winewill
cafb9b93b4
client-modules: a batch that already executed is never requested again, even when its first importer was a row it did register — every executed batch URL is remembered and a still-missing row goes straight to its one-resource URL. The in-process module system test in test-support is updated to the aggregated arrival message. describeError replaces three inline non-Error ternaries and is covered. subprocess-local: the spill path is published only after the exclusive open succeeds, so a failed open (EEXIST on a planted entry included) can no longer unlink a path this process did not create; a reporter that throws is contained and written to stderr; logSpillFailure builds the owner reporter for both the runtime and the SSH helper so the logging path is exercised once instead of duplicated. Tests cover the runtime logger, the bare-caller stderr default, EEXIST, and a throwing reporter. desktop: a fatal failure during shutdown still writes its report; the report phase follows the backend state so a failure during a restart is 'startup' again; writeReport is a required recovery operation and the dialog tests await the write; the shell pid is labelled; the withheld response-header list states why set-cookie is dropped. app-boot, READMEs, Agent Note: "never resumes" is restated as control never returning to the failed operation while the loop runs until release settles; inspect output is bounded; incident inferences (who removed the spill directory, which batch failure occurred) are written as inferences.
description, kind
| description | kind |
|---|---|
| OpenSSH connection configuration and remote helper lifecycle for deployments composing POSIX file, process and sandbox providers. | package-reference |
@deepseek-ai/dsh-ssh
English | 中文
Summary
dsh-ssh connects a POSIX Harness host to an installed helper on a POSIX SSH host. One deployment-owned OpenSSH alias supplies authentication and host identity; the paired filesystem, subprocess and sandbox providers use that connection. The connection verifies installed artifact digests before readiness; the helper owns remote cleanup when the connection closes or its lease expires.
Table of Contents
- Use this package
- Understand the implementation
- Further Exploration
- Model Experience
- Known Limitations and Deferred Work
- Dev Note
Use this package
Compose this service with fs-ssh, subprocess-ssh and sandbox-ssh in a custom dsh profile. The host runs the Harness, model transport and Session storage; the remote machine supplies the files and processes. Headless profiles support this arrangement.
Deployment prerequisites
Both endpoints require Linux or macOS. The local ssh command must support connection multiplexing and Unix-socket forwarding; the server must permit that forwarding. Configure the alias, credentials and known-host entry before startup: the service enables BatchMode, requires strict host-key checking, disables agent forwarding and adds no interactive authentication flow.
Install the built helper and its matching runtime dependencies on the remote host. Keep Node, helper, bootstrap and their dependencies outside the workspace and writable temporary roots. They must also remain outside a backend’s replaced temporary tree, such as bwrap’s private /tmp; the workspace may still be under /tmp. Digest verification detects an unexpected installed artifact after helper startup; it does not make writable deployment files safe to execute or authenticate a malicious SSH host.
| Field | Default | Meaning |
|---|---|---|
host |
required | Existing OpenSSH host alias |
node, helper, workspace |
required | Absolute remote Node executable, bundled helper entry and default workspace |
helperHash |
required | Lowercase SHA-256 of the installed helper entry |
bootstrapPath, bootstrapHash |
omitted | Paired remote PTC entry and its lowercase SHA-256 |
requestTimeoutMs |
30000 |
Connection and administrative-request deadline, from 1 through 2,147,483,647 ms |
maxFrameBytes |
67108864 |
Per-message JSON payload ceiling, at most 64 MiB |
maxPending |
128 |
Ordinary outstanding requests; heartbeat and bounded cleanup requests have reserved capacity |
leaseMs |
30000 |
Helper heartbeat lease, from 3000 to 600000 ms |
For PTC, configure both bootstrap fields and pass the verified ctx.ssh.nodeExecutable and ctx.ssh.bootstrapPath to NodePtcRuntime. Basic filesystem and Bash use may omit the pair. The bootstrapPath getter refuses an unconfigured PTC deployment.
Understand the implementation
Implementation internals — click to expand
The OpenSSH master carries private administrative RPC. Each program stream uses a separate forwarded Unix socket and an independent SSH channel. Program stdout cannot forge administrative replies or occupy the control stream’s channel window. SSH transport congestion still affects the shared connection.
Each stream reservation has a random 256-bit TLS pre-shared key carried only by administrative RPC. TLS authenticates both endpoints and protects every stream byte; the key is never sent as a stream preface. Socket directories are private (0700) and sockets use 0600. Replacing a writable socket path cannot impersonate an endpoint or reveal the stream key; an attacker can still interrupt service or relay opaque TLS records.
Connection disposal joins forwarding and cancellation subprocesses and partially established streams before removing local resources. Transport loss rejects pending operations and invalidates the connection. The helper starts managed cleanup on SSH EOF, termination signals or heartbeat expiry. A disconnected client cannot confirm the remote outcome; operations are never reconnected or replayed automatically.
Failed startup and process results release their reservations after native quiescence; the bounded completion cache preserves the original rejection for later result reads. Helper shutdown also joins endpoint and directory cleanup already in progress.
For terminals opting into shell activity observation, root exit retains the reservation and its remaining work. Activity RPC continues to reach the provider; explicit termination awaits quiescence before releasing endpoints and recording the completed result. Helper connection disposal and lease expiry retain their existing termination authority.
The helper starts with --disable-sigusr1, so a same-user process signal cannot open its Node debugger.
Further Exploration
- SSH subsystem — execution coordinates, transport semantics and lifecycle ownership.
- POSIX SSH decision — rationale, alternatives and required verification.
Model Experience
None, as host aliases, authentication and stream capabilities are private deployment details and consumers own every model-visible operation.
KV Cache effect
This provider contributes no request-prefix content. Its consumers own model-visible tools and results.
Known Limitations and Deferred Work
- No Windows endpoint, automatic provisioning, reconnect or replay is supplied.
- Web workspace UI paths still assume host filesystem access; use headless or a custom composition whose consumers honor provider paths.
- TLS stream keys do not protect against remote OS process-memory inspection or debugging. File-effect policy retains the selected sandbox backend’s limits.
Dev Note
Working context for maintainers — click to expand
No invariant companion is published. Wire validation and the owning filesystem, subprocess and sandbox providers enforce the observable obligations; this adapter adds no independently observed state relation.