dsh-ssh-tunnel 1.0.0

package/lib/shared/path.js

@@ -0,0 +1,156 @@
+import { lstatSync, realpathSync } from 'node:fs'
+import { dirname, isAbsolute, join, normalize, resolve as pathResolve } from 'node:path'
+
+export const WORKSPACE_ROOT = '/workspace'
+
+/**
+ * Local roots the path guard accepts, most specific first.
+ *
+ * The project workspace the user actually opened (`explicitRoot`) is the real
+ * boundary: on hosts whose workspace is a Windows drive path there is no
+ * `/workspace` at all, and a fixed root rejects every real local path — which
+ * breaks SFTP upload/download and the sidebar file browser. Relative local
+ * paths resolve against the first root, so an explicit project root wins over
+ * the `DSH_SSH_TUNNEL_WORKSPACE_ROOT` operator override and over the
+ * `/workspace` fallback.
+ *
+ * Read at call time so hosts and tests can set them after module load.
+ */
+export function workspaceRoots(explicitRoot = '') {
+  const raw = []
+  if (explicitRoot && String(explicitRoot).trim()) raw.push(String(explicitRoot).trim())
+  const env = process.env.DSH_SSH_TUNNEL_WORKSPACE_ROOT
+  if (env && String(env).trim()) raw.push(String(env).trim())
+  if (!raw.length) raw.push(WORKSPACE_ROOT)
+  const roots = []
+  for (const r of raw) {
+    const key = normalizeProjectKey(r)
+    if (key && !roots.includes(key)) roots.push(key)
+  }
+  return roots
+}
+
+/** Primary local root: the base for resolving relative local paths. */
+export function workspaceRoot(explicitRoot = '') {
+  return workspaceRoots(explicitRoot)[0]
+}
+
+/** Normalize a project path key (absolute, no trailing slash except root). */
+export function normalizeProjectKey(raw) {
+  if (!raw || typeof raw !== 'string') return ''
+  let p = raw.trim()
+  if (!p) return ''
+  try {
+    p = pathResolve(p)
+  } catch {
+    return ''
+  }
+  p = normalize(p)
+  while (p.length > 1 && (p.endsWith('/') || p.endsWith('\\'))) {
+    const next = p.slice(0, -1)
+    if (/^[A-Za-z]:$/.test(next)) break
+    p = next
+  }
+  return p
+}
+
+/**
+ * Comparison form for containment checks: unified separators, and on Windows
+ * case-insensitive (Win32 paths are case-insensitive; keys are stored in
+ * platform-native form, so string equality alone would misjudge containment).
+ */
+function comparablePath(p) {
+  const s = p.replace(/\\/g, '/')
+  return process.platform === 'win32' ? s.toLowerCase() : s
+}
+
+/**
+ * Whether abs is inside one of the allowed roots (lexical, after resolve).
+ * Does not follow symlinks — use constrainToWorkspace for FS operations.
+ */
+export function isPathInsideRoots(absPath, roots) {
+  const abs = normalizeProjectKey(absPath)
+  if (!abs) return false
+  const list = (roots || []).map(normalizeProjectKey).filter(Boolean)
+  const cAbs = comparablePath(abs)
+  for (const root of list) {
+    const cRoot = comparablePath(root)
+    if (cAbs === cRoot) return true
+    // Roots may end with '/' in comparison form ('/', or a drive root like
+    // 'c:/'): strip trailing separators before appending one, so filesystem
+    // roots still match their children.
+    const base = cRoot.replace(/\/+$/, '')
+    const prefix = base === '' ? '/' : base + '/'
+    if (cAbs.startsWith(prefix)) return true
+  }
+  return false
+}
+
+function realExisting(abs) {
+  let probe = abs
+  while (true) {
+    try {
+      return realpathSync(probe)
+    } catch (e) {
+      if (e && e.code === 'ENOENT') {
+        const parent = dirname(probe)
+        if (!parent || parent === probe) return ''
+        probe = parent
+        continue
+      }
+      throw e
+    }
+  }
+}
+
+/**
+ * Resolve a user-supplied local path and reject anything that is not under one
+ * of the allowed local roots (`workspaceRoots(root)`, i.e. the project
+ * workspace the caller passes plus any operator override) both lexically and
+ * after following existing symlinks.
+ *
+ * `{ forUnlink: true }` allows deleting a symlink whose *lexical* path is
+ * under an allowed root without following it (unlink the link, never the
+ * target).
+ */
+export function constrainToWorkspace(inputPath, { forUnlink = false, root = '' } = {}) {
+  if (inputPath == null || String(inputPath).trim() === '') {
+    throw new Error('local path required')
+  }
+  const roots = workspaceRoots(root)
+  let abs = String(inputPath)
+  if (!isAbsolute(abs)) abs = join(roots[0], abs)
+  abs = pathResolve(abs)
+  abs = normalize(abs)
+  if (abs.length > 1 && (abs.endsWith('/') || abs.endsWith('\\'))) abs = abs.slice(0, -1)
+  if (!isPathInsideRoots(abs, roots)) {
+    throw new Error('local path must be under ' + roots.join(' or '))
+  }
+  if (forUnlink) {
+    try {
+      const st = lstatSync(abs)
+      if (st.isSymbolicLink()) return abs
+    } catch (e) {
+      if (!(e && e.code === 'ENOENT')) throw e
+    }
+  }
+  const real = realExisting(abs)
+  if (real && !isPathInsideRoots(real, roots)) {
+    throw new Error('local path escapes ' + roots.join(' or ') + ' via symlink')
+  }
+  return abs
+}
+
+export function joinUnderRoot(root, relOrAbs) {
+  const roots = workspaceRoots()
+  const r = normalizeProjectKey(root) || roots[0]
+  let abs = String(relOrAbs || r)
+  if (!isAbsolute(abs)) abs = join(r, abs)
+  abs = pathResolve(abs)
+  if (!isPathInsideRoots(abs, [...roots, r])) {
+    throw new Error('path outside allowed roots')
+  }
+  return constrainToWorkspace(abs)
+}
+
+export { isAbsolute, join, normalize, pathResolve }

package/lib/shared/persist.js

@@ -0,0 +1,41 @@
+import { chmodSync, existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+
+/**
+ * Missing file → fallback. Corrupt JSON → throw (never treat as empty store).
+ */
+export function readJsonFile(path, fallback) {
+  if (!existsSync(path)) return fallback
+  let raw
+  try {
+    raw = readFileSync(path, 'utf8')
+  } catch (e) {
+    throw new Error('cannot read ' + path + ': ' + (e && e.message ? e.message : e))
+  }
+  try {
+    return JSON.parse(raw)
+  } catch {
+    throw new Error('corrupt json: ' + path)
+  }
+}
+
+export function writeJsonAtomic(path, data, mode = 0o600) {
+  const tmp = path + '.tmp'
+  writeFileSync(tmp, JSON.stringify(data, null, 2) + '\n', { mode })
+  try { chmodSync(tmp, mode) } catch {}
+  renameSync(tmp, path)
+  try { chmodSync(path, mode) } catch {}
+}
+
+export function migrateMarkerPath(dataDir) {
+  return join(dataDir, '.migrated-draft')
+}
+
+export function hostEndpointKey(host, port, username) {
+  return `${String(username || '').trim()}@${String(host || '').trim()}:${Number(port) || 22}`
+}
+
+export function findExistingHostByEndpoint(hosts, host, port, username) {
+  const key = hostEndpointKey(host, port, username)
+  return (hosts || []).find((h) => hostEndpointKey(h.host, h.port, h.username) === key)
+}

package/lib/shared/session-auth.js

@@ -0,0 +1,39 @@
+/**
+ * Result-delivery authorization gates for SSH session operations (security).
+ * Pure helpers kept in shared/ so they are testable without an ssh2 install.
+ *
+ * Background (v0.4.3): a host grant can be revoked while an SSHManager
+ * operation is already in flight. Closing the session stops the transport,
+ * but a command can complete and a file can be pulled in the same tick as the
+ * revocation. These gates are the *second* boundary: even if the transport
+ * work finished, nothing from the revoked host may be delivered to the agent
+ * (and no downloaded file may remain on disk).
+ *
+ * v0.4.4: missing predicate is fail-closed (never a silent no-op). HTTP and
+ * write actions re-check the same gate.
+ */
+import { unlinkSync } from 'node:fs'
+
+export function assertSessionStillAuthorized(session, isHostAuthorized) {
+  if (!session) throw new Error('SSH session missing')
+  if (typeof isHostAuthorized !== 'function') {
+    throw new Error('SSH authorization predicate required')
+  }
+  if (session.projectPathKey && !isHostAuthorized(session.projectPathKey, session.hostId)) {
+    throw new Error('SSH session host is not authorized for the current project.')
+  }
+}
+
+export function discardRevokedLocalFile(session, localPath, isHostAuthorized) {
+  if (!session) return false
+  if (typeof isHostAuthorized !== 'function') {
+    throw new Error('SSH authorization predicate required')
+  }
+  if (session.projectPathKey && !isHostAuthorized(session.projectPathKey, session.hostId)) {
+    try {
+      unlinkSync(localPath)
+    } catch {}
+    return true
+  }
+  return false
+}

package/lib/shared/session-policy.js

@@ -0,0 +1,125 @@
+/**
+ * Pure SSH session policy: timeouts, status invariant, reuse vs tombstone.
+ * No ssh2, no I/O.
+ */
+
+export const SSH_KEEPALIVE_INTERVAL_MS = 30_000
+export const SSH_KEEPALIVE_COUNT_MAX = 3
+export const SSH_READY_TIMEOUT_MS = 20_000
+export const SSH_RECONNECT_MAX_ATTEMPTS = 3
+export const SSH_RECONNECT_DELAYS_MS = [5_000, 10_000, 10_000]
+export const SSH_RECONNECT_ATTEMPT_TIMEOUT_MS = 20_000
+export const SSH_TOOL_TIMEOUT_MS = 300_000
+export const SSH_TIMEOUT_MIN_MS = 1_000
+export const SSH_TIMEOUT_MAX_MS = 300_000
+export const SSH_EXEC_DEFAULT_TIMEOUT_MS = 30_000
+export const SSH_SFTP_META_TIMEOUT_MS = 30_000
+export const SSH_SFTP_TRANSFER_TIMEOUT_MS = 120_000
+export const SSH_SHELL_OPEN_TIMEOUT_MS = 10_000
+
+export const SSH_STATUS_CONNECTED = 'connected'
+export const SSH_STATUS_RECONNECTING = 'reconnecting'
+export const SSH_STATUS_DISCONNECTED = 'disconnected'
+
+export function clampTimeoutMs(value, fallback) {
+  const n = Number(value)
+  const base = Number.isFinite(n) && n > 0 ? n : fallback
+  return Math.min(SSH_TIMEOUT_MAX_MS, Math.max(SSH_TIMEOUT_MIN_MS, Math.floor(base)))
+}
+
+export function defaultTimeoutMsForAction(action) {
+  const a = String(action || '')
+  if (a === 'exec') return SSH_EXEC_DEFAULT_TIMEOUT_MS
+  if (a === 'sftp_read_text' || a === 'sftp_write_text' || a === 'sftp_upload' || a === 'sftp_download') {
+    return SSH_SFTP_TRANSFER_TIMEOUT_MS
+  }
+  if (a.startsWith('sftp_')) return SSH_SFTP_META_TIMEOUT_MS
+  if (a === 'read_session' || a === 'send_input' || a === 'resize_session') return SSH_SHELL_OPEN_TIMEOUT_MS
+  return SSH_EXEC_DEFAULT_TIMEOUT_MS
+}
+
+export function isLiveStatus(status, running) {
+  return status === SSH_STATUS_CONNECTED && running === true
+}
+
+export function assertStatusInvariant(rec) {
+  const running = rec.status === SSH_STATUS_CONNECTED
+  return { ...rec, running }
+}
+
+export function findReusableLive(sessions, { projectPathKey, hostId, needsSftp }) {
+  return sessions
+    .filter((s) => {
+      if (s.projectPathKey !== projectPathKey || s.hostId !== hostId) return false
+      if (!isLiveStatus(s.status, s.running)) return false
+      if (needsSftp && !s.sftpEnabled) return false
+      return true
+    })
+    .sort((a, b) => a.createdAt - b.createdAt || String(a.id).localeCompare(String(b.id)))[0]
+}
+
+export function pickOldestTombstone(sessions, { projectPathKey, hostId, needsSftp }) {
+  return sessions
+    .filter((s) => {
+      if (s.projectPathKey !== projectPathKey || s.hostId !== hostId) return false
+      if (s.status !== SSH_STATUS_DISCONNECTED || s.running) return false
+      if (needsSftp && !s.sftpEnabled) return false
+      return true
+    })
+    .sort((a, b) => a.createdAt - b.createdAt || String(a.id).localeCompare(String(b.id)))[0]
+}
+
+export function disconnectedSessionError() {
+  return 'SSH session is disconnected. Reconnect in the SSH Tunnel tab, or omit session_id to reuse_or_create.'
+}
+
+export function kbiReconnectError() {
+  return 'keyboard-interactive auth is not supported; edit the host to password or private key.'
+}
+
+export function kbiUnsupportedError() {
+  return 'keyboard-interactive auth is not supported; edit the host to password or private key.'
+}
+
+export function withTimeout(work, ms, { signal, onTimeout } = {}) {
+  const timeoutMs = clampTimeoutMs(ms, SSH_EXEC_DEFAULT_TIMEOUT_MS)
+  const run = typeof work === 'function' ? work() : work
+  return new Promise((resolve, reject) => {
+    let settled = false
+    const finish = (kind, value) => {
+      if (settled) return
+      settled = true
+      clearTimeout(timer)
+      if (signal) signal.removeEventListener('abort', onAbort)
+      if (kind === 'ok') resolve(value)
+      else reject(value)
+    }
+    const onAbort = () => {
+      try {
+        onTimeout?.()
+      } catch {}
+      const err = new Error('Cancelled')
+      err.aborted = true
+      finish('err', err)
+    }
+    const timer = setTimeout(() => {
+      try {
+        onTimeout?.()
+      } catch {}
+      const err = new Error('timeout')
+      err.timedOut = true
+      finish('err', err)
+    }, timeoutMs)
+    if (signal) {
+      if (signal.aborted) {
+        onAbort()
+        return
+      }
+      signal.addEventListener('abort', onAbort, { once: true })
+    }
+    Promise.resolve(run).then(
+      (v) => finish('ok', v),
+      (e) => finish('err', e),
+    )
+  })
+}

package/lib/shared/shell-buffer.js

@@ -0,0 +1,10 @@
+/** Incremental shell output slice for polling clients. */
+export function chunkFromBuffer(fullText, since) {
+  const full = fullText == null ? '' : String(fullText)
+  const start = Math.max(0, Math.min(Number(since) || 0, full.length))
+  return {
+    chunk: full.slice(start),
+    length: full.length,
+    since: start,
+  }
+}

package/lib/shared/vendor.js

@@ -0,0 +1,50 @@
+/**
+ * Same-origin static assets for the browser client.
+ *
+ * `dsh-ssh-tunnel/lib/client.js` is a raw browser bundle executed by the DSH
+ * client module system; its `require()` only answers platform seeds and
+ * registered plugin rows, so `@xterm/xterm` is NOT resolvable there. Instead
+ * of the removed jsDelivr fallback we serve the UMD builds from our own web
+ * route (`/dsh-ssh-tunnel/vendor/*`) and load them with plain <script>/<link>
+ * tags. This module is the host-side allowlist + resolver (Node only).
+ */
+
+import { createRequire } from 'node:module'
+
+const requireHost = createRequire(import.meta.url)
+
+/** name -> { spec (resolved from this plugin's deps), content-type } */
+export const VENDOR_ASSETS = {
+  'xterm.js': {
+    spec: '@xterm/xterm/lib/xterm.js',
+    type: 'text/javascript; charset=utf-8',
+  },
+  'xterm.css': {
+    spec: '@xterm/xterm/css/xterm.css',
+    type: 'text/css; charset=utf-8',
+  },
+  'addon-fit.js': {
+    spec: '@xterm/addon-fit/lib/addon-fit.js',
+    type: 'text/javascript; charset=utf-8',
+  },
+}
+
+/**
+ * Resolve an allowlisted vendor asset to an absolute file path.
+ * Anything not in the allowlist throws — callers must treat that as 404 and
+ * must not interpolate user input into the file lookup.
+ * @param {string} name exact basename from the allowlist
+ * @returns {{ path: string, type: string }}
+ */
+export function resolveVendorAsset(name) {
+  const entry = VENDOR_ASSETS[name]
+  if (!entry) {
+    throw new Error(`dsh-ssh-tunnel: vendor asset not allowed: ${String(name)}`)
+  }
+  return { path: requireHost.resolve(entry.spec), type: entry.type }
+}
+
+/** @param {string} name checked against the allowlist only */
+export function isVendorAssetAllowed(name) {
+  return Object.prototype.hasOwnProperty.call(VENDOR_ASSETS, name)
+}

package/package.json

@@ -0,0 +1,84 @@
+{
+  "name": "dsh-ssh-tunnel",
+  "version": "1.0.0",
+  "description": "Multi-host SSH tunnel and SSHManager tool for DeepSeek Harness (project-scoped grants)",
+  "type": "module",
+  "license": "MIT",
+  "author": "thirsty5034",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/OMSociety/dsh-ssh-tunnel.git"
+  },
+  "homepage": "https://github.com/OMSociety/dsh-ssh-tunnel#readme",
+  "bugs": {
+    "url": "https://github.com/OMSociety/dsh-ssh-tunnel/issues"
+  },
+  "contributors": [
+    {
+      "name": "OMSociety",
+      "url": "https://github.com/OMSociety"
+    }
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "ssh",
+    "sftp",
+    "cordis",
+    "better-sidebar",
+    "dsh-better-sidebar"
+  ],
+  "engines": {
+    "node": ">=20",
+    "dsh": ">=0.1.7-rc.2 <0.3.0-0"
+  },
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "test": "node scripts/smoke-test.mjs",
+    "check": "node --check lib/index.js && node scripts/smoke-test.mjs"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-locale"
+      ],
+      "platform": "web"
+    }
+  },
+  "dependencies": {
+    "@xterm/addon-fit": "0.11.0",
+    "@xterm/xterm": "5.5.0",
+    "ssh2": "^1.17.0"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.4",
+    "@deepseek-ai/dsh-client-locale": ">=0.1.7-rc.2 <0.3.0-0",
+    "dsh-better-sidebar": ">=0.12.0"
+  },
+  "files": [
+    "CHANGELOG.md",
+    "LICENSE",
+    "README.md",
+    "README_en.md",
+    "cordis.patch.yml",
+    "lib",
+    "scripts/install.sh",
+    "scripts/install.ps1",
+    "scripts/portal-probe.mjs",
+    "scripts/smoke-test.mjs",
+    "scripts/sync-to-dsh.sh"
+  ]
+}

package/scripts/install.ps1

@@ -0,0 +1,148 @@
+# =============================================================================
+# dsh-ssh-tunnel one-click install (Windows PowerShell 5.1+ / pwsh)
+#
+# Usage:
+#   irm https://raw.githubusercontent.com/OMSociety/dsh-ssh-tunnel/main/scripts/install.ps1 | iex
+#   & ([scriptblock]::Create((irm 'https://raw.githubusercontent.com/OMSociety/dsh-ssh-tunnel/main/scripts/install.ps1'))) -From github -Restart
+# =============================================================================
+param(
+  [string]$Version = '',
+  [ValidateSet('github', 'npm')]
+  [string]$From = 'github',
+  [switch]$Restart,
+  [switch]$DryRun
+)
+
+$PKG = 'dsh-ssh-tunnel'
+$PLUGIN_ID = 'ssh-tunnel'
+$GITHUB_REPO = if ($env:GITHUB_REPO) { $env:GITHUB_REPO } else { 'OMSociety/dsh-ssh-tunnel' }
+$REGISTRY = if ($env:REGISTRY) { $env:REGISTRY } else { 'https://registry.npmjs.org' }
+
+if ($env:DSH_HOME) { $DSH_HOME = $env:DSH_HOME }
+elseif ($env:USERPROFILE) { $DSH_HOME = Join-Path $env:USERPROFILE '.dsh' }
+else { $DSH_HOME = Join-Path $HOME '.dsh' }
+
+$PROFILE_DIR = Join-Path $DSH_HOME 'profiles\web'
+$WS_YML = Join-Path $PROFILE_DIR 'pnpm-workspace.yaml'
+$PATCH_YML = Join-Path $PROFILE_DIR 'cordis.patch.yml'
+
+function Say([string]$m)  { Write-Host "[install] $m" -ForegroundColor Green }
+function Warn([string]$m) { Write-Host "[warn] $m" -ForegroundColor Yellow }
+function Die([string]$m)  { Write-Host "[error] $m" -ForegroundColor Red; exit 1 }
+
+function Get-DshCli {
+  if ($env:DSH_CMD) { return $env:DSH_CMD }
+  if (Get-Command dsh -ErrorAction SilentlyContinue) { return 'dsh' }
+  if (Get-Command npx -ErrorAction SilentlyContinue) { return 'npx' }
+  return $null
+}
+
+function Resolve-AddSpec {
+  if ($From -eq 'npm') {
+    $given = if ([string]::IsNullOrWhiteSpace($Version)) { 'latest' } else { $Version }
+    if ($given -eq 'latest') {
+      foreach ($tool in @('npm', 'pnpm')) {
+        if (Get-Command $tool -ErrorAction SilentlyContinue) {
+          $v = (& $tool view $PKG version "--registry=$REGISTRY" 2>$null | Select-Object -Last 1)
+          if ($v) { return "$PKG@$([string]$v.Trim())" }
+        }
+      }
+      return "$PKG@latest"
+    }
+    return "$PKG@$given"
+  }
+  if ([string]::IsNullOrWhiteSpace($Version)) { return "$PKG@github:$GITHUB_REPO" }
+  return "$PKG@github:$GITHUB_REPO#$Version"
+}
+
+if (-not (Get-Command node -ErrorAction SilentlyContinue)) { Die 'Node.js not found (need >= 20).' }
+$NodeMajor = [int](& node -p "process.versions.node.split('.')[0]")
+if ($NodeMajor -lt 20) { Die "Node.js $(& node -v) is too old (need >= 20)." }
+if (-not (Test-Path $PROFILE_DIR)) { Die "Profile dir missing: $PROFILE_DIR" }
+if (-not (Test-Path $WS_YML)) { Die "Missing $WS_YML" }
+
+$ADD_SPEC = Resolve-AddSpec
+$CLI = Get-DshCli
+if (-not $CLI) { Die 'dsh/npx not found. Install DSH or set DSH_CMD.' }
+
+Say "Target: $CLI plugin --profile web add $ADD_SPEC"
+Say "Source: $From ($GITHUB_REPO)"
+
+if ($DryRun) {
+  Say "[dry-run] exclude $PKG from minimumReleaseAge; add $ADD_SPEC; verify bundles; strip manual $PLUGIN_ID mount"
+  exit 0
+}
+
+$wsScript = @'
+const fs = require("fs");
+const p = process.argv[1];
+const pkg = process.argv[2];
+let t = fs.readFileSync(p, "utf8");
+const before = t;
+if (!new RegExp("^\\s*-\\s+" + pkg.replace(/[.*+?^${}()|[\\]\\]/g, "\\$&") + "\\s*$", "m").test(t)) {
+  if (/^\s*minimumReleaseAgeExclude:\s*$/m.test(t)) {
+    t = t.replace(/^(\s*minimumReleaseAgeExclude:\s*)$/m, "$1\n  - " + pkg);
+  } else {
+    t += "\nminimumReleaseAgeExclude:\n  - " + pkg + "\n";
+  }
+}
+if (t !== before) fs.writeFileSync(p, t);
+console.log(t === before ? "unchanged" : "updated");
+'@
+$wsResult = & node -e $wsScript $WS_YML $PKG
+if ($wsResult -eq 'updated') { Say "Updated $WS_YML minimumReleaseAgeExclude" } else { Say 'workspace ready' }
+
+Say "Running plugin add..."
+if ($CLI -eq 'npx') {
+  & npx -y --package @deepseek-ai/dsh dsh plugin --profile web add $ADD_SPEC
+} else {
+  & $CLI plugin --profile web add $ADD_SPEC
+}
+if ($LASTEXITCODE -ne 0) { Die 'dsh plugin add failed' }
+
+$check = @'
+const fs = require("fs");
+const p = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+const bundles = p.dsh?.profile?.bundles ?? [];
+process.exit(bundles.includes(process.argv[2]) ? 0 : 1);
+'@
+& node -e $check (Join-Path $PROFILE_DIR 'package.json') $PKG
+if ($LASTEXITCODE -ne 0) { Die "$PKG missing from dsh.profile.bundles" }
+Say "bundle registered: $PKG"
+
+if (Test-Path $PATCH_YML) {
+  $strip = @'
+const fs = require("fs");
+const p = process.argv[1];
+const id = process.argv[2];
+const lines = fs.readFileSync(p, "utf8").split("\n");
+const out = [];
+let i = 0, removed = false;
+const idRe = new RegExp("id:\\s*" + id.replace(/[.*+?^${}()|[\\]\\]/g, "\\$&") + "\\b");
+while (i < lines.length) {
+  const line = lines[i];
+  if (/^[ \t]*- insert:\s*$/.test(line)) {
+    const block = [line];
+    let j = i + 1;
+    while (j < lines.length && lines[j].trim() !== "" && !/^-\s/.test(lines[j])) { block.push(lines[j]); j++; }
+    if (block.some((l) => idRe.test(l))) {
+      while (out.length && /^[ \t]*#/.test(out[out.length - 1])) out.pop();
+      i = j; removed = true; continue;
+    }
+  }
+  out.push(line); i++;
+}
+if (!removed) console.log("none");
+else { fs.writeFileSync(p, out.join("\n").replace(/\n{3,}/g, "\n\n")); console.log("removed"); }
+'@
+  $mr = & node -e $strip $PATCH_YML $PLUGIN_ID
+  if ($mr -eq 'removed') { Say "Removed manual $PLUGIN_ID mount from cordis.patch.yml" }
+}
+
+Say "Done: $ADD_SPEC"
+if ($Restart) {
+  if (Get-Command pm2 -ErrorAction SilentlyContinue) { pm2 restart dsh-web }
+  else { Warn 'pm2 not found; restart DSH web manually' }
+} else {
+  Say 'Next: restart DSH web and hard-refresh the browser.'
+}