@tiphareth/dsh-hardssh 0.1.2

package/lib/environment-BL1jddfB.js

@@ -0,0 +1,449 @@
+import { randomUUID } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, posix } from "node:path";
+import { SENSITIVE_ENV_PATTERN } from "@deepseek-ai/dsh-subprocess";
+//#region src/ledger.ts
+/**
+* SSH-bound workspace ledger: the mapping from a LOCAL ANCHOR directory (the
+* host-visible workspace path, which sessions use as their cwd) to a REMOTE
+* directory on an SSH host. Persisted as JSON next to dsh-ssh.json so the
+* fs/subprocess seams can route a session whose cwd is an anchor to the
+* remote execution world, and everything else stays local.
+*
+* A ledger record is created through the GUI (pick a host, browse a remote
+* dir, give it a title). The host-side anchor directory is auto-created
+* under ~/.dsh/ssh-workspaces/<id>/; the host workspace registry owns it as
+* a normal local workspace, so session creation/listing/persistence keep
+* working untouched.
+*
+* Mutations are serialized through a per-instance queue and committed as:
+* write temp file → atomic rename → swap memory/index → bump revision →
+* notify subscribers. A persistence failure leaves observable state
+* unchanged and never publishes an event.
+*
+* @module dsh-hardssh/ledger
+*/
+/** Ledger file location: ~/.dsh/dsh-hardssh-workspaces.json. */
+function ledgerPath() {
+	return join(homedir(), ".dsh", "dsh-hardssh-workspaces.json");
+}
+/**
+* Normalize a remote POSIX root: keep '/' as '/', collapse repeated
+* separators and dot segments, reject relative paths and NUL.
+*/
+function normalizeRemoteRoot(raw) {
+	if (raw.includes("\0")) throw new Error(`remoteRoot must not contain NUL (got '${raw}')`);
+	const normalized = posix.normalize(raw.trim());
+	if (!normalized.startsWith("/")) throw new Error(`remoteRoot must be an absolute POSIX path (got '${raw}')`);
+	return normalized === "/" ? "/" : normalized.replace(/\/+$/, "");
+}
+/** Anchor roots: ~/.dsh/ssh-workspaces/<id>/ — visible in the sidebar as
+*  ordinary host workspaces (and thus selectable for sessions). */
+function anchorRoot() {
+	return join(homedir(), ".dsh", "ssh-workspaces");
+}
+/** Default record title when the user gives none. */
+function defaultTitle(remoteRoot, alias) {
+	return `${alias}:${remoteRoot.split("/").filter(Boolean).pop() ?? remoteRoot}`;
+}
+/**
+* Normalize a local anchor path for comparison: Windows anchors are
+* case-insensitive with mixed separators; POSIX anchors stay case-sensitive.
+*/
+function normalizeAnchorPath(path) {
+	if (isWindowsAnchor(path)) {
+		const normalized = path.replace(/\//g, "\\");
+		return trimTrailingSeparators(normalized, windowsRootLength(normalized)).toLowerCase();
+	}
+	return trimTrailingSeparators(path, path.startsWith("/") ? 1 : 0);
+}
+/** True when candidate equals anchor or is one of its descendants. Lexical
+*  comparison over already-resolved paths; deliberately no fs access. */
+function isPathUnderAnchor(anchor, candidate) {
+	const windowsStyle = isWindowsAnchor(anchor);
+	const normalizedAnchor = normalizeAnchorPath(anchor);
+	let normalizedCandidate;
+	if (windowsStyle) {
+		const withWindowsSeparators = candidate.replace(/\//g, "\\");
+		normalizedCandidate = trimTrailingSeparators(withWindowsSeparators, windowsRootLength(withWindowsSeparators)).toLowerCase();
+	} else normalizedCandidate = trimTrailingSeparators(candidate, candidate.startsWith("/") ? 1 : 0);
+	if (normalizedCandidate === normalizedAnchor) return true;
+	const separator = windowsStyle ? "\\" : "/";
+	const descendantPrefix = normalizedAnchor.endsWith(separator) ? normalizedAnchor : `${normalizedAnchor}${separator}`;
+	return normalizedCandidate.startsWith(descendantPrefix);
+}
+/**
+* The in-memory ledger. Loaded lazily on first access; every mutation writes
+* through durably (atomic rename) and is serialized through a per-instance
+* queue. A synchronous anchor index is maintained from the latest committed
+* records so host seams can resolve a cwd/root without awaiting I/O.
+*/
+var SshWorkspaceLedger = class {
+	fileOverride;
+	anchorOverride;
+	records;
+	loadPromise;
+	anchorIndex = [];
+	mutationTail = Promise.resolve();
+	currentRevision = 0;
+	listeners = /* @__PURE__ */ new Set();
+	/** Overridable file location (tests isolate per instance). */
+	constructor(fileOverride, anchorOverride) {
+		this.fileOverride = fileOverride;
+		this.anchorOverride = anchorOverride;
+	}
+	file() {
+		return this.fileOverride ?? ledgerPath();
+	}
+	anchors() {
+		return this.anchorOverride ?? anchorRoot();
+	}
+	anchorFor(id) {
+		return join(this.anchors(), id);
+	}
+	/** Load the ledger once (missing/unreadable/malformed file -> empty ledger). */
+	async ensureLoaded() {
+		if (this.records !== void 0) return;
+		if (this.loadPromise === void 0) this.loadPromise = this.readRecords();
+		await this.loadPromise;
+	}
+	async readRecords() {
+		try {
+			const text = await readFile(this.file(), "utf8");
+			const parsed = JSON.parse(text);
+			this.records = Array.isArray(parsed) ? parsed.filter(isRecord).map(cloneRecord) : [];
+		} catch {
+			this.records = [];
+		}
+		this.reindex();
+	}
+	/** Rebuild the synchronous anchor index from the current records. */
+	reindex() {
+		this.anchorIndex = (this.records ?? []).map((record) => ({
+			anchor: normalizeAnchorPath(record.anchorPath),
+			record
+		})).sort((a, b) => b.anchor.length - a.anchor.length);
+	}
+	/** Persist a proposed record array without touching observable state. */
+	async save(nextRecords) {
+		const target = this.file();
+		await mkdir(join(target, ".."), { recursive: true });
+		const temporary = `${target}.tmp-${process.pid}-${Date.now()}-${randomUUID()}`;
+		try {
+			await writeFile(temporary, JSON.stringify(nextRecords, null, 2), "utf8");
+			await rename(temporary, target);
+		} catch (error) {
+			await rm(temporary, { force: true }).catch(() => void 0);
+			throw error;
+		}
+	}
+	/** Serialize one mutation; a rejected earlier mutation never poisons later ones. */
+	enqueueMutation(operation) {
+		const result = this.mutationTail.then(operation);
+		this.mutationTail = result.then(() => void 0, () => void 0);
+		return result;
+	}
+	/** Commit a computed next state: swap memory, bump revision, notify. */
+	commit(nextRecords, change) {
+		this.records = nextRecords;
+		this.reindex();
+		this.currentRevision += 1;
+		this.emit({
+			...change,
+			revision: this.currentRevision
+		});
+	}
+	emit(change) {
+		for (const listener of [...this.listeners]) try {
+			listener(cloneChange(change));
+		} catch (error) {
+			console.warn("[dsh-hardssh] ledger subscriber failed:", error instanceof Error ? error.message : String(error));
+		}
+	}
+	/** Load the ledger (compat; returns detached copies). */
+	async load() {
+		await this.ensureLoaded();
+		return cloneRecords(this.records ?? []);
+	}
+	/** All records, in creation order (detached copies). */
+	async list() {
+		await this.ensureLoaded();
+		return cloneRecords(this.records ?? []);
+	}
+	/** Current detached snapshot. */
+	async snapshot() {
+		await this.ensureLoaded();
+		return {
+			revision: this.currentRevision,
+			records: cloneRecords(this.records ?? [])
+		};
+	}
+	/** Current in-process snapshot, synchronously (empty before first load).
+	*  The returned records are the live immutable objects — callers must not
+	*  mutate them (commits always replace the array wholesale). */
+	snapshotSync() {
+		return {
+			revision: this.currentRevision,
+			records: this.records ?? []
+		};
+	}
+	/** Current in-process revision (restarts at 0 on process restart). */
+	revision() {
+		return this.currentRevision;
+	}
+	/** Subscribe to committed mutations (no initial event). Returns a disposer. */
+	subscribe(listener) {
+		this.listeners.add(listener);
+		let disposed = false;
+		return () => {
+			if (disposed) return;
+			disposed = true;
+			this.listeners.delete(listener);
+		};
+	}
+	/** Look up by id. */
+	async get(id) {
+		await this.ensureLoaded();
+		const record = this.records?.find((candidate) => candidate.id === id);
+		return record === void 0 ? void 0 : cloneRecord(record);
+	}
+	/** Look up by LOCAL anchor path (resolved). Returns the record whose
+	*  anchor owns the path (the anchor itself or any descendant). */
+	async findByAnchor(path) {
+		await this.ensureLoaded();
+		return this.findByAnchorSync(path);
+	}
+	/** Synchronous anchor lookup (uses the in-memory index). */
+	findByAnchorSync(path) {
+		const canonical = safeRealpathSync(path);
+		if (canonical === void 0) return void 0;
+		for (const { anchor, record } of this.anchorIndex) if (isPathUnderAnchor(anchor, canonical)) return cloneRecord(record);
+	}
+	/** Create a record: materialize the anchor, then persist+commit. */
+	async create(input) {
+		return this.enqueueMutation(async () => {
+			await this.ensureLoaded();
+			const id = randomUUID();
+			const remoteRoot = normalizeRemoteRoot(input.remoteRoot);
+			const record = {
+				id,
+				title: input.title.trim() === "" ? defaultTitle(remoteRoot, input.alias) : input.title.trim(),
+				alias: input.alias,
+				remoteRoot,
+				anchorPath: this.anchorFor(id),
+				createdAt: (/* @__PURE__ */ new Date()).toISOString()
+			};
+			await mkdir(record.anchorPath, { recursive: true });
+			const nextRecords = [...this.records ?? [], record];
+			await this.save(nextRecords);
+			this.commit(nextRecords, {
+				type: "created",
+				record
+			});
+			return cloneRecord(record);
+		});
+	}
+	/** Rename a record (display title only). */
+	async rename(id, title) {
+		return this.enqueueMutation(async () => {
+			await this.ensureLoaded();
+			const records = this.records ?? [];
+			const index = records.findIndex((record) => record.id === id);
+			if (index < 0) return void 0;
+			const before = records[index];
+			const record = {
+				...before,
+				title: title.trim()
+			};
+			const nextRecords = [...records];
+			nextRecords[index] = record;
+			await this.save(nextRecords);
+			this.commit(nextRecords, {
+				type: "renamed",
+				before,
+				record
+			});
+			return cloneRecord(record);
+		});
+	}
+	/** Remove a record. The anchor directory is left in place (a host
+	*  workspace may still reference it; the caller decides on deletion). */
+	async remove(id) {
+		return this.enqueueMutation(async () => {
+			await this.ensureLoaded();
+			const records = this.records ?? [];
+			const index = records.findIndex((record) => record.id === id);
+			if (index < 0) return false;
+			const record = records[index];
+			const nextRecords = [...records.slice(0, index), ...records.slice(index + 1)];
+			await this.save(nextRecords);
+			this.commit(nextRecords, {
+				type: "removed",
+				record
+			});
+			return true;
+		});
+	}
+	/** The anchor root shared by every record (for UI hints). */
+	anchorsRoot() {
+		return this.anchors();
+	}
+};
+/** Guard: a parsed JSON value is a valid record. */
+function isRecord(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const record = value;
+	return typeof record.id === "string" && typeof record.title === "string" && typeof record.alias === "string" && typeof record.remoteRoot === "string" && typeof record.anchorPath === "string";
+}
+/** Synchronous realpath, swallowing errors (a session cwd can vanish mid-flight). */
+function safeRealpathSync(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return;
+	}
+}
+function isWindowsAnchor(path) {
+	return /^[a-zA-Z]:[\\/]/.test(path) || path.startsWith("\\\\") || path.includes("\\");
+}
+function windowsRootLength(path) {
+	if (/^[a-zA-Z]:\\/.test(path)) return 3;
+	if (path.startsWith("\\\\")) {
+		const segments = path.slice(2).split("\\");
+		if (segments.length >= 2 && segments[0] !== "" && segments[1] !== "") return 2 + segments[0].length + 1 + segments[1].length;
+		return 2;
+	}
+	return 0;
+}
+function trimTrailingSeparators(path, minimumLength) {
+	let end = path.length;
+	while (end > minimumLength && (path[end - 1] === "/" || path[end - 1] === "\\")) end -= 1;
+	return path.slice(0, end);
+}
+function cloneRecord(record) {
+	return { ...record };
+}
+function cloneRecords(records) {
+	return records.map(cloneRecord);
+}
+function cloneChange(change) {
+	switch (change.type) {
+		case "created": return {
+			...change,
+			record: cloneRecord(change.record)
+		};
+		case "renamed": return {
+			...change,
+			before: cloneRecord(change.before),
+			record: cloneRecord(change.record)
+		};
+		case "removed": return {
+			...change,
+			record: cloneRecord(change.record)
+		};
+	}
+}
+//#endregion
+//#region src/shell.ts
+/**
+* Canonical POSIX shell single-quoting for remote command construction.
+* Replaces the three near-identical copies that used to live in backend.ts,
+* tools.ts and remote/environment.ts.
+*/
+/** Quote one argument for a POSIX login shell (single-quote, `'\''` for embedded quotes). */
+function shellQuote(value) {
+	return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+//#endregion
+//#region src/remote/environment.ts
+/**
+* Remote-environment scrubbing and caching for the SSH process and terminal
+* launchers. Ported from UynajGI/dsh-ssh (MIT) — adapted to the dsh-ssh
+* engine. The read side is cached per (engine, alias) with a short TTL and
+* merged concurrent requests, so repeated spawns/terminals on one host stop
+* issuing an `env` exec each time (P1-12).
+*/
+/** How long a scrubbed environment stays fresh per alias. */
+const ENVIRONMENT_TTL_MS = 3e4;
+/** Per-engine alias caches (WeakMap so engines are collected with the pool). */
+const caches = /* @__PURE__ */ new WeakMap();
+function cacheFor(engine) {
+	let byAlias = caches.get(engine);
+	if (byAlias === void 0) {
+		byAlias = /* @__PURE__ */ new Map();
+		caches.set(engine, byAlias);
+	}
+	return byAlias;
+}
+/**
+* Read + scrub the remote login environment, cached per (engine, alias).
+* Concurrent requests share one fetch; failures are never cached.
+*/
+function readScrubbedRemoteEnvironment(engine, alias) {
+	const byAlias = cacheFor(engine);
+	const now = Date.now();
+	const existing = byAlias.get(alias);
+	if (existing !== void 0 && existing.expiresAt > now && existing.value !== void 0) return Promise.resolve(existing.value);
+	if (existing?.pending !== void 0) return existing.pending;
+	const pending = fetchScrubbedEnvironment(engine, alias).then((value) => {
+		byAlias.set(alias, {
+			expiresAt: Date.now() + ENVIRONMENT_TTL_MS,
+			value
+		});
+		return value;
+	}, (error) => {
+		byAlias.delete(alias);
+		throw error;
+	});
+	byAlias.set(alias, {
+		expiresAt: 0,
+		pending
+	});
+	return pending;
+}
+/** Drop cached environments for one alias (call after a host config change). */
+function invalidateRemoteEnvironment(engine, alias) {
+	cacheFor(engine).delete(alias);
+}
+/** One `env -0` round-trip, scrubbed (NUL-delimited so values keep newlines/=). */
+async function fetchScrubbedEnvironment(engine, alias) {
+	const result = await engine.exec(alias, "env -0", 1e4);
+	if (!result.success) throw new Error(`subprocess-ssh: cannot read the remote environment: ${result.stderr.trim() || "unknown error"}`);
+	const environment = /* @__PURE__ */ new Map();
+	for (const record of result.stdout.split("\0")) {
+		if (record === "") continue;
+		const separator = record.indexOf("=");
+		if (separator <= 0) continue;
+		const name = record.slice(0, separator);
+		if (name.includes("\0")) continue;
+		environment.set(name, record.slice(separator + 1));
+	}
+	return scrubRemoteEnvironment(environment);
+}
+/**
+* Remove harness-private and credential-shaped names from a remote environment.
+*/
+function scrubRemoteEnvironment(environment) {
+	const scrubbed = /* @__PURE__ */ new Map();
+	for (const [name, value] of environment) {
+		if (name.startsWith("DSH_") || SENSITIVE_ENV_PATTERN.test(name)) continue;
+		scrubbed.set(name, value);
+	}
+	return scrubbed;
+}
+/**
+* Overlay explicit entries and serialize one validated environment for `env -i`.
+*/
+function serializeEnvironment(scrubbed, explicit) {
+	const environment = new Map(scrubbed);
+	for (const [name, value] of Object.entries(explicit ?? {})) {
+		if (name.length === 0 || name.includes("=") || name.includes("\0") || value?.includes("\0") === true) throw new Error("subprocess-ssh: environment entries require non-empty NUL-free names without = and NUL-free values");
+		if (value === void 0) environment.delete(name);
+		else environment.set(name, value);
+	}
+	return [...environment].map(([name, value]) => shellQuote(`${name}=${value}`)).join(" ");
+}
+//#endregion
+export { SshWorkspaceLedger as a, shellQuote as i, readScrubbedRemoteEnvironment as n, isPathUnderAnchor as o, serializeEnvironment as r, normalizeAnchorPath as s, invalidateRemoteEnvironment as t };