dsh-ssh-manage 0.3.1 → 0.3.2

package/README.en.md

@@ -24,7 +24,7 @@
 
 - **Host management** — scan the config, groups, tags, favorites, notes, latency and host inspection;
 - **Interactive terminal** — ssh2 allocates a PTY, xterm.js renders it, with colors, arrow keys, full-screen programs such as `vim`/`top`, and window resizing;
-- **Day-to-day operations** — batch commands, SFTP browse/upload/download, connection tests;
+- **Day-to-day operations** — batch commands, SFTP browse/mkdir/rename/delete/upload/download, connection tests;
 - **Credentials** — one AES-256-GCM encrypted password per host, never written to `~/.ssh/config` and never returned to the browser;
 - **Agent tool** — `ssh_manager` exposes the same capabilities to the model.
 
@@ -53,7 +53,7 @@ No more jumping between a terminal and DSH, and no need to remember where each h
 ### Batch commands and files
 
 - **Batch commands** — select hosts and run one command across them, with per-host stdout/stderr/exit code.
-- **SFTP** — browse remote directories, upload and download from the host drawer, starting at the current user's home directory.
+- **SFTP** — browse remote directories from the host drawer, create folders, rename, delete files/empty directories, upload and download; the last directory per host is remembered.
 - **Connection test** — measures latency and writes it back to host metadata.
 - **Host inspection** — distro, CPU cores, memory and disk capacity.
 
@@ -68,7 +68,7 @@ No more jumping between a terminal and DSH, and no need to remember where each h
 
 ### Agent tool
 
-`ssh_manager` exposes: `overview`, `list_hosts`, `save_host`, `delete_host`, `set_metadata`, `save_password`, `delete_password`, `test_connection`, `inspect_host`, `exec`, `batch_exec`, `sftp_list`, `sftp_upload`, `sftp_download`.
+`ssh_manager` exposes: `overview`, `list_hosts`, `save_host`, `delete_host`, `set_metadata`, `save_password`, `delete_password`, `test_connection`, `inspect_host`, `exec`, `batch_exec`, `sftp_list`, `sftp_upload`, `sftp_download`, `sftp_mkdir`, `sftp_rename`, `sftp_delete`.
 
 The password parameter is write-only; no response contains a plaintext password.
 
@@ -96,16 +96,16 @@ Creating a host requires alias, hostname and password. The password is not writt
 
 ### From npm (recommended)
 
-npm package: [`dsh-ssh-manage`](https://www.npmjs.com/package/dsh-ssh-manage) (current version `0.3.1`).
+npm package: [`dsh-ssh-manage`](https://www.npmjs.com/package/dsh-ssh-manage) (current version `0.3.2`).
 
 ```text
-plugin_manager action=install_bundle target=dsh-ssh-manage@0.3.1
+plugin_manager action=install_bundle target=dsh-ssh-manage@0.3.2
 ```
 
 Or with the DSH CLI:
 
 ```bash
-dsh plugin add dsh-ssh-manage@0.3.1
+dsh plugin add dsh-ssh-manage@0.3.2
 ```
 
 After installation, refresh the Web page; the sidebar shows an "SSH Hosts" entry with id `dsh-ssh-manage`.
@@ -137,7 +137,7 @@ and make sure the package is resolvable by the profile (for example `link:` to t
 
 | | Requirement |
 | --- | --- |
-| **DSH** | **`>=0.2.1-rc.3 <0.3.1`** (validated on DSH Desktop `0.2.1-rc.3`) |
+| **DSH** | **`>=0.2.1-rc.3 <0.3.0`** (validated on DSH Desktop `0.2.1-rc.3`) |
 | **Node.js** | `>=20` (follows the DSH runtime) |
 | **Platform** | Validated on macOS; the test suite only uses Node built-ins and runs cross-platform |
 | **Network** | Reachable SSH port (22 by default, or the configured port) |
@@ -221,6 +221,7 @@ The terminal uses vendored xterm.js 6.0.0 (MIT, see `assets/LICENSE.xterm`), @xt
 - **Config editing scope**: the editor only changes `Host`, `HostName`, `User`, `Port` and plugin metadata; maintain other SSH directives in `~/.ssh/config`.
 - **Batch commands** run one command; they are not an interactive terminal. Per-host output is capped at 1 MB and marked `truncated` when exceeded.
 - **File size**: SFTP files are capped at 10 MB.
+- **SFTP rename/delete**: rename refuses to overwrite an existing destination by default (`sftp_rename` can pass `overwrite: true` explicitly); deleting a directory requires it to be empty, and root paths, `.`/`..` and drive roots are refused; symlinks are removed as links, not followed.
 - **xterm assets**: the first terminal open loads about 500 KB of xterm.js basics; the search addon loads on demand, about 556 KiB total from the same origin (no CDN).
 
 ## Contributing

package/README.md

@@ -24,7 +24,7 @@
 
 - **主机管理**：扫描配置、分组、标签、收藏、备注、连接延迟、主机巡检；
 - **交互式终端**：ssh2 分配 PTY，xterm.js 渲染，支持彩色输出、方向键、`vim`/`top` 等全屏程序和窗口自适应；
-- **日常运维**：批量命令、SFTP 目录浏览 / 上传 / 下载、测试连接；
+- **日常运维**：批量命令、SFTP 目录浏览 / 新建 / 重命名 / 删除 / 上传 / 下载、测试连接；
 - **凭据管理**：每台主机保存一份 AES-256-GCM 加密密码，不写进 `~/.ssh/config`，也不返回给浏览器；
 - **Agent 工具**：`ssh_manager` 把同一套能力开放给模型。
 
@@ -53,7 +53,7 @@
 ### 批量命令与文件
 
 - **批量命令**：勾选多台主机，一次执行同一条命令，按主机汇总 stdout / stderr / 退出码。
-- **SFTP**：在主机抽屉里浏览远程目录、上传、下载；默认从当前用户主目录开始。
+- **SFTP**：在主机抽屉里浏览远程目录，新建文件夹、重命名、删除文件/空目录、上传、下载；会记住每台主机上次所在目录。
 - **测试连接**：记录连接延迟，结果写回主机信息。
 - **主机巡检**：读取发行版、CPU 核心数、内存、磁盘容量。
 
@@ -70,7 +70,7 @@
 
 `ssh_manager` 工具开放以下动作，和页面走同一套 Host 逻辑：
 
-`overview`、`list_hosts`、`save_host`、`delete_host`、`set_metadata`、`save_password`、`delete_password`、`test_connection`、`inspect_host`、`exec`、`batch_exec`、`sftp_list`、`sftp_upload`、`sftp_download`。
+`overview`、`list_hosts`、`save_host`、`delete_host`、`set_metadata`、`save_password`、`delete_password`、`test_connection`、`inspect_host`、`exec`、`batch_exec`、`sftp_list`、`sftp_upload`、`sftp_download`、`sftp_mkdir`、`sftp_rename`、`sftp_delete`。
 
 密码字段是 write-only，任何返回值都不包含密码明文。
 
@@ -98,16 +98,16 @@
 
 ### 从 npm 安装（推荐）
 
-npm 包：[`dsh-ssh-manage`](https://www.npmjs.com/package/dsh-ssh-manage)（当前版本 `0.3.1`）。
+npm 包：[`dsh-ssh-manage`](https://www.npmjs.com/package/dsh-ssh-manage)（当前版本 `0.3.2`）。
 
 ```text
-plugin_manager action=install_bundle target=dsh-ssh-manage@0.3.1
+plugin_manager action=install_bundle target=dsh-ssh-manage@0.3.2
 ```
 
 或使用 DSH CLI：
 
 ```bash
-dsh plugin add dsh-ssh-manage@0.3.1
+dsh plugin add dsh-ssh-manage@0.3.2
 ```
 
 安装后刷新 Web 页面，左侧栏会出现「SSH 主机」入口，入口 id 为 `dsh-ssh-manage`。
@@ -139,7 +139,7 @@ plugin_manager action=install_bundle target=<仓库绝对路径>/dsh-ssh-manage
 
 | | 要求 |
 | --- | --- |
-| **DSH** | **`>=0.2.1-rc.3 <0.3.1`**（实机验证版本：DSH Desktop `0.2.1-rc.3`） |
+| **DSH** | **`>=0.2.1-rc.3 <0.3.0`**（实机验证版本：DSH Desktop `0.2.1-rc.3`） |
 | **Node.js** | `>=20`（跟随 DSH 内置运行时） |
 | **平台** | 实机验证 macOS；测试套件只依赖 Node 内置模块，可跨平台运行 |
 | **网络** | 需要能访问目标 SSH 主机的 22 端口（或配置的端口） |
@@ -224,6 +224,7 @@ npm test
 - **配置编辑范围**：编辑器只修改 `Host`、`HostName`、`User`、`Port` 与插件元数据；其它 SSH 指令请在 `~/.ssh/config` 中维护。
 - **批量命令**：一次执行一条命令，不等同于交互式终端；单台输出上限 1 MB，超出会标记 `truncated`。
 - **文件大小**：SFTP 单文件上限 10 MB。
+- **SFTP 重命名/删除**：重命名默认拒绝覆盖已存在的目标（`sftp_rename` 工具可显式传 `overwrite: true`）；删除目录要求目录为空，根路径、`.`/`..` 和盘符根会被拒绝；符号链接按链接本身删除，不会跟随到目标。
 - **xterm 资源**：首次打开会加载约 500 KB 的 xterm.js 基础资源；搜索组件按需加载，总计约 556 KiB（本地同源，不访问 CDN）。
 
 ## 参与贡献

package/client.js

@@ -182,6 +182,19 @@ window.__ModuleLoader__.load({
       'drawer.files.path': ['远程路径', 'Remote path'],
       'drawer.files.up': ['上级目录', 'Parent directory'],
       'drawer.files.empty': ['目录暂无内容。', 'This directory is empty.'],
+      'drawer.files.mkdir': ['新建文件夹', 'New folder'],
+      'drawer.files.mkdirTitle': ['新建文件夹', 'New folder'],
+      'drawer.files.rename': ['重命名', 'Rename'],
+      'drawer.files.renameTitle': ['重命名', 'Rename'],
+      'drawer.files.delete': ['删除', 'Delete'],
+      'drawer.files.deleteTitle': ['删除', 'Delete'],
+      'drawer.files.deleteConfirm': ['确定删除“{name}”？删除目录时要求目录为空。', 'Delete "{name}"? Directories must be empty.'],
+      'drawer.files.name': ['名称', 'Name'],
+      'drawer.files.invalidName': ['名称不能为空，也不能包含 / 或 \\。', 'Name must be non-empty and cannot contain / or \\.'],
+      'drawer.files.created': ['文件夹已创建', 'Folder created'],
+      'drawer.files.renamed': ['已重命名', 'Renamed'],
+      'drawer.files.deleted': ['已删除', 'Deleted'],
+      'common.create': ['新建', 'Create'],
       'drawer.files.dir': ['目录', 'dir'],
       'drawer.files.uploading': ['上传中…', 'Uploading…'],
       'drawer.details.connection': ['连接信息', 'Connection'],
@@ -793,7 +806,7 @@ window.__ModuleLoader__.load({
       return h('span', { className: 'ssh-spinner', style: { width: size, height: size } })
     }
 
-    function Button({ children, variant, size, onClick, disabled, title, type = 'button', className, ariaPressed }) {
+    function Button({ children, variant, size, onClick, disabled, title, type = 'button', className, ariaPressed, autoFocus }) {
       return h(
         'button',
         {
@@ -803,6 +816,7 @@ window.__ModuleLoader__.load({
           disabled,
           title,
           'aria-pressed': ariaPressed,
+          autoFocus,
         },
         children,
       )
@@ -4088,25 +4102,50 @@ window.__ModuleLoader__.load({
       )
     }
 
+    const SFTP_PATH_PREFIX = 'dsh-ssh-manage:sftp-path:'
+
+    function readSftpPath(alias) {
+      try {
+        const stored = window.localStorage.getItem(SFTP_PATH_PREFIX + alias)
+        return stored && stored.trim() ? stored : '.'
+      } catch {
+        return '.'
+      }
+    }
+
+    function saveSftpPath(alias, target) {
+      try {
+        window.localStorage.setItem(SFTP_PATH_PREFIX + alias, target)
+      } catch {}
+    }
+
     function FilesView({ model, host }) {
-      const { t, notify, withPending } = model
-      const [path, setPath] = React.useState('.')
+      const { t, notify } = model
+      const [path, setPath] = React.useState(() => readSftpPath(host.host))
       const [entries, setEntries] = React.useState([])
       const [loading, setLoading] = React.useState(true)
       const [error, setError] = React.useState('')
       const [uploading, setUploading] = React.useState(false)
+      const [dialog, setDialog] = React.useState(null)
+      const [dialogValue, setDialogValue] = React.useState('')
+      const [dialogBusy, setDialogBusy] = React.useState(false)
+      const dialogBusyRef = React.useRef(false)
       const fileRef = React.useRef(null)
 
       const loadDirectory = React.useCallback(
-        async (target) => {
+        async (target, options = {}) => {
+          const normalized = String(target ?? '').trim() || '.'
           setLoading(true)
           setError('')
           try {
-            const value = await callAction('sftp/list', { host: host.host, path: target })
+            const value = await callAction('sftp/list', { host: host.host, path: normalized })
             setEntries(value.entries ?? [])
-            setPath(target)
+            setPath(normalized)
+            if (options.remember !== false) saveSftpPath(host.host, normalized)
+            return true
           } catch (failure) {
             setError(errorMessage(failure))
+            return false
           } finally {
             setLoading(false)
           }
@@ -4115,8 +4154,72 @@ window.__ModuleLoader__.load({
       )
 
       React.useEffect(() => {
-        void loadDirectory('.')
-      }, [loadDirectory])
+        let cancelled = false
+        void (async () => {
+          const initial = readSftpPath(host.host)
+          const ok = await loadDirectory(initial)
+          if (!ok && initial !== '.' && !cancelled) await loadDirectory('.', { remember: false })
+        })()
+        return () => { cancelled = true }
+      }, [host.host, loadDirectory])
+
+      React.useEffect(() => {
+        if (!dialog) return undefined
+        const onKey = (event) => {
+          if (event.key === 'Escape' && !dialogBusy) {
+            event.preventDefault()
+            event.stopPropagation()
+            setDialog(null)
+          }
+        }
+        document.addEventListener('keydown', onKey, true)
+        return () => document.removeEventListener('keydown', onKey, true)
+      }, [dialog, dialogBusy])
+
+      const openDialog = (mode, entry = null) => {
+        setDialog({ mode, entry })
+        setDialogValue(mode === 'rename' && entry ? entry.name : '')
+      }
+
+      async function submitDialog() {
+        if (!dialog || dialogBusyRef.current) return
+        dialogBusyRef.current = true
+        const name = dialogValue.trim()
+        if (dialog.mode !== 'delete') {
+          if (!name || name.includes('/') || name.includes('\\') || name === '.' || name === '..') {
+            notify(t('drawer.files.invalidName'), 'error')
+            return
+          }
+        }
+        setDialogBusy(true)
+        try {
+          if (dialog.mode === 'mkdir') {
+            await callAction('sftp/mkdir', { host: host.host, path: remoteJoin(path, name) })
+            notify(t('drawer.files.created'), 'success')
+          } else if (dialog.mode === 'rename') {
+            if (name === dialog.entry.name) {
+              setDialog(null)
+              return
+            }
+            await callAction('sftp/rename', {
+              host: host.host,
+              path: remoteJoin(path, dialog.entry.name),
+              newPath: remoteJoin(path, name),
+            })
+            notify(t('drawer.files.renamed'), 'success')
+          } else if (dialog.mode === 'delete') {
+            await callAction('sftp/delete', { host: host.host, path: remoteJoin(path, dialog.entry.name) })
+            notify(t('drawer.files.deleted'), 'success')
+          }
+          setDialog(null)
+          await loadDirectory(path)
+        } catch (failure) {
+          notify(t('state.error', { message: errorMessage(failure) }), 'error')
+        } finally {
+          dialogBusyRef.current = false
+          setDialogBusy(false)
+        }
+      }
 
       async function downloadEntry(entry) {
         const remote = remoteJoin(path, entry.name)
@@ -4183,6 +4286,12 @@ window.__ModuleLoader__.load({
             { title: t('common.refresh'), onClick: () => void loadDirectory(path), disabled: loading },
             loading ? h(Spinner, { size: 13 }) : h(IconRefresh, { size: 15 }),
           ),
+          h(
+            Button,
+            { size: 'sm', variant: 'ghost', onClick: () => openDialog('mkdir'), disabled: loading || uploading },
+            h(IconPlus, { size: 13 }),
+            t('drawer.files.mkdir'),
+          ),
           h(
             Button,
             { size: 'sm', onClick: () => fileRef.current && fileRef.current.click(), disabled: uploading },
@@ -4194,6 +4303,69 @@ window.__ModuleLoader__.load({
         error
           ? h('div', { className: 'ssh-fileError' }, h(IconAlert, { size: 13 }), h('span', null, error))
           : null,
+        dialog
+          ? h(
+              'div',
+              {
+                className: 'ssh-fileDialogScrim',
+                onMouseDown: () => {
+                  if (!dialogBusy) setDialog(null)
+                },
+              },
+              h(
+                'div',
+                {
+                  className: 'ssh-fileDialog',
+                  role: 'dialog',
+                  'aria-modal': 'true',
+                  'aria-label': dialog.mode === 'mkdir'
+                    ? t('drawer.files.mkdirTitle')
+                    : dialog.mode === 'rename'
+                      ? t('drawer.files.renameTitle')
+                      : t('drawer.files.deleteTitle'),
+                  onMouseDown: (event) => event.stopPropagation(),
+                },
+                h(
+                  'div',
+                  { className: 'ssh-fileDialogTitle' },
+                  dialog.mode === 'mkdir'
+                    ? t('drawer.files.mkdirTitle')
+                    : dialog.mode === 'rename'
+                      ? t('drawer.files.renameTitle')
+                      : t('drawer.files.deleteTitle'),
+                ),
+                dialog.mode === 'delete'
+                  ? h('div', { className: 'ssh-fileDialogBody' }, t('drawer.files.deleteConfirm', { name: dialog.entry?.name ?? '' }))
+                  : h(TextInput, {
+                      value: dialogValue,
+                      autoFocus: true,
+                      placeholder: t('drawer.files.name'),
+                      onChange: setDialogValue,
+                      onKeyDown: (event) => {
+                        if (event.key === 'Enter') void submitDialog()
+                        else if (event.key === 'Escape' && !dialogBusy) setDialog(null)
+                      },
+                    }),
+                h(
+                  'div',
+                  { className: 'ssh-fileDialogActions' },
+                  h(Button, { variant: 'ghost', size: 'sm', onClick: () => setDialog(null), disabled: dialogBusy }, t('common.cancel')),
+                  h(
+                    Button,
+                    {
+                      variant: dialog.mode === 'delete' ? 'dangerSolid' : 'primary',
+                      size: 'sm',
+                      autoFocus: dialog.mode === 'delete',
+                      onClick: () => void submitDialog(),
+                      disabled: dialogBusy,
+                    },
+                    dialogBusy ? h(Spinner, { size: 12 }) : null,
+                    dialog.mode === 'delete' ? t('common.delete') : t('common.create'),
+                  ),
+                ),
+              ),
+            )
+          : null,
         h(
           'div',
           { className: 'ssh-fileList' },
@@ -4220,13 +4392,27 @@ window.__ModuleLoader__.load({
                       entry.name,
                     ),
                     h('span', { className: 'ssh-fileSize' }, entry.directory ? t('drawer.files.dir') : formatBytes(entry.size)),
-                    entry.directory
-                      ? h('span', null)
-                      : h(
-                          IconButton,
-                          { title: t('common.download'), onClick: () => void downloadEntry(entry) },
-                          h(IconDownload, { size: 14 }),
-                        ),
+                    h(
+                      'div',
+                      { className: 'ssh-fileActions' },
+                      entry.directory
+                        ? null
+                        : h(
+                            IconButton,
+                            { title: t('common.download'), onClick: () => void downloadEntry(entry) },
+                            h(IconDownload, { size: 14 }),
+                          ),
+                      h(
+                        IconButton,
+                        { title: t('drawer.files.rename'), onClick: () => openDialog('rename', entry) },
+                        h(IconEdit, { size: 14 }),
+                      ),
+                      h(
+                        IconButton,
+                        { title: t('drawer.files.delete'), onClick: () => openDialog('delete', entry) },
+                        h(IconTrash, { size: 14 }),
+                      ),
+                    ),
                   ),
                 ),
         ),
@@ -5333,7 +5519,13 @@ body.ssh-col-resizing,body.ssh-col-resizing *{cursor:col-resize!important;user-s
 .ssh-filesPath{flex:1;min-width:140px}
 .ssh-fileError{display:flex;align-items:center;gap:6px;font-size:11.5px;color:var(--ssh-danger)}
 .ssh-fileList{flex:1;min-height:0;overflow:auto;border:.5px solid var(--ssh-border);border-radius:var(--ssh-radius-md)}
-.ssh-fileRow{display:grid;grid-template-columns:22px minmax(0,1fr) 90px 28px;align-items:center;gap:8px;padding:0 10px;height:34px;border-bottom:.5px solid var(--ssh-border);font-size:12px}
+.ssh-fileRow{display:grid;grid-template-columns:22px minmax(0,1fr) 90px auto;align-items:center;gap:8px;padding:0 10px;height:34px;border-bottom:.5px solid var(--ssh-border);font-size:12px}
+.ssh-fileActions{display:flex;align-items:center;gap:2px}
+.ssh-fileDialogScrim{position:absolute;inset:0;z-index:20;display:flex;align-items:center;justify-content:center;padding:20px;background:var(--dsw-alias-bg-mask-1,color-mix(in srgb,var(--ssh-text) 18%,transparent))}
+.ssh-fileDialog{width:min(360px,100%);padding:14px;border:.5px solid var(--ssh-border-strong);border-radius:12px;background:var(--ssh-layer-1);box-shadow:var(--ssh-shadow);display:flex;flex-direction:column;gap:10px}
+.ssh-fileDialogTitle{font-size:13px;font-weight:600;color:var(--ssh-text)}
+.ssh-fileDialogBody{font-size:12px;line-height:1.5;color:var(--ssh-text-2)}
+.ssh-fileDialogActions{display:flex;justify-content:flex-end;gap:8px}
 .ssh-fileRow:last-child{border-bottom:none}
 .ssh-fileRow:hover{background:var(--ssh-hover)}
 .ssh-fileIcon{display:inline-flex;color:var(--ssh-text-3)}

package/index.js

@@ -4,7 +4,7 @@ import { fileURLToPath } from 'node:url'
 import { acceptWebSocket, isWebSocketUpgrade } from './lib/ws.js'
 import { resolveSshPaths, listSshHosts, saveSshHost, deleteSshHost } from './lib/ssh-config.js'
 import { deleteMetadata, loadMetadata, updateMetadata } from './lib/metadata.js'
-import { batchExec, downloadFile, execCommand, inspectHost, listRemoteFiles, openPty, testConnection, uploadFile } from './lib/ssh-client.js'
+import { batchExec, deleteRemotePath, downloadFile, execCommand, inspectHost, listRemoteFiles, makeRemoteDirectory, openPty, renameRemotePath, testConnection, uploadFile } from './lib/ssh-client.js'
 import { storagePaths } from './lib/storage.js'
 import { getPassword, listPasswordAliases, removePassword, setPassword } from './lib/vault.js'
 
@@ -31,7 +31,7 @@ const ASSETS = [
   { path: '/dsh-ssh-manage/assets/addon-search.js', file: 'addon-search.js', contentType: 'text/javascript; charset=utf-8' },
 ]
 const MAX_BODY_BYTES = 16 * 1024 * 1024
-const ACTIONS = ['overview', 'list_hosts', 'save_host', 'delete_host', 'set_metadata', 'save_password', 'delete_password', 'test_connection', 'inspect_host', 'exec', 'batch_exec', 'sftp_list', 'sftp_upload', 'sftp_download']
+const ACTIONS = ['overview', 'list_hosts', 'save_host', 'delete_host', 'set_metadata', 'save_password', 'delete_password', 'test_connection', 'inspect_host', 'exec', 'batch_exec', 'sftp_list', 'sftp_upload', 'sftp_download', 'sftp_mkdir', 'sftp_rename', 'sftp_delete']
 
 async function readJsonBody(req) {
   const chunks = []
@@ -217,6 +217,18 @@ export async function runAction(paths, action, params = {}) {
       const host = await findHost(paths, params.host)
       return await downloadFile(host, await requirePassword(paths, host), requireString(params, 'path'))
     }
+    case 'sftp/mkdir': {
+      const host = await findHost(paths, params.host)
+      return await makeRemoteDirectory(host, await requirePassword(paths, host), requireString(params, 'path'))
+    }
+    case 'sftp/rename': {
+      const host = await findHost(paths, params.host)
+      return await renameRemotePath(host, await requirePassword(paths, host), requireString(params, 'path'), requireString(params, 'newPath'), { overwrite: params.overwrite === true })
+    }
+    case 'sftp/delete': {
+      const host = await findHost(paths, params.host)
+      return await deleteRemotePath(host, await requirePassword(paths, host), requireString(params, 'path'))
+    }
     default:
       throw new Error(`Unknown action: ${String(action)}`)
   }
@@ -241,6 +253,8 @@ function managerTool(paths) {
         command: { type: 'string', description: 'Remote shell command.' },
         hosts: { type: 'array', items: { type: 'string' }, description: 'Host aliases for a batch command.' },
         path: { type: 'string', description: 'Remote SFTP path.' },
+        newPath: { type: 'string', description: 'New remote SFTP path for rename.' },
+        overwrite: { type: 'boolean', description: 'Allow sftp_rename to replace an existing destination (default false).' },
         contentBase64: { type: 'string', description: 'Base64 encoded file content for upload.' },
         metadata: { type: 'object', description: '{ group, tags, favorite, label, note, system, cpuCores, memoryGB, diskGB, latencyMs, checkedAt }' },
       },
@@ -284,6 +298,12 @@ function managerTool(paths) {
           return await runAction(paths, 'sftp/upload', params)
         case 'sftp_download':
           return await runAction(paths, 'sftp/download', params)
+        case 'sftp_mkdir':
+          return await runAction(paths, 'sftp/mkdir', params)
+        case 'sftp_rename':
+          return await runAction(paths, 'sftp/rename', params)
+        case 'sftp_delete':
+          return await runAction(paths, 'sftp/delete', params)
         default:
           throw new Error(`Unknown action: ${String(input.action)}`)
       }

package/lib/ssh-client.js

@@ -1,3 +1,4 @@
+import path from 'node:path'
 import { Client } from 'ssh2'
 import { verifyHostKey } from './known-hosts.js'
 
@@ -105,6 +106,21 @@ function safeRemotePath(value) {
   return value
 }
 
+/** POSIX-normalize a remote path; used only for guards and comparisons. */
+export function normalizeRemotePath(value) {
+  const raw = safeRemotePath(value)
+  const normalized = path.posix.normalize(raw)
+  return normalized.length > 1 ? normalized.replace(/\/+$/, '') : normalized
+}
+
+function isProtectedRemotePath(value) {
+  const normalized = normalizeRemotePath(value)
+  if (normalized === '' || normalized === '/' || normalized === '.' || normalized === '..') return true
+  if (normalized.startsWith('../') || normalized.includes('/../') || normalized.endsWith('/..') || normalized.includes('/./')) return true
+  if (/^[A-Za-z]:(?:\.{1,2})?$/.test(normalized)) return true
+  return false
+}
+
 function probeInteger(value) {
   const numeric = Number(String(value ?? '').trim())
   if (!Number.isFinite(numeric)) return 0
@@ -170,7 +186,13 @@ export async function listRemoteFiles(host, password, remotePath = '.') {
         if (error) return reject(error)
         sftp.readdir(target, (readError, entries) => {
           if (readError) return reject(readError)
-          resolve(entries.map((entry) => ({ name: entry.filename, size: entry.attrs?.size ?? 0, mode: entry.attrs?.mode ?? 0, directory: Boolean(entry.attrs?.isDirectory?.()) })))
+          resolve(entries.map((entry) => ({
+            name: entry.filename,
+            size: entry.attrs?.size ?? 0,
+            mode: entry.attrs?.mode ?? 0,
+            directory: Boolean(entry.attrs?.isDirectory?.()),
+            symlink: Boolean(entry.attrs?.isSymbolicLink?.()),
+          })))
         })
       })
     })
@@ -208,6 +230,69 @@ export async function downloadFile(host, password, remotePath) {
   } finally { client.end() }
 }
 
+async function withSftp(host, password, operation) {
+  const client = await connect(host, password)
+  try {
+    const sftp = await new Promise((resolve, reject) => client.sftp((error, value) => error ? reject(error) : resolve(value)))
+    return await operation(sftp)
+  } finally {
+    client.end()
+  }
+}
+
+export async function makeRemoteDirectory(host, password, remotePath) {
+  const target = safeRemotePath(remotePath)
+  await withSftp(host, password, (sftp) => new Promise((resolve, reject) => {
+    sftp.mkdir(target, (error) => error ? reject(error) : resolve())
+  }))
+  return { created: true, path: target }
+}
+
+export async function renameRemotePath(host, password, remotePath, nextPath, options = {}) {
+  const from = safeRemotePath(remotePath)
+  const to = safeRemotePath(nextPath)
+  if (normalizeRemotePath(from) === normalizeRemotePath(to)) throw new Error('Source and destination are the same')
+  if (isProtectedRemotePath(to)) throw new Error('Refusing to rename onto a root path')
+  await withSftp(host, password, async (sftp) => {
+    if (options.overwrite !== true) {
+      const exists = await new Promise((resolve, reject) => {
+        sftp.stat(to, (error) => {
+          if (error) {
+            if (error.code === 2) resolve(false)
+            else reject(error)
+          } else resolve(true)
+        })
+      })
+      if (exists) throw new Error(`Destination already exists: ${to}`)
+    }
+    await new Promise((resolve, reject) => {
+      sftp.rename(from, to, (error) => error ? reject(error) : resolve())
+    })
+  })
+  return { renamed: true, from, to }
+}
+
+export async function deleteRemotePath(host, password, remotePath) {
+  const target = safeRemotePath(remotePath)
+  if (isProtectedRemotePath(target)) {
+    throw new Error('Refusing to delete a root or empty path')
+  }
+  const result = await withSftp(host, password, async (sftp) => {
+    const stats = await new Promise((resolve, reject) => {
+      sftp.lstat(target, (error, value) => error ? reject(error) : resolve(value))
+    })
+    const symbolicLink = Boolean(stats?.isSymbolicLink?.())
+    const directory = !symbolicLink && Boolean(stats?.isDirectory?.())
+    await new Promise((resolve, reject) => {
+      const done = (error) => error ? reject(error) : resolve()
+      if (directory) sftp.rmdir(target, done)
+      else sftp.unlink(target, done)
+    })
+    return { directory, symbolicLink }
+  })
+  return { deleted: true, directory: result.directory, symbolicLink: result.symbolicLink, path: target }
+}
+
 export async function batchExec(hosts, passwordFor, command, options = {}) {
   const concurrency = Math.min(Math.max(Number(options.concurrency || 4), 1), 16)
   const results = []
@@ -270,4 +355,4 @@ export function openInteractiveShell(host, password, onReady, options = {}) {
   })
 }
 
-export const __test = { safeRemotePath, connectionConfig, parseProbeOutput, MAX_OUTPUT_BYTES, MAX_FILE_BYTES }
+export const __test = { safeRemotePath, normalizeRemotePath, isProtectedRemotePath, connectionConfig, parseProbeOutput, MAX_OUTPUT_BYTES, MAX_FILE_BYTES }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-ssh-manage",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "A DSH sidebar plugin for managing SSH host profiles with a real interactive PTY terminal.",
   "license": "MIT",
   "private": false,