@tiphareth/dsh-hardssh 0.1.2 → 0.2.2

package/lib/types/backend.d.ts

@@ -1,19 +1,13 @@
 /**
- * Gated filesystem backends and the production workspace file service.
+ * The generic record source the SSH workspace API projects.
  *
- * UI workspace routes resolve an exact ledger anchor and then create a
- * request-scoped RemoteBackend. There is no implicit local fallback and no
- * dependency on the legacy global SSH mode state.
+ * `GenericWorkspaceStore` is the single record source: it projects the generic
+ * `WorkspaceLedger` (via `WorkspaceCore`) into the client SSH DTO and performs
+ * workspace CRUD through the generic core. There is no implicit local fallback
+ * and no dependency on any retired global SSH mode state.
  */
-import type { SshEngine } from './ssh/engine.ts';
-import { shellQuote } from './shell.ts';
-import { RemoteSearchService } from './remote-search.ts';
-import type { SshWorkspaceLedger } from './ledger.ts';
-import type { DirListing, FileRead, FileWriteResult, SearchView, SshWorkspaceRecord, WorkspaceEntry } from './protocol.ts';
-export declare const SEARCH_HIT_CAP = 200;
-export declare const SEARCH_SCAN_CAP = 20000;
-export declare const SEARCH_MAX_DEPTH = 4;
-export declare const REMOTE_SEARCH_TIMEOUT_MS = 20000;
+import type { WorkspaceCore } from './runtime/workspace-core.ts';
+import type { SshWorkspaceRecord, WorkspaceEntry } from './protocol.ts';
 export type BackendErrorCode = 'binary' | 'too-large' | 'conflict' | 'outside-root' | 'not-remote' | 'root-mismatch' | 'not-found' | 'forbidden' | 'invalid' | 'io';
 export declare class BackendError extends Error {
     readonly code: BackendErrorCode;
@@ -21,26 +15,29 @@ export declare class BackendError extends Error {
         cause?: unknown;
     });
 }
-export interface WorkspaceFileContext {
-    workspaceId: string;
-    requestedRoot: string;
-    anchorPath: string;
-    alias: string;
-    remoteRoot: string;
-}
-export interface WorkspaceFileService {
-    resolveContext(root: string): Promise<WorkspaceFileContext>;
-    list(root: string, rel: string): Promise<DirListing>;
-    read(root: string, rel: string): Promise<FileRead>;
-    write(root: string, rel: string, content: string, expectedMtime?: number): Promise<FileWriteResult>;
-    search(root: string, query: string): Promise<SearchView>;
-}
-export interface WorkspaceBackend {
-    assertRoot(root: string): void;
-    list(root: string, rel: string): Promise<DirListing>;
-    read(root: string, rel: string): Promise<FileRead>;
-    write(root: string, rel: string, content: string, expectedMtime?: number): Promise<FileWriteResult>;
-    search(root: string, query: string): Promise<SearchView>;
+/**
+ * The SSH-workspace record source the workspace routes, agent tools, and the
+ * SSH host-delete reference guard satisfy. Every consumer depends on this
+ * narrow view, so none of them knows which ledger implementation is
+ * authoritative.
+ */
+export interface WorkspaceStoreView {
+    /** Every SSH-bound workspace as the client DTO. */
+    list(): Promise<SshWorkspaceRecord[]>;
+    get(id: string): Promise<SshWorkspaceRecord | undefined>;
+    findByAnchor(path: string): Promise<SshWorkspaceRecord | undefined>;
+    /** Synchronous anchor lookup used by the session announcement. */
+    findByAnchorSync(path: string): SshWorkspaceRecord | undefined;
+    /** Create an SSH workspace (title/alias/remoteRoot); the anchor is managed by the store. */
+    create(input: {
+        title: string;
+        alias: string;
+        remoteRoot: string;
+    }): Promise<SshWorkspaceRecord>;
+    rename(id: string, title: string): Promise<SshWorkspaceRecord | undefined>;
+    remove(id: string): Promise<boolean>;
+    /** The shared anchor root (fail-closed gating before the runtime is ready). */
+    anchorsRoot(): string;
 }
 /**
  * Normalize a workspace-relative path.
@@ -54,55 +51,53 @@ export declare function normalizeRel(raw: string): string;
 export declare function isInside(root: string, abs: string): boolean;
 /** Resolve a normalized relative path below a POSIX root. */
 export declare function relToAbs(root: string, rel: string): string;
-export { shellQuote };
-/** Stable dir-first, case-insensitive ordering shared by every backend. */
+/** Stable dir-first, case-insensitive ordering shared by every listing. */
 export declare function sortWorkspaceEntries(entries: WorkspaceEntry[]): WorkspaceEntry[];
-export type WorkspacePathFlavor = 'local' | 'remote';
-/** Return abs relative to root, rejecting prefix-collision/parent traversal. */
-export declare function relativeWorkspacePath(root: string, abs: string, flavor: WorkspacePathFlavor): string;
-/** Normalize filesystem/SFTP errors to stable route-visible codes. */
-export declare function toBackendIoError(error: unknown, path: string): BackendError;
 /** Map a BackendError to its stable HTTP status (routes use this). */
 export declare function backendErrorStatus(error: BackendError, ioStatus: 500 | 502): number;
 /**
- * Local implementation retained for explicit local-only consumers. It is
- * deliberately NOT selected by LedgerWorkspaceFileService.
+ * The single record source: projects the generic `WorkspaceLedger` (via
+ * `WorkspaceCore`) into the client SSH DTO and performs workspace CRUD through
+ * the generic core. Routes, agent tools, and the SSH host-delete guard stay
+ * store-agnostic behind `WorkspaceStoreView`. New SSH workspaces keep the
+ * established anchor layout (~/.dsh/ssh-workspaces/<id>) so existing
+ * sidebar/session bindings and the host workspace registry stay unchanged.
  */
-export declare class LocalBackend implements WorkspaceBackend {
-    assertRoot(root: string): void;
-    list(root: string, rel: string): Promise<DirListing>;
-    read(root: string, rel: string): Promise<FileRead>;
-    write(root: string, rel: string, content: string, expectedMtime?: number): Promise<FileWriteResult>;
-    search(root: string, query: string): Promise<SearchView>;
-    private resolvePath;
-    /** Resolve the nearest existing ancestor; root and every existing target
-     *  ancestor must resolve below the real workspace root. */
-    private assertRealpathWalk;
-}
-/** A request-scoped remote backend bound to one immutable ledger record. */
-export declare class RemoteBackend implements WorkspaceBackend {
-    private readonly engine;
-    private readonly record;
-    private readonly searchService;
-    private readonly remoteRoot;
-    constructor(engine: SshEngine, record: SshWorkspaceRecord, searchService: RemoteSearchService);
-    assertRoot(root: string): void;
-    list(root: string, rel: string): Promise<DirListing>;
-    read(root: string, rel: string): Promise<FileRead>;
-    write(root: string, rel: string, content: string, expectedMtime?: number): Promise<FileWriteResult>;
-    search(root: string, query: string): Promise<SearchView>;
-}
-/** Production UI service: exact ledger anchor -> request-scoped backend. */
-export declare class LedgerWorkspaceFileService implements WorkspaceFileService {
-    private readonly ledger;
-    private readonly engine;
-    private readonly searchService;
-    constructor(ledger: SshWorkspaceLedger, engine: SshEngine, searchService: RemoteSearchService);
-    resolveContext(root: string): Promise<WorkspaceFileContext>;
-    list(root: string, rel: string): Promise<DirListing>;
-    read(root: string, rel: string): Promise<FileRead>;
-    write(root: string, rel: string, content: string, expectedMtime?: number): Promise<FileWriteResult>;
-    search(root: string, query: string): Promise<SearchView>;
-    private resolveBackend;
+export declare class GenericWorkspaceStore implements WorkspaceStoreView {
+    private readonly core;
+    /** Resolves when the generic runtime (migration + initialize) finished;
+     *  rejects on any startup failure so every consumer fails closed instead
+     *  of silently reading an un-migrated or corrupt ledger. */
+    private readonly ready;
+    /** Anchor root for newly created SSH workspaces (~/.dsh/ssh-workspaces). */
+    private readonly anchorBase;
+    constructor(core: WorkspaceCore, 
+    /** Resolves when the generic runtime (migration + initialize) finished;
+     *  rejects on any startup failure so every consumer fails closed instead
+     *  of silently reading an un-migrated or corrupt ledger. */
+    ready: Promise<void>, 
+    /** Anchor root for newly created SSH workspaces (~/.dsh/ssh-workspaces). */
+    anchorBase: string);
+    /** WorkspaceCore.list() exposes every provider, but the SSH DTO surface is SSH-only, so this filters before projecting. */
+    list(): Promise<SshWorkspaceRecord[]>;
+    /** WorkspaceCore.get() returns generic records, so this narrows to SSH and projects the DTO. */
+    get(id: string): Promise<SshWorkspaceRecord | undefined>;
+    /** WorkspaceCore.findByAnchor() also resolves non-SSH workspaces, so this projects only SSH owners. */
+    findByAnchor(path: string): Promise<SshWorkspaceRecord | undefined>;
+    /** WorkspaceCore has no synchronous anchor lookup on the public surface, so this resolves the detached ledger snapshot lexically. */
+    findByAnchorSync(path: string): SshWorkspaceRecord | undefined;
+    /** WorkspaceLedger.create() cannot generate SSH defaults or the SSH anchor layout, so this maps the SSH create input into a generic record first. */
+    create(input: {
+        title: string;
+        alias: string;
+        remoteRoot: string;
+    }): Promise<SshWorkspaceRecord>;
+    /** Title edits route through the generic update (the generic ledger has no SSH-specific rename). */
+    rename(id: string, title: string): Promise<SshWorkspaceRecord | undefined>;
+    /** WorkspaceCore.remove() is the generic delete; the anchor directory stays in place (the host workspace may still reference it). */
+    remove(id: string): Promise<boolean>;
+    /** The SSH anchor base this store creates its managed anchors under
+     *  (~/.dsh/ssh-workspaces). */
+    anchorsRoot(): string;
 }
 //# sourceMappingURL=backend.d.ts.map

package/lib/types/base/capability.d.ts

@@ -83,6 +83,10 @@ export interface WorkspaceSearchHit {
     /** Path relative to the search root. */
     rel: string;
     isDir: boolean;
+    /** Optional raw matched line (`path:line:content`, engine-style) for a
+     *  content grep when the backend can report snippets; absent when the
+     *  search only returns matching paths. */
+    match?: string;
 }
 /** Filename / content search capability. */
 export interface WorkspaceSearchService {

package/lib/types/base/ledger-router.d.ts

@@ -1,48 +1,64 @@
-/**
- * Ledger-backed workspace router — the concrete `WorkspaceRouter` that ties
- * the ledger's anchor index, the namespace codec, and the provider registry
- * together. Any provider can be routed through this router with zero SSH
- * knowledge: a session cwd inside a workspace's anchor resolves to that
- * workspace's provider connection; an explicit `wfs://…` (or legacy `ssh:…`)
- * target key resolves to the owning connection.
- *
- * The router opens connections lazily and caches them per workspace id;
- * removed workspaces drop their connections so stale keys fail closed.
- *
- * @module @tiphareth/dsh-hardssh/base/ledger-router
- */
-import type { WorkspaceConnection, WorkspaceRecord } from './model.ts';
+/** Ledger-backed routing, readiness, single-flight opening, and connection ownership. */
+import type { WorkspaceLedger } from './ledger.ts';
+import type { WorkspaceConnection, WorkspaceId, WorkspaceRecord } from './model.ts';
 import { type WorkspaceNamespaceCodec, type WorkspaceRoute } from './namespace.ts';
-import type { WorkspaceRegistry } from './registry.ts';
-import { type WorkspaceLedger } from './ledger.ts';
+import type { WorkspaceProviderRegistry } from './registry.ts';
 import type { WorkspaceResolution, WorkspaceRouter } from './router.ts';
-/** Open-or-reuse strategy for workspace connections. */
+/** Router configuration that remains independent of any concrete provider. */
 export interface LedgerRouterOptions {
     codec?: WorkspaceNamespaceCodec;
-    /** Called with the record; resolves to a connection (undefined = cannot open). */
-    open(record: WorkspaceRecord, signal?: AbortSignal): Promise<WorkspaceConnection | undefined>;
-    /** Called when a workspace is removed (drop cache / pool leases). */
-    onRemoved?(workspaceId: string): void;
+    logger?: Pick<Console, 'warn' | 'error' | 'info' | 'debug'>;
 }
-/** Ledger + registry based router. */
+/** Ledger + provider-registry based router. */
 export declare class LedgerWorkspaceRouter implements WorkspaceRouter {
     private readonly ledger;
-    private readonly registry;
+    private readonly providers;
     private readonly options;
     readonly codec: WorkspaceNamespaceCodec;
     private readonly connections;
+    private readonly connectionBindings;
+    private readonly opening;
+    private readonly closing;
     private readonly anchors;
-    constructor(ledger: WorkspaceLedger, registry: WorkspaceRegistry, options: LedgerRouterOptions);
+    private readonly lifecycleAbort;
+    private initializePromise;
+    private ready;
+    private closed;
+    private ledgerDisposer;
+    private providerDisposer;
+    constructor(ledger: WorkspaceLedger, providers: WorkspaceProviderRegistry, options?: LedgerRouterOptions);
+    /** ensureOpen() warms one supplied record only, so initialize loads, subscribes, and preopens the complete persisted ledger before readiness. */
+    initialize(): Promise<void>;
+    /** initialize() is asynchronous, so isReady provides the synchronous seam gate it cannot provide. */
+    isReady(): boolean;
+    /** isReady() only reports a snapshot, so whenReady lets asynchronous consumers await the initialization outcome. */
+    whenReady(): Promise<void>;
+    /** ensureOpen() requires a record, so openById performs fail-closed ledger identity lookup before single-flight opening. */
+    openById(id: WorkspaceId, signal?: AbortSignal): Promise<WorkspaceConnection | undefined>;
+    /** openById() cannot translate a host anchor, so openByAnchor resolves ledger ownership before opening. */
+    openByAnchor(path: string, signal?: AbortSignal): Promise<WorkspaceConnection | undefined>;
+    /** initialize() owns promise reuse, so initializeInternal performs the one actual load/subscribe/preopen sequence. */
+    private initializeInternal;
     private reindex;
     private openFor;
     fromNamespace(key: string): WorkspaceResolution | undefined;
     fromAnchor(cwd: string | undefined): WorkspaceConnection | undefined;
     resolveRoute(route: WorkspaceRoute): WorkspaceResolution | undefined;
-    /** Async open used by the adapter at mount time (pre-warm active records). */
+    /** Async compatibility entry used by older adapters that already hold a detached record. */
     ensureOpen(record: WorkspaceRecord, signal?: AbortSignal): Promise<WorkspaceConnection | undefined>;
     /** All currently cached connections (for lifecycle/teardown). */
     connectionsSnapshot(): WorkspaceConnection[];
-    /** Close every cached connection (plugin teardown). */
+    /** Close every cached and in-flight connection and release both subscriptions. */
     closeAll(): Promise<void>;
+    /** reindex() only updates synchronous ownership, so this handler also closes and reopens resources after ledger commits. */
+    private handleLedgerChange;
+    /** openFor() cannot observe provider lifecycle events itself, so this handler invalidates unregisters and preopens later registrations. */
+    private handleProviderChange;
+    /** openFor() reuses an in-flight promise, so reopen waits for stale work before retrying the current record. */
+    private reopen;
+    /** reindex() cannot await resource release, so detach removes routing synchronously and tracks close completion separately. */
+    private detach;
+    /** WorkspaceConnection.close() alone is not tracked, so closeConnection lets closeAll await invalidation work already in progress. */
+    private closeConnection;
 }
 //# sourceMappingURL=ledger-router.d.ts.map

package/lib/types/base/ledger.d.ts

@@ -1,17 +1,8 @@
 /**
- * Generic workspace ledger — the provider-agnostic persistence and routing
- * index for workspace records. It generalizes the SSH-bound ledger's proven
- * mechanics (atomic write, sync anchor index, subscription) without any
- * SSH-typed fields: a record is a `WorkspaceRecord` whose `provider` ref
- * names the owning provider, and anchors are plain local directories.
- *
- * Concrete providers keep their own specialized stores (e.g. the SSH host
- * store) and reference them through `provider.connectionRef`; the ledger
- * itself never touches provider configs.
- *
- * @module @tiphareth/dsh-hardssh/base/ledger
+ * Provider-neutral workspace ledger with strict loading, atomic persistence,
+ * detached snapshots, and one serialized mutation queue.
  */
-import type { WorkspaceRecord } from './model.ts';
+import type { WorkspaceCreateInput, WorkspaceRecord, WorkspaceUpdate } from './model.ts';
 /** One committed ledger snapshot. */
 export interface LedgerSnapshot {
     revision: number;
@@ -27,20 +18,36 @@ export type LedgerChange = {
     revision: number;
     before: WorkspaceRecord;
     record: WorkspaceRecord;
+} | {
+    type: 'updated';
+    revision: number;
+    before: WorkspaceRecord;
+    record: WorkspaceRecord;
 } | {
     type: 'removed';
     revision: number;
     record: WorkspaceRecord;
+} | {
+    type: 'replaced';
+    revision: number;
+    before: WorkspaceRecord[];
+    records: WorkspaceRecord[];
 };
 export type LedgerListener = (change: LedgerChange) => void;
 /** Normalize an anchor for comparison (Windows case-insensitive; POSIX not). */
 export declare function normalizeAnchorPath(path: string): string;
 /** True when `candidate` equals `anchor` or is one of its descendants (lexical). */
 export declare function isPathUnderAnchor(anchor: string, candidate: string): boolean;
+/** Options for one atomic whole-ledger replacement. */
+export interface LedgerReplaceOptions {
+    /** Copy the current persisted ledger here before overwriting it. */
+    backupPath?: string;
+}
+/** Generic ledger schema currently accepted by strict loading. */
+export declare const WORKSPACE_LEDGER_SCHEMA_VERSION: 1;
 /**
- * The generic ledger. Persisted as a JSON file; mutations serialized through
- * a per-instance queue with atomic rename; a synchronous anchor index is
- * maintained so the switch layer can resolve a cwd without awaiting I/O.
+ * The generic ledger. The in-memory state changes only after an atomic save,
+ * and every public observation is detached from that state.
  */
 export declare class WorkspaceLedger {
     private readonly fileOverride?;
@@ -70,13 +77,17 @@ export declare class WorkspaceLedger {
     get(id: string): Promise<WorkspaceRecord | undefined>;
     findByAnchor(path: string): Promise<WorkspaceRecord | undefined>;
     findByAnchorSync(path: string): WorkspaceRecord | undefined;
-    /** Create a record: materialize the anchor (managed mode), persist, commit. */
-    create(input: Omit<WorkspaceRecord, 'id' | 'createdAt' | 'updatedAt'> & {
-        id?: string;
-    }): Promise<WorkspaceRecord>;
+    /** Create cannot preserve caller timestamps, so migration uses replaceAll instead. */
+    create(input: WorkspaceCreateInput): Promise<WorkspaceRecord>;
     rename(id: string, title: string): Promise<WorkspaceRecord | undefined>;
+    /** WorkspaceLedger.rename cannot change provider bindings or extension data, so update applies a generic patch. */
+    update(id: string, patch: WorkspaceUpdate): Promise<WorkspaceRecord | undefined>;
+    /** WorkspaceLedger.create persists one generated record, so it cannot atomically import a complete authoritative snapshot. */
+    replaceAll(records: readonly WorkspaceRecord[], options?: LedgerReplaceOptions): Promise<void>;
     /** Remove a record. The anchor directory is left in place (caller decides). */
     remove(id: string): Promise<boolean>;
     anchorsRoot(): string;
 }
+/** isRecord validates one shape only, so this validator also rejects duplicate ids and ambiguous anchors across records. */
+export declare function assertValidRecords(values: readonly unknown[]): asserts values is readonly WorkspaceRecord[];
 //# sourceMappingURL=ledger.d.ts.map

package/lib/types/base/model.d.ts

@@ -62,13 +62,22 @@ export interface WorkspaceRecord {
     /** Provider/feature extension bag. Never holds secrets. */
     extensions?: Record<string, unknown>;
 }
-/** One provider capability key (extensible via module augmentation). */
+/** Provider API major implemented by the generic workspace foundations. */
+export declare const WORKSPACE_PROVIDER_API_VERSION: 2;
+/**
+ * Provider capability augmentation point. Runtime packages add their official
+ * capability types here; the platform-neutral base deliberately defines none.
+ */
 export interface WorkspaceCapabilityMap {
-    'workspace.fs': import('./capability.ts').WorkspaceFileSystem;
-    'workspace.process': import('./capability.ts').WorkspaceProcessRuntime;
-    'workspace.terminal': import('./capability.ts').WorkspaceTerminalService;
-    'workspace.search': import('./capability.ts').WorkspaceSearchService;
+    /** Unaugmented providers may carry private keys; runtime-known keys gain precise types through augmentation. */
+    [capability: string]: unknown;
 }
+/** Input accepted when creating a record; identity and timestamps are ledger-owned. */
+export type WorkspaceCreateInput = Omit<WorkspaceRecord, 'id' | 'createdAt' | 'updatedAt'> & {
+    id?: WorkspaceId;
+};
+/** Mutable record fields; identity, schema, and creation time remain immutable. */
+export type WorkspaceUpdate = Partial<Pick<WorkspaceRecord, 'title' | 'provider' | 'location' | 'anchor' | 'labels' | 'extensions'>>;
 /** A resolved, open connection to one workspace's provider. */
 export interface WorkspaceConnection {
     readonly workspaceId: WorkspaceId;
@@ -91,8 +100,8 @@ export interface WorkspaceProvider {
     readonly manifest: WorkspaceProviderManifest;
     /** Validate a record before open (e.g. root shape, ref resolvable). */
     validate(record: WorkspaceRecord): void | Promise<void>;
-    /** Open a connection for one record. */
-    open(record: WorkspaceRecord, context?: WorkspaceOpenContext): Promise<WorkspaceConnection>;
+    /** Open a connection for one record under the router-owned lifecycle context. */
+    open(record: WorkspaceRecord, context: WorkspaceOpenContext): Promise<WorkspaceConnection>;
 }
 /** Static provider identity, checked before any plugin code runs. */
 export interface WorkspaceProviderManifest {
@@ -103,6 +112,6 @@ export interface WorkspaceProviderManifest {
     apiVersion: number;
     displayName: string;
     /** Capabilities this provider implements. */
-    capabilities: Array<keyof WorkspaceCapabilityMap | string>;
+    capabilities: string[];
 }
 //# sourceMappingURL=model.d.ts.map

package/lib/types/base/plugin.d.ts

@@ -76,6 +76,17 @@ export interface WorkspacePlugin {
 /**
  * Registry of loaded plugins (provider + feature plugins together). Keeps
  * the workspace registry and plugin lifecycle in one place.
+ *
+ * NOT WIRED INTO PRODUCTION YET: the DSH runtime registers the builtin
+ * providers directly (`runtime/workspace-core.ts`) and no third-party plugin
+ * loads through this host — only tests do. It is kept because it is the
+ * documented distribution contract for out-of-tree providers (see SKILLS.md);
+ * provider teardown stays ownership-correct for when it is wired up: each
+ * registration releases the disposer that `register()` returned for THAT call,
+ * so a duplicate (same id+version) registration never unregisters a provider it
+ * does not own.
+ *
+ * @internal Not reachable from any production assembly today.
  */
 export declare class WorkspacePluginHost {
     private readonly registries;

package/lib/types/base/registry.d.ts

@@ -1,18 +1,14 @@
-/**
- * Workspace provider registry — the single place providers register and are
- * looked up by id. The registry is provider-agnostic: SSH, local, and any
- * future provider all register here, and the switch layer resolves
- * workspaces through the registry without knowing which provider backs them.
- *
- * Registration is idempotent per (id, version, apiVersion): re-registering
- * the same provider is a no-op / reuse; registering a different or
- * incompatible implementation with the same id is an error.
- *
- * @module @tiphareth/dsh-hardssh/base/registry
- */
+/** Provider-neutral registry with observable, ownership-safe registration lifecycle. */
 import type { WorkspaceProvider, WorkspaceProviderManifest } from './model.ts';
-/** Fired when a provider registers (for surface mounts / cache invalidation). */
-export type ProviderListener = (provider: WorkspaceProvider) => void;
+/** Provider registration lifecycle event consumed by routers. */
+export type ProviderChange = {
+    type: 'registered';
+    provider: WorkspaceProvider;
+} | {
+    type: 'unregistered';
+    provider: WorkspaceProvider;
+};
+export type ProviderListener = (change: ProviderChange) => void;
 /** Duplicate / incompatible registration error. */
 export declare class ProviderRegistrationError extends Error {
     constructor(message: string);
@@ -21,40 +17,41 @@ export declare class ProviderRegistrationError extends Error {
 export declare class WorkspaceProviderRegistry {
     private readonly providers;
     private readonly listeners;
-    /** Register a provider. Throws on id collision with an incompatible impl. */
+    /** Register a provider and return a disposer that only removes that exact registration. */
     register(provider: WorkspaceProvider): () => void;
     /** Look up a provider by id. */
     get(id: string): WorkspaceProvider | undefined;
-    /** Unregister a provider by id (no-op when absent or different version). */
+    /**
+     * Remove a provider by id, whoever registered it.
+     *
+     * Ownership-unsafe by construction: callers that registered a provider must
+     * use the disposer returned by register() instead, otherwise teardown can
+     * delete a provider owned by another plugin. Kept for whole-registry
+     * operations (tests, process-level resets).
+     */
     unregister(id: string): void;
     /** All registered providers. */
     list(): WorkspaceProvider[];
-    /** Subscribe to registrations. Returns a disposer. */
+    /** Subscribe must expose both registration and removal, which the old registration-only listener could not report. */
     subscribe(listener: ProviderListener): () => void;
     /** True when a provider id is registered. */
     has(id: string): boolean;
     /** Static identity of a registered provider (for manifests / UI). */
     manifestOf(id: string): WorkspaceProviderManifest | undefined;
+    /** register() cannot safely repeat listener isolation for both lifecycle directions, so emit centralizes it. */
+    private emit;
 }
-/** The process-wide shared registry. */
-export declare const globalWorkspaceRegistry: WorkspaceProviderRegistry;
-/**
- * Workspace registry surface used by plugins: list / watch workspace records
- * and register providers. Implemented by the runtime over the ledger + the
- * provider registry.
- */
+/** Plugin-facing workspace registry surface. */
 export interface WorkspaceRegistry {
-    /** All known workspace records (provider-agnostic). */
     listWorkspaces(): Promise<import('./model.ts').WorkspaceRecord[]>;
-    /** Subscribe to workspace record changes. Returns a disposer. */
     subscribe(listener: (workspace: import('./model.ts').WorkspaceRecord) => void): () => void;
-    /** Register a provider (idempotent same-version; throws on conflict). */
-    register(provider: WorkspaceProvider): void;
-    /** Unregister a provider by id (no-op when absent). */
+    register(provider: WorkspaceProvider): () => void;
+    /**
+     * Ownership-unsafe id-based removal; plugin teardown must release the
+     * disposer returned by `register()` instead of calling this.
+     */
     unregister?(providerId: string): void;
-    /** Look up a provider by id. */
     provider(id: string): WorkspaceProvider | undefined;
-    /** All registered providers. */
     providers(): WorkspaceProvider[];
 }
 //# sourceMappingURL=registry.d.ts.map

package/lib/types/base/router.d.ts

@@ -30,11 +30,4 @@ export interface WorkspaceRouter {
     /** Map a route back to a resolution (used by the switch to re-encode child keys). */
     resolveRoute(route: WorkspaceRoute): WorkspaceResolution | undefined;
 }
-/** Convenience base: default codec wiring plus helper for resolution lookup. */
-export declare abstract class BaseWorkspaceRouter implements WorkspaceRouter {
-    abstract readonly codec: WorkspaceNamespaceCodec;
-    abstract fromNamespace(key: string): WorkspaceResolution | undefined;
-    abstract fromAnchor(cwd: string | undefined): WorkspaceConnection | undefined;
-    abstract resolveRoute(route: WorkspaceRoute): WorkspaceResolution | undefined;
-}
 //# sourceMappingURL=router.d.ts.map

package/lib/types/client/api.d.ts

@@ -4,11 +4,15 @@
  * endpoints the config dialog needs (host create + test). Plain fetch, same
  * origin 鈥?the only data path the panel components use.
  */
-import { HttpApiError } from '../client-http.ts';
-import { type DirListing, type FileRead, type FileWriteResult, type RemoteDirEntry, type SearchView, type SshWorkspaceRecord } from '../protocol.ts';
-/** Error carrying the route's JSON error message and stable code/status. */
+import { HttpApiError, type HttpErrorBody } from '../client-http.ts';
+import { type RemoteDirEntry, type SshWorkspaceRecord } from '../protocol.ts';
+/**
+ * Workspace-route error: the shared transport error under this family's name.
+ * It adds no parsing — `readJson` in ../client-http.ts owns status/body
+ * decoding for both route families.
+ */
 export declare class WorkspaceApiError extends HttpApiError {
-    constructor(message: string, code?: string, status?: number);
+    constructor(message: string, status?: number, body?: HttpErrorBody);
 }
 /** The workspace route family client. */
 export declare class WorkspaceApi {
@@ -36,10 +40,6 @@ export declare class WorkspaceApi {
         path: string;
         entries: RemoteDirEntry[];
     }>;
-    list(root: string, path: string): Promise<DirListing>;
-    read(root: string, path: string): Promise<FileRead>;
-    write(root: string, path: string, content: string, expectedMtime?: number): Promise<FileWriteResult>;
-    search(root: string, queryText: string): Promise<SearchView>;
 }
 /** The two /api/dsh-ssh endpoints the config dialog needs (host create/test). */
 export interface SshHostPayload {

package/lib/types/client/connect-host.d.ts

@@ -0,0 +1,13 @@
+import type { SshApi } from './ssh/api.ts';
+/**
+ * Probe + prompt until connected. Resolves true when the alias may proceed;
+ * false when the user cancelled or the failure is not interactive. When a
+ * credential was already supplied and the retry still fails (wrong password,
+ * unreachable host, network drop, …), the password dialog re-opens WITH the
+ * failure reason shown, VSCode style — no silent "stuck" states.
+ *
+ * @param api - the SSH API client.
+ * @param alias - the host alias to gate.
+ */
+export declare function connectHost(api: SshApi, alias: string): Promise<boolean>;
+//# sourceMappingURL=connect-host.d.ts.map

package/lib/types/client/index.d.ts

@@ -17,17 +17,19 @@ declare module '@deepseek-ai/dsh-client-ui-slots' {
         'dsh-hardssh': WorkspaceKey;
     }
 }
-export type { PanelControllerSnapshot } from './ssh/panel/controller.ts';
 export type { SshPanelProps } from './ssh/panel/SshPanel.tsx';
-export type { HostsTabProps } from './ssh/panel/HostsTab.tsx';
 export type { HostFormDialogProps } from './ssh/panel/HostFormDialog.tsx';
 export type { TerminalTabProps } from './ssh/panel/TerminalTab.tsx';
 export type { TransferTabProps } from './ssh/panel/TransferTab.tsx';
 export type { TunnelsTabProps } from './ssh/panel/TunnelsTab.tsx';
 export type { ClusterTabProps } from './ssh/panel/ClusterTab.tsx';
 export type { SshKey } from './ssh/locales.ts';
-/** Required services: slots for the header buttons + directory-flow holes,
- *  locale for the copy, workspaces for the native local-directory chooser. */
+/** Required services: slots for the extension seats, locale for copy,
+ *  workspaces for the native local-directory chooser, sessions for the
+ *  open/new-session connection gate, and sidebarRightTabs for the SSH
+ *  operations console type. Keep the registry explicit: without it Cordis may
+ *  activate this client before ui-sidebar-right provides the service; the
+ *  guarded registration then degrades silently and no HardSSH tab exists. */
 export declare const inject: string[];
 /** Apply the browser half. */
 export declare function apply(ctx: ClientContext): void;