@oh-my-pi/pi-coding-agent 16.2.1 → 16.2.3

package/src/session/sql-session-storage.ts

@@ -3,6 +3,7 @@ import {
 	type SessionStorageBackend,
 	type SessionStorageIndexEntry,
 } from "./indexed-session-storage";
+import type { SessionTitleUpdate } from "./session-title-slot";
 
 /**
  * Supported `bun:sql` adapter dialects. `Bun.SQL` reports this string on
@@ -55,10 +56,14 @@ export interface SqlSessionStorageOptions {
 
 interface DialectQueries {
 	createTable: string;
+	/** Add title metadata columns to existing tables created before title fields existed. */
+	addTitleColumns: readonly string[];
 	/** Insert or replace the full content for `path`. Used for `writeText`/`flags="w"` truncate. */
 	upsertReplace: string;
 	/** Insert if missing; otherwise append the new chunk to existing content. Used for `writeLine`. */
 	upsertAppend: string;
+	/** Update indexed title metadata without rewriting the JSONL body. */
+	updateTitle: string;
 	/** Delete a single row by path. */
 	delete: string;
 	/** Move a row from one path to another (caller deletes any conflicting destination first). */
@@ -75,6 +80,9 @@ interface IndexRow {
 	path: string;
 	byte_len: number | bigint | string;
 	mtime_ms: number | bigint | string;
+	title?: string | null;
+	title_source?: string | null;
+	title_updated_at?: string | null;
 }
 
 interface ContentRow {
@@ -119,17 +127,26 @@ function buildQueries(adapter: SqlSessionStorageAdapter, table: string): Dialect
 				`CREATE TABLE IF NOT EXISTS ${table} (` +
 				`path VARCHAR(512) NOT NULL PRIMARY KEY, ` +
 				`content LONGTEXT NOT NULL, ` +
-				`mtime_ms BIGINT NOT NULL` +
+				`mtime_ms BIGINT NOT NULL, ` +
+				`title TEXT NULL, ` +
+				`title_source VARCHAR(16) NULL, ` +
+				`title_updated_at VARCHAR(64) NULL` +
 				`) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin`,
+			addTitleColumns: [
+				`ALTER TABLE ${table} ADD COLUMN title TEXT NULL`,
+				`ALTER TABLE ${table} ADD COLUMN title_source VARCHAR(16) NULL`,
+				`ALTER TABLE ${table} ADD COLUMN title_updated_at VARCHAR(64) NULL`,
+			],
 			upsertReplace:
-				`INSERT INTO ${table} (path, content, mtime_ms) VALUES (?, ?, ?) ` +
-				`ON DUPLICATE KEY UPDATE content = VALUES(content), mtime_ms = VALUES(mtime_ms)`,
+				`INSERT INTO ${table} (path, content, mtime_ms, title, title_source, title_updated_at) VALUES (?, ?, ?, ?, ?, ?) ` +
+				`ON DUPLICATE KEY UPDATE content = VALUES(content), mtime_ms = VALUES(mtime_ms), title = VALUES(title), title_source = VALUES(title_source), title_updated_at = VALUES(title_updated_at)`,
 			upsertAppend:
 				`INSERT INTO ${table} (path, content, mtime_ms) VALUES (?, ?, ?) ` +
 				`ON DUPLICATE KEY UPDATE content = CONCAT(content, VALUES(content)), mtime_ms = VALUES(mtime_ms)`,
+			updateTitle: `UPDATE ${table} SET title = ?, title_source = ?, title_updated_at = ?, mtime_ms = ? WHERE path = ?`,
 			delete: `DELETE FROM ${table} WHERE path = ?`,
 			rename: `UPDATE ${table} SET path = ?, mtime_ms = ? WHERE path = ?`,
-			loadIndex: `SELECT path, mtime_ms, length(content) AS byte_len FROM ${table}`,
+			loadIndex: `SELECT path, mtime_ms, length(content) AS byte_len, title, title_source, title_updated_at FROM ${table}`,
 			readFull: `SELECT content AS content FROM ${table} WHERE path = ?`,
 			readSlices:
 				`SELECT substring(cast(content AS binary), 1, ?) AS head, ` +
@@ -157,19 +174,28 @@ function buildQueries(adapter: SqlSessionStorageAdapter, table: string): Dialect
 			`CREATE TABLE IF NOT EXISTS ${table} (` +
 			`path TEXT PRIMARY KEY, ` +
 			`content TEXT NOT NULL, ` +
-			`mtime_ms ${mtimeType} NOT NULL` +
+			`mtime_ms ${mtimeType} NOT NULL, ` +
+			`title TEXT, ` +
+			`title_source TEXT, ` +
+			`title_updated_at TEXT` +
 			`)`,
+		addTitleColumns: [
+			`ALTER TABLE ${table} ADD COLUMN title TEXT`,
+			`ALTER TABLE ${table} ADD COLUMN title_source TEXT`,
+			`ALTER TABLE ${table} ADD COLUMN title_updated_at TEXT`,
+		],
 		upsertReplace:
-			`INSERT INTO ${table} (path, content, mtime_ms) ` +
-			`VALUES (${placeholder(1)}, ${placeholder(2)}, ${placeholder(3)}) ` +
-			`ON CONFLICT (path) DO UPDATE SET content = excluded.content, mtime_ms = excluded.mtime_ms`,
+			`INSERT INTO ${table} (path, content, mtime_ms, title, title_source, title_updated_at) ` +
+			`VALUES (${placeholder(1)}, ${placeholder(2)}, ${placeholder(3)}, ${placeholder(4)}, ${placeholder(5)}, ${placeholder(6)}) ` +
+			`ON CONFLICT (path) DO UPDATE SET content = excluded.content, mtime_ms = excluded.mtime_ms, title = excluded.title, title_source = excluded.title_source, title_updated_at = excluded.title_updated_at`,
 		upsertAppend:
 			`INSERT INTO ${table} (path, content, mtime_ms) ` +
 			`VALUES (${placeholder(1)}, ${placeholder(2)}, ${placeholder(3)}) ` +
 			`ON CONFLICT (path) DO UPDATE SET content = ${tableQualifier} || excluded.content, mtime_ms = excluded.mtime_ms`,
+		updateTitle: `UPDATE ${table} SET title = ${placeholder(1)}, title_source = ${placeholder(2)}, title_updated_at = ${placeholder(3)}, mtime_ms = ${placeholder(4)} WHERE path = ${placeholder(5)}`,
 		delete: `DELETE FROM ${table} WHERE path = ${placeholder(1)}`,
 		rename: `UPDATE ${table} SET path = ${placeholder(1)}, mtime_ms = ${placeholder(2)} WHERE path = ${placeholder(3)}`,
-		loadIndex: `SELECT path, mtime_ms, ${byteLengthExpr} AS byte_len FROM ${table}`,
+		loadIndex: `SELECT path, mtime_ms, ${byteLengthExpr} AS byte_len, title, title_source, title_updated_at FROM ${table}`,
 		readFull: `SELECT content AS content FROM ${table} WHERE path = ${placeholder(1)}`,
 		readSlices,
 	};
@@ -180,6 +206,13 @@ function rowNumber(value: number | bigint | string): number {
 	if (typeof value === "bigint") return Number(value);
 	return Number.parseInt(value, 10);
 }
+function rowTitleSource(value: string | null | undefined): SessionTitleUpdate["source"] | undefined {
+	return value === "auto" || value === "user" ? value : undefined;
+}
+function isDuplicateColumnError(error: unknown): boolean {
+	const message = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
+	return message.includes("duplicate column") || message.includes("already exists");
+}
 
 function decodeSqlBytes(value: unknown): string {
 	if (value === null || value === undefined) return "";
@@ -260,6 +293,13 @@ class SqlSessionStorageBackend implements SessionStorageBackend {
 	async init(): Promise<void> {
 		if (this.#createTable) {
 			await this.#client.unsafe(this.#q.createTable);
+			for (const query of this.#q.addTitleColumns) {
+				try {
+					await this.#client.unsafe(query);
+				} catch (err) {
+					if (!isDuplicateColumnError(err)) throw err;
+				}
+			}
 		}
 	}
 
@@ -269,6 +309,9 @@ class SqlSessionStorageBackend implements SessionStorageBackend {
 			path: row.path,
 			size: rowNumber(row.byte_len),
 			mtimeMs: rowNumber(row.mtime_ms),
+			title: row.title ?? undefined,
+			titleSource: rowTitleSource(row.title_source),
+			titleUpdatedAt: row.title_updated_at ?? undefined,
 		}));
 	}
 
@@ -289,8 +332,25 @@ class SqlSessionStorageBackend implements SessionStorageBackend {
 		return [decodeSqlBytes(row.head), decodeSqlBytes(row.tail)];
 	}
 
-	async writeFull(path: string, content: string, mtimeMs: number): Promise<void> {
-		await this.#client.unsafe(this.#q.upsertReplace, [path, content, mtimeMs]);
+	async writeFull(path: string, content: string, mtimeMs: number, title?: SessionTitleUpdate): Promise<void> {
+		await this.#client.unsafe(this.#q.upsertReplace, [
+			path,
+			content,
+			mtimeMs,
+			title?.title ?? null,
+			title?.source ?? null,
+			title?.updatedAt ?? null,
+		]);
+	}
+
+	async updateSessionTitle(path: string, title: SessionTitleUpdate, mtimeMs: number): Promise<void> {
+		await this.#client.unsafe(this.#q.updateTitle, [
+			title.title ?? null,
+			title.source ?? null,
+			title.updatedAt,
+			mtimeMs,
+			path,
+		]);
 	}
 
 	async append(path: string, line: string, mtimeMs: number): Promise<void> {

package/src/session/turn-persistence.ts

@@ -0,0 +1,142 @@
+/**
+ * Helpers that share one cheap, structural identity for messages — both during
+ * incremental persistence and for the mid-run-compaction ordering check.
+ *
+ * Previously `AgentSession` carried two near-duplicate routines
+ * (`#sessionMessagesReferToSameTurn` + `#messageValueSignature`) that
+ * reconstructed the branch path on every check (O(n²) `unshift`) and
+ * `JSON.stringify`-compared the full message content on every pairwise hit.
+ * Long-running sessions with many subagents fired this thousands of times per
+ * minute and froze the TUI loop (see issue #3629). The persistence key already
+ * encodes a stable logical identity — timestamp + role-specific discriminators
+ * — so the structural compare is now the rare collision tiebreaker (e.g. two
+ * provider responses at the same millisecond with `undefined` responseId),
+ * not the load-bearing check.
+ *
+ * The helpers here keep that identity in one place and expose the planner so
+ * the persistence-ordering logic is unit-testable without standing up an
+ * `AgentSession`.
+ */
+import type { AgentMessage } from "@oh-my-pi/pi-agent-core";
+
+/**
+ * Stable identity for messages that pass through {@link AgentSession}'s
+ * incremental persistence path.
+ *
+ * The discriminators chosen per role are precisely the fields that uniquely
+ * identify a single logical message instance:
+ *
+ * - `assistant` — timestamp + provider + model + responseId + stopReason
+ *   (responseId is the canonical provider-side id when available; the rest
+ *   disambiguate when it is not, e.g. local/dev models).
+ * - `toolResult` — timestamp + toolCallId + toolName (toolCallId is unique
+ *   per execution; toolName guards against synthetic reuse).
+ * - `user` / `developer` — timestamp + attribution (attribution distinguishes
+ *   user-typed vs hook-injected at the same wall-clock millisecond).
+ * - `fileMention` — timestamp.
+ *
+ * Returns `undefined` for message roles that are not persisted through this
+ * path (e.g. `hookMessage`, `custom`, `bashExecution`) — those follow other
+ * append paths in `SessionManager`.
+ */
+export function sessionMessagePersistenceKey(message: AgentMessage): string | undefined {
+	switch (message.role) {
+		case "assistant":
+			return [
+				"assistant",
+				message.timestamp,
+				message.provider,
+				message.model,
+				message.responseId ?? "",
+				message.stopReason,
+			].join(":");
+		case "toolResult":
+			return `toolResult:${message.timestamp}:${message.toolCallId}:${message.toolName}`;
+		case "user":
+		case "developer":
+			return `${message.role}:${message.timestamp}:${message.attribution ?? ""}`;
+		case "fileMention":
+			return `fileMention:${message.timestamp}`;
+		default:
+			return undefined;
+	}
+}
+
+/**
+ * Slow-path content equality check used when two messages collide on
+ * {@link sessionMessagePersistenceKey}. Only the role's content fields are
+ * compared (no timestamps, no metadata) because the key already pinned all of
+ * those down.
+ *
+ * Most calls into the persistence path never reach this — keys are unique
+ * enough in production that the snapshot lookup short-circuits at the key
+ * level. Restoring the structural compare here preserves the pre-#3629
+ * contract that two messages with the same metadata BUT different content are
+ * distinct (e.g. two assistant turns with `undefined` responseId emitted in
+ * the same wall-clock millisecond, which is exactly how the in-memory test
+ * harness crafts streamed responses).
+ */
+export function sameMessageContent(left: AgentMessage, right: AgentMessage): boolean {
+	if (left === right) return true;
+	if (left.role !== right.role) return false;
+	// `JSON.stringify` is the slow-path serializer here on purpose: nothing on
+	// the hot persistence-check path reaches it (key lookup short-circuits
+	// first), so a stable lexicographic compare beats hand-rolling structural
+	// equality for content arrays that mix text / tool blocks / file refs.
+	const leftRaw = left.role === "fileMention" ? left.files : "content" in left ? left.content : undefined;
+	const rightRaw = right.role === "fileMention" ? right.files : "content" in right ? right.content : undefined;
+	if (leftRaw === undefined || rightRaw === undefined) return false;
+	return (JSON.stringify(leftRaw) ?? "undefined") === (JSON.stringify(rightRaw) ?? "undefined");
+}
+
+/**
+ * Outcome of {@link planTurnPersistence}.
+ *
+ * `ok` lists the turn-message indices that still need to be appended (in
+ * order). `out-of-order` reports the first message whose later sibling is
+ * already persisted — the caller bails so it does not silently splice a
+ * stale message between newer entries on the live branch.
+ */
+export type TurnPersistencePlan =
+	| { kind: "ok"; toPersist: readonly number[] }
+	| { kind: "out-of-order"; messageIndex: number };
+
+/**
+ * Decide what to do with a turn's messages relative to what's already on the
+ * branch, in a single pass over the pre-computed keys.
+ *
+ * @param turnKeys persistence keys for each turn message, in the order the
+ *   agent loop emitted them. `undefined` slots represent messages with no
+ *   persistence key (skipped silently).
+ * @param persistedKeys the snapshot of persistence keys currently on the
+ *   branch (built once per call from {@link sessionMessagePersistenceKey} for
+ *   each persisted message entry).
+ *
+ * The check is O(n²) over turn messages — but `n` here is the size of one
+ * turn (a handful of tool results), not the size of the branch. That's the
+ * point of this refactor: the expensive O(branch) work happens exactly once,
+ * inside the caller's snapshot loop, not per-comparison.
+ */
+export function planTurnPersistence(
+	turnKeys: readonly (string | undefined)[],
+	persistedKeys: ReadonlySet<string>,
+): TurnPersistencePlan {
+	const toPersist: number[] = [];
+	for (let index = 0; index < turnKeys.length; index++) {
+		const key = turnKeys[index];
+		// Slots without a persistence key (non-persistent roles like `custom` /
+		// `hookMessage`) take other branches in `SessionManager` — they are not
+		// our responsibility to append, and they cannot violate ordering because
+		// they have no identity on the branch.
+		if (key === undefined) continue;
+		if (persistedKeys.has(key)) continue;
+		for (let later = index + 1; later < turnKeys.length; later++) {
+			const laterKey = turnKeys[later];
+			if (laterKey !== undefined && persistedKeys.has(laterKey)) {
+				return { kind: "out-of-order", messageIndex: index };
+			}
+		}
+		toPersist.push(index);
+	}
+	return { kind: "ok", toPersist };
+}

package/src/session/unexpected-stop-classifier.ts

@@ -64,10 +64,10 @@ export async function classifyUnexpectedStop(
 }
 
 async function classifyOnline(text: string, deps: ClassifyUnexpectedStopDeps): Promise<boolean | undefined> {
-	const resolved = resolveRoleSelection(["smol"], deps.settings, deps.registry.getAvailable(), deps.registry);
+	const resolved = resolveRoleSelection(["tiny", "smol"], deps.settings, deps.registry.getAvailable(), deps.registry);
 	const model = resolved?.model;
 	if (!model) {
-		throw new Error("unexpected-stop: no smol model available for classification");
+		throw new Error("unexpected-stop: no tiny/smol model available for classification");
 	}
 	const apiKey = await deps.registry.getApiKey(model, deps.sessionId);
 	if (!apiKey) {

package/src/slash-commands/builtin-registry.ts

@@ -438,16 +438,18 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 		name: "advisor",
 		description: "Toggle the advisor (a second model that reviews each turn and injects notes)",
 		acpDescription: "Toggle advisor",
-		acpInputHint: "[on|off|status|dump [raw]]",
+		acpInputHint: "[on|off|status|dump [raw]|configure]",
 		subcommands: [
 			{ name: "on", description: "Enable the advisor" },
 			{ name: "off", description: "Disable the advisor" },
 			{ name: "status", description: "Show advisor status" },
 			{ name: "dump", description: "Copy the advisor's transcript to clipboard", usage: "[raw]" },
+			{ name: "configure", description: "Open the advisor configuration editor (TUI)" },
 		],
 		allowArgs: true,
 		getTuiAutocompleteDescription: runtime => {
 			const stats = runtime.ctx.session.getAdvisorStats();
+			if (stats.active && stats.advisors.length > 1) return `Advisor: on (${stats.advisors.length} advisors)`;
 			if (stats.active && stats.model) return `Advisor: on (${stats.model.provider}/${stats.model.id})`;
 			if (stats.configured) return "Advisor: configured, no model";
 			return "Advisor: off";
@@ -488,7 +490,13 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 				await runtime.output(text ?? "Advisor is not active for this session.");
 				return commandConsumed();
 			}
-			return usage("Usage: /advisor [on|off|status|dump [raw]]", runtime);
+			if (verb === "configure") {
+				await runtime.output(
+					"/advisor configure opens an interactive editor and is only available in the interactive TUI.",
+				);
+				return commandConsumed();
+			}
+			return usage("Usage: /advisor [on|off|status|dump [raw]|configure]", runtime);
 		},
 		handleTui: async (command, runtime) => {
 			const { verb, rest } = parseSubcommand(command.args);
@@ -533,7 +541,12 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 				runtime.ctx.editor.setText("");
 				return;
 			}
-			runtime.ctx.showStatus("Usage: /advisor [on|off|status|dump [raw]]");
+			if (verb === "configure") {
+				runtime.ctx.showAdvisorConfigure();
+				runtime.ctx.editor.setText("");
+				return;
+			}
+			runtime.ctx.showStatus("Usage: /advisor [on|off|status|dump [raw]|configure]");
 			runtime.ctx.editor.setText("");
 		},
 	},

package/src/slash-commands/helpers/mcp.ts

@@ -1,3 +1,4 @@
+import * as AIError from "@oh-my-pi/pi-ai/error";
 import { getMCPConfigPath, logger } from "@oh-my-pi/pi-utils";
 import { connectToServer, disconnectServer, listPrompts, listResources, listTools } from "../../mcp/client";
 import {
@@ -350,7 +351,7 @@ async function handleSmitherySearchCommand(rest: string, runtime: SlashCommandRu
 		return commandConsumed();
 	} catch (err) {
 		const message = errorMessage(err);
-		if (/401|403|unauthorized|forbidden/i.test(message)) {
+		if (AIError.is(AIError.classify(err), AIError.Flag.AuthFailed)) {
 			return usage(
 				"Smithery authentication required. Run /mcp smithery-login in the TUI client or add an API key to ~/.omp/agent/smithery.json.",
 				runtime,

package/src/ssh/__tests__/connection-manager-args.test.ts

@@ -2,7 +2,18 @@ import { describe, expect, it } from "bun:test";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { getRemoteHostDir } from "@oh-my-pi/pi-utils";
-import { buildRemoteCommand, getHostInfo, type SSHConnectionTarget, type SSHHostShell } from "../connection-manager";
+import {
+	buildRemoteCommand,
+	extractProbePayload,
+	findProbeMarker,
+	getHostInfo,
+	HOST_PROBE_MARKER,
+	osFromUname,
+	parseHostInfo,
+	type SSHConnectionTarget,
+	type SSHHostShell,
+	TRANSFER_PROBE_MARKER,
+} from "../connection-manager";
 import { buildSshTarget, sanitizeHostName } from "../utils";
 
 const TARGET: SSHConnectionTarget = { name: "h", host: "h" };
@@ -67,3 +78,114 @@ describe("ssh host shell classification", () => {
 		}
 	});
 });
+
+describe("extractProbePayload (host probe framing)", () => {
+	it("returns the text after the first marker line, ignoring login banners", async () => {
+		// Real-world failure shape: noisy dotfiles print a banner before the
+		// echo we asked for, so the legacy first-line parser would have read
+		// `Last login: ...` and classified the host as unknown (#3719).
+		const stdout = [
+			"Last login: Wed Mar 19 09:14:22 2025 from 10.0.0.1",
+			"Welcome to fancybox 1.0",
+			`${HOST_PROBE_MARKER}linux-gnu|/bin/bash|5.2.21`,
+		].join("\n");
+		expect(extractProbePayload(stdout, "")).toBe("linux-gnu|/bin/bash|5.2.21");
+	});
+
+	it("falls back to stderr when the payload only shows up there", async () => {
+		// Some shells redirect every echo to stderr after a dotfile error; the
+		// parser needs to recover the marker line from either stream.
+		const stderr = `noise\n${HOST_PROBE_MARKER}darwin|/bin/zsh|\n`;
+		expect(extractProbePayload("", stderr)).toBe("darwin|/bin/zsh|");
+	});
+
+	it("returns null when no marker line is present", async () => {
+		expect(extractProbePayload("just login banner\n", "and stderr noise\n")).toBeNull();
+	});
+});
+
+describe("findProbeMarker (transfer-shell probe recovery)", () => {
+	it("returns the tail after the marker when it appears in stdout", () => {
+		// Happy path: `sh -lc 'printf "PI_TRANSFER_OK|"; uname -s'` lands in
+		// stdout. The tail is the uname output the caller uses to refine OS.
+		const stdout = `${TRANSFER_PROBE_MARKER}Linux\n`;
+		expect(findProbeMarker(stdout, "", TRANSFER_PROBE_MARKER)).toBe("Linux\n");
+	});
+
+	it("falls back to stderr when a broken dotfile swaps fd 1/2", () => {
+		// Some remotes have dotfiles that redirect every shell write to stderr.
+		// The transfer probe must still recognize the marker so ssh:// doesn't
+		// refuse a POSIX-capable host (#3722 review).
+		const stderr = `dotfile noise\n${TRANSFER_PROBE_MARKER}Darwin\n`;
+		expect(findProbeMarker("", stderr, TRANSFER_PROBE_MARKER)).toBe("Darwin\n");
+	});
+
+	it("prefers stdout over stderr when the marker is in both", () => {
+		// Order matters: stdout is the canonical path, stderr is the rescue.
+		// A reordering bug would silently use stale stderr fragments first.
+		const stdout = `${TRANSFER_PROBE_MARKER}Linux`;
+		const stderr = `${TRANSFER_PROBE_MARKER}stale`;
+		expect(findProbeMarker(stdout, stderr, TRANSFER_PROBE_MARKER)).toBe("Linux");
+	});
+
+	it("returns null when the marker is in neither stream", () => {
+		expect(findProbeMarker("noise", "more noise", TRANSFER_PROBE_MARKER)).toBeNull();
+	});
+});
+
+describe("osFromUname (transfer-shell probe OS recovery)", () => {
+	it("classifies common POSIX uname payloads", () => {
+		// The markerless host-info fallback uses the transfer-shell probe's
+		// uname output to avoid returning a durable `os: "unknown"` when csh/tcsh
+		// killed the first marker probe before it could echo anything (#3722 review).
+		expect(osFromUname("Linux")).toBe("linux");
+		expect(osFromUname("GNU/Linux")).toBe("linux");
+		expect(osFromUname("Darwin")).toBe("macos");
+	});
+
+	it("classifies Windows compat unames as windows so ssh:// still refuses them", () => {
+		expect(osFromUname("MINGW64_NT-10.0")).toBe("windows");
+		expect(osFromUname("MSYS_NT-10.0")).toBe("windows");
+		expect(osFromUname("CYGWIN_NT-10.0")).toBe("windows");
+	});
+
+	it("returns undefined when uname is not recognized", () => {
+		expect(osFromUname("")).toBeUndefined();
+		expect(osFromUname("SunOS")).toBeUndefined();
+	});
+});
+
+describe("parseHostInfo transferShell handling", () => {
+	it("round-trips a verified transferShell value", () => {
+		// Cache writers persist `transferShell` so callers don't re-probe
+		// every session; parseHostInfo must thread it back through (#3719).
+		const parsed = parseHostInfo({
+			version: 4,
+			os: "linux",
+			shell: "unknown",
+			transferShell: "bash",
+			compatEnabled: false,
+		});
+		expect(parsed?.transferShell).toBe("bash");
+	});
+
+	it("drops a transferShell value outside the sh/bash/zsh allowlist", () => {
+		// Anything we couldn't have probed (fish, csh, garbage) must not slip
+		// into the cache and bypass the ssh:// transfer guard.
+		const parsed = parseHostInfo({
+			version: 4,
+			os: "linux",
+			shell: "sh",
+			transferShell: "fish",
+			compatEnabled: false,
+		});
+		expect(parsed?.transferShell).toBeUndefined();
+	});
+
+	it("returns transferShell undefined when the field is missing", () => {
+		// A pre-v4 cache file lacks transferShell entirely; the parsed value
+		// must be undefined so shouldRefreshHostInfo treats it as stale.
+		const parsed = parseHostInfo({ version: 3, os: "linux", shell: "sh", compatEnabled: false });
+		expect(parsed?.transferShell).toBeUndefined();
+	});
+});

package/src/ssh/__tests__/file-transfer-posix-guard.test.ts

@@ -1,7 +1,7 @@
 import { afterEach, describe, expect, it, vi } from "bun:test";
 import type { SSHConnectionTarget } from "../connection-manager";
 import * as connectionManager from "../connection-manager";
-import { readRemoteFile, writeRemoteFile } from "../file-transfer";
+import { listRemoteDir, readRemoteFile, statRemotePath, writeRemoteFile } from "../file-transfer";
 
 describe("ssh file-transfer POSIX guard", () => {
 	afterEach(() => {
@@ -13,7 +13,7 @@ describe("ssh file-transfer POSIX guard", () => {
 		// without opening a real SSH connection and before any command is spawned.
 		const ensureConnectionSpy = vi.spyOn(connectionManager, "ensureConnection").mockResolvedValue(undefined);
 		const ensureHostInfoSpy = vi.spyOn(connectionManager, "ensureHostInfo").mockResolvedValue({
-			version: 2,
+			version: 4,
 			os: "windows",
 			shell: "powershell",
 			compatEnabled: false,
@@ -27,42 +27,79 @@ describe("ssh file-transfer POSIX guard", () => {
 		expect(ensureHostInfoSpy).toHaveBeenCalled();
 	});
 
-	it("rejects a non-POSIX login shell (csh/tcsh/fish classify as non-sh) before any transfer", async () => {
-		// csh/tcsh history-expand `!`, and fish can't parse our POSIX source; all
-		// classify as a non-sh shell, so the guard must refuse them before any spawn.
+	it("rejects a non-Windows remote with no verified transferShell", async () => {
+		// No transferShell means the capability probe never confirmed any of
+		// sh/bash/zsh works. The guard refuses regardless of `shell` because the
+		// real ssh:// contract is "did we verify a POSIX shell works", not
+		// "what name did the login shell self-report" (#3719).
 		vi.spyOn(connectionManager, "ensureConnection").mockResolvedValue(undefined);
 		vi.spyOn(connectionManager, "ensureHostInfo").mockResolvedValue({
-			version: 3,
+			version: 4,
 			os: "linux",
 			shell: "unknown",
 			compatEnabled: false,
 		});
-		const target: SSHConnectionTarget = { name: "fishbox", host: "fishbox" };
-		await expect(readRemoteFile(target, "/etc/hosts", { maxBytes: 1024 })).rejects.toThrow(/non-POSIX login shell/);
-		await expect(writeRemoteFile(target, "/tmp/x", new Uint8Array([1]), {})).rejects.toThrow(/non-POSIX login shell/);
+		const target: SSHConnectionTarget = { name: "noshell", host: "noshell" };
+		await expect(readRemoteFile(target, "/etc/hosts", { maxBytes: 1024 })).rejects.toThrow(/no verified POSIX shell/);
+		await expect(writeRemoteFile(target, "/tmp/x", new Uint8Array([1]), {})).rejects.toThrow(
+			/no verified POSIX shell/,
+		);
 	});
 
-	it("allows a POSIX login shell (sh/bash/zsh) to run the transfer commands directly", async () => {
-		// A POSIX login shell runs our snippets verbatim; the guard must let it through.
-		// Reject at buildRemoteCommand to capture the command before any real ssh spawn.
+	it("dispatches transfer commands through the verified transferShell, not the login shell", async () => {
+		// The bug fix: if the login shell is fish/csh/tcsh, the legacy guard
+		// would refuse the host — but allowing it isn't enough on its own.
+		// OpenSSH still hands our snippets to `$SHELL -c`, so a fish login
+		// shell would choke on `if [ … ]; then …`. Every transfer command
+		// must be wrapped in `<transferShell> -c '…'` to force parsing
+		// under the shell we verified can run it (#3719).
 		vi.spyOn(connectionManager, "ensureConnection").mockResolvedValue(undefined);
 		vi.spyOn(connectionManager, "ensureHostInfo").mockResolvedValue({
-			version: 3,
+			version: 4,
 			os: "linux",
-			shell: "sh",
+			// Login shell is fish; only `transferShell` indicates a working POSIX shell.
+			shell: "unknown",
+			transferShell: "bash",
 			compatEnabled: false,
 		});
 		const buildSpy = vi
 			.spyOn(connectionManager, "buildRemoteCommand")
 			.mockRejectedValue(new Error("stop-before-spawn"));
-		const target: SSHConnectionTarget = { name: "shbox", host: "shbox" };
+		const target: SSHConnectionTarget = { name: "fishbox", host: "fishbox" };
 
 		await expect(readRemoteFile(target, "/etc/hosts", { maxBytes: 1024 })).rejects.toThrow(/stop-before-spawn/);
 		await expect(writeRemoteFile(target, "/tmp/x", new Uint8Array([1]), {})).rejects.toThrow(/stop-before-spawn/);
+		await expect(statRemotePath(target, "/etc/hosts")).rejects.toThrow(/stop-before-spawn/);
+		await expect(listRemoteDir(target, "/etc")).rejects.toThrow(/stop-before-spawn/);
 
-		// Reached buildRemoteCommand → the guard allowed the POSIX shell. Commands are
-		// sent verbatim (no `sh -c` wrapper); write keeps its stdin staging.
-		expect(buildSpy.mock.calls[0]?.[1]).toContain("head -c 1025");
+		// Each dispatch must start with `bash -c '…'` and embed the original
+		// POSIX snippet inside the quoted command. Read also drops `-n`
+		// (allowStdin: true) because cat-staging needs stdin streaming.
+		const dispatches = buildSpy.mock.calls.map(call => call[1] as string);
+		expect(dispatches[0]).toMatch(/^bash -c '.*head -c 1025/);
+		expect(dispatches[1]).toMatch(/^bash -c '.*cat > /);
 		expect(buildSpy.mock.calls[1]?.[2]).toMatchObject({ allowStdin: true });
+		expect(dispatches[2]).toMatch(/^bash -c '.*if \[ -d /);
+		expect(dispatches[3]).toMatch(/^bash -c '.*LC_ALL=C ls -1Ap /);
+	});
+
+	it("uses sh -c when transferShell is sh (the most universal POSIX fallback)", async () => {
+		// Belt-and-suspenders: the common happy path with a sh-family login
+		// shell still routes through `sh -c` to keep one dispatch shape.
+		vi.spyOn(connectionManager, "ensureConnection").mockResolvedValue(undefined);
+		vi.spyOn(connectionManager, "ensureHostInfo").mockResolvedValue({
+			version: 4,
+			os: "linux",
+			shell: "sh",
+			transferShell: "sh",
+			compatEnabled: false,
+		});
+		const buildSpy = vi
+			.spyOn(connectionManager, "buildRemoteCommand")
+			.mockRejectedValue(new Error("stop-before-spawn"));
+		const target: SSHConnectionTarget = { name: "shbox", host: "shbox" };
+
+		await expect(readRemoteFile(target, "/etc/hosts", { maxBytes: 1024 })).rejects.toThrow(/stop-before-spawn/);
+		expect(buildSpy.mock.calls[0]?.[1]).toMatch(/^sh -c '.*head -c 1025/);
 	});
 });