@tiphareth/dsh-hardssh 0.1.2 → 0.2.3

package/lib/fs.js

@@ -1,478 +1,395 @@
-import { i as shellQuote, o as isPathUnderAnchor } from "./environment-BL1jddfB.js";
-import { n as SwitchFileSystem, r as WFS_NAMESPACE_MARKER } from "./switch-fs-RrZtG2gv.js";
-import { createHash, randomUUID } from "node:crypto";
-import { posix } from "node:path";
-import { FileSystem, FsError, FsTargetKey, FsVersion } from "@deepseek-ai/dsh-fs";
+import { i as isPathUnderAnchor } from "./ledger-D2ezq1iW.js";
+import { t as anchorRoot } from "./ledger-B-LXlftp.js";
+import { n as legacyVaultPath, r as vaultDirectory } from "./vault-3gpWct2Q.js";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { FileSystem, FsError } from "@deepseek-ai/dsh-fs";
 import { SandboxedFileSystem } from "@deepseek-ai/dsh-fs-sandbox";
-//#region src/remote/remote-fs.ts
-/**
-* Remote filesystem provider for the `ctx.fs` capability seam: paths,
-* contents, and atomic staging files live on the remote host, reached through
-* the dsh-ssh engine's SFTP/exec primitives. Ported and adapted from
-* UynajGI/dsh-ssh (MIT, https://github.com/UynajGI/dsh-ssh) — the seam
-* contract (targets, versions, atomic writes, CRLF handling, canonical path
-* transport) is preserved; the connection owner is replaced by the shared
-* SshEngine and the working directory follows the mode store's remote root.
-*
-* @module dsh-hardssh/remote-fs
-*/
-const BINARY_SAMPLE_BYTES = 8192;
-const BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
-function assertNotAborted(signal, operation) {
-	if (signal?.aborted === true) throw new FsError(`${operation} aborted`, "FS_ABORTED");
+/** Strict WFS key prefix (includes the double slash + separator). */
+const WFS_NAMESPACE_MARKER = `wfs://`;
+function normalizeForEquality(path) {
+	return path.replace(/\\/g, "/").replace(/\/+$/, "");
 }
-function normalizeLineEndings(value) {
-	return value.replaceAll("\r\n", "\n");
+/** Whether `path` is `root` itself or under it. Case-folding is applied ONLY
+*  when the root is a Windows-style path (drive letter) — no OS guessing. */
+function isUnder(root, path) {
+	if (root === void 0 || root === "") return false;
+	const r = normalizeForEquality(root);
+	const p = normalizeForEquality(path);
+	const fold = /^[a-zA-Z]:\//.test(r);
+	const nr = fold ? r.toLowerCase() : r;
+	const np = fold ? p.toLowerCase() : p;
+	return np === nr || np.startsWith(nr + "/");
 }
-function detectsCrlf(value) {
-	const sample = value.slice(0, 4096);
-	const crlf = sample.split("\r\n").length - 1;
-	return crlf > sample.split("\n").length - 1 - crlf;
+/** Membership test for a REMOTE world. Default: EVERYTHING routes remote —
+*   a bound session's work lives on the server (including absolute paths
+*   outside the workspace tree, e.g. another project dir on that host).
+*   The ONLY exclusion is the DECLARED client infrastructure (`localRoots`:
+*   dsh's own `~/.dsh` with skills + harness state, plugin configs, …),
+*   which stays local on any client OS. `localRootExclusions` subtract the
+*   workspace-anchor window from that exception, because anchors physically
+*   live under `~/.dsh` and must never be treated as local. No host-OS
+*   syntax guessing. */
+function belongsToRemoteWorld(path, deps) {
+	if (deps.localRootExclusions?.some((root) => isUnder(root, path)) === true) return true;
+	if (deps.localRoots !== void 0 && deps.localRoots.some((root) => isUnder(root, path))) return false;
+	return true;
 }
-function restoreLineEndings(value, crlf) {
-	return crlf ? normalizeLineEndings(value).replaceAll("\n", "\r\n") : value;
-}
-function decodeText(bytes, displayPath) {
-	if (bytes.subarray(0, BINARY_SAMPLE_BYTES).includes(0)) throw new FsError(`cannot read "${displayPath}": binary file`, "FS_NOT_TEXT");
-	try {
-		return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-	} catch (error) {
-		throw new FsError(`cannot read "${displayPath}": invalid UTF-8 text`, "FS_NOT_TEXT", { cause: error });
+/** The routing filesystem facade. */
+var SwitchFileSystem = class extends FileSystem {
+	deps;
+	local;
+	constructor(ctx, deps) {
+		super(ctx);
+		this.deps = deps;
+		this.local = deps.local;
 	}
-}
-/** Decode a base64-wrapped NUL-terminated canonical path from `realpath -mz`. */
-function decodeCanonicalPath(encoded) {
-	if (encoded.length === 0 || !BASE64.test(encoded)) throw new Error("fs-ssh: canonical path transport returned invalid base64");
-	const framed = Buffer.from(encoded, "base64");
-	if (framed.toString("base64") !== encoded || framed.length < 2 || framed.at(-1) !== 0 || framed.subarray(0, -1).includes(0)) throw new Error("fs-ssh: canonical path transport returned invalid NUL framing");
-	let path;
-	try {
-		path = new TextDecoder("utf-8", { fatal: true }).decode(framed.subarray(0, -1));
-	} catch (error) {
-		throw new Error("fs-ssh: canonical path is not valid UTF-8", { cause: error });
+	/** The deployment's local backend is still a sandboxed filesystem, and
+	*  `dsh-tool-fs` reads this capability fact ONCE at apply() to decide whether
+	*  to advertise `sandbox_permissions` / `justification` at all. Returning
+	*  undefined here disabled that escalation entry for EVERY session,
+	*  including purely local ones, so the local backend's mode is the honest
+	*  answer. Remote worlds are not confined by the local sandbox, so a wider
+	*  per-call policy is meaningless for them and is dropped at the call site
+	*  instead of being silently swallowed by a 4-parameter remote backend. */
+	get sandboxMode() {
+		return this.local.sandboxMode;
 	}
-	if (!posix.isAbsolute(path)) throw new Error("fs-ssh: canonical path is not absolute");
-	return path;
-}
-function entryType(stats) {
-	if (stats.isFile()) return "file";
-	if (stats.isDirectory()) return "directory";
-	return "other";
-}
-function entryVersion(stats, path) {
-	return FsVersion(`ssh:${createHash("sha256").update(JSON.stringify([
-		path,
-		stats.size,
-		stats.mtime,
-		stats.mode
-	])).digest("hex")}`);
-}
-function mapError(error, operation, displayPath, signal) {
-	if (error instanceof FsError) return error;
-	if (signal?.aborted === true) return new FsError(`${operation} aborted`, "FS_ABORTED", { cause: error });
-	const code = String(error.code ?? "");
-	const message = String(error);
-	if (/NO_SUCH_FILE|ENOENT|no such file|does not exist/i.test(`${code} ${message}`)) return new FsError(`cannot ${operation} "${displayPath}": not found`, "FS_NOT_FOUND", { cause: error });
-	if (/PERMISSION_DENIED|EACCES|permission denied/i.test(`${code} ${message}`)) return new FsError(`cannot ${operation} "${displayPath}": permission denied`, "FS_PERMISSION_DENIED", { cause: error });
-	return new FsError(`cannot ${operation} "${displayPath}": ${message}`, "FS_IO_ERROR", { cause: error });
-}
-function literalEdit(content, request, displayPath) {
-	const oldString = normalizeLineEndings(request.oldString);
-	const newString = normalizeLineEndings(request.newString);
-	if (oldString.length === 0) throw new FsError(`cannot edit "${displayPath}": old_string must be non-empty`, "FS_EDIT_NOT_FOUND");
-	let matches = 0;
-	let offset = 0;
-	while (true) {
-		const found = content.indexOf(oldString, offset);
-		if (found < 0) break;
-		matches += 1;
-		offset = found + oldString.length;
+	/** Encode a raw key into the world's namespace. */
+	encode(rawKey, namespace) {
+		return namespace === "" ? rawKey : `${namespace}${rawKey}`;
 	}
-	if (matches === 0) throw new FsError(`cannot edit "${displayPath}": old_string was not found`, "FS_EDIT_NOT_FOUND");
-	if (!request.replaceAll && matches !== 1) throw new FsError(`cannot edit "${displayPath}": old_string matched ${matches} times`, "FS_AMBIGUOUS_EDIT");
-	return request.replaceAll ? content.split(oldString).join(newString) : content.replace(oldString, newString);
-}
-/** Whether one SFTP/exec error means "path absent". */
-function isNotFound(error) {
-	const code = String(error.code ?? "");
-	const message = String(error);
-	return /NO_SUCH_FILE|ENOENT|no such file|does not exist/i.test(`${code} ${message}`);
-}
-/**
-* Remote filesystem backend over the dsh-ssh engine. The working directory
-* follows the mode store: relative paths resolve against the resolved remote
-* root; a POSIX-absolute cwd override is honored; local (Windows) cwds are
-* ignored so the model's relative-path habit keeps working remotely.
-*/
-var SshFileSystem = class extends FileSystem {
-	engine;
-	getState;
-	locks = /* @__PURE__ */ new Map();
-	constructor(ctx, engine, getState) {
-		super(ctx);
-		this.engine = engine;
-		this.getState = getState;
-	}
-	/** The active remote execution world (throws when not in remote mode). */
-	current() {
-		const state = this.getState();
-		if (state.mode !== "remote" || state.alias === void 0) throw new FsError("not in remote mode — switch the GUI to SSH mode first", "FS_IO_ERROR");
-		if (state.remoteRoot === void 0) throw new FsError("remote workspace root is not set", "FS_IO_ERROR");
+	/** Decode a namespaced key back to (rawKey, world). Supports both the
+	*  current `wfs://<id>/…` form and the legacy `ssh:<recordId>:…` form. */
+	decode(key) {
+		if (key.startsWith(WFS_NAMESPACE_MARKER)) {
+			const rest = key.slice(WFS_NAMESPACE_MARKER.length);
+			const end = rest.indexOf("/");
+			if (end > 0) {
+				const namespace = `wfs://${rest.slice(0, end + 1)}`;
+				const world = this.deps.worldForNamespace(namespace);
+				if (world !== void 0) return {
+					rawKey: rest.slice(end + 1),
+					world
+				};
+			}
+			return;
+		}
+		if (key.startsWith("ssh:")) {
+			const end = key.indexOf(":", 4);
+			if (end > 0) {
+				const namespace = key.slice(0, end + 1);
+				const world = this.deps.worldForNamespace(namespace);
+				if (world !== void 0) return {
+					rawKey: key.slice(namespace.length),
+					world
+				};
+			}
+			return;
+		}
+		this.assertNotDenied(key, "");
 		return {
-			alias: state.alias,
-			remoteRoot: state.remoteRoot
+			rawKey: key,
+			world: {
+				backend: this.local,
+				namespace: ""
+			}
 		};
 	}
 	/**
-	* Resolve the working directory for a path: a POSIX-absolute cwd wins;
-	* anything else (relative or a local Windows path) falls back to the
-	* remote root.
+	* Refuse a protected client directory before any backend sees it.
+	*
+	* Only a LOCAL world is checked: for a remote world the path is a path on the
+	* SERVER, which may legitimately look like a client path (both can be
+	* `/home/me/.dsh/…`).
+	*
+	* @param path - the path (or canonical target key) about to be dispatched.
+	* @param namespace - the resolved world's namespace ('' = local).
 	*/
-	resolveRemoteCwd(cwd) {
-		if (cwd !== void 0 && posix.isAbsolute(cwd)) return cwd;
-		return this.current().remoteRoot;
+	assertNotDenied(path, namespace) {
+		if (namespace !== "") return;
+		if (this.deps.deniedRoots?.find((root) => isUnder(root, path)) !== void 0) throw new Error(`fs-hardssh: '${path}' is not accessible through the workspace filesystem (protected client directory)`);
+	}
+	/**
+	* The world owning one call: an explicit anchor path (this workspace's or a
+	* SIBLING's) wins over the session cwd, because anchors are physically under
+	* the local-infrastructure root and would otherwise be carved out as local.
+	* Falls back to the session cwd's world, then to the caller's default.
+	*/
+	worldForPath(path, cwd) {
+		const anchorWorld = this.deps.worldForAnchorPath?.(path);
+		if (anchorWorld !== void 0) {
+			this.assertNotDenied(path, anchorWorld.namespace);
+			return anchorWorld;
+		}
+		const pathWorld = this.deps.worldFor(path);
+		if (pathWorld.namespace !== "" && pathWorld.anchorPath !== void 0 && pathWorld.remoteRoot !== void 0) return pathWorld;
+		const chosen = this.deps.worldFor(cwd);
+		this.assertNotDenied(path, chosen.namespace);
+		return chosen;
 	}
 	async resolve(path, opts) {
-		assertNotAborted(opts?.signal, "resolve");
-		if (path.trim().length === 0) throw new FsError("file_path must be a non-empty string", "FS_NOT_FOUND");
-		const displayPath = posix.resolve(this.resolveRemoteCwd(opts?.cwd), path);
-		try {
-			const targetKey = await this.canonicalPath(displayPath, opts?.signal);
-			assertNotAborted(opts?.signal, "resolve");
+		const world = this.worldForPath(path, opts?.cwd);
+		const effectivePath = world.anchorPath !== void 0 && world.remoteRoot !== void 0 ? this.translateAnchorPath(world.anchorPath, world.remoteRoot, path) : path;
+		if (world.namespace !== "" && !belongsToRemoteWorld(effectivePath, this.deps)) {
+			this.assertNotDenied(path, "");
+			const raw = await this.local.resolve(path, opts);
 			return {
-				targetKey: FsTargetKey(targetKey),
-				displayPath
+				targetKey: String(raw.targetKey),
+				displayPath: raw.displayPath
 			};
-		} catch (error) {
-			throw mapError(error, "resolve", displayPath, opts?.signal);
 		}
+		const raw = await world.backend.resolve(effectivePath, opts);
+		return {
+			targetKey: this.encode(String(raw.targetKey), world.namespace),
+			displayPath: raw.displayPath
+		};
+	}
+	/** Rewrite `<anchor>/<rest>` to `<remoteRoot>/<rest>` when `path` is the
+	*  anchor or under it; otherwise return `path` unchanged (remote absolute
+	*  paths, relative paths, and foreign local paths all pass through). */
+	translateAnchorPath(anchor, remoteRoot, path) {
+		const norm = (value) => value.replace(/[\\/]+$/, "");
+		const a = norm(anchor);
+		const isWin = a.includes("\\");
+		const normPath = (value) => {
+			let out = norm(value);
+			if (isWin) out = out.replace(/\//g, "\\");
+			return out;
+		};
+		const p = normPath(path);
+		const aa = isWin ? a.toLowerCase() : a;
+		const pp = isWin ? p.toLowerCase() : p;
+		if (pp === aa) return remoteRoot;
+		if (pp.startsWith(`${aa}\\`) || pp.startsWith(`${aa}/`)) {
+			const tail = p.slice(a.length).replace(/^[\\/]+/, "").replace(/\\/g, "/");
+			return tail === "" ? remoteRoot : `${remoteRoot.replace(/\/+$/, "")}/${tail}`;
+		}
+		return path;
 	}
 	processPath(target) {
-		return String(target.targetKey);
+		const decoded = this.decode(String(target.targetKey));
+		if (decoded === void 0) throw new Error("fs-ssh: cannot route stale workspace target");
+		return decoded.world.backend.processPath({
+			targetKey: decoded.rawKey,
+			displayPath: target.displayPath
+		});
 	}
 	fileUrl(target) {
-		const path = this.processPath(target);
-		if (!posix.isAbsolute(path)) throw new Error(`fs-ssh: expected an absolute process path: ${JSON.stringify(path)}`);
-		return `file://${path.split("/").map((segment) => encodeURIComponent(segment)).join("/")}`;
+		const decoded = this.decode(String(target.targetKey));
+		if (decoded === void 0) throw new Error("fs-ssh: cannot route stale workspace target");
+		return decoded.world.backend.fileUrl({
+			targetKey: decoded.rawKey,
+			displayPath: target.displayPath
+		});
 	}
 	contains(parent, child) {
-		const relative = posix.relative(this.processPath(parent), this.processPath(child));
-		return relative === "" || relative !== ".." && !relative.startsWith("../") && !posix.isAbsolute(relative);
+		const p = this.decode(String(parent.targetKey));
+		const c = this.decode(String(child.targetKey));
+		if (p === void 0 || c === void 0 || p.world.backend !== c.world.backend) return false;
+		return p.world.backend.contains({
+			targetKey: p.rawKey,
+			displayPath: parent.displayPath
+		}, {
+			targetKey: c.rawKey,
+			displayPath: child.displayPath
+		});
 	}
 	async stat(target, signal) {
-		assertNotAborted(signal, "stat");
-		const stats = await this.probe(String(target.targetKey), target.displayPath, signal);
-		if (stats === void 0) return void 0;
-		return {
-			version: entryVersion(stats, String(target.targetKey)),
-			type: entryType(stats),
-			...stats.isFile() ? { size: stats.size } : {}
-		};
+		const decoded = this.decode(String(target.targetKey));
+		if (decoded === void 0) return void 0;
+		return decoded.world.backend.stat({
+			targetKey: decoded.rawKey,
+			displayPath: target.displayPath
+		}, signal);
 	}
 	async lstat(path, opts, signal) {
-		assertNotAborted(signal, "lstat");
-		if (path.trim().length === 0) throw new FsError("file_path must be a non-empty string", "FS_NOT_FOUND");
-		const displayPath = posix.resolve(this.resolveRemoteCwd(opts?.cwd), path);
-		const { alias } = this.current();
-		try {
-			const info = await this.engine.lstat(alias, displayPath);
-			assertNotAborted(signal, "lstat");
-			if (info === void 0) return void 0;
-			const type = info.type === "symlink" ? "symlink" : info.type === "directory" ? "directory" : info.type === "file" ? "file" : "other";
-			return {
-				version: entryVersion(this.asStats({
-					type: info.type,
-					size: info.size,
-					mtimeMs: info.mtimeMs,
-					mode: info.mode
-				}), displayPath),
-				type,
-				...type === "file" ? { size: info.size } : {}
-			};
-		} catch (error) {
-			if (isNotFound(error)) return void 0;
-			throw mapError(error, "lstat", displayPath, signal);
+		const world = this.worldForPath(path, opts?.cwd);
+		const effectivePath = world.anchorPath !== void 0 && world.remoteRoot !== void 0 ? this.translateAnchorPath(world.anchorPath, world.remoteRoot, path) : path;
+		if (world.namespace !== "" && !belongsToRemoteWorld(effectivePath, this.deps)) {
+			this.assertNotDenied(path, "");
+			return this.local.lstat(path, opts, signal);
 		}
+		return world.backend.lstat(effectivePath, opts, signal);
 	}
 	async readText(target, signal) {
-		await this.requireRegular(target, signal);
-		const bytes = await this.readBytesRaw(target, signal, Number.POSITIVE_INFINITY);
-		assertNotAborted(signal, "read");
-		return decodeText(bytes, target.displayPath);
-	}
-	async readBytes(target, signal, maxBytes) {
-		const info = await this.requireRegular(target, signal);
-		if (info.size !== void 0 && info.size > maxBytes) throw new FsError(`cannot read "${target.displayPath}": ${info.size} bytes exceeds the ${maxBytes}-byte limit`, "FS_TOO_LARGE");
-		const bytes = await this.readBytesRaw(target, signal, maxBytes);
-		assertNotAborted(signal, "read");
-		return bytes;
+		const decoded = this.decode(String(target.targetKey));
+		if (decoded === void 0) throw new Error("fs-ssh: cannot route target");
+		return decoded.world.backend.readText({
+			targetKey: decoded.rawKey,
+			displayPath: target.displayPath
+		}, signal);
 	}
 	async streamText(target, signal) {
-		await this.requireRegular(target, signal);
-		const { alias } = this.current();
-		const displayPath = target.displayPath;
-		const stream = await this.engine.readStream(alias, String(target.targetKey));
-		return { async *[Symbol.asyncIterator]() {
-			const decoder = new TextDecoder("utf-8", { fatal: true });
-			let sampledBytes = 0;
-			try {
-				for await (const chunk of stream) {
-					assertNotAborted(signal, "read");
-					const bytes = Buffer.from(chunk);
-					if (sampledBytes < BINARY_SAMPLE_BYTES) {
-						const sample = bytes.subarray(0, BINARY_SAMPLE_BYTES - sampledBytes);
-						if (sample.includes(0)) throw new FsError(`cannot read "${displayPath}": binary file`, "FS_NOT_TEXT");
-						sampledBytes += sample.length;
-					}
-					try {
-						const text = decoder.decode(bytes, { stream: true });
-						if (text.length > 0) yield text;
-					} catch (error) {
-						throw new FsError(`cannot read "${displayPath}": invalid UTF-8 text`, "FS_NOT_TEXT", { cause: error });
-					}
-				}
-				try {
-					decoder.decode();
-				} catch (error) {
-					throw new FsError(`cannot read "${displayPath}": invalid UTF-8 text`, "FS_NOT_TEXT", { cause: error });
-				}
-			} catch (error) {
-				throw mapError(error, "read", displayPath, signal);
-			}
-		} };
+		const decoded = this.decode(String(target.targetKey));
+		if (decoded === void 0) throw new Error("fs-ssh: cannot route target");
+		return decoded.world.backend.streamText({
+			targetKey: decoded.rawKey,
+			displayPath: target.displayPath
+		}, signal);
+	}
+	async readBytes(target, signal, maxBytes) {
+		const decoded = this.decode(String(target.targetKey));
+		if (decoded === void 0) throw new Error("fs-ssh: cannot route target");
+		return decoded.world.backend.readBytes({
+			targetKey: decoded.rawKey,
+			displayPath: target.displayPath
+		}, signal, maxBytes);
 	}
 	async listDir(target, signal) {
-		const info = await this.stat(target, signal);
-		if (info === void 0) throw new FsError(`cannot list "${target.displayPath}": not found`, "FS_NOT_FOUND");
-		if (info.type !== "directory") throw new FsError(`cannot list "${target.displayPath}": not a directory`, "FS_NOT_DIRECTORY");
-		const { alias } = this.current();
-		try {
-			const listed = await this.engine.ls(alias, String(target.targetKey));
-			assertNotAborted(signal, "list");
-			const displayPaths = listed.map((entry) => posix.join(target.displayPath, entry.name));
-			const canonicalPaths = await this.engine.realpaths(alias, displayPaths);
-			const entries = [];
-			for (let i = 0; i < listed.length; i += 1) {
-				const entry = listed[i];
-				const displayPath = displayPaths[i];
-				const canonical = canonicalPaths[i];
-				const stats = this.asStats({
-					type: entry.type === "dir" ? "directory" : entry.type === "file" ? "file" : "other",
-					size: entry.size,
-					mtimeMs: entry.mtimeMs,
-					mode: entry.mode ?? 384
-				});
-				entries.push({
-					name: entry.name,
-					type: entryType(stats),
-					target: {
-						targetKey: FsTargetKey(canonical),
-						displayPath
-					},
-					version: entryVersion(stats, canonical),
-					...entry.type === "file" ? { size: entry.size } : {}
-				});
+		const decoded = this.decode(String(target.targetKey));
+		if (decoded === void 0) throw new Error("fs-ssh: cannot route target");
+		const entries = await decoded.world.backend.listDir({
+			targetKey: decoded.rawKey,
+			displayPath: target.displayPath
+		}, signal);
+		if (decoded.world.namespace === "") return entries;
+		return entries.map((entry) => ({
+			...entry,
+			target: {
+				targetKey: this.encode(String(entry.target.targetKey), decoded.world.namespace),
+				displayPath: entry.target.displayPath
 			}
-			return entries.sort((left, right) => left.name.localeCompare(right.name));
-		} catch (error) {
-			throw mapError(error, "list", target.displayPath, signal);
-		}
-	}
-	async writeText(target, content, expected, signal) {
-		return this.withLock(String(target.targetKey), async () => {
-			const existing = await this.probe(String(target.targetKey), target.displayPath, signal);
-			if (existing !== void 0 && !existing.isFile()) throw new FsError(`cannot write "${target.displayPath}": not a regular file`, "FS_NOT_REGULAR_FILE");
-			this.checkWriteIntent(existing, expected, target);
-			const before = existing === void 0 ? null : await this.readForDiff(target, signal);
-			const version = await this.writeAtomic(target, content, existing, expected?.kind === "createIfAbsent", signal);
-			return {
-				operation: existing === void 0 ? "create" : "update",
-				version,
-				before,
-				after: normalizeLineEndings(content)
-			};
-		});
-	}
-	async editText(target, edit, expected, signal) {
-		return this.withLock(String(target.targetKey), async () => {
-			const existing = await this.probe(String(target.targetKey), target.displayPath, signal);
-			if (existing === void 0) throw new FsError(`cannot edit "${target.displayPath}": file changed since it was read`, "FS_STALE_VERSION");
-			if (!existing.isFile()) throw new FsError(`cannot edit "${target.displayPath}": not a regular file`, "FS_NOT_REGULAR_FILE");
-			if (expected !== void 0 && entryVersion(existing, String(target.targetKey)) !== expected.version) throw new FsError(`cannot edit "${target.displayPath}": file changed since it was read`, "FS_STALE_VERSION");
-			const raw = await this.readForEdit(target, signal);
-			const before = normalizeLineEndings(raw);
-			const after = literalEdit(before, edit, target.displayPath);
-			const storage = restoreLineEndings(after, detectsCrlf(raw));
-			return {
-				version: await this.writeAtomic(target, storage, existing, false, signal),
-				before,
-				after
-			};
-		});
+		}));
 	}
-	async withLock(targetKey, operation) {
-		const run = (this.locks.get(targetKey) ?? Promise.resolve()).then(operation, operation);
-		const tail = run.then(() => void 0, () => void 0);
-		this.locks.set(targetKey, tail);
-		try {
-			return await run;
-		} finally {
-			if (this.locks.get(targetKey) === tail) this.locks.delete(targetKey);
-		}
+	async writeText(target, content, expected, signal, sandboxPolicy) {
+		const decoded = this.decode(String(target.targetKey));
+		if (decoded === void 0) throw new Error("fs-ssh: cannot route target");
+		const policy = decoded.world.namespace === "" ? sandboxPolicy : void 0;
+		return decoded.world.backend.writeText({
+			targetKey: decoded.rawKey,
+			displayPath: target.displayPath
+		}, content, expected, signal, policy);
 	}
-	async canonicalPath(path, signal) {
-		const { alias } = this.current();
-		const result = await this.engine.exec(alias, `set -o pipefail; realpath -mz -- ${shellQuote(path)} | base64 -w0`, 1e4);
-		signal?.throwIfAborted();
-		if (!result.success || result.exitCode !== 0) throw new Error(result.stderr || `realpath failed for ${path}`);
-		return decodeCanonicalPath(result.stdout.trim());
-	}
-	async probe(path, displayPath, signal) {
-		assertNotAborted(signal, "stat");
-		const { alias } = this.current();
-		try {
-			const info = await this.engine.stat(alias, path);
-			assertNotAborted(signal, "stat");
-			return this.asStats({
-				type: info.type,
-				size: info.size,
-				mtimeMs: info.mtimeMs,
-				mode: info.mode
-			});
-		} catch (error) {
-			if (isNotFound(error)) return void 0;
-			throw mapError(error, "stat", displayPath, signal);
-		}
-	}
-	async requireRegular(target, signal) {
-		const info = await this.stat(target, signal);
-		if (info === void 0) throw new FsError(`cannot read "${target.displayPath}": not found`, "FS_NOT_FOUND");
-		if (info.type !== "file") throw new FsError(`cannot read "${target.displayPath}": not a regular file`, "FS_NOT_REGULAR_FILE");
-		return info;
-	}
-	async readBytesRaw(target, signal, maxBytes) {
-		const { alias } = this.current();
-		try {
-			const data = await this.engine.readFile(alias, String(target.targetKey));
-			assertNotAborted(signal, "read");
-			if (data.content.length > maxBytes) throw new FsError(`cannot read "${target.displayPath}": content exceeds the ${maxBytes}-byte limit`, "FS_TOO_LARGE");
-			return data.content;
-		} catch (error) {
-			throw mapError(error, "read", target.displayPath, signal);
-		}
-	}
-	checkWriteIntent(existing, expected, target) {
-		if (expected?.kind === "createIfAbsent" && existing !== void 0) throw new FsError(`cannot overwrite existing "${target.displayPath}" without reading it first`, "FS_NOT_OBSERVED");
-		if (expected?.kind === "replaceIfVersion") {
-			if (existing === void 0 || entryVersion(existing, String(target.targetKey)) !== expected.version) throw new FsError(`cannot write "${target.displayPath}": file changed since it was read`, "FS_STALE_VERSION");
-		}
-	}
-	async readForDiff(target, signal) {
-		try {
-			return normalizeLineEndings(decodeText(await this.readBytesRaw(target, signal, Number.POSITIVE_INFINITY), target.displayPath));
-		} catch (error) {
-			if (error instanceof FsError && error.code === "FS_NOT_TEXT") return null;
-			throw mapError(error, "read", target.displayPath, signal);
-		}
-	}
-	async readForEdit(target, signal) {
-		return decodeText(await this.readBytesRaw(target, signal, Number.POSITIVE_INFINITY), target.displayPath);
-	}
-	async writeAtomic(target, content, existing, createIfAbsent, signal) {
-		assertNotAborted(signal, "write");
-		const { alias } = this.current();
-		const targetPath = String(target.targetKey);
-		const stagingDirectory = posix.join(posix.dirname(targetPath), `.dsh-${randomUUID()}.tmp`);
-		const temporary = posix.join(stagingDirectory, "content");
-		let stagingCreated = false;
-		try {
-			await this.engine.mkdir(alias, stagingDirectory);
-			stagingCreated = true;
-			await this.engine.writeFile(alias, temporary, Buffer.from(content, "utf8"));
-			assertNotAborted(signal, "write");
-			const mode = existing === void 0 ? 384 : existing.mode & 511;
-			await this.engine.exec(alias, `chmod ${mode.toString(8)} -- ${shellQuote(temporary)}`, 1e4);
-			assertNotAborted(signal, "write");
-			if (createIfAbsent) {
-				const publication = await this.engine.exec(alias, `if ln -T -- ${shellQuote(temporary)} ${shellQuote(targetPath)}; then printf created; elif test -e ${shellQuote(targetPath)} || test -L ${shellQuote(targetPath)}; then printf exists; else exit 1; fi`, 1e4);
-				if (publication.stdout.trim() === "exists") throw new FsError(`cannot overwrite existing "${target.displayPath}" without reading it first`, "FS_NOT_OBSERVED");
-				if (publication.stdout.trim() !== "created") throw new Error("guarded create returned an invalid publication result");
-			} else await this.engine.rename(alias, temporary, targetPath);
-			assertNotAborted(signal, "write");
-			await this.removeStaging(stagingDirectory);
-			const committed = await this.probe(targetPath, target.displayPath, signal);
-			if (committed === void 0) throw new FsError(`cannot write "${target.displayPath}": commit produced no file`, "FS_IO_ERROR");
-			return entryVersion(committed, targetPath);
-		} catch (error) {
-			if (stagingCreated) await this.removeStaging(stagingDirectory);
-			throw mapError(error, "write", target.displayPath, signal);
-		}
-	}
-	async removeStaging(directory) {
-		const { alias } = this.current();
-		try {
-			await this.engine.rm(alias, directory, true);
-		} catch {}
-	}
-	/** Normalize an engine stat/ls shape into the RemoteStats the helpers expect. */
-	asStats(info) {
-		const isDir = info.type === "dir" || info.type === "directory";
-		const isFile = info.type === "file";
-		return {
-			isFile: () => isFile,
-			isDirectory: () => isDir,
-			isSymbolicLink: () => info.type === "symlink",
-			size: info.size,
-			mtime: Math.round(info.mtimeMs / 1e3),
-			mode: info.mode
-		};
+	async editText(target, edit, expected, signal, sandboxPolicy) {
+		const decoded = this.decode(String(target.targetKey));
+		if (decoded === void 0) throw new Error("fs-ssh: cannot route target");
+		const policy = decoded.world.namespace === "" ? sandboxPolicy : void 0;
+		return decoded.world.backend.editText({
+			targetKey: decoded.rawKey,
+			displayPath: target.displayPath
+		}, edit, expected, signal, policy);
 	}
 };
 //#endregion
 //#region src/fs.ts
 /** Stable cordis plugin name. */
 const name = "hardssh-fs";
-/** Services required: the shared workspace core (mode store + engine) and the
-*  sandbox policy the local backend (`SandboxedFileSystem`) consumes. */
-const inject = ["hardsshCore", "sandboxPolicy"];
-/** A remote backend fixed to one SSH workspace's alias + remote root. */
-function fixedRemoteState(alias, remoteRoot) {
-	return () => ({
-		mode: "remote",
-		alias,
-		remoteRoot
-	});
+/** The generic workspace core plus the policy used by the local fallback. */
+const inject = ["sandboxPolicy", "workspaceCore"];
+/** The record behind a router connection (sync snapshot lookup). */
+function genericRecordFor(core, id) {
+	return core.ledger.snapshotSync().records.find((record) => record.id === id);
+}
+/** Resolve the fs world owning a cwd, or undefined when it is definitely local. */
+function genericFsWorldFor(core, cwd, reservedAnchorRoots) {
+	if (!core.isReady()) {
+		if (cwd !== void 0 && reservedAnchorRoots.some((root) => isPathUnderAnchor(root, cwd))) throw new Error("fs-ssh: workspace routing is unavailable while the generic workspace core is not ready (anchor path fails closed)");
+		return;
+	}
+	const connection = core.router.fromAnchor(cwd);
+	if (connection === void 0) return void 0;
+	const record = genericRecordFor(core, connection.workspaceId);
+	if (record === void 0) throw new Error(`fs-workspace: routed workspace '${connection.workspaceId}' is missing from the ledger`);
+	if (record.anchor === void 0) throw new Error(`fs-workspace: workspace '${record.id}' has no anchor`);
+	const backend = connection.get("workspace.fs");
+	if (backend === void 0) throw new Error(`fs-workspace: workspace '${record.id}' provides no workspace.fs capability`);
+	return {
+		backend,
+		namespace: `${WFS_NAMESPACE_MARKER}${record.id.toLowerCase()}/`,
+		anchorPath: record.anchor.path,
+		remoteRoot: record.location.root
+	};
+}
+/** Resolve one namespaced target key, failing closed for stale namespaces. */
+function genericFsWorldForNamespace(core, namespace) {
+	if (!core.isReady()) return void 0;
+	const route = core.router.codec.decode(namespace);
+	if (route === void 0) return void 0;
+	const resolution = core.router.resolveRoute(route);
+	if (resolution === void 0) return void 0;
+	const record = genericRecordFor(core, resolution.connection.workspaceId);
+	if (record === void 0) throw new Error(`fs-workspace: routed workspace '${resolution.connection.workspaceId}' is missing from the ledger`);
+	if (record.anchor === void 0) throw new Error(`fs-workspace: workspace '${record.id}' has no anchor`);
+	const backend = resolution.connection.get("workspace.fs");
+	if (backend === void 0) throw new Error(`fs-workspace: workspace '${record.id}' provides no workspace.fs capability`);
+	return {
+		backend,
+		namespace: `${WFS_NAMESPACE_MARKER}${record.id.toLowerCase()}/`,
+		anchorPath: record.anchor.path,
+		remoteRoot: record.location.root
+	};
 }
-/** Mount the switching filesystem facade. */
+/**
+* Refuse a path that sits inside the managed anchor root but is owned by no
+* registered workspace — as a NOT-FOUND answer, not as a fatal error.
+*
+* The path stays unreachable either way (it is never handed to the local
+* backend, so a bound session cannot read or write client files through the
+* anchor window). What changes is how callers SEE the refusal: `FS_NOT_FOUND`
+* is the DSH contract for "this path does not exist", and the harness relies on
+* it when walking UP from the session cwd looking for a project root —
+* `dsh-agent-instructions` probes `<dir>/.git` per ancestor and treats ONLY
+* `FS_NOT_FOUND` as "keep walking" (any other error aborts the whole run),
+* `dsh-skill-filesystem` does the same. With a bare Error the very first step
+* above the anchor (`<anchorRoot>/.git`) killed the run with
+* "fs-ssh: … is inside the workspace anchor root but no registered workspace
+* owns it (fail closed)". The message is kept verbatim so the refusal is still
+* self-explanatory in logs.
+*/
+function refuseUnownedAnchorPath(path) {
+	throw new FsError(`fs-ssh: '${path}' is inside the workspace anchor root but no registered workspace owns it (fail closed)`, "FS_NOT_FOUND");
+}
+/**
+* The shipped `worldForAnchorPath` deps hook: the workspace owning an absolute
+* anchor path (this session's or a SIBLING's), else the anchor-window refusal.
+* Exported so the seam can be exercised without re-implementing the policy.
+*/
+function anchorWorldFor(core, anchorRootDir, path) {
+	const world = genericFsWorldFor(core, path, [anchorRootDir]);
+	if (world !== void 0) return world;
+	if (isPathUnderAnchor(anchorRootDir, path)) refuseUnownedAnchorPath(path);
+}
+/** Mount the generic switching filesystem facade. */
 function apply(ctx) {
-	const core = ctx.hardsshCore;
 	const localCtx = ctx.isolate("fs");
 	const localFs = new SandboxedFileSystem(localCtx, {
 		cwd: process.env.DSH_CWD ?? process.cwd(),
 		diffBasisMaxBytes: 10485760
 	});
-	core.seams.bindFs((record) => ({
-		backend: new SshFileSystem(ctx.isolate("fs"), core.engine, fixedRemoteState(record.alias, record.remoteRoot)),
-		namespace: `${WFS_NAMESPACE_MARKER}${record.id.toLowerCase()}/`,
-		anchorPath: record.anchorPath,
-		remoteRoot: record.remoteRoot
-	}));
-	const anchorRoot = core.ledger.anchorsRoot();
+	const ws = ctx.workspaceCore;
+	const anchorRootDir = anchorRoot();
 	let warnedUnready = false;
 	new SwitchFileSystem(ctx, {
 		local: localFs,
+		localRoots: [join(homedir(), ".dsh"), join(homedir(), ".agents")],
+		localRootExclusions: [anchorRootDir],
+		deniedRoots: [vaultDirectory(), legacyVaultPath()],
+		worldForAnchorPath: (path) => anchorWorldFor(ws, anchorRootDir, path),
 		worldFor: (cwd) => {
-			if (!core.seams.isReady() && !warnedUnready && cwd !== void 0 && isPathUnderAnchor(anchorRoot, cwd)) {
-				warnedUnready = true;
-				console.warn("[dsh-hardssh] fs routing is not ready yet (workspace ledger still loading) — operating on the local anchor until the snapshot is applied");
+			if (!ws.isReady()) {
+				if (cwd !== void 0 && isPathUnderAnchor(anchorRootDir, cwd)) {
+					if (!warnedUnready) {
+						warnedUnready = true;
+						console.warn("[dsh-hardssh] fs routing is not ready yet (workspace core still initializing or failed) — refusing access beneath the workspace anchor root");
+					}
+					throw new Error("fs-ssh: workspace routing is unavailable while the generic workspace core is not ready (anchor path fails closed)");
+				}
+				return {
+					backend: localFs,
+					namespace: ""
+				};
 			}
-			return core.seams.worldForFs(cwd) ?? {
+			const world = genericFsWorldFor(ws, cwd, [anchorRootDir]);
+			if (world !== void 0) return world;
+			if (cwd !== void 0 && isPathUnderAnchor(anchorRootDir, cwd)) throw new Error(`fs-ssh: '${cwd}' is inside the workspace anchor root but no registered workspace owns it (fail closed)`);
+			return {
 				backend: localFs,
 				namespace: ""
 			};
 		},
-		worldForNamespace: (namespace) => core.seams.worldForFsNamespace(namespace)
+		worldForNamespace: (namespace) => genericFsWorldForNamespace(ws, namespace)
 	});
 }
 //#endregion
-export { apply, inject, name };
+export { anchorWorldFor, apply, genericFsWorldFor, genericFsWorldForNamespace, inject, name, refuseUnownedAnchorPath };