
+  /** Bounded scrollback replayed to an attaching socket. */
+  buffer: string[]
+  bufferBytes: number
+  exited: boolean
+  exit?: { code: number | null; error?: string }
+  /** Pending keyboard-interactive challenge, whoever attached when it arrived. */
+  pendingAuthFinish?: (responses: string[]) => void
+  reapTimer?: ReturnType<typeof setTimeout>
+}
+
+/** What the registry needs from the engine (swappable in tests). */
+export interface TerminalSessionDeps {
+  /** Open one PTY shell for the alias (engine.openShell). */
+  openShell(alias: string, size: { cols: number; rows: number }, onKeyboardInteractive?: KeyboardInteractiveHandler): Promise<ShellSession>
+  /** @returns the current time (defaults to Date.now). */
+  now?: () => number
+  /** Bounded scrollback per session. */
+  maxBufferBytes?: number
+  /** Idle window before a detached session is reaped. */
+  idleMs?: number
+  /** Grace window an exited session is kept for reattaching views. */
+  exitGraceMs?: number
+}
+
+/**
+ * The host's terminal session table: open one session per connect, attach any
+ * number of sockets, and keep the shell alive across detach.
+ */
+export class TerminalSessionRegistry {
+  private readonly sessions = new Map<string, HostedTerminal>()
+  private readonly deps: TerminalSessionDeps
+  private readonly maxBufferBytes: number
+  private readonly idleMs: number
+  private readonly exitGraceMs: number
+
+  constructor(deps: TerminalSessionDeps) {
+    this.deps = deps
+    this.maxBufferBytes = deps.maxBufferBytes ?? DEFAULT_MAX_BUFFER_BYTES
+    this.idleMs = deps.idleMs ?? DEFAULT_IDLE_MS
+    this.exitGraceMs = deps.exitGraceMs ?? DEFAULT_EXIT_GRACE_MS
+  }
+
+  /** Open a new session for the alias and attach the requesting socket to it. */
+  async open(ws: WebSocket, alias: string, size: { cols: number; rows: number }): Promise<void> {
+    const session: HostedTerminal = {
+      id: randomBytes(9).toString('hex'),
+      alias,
+      sockets: new Set(),
+      buffer: [],
+      bufferBytes: 0,
+      exited: false,
+    }
+    this.sessions.set(session.id, session)
+    this.bind(ws, session)
+    try {
+      const shell = await this.deps.openShell(alias, size, this.keyboardInteractive(session))
+      if (!this.sessions.has(session.id)) {
+        // The session was ended (or the host torn down) while it connected.
+        shell.close()
+        return
+      }
+      session.shell = shell
+      shell.onData = data => { this.pushOutput(session, data.toString('utf8')) }
+      shell.onExit = (code, error) => { this.finish(session, code, error) }
+      this.send(session, { type: 'ready', alias, sessionId: session.id })
+    } catch (error) {
+      this.sessions.delete(session.id)
+      this.send(session, { type: 'exit', code: null, error: error instanceof Error ? error.message : String(error) })
+    }
+  }
+
+  /**
+   * Attach a socket to an existing session, replaying its scrollback first.
+   * @returns false when the session is unknown (expired or already reaped).
+   */
+  attach(ws: WebSocket, sessionId: string, size: { cols: number; rows: number }): boolean {
+    const session = this.sessions.get(sessionId)
+    if (session === undefined) return false
+    this.bind(ws, session)
+    this.clearReap(session)
+    for (const chunk of session.buffer) this.sendTo(session, ws, { type: 'output', data: chunk })
+    this.sendTo(session, ws, { type: 'ready', alias: session.alias, sessionId: session.id })
+    if (session.exited) {
+      this.sendTo(session, ws, { type: 'exit', code: session.exit?.code ?? null, error: session.exit?.error })
+      // Re-arm the grace window: this socket now holds the exited session open.
+      this.scheduleReap(session, this.exitGraceMs)
+    } else {
+      session.shell?.resize(Math.max(2, size.cols), Math.max(1, size.rows))
+      session.shell?.resume()
+    }
+    return true
+  }
+
+  /** End every session (host teardown, plugin dispose). */
+  dispose(): void {
+    for (const session of [...this.sessions.values()]) this.end(session, false)
+    this.sessions.clear()
+  }
+
+  /** Number of live sessions (introspection for tests and diagnostics). */
+  size(): number {
+    return this.sessions.size
+  }
+
+  /** Wire one socket's frames and lifecycle onto a session. */
+  private bind(ws: WebSocket, session: HostedTerminal): void {
+    session.sockets.add(ws)
+    ws.on('message', (data) => {
+      let frame: { type?: string; data?: string; cols?: number; rows?: number; responses?: string[] }
+      try {
+        frame = JSON.parse(String(data)) as typeof frame
+      } catch {
+        return
+      }
+      if (frame.type === 'input') {
+        session.shell?.send(frame.data ?? '')
+      } else if (frame.type === 'resize') {
+        session.shell?.resize(Math.max(2, frame.cols ?? 80), Math.max(1, frame.rows ?? 24))
+      } else if (frame.type === 'auth_response') {
+        const finish = session.pendingAuthFinish
+        session.pendingAuthFinish = undefined
+        try { finish?.(frame.responses ?? []) } catch { /* the connect already failed */ }
+      } else if (frame.type === 'close') {
+        this.end(session, true)
+      } else if (frame.type === 'detach') {
+        this.detach(ws)
+      }
+    })
+    ws.on('close', () => { this.detach(ws) })
+    ws.on('error', () => { this.detach(ws) })
+  }
+
+  /** Remove a socket from its session, keeping the shell alive. */
+  private detach(ws: WebSocket): void {
+    for (const session of this.sessions.values()) {
+      if (!session.sockets.delete(ws)) continue
+      if (session.sockets.size === 0) {
+        // Nobody is watching: give the view a window to come back before the
+        // remote shell is torn down (or, for an exited one, before its final
+        // screen is dropped).
+        this.scheduleReap(session, session.exited ? this.exitGraceMs : this.idleMs)
+      }
+      return
+    }
+  }
+
+  /** End the session a socket is attached to (explicit close from the view). */
+  private end(session: HostedTerminal, notify: boolean): void {
+    this.clearReap(session)
+    if (this.sessions.delete(session.id) && notify) {
+      if (session.pendingAuthFinish !== undefined) {
+        const finish = session.pendingAuthFinish
+        session.pendingAuthFinish = undefined
+        try { finish([]) } catch { /* the connect already failed */ }
+      }
+    }
+    try { session.shell?.close() } catch { /* channel gone */ }
+  }
+
+  /** Mark a session exited and keep it briefly so a reattaching view sees it. */
+  private finish(session: HostedTerminal, code: number | null, error?: string): void {
+    if (session.exited) return
+    session.exited = true
+    session.exit = { code, error }
+    this.send(session, { type: 'exit', code, error })
+    // The view has its exit frame; close the sockets so neither the browser
+    // nor the host holds a dead transport open. The session record itself
+    // survives the grace window, so a reattach still replays the final screen.
+    for (const ws of [...session.sockets]) {
+      session.sockets.delete(ws)
+      try { ws.close(1000) } catch { /* already closed */ }
+    }
+    this.scheduleReap(session, this.exitGraceMs)
+  }
+
+  /** Append output to the replay buffer, trimmed to the byte cap. */
+  private pushOutput(session: HostedTerminal, data: string): void {
+    session.buffer.push(data)
+    session.bufferBytes += Buffer.byteLength(data)
+    while (session.bufferBytes > this.maxBufferBytes && session.buffer.length > 1) {
+      const dropped = session.buffer.shift()
+      session.bufferBytes -= Buffer.byteLength(dropped ?? '')
+    }
+    this.send(session, { type: 'output', data })
+  }
+
+  /** Broadcast one frame to every attached socket, honoring backpressure. */
+  private send(session: HostedTerminal, frame: TerminalServerFrame): void {
+    for (const ws of session.sockets) this.sendTo(session, ws, frame)
+    this.applyBackpressure(session)
+  }
+
+  private sendTo(session: HostedTerminal, ws: WebSocket, frame: TerminalServerFrame): void {
+    if (ws.readyState !== WebSocket.OPEN) return
+    try { ws.send(JSON.stringify(frame)) } catch { /* socket raced away */ }
+  }
+
+  /** Pause while any attached socket is backed up; resume once all drained. */
+  private applyBackpressure(session: HostedTerminal): void {
+    const shell = session.shell
+    if (shell === undefined) return
+    let high = false
+    let low = true
+    for (const ws of session.sockets) {
+      if (ws.bufferedAmount > BACKPRESSURE_HIGH_WATER) high = true
+      if (ws.bufferedAmount > BACKPRESSURE_LOW_WATER) low = false
+    }
+    if (high) shell.pause()
+    else if (low) shell.resume()
+  }
+
+  /** Answer a keyboard-interactive challenge through whoever is attached. */
+  private keyboardInteractive(session: HostedTerminal): KeyboardInteractiveHandler {
+    return (name, instructions, _lang, prompts, finish) => {
+      session.pendingAuthFinish = finish
+      this.send(session, {
+        type: 'auth_prompt',
+        name,
+        instructions,
+        prompts: prompts.map(p => ({ prompt: p.prompt, echo: p.echo })),
+      })
+    }
+  }
+
+  private scheduleReap(session: HostedTerminal, delayMs: number): void {
+    this.clearReap(session)
+    const timer = setTimeout(() => {
+      session.reapTimer = undefined
+      if (session.sockets.size > 0) return
+      this.end(session, false)
+    }, delayMs)
+    // Never hold the host process open for an idle terminal.
+    ;(timer as { unref?: () => void }).unref?.()
+    session.reapTimer = timer
+  }
+
+  private clearReap(session: HostedTerminal): void {
+    if (session.reapTimer !== undefined) {
+      clearTimeout(session.reapTimer)
+      session.reapTimer = undefined
+    }
+  }
+}

package/src/index.ts

@@ -151,7 +151,7 @@ function applyImpl(ctx: Context, config?: ResolvedConfig): void {
   }
 
   // The /api/dsh-ssh route family + terminal upgrade.
-  const { routes, upgrade } = makeRoutes({ store, engine })
+  const { routes, upgrade, terminalSessions } = makeRoutes({ store, engine })
   let disposeRoutes: (() => void) | undefined
 
   // Agent tools + their prompt sections.
@@ -200,6 +200,9 @@ function applyImpl(ctx: Context, config?: ResolvedConfig): void {
         return () => {
           for (const dispose of disposers) dispose()
           upgradeDisposer()
+          // Dropping the routes also ends the terminal sessions they served:
+          // a live shell must not outlive the surface that can reach it.
+          terminalSessions.dispose()
         }
       },
       'dsh-ssh: routes',

package/src/mount-once.ts

@@ -5,44 +5,138 @@
  * the loader accepts a standalone install of the same package side by side;
  * without this guard the second instance would still re-register the same
  * webserver routes, tools, settings namespaces, and system-prompt sections
- * and fail the boot. mountOnce makes the second host apply a no-op for the
- * lifetime of the first instance (the browser half is already deduped by
- * package name in the client module host).
+ * and fail the boot. mountOnce makes a mount of an already-mounted package a
+ * no-op for as long as the first instance lives (the browser half is already
+ * deduped by package name in the client module host).
+ *
+ * A no-op is only safe while the holder is ALIVE. The holder can be disposed
+ * long after the refused mount ran its course: the Host reloads a profile by
+ * creating the new loader entries before the old ones are torn down (a
+ * plugin-manager enable/disable/install write, a settings-driven row reload,
+ * HMR), so the new aggregate shell entry mounts its family plugin while the
+ * previous entry still owns the name. Dropping that refused mount lost the
+ * plugin for good - the previous entry then disposed its own mount, releasing
+ * the name with nobody left to take it, and the family row stayed listed as
+ * active while its host routes 404ed (the task-board panel showed
+ * "board.hostError.notMounted", no degraded record appeared, and only a Host
+ * restart recovered it).
+ *
+ * The refused mount is therefore QUEUED, not dropped, and replayed the moment
+ * the holder releases the name - if the waiting fiber is still alive then. The
+ * single-instance guarantee is unchanged: exactly one mount is live per
+ * package name, and the replay re-enters the guard so a later mount still
+ * dedupes against it.
  *
  * The registry rides a global symbol so two module instances of the same
- * package (npm copy vs repository link) still share one verdict. cordis
- * `ctx.effect` runs its callback immediately and treats the callback's
+ * package (npm copy vs repository link) still share one verdict. That symbol
+ * is a CROSS-REPOSITORY contract, not this file's private state: the four
+ * satellite packages (dsh-skins / dsh-pet / dsh-presets /
+ * dsh-community-plugins) are separate repositories carrying their own copy of
+ * this guard, rebuilt on their own schedule, so the value under `MOUNTED`
+ * must keep the shape every published copy reads (a `Set` of package names
+ * with `has`/`add`/`delete`). The wait queues this guard added therefore live
+ * under their own additive key, and the registry reads back a `Set` even when
+ * some other build left a different value there. Changing `MOUNTED`'s shape
+ * in place broke that contract once: a satellite's legacy copy created a
+ * `Set`, the family's new copy read it as a `Map`, and every family row
+ * mounted after it failed with "claims.get is not a function".
+ *
+ * cordis `ctx.effect` runs its callback immediately and treats the callback's
  * return value as the fiber disposer, so the unmarker is returned, not run.
  */
 
+/** Published cross-repository contract: package names currently mounted. */
 const MOUNTED = Symbol.for('dsh-web.mounted-plugins')
 
+/** Additive key this guard owns: refused mounts waiting for the name. */
+const WAITERS = Symbol.for('dsh-web.mounted-plugins.waiters')
+
+/** The slice of a cordis context this guard touches. */
+interface MountContext {
+  effect?: (effect: () => unknown) => unknown
+}
+
+/** One mount that was refused while another fiber owned the package name. */
+interface PendingMount {
+  /** Replay the refused mount; a no-op once its own fiber has been disposed. */
+  run(): void
+}
+
 interface MountRegistry {
-  [MOUNTED]?: Set<string>
+  [MOUNTED]?: unknown
+  [WAITERS]?: Map<string, PendingMount[]>
 }
 
+/**
+ * The shared name registry, always a `Set` whatever another build stored here:
+ * a foreign value (an interim shape, a hand-written global) must not take every
+ * family plugin down with it.
+ * @returns the process-wide set of mounted package names.
+ */
 function mountedSet(): Set<string> {
   const registry = globalThis as MountRegistry
-  return (registry[MOUNTED] ??= new Set())
+  const existing = registry[MOUNTED]
+  if (existing instanceof Set) return existing as Set<string>
+  const created = new Set<string>()
+  registry[MOUNTED] = created
+  return created
+}
+
+/** Queue per package name for mounts refused while a holder was alive. */
+function mountWaiters(): Map<string, PendingMount[]> {
+  const registry = globalThis as MountRegistry
+  return (registry[WAITERS] ??= new Map())
 }
 
 /**
  * Wrap a cordis plugin apply so the package runs at most once per process.
- * The first mount registers normally and unmarks when its fiber disposes;
- * any later mount of the same package name is a no-op.
+ * The first mount registers normally and releases the name when its fiber
+ * disposes; a mount refused while that name is held waits for the release and
+ * then runs, unless its own fiber disposes first.
  * @param packageName - npm package identity shared by every install source.
  * @param fn - the original plugin apply.
  * @returns an apply of the same shape.
  */
 export function mountOnce<T extends (...args: any[]) => unknown>(packageName: string, fn: T): T {
-  return ((...args: unknown[]) => {
+  const mount = (...args: unknown[]): unknown => {
     const mounted = mountedSet()
-    if (mounted.has(packageName)) return
+    const ctx = args[0] as MountContext | undefined
+    if (mounted.has(packageName)) {
+      // Another fiber (the aggregate row, a standalone install, or a copy built
+      // from an older revision of this guard) owns the name. Queue instead of
+      // dropping: dropping lost the plugin for the rest of the process when the
+      // holder was disposed by a reload.
+      const waiters = mountWaiters()
+      const queue = waiters.get(packageName) ?? []
+      let alive = true
+      const pending: PendingMount = {
+        run: () => {
+          if (alive) mount(...args)
+        },
+      }
+      // A fiber that dies while it waits must not be replayed afterwards: its
+      // context is disposed and registering effects on it would throw.
+      ctx?.effect?.(() => () => {
+        alive = false
+        const index = queue.indexOf(pending)
+        if (index >= 0) queue.splice(index, 1)
+      })
+      queue.push(pending)
+      waiters.set(packageName, queue)
+      return
+    }
     mounted.add(packageName)
-    const ctx = args[0] as { effect?: (effect: () => unknown) => unknown } | undefined
     ctx?.effect?.(() => () => {
       mounted.delete(packageName)
+      const waiters = mountWaiters()
+      const queue = waiters.get(packageName)
+      if (queue === undefined) return
+      waiters.delete(packageName)
+      // Defer the handover one microtask so the disposing mount's own effects
+      // (routes, ledger, timers) are torn down before the next one registers.
+      for (const waiter of queue.splice(0)) queueMicrotask(() => { waiter.run() })
     })
     return fn(...args)
-  }) as T
+  }
+  return mount as T
 }

package/src/protocol.ts

@@ -188,7 +188,8 @@ export interface ApiErrorBody {
 
 /** WebSocket terminal protocol frames (host -> client and client -> host). */
 export type TerminalServerFrame =
-  | { type: 'ready'; alias: string }
+  /** The shell is up; `sessionId` reattaches to it after a view detach. */
+  | { type: 'ready'; alias: string; sessionId: string }
   | { type: 'output'; data: string }
   | { type: 'exit'; code: number | null; error?: string }
   | {
@@ -202,6 +203,10 @@ export type TerminalClientFrame =
   | { type: 'input'; data: string }
   | { type: 'resize'; cols: number; rows: number }
   | { type: 'auth_response'; responses: string[] }
+  /** Leave the socket while the host keeps the shell alive for a reattach. */
+  | { type: 'detach' }
+  /** End the session outright (the view's disconnect control). */
+  | { type: 'close' }
 
 /** Route paths the client calls (shared literals). */
 export const SSH_API_BASE = '/api/dsh-ssh' as const