minimal-agent 0.18.13 → 0.18.14

package/src/cli/wizards/sshHostWizard.js

@@ -1,156 +0,0 @@
-import { jsx as _jsx } from "react/jsx-runtime";
-/**
- * ============================================================
- *  src/cli/wizards/sshHostWizard.tsx —— 新增/编辑一个 SSH 主机
- * ------------------------------------------------------------
- *  三阶段状态机（同 advisorWizard.tsx 的做法）：基础信息 → 认证方式
- *  （分叉：密码 or 私钥）→ 高级选项，最后一步才真正落盘。alias 是主机的
- *  唯一标识，编辑时不可改（同模型 id 的语义），所以编辑模式直接跳过第一
- *  阶段的 alias 字段。
- * ============================================================
- */
-import { useState } from 'react';
-import { addSshHost, updateSshHost, } from '../../context/sshHosts.js';
-import { CONFIG_LIMITS, normalizeLimited } from '../../config/numericLimits.js';
-import { FieldForm } from './fieldForm.js';
-function parsePort(value, fallback) {
-    const parsed = Number.parseInt(String(value ?? ''), 10);
-    return Number.isFinite(parsed) ? parsed : fallback;
-}
-export function SshHostWizard({ workspaceId, existing, onDone, onCancel }) {
-    const [phase, setPhase] = useState('basic');
-    const [basic, setBasic] = useState(existing
-        ? { alias: existing.alias, host: existing.host, port: String(existing.port), username: existing.username }
-        : null);
-    const [authMethod, setAuthMethod] = useState(existing?.authMethod ?? 'password');
-    const [authDraft, setAuthDraft] = useState(existing
-        ? { password: existing.password, privateKeyPath: existing.privateKeyPath, passphrase: existing.passphrase }
-        : null);
-    if (phase === 'basic') {
-        return (_jsx(FieldForm, { title: existing ? `编辑 SSH 主机 "${existing.alias}"` : '新增 SSH 主机', fields: [
-                ...(existing ? [] : [{
-                        key: 'alias', label: '别名（模型/工具用它引用主机，不含空格）', type: 'text', default: '',
-                        hint: '例如 jetson、prod-server；只能是字母数字与 . _ -',
-                    }]),
-                { key: 'host', label: '主机地址（IP 或域名）', type: 'text', default: existing?.host ?? '' },
-                { key: 'port', label: '端口', type: 'text', default: String(existing?.port ?? 22), optional: true },
-                { key: 'username', label: '用户名', type: 'text', default: existing?.username ?? '' },
-            ], onSubmit: async (values) => {
-                const alias = existing?.alias ?? String(values.alias ?? '').trim();
-                const host = String(values.host ?? '').trim();
-                const username = String(values.username ?? '').trim();
-                if (!alias)
-                    throw new Error('别名不能为空');
-                if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(alias))
-                    throw new Error('别名格式不合法（只能是字母数字与 . _ -）');
-                if (!host)
-                    throw new Error('主机地址不能为空');
-                if (!username)
-                    throw new Error('用户名不能为空');
-                setBasic({
-                    alias,
-                    host,
-                    port: String(normalizeLimited(parsePort(values.port, 22), CONFIG_LIMITS.sshPort, 22)),
-                    username,
-                });
-                setPhase('auth');
-            }, onCancel: onCancel }));
-    }
-    if (phase === 'auth') {
-        return (_jsx(FieldForm, { title: "\u8BA4\u8BC1\u65B9\u5F0F", fields: [
-                {
-                    key: 'authMethod',
-                    label: '认证方式',
-                    type: 'select',
-                    options: ['password', 'privateKey'],
-                    default: authMethod,
-                    hint: 'password=密码认证（部分设备如 Jetson 只支持这种）· privateKey=私钥认证',
-                },
-            ], onSubmit: async (values) => {
-                const method = values.authMethod === 'privateKey' ? 'privateKey' : 'password';
-                setAuthMethod(method);
-                setPhase(method === 'password' ? 'auth-password' : 'auth-key');
-            }, onCancel: onCancel }));
-    }
-    if (phase === 'auth-password') {
-        // 只有「编辑且此前也是密码认证」才允许留空沿用旧值——从私钥切到密码认证时
-        // 旧密码根本不存在，必须强制录入，否则会存出一条没有真实凭据的主机记录。
-        const canKeepExisting = Boolean(existing && existing.authMethod === 'password');
-        return (_jsx(FieldForm, { title: "\u5BC6\u7801\u8BA4\u8BC1", fields: [{
-                    key: 'password', label: '密码', type: 'password',
-                    default: authDraft?.password ?? '',
-                    optional: canKeepExisting,
-                    hint: canKeepExisting ? '留空 = 保持现有密码不变' : undefined,
-                }], onSubmit: async (values) => {
-                const password = String(values.password ?? '').trim();
-                if (!password && !canKeepExisting)
-                    throw new Error('密码不能为空');
-                setAuthDraft({ password: password || existing?.password, privateKeyPath: undefined, passphrase: undefined });
-                setPhase('advanced');
-            }, onCancel: onCancel }));
-    }
-    if (phase === 'auth-key') {
-        // 同上：只有此前也是私钥认证才允许留空沿用旧路径。
-        const canKeepExisting = Boolean(existing && existing.authMethod === 'privateKey');
-        return (_jsx(FieldForm, { title: "\u79C1\u94A5\u8BA4\u8BC1", fields: [
-                {
-                    key: 'privateKeyPath', label: '私钥文件路径', type: 'text',
-                    default: authDraft?.privateKeyPath ?? '', optional: canKeepExisting,
-                    hint: canKeepExisting ? '留空 = 保持现有私钥路径不变' : '本机绝对路径，例如 C:\\Users\\you\\.ssh\\id_ed25519',
-                },
-                {
-                    key: 'passphrase', label: '私钥密码（没有则留空）', type: 'password',
-                    default: authDraft?.passphrase ?? '', optional: true,
-                },
-            ], onSubmit: async (values) => {
-                const privateKeyPath = String(values.privateKeyPath ?? '').trim();
-                if (!privateKeyPath && !canKeepExisting)
-                    throw new Error('私钥文件路径不能为空');
-                setAuthDraft({
-                    password: undefined,
-                    privateKeyPath: privateKeyPath || existing?.privateKeyPath,
-                    passphrase: String(values.passphrase ?? '').trim() || undefined,
-                });
-                setPhase('advanced');
-            }, onCancel: onCancel }));
-    }
-    // phase === 'advanced'
-    return (_jsx(FieldForm, { title: "\u9AD8\u7EA7\u9009\u9879", fields: [
-            {
-                key: 'remoteShell', label: '远程 shell 类型', type: 'select',
-                options: ['bash', 'cmd', 'powershell'],
-                default: existing?.remoteShell ?? 'bash',
-                hint: '用于危险命令拦截判断（如 rm/del），必须与主机实际 shell 一致；Linux/树莓派/Jetson 选 bash',
-            },
-            {
-                key: 'timeoutMs', label: '默认操作超时（秒，留空用工具默认值）', type: 'text',
-                default: existing?.timeoutMs ? String(Math.round(existing.timeoutMs / 1000)) : '', optional: true,
-            },
-        ], onSubmit: async (values) => {
-            if (!basic)
-                throw new Error('缺少基础信息'); // 状态机不应该走到这一步却没有 basic
-            const remoteShell = (values.remoteShell === 'cmd' || values.remoteShell === 'powershell')
-                ? values.remoteShell
-                : 'bash';
-            const timeoutSeconds = String(values.timeoutMs ?? '').trim();
-            const timeoutMs = timeoutSeconds
-                ? normalizeLimited(Number.parseInt(timeoutSeconds, 10) * 1000, CONFIG_LIMITS.sshTimeoutMs, CONFIG_LIMITS.sshTimeoutMs.min)
-                : undefined;
-            const host = {
-                alias: basic.alias,
-                host: basic.host,
-                port: Number.parseInt(basic.port, 10),
-                username: basic.username,
-                authMethod,
-                ...(authMethod === 'password' ? { password: authDraft?.password } : {}),
-                ...(authMethod === 'privateKey' ? { privateKeyPath: authDraft?.privateKeyPath, passphrase: authDraft?.passphrase } : {}),
-                remoteShell,
-                ...(timeoutMs !== undefined ? { timeoutMs } : {}),
-            };
-            if (existing)
-                await updateSshHost(workspaceId, existing.alias, host);
-            else
-                await addSshHost(workspaceId, host);
-            onDone();
-        }, onCancel: onCancel }));
-}

package/src/cli/wizards/sshHostWizard.tsx

@@ -1,214 +0,0 @@
-/**
- * ============================================================
- *  src/cli/wizards/sshHostWizard.tsx —— 新增/编辑一个 SSH 主机
- * ------------------------------------------------------------
- *  三阶段状态机（同 advisorWizard.tsx 的做法）：基础信息 → 认证方式
- *  （分叉：密码 or 私钥）→ 高级选项，最后一步才真正落盘。alias 是主机的
- *  唯一标识，编辑时不可改（同模型 id 的语义），所以编辑模式直接跳过第一
- *  阶段的 alias 字段。
- * ============================================================
- */
-
-import React, { useState } from 'react';
-
-import {
-  addSshHost,
-  updateSshHost,
-  type SshHostConfig,
-} from '../../context/sshHosts.js';
-import { CONFIG_LIMITS, normalizeLimited } from '../../config/numericLimits.js';
-import { FieldForm } from './fieldForm.js';
-
-interface Props {
-  workspaceId: string;
-  existing?: SshHostConfig | null;
-  onDone: () => void;
-  onCancel: () => void;
-}
-
-type Phase = 'basic' | 'auth' | 'auth-password' | 'auth-key' | 'advanced';
-
-interface BasicDraft {
-  alias: string;
-  host: string;
-  port: string;
-  username: string;
-}
-
-function parsePort(value: unknown, fallback: number): number {
-  const parsed = Number.parseInt(String(value ?? ''), 10);
-  return Number.isFinite(parsed) ? parsed : fallback;
-}
-
-export function SshHostWizard({ workspaceId, existing, onDone, onCancel }: Props): JSX.Element {
-  const [phase, setPhase] = useState<Phase>('basic');
-  const [basic, setBasic] = useState<BasicDraft | null>(
-    existing
-      ? { alias: existing.alias, host: existing.host, port: String(existing.port), username: existing.username }
-      : null,
-  );
-  const [authMethod, setAuthMethod] = useState<'password' | 'privateKey'>(existing?.authMethod ?? 'password');
-  const [authDraft, setAuthDraft] = useState<{ password?: string; privateKeyPath?: string; passphrase?: string } | null>(
-    existing
-      ? { password: existing.password, privateKeyPath: existing.privateKeyPath, passphrase: existing.passphrase }
-      : null,
-  );
-
-  if (phase === 'basic') {
-    return (
-      <FieldForm
-        title={existing ? `编辑 SSH 主机 "${existing.alias}"` : '新增 SSH 主机'}
-        fields={[
-          ...(existing ? [] : [{
-            key: 'alias', label: '别名（模型/工具用它引用主机，不含空格）', type: 'text' as const, default: '',
-            hint: '例如 jetson、prod-server；只能是字母数字与 . _ -',
-          }]),
-          { key: 'host', label: '主机地址（IP 或域名）', type: 'text' as const, default: existing?.host ?? '' },
-          { key: 'port', label: '端口', type: 'text' as const, default: String(existing?.port ?? 22), optional: true },
-          { key: 'username', label: '用户名', type: 'text' as const, default: existing?.username ?? '' },
-        ]}
-        onSubmit={async (values) => {
-          const alias = existing?.alias ?? String(values.alias ?? '').trim();
-          const host = String(values.host ?? '').trim();
-          const username = String(values.username ?? '').trim();
-          if (!alias) throw new Error('别名不能为空');
-          if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(alias)) throw new Error('别名格式不合法（只能是字母数字与 . _ -）');
-          if (!host) throw new Error('主机地址不能为空');
-          if (!username) throw new Error('用户名不能为空');
-          setBasic({
-            alias,
-            host,
-            port: String(normalizeLimited(parsePort(values.port, 22), CONFIG_LIMITS.sshPort, 22)),
-            username,
-          });
-          setPhase('auth');
-        }}
-        onCancel={onCancel}
-      />
-    );
-  }
-
-  if (phase === 'auth') {
-    return (
-      <FieldForm
-        title="认证方式"
-        fields={[
-          {
-            key: 'authMethod',
-            label: '认证方式',
-            type: 'select',
-            options: ['password', 'privateKey'],
-            default: authMethod,
-            hint: 'password=密码认证（部分设备如 Jetson 只支持这种）· privateKey=私钥认证',
-          },
-        ]}
-        onSubmit={async (values) => {
-          const method = values.authMethod === 'privateKey' ? 'privateKey' : 'password';
-          setAuthMethod(method);
-          setPhase(method === 'password' ? 'auth-password' : 'auth-key');
-        }}
-        onCancel={onCancel}
-      />
-    );
-  }
-
-  if (phase === 'auth-password') {
-    // 只有「编辑且此前也是密码认证」才允许留空沿用旧值——从私钥切到密码认证时
-    // 旧密码根本不存在，必须强制录入，否则会存出一条没有真实凭据的主机记录。
-    const canKeepExisting = Boolean(existing && existing.authMethod === 'password');
-    return (
-      <FieldForm
-        title="密码认证"
-        fields={[{
-          key: 'password', label: '密码', type: 'password',
-          default: authDraft?.password ?? '',
-          optional: canKeepExisting,
-          hint: canKeepExisting ? '留空 = 保持现有密码不变' : undefined,
-        }]}
-        onSubmit={async (values) => {
-          const password = String(values.password ?? '').trim();
-          if (!password && !canKeepExisting) throw new Error('密码不能为空');
-          setAuthDraft({ password: password || existing?.password, privateKeyPath: undefined, passphrase: undefined });
-          setPhase('advanced');
-        }}
-        onCancel={onCancel}
-      />
-    );
-  }
-
-  if (phase === 'auth-key') {
-    // 同上：只有此前也是私钥认证才允许留空沿用旧路径。
-    const canKeepExisting = Boolean(existing && existing.authMethod === 'privateKey');
-    return (
-      <FieldForm
-        title="私钥认证"
-        fields={[
-          {
-            key: 'privateKeyPath', label: '私钥文件路径', type: 'text',
-            default: authDraft?.privateKeyPath ?? '', optional: canKeepExisting,
-            hint: canKeepExisting ? '留空 = 保持现有私钥路径不变' : '本机绝对路径，例如 C:\\Users\\you\\.ssh\\id_ed25519',
-          },
-          {
-            key: 'passphrase', label: '私钥密码（没有则留空）', type: 'password',
-            default: authDraft?.passphrase ?? '', optional: true,
-          },
-        ]}
-        onSubmit={async (values) => {
-          const privateKeyPath = String(values.privateKeyPath ?? '').trim();
-          if (!privateKeyPath && !canKeepExisting) throw new Error('私钥文件路径不能为空');
-          setAuthDraft({
-            password: undefined,
-            privateKeyPath: privateKeyPath || existing?.privateKeyPath,
-            passphrase: String(values.passphrase ?? '').trim() || undefined,
-          });
-          setPhase('advanced');
-        }}
-        onCancel={onCancel}
-      />
-    );
-  }
-
-  // phase === 'advanced'
-  return (
-    <FieldForm
-      title="高级选项"
-      fields={[
-        {
-          key: 'remoteShell', label: '远程 shell 类型', type: 'select',
-          options: ['bash', 'cmd', 'powershell'],
-          default: existing?.remoteShell ?? 'bash',
-          hint: '用于危险命令拦截判断（如 rm/del），必须与主机实际 shell 一致；Linux/树莓派/Jetson 选 bash',
-        },
-        {
-          key: 'timeoutMs', label: '默认操作超时（秒，留空用工具默认值）', type: 'text',
-          default: existing?.timeoutMs ? String(Math.round(existing.timeoutMs / 1000)) : '', optional: true,
-        },
-      ]}
-      onSubmit={async (values) => {
-        if (!basic) throw new Error('缺少基础信息'); // 状态机不应该走到这一步却没有 basic
-        const remoteShell = (values.remoteShell === 'cmd' || values.remoteShell === 'powershell')
-          ? values.remoteShell
-          : 'bash';
-        const timeoutSeconds = String(values.timeoutMs ?? '').trim();
-        const timeoutMs = timeoutSeconds
-          ? normalizeLimited(Number.parseInt(timeoutSeconds, 10) * 1000, CONFIG_LIMITS.sshTimeoutMs, CONFIG_LIMITS.sshTimeoutMs.min)
-          : undefined;
-        const host: SshHostConfig = {
-          alias: basic.alias,
-          host: basic.host,
-          port: Number.parseInt(basic.port, 10),
-          username: basic.username,
-          authMethod,
-          ...(authMethod === 'password' ? { password: authDraft?.password } : {}),
-          ...(authMethod === 'privateKey' ? { privateKeyPath: authDraft?.privateKeyPath, passphrase: authDraft?.passphrase } : {}),
-          remoteShell,
-          ...(timeoutMs !== undefined ? { timeoutMs } : {}),
-        };
-        if (existing) await updateSshHost(workspaceId, existing.alias, host);
-        else await addSshHost(workspaceId, host);
-        onDone();
-      }}
-      onCancel={onCancel}
-    />
-  );
-}

package/src/context/sshHosts.js

@@ -1,290 +0,0 @@
-/**
- * ============================================================
- *  src/context/sshHosts.ts —— 工作区级 SSH 主机配置存储
- * ------------------------------------------------------------
- *  每个工作区（workspaceId，见 workspaceIndex.ts）独立一份 SSH 主机列表，
- *  **不进全局 config.json**——绿色版的 config.json 是卖家预置件（U 盘出厂
- *  即预配置好 API），不能承载终端用户自己录入的远程主机凭据（尤其是明文
- *  密码：Jetson 类设备常常只支持密码认证，见 SshHostConfig.authMethod）。
- *
- *  落盘路径：agentStateDir()/workspaces/<workspaceId>/ssh-hosts.json
- *  锁 + 原子写模式镜像 configFile.ts::acquireConfigLock（mkdir 锁目录 +
- *  owner.json + 陈旧锁检测），但这是独立文件独立锁，不与全局 config 锁
- *  互相阻塞。
- *
- *  workspaceId 缺失（临时/e2e/cron 工作目录，见 workspaceIndex.ts 的
- *  isTemporaryWorkspace）时，本模块的调用方（SSH/SSHUpload/SSHDownload
- *  三个工具）必须 fail-closed 报错，不得静默回落到某个共享位置——这与
- *  memoryAccess 默认 denied 是同一个哲学：没有工作区身份就没有可信的
- *  隔离边界。
- * ============================================================
- */
-import { randomUUID } from 'node:crypto';
-import { chmod, mkdir, readFile, rename, rm, stat, unlink, writeFile } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
-import { agentStateDir } from './agentHome.js';
-import { CONFIG_LIMITS, withinLimit } from '../config/numericLimits.js';
-const EMPTY_DATA = { hosts: [], defaultHostAlias: null };
-const LOCK_STALE_MS = 120_000;
-const LOCK_WAIT_MS = 15_000;
-const ALIAS_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/;
-/** 标准 SSH 端口——唯一真值，向导默认值与 normalizeHost() 的兜底都从这里取。 */
-export const DEFAULT_SSH_PORT = 22;
-export function sshHostsFilePath(workspaceId) {
-    return join(agentStateDir(), 'workspaces', workspaceId, 'ssh-hosts.json');
-}
-function processIsAlive(pid) {
-    if (!Number.isInteger(pid) || pid <= 0)
-        return false;
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        return error.code === 'EPERM';
-    }
-}
-async function acquireLock(file) {
-    const lockDir = `${file}.lock`;
-    const ownerFile = join(lockDir, 'owner.json');
-    const startedAt = Date.now();
-    await mkdir(dirname(file), { recursive: true, mode: 0o700 });
-    while (true) {
-        try {
-            await mkdir(lockDir, { mode: 0o700 });
-            await writeFile(ownerFile, JSON.stringify({ pid: process.pid, createdAt: Date.now() }), { mode: 0o600 });
-            return async () => { await rm(lockDir, { recursive: true, force: true }); };
-        }
-        catch (error) {
-            if (error.code !== 'EEXIST')
-                throw error;
-            let stale = false;
-            try {
-                const [ownerRaw, info] = await Promise.all([readFile(ownerFile, 'utf8'), stat(lockDir)]);
-                const owner = JSON.parse(ownerRaw);
-                stale = typeof owner.pid === 'number' ? !processIsAlive(owner.pid) : Date.now() - info.mtimeMs > LOCK_STALE_MS;
-            }
-            catch {
-                try {
-                    stale = Date.now() - (await stat(lockDir)).mtimeMs > LOCK_STALE_MS;
-                }
-                catch {
-                    stale = false;
-                }
-            }
-            if (stale) {
-                await rm(lockDir, { recursive: true, force: true });
-                continue;
-            }
-            if (Date.now() - startedAt > LOCK_WAIT_MS)
-                throw new Error('等待 SSH 主机配置锁超时');
-            await new Promise((resolveWait) => setTimeout(resolveWait, 40));
-        }
-    }
-}
-function normalizeHost(raw) {
-    if (!raw || typeof raw !== 'object')
-        return null;
-    const value = raw;
-    if (typeof value.alias !== 'string' || !ALIAS_RE.test(value.alias))
-        return null;
-    if (typeof value.host !== 'string' || !value.host.trim())
-        return null;
-    if (typeof value.username !== 'string' || !value.username.trim())
-        return null;
-    if (value.authMethod !== 'password' && value.authMethod !== 'privateKey')
-        return null;
-    if (value.remoteShell !== 'bash' && value.remoteShell !== 'cmd' && value.remoteShell !== 'powershell')
-        return null;
-    const port = typeof value.port === 'number' ? value.port : DEFAULT_SSH_PORT;
-    if (!withinLimit(port, CONFIG_LIMITS.sshPort))
-        return null;
-    const timeoutMs = typeof value.timeoutMs === 'number' ? value.timeoutMs : undefined;
-    if (timeoutMs !== undefined && !withinLimit(timeoutMs, CONFIG_LIMITS.sshTimeoutMs))
-        return null;
-    return {
-        alias: value.alias,
-        host: value.host,
-        port,
-        username: value.username,
-        authMethod: value.authMethod,
-        ...(typeof value.password === 'string' ? { password: value.password } : {}),
-        ...(typeof value.privateKeyPath === 'string' ? { privateKeyPath: value.privateKeyPath } : {}),
-        ...(typeof value.passphrase === 'string' ? { passphrase: value.passphrase } : {}),
-        remoteShell: value.remoteShell,
-        ...(timeoutMs !== undefined ? { timeoutMs } : {}),
-    };
-}
-function normalizeFile(parsed) {
-    if (!parsed || typeof parsed !== 'object')
-        return null;
-    const raw = parsed;
-    if (raw.version !== 1 || !Array.isArray(raw.hosts))
-        return null;
-    const hosts = raw.hosts.flatMap((item) => {
-        const host = normalizeHost(item);
-        return host ? [host] : [];
-    });
-    const defaultHostAlias = typeof raw.defaultHostAlias === 'string' && hosts.some((h) => h.alias === raw.defaultHostAlias)
-        ? raw.defaultHostAlias
-        : null;
-    return { hosts, defaultHostAlias };
-}
-/** 读路径 fail-open：坏文件被隔离到旁路而不是让整个工作区永远读不出主机列表。 */
-async function quarantineCorruptFile(file, reason) {
-    const target = `${file}.corrupt-${Date.now()}`;
-    try {
-        await rename(file, target);
-        await writeFile(`${target}.reason.txt`, reason, { mode: 0o600 });
-    }
-    catch { /* 文件在读和隔离之间消失也无妨，视同不存在 */ }
-}
-async function readUnlocked(workspaceId) {
-    const file = sshHostsFilePath(workspaceId);
-    let raw;
-    try {
-        raw = await readFile(file, 'utf8');
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return EMPTY_DATA;
-        throw error;
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch (error) {
-        await quarantineCorruptFile(file, `JSON 解析失败：${error instanceof Error ? error.message : String(error)}`);
-        return EMPTY_DATA;
-    }
-    const normalized = normalizeFile(parsed);
-    if (!normalized) {
-        await quarantineCorruptFile(file, 'SSH 主机配置文件结构不合法');
-        return EMPTY_DATA;
-    }
-    return normalized;
-}
-async function writeUnlocked(workspaceId, data) {
-    const file = sshHostsFilePath(workspaceId);
-    const payload = { version: 1, hosts: data.hosts, defaultHostAlias: data.defaultHostAlias };
-    const tmp = `${file}.${process.pid}.${randomUUID()}.tmp`;
-    try {
-        await mkdir(dirname(file), { recursive: true, mode: 0o700 });
-        await writeFile(tmp, JSON.stringify(payload, null, 2), { encoding: 'utf8', mode: 0o600 });
-        await rename(tmp, file);
-        await chmod(file, 0o600).catch(() => { });
-    }
-    finally {
-        await unlink(tmp).catch(() => { });
-    }
-}
-/** 写入前的形状校验——别名唯一、必填字段非空、数字边界，defaultHostAlias 必须指向存在的主机或为 null。 */
-function assertValid(data) {
-    const seen = new Set();
-    for (const host of data.hosts) {
-        if (!ALIAS_RE.test(host.alias))
-            throw new Error(`主机别名不合法：${host.alias}`);
-        if (seen.has(host.alias))
-            throw new Error(`主机别名重复：${host.alias}`);
-        seen.add(host.alias);
-        if (!host.host.trim())
-            throw new Error(`主机地址不能为空（alias=${host.alias}）`);
-        if (!host.username.trim())
-            throw new Error(`用户名不能为空（alias=${host.alias}）`);
-        if (!withinLimit(host.port, CONFIG_LIMITS.sshPort))
-            throw new Error(`端口超出范围（alias=${host.alias}）`);
-        if (host.timeoutMs !== undefined && !withinLimit(host.timeoutMs, CONFIG_LIMITS.sshTimeoutMs)) {
-            throw new Error(`超时时间超出范围（alias=${host.alias}）`);
-        }
-        if (host.authMethod === 'password' && !host.password)
-            throw new Error(`密码认证缺少密码（alias=${host.alias}）`);
-        if (host.authMethod === 'privateKey' && !host.privateKeyPath)
-            throw new Error(`密钥认证缺少私钥路径（alias=${host.alias}）`);
-    }
-    if (data.defaultHostAlias !== null && !seen.has(data.defaultHostAlias)) {
-        throw new Error(`默认主机 "${data.defaultHostAlias}" 不在主机列表中`);
-    }
-}
-/** 读-改-写的唯一入口：整个过程持锁，避免并发编辑丢更新。 */
-async function mutate(workspaceId, mutator) {
-    const file = sshHostsFilePath(workspaceId);
-    const release = await acquireLock(file);
-    try {
-        const current = await readUnlocked(workspaceId);
-        const next = mutator(current);
-        assertValid(next);
-        await writeUnlocked(workspaceId, next);
-        return next;
-    }
-    finally {
-        await release();
-    }
-}
-export async function listSshHosts(workspaceId) {
-    return readUnlocked(workspaceId);
-}
-export async function addSshHost(workspaceId, host) {
-    return mutate(workspaceId, (current) => {
-        if (current.hosts.some((h) => h.alias === host.alias))
-            throw new Error(`主机别名已存在：${host.alias}`);
-        const hosts = [...current.hosts, host];
-        return { hosts, defaultHostAlias: current.defaultHostAlias ?? (hosts.length === 1 ? host.alias : null) };
-    });
-}
-export async function updateSshHost(workspaceId, alias, patch) {
-    return mutate(workspaceId, (current) => {
-        const index = current.hosts.findIndex((h) => h.alias === alias);
-        if (index < 0)
-            throw new Error(`主机不存在：${alias}`);
-        const hosts = [...current.hosts];
-        hosts[index] = { ...hosts[index], ...patch };
-        return { hosts, defaultHostAlias: current.defaultHostAlias };
-    });
-}
-export async function removeSshHost(workspaceId, alias) {
-    return mutate(workspaceId, (current) => {
-        const hosts = current.hosts.filter((h) => h.alias !== alias);
-        return {
-            hosts,
-            defaultHostAlias: current.defaultHostAlias === alias ? null : current.defaultHostAlias,
-        };
-    });
-}
-export async function setDefaultSshHost(workspaceId, alias) {
-    return mutate(workspaceId, (current) => ({ ...current, defaultHostAlias: alias }));
-}
-/**
- * 供 SSH/SSHUpload/SSHDownload 三个工具调用的解析入口：
- * 显式给了 alias 就按 alias 找；没给就退回该工作区的默认主机；
- * 两者都没有就明确报错，不静默选第一个（选错主机执行远程命令后果比报错严重）。
- */
-export async function resolveSshHost(workspaceId, aliasInput) {
-    const data = await listSshHosts(workspaceId);
-    if (aliasInput) {
-        const host = data.hosts.find((h) => h.alias === aliasInput);
-        if (!host) {
-            const known = data.hosts.map((h) => h.alias).join(', ') || '（无）';
-            return { ok: false, error: `未找到主机 "${aliasInput}"。已配置：${known}` };
-        }
-        return { ok: true, host };
-    }
-    if (data.defaultHostAlias) {
-        const host = data.hosts.find((h) => h.alias === data.defaultHostAlias);
-        if (host)
-            return { ok: true, host };
-    }
-    if (data.hosts.length === 0) {
-        return { ok: false, error: '当前工作区尚未配置任何 SSH 主机，请先在 /config → 远程主机 (SSH) 中添加。' };
-    }
-    return { ok: false, error: `未指定主机且未设置默认主机。已配置：${data.hosts.map((h) => h.alias).join(', ')}` };
-}
-/** 给工具 description 用的轻量列表——只暴露 alias/host/username，绝不带密码。 */
-export async function describeSshHosts(workspaceId) {
-    const data = await listSshHosts(workspaceId);
-    if (data.hosts.length === 0)
-        return '（当前工作区尚未配置任何 SSH 主机）';
-    return data.hosts
-        .map((h) => `${h.alias}(${h.username}@${h.host}:${h.port})${h.alias === data.defaultHostAlias ? ' [默认]' : ''}`)
-        .join(', ');
-}