@oh-my-pi/pi-coding-agent 16.1.22 → 16.2.0

package/src/session/session-history-format.ts

@@ -105,14 +105,14 @@ function primaryArg(name: string, args: Record<string, unknown> | undefined): st
 		if (note) return oneLine(note);
 		if (severity) return oneLine(severity);
 	}
-	if (name === "search") {
+	if (name === "grep") {
 		const pattern = primaryArgValue(args.pattern);
 		const paths = primaryArgValue(args.paths);
 		if (pattern && paths) return oneLine(`${pattern} @ ${paths}`);
 		if (pattern) return oneLine(pattern);
 		if (paths) return oneLine(paths);
 	}
-	if (name === "find") {
+	if (name === "glob") {
 		const paths = primaryArgValue(args.paths);
 		if (paths) return oneLine(paths);
 	}

package/src/session/session-listing.ts

@@ -495,6 +495,19 @@ async function scanSessionDir(
 	}
 }
 
+async function scanSessionDirReadOnly(
+	sessionDir: string,
+	storage: SessionStorage,
+	withStatus: boolean,
+): Promise<SessionInfo[]> {
+	try {
+		const files = storage.listFilesSync(sessionDir, "*.jsonl");
+		return await collectSessionsFromFiles(files, storage, withStatus);
+	} catch {
+		return [];
+	}
+}
+
 /**
  * List sessions in a resolved session directory (newest first), reading each
  * file's lifecycle {@link SessionStatus}.
@@ -503,6 +516,13 @@ export function listSessions(sessionDir: string, storage: SessionStorage): Promi
 	return scanSessionDir(sessionDir, storage, true);
 }
 
+/**
+ * List sessions without repairing orphaned backups or mutating the directory.
+ */
+export function listSessionsReadOnly(sessionDir: string, storage: SessionStorage): Promise<SessionInfo[]> {
+	return scanSessionDirReadOnly(sessionDir, storage, true);
+}
+
 /** List all sessions across all project directories (newest first). */
 export async function listAllSessions(storage: SessionStorage = new FileSessionStorage()): Promise<SessionInfo[]> {
 	const sessionsRoot = path.join(getDefaultAgentDir(), "sessions");
@@ -561,12 +581,25 @@ function sessionMatchesResumeArg(session: SessionInfo, sessionArg: string): bool
 	return fileSessionId.startsWith(normalizedArg);
 }
 
+/** Controls cross-directory fallback for resumable session lookup. */
+export interface ResolveResumableSessionOptions {
+	/** Search default global session buckets after the active/custom session directory misses. */
+	allowGlobalFallback?: boolean;
+}
+
+function isSessionStorage(value: SessionStorage | ResolveResumableSessionOptions): value is SessionStorage {
+	return "listFilesSync" in value;
+}
+
 export async function resolveResumableSession(
 	sessionArg: string,
 	cwd: string,
 	sessionDir?: string,
-	storage: SessionStorage = new FileSessionStorage(),
+	storageOrOptions: SessionStorage | ResolveResumableSessionOptions = new FileSessionStorage(),
+	options: ResolveResumableSessionOptions = {},
 ): Promise<ResolvedSessionMatch | undefined> {
+	const storage = isSessionStorage(storageOrOptions) ? storageOrOptions : new FileSessionStorage();
+	const resolvedOptions = isSessionStorage(storageOrOptions) ? options : storageOrOptions;
 	const localSessionDir = sessionDir ?? computeDefaultSessionDir(cwd, storage);
 	const localSessions = await listSessions(localSessionDir, storage);
 	const localMatch = localSessions.find(session => sessionMatchesResumeArg(session, sessionArg));
@@ -574,7 +607,7 @@ export async function resolveResumableSession(
 		return { session: localMatch, scope: "local" };
 	}
 
-	if (sessionDir) {
+	if (sessionDir && resolvedOptions.allowGlobalFallback !== true) {
 		return undefined;
 	}
 

package/src/session/session-manager.ts

@@ -1523,6 +1523,29 @@ export class SessionManager {
 		return manager;
 	}
 
+	/**
+	 * Create a fresh empty session file in the default session directory for
+	 * `cwd`, writing only the session header. The returned path can be passed to
+	 * `setSessionFile` / `AgentSession.switchSession` to start a new empty
+	 * session in that directory. Used by `/move` to switch projects without
+	 * dragging the current conversation along.
+	 */
+	static createEmptySessionFile(cwd: string, storage: SessionStorage = new FileSessionStorage()): string {
+		const sessionDir = SessionManager.getDefaultSessionDir(cwd, undefined, storage);
+		const id = mintSessionId();
+		const timestamp = nowIso();
+		const header: SessionHeader = {
+			type: "session",
+			version: CURRENT_SESSION_VERSION,
+			id,
+			timestamp,
+			cwd: path.resolve(cwd),
+		};
+		const file = path.join(sessionDir, `${fileSafeTimestamp(timestamp)}_${id}.jsonl`);
+		storage.writeTextSync(file, `${JSON.stringify(header)}\n`);
+		return file;
+	}
+
 	/**
 	 * Fork a session into the current project directory: copy history from another
 	 * session file while creating a fresh session file in this sessionDir.
@@ -1748,3 +1771,26 @@ export class SessionManager {
 		return listAllSessions(storage);
 	}
 }
+
+/**
+ * If the current session was created by `/move` and contains no real
+ * user/assistant messages, delete it so empty move sessions don't accumulate.
+ */
+export async function cleanupEmptyMoveSession(
+	sessionManager: SessionManager,
+	movedFromEmptySessionFile: string | undefined,
+): Promise<void> {
+	const sessionFile = sessionManager.getSessionFile();
+	if (!sessionFile || !movedFromEmptySessionFile) return;
+	if (path.resolve(sessionFile) !== path.resolve(movedFromEmptySessionFile)) return;
+	const entries = sessionManager.getEntries();
+	const hasRealMessages = entries.some(
+		e => e.type === "message" && (e.message.role === "user" || e.message.role === "assistant"),
+	);
+	if (hasRealMessages) return;
+	try {
+		await sessionManager.dropSession(sessionFile);
+	} catch (err) {
+		logger.warn("Failed to clean up empty move session", { sessionFile, error: String(err) });
+	}
+}

package/src/slash-commands/builtin-registry.ts

@@ -1,8 +1,9 @@
 import * as fs from "node:fs/promises";
+import * as os from "node:os";
 import * as path from "node:path";
 import { getOAuthProviders } from "@oh-my-pi/pi-ai/oauth";
 import { type AutocompleteItem, Spacer } from "@oh-my-pi/pi-tui";
-import { APP_NAME, setProjectDir } from "@oh-my-pi/pi-utils";
+import { APP_NAME, getProjectDir, setProjectDir } from "@oh-my-pi/pi-utils";
 import { COLLAB_GUEST_ALLOWED_COMMANDS, CollabGuestLink } from "../collab/guest";
 import { CollabHost } from "../collab/host";
 import type { SettingPath, SettingValue } from "../config/settings";
@@ -27,7 +28,10 @@ import { theme } from "../modes/theme/theme";
 import type { InteractiveModeContext } from "../modes/types";
 import type { AgentSession, FreshSessionResult } from "../session/agent-session";
 import { COMPACT_MODES, parseCompactArgs } from "../session/compact-modes";
+import { resolveResumableSession } from "../session/session-listing";
+import { SessionManager } from "../session/session-manager";
 import { formatShakeSummary, type ShakeMode } from "../session/shake-types";
+import { expandTilde, resolveToCwd } from "../tools/path-utils";
 import { urlHyperlinkAlways } from "../tui";
 import { getChangelogPath, parseChangelog } from "../utils/changelog";
 import { CollabQrCodeComponent } from "./helpers/collab-qrcode";
@@ -58,7 +62,7 @@ export type { BuiltinSlashCommand, SubcommandDef } from "./types";
 export type BuiltinSlashCommandRuntime = TuiSlashCommandRuntime;
 
 export interface TuiBuiltinSlashCommand extends BuiltinSlashCommand {
-	getArgumentCompletions?: (prefix: string) => AutocompleteItem[] | null;
+	getArgumentCompletions?: (prefix: string) => AutocompleteItem[] | null | Promise<AutocompleteItem[] | null>;
 	getInlineHint?: (argumentText: string) => string | null;
 	getAutocompleteDescription?: () => string | undefined;
 }
@@ -1414,9 +1418,26 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 	{
 		name: "resume",
 		description: "Resume a different session",
-		handleTui: (_command, runtime) => {
-			runtime.ctx.showSessionSelector();
+		inlineHint: "[session id]",
+		allowArgs: true,
+		handleTui: async (command, runtime) => {
+			const sessionArg = command.args.trim();
 			runtime.ctx.editor.setText("");
+			if (!sessionArg) {
+				runtime.ctx.showSessionSelector();
+				return;
+			}
+			const match = await resolveResumableSession(
+				sessionArg,
+				runtime.ctx.sessionManager.getCwd(),
+				runtime.ctx.sessionManager.getSessionDir(),
+				{ allowGlobalFallback: true },
+			);
+			if (!match) {
+				runtime.ctx.showError(`Session "${sessionArg}" not found`);
+				return;
+			}
+			await runtime.ctx.handleResumeSession(match.session.path);
 		},
 	},
 	{
@@ -1572,44 +1593,56 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 	},
 	{
 		name: "move",
-		description: "Move session to a different working directory",
-		acpDescription: "Move the current session file",
-		inlineHint: "<path>",
+		description: "Switch to a fresh session in a different directory",
+		acpDescription: "Start a fresh session in a different directory",
+		inlineHint: "[<path>]",
 		allowArgs: true,
 		handle: async (command, runtime) => {
 			if (runtime.session.isStreaming) return usage("Cannot move while streaming.", runtime);
 			if (!command.args) return usage("Usage: /move <path>", runtime);
-			const resolvedPath = path.resolve(runtime.cwd, command.args);
-			let isDirectory: boolean;
+			const resolvedPath = resolveToCwd(command.args, runtime.cwd);
 			try {
-				isDirectory = (await fs.stat(resolvedPath)).isDirectory();
+				const stat = await fs.stat(resolvedPath);
+				if (!stat.isDirectory()) {
+					return usage(`Not a directory: ${resolvedPath}`, runtime);
+				}
 			} catch {
-				return usage(`Directory does not exist or is not a directory: ${resolvedPath}`, runtime);
+				return usage(`Directory does not exist: ${resolvedPath}`, runtime);
 			}
-			if (!isDirectory) return usage(`Directory does not exist or is not a directory: ${resolvedPath}`, runtime);
+			let newSessionFile: string | undefined;
 			try {
-				await runtime.sessionManager.flush();
-				await runtime.sessionManager.moveTo(resolvedPath);
+				newSessionFile = SessionManager.createEmptySessionFile(resolvedPath);
+				const switched = await runtime.session.switchSession(newSessionFile);
+				if (!switched) {
+					await runtime.sessionManager.dropSession(newSessionFile);
+					return usage("Move cancelled.", runtime);
+				}
 			} catch (err) {
+				if (newSessionFile) {
+					try {
+						await runtime.sessionManager.dropSession(newSessionFile);
+					} catch (dropErr) {
+						return usage(
+							`Move failed: ${errorMessage(err)}; failed to remove empty session: ${errorMessage(dropErr)}`,
+							runtime,
+						);
+					}
+				}
 				return usage(`Move failed: ${errorMessage(err)}`, runtime);
 			}
+			runtime.session.markMovedFromEmptySessionFile(newSessionFile!);
 			setProjectDir(resolvedPath);
 			// Reload plugin/capability caches so the next prompt sees commands and
 			// capabilities scoped to the new cwd.
 			await runtime.reloadPlugins();
 			await runtime.notifyTitleChanged?.();
-			await runtime.output(`Session moved to ${runtime.sessionManager.getCwd()}.`);
+			await runtime.output(`Moved to ${runtime.sessionManager.getCwd()}.`);
 			return commandConsumed();
 		},
 		handleTui: async (command, runtime) => {
-			const targetPath = command.args;
-			if (!targetPath) {
-				runtime.ctx.showError("Usage: /move <path>");
-				runtime.ctx.editor.setText("");
-				return;
-			}
+			runtime.ctx.editor.addToHistory(command.text);
 			runtime.ctx.editor.setText("");
-			await runtime.ctx.handleMoveCommand(targetPath);
+			await runtime.ctx.handleMoveCommand(command.args || undefined);
 		},
 	},
 	{
@@ -2276,6 +2309,106 @@ function buildStaticInlineHint(hint: string): (argumentText: string) => string |
 	return (argumentText: string) => (argumentText.trim().length === 0 ? hint : null);
 }
 
+/**
+ * Build getArgumentCompletions that suggests directories relative to the
+ * current project directory. Used by /move so users can Tab-complete the
+ * destination directory.
+ */
+function buildDirectoryArgumentCompletions(): (prefix: string) => Promise<AutocompleteItem[] | null> {
+	return async (argumentPrefix: string) => {
+		const prefix = argumentPrefix.trim();
+
+		const cwd = getProjectDir();
+		const expandedPrefix = expandTilde(prefix);
+		const isAbsolute = path.isAbsolute(expandedPrefix);
+
+		let searchDir: string;
+		let searchPrefix: string;
+		if (
+			prefix === "" ||
+			prefix === "." ||
+			prefix === "./" ||
+			prefix === ".." ||
+			prefix === "../" ||
+			prefix === "~" ||
+			prefix === "~/" ||
+			prefix === "/"
+		) {
+			searchDir = isAbsolute ? expandedPrefix : path.join(cwd, expandedPrefix);
+			searchPrefix = "";
+		} else if (expandedPrefix.endsWith("/")) {
+			searchDir = isAbsolute ? expandedPrefix : path.join(cwd, expandedPrefix);
+			searchPrefix = "";
+		} else {
+			const dir = path.dirname(expandedPrefix);
+			searchDir = isAbsolute ? dir : path.join(cwd, dir);
+			searchPrefix = path.basename(expandedPrefix);
+		}
+
+		try {
+			const entries = await fs.readdir(searchDir, { withFileTypes: true });
+			const suggestions: AutocompleteItem[] = [];
+			for (const entry of entries) {
+				if (!entry.name.toLowerCase().startsWith(searchPrefix.toLowerCase())) continue;
+				if (entry.name === ".git") continue;
+
+				let isDirectory = entry.isDirectory();
+				if (!isDirectory && entry.isSymbolicLink()) {
+					try {
+						isDirectory = (await fs.stat(path.join(searchDir, entry.name))).isDirectory();
+					} catch {
+						continue;
+					}
+				}
+				if (!isDirectory) continue;
+
+				const absoluteValue = path.join(searchDir, entry.name);
+				const displayValue = buildDirectoryCompletionDisplayValue(prefix, absoluteValue, cwd);
+				suggestions.push({ value: displayValue, label: `${entry.name}/` });
+			}
+			suggestions.sort((a, b) => a.label.localeCompare(b.label));
+			return suggestions.length > 0 ? suggestions : null;
+		} catch {
+			return null;
+		}
+	};
+}
+function buildDirectoryCompletionDisplayValue(prefix: string, absoluteValue: string, cwd: string): string {
+	// Preserve the user's prefix style where possible, but always return a
+	// value that /move can resolve (absolute or relative) without escaping.
+	const normalized = path.normalize(absoluteValue);
+
+	if (prefix.startsWith("~/")) {
+		const home = os.homedir();
+		const homeRelative = path.relative(home, normalized);
+		return `~/${homeRelative.replaceAll("\\", "/")}/`;
+	}
+	if (prefix === "~") {
+		const home = os.homedir();
+		const homeRelative = path.relative(home, normalized);
+		return `~/${homeRelative.replaceAll("\\", "/")}/`;
+	}
+	if (prefix.startsWith("/")) {
+		return `${normalized.replaceAll("\\", "/")}/`;
+	}
+	if (prefix.startsWith("./")) {
+		const relative = path.relative(cwd, normalized);
+		return `./${relative.replaceAll("\\", "/")}/`;
+	}
+	if (prefix.startsWith("../")) {
+		const relative = path.relative(cwd, normalized);
+		return `${relative.replaceAll("\\", "/")}/`;
+	}
+	if (prefix === "..") {
+		const relative = path.relative(cwd, normalized);
+		return `${relative.replaceAll("\\", "/")}/`;
+	}
+
+	// Default: relative to cwd.
+	const relative = path.relative(cwd, normalized);
+	return `${relative.replaceAll("\\", "/")}/`;
+}
+
 /** Builtin command metadata used for slash-command autocomplete and help text. */
 export const BUILTIN_SLASH_COMMAND_DEFS: ReadonlyArray<BuiltinSlashCommand> = BUILTIN_SLASH_COMMAND_REGISTRY.map(
 	command => ({
@@ -2296,6 +2429,9 @@ function materializeTuiBuiltinSlashCommand(
 	if (cmd.subcommands) {
 		materialized.getArgumentCompletions = buildArgumentCompletions(cmd.subcommands);
 		materialized.getInlineHint = buildSubcommandInlineHint(cmd.subcommands);
+	} else if (cmd.name === "move") {
+		materialized.getArgumentCompletions = buildDirectoryArgumentCompletions();
+		if (cmd.inlineHint) materialized.getInlineHint = buildStaticInlineHint(cmd.inlineHint);
 	} else if (cmd.inlineHint) {
 		materialized.getInlineHint = buildStaticInlineHint(cmd.inlineHint);
 	}

package/src/slash-commands/helpers/usage-report.ts

@@ -27,9 +27,14 @@ function formatUsageAmount(limit: UsageLimit): string {
 function formatUsageReportAccount(report: UsageReport, limit: UsageLimit, index: number): string {
 	const email = report.metadata?.email;
 	if (typeof email === "string" && email) return email;
-	const accountId = report.metadata?.accountId ?? limit.scope.accountId;
+	// Guard metadata values for truthiness before using, then fall back to scope.
+	// ?? won't help here: empty string is not null/undefined, so it would suppress
+	// a valid scoped fallback (e.g. metadata.accountId="" hides limit.scope.accountId).
+	const metaAccountId = report.metadata?.accountId;
+	const accountId = typeof metaAccountId === "string" && metaAccountId ? metaAccountId : limit.scope.accountId;
 	if (typeof accountId === "string" && accountId) return accountId;
-	const projectId = report.metadata?.projectId ?? limit.scope.projectId;
+	const metaProjectId = report.metadata?.projectId;
+	const projectId = typeof metaProjectId === "string" && metaProjectId ? metaProjectId : limit.scope.projectId;
 	if (typeof projectId === "string" && projectId) return projectId;
 	return `account ${index + 1}`;
 }
@@ -70,6 +75,22 @@ function renderUsageReports(
 				lines.push(
 					`- ${resetLabel}: ${savedResets} saved rate-limit reset${savedResets === 1 ? "" : "s"} available — /usage reset to spend`,
 				);
+				const credits = report.resetCredits?.credits;
+				if (credits) {
+					for (const credit of credits) {
+						if (credit.expiresAt) {
+							const expiryMs = Date.parse(credit.expiresAt);
+							if (!Number.isNaN(expiryMs)) {
+								const remaining = expiryMs - nowMs;
+								if (remaining > 0) {
+									lines.push(`  expires in ${formatDuration(remaining)} (${credit.expiresAt.slice(0, 10)})`);
+								} else {
+									lines.push(`  expired (${credit.expiresAt.slice(0, 10)})`);
+								}
+							}
+						}
+					}
+				}
 			}
 			if (report.limits.length === 0) {
 				const email = typeof report.metadata?.email === "string" ? report.metadata.email : "account";

package/src/ssh/__tests__/connection-manager-args.test.ts

@@ -0,0 +1,69 @@
+import { describe, expect, it } from "bun:test";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { getRemoteHostDir } from "@oh-my-pi/pi-utils";
+import { buildRemoteCommand, getHostInfo, type SSHConnectionTarget, type SSHHostShell } from "../connection-manager";
+import { buildSshTarget, sanitizeHostName } from "../utils";
+
+const TARGET: SSHConnectionTarget = { name: "h", host: "h" };
+
+describe("buildRemoteCommand stdin handling", () => {
+	it("includes -n by default so ssh reads stdin from /dev/null", async () => {
+		const args = await buildRemoteCommand(TARGET, "cat");
+		expect(args).toContain("-n");
+	});
+
+	it("omits -n when allowStdin is set so the remote command reads piped stdin", async () => {
+		const args = await buildRemoteCommand(TARGET, "cat", { allowStdin: true });
+		expect(args).not.toContain("-n");
+	});
+});
+
+describe("buildSshTarget argument-injection guard", () => {
+	it("rejects a host that begins with '-' (ssh would parse it as an option)", () => {
+		expect(() => buildSshTarget(undefined, "-oProxyCommand=touch /tmp/pwned")).toThrow(/must not begin with/);
+	});
+
+	it("rejects a username that begins with '-'", () => {
+		expect(() => buildSshTarget("-oProxyCommand=x", "host")).toThrow(/must not begin with/);
+	});
+
+	it("renders a normal destination unchanged", () => {
+		expect(buildSshTarget("user", "host")).toBe("user@host");
+		expect(buildSshTarget(undefined, "host")).toBe("host");
+	});
+
+	it("rejects a dash-leading host through the real buildRemoteCommand path", async () => {
+		await expect(buildRemoteCommand({ name: "x", host: "-oProxyCommand=x" }, "cat")).rejects.toThrow(
+			/must not begin with/,
+		);
+	});
+});
+
+describe("ssh host shell classification", () => {
+	it("treats fish/csh/tcsh as non-POSIX (unknown) and keeps real sh-family as sh", async () => {
+		// parseHostInfo re-runs parseShell on the stored shell field, so getHostInfo
+		// exercises the classifier through a public seam. The ensurePosixRemote
+		// whitelist then refuses anything that isn't sh/bash/zsh.
+		const cases: Array<[string, SSHHostShell]> = [
+			["/usr/bin/fish", "unknown"],
+			["/bin/csh", "unknown"],
+			["/bin/tcsh", "unknown"],
+			["/bin/dash", "sh"],
+			["/bin/sh", "sh"],
+			["/usr/bin/bash", "bash"],
+			["/usr/bin/zsh", "zsh"],
+		];
+		for (const [shellValue, expected] of cases) {
+			const name = `omp-shellclf-${crypto.randomUUID()}`;
+			const file = path.join(getRemoteHostDir(), `${sanitizeHostName(name)}.json`);
+			await Bun.write(file, JSON.stringify({ version: 3, os: "linux", shell: shellValue, compatEnabled: false }));
+			try {
+				const info = await getHostInfo(name);
+				expect(info?.shell).toBe(expected);
+			} finally {
+				await fs.promises.rm(file, { force: true });
+			}
+		}
+	});
+});

package/src/ssh/__tests__/file-transfer-posix-guard.test.ts

@@ -0,0 +1,68 @@
+import { afterEach, describe, expect, it, vi } from "bun:test";
+import type { SSHConnectionTarget } from "../connection-manager";
+import * as connectionManager from "../connection-manager";
+import { readRemoteFile, writeRemoteFile } from "../file-transfer";
+
+describe("ssh file-transfer POSIX guard", () => {
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	it("rejects a confirmed Windows remote before running any POSIX command", async () => {
+		// Stub BOTH the connection and the host-info probe so the guard is reached
+		// without opening a real SSH connection and before any command is spawned.
+		const ensureConnectionSpy = vi.spyOn(connectionManager, "ensureConnection").mockResolvedValue(undefined);
+		const ensureHostInfoSpy = vi.spyOn(connectionManager, "ensureHostInfo").mockResolvedValue({
+			version: 2,
+			os: "windows",
+			shell: "powershell",
+			compatEnabled: false,
+		});
+		const target: SSHConnectionTarget = { name: "winbox", host: "winbox" };
+		await expect(readRemoteFile(target, "C:/x.txt", { maxBytes: 1024 })).rejects.toThrow(/Windows host/);
+		await expect(writeRemoteFile(target, "C:/x.txt", new Uint8Array([1]), {})).rejects.toThrow(/Windows host/);
+		// Prove the guard ran through the stubbed transport rather than failing early
+		// for an unrelated reason (e.g. a future import refactor bypassing the mocks).
+		expect(ensureConnectionSpy).toHaveBeenCalled();
+		expect(ensureHostInfoSpy).toHaveBeenCalled();
+	});
+
+	it("rejects a non-POSIX login shell (csh/tcsh/fish classify as non-sh) before any transfer", async () => {
+		// csh/tcsh history-expand `!`, and fish can't parse our POSIX source; all
+		// classify as a non-sh shell, so the guard must refuse them before any spawn.
+		vi.spyOn(connectionManager, "ensureConnection").mockResolvedValue(undefined);
+		vi.spyOn(connectionManager, "ensureHostInfo").mockResolvedValue({
+			version: 3,
+			os: "linux",
+			shell: "unknown",
+			compatEnabled: false,
+		});
+		const target: SSHConnectionTarget = { name: "fishbox", host: "fishbox" };
+		await expect(readRemoteFile(target, "/etc/hosts", { maxBytes: 1024 })).rejects.toThrow(/non-POSIX login shell/);
+		await expect(writeRemoteFile(target, "/tmp/x", new Uint8Array([1]), {})).rejects.toThrow(/non-POSIX login shell/);
+	});
+
+	it("allows a POSIX login shell (sh/bash/zsh) to run the transfer commands directly", async () => {
+		// A POSIX login shell runs our snippets verbatim; the guard must let it through.
+		// Reject at buildRemoteCommand to capture the command before any real ssh spawn.
+		vi.spyOn(connectionManager, "ensureConnection").mockResolvedValue(undefined);
+		vi.spyOn(connectionManager, "ensureHostInfo").mockResolvedValue({
+			version: 3,
+			os: "linux",
+			shell: "sh",
+			compatEnabled: false,
+		});
+		const buildSpy = vi
+			.spyOn(connectionManager, "buildRemoteCommand")
+			.mockRejectedValue(new Error("stop-before-spawn"));
+		const target: SSHConnectionTarget = { name: "shbox", host: "shbox" };
+
+		await expect(readRemoteFile(target, "/etc/hosts", { maxBytes: 1024 })).rejects.toThrow(/stop-before-spawn/);
+		await expect(writeRemoteFile(target, "/tmp/x", new Uint8Array([1]), {})).rejects.toThrow(/stop-before-spawn/);
+
+		// Reached buildRemoteCommand → the guard allowed the POSIX shell. Commands are
+		// sent verbatim (no `sh -c` wrapper); write keeps its stdin staging.
+		expect(buildSpy.mock.calls[0]?.[1]).toContain("head -c 1025");
+		expect(buildSpy.mock.calls[1]?.[2]).toMatchObject({ allowStdin: true });
+	});
+});

package/src/ssh/connection-manager.ts

@@ -32,7 +32,7 @@ export interface SSHHostInfo {
 const CONTROL_DIR = getSshControlDir();
 const CONTROL_PATH = path.join(CONTROL_DIR, "%C.sock");
 const HOST_INFO_DIR = getRemoteHostDir();
-const HOST_INFO_VERSION = 2;
+const HOST_INFO_VERSION = 3;
 
 const activeHosts = new Map<string, SSHConnectionTarget>();
 const pendingConnections = new Map<string, Promise<void>>();
@@ -40,6 +40,8 @@ const hostInfoCache = new Map<string, SSHHostInfo>();
 
 interface SSHArgsOptions {
 	platform?: SshPlatform;
+	/** When true, omit `-n` so the remote command can read from our piped stdin. */
+	allowStdin?: boolean;
 }
 
 function ensureControlDir() {
@@ -87,7 +89,7 @@ async function validateKeyPermissions(keyPath?: string, platform: SshPlatform =
 }
 
 function buildCommonArgs(host: SSHConnectionTarget, options?: SSHArgsOptions): string[] {
-	const args = ["-n"];
+	const args = options?.allowStdin ? [] : ["-n"];
 
 	if (supportsSshControlMaster(options?.platform)) {
 		args.push("-o", "ControlMaster=auto", "-o", `ControlPath=${CONTROL_PATH}`, "-o", "ControlPersist=3600");
@@ -151,7 +153,11 @@ function parseShell(value: unknown): SSHHostShell | null {
 	if (normalized.includes("zsh")) return "zsh";
 	if (normalized.includes("pwsh") || normalized.includes("powershell")) return "powershell";
 	if (normalized.includes("cmd.exe") || normalized === "cmd") return "cmd";
-	if (normalized.endsWith("sh") || normalized.includes("/sh")) return "sh";
+	// Only genuine POSIX sh-family by basename — fish/csh/tcsh also end in "sh"
+	// but are non-POSIX (csh/tcsh history-expand `!`), so they fall through to
+	// "unknown" and are refused by the ssh:// transfer guard.
+	const base = normalized.slice(normalized.lastIndexOf("/") + 1);
+	if (base === "sh" || base === "dash" || base === "ash" || base === "ksh" || base === "mksh") return "sh";
 	return "unknown";
 }
 
@@ -293,18 +299,9 @@ async function probeHostInfo(host: SSHConnectionTarget): Promise<SSHHostInfo> {
 		os = "linux";
 	}
 
-	let shell: SSHHostShell = "unknown";
-	if (shellLower.includes("bash")) {
-		shell = "bash";
-	} else if (shellLower.includes("zsh")) {
-		shell = "zsh";
-	} else if (shellLower.includes("pwsh") || shellLower.includes("powershell")) {
-		shell = "powershell";
-	} else if (shellLower.includes("cmd.exe") || shellLower === "cmd") {
-		shell = "cmd";
-	} else if (shellLower.endsWith("sh") || shellLower.includes("/sh")) {
-		shell = "sh";
-	} else if (os === "windows" && !shellLower) {
+	// Reuse parseShell so probe-time and cached classification stay identical.
+	let shell = parseShell(shellLower) ?? "unknown";
+	if (shell === "unknown" && os === "windows" && !shellLower) {
 		shell = "cmd";
 	}