dsh-hoploom 0.2.2 — Trusted Publishing

dsh-hoploom is now published from GitHub Actions through npm Trusted Publishing (OIDC), with automatic provenance and no stored npm token.

The package contents are the same as 0.2.1: Hoploom opens in dsh's right sidebar beside your conversation, and the plugin supports dsh 0.2.1-rc.5 and later 0.2.x releases. Only the version, changelog and READMEs differ. Upgrading from 0.2.1 is optional; on Desktop, uninstall the old plugin and install dsh-hoploom@0.2.2. Host data, vault entries and the managed runtime are kept.

插件改为通过 npm Trusted Publishing 从 GitHub Actions 发布，自动附带 provenance，不再保存 npm token。内容与 0.2.1 相同，可不升级。

dsh-hoploom 0.2.1 — Hoploom beside your conversation

Hoploom now opens beside your conversation instead of replacing it, and the plugin installs on dsh releases after 0.2.1-rc.5.

• Right sidebar. The Hoploom sidebar entry keeps the chat and its draft in view and opens Hoploom in dsh's right sidebar. The sidebar's start page lists Hoploom next to files and terminals. Use the panel's fullscreen control for more room.
• Stays loaded. Collapsing the panel, or switching tabs or Sessions, no longer reloads the embedded UI, so transfers and page state continue. The embedded UI now includes Hoploom's Transfers dock.
• dsh 0.2.x. 0.2.0 accepted only dsh 0.2.1-rc.5, so dsh 0.2.2 refuses to install it and skips an installed copy at startup. 0.2.1 supports >=0.2.1-rc.5 <0.3.0-0 and is verified on dsh 0.2.1-rc.5 and 0.2.2-rc.1: type checks, the plugin suite, and a packed install that prepares its runtime and docks beside the conversation.
• Agent access is unchanged: six local metadata tools by default, with remote checks and allowlisted commands still behind explicit settings.

Install dsh-hoploom@0.2.1 from npm (Plugins → Add plugin, enter dsh-hoploom) or use the attached tarball. On Desktop, upgrade by uninstalling the old plugin and installing the new one; host data, vault entries and the managed runtime are kept, and the bundled backend is reinstalled automatically.

Hoploom 现在在对话旁的右侧栏打开，不再替换聊天窗口；收起面板或切换标签不会重新加载。0.2.1 支持 dsh 0.2.1-rc.5 及之后的 0.2.x 版本（0.2.0 会被 dsh 0.2.2 拒绝安装）。桌面版请先卸载旧插件再安装新版，主机数据和保险库会保留。

dsh-hoploom 0.2.0 — Hoploom UI inside dsh

Hoploom now runs directly inside DeepSeek Harness. Click the Hoploom sidebar icon to use the existing host, credential, file, port, tag, skill and audit interfaces without opening an external browser.

• No separate Hoploom or Python installation is required. The plugin prepares its bundled backend and private runtime, with progress, retry, cancellation and offline reuse.
• Existing MCP installations remain usable. The embedded UI shares their configured inventory and OS vault, while retaining per-view sessions, CSRF and credential-reveal checks.
• Agent access still defaults to six local metadata tools. Remote checks and allowlisted commands require explicit settings; hoploom_setup provides recovery during setup.
• Verified on macOS, Linux and Windows, including real MCP registration, fresh managed installation, offline reuse, embedded sessions and streaming cancellation. The original frontend also passes its tests and build checks.

Install dsh-hoploom@0.2.0 from npm or use the attached tarball with dsh 0.2.1-rc.5. When upgrading from 0.1.x, finish active tasks and fully restart dsh after installation: this dsh version caches the old plugin's lack of a UI entry until its backend exits.

首次使用无需提前安装 Hoploom 或 Python。点击侧边栏 Hoploom，即可在 dsh 内直接使用原有完整界面。首次准备需要联网；从 0.1.x 升级后请在任务结束后完整重启 dsh。

dsh-hoploom 0.1.1

Fix desktop activation when the Hoploom backend is missing from PATH or an old serverctl installation lacks MCP support.

• Discover the default backend in standard local installation directories while preserving explicit command settings.
• Check mcp serve --help before connecting and provide installation, upgrade and absolute-path recovery instructions. The check scrubs ambient credentials and does not access inventory, vault or SSH.
• Add regression coverage for restricted desktop PATH, paths with spaces, Windows launchers, outdated backends and cancelled startup.

Install from npm:

dsh plugin --profile web add dsh-hoploom@0.1.1

Update an existing installation with dsh plugin --profile web update dsh-hoploom@0.1.1. For the desktop profile, fully quit the desktop app before using the CLI. Hoploom must be installed separately; verify hoploom mcp serve --help, and re-enable the component after repairing its backend.

Validated on macOS, Linux and Windows, plus installation of the packed plugin into a disposable DSH_HOME using the default command, six tools and an isolated inventory query.

Package on npm · Installation and troubleshooting · CI results

dsh-hoploom 0.1.0

Hoploom's first plugin for DeepSeek Harness, compatible with dsh 0.2.1-rc.5.

What it provides

• Six local metadata tools: hosts, ProxyJump routes, saved working directories, host-bound skills, tunnel profiles and runtime capabilities.
• Optional host checks and allowlisted argv command execution, configured in the plugin settings.
• Target-first agent instructions. Saved credentials remain in Hoploom's OS vault; the plugin has no credential-reveal tool.
• English/Chinese installation guides and plugin metadata.

Install this release

Install the local Hoploom backend, then install from npm:

dsh plugin --profile web add dsh-hoploom

Published as dsh-hoploom@0.1.0. Use tui instead of web for terminal sessions. The backend and plugin run on the machine hosting dsh, under the same OS account. Remote checks and execution are off by default.

The attached .tgz is the same artifact published to npm. It can also be installed using dsh plugin --profile web add /absolute/path/dsh-hoploom-0.1.0.tgz.

Verification

• 7 plugin tests passed on Linux, macOS and Windows in CI.
• The packed artifact installed and activated in an isolated real dsh process; all six metadata tools were discovered and an inventory query succeeded.
• Public npm package-name installation into a fresh dsh profile passed; real tool activation and an isolated inventory query succeeded. npm artifact integrity matches the attached release tarball.
• Local Python regression suite: 838 passed, 2 skipped.
• SHA-256 checksum attached. This independent plugin release does not publish or change the Python package version.

中文安装说明 · Architecture and maintainer guide

这是 Hoploom 的首个 dsh 插件版本。默认只查询本地主机与上下文；远程检查、白名单命令需显式开启。已发布到 npm，安装 Hoploom 后运行 dsh plugin --profile web add dsh-hoploom 即可。本页 .tgz 与 npm 发布包一致。

0.10.1

No runtime change. The installed package behaves exactly as 0.10.0. This
patch corrects the checks and the source distribution that ship beside it —
someone building from the 0.10.0 sdist got an upgrade check that could no longer
pass.

Fixed

• The upgrade smoke check had stopped guarding anything. It pinned the
  candidate schema to 7, but the tunnels table had moved the database to schema
  8, so it asserted the candidate "does not support schema 7" and failed on every
  platform the moment the schema changed. With the constant corrected, a real
  published 0.8.0 database (schema 5) migrates to this version with every host,
  credential, tag, note, saved path, Skill binding and authentication setting
  preserved, and repeated startup leaves the file unchanged. The sdist now ships
  the check in its working form.
• The suite is portable again. The mosh session tests drove a real session on
  Windows, where mosh is refused by design; they now carry the same platform
  guard the feature uses. The recursive-transfer tests put a #!/bin/sh shim on
  PATH to stand in for sftp, which Windows cannot execute, so that module
  skips there and names where the same code is still covered without a shim
  (test_runner.py builds the SFTP command streams, test_file_backend.py
  covers the batch semantics, test_modern_fixture.py covers them end to end).
• The GeoIP index-rebuild test is deterministic. It rewrote the range file
  from DE to FR — the same byte length — and relied on the clock advancing
  between two writes, which a coarse-timestamp filesystem or a CI runner writing
  both within one tick defeats. It now sets a newer mtime explicitly.

Full detail: CHANGELOG.md under 0.10.1.

0.10.0

A minor release: new commands and surfaces, not only fixes.

Ports and Audit in the Web UI

Two surfaces that previously only existed on the command line now have a
browser view, deliberately read-only — a reload can never start, stop or
rewrite anything. GET /api/v1/tunnels joins saved forwarding profiles with
this machine's process table, so the State column means something: Running
carries the pid and uptime the server actually read, Saved means nothing holds
the port, and Orphaned marks a process whose profile was deleted (the row
still shows the forward it holds). GET /api/v1/audit serves the local log
newest-first; a reveal appears as a credential label and slot, and its type has
no value field at all. The two pages are lazy chunks costing 2.2 and 2.6 KiB
gzip.

Port forwards

serverctl tunnel add|list|open|close. A forward is a saved profile plus the
process running it; liveness comes from reading the process table natively
(/proc, sysctl, Win32) rather than shelling out to ps, with its own pid,
uptime and orphan detection.

A local audit log

Privileged actions (exec, reveals and refusals, connects, tunnels) append to a
mode-600 JSONL log that rotates at 5 MiB. Credentials inside a recorded command
are masked before the line is written, and there is no code path that records a
secret value.

MCP for agents that cannot read a Skill

serverctl mcp serve speaks MCP over stdio; --http adds a loopback listener
for clients that cannot spawn a process. The HTTP transport requires a per-launch
bearer token, refuses browser origins outright, serves only POST /mcp, and
shares the stdio allowlist. Verified against the official MCP Python SDK, which
completes initialize (protocol 2025-06-18), tools/list, and tools/call.

Moving inventories around

serverctl export / import produce a deterministic JSON document of host
profiles, saved directories and forwarding profiles — secrets, credential ids
and everything observed remotely are left behind. Import previews by default,
merges rather than replaces, and refuses future formats.

Also in this release

mosh as an opt-in transport, opt-in session transcripts (--log), local GeoIP
lookup, recursive put --recursive, audit-log rotation, a single round trip for
remote directory browsing, an MCP server, Homebrew packaging preparation, and a
doctor that now reports whether forwards can be tracked and a log kept here.

Bug fixes include first-use host-key confirmation for interactive connect,
SSH config Include handling on native Windows and Git/MSYS OpenSSH, and
refusing a host database or managed config this app cannot write instead of
failing later.

Full detail: see CHANGELOG.md under 0.10.0.

SSH Server Manager 0.9.0

SSH Server Manager 0.9.0 replaces the Web UI with a six-page React/TypeScript application. The CLI and installed Skill continue to run without Node.js.

• Hosts: edit and import profiles, inspect cached system/IP/host-key observations and complete routes, save manual locations, manage notes/directories/Skill and credential bindings, and run explicit single or batch connection checks and diagnostics.
• Files: independent host/path tabs, server-side filtering and accurate counts, metadata fallbacks, safe uploads that require explicit overwrite after a conflict, and bounded ordinary-file downloads.
• Tags and Skills: real metadata CRUD, membership/binding management, and explicit local discovery/refresh without executing Skills.
• Credentials: in-memory OpenSSH/PEM key validation, scoped local browsing, explicit agent inspection, independent selected-credential authentication tests, short single-use secret reveals, and atomic detach/delete with recoverable cleanup.
• Runtime and packaging: API v1 types and CSRF/session handling, fingerprinted local assets, actual session expiry and vault status, and schema 7 migration while preserving existing CLI and legacy HTTP routes.

Release commit 544f74a59c4ca7835c564260f3919efce1274036 passes branch, PR, main and tag validation: all 28 jobs pass. macOS, Linux and Windows cover Python 3.10/3.13, with 431 backend cases (Windows: 430 passed, one privilege-dependent skip), 45 frontend tests and 17 browser cases. The eight Windows tasks additionally pass 320 fresh authentication cases without retries. Wheel/sdist installation outside the checkout and populated official 0.8.0 database upgrades pass on all three platforms. Bundled assets match source and stay within the initial 150 KiB / total 250 KiB gzip budgets. The documentation site deployment and public desktop/mobile checks also pass.

PyPI Trusted Publishing succeeds for this exact commit. Official PyPI 0.9.0 downloads match that workflow's distribution artifact, and their source and UI assets match the tag. Post-publication isolated wheel/sdist CLI/Web installation, resources, status/stop cleanup and published 0.8.0 to official 0.9.0 upgrade checks all pass. GitHub Release attachments and PyPI archives are separate builds of the same source, so their archive hashes differ.

Changelog

Upgrade with python -m pip install --upgrade ssh-server-manager==0.9.0. Stop an existing Web process first and back up the database before upgrade. Returning to 0.8.0 requires restoring the pre-upgrade database backup; existing OS-vault secrets are never replaced with file storage.

Installation and upgrade guide · Web UI guide · Validation guide

Automatic GeoIP and a desktop shell are reserved for a later release.

v0.8.0

Added

• serverctl ui --credential ALIAS deep-links first-time credential entry:
  the browser opens directly on that server's edit dialog with the
  new-credential form expanded and the password field focused, instead of
  landing on the dashboard. The target travels in the URL fragment, which
  browsers never send to the server; the one-time token flow is unchanged.
• serverctl server add --password-credential LABEL creates a password
  credential through the hidden local prompt and attaches it in one command.
  Without a TTY it fails fast and points to the UI path, so agent tool calls
  get a clear error instead of a hanging getpass.
• SKILL.md gained a "When the user wants to add a server" playbook: agents
  now drive onboarding proactively — collect non-secret fields in chat,
  create the profile, route password entry through
  serverctl ui --credential ALIAS (or hand terminal commands to the user),
  and finish with server test — instead of leaving users to discover the
  commands.

Changed

• Agent-driven installation now treats serverctl doctor as a local health
  checkpoint rather than the end of onboarding. After a healthy install,
  agents are instructed to read the managed host inventory, summarize the
  actual aliases, give a few natural-language examples of what the user can
  ask next, and explain that saved SSH secrets stay in the local OS vault.
• SKILL.md, docs/ai-agents.md, both one-line installers, and the CLI/command
  references now explicitly avoid first-run CLI tutorials and diagnostic dumps
  by default. They also distinguish local readiness from an untested remote
  login and forbid adding remote tests merely to make onboarding look complete.
• Duplicate-name errors now name the way out: server add with an existing
  alias answers with the matching serverctl server edit command, and a
  taken credential label points to credential edit (failing before the
  hidden password prompt, so correcting a typo no longer means typing the
  secret twice for nothing). The add/add-* help texts say the same up
  front, and the FAQ gained the two most-hit confusion entries, so the
  edit path is discoverable before the error ever happens.
• The UI's default accent is now teal instead of indigo — a deliberate
  brand choice rather than the statistical default of generated interfaces.
  Indigo remains available as an accent option (now backed by explicit
  themes.css blocks for every color theme), and existing users keep the
  accent already stored in their browser. The landing page makes the same
  choice: teal accents, flat primary buttons without the glow halo, solid
  headline color instead of gradient text, and the embedded product demo
  now defaults to the accent the product actually ships.
• Border radii and spacing moved from ~90 ad-hoc literals onto design-token
  scales (--radius-sm/md/lg/xl, --space-1..7), consolidating eleven
  radius values and the odd one-off spacings into coherent steps; the
  lazily loaded contexts/skills/workspace/notes/diagnostics modules then
  moved onto the same scales (~190 more declarations). The raw
  asset budget grew ~2.6% for the longer var() names; the gzipped wire
  size grew only ~0.4%. Rationale is recorded in
  docs/ui-ux-research.md ("Design tokens").
• The font stack no longer names Inter, which was never bundled — the UI
  renders with the system sans font it was already using in practice.

Fixed

• The generated docs pages' footer showed a hand-maintained version that had
  gone stale (v0.6.0 under a 0.7.0 product); website/build.py now
  derives it from the package, and a test pins the two together.
• The landing page's agent install prompt stopped at "installed and checked",
  leaving first-time users with an empty inventory and no next step. The
  prompt (both languages) now asks the agent to walk the user through first
  use — previewing what their ~/.ssh/config could import or guiding a
  first server with proper credential routing — and docs/ai-agents.md's
  no-managed-hosts branch spells out that procedure instead of a vague
  "offer to import".
• "Save server" silently did nothing when adding a server with an
  existing credential (or OpenSSH default): the inline credential composer's
  password/key inputs kept required while hidden, and an invisible required
  control blocks form submission with no visible feedback. required now
  follows composer visibility. This was the real wall behind "adding a server
  is hard" for anyone not creating a credential inline.
• The alias pattern attribute never validated anything in current Chrome:
  since M136 Chrome compiles pattern with the RegExp v flag, under which
  a bare class hyphen is a syntax error that also aborts interactive
  validation. The hyphen is now escaped.

v0.7.0 — Remote file management

Added

• Per-host saved working directories. serverctl path list|add|edit|remove
  records where you actually work on a host, and the Host Workspace shows them
  as chips ordered by recent use, with one click to save the directory you are
  in. A directory belongs to one host, and removing the host removes its own.
• serverctl path resolve ALIAS [ALIAS ...] --json for agents: one read, no
  connection, and identical paths across hosts collapse into a single entry
  listing every host that has them — so "where does this fleet keep its
  application" is answered before anything is browsed or transferred.
• File transfer: serverctl cp, get, and put move one file over the same
  SFTP path and vault credentials as every other command. Previously the only
  documented option was raw scp/rsync, which cannot see the vault and
  prompts for a password the tool already holds.
• The web UI browses read-only as before and now offers explicit per-file
  download and upload-into-this-directory actions.
• serverctl mount ALIAS[:REMOTE] [MOUNTPOINT], --list, and
  serverctl unmount expose a remote directory locally through sshfs, reusing
  the managed config and credential boundary. serverctl doctor gained a
  mount row that names the missing component — macFUSE, libfuse, or
  SSHFS-Win — because sshfs installed without its FUSE layer looks installed
  and fails every mount.
• New docs/mounting.md, including when not to mount: a mount makes remote
  latency look local, so repo-wide searches and builds belong in
  serverctl exec.

Security

• The web file browser is no longer read-only, and the four documents that
  promised it were rewritten rather than left to drift. Browsing still returns
  metadata only. Transfer is a separate, explicit action: CSRF-protected POST
  routes (download included, since a link cannot carry the CSRF header), capped
  at 100 MB, staged inside the 0700 runtime directory and cleared when the
  request ends. Credential handling is unchanged — a transfer cannot reach a
  secret that a listing could not.
• Transfers validate the remote path before any process spawns, and treat both
  of sftp's silent failures as errors: a diagnostic on stderr alongside exit
  code 0, and a download that "succeeds" without writing the destination.

Changed

• UI colour tokens renamed for purpose rather than appearance: the generic
  --tint-soft, --tint-line, --tint-text, and --sidebar-soft are replaced
  by --sidebar-hover, --sidebar-active, --sidebar-line, --sidebar-input,
  --sidebar-input-line, and --terminal-bg / --terminal-text /
  --terminal-line. A token now says where it belongs, so changing the sidebar
  cannot silently repaint the terminal block.
• Runtime color-mix() calls folded into literal colours (23 to 10 in
  styles.css, 4 to 3 in contexts.css), removing per-paint colour computation
  from the busiest surfaces.
• All six accent palettes re-tuned for contrast (66 of 97 colour values in
  themes.css changed; for example teal moves from #0b8277 to #0f766e).
  Token names, theme modes, and every selector are unchanged, so this is a
  visual refresh rather than an API change.
• Database schema 5 adds server_paths. Existing databases upgrade in place;
  all four upgrade paths from schema 1 were verified.
• python-multipart is now a dependency, required for the upload endpoint.

---

Verification note: everything here is covered by CI on macOS, Linux and
Windows except serverctl mount. Mounting needs a FUSE stack (macFUSE,
libfuse, or SSHFS-Win) that CI cannot install, so its tests stop at the command
handed to sshfs and at capability detection. Run serverctl doctor to see
whether your machine can mount before you try.