dsh-winrm 0.1.0

package/lib/invariant.js

@@ -0,0 +1,6 @@
+//#region src/invariant.ts
+/** Invariant companion plugin (no assertions — nothing to check at runtime). */
+/** Provides no assertions: the winrm plugin owns no cross-package runtime invariants. */
+function apply() {}
+//#endregion
+export { apply };

package/lib/types/client/api.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Browser-side API client for the /api/dsh-winrm route family. The only data
+ * access path the panel components use — plain fetch/WebSocket, same origin.
+ */
+import { type ClusterResult, type ExecResult, type ProcessInfo, type RemoteDirEntry, type ServiceInfo, type TestResult, type TransferProgress, type WinHostPayload, type WinHostSummary } from '../protocol.ts';
+/** Error carrying the route's JSON error message. */
+export declare class WinrmApiError extends Error {
+    constructor(message: string);
+}
+/** One open console connection (WebSocket JSON frames). */
+export interface ConsoleConnection {
+    onReady: (() => void) | undefined;
+    onOutput: ((data: string) => void) | undefined;
+    onExit: ((code: number | null, error?: string) => void) | undefined;
+    send(data: string): void;
+    close(): void;
+}
+/** The browser half's only data entry point. */
+export declare class WinrmApi {
+    listHosts(queryText?: string): Promise<WinHostSummary[]>;
+    createHost(payload: WinHostPayload): Promise<WinHostSummary>;
+    updateHost(alias: string, patch: WinHostPayload): Promise<WinHostSummary>;
+    deleteHost(alias: string): Promise<void>;
+    testHost(alias: string): Promise<TestResult>;
+    exec(alias: string, command: string, timeoutMs?: number): Promise<ExecResult>;
+    cluster(options: {
+        command: string;
+        aliases?: string[];
+        environment?: string;
+        tags?: string[];
+        timeoutMs?: number;
+        maxWorkers?: number;
+    }): Promise<ClusterResult[]>;
+    listServices(alias: string): Promise<ServiceInfo[]>;
+    serviceAction(alias: string, name: string, action: string): Promise<ServiceInfo>;
+    listProcesses(alias: string): Promise<ProcessInfo[]>;
+    killProcess(alias: string, id: number): Promise<void>;
+    ls(alias: string, dir: string): Promise<RemoteDirEntry[]>;
+    /**
+     * Upload one file (raw bytes) to a remote path. Progress arrives through
+     * the NDJSON response stream; resolves when the result frame lands.
+     */
+    uploadFile(file: File, alias: string, remotePath: string, onProgress?: (progress: TransferProgress) => void): Promise<{
+        transferredBytes: number;
+    }>;
+    /**
+     * Download a remote file with client-side progress. Streams straight to
+     * disk when the File System Access API is available; otherwise falls back
+     * to an in-memory Blob.
+     */
+    downloadFile(alias: string, remotePath: string, onProgress?: (progress: TransferProgress) => void): Promise<{
+        blob?: Blob;
+        filename: string;
+        streamed: boolean;
+        bytes: number;
+    }>;
+    /** Open a WebSocket PowerShell console session. */
+    openConsole(alias: string): ConsoleConnection;
+}

package/lib/types/client/index.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Browser-half entry for the dsh-winrm plugin — runs inside the dsh web GUI.
+ * Registers locale dictionaries and contributes the "Windows" sidebar entry
+ * plus the central operations panel through the shell's slot system: a
+ * `sidebar.panellist` list row (icon + label) that selects the keyed `main`
+ * panel, and the `main` occupant that renders the tabbed WinRM panel in the
+ * center column. This replaces the earlier DOM-injection approach with the
+ * first-class extension points the shell now provides. DOM/slot mounting
+ * problems are logged, never thrown — an external plugin must not take the
+ * GUI down.
+ *
+ * Export discipline (packages/client rule): the /client surface carries what
+ * cordis loading needs plus types only — all value exports stay internal.
+ */
+import type { Context as ClientContext } from '@deepseek-ai/cordis';
+import { type WinKey } from './locales.ts';
+declare module '@deepseek-ai/dsh-client-ui-slots' {
+    interface LocaleNamespaceMap {
+        /** dsh-winrm surface copy. */
+        'dsh-winrm': WinKey;
+    }
+}
+/** Required services (fiber inject waiting — slots, locale, and layout must be up first). */
+export declare const inject: string[];
+/** Type-only surface (export discipline: no value exports beyond the plugin contract). */
+export type { WinrmPanelProps } from './panel/WinrmPanel.tsx';
+export type { HostsTabProps } from './panel/HostsTab.tsx';
+export type { HostFormDialogProps } from './panel/HostFormDialog.tsx';
+export type { ConsoleTabProps } from './panel/ConsoleTab.tsx';
+export type { ServicesTabProps } from './panel/ServicesTab.tsx';
+export type { ProcessesTabProps } from './panel/ProcessesTab.tsx';
+export type { TransferTabProps } from './panel/TransferTab.tsx';
+export type { WinKey } from './locales.ts';
+/**
+ * Contribute the Windows sidebar entry and the tabbed WinRM panel it opens.
+ * @param ctx - client root context (locale, slots, layout services).
+ */
+export declare function apply(ctx: ClientContext): void;

package/lib/types/client/locales.d.ts

@@ -0,0 +1,231 @@
+/**
+ * Locale dictionaries for the WinRM panel (zh / en), bound to the shared
+ * interpolator in panel/helpers.ts.
+ */
+export declare const zh: {
+    readonly 'entry.label': "Windows";
+    readonly 'entry.tooltip': "Windows 远程管理（WinRM）";
+    readonly 'panel.title': "Windows 远程管理";
+    readonly 'panel.backToConversation': "返回对话";
+    readonly 'tab.hosts': "主机";
+    readonly 'tab.console': "控制台";
+    readonly 'tab.services': "服务";
+    readonly 'tab.processes': "进程";
+    readonly 'tab.transfer': "传输";
+    readonly 'common.loading': "加载中…";
+    readonly 'common.error': "错误：{error}";
+    readonly 'common.refresh': "刷新";
+    readonly 'hosts.search': "搜索主机…";
+    readonly 'hosts.add': "添加主机";
+    readonly 'hosts.test': "测试";
+    readonly 'hosts.testing': "测试中…";
+    readonly 'hosts.edit': "编辑";
+    readonly 'hosts.delete': "删除";
+    readonly 'hosts.deleteConfirm': "确认删除主机 {alias}？";
+    readonly 'hosts.connect': "连接控制台";
+    readonly 'hosts.testOk': "连接成功（{latency} ms）";
+    readonly 'hosts.testFail': "连接失败：{error}";
+    readonly 'hosts.empty': "尚未配置 Windows 主机，点「添加主机」开始。";
+    readonly 'hosts.col.alias': "别名";
+    readonly 'hosts.col.host': "主机";
+    readonly 'hosts.col.user': "用户";
+    readonly 'hosts.col.auth': "认证";
+    readonly 'hosts.col.transport': "传输";
+    readonly 'hosts.col.environment': "环境";
+    readonly 'hosts.col.tags': "标签";
+    readonly 'hosts.col.description': "备注";
+    readonly 'hosts.col.actions': "操作";
+    readonly 'form.title.create': "添加 Windows 主机";
+    readonly 'form.title.edit': "编辑主机 {alias}";
+    readonly 'form.alias': "别名";
+    readonly 'form.aliasHint': "英文字母/数字/点/连字符/下划线";
+    readonly 'form.host': "主机名或 IP";
+    readonly 'form.port': "WinRM 端口";
+    readonly 'form.user': "用户名";
+    readonly 'form.userHint': "由原生 Node WinRM 客户端自动选择 NTLM/Negotiate 或 Basic；支持本地账户、DOMAIN\\user 或 user@domain";
+    readonly 'form.password': "密码";
+    readonly 'form.passwordHint': "仅保存在本机 ~/.dsh/dsh-winrm.json（0600），不显示在页面上";
+    readonly 'form.transport': "传输";
+    readonly 'form.transport.http': "HTTP (5985)";
+    readonly 'form.transport.https': "HTTPS (5986)";
+    readonly 'form.rejectUnauthorized': "接受自签名证书（HTTPS）";
+    readonly 'form.environment': "环境（development / production…）";
+    readonly 'form.tags': "标签（逗号分隔）";
+    readonly 'form.description': "备注";
+    readonly 'form.save': "保存";
+    readonly 'form.cancel': "取消";
+    readonly 'form.error': "错误：{error}";
+    readonly 'form.passwordPlaceholder': "（保持不变）";
+    readonly 'console.select': "选择主机开始控制台";
+    readonly 'console.connecting': "正在连接 {alias}…";
+    readonly 'console.connected': "已连接 {alias} — 输入 PowerShell 命令，回车执行；输入 exit 退出";
+    readonly 'console.disconnected': "连接已关闭";
+    readonly 'console.disconnect': "断开";
+    readonly 'console.inputPlaceholder': "PowerShell 命令…";
+    readonly 'console.send': "发送";
+    readonly 'console.utf8Note': "注意：控制台经 WinRM 传输，中文输出可能乱码；需要精确中文输出请用「exec」或文件传输";
+    readonly 'services.select': "选择主机查看服务";
+    readonly 'services.list': "服务列表";
+    readonly 'services.name': "服务名";
+    readonly 'services.displayName': "显示名";
+    readonly 'services.status': "状态";
+    readonly 'services.startMode': "启动类型";
+    readonly 'services.startName': "运行账户";
+    readonly 'services.start': "启动";
+    readonly 'services.stop': "停止";
+    readonly 'services.restart': "重启";
+    readonly 'services.auto': "自动";
+    readonly 'services.manual': "手动";
+    readonly 'services.disabled': "禁用";
+    readonly 'services.actionOk': "操作成功：{name} → {status}";
+    readonly 'services.actionFail': "操作失败：{error}";
+    readonly 'services.filter': "筛选…";
+    readonly 'processes.select': "选择主机查看进程";
+    readonly 'processes.id': "PID";
+    readonly 'processes.name': "名称";
+    readonly 'processes.cpu': "CPU";
+    readonly 'processes.memMB': "内存(MB)";
+    readonly 'processes.startTime': "启动时间";
+    readonly 'processes.path': "路径";
+    readonly 'processes.kill': "结束";
+    readonly 'processes.killConfirm': "确认结束进程 {name} (PID {id})？";
+    readonly 'processes.killed': "已结束进程 PID {id}";
+    readonly 'processes.killFail': "结束失败：{error}";
+    readonly 'processes.filter': "筛选…";
+    readonly 'transfer.select': "选择主机浏览文件";
+    readonly 'transfer.path': "路径";
+    readonly 'transfer.go': "打开";
+    readonly 'transfer.up': "上级";
+    readonly 'transfer.root': "根目录";
+    readonly 'transfer.name': "名称";
+    readonly 'transfer.type': "类型";
+    readonly 'transfer.size': "大小";
+    readonly 'transfer.modified': "修改时间";
+    readonly 'transfer.download': "下载";
+    readonly 'transfer.upload': "上传文件";
+    readonly 'transfer.uploading': "上传中…";
+    readonly 'transfer.downloading': "下载中…";
+    readonly 'transfer.uploaded': "已上传 {bytes} 字节";
+    readonly 'transfer.downloaded': "已下载 {bytes} 字节";
+    readonly 'transfer.fail': "传输失败：{error}";
+    readonly 'transfer.bytes': "B";
+    readonly 'transfer.kib': "KB";
+    readonly 'transfer.mib': "MB";
+    readonly 'transfer.dir': "目录";
+    readonly 'transfer.file': "文件";
+};
+export declare const en: {
+    readonly 'entry.label': "Windows";
+    readonly 'entry.tooltip': "Windows remote administration (WinRM)";
+    readonly 'panel.title': "Windows Remote";
+    readonly 'panel.backToConversation': "Back to chat";
+    readonly 'tab.hosts': "Hosts";
+    readonly 'tab.console': "Console";
+    readonly 'tab.services': "Services";
+    readonly 'tab.processes': "Processes";
+    readonly 'tab.transfer': "Transfer";
+    readonly 'common.loading': "Loading…";
+    readonly 'common.error': "Error: {error}";
+    readonly 'common.refresh': "Refresh";
+    readonly 'hosts.search': "Search hosts…";
+    readonly 'hosts.add': "Add host";
+    readonly 'hosts.test': "Test";
+    readonly 'hosts.testing': "Testing…";
+    readonly 'hosts.edit': "Edit";
+    readonly 'hosts.delete': "Delete";
+    readonly 'hosts.deleteConfirm': "Delete host {alias}?";
+    readonly 'hosts.connect': "Console";
+    readonly 'hosts.testOk': "connected ({latency} ms)";
+    readonly 'hosts.testFail': "failed: {error}";
+    readonly 'hosts.empty': "No Windows hosts configured yet — click \"Add host\" to start.";
+    readonly 'hosts.col.alias': "Alias";
+    readonly 'hosts.col.host': "Host";
+    readonly 'hosts.col.user': "User";
+    readonly 'hosts.col.auth': "Auth";
+    readonly 'hosts.col.transport': "Transport";
+    readonly 'hosts.col.environment': "Environment";
+    readonly 'hosts.col.tags': "Tags";
+    readonly 'hosts.col.description': "Description";
+    readonly 'hosts.col.actions': "Actions";
+    readonly 'form.title.create': "Add Windows host";
+    readonly 'form.title.edit': "Edit host {alias}";
+    readonly 'form.alias': "Alias";
+    readonly 'form.aliasHint': "letters, digits, dots, hyphens or underscores";
+    readonly 'form.host': "Hostname or IP";
+    readonly 'form.port': "WinRM port";
+    readonly 'form.user': "Username";
+    readonly 'form.userHint': "Native Node WinRM client auto-selects NTLM/Negotiate or Basic; supports local, DOMAIN\\user, or user@domain accounts";
+    readonly 'form.password': "Password";
+    readonly 'form.passwordHint': "Stored locally only in ~/.dsh/dsh-winrm.json (0600), never shown here";
+    readonly 'form.transport': "Transport";
+    readonly 'form.transport.http': "HTTP (5985)";
+    readonly 'form.transport.https': "HTTPS (5986)";
+    readonly 'form.rejectUnauthorized': "Accept self-signed certificates (HTTPS)";
+    readonly 'form.environment': "Environment (development / production…)";
+    readonly 'form.tags': "Tags (comma separated)";
+    readonly 'form.description': "Description";
+    readonly 'form.save': "Save";
+    readonly 'form.cancel': "Cancel";
+    readonly 'form.error': "Error: {error}";
+    readonly 'form.passwordPlaceholder': "(unchanged)";
+    readonly 'console.select': "Pick a host to open the console";
+    readonly 'console.connecting': "Connecting to {alias}…";
+    readonly 'console.connected': "Connected to {alias} — type a PowerShell command and press Enter; type exit to quit";
+    readonly 'console.disconnected': "Connection closed";
+    readonly 'console.disconnect': "Disconnect";
+    readonly 'console.inputPlaceholder': "PowerShell command…";
+    readonly 'console.send': "Send";
+    readonly 'console.utf8Note': "Note: the console travels over WinRM and non-ASCII output may garble; use exec or file transfer for exact UTF-8 content";
+    readonly 'services.select': "Pick a host to view services";
+    readonly 'services.list': "Services";
+    readonly 'services.name': "Name";
+    readonly 'services.displayName': "Display name";
+    readonly 'services.status': "Status";
+    readonly 'services.startMode': "Start mode";
+    readonly 'services.startName': "Run as";
+    readonly 'services.start': "Start";
+    readonly 'services.stop': "Stop";
+    readonly 'services.restart': "Restart";
+    readonly 'services.auto': "Auto";
+    readonly 'services.manual': "Manual";
+    readonly 'services.disabled': "Disabled";
+    readonly 'services.actionOk': "OK: {name} → {status}";
+    readonly 'services.actionFail': "Failed: {error}";
+    readonly 'services.filter': "Filter…";
+    readonly 'processes.select': "Pick a host to view processes";
+    readonly 'processes.id': "PID";
+    readonly 'processes.name': "Name";
+    readonly 'processes.cpu': "CPU";
+    readonly 'processes.memMB': "Mem(MB)";
+    readonly 'processes.startTime': "Started";
+    readonly 'processes.path': "Path";
+    readonly 'processes.kill': "Kill";
+    readonly 'processes.killConfirm': "Kill process {name} (PID {id})?";
+    readonly 'processes.killed': "Killed PID {id}";
+    readonly 'processes.killFail': "Failed: {error}";
+    readonly 'processes.filter': "Filter…";
+    readonly 'transfer.select': "Pick a host to browse files";
+    readonly 'transfer.path': "Path";
+    readonly 'transfer.go': "Open";
+    readonly 'transfer.up': "Up";
+    readonly 'transfer.root': "Root";
+    readonly 'transfer.name': "Name";
+    readonly 'transfer.type': "Type";
+    readonly 'transfer.size': "Size";
+    readonly 'transfer.modified': "Modified";
+    readonly 'transfer.download': "Download";
+    readonly 'transfer.upload': "Upload file";
+    readonly 'transfer.uploading': "Uploading…";
+    readonly 'transfer.downloading': "Downloading…";
+    readonly 'transfer.uploaded': "Uploaded {bytes} bytes";
+    readonly 'transfer.downloaded': "Downloaded {bytes} bytes";
+    readonly 'transfer.fail': "Transfer failed: {error}";
+    readonly 'transfer.bytes': "B";
+    readonly 'transfer.kib': "KB";
+    readonly 'transfer.mib': "MB";
+    readonly 'transfer.dir': "dir";
+    readonly 'transfer.file': "file";
+};
+export type WinKey = keyof typeof zh;
+/** Translate a key in one dictionary with optional {name} params. */
+export declare function t(dict: Record<string, string>, key: WinKey, values?: Record<string, string | number>): string;

package/lib/types/client/panel/ConsoleTab.d.ts

@@ -0,0 +1,11 @@
+import type { WinrmApi } from '../api.ts';
+/** Console tab props. */
+export interface ConsoleTabProps {
+    api: WinrmApi;
+    /** Alias to auto-connect (from the hosts tab). */
+    presetAlias?: string;
+    /** Increments when a new connect request arrives. */
+    requestId?: number;
+}
+/** The streaming PowerShell console. */
+export declare function ConsoleTab({ api, presetAlias, requestId }: ConsoleTabProps): import("react").JSX.Element;

package/lib/types/client/panel/HostFormDialog.d.ts

@@ -0,0 +1,12 @@
+import type { WinrmApi } from '../api.ts';
+import type { WinHostSummary } from '../../protocol.ts';
+/** Host form dialog props. */
+export interface HostFormDialogProps {
+    api: WinrmApi;
+    /** The host being edited, or null for create. */
+    editing: WinHostSummary | null;
+    onClose: () => void;
+    onSaved: () => void;
+}
+/** The create/edit host dialog. */
+export declare function HostFormDialog({ api, editing, onClose, onSaved }: HostFormDialogProps): import("react").JSX.Element;

package/lib/types/client/panel/HostsTab.d.ts

@@ -0,0 +1,9 @@
+import type { WinrmApi } from '../api.ts';
+/** Hosts tab props. */
+export interface HostsTabProps {
+    api: WinrmApi;
+    /** Connect the given alias in the console tab. */
+    onConnect: (alias: string) => void;
+}
+/** The hosts table plus its toolbar and dialogs. */
+export declare function HostsTab({ api, onConnect }: HostsTabProps): import("react").JSX.Element;

package/lib/types/client/panel/ProcessesTab.d.ts

@@ -0,0 +1,7 @@
+import type { WinrmApi } from '../api.ts';
+/** Processes tab props. */
+export interface ProcessesTabProps {
+    api: WinrmApi;
+}
+/** The processes table with host picker and kill actions. */
+export declare function ProcessesTab({ api }: ProcessesTabProps): import("react").JSX.Element;

package/lib/types/client/panel/ServicesTab.d.ts

@@ -0,0 +1,7 @@
+import type { WinrmApi } from '../api.ts';
+/** Services tab props. */
+export interface ServicesTabProps {
+    api: WinrmApi;
+}
+/** The services table with host picker and actions. */
+export declare function ServicesTab({ api }: ServicesTabProps): import("react").JSX.Element;

package/lib/types/client/panel/TransferTab.d.ts

@@ -0,0 +1,7 @@
+import type { WinrmApi } from '../api.ts';
+/** Transfer tab props. */
+export interface TransferTabProps {
+    api: WinrmApi;
+}
+/** The file browser with upload/download. */
+export declare function TransferTab({ api }: TransferTabProps): import("react").JSX.Element;

package/lib/types/client/panel/WinrmPanel.d.ts

@@ -0,0 +1,12 @@
+import type { WinrmApi } from '../api.ts';
+/** The panel's tab identifiers. */
+export type WinrmTab = 'hosts' | 'console' | 'services' | 'processes' | 'transfer';
+/** Panel shell props (the inject face supplied by the main-slot registration). */
+export interface WinrmPanelProps {
+    /** The WinRM API client every tab operates through. */
+    api: WinrmApi;
+    /** Return to the Conversation (wired to ctx.layout.selectPanel(null)). */
+    onBack: () => void;
+}
+/** The tabbed WinRM panel. */
+export declare function WinrmPanel({ api, onBack }: WinrmPanelProps): import("react").JSX.Element;

package/lib/types/client/panel/WinrmPanelIcon.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Sidebar `panellist` icon for the WinRM panel. The shell owns the row
+ * button and its label; this component only renders the glyph at the size
+ * and active state the row requests.
+ */
+import type { SidebarPanelIconOwnerProps } from '@deepseek-ai/dsh-client-ui-sidebar/client';
+/** One glyph contribution for the `sidebar.panellist` list slot. */
+export declare function WinrmPanelIcon({ size }: SidebarPanelIconOwnerProps): import("react").JSX.Element;

package/lib/types/client/panel/helpers.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Shared panel helpers: the active-dictionary pick (document-language based)
+ * bound to the dsh-winrm interpolator in locales.ts, plus a small
+ * error-message extractor.
+ */
+import { type WinKey } from '../locales.ts';
+/** Template values accepted by the interpolator. */
+export type TranslateValues = Record<string, string | number>;
+/** Active dictionary, picked by the document language at call time. */
+export declare function dictionary(): Record<string, string>;
+/** Translate a key with optional {name} template params (current language). */
+export declare function tt(key: WinKey, values?: TranslateValues): string;
+/** Human-readable error text from an unknown thrown value. */
+export declare function errorMessage(error: unknown): string;
+/** Format a byte count into B/KB/MB. */
+export declare function formatBytes(bytes: number): string;

package/lib/types/engine/client.d.ts

@@ -0,0 +1,49 @@
+/**
+ * WinRM transport bridge.
+ *
+ * Runs each PowerShell payload over a native Node.js WinRM client
+ * (winrm-client) — no Python/pywinrm subprocess. The script rides the
+ * UTF-8 base64 envelope (marker + base64 of UTF-8 output) so Chinese and
+ * any codepage output survives the WinRM transport losslessly; the envelope
+ * is base64-encoded with `-EncodedCommand`, keeping the command line a
+ * single ASCII-safe line that WinRS/cmd.exe cannot mangle.
+ *
+ * Auth is chosen per attempt (HTTPS: Basic first, then NTLM; HTTP: NTLM
+ * first, then Basic) with fallback, so a host that only enables one scheme
+ * still connects. Credentials are passed to the library in-process — they
+ * never appear in a child-process argument list.
+ */
+import type { WinHostEntry } from '../protocol.ts';
+/** Connection parameters for one target (transport-agnostic projection of a host entry). */
+export interface WinRMParams {
+    host: string;
+    port: number;
+    path: string;
+    username: string;
+    password: string;
+    useHttps?: boolean;
+    rejectUnauthorized?: boolean;
+}
+export declare function runScript(conn: WinRMParams, script: string, options?: {
+    timeoutMs?: number;
+    onChunk?: (chunk: {
+        output: string;
+        stderr: string;
+    }) => void;
+}): Promise<{
+    stdout: string;
+    stderr: string;
+    exitCode: number | null;
+    timedOut: boolean;
+    durationMs: number;
+}>;
+export declare function connOf(entry: WinHostEntry): WinRMParams;
+export declare function testConnection(conn: WinRMParams): Promise<{
+    ok: boolean;
+    latencyMs: number;
+    error?: string;
+}>;
+export declare const TRANSFER_CHUNK: number;
+export declare function remoteFileSize(conn: WinRMParams, remotePath: string, timeoutMs?: number): Promise<number>;
+export declare function downloadChunks(conn: WinRMParams, remotePath: string, onChunk: (b64: string, bytes: number) => void, onProgress?: (transferred: number, total: number) => void, timeoutMs?: number): Promise<number>;
+export declare function uploadBuffer(conn: WinRMParams, remotePath: string, data: Buffer, onProgress?: (transferred: number, total: number) => void, timeoutMs?: number): Promise<number>;

package/lib/types/engine/console.d.ts

@@ -0,0 +1,23 @@
+/**
+ * WebSocket PowerShell console backed by winrm-client one-shot commands.
+ *
+ * The native Node WinRM client executes each submitted command through the
+ * same UTF-8 envelope as winrm_exec; the WebSocket remains open while
+ * commands are serialized. This is intentionally a command console rather
+ * than a persistent remote process, so every line is authenticated and
+ * isolated.
+ */
+import type { WinRMParams } from './client.ts';
+export declare class ConsoleSession {
+    private conn;
+    private running;
+    private exited;
+    private queue;
+    onData: ((data: string) => void) | undefined;
+    onExit: ((code: number | null, error?: string) => void) | undefined;
+    constructor(conn: WinRMParams);
+    start(): Promise<void>;
+    send(data: string): void;
+    close(): void;
+    private finish;
+}

package/lib/types/engine.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The WinRM engine facade: host lookup, PowerShell exec (UTF-8 envelope),
+ * service & process management, directory listing, base64-chunked file
+ * transfer, cluster execution and the streaming console. The heavy lifting
+ * lives in engine/ (client, console); this class composes them behind one
+ * WinRmEngine instance per plugin apply.
+ */
+import type { ClusterResult, ExecResult, ProcessInfo, RemoteDirEntry, ServiceInfo, TestResult, TransferProgress, WinHostSummary } from './protocol.ts';
+import type { HostStore } from './store.ts';
+import { type TransferChannel } from './smb.ts';
+import { ConsoleSession } from './engine/console.ts';
+/** The engine. One instance per plugin apply; dispose() clears nothing pooled (WinRM is per-call HTTP). */
+export declare class WinRmEngine {
+    readonly store: HostStore;
+    private gate;
+    constructor(store: HostStore);
+    /** Secret-free host list (filtered by the optional query). */
+    list(query?: string): WinHostSummary[];
+    /** One host summary by alias. */
+    find(alias: string): WinHostSummary | undefined;
+    /** Run one PowerShell command on `alias`. */
+    exec(alias: string, command: string, timeoutMs?: number): Promise<ExecResult>;
+    /** Run one command against many hosts concurrently. */
+    cluster(options: {
+        command: string;
+        aliases?: string[];
+        environment?: string;
+        tags?: string[];
+        timeoutMs?: number;
+        maxWorkers?: number;
+    }): Promise<ClusterResult[]>;
+    /** Full service table. */
+    listServices(alias: string): Promise<ServiceInfo[]>;
+    /** One service action, returning the refreshed service row. */
+    serviceAction(alias: string, name: string, action: 'start' | 'stop' | 'restart' | 'set-auto' | 'set-manual' | 'set-disabled'): Promise<ServiceInfo>;
+    /** Full process table. */
+    listProcesses(alias: string): Promise<ProcessInfo[]>;
+    /** Kill one process by id. */
+    killProcess(alias: string, id: number): Promise<void>;
+    /** List a remote directory. */
+    ls(alias: string, dir: string): Promise<RemoteDirEntry[]>;
+    /** Upload one local file to a remote path. Defaults to SMB with WinRM fallback. */
+    upload(alias: string, localPath: string, remotePath: string, onProgress?: (progress: TransferProgress) => void, channel?: TransferChannel): Promise<{
+        bytes: number;
+        channel?: TransferChannel;
+    }>;
+    /** Download one remote file to a local path. Defaults to SMB with WinRM fallback. */
+    download(alias: string, remotePath: string, localPath: string, onProgress?: (progress: TransferProgress) => void, channel?: TransferChannel): Promise<{
+        bytes: number;
+        channel?: TransferChannel;
+    }>;
+    /** Open a streaming PowerShell console session (standalone connection). */
+    openConsole(alias: string): Promise<ConsoleSession>;
+    /** Probe connectivity. */
+    test(alias: string): Promise<TestResult>;
+    /** No pooled resources to close (WinRM is per-call HTTP). */
+    dispose(): void;
+}

package/lib/types/index.d.ts

@@ -0,0 +1,44 @@
+/**
+ * dsh-winrm — host half. Mounts the WinRM engine (per-call PowerShell
+ * execution with a UTF-8 envelope, streaming console, service/process
+ * management, base64-chunked file transfer, cluster), the /api/dsh-winrm
+ * route family plus the console WebSocket upgrade, the agent tools
+ * (winrm_list, winrm_exec, winrm_service, winrm_process, winrm_upload,
+ * winrm_download, winrm_cluster), and a system-prompt announcement. The
+ * browser half (./client) renders the host manager and operations panel.
+ * Everything rides official NPM SDK packages — no dsh source changes.
+ *
+ * Config is read live through `Volatile` references (`.get()`), so the
+ * Settings page can flip `enabled` / `announceToAgent` without remounting;
+ * `loader/volatile-update` re-runs the registration sync when they change.
+ */
+import type { Context, Volatile } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+/** Stable cordis plugin name. */
+export declare const name = "winrm";
+/** Services required before the WinRM surfaces can mount. */
+export declare const inject: string[];
+/** Plugin config, validated by the same-named schemastery schema. Live fields are `Volatile`. */
+export interface Config {
+    /** When true (default), a system-prompt section announces the plugin to every agent. */
+    announceToAgent?: Volatile<boolean>;
+    /** Master switch for the plugin (routes, tools, prompt section). */
+    enabled?: Volatile<boolean>;
+}
+export declare const Config: z<Schemastery.ObjectS<NoInfer<{
+    announceToAgent: z<boolean, boolean, "volatile-defined">;
+    enabled: z<boolean, boolean, "volatile-defined">;
+}>>, Schemastery.ObjectT<NoInfer<{
+    announceToAgent: z<boolean, boolean, "volatile-defined">;
+    enabled: z<boolean, boolean, "volatile-defined">;
+}>>, "plain">;
+/** Model-facing announcement: plugin presence, capabilities, and limits. */
+export declare const WINRM_GUIDANCE = "\u672C\u673A\u5DF2\u5B89\u88C5 dsh-winrm \u63D2\u4EF6\uFF08DSH \u8FDC\u7A0B Windows \u8FD0\u7EF4\uFF0CWinRM/PowerShell Remoting\uFF09\uFF1A\u4FA7\u8FB9\u680F\u300CWindows\u300D\u5165\u53E3\uFF1B\u4EFF\u7167 dsh-ssh \u63D2\u4EF6\u5F00\u53D1\u3002\u80FD\u529B\uFF1A\u4E3B\u673A\u914D\u7F6E\u5B58 ~/.dsh/dsh-winrm.json\uFF08GUI \u914D\u7F6E\u540E agent \u65B9\u53EF\u4F7F\u7528\uFF09\uFF1Bwinrm_list \u5217\u51FA\u4E3B\u673A\u3001winrm_exec \u6267\u884C PowerShell \u547D\u4EE4\uFF08UTF-8 \u4FE1\u5C01\uFF0C\u4E2D\u6587\u4E0D\u4E71\u7801\uFF09\u3001winrm_service \u670D\u52A1\u7BA1\u7406\uFF08start/stop/restart/\u542F\u52A8\u7C7B\u578B\uFF09\u3001winrm_process \u8FDB\u7A0B\u7BA1\u7406\uFF08list/kill\uFF09\u3001winrm_upload/winrm_download \u6587\u4EF6\u4F20\u8F93\uFF08base64 \u5206\u5757\uFF0C\u65E0 SMB \u4F9D\u8D56\uFF09\u3001winrm_cluster \u96C6\u7FA4\u5E76\u53D1\u6267\u884C\uFF1BWeb \u63A7\u5236\u53F0\u8D70 WebSocket\u3002\u8BA4\u8BC1\uFF1A\u901A\u8FC7\u539F\u751F Node.js WinRM \u5BA2\u6237\u7AEF\uFF08winrm-client\uFF09\u7684 NTLM/Negotiate \u4E0E Basic \u5B9E\u73B0\uFF0C\u517C\u5BB9\u672C\u5730\u8D26\u6237\u4E0E\u57DF\u8D26\u6237\uFF1B\u4F20\u8F93\u652F\u6301 http(5985)/https(5986)\u3002\u524D\u63D0\uFF1A\u76EE\u6807\u673A\u9700\u542F\u7528 WinRM\uFF08scripts/enable-winrm.ps1\uFF09\uFF0C\u672C\u673A\u65E0\u9700 Python \u2014\u2014 WinRM \u8D70\u7EAF Node \u4F9D\u8D56\u3002HTTP \u4EC5\u5EFA\u8BAE\u53D7\u4FE1\u5185\u7F51\u4F7F\u7528\uFF1B\u5BC6\u7801\u4EE5\u660E\u6587\u5B58\u5728\u7528\u6237\u4E3B\u76EE\u5F55\u79C1\u6709\u6587\u4EF6\uFF08\u6743\u9650 0600\uFF09\uFF1B\u547D\u4EE4\u8F93\u51FA\u53EF\u80FD\u542B\u654F\u611F\u4FE1\u606F\uFF1B\u4F20\u8F93/\u6267\u884C\u6D88\u8017\u771F\u5B9E\u8FDC\u7A0B\u8D44\u6E90\uFF0C\u5148\u786E\u8BA4\u518D\u64CD\u4F5C\u3002\u7528\u6237\u63D0\u5230\u300CWindows \u670D\u52A1\u5668 / WinRM / PowerShell \u8FDC\u7A0B / \u670D\u52A1\u7BA1\u7406 / \u8FDB\u7A0B\u7BA1\u7406\u300D\u65F6\u5373\u6307\u672C\u63D2\u4EF6\uFF0C\u8BF7\u636E\u6B64\u534F\u4F5C\u3002";
+/**
+ * Mount the WinRM engine, routes, tools, and announcement.
+ * @param ctx - host plugin context carrying webServer/tools/systemPrompt.
+ * @param config - resolved plugin config (volatile fields read via `.get()`).
+ */
+export declare const apply: typeof applyImpl;
+declare function applyImpl(ctx: Context, config?: Config): void;
+export {};

package/lib/types/invariant.d.ts

@@ -0,0 +1,3 @@
+/** Invariant companion plugin (no assertions — nothing to check at runtime). */
+/** Provides no assertions: the winrm plugin owns no cross-package runtime invariants. */
+export declare function apply(): void;