@tiphareth/dsh-hardssh 0.1.2-alpha

package/lib/types/ssh/plugin.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The SSH operations capability, now hosted inside dsh-hardssh (migrated
+ * from the legacy dsh-ssh package): host config store
+ * (~/.dsh/dsh-ssh.json), the shared ssh2 engine, /api/dsh-ssh routes, the
+ * six ssh_* agent tools, the `dsh-ssh` settings namespace, and the SSH
+ * system-prompt section.
+ *
+ * This module deliberately does NOT create or dispose the engine/store:
+ * ownership belongs to src/index.ts (one instance, one dispose point). It
+ * only mounts/unmounts surfaces against the shared instances.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+import type { SshEngine } from './engine.ts';
+/** Settings namespace of the SSH capability. Kept as 'dsh-ssh' so existing
+ *  user settings survive the package merge unchanged. */
+export declare const SSH_SETTINGS_NAMESPACE = "dsh-ssh";
+/** SSH-capability config, validated by the same-named schemastery schema. */
+export interface SshConfig {
+    /** When true (default), a system-prompt section announces the SSH capability. */
+    announceToAgent?: boolean;
+    /** Master switch for the SSH surfaces (routes, tools, prompt section). */
+    enabled?: boolean;
+    /**
+     * Secret storage mode:
+     * - 'none' (default): passwords/passphrases are NEVER persisted; each
+     *   session's first connection prompts for them (VSCode Remote-SSH style)
+     *   and they live in memory (session password table) for the connection
+     *   pool lifetime (idle 30 min auto-disconnect; new terminals reuse it).
+     * - 'vault': store secrets encrypted at rest (AES-256-GCM) under a master
+     *   password / DSH_CREDENTIAL_PASSWORD; for headless agents that must run
+     *   password hosts unattended.
+     */
+    secretStorage?: 'none' | 'vault';
+}
+export declare const SshConfig: z<SshConfig>;
+/** Model-facing announcement: SSH operations capability, capabilities, limits. */
+export declare const SSH_GUIDANCE = "\u672C\u673A\u5DF2\u5B89\u88C5 dsh-hardssh \u63D2\u4EF6\uFF08\u5185\u5EFA DSH \u8FDC\u7A0B SSH \u8FD0\u7EF4\uFF09\uFF1A\u4FA7\u8FB9\u680F\u300CSSH\u300D\u5165\u53E3\uFF1BSSH \u8FD0\u7EF4\u4E0E SSH \u5DE5\u4F5C\u533A\u5728 dsh-hardssh \u4E2D\u7EDF\u4E00\u7EF4\u62A4\u3002\u80FD\u529B\uFF1A\u4E3B\u673A\u914D\u7F6E\u5B58 ~/.dsh/dsh-ssh.json\uFF08\u53EF\u4ECE ~/.ssh/config \u5BFC\u5165\uFF09\uFF1B\u6301\u4E45\u8FDE\u63A5\u6C60\u590D\u7528\u957F\u8FDE\u63A5\uFF08\u7A7A\u95F2 30 \u5206\u949F\u81EA\u52A8\u65AD\u5F00\uFF09\uFF1Bssh_list \u5217\u51FA\u4E3B\u673A\u3001ssh_exec \u6267\u884C\u8FDC\u7A0B\u547D\u4EE4\u3001ssh_upload/ssh_download \u4F20\u8F93\u6587\u4EF6\u3001ssh_tunnel \u672C\u5730\u7AEF\u53E3\u8F6C\u53D1\uFF08\u8BBF\u95EE\u8FDC\u7A0B\u6570\u636E\u5E93/\u5185\u7F51\u670D\u52A1\uFF09\u3001ssh_cluster \u96C6\u7FA4\u5E76\u53D1\u6267\u884C\uFF1B\u652F\u6301\u5BC6\u94A5/\u5BC6\u7801\u8BA4\u8BC1\u3001passphrase \u5BC6\u94A5\u4E0E ProxyJump \u8DF3\u677F\u673A\uFF1BWeb \u7EC8\u7AEF\u8D70 WebSocket\u3002\u9650\u5236\uFF1A\u4E3B\u673A\u64CD\u4F5C\u7531\u7528\u6237\u5728 GUI \u4E2D\u914D\u7F6E\u540E agent \u65B9\u53EF\u4F7F\u7528\uFF1B\u5BC6\u7801\u4EE5\u660E\u6587\u5B58\u5728\u7528\u6237\u4E3B\u76EE\u5F55\u79C1\u6709\u6587\u4EF6\uFF08\u6743\u9650 0600\uFF09\uFF1B\u547D\u4EE4\u8F93\u51FA\u539F\u6837\u8FD4\u56DE\u3001\u53EF\u80FD\u542B\u654F\u611F\u4FE1\u606F\uFF1B\u8FDE\u63A5\u5EFA\u7ACB\u5931\u8D25\u4F1A\u81EA\u52A8\u91CD\u8FDE\uFF0C\u4F46\u547D\u4EE4\u6216\u6587\u4EF6\u64CD\u4F5C\u4E00\u65E6\u63D0\u4EA4\u5C31\u4E0D\u4F1A\u81EA\u52A8\u91CD\u8BD5\u2014\u2014\u7ED3\u679C\u4E0D\u660E\u786E\u65F6\u5E94\u5148\u6838\u5B9E\u8FDC\u7AEF\u72B6\u6001\uFF0C\u518D\u51B3\u5B9A\u662F\u5426\u4EBA\u5DE5\u91CD\u8BD5\uFF1B\u4F20\u8F93/\u6267\u884C\u6D88\u8017\u771F\u5B9E\u8FDC\u7A0B\u8D44\u6E90\uFF0C\u5148\u786E\u8BA4\u518D\u64CD\u4F5C\u3002\u7528\u6237\u63D0\u5230\u300CSSH / \u8FDC\u7A0B\u670D\u52A1\u5668 / \u670D\u52A1\u5668\u64CD\u4F5C / \u8DF3\u677F\u673A / \u96A7\u9053 / \u90E8\u7F72 / \u4E0A\u4F20\u4E0B\u8F7D\u300D\u65F6\u5373\u6307\u672C\u63D2\u4EF6\uFF0C\u8BF7\u636E\u6B64\u534F\u4F5C\u3002";
+/** Shared instances the SSH surfaces run on. */
+export interface SshCapabilityDeps {
+    store: import('./store.ts').SecureHostStore;
+    engine: SshEngine;
+    /** Host-key TOFU trust store; absent → host-key verification disabled. */
+    knownHosts?: import('./known-hosts.ts').KnownHostsStore;
+    /** Credential vault; absent → vault endpoints disabled. */
+    vault?: import('./vault.ts').Vault;
+    /** SSH-bound workspace ledger (host-delete reference guard). */
+    ledger?: import('../ledger.ts').SshWorkspaceLedger;
+}
+/**
+ * Mount the SSH operations surfaces (routes, tools, settings, prompt) against
+ * the shared engine/store. Called from src/index.ts BEFORE the workspace
+ * `enabled` early-return, so the SSH capability stays independently togglable
+ * via its own `dsh-ssh` settings namespace.
+ */
+export declare function mountSshCapability(ctx: Context, deps: SshCapabilityDeps): void;
+//# sourceMappingURL=plugin.d.ts.map

package/lib/types/ssh/protocol.d.ts

@@ -0,0 +1,236 @@
+/**
+ * Wire contract between the host half (routes.ts) and the browser half
+ * (client/api.ts). Pure types only — imported by both halves, bundled into
+ * each, no runtime identity to share.
+ */
+/** Authentication flavors a host entry may carry. */
+export type SshAuthKind = 'key' | 'password';
+/** One stored host entry (the ~/.dsh/dsh-ssh.json store shape). */
+export interface SshHostEntry {
+    /** Stable, user-chosen identifier used by every operation. */
+    alias: string;
+    /** Hostname or IP of the target. */
+    host: string;
+    /** SSH port (default 22). */
+    port: number;
+    /** Login user. */
+    user: string;
+    /** Authentication. */
+    auth: {
+        kind: SshAuthKind;
+        /** Absolute path to the private key for 'key' auth. */
+        keyPath?: string;
+        /** Passphrase for an encrypted key. */
+        passphrase?: string;
+        /** Password for 'password' auth. */
+        password?: string;
+        /** Vault ref to the encrypted password/passphrase (v2 secure store). */
+        secretRef?: string;
+    };
+    /** Jump chain: local aliases connected through in order (ProxyJump). */
+    proxyJump: string[];
+    /** Free-form note. */
+    description?: string;
+    /** Deployment environment label (development / production / ...). */
+    environment?: string;
+    /** Free-form tags. */
+    tags: string[];
+    /** Physical location note. */
+    location?: string;
+    createdAt: number;
+    updatedAt: number;
+}
+/** Public (secret-free) projection of an entry, safe for the browser/agent. */
+export interface SshHostSummary {
+    alias: string;
+    host: string;
+    port: number;
+    user: string;
+    auth: SshAuthKind;
+    /** Whether the key path exists on the host machine (key auth only). */
+    keyReady: boolean;
+    proxyJump: string[];
+    description?: string;
+    environment?: string;
+    tags: string[];
+    location?: string;
+    createdAt: number;
+    updatedAt: number;
+}
+/** Result of one non-interactive command execution. */
+export interface ExecResult {
+    success: boolean;
+    /** Remote exit code, or null when the channel died without one. */
+    exitCode: number | null;
+    timedOut: boolean;
+    stdout: string;
+    stderr: string;
+    /** Wall-clock duration of the round trip in ms. */
+    durationMs: number;
+    /** Connection error message when the command never ran. */
+    error?: string;
+}
+/** One server entry in a cluster run. */
+export interface ClusterResult {
+    alias: string;
+    ok: boolean;
+    exitCode?: number | null;
+    timedOut?: boolean;
+    stdout?: string;
+    stderr?: string;
+    durationMs?: number;
+    error?: string;
+}
+/** SFTP transfer progress frame (upload stream). */
+export interface TransferProgress {
+    phase: 'connecting' | 'transferring' | 'done' | 'error';
+    file: string;
+    transferred: number;
+    total: number;
+    percent: number;
+    speedBps?: number;
+    error?: string;
+}
+/** One active local port-forward tunnel. */
+export interface TunnelInfo {
+    id: string;
+    alias: string;
+    localPort: number;
+    remoteHost: string;
+    remotePort: number;
+    state: 'forwarding' | 'connecting' | 'failed';
+    error?: string;
+    startedAt: number;
+}
+/** One directory listing entry (remote file browser). */
+export interface RemoteDirEntry {
+    name: string;
+    type: 'dir' | 'file' | 'other';
+    size: number;
+    mtimeMs: number;
+    mode?: number;
+}
+/** Test-connection outcome. */
+export interface TestResult {
+    ok: boolean;
+    latencyMs?: number;
+    error?: string;
+    /** Stable machine code for host-key routing (HOST_KEY_UNKNOWN / HOST_KEY_MISMATCH / NEEDS_PASSWORD). */
+    code?: string;
+    /** Which secret a connection needs when code === 'NEEDS_PASSWORD'. */
+    secret?: 'password' | 'passphrase';
+    /** The pending/expected fingerprint when a host key was refused. */
+    hostKeyFingerprint?: string;
+    /** Mismatch detail (expected vs actual) when the host key changed. */
+    hostKeyMismatch?: {
+        expected: string;
+        actual: string;
+    };
+}
+/** Host edit payload (create/update); 'alias' comes from the URL for updates. */
+export interface HostPayload {
+    alias?: string;
+    host: string;
+    port?: number;
+    user: string;
+    /**
+     * Authentication. Required on create; on update an omitted auth keeps the
+     * stored secrets (the browser never receives them back).
+     */
+    auth?: SshHostEntry['auth'];
+    proxyJump?: string[];
+    description?: string;
+    environment?: string;
+    tags?: string[];
+    location?: string;
+}
+/** Import outcome from ~/.ssh/config. */
+export interface ImportResult {
+    parsed: number;
+    added: number;
+    skipped: number;
+    /** Aliases that failed to map (wildcard patterns, missing HostName, ...). */
+    skippedNames: string[];
+}
+/** JSON error body used by every route. */
+export interface ApiErrorBody {
+    error: string;
+    /** Stable machine code (HOST_KEY_UNKNOWN / HOST_KEY_MISMATCH / HOST_IN_USE / ...). */
+    code?: string;
+    /** Which secret a connection needs when code === 'NEEDS_PASSWORD'. */
+    secret?: 'password' | 'passphrase';
+    /** The fingerprint when a host key was refused. */
+    hostKeyFingerprint?: string;
+    /** Mismatch detail (expected vs actual) when the host key changed. */
+    hostKeyMismatch?: {
+        expected: string;
+        actual: string;
+    };
+    /** Workspace titles referencing a host that cannot be deleted (HOST_IN_USE). */
+    workspaces?: Array<{
+        id: string;
+        title: string;
+    }>;
+}
+/** WebSocket terminal protocol frames (host -> client and client -> host). */
+export type TerminalServerFrame = {
+    type: 'ready';
+    alias: string;
+} | {
+    type: 'output';
+    data: string;
+} | {
+    type: 'exit';
+    code: number | null;
+    error?: string;
+};
+export type TerminalClientFrame = {
+    type: 'input';
+    data: string;
+} | {
+    type: 'resize';
+    cols: number;
+    rows: number;
+};
+/** Route paths the client calls (shared literals). */
+export declare const SSH_API_BASE: "/api/dsh-ssh";
+export declare const SSH_API: {
+    readonly hosts: string;
+    readonly importSshConfig: string;
+    readonly test: string;
+    readonly exec: string;
+    readonly cluster: string;
+    readonly upload: string;
+    readonly download: string;
+    readonly ls: string;
+    readonly tunnel: string;
+    readonly terminal: string;
+    readonly knownHosts: string;
+    readonly vault: string;
+    readonly sessionSecret: string;
+    readonly connections: string;
+};
+/** One known-host record as seen by the browser (no secrets). */
+export interface KnownHostView {
+    alias: string;
+    host: string;
+    port: number;
+    keyType: string;
+    fingerprint: string;
+    status: 'pending' | 'trusted';
+    firstSeenAt: number;
+    confirmedAt: number | null;
+}
+/** Host-key trust actions the browser can perform. */
+export type KnownHostAction = 'trust' | 'forget';
+/** NDJSON transfer stream line shapes (upload). */
+export type TransferStreamLine = {
+    type: 'progress';
+    progress: TransferProgress;
+} | {
+    type: 'result';
+    ok: boolean;
+    transferredBytes?: number;
+    error?: string;
+};
+//# sourceMappingURL=protocol.d.ts.map

package/lib/types/ssh/routes.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The /api/dsh-ssh route family: host CRUD, exec, cluster, SFTP transfer
+ * (NDJSON progress stream for uploads, binary stream for downloads), remote
+ * listing, tunnels, and the WebSocket PTY terminal upgrade. Every route
+ * carries a loopback-only trust fence (plus browser same-origin markers) —
+ * these endpoints execute commands on remote servers, so LAN-exposed dsh web
+ * deployments must not serve them.
+ */
+import type { WebRoute, WebUpgradeRoute } from '@deepseek-ai/dsh-host-webserver';
+import type { SshEngine } from './engine.ts';
+import { type KnownHostsStore } from './known-hosts.ts';
+/** Cap on declared upload bodies (staged to disk before SFTP). */
+export declare const DEFAULT_MAX_UPLOAD_BYTES: number;
+/** Route family dependencies. */
+export interface SshRoutesDeps {
+    /** The host store (CRUD; vault-backed for secrets). */
+    store: import('./store.ts').SecureHostStore;
+    /** The engine (ops). */
+    engine: SshEngine;
+    /** Host-key trust store (TOFU); absent → host-key verification disabled. */
+    knownHosts?: KnownHostsStore;
+    /** Credential vault (optional; enables /api/dsh-ssh/vault endpoints). */
+    vault?: import('./vault.ts').Vault;
+    /** SSH-bound workspace ledger (host-delete reference check). */
+    ledger?: import('../ledger.ts').SshWorkspaceLedger;
+    /** Temp dir for upload/download staging (tests inject a sandbox). */
+    stagingDir?: string;
+    /** Hard cap on ACTUAL upload bytes accepted (chunked requests included).
+     *  Defaults to 4 GiB; tests inject a small value. */
+    uploadLimitBytes?: number;
+    /** Called after a host PATCH/DELETE persisted, so derived caches (e.g. the
+     *  remote environment cache) can drop that alias. */
+    onHostInvalidated?: (alias: string) => void;
+}
+/**
+ * Build every /api/dsh-ssh route (exact paths) plus the terminal upgrade.
+ * @param deps - store, engine, staging dir.
+ * @returns routes and the upgrade route.
+ */
+export declare function makeRoutes(deps: SshRoutesDeps): {
+    routes: WebRoute[];
+    upgrade: WebUpgradeRoute;
+};
+//# sourceMappingURL=routes.d.ts.map

package/lib/types/ssh/store.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Host config store: one JSON file (`~/.dsh/dsh-ssh.json`) holding every
+ * SSH host entry, written atomically (tmp + rename). Also parses the user's
+ * standard `~/.ssh/config` for one-shot import. Secrets (passwords,
+ * passphrases) live in this user-owned file in plaintext — same trust model
+ * as ssh-skill's annotated ssh-config comments; document it, never log it.
+ */
+import type { HostPayload, ImportResult, SshAuthKind, SshHostEntry, SshHostSummary } from './protocol.ts';
+/** Store file location: <home>/.dsh/dsh-ssh.json. */
+export declare function storePath(): string;
+/** The user's standard OpenSSH config path. */
+export declare function sshConfigPath(): string;
+/** Payload shape the validator enforces: full create vs partial patch. */
+export type HostPayloadValidationMode = 'create' | 'patch';
+/** Validate the wire shape of a host payload; returns a message or undefined.
+ *  `mode` picks the required fields: 'create' demands host/user/auth,
+ *  'patch' only validates the fields that are present (same rules).
+ *  `allowSecretless` relaxes the password requirement so SecureHostStore can
+ *  persist stripped entries (secrets in vault / never persisted). */
+export declare function validateHostPayload(payload: unknown, mode?: HostPayloadValidationMode, allowSecretless?: boolean): string | undefined;
+/** Validate an alias for creation. */
+export declare function validateAlias(alias: string): string | undefined;
+/**
+ * The host store. Pure file I/O — no cordis dependency, unit-testable.
+ */
+export declare class HostStore {
+    /** The JSON file path. */
+    readonly path: string;
+    /** Optional override of the ~/.ssh/config path (tests). */
+    private readonly sshConfigOverride;
+    /**
+     * @param path - store file path (defaults to the standard location).
+     * @param sshConfigOverride - ssh config path override (tests only).
+     */
+    constructor(path?: string, sshConfigOverride?: string);
+    /** Load all entries (empty store when the file is absent). */
+    list(): SshHostEntry[];
+    /** Find one entry by alias. */
+    find(alias: string): SshHostEntry | undefined;
+    /** Secret-free projection for the browser and agent surfaces. */
+    summarize(entry: SshHostEntry): SshHostSummary;
+    /** Create one entry. Throws on alias collision or invalid payload. */
+    create(payload: HostPayload, allowSecretless?: boolean): SshHostEntry;
+    /** Update the fields present in `patch`; unknown aliases throw. */
+    update(alias: string, patch: Partial<HostPayload>, allowSecretless?: boolean): SshHostEntry;
+    /** Remove one entry. */
+    delete(alias: string): void;
+    /**
+     * Import hosts from `~/.ssh/config`: Host blocks with a single non-wildcard
+     * pattern and a HostName become entries (key auth via IdentityFile, jump
+     * hosts via ProxyJump). Existing aliases are skipped.
+     * @returns import statistics.
+     */
+    importFromSshConfig(): ImportResult;
+    private skippedNames;
+    private load;
+    private save;
+}
+/** Expand a leading `~` in a filesystem path. */
+export declare function expandHome(path: string): string;
+/** Resolved authentication for one connect (vault-aware). */
+export interface ResolvedAuth {
+    kind: SshAuthKind;
+    keyPath?: string;
+    password?: string;
+    passphrase?: string;
+}
+/**
+ * Secure host store: composes the plaintext HostStore (host/port/user/… +
+ * key paths — non-secrets) with the credential handling chosen by
+ * `secretStorage`:
+ *
+ * - **'vault'**: passwords/passphrases are stored encrypted in the
+ *   credential vault (AES-256-GCM); the hosts file keeps only a `secretRef`,
+ *   and resolveAuth reveals on demand. For headless agents running password
+ *   hosts unattended.
+ *
+ * - **'none' (default, VSCode Remote-SSH style)**: secrets are NEVER
+ *   persisted. create/update strip the password/passphrase from the entry
+ *   (kind + keyPath stay); the engine prompts once per session and holds the
+ *   credential in-memory (session password table). The plaintext HostStore
+ *   remains untouched, so existing v1 tests and dual-format reads keep
+ *   working.
+ */
+export declare class SecureHostStore {
+    private readonly vault;
+    private readonly mode;
+    private readonly inner;
+    constructor(vault: import('./vault.ts').Vault | undefined, path?: string, sshConfigOverride?: string, mode?: 'none' | 'vault');
+    list(): SshHostEntry[];
+    find(alias: string): SshHostEntry | undefined;
+    summarize(entry: SshHostEntry): SshHostSummary;
+    get path(): string;
+    /** Legacy ssh-config import (delegates; passwords imported stay inline —
+     *  a follow-up may route them through the vault). */
+    importFromSshConfig(): ImportResult;
+    /** Create: secrets are stashed per mode; entry only keeps kind (+ keyPath). */
+    create(payload: HostPayload): Promise<SshHostEntry>;
+    /** Update: auth present -> re-stash (or strip in none mode); absent → keep. */
+    update(alias: string, patch: Partial<HostPayload>): Promise<SshHostEntry>;
+    /** Delete: drop the host (and its vault secrets in vault mode, best-effort). */
+    delete(alias: string): Promise<void>;
+    /** Resolve the authentication for one entry (vault reveal when needed). */
+    resolveAuth(entry: SshHostEntry): Promise<ResolvedAuth>;
+    private stashSecrets;
+}
+//# sourceMappingURL=store.d.ts.map

package/lib/types/ssh/tools.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Agent tools: the DSH-native counterpart of ssh-skill's CLI. Every tool
+ * talks to the same engine the web UI uses, so a host configured in the GUI
+ * is immediately operable by any agent, and vice versa.
+ *
+ * Result contract (P1-20): every tool resolves to an envelope — `ok` is a
+ * required discriminator, business fields appear only on success, and a
+ * single `error` string carries failures. Business errors never reject;
+ * parameter and engine errors never masquerade as fake payloads. The output
+ * schema mirrors this: `ok` required, payload fields optional.
+ */
+import type { SshEngine } from './engine.ts';
+/**
+ * Uniform tool result: `{ ok: true, ...payload }` or `{ ok: false, error }`.
+ * Business fields only appear on success — no zero-value placeholders.
+ */
+export type ToolEnvelope<T extends object> = ({
+    ok: true;
+} & T) | {
+    ok: false;
+    error: string;
+};
+/** The host-list tool. */
+export declare function sshListTool(engine: SshEngine): import("@deepseek-ai/dsh-tools").ToolDefinition;
+/** The command-execution tool. */
+export declare function sshExecTool(engine: SshEngine): import("@deepseek-ai/dsh-tools").ToolDefinition;
+/** The upload tool. */
+export declare function sshUploadTool(engine: SshEngine): import("@deepseek-ai/dsh-tools").ToolDefinition;
+/** The download tool. */
+export declare function sshDownloadTool(engine: SshEngine): import("@deepseek-ai/dsh-tools").ToolDefinition;
+/** The tunnel tool. */
+export declare function sshTunnelTool(engine: SshEngine): import("@deepseek-ai/dsh-tools").ToolDefinition;
+/** The cluster tool. */
+export declare function sshClusterTool(engine: SshEngine): import("@deepseek-ai/dsh-tools").ToolDefinition;
+//# sourceMappingURL=tools.d.ts.map

package/lib/types/ssh/transfer/progress.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Shared transfer-progress tracker for fastPut/fastGet (P1-19): one
+ * throttle/speed/percent rule set so uploads and downloads cannot drift.
+ * Sends an initial 0-frame on creation, never throttles the final step,
+ * keeps the last known progress on failure, and always reports 100% on done.
+ */
+import type { TransferProgress } from '../protocol.ts';
+export interface TransferProgressTracker {
+    step(transferred: number, total: number): void;
+    done(): void;
+    fail(error: unknown): void;
+}
+export declare function createTransferProgressTracker(file: string, initialTotal: number, emit?: (progress: TransferProgress) => void, now?: () => number): TransferProgressTracker;
+//# sourceMappingURL=progress.d.ts.map

package/lib/types/ssh/vault.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Credential vault: secrets (SSH passwords, key passphrases) encrypted at
+ * rest with AES-256-GCM under a master key derived from a password via
+ * scrypt (Node built-in). Each entry uses an independent random nonce and
+ * binds its credential reference as GCM AAD; every ciphertext additionally
+ * carries a SHA3-256 digest for integrity self-checks. Brute-force lockout
+ * persists across restarts.
+ *
+ * The vault is deliberately dependency-free (node:crypto + fs only) and has
+ * no cordis coupling, matching the HostStore style. KDF parameters are stored
+ * in the file header so a later KDF upgrade never invalidates existing
+ * vaults (algorithm is a stable switch point).
+ *
+ * @module dsh-hardssh/vault
+ */
+/** Types of secrets the vault stores. */
+export type VaultPurpose = 'host.password' | 'host.passphrase';
+/** KDF parameters persisted in the file header. */
+export interface VaultKdfParams {
+    algorithm: 'scrypt';
+    N: number;
+    r: number;
+    p: number;
+    saltB64: string;
+}
+/** Vault status (no secrets exposed). */
+export interface VaultStatus {
+    locked: boolean;
+    mode: 'env' | 'password';
+    entries: number;
+}
+/** Default vault file location: <home>/.dsh/dsh-ssh-vault.json. */
+export declare function vaultPath(): string;
+/** SHA3-256 hex of a UTF-8 string. */
+export declare function sha3_256Hex(text: string): string;
+/** Errors raised by the vault. */
+export declare class VaultError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/** Unlocked-password or wrong-password errors. */
+export declare class VaultLockedError extends VaultError {
+    constructor(message?: string);
+}
+/** Wrong unlock password (with remaining attempts). */
+export declare class VaultAuthError extends VaultError {
+    readonly remaining: number;
+    constructor(message: string, remaining: number);
+}
+/** Locked out due to repeated failures. */
+export declare class VaultLockoutError extends VaultError {
+    readonly retryAfterMs: number;
+    constructor(message: string, retryAfterMs: number);
+}
+/** One revealed secret value, registered for output redaction. */
+export interface RevealedSecret {
+    ref: string;
+    value: string;
+}
+/**
+ * The credential vault. Plain file I/O + node:crypto; no cordis dependency.
+ * Construction never requires a password (status/describe work locked); the
+ * master key is derived on unlock and cached in memory for the session.
+ */
+export declare class Vault {
+    private readonly path;
+    private readonly passwordProvider;
+    private document;
+    private unlockedKey;
+    private lockTimer;
+    private readonly leaked;
+    constructor(filePath?: string, options?: {
+        /** Session password source (loopback unlock route passes a password). */
+        passwordProvider?: () => Promise<string | undefined>;
+        /** Vault idle auto-lock (ms); 0 disables (default 30 min). */
+        idleLockMs?: number;
+    });
+    private load;
+    private save;
+    private deriveKey;
+    private lockoutRetryAfter;
+    private checkLockout;
+    private verifyPassword;
+    private encryptEntryBuffer;
+    private decryptEntryBuffer;
+    private requireKey;
+    private tryEnvUnlock;
+    /** Current status (locked / mode / entry count) — safe for UIs. */
+    status(): VaultStatus;
+    /** Unlock with a password (loopback route / env). Persists lockout on failure. */
+    unlock(password: string): Promise<void>;
+    /** Lock: drop the in-memory key. JS strings cannot be zeroized; the Buffer
+     *  key is wiped. */
+    lock(): void;
+    /** Store one secret, returning a random ref. Requires unlock. */
+    store(purpose: VaultPurpose, alias: string, secret: string): Promise<string>;
+    /** Reveal one secret (unlock required); registers it for redaction. */
+    reveal(ref: string): Promise<string>;
+    /** Delete one secret (host delete / cleanup). */
+    remove(ref: string): Promise<void>;
+    /** Rekey with a new password: decrypt all, re-encrypt under a fresh KDF. */
+    rekey(newPassword: string): Promise<void>;
+    /** Redact every leaked secret value in `text` (Leak Guard light). */
+    redact(text: string): string;
+    /** Dispose: wipe the key and stop the idle timer. */
+    dispose(): void;
+}
+/** Constant-time helper (kept for completeness; GCM auth is the real gate). */
+export declare function secretsEqual(a: string, b: string): boolean;
+//# sourceMappingURL=vault.d.ts.map

package/lib/types/subprocess.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The `ctx.subprocess` switch row: provides the workspace-routing subprocess
+ * facade in the host scope. The local runtime is mounted in an isolated
+ * child scope; every SSH-bound workspace record gets its OWN remote runtime
+ * bound to that record's alias + remote root; the facade routes each spawn by
+ * its cwd. The facade auto-provides `subprocess` here because the plain
+ * subprocess row is disabled by the profile patch.
+ *
+ * Routing and per-record remote runtimes are owned by the SHARED seam state
+ * (hardsshCore.seams): the row binds its per-record runtime factory and reads
+ * the state on every spawn. The seam state re-applies the ledger snapshot
+ * synchronously on every commit, so creating or removing an SSH workspace
+ * takes effect without a plugin restart and the fs/subprocess seams can never
+ * disagree. Before the initial ledger load finishes, routing degrades to
+ * local with a one-time warning for anchor-root paths.
+ *
+ * @module dsh-hardssh/subprocess
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { HardsshCore } from './core.ts';
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        hardsshCore: HardsshCore;
+    }
+}
+/** Stable cordis plugin name. */
+export declare const name = "hardssh-subprocess";
+/** Services required: the shared workspace core (mode store + engine). */
+export declare const inject: string[];
+/** Mount the switching subprocess facade. */
+export declare function apply(ctx: Context): void;
+//# sourceMappingURL=subprocess.d.ts.map