dsh-remote-sudo 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dsh-remote-sudo contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,185 @@
-# Temporary Holding Version
+# dsh-remote-sudo
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+![CI](https://github.com/seudut/dsh-remote-sudo/actions/workflows/ci.yml/badge.svg)
+
+DSH 的远端 sudo 密码面板：在输入框位置弹出，密码只走 stdin，不进对话、工具参数、环境变量或磁盘。
+
+A composer-hosted sudo password prompt for DeepSeek Harness: the password goes to the remote `sudo` over stdin and never enters the transcript, tool arguments, environment, or disk.
+
+[中文](#中文) · [English](#english)
+
+![DSH composer sudo password panel](docs/panel.png)
+
+---
+
+## 中文
+
+### 功能
+
+- **composer 面板**：接管输入框，显示主机、命令、密码；Enter 提交，Esc 取消。
+- **单一缓存开关**：`passwordTtlMs: 0` 每次都要密码；正整数时密码只在宿主内存保留该时长。
+- **不依赖 sudo ticket**：每次执行后 `sudo -k`，不假设 ticket 能跨 ssh 复用。
+- **自动探测 sudo**：先试常见绝对路径，再用 `command -v sudo` 兜底。
+- **中英文**：跟随 DSH 语言；root 命令的 stdin 固定 `/dev/null`。
+
+### 安装
+
+**从 npm（推荐）**：
+
+```bash
+dsh plugin --profile desktop add dsh-remote-sudo
+```
+
+**从 GitHub**：
+
+```bash
+dsh plugin --profile desktop add github:seudut/dsh-remote-sudo#v0.1.0
+```
+
+或在插件管理器里选“从 Git 仓库安装”，填 `github:seudut/dsh-remote-sudo#v0.1.0`。
+
+然后在 profile 的 `cordis.patch.yml` 加入：
+
+```yaml
+- insert:
+    - id: sudo-askpass
+      name: 'dsh-remote-sudo'
+```
+
+重启 DSH。前置条件：`ssh <host>` 能密钥登录。
+
+插件管理器安装会同时处理 bundle 选择；命令行安装需要手动加这一行。本地开发时，把 `github:...` 换成插件目录的绝对路径即可。
+
+### 配置
+
+```yaml
+config:
+  passwordTtlMs: 0   # 0 = 每次都要密码；正整数 = 内存缓存毫秒数
+```
+
+| 键 | 默认 | 说明 |
+|---|---|---|
+| `passwordTtlMs` | `0` | `0` = 每次都要密码；正整数 = 密码在宿主内存保留的毫秒数 |
+
+### 使用
+
+让 agent 调用 `remote_sudo`：
+
+> 用 `remote_sudo` 在 aliyun 上执行 `apt-get update`
+
+| 参数 | 必填 | 说明 |
+|---|---|---|
+| `host` | 是 | `~/.ssh/config` 别名 |
+| `command` | 是 | 远端 root 命令 |
+| `description` | 否 | 面板里的短标签 |
+
+需要密码时弹面板；`passwordTtlMs` 内不重复弹；取消/停止会结束调用。
+
+### 安全边界
+
+- **能挡**：argv、环境变量、shell history、工具参数、对话记录、远端磁盘、SSH 明文传输。
+- **挡不住**：浏览器插件域（任何 client 插件都能读输入）、宿主内存、本机回环 HTTP、被入侵的远端、JS 内存残留、单因子。
+- **建议**：专用 sudo 密码；Web UI 只绑 loopback 或上 HTTPS；需要更强隔离时用原生 askpass、Touch ID 或 scoped `NOPASSWD`。
+
+### 限制
+
+- 只支持 SSH 远端，不支持本机 root。
+- 没有内置超时：密码等待和命令执行都会一直阻塞，直到回答/取消/ssh 结束。
+- 取消/停止只杀本地 ssh，远端进程不保证停止；需要硬上限时在远端命令里用 `timeout`。
+- 同时只展示一个 prompt；远端需 POSIX shell + sudo。
+
+### 开发
+
+```bash
+npm test
+node test/real-host-probe.mjs   # 手动：真实主机 + 错误密码验证链路
+```
+
+---
+
+## English
+
+### Features
+
+- **Composer panel**: takes over the input box with host, command, and password; Enter submits, Esc cancels.
+- **One cache knob**: `passwordTtlMs: 0` asks every call; a positive value keeps the password in host memory for that window.
+- **No sudo ticket reuse**: runs `sudo -k` after every command and never assumes a no-TTY ticket survives across ssh.
+- **Auto-detect sudo**: common absolute paths first, then `command -v sudo`.
+- **Bilingual**: follows the DSH locale; the root command's stdin is always `/dev/null`.
+
+### Install
+
+**From npm (recommended)**:
+
+```bash
+dsh plugin --profile desktop add dsh-remote-sudo
+```
+
+**From GitHub**:
+
+```bash
+dsh plugin --profile desktop add github:seudut/dsh-remote-sudo#v0.1.0
+```
+
+Or use the plugin manager's "install from Git repository" with `github:seudut/dsh-remote-sudo#v0.1.0`.
+
+Then add this row to the profile's `cordis.patch.yml`:
+
+```yaml
+- insert:
+    - id: sudo-askpass
+      name: 'dsh-remote-sudo'
+```
+
+Restart DSH. Requires key-based `ssh <host>` access.
+
+The plugin manager also selects the bundle; a CLI install needs this row manually. For local development, replace the `github:...` spec with the absolute path of the checkout.
+
+### Configuration
+
+```yaml
+config:
+  passwordTtlMs: 0   # 0 = ask every call; positive = in-memory TTL in ms
+```
+
+| Key | Default | Meaning |
+|---|---|---|
+| `passwordTtlMs` | `0` | `0` asks every call; a positive value is the in-memory password TTL in milliseconds |
+
+### Usage
+
+Ask the agent to call `remote_sudo`:
+
+> Use `remote_sudo` to run `apt-get update` on aliyun
+
+| Argument | Required | Meaning |
+|---|---|---|
+| `host` | yes | SSH alias from `~/.ssh/config` |
+| `command` | yes | root command to run remotely |
+| `description` | no | short label shown in the panel |
+
+The panel appears when a password is needed; within `passwordTtlMs` it does not ask again. Cancel/stop ends the call.
+
+### Security
+
+- **Protected**: argv, environment, shell history, tool arguments, transcript, remote disk, plaintext transport.
+- **Not protected**: the browser plugin realm (any client plugin can read the input), host memory, loopback HTTP, a compromised remote, JS memory residue, a single factor.
+- **Recommendations**: a dedicated sudo password; bind the Web UI to loopback or use HTTPS; for stronger isolation use a native askpass, Touch ID, or scoped `NOPASSWD`.
+
+### Limitations
+
+- Remote SSH only; no local root.
+- No built-in timeout: both the password wait and the command run block until answered, cancelled, or ssh exits.
+- Cancel/stop kills the local ssh; the remote process is not guaranteed to stop. Use `timeout` in the remote command for a hard limit.
+- One prompt at a time; the remote must be POSIX with sudo.
+
+### Development
+
+```bash
+npm test
+node test/real-host-probe.mjs   # manual: real host + wrong password
+```
+
+## License
+
+MIT

package/client.js

@@ -0,0 +1,367 @@
+/**
+ * dsh-remote-sudo — Client half.
+ *
+ * Long-polls the Host route for a pending sudo prompt, publishes it as a
+ * `uiSession` pending interaction, and takes over `conversation.composer`
+ * exactly like the approval panel: the prompt replaces the composer while it
+ * is pending. The password travels browser → Host over the same authenticated
+ * origin; it never enters the session log or a tool call.
+ */
+
+window.__ModuleLoader__.load({
+  id: 'dsh-remote-sudo',
+  factory(require) {
+    const React = require('react')
+    const h = React.createElement
+    const { useCallback, useEffect, useRef, useState } = React
+
+    const BASE = '/_dsh/dsh-remote-sudo'
+    const POLL_WAIT_MS = 20000
+    const RETRY_DELAY_MS = 2000
+    const KIND = 'sudo-password'
+    const NS = 'dsh-remote-sudo'
+
+    /** Simplified Chinese dictionary. */
+    const zh = {
+      aria: 'sudo 授权',
+      strip: '需要 sudo 密码',
+      headline: '在 {host} 上以 root 执行',
+      placeholder: 'sudo 密码',
+      cancel: '取消',
+      run: '执行',
+      running: '执行中…',
+      'error.expired': '这次授权已过期，请重新发起',
+      'error.empty': '请输入密码',
+      'error.failed': '提交失败，请重试',
+    }
+
+    /** English dictionary. */
+    const en = {
+      aria: 'sudo authorization',
+      strip: 'sudo password required',
+      headline: 'Run as root on {host}',
+      placeholder: 'sudo password',
+      cancel: 'Cancel',
+      run: 'Run',
+      running: 'Running…',
+      'error.expired': 'This authorization expired. Start it again.',
+      'error.empty': 'Enter a password.',
+      'error.failed': 'Could not submit. Try again.',
+    }
+
+    const S = {
+      root: {
+        display: 'flex',
+        flexDirection: 'column',
+        alignItems: 'center',
+        padding: '8px calc(var(--dsh-composer-side-clearance, 0px) + 16px) 12px',
+      },
+      card: {
+        width: '100%',
+        maxWidth: 'var(--dsh-chat-content-width, 760px)',
+        overflow: 'hidden',
+        border: '1px solid var(--dsw-alias-state-warn-secondary, rgba(214, 158, 46, 0.35))',
+        borderRadius: 'var(--dsw-radius-xl, 14px)',
+        background: 'var(--dsw-specific-input-major, var(--dsw-alias-bg-layer-2, #1e1e22))',
+        boxShadow: 'var(--dsw-shadow-lv2, 0 8px 24px rgba(0, 0, 0, 0.25))',
+        color: 'var(--dsw-alias-label-primary, #f3f3f3)',
+        font: '14px/1.55 system-ui, -apple-system, "Segoe UI", sans-serif',
+      },
+      strip: {
+        display: 'flex',
+        alignItems: 'center',
+        gap: '8px',
+        padding: '10px 16px',
+        background: 'var(--dsw-alias-state-warn-tertiary, rgba(214, 158, 46, 0.12))',
+        color: 'var(--dsw-alias-state-warn-primary, #d69e2e)',
+        fontSize: '13px',
+        lineHeight: '18px',
+      },
+      dot: {
+        width: '6px',
+        height: '6px',
+        borderRadius: '50%',
+        background: 'currentColor',
+        flexShrink: 0,
+      },
+      body: {
+        display: 'flex',
+        flexDirection: 'column',
+        gap: '8px',
+        padding: '12px 16px 0',
+        maxHeight: 'var(--dsh-composer-text-max-height, 40vh)',
+        overflowY: 'auto',
+      },
+      headline: {
+        fontSize: '15px',
+        fontWeight: 500,
+        lineHeight: '24px',
+      },
+      command: {
+        fontFamily: 'var(--ds-font-family-code, ui-monospace, SFMono-Regular, Menlo, monospace)',
+        fontSize: '13px',
+        lineHeight: '20px',
+        color: 'var(--dsw-alias-label-tertiary, #9a9aa3)',
+        wordBreak: 'break-all',
+        whiteSpace: 'pre-wrap',
+      },
+      description: {
+        fontSize: '12px',
+        lineHeight: '18px',
+        color: 'var(--dsw-alias-label-secondary, #b9b9c0)',
+      },
+      input: {
+        width: '100%',
+        boxSizing: 'border-box',
+        padding: '8px 12px',
+        borderRadius: 'var(--dsw-radius-md, 8px)',
+        border: '1px solid var(--dsw-alias-border-l3, rgba(127, 127, 127, 0.35))',
+        background: 'var(--dsw-alias-bg-base, rgba(0, 0, 0, 0.2))',
+        color: 'inherit',
+        fontSize: '14px',
+        outline: 'none',
+      },
+      error: {
+        color: 'var(--dsw-alias-state-error-primary, #e5484d)',
+        fontSize: '12px',
+      },
+      actionRow: {
+        display: 'flex',
+        justifyContent: 'flex-end',
+        gap: '8px',
+        padding: '14px 16px',
+      },
+      reject: {
+        padding: '6px 14px',
+        borderRadius: 'var(--dsw-radius-md, 8px)',
+        border: '1px solid var(--dsw-alias-border-l2, rgba(127, 127, 127, 0.3))',
+        background: 'transparent',
+        color: 'var(--dsw-alias-label-secondary, #b9b9c0)',
+        fontSize: '13px',
+        cursor: 'pointer',
+      },
+      accept: {
+        padding: '6px 14px',
+        borderRadius: 'var(--dsw-radius-md, 8px)',
+        border: '1px solid transparent',
+        background: 'var(--dsw-alias-button-primary-fill, #3b82f6)',
+        color: 'var(--dsw-alias-label-primary-foreground, #fff)',
+        fontSize: '13px',
+        fontWeight: 600,
+        cursor: 'pointer',
+      },
+    }
+
+    /** One published prompt; the composer panel drives answer/cancel. */
+    class SudoPrompt {
+      constructor(value) {
+        this.kind = KIND
+        this.key = value.id
+        this.id = value.id
+        this.host = value.host
+        this.command = value.command
+        this.description = value.description
+        this.sessionId = value.sessionId
+        this.settled = false
+        this.completion = new Promise((resolve) => {
+          this.resolveCompletion = resolve
+        })
+      }
+
+      settle() {
+        if (this.settled) return
+        this.settled = true
+        this.resolveCompletion()
+      }
+
+      async answer(password) {
+        if (this.settled) return
+        const response = await fetch(`${BASE}/answer`, {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ id: this.id, password }),
+        })
+        if (!response.ok) {
+          const body = await response.json().catch(() => ({}))
+          throw new Error(typeof body.error === 'string' ? body.error : `HTTP ${response.status}`)
+        }
+        this.settle()
+      }
+
+      async cancel() {
+        if (this.settled) return
+        try {
+          await fetch(`${BASE}/cancel`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ id: this.id }),
+          })
+        } catch {
+          // The Host may already have dropped the prompt; cancelling is best effort.
+        }
+        this.settle()
+      }
+    }
+
+    function SudoPromptPanel(props) {
+      const prompt = props.matched
+      const t = typeof props.t === 'function' ? props.t : (key) => key
+      const [password, setPassword] = useState('')
+      const [busy, setBusy] = useState(false)
+      const [error, setError] = useState(null)
+      const inputRef = useRef(null)
+      const rootRef = useRef(null)
+
+      useEffect(() => {
+        if (inputRef.current !== null) inputRef.current.focus()
+      }, [])
+
+      const describeError = useCallback((cause) => {
+        const message = cause instanceof Error ? cause.message : String(cause)
+        if (message.includes('no pending prompt')) return t('error.expired')
+        if (message.includes('password required')) return t('error.empty')
+        return t('error.failed')
+      }, [t])
+
+      const cancel = useCallback(async () => {
+        if (busy) return
+        setBusy(true)
+        setError(null)
+        try {
+          await prompt.cancel()
+        } catch (cause) {
+          setError(describeError(cause))
+        } finally {
+          setBusy(false)
+        }
+      }, [prompt, busy, describeError])
+
+      const submit = useCallback(async () => {
+        if (busy || password.length === 0) return
+        setBusy(true)
+        setError(null)
+        try {
+          await prompt.answer(password)
+        } catch (cause) {
+          setError(describeError(cause))
+        } finally {
+          setBusy(false)
+        }
+      }, [prompt, busy, password, describeError])
+
+      useEffect(() => {
+        const onKeyDown = (event) => {
+          if (event.key !== 'Escape') return
+          const root = rootRef.current
+          if (root !== null && !root.contains(document.activeElement)) return
+          event.preventDefault()
+          cancel()
+        }
+        window.addEventListener('keydown', onKeyDown, true)
+        return () => window.removeEventListener('keydown', onKeyDown, true)
+      }, [cancel])
+
+      return h(
+        'div',
+        { ref: rootRef, style: S.root },
+        h(
+          'div',
+          { style: S.card, role: 'group', 'aria-label': t('aria') },
+          h('div', { style: S.strip }, h('span', { style: S.dot }), t('strip')),
+          h(
+            'div',
+            { style: S.body },
+            h('div', { style: S.headline }, t('headline', { host: prompt.host })),
+            h('div', { style: S.command }, prompt.command),
+            prompt.description ? h('div', { style: S.description }, prompt.description) : null,
+            h('input', {
+              ref: inputRef,
+              type: 'password',
+              value: password,
+              autoComplete: 'off',
+              spellCheck: false,
+              placeholder: t('placeholder'),
+              disabled: busy,
+              style: S.input,
+              onChange: (event) => setPassword(event.target.value),
+              onKeyDown: (event) => {
+                if (event.key === 'Enter') {
+                  event.preventDefault()
+                  submit()
+                }
+              },
+            }),
+            error ? h('div', { style: S.error }, error) : null,
+          ),
+          h(
+            'div',
+            { style: S.actionRow },
+            h('button', { type: 'button', style: S.reject, disabled: busy, onClick: cancel }, t('cancel')),
+            h(
+              'button',
+              { type: 'button', style: S.accept, disabled: busy || password.length === 0, onClick: submit },
+              busy ? t('running') : t('run'),
+            ),
+          ),
+        ),
+      )
+    }
+
+    return {
+      inject: ['locale', 'slots', 'uiSession'],
+      apply(ctx) {
+        ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dsh-remote-sudo: dictionaries')
+        const publish = ctx.uiSession.registerPendingInteraction((pending) =>
+          pending.kind === KIND ? 3 : 0,
+        )
+        const controller = new AbortController()
+        let active = null
+
+        async function poll() {
+          while (!controller.signal.aborted) {
+            if (active !== null) {
+              await active.completion
+              active = null
+              continue
+            }
+            try {
+              const response = await fetch(`${BASE}/pending?wait=${POLL_WAIT_MS}`, {
+                signal: controller.signal,
+                headers: { accept: 'application/json' },
+                cache: 'no-store',
+              })
+              if (!response.ok) throw new Error(`HTTP ${response.status}`)
+              const value = await response.json()
+              if (value !== null && typeof value === 'object' && typeof value.id === 'string') {
+                const sessionId = typeof value.sessionId === 'string'
+                  ? value.sessionId
+                  : ctx.uiSession.current?.value?.key
+                const prompt = new SudoPrompt({ ...value, sessionId })
+                active = prompt
+                const remove = publish(prompt, () => prompt.settle())
+                prompt.completion.then(() => remove())
+              }
+            } catch {
+              if (controller.signal.aborted) return
+              await new Promise((resolve) => setTimeout(resolve, RETRY_DELAY_MS))
+            }
+          }
+        }
+
+        poll()
+
+        ctx.effect(() => () => {
+          controller.abort()
+        }, 'dsh-remote-sudo: pending poll')
+
+        ctx.slots.inject('conversation.composer', () => ctx.slots.register({
+          name: 'conversation.composer',
+          priority: 2,
+          locale: NS,
+          select: ({ pendingInteraction }) =>
+            pendingInteraction !== undefined && pendingInteraction.kind === KIND ? pendingInteraction : null,
+        }, SudoPromptPanel))
+      },
+    }
+  },
+})

package/cordis.patch.yml

@@ -0,0 +1,3 @@
+- insert:
+    - id: sudo-askpass
+      name: 'dsh-remote-sudo'

package/icon.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64" role="img" aria-label="Remote sudo password">
+  <rect width="64" height="64" rx="14" fill="#1f6feb"/>
+  <path d="M32 12l16 6v12c0 10-6.6 18.1-16 22-9.4-3.9-16-12-16-22V18l16-6z" fill="#fff" opacity="0.95"/>
+  <circle cx="32" cy="28" r="5" fill="#1f6feb"/>
+  <rect x="30" y="31" width="4" height="9" rx="2" fill="#1f6feb"/>
+</svg>

package/index.js

@@ -0,0 +1,550 @@
+/**
+ * dsh-remote-sudo — Host half.
+ *
+ * Registers the `remote_sudo` tool and the `/_dsh/dsh-remote-sudo/*` route the
+ * Client half uses to fetch a pending password prompt and submit the password.
+ *
+ * Password handling: the password lives only in this process's memory and in
+ * the ssh child's stdin. It is never placed in the tool call, the session log,
+ * the tool result, the environment, argv, or a file. The remote command runs
+ * with stdin redirected to /dev/null so a password that sudo did not need can
+ * never be read by the command.
+ *
+ * Caching: every call asks for the password by default. When `passwordTtlMs`
+ * is positive, the host keeps the password in memory for that long and reuses
+ * it, so repeated root commands inside the window do not prompt again. This is
+ * only an in-memory cache: the remote sudo timestamp is always invalidated
+ * with `sudo -k` after each command, because no-TTY tickets are not assumed to
+ * survive across ssh invocations.
+ */
+
+import { spawn } from 'node:child_process'
+import { randomUUID } from 'node:crypto'
+
+const ROUTE_PREFIX = '/_dsh/dsh-remote-sudo'
+const MAX_BODY_BYTES = 16 * 1024
+const MAX_OUTPUT_CHARS = 20000
+const INVALIDATE_TIMEOUT_MS = 15000
+const SUDO_CANDIDATES = [
+  '/usr/bin/sudo',
+  '/bin/sudo',
+  '/usr/local/bin/sudo',
+  '/opt/homebrew/bin/sudo',
+  '/opt/local/bin/sudo',
+  '/run/current-system/sw/bin/sudo',
+]
+const SUDO_RESOLVER = `SUDO=; for p in ${SUDO_CANDIDATES.join(' ')}; do [ -x "$p" ] && { SUDO=$p; break; }; done; if [ -z "$SUDO" ]; then SUDO=$(command -v sudo 2>/dev/null); case "$SUDO" in /*) ;; *) SUDO= ;; esac; fi; if [ -z "$SUDO" ]; then echo "dsh-remote-sudo: sudo not found; set sudoPath" >&2; exit 127; fi; exec "$SUDO"`
+
+export const name = 'dsh-remote-sudo'
+export const inject = ['tools', 'webServer', 'connection']
+
+const TOOL_DESCRIPTION = [
+  'Run a command with sudo on a remote host over SSH.',
+  'DSH opens a password prompt; the password is fed to sudo over stdin and is never stored, logged, or returned.',
+  'By default every call asks. Set passwordTtlMs to reuse the password from host memory for a short window; the remote sudo timestamp is always invalidated afterwards.',
+  'Use this instead of bash for any remote command that needs root, for example apt-get, dpkg, systemctl on a VPS.',
+  'The host argument is an SSH host alias from ~/.ssh/config (for example "aliyun").',
+  'SSH must authenticate with a key (BatchMode=yes is passed), so this tool never asks for an SSH password.',
+].join(' ')
+
+const SYSTEM_PROMPT_SECTION = [
+  'Remote root commands: when a command on another machine needs sudo, call `remote_sudo` with the SSH host alias and the root command.',
+  'Do not run `ssh <host> sudo ...` through bash: it has no TTY and cannot receive the password.',
+  'The password prompt appears in the DSH UI; never ask the user to paste a password into chat.',
+].join(' ')
+
+/**
+ * Quote one string for POSIX sh so it survives ssh's remote command parsing.
+ * @param {string} value raw command text.
+ * @returns {string} single-quoted shell word.
+ */
+function shellQuote(value) {
+  return `'${String(value).replace(/'/g, `'\\''`)}'`
+}
+
+/**
+ * Send a JSON body without leaking internals to the browser.
+ * @param {import('node:http').ServerResponse} res response.
+ * @param {number} status HTTP status.
+ * @param {unknown} body JSON-serializable payload.
+ */
+function sendJson(res, status, body) {
+  if (res.destroyed || res.writableEnded) return
+  const text = JSON.stringify(body)
+  res.writeHead(status, {
+    'content-type': 'application/json; charset=utf-8',
+    'cache-control': 'no-store',
+    'content-length': Buffer.byteLength(text),
+  })
+  res.end(text)
+}
+
+/**
+ * Read a bounded request body as UTF-8.
+ * @param {import('node:http').IncomingMessage} req request.
+ * @param {number} limit maximum bytes.
+ * @returns {Promise<string>} decoded body.
+ */
+function readBody(req, limit) {
+  return new Promise((resolve, reject) => {
+    const chunks = []
+    let size = 0
+    req.on('data', (chunk) => {
+      size += chunk.length
+      if (size > limit) {
+        reject(new Error('request body too large'))
+        req.destroy()
+        return
+      }
+      chunks.push(chunk)
+    })
+    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')))
+    req.on('error', reject)
+  })
+}
+
+/**
+ * Clamp a numeric option.
+ * @param {unknown} value raw config value.
+ * @param {number} min lower bound.
+ * @param {number} max upper bound.
+ * @param {number} fallback value used when the input is not a finite number.
+ * @returns {number} sanitized value.
+ */
+function numberOption(value, min, max, fallback) {
+  const parsed = typeof value === 'number' ? value : Number(value)
+  if (!Number.isFinite(parsed)) return fallback
+  return Math.min(Math.max(parsed, min), max)
+}
+
+/**
+ * Resolve the plugin row's config with safe defaults.
+ * @param {unknown} config raw row config.
+ * @returns {{passwordTtlMs: number, sudoPath: string}} options
+ */
+function readOptions(config) {
+  const raw = config !== null && typeof config === 'object' ? config : {}
+  const sudoPath = typeof raw.sudoPath === 'string' && raw.sudoPath.length > 0 && /^\/[^\s]+$/.test(raw.sudoPath)
+    ? raw.sudoPath
+    : ''
+  return {
+    passwordTtlMs: numberOption(raw.passwordTtlMs, 0, 3600000, 0),
+    sudoPath,
+  }
+}
+
+/**
+ * Build the remote command. The command itself runs with stdin from /dev/null:
+ * sudo reads the password from the ssh pipe before exec'ing the shell, so a
+ * leftover password line can never reach the root command.
+ * @param {{sudoPath: string, command: string}} input command parts.
+ * @returns {string} remote shell command.
+ */
+function buildRemoteCommand(input) {
+  const inner = `exec 0</dev/null; ${input.command}`
+  const launcher = input.sudoPath.length > 0 ? input.sudoPath : SUDO_RESOLVER
+  return `${launcher} -S -p '' -- sh -c ${shellQuote(inner)}`
+}
+
+/**
+ * Spawn one ssh child with the shared non-interactive options.
+ * @param {string} host SSH host alias.
+ * @param {string} remote remote command string.
+ * @param {import('node:child_process').StdioOptions} stdio stdio wiring.
+ * @returns {import('node:child_process').ChildProcess} child.
+ */
+function spawnSsh(host, remote, stdio) {
+  return spawn('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', host, remote], { stdio })
+}
+
+/**
+ * Append a chunk while keeping only the tail of the stream.
+ * @param {string} current accumulated text.
+ * @param {Buffer|string} chunk new data.
+ * @returns {string} bounded text.
+ */
+function appendCapped(current, chunk) {
+  const next = current + chunk.toString('utf8')
+  return next.length > MAX_OUTPUT_CHARS ? next.slice(-MAX_OUTPUT_CHARS) : next
+}
+
+/**
+ * Format one completed remote invocation for the model.
+ * @param {string} host SSH host alias.
+ * @param {string} command root command text.
+ * @param {{stdout: string, stderr: string, code: number|null, signalName: string|null}} result completed run.
+ * @returns {string} tool result.
+ */
+function formatResult(host, command, result) {
+  const lines = [`remote_sudo ${host}: ${command}`]
+  if (result.stdout.trim().length > 0) lines.push(result.stdout.trimEnd())
+  if (result.stderr.trim().length > 0) lines.push('[stderr]', result.stderr.trimEnd())
+  lines.push(result.signalName ? `[killed by ${result.signalName}]` : `[exit code: ${result.code}]`)
+  return lines.join('\n')
+}
+
+/**
+ * Run one remote sudo command. `password` is written to ssh's stdin and then
+ * dropped; it is never included in argv, env, the result, or logs.
+ * @param {{host: string, remote: string, password: string, signal?: AbortSignal}} input invocation.
+ * @returns {Promise<{stdout: string, stderr: string, code: number|null, signalName: string|null}>} completed run.
+ */
+function runRemoteSudo(input) {
+  return new Promise((resolve, reject) => {
+    let child
+    try {
+      child = spawnSsh(input.host, input.remote, ['pipe', 'pipe', 'pipe'])
+    } catch (error) {
+      reject(new Error(`cannot start ssh: ${error instanceof Error ? error.message : String(error)}`))
+      return
+    }
+
+    let stdout = ''
+    let stderr = ''
+    let settled = false
+    const onAbort = () => {
+      child.kill('SIGKILL')
+      finish()
+      reject(new Error('remote_sudo was aborted'))
+    }
+
+    function finish() {
+      if (settled) return
+      settled = true
+      input.signal?.removeEventListener('abort', onAbort)
+    }
+
+    input.signal?.addEventListener('abort', onAbort, { once: true })
+    child.stdout.on('data', (chunk) => {
+      stdout = appendCapped(stdout, chunk)
+    })
+    child.stderr.on('data', (chunk) => {
+      stderr = appendCapped(stderr, chunk)
+    })
+    child.stdin.on('error', () => {
+      // ssh may close stdin before the write lands (auth failure); the exit code carries the reason.
+    })
+    child.on('error', (error) => {
+      finish()
+      reject(new Error(`cannot start ssh: ${error.message}`))
+    })
+    child.on('close', (code, signalName) => {
+      finish()
+      resolve({ stdout, stderr, code, signalName })
+    })
+
+    if (input.password.length > 0) child.stdin.end(`${input.password}\n`)
+    else child.stdin.end()
+  })
+}
+
+/**
+ * Invalidate the remote sudo timestamp after every command.
+ * @param {{host: string, sudoPath: string}} input invalidation target.
+ * @returns {Promise<void>} completion; failures are ignored.
+ */
+function invalidateTicket(input) {
+  return new Promise((resolve) => {
+    let child
+    const launcher = input.sudoPath.length > 0 ? input.sudoPath : SUDO_RESOLVER
+    try {
+      child = spawnSsh(input.host, `${launcher} -k`, 'ignore')
+    } catch {
+      resolve()
+      return
+    }
+    const timer = setTimeout(() => {
+      child.kill('SIGKILL')
+      resolve()
+    }, INVALIDATE_TIMEOUT_MS)
+    child.on('close', () => {
+      clearTimeout(timer)
+      resolve()
+    })
+    child.on('error', () => {
+      clearTimeout(timer)
+      resolve()
+    })
+  })
+}
+
+/**
+ * Install the tool, the web route, and the prompt section.
+ * @param {import('@deepseek-ai/cordis').Context} ctx plugin context.
+ * @param {unknown} config row config.
+ */
+export function apply(ctx, config = {}) {
+  const options = readOptions(config)
+
+  /** @type {Map<string, {id: string, host: string, command: string, description?: string, sessionId?: string, createdAt: number, resolve: (password: string) => void, reject: (error: Error) => void}>} */
+  const pending = new Map()
+  /** @type {Set<() => void>} */
+  const waiters = new Set()
+  /** @type {Map<string, {value: string, expiresAt: number}>} */
+  const cachedPasswords = new Map()
+
+  function snapshot() {
+    const first = pending.values().next().value
+    if (first === undefined) return null
+    return {
+      id: first.id,
+      host: first.host,
+      command: first.command,
+      ...(first.description === undefined ? {} : { description: first.description }),
+      ...(first.sessionId === undefined ? {} : { sessionId: first.sessionId }),
+      createdAt: first.createdAt,
+      count: pending.size,
+    }
+  }
+
+  function wakeWaiters() {
+    for (const wake of [...waiters]) wake()
+  }
+
+  /**
+   * Resolve with the current or next prompt, or null after the wait.
+   * @param {number} ms maximum wait.
+   * @param {import('node:http').IncomingMessage} req request used to stop early.
+   * @returns {Promise<ReturnType<typeof snapshot>>} prompt snapshot.
+   */
+  function waitForPrompt(ms, req) {
+    const now = snapshot()
+    if (now !== null || ms <= 0) return Promise.resolve(now)
+    return new Promise((resolve) => {
+      let settled = false
+      const finish = () => {
+        if (settled) return
+        settled = true
+        clearTimeout(timer)
+        waiters.delete(finish)
+        req.removeListener('close', finish)
+        resolve(snapshot())
+      }
+      const timer = setTimeout(finish, ms)
+      waiters.add(finish)
+      req.once('close', finish)
+    })
+  }
+
+  /**
+   * Ask the browser for one password and wait for the answer.
+   * @param {{host: string, command: string, description?: string, sessionId?: string, signal?: AbortSignal}} request prompt content.
+   * @returns {Promise<string>} the submitted password.
+   */
+  function requestPassword(request) {
+    const id = randomUUID()
+    return new Promise((resolve, reject) => {
+      const entry = {
+        id,
+        host: request.host,
+        command: request.command,
+        ...(request.description === undefined ? {} : { description: request.description }),
+        ...(request.sessionId === undefined ? {} : { sessionId: request.sessionId }),
+        createdAt: Date.now(),
+        resolve: (value) => {
+          pending.delete(id)
+          resolve(value)
+        },
+        reject: (error) => {
+          pending.delete(id)
+          reject(error)
+        },
+      }
+      pending.set(id, entry)
+      wakeWaiters()
+      request.signal?.addEventListener('abort', () => {
+        entry.reject(new Error('remote_sudo was aborted before the password was entered'))
+      }, { once: true })
+    })
+  }
+
+  async function handleRoute(req, res) {
+    let method = ''
+    try {
+      const rejection = typeof ctx.connection.requestRejection === 'function'
+        ? ctx.connection.requestRejection(req)
+        : undefined
+      if (rejection !== undefined) {
+        sendJson(res, rejection, { error: rejection === 401 ? 'authentication required' : 'request rejected' })
+        return
+      }
+
+      const url = new URL(req.url || '/', 'http://localhost')
+      if (!url.pathname.startsWith(`${ROUTE_PREFIX}/`)) {
+        sendJson(res, 404, { error: 'not found' })
+        return
+      }
+      method = decodeURIComponent(url.pathname.slice(ROUTE_PREFIX.length + 1))
+
+      if (method === 'pending') {
+        if (req.method !== 'GET' && req.method !== 'HEAD') {
+          sendJson(res, 405, { error: 'pending requires GET' })
+          return
+        }
+        const requested = Number(url.searchParams.get('wait') ?? '0')
+        const wait = Number.isFinite(requested) ? Math.min(Math.max(requested, 0), 25000) : 0
+        const prompt = await waitForPrompt(wait, req)
+        sendJson(res, 200, prompt ?? {})
+        return
+      }
+
+      if (method === 'answer') {
+        if (req.method !== 'POST') {
+          sendJson(res, 405, { error: 'answer requires POST' })
+          return
+        }
+        const body = JSON.parse(await readBody(req, MAX_BODY_BYTES) || '{}')
+        const id = typeof body?.id === 'string' ? body.id : ''
+        const password = typeof body?.password === 'string' ? body.password : ''
+        const entry = pending.get(id)
+        if (entry === undefined) {
+          sendJson(res, 409, { error: 'no pending prompt with that id' })
+          return
+        }
+        if (password.length === 0) {
+          sendJson(res, 400, { error: 'password required' })
+          return
+        }
+        entry.resolve(password)
+        sendJson(res, 200, { ok: true })
+        return
+      }
+
+      if (method === 'cancel') {
+        if (req.method !== 'POST') {
+          sendJson(res, 405, { error: 'cancel requires POST' })
+          return
+        }
+        const body = JSON.parse(await readBody(req, MAX_BODY_BYTES) || '{}')
+        const id = typeof body?.id === 'string' ? body.id : ''
+        const entry = pending.get(id)
+        if (entry === undefined) {
+          sendJson(res, 409, { error: 'no pending prompt with that id' })
+          return
+        }
+        entry.reject(new Error('sudo password prompt was cancelled by the user'))
+        sendJson(res, 200, { ok: true })
+        return
+      }
+
+      sendJson(res, 404, { error: `unknown method: ${method}` })
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error)
+      sendJson(res, message === 'request body too large' ? 413 : 400, { error: message })
+    }
+  }
+
+  ctx.effect(() => {
+    const dispose = ctx.webServer.register({
+      kind: 'prefix',
+      path: ROUTE_PREFIX,
+      handler: handleRoute,
+    })
+    return () => dispose()
+  }, 'dsh-remote-sudo: web route')
+
+  ctx.effect(() => () => {
+    cachedPasswords.clear()
+  }, 'dsh-remote-sudo: password cache')
+
+  ctx.effect(() => () => {
+    for (const entry of [...pending.values()]) {
+      entry.reject(new Error('dsh-remote-sudo was unloaded'))
+    }
+    pending.clear()
+    wakeWaiters()
+  }, 'dsh-remote-sudo: pending prompts')
+
+  ctx.tools.register({
+    name: 'remote_sudo',
+    description: TOOL_DESCRIPTION,
+    parameters: {
+      type: 'object',
+      additionalProperties: false,
+      properties: {
+        host: {
+          type: 'string',
+          description: 'SSH host alias from ~/.ssh/config, for example "aliyun".',
+        },
+        command: {
+          type: 'string',
+          description: 'Command to run as root on the remote host, for example "apt-get update".',
+        },
+        description: {
+          type: 'string',
+          description: 'Optional short label shown in the password prompt, for example "更新 apt 索引".',
+        },
+      },
+      required: ['host', 'command'],
+    },
+    output: {
+      schema: { type: 'string' },
+      render: (_args, value) => [{ type: 'text', text: String(value) }],
+    },
+    async execute(args, exec) {
+      const host = String(args.host ?? '').trim()
+      const command = String(args.command ?? '').trim()
+      if (host.length === 0 || !/^[A-Za-z0-9._@%+:-]+$/.test(host) || host.startsWith('-')) {
+        throw new Error('remote_sudo: host must be an SSH host alias (letters, digits, dot, dash, underscore)')
+      }
+      if (command.length === 0 || command.includes('\u0000')) {
+        throw new Error('remote_sudo: command is required')
+      }
+
+      const sessionId = typeof exec.agent?.session?.id === 'string' ? exec.agent.session.id : undefined
+
+      let password = ''
+      if (options.passwordTtlMs > 0) {
+        const cached = cachedPasswords.get(host)
+        if (cached !== undefined && cached.expiresAt > Date.now()) password = cached.value
+      }
+      if (password.length === 0) {
+        password = await requestPassword({
+          host,
+          command,
+          description: typeof args.description === 'string' && args.description.trim().length > 0
+            ? args.description.trim()
+            : undefined,
+          sessionId,
+          signal: exec.signal,
+        })
+        if (options.passwordTtlMs > 0) {
+          cachedPasswords.set(host, { value: password, expiresAt: Date.now() + options.passwordTtlMs })
+        }
+      }
+
+      const remote = buildRemoteCommand({ sudoPath: options.sudoPath, command })
+      let result
+      try {
+        result = await runRemoteSudo({
+          host,
+          remote,
+          password,
+          signal: exec.signal,
+        })
+      } finally {
+        password = ''
+        await invalidateTicket({ host, sudoPath: options.sudoPath })
+      }
+
+      if (result.code !== 0) {
+        // Conservative: any failure drops the cached password so the next call
+        // asks again instead of replaying a possibly stale secret.
+        cachedPasswords.delete(host)
+      }
+
+      return formatResult(host, command, result)
+    },
+  })
+
+  ctx.inject(['systemPrompt'], (scope) => {
+    scope.effect(() => {
+      const dispose = scope.systemPrompt.section({
+        name: 'tool:remote-sudo',
+        order: 10250,
+        text: SYSTEM_PROMPT_SECTION,
+      })
+      return () => dispose()
+    }, 'dsh-remote-sudo: prompt section')
+  })
+}

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Remote sudo password",
+    "description": "Prompts for a sudo password in the composer and runs remote root commands over SSH."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "远程 sudo 密码",
+    "description": "在输入框位置询问 sudo 密码，通过 SSH 执行远端 root 命令。"
+  }
+}

package/package.json

@@ -1,6 +1,63 @@
 {
   "name": "dsh-remote-sudo",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Ask for a sudo password in the DSH composer and run remote root commands over SSH without putting the password in the transcript.",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/seudut/dsh-remote-sudo.git"
+  },
+  "homepage": "https://github.com/seudut/dsh-remote-sudo#readme",
+  "bugs": {
+    "url": "https://github.com/seudut/dsh-remote-sudo/issues"
+  },
+  "main": "index.js",
+  "exports": {
+    ".": "./index.js",
+    "./client": "./client.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./locale/*.json": "./locale/*.json",
+    "./icon": "./icon.svg",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "index.js",
+    "client.js",
+    "cordis.patch.yml",
+    "locale/*.json",
+    "icon.svg",
+    "README.md",
+    "LICENSE",
+    "docs/panel.png"
+  ],
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "sudo",
+    "ssh",
+    "askpass",
+    "password",
+    "remote"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "test": "node test/host-test.mjs && node test/client-render-test.mjs"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true,
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-conversation",
+        "@deepseek-ai/dsh-client-ui-session"
+      ]
+    }
+  }
+}