dsh-remote 0.8.67 → 0.8.70

package/lib/openssh.js

@@ -208,6 +208,10 @@ export function baseSshArgs(config, { forSecret = false } = {}) {
     const port = proxy.port && Number(proxy.port) !== 22 ? `:${Number(proxy.port)}` : ''
     args.push('-J', `${user}${proxy.host}${port}`)
   }
+  // An explicit known_hosts file (tests keep loopback keys OUT of the user's
+  // real ~/.ssh/known_hosts with this; ssh ignores $HOME on some platforms).
+  // Checking strength is unchanged — StrictHostKeyChecking below still applies.
+  if (config.knownHostsFile) args.push('-o', `UserKnownHostsFile=${config.knownHostsFile}`)
   args.push(...hostKeyArgs(config))
   const connectSecs = Math.max(1, Math.round((Number(config.connectTimeoutMs) || 15000) / 1000))
   args.push('-o', `ConnectTimeout=${connectSecs}`, '-o', 'ServerAliveInterval=15', '-o', 'ServerAliveCountMax=3')
@@ -244,7 +248,7 @@ export class OpenSshConnection extends EventEmitter {
   spawnSsh(extraArgs, { tty = false } = {}) {
     if (this.closed) throw new Error('ssh connection closed')
     const args = [
-      ...baseSshArgs(this.pool.config, { forSecret: !!this.secret }),
+      ...baseSshArgs(this.pool._argConfig(), { forSecret: !!this.secret }),
       ...extraArgs,
     ]
     const child = spawn(this.sshBinary, args, {
@@ -395,6 +399,19 @@ export class SystemOpenSshPool {
     this._secretPromise = null
   }
 
+  /**
+   * The config baseSshArgs should see. `opts.knownHostsFile` (a path, or a
+   * function returning one, exactly like the native pool) used to be stored
+   * and silently dropped — so a custom known_hosts never reached the CLI, and
+   * tests had no way to keep loopback keys out of the user's real file.
+   * Resolved per call so a function value is honored as late as the native
+   * backend resolves it.
+   */
+  _argConfig() {
+    const kh = typeof this._knownHostsFile === 'function' ? this._knownHostsFile() : this._knownHostsFile
+    return kh ? { ...this.config, knownHostsFile: kh } : this.config
+  }
+
   /** The destination OpenSSH should connect to (an alias passes through). */
   destination() {
     // A bare alias resolves through ~/.ssh/config inside ssh itself, so it is
@@ -502,7 +519,12 @@ export class SystemOpenSshPool {
    * Run one `ssh` invocation and collect its result.
    *
    * @param {string[]} extraArgs - arguments appended after the shared base.
-   * @param {object} [opts] - `timeoutMs`, `signal` (AbortSignal), `stdin`.
+   * @param {object} [opts] - `timeoutMs`, `signal` (AbortSignal), `stdin`,
+   *   `onData(channel, chunk)` — a streaming tap the native backend has had
+   *   since issue #70. A background job's value is its LIVE output, which the
+   *   job ring must receive as it arrives; a backend that only returns the
+   *   accumulated text loses every byte the caller stopped waiting for
+   *   (issue #80). Tap errors are not command errors, so the call is guarded.
    * @returns {Promise<{code: number|null, signal: string|null, stdout: string, stderr: string}>}
    */
   async _runSsh(extraArgs, opts = {}) {
@@ -510,7 +532,7 @@ export class SystemOpenSshPool {
     const secret = await this._resolveSecret()
     const timeoutMs = opts.timeoutMs || this.config.commandTimeoutMs
     const sshBinary = resolveSshBinary(this.config)
-    const args = [...baseSshArgs(this.config, { forSecret: !!secret }), ...extraArgs]
+    const args = [...baseSshArgs(this._argConfig(), { forSecret: !!secret }), ...extraArgs]
     return new Promise((resolve) => {
       let child
       try {
@@ -524,6 +546,7 @@ export class SystemOpenSshPool {
       let exitCode = null
       let exitSignal = null
       const cap = Math.max(this.config.maxOutputChars * 4, 1024 * 1024)
+      const onData = typeof opts.onData === 'function' ? opts.onData : null
       const cleanupAbort = () => { if (opts.signal && onAbort) opts.signal.removeEventListener('abort', onAbort) }
       let onAbort = null
       const finish = () => {
@@ -562,8 +585,17 @@ export class SystemOpenSshPool {
         }
         opts.signal.addEventListener('abort', onAbort, { once: true })
       }
-      child.stdout.on('data', (d) => { if (stdout.length < cap) stdout += d })
-      child.stderr.on('data', (d) => { if (stderr.length < cap) stderr += d })
+      // The tap fires even past the local cap, exactly like the native
+      // backend's: a promoted job's ring has its own bounds and must keep
+      // receiving output the truncated return value no longer holds.
+      child.stdout.on('data', (d) => {
+        if (stdout.length < cap) stdout += d
+        if (onData) { try { onData('stdout', d) } catch { /* tap errors are not command errors */ } }
+      })
+      child.stderr.on('data', (d) => {
+        if (stderr.length < cap) stderr += d
+        if (onData) { try { onData('stderr', d) } catch { /* tap errors are not command errors */ } }
+      })
       child.on('error', (e) => {
         if (settled) return
         stderr += String((e && e.message) || e)
@@ -651,9 +683,9 @@ export class SystemOpenSshPool {
       if (this.platform === 'windows' && this.gitBashPath) {
         // Pipe the script to `bash -s` over stdin: no quoting round-trip, so
         // quotes/backslashes/newlines survive verbatim (same as the native pool).
-        return this._runSsh(['--', this.destination(), `"${this.gitBashPath}" -s`], { timeoutMs, signal: opts.signal, stdin: String(command) })
+        return this._runSsh(['--', this.destination(), `"${this.gitBashPath}" -s`], { timeoutMs, signal: opts.signal, stdin: String(command), onData: opts.onData })
       }
-      return this._runSsh(['--', this.destination(), String(command)], { timeoutMs, signal: opts.signal })
+      return this._runSsh(['--', this.destination(), String(command)], { timeoutMs, signal: opts.signal, onData: opts.onData })
     })
   }
 
@@ -662,7 +694,7 @@ export class SystemOpenSshPool {
     const Sftp = loadSftpEngine()
     const secret = await this._resolveSecret()
     const sshBinary = resolveSshBinary(this.config)
-    const args = [...baseSshArgs(this.config, { forSecret: !!secret }), '-s', this.destination(), 'sftp']
+    const args = [...baseSshArgs(this._argConfig(), { forSecret: !!secret }), '-s', this.destination(), 'sftp']
     const child = spawn(sshBinary, args, { stdio: ['pipe', 'pipe', 'pipe'], env: secret ? askpassEnv(secret) : undefined })
 
     // ssh2's SFTP engine only reaches `_protocol` for channelData/channelClose,

package/lib/paths.js

@@ -184,6 +184,33 @@ export function remotePathBase(p) {
   return base
 }
 
+/**
+ * Workspace title for a REMOTE mirror: `<machine>-<remote basename>`.
+ *
+ * The Harness derives a Workspace title from the basename of the directory it
+ * registers, and a remote workspace is registered on its LOCAL mirror
+ * (`$DSH_HOME/remote-workspaces/<host>-<user>-<port>/<basename>`). That last
+ * segment is still the remote basename, so a local `/mnt/xdfs` and a remote
+ * `/mnt/xdfs` both read "xdfs". dsh-remote pre-registers the mirror with this
+ * host-qualified title, so the two are distinguishable from the start.
+ *
+ * The machine's display name wins; a machine saved without one (or named after
+ * the folder itself) falls back to its host. A workspace title must be
+ * non-empty, so the bare basename is the last resort.
+ *
+ * @param {string} remotePath - remote workspace directory (POSIX or Windows).
+ * @param {{name?: string, host?: string}} [machine] - the machine registry record.
+ * @returns {string} a non-empty, host-qualified title.
+ */
+export function remoteWorkspaceTitle(remotePath, machine) {
+  const base = remotePathBase(remotePath)
+  const label = String((machine && machine.name) || '').trim()
+  const host = String((machine && machine.host) || '').trim()
+  if (label && label !== base) return label + '-' + base
+  if (host && host !== base) return host + '-' + base
+  return base
+}
+
 /** Relative path of `p` under `root` (POSIX form, no leading slash), or null
  * when `p` is not inside `root`. Both POSIX and Windows drive paths work
  * (Windows is compared in its `/D:/…` POSIX-equivalent form). */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-remote",
-  "version": "0.8.67",
-  "description": "Remote-work assistant for DeepSeek Harness: connect SSH (password/key/agent/keyboard-interactive, multi-hop ProxyJump), pick a remote workspace, operate on it with 22 rw_* tools, conflict-aware mirror sync, an embedded PTY terminal, one-click remote dsh deploy + web UI attach, port forwarding, host grouping, remote sandbox fencing, audit log, keychain passwords.",
+  "version": "0.8.70",
+  "description": "Remote-work assistant for DeepSeek Harness: connect SSH (password/key/agent/keyboard-interactive, multi-hop ProxyJump), list hosts from ~/.ssh/config, pick a remote workspace, operate on it with 21 rw_* tools, conflict-aware mirror sync, an embedded PTY terminal, remote DSH web UI attach, port forwarding, host grouping, remote sandbox fencing, audit log, keychain passwords.",
   "license": "MIT",
   "author": "flymysql <flyphp@outlook.com>",
   "readme": "README.md",