dsh-remote 0.8.13 → 0.8.15

package/lib/paths.js

@@ -1,217 +1,217 @@
-// dsh-remote — pure path / shell helpers (no fs, no ssh).
-// Split out of lib/index.js so they are unit-testable without loading the
-// plugin. Both POSIX (`/a/b`) and Windows (`D:\Code`, `\\server\share`) forms
-// are supported everywhere.
-
-/** Single-quote one shell argument verbatim. */
-export function shq(s) {
-  return "'" + String(s).replace(/'/g, "'\\''") + "'"
-}
-
-/**
- * Normalize a remote path into a clean absolute path, supporting BOTH POSIX
- * (`/home/user`) and Windows (`D:\Code`, `C:/Users/x`, `\\server\share`) forms.
- *
- * - POSIX paths keep `/` separators and a leading `/`.
- * - Windows drive paths keep their `X:` prefix and are returned with `\`
- *   separators (the native form on a Windows remote); a leading `/` is NOT
- *   added, so `D:\Code` stays `D:\Code` instead of becoming `/D:\Code`.
- * - UNC paths (`\\server\share\…`) keep the `\\server\share` prefix.
- * - `.` / `..` segments are collapsed in both separator styles.
- */
-export function normalizeRemotePath(p) {
-  const s = String(p)
-  // Windows UNC: \\server\share\…
-  const unc = s.match(/^(\\\\[^\\]+(?:\\[^\\]+)?)(?:\\|$)(.*)$/s)
-  if (unc) {
-    const [prefix, rest] = [unc[1], unc[2]]
-    const parts = []
-    for (const seg of rest.split(/[\\/]+/)) {
-      if (seg === '' || seg === '.') continue
-      if (seg === '..') { parts.pop(); continue }
-      parts.push(seg)
-    }
-    return parts.length ? prefix + '\\' + parts.join('\\') : prefix
-  }
-  // Windows drive: X:\… or X:/…
-  const drive = s.match(/^([a-zA-Z]:)(?:[\\/]|$)(.*)$/s)
-  if (drive) {
-    const [prefix, rest] = [drive[1], drive[2]]
-    const parts = []
-    for (const seg of rest.split(/[\\/]+/)) {
-      if (seg === '' || seg === '.') continue
-      if (seg === '..') { parts.pop(); continue }
-      parts.push(seg)
-    }
-    return prefix + '\\' + parts.join('\\')
-  }
-  // POSIX: /a/b/c
-  const parts = []
-  for (const seg of s.split('/')) {
-    if (seg === '' || seg === '.') continue
-    if (seg === '..') {
-      parts.pop()
-      continue
-    }
-    parts.push(seg)
-  }
-  return '/' + parts.join('/')
-}
-
-/** Join a remote dir + entry name, honoring the dir's own separator style. */
-export function joinRemotePath(dir, name) {
-  const d = String(dir)
-  if (!d) return String(name)
-  if (d.endsWith('/') || d.endsWith('\\')) return d + String(name)
-  return d + (d.includes('\\') ? '\\' : '/') + String(name)
-}
-
-/** Parent dir of a remote absolute path (string-level; POSIX or Windows). */
-export function remoteDirname(p) {
-  const norm = normalizeRemotePath(p)
-  // Windows drive/UNC root: D:\ or \\server\share
-  if (norm === '/' || /^[a-zA-Z]:\\?$/.test(norm) || /^\\\\[^\\]+\\[^\\]+$/.test(norm)) {
-    // Ensure a drive root ends with a backslash: D: → D:\
-    const m = norm.match(/^([a-zA-Z]:)$/)
-    return m ? m[1] + '\\' : norm
-  }
-  const sep = norm.includes('\\') ? '\\' : '/'
-  const idx = norm.lastIndexOf(sep)
-  if (idx <= 0) {
-    // Windows drive with a child (D:\Code) → D:\
-    const m = norm.match(/^([a-zA-Z]:)\\/)
-    return m ? m[1] + '\\' : sep === '/' && norm.startsWith('/') ? '/' : norm
-  }
-  // A parent that is a Windows drive root also needs the trailing backslash.
-  const parent = norm.slice(0, idx)
-  if (sep === '\\' && /^[a-zA-Z]:$/.test(parent)) return parent + '\\'
-  return parent
-}
-
-/** Create every level of a remote dir via SFTP (true mkdir -p: parents AND the
- * target itself), working for both POSIX (`/a/b`) and Windows (`D:\a\b`)
- * paths. Best effort: an existing or permission-denied level is skipped.
- * FILE-oriented callers must pass the parent dir (remoteDirname(filePath)). */
-export async function mkdirRemoteDirs(sftp, dir) {
-  const target = normalizeRemotePath(dir)
-  const isWin = target.includes('\\')
-  // Split off a Windows drive prefix (D:) so it is not treated as a segment.
-  const drive = isWin ? (target.match(/^([a-zA-Z]:)[\\/]?(.*)$/s) || null) : null
-  const segs = drive ? drive[2].split(/[\\/]/).filter(Boolean) : target.split(/[\\/]/).filter(Boolean)
-  let cur = isWin ? (drive ? drive[1] + '\\' : '') : ''
-  // Drive root (D:\) itself, best effort (usually exists).
-  if (isWin && cur) { try { await sftp.mkdir(cur) } catch { /* exists */ } }
-  for (const s of segs) {
-    if (cur) {
-      if (!cur.endsWith('\\') && !cur.endsWith('/')) cur += isWin ? '\\' : '/'
-      cur += s
-    } else {
-      cur = (isWin ? s + ':' : '/' + s)
-    }
-    try { await sftp.mkdir(cur) } catch { /* exists or no perms */ }
-  }
-}
-
-/**
- * Convert an internal remote path (POSIX `/a/b` or Windows `D:\Code`) into the
- * path format the SFTP server understands.
- *
- * Windows OpenSSH's sftp-server accepts POSIX-style paths: a drive letter is
- * written `/D:/…` (equivalent to `D:\…`). POSIX paths pass through unchanged.
- * UNC paths are kept as-is (the server resolves `\\server\share` itself).
- */
-export function toSftpPath(p) {
-  const norm = normalizeRemotePath(p)
-  const m = norm.match(/^([a-zA-Z]):\\(.*)$/s)
-  if (m) return '/' + m[1] + ':/' + m[2].replace(/\\/g, '/')
-  return norm
-}
-
-/**
- * Convert a remote path to the form used in SHELL commands on the remote.
- *
- * On Windows remotes running Git Bash, native `D:\Code` (or `D:/Code`,
- * `/D:/Code`, `/d/Code`) becomes the Git-Bash mount form `/d/Code`; a path
- * already in Git-Bash form passes through unchanged. UNC (`\\server\share`)
- * maps to `//server/share`. POSIX paths are normalized as-is. The conversion
- * is syntactic, so it is safe on POSIX remotes too (only unambiguous Windows
- * forms are rewritten).
- */
-export function toShellPath(p) {
-  let t = String(p || '').replace(/\\/g, '/')
-  const unc = t.match(/^\/\/([^/]+)(?:\/(.*))?$/)
-  if (unc) return '//' + unc[1] + (unc[2] ? '/' + unc[2] : '')
-  const drive = t.match(/^([a-zA-Z]):(\/|$)/) || t.match(/^\/([a-zA-Z]):(\/|$)/)
-  if (drive) {
-    t = '/' + drive[1].toLowerCase() + (drive[2] ? '/' : '') + t.slice(drive[0].length)
-  }
-  const parts = []
-  for (const seg of t.split('/')) {
-    if (seg === '' || seg === '.') continue
-    if (seg === '..') { parts.pop(); continue }
-    parts.push(seg)
-  }
-  return '/' + parts.join('/')
-}
-
-/**
- * Display form of a path for a Windows remote: a Git-Bash mount `/d/Code` (or
- * `/D:/Code`, `D:/Code`) renders as `D:\Code`; anything else (POSIX paths,
- * native Windows paths) is returned normalized. POSIX remotes always pass
- * through unchanged.
- */
-export function toDisplayPath(p, platform) {
-  if (platform !== 'windows') return normalizeRemotePath(p)
-  const t = String(p || '').replace(/\\/g, '/')
-  // /X:/rest (Win32-OpenSSH SFTP form)
-  const gs = t.match(/^\/([a-zA-Z]):\/(.*)$/)
-  if (gs) return gs[1].toUpperCase() + ':\\' + gs[2].replace(/\//g, '\\')
-  // /x/rest (Git-Bash mount form) and bare /x
-  const git = t.match(/^\/([a-zA-Z])(?:\/(.*))?$/)
-  if (git) return git[1].toUpperCase() + ':\\' + (git[2] || '').replace(/\//g, '\\')
-  // native X:/rest
-  const drive = t.match(/^([a-zA-Z]):(?:\/(.*))?$/)
-  if (drive) return drive[1].toUpperCase() + ':\\' + (drive[2] || '').replace(/\//g, '\\')
-  return t
-}
-
-/** Basename of a remote absolute path (POSIX or Windows). */
-export function remotePathBase(p) {
-  const norm = normalizeRemotePath(p).replace(/[\\/]+$/, '')
-  const base = norm.split(/[\\/]/).pop()
-  // Windows drive root (D:\) has no meaningful basename
-  if (!base || /^[a-zA-Z]:$/.test(base)) return 'workspace'
-  return base
-}
-
-/** Relative path of `p` under `root` (POSIX form, no leading slash), or null
- * when `p` is not inside `root`. Both POSIX and Windows drive paths work
- * (Windows is compared in its `/D:/…` POSIX-equivalent form). */
-export function relPathUnder(root, p) {
-  const posix = (x) => {
-    let n = normalizeRemotePath(x).replace(/[\\/]+$/, '')
-    const m = n.match(/^([a-zA-Z]):(.*)$/s)
-    if (m) return '/' + m[1].toLowerCase() + ':/' + (m[2] ? m[2].replace(/\\/g, '/').replace(/^\/+/, '') : '')
-    return n.replace(/\\/g, '/')
-  }
-  const r = posix(root)
-  const n = posix(p)
-  if (n === r) return ''
-  const prefix = r === '/' ? '/' : r + '/'
-  if (n.startsWith(prefix)) return n.slice(prefix.length)
-  return null
-}
-
-export function truncate(s, max) {
-  if (s.length <= max) return s
-  return s.slice(0, max) + `\n…[truncated: ${s.length - max} more chars]`
-}
-
-/** 32-bit string hash rendered in base36 (short, collision-safe enough). */
-export function shortHash(s) {
-  let h = 0
-  for (let i = 0; i < s.length; i++) {
-    h = ((h << 5) - h + s.charCodeAt(i)) | 0
-  }
-  return (h >>> 0).toString(36)
-}
+// dsh-remote — pure path / shell helpers (no fs, no ssh).
+// Split out of lib/index.js so they are unit-testable without loading the
+// plugin. Both POSIX (`/a/b`) and Windows (`D:\Code`, `\\server\share`) forms
+// are supported everywhere.
+
+/** Single-quote one shell argument verbatim. */
+export function shq(s) {
+  return "'" + String(s).replace(/'/g, "'\\''") + "'"
+}
+
+/**
+ * Normalize a remote path into a clean absolute path, supporting BOTH POSIX
+ * (`/home/user`) and Windows (`D:\Code`, `C:/Users/x`, `\\server\share`) forms.
+ *
+ * - POSIX paths keep `/` separators and a leading `/`.
+ * - Windows drive paths keep their `X:` prefix and are returned with `\`
+ *   separators (the native form on a Windows remote); a leading `/` is NOT
+ *   added, so `D:\Code` stays `D:\Code` instead of becoming `/D:\Code`.
+ * - UNC paths (`\\server\share\…`) keep the `\\server\share` prefix.
+ * - `.` / `..` segments are collapsed in both separator styles.
+ */
+export function normalizeRemotePath(p) {
+  const s = String(p)
+  // Windows UNC: \\server\share\…
+  const unc = s.match(/^(\\\\[^\\]+(?:\\[^\\]+)?)(?:\\|$)(.*)$/s)
+  if (unc) {
+    const [prefix, rest] = [unc[1], unc[2]]
+    const parts = []
+    for (const seg of rest.split(/[\\/]+/)) {
+      if (seg === '' || seg === '.') continue
+      if (seg === '..') { parts.pop(); continue }
+      parts.push(seg)
+    }
+    return parts.length ? prefix + '\\' + parts.join('\\') : prefix
+  }
+  // Windows drive: X:\… or X:/…
+  const drive = s.match(/^([a-zA-Z]:)(?:[\\/]|$)(.*)$/s)
+  if (drive) {
+    const [prefix, rest] = [drive[1], drive[2]]
+    const parts = []
+    for (const seg of rest.split(/[\\/]+/)) {
+      if (seg === '' || seg === '.') continue
+      if (seg === '..') { parts.pop(); continue }
+      parts.push(seg)
+    }
+    return prefix + '\\' + parts.join('\\')
+  }
+  // POSIX: /a/b/c
+  const parts = []
+  for (const seg of s.split('/')) {
+    if (seg === '' || seg === '.') continue
+    if (seg === '..') {
+      parts.pop()
+      continue
+    }
+    parts.push(seg)
+  }
+  return '/' + parts.join('/')
+}
+
+/** Join a remote dir + entry name, honoring the dir's own separator style. */
+export function joinRemotePath(dir, name) {
+  const d = String(dir)
+  if (!d) return String(name)
+  if (d.endsWith('/') || d.endsWith('\\')) return d + String(name)
+  return d + (d.includes('\\') ? '\\' : '/') + String(name)
+}
+
+/** Parent dir of a remote absolute path (string-level; POSIX or Windows). */
+export function remoteDirname(p) {
+  const norm = normalizeRemotePath(p)
+  // Windows drive/UNC root: D:\ or \\server\share
+  if (norm === '/' || /^[a-zA-Z]:\\?$/.test(norm) || /^\\\\[^\\]+\\[^\\]+$/.test(norm)) {
+    // Ensure a drive root ends with a backslash: D: → D:\
+    const m = norm.match(/^([a-zA-Z]:)$/)
+    return m ? m[1] + '\\' : norm
+  }
+  const sep = norm.includes('\\') ? '\\' : '/'
+  const idx = norm.lastIndexOf(sep)
+  if (idx <= 0) {
+    // Windows drive with a child (D:\Code) → D:\
+    const m = norm.match(/^([a-zA-Z]:)\\/)
+    return m ? m[1] + '\\' : sep === '/' && norm.startsWith('/') ? '/' : norm
+  }
+  // A parent that is a Windows drive root also needs the trailing backslash.
+  const parent = norm.slice(0, idx)
+  if (sep === '\\' && /^[a-zA-Z]:$/.test(parent)) return parent + '\\'
+  return parent
+}
+
+/** Create every level of a remote dir via SFTP (true mkdir -p: parents AND the
+ * target itself), working for both POSIX (`/a/b`) and Windows (`D:\a\b`)
+ * paths. Best effort: an existing or permission-denied level is skipped.
+ * FILE-oriented callers must pass the parent dir (remoteDirname(filePath)). */
+export async function mkdirRemoteDirs(sftp, dir) {
+  const target = normalizeRemotePath(dir)
+  const isWin = target.includes('\\')
+  // Split off a Windows drive prefix (D:) so it is not treated as a segment.
+  const drive = isWin ? (target.match(/^([a-zA-Z]:)[\\/]?(.*)$/s) || null) : null
+  const segs = drive ? drive[2].split(/[\\/]/).filter(Boolean) : target.split(/[\\/]/).filter(Boolean)
+  let cur = isWin ? (drive ? drive[1] + '\\' : '') : ''
+  // Drive root (D:\) itself, best effort (usually exists).
+  if (isWin && cur) { try { await sftp.mkdir(cur) } catch { /* exists */ } }
+  for (const s of segs) {
+    if (cur) {
+      if (!cur.endsWith('\\') && !cur.endsWith('/')) cur += isWin ? '\\' : '/'
+      cur += s
+    } else {
+      cur = (isWin ? s + ':' : '/' + s)
+    }
+    try { await sftp.mkdir(cur) } catch { /* exists or no perms */ }
+  }
+}
+
+/**
+ * Convert an internal remote path (POSIX `/a/b` or Windows `D:\Code`) into the
+ * path format the SFTP server understands.
+ *
+ * Windows OpenSSH's sftp-server accepts POSIX-style paths: a drive letter is
+ * written `/D:/…` (equivalent to `D:\…`). POSIX paths pass through unchanged.
+ * UNC paths are kept as-is (the server resolves `\\server\share` itself).
+ */
+export function toSftpPath(p) {
+  const norm = normalizeRemotePath(p)
+  const m = norm.match(/^([a-zA-Z]):\\(.*)$/s)
+  if (m) return '/' + m[1] + ':/' + m[2].replace(/\\/g, '/')
+  return norm
+}
+
+/**
+ * Convert a remote path to the form used in SHELL commands on the remote.
+ *
+ * On Windows remotes running Git Bash, native `D:\Code` (or `D:/Code`,
+ * `/D:/Code`, `/d/Code`) becomes the Git-Bash mount form `/d/Code`; a path
+ * already in Git-Bash form passes through unchanged. UNC (`\\server\share`)
+ * maps to `//server/share`. POSIX paths are normalized as-is. The conversion
+ * is syntactic, so it is safe on POSIX remotes too (only unambiguous Windows
+ * forms are rewritten).
+ */
+export function toShellPath(p) {
+  let t = String(p || '').replace(/\\/g, '/')
+  const unc = t.match(/^\/\/([^/]+)(?:\/(.*))?$/)
+  if (unc) return '//' + unc[1] + (unc[2] ? '/' + unc[2] : '')
+  const drive = t.match(/^([a-zA-Z]):(\/|$)/) || t.match(/^\/([a-zA-Z]):(\/|$)/)
+  if (drive) {
+    t = '/' + drive[1].toLowerCase() + (drive[2] ? '/' : '') + t.slice(drive[0].length)
+  }
+  const parts = []
+  for (const seg of t.split('/')) {
+    if (seg === '' || seg === '.') continue
+    if (seg === '..') { parts.pop(); continue }
+    parts.push(seg)
+  }
+  return '/' + parts.join('/')
+}
+
+/**
+ * Display form of a path for a Windows remote: a Git-Bash mount `/d/Code` (or
+ * `/D:/Code`, `D:/Code`) renders as `D:\Code`; anything else (POSIX paths,
+ * native Windows paths) is returned normalized. POSIX remotes always pass
+ * through unchanged.
+ */
+export function toDisplayPath(p, platform) {
+  if (platform !== 'windows') return normalizeRemotePath(p)
+  const t = String(p || '').replace(/\\/g, '/')
+  // /X:/rest (Win32-OpenSSH SFTP form)
+  const gs = t.match(/^\/([a-zA-Z]):\/(.*)$/)
+  if (gs) return gs[1].toUpperCase() + ':\\' + gs[2].replace(/\//g, '\\')
+  // /x/rest (Git-Bash mount form) and bare /x
+  const git = t.match(/^\/([a-zA-Z])(?:\/(.*))?$/)
+  if (git) return git[1].toUpperCase() + ':\\' + (git[2] || '').replace(/\//g, '\\')
+  // native X:/rest
+  const drive = t.match(/^([a-zA-Z]):(?:\/(.*))?$/)
+  if (drive) return drive[1].toUpperCase() + ':\\' + (drive[2] || '').replace(/\//g, '\\')
+  return t
+}
+
+/** Basename of a remote absolute path (POSIX or Windows). */
+export function remotePathBase(p) {
+  const norm = normalizeRemotePath(p).replace(/[\\/]+$/, '')
+  const base = norm.split(/[\\/]/).pop()
+  // Windows drive root (D:\) has no meaningful basename
+  if (!base || /^[a-zA-Z]:$/.test(base)) return 'workspace'
+  return base
+}
+
+/** Relative path of `p` under `root` (POSIX form, no leading slash), or null
+ * when `p` is not inside `root`. Both POSIX and Windows drive paths work
+ * (Windows is compared in its `/D:/…` POSIX-equivalent form). */
+export function relPathUnder(root, p) {
+  const posix = (x) => {
+    let n = normalizeRemotePath(x).replace(/[\\/]+$/, '')
+    const m = n.match(/^([a-zA-Z]):(.*)$/s)
+    if (m) return '/' + m[1].toLowerCase() + ':/' + (m[2] ? m[2].replace(/\\/g, '/').replace(/^\/+/, '') : '')
+    return n.replace(/\\/g, '/')
+  }
+  const r = posix(root)
+  const n = posix(p)
+  if (n === r) return ''
+  const prefix = r === '/' ? '/' : r + '/'
+  if (n.startsWith(prefix)) return n.slice(prefix.length)
+  return null
+}
+
+export function truncate(s, max) {
+  if (s.length <= max) return s
+  return s.slice(0, max) + `\n…[truncated: ${s.length - max} more chars]`
+}
+
+/** 32-bit string hash rendered in base36 (short, collision-safe enough). */
+export function shortHash(s) {
+  let h = 0
+  for (let i = 0; i < s.length; i++) {
+    h = ((h << 5) - h + s.charCodeAt(i)) | 0
+  }
+  return (h >>> 0).toString(36)
+}

package/lib/registry.js

@@ -1,89 +1,89 @@
-// Machine-registry pure logic for dsh-remote.
-//
-// Issue #13: a SAVED machine is only a standby connection — it must never
-// silently become the "active remote context" of every session. The registry
-// therefore keeps `currentId` as an EXPLICIT user choice:
-//   • loadMachines never falls back to the first saved machine,
-//   • a stale currentId (machine deleted meanwhile) resolves to null,
-//   • add/update never auto-activate; only an explicit "set current" does,
-//   • deleting the current machine leaves NO current (no auto-promotion).
-// Keeping this logic in one module makes the guarantee unit-testable and
-// shared between the HTTP routes and the tools (rw_connect).
-
-import { readFileSync, writeFileSync, mkdirSync } from 'node:fs'
-import path from 'node:path'
-
-/** Load { list, currentId, explicitNone } from the registry file. */
-export function loadMachines(file) {
-  try {
-    const j = JSON.parse(readFileSync(file, 'utf8'))
-    if (Array.isArray(j.list)) {
-      const list = j.list
-      // Explicit choice only — no fallback to the first machine, no activation
-      // of a stale/deleted id (issue #13).
-      const currentId = j.currentId && list.some((m) => m.id === j.currentId) ? j.currentId : null
-      // A persisted `currentId: null` is a deliberate "active remote = none"
-      // (the user cleared the current machine). It must survive restarts so a
-      // config-level default host cannot silently reactivate a context the user
-      // explicitly turned off. `explicitNone` is true when the file carries an
-      // explicit null (vs. a fresh file where currentId is simply absent).
-      const explicitNone = Object.prototype.hasOwnProperty.call(j, 'currentId') && j.currentId == null
-      return { list, currentId, explicitNone }
-    }
-  } catch {}
-  return { list: [], currentId: null, explicitNone: false }
-}
-
-/** Persist { list, currentId }. `currentId` may be null → active remote = none.
- *  Pass `keepCurrentKey: false` (add/update a machine without touching the
- *  current selection) to PRESERVE whatever `currentId` the file already holds
- *  — so merely saving a machine never flips a fresh registry into "explicit
- *  none", nor clears an explicit choice. When no previous file exists the
- *  `currentId` key is omitted entirely (fresh registry = "no choice yet"). */
-export function saveMachines(file, list, currentId, keepCurrentKey = true) {
-  try { mkdirSync(path.dirname(file), { recursive: true }) } catch {}
-  let stored = currentId
-  let hasStored = keepCurrentKey
-  if (!keepCurrentKey) {
-    try {
-      const prev = JSON.parse(readFileSync(file, 'utf8'))
-      if (prev && Object.prototype.hasOwnProperty.call(prev, 'currentId')) {
-        stored = prev.currentId
-        hasStored = true
-      }
-    } catch { /* no previous file → omit the key */ }
-  }
-  const payload = { list }
-  if (hasStored) payload.currentId = stored
-  writeFileSync(file, JSON.stringify(payload, null, 2))
-}
-
-/** Strip secrets before sending a machine to the client. */
-export function sanitizeMachine(m) {
-  if (!m) return m
-  const { password, proxy, ...rest } = m
-  const out = { ...rest, passwordSet: !!(m.password && m.password.length) }
-  if (proxy) out.proxy = { ...proxy, password: proxy.password ? '' : undefined, passwordSet: !!(proxy.password && proxy.password.length) }
-  return out
-}
-
-/** Apply a machine's fields onto the live config object (pool + tools read it). */
-export function applyMachine(config, m) {
-  if (!m) return
-  config.host = m.host
-  config.port = Number(m.port) || 22
-  config.username = m.username || ''
-  config.password = m.password || ''
-  config.privateKeyPath = m.privateKeyPath || ''
-  config.passphrase = m.passphrase || ''
-  config.workspace = m.workspace || (config.workspace || '')
-  if (m.hostKeyMode) config.hostKeyMode = m.hostKeyMode
-  if (typeof m.useAgent === 'boolean') config.useAgent = m.useAgent
-  if (typeof m.keyboardInteractive === 'boolean') config.keyboardInteractive = m.keyboardInteractive
-  config.proxy = m.proxy && m.proxy.host ? m.proxy : undefined
-}
-
-/** Mint a fresh machine id. */
-export function machineId() {
-  return 'm-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2, 6)
-}
+// Machine-registry pure logic for dsh-remote.
+//
+// Issue #13: a SAVED machine is only a standby connection — it must never
+// silently become the "active remote context" of every session. The registry
+// therefore keeps `currentId` as an EXPLICIT user choice:
+//   • loadMachines never falls back to the first saved machine,
+//   • a stale currentId (machine deleted meanwhile) resolves to null,
+//   • add/update never auto-activate; only an explicit "set current" does,
+//   • deleting the current machine leaves NO current (no auto-promotion).
+// Keeping this logic in one module makes the guarantee unit-testable and
+// shared between the HTTP routes and the tools (rw_connect).
+
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs'
+import path from 'node:path'
+
+/** Load { list, currentId, explicitNone } from the registry file. */
+export function loadMachines(file) {
+  try {
+    const j = JSON.parse(readFileSync(file, 'utf8'))
+    if (Array.isArray(j.list)) {
+      const list = j.list
+      // Explicit choice only — no fallback to the first machine, no activation
+      // of a stale/deleted id (issue #13).
+      const currentId = j.currentId && list.some((m) => m.id === j.currentId) ? j.currentId : null
+      // A persisted `currentId: null` is a deliberate "active remote = none"
+      // (the user cleared the current machine). It must survive restarts so a
+      // config-level default host cannot silently reactivate a context the user
+      // explicitly turned off. `explicitNone` is true when the file carries an
+      // explicit null (vs. a fresh file where currentId is simply absent).
+      const explicitNone = Object.prototype.hasOwnProperty.call(j, 'currentId') && j.currentId == null
+      return { list, currentId, explicitNone }
+    }
+  } catch {}
+  return { list: [], currentId: null, explicitNone: false }
+}
+
+/** Persist { list, currentId }. `currentId` may be null → active remote = none.
+ *  Pass `keepCurrentKey: false` (add/update a machine without touching the
+ *  current selection) to PRESERVE whatever `currentId` the file already holds
+ *  — so merely saving a machine never flips a fresh registry into "explicit
+ *  none", nor clears an explicit choice. When no previous file exists the
+ *  `currentId` key is omitted entirely (fresh registry = "no choice yet"). */
+export function saveMachines(file, list, currentId, keepCurrentKey = true) {
+  try { mkdirSync(path.dirname(file), { recursive: true }) } catch {}
+  let stored = currentId
+  let hasStored = keepCurrentKey
+  if (!keepCurrentKey) {
+    try {
+      const prev = JSON.parse(readFileSync(file, 'utf8'))
+      if (prev && Object.prototype.hasOwnProperty.call(prev, 'currentId')) {
+        stored = prev.currentId
+        hasStored = true
+      }
+    } catch { /* no previous file → omit the key */ }
+  }
+  const payload = { list }
+  if (hasStored) payload.currentId = stored
+  writeFileSync(file, JSON.stringify(payload, null, 2))
+}
+
+/** Strip secrets before sending a machine to the client. */
+export function sanitizeMachine(m) {
+  if (!m) return m
+  const { password, proxy, ...rest } = m
+  const out = { ...rest, passwordSet: !!(m.password && m.password.length) }
+  if (proxy) out.proxy = { ...proxy, password: proxy.password ? '' : undefined, passwordSet: !!(proxy.password && proxy.password.length) }
+  return out
+}
+
+/** Apply a machine's fields onto the live config object (pool + tools read it). */
+export function applyMachine(config, m) {
+  if (!m) return
+  config.host = m.host
+  config.port = Number(m.port) || 22
+  config.username = m.username || ''
+  config.password = m.password || ''
+  config.privateKeyPath = m.privateKeyPath || ''
+  config.passphrase = m.passphrase || ''
+  config.workspace = m.workspace || (config.workspace || '')
+  if (m.hostKeyMode) config.hostKeyMode = m.hostKeyMode
+  if (typeof m.useAgent === 'boolean') config.useAgent = m.useAgent
+  if (typeof m.keyboardInteractive === 'boolean') config.keyboardInteractive = m.keyboardInteractive
+  config.proxy = m.proxy && m.proxy.host ? m.proxy : undefined
+}
+
+/** Mint a fresh machine id. */
+export function machineId() {
+  return 'm-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2, 6)
+}