dsh-over-ssh 0.1.0 → 0.2.0

package/lib/types/src/host/infra/transport/askpass.d.ts

@@ -1,133 +0,0 @@
-/**
- * Non-interactive **password** authentication for the system `ssh` client, via `SSH_ASKPASS`.
- *
- * Why this module exists: the Tier 2 agent is launched by spawning `ssh` (`ssh <alias> <agent> --stdio`),
- * and the alias transport runs every command the same way. System `ssh` cannot read a password from a pipe,
- * so a password-only connection used to be impossible on any transport that goes through `ssh` — which made
- * "default to Tier 2" silently false for password connections (they were downgraded to `ssh2`). That was
- * never a property of SSH: OpenSSH ≥ 8.4 supports `SSH_ASKPASS_REQUIRE=force`, which runs a helper program
- * to obtain the secret **even with no tty**, exactly the situation a background plugin is in.
- *
- * Two rules make this safe:
- *
- *  1. **The secret never touches the disk.** The helper program carries no secret; it forwards the value of
- *     an environment variable (`DSH_SSH_ASKPASS_SECRET`) that the ssh child process inherits. A leftover
- *     helper file therefore leaks nothing: with the variable absent it prints an empty line and ssh fails
- *     the authentication instead of succeeding with a stale credential.
- *  2. **The secret is never interpolated into a shell or command line.** It travels only as an environment
- *     value, so characters like `&`, `|`, `%`, `^` and quotes need no escaping (a `cmd`-based helper that
- *     echoed the secret would break on those, and its argv would be visible in the process list).
- *
- * Verified on the real host (Windows, OpenSSH_for_Windows_9.5p1): password auth succeeds through a spawned
- * `ssh` whose stdio are pipes, and a **wrong** secret fails — so the helper is genuinely what authenticates.
- *
- * @module dsh-remote-workspace/infra/transport/askpass
- */
-/** The interpreter that runs the helper script. */
-export interface AskpassInterpreter {
-    /** Absolute path of the executable (`node`/Electron). */
-    readonly execPath: string;
-    /** `'win32'` or a POSIX platform id; decides which shim shape is written. */
-    readonly platform: string;
-}
-/** The two files a helper is made of, and the exact text written to each. */
-export interface AskpassFiles {
-    /** The program `SSH_ASKPASS` points at. */
-    readonly helperPath: string;
-    /** The script the helper delegates to. */
-    readonly scriptPath: string;
-    /** Contents of {@link scriptPath}; carries no secret. */
-    readonly script: string;
-    /** Contents of {@link helperPath}; carries no secret. */
-    readonly helper: string;
-    /** Mode to create the files with (POSIX needs the helper executable). */
-    readonly mode: number;
-}
-/**
- * The helper script: print the secret from the environment, then a newline.
- *
- * A trailing newline is required — an ssh askpass program whose output lacks one is rejected
- * (measured: `<nul set /p =` without a newline failed while `echo` succeeded).
- */
-export declare function askpassScript(): string;
-/**
- * The program `SSH_ASKPASS` names.
- *
- * Windows: a `cmd` shim, because ssh executes the path directly and a `.mjs` is not executable there.
- * POSIX: a `sh` script. Both only *launch* the interpreter with the script path, so the secret is never
- * quoted into a command line.
- *
- * @param interpreter - interpreter and platform.
- * @param scriptPath - absolute path of {@link askpassScript}'s file.
- * @returns the shim text.
- */
-export declare function askpassHelper(interpreter: AskpassInterpreter, scriptPath: string): string;
-/**
- * Build the files for one helper directory.
- *
- * @param dir - directory to place the helper in.
- * @param interpreter - interpreter and platform.
- * @returns the file plan (paths plus contents).
- */
-export declare function planAskpassFiles(dir: string, interpreter: AskpassInterpreter): AskpassFiles;
-/**
- * The environment that makes the system `ssh` ask {@link AskpassFiles.helperPath} for the password.
- *
- * `ELECTRON_RUN_AS_NODE=1` is set unconditionally: this plugin normally runs inside the Electron desktop
- * app, where `process.execPath` is the Electron binary and would otherwise open a GUI instead of running
- * the script. Real `node` ignores the variable, so one code path covers both hosts.
- *
- * `DISPLAY` is set because pre-8.4 OpenSSH only consults `SSH_ASKPASS` when it is non-empty, and
- * `SSH_ASKPASS_REQUIRE=force` because ≥ 8.4 additionally requires it when a tty might exist. Setting both
- * makes the helper work on either generation.
- *
- * @param files - the helper plan.
- * @param secret - the password; only ever passed here, never written to a file.
- * @returns environment entries to merge into the `ssh` child's environment.
- */
-export declare function askpassEnvironment(files: AskpassFiles, secret: string): Record<string, string>;
-/** Filesystem surface this module needs; injected so tests never touch a real disk. */
-export interface AskpassIo {
-    /** Create `dir` (and parents). */
-    mkdir(dir: string): Promise<void>;
-    /** Write `content` to `path`, optionally with a POSIX mode. */
-    writeFile(path: string, content: string, mode: number): Promise<void>;
-    /** Remove `dir` recursively; never throws when it is already gone. */
-    remove(dir: string): Promise<void>;
-    /** Create a private directory to hold one helper. */
-    makeTempDir(): Promise<string>;
-}
-/** A live helper: the environment to hand `ssh`, plus a way to take it away again. */
-export interface AskpassHandle {
-    /** Environment entries for the `ssh` child process. */
-    readonly env: Record<string, string>;
-    /** Delete the helper directory. Safe to call more than once. */
-    dispose(): Promise<void>;
-}
-/** Options for {@link createAskpass}. */
-export interface AskpassOptions {
-    /** The password. Held in memory only. */
-    readonly secret: string;
-    /** Interpreter facts; defaults to this process. */
-    readonly interpreter?: AskpassInterpreter;
-    /** Injected filesystem. */
-    readonly io: AskpassIo;
-}
-/**
- * Create a password helper and the environment that uses it.
- *
- * @param options - secret, interpreter and injected filesystem.
- * @returns the handle; call {@link AskpassHandle.dispose} when the connection goes away.
- */
-export declare function createAskpass(options: AskpassOptions): Promise<AskpassHandle>;
-/**
- * Whether a connection's password can be handed to the system `ssh` at all.
- *
- * Only `authKind: 'password'` needs the helper: key and agent connections never prompt, and forcing
- * `BatchMode=no` for them would let a misconfigured host block on an interactive prompt forever.
- *
- * @param authKind - the connection's authentication mode.
- * @returns true when the askpass helper must be wired in.
- */
-export declare function needsAskpass(authKind: 'agent' | 'key' | 'password'): boolean;
-//# sourceMappingURL=askpass.d.ts.map

package/lib/types/src/host/infra/transport/command-pool.d.ts

@@ -1,61 +0,0 @@
-/**
- * Per-connection command session pool.
- *
- * Reusing one established session is what turns "one TCP + SSH handshake per command" into the
- * ≈15× speedup the requirements ask for. The pool owns three concerns:
- *  - single-flight connection establishment per connection id;
- *  - a FIFO concurrency limit per connection;
- *  - idle eviction, so a forgotten connection does not hold a remote session forever.
- *
- * @module dsh-remote-workspace/infra/transport/command-pool
- */
-/** A pooled connection handle; the pool never inspects it. */
-export interface PooledConnection {
-    close(): Promise<void>;
-}
-/** Pool configuration. */
-export interface CommandPoolOptions {
-    /** Maximum commands in flight on one connection. */
-    readonly maxConcurrentPerConnection: number;
-    /** Close a connection that has been idle for this long. */
-    readonly idleTtlMs: number;
-    /** Establish a connection on first use. */
-    readonly open: (connectionId: string) => Promise<PooledConnection>;
-    /** Injectable clock for deterministic tests. */
-    readonly now?: () => number;
-}
-/** Per-connection counters. */
-export interface PoolStats {
-    readonly opens: number;
-    readonly reuses: number;
-    readonly active: number;
-    readonly queued: number;
-    readonly idleClosed: number;
-    readonly failures: number;
-}
-/** Bounded, idle-evicting pool of remote command sessions. */
-export declare class CommandPool {
-    #private;
-    constructor(options: CommandPoolOptions);
-    /** Connection ids currently tracked. */
-    get connectionIds(): readonly string[];
-    /**
-     * Run one task against the pooled connection, opening it on first use.
-     *
-     * @param connectionId - pool key (a connection profile id).
-     * @param task - receives the pooled connection; its rejection propagates to the caller.
-     * @returns the task result.
-     */
-    run<T>(connectionId: string, task: (connection: PooledConnection) => Promise<T>): Promise<T>;
-    /**
-     * Close connections that have been idle past the TTL.
-     *
-     * @returns the number of connections closed.
-     */
-    sweep(): Promise<number>;
-    /** Close every connection; safe to call during plugin disposal. */
-    closeAll(): Promise<void>;
-    /** Counters for one connection, or zeros when it is not tracked. */
-    stats(connectionId: string): PoolStats;
-}
-//# sourceMappingURL=command-pool.d.ts.map

package/lib/types/src/host/infra/transport/fs-commands.d.ts

@@ -1,140 +0,0 @@
-/**
- * Shell commands for the file-write primitives: offset read, positioned write, rename, remove.
- *
- * These live in one module because three transports (alias, agent) execute them and the ssh2 transport
- * deliberately does the same operations through SFTP instead — if the two paths disagree, one of them is
- * wrong and nobody notices until a user's file is truncated.
- *
- * Two guarantees worth naming, because both are easy to get wrong with shell tools:
- *
- *  - **rename must not degrade into a copy.** Coreutils `mv` silently copies and unlinks when `rename(2)`
- *    fails on another filesystem, which would break "move first, confirm, then delete" recycle semantics
- *    (the copy is not atomic and the source may survive). The command therefore compares device ids and
- *    fails loudly instead.
- *  - **removing a directory without `recursive` must fail, not half-succeed.** `rm -f` on a directory does
- *    nothing while reporting success on some platforms.
- *
- * @module dsh-over-ssh/infra/transport/fs-commands
- */
-/** Marker printed when a command refuses to do something the caller must know about. */
-export declare const DSH_COMMAND_ERROR = "DSH_ERROR=";
-/**
- * Read `[offset, offset+maxBytes)` of a file as base64, with the file's size and mtime as a header.
- *
- * `tail -c +N` is 1-based, hence the `+1`. `head -c` bounds the payload before it crosses the wire.
- *
- * @param path - absolute remote path.
- * @param offset - 0-based start offset.
- * @param maxBytes - maximum bytes to return.
- * @returns the shell script (stdout: `DSH_SIZE=`/`DSH_MTIME=` lines, then base64).
- */
-export declare function readRangeCommand(path: string, offset: number, maxBytes: number): string;
-/**
- * Write `bytes` (fed on stdin as base64) at `offset`, leaving earlier bytes untouched.
- *
- * The aligned fast path matters: `dd bs=1` is one syscall per byte, so a 4 MiB chunk at a 4 KiB-aligned
- * offset (the normal case for chunked uploads) would be ~4000× slower than it needs to be.
- *
- * @param path - absolute remote path.
- * @param offset - 0-based offset to write at.
- * @param createParents - create missing parent directories first.
- * @returns the shell script (stdin: base64 payload).
- */
-export declare function writeRangeCommand(path: string, offset: number, createParents: boolean): string;
-/**
- * Create a directory.
- *
- * `recursive: false` **fails** on an existing target (`mkdir` without `-p` reports `EEXIST`), which is the
- * behaviour a 「新建目录」 dialog needs: silently succeeding on a name that is already taken would look like a
- * successful creation and then show the user someone else's folder.
- *
- * @param path - absolute remote path.
- * @param recursive - create parents and tolerate an existing directory.
- * @returns the shell script.
- */
-export declare function mkdirCommand(path: string, recursive: boolean): string;
-/**
- * Print the **device id** of one path, so a caller can tell whether a `rename` between two paths stays on one
- * filesystem.
- *
- * Why this exists: the recycle bin's guarantee is "move first, then confirm", and `renameCommand` refuses a
- * cross-device move rather than degrading to a copy. Choosing a bin location therefore requires knowing whether
- * the candidate directory shares the root's filesystem — the plugin's own `$HOME` looks like the tidy answer and
- * is usually a **different mount** on the sites this runs on (NFS/automount homes), which would make every
- * delete fail. Measured here, never guessed.
- *
- * Both `stat` spellings are tried (GNU `-c %d`, BSD/macOS `-f %d`), and the answer is printed under a header so
- * a shell banner or a warning on stdout cannot be mistaken for it. A path that cannot be stat'ed prints nothing
- * — the caller treats that as "unknown", which is a different answer from "different device".
- *
- * @param path - absolute path to inspect.
- * @returns the shell script.
- */
-export declare function deviceIdCommand(path: string): string;
-/**
- * Parse the device id printed by {@link deviceIdCommand}.
- *
- * @param stdout - the command's stdout.
- * @returns the device id, or `undefined` when the command could not answer.
- */
-export declare function parseDeviceId(stdout: string): string | undefined;
-/**
- * Change one path's permission bits.
- *
- * `mode` is an **octal digit string** (`"755"`, `"0644"`, `"4755"`), never a number: a decimal `755` is
- * meaningless to `chmod`, and the tool layer normalises both spellings to this one so nothing downstream has
- * to guess. The digits are re-validated here rather than trusted — this function's output is a shell script,
- * and a caller that forgot its own check must not be able to inject one.
- *
- * Both tiers run this through their own `exec` (the agent has no `fs.chmod`), so `remote_write`'s `mode` needs
- * no protocol change and behaves identically on Tier 1 and Tier 2.
- *
- * @param path - absolute remote path.
- * @param mode - 3- or 4-digit octal permission string.
- * @returns the shell script.
- * @throws Error when `mode` is not an octal string.
- */
-export declare function chmodCommand(path: string, mode: string): string;
-/**
- * Rename/move a path, refusing to copy across devices and refusing to clobber.
- *
- * **The no-clobber guard is not optional.** `mv -f` replaces a file, and `mv -f src dst` where `dst` is an
- * existing *directory* moves `src` **inside** it — two completely different outcomes from the same command,
- * both silent. A rename dialog must not be able to produce either: it asks to rename A to B, so B existing is
- * a refusal, not a merge. `-n` (no-clobber) is not portable enough to rely on alone, so the check is explicit.
- *
- * @param from - source path.
- * @param to - destination path.
- * @param createParents - create the destination's parent directories.
- * @returns the shell script.
- */
-export declare function renameCommand(from: string, to: string, createParents: boolean): string;
-/**
- * Remove a file, or a directory tree when `recursive` is set.
- *
- * @param path - absolute remote path.
- * @param recursive - allow removing directories and their contents.
- * @returns the shell script.
- */
-export declare function removeCommand(path: string, recursive: boolean): string;
-/** Header cap callers should pass when executing these commands. */
-export declare const FS_COMMAND_MAX_BYTES: number;
-/**
- * Parse a `DSH_ERROR=…` refusal out of a command's output.
- *
- * @param stdout - captured stdout.
- * @param stderr - captured stderr.
- * @returns the code after `DSH_ERROR=`, or `undefined` when the command did not refuse.
- */
-export declare function commandRefusal(stdout: string, stderr: string): string | undefined;
-/**
- * Read one `PREFIX<number>` header line.
- *
- * @param stdout - command output.
- * @param prefix - header prefix, including `=`.
- * @returns the number, or `undefined` when absent or not finite.
- */
-export declare function parseHeaderNumber(stdout: string, prefix: string): number | undefined;
-/** The payload after the last header line, for commands that print base64 last. */
-export declare function payloadAfterHeaders(stdout: string, lastHeader: string): string;
-//# sourceMappingURL=fs-commands.d.ts.map

package/lib/types/src/host/infra/transport/git-status-route.d.ts

@@ -1,63 +0,0 @@
-/**
- * The same-origin HTTP route the directory browser uses to read remote git status.
- *
- * A separate route rather than another action on the roots route: the roots route's actions are the panel's
- * **state machine** (add/remove/list/edit), while this is a read-only observation with its own TTL cache and
- * its own failure vocabulary ("no badges" is not a listing failure). Keeping them apart means a git hiccup can
- * never make a directory listing look failed, which is exactly the degradation the UI promises.
- *
- * Same carrier pattern as the roots/session routes (`ctx.inject(['webServer'], …)`): the packaged runtime
- * constructs the browser carrier after the plugin entries activate, so a bare `ctx.get('webServer')` would miss
- * it and the browser would show `http-404` with the plugin looking healthy.
- *
- * Trust is the **same fence** as the other mutating/observing routes: same-origin only (`Host` vs `Origin`,
- * `Sec-Fetch-Site`), reused from the roots route rather than re-implemented, so the two cannot drift apart.
- *
- * @module dsh-over-ssh/infra/transport/git-status-route
- */
-import { type RootsApiRequest, type RootsApiResponse } from '../../app/roots/roots-api-contract.ts';
-import type { GitStatusService, GitStatusSnapshot } from './git-status.ts';
-/** The exact path this route is served at. The client duplicates it (it cannot import host modules). */
-export declare const GIT_STATUS_API_PATH = "/api/over-ssh/git-status";
-/** The browser HTTP carrier, narrowed to the one method this route needs. */
-export interface GitStatusRouteHost {
-    register(route: {
-        readonly kind: 'exact';
-        readonly path: string;
-        readonly handler: (req: never, res: never) => Promise<void>;
-    }): () => void;
-}
-/** A provider that hands the carrier over when it appears (the real one is `ctx`). */
-export interface GitStatusRouteHostProvider {
-    inject(names: readonly string[], callback: (scoped: {
-        get(name: string): unknown;
-    }) => void | (() => void)): unknown;
-}
-/** The handler factory's dependencies. */
-export interface GitStatusApiDeps {
-    readonly service: Pick<GitStatusService, 'status'>;
-}
-/** One answer: the snapshot, projected for the browser (no backend/transport details leave the host). */
-export declare function toPublicAnswer(snapshot: GitStatusSnapshot): Record<string, unknown>;
-/**
- * Build the route handler (decoupled from cordis, so tests drive it with fake req/res).
- *
- * @param deps - the git status service.
- * @returns the handler pair.
- */
-export declare function createGitStatusApi(deps: GitStatusApiDeps): {
-    readonly handle: (req: RootsApiRequest, res: RootsApiResponse) => Promise<void>;
-};
-/**
- * Register the route on the browser carrier, whenever that carrier appears.
- *
- * Best effort by construction: a composition without `webServer` (headless) has no browser, so losing this route
- * must not fail activation. Registration errors (an exact-path collision with another plugin) are swallowed on
- * purpose — the route is a convenience for a panel, not a contract the plugin depends on.
- *
- * @param provider - the deferred carrier (`ctx` in the composition).
- * @param deps - the git status service.
- * @returns nothing; the registration lives and dies with the plugin fiber.
- */
-export declare function registerGitStatusRoute(provider: GitStatusRouteHostProvider, deps: GitStatusApiDeps): void;
-//# sourceMappingURL=git-status-route.d.ts.map

package/lib/types/src/host/infra/transport/git-status.d.ts

@@ -1,101 +0,0 @@
-/**
- * Remote git status: one thin service with a **bounded** cache, in front of `git.status`.
- *
- * Why a service instead of putting this on {@link RemoteBackend}: the caller (the directory browser) asks about
- * a *browsed directory*, not about a root, and it asks once per level; the resolution root→(connection, path)
- * and the TTL cache are the same for every backend. `@deepseek-ai/dsh-api-workspace-files`-style consumers poll
- * far more often than a human navigates, so an uncached round trip per listing would be one git process per
- * keystroke-adjacent event.
- *
- * Cache discipline follows the repository's rule (count cap + byte cap + TTL, all named):
- *  - **TTL 5 s** — the UI shows a badge set that is one navigation old; 5 s is short enough that a save is
- *    visible on the next level change, long enough that a back-and-forth navigation costs no git process;
- *  - **entries cap 64** — one entry per (connection, root); more roots than that is not a browsing session;
- *  - **bytes cap 4 MiB** — the retained snapshots are capped too (2000 changes / 512 KiB of paths each), so the
- *    cache cannot grow with a repository's size.
- *
- * Tier 1 has **no** fallback by decision: there is no protocol frame, and shelling out `git status` from the
- * host would reintroduce command assembly/quoting into the browser's data path while Tier 1 cannot even probe
- * whether the directory is a work tree. The service answers `available: false` and the UI draws no badges.
- *
- * @module dsh-over-ssh/infra/transport/git-status
- */
-import type { AgentGitChangeStatus } from './agent/agent-protocol-types.ts';
-import { type VersionedCacheStats } from '../cache/versioned.ts';
-/** One normalized change status (the agent normalizes porcelain's XY columns into exactly these). */
-export type GitChangeStatus = AgentGitChangeStatus;
-/** One changed path, relative to the queried root. */
-export interface GitStatusChange {
-    readonly path: string;
-    readonly status: GitChangeStatus;
-}
-/**
- * What one browser level needs to draw badges.
- *
- * `available: false` is a **normal** answer (Tier 1, an old agent, a non-work-tree root): the browser draws no
- * badges and keeps browsing. `reason` is diagnostics only — never shown as a listing failure.
- */
-export interface GitStatusSnapshot {
-    readonly available: boolean;
-    readonly reason?: string;
-    /** Root the answer belongs to, when there is one. */
-    readonly root?: string;
-    /** The browsed directory, relative to {@link root} ('' when the browsed path *is* the root). */
-    readonly directory?: string;
-    /** Branch name; absent for a detached HEAD (the UI must not substitute one). */
-    readonly branch?: string;
-    /** Changes **relative to {@link root}** (the UI joins them with {@link directory}). */
-    readonly changes: readonly GitStatusChange[];
-    /** One of the agent's/this service's caps fired, so the list is a prefix. */
-    readonly truncated: boolean;
-}
-/** One query: which connection, which browsed remote path. */
-export interface GitStatusQuery {
-    readonly connectionId: string;
-    readonly path: string;
-}
-/** Everything {@link createGitStatusService} needs, injected so tests need no transport and no clock. */
-export interface GitStatusServiceDeps {
-    /** Resolve one connection's transport; `undefined` means Tier 1 / not configured. */
-    readonly transportFor: (connectionId: string) => Promise<unknown> | unknown;
-    /**
-     * The remote root that contains `path`, or `undefined` when no registered root covers it.
-     *
-     * Root-local rather than global: `git status` paths are relative to the repository root, and the browser
-     * matches them against the level it listed, so the service must know which root the answer belongs to.
-     */
-    readonly resolveRoot: (connectionId: string, path: string) => string | undefined;
-    readonly now?: () => number;
-    /** Freshness window; default {@link DEFAULT_GIT_STATUS_TTL_MS}. */
-    readonly ttlMs?: number;
-    readonly maxEntries?: number;
-    readonly maxBytes?: number;
-    /** Per-snapshot caps (independent of the cache caps): more changes than this are cut with `truncated`. */
-    readonly maxChanges?: number;
-    readonly maxPathBytes?: number;
-}
-/** Defaults, all named (repository rule: a cache names a count cap, a byte cap and a TTL). */
-export declare const DEFAULT_GIT_STATUS_TTL_MS = 5000;
-export declare const DEFAULT_GIT_STATUS_MAX_ENTRIES = 64;
-export declare const DEFAULT_GIT_STATUS_MAX_BYTES: number;
-export declare const DEFAULT_GIT_STATUS_MAX_CHANGES = 2000;
-export declare const DEFAULT_GIT_STATUS_MAX_PATH_BYTES: number;
-/** The status→(code, UI) table is owned by the agent; this service only caps and caches. */
-export interface GitStatusService {
-    /** Read one browsed directory's badge data (cached). */
-    status(query: GitStatusQuery, signal?: AbortSignal): Promise<GitStatusSnapshot>;
-    /** Drop the cached snapshot of one connection (its transport was retired or edited). */
-    invalidate(connectionId?: string): void;
-    /** Cache counters, for diagnostics and tests. */
-    readonly cacheStats: VersionedCacheStats;
-}
-export declare function createGitStatusService(deps: GitStatusServiceDeps): GitStatusService;
-/**
- * The browsed directory, relative to the root ('' when they are the same).
- *
- * Both sides are normalized first: the caller's path may carry a trailing slash, and the root comes from the
- * registry. A path outside the root cannot happen (`resolveRoot` only answers covering roots) but returns the
- * empty string rather than a bogus relative path.
- */
-export declare function relativeDirectory(root: string, path: string): string;
-//# sourceMappingURL=git-status.d.ts.map

package/lib/types/src/host/infra/transport/node-spawn.d.ts

@@ -1,26 +0,0 @@
-/**
- * The real process spawner behind {@link AliasTransport}.
- *
- * The transport itself never touches `node:child_process`, which is what keeps its tests
- * deterministic; this module is the thin, deliberately boring adapter that runs the system `ssh`.
- *
- * Bounded everywhere: stdout/stderr are capped (a chatty remote command must not grow memory),
- * a deadline kills the child, and an abort signal kills it too. `stdin` is written once and then
- * closed, so a command that reads input does not hang the plugin.
- *
- * @module dsh-over-ssh/infra/transport/node-spawn
- */
-import type { SpawnFn, SpawnOptions, SpawnResult } from './ssh/alias-transport.ts';
-/**
- * Build the spawner used in production.
- *
- * @param options - optional binary overrides for tests and non-default installations.
- * @returns a `SpawnFn` compatible with the alias transport.
- */
-export declare function createNodeSpawner(options?: {
-    readonly defaultTimeoutMs?: number;
-    readonly maxBytes?: number;
-}): SpawnFn;
-/** Narrow view of the spawner's options, re-exported for callers that build their own. */
-export type { SpawnFn, SpawnOptions, SpawnResult };
-//# sourceMappingURL=node-spawn.d.ts.map

package/lib/types/src/host/infra/transport/session-window.d.ts

@@ -1,51 +0,0 @@
-/**
- * 客户端侧的在飞窗口记账（镜像代理的 `sessionTable`，见 protocol.md §9.3）。
- *
- * 为什么单独成类：这段逻辑有**自己的状态**（连接级在飞数、每会话在飞/排队计数、等待者队列）
- * 和**自己的不变量**（预留名额只给"一个都没占"的会话；取消与名额释放必须都能唤醒等待者），
- * 却和"帧编解码 / RPC 关联 / blob 通道"挤在同一个 3.4k 行文件里。抽出来之后：
- *
- *   1. 它**不依赖**任何传输细节，可以脱离 ssh 与协议单独测（`tests/session-window.test.ts`）；
- *   2. `AgentProtocolClient` 只剩"发请求 / 收响应"的编排；
- *   3. 代理侧的 `sessionTable` 与它是同一个模型的两种实现，两边的注释可以互相对照。
- *
- * 三条规则与代理侧 `takeLocked` 逐条对应：
- *   ① 每会话上限 = `window / 参与会话数`（至少 1）；
- *   ② 总在飞不得超过 `window + 1`；
- *   ③ 超出 `window` 的那一个名额只发给当前 `in-flight == 0` 的会话（"留给新会话的门"）。
- *
- * @module dsh-over-ssh/infra/transport/session-window
- */
-export declare class SessionWindow {
-    #private;
-    constructor(maxInFlight: number);
-    /** Slots held right now (diagnostics and tests). */
-    get inFlight(): number;
-    /** The configured connection-wide window. */
-    get max(): number;
-    /**
-     * Wait for a slot of `session`'s share and commit it.
-     *
-     * `isLost` lets the owner abort the wait when the connection is declared dead: the loop condition
-     * mirrors the pre-extraction behaviour exactly (wake up, re-check, then either throw `CANCELLED`
-     * or admit).
-     */
-    acquire(session: string, signal?: AbortSignal, isLost?: () => boolean): Promise<void>;
-    /** Release one slot of `session` and wake every parked caller (they re-check their own share). */
-    release(session: string): void;
-    /** Sessions that currently hold a slot or are parked; used for the per-session cap. */
-    engagedSessions(): number;
-    /** Per-session in-flight cap, mirroring the agent's `window / engagedSessions` (at least 1). */
-    sessionCap(): number;
-    /** Whether `session` may take a slot right now (same three rules as the agent's `takeLocked`). */
-    canAdmit(session: string): boolean;
-    /** Commit the slot {@link canAdmit} promised. */
-    admit(session: string): void;
-    /** Register a parked caller for `session` (so it counts as engaged while it waits). */
-    park(session: string): void;
-    /** Unregister a parked caller (it is about to proceed or give up). */
-    unpark(session: string): void;
-    /** Wake every parked caller (a slot freed up, or the connection died). */
-    wakeAllWaiters(): void;
-}
-//# sourceMappingURL=session-window.d.ts.map

package/lib/types/src/host/infra/transport/shell-quote.d.ts

@@ -1,59 +0,0 @@
-/**
- * POSIX shell quoting for remote command construction.
- *
- * Remote commands are the plugin's one injection surface: `ssh <alias> <command>` runs the
- * command through the remote login shell, so every interpolated value must be quoted. The
- * `argv`-first design keeps quoting to the places that genuinely need a shell.
- *
- * @module dsh-remote-workspace/infra/transport/shell-quote
- */
-/**
- * Quote one value for a POSIX shell so it cannot be interpreted.
- *
- * Uses single quotes; an embedded single quote is closed, escaped and reopened.
- *
- * @param value - raw value.
- * @returns a shell-safe literal.
- */
-export declare function shellQuote(value: string): string;
-/** Quote several values and join them with spaces. */
-export declare function shellQuoteAll(values: readonly string[]): string;
-/** How a remote command is assembled. */
-export interface RemoteCommandOptions {
-    /** Directory to `cd` into before running; omitted leaves the remote default. */
-    readonly cwd?: string;
-    /** Environment assignments applied to the command only. */
-    readonly env?: Readonly<Record<string, string>>;
-}
-/**
- * Build a remote command string from an argv vector.
- *
- * @param argv - executable followed by arguments; never shell-interpreted as a whole.
- * @param options - optional `cwd` and environment.
- * @returns a command string safe to pass as the single `ssh` command argument.
- * @throws SshDevError when `argv` is empty or a value carries a NUL.
- */
-export declare function buildRemoteCommand(argv: readonly string[], options?: RemoteCommandOptions): string;
-/**
- * Prefix lines that make a **script** honour `cwd` and `env`.
- *
- * The argv path builds these into one command; the script path must apply them too, because dropping them
- * silently is the worst outcome — a real-host run showed `remote_exec { cwd: 'src' }` running in `$HOME` and
- * reporting success. Shared by every shell transport so the two paths cannot drift apart again.
- *
- * @param request - requested `cwd` and environment.
- * @returns prefix lines, `cd` first; empty when neither was requested.
- * @throws SshDevError when an environment name is not a shell identifier.
- */
-export declare function scriptPrefixes(request: RemoteCommandOptions): readonly string[];
-/**
- * Build a remote command from a raw script body.
- *
- * The caller owns the script text; values interpolated into it must already be quoted with
- * {@link shellQuote}.
- *
- * @param script - POSIX shell script body.
- * @returns the command string.
- */
-export declare function buildRemoteScript(script: string): string;
-//# sourceMappingURL=shell-quote.d.ts.map