dsh-remote 0.8.40 → 0.8.42

package/lib/index.js

@@ -40,6 +40,7 @@ import { syncTree, pushTree, loadSyncState, saveSyncState, pushOneFile } from '.
 import { searchRemote } from './search.js'
 import { resolveMirror, poolKey, lookupSessionCwd, encodeSegmentSafe, readSessionHeaderCwd, requestSessionHint } from './binding.js'
 import { TaskManager } from './tasks.js'
+import { DeployTasks } from './deploy-tasks.js'
 import { ForwardManager } from './forwards.js'
 import { WebAttach } from './web-attach.js'
 import {
@@ -53,13 +54,7 @@ import { loadMachines as _loadMachines, saveMachines as _saveMachines, sanitizeM
 import { registerHttpTransports } from './http-transport.js'
 import { SshPool } from './pool.js'
 import { createFsRoutes } from './routes-fs.js'
-import { createBackupRoutes } from './routes-backup.js'
 import { listDirStructured, removeRemoteTree } from './remote-fs.js'
-import {
-  createBackup, listBackups, restoreBackup, describeCreate, localBackupDirFor, resolveRemoteHome,
-  pullBackup, pushBackup, deleteBackup, listLocalBackups,
-} from './backup.js'
-import { parseExcludes, resolveBackupDir, isSafeArchiveName, formatBytes, DEFAULT_MAX_TRANSFER_BYTES } from './archive.js'
 
 export const name = 'dsh-remote'
 
@@ -198,19 +193,6 @@ export const Config = z.object({
   /** npm registry to install from. Empty uses the remote's own npm config, which
    *  is what an internal mirror needs to stay in effect. */
   webInstallRegistry: z.string().default(''),
-  /** Directory that workspace backups are written to on the REMOTE host. Empty
-   *  means `$HOME/.dsh-remote/backups`, resolved on the remote (so a remote
-   *  $HOME is never guessed from the local machine). */
-  backupDir: z.string().default(''),
-  /** Exclude patterns applied to backups by default (gitignore-ish, one per
-   *  line). Deliberately EMPTY: a backup that silently omits directories is how
-   *  a "restore" turns into silent data loss. Add patterns here (or per call)
-   *  when you want a smaller archive. */
-  backupExcludes: z.array(z.string()).default([]),
-  /** Cap (bytes) on copying an archive between the remote and this machine.
-   *  The archive on the remote is never truncated — this only bounds the
-   *  optional cross-machine transfer. 0 = unlimited. */
-  maxBackupTransferBytes: z.number().step(1).min(0).default(DEFAULT_MAX_TRANSFER_BYTES),
 })
 
 // ── shell / path helpers (pure implementations in lib/paths.js) ───────────
@@ -868,6 +850,10 @@ export async function apply(ctx, config) {
   // starting a second remote server. Lifecycle is owned by the plugin fiber, so
   // unloading the plugin tears every tunnel down.
   const webAttaches = new Map() // machineId → WebAttach
+  // Deploy tasks run on the HOST, detached from any request: closing the browser
+  // window mid-install must not lose the progress, and a re-opened page must be
+  // able to re-attach and see the live state (high-availability requirement).
+  const deployTasks = new DeployTasks()
   ctx.effect(() => () => {
     for (const attach of webAttaches.values()) { try { attach.close() } catch { /* already gone */ } }
     webAttaches.clear()
@@ -1297,74 +1283,6 @@ export async function apply(ctx, config) {
     return normalizeRemotePath(b.ws ? joinRemoteRel(b.ws, rel.replace(/\\/g, '/')) : rel)
   }
 
-  // ── backup helpers (shared by the tools and the /dsh-remote/backup routes) ─
-  /** The remote directory backups land in: the configured override, else
-   *  `$HOME/.dsh-remote/backups` resolved ON THE REMOTE (never guessed from the
-   *  local machine, whose home has nothing to do with the remote one). */
-  const backupDirForBinding = async (b) => {
-    const override = String(config.backupDir || '').trim()
-    if (override) return resolveBackupDir('', override)
-    if (!b || !b.pool) return ''
-    const home = await resolveRemoteHome(b.pool)
-    return resolveBackupDir(home, '')
-  }
-  /** Local directory holding archives pulled from one machine. */
-  const localBackupRootFor = (b) => localBackupDirFor(mirrorRootFor(b.host, b.username, b.port))
-
-  /**
-   * Every REMOTE workspace the sidebar knows about for one machine.
-   *
-   * "Back up all my workspaces" has to mean what the user sees in the sidebar, so
-   * this walks the mirror registry rather than the machine's recent-workspaces
-   * list: each mirror dir carries `.dsh-remote-meta.json` with the remote origin,
-   * which is authoritative and survives the sidebar's own storage being reset.
-   * The machine's remembered workspaces are unioned in as a fallback for
-   * workspaces that have never been mirrored on this machine.
-   *
-   * @param {{host: string, username: string, port: number}} machine
-   * @returns {string[]} absolute REMOTE directory paths, de-duplicated.
-   */
-  const remoteWorkspacesFor = (machine) => {
-    const out = new Set()
-    const host = String((machine && machine.host) || '')
-    const username = String((machine && machine.username) || '')
-    const port = Number((machine && machine.port) || 22)
-    if (!host) return []
-    // 1) Mirror dirs for THIS machine (the sidebar's remote entries).
-    try {
-      const hostDir = mirrorRootFor(host, username, port)
-      if (existsSync(hostDir)) {
-        for (const entry of readdirSync(hostDir)) {
-          const metaPath = path.join(hostDir, entry, '.dsh-remote-meta.json')
-          if (!existsSync(metaPath)) continue
-          try {
-            const meta = JSON.parse(readFileSync(metaPath, 'utf8'))
-            if (!meta || !meta.remotePath) continue
-            // Only mirrors that unambiguously belong to this machine.
-            if (String(meta.host || '') !== host) continue
-            if (Number(meta.port || 22) !== port) continue
-            if (username && String(meta.username || '') !== username) continue
-            out.add(normalizeRemotePath(meta.remotePath))
-          } catch { /* unreadable meta → not a usable workspace */ }
-        }
-      }
-    } catch { /* registry unreadable */ }
-    // 2) Workspaces the registry remembers for this machine, even if unmirrored.
-    const rec = machines.find((m) => m.host === host
-      && Number(m.port || 22) === port
-      && (!username || m.username === username))
-    const remembered = [rec && rec.workspace, ...((rec && rec.recentWorkspaces) || [])]
-    for (const p of remembered) {
-      const norm = p ? normalizeRemotePath(String(p)) : ''
-      if (norm && norm !== '/') out.add(norm)
-    }
-    // 3) The mirror the calling session is bound to, if any (a session can be
-    //    bound to a workspace the registry has not recorded yet).
-    const bound = wsPath()
-    if (bound) out.add(normalizeRemotePath(bound))
-    return [...out]
-  }
-
   // ── tools ─────────────────────────────────────────────────────────────────
 
   const textOut = {
@@ -2313,158 +2231,6 @@ export async function apply(ctx, config) {
       },
     }),
 
-    defineTool({
-      name: 'rw_backup',
-      description:
-        'Create a compressed (.tar.gz) backup of the remote workspace (or a subdirectory of it) on the remote host, with an optional copy pulled to this machine. Archives are written under $HOME/.dsh-remote/backups (config backupDir) with a sidecar .meta.json recording the workspace, entry count and sha256. Add exclude patterns when you want a smaller archive — by default EVERYTHING is archived, because silently omitting files is how a restore becomes silent data loss. Use rw_backup_list to see what exists and rw_restore to restore one.',
-      parameters: {
-        path: { type: 'string', description: 'Directory to back up (default and normally: the current remote workspace). Must be the workspace or a subdirectory of it.' },
-        label: { type: 'string', description: 'Optional tag embedded in the archive filename (e.g. "before-refactor").' },
-        excludes: { type: 'string', description: 'Comma- or newline-separated extra exclude patterns (gitignore-ish: node_modules, /build/, *.log). Relative paths inside the workspace.' },
-        dest: { type: 'string', description: 'Where the archive ends up: remote (default), local (pulled here; the remote staging copy is removed), or both.' },
-      },
-      output: textOut,
-      async execute(args, exec) {
-        const b = requireBinding(exec, 'rw_backup')
-        const dir = resolveRemoteArg(b, args.path || '')
-        if (!dir || dir === '/') throw new Error('rw_backup: a directory to back up is required')
-        const root = normalizeRemotePath(b.ws || '')
-        if (root && dir !== root && !dir.startsWith(root.replace(/\/+$/, '') + '/')) {
-          throw new Error(`rw_backup: ${dir} is outside this session's remote workspace (${root}) — backups are limited to the workspace tree`)
-        }
-        // Config defaults first, then this call's own patterns, so a caller can
-        // extend the profile's excludes without restating them.
-        const parsed = parseExcludes([
-          ...(Array.isArray(config.backupExcludes) ? config.backupExcludes : []),
-          ...String(args.excludes || '').split(/[\r\n,]+/),
-        ])
-        const backupDir = await backupDirForBinding(b)
-        if (!backupDir) throw new Error('rw_backup: cannot determine the remote $HOME — set the backupDir config option')
-        const dest = ['remote', 'local', 'both'].includes(String(args.dest)) ? String(args.dest) : 'remote'
-        const result = await createBackup(b.pool, {
-          dir,
-          backupDir,
-          label: args.label ? String(args.label) : '',
-          excludes: parsed.patterns,
-          meta: { host: b.host, username: b.username, port: b.port, label: args.label ? String(args.label) : '' },
-        })
-        if (!result.ok) {
-          audit('backup', `backup ${dir} failed: ${result.error}`, 1, b)
-          throw new Error('rw_backup: ' + result.error)
-        }
-        audit('backup', `backup ${dir} → ${result.archive}`, 0, b)
-        const lines = [describeCreate(result, { dest })]
-        lines.push(`remote archive: ${result.archive}`)
-        if (result.meta && result.meta.excludes && result.meta.excludes.length) lines.push(`excludes: ${result.meta.excludes.join(', ')}`)
-        if (parsed.dropped.length) lines.push(`ignored (no usable pattern): ${parsed.dropped.join(', ')}`)
-        if (dest === 'local' || dest === 'both') {
-          const pulled = await pullBackup(b.pool, {
-            archive: result.archive,
-            localDir: localBackupDirFor(mirrorRootFor(b.host, b.username, b.port)),
-            maxTransferBytes: Number(config.maxBackupTransferBytes) || 0,
-          })
-          if (pulled.ok) {
-            lines.push(`local copy: ${pulled.localPath}`)
-            if (dest === 'local') {
-              const del = await deleteBackup(b.pool, { archive: result.archive })
-              lines.push(del.ok ? 'remote staging copy removed (dest=local)' : `could NOT remove the remote copy: ${del.error || 'unknown error'}`)
-            }
-          } else {
-            lines.push(`local copy FAILED: ${pulled.error}`)
-          }
-        }
-        return { text: lines.join('\n') }
-      },
-    }),
-
-    defineTool({
-      name: 'rw_backup_list',
-      description:
-        "List the compressed backups of this session's remote workspace: name, size, entry count, and when it was taken. Shows both the archives stored on the remote host and any pulled into the local machine. Use the exact `name` with rw_restore.",
-      parameters: {
-        path: { type: 'string', description: "Directory whose backups to list (default: the workspace). Backups are named by workspace, so passing a subdirectory lists that subdirectory's backups." },
-      },
-      output: textOut,
-      async execute(args, exec) {
-        const b = requireBinding(exec, 'rw_backup_list')
-        const backupDir = await backupDirForBinding(b)
-        const remote = backupDir
-          ? await listBackups(b.pool, { dir: backupDir })
-          : { exists: false, dir: '', entries: [], error: '' }
-        const localDir = localBackupDirFor(mirrorRootFor(b.host, b.username, b.port))
-        const local = listLocalBackups(localDir)
-        const fmt = (e) => {
-          const bits = [e.name, formatBytes(e.bytes)]
-          if (e.members != null) bits.push(`${e.members} entries`)
-          if (e.createdAt || e.mtime) bits.push(e.createdAt || e.mtime)
-          if (!e.hasMeta) bits.push('NO SIDECAR (metadata unknown)')
-          return '  ' + bits.join('  |  ')
-        }
-        const lines = []
-        if (!backupDir) {
-          lines.push('(cannot resolve the remote backup directory — set the backupDir config option)')
-        } else if (remote.error) {
-          lines.push(`remote listing failed: ${remote.error}`)
-        } else if (!remote.entries.length) {
-          lines.push(`no backups yet in ${backupDir} (create one with rw_backup)`)
-        } else {
-          lines.push(`${remote.entries.length} remote backup(s) in ${backupDir}:`)
-          lines.push(...remote.entries.map(fmt))
-        }
-        if (local.entries.length) {
-          lines.push('', `${local.entries.length} local copy(ies) in ${localDir}:`)
-          lines.push(...local.entries.map(fmt))
-        }
-        lines.push('', 'restore one with rw_restore(file=<name>).')
-        return { text: lines.join('\n') }
-      },
-    }),
-
-    defineTool({
-      name: 'rw_restore',
-      description:
-        'Restore a workspace from one of its compressed backups (list them with rw_backup_list). The archive is verified BEFORE anything is written; a corrupt or truncated archive is refused and the target is left untouched. mode=replace (default) swaps the target for the archive contents and removes files not present in the archive; mode=merge extracts over the existing tree and deletes nothing. Prefer replace for "give me back exactly the state I archived"; use merge only when the archive is known to be a partial overlay.',
-      parameters: {
-        file: { type: 'string', required: true, description: 'Backup archive filename from rw_backup_list (e.g. proj-abc-2026-10-08T11-22-33.tar.gz).' },
-        target: { type: 'string', description: 'Directory to restore into (default: the current remote workspace). Usually left unset.' },
-        mode: { type: 'string', description: 'replace (default) or merge.' },
-        where: { type: 'string', description: 'Which copy to restore from: remote (default) or local (a pulled copy; it is uploaded back first).' },
-      },
-      output: textOut,
-      async execute(args, exec) {
-        const b = requireBinding(exec, 'rw_restore')
-        const file = String(args.file || '').trim()
-        if (!file) throw new Error('rw_restore: file is required (list them with rw_backup_list)')
-        if (!isSafeArchiveName(file)) throw new Error(`rw_restore: ${file} is not a valid backup filename (expected a plain *.tar.gz basename)`)
-        const target = args.target ? resolveRemoteArg(b, args.target) : (b.ws || '')
-        if (!target || target === '/') throw new Error('rw_restore: no restore target — pick a remote workspace first')
-        const root = normalizeRemotePath(b.ws || '')
-        if (root && target !== root && !target.startsWith(root.replace(/\/+$/, '') + '/')) {
-          throw new Error(`rw_restore: refusing to restore into ${target} — it is outside this session's remote workspace (${root})`)
-        }
-        const mode = args.mode === 'merge' ? 'merge' : 'replace'
-        const backupDir = await backupDirForBinding(b)
-        if (!backupDir) throw new Error('rw_restore: cannot determine the remote backup directory — set the backupDir config option')
-        const where = args.where === 'local' ? 'local' : 'remote'
-        let archive = `${backupDir.replace(/\/+$/, '')}/${file}`
-        if (where === 'local') {
-          const localDir = localBackupDirFor(mirrorRootFor(b.host, b.username, b.port))
-          const up = await pushBackup(b.pool, {
-            localPath: path.join(localDir, file),
-            remoteDir: backupDir,
-            maxTransferBytes: Number(config.maxBackupTransferBytes) || 0,
-          })
-          if (!up.ok) throw new Error('rw_restore: could not upload the local copy — ' + up.error)
-          archive = up.remotePath
-        }
-        const r = await restoreBackup(b.pool, { archive, target, mode })
-        audit('restore', `${mode} restore ${file} → ${target}`, r.ok ? 0 : 1, b)
-        if (!r.ok) throw new Error('rw_restore: ' + (r.error || 'restore failed'))
-        return {
-          text: `${r.mode === 'merge' ? 'Merged into' : 'Replaced'} ${target} from ${file} (${r.members} file(s) now present; the archive was verified before anything was written)${where === 'local' ? ' [from the local copy, uploaded first]' : ''}.`,
-        }
-      },
-    }),
   ]
 
   for (const t of tools) {
@@ -2844,41 +2610,6 @@ export async function apply(ctx, config) {
       sendJson, readBody, resolveRequestBinding, decodeBuf, encodeText, audit, config, mirrorDirFor,
     }),
 
-    ...createBackupRoutes({
-      sendJson,
-      readBody,
-      config,
-      audit,
-      resolveRequestBinding,
-      // The settings panel may act on a machine that is not the current one; the
-      // id is resolved to a real pool so a backup never runs against whichever
-      // machine happened to be active.
-      resolveMachineBinding: async (machineId) => {
-        const m = machines.find((x) => x.id === machineId)
-        if (!m) {
-          const err = new Error(`机器不存在：${machineId}`)
-          err.httpStatus = 404
-          throw err
-        }
-        const target = poolForMachine(identityOf(m))
-        return {
-          pool: target,
-          ws: String(m.workspace || ''),
-          host: m.host,
-          username: m.username,
-          port: Number(m.port) || 22,
-          alias: aliasOf(m),
-          mirrorDir: m.workspace ? mirrorDirFor(m.workspace, m.host, m.username, m.port) : null,
-          bound: false,
-          local: false,
-        }
-      },
-      localRootFor: localBackupRootFor,
-      // "Back up all my workspaces" means what the SIDEBAR shows, so the route
-      // asks the same collection the panel displays.
-      workspacesFor: (b) => remoteWorkspacesFor({ host: b.host, username: b.username, port: b.port }),
-    }),
-
     {
       kind: 'exact',
       path: '/dsh-remote/workspace',
@@ -3350,10 +3081,15 @@ export async function apply(ctx, config) {
             const q = new URL(req.url, 'http://localhost').searchParams
             const id = q.get('machineId') || ''
             const attach = id ? webAttaches.get(id) : undefined
+            // Deploy tasks ride along so a REOPENED window sees an in-flight
+            // install immediately, without a separate poll's first tick.
+            const deploy = id ? deployTasks.forMachine(id) : null
             return sendJson(res, 200, {
               ok: true,
               attach: attach ? attach.describe() : null,
               attaches: [...webAttaches.values()].map((a) => a.describe()),
+              deploys: deployTasks.list(),
+              deploy: deploy ? deployTasks.describe(deploy) : null,
             })
           }
           if (req.method !== 'POST') return sendJson(res, 405, { ok: false, error: 'method not allowed' })
@@ -3398,75 +3134,113 @@ export async function apply(ctx, config) {
               })
             }
 
-            // install
+            // install — runs as a HOST-SIDE BACKGROUND TASK.
+            //
+            // It used to be one long HTTP request; npm can legitimately take
+            // minutes, and closing the tab mid-deploy lost the response AND
+            // every trace of the progress — the user could not tell whether it
+            // succeeded, and a second click started a CONCURRENT npm install
+            // into the same prefix. Now the work runs detached from the request
+            // lifecycle, every step's outcome is recorded as it happens, and
+            // the UI re-attaches by polling install-status (or by clicking the
+            // button again, which resumes rather than restarts).
             if (body.confirm !== true) {
               return sendJson(res, 400, { ok: false, error: '安装需要在请求里显式 confirm: true' })
             }
-            const pout = await target.exec(buildProbeCommand({ prefix, installedCommand, defaultPrefixFor: config.webInstallPrefix ? '' : 'home' }), { timeoutMs: 30000 })
-            const facts = parseProbe(pout && pout.stdout)
-            const verdict = judgeProbe(facts, { installedCommand })
-            if (!verdict.canAutoInstall) {
-              const why = verdict.findings.filter((x) => x.severity === 'blocker').map((x) => x.summary).join('；')
-              audit('web-deploy', `install ${machine.host} refused: ${why}`, 1, machine)
-              return sendJson(res, 400, { ok: false, error: `无法自动安装：${why || '远端缺少前提条件'}`, verdict })
+            // RESUME: a running/queued task for this machine is returned as-is.
+            // One deploy per machine at a time — two concurrent `npm --prefix`
+            // into the same directory corrupt the tree.
+            const already = deployTasks.forMachine(machineId)
+            if (already && (already.status === 'queued' || already.status === 'running') && body.force !== true) {
+              return sendJson(res, 200, { ok: true, resumed: true, task: deployTasks.describe(already) })
             }
-            const installPrefix = facts.resolvedPrefix || resolvePrefix(facts, { prefix: config.webInstallPrefix || '' })
-            // A registry the user set explicitly wins; otherwise the remote's own
-            // npm config is left alone, which is what an internal mirror needs.
-            // `--registry` is only added when configured — overriding a working
-            // corporate mirror with the public one would be a regression.
-            const registry = String(body.registry || config.webInstallRegistry || '').trim()
-            // Proxy comes from the remote's own environment; the operator may
-            // override it per-install when the inherited one is wrong.
-            const env = body.proxy && typeof body.proxy === 'object'
-              ? Object.fromEntries(Object.entries(body.proxy).filter(([, v]) => typeof v === 'string'))
-              : undefined
-            const plan = buildInstallPlan({
-              facts,
-              prefix: installPrefix,
-              version: String(body.version || config.webInstallVersion || DEFAULT_INSTALL_VERSION),
-              registry,
-              env,
-            })
-            const results = []
-            for (const step of plan.steps) {
-              let res2
-              try {
-                res2 = await target.exec(step.command, {
-                  timeoutMs: step.timeoutMs || 120000,
-                  // Per-step env exists for the proxy override (P4); pool.exec
-                  // passes it through to the remote process.
-                  ...(step.env ? { env: step.env } : {}),
-                })
-              } catch (err) {
-                results.push({ id: step.id, title: step.title, ok: false, code: -1, output: String((err && err.message) || err) })
-                break
-              }
-              const r = stepResult(step, res2)
-              results.push(r)
-              if (!r.ok) break
-            }
-            const ok = results.length === plan.steps.length && results.every((r) => r.ok)
-            if (ok) {
-              // Persist so the attach flow uses the working build from now on.
-              persistWebAttachCommand(machine, plan.command)
-              audit('web-deploy', `install ${machine.host} → ${plan.command}`, 0, machine)
-              return sendJson(res, 200, { ok: true, steps: results, command: plan.command, prefix: installPrefix })
+            if (already && body.force !== true && already.status !== 'done' && already.status !== 'failed' && already.status !== 'cancelled') {
+              return sendJson(res, 200, { ok: true, resumed: true, task: deployTasks.describe(already) })
             }
-            const failed = results.find((r) => !r.ok)
-            audit('web-deploy', `install ${machine.host} failed at ${failed && failed.id}`, 1, machine)
-            // A failure that looks like a network/registry problem gets the AI
-            // escape hatch suggested, since that is precisely the long tail the
-            // deterministic path cannot classify.
-            const looksNetworky = /ETIMEDOUT|ENOTFOUND|ECONNREFUSED|network|proxy|403|404/i.test(String(failed && failed.output))
-            return sendJson(res, 500, {
-              ok: false,
-              error: `安装失败于「${failed ? failed.title : '未知步骤'}」`,
-              steps: results,
-              prefix: installPrefix,
-              suggestInvestigate: true,
-              ...(looksNetworky ? { hint: '看起来是网络或源的问题，可以让 AI 排查。' } : {}),
+            const { task } = deployTasks.start(machineId, `deploy ${machine.host}`, async (ctx) => {
+              // Everything below is the SAME plan as before, but progress goes
+              // to the task (visible while it runs) instead of one response.
+              const pout = await target.exec(buildProbeCommand({ prefix, installedCommand, defaultPrefixFor: config.webInstallPrefix ? '' : 'home' }), { timeoutMs: 30000 })
+              const facts = parseProbe(pout && pout.stdout)
+              const verdict = judgeProbe(facts, { installedCommand })
+              if (!verdict.canAutoInstall) {
+                const why = verdict.findings.filter((x) => x.severity === 'blocker').map((x) => x.summary).join('；')
+                audit('web-deploy', `install ${machine.host} refused: ${why}`, 1, machine)
+                throw new Error(`无法自动安装：${why || '远端缺少前提条件'}`)
+              }
+              const installPrefix = facts.resolvedPrefix || resolvePrefix(facts, { prefix: config.webInstallPrefix || '' })
+              // A registry the user set explicitly wins; otherwise the remote's
+              // own npm config is left alone (internal mirrors keep working).
+              const registry = String(body.registry || config.webInstallRegistry || '').trim()
+              const env = body.proxy && typeof body.proxy === 'object'
+                ? Object.fromEntries(Object.entries(body.proxy).filter(([, v]) => typeof v === 'string'))
+                : undefined
+              const plan = buildInstallPlan({
+                facts,
+                prefix: installPrefix,
+                version: String(body.version || config.webInstallVersion || DEFAULT_INSTALL_VERSION),
+                registry,
+                env,
+              })
+              ctx.progress({ totalSteps: plan.steps.length, prefix: installPrefix })
+              const results = []
+              for (const step of plan.steps) {
+                if (ctx.cancelled) break
+                task.current = step.title
+                ctx.progress({ doneSteps: results.length })
+                let res2
+                try {
+                  res2 = await target.exec(step.command, {
+                    timeoutMs: step.timeoutMs || 120000,
+                    ...(step.env ? { env: step.env } : {}),
+                  })
+                } catch (err) {
+                  results.push({ id: step.id, title: step.title, ok: false, code: -1, output: String((err && err.message) || err) })
+                  break
+                }
+                const r = stepResult(step, res2)
+                results.push(r)
+                task.steps = [...results]
+                if (!r.ok) break
+              }
+              task.steps = [...results]
+              const ok = results.length === plan.steps.length && results.every((r) => r.ok)
+              if (ok) {
+                // Persist so the attach flow uses the working build from now on.
+                persistWebAttachCommand(machine, plan.command)
+                audit('web-deploy', `install ${machine.host} → ${plan.command}`, 0, machine)
+                return { ok: true, steps: results, command: plan.command, prefix: installPrefix }
+              }
+              const failed = results.find((r) => !r.ok)
+              audit('web-deploy', `install ${machine.host} failed at ${failed && failed.id}`, 1, machine)
+              const looksNetworky = /ETIMEDOUT|ENOTFOUND|ECONNREFUSED|network|proxy|403|404/i.test(String(failed && failed.output))
+              const err = new Error(`安装失败于「${failed ? failed.title : '未知步骤'}」`)
+              err.detail = {
+                steps: results,
+                prefix: installPrefix,
+                suggestInvestigate: true,
+                ...(looksNetworky ? { hint: '看起来是网络或源的问题，可以让 AI 排查。' } : {}),
+              }
+              throw err
             })
+            // Answer immediately: the task object IS the handle the UI polls.
+            return sendJson(res, 200, { ok: true, started: true, task: deployTasks.describe(task) })
+          }
+
+          // install-status: re-attach to a deploy at ANY time (window reopened,
+          // page refreshed). Also carried by GET /dsh-remote/web-attach.
+          if (action === 'install-status') {
+            const t = deployTasks.forMachine(machineId)
+            if (!t) return sendJson(res, 200, { ok: true, task: null })
+            return sendJson(res, 200, { ok: true, task: deployTasks.describe(t) })
+          }
+
+          // install-cancel: cooperative cancel between steps.
+          if (action === 'install-cancel') {
+            const t = deployTasks.forMachine(machineId)
+            if (!t) return sendJson(res, 200, { ok: true, cancelled: false })
+            const did = deployTasks.cancel(machineId)
+            return sendJson(res, 200, { ok: true, cancelled: did, task: deployTasks.describe(t) })
           }
 
           if (action === 'open') {

package/lib/paths.js

@@ -203,8 +203,16 @@ export function relPathUnder(root, p) {
 }
 
 export function truncate(s, max) {
-  if (s.length <= max) return s
-  return s.slice(0, max) + `\n…[truncated: ${s.length - max} more chars]`
+  // A missing/NaN cap is a CONFIG BUG (measured: a bare `new SshPool({...})`
+  // with no maxOutputChars turned EVERY exec result into a 29-char truncation
+  // marker — `'x'.length <= undefined` is false, so the "cap" branch always ran
+  // and `s.length - undefined` printed NaN — silently destroying every remote
+  // output, including the web-attach startup token). A bad cap must disable
+  // truncation, not destroy the string.
+  const limit = Number(max)
+  if (!Number.isFinite(limit) || limit <= 0) return s
+  if (s.length <= limit) return s
+  return s.slice(0, limit) + `\n…[truncated: ${s.length - limit} more chars]`
 }
 
 /** 32-bit string hash rendered in base36 (short, collision-safe enough). */

package/lib/web-attach.js

@@ -301,12 +301,24 @@ export class WebAttach {
       // Both failure shapes carry the same diagnostics: the process either died
       // (its output is the whole story) or is still booting after the deadline.
       if (launchFailed(out)) {
+        // The remote process is already gone — nothing to clean up.
         throw new Error('web-attach: the remote DSH exited during startup.'
           + explainLaunchFailure(tail || out)
           + ` ${tail || 'no output'}`)
       }
       const parsed = parseWebStart(out)
       if (!parsed) {
+        // A timed-out launch may STILL be booting: the deadline expiring is not
+        // evidence the process died. Kill it before throwing, or every retry
+        // leaks another remote server (measured: three leftover `dsh --port 0`
+        // processes after three failed attaches). A PID of 0 means the launcher
+        // could not report one — nothing to target.
+        if (this.remotePid > 0) {
+          try {
+            await exec(buildStopCommand(this.remotePid, logPath), { timeoutMs: 20000 })
+            this.remotePid = 0
+          } catch { /* the process may already be gone; a leftover is worse than a failed kill attempt only if it repeats, and the next attach replaces this session */ }
+        }
         throw new Error(
           `web-attach: the remote DSH did not report a startup token within ${waitSeconds}s.`
           + ` Check that \`${command}\` exists on the remote and can boot a web profile.`

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-remote",
-  "version": "0.8.40",
-  "description": "Remote-work assistant for DeepSeek Harness: connect SSH (password/key/agent/keyboard-interactive/proxy jump), pick a remote workspace, operate on it with 25 rw_* tools (incl. rw_edit/rw_stat/rw_mkdir/rw_remove/rw_move/rw_forward), conflict-aware mirror sync, one-click backup/restore of every sidebar workspace, remote dsh deploy, port forwarding, optional side-bar remote file editing, audit log, keychain passwords.",
+  "version": "0.8.42",
+  "description": "Remote-work assistant for DeepSeek Harness: connect SSH (password/key/agent/keyboard-interactive/proxy jump), pick a remote workspace, operate on it with 22 rw_* tools (incl. rw_edit/rw_stat/rw_mkdir/rw_remove/rw_move/rw_forward), conflict-aware mirror sync, one-click remote dsh deploy + web UI attach, port forwarding, optional side-bar remote file editing, audit log, keychain passwords.",
   "license": "MIT",
   "author": "flymysql <flyphp@outlook.com>",
   "readme": "README.md",