@tiphareth/dsh-hardssh 0.1.2

package/src/client/workspace.module.css

@@ -0,0 +1,283 @@
+/* SSH workspace flow styles — follow the dsh --dsw-* theme tokens so the
+   dialogs match the active GUI theme exactly like the rest of dsh: native
+   dsh cards (12px radius, hairline border, flat, no shadow), 8px controls,
+   near-black primary buttons, brand blue only for focus/accents. */
+
+.dialogGrid {
+  display: grid;
+  grid-template-columns: 1fr;
+  gap: 10px;
+}
+
+.field {
+  display: flex;
+  flex-direction: column;
+  gap: 5px;
+}
+
+.field > span {
+  font-size: 13px;
+  font-weight: 500;
+  color: var(--dsw-alias-label-primary, #0f1115);
+}
+
+.field input,
+.field select {
+  padding: 7px 10px;
+  min-height: 36px;
+  box-sizing: border-box;
+  font-size: 13px;
+  color: var(--dsw-alias-label-primary, #0f1115);
+  background: var(--dsw-alias-bg-layer-1, #fff);
+  border: 1px solid var(--dsw-alias-border-l2, rgba(0, 0, 0, 0.14));
+  border-radius: 8px;
+  outline: none;
+  font-family: inherit;
+  transition: border-color 0.15s ease, box-shadow 0.15s ease;
+}
+
+.field select option {
+  background: var(--dsw-alias-bg-base, #fff);
+  color: var(--dsw-alias-label-primary, #0f1115);
+}
+
+.field input::placeholder,
+.field select::placeholder {
+  color: var(--dsw-alias-label-tertiary, #81858c);
+}
+
+.field input:focus,
+.field select:focus {
+  border-color: var(--dsw-alias-brand-primary-new-colorprimary-new-color, #4176e6);
+  box-shadow: 0 0 0 2px rgba(65, 118, 230, 0.15);
+}
+
+.dialogFail {
+  margin-top: 10px;
+  padding: 8px 12px;
+  border-radius: 6px;
+  background: var(--dsw-alias-state-error-bg, rgba(245, 63, 63, 0.1));
+  border: 1px solid var(--dsw-alias-state-error-primary, rgba(245, 63, 63, 0.4));
+  color: var(--dsw-alias-state-error-primary, #d03050);
+  font-size: 12px;
+}
+
+.dialogInfo {
+  margin-top: 10px;
+  padding: 8px 12px;
+  border-radius: 6px;
+  background: var(--dsw-alias-bg-base-2, rgba(0, 0, 0, 0.04));
+  border: 1px solid var(--dsw-alias-border-l2, rgba(0, 0, 0, 0.1));
+  color: #000000;
+  font-size: 12px;
+}
+
+.dialogActions {
+  display: flex;
+  justify-content: flex-end;
+  gap: 8px;
+  margin-top: 14px;
+}
+
+.button {
+  padding: 7px 15px;
+  border: 1px solid var(--dsw-alias-border-l2, rgba(0, 0, 0, 0.15));
+  border-radius: 8px;
+  background: transparent;
+  color: var(--dsw-alias-label-primary, #0f1115);
+  font-size: 13px;
+  cursor: pointer;
+  transition: background 0.15s ease;
+  font-family: inherit;
+}
+
+.button:hover:not(:disabled) {
+  background: var(--dsw-alias-bg-overlay, rgba(0, 0, 0, 0.05));
+}
+
+.button:disabled {
+  opacity: 0.55;
+  cursor: default;
+}
+
+.buttonPrimary {
+  background: var(--dsw-alias-button-primary-fill, #0f1115);
+  border-color: transparent;
+  color: var(--dsw-alias-label-primary-foreground, #fff);
+  font-weight: 600;
+}
+
+.buttonPrimary:hover:not(:disabled) {
+  background: var(--dsw-alias-button-primary-hover, #2b2f36);
+  color: var(--dsw-alias-label-primary-foreground, #fff);
+}
+
+.dialogHint {
+  margin-top: 10px;
+  font-size: 11.5px;
+  line-height: 1.45;
+  color: var(--dsw-alias-label-tertiary, #81858c);
+}
+
+.hostRow {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 7px 10px;
+  border: 1px solid var(--dsw-alias-border-l2, rgba(0, 0, 0, 0.1));
+  border-radius: 8px;
+  background: var(--dsw-alias-bg-base, rgba(0, 0, 0, 0.02));
+  color: var(--dsw-alias-label-primary, #0f1115);
+  font-size: 13px;
+}
+
+.hostRow:hover {
+  background: var(--dsw-alias-bg-overlay, rgba(0, 0, 0, 0.05));
+}
+
+.hostAlias {
+  font-weight: 500;
+  font-size: 13px;
+  color: var(--dsw-alias-label-primary, #0f1115);
+  white-space: nowrap;
+}
+
+.hostMeta {
+  flex: 1;
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  font-size: 12px;
+  color: var(--dsw-alias-label-tertiary, #81858c);
+}
+
+.danger {
+  background: var(--dsw-alias-state-error-primary, #d03050);
+  border-color: transparent;
+  color: #fff;
+}
+
+/* SSH workspace manager header button */
+.managerButton {
+  border: 1px solid var(--dsw-alias-border-l2, rgba(0, 0, 0, 0.2));
+  height: 32px;
+  min-width: 111px;
+  color: #000000;
+  font-family: var(--dsw-font-family, -apple-system, BlinkMacSystemFont, 'Segoe UI',
+    Roboto, system-ui, 'PingFang SC', 'Microsoft YaHei', sans-serif);
+  cursor: pointer;
+  background: transparent;
+  border-radius: 12px;
+  justify-content: center;
+  align-items: center;
+  gap: 4px;
+  padding: 6px 12px;
+  font-size: 13px;
+  font-weight: 400;
+  line-height: 20px;
+  display: inline-flex;
+  white-space: nowrap;
+  transition: background 0.15s ease, border-color 0.15s ease;
+}
+.managerButton:hover {
+  background: var(--dsw-alias-bg-overlay, rgba(0, 0, 0, 0.05));
+}
+.managerButton svg {
+  flex: none;
+}
+
+.managerMenuHeader {
+  margin: 0 0 2px;
+  font-size: 13px;
+  font-weight: 600;
+  color: var(--dsw-alias-label-primary, #0f1115);
+}
+.managerMenuClose {
+  float: right;
+  border: none;
+  background: transparent;
+  color: var(--dsw-alias-label-secondary, #61666b);
+  cursor: pointer;
+  font-size: 14px;
+  line-height: 18px;
+  padding: 0 2px;
+}
+.managerMenuClose:hover { color: var(--dsw-alias-label-primary, #0f1115); }
+
+/* Dropdown panel: native dsh flat card — 12px radius, hairline border,
+   no shadow. */
+.menuDropdown {
+  position: fixed;
+  z-index: 99999;
+  min-width: 230px;
+  max-width: calc(100vw - 16px);
+  box-sizing: border-box;
+  overflow-x: hidden;
+  overflow-y: auto;
+  max-height: min(600px, calc(100vh - 64px));
+  padding: 8px;
+  border-radius: 12px;
+  background: var(--dsw-alias-bg-base, #fff);
+  border: 1px solid var(--dsw-alias-border-l1, rgba(0, 0, 0, 0.04));
+  color: var(--dsw-alias-label-primary, #0f1115);
+  font-family: var(--dsw-font-family, -apple-system, BlinkMacSystemFont, 'Segoe UI',
+    Roboto, system-ui, 'PingFang SC', 'Microsoft YaHei', sans-serif);
+  font-size: 13px;
+  line-height: 20px;
+  scrollbar-width: thin;
+  scrollbar-color: var(--dsw-alias-label-caption, rgba(128, 128, 128, 0.5)) transparent;
+}
+.menuItem {
+  display: flex;
+  align-items: center;
+  gap: 9px;
+  width: 100%;
+  border: none;
+  background: transparent;
+  color: var(--dsw-alias-label-primary, #0f1115);
+  font: inherit;
+  text-align: left;
+  padding: 8px 11px;
+  border-radius: 8px;
+  cursor: pointer;
+  white-space: nowrap;
+  transition: background 0.12s ease, color 0.12s ease;
+}
+.menuItem:hover:not(:disabled) { background: var(--dsw-alias-bg-overlay, rgba(0, 0, 0, 0.05)); }
+.menuItem:disabled { opacity: 0.55; cursor: default; }
+.menuItemIcon { flex: none; font-size: 14px; line-height: 1; }
+.menuDivider { height: 1px; margin: 5px 9px; background: var(--dsw-alias-border-l2, rgba(0, 0, 0, 0.1)); }
+
+/* dsh-hardssh */
+.managerGroupHeader {
+  border-bottom: 1px solid var(--dsw-alias-border-l2, rgba(0, 0, 0, 0.1));
+  margin-bottom: 5px;
+}
+
+/* Icon-only round buttons on server rows (edit/delete) */
+.menuItemIconButton {
+  flex: none;
+  width: 22px;
+  height: 22px;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  border: 1px solid var(--dsw-alias-border-l2, rgba(0, 0, 0, 0.15));
+  border-radius: 6px;
+  background: transparent;
+  color: var(--dsw-alias-label-secondary, #4a5060);
+  font-size: 13px;
+  line-height: 1;
+  cursor: pointer;
+  transition: background 0.12s ease, color 0.12s ease, border-color 0.12s ease;
+}
+.menuItemIconButton:hover:not(:disabled) {
+  background: var(--dsw-alias-bg-overlay, rgba(0, 0, 0, 0.06));
+  border-color: var(--dsw-alias-border-l3, rgba(0, 0, 0, 0.12));
+  color: var(--dsw-alias-label-primary, #0f1115);
+}
+.menuItemIconButton:disabled {
+  opacity: 0.4;
+  cursor: default;
+}

package/src/client-http.ts

@@ -0,0 +1,45 @@
+/**
+ * Browser-side HTTP helpers for the dsh-hardssh route clients.
+ * Plain fetch / same-origin — bundled inline into the client bundle.
+ */
+
+/** Error carrying the route's JSON error message and stable code/status. */
+export class HttpApiError extends Error {
+  constructor(
+    message: string,
+    public readonly code?: string,
+    public readonly status?: number,
+  ) {
+    super(message)
+    this.name = 'HttpApiError'
+  }
+}
+
+/** Query-string helper (skips undefined and empty values). */
+export function buildQuery(params: Record<string, string | number | undefined>): string {
+  const search = new URLSearchParams()
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== undefined && value !== '') search.set(key, String(value))
+  }
+  const text = search.toString()
+  return text === '' ? '' : '?' + text
+}
+
+/** Parse a JSON response or throw an HttpApiError (code/status preserved). */
+export async function readJson<T>(response: Response): Promise<T> {
+  let body: unknown
+  try {
+    body = await response.json()
+  } catch {
+    throw new HttpApiError(`HTTP ${response.status}: invalid JSON response`, undefined, response.status)
+  }
+  if (!response.ok) {
+    const record = typeof body === 'object' && body !== null
+      ? body as { error?: unknown; code?: unknown }
+      : undefined
+    const message = typeof record?.error === 'string' ? record.error : `HTTP ${response.status}`
+    const code = typeof record?.code === 'string' ? record.code : undefined
+    throw new HttpApiError(message, code, response.status)
+  }
+  return body as T
+}

package/src/core.ts

@@ -0,0 +1,47 @@
+/**
+ * The shared workspace core: the host store, the SSH engine, and the
+ * workspace ledger, provided as `ctx.hardsshCore` by the main plugin row so
+ * the two switch rows (fs / subprocess) resolve one instance each.
+ */
+
+import type { SshEngine } from './ssh/engine.ts'
+import type { SshHostEntry, SshHostSummary } from './ssh/protocol.ts'
+import type { SshWorkspaceLedger } from './ledger.ts'
+import type { RemoteWorkspaceRunner } from './remote-runner.ts'
+import type { WorkspaceSeamState } from './seam-state.ts'
+
+/** Read-only host-store surface exposed on the core (the write paths live in
+ *  the SSH routes, which get the full store). Avoids coupling the core type
+ *  to either the plaintext HostStore or the vault-backed SecureHostStore. */
+export interface HostStoreView {
+  readonly path: string
+  list(): SshHostEntry[]
+  find(alias: string): SshHostEntry | undefined
+  summarize(entry: SshHostEntry): SshHostSummary
+}
+
+/** One process-wide core shared by every dsh-hardssh row. */
+export interface HardsshCore {
+  hosts: HostStoreView
+  engine: SshEngine
+  /** The SSH-bound workspace ledger (anchor dir -> remote dir). */
+  ledger: SshWorkspaceLedger
+  /** The shared seam state: ledger-derived routing snapshot + per-record
+   *  fs/subprocess instances, consumed by the fs/subprocess switch rows. */
+  seams: WorkspaceSeamState
+  /** Remote-workspace runner: resolve local anchor paths to remote channels
+   *  (git / files / commands) so other plugins (dsh-workbench-tiphareth) can
+   *  operate SSH-bound workspaces transparently. Optional in older builds. */
+  resolveRemote?: RemoteWorkspaceRunner['resolveRemote']
+}
+
+/**
+ * @deprecated Use HardsshCore. Kept as a source-compatible migration alias.
+ */
+export type EasysshCore = HardsshCore
+
+declare module '@deepseek-ai/cordis' {
+  interface Context {
+    hardsshCore: HardsshCore
+  }
+}

package/src/fs.ts

@@ -0,0 +1,85 @@
+/**
+ * The `ctx.fs` switch row: provides the workspace-routing filesystem facade in
+ * the host scope. The local backend (the deployment's sandboxed filesystem) is
+ * mounted in an isolated child scope so its own `ctx.fs` provide never
+ * collides. Routing and per-record remote backends are owned by the SHARED
+ * seam state (hardsshCore.seams): the row only binds its per-record backend
+ * factory and reads the state on every call. Every SSH-bound workspace record
+ * gets its OWN remote backend instance bound to that record's alias + remote
+ * root; the facade routes each call by the session cwd — an anchor path of an
+ * SSH workspace routes remote, everything else stays local. The facade
+ * auto-provides `fs` here because the `fs-sandbox` row is disabled by the
+ * profile patch.
+ *
+ * The seam state re-applies the ledger snapshot synchronously on every
+ * commit, so creating or removing an SSH workspace takes effect without a
+ * plugin restart and the fs/subprocess seams can never disagree. Before the
+ * initial ledger load finishes, routing degrades to local with a one-time
+ * warning for anchor-root paths.
+ *
+ * @module dsh-hardssh/fs
+ */
+
+import type { Context } from '@deepseek-ai/cordis'
+import { SandboxedFileSystem } from '@deepseek-ai/dsh-fs-sandbox'
+import type { HardsshCore } from './core.ts'
+import { isPathUnderAnchor } from './ledger.ts'
+import type { WorkspaceState } from './protocol.ts'
+import { SshFileSystem } from './remote/remote-fs.ts'
+import { WFS_NAMESPACE_MARKER, SwitchFileSystem } from './switch/switch-fs.ts'
+
+declare module '@deepseek-ai/cordis' {
+  interface Context {
+    hardsshCore: HardsshCore
+  }
+}
+
+/** Stable cordis plugin name. */
+export const name = 'hardssh-fs'
+
+/** Services required: the shared workspace core (mode store + engine) and the
+ *  sandbox policy the local backend (`SandboxedFileSystem`) consumes. */
+export const inject = ['hardsshCore', 'sandboxPolicy']
+
+/** A remote backend fixed to one SSH workspace's alias + remote root. */
+function fixedRemoteState(alias: string, remoteRoot: string): () => WorkspaceState {
+  return () => ({ mode: 'remote' as const, alias, remoteRoot })
+}
+
+/** Mount the switching filesystem facade. */
+export function apply(ctx: Context): void {
+  const core = ctx.hardsshCore
+
+  // The local backend lives in an isolated scope: its `fs` provide shadows
+  // only below this scope, so consumers keep resolving our facade.
+  const localCtx = ctx.isolate('fs')
+  const localFs = new SandboxedFileSystem(localCtx, {
+    cwd: process.env.DSH_CWD ?? process.cwd(),
+    diffBasisMaxBytes: 10 * 1024 * 1024,
+  })
+
+  // Bind the per-record remote backend builder into the shared seam state;
+  // instances are built lazily on first route and reused across refreshes.
+  core.seams.bindFs((record) => ({
+    backend: new SshFileSystem(ctx.isolate('fs'), core.engine, fixedRemoteState(record.alias, record.remoteRoot)),
+    namespace: `${WFS_NAMESPACE_MARKER}${record.id.toLowerCase()}/`,
+    anchorPath: record.anchorPath,
+    remoteRoot: record.remoteRoot,
+  }))
+
+  const anchorRoot = core.ledger.anchorsRoot()
+  let warnedUnready = false
+
+  // The SwitchFileSystem constructor registers the `fs` provide on ctx.
+  new SwitchFileSystem(ctx, {
+    local: localFs,
+    worldFor: (cwd) => {
+      if (!core.seams.isReady() && !warnedUnready && cwd !== undefined && isPathUnderAnchor(anchorRoot, cwd)) {
+        warnedUnready = true
+        console.warn('[dsh-hardssh] fs routing is not ready yet (workspace ledger still loading) — operating on the local anchor until the snapshot is applied')
+      }
+      return core.seams.worldForFs(cwd) ?? { backend: localFs, namespace: '' }
+    },
+    worldForNamespace: (namespace) => core.seams.worldForFsNamespace(namespace),
+  })
+}

package/src/host-http.ts

@@ -0,0 +1,74 @@
+/**
+ * Host-side HTTP route helpers for the dsh-hardssh route family.
+ * HOST-ONLY: these import node:http types and must never end up in the
+ * client bundle (the client half never imports this module).
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http'
+
+/** One JSON response. */
+export function writeJson(res: ServerResponse, status: number, body: unknown): void {
+  const payload = JSON.stringify(body)
+  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'referrer-policy': 'no-referrer' })
+  res.end(payload)
+}
+
+/** URL query helper (first value, decoded). */
+export function queryParam(url: URL, name: string): string | undefined {
+  const value = url.searchParams.get(name)
+  return value === null ? undefined : value
+}
+
+/** Loopback literal check plus browser same-origin markers (mirrors dsh-ssh). */
+export function isLoopbackRequest(request: IncomingMessage): boolean {
+  const address = request.socket.remoteAddress
+  if (address !== '127.0.0.1' && address !== '::1' && address !== '::ffff:127.0.0.1') return false
+  const host = request.headers.host
+  if (typeof host !== 'string') return false
+  let hostUrl: URL
+  try {
+    hostUrl = new URL(`http://${host}`)
+  } catch {
+    return false
+  }
+  if (hostUrl.hostname !== '127.0.0.1' && hostUrl.hostname !== 'localhost' && hostUrl.hostname !== '[::1]') return false
+  if (request.headers['sec-fetch-site'] === 'cross-site') return false
+  const origin = request.headers.origin
+  if (origin === undefined) return true
+  try {
+    return new URL(origin).host === hostUrl.host
+  } catch {
+    return false
+  }
+}
+
+export type ReadJsonBodyResult =
+  | { ok: true; body: Record<string, unknown> }
+  | { ok: false; reason: 'too-large' | 'malformed' | 'not-object' }
+
+/**
+ * Read a JSON request body with a hard byte cap. Discriminative result so
+ * the caller keeps its own error mapping (silent undefined vs 400/413).
+ */
+export async function readJsonBody(
+  req: IncomingMessage,
+  maxBytes: number,
+): Promise<ReadJsonBodyResult> {
+  const chunks: Buffer[] = []
+  let size = 0
+  for await (const chunk of req) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    size += buffer.length
+    if (size > maxBytes) return { ok: false, reason: 'too-large' }
+    chunks.push(buffer)
+  }
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(Buffer.concat(chunks).toString('utf8'))
+  } catch {
+    return { ok: false, reason: 'malformed' }
+  }
+  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+    return { ok: false, reason: 'not-object' }
+  }
+  return { ok: true, body: parsed as Record<string, unknown> }
+}