@tiphareth/dsh-hardssh 0.1.2 → 0.2.2

package/src/client/ssh/sidebar-entry.ts

@@ -1,123 +0,0 @@
-/**
- * Sidebar entry injection.
- *
- * dsh's sidebar shell exposes no slot an external plugin can register into,
- * so — following the task-board precedent of DOM-level extension — the entry
- * row is injected between the shell's New Session button and the workspace
- * browser. The injection self-heals: a MutationObserver watches the sidebar
- * root and re-inserts the row whenever a React re-render displaces it
- * (re-insertion happens in the same frame, before paint, so no flicker).
- *
- * The row is plain DOM (no React tree) so it can never disturb the shell's
- * reconciliation; the panel view it toggles is a separate React root mounted
- * in the center column (see mount.tsx).
- */
-import type { PanelController } from './panel/controller.ts'
-import { tt } from './panel/helpers.ts'
-import css from './panel/panel.module.css'
-
-/** Stable data attribute identifying the injected entry row. */
-export const ENTRY_SELECTOR = '[data-dsh-ssh-entry]'
-
-/** The sidebar column is the grid item AppFrame renders with this pane marker. */
-const SIDEBAR_COLUMN_SELECTOR = '[data-pane="sidebar"]'
-
-/** Inline icon (matches the shell's 16px nav-icon look): a terminal prompt glyph. */
-const ICON = '<svg viewBox="0 0 16 16" width="14" height="14" fill="none" stroke="currentColor" stroke-width="1.3" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="2" y="2.5" width="12" height="11" rx="1.5"/><path d="M4.5 5.5l2.5 2.5-2.5 2.5"/><path d="M8.5 10.5h3"/></svg>'
-
-/** Find the sidebar shell root element, or undefined while not yet mounted. */
-function sidebarRoot(): HTMLElement | undefined {
-  const column = document.querySelector<HTMLElement>(SIDEBAR_COLUMN_SELECTOR)
-  const root = column?.firstElementChild as HTMLElement | undefined
-  return root ?? undefined
-}
-
-/** The New Session button: the shell's only direct-child button of the root. */
-function newSessionButton(root: HTMLElement): HTMLButtonElement | undefined {
-  for (const child of root.children) {
-    if (child.tagName === 'BUTTON') return child as HTMLButtonElement
-  }
-  return undefined
-}
-
-/** Build the entry row (a detached button; insert once the shell is up). */
-function createEntry(controller: PanelController): HTMLButtonElement {
-  const entry = document.createElement('button')
-  entry.type = 'button'
-  entry.dataset.dshSshEntry = ''
-  entry.className = css.entry
-  entry.setAttribute('aria-label', tt('entry.label'))
-  entry.setAttribute('title', tt('entry.tooltip'))
-  entry.innerHTML = '<span class="' + css.entryIcon + '">' + ICON + '</span><span class="' + css.entryLabel + '">' + tt('entry.label') + '</span>'
-  entry.addEventListener('click', () => { controller.toggle() })
-  return entry
-}
-
-/** Re-insert the entry after the New Session button (before the browser region). */
-function placeEntry(root: HTMLElement, entry: HTMLButtonElement): boolean {
-  const button = newSessionButton(root)
-  if (button === undefined) return false
-  if (entry.parentElement !== root) {
-    // Insert after the button: React never manages this node, and the shell
-    // keeps its own child order intact around it.
-    root.insertBefore(entry, button.nextElementSibling)
-  }
-  return true
-}
-
-/**
- * Mount the sidebar entry, waiting for the shell to render and self-healing
- * on later React re-renders.
- * @param controller - the panel controller the entry toggles.
- * @returns disposer removing the entry and its observers.
- */
-export function mountSidebarEntry(controller: PanelController): () => void {
-  const entry = createEntry(controller)
-  let root: HTMLElement | undefined
-  let placed = false
-
-  const tryPlace = (): void => {
-    if (placed) return
-    if (root !== undefined && !root.isConnected) {
-      // The shell re-created the sidebar pane; re-query from scratch.
-      rootObserver.disconnect()
-      root = undefined
-    }
-    root ??= sidebarRoot()
-    if (root === undefined) return
-    placed = placeEntry(root, entry)
-    if (placed) rootObserver.observe(root, { childList: true, subtree: true })
-  }
-
-  // The shell renders after boot settlement; watch for its arrival.
-  const waitObserver = new MutationObserver(() => { tryPlace() })
-  waitObserver.observe(document.body, { childList: true, subtree: true })
-
-  // Self-heal: if a React re-render displaces the row, re-insert it in the
-  // same frame (microtask before paint -> no visible flicker).
-  const rootObserver = new MutationObserver(() => {
-    if (root === undefined || !root.isConnected) {
-      placed = false
-      tryPlace()
-      return
-    }
-    if (!root.contains(entry)) {
-      placed = placeEntry(root, entry)
-    }
-  })
-
-  // Reflect the panel's open state on the row (active highlight).
-  const unsubscribe = controller.subscribe(() => {
-    entry.dataset.active = controller.getSnapshot().panelOpen ? 'true' : undefined
-  })
-  entry.dataset.active = controller.getSnapshot().panelOpen ? 'true' : undefined
-
-  tryPlace()
-
-  return () => {
-    waitObserver.disconnect()
-    rootObserver.disconnect()
-    unsubscribe()
-    entry.remove()
-  }
-}

package/src/client/workspace-gate.ts

@@ -1,225 +0,0 @@
-/**
- * Sidebar workspace-row click gate: when the operator clicks an SSH-bound
- * workspace row in the session sidebar, ensure the server connection can
- * actually be established BEFORE the shell proceeds with the native open —
- * otherwise the shell surfaces raw SSH errors (host key untrusted, session
- * password missing) and the workspace appears "dead" with no prompt.
- *
- * The gate runs the engine's /test probe (a real, lightweight connect):
- * - HOST_KEY_UNKNOWN / HOST_KEY_MISMATCH → the host fingerprint confirm
- *   dialog (HostFingerprintDialog; TOFU first encounter / key rotation);
- * - NEEDS_PASSWORD / NEEDS_PASSPHRASE → the VSCode-style session password
- *   dialog (SessionSecretDialog; never persisted, session-only);
- * - ok → mark the alias as gated (5-minute TTL — trust is durable and the
- *   session password survives in the engine table) and re-dispatch the click.
- *
- * Pure DOM-level extension following the workspace-badges precedent: the
- * sidebar shell exposes no row slot, so a MutationObserver self-heals when
- * React re-renders displace the injected listener. A capture-phase listener
- * on the row blocks the shell's click while a dialog is needed, then lets
- * clicks through once the alias has passed the gate.
- *
- * @module dsh-hardssh/client/workspace-gate
- */
-import { createElement, type ReactElement } from 'react'
-import { createRoot } from 'react-dom/client'
-import type { SshApi } from './ssh/api.ts'
-import { SshApiError } from './ssh/api.ts'
-import { HostFingerprintDialog } from './ssh/panel/HostFingerprintDialog.tsx'
-import { SessionSecretDialog } from './ssh/panel/SessionSecretDialog.tsx'
-import { tt } from './text.ts'
-
-const PROJECT_ROW_SELECTOR = '[class*="projectRow"]'
-const TITLE_SELECTOR = '[class*="title"]'
-/** A passed gate stays valid this long (trust is durable; the session
- *  password table lives in the host process for the session). */
-const GATE_TTL_MS = 5 * 60 * 1000
-/** Cap on interactive retry rounds (wrong password loops etc.). */
-const MAX_ATTEMPTS = 3
-
-/** alias → last successful gate timestamp (browser-session scope). */
-const gatePassedAt = new Map<string, number>()
-/** alias → in-flight gate promise (no duplicate dialogs on multi-click). */
-const pending = new Map<string, Promise<boolean>>()
-/** alias → SSH login name (fetched once for the user@alias prompt). */
-let hostsCache: Map<string, string> | null = null
-
-async function hostsUser(api: SshApi, alias: string): Promise<string | undefined> {
-  if (hostsCache === null) {
-    try {
-      const list = await api.listHosts()
-      hostsCache = new Map(list.map(host => [host.alias, host.user]))
-    } catch {
-      hostsCache = new Map()
-    }
-  }
-  return hostsCache.get(alias)
-}
-
-function gateActive(alias: string, now: number): boolean {
-  const at = gatePassedAt.get(alias)
-  return at !== undefined && now - at < GATE_TTL_MS
-}
-
-/** Mount a dialog component into a fresh portal root; returns its closer.
- *  The dialog's onClose prop is forced to the closer so cancel works. */
-function mountModal(node: ReactElement): () => void {
-  const host = document.createElement('div')
-  host.dataset.sshGateDialog = ''
-  document.body.appendChild(host)
-  const root = createRoot(host)
-  const close = (): void => {
-    root.unmount()
-    host.remove()
-  }
-  root.render(createElement(node.type, { ...node.props, onClose: close }))
-  return close
-}
-
-/** Transient inline error under the clicked row (removed after 8 s).
- *  A null row means the caller owns error surfacing — stay silent. */
-function showBanner(row: HTMLElement | null, alias: string, message: string): void {
-  if (row === null) return
-  const banner = document.createElement('div')
-  banner.dataset.sshGateError = ''
-  banner.textContent = `${tt('gate.failed', alias)}: ${message}`
-  banner.setAttribute(
-    'style',
-    'margin:2px 4px;padding:6px 8px;font-size:12px;color:#b00020;background:rgba(176,0,32,.08);border-radius:4px;white-space:normal;line-height:1.5',
-  )
-  row.insertAdjacentElement('afterend', banner)
-  setTimeout(() => { banner.remove() }, 8000)
-}
-
-/** Interactive prompts, resolving true when the user finished the action. */
-function promptFingerprint(api: SshApi, alias: string, fingerprintSha256: string, mismatch: boolean): Promise<boolean> {
-  return new Promise((resolve) => {
-    const close = mountModal(createElement(HostFingerprintDialog, {
-      api,
-      alias,
-      fingerprintSha256,
-      mismatch,
-      onClose: () => { resolve(false) },
-      onTrusted: () => { close(); resolve(true) },
-    }))
-  })
-}
-
-function promptSecret(api: SshApi, alias: string, secret: 'password' | 'passphrase'): Promise<boolean> {
-  return new Promise((resolve) => {
-    let closed = false
-    const finish = (ok: boolean): void => {
-      if (closed) return
-      closed = true
-      resolve(ok)
-    }
-    void hostsUser(api, alias).then((user) => {
-      const close = mountModal(createElement(SessionSecretDialog, {
-        api,
-        alias,
-        user,
-        secret,
-        onClose: () => { finish(false) },
-        onProvided: () => { close(); finish(true) },
-      }))
-    })
-  })
-}
-
-/**
- * Probe + prompt until connected. Resolves true when the alias may proceed
- * (the gate passed); false when the user cancelled or the failure is not
- * interactive (banner left behind).
- */
-function ensureConnected(api: SshApi, alias: string, row: HTMLElement | null): Promise<boolean> {
-  const now = Date.now()
-  if (gateActive(alias, now)) return Promise.resolve(true)
-  const inFlight = pending.get(alias)
-  if (inFlight !== undefined) return inFlight
-
-  const attempt = (async (): Promise<boolean> => {
-    for (let i = 0; i < MAX_ATTEMPTS; i++) {
-      try {
-        const result = await api.testHost(alias)
-        if (result.ok) {
-          gatePassedAt.set(alias, Date.now())
-          return true
-        }
-        if (result.code === 'NEEDS_PASSWORD' && (result.secret === 'password' || result.secret === 'passphrase')) {
-          if (await promptSecret(api, alias, result.secret)) continue
-          return false
-        }
-        showBanner(row, alias, result.error ?? 'connection failed')
-        return false
-      } catch (cause) {
-        if (cause instanceof SshApiError && (cause.code === 'HOST_KEY_UNKNOWN' || cause.code === 'HOST_KEY_MISMATCH')) {
-          const fingerprint = cause.hostKeyFingerprint ?? ''
-          if (fingerprint !== '' && await promptFingerprint(api, alias, fingerprint, cause.code === 'HOST_KEY_MISMATCH')) continue
-          if (fingerprint === '') showBanner(row, alias, cause.message)
-          return false
-        }
-        showBanner(row, alias, cause instanceof Error ? cause.message : String(cause))
-        return false
-      }
-    }
-    showBanner(row, alias, tt('gate.retryLimit'))
-    return false
-  })()
-
-  pending.set(alias, attempt)
-  void attempt.finally(() => { pending.delete(alias) })
-  return attempt
-}
-
-/** Silent prompt-only connection gate (no row / banner) for flows that
- *  surface their own errors (e.g. the directory browser). */
-export function connectHost(api: SshApi, alias: string): Promise<boolean> {
-  return ensureConnected(api, alias, null)
-}
-
-/**
- * Mount the click gate over every sidebar workspace row whose title belongs
- * to an SSH-bound workspace. Self-heals via MutationObserver. Returns a
- * disposer that removes listeners and injected state.
- */
-export function mountWorkspaceGates(
-  workspaces: Array<{ id: string; title: string; alias: string }>,
-  api: SshApi,
-): () => void {
-  const byTitle = new Map<string, string>()
-  for (const workspace of workspaces) byTitle.set(workspace.title, workspace.alias)
-
-  const attach = (row: HTMLElement): void => {
-    if (row.dataset.sshGate !== undefined) return
-    const titleEl = row.querySelector<HTMLElement>(TITLE_SELECTOR)
-    if (titleEl === null || titleEl === undefined) return
-    const alias = byTitle.get(titleEl.textContent?.trim() ?? '')
-    if (alias === undefined) return
-    row.dataset.sshGate = '1'
-    row.addEventListener('click', (event: MouseEvent) => {
-      if (gateActive(alias, Date.now())) return // passed: let the native click through
-      event.preventDefault()
-      event.stopPropagation()
-      void ensureConnected(api, alias, row).then((ok) => {
-        if (ok) row.click() // re-dispatch; the guard now lets it through
-      })
-    }, true)
-  }
-
-  const scan = (): void => {
-    for (const row of document.querySelectorAll<HTMLElement>(PROJECT_ROW_SELECTOR)) {
-      attach(row)
-    }
-  }
-
-  const observer = new MutationObserver(() => { scan() })
-  observer.observe(document.body, { childList: true, subtree: true })
-  scan()
-
-  return () => {
-    observer.disconnect()
-    for (const row of document.querySelectorAll<HTMLElement>('[data-ssh-gate]')) {
-      delete row.dataset.sshGate
-    }
-  }
-}

package/src/remote-runner.ts

@@ -1,201 +0,0 @@
-/**
- * Remote-workspace runner: lets other plugins (dsh-workbench-tiphareth) run
- * git/files/terminals against an SSH-bound workspace. The workbench host asks
- * `resolveRemote(root)` for a local anchor path; a hit returns the remote
- * context + callable channels (git exec via the engine, SFTP ops, PTY).
- * Kept duck-typed so the workbench never needs a compile-time dependency.
- */
-
-import type { SshEngine } from './ssh/engine.ts'
-import type { SshWorkspaceLedger } from './ledger.ts'
-
-/** The remote context one SSH-bound workspace resolves to. */
-export interface RemoteWorkspaceContext {
-  alias: string
-  remoteRoot: string
-  /** Run `git [args...]` inside remoteRoot. Mirrors runGit's result shape. */
-  git(args: readonly string[], opts?: { timeoutMs?: number; input?: string; allowNonZero?: boolean }): Promise<{ stdout: string; stderr: string; exitCode: number }>
-  /** Run one arbitrary command (used by tools that shell out). */
-  run(command: string, opts?: { timeoutMs?: number }): Promise<{ stdout: string; stderr: string; exitCode: number }>
-  /** SFTP operations. */
-  list(path: string): Promise<Array<{ name: string; type: 'dir' | 'file' | 'other'; size: number; mtimeMs: number }>>
-  stat(path: string): Promise<{ type: 'dir' | 'file' | 'other'; size: number; mtimeMs: number; mode: number }>
-  readFile(path: string): Promise<{ content: Buffer; mtime: number; size: number }>
-  writeFile(path: string, content: Buffer, expectedMtime?: number): Promise<{ mtime: number }>
-  mkdir(path: string): Promise<void>
-  rm(path: string, recursive: boolean): Promise<void>
-  rename(from: string, to: string): Promise<void>
-  /** Open an interactive SSH PTY in remoteRoot (columns/rows for the channel). */
-  openTerminal(cols: number, rows: number): Promise<RemotePtyHandle>
-}
-
-/** Minimal PTY handle (duck-typed for consumers like dsh-workbench-tiphareth). */
-export interface RemotePtyHandle {
-  shell: string
-  write(data: string): void
-  resize(cols: number, rows: number): void
-  kill(): void
-  onData(handler: (data: string) => void): { dispose(): void }
-  onExit(handler: (event: { exitCode: number }) => void): { dispose(): void }
-}
-
-/** Last-resort bound on opening a remote PTY (fresh SSH connect + shell). */
-const OPEN_SHELL_TIMEOUT_MS = 30_000
-
-/** Reject `promise` after `ms` with a clear message (unref'd timer). */
-function withTimeout<T>(promise: Promise<T>, ms: number, message: string): Promise<T> {
-  return new Promise<T>((resolve, reject) => {
-    const timer = setTimeout(() => reject(new Error(message)), ms)
-    timer.unref?.()
-    promise.then(
-      (value) => { clearTimeout(timer); resolve(value) },
-      (error) => { clearTimeout(timer); reject(error) },
-    )
-  })
-}
-
-/** Builds remote-workspace contexts off the shared ledger + engine. */
-export class RemoteWorkspaceRunner {
-  constructor(
-    private readonly engine: SshEngine,
-    private readonly ledger: SshWorkspaceLedger,
-  ) {}
-
-  /** Resolve a LOCAL anchor path to a remote context, or null if not SSH-bound. */
-  resolveRemote(root: string): RemoteWorkspaceContext | null {
-    const record = this.ledger.findByAnchorSync(root)
-    if (record === undefined) return null
-    return this.build(record.alias, record.remoteRoot)
-  }
-
-  private build(alias: string, remoteRoot: string): RemoteWorkspaceContext {
-    const engine = this.engine
-    const git = async (
-      args: readonly string[],
-      opts: { timeoutMs?: number; input?: string; allowNonZero?: boolean } = {},
-    ): Promise<{ stdout: string; stderr: string; exitCode: number }> => {
-      const quoted = args.map(arg => quote(arg)).join(' ')
-      // Restore real stderr ordering by capturing both streams; the engine
-      // exec returns them merged per frame — keep them merged for git too.
-      const command = `git ${quoted}`
-      const result = await engine.exec(alias, `cd ${quote(remoteRoot)} && ${command}`, opts.timeoutMs)
-      const stdout = result.stdout
-      const stderr = result.stderr
-      const exitCode = result.exitCode ?? 1
-      if (exitCode !== 0 && opts.allowNonZero !== true) {
-        const err = new Error(stderr.trim() || `git exited ${exitCode}`)
-        ;(err as { shortMessage?: string }).shortMessage = stderr.trim()
-        throw err
-      }
-      return { stdout, stderr, exitCode }
-    }
-    const run = async (
-      command: string,
-      opts: { timeoutMs?: number } = {},
-    ): Promise<{ stdout: string; stderr: string; exitCode: number }> => {
-      const result = await engine.exec(alias, `cd ${quote(remoteRoot)} && ${command}`, opts.timeoutMs)
-      return {
-        stdout: result.stdout,
-        stderr: result.stderr,
-        exitCode: result.exitCode ?? 1,
-      }
-    }
-    const list = async (path: string): Promise<Array<{ name: string; type: 'dir' | 'file' | 'other'; size: number; mtimeMs: number }>> => {
-      return engine.ls(alias, path)
-    }
-    const stat = async (path: string): Promise<{ type: 'dir' | 'file' | 'other'; size: number; mtimeMs: number; mode: number }> => {
-      return engine.stat(alias, path)
-    }
-    const readFile = async (path: string): Promise<{ content: Buffer; mtime: number; size: number }> => {
-      return engine.readFile(alias, path)
-    }
-    const writeFile = async (path: string, content: Buffer, expectedMtime?: number): Promise<{ mtime: number }> => {
-      return engine.writeFile(alias, path, content, expectedMtime)
-    }
-    const mkdir = async (path: string): Promise<void> => { await engine.mkdir(alias, path) }
-    const rm = async (path: string, recursive: boolean): Promise<void> => { await engine.rm(alias, path, recursive) }
-    const rename = async (from: string, to: string): Promise<void> => { await engine.rename(alias, from, to) }
-    const openTerminal = async (cols: number, rows: number): Promise<RemotePtyHandle> => {
-      // Bound the shell open: the engine's own connect/channel timeouts cover
-      // the normal failure modes, this is a last-resort guard so a terminal
-      // request can never hang the workbench's SSE stream indefinitely.
-      const session = await withTimeout(
-        engine.openShell(alias, { cols, rows }),
-        OPEN_SHELL_TIMEOUT_MS,
-        `SSH 终端打开超时（${OPEN_SHELL_TIMEOUT_MS / 1000} 秒）：${alias}`,
-      )
-      let exited = false
-      const exitHandlers = new Set<(event: { exitCode: number }) => void>()
-      const onDataHandlers = new Set<(data: string) => void>()
-      const enc = new TextDecoder()
-
-      // The PTY already runs the user's interactive login shell (client.shell
-      // allocates one); just cd into the remote root. Do NOT exec a new shell
-      // here — that restarts the shell, re-runs profile/.bashrc, and replays
-      // the login banner + prompt (the "command ran twice" symptom).
-      //
-      // Send `cd` only AFTER the first shell prompt has been emitted — a
-      // prompt (line ending in $ / # / > / %) means the login banner finished
-      // and the shell is interactive. Sending earlier makes the PTY echo the
-      // command raw AND the shell re-echo it after the prompt (double cd).
-      let cwdSent = false
-      let shellBuf = ''
-      const trySendCwd = (): void => {
-        if (cwdSent || exited) return
-        // Prompt heuristic: the last non-empty line ends with a prompt char
-        // (`$ # > %`) OR looks like a user@host prompt (e.g. `@login01 ~`,
-        // `majie@host:~/dir$`). Either means the shell is interactive now.
-        const lines = shellBuf.split('\n').map(line => line.replace(/\r$/, '')).filter(line => line.trim() !== '')
-        const last = lines[lines.length - 1]
-        if (last !== undefined
-          && ( /[#$>%]\s*$/.test(last) || /^\S+@\S+/.test(last) )
-          && !last.trim().endsWith('cd')) {
-          cwdSent = true
-          session.send(`cd ${quote(remoteRoot)}\r`)
-        }
-      }
-      session.onData = (data: Buffer) => {
-        const text = enc.decode(data)
-        shellBuf = (shellBuf + text).slice(-4096)
-        trySendCwd()
-        for (const handler of onDataHandlers) handler(text)
-      }
-      session.onExit = (code: number | null) => {
-        exited = true
-        for (const handler of exitHandlers) handler({ exitCode: code ?? -1 })
-      }
-      // Fallback: if no prompt heuristic matched (odd PS1), send cd after 4s.
-      setTimeout(() => {
-        if (!cwdSent && !exited) {
-          cwdSent = true
-          session.send(`cd ${quote(remoteRoot)}\r`)
-        }
-      }, 4000)
-      return {
-        shell: 'ssh',
-        write(data: string) { if (!exited) session.send(data) },
-        resize(c: number, r: number) { session.resize(c, r) },
-        kill() {
-          try { session.signal('KILL') } catch { /* closed */ }
-          try { session.close() } catch { /* closed */ }
-        },
-        onData(handler: (data: string) => void) {
-          onDataHandlers.add(handler)
-          return { dispose: () => { onDataHandlers.delete(handler) } }
-        },
-        onExit(handler: (event: { exitCode: number }) => void) {
-          exitHandlers.add(handler)
-          return { dispose: () => { exitHandlers.delete(handler) } }
-        },
-      }
-    }
-    return { alias, remoteRoot, git, run, list, stat, readFile, writeFile, mkdir, rm, rename, openTerminal }
-  }
-}
-
-/** POSIX single-quote a shell argument. */
-function quote(arg: string): string {
-  if (arg === '') return "''"
-  if (/^[a-zA-Z0-9_\-./:=@]+$/.test(arg)) return arg
-  return `'${arg.replace(/'/g, `'\\''`)}'`
-}