@tiphareth/dsh-hardssh 0.1.2-alpha → 0.2.2

package/src/client/ssh/api.ts

@@ -3,6 +3,7 @@
  * access path the panel components use — plain fetch/WebSocket, same origin.
  */
 
+import { HttpApiError, buildQuery, readJson, throwHttpError, type HttpErrorBody } from '../../client-http.ts'
 import {
   SSH_API,
   type ClusterResult,
@@ -14,7 +15,6 @@ import {
   type RemoteDirEntry,
   type SshHostSummary,
   type TerminalClientFrame,
-  type TerminalServerFrame,
   type TestResult,
   type TransferProgress,
   type TransferStreamLine,
@@ -24,49 +24,44 @@ import {
 /** Minimal File System Access API surface (not in all lib.dom versions). */
 interface WindowWithFileSystemAccess {
   showSaveFilePicker?: (options: { suggestedName?: string }) => Promise<{
-    createWritable: () => Promise<{ write: (data: Uint8Array) => Promise<void>; close: () => Promise<void> }>
+    createWritable: () => Promise<{
+      write: (data: Uint8Array) => Promise<void>
+      close: () => Promise<void>
+      /** Discard the browser-managed temporary file instead of publishing it. */
+      abort?: (reason?: unknown) => Promise<void>
+    }>
   }>
 }
 
-/** Error carrying the route's JSON error message. */
-export class SshApiError extends Error {
-  /** Stable machine code from the route error body (HOST_KEY_*, HOST_IN_USE, …). */
-  readonly code: string | undefined
-  readonly hostKeyFingerprint: string | undefined
-  constructor(message: string, code?: string, hostKeyFingerprint?: string) {
-    super(message)
-    this.name = 'SshApiError'
-    this.code = code
-    this.hostKeyFingerprint = hostKeyFingerprint
-  }
-}
+/**
+ * This family's error name for the ONE shared transport error
+ * (`HttpApiError`): same class at runtime, so it carries the HTTP status and
+ * the parsed body (code / secret / hostKeyFingerprint / hostKeyMismatch /
+ * remaining / retryAfterMs) and existing `instanceof SshApiError` checks keep
+ * working. Parsing lives in ./client-http.ts — never re-implemented here.
+ */
+export { HttpApiError as SshApiError }
 
-/** Parse a JSON response or throw an SshApiError. */
-async function readJson<T>(response: Response): Promise<T> {
-  let body: unknown
-  try {
-    body = await response.json()
-  } catch {
-    throw new SshApiError(`HTTP ${response.status}: invalid JSON response`)
-  }
-  if (!response.ok) {
-    const record = typeof body === 'object' && body !== null ? body as Record<string, unknown> : {}
-    const message = typeof record.error === 'string' ? record.error : `HTTP ${response.status}`
-    const code = typeof record.code === 'string' ? record.code : undefined
-    const hostKeyFingerprint = typeof record.hostKeyFingerprint === 'string' ? record.hostKeyFingerprint : undefined
-    throw new SshApiError(message, code, hostKeyFingerprint)
-  }
-  return body as T
-}
+/** Query-string helper (shared transport helper, no local copy). */
+const query = buildQuery
 
-/** Query-string helper. */
-function query(params: Record<string, string | number | undefined>): string {
-  const search = new URLSearchParams()
-  for (const [key, value] of Object.entries(params)) {
-    if (value !== undefined && value !== '') search.set(key, String(value))
+/**
+ * Structured fields of one streamed (`application/x-ndjson`) failure frame.
+ * The upload route currently sends only `error`, so the interactive-gate
+ * fields are picked up when present and simply absent otherwise — the same
+ * shape the JSON routes produce, so callers handle one error type.
+ */
+function frameFailure(frame: TransferStreamLine): HttpErrorBody {
+  const record = frame as TransferStreamLine & Partial<HttpErrorBody>
+  const secret = record.secret
+  return {
+    ...(typeof record.error === 'string' ? { error: record.error } : {}),
+    ...(typeof record.code === 'string' ? { code: record.code } : {}),
+    ...(secret === 'password' || secret === 'passphrase' ? { secret } : {}),
+    ...(typeof record.hostKeyFingerprint === 'string' ? { hostKeyFingerprint: record.hostKeyFingerprint } : {}),
+    ...(typeof record.remaining === 'number' ? { remaining: record.remaining } : {}),
+    ...(typeof record.retryAfterMs === 'number' ? { retryAfterMs: record.retryAfterMs } : {}),
   }
-  const text = search.toString()
-  return text === '' ? '' : '?' + text
 }
 
 /** One open terminal connection (WebSocket JSON frames). */
@@ -221,45 +216,80 @@ export class SshApi {
     alias: string,
     remotePath: string,
     onProgress?: (progress: TransferProgress) => void,
+    signal?: AbortSignal,
   ): Promise<{ transferredBytes: number }> {
     const response = await fetch(SSH_API.upload + query({ alias, remotePath }), {
       method: 'POST',
       body: file,
+      signal,
     })
-    if (!response.ok || response.body === null) {
-      throw new SshApiError(`upload failed: HTTP ${response.status}`)
-    }
+    // Errors here are JSON too (the route maps them through errorBody), so the
+    // shared transport parses them instead of flattening the body to a string.
+    if (!response.ok) await throwHttpError(response, 'upload failed')
+    if (response.body === null) throw new HttpApiError('upload failed: the response carried no body stream', response.status)
     const reader = response.body.getReader()
     const decoder = new TextDecoder()
     let buffer = ''
-    let finalError: string | undefined
+    let failure: HttpErrorBody | undefined
     let sawResult = false
+    let commitStarted = false
+    let readerDone = false
     let transferredBytes = 0
-    for (;;) {
-      const { done, value } = await reader.read()
-      if (done) break
-      buffer += decoder.decode(value, { stream: true })
-      const lines = buffer.split('\n')
-      buffer = lines.pop() ?? ''
-      for (const line of lines) {
-        if (line.trim() === '') continue
-        let parsed: TransferStreamLine
-        try {
-          parsed = JSON.parse(line) as TransferStreamLine
-        } catch {
-          continue
+    try {
+      for (;;) {
+        const { done, value } = await reader.read()
+        if (done) {
+          readerDone = true
+          break
         }
-        if (parsed.type === 'progress') {
-          onProgress?.(parsed.progress)
-        } else if (parsed.type === 'result') {
-          sawResult = true
-          if (parsed.ok) transferredBytes = parsed.transferredBytes ?? 0
-          finalError = parsed.ok ? undefined : parsed.error ?? 'upload failed'
+        buffer += decoder.decode(value, { stream: true })
+        const lines = buffer.split('\n')
+        buffer = lines.pop() ?? ''
+        for (const line of lines) {
+          if (line.trim() === '') continue
+          let parsed: TransferStreamLine
+          try {
+            parsed = JSON.parse(line) as TransferStreamLine
+          } catch {
+            continue
+          }
+          if (parsed.type === 'progress') {
+            onProgress?.(parsed.progress)
+          } else if (parsed.type === 'commit') {
+            commitStarted = true
+          } else if (parsed.type === 'result') {
+            sawResult = true
+            if (parsed.ok) transferredBytes = parsed.transferredBytes ?? 0
+            else failure = frameFailure(parsed)
+          }
         }
       }
+    } catch (error) {
+      if (commitStarted) {
+        throw new HttpApiError(
+          'upload connection closed after commit began; the remote result is unknown',
+          response.status,
+          { code: 'RESULT_UNKNOWN' },
+        )
+      }
+      throw error
+    } finally {
+      if (!readerDone) await reader.cancel().catch(() => undefined)
+    }
+    // A failed transfer is a typed transport error too: the interactive gates
+    // (NEEDS_PASSWORD / HOST_KEY_*) must be able to prompt from this path.
+    if (failure !== undefined) {
+      throw new HttpApiError(typeof failure.error === 'string' ? failure.error : 'upload failed', response.status, failure)
+    }
+    if (!sawResult) {
+      throw new HttpApiError(
+        commitStarted
+          ? 'upload connection closed after commit began; the remote result is unknown'
+          : 'upload ended without a result frame — the remote destination was not published',
+        response.status,
+        commitStarted ? { code: 'RESULT_UNKNOWN' } : { code: 'ABORTED' },
+      )
     }
-    if (finalError !== undefined) throw new SshApiError(finalError)
-    if (!sawResult) throw new SshApiError('upload ended without a result frame — the transfer did not complete')
     return { transferredBytes }
   }
 
@@ -272,12 +302,14 @@ export class SshApi {
     alias: string,
     remotePath: string,
     onProgress?: (progress: TransferProgress) => void,
+    signal?: AbortSignal,
   ): Promise<{ blob?: Blob; filename: string; streamed: boolean; bytes: number }> {
-    const response = await fetch(SSH_API.download + query({ alias, remotePath }))
-    if (!response.ok || response.body === null) {
-      const text = await response.text().catch(() => '')
-      throw new SshApiError(text !== '' && text.startsWith('{') ? text : `download failed: HTTP ${response.status}`)
-    }
+    const response = await fetch(SSH_API.download + query({ alias, remotePath }), { signal })
+    // The success path is a raw byte stream, but the error path is the same
+    // JSON body as every other route — the shared transport parses it, so the
+    // caller keeps code/status instead of a flattened JSON string.
+    if (!response.ok) await throwHttpError(response, 'download failed')
+    if (response.body === null) throw new HttpApiError('download failed: the response carried no body stream', response.status)
     const total = Number(response.headers.get('content-length') ?? '0')
     const disposition = response.headers.get('content-disposition') ?? ''
     const match = /filename="([^"]+)"/.exec(disposition)
@@ -287,9 +319,15 @@ export class SshApi {
       ? (window as WindowWithFileSystemAccess).showSaveFilePicker
       : undefined
     let streamed = false
-    let writable: { write: (data: Uint8Array) => Promise<void>; close: () => Promise<void> } | undefined
+    let writable: {
+      write: (data: Uint8Array) => Promise<void>
+      close: () => Promise<void>
+      abort?: (reason?: unknown) => Promise<void>
+    } | undefined
     const chunks: Uint8Array<ArrayBuffer>[] = []
     let received = 0
+    let readerDone = false
+    let writableClosed = false
     const progress = (): void => {
       onProgress?.({
         phase: 'transferring',
@@ -300,32 +338,52 @@ export class SshApi {
       })
     }
     try {
-      if (picker !== undefined) {
-        const handle = await picker.call(window, { suggestedName: filename })
-        writable = await handle.createWritable()
-        streamed = true
+      try {
+        if (picker !== undefined) {
+          const handle = await picker.call(window, { suggestedName: filename })
+          signal?.throwIfAborted()
+          writable = await handle.createWritable()
+          streamed = true
+        }
+      } catch (error) {
+        // A user-cancelled picker falls back to Blob. An operation abort must
+        // not continue into memory or later trigger a browser save.
+        if (signal?.aborted === true) throw error
       }
-    } catch {
-      // User cancelled the save dialog or the API is unavailable: fall back.
-    }
-    for (;;) {
-      const { done, value } = await reader.read()
-      if (done) break
+      for (;;) {
+        signal?.throwIfAborted()
+        const { done, value } = await reader.read()
+        if (done) {
+          readerDone = true
+          break
+        }
+        if (writable !== undefined) {
+          await writable.write(value as Uint8Array)
+        } else {
+          chunks.push(value as Uint8Array<ArrayBuffer>)
+        }
+        received += value.length
+        progress()
+      }
+      signal?.throwIfAborted()
       if (writable !== undefined) {
-        await writable.write(value as Uint8Array)
-      } else {
-        chunks.push(value as Uint8Array<ArrayBuffer>)
+        await writable.close()
+        writableClosed = true
       }
-      received += value.length
-      progress()
-    }
-    if (writable !== undefined) await writable.close()
-    onProgress?.({ phase: 'done', file: remotePath, transferred: received, total: received > 0 ? received : total, percent: 100 })
-    return {
-      blob: streamed ? undefined : new Blob(chunks),
-      filename,
-      streamed,
-      bytes: received,
+      onProgress?.({ phase: 'done', file: remotePath, transferred: received, total: received > 0 ? received : total, percent: 100 })
+      return {
+        blob: streamed ? undefined : new Blob(chunks),
+        filename,
+        streamed,
+        bytes: received,
+      }
+    } catch (error) {
+      chunks.length = 0
+      if (!readerDone) await reader.cancel(error).catch(() => undefined)
+      if (writable !== undefined && !writableClosed) {
+        await writable.abort?.(error).catch(() => undefined)
+      }
+      throw error
     }
   }
 
@@ -335,37 +393,116 @@ export class SshApi {
     const scheme = window.location.protocol === 'https:' ? 'wss' : 'ws'
     const url = scheme + '://' + window.location.host + SSH_API.terminal + query({ alias, cols, rows })
     const socket = new WebSocket(url)
+    const MAX_PENDING_INPUT = 64 * 1024
+    let ready = false
+    let finalized = false
+    let queuedInput = ''
+    let queuedResize: { cols: number; rows: number } | undefined
+    let readyListener: (() => void) | undefined
+    let readyDelivered = false
+    let outputListener: ((data: string) => void) | undefined
+    let exitListener: ((code: number | null, error?: string) => void) | undefined
+    let exitRecord: { code: number | null; error?: string } | undefined
+    let exitDelivered = false
+    const deliverReady = (): void => {
+      if (!ready || readyDelivered || readyListener === undefined) return
+      readyDelivered = true
+      readyListener()
+    }
+    const deliverExit = (): void => {
+      if (exitRecord === undefined || exitDelivered || exitListener === undefined) return
+      exitDelivered = true
+      exitListener(exitRecord.code, exitRecord.error)
+    }
+    const finalize = (code: number | null, error?: string): void => {
+      if (finalized) return
+      finalized = true
+      queuedInput = ''
+      queuedResize = undefined
+      exitRecord = error === undefined ? { code } : { code, error }
+      deliverExit()
+    }
+    const sendFrame = (frame: TerminalClientFrame): void => {
+      if (finalized || !ready || socket.readyState !== WebSocket.OPEN) return
+      socket.send(JSON.stringify(frame))
+    }
     const connection: TerminalConnection = {
-      onReady: undefined,
-      onOutput: undefined,
-      onExit: undefined,
+      get onReady() { return readyListener },
+      set onReady(listener) {
+        readyListener = listener
+        deliverReady()
+      },
+      get onOutput() { return outputListener },
+      set onOutput(listener) { outputListener = listener },
+      get onExit() { return exitListener },
+      set onExit(listener) {
+        exitListener = listener
+        deliverExit()
+      },
       send: (data) => {
-        if (socket.readyState === WebSocket.OPEN) {
-          socket.send(JSON.stringify({ type: 'input', data } satisfies TerminalClientFrame))
+        if (finalized) return
+        if (!ready || socket.readyState !== WebSocket.OPEN) {
+          if (queuedInput.length + data.length > MAX_PENDING_INPUT) {
+            finalize(null, 'terminal input buffer exceeded before ready')
+            try { socket.close(1008, 'terminal input buffer exceeded') } catch { /* already closed */ }
+            return
+          }
+          queuedInput += data
+          return
         }
+        sendFrame({ type: 'input', data })
       },
-      resize: (cols, rows) => {
-        if (socket.readyState === WebSocket.OPEN) {
-          socket.send(JSON.stringify({ type: 'resize', cols, rows } satisfies TerminalClientFrame))
+      resize: (nextCols, nextRows) => {
+        if (finalized) return
+        const frame = { type: 'resize', cols: nextCols, rows: nextRows } satisfies TerminalClientFrame
+        if (!ready || socket.readyState !== WebSocket.OPEN) {
+          // Resize is state, not a sequence: one latest value is the complete
+          // bounded buffer needed before the server reports shell readiness.
+          queuedResize = { cols: nextCols, rows: nextRows }
+          return
         }
+        sendFrame(frame)
       },
       close: () => {
         try { socket.close() } catch { /* already closed */ }
       },
     }
     socket.onmessage = (event: MessageEvent<string>) => {
-      let frame: TerminalServerFrame
       try {
-        frame = JSON.parse(event.data) as TerminalServerFrame
+        const value: unknown = JSON.parse(event.data)
+        if (typeof value !== 'object' || value === null || Array.isArray(value)) throw new Error('invalid terminal frame')
+        const frame = value as Record<string, unknown>
+        if (frame.type === 'ready' && typeof frame.alias === 'string') {
+          if (ready || finalized) return
+          ready = true
+          deliverReady()
+          if (queuedResize !== undefined) {
+            sendFrame({ type: 'resize', ...queuedResize })
+            queuedResize = undefined
+          }
+          if (queuedInput !== '') {
+            sendFrame({ type: 'input', data: queuedInput })
+            queuedInput = ''
+          }
+          return
+        }
+        if (frame.type === 'output' && typeof frame.data === 'string') {
+          outputListener?.(frame.data)
+          return
+        }
+        if (frame.type === 'exit' && (typeof frame.code === 'number' || frame.code === null) && (frame.error === undefined || typeof frame.error === 'string')) {
+          finalize(frame.code as number | null, frame.error as string | undefined)
+          try { socket.close(1000) } catch { /* already closed */ }
+          return
+        }
+        throw new Error('invalid terminal frame')
       } catch {
-        return
+        finalize(null, 'invalid terminal server frame')
+        try { socket.close(1008, 'invalid terminal server frame') } catch { /* already closed */ }
       }
-      if (frame.type === 'ready') connection.onReady?.()
-      else if (frame.type === 'output') connection.onOutput?.(frame.data)
-      else if (frame.type === 'exit') connection.onExit?.(frame.code, frame.error)
     }
-    socket.onclose = () => { connection.onExit?.(null, 'connection closed') }
-    socket.onerror = () => { connection.onExit?.(null, 'connection error') }
+    socket.onclose = () => { finalize(null, 'connection closed') }
+    socket.onerror = () => { finalize(null, 'connection error') }
     return connection
   }
 

package/src/client/ssh/apply.ts

@@ -1,21 +1,22 @@
 /**
  * SSH operations browser surfaces, hosted inside dsh-hardssh's client bundle
- * (migrated from the legacy dsh-ssh package): the 'dsh-ssh'
- * locale dictionaries, the sidebar entry row, and the SSH operations panel
- * in the center column. Mounted from src/client/index.ts alongside the
- * workspace surfaces; a DOM failure here degrades the SSH panel only, never
- * the GUI.
+ * (migrated from the legacy dsh-ssh package): the 'dsh-ssh' locale
+ * dictionaries and the SSH operations console mounted as a RIGHT-Sidebar page
+ * tab.
+ *
+ * Nothing here touches the DOM. The old build injected a sidebar row and a
+ * panel container by selector, which the 0.1.5 shell no longer renders — the
+ * surfaces are standard plugin extension points now (see ./ops-tab.tsx).
  */
 import type { ClientContext } from '@deepseek-ai/dsh-client-runtime/client'
 // Type-only: pulls the locale plugin's Context merge (ctx.locale).
 import type {} from '@deepseek-ai/dsh-client-locale/client'
 // Type-only: pulls the LocaleNamespaceMap merge table.
 import type {} from '@deepseek-ai/dsh-client-ui-slots'
-import { SshApi } from './api.ts'
+import type { SshApi } from './api.ts'
 import { en, zh } from './locales.ts'
-import { mountPanel } from './mount.tsx'
-import { PanelController } from './panel/controller.ts'
-import { mountSidebarEntry } from './sidebar-entry.ts'
+import { registerOperationsTab } from './ops-tab.tsx'
+import type { SessionSshTargetSource } from './session-target.ts'
 
 /** Locale namespace this capability owns (kept as 'dsh-ssh'). */
 export const NS = 'dsh-ssh'
@@ -28,23 +29,21 @@ declare module '@deepseek-ai/dsh-client-ui-slots' {
 }
 
 /**
- * Mount the SSH operations surfaces (sidebar entry + operations panel).
- * @param ctx - client root context (locale service).
+ * Mount the SSH operations surfaces (locale dictionaries + the right-Sidebar tab).
+ * @param ctx - client root context (locale service, slot registry, tab registry).
+ * @param api - shared SSH API client.
+ * @param target - selected Session's fixed SSH target, or null for local Sessions.
  */
-export function mountSshOperations(ctx: ClientContext): void {
-  ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dsh-ssh: dictionaries')
-
-  const controller = new PanelController()
-  const api = new SshApi()
-  const disposers: Array<() => void> = []
+export function mountSshOperations(
+  ctx: ClientContext,
+  api: SshApi,
+  target: SessionSshTargetSource,
+): void {
   try {
-    disposers.push(mountSidebarEntry(controller))
-    disposers.push(mountPanel(controller, api))
+    registerOperationsTab(ctx, api, target)
   } catch (error) {
-    // DOM failures degrade the panel, never the GUI.
-    console.warn('[dsh-ssh] mount failed:', error)
+    // A wiring failure degrades the SSH operations tab only, never the GUI.
+    console.warn('[dsh-ssh] operations tab registration failed:', error)
   }
-  ctx.effect(() => () => {
-    for (const dispose of disposers.splice(0)) dispose()
-  }, 'dsh-ssh: ui mounts')
+  ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dsh-ssh: dictionaries')
 }

package/src/client/ssh/locales.ts

@@ -11,6 +11,13 @@ export const zh = {
   'tab.transfer': '传输',
   'tab.tunnels': '隧道',
   'tab.cluster': '集群',
+  'session.server': '当前服务器',
+  'session.target': '跟随当前会话：{alias} · {remoteRoot}',
+  'session.localTitle': '当前会话位于本地工作区',
+  'session.localUnavailable': 'SSH 操作台仅适用于 SSH 工作区会话。请切换到远程会话后使用。',
+  'connectionError.title': '无法连接服务器 {alias}',
+  'connectionError.intro': 'SSH 连接未建立，请检查服务器地址、网络和认证配置。',
+  'connectionError.close': '知道了',
   // hosts
   'hosts.empty': '尚未配置主机。点击「新增主机」添加，或从 ~/.ssh/config 导入。',
   'hosts.add': '新增主机',
@@ -68,7 +75,7 @@ export const zh = {
   'terminal.selectHost': '选择主机',
   'terminal.connect': '连接',
   'terminal.disconnect': '断开',
-  'terminal.placeholder': '选择主机后点击「连接」打开远程终端。',
+  'terminal.placeholder': '点击「连接」打开当前会话服务器的远程终端。',
   'terminal.connecting': '正在连接…',
   'terminal.ready': '终端已连接（{alias}）',
   'terminal.exited': '终端已退出（{alias}）',
@@ -168,6 +175,13 @@ export const en: Record<keyof typeof zh, string> = {
   'tab.transfer': 'Transfer',
   'tab.tunnels': 'Tunnels',
   'tab.cluster': 'Cluster',
+  'session.server': 'Current server',
+  'session.target': 'Following current session: {alias} · {remoteRoot}',
+  'session.localTitle': 'This session uses a local workspace',
+  'session.localUnavailable': 'The SSH console is available only for SSH workspace sessions. Switch to a remote session to use it.',
+  'connectionError.title': 'Unable to connect to {alias}',
+  'connectionError.intro': 'The SSH connection was not established. Check the server address, network, and authentication settings.',
+  'connectionError.close': 'OK',
   'hosts.empty': 'No hosts configured. Click "Add host" or import from ~/.ssh/config.',
   'hosts.add': 'Add host',
   'hosts.import': 'Import ~/.ssh/config',
@@ -222,7 +236,7 @@ export const en: Record<keyof typeof zh, string> = {
   'terminal.selectHost': 'Select host',
   'terminal.connect': 'Connect',
   'terminal.disconnect': 'Disconnect',
-  'terminal.placeholder': 'Select a host and click "Connect" to open the remote terminal.',
+  'terminal.placeholder': 'Click "Connect" to open a terminal on the current session server.',
   'terminal.connecting': 'Connecting…',
   'terminal.ready': 'Terminal connected ({alias})',
   'terminal.exited': 'Terminal exited ({alias})',

package/src/client/ssh/ops-tab.tsx

@@ -0,0 +1,79 @@
+/**
+ * The SSH operations surface as a RIGHT-Sidebar page tab.
+ *
+ * Registration follows the same public two-stage path any shipped tab type
+ * uses:
+ * 1. `ctx.sidebarRightTabs.register(...)` declares the type — its `id` is the
+ *    key its body and chip title register under, its `kind` is what
+ *    `ctx.sidebarRight.openTab(kind)` names.
+ * 2. the body goes into the keyed `sidebar.right.pane.tab` seat, the chip title
+ *    into `sidebar.right.pane.tab.title`, both under that `id`.
+ *
+ * It is a PAGE type (no `patterns`): it recognizes no resource address, so it is
+ * opened by kind from the right sidebar's own add control or from its guide
+ * entry — the plugin never forces the column open.
+ *
+ * The left sidebar's workspace manager is a separate, GLOBAL surface; host
+ * CRUD lives there, so this console keeps only the per-session operations:
+ * terminal, transfer, tunnels, cluster.
+ */
+import type { ClientContext } from '@deepseek-ai/dsh-client-runtime/client'
+// Type-only: pulls the SidebarRightTabDefinition type and the `sidebar.right.*`
+// SlotMap augmentations.
+import type {} from '@deepseek-ai/dsh-client-ui-sidebar-right/client'
+// Type-only: pulls the LocaleNamespaceMap augmentation.
+import type {} from '@deepseek-ai/dsh-client-ui-slots'
+import { tt } from '../text.ts'
+import { SshPanel } from './panel/SshPanel.tsx'
+import type { SshApi } from './api.ts'
+import type { SessionSshTargetSource } from './session-target.ts'
+
+/** This implementation's identity in the tab system; also the body/title key. */
+export const OPS_TAB_ID = '@tiphareth/dsh-hardssh/operations'
+
+/** The page kind `ctx.sidebarRight.openTab(kind)` names. */
+export const OPS_TAB_KIND = 'hardssh-operations'
+
+/**
+ * Register the regression type, its body, and its chip title.
+ * @param ctx - client root context carrying the tab registry and slot registry.
+ * @param api - the SSH API client the panel's tabs operate through.
+ * @param target - live target inherited from the selected Session.
+ */
+export function registerOperationsTab(
+  ctx: ClientContext,
+  api: SshApi,
+  target: SessionSshTargetSource,
+): void {
+  ctx.effect(() => ctx.sidebarRightTabs.register({
+    id: OPS_TAB_ID,
+    kind: OPS_TAB_KIND,
+    // The chip's initial text is captured into the layout record at open time;
+    // a thunk keeps it following the active language without re-registering.
+    title: () => tt('ops.tab'),
+    // An entry box on the right sidebar's empty-state guide, so the surface is
+    // discoverable without a plugin-owned button.
+    guide: [{
+      order: 100,
+      title: () => tt('ops.tab'),
+      description: () => tt('ops.guide'),
+    }],
+  }), 'dsh-hardssh: operations tab type')
+
+  // The body: receives every tab of this kind, in every pane, docked or floating.
+  ctx.slots.inject('sidebar.right.pane.tab', () => ctx.slots.register(
+    { name: 'sidebar.right.pane.tab', key: OPS_TAB_ID, inject: () => ({ api, target }) },
+    SshPanel,
+  ))
+
+  // The chip title in the strip and a floating panel's header.
+  ctx.slots.inject('sidebar.right.pane.tab.title', () => ctx.slots.register(
+    { name: 'sidebar.right.pane.tab.title', key: OPS_TAB_ID },
+    OpsTabTitle,
+  ))
+}
+
+/** The tab chip and floating-panel header text. */
+function OpsTabTitle(): string {
+  return tt('ops.tab')
+}