dsh-ssh-workbench 1.6.4 → 1.7.0

package/lib/index.js

@@ -1,18 +1,17 @@
 /**
  * dsh-ssh-workbench host half.
  *
- * Remote execution is deliberately not a second toolbox: on POSIX Hosts the
- * plugin gives DSH's own `bash` tool a remote execution world, and when a
- * Session has no active managed target every tool behaves exactly as shipped.
- * Windows Hosts ship no `bash` tool at all (DSH disables it by platform), so
- * there the plugin registers the standalone `remote_bash` tool instead. A
- * single `ssh_workbench_target` tool switches the active target, and a synchronous
- * `ctx.tools.guard()` blacklist is the fallback safety net.
+ * Local and remote execution are two separate worlds. The native shell tools
+ * always run on the local DSH Host; remote work always names its target on the
+ * tool call (`remote_bash`, `remote_pwsh`, `remote_exec`). There is no
+ * session-scoped target state and no native shell interception, so a follow-up
+ * without a new `@mention` can never move a command silently to a different
+ * machine. A synchronous `ctx.tools.guard()` blacklist is the fallback safety
+ * net for every explicit remote target.
  */
 import os from 'node:os'
 import path from 'node:path'
 import z from '@deepseek-ai/schemastery'
-import { defineTool } from '@deepseek-ai/dsh-tools'
 
 import { loadServers, saveServers } from './core/store.js'
 import { loadPrefs, savePrefs } from './core/prefs.js'
@@ -22,14 +21,14 @@ import { createSecretStore } from './core/secrets.js'
 import { createKnownHosts } from './core/known-hosts.js'
 import { createSshRuntime } from './core/ssh.js'
 import { createActivityStore } from './core/activity.js'
-import { createTargetStore, TARGET_TOOL_NAME, LOCAL_TARGET } from './core/targets.js'
+import { createTargetStore } from './core/mentions.js'
 import { createBlacklistGuard } from './core/guard.js'
-import { createRemoteBashRouter } from './core/remote-bash.js'
-import { createRemoteShellTool } from './core/remote-bash-tool.js'
-import { posixAdapter, win32Adapter } from './core/shell-adapters.js'
-import { effectiveDialect } from './core/dialect.js'
-import { hostPlatform } from './core/shell-adapters.js'
-import { installTargetContext } from './core/server-reference.js'
+import { createRemoteShellTool } from './core/remote-shell-tool.js'
+import { createRemoteExecTool } from './core/remote-exec-tool.js'
+import { createRemoteFileTools } from './core/remote-file-tools.js'
+import { createLiveExecutions } from './core/live-executions.js'
+import { posixAdapter, win32Adapter, hostPlatform } from './core/shell-adapters.js'
+import { installManagedContext } from './core/managed-context.js'
 import { createRoutes, registerRoutes } from './routes.js'
 
 export const name = 'dsh-ssh-workbench'
@@ -50,6 +49,19 @@ export const Config = z.object({
   // stderr is capped separately so one chatty failing command cannot flood the
   // model context (stdout keeps maxOutputBytes).
   maxStderrBytes: z.natural().default(16384),
+  // `remote_exec` fan-out: tasks per call, concurrent SSH channels, and the
+  // total stdout/stderr budget for one batch (shared across all tasks).
+  maxBatchTasks: z.natural().default(8),
+  batchConcurrency: z.natural().default(4),
+  maxBatchOutputBytes: z.natural().default(262144),
+  // Explicit remote file tools: read/glob/grep are always available; write and
+  // edit stay disabled until an operator opts in. All sizes are bytes.
+  remoteFileReadBytes: z.natural().default(262144),
+  remoteFileEditBytes: z.natural().default(2097152),
+  remoteFileWrite: z.boolean().default(false),
+  remoteGlobMaxResults: z.natural().default(200),
+  remoteGlobMaxDepth: z.natural().default(4),
+  remoteGrepMaxResults: z.natural().default(200),
   // A stalled SFTP chunk (half-open connection) fails after this long instead
   // of hanging the file panel; the client can resume from its offset.
   transferChunkTimeoutMs: z.natural().default(30000),
@@ -60,8 +72,8 @@ export const Config = z.object({
   maxChannelsPerServer: z.natural().default(6),
   // Warm a server connection when the user selects it in the UI.
   prewarm: z.boolean().default(true),
-  // Inject the `@server` target context into the step and bind the session's
-  // remote target. Disable to keep every native tool strictly local.
+  // Inject the managed-resource context into every human turn. Disable only
+  // for a deliberately remote-blind session.
   targetContext: z.boolean().default(true),
   // Root of the workbench's local side (local terminal cwd + local file
   // panel). Empty = the OS user home directory, matching the local pane of
@@ -77,6 +89,15 @@ const APPLY_DEFAULTS = {
   timeoutKillAfterMs: 5000,
   maxOutputBytes: 102400,
   maxStderrBytes: 16384,
+  maxBatchTasks: 8,
+  batchConcurrency: 4,
+  maxBatchOutputBytes: 262144,
+  remoteFileReadBytes: 262144,
+  remoteFileEditBytes: 2097152,
+  remoteFileWrite: false,
+  remoteGlobMaxResults: 200,
+  remoteGlobMaxDepth: 4,
+  remoteGrepMaxResults: 200,
   transferChunkTimeoutMs: 30000,
   hostKeyMode: 'strict',
   connectionPool: true,
@@ -105,6 +126,15 @@ export function publicConfig(config) {
     timeoutKillAfterMs: config.timeoutKillAfterMs,
     maxOutputBytes: config.maxOutputBytes,
     maxStderrBytes: config.maxStderrBytes,
+    maxBatchTasks: config.maxBatchTasks,
+    batchConcurrency: config.batchConcurrency,
+    maxBatchOutputBytes: config.maxBatchOutputBytes,
+    remoteFileReadBytes: config.remoteFileReadBytes,
+    remoteFileEditBytes: config.remoteFileEditBytes,
+    remoteFileWrite: config.remoteFileWrite === true,
+    remoteGlobMaxResults: config.remoteGlobMaxResults,
+    remoteGlobMaxDepth: config.remoteGlobMaxDepth,
+    remoteGrepMaxResults: config.remoteGrepMaxResults,
     transferChunkTimeoutMs: config.transferChunkTimeoutMs,
     connectionPool: config.connectionPool !== false,
     poolIdleMs: config.poolIdleMs,
@@ -113,90 +143,8 @@ export function publicConfig(config) {
   }
 }
 
-/**
- * The only model-facing tool this plugin registers. It never executes a
- * command; it selects the managed server the native `bash` tool runs on.
- */
-export function createTargetTool({
-  targets,
-  loadInventory,
-  onActivated,
-  remoteToolName = 'bash',
-  windowsToolName = 'remote_pwsh',
-  hostPlatform: hostOs = 'posix',
-}) {
-  const description =
-    hostOs === 'win32'
-      ? `Select the managed remote resource (server or VM) that this session's remote shell tools run on. Pass a managed resource name or id, or "local" to return to the local DSH host. Only one target is active at a time; the native pwsh tool and read/write/edit/glob/grep always run on the local DSH host. Remote POSIX targets run through ${remoteToolName}; Windows targets run through ${windowsToolName}.`
-      : `Select the managed remote resource (server or VM) that this session's remote shell runs on. Pass a managed resource name or id, or "local" to return to the local DSH host. Only one target is active at a time; read/write/edit/glob/grep always run on the local DSH host. POSIX targets run through the native ${remoteToolName} tool; Windows targets run through ${windowsToolName}.`
-  return defineTool({
-    name: TARGET_TOOL_NAME,
-    description,
-    parameters: {
-      server: { type: 'string', required: true, description: `Managed resource name or id, or "${LOCAL_TARGET}" to detach` },
-    },
-    output: textOut,
-    async execute(args, exec) {
-      const session = exec?.agent?.session
-      const key = session?.id ?? exec?.agent?.id
-      if (typeof key !== 'string' || key.length === 0) {
-        throw new Error('ssh_workbench_target requires an agent session')
-      }
-      const servers = loadInventory()
-      const outcome = targets.setActive(key, String(args.server ?? '').trim(), servers)
-      if (!outcome.ok) {
-        const available = servers
-          .filter((server) => server.enabled !== false)
-          .slice(0, 20)
-          .map((server) => server.name)
-          .join(', ')
-        throw new Error(`${outcome.error}. Available targets: ${available || '(none)'}; or "${LOCAL_TARGET}".`)
-      }
-      const state = outcome.state
-      if (!state.active) {
-        return { text: `active target: ${LOCAL_TARGET} — ${localShellSentence(hostOs)}.` }
-      }
-      const server = servers.find((entry) => entry.name === state.active)
-      const target = server ? `${server.username}@${server.host}:${server.port}` : state.active
-      // Probing the dialect before answering makes the next injected context
-      // name the right tool. It is bounded: a slow/unreachable host must not
-      // stall target selection.
-      let dialect = server ? effectiveDialect(server) : undefined
-      if (server && typeof onActivated === 'function') {
-        try {
-          const facts = await Promise.race([
-            Promise.resolve().then(() => onActivated(server)),
-            new Promise((resolve) => {
-              const timer = setTimeout(resolve, 4000)
-              timer.unref?.()
-            }),
-          ])
-          if (facts?.dialect) dialect = facts.dialect
-        } catch {
-          // Keep the record hint.
-        }
-      }
-      if (dialect === 'windows') {
-        return {
-          text: `active target: ${state.active} (${target}); ${windowsToolName} runs PowerShell commands there; read/write/edit/glob/grep run on the local DSH host.`,
-        }
-      }
-      return {
-        text: `active target: ${state.active} (${target}); ${remoteToolName} runs remotely on this resource; read/write/edit/glob/grep run on the local DSH host.`,
-      }
-    },
-  })
-}
-
-/** One sentence describing where the native shell tool runs on this Host. */
-function localShellSentence(hostOs) {
-  return hostOs === 'win32'
-    ? 'the native pwsh tool runs on the local DSH host; no remote target is selected'
-    : 'bash runs on the local DSH host'
-}
-
 /** Expand a configured `~` prefix; relative/invalid values are left for the caller. */
-export function expandLocalRoot(value) {
+function expandLocalRoot(value) {
   const raw = typeof value === 'string' ? value.trim() : ''
   if (!raw) return ''
   return raw === '~'
@@ -228,12 +176,11 @@ export function resolveLocalRoot(config = {}) {
  */
 export function apply(ctx, config, deps = {}) {
   config = { ...APPLY_DEFAULTS, ...(config ?? {}) }
-  // Hosts ship different native shell tools: DSH disables `bash` on win32 and
-  // `pwsh` elsewhere. The remote tool therefore depends on the Host, not on a
-  // global assumption; tests can pin it through deps.hostPlatform.
+  // The native shell tool differs per Host, but remote tools are explicit:
+  // both dialect tools are registered on both Hosts.
   const hostOs = hostPlatform(deps.hostPlatform ?? process.platform)
   const isWindowsHost = hostOs === 'win32'
-  const remoteToolName = isWindowsHost ? 'remote_bash' : 'bash'
+  const localShellName = isWindowsHost ? 'pwsh' : 'bash'
   let remoteAvailable = false
   if (config.hostKeyMode !== 'strict' && config.hostKeyMode !== 'accept-new') {
     ctx.logger?.warn?.('dsh-ssh-workbench: unknown hostKeyMode value, falling back to strict', { value: config.hostKeyMode })
@@ -272,6 +219,7 @@ export function apply(ctx, config, deps = {}) {
   }
 
   const targets = deps.targets ?? createTargetStore({ loadInventory })
+  const liveExecutions = deps.liveExecutions ?? createLiveExecutions()
 
   /**
    * Collect a host's facts once and persist them on the server record.
@@ -299,21 +247,8 @@ export function apply(ctx, config, deps = {}) {
     }
   }
 
-  // ── model-facing tools: target selector + dialect-specific remote shells ───
+  // ── model-facing tools: explicit-target remote shells + fan-out ────────────
   if (typeof ctx.tools?.register === 'function') {
-    const targetTool = createTargetTool({
-      targets,
-      loadInventory,
-      onActivated: (server) => refreshServerFacts(server),
-      remoteToolName,
-      windowsToolName: 'remote_pwsh',
-      hostPlatform: hostOs,
-    })
-    const offTool = ctx.tools.register(targetTool)
-    if (typeof offTool === 'function' && typeof ctx.effect === 'function') {
-      ctx.effect(() => offTool, 'dsh-ssh-workbench: target tool')
-    }
-
     const registerRemote = (definition, label) => {
       try {
         const off = ctx.tools.register(definition)
@@ -329,42 +264,66 @@ export function apply(ctx, config, deps = {}) {
       }
     }
 
-    // Windows targets are not covered by any native tool on either Host.
+    remoteAvailable =
+      registerRemote(
+        createRemoteExecTool({
+          runtime,
+          config,
+          loadInventory,
+          recordActivity,
+        }),
+        'remote exec tool',
+      ) || remoteAvailable
+
+    remoteAvailable =
+      registerRemote(
+        createRemoteShellTool({
+          runtime,
+          config,
+          loadInventory,
+          recordActivity,
+          adapter: posixAdapter,
+          localShellName,
+        }),
+        'remote bash tool',
+      ) || remoteAvailable
+
     remoteAvailable =
       registerRemote(
         createRemoteShellTool({
           runtime,
-          targets,
           config,
           loadInventory,
           recordActivity,
           adapter: win32Adapter,
-          localShellName: isWindowsHost ? 'pwsh' : 'bash',
+          localShellName,
         }),
         'remote pwsh tool',
       ) || remoteAvailable
-    // Windows Hosts also have no native bash, so POSIX targets need the
-    // plugin-owned tool there; POSIX Hosts keep the native bash router below.
-    if (isWindowsHost) {
-      remoteAvailable =
-        registerRemote(
-          createRemoteShellTool({
-            runtime,
-            targets,
-            config,
-            loadInventory,
-            recordActivity,
-            adapter: posixAdapter,
-            localShellName: 'pwsh',
-          }),
-          'remote bash tool',
-        ) || remoteAvailable
+
+    for (const tool of createRemoteFileTools({ runtime, config, loadInventory, recordActivity })) {
+      remoteAvailable = registerRemote(tool, `remote file tool: ${tool.name}`) || remoteAvailable
+    }
+  }
+
+  // ── live execution indicator: display-only, never selects a target ─────────
+  if (remoteAvailable) {
+    const offLive = ctx.on?.('tools/execute', async (exec, next) => {
+      const token = liveExecutions.begin(exec)
+      try {
+        return await next()
+      } finally {
+        liveExecutions.end(token)
+      }
+    })
+    if (typeof offLive === 'function' && typeof ctx.effect === 'function') {
+      ctx.effect(() => offLive, 'dsh-ssh-workbench: live execution indicator')
     }
   }
 
   // ── fallback blacklist: deny-only, synchronous, monotonic ──────────────────
   if (typeof ctx.tools?.guard === 'function') {
-    const offGuard = ctx.tools.guard(createBlacklistGuard({ targets, recordActivity }))
+    const offGuard = ctx.tools.guard(createBlacklistGuard({ recordActivity, loadInventory }))
     if (typeof offGuard === 'function' && typeof ctx.effect === 'function') {
       ctx.effect(() => offGuard, 'dsh-ssh-workbench: blacklist guard')
     }
@@ -372,30 +331,29 @@ export function apply(ctx, config, deps = {}) {
     ctx.logger?.warn?.('dsh-ssh-workbench: ctx.tools.guard() is unavailable; the destructive-command blacklist is disabled')
   }
 
-  // ── route the native bash tool to the active managed target (POSIX Hosts) ──
-  if (!isWindowsHost && typeof ctx.on === 'function') {
-    const router = createRemoteBashRouter({ runtime, targets, config, loadInventory, recordActivity })
-    const offExecute = ctx.on('tools/execute', router)
-    if (typeof offExecute === 'function' && typeof ctx.effect === 'function') {
-      ctx.effect(() => offExecute, 'dsh-ssh-workbench: remote bash router')
-    }
-    remoteAvailable = true
-  }
-
-  // ── @server → session target + one compact context message per turn ────────
+  // ── managed-resource context: one compact inventory + tool rules per turn ──
   // The context is only injected when this Host really has a remote execution
   // path; otherwise it would tell the model that a tool runs remotely when no
-  // such tool exists (the Windows-without-remote_bash failure mode).
+  // such tool exists.
+  const loadLastExecuted = (sessionId) => {
+    try {
+      const entries = activity.list(200)
+      const last = entries.find((entry) => entry?.kind === 'exec' && entry.sessionId === sessionId)
+      return typeof last?.server === 'string' && last.server.length > 0 ? last.server : null
+    } catch {
+      return null
+    }
+  }
   if (config.targetContext !== false) {
-    installTargetContext(ctx, {
+    installManagedContext(ctx, {
       targets,
       loadInventory,
+      loadLastExecuted,
       createUserMessage: deps.createUserMessage,
       remoteAvailable,
       hostPlatform: hostOs,
-      remoteToolName,
-      windowsToolName: 'remote_pwsh',
-      ensureDialect: (server) => refreshServerFacts(server),
+      maxContextServers: 20,
+      remoteFileWrite: config.remoteFileWrite === true,
     })
   }
 
@@ -436,6 +394,7 @@ export function apply(ctx, config, deps = {}) {
       secrets,
       knownHosts,
       targets,
+      liveExecutions,
       refreshFacts: (server) => refreshServerFacts(server),
       activity,
       prefs: { load: () => loadPrefs(), save: (patch) => savePrefs(patch) },

package/lib/routes.js

@@ -15,6 +15,7 @@ import { Readable } from 'node:stream'
 import { createLocalFileApi, LOCAL_FILE_REF } from './core/local-file-api.js'
 import { effectiveDialect } from './core/dialect.js'
 import { SshError } from './core/errors.js'
+import { summarizeExecution } from './core/execution-stats.js'
 
 const PREFIX = '/dsh-ssh-workbench'
 const MAX_BODY = 8 * 1024 * 1024
@@ -147,7 +148,24 @@ function resolveRef(value) {
  * @param {() => object} deps.publicConfig
  * @param {{ append: Function, list: Function }} [deps.activity] bounded local activity store
  */
-export function createRoutes({ loadServers, saveServers, runtime, secrets, knownHosts, targets, refreshFacts, prefs, terminals, localfs, publicConfig, activity }) {
+/** Read the bounded activity log without letting a store failure break /target. */
+function targetActivityEntries(activity, limit = 200) {
+  try {
+    return typeof activity?.list === 'function' ? activity.list(limit) : []
+  } catch {
+    return []
+  }
+}
+
+/** Latest remote execution for one Session, derived from the activity ledger. */
+function lastExecutedServer(entries, session) {
+  const entry = (Array.isArray(entries) ? entries : []).find(
+    (item) => item?.kind === 'exec' && item.sessionId === session && typeof item.server === 'string',
+  )
+  return entry?.server ?? null
+}
+
+export function createRoutes({ loadServers, saveServers, runtime, secrets, knownHosts, targets, liveExecutions, refreshFacts, prefs, terminals, localfs, publicConfig, activity }) {
   const prefsApi = prefs ?? {
     load: () => ({ sidebar: true }),
     save: () => ({ sidebar: true }),
@@ -308,11 +326,19 @@ export function createRoutes({ loadServers, saveServers, runtime, secrets, known
       if (req.method === 'GET' && rel === '/target') {
         const session = String(searchParams.get('session') ?? '')
         const state = session && typeof targets?.get === 'function' ? targets.get(session) : undefined
+        const entries = targetActivityEntries(activity)
         return send(res, 200, {
           ok: true,
-          target: state?.active ?? null,
           candidates: state?.candidates ?? [],
+          lastExecuted: lastExecutedServer(entries, session),
+          running: typeof liveExecutions?.snapshot === 'function'
+            ? liveExecutions.snapshot(session)
+            : { count: 0, servers: [] },
           version: state?.version ?? 0,
+          // The dock is a read-only projection of this Session's executions:
+          // only servers that actually ran appear (zero-count candidates would
+          // make the total disagree with the rows).
+          stats: summarizeExecution(entries, { sessionId: session, candidates: [] }),
         })
       }
       if (req.method === 'GET' && rel === '/activity') {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-ssh-workbench",
-  "version": "1.6.4",
-  "description": "远程工作台：SSH 终端、本地与远程文件、@服务器 对话执行；Windows 宿主和目标都能用。DeepSeek Harness SSH workbench plugin.",
+  "version": "1.7.0",
+  "description": "远程工作台：SSH 终端、本地与远程文件、@服务器 对话执行；显式目标的远程 shell 与 read/glob/grep，Windows 宿主和目标都能用。DeepSeek Harness SSH workbench plugin.",
   "type": "module",
   "main": "lib/index.js",
   "exports": {
@@ -22,7 +22,9 @@
     "locale",
     "vendor",
     "docs/quickstart.md",
-    "docs/architecture.md"
+    "docs/architecture.md",
+    "docs/execution-model.md",
+    "docs/images"
   ],
   "dsh": {
     "manifestVersion": 1,
@@ -62,8 +64,7 @@
     "pack": "node -e \"require('node:fs').mkdirSync('dist',{recursive:true})\" && npm pack --ignore-scripts --pack-destination dist",
     "test:ssh": "node --import ./test/ssh.register.mjs test/ssh.integration.mjs",
     "test:ssh:sftp": "node --import ./test/ssh.register.mjs test/sftp.integration.mjs",
-    "bench": "node --import ./test/ssh.register.mjs test/bench/latency.mjs",
-    "test:live": "node --import ./test/register.mjs --import ./test/ssh.register.mjs test/regression/live-p0.mjs"
+    "bench": "node --import ./test/ssh.register.mjs test/bench/latency.mjs"
   },
   "license": "MIT",
   "keywords": [
@@ -81,7 +82,7 @@
   "author": "duobaobox",
   "repository": {
     "type": "git",
-    "url": "https://github.com/duobaobox/dsh-ssh-workbench.git"
+    "url": "git+https://github.com/duobaobox/dsh-ssh-workbench.git"
   },
   "homepage": "https://github.com/duobaobox/dsh-ssh-workbench",
   "bugs": {