Turtle
38c7a9fbf4
* feat(release): publish package source, declaration maps, and documentation Every release member publishes its TypeScript source and the declaration maps that resolve into it, and @deepseek-ai/dsh publishes the repository Markdown documentation staged from docs/ at prepack time. The ./src/* export most members already declared now resolves for an installed consumer, and a consumer editor follows a declaration to the implementation. Bundled JavaScript maps stay unpublished; the vendored family and the Desktop runtime file policy are unchanged. Rationale: .agents/notes/implemented/process/2026-10-08-published-source-and-docs.md * feat(release): publish JavaScript maps and compress bundles Every emitted JavaScript map ships beside the bundle it describes, and the workspace build and the client preset compress bundles without mangling identifiers. The documentation payload now mirrors the website publication manifest and is removed again by `postpack`; Desktop and the Python executable exclude the published source, documentation, and maps; `clean` removes a staged copy. Typert's publication contract gains the Remote declaration map. * fix(release): keep node bundles readable for the worker image The browser worker image lowers `yield*` only as a whole statement and rewrites `for await` loops by their source layout, so compressed node-side entries either fail that lowering or lower to unparseable code. Only the browser bundles keep compression, which removes about a third of their text. The bundle-purity assertion now matches the module-loader call regardless of the quote style compression picks, and the release-pack fixture exercises the installed package's new documentation requirement. * feat(release): publish the whole documentation tree `@deepseek-ai/dsh` copies `docs/` in full instead of the website's page set: the maintainer documents, the generated migration records, the translation guidelines, and the `*.i18n.yaml` consistency records ship with the installed package, so the documentation's own links resolve without a checkout. * feat(release): publish the upgrade guides with the documentation The staged documentation keeps the website's page set and adds every `docs/upgrade-guide/` document, which is what an installed reader consults when a released change breaks something. The rest of the maintainer tree stays out. * test(release): expect source and maps in master's new payload cases * feat(release): keep installed docs and source readable in Desktop Desktop keeps the published src/ and docs/ trees inside app.asar, and every model shell call receives DSH_INSTALL_DIR and DSH_NODE_EXECUTABLE so an agent can read them through Electron's Node mode. Staging also generates docs/upgrade-guide/README.md, an index of the upgrade guides grouped by the release they upgrade from. Minified client bundles print string literals with backticks: the worker image packer now recognizes those chunk requests, client license banners are prepended after minification so their text survives, and the affected artifact tests accept either quote. * test(desktop): read archived docs through the Windows PowerShell form Regenerate the config catalog for the shifted shell-env source line. * test(desktop): wait for the GUI-subsystem Electron process from PowerShell * build(release): publish source and maps from the message-quotes package * build(release): publish source and maps from packages new on master * build(release): publish source and maps from the tool-office package
description, kind
| description | kind |
|---|---|
| Build and verify SSH helper executables with an embedded Node runtime for Linux and macOS. | package-library |
@deepseek-ai/dsh-ssh-helper-runtime
English | 中文
Summary
Run the SSH helper on a remote machine without installing Node or npm packages. Each archive includes the executable, its native resources and integrity metadata. The private carrier supports managed processes, terminals, sandboxing and an embedded PTC worker through the existing SSH providers. Project commands still use the remote machine’s own development tools.
Table of Contents
- Use this package
- Understand the implementation
- Further Exploration
- Model Experience
- Known Limitations and Deferred Work
- Dev Note
Use this package
Build and installation
This private workspace produces release archives; it is not a profile plugin or an npm CLI. From a checkout with dependencies installed, build the current native platform:
pnpm exec tsx scripts/build-exe-for-ssh-helper.ts
The builder requires Node 24, a C/C++ compiler and the development headers from that Node installation. Linux additionally needs musl-gcc; its node-pty addon must meet the glibc baseline. The native workflow prepares the compatible addon before packaging. --target selects one native target, --skip-build reuses prepared JS/native outputs, and --dry-run validates the target and dependency declarations without building.
| Target | Native archive | Checked deployment baseline |
|---|---|---|
node24-linux-x64 |
linux-x64 |
glibc 2.28 |
node24-linux-arm64 |
linux-arm64 |
glibc 2.28 |
node24-macos-x64 |
macos-x64 |
macOS 14 deployment target |
node24-macos-arm64 |
macos-arm64 |
macOS 14 deployment target |
Outputs live under dist-exe/ssh-helper/. Each dsh-ssh-helper-<version>-<platform>-<arch>.tar.gz has a companion .sha256 file. The archive contains dsh-ssh-helper, native/system/, licenses and manifest.json; macOS also includes dsh-ssh-helper-spawn-helper. The manifest records the source commit, whether the source tree was dirty, embedded Node version, protocol and every payload file’s digest and permissions.
Verify the archive checksum, then extract the whole directory into a versioned runtime location outside the project and replaced temporary mounts. Keep the native resources beside the executable. The installation can be read-only; the helper user needs a writable temporary/cache location. Configure dsh-ssh with launch: { kind: "executable" }, the absolute helper path and the executable’s SHA-256 from the manifest. The client obtains the embedded PTC invocation through ctx.ssh.ptcLaunch.
Verification and publication
The artifact verifier accepts --archive and an optional --report path. It validates and relocates the archive, makes installation files read-only, and runs two concurrent Loader compositions sharing a fresh native cache. Those compositions exercise files, processes, PTY, native flock and PTC through the SSH providers. macOS also runs a worker under a policy denying the checkout and host Node. --sandbox=required requires real confinement; Linux’s additional --backend=landlock-run check makes the bwrap probe unavailable and requires the packaged Landlock runner.
The OpenSSH verifier accepts a Linux --archive. It creates a temporary glibc 2.28 SSH server with no Node installation, mounts only the release and a disposable public key, and exercises the production connection. Its portability lane makes no kernel-confinement claim; the native host lane owns that check. Test identities, host keys, ports and workspaces are private to the run.
Ordinary PR and master CI run source and build-script checks without building SSH executables. For changes to helper startup, native dependencies or packaging, manually run the native workflow before merging; it accepts selected targets and defaults to all four. CI master also exposes the manual ssh-helper suite. Release (SSH helper) defaults to publish=false: it builds all four targets from the selected ref and validates complete same-commit evidence from clean builds. With publish=true, it requires the matching dsh-v<version> tag and attaches the tested archives and SHA256SUMS to that GitHub release; a missing release is created as a draft. Native validation remains mandatory before publication. Deployment-target inspection alone does not establish execution on the oldest macOS version.
Understand the implementation
Implementation internals — click to expand
The carrier embeds its closed dependency set with the repository’s patched pkg --sea pipeline. Its entry dispatches the SSH helper, managed subprocess runner or PTC worker. Shared deployment helpers also serve the Python SDK builder. Production deploy restores development installation state before invoking build tools, so pnpm’s automatic dependency check cannot prune them.
The operating system must execute the Landlock and PTY launchers from real files. A process-local resolution hook points the system package at its co-shipped native directory; node-pty uses its existing executable-relative spawn-helper convention. Binary inspection covers the embedded native modules before packaging and the external resources before publication.
Further Exploration
- SSH connection — authentication, invocation and lifecycle.
- PTC Node runtime — explicit worker launch and execution limits.
- SSH subsystem — remote execution coordinates.
Model Experience
None, as this private process carrier registers no model-facing tools or prompt content; its consumers own operation results.
KV Cache effect
The carrier adds no request-prefix content.
Known Limitations and Deferred Work
- Windows and musl-based Linux are not build targets. Sandbox availability still depends on the target kernel and system tools.
- Automatic download, deployment, updates and connection UI are separate from archive production.
- The executable accepts private worker invocations, not arbitrary Node CLI arguments. Project
nodecommands and nested JavaScript subprocesses need their own Node installation.
Dev Note
Working context for maintainers — click to expand
None.