@linxin666/dsh-ssh 0.4.4 → 0.4.5

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   node scripts/verify-docs.mjs --write <dir>
-README.md: e477f468d33c808362bab0fd246dc6eb2bfefb62
-README.zh.md: d37b585d6e6a18f1a9bb22e8d9e223fb39b91076
+README.md: bd5c0cb0afa9dc65e65b1fdfb6ba5205b66019df
+README.zh.md: 84f564e99c5c7a42ae2a48fce5772b940d18ff3e

package/README.md

@@ -1,8 +1,21 @@
-# dsh-ssh — Remote SSH operations plugin for DSH
+# dsh-ssh · Web SSH Terminal, SFTP Transfer & Remote Operations for DeepSeek Harness (DSH)
 
 English | [中文](README.zh.md)
 
-Built on the capability list of [badseal/ssh-skill](https://github.com/badseal/ssh-skill), a remote SSH plugin tailored for DeepSeek Harness (DSH): a persistent connection pool inside the Host process + a Web GUI host-management panel + a Web terminal + Agent tools, all implemented through the official NPM SDK without modifying DSH source.
+<p align="center">
+  <img src="https://img.shields.io/npm/v/@linxin666/dsh-ssh?style=flat-square" alt="Version">
+  &nbsp;
+  <img src="https://img.shields.io/badge/DSH-%3E%3D0.2.0--rc.2-4c6ef5?style=flat-square&amp;labelColor=454a54" alt="DSH">
+  &nbsp;
+  <img src="https://img.shields.io/badge/license-Apache--2.0-blue?style=flat-square" alt="License">
+</p>
+
+<p align="center">
+  <strong>Remote Linux Server Operations & Web SSH Suite for DeepSeek Harness (DSH)</strong><br>
+  <em>xterm.js Web Terminal · Visual SFTP Transfer · Port Forwarding Tunnels · Cluster Execution · 6 Agent Tools</em>
+</p>
+
+A dedicated remote Linux server operations and cluster management plugin for DeepSeek Harness (DSH) Web GUI and official desktop client: in-process persistent connection pool, Web GUI host inventory management, xterm.js terminal, visual SFTP file transfer, port forwarding tunnels, and 6 dedicated agent tools implemented on top of official NPM SDKs without modifying DSH core source code.
 
 ## Capabilities
 

package/README.zh.md

@@ -1,8 +1,21 @@
-# dsh-ssh — 远程 SSH 运维插件（DSH 版 ssh-skill）
+# dsh-ssh · DeepSeek Harness (DSH) 网页版 SSH 终端、SFTP 文件传输与集群运维插件
 
 [English](README.md) | 中文
 
-基于 [badseal/ssh-skill](https://github.com/badseal/ssh-skill) 的能力清单，为 DeepSeek Harness（DSH）定制的远程 SSH 插件：Host 进程内的持久连接池 + Web GUI 主机管理面板 + Web 终端 + Agent 工具，全部通过官方 NPM SDK 实现，不修改 DSH 源码。
+<p align="center">
+  <img src="https://img.shields.io/npm/v/@linxin666/dsh-ssh?style=flat-square" alt="Version">
+  &nbsp;
+  <img src="https://img.shields.io/badge/DSH-%3E%3D0.2.0--rc.2-4c6ef5?style=flat-square&amp;labelColor=454a54" alt="DSH">
+  &nbsp;
+  <img src="https://img.shields.io/badge/license-Apache--2.0-blue?style=flat-square" alt="License">
+</p>
+
+<p align="center">
+  <strong>DeepSeek Harness（DSH）官方 Web GUI 与桌面客户端专属远程 Linux 服务器运维套件</strong><br>
+  <em>xterm.js Web 终端 · 可视化 SFTP 传输 · 本地端口转发隧道 · 集群并发命令 · 6 大 Agent 工具</em>
+</p>
+
+专为 DeepSeek Harness（DSH）Web GUI 与官方桌面客户端定制的远程 Linux 服务器运维与集群管理插件：Host 进程内的持久连接池 + Web GUI 主机管理面板 + 基于 xterm.js 的 Web 终端 + 可视化 SFTP 传输 + 6 大专用 Agent 工具，全部通过官方 NPM SDK 实现，零修改侵入 DSH 官方源码。
 
 ## 能力
 

package/lib/client.js

@@ -115,7 +115,7 @@ window.__ModuleLoader__.load({
 			"terminal.ready": "终端已连接（{alias}）",
 			"terminal.exited": "终端已退出（{alias}）",
 			"terminal.error": "终端错误：{error}",
-			"terminal.noWebSocket": "当前页面不支持 WebSocket（应用外壳只转发 HTTP），请改用浏览器打开的 Web 界面使用终端。",
+			"terminal.noWebSocket": "当前页面不支持 WebSocket（应用外壳没有可连接的本地主机地址），请改用浏览器打开的 Web 界面使用终端。",
 			"terminal.auth.title": "二次身份验证 (2FA / 交互式认证)",
 			"terminal.auth.submit": "提交验证码",
 			"terminal.auth.cancel": "取消",
@@ -271,7 +271,7 @@ window.__ModuleLoader__.load({
 			"terminal.ready": "Terminal connected ({alias})",
 			"terminal.exited": "Terminal exited ({alias})",
 			"terminal.error": "Terminal error: {error}",
-			"terminal.noWebSocket": "This page cannot carry a WebSocket (the application shell forwards HTTP only). Open the Web UI in a browser to use the terminal.",
+			"terminal.noWebSocket": "This page cannot carry a WebSocket (the application shell published no local host address to reach). Open the Web UI in a browser to use the terminal.",
 			"terminal.auth.title": "Two-Factor Authentication (2FA)",
 			"terminal.auth.submit": "Submit Code",
 			"terminal.auth.cancel": "Cancel",
@@ -453,23 +453,71 @@ window.__ModuleLoader__.load({
 		* The WebSocket URL the terminal route is reached at, or undefined when this
 		* page cannot carry one.
 		*
-		* A page delivered by an application on this machine (the official DSH
-		* Desktop shell serves its Web GUI from `dsh-app://app/`) has no WebSocket
-		* transport: its scheme handler forwards HTTP requests to the local host but
-		* cannot upgrade a socket, so `ws://app/...` never connects and the terminal
-		* reports "connection error" (issue #1744). Every other page is a web page and
-		* resolves the socket against its own origin, exactly as before.
+		* A web page resolves the socket against its own origin, exactly as before.
 		*
-		* A blank authority is treated the same as an application scheme: there is
-		* nothing to dial, and the caller gets the actionable reason instead of a
-		* socket that can only fail.
+		* A page delivered by an application on this machine (the official DSH Desktop
+		* shell serves its Web GUI from `dsh-app://app/`) cannot carry a socket on its
+		* own scheme: the protocol handler forwards HTTP to the local Host but has no
+		* upgrade to forward. That is exactly the case the official transport hook
+		* covers - the shell publishes `__DSH_TRANSPORT__.streamBaseUrl`, the loopback
+		* authority of the Host it owns and already forwards every other request to
+		* (issue #1744). The socket is therefore dialed there instead, with the `ws`/
+		* `wss` scheme derived from that base, which is what the shell's
+		* `onBeforeSendHeaders` hook expects to see before it attaches its
+		* authority-bound credential.
+		*
+		* The base is used only on an application-delivered page. A web page that
+		* somehow carries the hook (the remote channel grants `ownsHost` to a paired
+		* LAN page, and that page is fenced behind a pairing channel) keeps resolving
+		* against its own origin, so this cannot reroute gated traffic onto a host the
+		* page is not entitled to reach. A blank authority is treated the same as an
+		* application scheme with no base: there is nothing to dial, and the caller
+		* gets the actionable reason instead of a socket that can only fail.
 		*
 		* @param location - the page location to read.
 		* @param search - the query string carrying `alias` or `session`.
+		* @param streamBaseUrl - `__DSH_TRANSPORT__.streamBaseUrl`, when the shell published one.
 		* @returns the absolute `ws:`/`wss:` URL, or undefined when the page cannot carry one.
 		*/
-		function terminalSocketUrl(location, search) {
+		function terminalSocketUrl(location, search, streamBaseUrl) {
 			if (WEB_PAGE_PROTOCOLS.includes(location.protocol)) return (location.protocol === "https:" ? "wss" : "ws") + "://" + location.host + SSH_API.terminal + search;
+			const base = hostAuthorityOf(streamBaseUrl);
+			if (base === void 0) return void 0;
+			return (base.protocol === "https:" ? "wss" : "ws") + "://" + base.authority + SSH_API.terminal + search;
+		}
+		/**
+		* The authority and scheme of a shell-owned Host base, or undefined when the
+		* value is absent, unparsable, or not a network origin this Host can serve
+		* (an application scheme could only resolve back to the page that has no
+		* socket transport in the first place).
+		* @param base - the raw `streamBaseUrl` as published by the transport hook.
+		*/
+		function hostAuthorityOf(base) {
+			if (base === void 0 || base === "") return void 0;
+			let url;
+			try {
+				url = new URL(base);
+			} catch {
+				return;
+			}
+			if (url.protocol !== "http:" && url.protocol !== "https:") return void 0;
+			if (url.username !== "" || url.password !== "") return void 0;
+			if (url.host === "") return void 0;
+			return {
+				protocol: url.protocol,
+				authority: url.host
+			};
+		}
+		/**
+		* The shell-owned Host authority the page is told to reach, read from the
+		* official transport hook. The global is written by the shell before any boot
+		* entry runs, so it is absent on every page it does not own.
+		* @param globals - the global object to read (defaults to the real one).
+		* @returns the published base URL, or undefined when the page carries none.
+		*/
+		function transportStreamBaseUrl(globals = globalThis) {
+			const published = globals.__DSH_TRANSPORT__?.streamBaseUrl;
+			return typeof published === "string" ? published : void 0;
 		}
 		/**
 		* Schemes a network page can be delivered with. Every other scheme belongs to
@@ -733,7 +781,7 @@ window.__ModuleLoader__.load({
 			}
 			/** One terminal socket over either an alias (open) or a session id (attach). */
 			terminalSocket(search) {
-				const target = terminalSocketUrl(window.location, search);
+				const target = terminalSocketUrl(window.location, search, transportStreamBaseUrl());
 				if (target === void 0) return failedTerminal(tt("terminal.noWebSocket"));
 				let socket;
 				try {
@@ -16367,7 +16415,7 @@ window.__ModuleLoader__.load({
 		/** The building package's version, when the bundle carries it. */
 		function bakedVersion() {
 			try {
-				return "0.4.4";
+				return "0.4.5";
 			} catch {
 				return;
 			}