better-dsh 0.3.0-e → 0.3.0-g

package/lib/remote/plugin.js

@@ -1,19 +1,971 @@
 import { t as Schema } from "../lib-C8_jXvwA.js";
 import { Context } from "@deepseek-ai/cordis";
-import { randomBytes } from "node:crypto";
-import { join } from "node:path";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { constants, createReadStream, createWriteStream, mkdirSync, statSync } from "node:fs";
+import { dirname, isAbsolute, join, posix, resolve } from "node:path";
 import { spawn } from "node:child_process";
-import { homedir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { defineTool } from "@deepseek-ai/dsh-tools";
-import { readFile } from "node:fs/promises";
+import { lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, rename, rm, symlink } from "node:fs/promises";
+import { pipeline } from "node:stream/promises";
+import { Readable } from "node:stream";
+import { createConnection, createServer } from "node:net";
+import { EventEmitter } from "node:events";
 
-//#region src/remote/oneshot.ts
-/** 单流硬收集帽（4M UTF-16 code units，ASCII≈4MB）：防失控输出吃内存；模型面截断由上层 tailWindow 负责。 */
-const HARD_CAP = 4e6;
-/** One-shot：子进程退出码即收尾（spec §五.1），stdout/stderr 分离保留。 */
-async function runOneShot(argv, opts = {}) {
+//#region src/remote/archive.ts
+const FILE_FRAME_BYTES = 64 * 1024;
+const FILE_MAX_ENTRIES = 1e4;
+const FILE_MAX_METADATA = 8 * 1024 * 1024;
+const order = (a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b));
+function checkRelative(p) {
+	if (typeof p !== "string" || Buffer.byteLength(p) > 4096 || p.includes("\0") || p !== "" && (p.startsWith("/") || p.split("/").some((s) => !s || s === "." || s === ".."))) throw new Error("unsafe archive relative path");
+}
+function checkAbsolute(p) {
+	if (typeof p !== "string" || !p.startsWith("/") || p.includes("\0") || p.split("/").includes("..")) throw new Error("file endpoint requires an absolute path without traversal or NUL");
+}
+function checkSelection(selection) {
+	if (selection.length > FILE_MAX_ENTRIES || Buffer.byteLength(JSON.stringify(selection)) > FILE_MAX_METADATA) throw new Error("file selection metadata limit exceeded");
+	const seen = /* @__PURE__ */ new Set();
+	for (const p of selection) {
+		checkRelative(p);
+		if (seen.has(p)) throw new Error("duplicate selection path");
+		seen.add(p);
+	}
+}
+function checkLink(e) {
+	const link = e.link;
+	if (e.p === "" || typeof link !== "string" || !link || link.includes("\0") || link.startsWith("/") || Buffer.byteLength(link) > 4096) throw new Error("unsafe archive symlink");
+	const target = posix.normalize(posix.join(posix.dirname(e.p), link));
+	if (target === ".." || target.startsWith("../")) throw new Error("unsafe archive symlink escape");
+}
+/** Conservative effective resolution: links may traverse only members of this incoming tree.
+* Preserved destination extras cannot supply a symlink target or any of its ancestors.
+*/
+function checkTreeLinks(entries) {
+	const incoming = new Map(entries.map((e) => [e.p, e]));
+	for (const link of entries.filter((e) => e.t === "l")) {
+		const stack = posix.dirname(link.p) === "." ? [] : posix.dirname(link.p).split("/");
+		let pending = link.link.split("/"), hops = 0;
+		while (pending.length) {
+			const part = pending.shift();
+			if (!part || part === ".") continue;
+			if (part === "..") {
+				if (!stack.length) throw new Error("unsafe symlink chain escape");
+				stack.pop();
+				continue;
+			}
+			const entry = incoming.get([...stack, part].join("/"));
+			if (!entry) throw new Error("unsafe symlink target outside incoming tree (destination aliases are not followed)");
+			if (entry.t === "l") {
+				if (++hops > 40) throw new Error("unsafe symlink cycle or chain limit");
+				pending = [...entry.link.split("/"), ...pending];
+			} else {
+				if (pending.length && entry.t !== "d") throw new Error("unsafe symlink non-directory target ancestor");
+				stack.push(part);
+			}
+		}
+	}
+}
+function header(e) {
+	const b = Buffer.from(JSON.stringify(e)), n = Buffer.alloc(4);
+	n.writeUInt32BE(b.length);
+	return Buffer.concat([n, b]);
+}
+function manifestDigest(entries) {
+	const hash = createHash("sha256");
+	let bytes = 0;
+	for (const e of [...entries].sort((a, b) => order(a.p, b.p))) {
+		hash.update(header([
+			e.p,
+			e.t,
+			e.n,
+			e.t === "f" ? e.hash : e.t === "l" ? e.link : ""
+		]));
+		if (e.t === "f") bytes += e.n;
+	}
+	return {
+		sha256: hash.digest("hex"),
+		bytes,
+		entries: entries.length
+	};
+}
+/** Reject even existing parent symlinks; leaf may be an explicitly copied symlink. */
+async function ancestors(path$1, includeLeaf = false) {
+	checkAbsolute(path$1);
+	const parts = resolve(path$1).split("/").filter(Boolean);
+	for (let i = 1; i <= parts.length - (includeLeaf ? 0 : 1); i++) try {
+		const st = await lstat("/" + parts.slice(0, i).join("/"));
+		if (st.isSymbolicLink() || !st.isDirectory()) throw new Error("unsafe destination/source ancestor: symlink or non-directory");
+	} catch (e) {
+		if (e.code !== "ENOENT") throw e;
+	}
+}
+async function safeRead(path$1, signal) {
+	return (await open(path$1, constants.O_RDONLY | constants.O_NOFOLLOW)).createReadStream({
+		autoClose: true,
+		highWaterMark: FILE_FRAME_BYTES,
+		signal
+	});
+}
+async function entryAt(root, p, signal) {
+	signal.throwIfAborted();
+	const path$1 = p ? join(root, p) : root;
+	await ancestors(path$1);
+	const st = await lstat(path$1);
+	if (st.isDirectory()) return {
+		p,
+		t: "d",
+		n: 0
+	};
+	if (st.isSymbolicLink()) {
+		const e = {
+			p,
+			t: "l",
+			n: 0,
+			link: await readlink(path$1)
+		};
+		checkLink(e);
+		return e;
+	}
+	if (!st.isFile()) throw new Error("unsupported file type (only files, directories and safe relative symlinks)");
+	const hash = createHash("sha256");
+	for await (const chunk of await safeRead(path$1, signal)) hash.update(chunk);
+	return {
+		p,
+		t: "f",
+		n: st.size,
+		hash: hash.digest("hex")
+	};
+}
+async function tree(root, signal, selection) {
+	checkAbsolute(root);
+	const entries = [];
+	const visit = async (p) => {
+		const e = await entryAt(root, p, signal);
+		entries.push(e);
+		if (entries.length > FILE_MAX_ENTRIES) throw new Error("archive entry limit exceeded");
+		if (e.t === "d") for (const name$1 of (await readdir(p ? join(root, p) : root)).sort(order)) await visit(p ? `${p}/${name$1}` : name$1);
+	};
+	if (selection) {
+		checkSelection(selection);
+		for (const p of selection) entries.push(await entryAt(root, p, signal));
+	} else await visit("");
+	if (Buffer.byteLength(JSON.stringify(entries)) > FILE_MAX_METADATA) throw new Error("archive metadata limit exceeded");
+	return entries;
+}
+async function inspectArchive(path$1, signal) {
+	const file = await open(path$1, "r");
+	let offset = 0, metadata = 0;
+	const entries = [];
+	const seen = /* @__PURE__ */ new Map();
+	const exact = async (n) => {
+		const b = Buffer.alloc(n);
+		let at = 0;
+		while (at < n) {
+			signal.throwIfAborted();
+			const r = await file.read(b, at, n - at, offset);
+			if (!r.bytesRead) throw new Error("truncated binary archive");
+			at += r.bytesRead;
+			offset += r.bytesRead;
+		}
+		return b;
+	};
+	try {
+		while (true) {
+			const size = (await exact(4)).readUInt32BE();
+			if (!size || size > FILE_FRAME_BYTES) throw new Error("archive header limit exceeded");
+			metadata += size;
+			if (metadata > FILE_MAX_METADATA) throw new Error("archive metadata limit exceeded");
+			const e = JSON.parse((await exact(size)).toString("utf8"));
+			if (e.end === true) {
+				if ((await file.stat()).size !== offset) throw new Error("trailing archive bytes");
+				break;
+			}
+			checkRelative(e.p);
+			if (![
+				"f",
+				"d",
+				"l"
+			].includes(e.t) || !Number.isSafeInteger(e.n) || e.n < 0 || e.t !== "f" && e.n !== 0) throw new Error("unsafe archive type/size");
+			if (entries.length >= FILE_MAX_ENTRIES || seen.has(e.p)) throw new Error("archive entry limit or duplicate path");
+			if (e.p !== "" && seen.get(posix.dirname(e.p) === "." ? "" : posix.dirname(e.p))?.t !== "d") throw new Error("unsafe archive parent ordering/type");
+			if (!entries.length && e.p !== "") throw new Error("archive root missing");
+			if (e.t === "l") checkLink(e);
+			e.offset = offset;
+			if (e.t === "f") {
+				const hash = createHash("sha256");
+				let left = e.n;
+				while (left) {
+					const chunk = await exact(Math.min(FILE_FRAME_BYTES, left));
+					hash.update(chunk);
+					left -= chunk.length;
+				}
+				e.hash = hash.digest("hex");
+			}
+			entries.push(e);
+			seen.set(e.p, e);
+		}
+		if (!entries.length) throw new Error("archive root missing");
+		return entries;
+	} finally {
+		await file.close();
+	}
+}
+async function importArchive(destination, payload, mkdirParents, signal, resources) {
+	checkAbsolute(destination);
+	const entries = await inspectArchive(payload, signal);
+	checkTreeLinks(entries);
+	for (const e of entries) {
+		const path$1 = e.p ? join(destination, e.p) : destination;
+		await ancestors(path$1);
+		try {
+			const st = await lstat(path$1);
+			const type = st.isSymbolicLink() ? "l" : st.isDirectory() ? "d" : st.isFile() ? "f" : "?";
+			if (type !== e.t || type === "l") throw new Error("destination path/type conflict or existing symlink");
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+	}
+	await ancestors(destination);
+	if (mkdirParents) await mkdir(dirname(destination), { recursive: true });
+	for (const e of entries) {
+		signal.throwIfAborted();
+		const path$1 = e.p ? join(destination, e.p) : destination;
+		await ancestors(path$1);
+		if (e.t === "d") {
+			await mkdir(path$1, { recursive: false }).catch((error) => {
+				if (error.code !== "EEXIST") throw error;
+			});
+			continue;
+		}
+		if (e.t === "l") {
+			await symlink(e.link, path$1);
+			continue;
+		}
+		const temporary = join(dirname(path$1), `.remote-copy-${randomUUID()}`);
+		await resources.temporary?.(temporary, true);
+		try {
+			const output = createWriteStream(temporary, {
+				flags: "wx",
+				mode: 384
+			});
+			await pipeline(e.n ? createReadStream(payload, {
+				start: e.offset,
+				end: e.offset + e.n - 1
+			}) : Readable.from([]), output, { signal });
+			await ancestors(path$1);
+			signal.throwIfAborted();
+			await rename(temporary, path$1);
+		} finally {
+			await rm(temporary, { force: true });
+			await resources.temporary?.(temporary, false);
+		}
+	}
+}
+function localFileEndpoint(resources = {}) {
+	return {
+		async exportTree(path$1, signal) {
+			const entries = await tree(path$1, signal);
+			return Readable.from((async function* () {
+				for (const e of entries) {
+					signal.throwIfAborted();
+					yield header({
+						p: e.p,
+						t: e.t,
+						n: e.n,
+						...e.link === void 0 ? {} : { link: e.link }
+					});
+					if (e.t === "f" && e.n) for await (const chunk of await safeRead(e.p ? join(path$1, e.p) : path$1, signal)) yield chunk;
+				}
+				yield header({ end: true });
+			})());
+		},
+		async importTree(path$1, source, { mkdir: parents, signal }) {
+			checkAbsolute(path$1);
+			const scratch = resources.receiveRoot ?? await mkdtemp(join(tmpdir(), "remote-file-receive-"));
+			try {
+				const payload = join(scratch, "payload");
+				await pipeline(source, createWriteStream(payload, {
+					flags: "wx",
+					mode: 384
+				}), { signal });
+				await importArchive(path$1, payload, parents, signal, resources);
+			} finally {
+				source.destroy?.();
+				await rm(scratch, {
+					recursive: true,
+					force: true
+				});
+			}
+		},
+		async digest(path$1, signal, selection) {
+			return manifestDigest(await tree(path$1, signal, selection));
+		}
+	};
+}
+
+//#endregion
+//#region src/remote/copy.ts
+var CopyError = class extends Error {
+	constructor(receipt) {
+		super(`copy failed: ${JSON.stringify(receipt)}`);
+		this.receipt = receipt;
+	}
+};
+async function copyTree(request, source, destination, signal, scratchRoot = join(process.cwd(), ".scratch")) {
+	signal.throwIfAborted();
+	await mkdir(scratchRoot, { recursive: true });
+	signal.throwIfAborted();
+	const scratch = await mkdtemp(join(scratchRoot, "remote-copy-")), payload = join(scratch, "payload.bin");
+	const receipt = {
+		action: "copy",
+		src: request.src,
+		dst: request.dst,
+		verified: false,
+		bytes: 0,
+		entries: 0,
+		scope: "transferred entries"
+	};
+	try {
+		await pipeline(await source.endpoint.exportTree(source.path, signal), createWriteStream(payload, {
+			flags: "wx",
+			mode: 384
+		}), { signal });
+		const manifest = await inspectArchive(payload, signal), staged = manifestDigest(manifest);
+		receipt.bytes = staged.bytes;
+		receipt.entries = staged.entries;
+		const selection = manifest.map((e) => e.p);
+		if (request.verify !== false) {
+			const original = await source.endpoint.digest(source.path, signal, selection);
+			receipt.sourceDigest = original.sha256;
+			if (original.sha256 !== staged.sha256) throw new Error("source changed during export; staged digest mismatch");
+		}
+		signal.throwIfAborted();
+		await destination.endpoint.importTree(destination.path, createReadStream(payload), {
+			mkdir: request.mkdir ?? true,
+			signal
+		});
+		if (request.verify !== false) {
+			const dest = await destination.endpoint.digest(destination.path, signal, selection);
+			receipt.destinationDigest = dest.sha256;
+			if (dest.sha256 !== receipt.sourceDigest) throw new Error("destination digest mismatch");
+			receipt.verified = true;
+		}
+		signal.throwIfAborted();
+		await rm(scratch, {
+			recursive: true,
+			force: true
+		});
+		return receipt;
+	} catch (error) {
+		throw new CopyError({
+			...receipt,
+			verified: false,
+			scratch,
+			error: error instanceof Error ? error.message : String(error)
+		});
+	}
+}
+
+//#endregion
+//#region src/remote/ssh-targets.ts
+const LABEL = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const USER = /^[A-Za-z0-9_][A-Za-z0-9_.-]*$/;
+const HOST = /^(?:[A-Za-z0-9_][A-Za-z0-9_.-]*@)?(?:[A-Za-z0-9_][A-Za-z0-9_.-]*|\[[A-Fa-f0-9:.]+\]|[A-Fa-f0-9:]+)$/;
+const JUMP = /^(?:[A-Za-z0-9_][A-Za-z0-9_.-]*@)?(?:[A-Za-z0-9_][A-Za-z0-9_.-]*|\[[A-Fa-f0-9:.]+\])(?::([0-9]+))?$/;
+function validateSshLabel(label) {
+	if (!LABEL.test(label)) throw new Error("[E_BAD_LABEL] remote: BYO-SSH label must use letters, digits, dot, underscore or hyphen and start with a letter/digit");
+}
+function bad(field) {
+	throw new Error(`[E_SSH_PARAMS] remote: invalid SSH ${field} — use host/user/port, an existing origin key file path, and optional ProxyJump aliases or [user@]host[:port] hops; no inline keys or shell options`);
+}
+function normalizeSshConnection(input) {
+	if (!input || typeof input !== "object" || Array.isArray(input)) bad("connection");
+	if (Object.keys(input).some((key$1) => ![
+		"host",
+		"user",
+		"port",
+		"key",
+		"proxyJump"
+	].includes(key$1))) bad("field");
+	if (typeof input.host !== "string" || !HOST.test(input.host)) bad("host");
+	if (input.user !== void 0 && (typeof input.user !== "string" || !USER.test(input.user))) bad("user");
+	if (input.port !== void 0 && (!Number.isInteger(input.port) || input.port < 1 || input.port > 65535)) bad("port");
+	if (input.proxyJump !== void 0) {
+		if (typeof input.proxyJump !== "string" || !input.proxyJump || input.proxyJump.split(",").some((hop) => {
+			const match = JUMP.exec(hop);
+			return !match || match[1] !== void 0 && (Number(match[1]) < 1 || Number(match[1]) > 65535);
+		})) bad("proxyJump");
+	}
+	let key;
+	if (input.key !== void 0) {
+		if (typeof input.key !== "string" || !input.key || /[\0\r\n]/.test(input.key)) bad("key");
+		key = input.key.startsWith("~/") ? join(homedir(), input.key.slice(2)) : resolve(input.key);
+		try {
+			if (!statSync(key).isFile()) bad("key");
+		} catch {
+			bad("key file (must exist on the origin)");
+		}
+	}
+	return Object.freeze({
+		host: input.host,
+		...input.user === void 0 ? {} : { user: input.user },
+		...input.port === void 0 ? {} : { port: input.port },
+		...key === void 0 ? {} : { key },
+		...input.proxyJump === void 0 ? {} : { proxyJump: input.proxyJump }
+	});
+}
+/** One instance per Agent-owned driver; destroyed with its Agent/plugin owners. */
+var SshTargets = class {
+	targets = /* @__PURE__ */ new Map();
+	register(label, connection) {
+		validateSshLabel(label);
+		const normalized = normalizeSshConnection(connection), existing = this.targets.get(label);
+		if (existing && JSON.stringify(existing) !== JSON.stringify(normalized)) throw new Error(`[E_LABEL_CONFLICT] remote: byossh:${label} SSH identity conflict — nothing was run. Reuse the label without ssh, or choose another label; existing credentials were not replaced`);
+		if (!existing) this.targets.set(label, normalized);
+		return existing ?? normalized;
+	}
+	get(label) {
+		validateSshLabel(label);
+		return this.targets.get(label);
+	}
+	entries() {
+		return [...this.targets.entries()];
+	}
+	clear() {
+		this.targets.clear();
+	}
+};
+/** Shared by execution, probes and file/relay consumers. extraArgs is trusted
+* internal SSH argv (e.g. forwarding), never a model-provided shell string. */
+function sshArgv(connection, options = {}) {
+	const args = options.tty ? [
+		"ssh",
+		"-tt",
+		"-o",
+		"BatchMode=yes"
+	] : [
+		"ssh",
+		"-o",
+		"BatchMode=yes",
+		"-T"
+	];
+	if (connection.user !== void 0) args.push("-l", connection.user);
+	if (connection.port !== void 0) args.push("-p", String(connection.port));
+	if (connection.key !== void 0) args.push("-i", connection.key);
+	if (connection.proxyJump !== void 0) args.push("-J", connection.proxyJump);
+	args.push(...options.extraArgs ?? [], "--", connection.host);
+	if (options.command !== void 0) args.push(options.command);
+	return args;
+}
+
+//#endregion
+//#region src/remote/transports.ts
+/** POSIX 单引号机械转义（唯一一层转义，spec §三"一层机械转义"）。 */
+function shQuote(s) {
+	return `'${s.replaceAll("'", `'\\''`)}'`;
+}
+/** One-shot（§五.1）：不分配 tty，收尾 = 子进程退出码，零字符串扫描。 */
+function buildOneShotArgv(plan, cmd) {
+	switch (plan.kind) {
+		case "ssh": return sshArgv(plan.connection ?? { host: plan.host }, { command: `bash -lc ${shQuote(cmd)}` });
+		case "docker": return [
+			"docker",
+			"exec",
+			"-i",
+			"--",
+			plan.container,
+			"bash",
+			"-lc",
+			cmd
+		];
+		case "incus": return [
+			"incus",
+			"exec",
+			"--force-noninteractive",
+			plan.container,
+			"--",
+			"bash",
+			"-lc",
+			cmd
+		];
+	}
+}
+/** Persistent pty（Ruling 2）：ssh/incus 走宿主管道，docker 经 script(1) 托管宿主 PTY。 */
+function buildPtyArgv(plan) {
+	switch (plan.kind) {
+		case "ssh": return sshArgv(plan.connection ?? { host: plan.host }, {
+			tty: true,
+			command: "bash"
+		});
+		case "docker": return [
+			"script",
+			"-qfec",
+			`stty -echo 2>/dev/null ; exec docker exec -it -- ${shQuote(plan.container)} bash`,
+			"/dev/null"
+		];
+		case "incus": return [
+			"incus",
+			"exec",
+			"--force-interactive",
+			plan.container,
+			"--",
+			"bash"
+		];
+	}
+}
+/** BYO-PTY（§三 spawn）：工具只提供 PTY 托管 + Nonce 注入 + 收帧。 */
+function buildSpawnArgv(spawnCommand) {
+	return [
+		"script",
+		"-qfec",
+		`stty -echo 2>/dev/null ; exec ${spawnCommand}`,
+		"/dev/null"
+	];
+}
+
+//#endregion
+//#region src/remote/ssh-lease.ts
+/** Portable, transient recovery gate. The flock is inherited by the supervised cohort,
+* so a wrapper exit alone cannot certify descendant release. No persistent tombstone. */
+const SSH_RECOVERY_HELPER = String.raw`import fcntl, json, os, signal, stat, subprocess, sys, tempfile, time
+role=sys.argv[1];args=json.loads(sys.argv[2])
+if sys.version_info<(3,7) or (sys.platform=='darwin' and sys.version_info<(3,10)):
+    raise RuntimeError('SSH recovery requires Python3.7+ (macOS3.10+) shared cross-process monotonic clock and Unix fcntl.flock')
+info=time.get_clock_info('monotonic')
+if not info.monotonic or info.adjustable or not hasattr(fcntl,'flock'):
+    raise RuntimeError('SSH recovery requires shared non-adjustable monotonic clock and Unix fcntl.flock')
+def now():return time.monotonic_ns()//1000000
+if role=='recovery-clock':
+    print(json.dumps({'tick':now(),'base':tempfile.gettempdir()}),flush=True);sys.exit(0)
+root=args['root'];cutoff=args['cutoff'];since=args['since'];token=args['token']
+if type(cutoff) is not int or type(since) is not int or cutoff!=since+8000 or now()<since:
+    raise RuntimeError('invalid recovery clock epoch/entry fence')
+stopped=False
+def stop(sig,frame):
+    global stopped
+    stopped=True
+for sig in (signal.SIGHUP,signal.SIGTERM,signal.SIGINT):signal.signal(sig,stop)
+def gate():
+    try:os.mkdir(root,0o700)
+    except FileExistsError:pass
+    directory=os.open(root,os.O_RDONLY|os.O_DIRECTORY|os.O_NOFOLLOW)
+    st=os.fstat(directory)
+    if st.st_uid!=os.getuid() or stat.S_IMODE(st.st_mode)!=0o700:
+        os.close(directory);raise RuntimeError('unsafe rsync recovery owner directory')
+    fd=os.open('lock',os.O_RDWR|os.O_CREAT|os.O_NOFOLLOW,0o600,dir_fd=directory)
+    st=os.fstat(fd)
+    if st.st_uid!=os.getuid() or not stat.S_ISREG(st.st_mode) or stat.S_IMODE(st.st_mode)!=0o600:
+        os.close(fd);os.close(directory);raise RuntimeError('unsafe rsync recovery lock')
+    return directory,fd
+def current(directory,fd):
+    try:
+        a=os.stat(root,follow_symlinks=False);b=os.fstat(directory)
+        c=os.stat('lock',dir_fd=directory,follow_symlinks=False);d=os.fstat(fd)
+        return (a.st_dev,a.st_ino)==(b.st_dev,b.st_ino) and (c.st_dev,c.st_ino)==(d.st_dev,d.st_ino)
+    except FileNotFoundError:return False
+def remove(directory,fd):
+    if not current(directory,fd):return
+    for name in ('cancel','lock'):
+        try:os.unlink(name,dir_fd=directory)
+        except FileNotFoundError:pass
+    os.rmdir(root)
+def cancelled(directory):
+    try:os.stat('cancel',dir_fd=directory,follow_symlinks=False);return True
+    except FileNotFoundError:return False
+if role=='recovery-run':
+    while not stopped and now()<cutoff:
+        directory=fd=None;child=None
+        try:
+            directory,fd=gate()
+            try:fcntl.flock(fd,fcntl.LOCK_EX|fcntl.LOCK_NB)
+            except BlockingIOError:sys.stderr.write('recovery-run: gate entry fenced, token already owned\n');sys.exit(125) # observer/owner already fenced this unique token
+            if not current(directory,fd):continue
+            if stopped or now()>=cutoff or cancelled(directory):
+                sys.stderr.write('recovery-run: gate entry fenced stopped=%s cutoff-reached=%s cancelled=%s\n'%(stopped,now()>=cutoff,cancelled(directory)));sys.exit(125)
+            command=args['command'];command=command if command.startswith('exec ') else 'exec '+command
+            # The dead original SSH channel must never block cancellation/cleanup.
+            # Preserve binary output normally, bounded to 512KiB/channel; once
+            # cancelled, drain/discard it so even terminal cleanup writes finish.
+            for output in (1,2):os.set_blocking(output,False)
+            child=subprocess.Popen(['bash','-c',command],pass_fds=(fd,),stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE)
+            streams={1:child.stdout,2:child.stderr};pending={1:bytearray(),2:bytearray()};sent=False
+            phase=None;deadline=None;incoming=bytearray();forward=bytearray();tail=bytearray()
+            prepared=('__SUPERD_RSYNC_'+token+'_PREPARED__\n').encode()
+            cleaned=('__SUPERD_RSYNC_'+token+'_CLEANED__\n').encode()
+            os.set_blocking(0,False);os.set_blocking(child.stdin.fileno(),False)
+            for stream in streams.values():os.set_blocking(stream.fileno(),False)
+            while True:
+                # This gate is itself an owner, including after the inner child
+                # exits. Anchor BEFORE forwarding PREPARED; KEEP adds only the
+                # same fixed step already counted before origin dispatch.
+                if deadline is not None and now()>=deadline:stopped=True
+                if not stopped:
+                    try:control=os.read(0,4096)
+                    except BlockingIOError:control=None
+                    if control==b'':stopped=True
+                    elif control:
+                        incoming.extend(control)
+                        if len(incoming)+len(forward)>65536:stopped=True
+                        while not stopped and b'\n' in incoming:
+                            line,rest=incoming.split(b'\n',1);incoming=bytearray(rest);tick=now()
+                            if deadline is None or tick>=deadline:stopped=True
+                            elif line==b'START' and phase=='prepared':phase='active'
+                            elif line==b'KEEP' and phase=='active':deadline=min(deadline+2000,tick+8000)
+                            else:stopped=True
+                            if not stopped:forward.extend(line+b'\n')
+                    if forward and not child.stdin.closed:
+                        try:count=os.write(child.stdin.fileno(),forward);del forward[:count]
+                        except BlockingIOError:pass
+                        except BrokenPipeError:child.stdin.close();forward.clear()
+                    if child.stdin.closed:forward.clear()
+                discard=stopped or cancelled(directory)
+                if discard:
+                    stopped=True;tail.clear();forward.clear();incoming.clear()
+                    for data in pending.values():data.clear()
+                    if not sent and child.poll() is None:
+                        try:child.terminate()
+                        except ProcessLookupError:pass
+                        sent=True
+                progress=False
+                for output,stream in list(streams.items()):
+                    for _ in range(8):
+                        room=65536 if discard else min(65536,524288-len(pending[output])-(len(tail) if output==2 else 0))
+                        if not room:break
+                        try:data=os.read(stream.fileno(),room)
+                        except BlockingIOError:break
+                        if not data:
+                            stream.close();del streams[output]
+                            if output==2 and not discard:pending[2].extend(tail);tail.clear()
+                            break
+                        progress=True
+                        if discard:continue
+                        if output==1:pending[1].extend(data);continue
+                        # Streaming marker recognition retains only a possible
+                        # marker prefix. The inner CLEANED is not gate cleanup.
+                        tail.extend(data)
+                        while tail:
+                            hits=[(tail.find(mark),mark) for mark in (prepared,cleaned) if tail.find(mark)>=0]
+                            if hits:
+                                index,mark=min(hits,key=lambda item:item[0]);pending[2].extend(tail[:index]);del tail[:index+len(mark)]
+                                if mark==prepared:
+                                    if phase is None:phase='prepared';deadline=now()+8000
+                                    pending[2].extend(mark)
+                            else:
+                                keep=max([n for mark in (prepared,cleaned) for n in range(1,min(len(tail),len(mark)-1)+1) if tail[-n:]==mark[:n]] or [0])
+                                count=len(tail)-keep;pending[2].extend(tail[:count]);del tail[:count];break
+                if not discard:
+                    for output,data in pending.items():
+                        if not data:continue
+                        try:
+                            count=os.write(output,data);del data[:count];progress=True
+                        except BlockingIOError:pass
+                        except OSError:stopped=True;break
+                if child.poll() is not None and not streams and not any(pending.values()):break
+                if not progress:time.sleep(.01)
+            status=child.wait();child.stdin.close()
+            remove(directory,fd);os.close(fd);os.close(directory);fd=directory=None
+            # Only the post-cohort, post-pipe, post-lock release is an ACK.
+            # A lost/full old channel may lose this receipt, never hold cleanup.
+            try:os.write(2,cleaned)
+            except OSError:pass
+            sys.exit(125 if stopped else status if status>=0 else 128-status)
+        finally:
+            # Never remove ownership while a child remains. Its inherited lock also
+            # survives abrupt wrapper death, until the existing supervisor reaps it.
+            if child is None and directory is not None and fd is not None and current(directory,fd):
+                # A different owner may hold this file: only a held exclusive lock permits removal.
+                try:fcntl.flock(fd,fcntl.LOCK_EX|fcntl.LOCK_NB);remove(directory,fd)
+                except BlockingIOError:pass
+            if fd is not None:os.close(fd)
+            if directory is not None:os.close(directory)
+    if not stopped:sys.stderr.write('recovery-run: session ended before cutoff without a signal\n')
+    sys.exit(125)
+elif role=='recovery-lock':
+    directory=fd=None
+    try:
+        while not stopped and now()<cutoff:
+            directory,fd=gate()
+            try:fcntl.flock(fd,fcntl.LOCK_EX|fcntl.LOCK_NB)
+            except BlockingIOError:
+                raise RuntimeError('rsync recovery entry already owned or cancelled')
+            if current(directory,fd) and now()<cutoff and not cancelled(directory):break
+            remove(directory,fd);os.close(fd);os.close(directory);directory=fd=None
+        if directory is None:raise RuntimeError('rsync recovery entry closed; no controller admitted')
+    except BaseException:
+        if fd is not None:os.close(fd)
+        if directory is not None:os.close(directory)
+        raise
+elif role=='recovery-observe':
+    while True:
+        directory=fd=None
+        try:
+            directory,fd=gate()
+            cancel=os.open('cancel',os.O_WRONLY|os.O_CREAT|os.O_NOFOLLOW,0o600,dir_fd=directory);os.close(cancel)
+            while True:
+                try:fcntl.flock(fd,fcntl.LOCK_EX|fcntl.LOCK_NB);break
+                except BlockingIOError:time.sleep(.05)
+            if not current(directory,fd):continue
+            # No active cohort holds the lock. Preserve cancellation against an
+            # original exec request that has not entered its gate yet.
+            while now()<cutoff:time.sleep(.05)
+            remove(directory,fd)
+            break
+        except FileNotFoundError:continue
+        finally:
+            if fd is not None:os.close(fd)
+            if directory is not None:os.close(directory)
+    print('__SUPERD_RSYNC_'+token+'_CLEANED__',flush=True)
+else:raise RuntimeError('unknown rsync recovery role')
+`;
+const recoveryHelperCommand = (role, args = {}) => "exec python3 -u -c " + shQuote(SSH_RECOVERY_HELPER) + " " + shQuote(role) + " " + shQuote(JSON.stringify(args));
+/** One receiving helper: portable monotonic clock; Linux only for owned -R transport. */
+const SSH_LEASE_HELPER = String.raw`import json, os, selectors, signal, subprocess, sys, time
+role=sys.argv[1]
+args=json.loads(sys.argv[2]) if len(sys.argv)>2 else {}
+if sys.version_info<(3,7):raise RuntimeError('SSH ownership requires Python3.7+ monotonic_ns')
+info=time.get_clock_info('monotonic')
+if not info.monotonic or info.adjustable:
+    raise RuntimeError('SSH ownership requires a non-adjustable monotonic Python clock')
+last=0
+def now():
+    global last
+    value=time.monotonic_ns()//1000000
+    if not isinstance(value,int) or value<last or value<0:
+        raise RuntimeError('invalid monotonic SSH clock; admission closed')
+    last=value
+    return value
+
+def clock_pipe(leased):
+    selector=selectors.DefaultSelector()
+    for fd in ([0,3] if leased else [0]):
+        os.set_blocking(fd,False);selector.register(fd,selectors.EVENT_READ)
+    buffers={0:b'',3:b''};phase='prepared';deadline=now()+8000;count=0
+    while True:
+        if leased and now()>=deadline:phase='closed'
+        for key,events in selector.select(.05):
+            fd=key.fd;data=os.read(fd,4096)
+            if not data:
+                if fd==0:return
+                phase='closed';selector.unregister(fd);continue
+            buffers[fd]+=data
+            if len(buffers[fd])>65536:raise RuntimeError('rsync lease input too large')
+            while b'\n' in buffers[fd]:
+                line,buffers[fd]=buffers[fd].split(b'\n',1);tick=now()
+                if fd==0:
+                    if line!=b'QUERY':raise RuntimeError('invalid clock query')
+                    if leased:
+                        if tick>=deadline:phase='closed'
+                        print(tick,deadline,count,phase,flush=True)
+                    else:print(tick,flush=True)
+                elif tick>=deadline:phase='closed'
+                elif line==b'START' and phase=='prepared':phase='active'
+                elif line==b'KEEP' and phase=='active':deadline=min(deadline+2000,tick+8000);count+=1
+                else:phase='closed'
+
+def native_command():
+    # fd0 is exclusively the user's literal stdin. Control lives in the separate owner SSH.
+    owner=args['directory'];active=owner+'/active';record=owner+'/server.'+str(os.getpid())
+    child=None;stopped=False;status=125
+    subreaper=args.get('subreaper',False)
+    if subreaper:
+        # Containers can have a non-reaping PID1: own adopted descendants ourselves.
+        import ctypes
+        if sys.platform!='linux':raise RuntimeError('container command ownership requires Linux PR_SET_CHILD_SUBREAPER')
+        libc=ctypes.CDLL(None,use_errno=True)
+        if libc.prctl(36,1,0,0,0)!=0:raise OSError(ctypes.get_errno(),'container PR_SET_CHILD_SUBREAPER denied before work admission')
+    def reap():
+        if not subreaper:return
+        # Popen retains its direct-child status; waitpid only after it is collected.
+        child.poll()
+        if child.returncode is None:return
+        while True:
+            try:
+                pid,status=os.waitpid(-1,os.WNOHANG)
+                if pid==0:return
+            except ChildProcessError:return
+    def stop(signum,frame):
+        nonlocal stopped
+        stopped=True
+    for sig in (signal.SIGTERM,signal.SIGHUP,signal.SIGINT):signal.signal(sig,stop)
+    def registered(group):
+        with open(record,'w') as f:f.write('%s %s 0\n'%(os.getpid(),group))
+    def lease():
+        with open(owner+'/lease') as f:values=f.read(128).split()
+        if len(values)!=2:raise RuntimeError('invalid SSH command lease')
+        remaining,count=map(int,values)
+        if remaining<=0 or remaining>8000 or count<0:raise RuntimeError('invalid SSH command lease')
+        return remaining,count
+    def group_live():
+        reap()
+        try:os.killpg(child.pid,0);return True
+        except ProcessLookupError:return False
+    try:
+        # No child/clock/IPC is created before the sideband admission fences.
+        if stopped or not os.path.isfile(active):
+            sys.stderr.write('native-command admission closed before spawn: signal=%s owner=%s owner-dir=%s owner-active=%s\n'%(stopped,owner,os.path.isdir(owner),os.path.isfile(active)));return 125
+        registered(0)
+        if stopped or not os.path.isfile(active):
+            sys.stderr.write('native-command admission closed after registration: signal=%s owner-active=%s\n'%(stopped,os.path.isfile(active)));return 125
+        remaining,seen=lease();deadline=now()+remaining
+        if stopped or not os.path.isfile(active) or now()>=deadline:
+            sys.stderr.write('native-command admission closed before child: signal=%s owner-active=%s lease-expired=%s\n'%(stopped,os.path.isfile(active),now()>=deadline));return 125
+        child=subprocess.Popen(args['argv'],stdin=0,stdout=1,stderr=2,start_new_session=True)
+        registered(child.pid)
+        while True:
+            status=child.poll()
+            if status is not None:break
+            if stopped or not os.path.isfile(active) or now()>=deadline:
+                status=125
+                if not stopped:sys.stderr.write('native-command admission closed while running without signal: owner-active=%s lease-expired=%s child=%s\n'%(os.path.isfile(active),now()>=deadline,child.pid))
+                break
+            remaining,count=lease()
+            if count<seen:raise RuntimeError('SSH command lease count regressed')
+            deadline=min(deadline+(count-seen)*2000,now()+8000);seen=count
+            time.sleep(.02)
+        return status if status>=0 else 128-status
+    finally:
+        if child is not None:
+            try:os.killpg(child.pid,signal.SIGTERM)
+            except ProcessLookupError:pass
+            end=now()+200
+            while now()<end:
+                child.poll()
+                if not group_live():break
+                time.sleep(.01)
+            try:os.killpg(child.pid,signal.SIGKILL)
+            except ProcessLookupError:pass
+            child.wait()
+            while group_live():time.sleep(.01)
+
+if role=='clock':clock_pipe(False)
+elif role=='lease-clock':clock_pipe(True)
+elif role=='native-command':sys.exit(native_command())
+elif role=='preflight':now()
+else:raise RuntimeError('unknown rsync ownership helper role')
+`;
+const leaseHelperCommand = (role, args = {}) => "exec python3 -u -c " + shQuote(SSH_LEASE_HELPER) + " " + shQuote(role) + " " + shQuote(JSON.stringify(args));
+
+//#endregion
+//#region src/remote/output-ring.ts
+const continuation = (byte) => (byte & 192) === 128;
+function completeUtf8End(bytes) {
+	if (!bytes.length) return 0;
+	let start = bytes.length - 1;
+	while (start > 0 && continuation(bytes[start]) && bytes.length - start < 4) start--;
+	const lead = bytes[start];
+	const width = lead >= 240 && lead <= 244 ? 4 : lead >= 224 && lead <= 239 ? 3 : lead >= 194 && lead <= 223 ? 2 : 1;
+	return bytes.length - start < width ? start : bytes.length;
+}
+/** Byte-addressed decoded output: mid-codepoint cursors skip forward and explicitly report loss. */
+function readUtf8Tail(bytes, totalBytes, fromByte) {
+	if (!Number.isSafeInteger(fromByte) || fromByte < 0) throw new Error("Output cursor must be a non-negative safe byte offset");
+	const start = totalBytes - bytes.length;
+	let offset = Math.max(0, Math.min(bytes.length, fromByte - start));
+	let lossy = fromByte < start;
+	while (offset < bytes.length && continuation(bytes[offset])) {
+		offset++;
+		lossy = true;
+	}
+	const end = completeUtf8End(bytes);
+	return {
+		text: bytes.subarray(Math.min(offset, end), end).toString("utf8"),
+		nextOffset: start + end,
+		lossy
+	};
+}
+/** Native/PTY retention is UTF16 units; cursor offsets remain real UTF8 bytes. Input is decoded text. */
+var Utf16TailRing = class {
+	text = "";
+	total = 0;
+	totalBytes = 0;
+	constructor(capacity = 4e6) {
+		this.capacity = capacity;
+	}
+	push(text) {
+		this.total += text.length;
+		this.totalBytes += Buffer.byteLength(text);
+		this.text = (this.text + text).slice(-this.capacity);
+		if (this.text.charCodeAt(0) >= 56320 && this.text.charCodeAt(0) <= 57343) this.text = this.text.slice(1);
+	}
+	stats(returned = this.text.length) {
+		return {
+			unit: "utf16",
+			total: this.total,
+			retained: this.text.length,
+			dropped: this.total - this.text.length,
+			returned,
+			retentionLimit: this.capacity
+		};
+	}
+	read(fromByte) {
+		return readUtf8Tail(Buffer.from(this.text), this.totalBytes, fromByte);
+	}
+};
+/** Raw byte retention for Hub oneshot. Tail/read starts skip partial UTF8 prefixes, never invent replacement characters. */
+var ByteTailRing = class {
+	total = 0;
+	chunks = [];
+	retained = 0;
+	constructor(capacity = 4 * 1024 * 1024) {
+		this.capacity = capacity;
+	}
+	push(chunk) {
+		if (chunk.length === 0) return;
+		this.total += chunk.length;
+		this.chunks.push(chunk);
+		this.retained += chunk.length;
+		let drop = this.retained - this.capacity;
+		while (drop > 0) {
+			const head = this.chunks[0];
+			const count = Math.min(drop, head.length);
+			if (count === head.length) this.chunks.shift();
+			else this.chunks[0] = head.subarray(count);
+			this.retained -= count;
+			drop -= count;
+		}
+	}
+	tail(maxBytes = this.retained) {
+		let skip = Math.max(0, this.retained - maxBytes);
+		const out = [];
+		for (const chunk of this.chunks) {
+			if (skip >= chunk.length) {
+				skip -= chunk.length;
+				continue;
+			}
+			out.push(chunk.subarray(skip));
+			skip = 0;
+		}
+		const bytes = Buffer.concat(out);
+		let offset = 0;
+		while (offset < bytes.length && continuation(bytes[offset])) offset++;
+		return bytes.subarray(offset, completeUtf8End(bytes));
+	}
+	stats(returned = this.tail().length) {
+		return {
+			unit: "bytes",
+			total: this.total,
+			retained: this.retained,
+			dropped: this.total - this.retained,
+			returned,
+			retentionLimit: this.capacity
+		};
+	}
+	read(fromByte) {
+		return readUtf8Tail(Buffer.concat(this.chunks), this.total, fromByte);
+	}
+};
+
+//#endregion
+//#region src/remote/process.ts
+const TERM_GRACE_MS = 2e3;
+const KILL_SETTLE_MS = 100;
+const PROCESS_CLEANUP_BOUND_MS = TERM_GRACE_MS + KILL_SETTLE_MS;
+/** Real detached process. Completion includes group cleanup, even after its leader closes. */
+function startBinaryProcess(argv, options = {}) {
 	const started = Date.now();
 	const child = spawn(argv[0], argv.slice(1), {
+		cwd: options.cwd,
 		stdio: [
 			"pipe",
 			"pipe",
@@ -21,54 +973,1401 @@ async function runOneShot(argv, opts = {}) {
 		],
 		detached: true
 	});
-	let stdout = "";
-	let stderr = "";
-	let timedOut = false;
-	child.stdout.setEncoding("utf8").on("data", (d) => {
-		if (stdout.length < HARD_CAP) stdout = (stdout + d).slice(0, HARD_CAP);
+	let diagnostic;
+	let timedOut = false, finished = false, cancelled = false;
+	let cleanup;
+	let timer;
+	const signal = (sig) => {
+		if (child.pid === void 0) return false;
+		try {
+			process.kill(-child.pid, sig);
+			return true;
+		} catch (error) {
+			if (error.code !== "ESRCH") diagnostic = `remote: process cleanup failed: ${String(error)}`;
+			return false;
+		}
+	};
+	let closed;
+	const close = new Promise((resolve$1) => {
+		closed = resolve$1;
 	});
-	child.stderr.setEncoding("utf8").on("data", (d) => {
-		if (stderr.length < HARD_CAP) stderr = (stderr + d).slice(0, HARD_CAP);
+	const reap = () => cleanup ??= new Promise((resolve$1) => {
+		if (!signal("SIGTERM")) {
+			resolve$1();
+			return;
+		}
+		let settled = false;
+		const finish = () => {
+			if (!settled) {
+				settled = true;
+				clearTimeout(grace);
+				resolve$1();
+			}
+		};
+		const grace = setTimeout(() => {
+			signal("SIGKILL");
+			setTimeout(finish, KILL_SETTLE_MS);
+		}, TERM_GRACE_MS);
+		close.then(() => {
+			if (!signal(0)) finish();
+		});
 	});
+	const cancel = () => {
+		if (!finished) {
+			cancelled = true;
+			reap();
+		}
+	};
 	child.stdin.on("error", () => {});
-	if (opts.stdin !== void 0) child.stdin.write(opts.stdin);
-	child.stdin.end();
-	let termTimer;
-	let killTimer;
-	const clearTimers = () => {
-		if (termTimer !== void 0) clearTimeout(termTimer);
-		if (killTimer !== void 0) clearTimeout(killTimer);
+	child.once("error", (error) => {
+		diagnostic = `exec: spawn failed — ${error.message}${options.cwd === void 0 ? "" : ` (cwd: ${options.cwd})`}`;
+	});
+	const done = new Promise((resolve$1) => {
+		child.once("close", async (exit) => {
+			closed();
+			if (timer) clearTimeout(timer);
+			await reap();
+			finished = true;
+			resolve$1({
+				exit: diagnostic ? null : exit,
+				timedOut,
+				cancelled,
+				durationMs: Date.now() - started
+			});
+		});
+	});
+	if (options.timeoutSec !== void 0) timer = setTimeout(() => {
+		timedOut = true;
+		cancel();
+	}, options.timeoutSec * 1e3);
+	return {
+		cancel,
+		done,
+		stdout: child.stdout,
+		stderr: child.stderr,
+		stdin: child.stdin,
+		diagnostic: () => diagnostic
+	};
+}
+/** Text adapter over the same owned process-group lifecycle as binary pipelines. */
+function startOneShot(argv, options = {}) {
+	const child = startBinaryProcess(argv, options);
+	const byteMode = options.unit === "bytes";
+	const stdout = byteMode ? new ByteTailRing() : new Utf16TailRing();
+	const stderr = byteMode ? new ByteTailRing() : new Utf16TailRing();
+	for (const [stream, ring] of [[child.stdout, stdout], [child.stderr, stderr]]) {
+		if (!byteMode) stream.setEncoding("utf8");
+		stream.on("data", (chunk) => {
+			if (ring instanceof ByteTailRing) ring.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+			else ring.push(String(chunk));
+			options.onOutput?.();
+		});
+	}
+	child.stdin.end(options.stdin);
+	return {
+		cancel: child.cancel,
+		done: child.done,
+		read(channel, fromByte) {
+			const ring = channel === "stdout" ? stdout : stderr;
+			const read = ring.read(fromByte), diagnostic = child.diagnostic();
+			return {
+				...read,
+				stats: ring.stats(byteMode ? Buffer.byteLength(read.text) : read.text.length),
+				...channel === "stderr" && diagnostic ? { diagnostic } : {}
+			};
+		}
+	};
+}
+
+//#endregion
+//#region src/remote/ssh-source-proxy.ts
+/** One sequential connection at a time; all queues bounded independently of file size.
+* This helper is a child of native-command, never an independently owned daemon. */
+const SOURCE_PROXY_HELPER = String.raw`import json,os,select,signal,socket,struct,sys,time
+port=int(sys.argv[1]);MAX=65536;CAP=262144
+stopped=False
+def stop(sig,frame):
+    global stopped
+    stopped=True
+for sig in (signal.SIGTERM,signal.SIGHUP,signal.SIGINT):signal.signal(sig,stop)
+for fd in (0,1,2):os.set_blocking(fd,False)
+listener=socket.socket();listener.setsockopt(socket.SOL_SOCKET,socket.SO_REUSEADDR,1)
+client=None;probe=None;incoming=bytearray();out=bytearray();pending=bytearray()
+read_end=False;write_end=False;shutdown=False;verified=False;ready=False;greeting=bytearray()
+def frame(kind,data=b''):
+    if len(data)>MAX or len(out)+len(data)+5>CAP:raise RuntimeError('source proxy output bound')
+    out.extend(struct.pack('!BI',kind,len(data)));out.extend(data)
+try:
+    listener.bind(('127.0.0.1',port));listener.listen(1);listener.setblocking(False)
+    # An internal client traverses this exact listener, SSH stream and destination-L.
+    probe=socket.create_connection(('127.0.0.1',port),timeout=2);probe.setblocking(False)
+    deadline=time.monotonic()+10
+    while not stopped:
+        if not ready and time.monotonic()>deadline:raise RuntimeError('source proxy @RSYNCD greeting timeout')
+        # Parse at most one bounded data frame ahead of the destination writer.
+        while len(incoming)>=5:
+            kind,size=struct.unpack('!BI',incoming[:5])
+            if size>MAX or kind not in (2,3) or (kind==3 and size):raise RuntimeError('invalid source proxy frame')
+            if len(incoming)<5+size or len(pending)+size>CAP:break
+            if client is None:raise RuntimeError('source proxy frame without connection')
+            data=bytes(incoming[5:5+size]);del incoming[:5+size]
+            if kind==2:
+                if write_end:raise RuntimeError('source proxy data after EOF')
+                pending.extend(data)
+            else:write_end=True
+        if client is not None and write_end and not pending and not shutdown:
+            client.shutdown(socket.SHUT_WR);shutdown=True
+        if client is not None and read_end and shutdown and not pending and len(out)+5<=CAP:
+            client.close();client=None;frame(4)
+            if verified and not ready:
+                os.write(2,b'SOURCE_PROXY_READY\n');ready=True
+        readers=[];writers=[]
+        if len(incoming)<MAX+5 and len(pending)<=CAP-MAX:readers.append(0)
+        if out:writers.append(1)
+        if client is None and len(out)<=CAP-5:readers.append(listener)
+        if client is not None:
+            if not read_end and len(out)<=CAP-MAX-5:readers.append(client)
+            if pending:writers.append(client)
+        if probe is not None:readers.append(probe)
+        r,w,_=select.select(readers,writers,[],.05)
+        if 0 in r:
+            data=os.read(0,MAX+5-len(incoming))
+            if not data:break
+            incoming.extend(data)
+        if 1 in w:
+            n=os.write(1,out);del out[:n]
+        if listener in r:
+            client,_=listener.accept();client.setblocking(False)
+            read_end=False;write_end=False;shutdown=False;frame(1)
+        if client is not None and client in r:
+            data=client.recv(MAX)
+            if data:frame(2,data)
+            else:read_end=True;frame(3)
+        if client is not None and client in w:
+            n=client.send(pending);del pending[:n]
+        if probe is not None and probe in r:
+            data=probe.recv(1024-len(greeting))
+            if not data:raise RuntimeError('source proxy missing @RSYNCD greeting')
+            greeting.extend(data)
+            if b'\n' in greeting:
+                if not greeting.startswith(b'@RSYNCD: '):raise RuntimeError('source proxy invalid @RSYNCD greeting')
+                verified=True;probe.close();probe=None
+            elif len(greeting)>=1024:raise RuntimeError('source proxy greeting exceeds bound')
+finally:
+    for item in (probe,client,listener):
+        if item is not None:item.close()
+`;
+const MAX = 65536;
+function write(stream, data) {
+	return new Promise((resolve$1, reject) => {
+		stream.write(data, (error) => error ? reject(error) : resolve$1());
+	});
+}
+/** Origin-only bytes bridge. Local teardown is a resource barrier, not receiving proof. */
+function startSourceProxy(argv, destinationPort, signal) {
+	signal.throwIfAborted();
+	const child = startBinaryProcess(argv);
+	let socket, socketReader;
+	let closing = false, stderr = "", readyResolve, readyReject, fail;
+	const ready = new Promise((resolve$1, reject) => {
+		readyResolve = resolve$1;
+		readyReject = reject;
+	});
+	const failed = new Promise((_, reject) => {
+		fail = reject;
+	});
+	failed.catch(() => {});
+	const failure = (error, stage = "bridge") => {
+		if (!closing) {
+			const detail = new Error(`source proxy ${stage}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+			readyReject(detail);
+			fail(detail);
+		}
+	};
+	child.stderr.setEncoding("utf8");
+	child.stderr.on("data", (data) => {
+		stderr = (stderr + data).slice(-2 * 1024 * 1024);
+		if (stderr.includes("SOURCE_PROXY_READY\n")) readyResolve();
+	});
+	const send = async (kind, data = Buffer.alloc(0)) => {
+		const header$1 = Buffer.alloc(5);
+		header$1[0] = kind;
+		header$1.writeUInt32BE(data.length, 1);
+		await write(child.stdin, Buffer.concat([header$1, data]));
+	};
+	const pump = (async () => {
+		let input = Buffer.alloc(0);
+		for await (const chunk of child.stdout) {
+			input = Buffer.concat([input, chunk]);
+			while (input.length >= 5) {
+				const kind = input[0], size = input.readUInt32BE(1);
+				if (size > MAX || ![
+					1,
+					2,
+					3,
+					4
+				].includes(kind) || kind !== 2 && size) throw new Error("invalid source proxy frame");
+				if (input.length < size + 5) break;
+				const data = input.subarray(5, size + 5);
+				input = input.subarray(size + 5);
+				if (kind === 1) {
+					if (socket) throw new Error("source proxy overlapping connection");
+					const active = createConnection({
+						host: "127.0.0.1",
+						port: destinationPort,
+						allowHalfOpen: true
+					});
+					socket = active;
+					active.on("error", (error) => failure(error, "destination socket"));
+					await new Promise((resolve$1, reject) => {
+						const timer = setTimeout(() => {
+							active.destroy(/* @__PURE__ */ new Error("source proxy destination connect timeout"));
+						}, 5e3);
+						active.once("connect", () => {
+							clearTimeout(timer);
+							resolve$1();
+						});
+						active.once("error", (error) => {
+							clearTimeout(timer);
+							reject(error);
+						});
+					});
+					socketReader = (async () => {
+						for await (const bytes of active.iterator({ destroyOnReturn: false })) {
+							const data$1 = bytes;
+							for (let i = 0; i < data$1.length; i += MAX) await send(2, data$1.subarray(i, i + MAX));
+						}
+						await send(3);
+					})();
+					socketReader.catch((error) => failure(error, "destination reader"));
+				} else {
+					if (!socket) throw new Error("source proxy frame without socket");
+					if (kind === 2) await write(socket, data);
+					else if (kind === 3) socket.end();
+					else {
+						const previous = socket;
+						const closed = previous.closed ? Promise.resolve() : new Promise((resolve$1) => previous.once("close", () => resolve$1()));
+						await socketReader;
+						previous.destroy();
+						await closed;
+						socket = void 0;
+						socketReader = void 0;
+					}
+				}
+			}
+			if (input.length > MAX + 5) throw new Error("source proxy input bound");
+		}
+		if (input.length) throw new Error("truncated source proxy frame");
+	})();
+	pump.catch((error) => failure(error, "source frame reader"));
+	child.done.then((result) => failure(/* @__PURE__ */ new Error(`source proxy closed: exit ${result.exit}; ${stderr || child.diagnostic() || "no greeting"}`)));
+	const abort = () => {
+		socket?.destroy();
+		child.stdin.destroy();
+		failure(signal.reason);
+	};
+	signal.addEventListener("abort", abort, { once: true });
+	if (signal.aborted) abort();
+	let closePromise;
+	const close = () => closePromise ??= (async () => {
+		closing = true;
+		signal.removeEventListener("abort", abort);
+		const active = socket;
+		const socketClosed = active && !active.closed ? new Promise((resolve$1) => active.once("close", () => resolve$1())) : Promise.resolve();
+		active?.destroy();
+		child.stdin.destroy();
+		child.stdout.destroy();
+		child.cancel();
+		await Promise.allSettled([
+			pump,
+			socketReader,
+			socketClosed,
+			child.done
+		]);
+	})();
+	return {
+		ready,
+		failed,
+		close,
+		stderr: () => stderr
+	};
+}
+
+//#endregion
+//#region src/remote/ssh-relay.ts
+const RELAY_SSH_OPTIONS = [
+	"-a",
+	"-o",
+	"ForwardAgent=no",
+	"-o",
+	"ControlMaster=no",
+	"-o",
+	"ControlPath=none",
+	"-o",
+	"ExitOnForwardFailure=yes",
+	"-o",
+	"ConnectTimeout=10",
+	"-o",
+	"ServerAliveInterval=5",
+	"-o",
+	"ServerAliveCountMax=2"
+];
+const OUTPUT_LIMIT = 2 * 1024 * 1024;
+const LEASE_MS = 8e3;
+const RENEW_STEP_MS = 2e3;
+const REMOTE_CLEANUP_MS = 3500;
+const marker = (token, kind) => `__SUPERD_RSYNC_${token}_${kind}__`;
+/** Existing origin group ownership plus the independently accounted remote barrier. */
+var Command = class {
+	child;
+	events = new EventEmitter();
+	stdout = "";
+	stderr = "";
+	truncated = false;
+	renew;
+	stopping = false;
+	prepared = false;
+	exit;
+	argv;
+	acknowledged = false;
+	stopPromise;
+	cleanupDeadline = 0;
+	constructor(argv, signal, token, recover) {
+		this.signal = signal;
+		this.token = token;
+		this.recover = recover;
+		signal.throwIfAborted();
+		this.argv = argv;
+		this.child = startBinaryProcess(argv);
+		for (const channel of ["stdout", "stderr"]) {
+			this.child[channel].setEncoding("utf8");
+			this.child[channel].on("data", (text) => {
+				const value = this[channel] + text;
+				if (value.length > OUTPUT_LIMIT) this.truncated = true;
+				this[channel] = value.slice(-OUTPUT_LIMIT);
+				if (token && channel === "stderr") {
+					if (!this.prepared && this.stderr.includes(marker(token, "PREPARED"))) {
+						this.prepared = true;
+						this.cleanupDeadline = performance.now() + LEASE_MS + REMOTE_CLEANUP_MS;
+						if (!this.stopping && !signal.aborted) {
+							this.child.stdin.write("START\n");
+							this.renew = setInterval(() => {
+								if (this.stopping || this.child.stdin.destroyed) return;
+								this.cleanupDeadline += RENEW_STEP_MS;
+								this.child.stdin.write("KEEP\n");
+							}, RENEW_STEP_MS);
+						}
+					}
+					if (this.stderr.includes(marker(token, "CLEANED"))) this.acknowledged = true;
+				}
+				this.events.emit("change");
+			});
+		}
+		if (!token) this.child.stdin.end();
+		signal.addEventListener("abort", this.abort, { once: true });
+		if (signal.aborted) this.abort();
+		this.child.done.then((result) => {
+			this.exit = result.exit;
+			this.quiesce();
+			signal.removeEventListener("abort", this.abort);
+			this.events.emit("change");
+		});
+	}
+	quiesce() {
+		this.stopping = true;
+		if (this.renew) clearInterval(this.renew);
+	}
+	send(line) {
+		this.signal.throwIfAborted();
+		if (this.stopping || this.child.stdin.destroyed) throw new Error("SSH relay admission closed");
+		this.child.stdin.write(line + "\n");
+	}
+	stderrOutput() {
+		return this.token ? this.stderr.replace(new RegExp(`^__SUPERD_RSYNC_${this.token}_(?:PREPARED|CLEANED)__[^\n]*\n?`, "gm"), "") : this.stderr;
+	}
+	abort = () => {
+		this.quiesce();
+		if (!this.token) {
+			this.child.stdin.end();
+			this.child.cancel();
+		}
+		this.events.emit("change");
+	};
+	async change(ms) {
+		await new Promise((resolve$1) => {
+			const timer = setTimeout(finish, ms), self = this;
+			function finish() {
+				clearTimeout(timer);
+				self.events.off("change", finish);
+				resolve$1();
+			}
+			this.events.once("change", finish);
+		});
+	}
+	async result() {
+		this.signal.throwIfAborted();
+		let rejectAbort;
+		const aborted = new Promise((_, reject) => {
+			rejectAbort = () => reject(this.signal.reason);
+		});
+		this.signal.addEventListener("abort", rejectAbort, { once: true });
+		let result;
+		try {
+			result = await Promise.race([this.child.done, aborted]);
+		} finally {
+			this.signal.removeEventListener("abort", rejectAbort);
+		}
+		this.signal.throwIfAborted();
+		const stderr = this.stderrOutput() + (this.child.diagnostic() ? "\n" + this.child.diagnostic() : "");
+		return {
+			exit: result.exit,
+			stdout: this.stdout,
+			stderr: stderr.slice(-OUTPUT_LIMIT),
+			outputTruncated: this.truncated || stderr.length > OUTPUT_LIMIT
+		};
+	}
+	async ready(pattern, timeoutMs = 1e4) {
+		let ended = false;
+		this.child.done.then(() => {
+			ended = true;
+		});
+		const until = Date.now() + timeoutMs;
+		for (;;) {
+			this.signal.throwIfAborted();
+			const match = pattern.exec(this.stdout);
+			if (match) return match;
+			if (ended || Date.now() >= until) {
+				const status = ended ? `exit ${(await this.child.done).exit}` : "timeout";
+				throw new Error(`SSH relay readiness failed (${status}): ${this.stderrOutput() || this.child.diagnostic() || "no SSH ownership readiness greeting"}`);
+			}
+			await this.change(40);
+		}
+	}
+	stop() {
+		return this.stopPromise ??= this.stopOwned();
+	}
+	rejectedBeforeRemoteAdmission() {
+		if (this.prepared || this.acknowledged) return false;
+		if (this.exit !== 255) return false;
+		const lines = this.stderr.split("\n").map((line) => line.replace(/\r$/, ""));
+		if (lines.some((line) => /^ssh: connect to host [^\r\n]+ port [0-9]+: (?:Connection refused|No route to host|Network is unreachable|Connection timed out)$/.test(line))) return true;
+		if (lines.some((line) => /^[^\r\n ]+@[^\r\n ]+: Permission denied \((?:publickey|keyboard-interactive|password)(?:,[a-z-]+)*\)\.$/.test(line))) return true;
+		const forward = this.argv[this.argv.indexOf("-L") + 1];
+		const local = forward && /^127\.0\.0\.1:([0-9]+):/.exec(forward)?.[1];
+		return !!local && this.argv.includes("ExitOnForwardFailure=yes") && lines.includes(`bind [127.0.0.1]:${local}: Address already in use`) && lines.includes("Could not request local forwarding.");
+	}
+	async stopOwned() {
+		this.quiesce();
+		if (!this.child.stdin.destroyed) this.child.stdin.end("STOP\n");
+		while (this.token && !this.prepared && !this.acknowledged && !this.rejectedBeforeRemoteAdmission()) if (this.exit !== void 0 && this.recover) {
+			await this.recover();
+			this.acknowledged = true;
+		} else await this.change(100);
+		let timer;
+		try {
+			await Promise.race([this.child.done, new Promise((resolve$1) => {
+				timer = setTimeout(() => {
+					this.child.cancel();
+					resolve$1();
+				}, 2500);
+			})]);
+			await this.child.done;
+			while (this.prepared && !this.acknowledged && performance.now() < this.cleanupDeadline) await this.change(Math.min(100, this.cleanupDeadline - performance.now()));
+		} finally {
+			if (timer) clearTimeout(timer);
+		}
+	}
+};
+/** Native groups plus one owned monotonic clock/control coprocess. */
+const supervisor = (leased = true, token) => `set -eu
+set -m
+pid=
+clockPid=
+tmp=
+ack=${token ? shQuote(marker(token, "CLEANED")) : "''"}
+extraCleanup() { :; }
+cleanup() {
+  trap - EXIT
+  trap '' HUP INT TERM # A second gate/lease signal cannot interrupt cleanup or its final ACK.
+  extraCleanup
+  for child in $pid $clockPid $(jobs -pr); do
+    kill -TERM -- "-$child" 2>/dev/null || :
+    sleep .1
+    kill -KILL -- "-$child" 2>/dev/null || :
+    wait "$child" 2>/dev/null || :
+    while kill -0 -- "-$child" 2>/dev/null; do sleep .02; done
+  done
+  if [ -n "$tmp" ]; then rm -rf -- "$tmp"; fi
+  if [ -n "$ack" ]; then printf '%s\n' "$ack" >&2; fi
+}
+trap cleanup EXIT
+trap 'exit 125' HUP INT TERM
+${leased ? "exec {leaseInput}<&0" : ""}
+coproc CLOCK { ${leaseHelperCommand(leased ? "lease-clock" : "clock")}${leased ? " 3<&$leaseInput" : ""}; }
+clockPid=$CLOCK_PID
+exec {clockRead}<&\${CLOCK[0]}
+exec {clockWrite}>&\${CLOCK[1]}
+${leased ? "exec {leaseInput}<&-" : ""}
+now=0
+phase=prepared
+leaseEnd=0
+renewCount=0
+clock() {
+  previous=$now
+  printf 'QUERY\n' >&$clockWrite || { echo 'rsync monotonic clock pipe failed; admission closed' >&2; exit 125; }
+  IFS=' ' read -r now incomingEnd incomingCount incomingPhase <&$clockRead || { echo 'rsync monotonic clock EOF; admission closed' >&2; exit 125; }
+  [[ "$now" =~ ^[0-9]+$ ]] && [ "$now" -ge "$previous" ] || { echo 'invalid monotonic rsync clock; admission closed' >&2; exit 125; }
+  ${leased ? `[[ "$incomingEnd" =~ ^[0-9]+$ ]] && [[ "$incomingCount" =~ ^[0-9]+$ ]] || exit 125
+  leaseEnd=$incomingEnd
+  renewCount=$incomingCount
+  phase=$incomingPhase
+  [ "$phase" = prepared ] || [ "$phase" = active ] || exit 125` : ""}
+}
+publish() { :; }
+control() {
+  clock
+  [ "$phase" = active ] || return 1
+  publish
+  sleep .1
+}
+`;
+const leasedCommand = (script, token) => "bash -c " + shQuote(supervisor(true, token) + `clock
+[ "$phase" = prepared ] && [ "$now" -lt "$leaseEnd" ] && [ "$leaseEnd" -le $((now + 8000)) ] || { echo "native supervisor: prepared fence failed now=$now leaseEnd=$leaseEnd phase=$phase" >&2; exit 125; }
+printf '%s\n' ${shQuote(marker(token, "PREPARED"))} >&2
+while :; do clock; [ "$phase" = prepared ] || break; sleep .02; done
+[ "$phase" = active ] || { echo "native supervisor: admission not activated phase=$phase now=$now leaseEnd=$leaseEnd" >&2; exit 125; }
+` + script);
+async function startRecoverable(connection, command, token, signal, ssh, extra = []) {
+	const clock = await runCommand(commandArgv(connection, "bash -c " + shQuote("(( BASH_VERSINFO[0] > 4 || (BASH_VERSINFO[0] == 4 && BASH_VERSINFO[1] >= 1) ))") + " && " + recoveryHelperCommand("recovery-clock"), ssh), signal);
+	if (clock.exit !== 0) throw new Error(`native receiving recovery prerequisite failed: Bash4.1+, Python3.7+ (macOS3.10+), Unix fcntl.flock and shared monotonic clock required: ${clock.stderr}`);
+	const value = JSON.parse(clock.stdout);
+	if (!Number.isSafeInteger(value.tick) || value.tick < 0 || typeof value.base !== "string" || !value.base.startsWith("/") || /[\0\r\n]/.test(value.base)) throw new Error("invalid rsync receiving recovery clock");
+	const gate = {
+		root: value.base.replace(/\/$/, "") + "/superd-rsync-recovery." + token,
+		since: value.tick,
+		cutoff: value.tick + LEASE_MS,
+		token
+	};
+	const recover = async () => {
+		for (;;) {
+			const result = await runCommand(commandArgv(connection, recoveryHelperCommand("recovery-observe", gate), ssh), new AbortController().signal);
+			if (result.exit === 0 && result.stdout.trim() === marker(token, "CLEANED")) return;
+			await new Promise((resolve$1) => setTimeout(resolve$1, 500));
+		}
+	};
+	signal.throwIfAborted();
+	return new Command(commandArgv(connection, "bash -c " + shQuote(recoveryHelperCommand("recovery-run", {
+		...gate,
+		command
+	})), ssh, extra), signal, token, recover);
+}
+async function startLeased(connection, script, signal, ssh, extra = []) {
+	const token = randomUUID();
+	return startRecoverable(connection, leasedCommand(script, token), token, signal, ssh, extra);
+}
+const commandArgv = (connection, command, ssh, extra = []) => connection ? "commandArgv" in connection ? connection.commandArgv(command) : ssh(connection, {
+	extraArgs: [...RELAY_SSH_OPTIONS, ...extra],
+	command
+}) : [
+	"bash",
+	"-c",
+	command
+];
+async function runCommand(argv, signal) {
+	const command = new Command(argv, signal);
+	try {
+		return await command.result();
+	} finally {
+		await command.stop();
+	}
+}
+async function preflightRsync(connection, signal, ssh = sshArgv) {
+	const test = `set -eu
+(( BASH_VERSINFO[0] > 4 || (BASH_VERSINFO[0] == 4 && BASH_VERSINFO[1] >= 1) )) || { echo 'rsync requires Bash4.1+ coproc and dynamic file descriptors' >&2; exit 69; }
+coproc CLOCK { ${leaseHelperCommand("clock")}; }
+pid=$CLOCK_PID
+trap 'kill "$pid" 2>/dev/null || :; wait "$pid" 2>/dev/null || :' EXIT
+exec {reader}<&\${CLOCK[0]}
+exec {writer}>&\${CLOCK[1]}
+printf 'QUERY\\n' >&$writer
+IFS= read -r value <&$reader
+[[ "$value" =~ ^[0-9]+$ ]]
+`;
+	const result = await runCommand(commandArgv(connection, "command -v bash >/dev/null && command -v rsync >/dev/null" + (connection ? " && bash -c " + shQuote(test) : ""), ssh), signal);
+	if (result.exit !== 0) throw new Error(`rsync requires Bash/native rsync on the origin and Bash4.1+, native rsync, Python3.7+ monotonic clock/coprocess channel on SSH endpoints (no copy fallback): exit ${result.exit}; ${result.stderr}`);
+}
+/** Inspect link presence, not filenames: newline-bearing names cannot hide a link.
+* find owns a separate leased group, including while a large tree is inspected. */
+async function preflightRelaySource(connection, path$1, signal, ssh = sshArgv) {
+	await preflightRsync(connection, signal, ssh);
+	const source = path$1.replace(/\/+$/, "") || "/";
+	const command = await startLeased(connection, `command -v find >/dev/null || { echo 'SSH relay source inspection requires native find (no copy fallback)' >&2; exit 69; }
+if [ -e ${shQuote(source)} ] || [ -L ${shQuote(source)} ]; then
+  umask 077
+  tmp=$(mktemp -d "\${TMPDIR:-/tmp}/superd-rsync-inspect.XXXXXXXX")
+  clock; [ "$now" -lt "$leaseEnd" ] || exit 125
+  find ${shQuote(source)} -type l -print > "$tmp/links" &
+  pid=$!
+  while kill -0 "$pid" 2>/dev/null; do control || exit 125; done
+  set +e
+  wait "$pid"
+  status=$?
+  set -e
+  [ "$status" = 0 ] || exit "$status"
+  [ ! -s "$tmp/links" ] || { echo 'rsync SSH relay source symlinks are unsupported: confined non-chroot daemon cannot preserve their values. Use an ordinary local-SSH rsync leg or materialize files first.' >&2; exit 64; }
+fi`, signal, ssh);
+	try {
+		const result = await command.result();
+		if (result.exit !== 0) throw new Error(`rsync relay source inspection: exit ${result.exit}; ${result.stderr}`);
+	} finally {
+		await command.stop();
+	}
+}
+async function availablePort() {
+	const server = createServer();
+	await new Promise((resolve$1, reject) => {
+		server.once("error", reject);
+		server.listen(0, "127.0.0.1", resolve$1);
+	});
+	const address = server.address();
+	if (!address || typeof address === "string") throw new Error("cannot allocate SSH relay loopback port");
+	await new Promise((resolve$1, reject) => server.close((error) => error ? reject(error) : resolve$1()));
+	return address.port;
+}
+async function withSshRelay(source, destination, targetPath, signal, run, options = {}) {
+	if (!targetPath.startsWith("/") || /[\0\r\n]/.test(targetPath) || targetPath.trim() !== targetPath) throw new Error("rsync daemon destination must be an absolute existing directory without NUL/newline or leading/trailing whitespace");
+	if (targetPath.includes("%")) throw new Error("rsync SSH relay destination percent signs are unsupported by daemon config path expansion; use an ordinary local-SSH rsync leg or rename the directory (no relay writes performed)");
+	const target = targetPath.replace(/\/+$/, "") || "/";
+	if (target.trim() !== target) throw new Error("rsync daemon normalized destination must not end in whitespace (no relay writes performed)");
+	const ssh = options.ssh ?? sshArgv;
+	const chosen = /* @__PURE__ */ new Set();
+	if (!options.ports) while (chosen.size < 3) chosen.add(await availablePort());
+	const [d, o, s] = [...chosen];
+	const ports = options.ports ?? {
+		destination: d,
+		origin: o,
+		source: s
+	};
+	for (const value of Object.values(ports)) if (!Number.isInteger(value) || value < 1024 || value > 65535) throw new Error("SSH relay requires unprivileged high ports");
+	let dest;
+	let proxy;
+	let closed = false;
+	const senders = /* @__PURE__ */ new Set();
+	let outcome;
+	try {
+		await preflightRsync(source, signal, ssh);
+		await preflightRsync(destination, signal, ssh);
+		dest = await startLeased(destination, `[ -d ${shQuote(target)} ] && [ ! -L ${shQuote(target)} ] || { echo 'rsync remote relay requires an existing non-symlink destination directory; files/new paths are unsupported (module not widened)' >&2; exit 64; }
+umask 077
+tmp=$(mktemp -d "\${TMPDIR:-/tmp}/superd-rsync.XXXXXXXX")
+printf '%s\\n' 'use chroot = no' 'read only = no' 'munge symlinks = yes' 'hosts allow = 127.0.0.1' 'hosts deny = *' '[task]' ${shQuote("path = " + target)} > "$tmp/rsyncd.conf"
+clock; [ "$now" -lt "$leaseEnd" ] || exit 125
+rsync --daemon --no-detach --address=127.0.0.1 --port=${ports.destination} --config="$tmp/rsyncd.conf" &
+pid=$!
+for i in $(seq 1 100); do
+  clock; [ "$now" -lt "$leaseEnd" ] || exit 125
+  kill -0 "$pid" || exit 70
+  if (exec 3<>/dev/tcp/127.0.0.1/${ports.destination}) 2>/dev/null; then break; fi
+  sleep .05
+done
+kill -0 "$pid"
+printf 'READY %s %s\\n' "$pid" "$tmp"
+while kill -0 "$pid" 2>/dev/null; do control || exit 125; done
+wait "$pid"
+`, signal, ssh, ["-L", `127.0.0.1:${ports.origin}:127.0.0.1:${ports.destination}`]);
+		await dest.ready(/^READY \d+ \S+$/m);
+		outcome = await withNativeCommandOwner(source, signal, async (owner) => {
+			proxy = startSourceProxy(commandArgv(source, leaseHelperCommand("native-command", {
+				directory: owner,
+				argv: [
+					"python3",
+					"-u",
+					"-c",
+					SOURCE_PROXY_HELPER,
+					String(ports.source)
+				]
+			}), ssh), ports.origin, signal);
+			await Promise.race([proxy.ready, proxy.failed]);
+			return await Promise.race([proxy.failed, run({
+				url: `rsync://127.0.0.1:${ports.source}/task/`,
+				async run(argv) {
+					signal.throwIfAborted();
+					if (closed) throw new Error("SSH relay admission closed");
+					const sender = await startLeased(source, `LC_ALL=C ${argv.map(shQuote).join(" ")} <&0 &\npid=$!\nwhile kill -0 "$pid" 2>/dev/null; do control || exit 125; done\nset +e\nwait "$pid"\nexit $?\n`, signal, ssh);
+					senders.add(sender);
+					try {
+						const result = await sender.result();
+						const tunnel = [dest?.stderrOutput(), proxy?.stderr().replace("SOURCE_PROXY_READY\n", "")].filter(Boolean).join("\n");
+						const stderr = result.stderr + (tunnel ? "\n[tunnel stderr]\n" + tunnel : "");
+						return {
+							...result,
+							stderr: stderr.slice(-OUTPUT_LIMIT),
+							outputTruncated: result.outputTruncated || !!dest?.truncated || stderr.length > OUTPUT_LIMIT
+						};
+					} finally {
+						await sender.stop();
+						senders.delete(sender);
+					}
+				}
+			})]);
+		}, ssh);
+		signal.throwIfAborted();
+		return outcome;
+	} catch (error) {
+		const native = [dest?.stderrOutput(), proxy?.stderr()].filter(Boolean).join("\n");
+		if (signal.aborted) throw signal.reason;
+		throw new Error(`${error instanceof Error ? error.message : String(error)}${native ? "\n[tunnel stderr]\n" + native : ""}`, { cause: error });
+	} finally {
+		closed = true;
+		dest?.quiesce();
+		for (const sender of senders) sender.quiesce();
+		try {
+			for (const sender of senders) await sender.stop();
+		} finally {
+			try {
+				await proxy?.close();
+			} finally {
+				await dest?.stop();
+			}
+		}
+	}
+}
+/** Portable sideband ownership: work stdin stays exclusively with the native command. */
+async function withNativeCommandOwner(connection, signal, run, ssh = sshArgv) {
+	signal.throwIfAborted();
+	const controller = await startLeased(connection, `for executable in mktemp mv rm sleep; do
+  command -v "$executable" >/dev/null || { printf 'native receiving control requires %s (no transfer admitted)\\n' "$executable" >&2; exit 69; }
+done
+umask 077
+tmp=$(mktemp -d "\${TMPDIR:-/tmp}/superd-rsync-native.XXXXXXXX")
+extraCleanup() {
+  rm -f -- "$tmp/active"
+  helpers=()
+  groups=()
+  clocks=()
+  for record in "$tmp"/server.*; do
+    [ -f "$record" ] || continue
+    helper=\${record##*/server.}
+    [[ "$helper" =~ ^[0-9]+$ ]] || continue
+    group=0
+    clockGroup=0
+    IFS=' ' read -r ignored group clockGroup < "$record" || :
+    [[ "$group" =~ ^[1-9][0-9]*$ ]] || group=0
+    [[ "$clockGroup" =~ ^[1-9][0-9]*$ ]] || clockGroup=0
+    helpers+=("$helper")
+    groups+=("$group")
+    clocks+=("$clockGroup")
+    [ "$group" = 0 ] || kill -TERM -- "-$group" 2>/dev/null || :
+    [ "$clockGroup" = 0 ] || kill -TERM -- "-$clockGroup" 2>/dev/null || :
+    kill -TERM -- "$helper" 2>/dev/null || :
+  done
+  sleep .25
+  for group in "\${groups[@]}"; do [ "$group" = 0 ] || kill -KILL -- "-$group" 2>/dev/null || :; done
+  for group in "\${clocks[@]}"; do [ "$group" = 0 ] || kill -KILL -- "-$group" 2>/dev/null || :; done
+  for helper in "\${helpers[@]}"; do kill -KILL -- "$helper" 2>/dev/null || :; done
+  for group in "\${groups[@]}" "\${clocks[@]}"; do
+    [ "$group" = 0 ] && continue
+    while kill -0 -- "-$group" 2>/dev/null; do sleep .02; done
+  done
+  for helper in "\${helpers[@]}"; do while kill -0 "$helper" 2>/dev/null; do sleep .02; done; done
+}
+publish() {
+  printf '%s %s\\n' "$((leaseEnd - now))" "$renewCount" > "$tmp/lease.new"
+  mv -- "$tmp/lease.new" "$tmp/lease"
+}
+publish
+clock; [ "$now" -lt "$leaseEnd" ] || { echo "native owner: lease expired before activation now=$now leaseEnd=$leaseEnd" >&2; exit 125; }
+printf '%s\n' active > "$tmp/active"
+printf 'OWNER %s\n' "$tmp"
+while :; do control || { [ "$phase" = closed ] || echo "native owner: control lost while phase=$phase now=$now leaseEnd=$leaseEnd" >&2; exit 125; }; done
+`, signal, ssh);
+	try {
+		const directory = (await controller.ready(/^OWNER (.+)$/m))[1];
+		if (!directory.startsWith("/") || /[\0\r\n]/.test(directory)) throw new Error("native receiving ownership path is not representable");
+		const result = await run(directory);
+		signal.throwIfAborted();
+		return result;
+	} finally {
+		await controller.stop();
+	}
+}
+/** Registration precedes the second activation fence and protocol child admission.
+* Controller and server use counted increments, never refresh leases from late arrival. */
+function nativeRsyncPath(directory) {
+	return "bash -c " + shQuote(supervisor(false) + `owner=${shQuote(directory)}
+record="$owner/server.$$"
+extraCleanup() { :; }
+[ -f "$owner/active" ] || exit 125
+printf '%s 0 %s\\n' "$$" "$clockPid" > "$record"
+IFS=' ' read -r remaining seen < "$owner/lease"
+[[ "$remaining" =~ ^[1-9][0-9]*$ ]] && [[ "$seen" =~ ^[0-9]+$ ]] || exit 125
+clock
+leaseEnd=$((now + remaining))
+[ -f "$owner/active" ] || exit 125
+rsync "$@" <&0 &
+pid=$!
+printf '%s %s %s\\n' "$$" "$pid" "$clockPid" > "$record"
+while kill -0 "$pid" 2>/dev/null; do
+  clock; [ "$now" -lt "$leaseEnd" ] && [ -f "$owner/active" ] || exit 125
+  IFS=' ' read -r remaining count < "$owner/lease" || exit 125
+  [[ "$remaining" =~ ^[1-9][0-9]*$ ]] && [[ "$count" =~ ^[0-9]+$ ]] || exit 125
+  [ "$count" -ge "$seen" ] || exit 125
+  leaseEnd=$((leaseEnd + (count - seen) * 2000))
+  seen=$count
+  [ "$leaseEnd" -le $((now + 8000)) ] || leaseEnd=$((now + 8000))
+  sleep .1
+done
+set +e
+wait "$pid"
+status=$?
+exit "$status"
+`) + " rsync-server";
+}
+const withNativeRsyncOwner = withNativeCommandOwner;
+
+//#endregion
+//#region src/remote/rsync.ts
+const rshQuote = (value) => "'" + value.replaceAll("'", "''") + "'";
+async function runRsync(request, source, destination, signal, options = {}) {
+	signal.throwIfAborted();
+	checkAbsolute(source.path);
+	checkAbsolute(destination.path);
+	if (!source.connection && !destination.connection) throw new Error("rsync requires at least one SSH endpoint; local-only is unsupported");
+	if (request.excludes !== void 0 && (!Array.isArray(request.excludes) || request.excludes.some((value) => typeof value !== "string" || value.includes("\0")))) throw new Error("rsync excludes must be strings without NUL");
+	const dryRun = request.dryRun ?? true, remove = request.delete ?? false, preserve = request.preserve ?? true;
+	const args = [
+		"rsync",
+		preserve ? "-a" : "-r",
+		"--no-compress",
+		"--stats",
+		"--itemize-changes",
+		"--timeout=10",
+		...dryRun ? ["--dry-run"] : [],
+		...remove ? ["--delete"] : [],
+		...(request.excludes ?? []).map((value) => "--exclude=" + value)
+	];
+	const ssh = options.ssh ?? sshArgv;
+	let result;
+	if (source.connection && destination.connection) {
+		await preflightRelaySource(source.connection, source.path, signal, ssh);
+		result = await withSshRelay(source.connection, destination.connection, destination.path, signal, (relay) => relay.run([
+			...args,
+			"--",
+			source.path,
+			relay.url
+		]), options);
+	} else {
+		const remote = source.connection ?? destination.connection;
+		await preflightRsync(void 0, signal, ssh);
+		await preflightRsync(remote, signal, ssh);
+		const transport = [
+			"bash",
+			"-c",
+			"shift; exec " + ssh(remote, { extraArgs: RELAY_SSH_OPTIONS }).map(shQuote).join(" ") + " \"$@\"",
+			"rsync-ssh"
+		].map(rshQuote).join(" ");
+		const src = source.connection ? `rsync-peer:${source.path}` : source.path;
+		const dst = destination.connection ? `rsync-peer:${destination.path}` : destination.path;
+		result = await withNativeRsyncOwner(remote, signal, (directory) => {
+			return runCommand([
+				"bash",
+				"-c",
+				"LC_ALL=C exec " + [
+					...args,
+					"--secluded-args",
+					"-e",
+					transport,
+					"--rsync-path=" + nativeRsyncPath(directory),
+					"--",
+					src,
+					dst
+				].map(shQuote).join(" ")
+			], signal);
+		}, ssh);
+	}
+	const number = (label) => {
+		const match = new RegExp(`^${label}: ([\\d,]+)(?: bytes)?$`, "m").exec(result.stdout);
+		return match ? Number(match[1].replaceAll(",", "")) : void 0;
+	};
+	const sentBytes = number("Total bytes sent"), receivedBytes = number("Total bytes received");
+	return {
+		...result,
+		action: "rsync",
+		src: request.src,
+		dst: request.dst,
+		dryRun,
+		delete: remove,
+		preserve,
+		itemizedChanges: result.stdout.split("\n").filter((line) => /^[<>ch.*][fdLDS.]/.test(line) || line.startsWith("*deleting")),
+		literalBytes: number("Literal data"),
+		matchedBytes: number("Matched data"),
+		sentBytes,
+		receivedBytes,
+		transferredBytes: sentBytes !== void 0 && receivedBytes !== void 0 ? sentBytes + receivedBytes : void 0
+	};
+}
+
+//#endregion
+//#region src/remote/ssh-process.ts
+/** The sideband owns receiving cleanup; the separate native work transport keeps literal stdio. */
+function startOwnedNativeProcess(plan, cmd, options) {
+	const started = Date.now(), abort = new AbortController(), ssh = options.ssh ?? sshArgv;
+	const connection = plan.kind === "ssh" ? plan.connection ?? { host: plan.host } : { commandArgv: (command) => buildOneShotArgv(plan, command) };
+	const workArgv = (command) => "commandArgv" in connection ? connection.commandArgv(command) : ssh(connection, {
+		extraArgs: [...RELAY_SSH_OPTIONS],
+		command
+	});
+	let timedOut = false, raw, diagnostic;
+	let complete;
+	const done = new Promise((resolve$1) => {
+		complete = resolve$1;
+	});
+	let admit, reject;
+	const ready = new Promise((resolve$1, fail) => {
+		admit = resolve$1;
+		reject = fail;
+	});
+	const cancel = () => abort.abort(/* @__PURE__ */ new Error("remote command cancelled"));
+	options.signal.addEventListener("abort", cancel, { once: true });
+	if (options.signal.aborted) cancel();
+	const timer = options.timeoutSec === void 0 ? void 0 : setTimeout(() => {
+		timedOut = true;
+		cancel();
+	}, options.timeoutSec * 1e3);
+	const operation = withNativeCommandOwner(connection, abort.signal, async (directory) => {
+		abort.signal.throwIfAborted();
+		raw = startOneShot(workArgv(leaseHelperCommand("native-command", {
+			directory,
+			argv: [
+				"bash",
+				"-lc",
+				cmd
+			],
+			subreaper: plan.kind !== "ssh"
+		})), { stdin: options.stdin });
+		admit({
+			done,
+			cancel,
+			read(channel, cursor) {
+				const value = raw.read(channel, cursor);
+				return channel === "stderr" && diagnostic ? {
+					...value,
+					diagnostic
+				} : value;
+			}
+		});
+		let aborted;
+		const interrupted = new Promise((_, fail) => {
+			aborted = () => fail(abort.signal.reason);
+		});
+		abort.signal.addEventListener("abort", aborted, { once: true });
+		if (abort.signal.aborted) aborted();
+		try {
+			return await Promise.race([raw.done, interrupted]);
+		} finally {
+			abort.signal.removeEventListener("abort", aborted);
+		}
+	}, ssh);
+	(async () => {
+		let result;
+		try {
+			result = await operation;
+		} catch (error) {
+			if (!abort.signal.aborted) diagnostic = String(error);
+			if (!raw) reject(error);
+		} finally {
+			if (raw) {
+				let drainTimer;
+				const drained = await Promise.race([raw.done, new Promise((resolve$1) => {
+					drainTimer = setTimeout(() => resolve$1(void 0), 2500);
+				})]);
+				if (drainTimer) clearTimeout(drainTimer);
+				if (!drained) {
+					diagnostic = [diagnostic, "remote: receiver cleanup confirmed; work output drain unavailable after 2500ms, output may be incomplete (stats count received data only)"].filter(Boolean).join("\n");
+					raw.cancel();
+				}
+				result = drained ?? await raw.done;
+			}
+			if (timer) clearTimeout(timer);
+			options.signal.removeEventListener("abort", cancel);
+			complete({
+				exit: diagnostic ? null : result?.exit ?? null,
+				cancelled: abort.signal.aborted,
+				timedOut,
+				durationMs: Date.now() - started
+			});
+		}
+	})();
+	return ready;
+}
+/** Raw file/protocol lane: no text rings or successful incomplete-output deadline.
+* Cancellation stops the receiver through its independent owner before the local
+* work transport is torn down. Normal completion requires the work stream close.
+*/
+function startOwnedBinaryProcess(plan, argv, signal) {
+	const started = Date.now(), abort = new AbortController();
+	const connection = plan.kind === "ssh" ? plan.connection ?? { host: plan.host } : { commandArgv: (command) => buildOneShotArgv(plan, command) };
+	const workArgv = (command) => "commandArgv" in connection ? connection.commandArgv(command) : sshArgv(connection, {
+		extraArgs: [...RELAY_SSH_OPTIONS],
+		command
+	});
+	let raw, diagnostic;
+	let complete;
+	const done = new Promise((resolve$1) => {
+		complete = resolve$1;
+	});
+	let admit, reject;
+	const ready = new Promise((resolve$1, fail) => {
+		admit = resolve$1;
+		reject = fail;
+	});
+	const cancel = () => abort.abort(signal.reason ?? /* @__PURE__ */ new Error("remote binary operation cancelled"));
+	signal.addEventListener("abort", cancel, { once: true });
+	if (signal.aborted) cancel();
+	const operation = withNativeCommandOwner(connection, abort.signal, async (directory) => {
+		abort.signal.throwIfAborted();
+		raw = startBinaryProcess(workArgv(leaseHelperCommand("native-command", {
+			directory,
+			argv,
+			subreaper: plan.kind !== "ssh"
+		})));
+		admit({
+			...raw,
+			cancel,
+			done,
+			diagnostic: () => diagnostic ?? raw.diagnostic()
+		});
+		let interrupted;
+		const interruption = new Promise((_, fail) => {
+			interrupted = () => fail(abort.signal.reason);
+		});
+		abort.signal.addEventListener("abort", interrupted, { once: true });
+		if (abort.signal.aborted) interrupted();
+		try {
+			return await Promise.race([raw.done, interruption]);
+		} finally {
+			abort.signal.removeEventListener("abort", interrupted);
+		}
+	});
+	(async () => {
+		let result;
+		try {
+			result = await operation;
+		} catch (error) {
+			diagnostic = String(error);
+			if (!raw) reject(error);
+		} finally {
+			if (raw) {
+				if (!result) raw.cancel();
+				result = await raw.done;
+			}
+			signal.removeEventListener("abort", cancel);
+			complete({
+				exit: diagnostic ? null : result?.exit ?? null,
+				cancelled: abort.signal.aborted,
+				timedOut: false,
+				durationMs: Date.now() - started
+			});
+		}
+	})();
+	return ready;
+}
+
+//#endregion
+//#region src/remote/archive-python.ts
+/** CLI peer implementation of archive.ts carrier v1. Never installed or persisted. */
+const FILE_PYTHON = String.raw`
+import os,sys,json,hashlib,struct,stat,tempfile,shutil,posixpath,signal
+def interrupted(signum,frame): raise InterruptedError('binary transfer cancelled')
+for sig in (signal.SIGTERM,signal.SIGHUP,signal.SIGINT):signal.signal(sig,interrupted)
+LIMIT=65536
+MAX_ENTRIES=10000
+MAX_META=8388608
+op,root=sys.argv[1:3]
+def relative(p):
+ if not isinstance(p,str) or len(p.encode())>4096 or '\0' in p or (p and (p.startswith('/') or any(x in ('','.','..') for x in p.split('/')))): raise ValueError('unsafe archive relative path')
+def absolute(p):
+ if not p.startswith('/') or '\0' in p or '..' in p.split('/'): raise ValueError('absolute file path without traversal required')
+def ancestors(p):
+ absolute(p)
+ parts=os.path.abspath(p).split('/')[1:-1]
+ for i in range(1,len(parts)+1):
+  try:
+   st=os.lstat('/'+'/'.join(parts[:i]))
+   if not stat.S_ISDIR(st.st_mode): raise ValueError('unsafe symlink or non-directory ancestor')
+  except FileNotFoundError: pass
+def linkcheck(e):
+ link=e.get('link')
+ if not e['p'] or not isinstance(link,str) or not link or link.startswith('/') or '\0' in link or len(link.encode())>4096: raise ValueError('unsafe archive symlink')
+ target=posixpath.normpath(posixpath.join(posixpath.dirname(e['p']),link))
+ if target=='..' or target.startswith('../'): raise ValueError('unsafe archive symlink escape')
+def tree_links(entries):
+ incoming={e['p']:e for e in entries}
+ for link in entries:
+  if link['t']!='l':continue
+  parent=posixpath.dirname(link['p']);stack=parent.split('/') if parent else [];pending=link['link'].split('/');hops=0
+  while pending:
+   part=pending.pop(0)
+   if part in ('','.'):continue
+   if part=='..':
+    if not stack:raise ValueError('unsafe symlink chain escape')
+    stack.pop();continue
+   e=incoming.get('/'.join(stack+[part]))
+   if not e:raise ValueError('unsafe symlink target outside incoming tree (destination aliases are not followed)')
+   if e['t']=='l':
+    hops+=1
+    if hops>40:raise ValueError('unsafe symlink cycle or chain limit')
+    pending=e['link'].split('/')+pending
+   else:
+    if pending and e['t']!='d':raise ValueError('unsafe symlink non-directory target ancestor')
+    stack.append(part)
+def encode(o): return json.dumps(o,ensure_ascii=False,separators=(',',':')).encode()
+def header(o):
+ b=encode(o)
+ return struct.pack('>I',len(b))+b
+def entry(p):
+ relative(p);path=os.path.join(root,p) if p else root;ancestors(path);st=os.lstat(path)
+ if stat.S_ISDIR(st.st_mode): return dict(p=p,t='d',n=0)
+ if stat.S_ISLNK(st.st_mode):
+  e=dict(p=p,t='l',n=0,link=os.readlink(path));linkcheck(e);return e
+ if not stat.S_ISREG(st.st_mode): raise ValueError('unsupported file type')
+ h=hashlib.sha256()
+ with os.fdopen(os.open(path,os.O_RDONLY|os.O_NOFOLLOW),'rb') as f:
+  for data in iter(lambda:f.read(LIMIT),b''):h.update(data)
+ return dict(p=p,t='f',n=st.st_size,hash=h.hexdigest())
+def tree(selection=None):
+ entries=[]
+ def visit(p):
+  e=entry(p);entries.append(e)
+  if len(entries)>MAX_ENTRIES:raise ValueError('archive entry limit')
+  if e['t']=='d':
+   for name in sorted(os.listdir(os.path.join(root,p)),key=lambda x:x.encode()):visit(posixpath.join(p,name))
+ if selection is None:visit('')
+ else:
+  if not isinstance(selection,list) or len(selection)>MAX_ENTRIES or len(encode(selection))>MAX_META or len(set(selection))!=len(selection):raise ValueError('invalid selection limit/duplicates')
+  entries=[entry(p) for p in selection]
+ if len(encode(entries))>MAX_META:raise ValueError('archive metadata limit')
+ return entries
+def digest(entries):
+ h=hashlib.sha256();size=0
+ for e in sorted(entries,key=lambda e:e['p'].encode()):
+  h.update(header([e['p'],e['t'],e['n'],e.get('hash','') if e['t']=='f' else e.get('link','') if e['t']=='l' else '']))
+  if e['t']=='f':size+=e['n']
+ return dict(sha256=h.hexdigest(),bytes=size,entries=len(entries))
+def readexact(f,n):
+ b=f.read(n)
+ if len(b)!=n:raise ValueError('truncated binary archive')
+ return b
+def inspect(f):
+ result=[];seen={};meta=0
+ while True:
+  n=struct.unpack('>I',readexact(f,4))[0]
+  if not n or n>LIMIT:raise ValueError('archive header limit')
+  meta+=n
+  if meta>MAX_META:raise ValueError('archive metadata limit')
+  e=json.loads(readexact(f,n))
+  if e.get('end') is True:
+   if f.read(1):raise ValueError('trailing archive bytes')
+   break
+  relative(e.get('p'));p=e['p']
+  if e.get('t') not in ('f','d','l') or type(e.get('n')) is not int or not 0<=e['n']<=9007199254740991 or (e['t']!='f' and e['n']!=0):raise ValueError('unsafe archive type/size')
+  if len(result)>=MAX_ENTRIES or p in seen:raise ValueError('archive duplicate or limit')
+  if not result and p!='':raise ValueError('archive root missing')
+  if p and seen.get(posixpath.dirname(p),{}).get('t')!='d':raise ValueError('unsafe archive parent')
+  if e['t']=='l':linkcheck(e)
+  e['offset']=f.tell();h=hashlib.sha256();left=e['n']
+  while left:
+   data=readexact(f,min(LIMIT,left));h.update(data);left-=len(data)
+  if e['t']=='f':e['hash']=h.hexdigest()
+  seen[p]=e;result.append(e)
+ if not result:raise ValueError('archive root missing')
+ return result
+absolute(root)
+if op=='export':
+ for e in tree():
+  sys.stdout.buffer.write(header({k:v for k,v in e.items() if k!='hash'}))
+  if e['t']=='f':
+   with os.fdopen(os.open(os.path.join(root,e['p']) if e['p'] else root,os.O_RDONLY|os.O_NOFOLLOW),'rb') as f:shutil.copyfileobj(f,sys.stdout.buffer,LIMIT)
+ sys.stdout.buffer.write(header(dict(end=True)));sys.stdout.buffer.flush()
+elif op=='digest':
+ raw=sys.stdin.buffer.read(MAX_META+1)
+ if len(raw)>MAX_META:raise ValueError('selection metadata limit')
+ print(json.dumps(digest(tree(json.loads(raw) if raw else None)),separators=(',',':')))
+elif op=='import':
+ with tempfile.TemporaryFile() as f:
+  shutil.copyfileobj(sys.stdin.buffer,f,LIMIT);f.seek(0);entries=inspect(f);tree_links(entries)
+  for e in entries:
+   path=os.path.join(root,e['p']) if e['p'] else root;ancestors(path)
+   try:
+    st=os.lstat(path);typ='l' if stat.S_ISLNK(st.st_mode) else 'd' if stat.S_ISDIR(st.st_mode) else 'f' if stat.S_ISREG(st.st_mode) else '?'
+    if typ!=e['t'] or typ=='l':raise ValueError('destination path/type conflict or existing symlink')
+   except FileNotFoundError:pass
+  if sys.argv[3]=='true':os.makedirs(os.path.dirname(root),exist_ok=True)
+  for e in entries:
+   path=os.path.join(root,e['p']) if e['p'] else root;ancestors(path)
+   if e['t']=='d':os.makedirs(path,exist_ok=True)
+   elif e['t']=='l':os.symlink(e['link'],path)
+   else:
+    fd,temp=tempfile.mkstemp(prefix='.remote-copy-',dir=os.path.dirname(path))
+    try:
+     with os.fdopen(fd,'wb') as out:
+      f.seek(e['offset']);left=e['n']
+      while left:
+       b=readexact(f,min(LIMIT,left));out.write(b);left-=len(b)
+     ancestors(path);os.replace(temp,path)
+    finally:
+     if os.path.exists(temp):os.unlink(temp)
+else:raise ValueError('unsupported binary operation')
+`;
+
+//#endregion
+//#region src/remote/endpoints.ts
+function parseFileEndpoint(value) {
+	if (typeof value !== "string" || !value) throw new Error("file endpoint required");
+	if (value.startsWith("/")) {
+		checkAbsolute(value);
+		return { path: value };
+	}
+	const split = value.lastIndexOf(":/");
+	if (split < 1) throw new Error("file endpoint must be [target:]absolute/path");
+	const target = value.slice(0, split), path$1 = value.slice(split + 1);
+	checkAbsolute(path$1);
+	if (target.startsWith("byop:")) throw new Error("BYO-PTY has no binary file lane; select SSH/Docker/Incus/Hub");
+	return {
+		target,
+		path: path$1
 	};
-	if (opts.timeoutSec !== void 0) {
-		const killGroup = (sig) => {
-			if (child.pid === void 0) {
-				child.kill(sig);
-				return;
+}
+/** Shared process-group lifecycle; binary stdout never enters the text output ring. */
+function cliFileEndpoint(plan) {
+	const run = async (op, path$1, signal, mkdir$1 = false) => {
+		checkAbsolute(path$1);
+		signal.throwIfAborted();
+		const child = await startOwnedBinaryProcess(plan, [
+			"python3",
+			"-c",
+			FILE_PYTHON,
+			op,
+			path$1,
+			String(mkdir$1)
+		], signal);
+		let stderr = "";
+		child.stderr.on("data", (chunk) => {
+			stderr = (stderr + String(chunk)).slice(-8e3);
+		});
+		const cancel = () => child.cancel();
+		signal.addEventListener("abort", cancel, { once: true });
+		const done = child.done.then((result) => {
+			signal.removeEventListener("abort", cancel);
+			if (signal.aborted) throw signal.reason;
+			if (result.exit !== 0) throw new Error(`binary CLI ${op} failed (receiving owner requires Bash 4.1+, Python 3.7+, fcntl and shared monotonic clock; containers also ctypes/subreaper): ${child.diagnostic() ?? stderr ?? result.exit}`);
+		});
+		done.catch(() => {});
+		return {
+			child,
+			done
+		};
+	};
+	return {
+		async exportTree(path$1, signal) {
+			const { child, done } = await run("export", path$1, signal);
+			child.stdin.end();
+			return Readable.from((async function* () {
+				try {
+					for await (const chunk of child.stdout) yield chunk;
+					await done;
+				} finally {
+					child.cancel();
+					await done.catch(() => {});
+				}
+			})());
+		},
+		async importTree(path$1, source, { mkdir: mkdir$1, signal }) {
+			const { child, done } = await run("import", path$1, signal, mkdir$1);
+			child.stdout.resume();
+			try {
+				await pipeline(source, child.stdin, { signal });
+				await done;
+			} catch (error) {
+				child.cancel();
+				await done;
+				throw error;
+			} finally {
+				child.cancel();
+				await done.catch(() => {});
 			}
+		},
+		async digest(path$1, signal, selection) {
+			if (selection) checkSelection(selection);
+			const { child, done } = await run("digest", path$1, signal);
+			child.stdin.end(selection ? JSON.stringify(selection) : "");
+			let data = "";
 			try {
-				process.kill(-child.pid, sig);
-			} catch {}
+				for await (const chunk of child.stdout) {
+					data += String(chunk);
+					if (data.length > 8192) throw new Error("oversized digest response");
+				}
+				await done;
+				return JSON.parse(data);
+			} finally {
+				child.cancel();
+				await done.catch(() => {});
+			}
+		}
+	};
+}
+
+//#endregion
+//#region src/remote/input.ts
+/** Local carrier validation precedes any target discovery, connection or spawn. */
+async function prepareRemoteInput(input) {
+	if (input.mode !== void 0 && input.mode !== "oneshot" && input.mode !== "pty") throw new Error("[E_BAD_MODE] remote: mode must be oneshot or pty");
+	if (input.script !== void 0) {
+		if (input.cmd !== void 0 || input.stdin !== void 0 || input.mode === "pty" || input.spawn !== void 0 || input.target?.startsWith("byop:")) throw new Error("[E_SCRIPT_PARAMS] remote: script is oneshot-only and cannot be combined with cmd, stdin, spawn or BYO-PTY");
+		if (typeof input.script !== "string" || !isAbsolute(input.script) || input.script.includes("\0")) throw new Error("[E_SCRIPT_PATH] remote: script must be a local absolute path without NUL");
+	}
+	if (!input.target) throw new Error("[E_PARAMS] remote: target is required; spawn requires a byop:<label> target");
+	if (input.script !== void 0) {
+		let stdin;
+		try {
+			stdin = await readFile(input.script, "utf8");
+		} catch (error) {
+			throw new Error(`[E_SCRIPT_READ] remote: cannot read local script ${JSON.stringify(input.script)} — ${error instanceof Error ? error.message : String(error)}`);
+		}
+		return {
+			target: input.target,
+			ssh: input.ssh,
+			cmd: "bash -s",
+			stdin,
+			mode: "oneshot",
+			timeout: input.timeout
 		};
-		termTimer = setTimeout(() => {
-			timedOut = true;
-			killGroup("SIGTERM");
-			killTimer = setTimeout(() => killGroup("SIGKILL"), 2e3);
-		}, opts.timeoutSec * 1e3);
-	}
-	const exit = await new Promise((resolve$1) => {
-		child.once("close", (code) => resolve$1(code));
-		child.once("error", (err) => {
-			stderr += `\n[remote: spawn failed: ${err.message}]`;
-			resolve$1(null);
-		});
-	});
-	clearTimers();
+	}
+	return {
+		target: input.target,
+		spawn: input.spawn,
+		ssh: input.ssh,
+		cmd: input.cmd ?? "",
+		stdin: input.stdin,
+		mode: input.mode,
+		timeout: input.timeout
+	};
+}
+
+//#endregion
+//#region src/remote/oneshot.ts
+async function runOneShot(argv, opts = {}) {
+	const process$1 = startOneShot(argv, opts);
+	const result = await process$1.done;
+	const stdout = process$1.read("stdout", 0), stderr = process$1.read("stderr", 0);
 	return {
-		exit,
-		timedOut,
-		stdout,
-		stderr,
-		durationMs: Date.now() - started
+		...result,
+		stdout: stdout.text,
+		stderr: [stderr.text, stderr.diagnostic].filter(Boolean).join("\n"),
+		outputStats: {
+			stdout: stdout.stats,
+			stderr: stderr.stats
+		}
 	};
 }
 
@@ -93,11 +2392,23 @@ function stripAnsi(s) {
 function normalizePtyText(s) {
 	return stripAnsi(s).replace(/\r\n/g, "\n").replace(/\r/g, "");
 }
-function tailWindow(text, cap) {
-	if (text.length <= cap) return { text };
+function tailWindow(text, cap, stats) {
+	let tail = text.slice(-cap);
+	if (tail.charCodeAt(0) >= 56320 && tail.charCodeAt(0) <= 57343) tail = tail.slice(1);
+	const returned = stats?.unit === "bytes" ? Buffer.byteLength(tail) : tail.length;
+	const total = stats?.total ?? text.length;
+	const updated = stats === void 0 ? {} : { stats: {
+		...stats,
+		returned
+	} };
+	if (total <= returned) return {
+		text: tail,
+		...updated
+	};
 	return {
-		text: `[truncated: showing last ${cap} of ${text.length} chars]\n${text.slice(text.length - cap)}`,
-		truncated: text.length
+		text: `[truncated: showing last ${returned} of ${total} ${stats?.unit === "bytes" ? "bytes" : "chars"}${stats !== void 0 && stats.dropped > 0 ? `; retained ${stats.retained}, dropped head ${stats.dropped}, retention limit ${stats.retentionLimit} ${stats.unit === "bytes" ? "bytes" : "UTF-16 code units"}` : ""}]\n${tail}`,
+		truncated: total,
+		...updated
 	};
 }
 const FRAME_BODY_RE = /^(\d+);([^\x07\x1b]*)(?:\x07|\x1b\\)/;
@@ -182,6 +2493,9 @@ var PtySession = class {
 	lastSettleAt = 0;
 	/** 是否曾成功初始化（ready 过）。决定死亡语义：ready 过 → reconnect（留池）；从未 ready → 出池（见 start()）。 */
 	everReady = false;
+	disposal;
+	procClose = Promise.resolve();
+	groupCleanup = Promise.resolve();
 	constructor(opts) {
 		this.opts = opts;
 	}
@@ -207,16 +2521,17 @@ var PtySession = class {
 			const started = Date.now();
 			const reconnected = this.state === "dead";
 			if (this.state !== "ready") await this.start();
+			if (this.state === "disposed") throw new Error(`[E_SESSION_DISPOSED] remote pty session '${displayKey(this.opts.key)}' was disposed before dispatch`);
 			this.inFlight++;
 			return await new Promise((resolve$1) => {
 				const nonce = genNonce();
-				let output = "";
+				const ring = new Utf16TailRing(OUTPUT_HARD_CAP);
 				let interrupted = false;
 				let settled = false;
 				let interruptTimer;
 				let killTimer;
 				const deathWaiter = () => finish({
-					output,
+					output: ring.text,
 					exit: null,
 					cwd: null,
 					timedOut: interrupted
@@ -236,20 +2551,17 @@ var PtySession = class {
 					this.resetIdleTimer();
 					resolve$1({
 						...r,
+						outputStats: { stdout: ring.stats() },
 						reconnected,
 						durationMs: Date.now() - started
 					});
 				};
 				const parser = createNonceFrameParser(nonce, {
 					onOutput: (t) => {
-						output += t;
-						if (output.length > OUTPUT_HARD_CAP) {
-							output = output.slice(output.length - OUTPUT_HARD_CAP);
-							if (output.charCodeAt(0) >= 56320 && output.charCodeAt(0) <= 57343) output = output.slice(1);
-						}
+						ring.push(t);
 					},
 					onFrame: ({ exit, cwd }) => finish({
-						output,
+						output: ring.text,
 						exit,
 						cwd,
 						timedOut: interrupted
@@ -266,7 +2578,7 @@ var PtySession = class {
 						this.killTree();
 						this.markDead();
 						finish({
-							output,
+							output: ring.text,
 							exit: null,
 							cwd: null,
 							timedOut: true
@@ -281,14 +2593,24 @@ var PtySession = class {
 		return run;
 	}
 	/** TTL / row teardown：尽力 exit，1s 后杀组，出池。 */
-	async dispose() {
-		if (this.state === "disposed") return;
+	dispose() {
+		if (this.disposal) return this.disposal;
 		this.clearIdleTimer();
 		this.state = "disposed";
 		this.startPromise = null;
+		const proc = this.proc;
+		const close = this.procClose;
+		const group = this.reapGroup(proc?.pid, 1e3, close);
+		this.disposal = Promise.all([
+			close,
+			this.groupCleanup,
+			group
+		]).then(() => {
+			if (this.proc === proc) this.proc = null;
+		});
 		this.write("exit\n");
-		setTimeout(() => this.killTree(), 1e3).unref();
 		this.opts.onDead?.();
+		return this.disposal;
 	}
 	write(s) {
 		if (this.proc?.stdin?.writable !== true) return;
@@ -326,7 +2648,12 @@ var PtySession = class {
 		proc.stderr.setEncoding("utf8").on("data", (d) => {
 			this.diag = (this.diag + d).slice(-2e3);
 		});
-		proc.once("close", () => this.markDead());
+		this.procClose = new Promise((resolve$1) => {
+			proc.once("close", () => {
+				this.markDead();
+				resolve$1();
+			});
+		});
 		proc.once("error", (err) => {
 			this.diag = (this.diag + `\n[remote: spawn failed: ${err.message}]`).slice(-2e3);
 		});
@@ -374,6 +2701,7 @@ var PtySession = class {
 	}
 	resetIdleTimer() {
 		this.clearIdleTimer();
+		if (this.state === "disposed") return;
 		this.idleTimer = setTimeout(() => void this.dispose(), this.opts.idleTtlSec * 1e3);
 		this.idleTimer.unref();
 	}
@@ -386,20 +2714,69 @@ var PtySession = class {
 	killTree() {
 		const pid = this.proc?.pid;
 		this.proc = null;
-		if (pid === void 0) return;
-		try {
-			process.kill(-pid, "SIGTERM");
-		} catch {}
-		setTimeout(() => {
+		const cleanup = this.reapGroup(pid, 0, this.procClose);
+		this.groupCleanup = Promise.all([this.groupCleanup, cleanup]).then(() => void 0);
+	}
+	/** A direct child's close is not proof that its detached process group is gone. */
+	reapGroup(pid, graceMs, close) {
+		if (pid === void 0) return Promise.resolve();
+		const signal = (value) => {
 			try {
-				process.kill(-pid, "SIGKILL");
-			} catch {}
-		}, 2e3).unref();
+				process.kill(-pid, value);
+				return true;
+			} catch (error) {
+				if (error.code === "ESRCH") return false;
+				throw error;
+			}
+		};
+		return new Promise((resolve$1, reject) => {
+			let termTimer;
+			let killTimer;
+			let settled = false;
+			const finish = (error) => {
+				if (settled) return;
+				settled = true;
+				if (termTimer !== void 0) clearTimeout(termTimer);
+				if (killTimer !== void 0) clearTimeout(killTimer);
+				if (error !== void 0) reject(error);
+				else resolve$1();
+			};
+			const checkGone = () => {
+				try {
+					if (!signal(0)) finish();
+				} catch (error) {
+					finish(error);
+				}
+			};
+			checkGone();
+			if (settled) return;
+			close.then(checkGone);
+			termTimer = setTimeout(() => {
+				try {
+					if (!signal("SIGTERM")) {
+						finish();
+						return;
+					}
+					killTimer = setTimeout(() => {
+						try {
+							signal("SIGKILL");
+							killTimer = setTimeout(() => finish(), 100);
+						} catch (error) {
+							finish(error);
+						}
+					}, 2e3);
+				} catch (error) {
+					finish(error);
+				}
+			}, graceMs);
+		});
 	}
 };
 /** 会话池：键 → 会话。意外死亡的会话留在池内（下次 dispatch 带 reconnect 提示）。 */
 var PtyPool = class {
 	sessions = /* @__PURE__ */ new Map();
+	disposed = false;
+	disposal;
 	constructor(defaults) {
 		this.defaults = defaults;
 	}
@@ -424,6 +2801,7 @@ var PtyPool = class {
 		return s === void 0 || s.sessionState === "disposed" ? void 0 : s;
 	}
 	getOrCreate(key, argv, origin) {
+		if (this.disposed) throw new Error("[E_REMOTE_DISPOSED] remote: the owning Agent or plugin PTY pool was disposed");
 		let s = this.sessions.get(key);
 		if (s === void 0 || s.sessionState === "disposed") {
 			s = new PtySession({
@@ -437,9 +2815,12 @@ var PtyPool = class {
 		}
 		return s;
 	}
-	async disposeAll() {
-		await Promise.all([...this.sessions.values()].map((s) => s.dispose()));
-		this.sessions.clear();
+	disposeAll() {
+		if (this.disposal) return this.disposal;
+		this.disposed = true;
+		return this.disposal = Promise.all([...this.sessions.values()].map((s) => s.dispose())).then(() => {
+			this.sessions.clear();
+		});
 	}
 };
 
@@ -489,17 +2870,10 @@ async function probeTarget(plan, opts = {}) {
 	const hard = opts.hardTimeoutSec ?? 10;
 	const runner = opts.runner ?? runOneShot;
 	const started = Date.now();
-	const r = await runner(plan.kind === "ssh" ? [
-		"ssh",
-		"-o",
-		"BatchMode=yes",
-		"-o",
-		`ConnectTimeout=${ct}`,
-		"-T",
-		"--",
-		plan.host,
-		"true"
-	] : plan.kind === "docker" ? [
+	const r = await runner(plan.kind === "ssh" ? sshArgv(plan.connection ?? { host: plan.host }, {
+		extraArgs: ["-o", `ConnectTimeout=${ct}`],
+		command: "true"
+	}) : plan.kind === "docker" ? [
 		"docker",
 		"inspect",
 		"--format",
@@ -677,6 +3051,7 @@ async function renderRoster(sessions, opts = {}) {
 	} catch (error) {
 		lines.push(`ssh hosts: no readable ~/.ssh/config (${error instanceof Error ? error.message : String(error)})`);
 	}
+	lines.push(`byossh labels (this Agent, in memory): ${opts.byosshLabels?.map((label) => `byossh:${label}`).join(", ") || "(none)"}`);
 	const docker = await runner([
 		"docker",
 		"ps",
@@ -710,91 +3085,21 @@ async function renderRoster(sessions, opts = {}) {
 	return lines.join("\n");
 }
 
-//#endregion
-//#region src/remote/transports.ts
-/** POSIX 单引号机械转义（唯一一层转义，spec §三"一层机械转义"）。 */
-function shQuote(s) {
-	return `'${s.replaceAll("'", `'\\''`)}'`;
-}
-/** One-shot（§五.1）：不分配 tty，收尾 = 子进程退出码，零字符串扫描。 */
-function buildOneShotArgv(plan, cmd) {
-	switch (plan.kind) {
-		case "ssh": return [
-			"ssh",
-			"-o",
-			"BatchMode=yes",
-			"-T",
-			"--",
-			plan.host,
-			`bash -lc ${shQuote(cmd)}`
-		];
-		case "docker": return [
-			"docker",
-			"exec",
-			"-i",
-			"--",
-			plan.container,
-			"bash",
-			"-lc",
-			cmd
-		];
-		case "incus": return [
-			"incus",
-			"exec",
-			"--force-noninteractive",
-			plan.container,
-			"--",
-			"bash",
-			"-lc",
-			cmd
-		];
-	}
-}
-/** Persistent pty（Ruling 2）：ssh/incus 走宿主管道，docker 经 script(1) 托管宿主 PTY。 */
-function buildPtyArgv(plan) {
-	switch (plan.kind) {
-		case "ssh": return [
-			"ssh",
-			"-tt",
-			"-o",
-			"BatchMode=yes",
-			"--",
-			plan.host,
-			"bash"
-		];
-		case "docker": return [
-			"script",
-			"-qfec",
-			`stty -echo 2>/dev/null ; exec docker exec -it -- ${shQuote(plan.container)} bash`,
-			"/dev/null"
-		];
-		case "incus": return [
-			"incus",
-			"exec",
-			"--force-interactive",
-			plan.container,
-			"--",
-			"bash"
-		];
-	}
-}
-/** BYO-PTY（§三 spawn）：工具只提供 PTY 托管 + Nonce 注入 + 收帧。 */
-function buildSpawnArgv(spawnCommand) {
-	return [
-		"script",
-		"-qfec",
-		`stty -echo 2>/dev/null ; exec ${spawnCommand}`,
-		"/dev/null"
-	];
-}
-
 //#endregion
 //#region src/remote/driver.ts
 /** PTY label 字符集：只禁空白 / `:` / 控制字符（roster 一行一 label，带换行的 label 渲染即烂）。 */
 const PTY_LABEL_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 /** 双轨调度器（spec §七 Phase 2）：参数校验 → 路由 → oneshot 子进程 / pty 会话池。 */
 var RemoteDriver = class {
+	sshTargets = new SshTargets();
 	pool;
+	hubOwner = randomUUID();
+	hubProviders = /* @__PURE__ */ new Set();
+	processes = /* @__PURE__ */ new Set();
+	starting = /* @__PURE__ */ new Set();
+	fileAbort = new AbortController();
+	disposed = false;
+	disposal;
 	constructor(opts = {}) {
 		this.opts = opts;
 		this.pool = new PtyPool({ idleTtlSec: opts.idleTtlSec ?? 600 });
@@ -802,11 +3107,14 @@ var RemoteDriver = class {
 	async call(params, callCtx = {}) {
 		const started = Date.now();
 		try {
-			const routing = this.route(params);
-			const result = await this.execute(params, routing, callCtx);
+			this.assertOpen();
+			const prepared = await prepareRemoteInput(params);
+			this.assertOpen();
+			const routing = this.route(prepared);
+			const result = await this.execute(prepared, routing, callCtx);
 			this.audit({
 				target: routing.display,
-				cmd: params.cmd,
+				cmd: prepared.cmd,
 				cwd: result.cwd ?? void 0,
 				exit: result.exit,
 				durationMs: Date.now() - started
@@ -815,13 +3123,129 @@ var RemoteDriver = class {
 		} catch (error) {
 			this.audit({
 				target: params.target ?? params.spawn ?? "?",
-				cmd: params.cmd,
+				cmd: params.cmd ?? "[local script]",
 				error: error instanceof Error ? error.message : String(error),
 				durationMs: Date.now() - started
 			});
 			throw error;
 		}
 	}
+	copy(request, signal, callCtx = {}) {
+		const combined = AbortSignal.any([signal, this.fileAbort.signal]);
+		const work = (async () => {
+			this.assertOpen();
+			combined.throwIfAborted();
+			const endpoint = async (value) => {
+				const parsed = parseFileEndpoint(value);
+				if (!parsed.target) return {
+					path: parsed.path,
+					endpoint: localFileEndpoint()
+				};
+				if (parsed.target.startsWith("hub:")) {
+					const hub = this.requireHub();
+					this.hubProviders.add(hub);
+					return {
+						path: parsed.path,
+						endpoint: hub.fileEndpoint(parsed.target.slice(4))
+					};
+				}
+				const plan = await this.resolveConnectionTarget(parsed.target, callCtx);
+				this.assertOpen();
+				combined.throwIfAborted();
+				return {
+					path: parsed.path,
+					endpoint: cliFileEndpoint(plan)
+				};
+			};
+			const source = await endpoint(request.src), destination = await endpoint(request.dst);
+			this.assertOpen();
+			combined.throwIfAborted();
+			return copyTree(request, source, destination, combined);
+		})();
+		this.starting.add(work);
+		work.then(() => this.starting.delete(work), () => this.starting.delete(work));
+		return work;
+	}
+	rsync(request, signal, callCtx = {}) {
+		const combined = AbortSignal.any([signal, this.fileAbort.signal]);
+		const work = (async () => {
+			this.assertOpen();
+			combined.throwIfAborted();
+			const endpoint = async (value) => {
+				const parsed = parseFileEndpoint(value);
+				if (!parsed.target) return { path: parsed.path };
+				if (/^(hub|docker|incus|byop):/.test(parsed.target)) throw new Error("rsync supports SSH/byossh only (plus one local endpoint); no mixed-transport or copy fallback");
+				const plan = await this.resolveConnectionTarget(parsed.target, callCtx);
+				this.assertOpen();
+				combined.throwIfAborted();
+				if (plan.kind !== "ssh") throw new Error("rsync requires an SSH target; no copy fallback");
+				return {
+					path: parsed.path,
+					connection: plan.connection ?? { host: plan.host }
+				};
+			};
+			const source = await endpoint(request.src), destination = await endpoint(request.dst);
+			this.assertOpen();
+			combined.throwIfAborted();
+			return runRsync(request, source, destination, combined, { ssh: this.opts.rsyncSshArgv });
+		})();
+		this.starting.add(work);
+		work.then(() => this.starting.delete(work), () => this.starting.delete(work));
+		return work;
+	}
+	/** Only called from JobSpec.run: admission precedes local file reads and discovery. */
+	start(input, signal) {
+		const work = this.startPrepared(input, AbortSignal.any([signal, this.fileAbort.signal]));
+		this.starting.add(work);
+		work.then(() => this.starting.delete(work), () => this.starting.delete(work));
+		return work;
+	}
+	async startPrepared(input, signal) {
+		this.assertOpen();
+		signal.throwIfAborted();
+		const params = await prepareRemoteInput(input);
+		this.assertOpen();
+		signal.throwIfAborted();
+		const route = this.route(params);
+		if (route.mode !== "oneshot" || route.pty) throw new Error("remote: background requires oneshot");
+		let process$1;
+		if (route.display.startsWith("hub:")) {
+			const hub = this.requireHub();
+			this.hubProviders.add(hub);
+			process$1 = await hub.start(route.display.slice(4), {
+				...params,
+				mode: "oneshot"
+			}, this.hubOwner);
+		} else {
+			const plan = route.plan ?? await this.resolveBareName(route.bare, "no-session", false);
+			this.assertOpen();
+			signal.throwIfAborted();
+			if (plan.kind === "pty") throw new Error("remote: background requires oneshot");
+			process$1 = await this.nativeProcess(plan, params, params.timeout, signal);
+		}
+		this.own(process$1);
+		if (signal.aborted || this.disposed) process$1.cancel("owner closed during start");
+		return process$1;
+	}
+	nativeProcess(plan, params, timeoutSec, signal = this.fileAbort.signal) {
+		const work = !this.opts.oneshotArgvFor ? startOwnedNativeProcess(plan, params.cmd, {
+			stdin: params.stdin,
+			timeoutSec,
+			signal,
+			ssh: this.opts.rsyncSshArgv
+		}) : Promise.resolve(startOneShot((this.opts.oneshotArgvFor ?? buildOneShotArgv)(plan, params.cmd), {
+			stdin: params.stdin,
+			timeoutSec
+		}));
+		this.starting.add(work);
+		work.then(() => this.starting.delete(work), () => this.starting.delete(work));
+		return work;
+	}
+	own(process$1) {
+		this.processes.add(process$1);
+		process$1.done.then(() => this.processes.delete(process$1));
+		return process$1;
+	}
 	/** Ruling 16/17：on-demand 探测 + 会话层，两行如实陈述。 */
 	/**
 	* Ruling P20 + PTY 候选表末位：裸名按名匹配——ssh config 字面 host → docker → incus（本地廉价扫描，
@@ -831,13 +3255,15 @@ var RemoteDriver = class {
 	async resolveBareName(name$1, sessionKey, usePtyLabels = true) {
 		const runner = this.opts.rosterRunner ?? runOneShot;
 		const readCfg = this.opts.sshConfigReader ?? (async () => await readFile(join(homedir(), ".ssh", "config"), "utf8"));
+		let hosts = [];
 		try {
-			const { hosts } = literalHosts(await readCfg());
-			if (hosts.some((h) => h.toLowerCase() === name$1.toLowerCase())) return {
-				kind: "ssh",
-				host: name$1
-			};
+			hosts = literalHosts(await readCfg()).hosts;
 		} catch {}
+		this.assertOpen();
+		if (hosts.some((h) => h.toLowerCase() === name$1.toLowerCase())) return {
+			kind: "ssh",
+			host: name$1
+		};
 		const docker = await runner([
 			"docker",
 			"ps",
@@ -845,6 +3271,7 @@ var RemoteDriver = class {
 			"--format",
 			"{{.Names}}"
 		], { timeoutSec: 10 });
+		this.assertOpen();
 		if (docker.exit === 0 && docker.stdout.trim().split(/\r?\n/).some((n) => n.trim().toLowerCase() === name$1.toLowerCase())) return {
 			kind: "docker",
 			container: name$1
@@ -857,6 +3284,7 @@ var RemoteDriver = class {
 			"--columns",
 			"n"
 		], { timeoutSec: 10 });
+		this.assertOpen();
 		if (incus.exit === 0 && incus.stdout.trim().split(/\r?\n/).some((n) => n.split(",")[0]?.trim().toLowerCase() === name$1.toLowerCase())) return {
 			kind: "incus",
 			container: name$1
@@ -875,22 +3303,47 @@ var RemoteDriver = class {
 	*  而活会话是**操作环境**——复用别的 agent 留下的 shell 等于继承未知状态，且两个 agent 各开一条线
 	*  的代价可忽略。BYO-PTY 天然是活的，于是自然落进这个 scope，无需另立规则。 */
 	async roster(callCtx = {}) {
+		this.assertOpen();
 		const prefix = `${callCtx.sessionKey ?? "no-session"}|`;
-		return await renderRoster(this.pool.list().filter(({ key }) => key.startsWith(prefix)).map(({ key, snapshot }) => ({
+		const sessions = this.pool.list().filter(({ key }) => key.startsWith(prefix)).map(({ key, snapshot }) => ({
 			target: displayKey(key),
 			state: snapshot.state,
 			idleSec: snapshot.idleMs !== null ? Math.round(snapshot.idleMs / 1e3) : null
-		})), this.opts.rosterRunner !== void 0 ? { runner: this.opts.rosterRunner } : {});
+		}));
+		const runner = this.opts.rosterRunner ?? runOneShot;
+		const hub = this.opts.getHub?.();
+		return [...hub ? ["hub machines: " + (hub.listTargets().map((t) => `hub:${t.id} (${t.label}${t.execEnabled ? "" : "; exec disabled"})`).join(", ") || "none")] : [], await renderRoster(sessions, {
+			byosshLabels: this.sshTargets.entries().map(([label]) => label),
+			readSshConfig: this.opts.sshConfigReader,
+			runner: (argv, options) => {
+				this.assertOpen();
+				return runner(argv, options);
+			}
+		})].join("\n");
 	}
 	async status(target, callCtx = {}) {
+		this.assertOpen();
+		if (target.startsWith("hub:")) {
+			const machine = target.slice(4);
+			const row = this.requireHub().listTargets().find((t) => t.id === machine);
+			if (!row) throw new Error(`unknown remote machine ${machine} — select a remote machine from the Hub roster; local execution is not available`);
+			return `${target} — Hub remote machine (${row.label}); exec ${row.execEnabled ? "enabled" : "disabled"}; not probed`;
+		}
 		const sessionKey = callCtx.sessionKey ?? "no-session";
 		const label = target.startsWith("byop:") ? target.slice(5) : void 0;
 		if (label !== void 0) return this.ptyStatus(target, label, sessionKey);
-		const resolved = /^(docker|incus|ssh):/.test(target) ? resolveTarget(target) : await this.resolveBareName(target, sessionKey);
+		const direct = /^(docker|incus|ssh):/.test(target);
+		const resolved = target.startsWith("byossh:") ? this.byosshPlan(target) : direct ? resolveTarget(target) : await this.resolveBareName(target, sessionKey);
+		this.assertOpen();
 		if (resolved.kind === "pty") return this.ptyStatus(`byop:${resolved.label}`, resolved.label, sessionKey);
+		const head = `${target} — ${resolved.kind === "ssh" ? "ssh host" : `${resolved.kind} container`}`;
+		const runner = this.opts.probeRunner ?? runOneShot;
 		return [
-			`${target} — ${resolved.kind === "ssh" ? "ssh host" : `${resolved.kind} container`}`,
-			renderProbe(await probeTarget(resolved, { runner: this.opts.probeRunner })),
+			head,
+			renderProbe(await probeTarget(resolved, { runner: (argv, options) => {
+				this.assertOpen();
+				return runner(argv, options);
+			} })),
 			renderSession(this.pool.inspect(`${sessionKey}|t:${target}`))
 		].join("\n");
 	}
@@ -904,12 +3357,50 @@ var RemoteDriver = class {
 			this.opts.onAudit?.(r);
 		} catch {}
 	}
+	/** Registration never dials; response reveals labels only, not credentials. */
+	registerSsh(target, connection) {
+		this.assertOpen();
+		if (!target.startsWith("byossh:")) throw new Error("[E_SSH_PARAMS] remote: ssh requires a byossh:<label> target");
+		this.sshTargets.register(target.slice(7), connection);
+		return `${target} registered (no dialing). Reuse this Agent's label without ssh; a new Agent/cold resume must register again.`;
+	}
+	byosshPlan(target, connection) {
+		if (connection !== void 0) this.registerSsh(target, connection);
+		const spec = this.sshTargets.get(target.slice(7));
+		if (!spec) throw new Error(`[E_NO_SSH_TARGET] remote: ${target} is not registered in this Agent — supply ssh:{host,user?,port?,key?,proxyJump?} first; key must be an existing origin file path`);
+		return {
+			kind: "ssh",
+			host: spec.host,
+			connection: spec
+		};
+	}
+	/** Single target resolver for later copy/rsync; BYO identities cannot be
+	* independently re-resolved through the origin's alias table. */
+	async resolveConnectionTarget(target, callCtx = {}) {
+		this.assertOpen();
+		if (target.startsWith("byossh:")) return this.byosshPlan(target);
+		if (/^(docker|incus|ssh):/.test(target)) return resolveTarget(target);
+		if (/^(byop|hub):/.test(target)) throw new Error("remote: select an SSH/Docker/Incus target for this connection resolver");
+		const plan = await this.resolveBareName(target, callCtx.sessionKey ?? "no-session", false);
+		this.assertOpen();
+		if (plan.kind === "pty") throw new Error("remote: BYO-PTY is not a filesystem connection");
+		return plan;
+	}
 	route(params) {
 		const hasTarget = params.target !== void 0 && params.target.length > 0;
 		const hasSpawn = params.spawn !== void 0 && params.spawn.length > 0;
 		if (!hasTarget && !hasSpawn) throw new Error("[E_PARAMS] remote: target is required (e.g. { target: \"dev4\", cmd: \"git status\" }); spawn is a modifier of a \"byop:<label>\" target and cannot stand alone");
 		if (params.timeout !== void 0 && (!Number.isFinite(params.timeout) || params.timeout <= 0)) throw new Error(`[E_BAD_TIMEOUT] remote: timeout must be a positive number of seconds (got ${JSON.stringify(params.timeout)})`);
 		if (params.stdin !== void 0 && (params.cmd === void 0 || params.cmd.length === 0)) throw new Error("[E_STDIN_WITHOUT_CMD] remote: stdin requires cmd");
+		if (params.ssh !== void 0 && !params.target.startsWith("byossh:")) throw new Error("[E_SSH_PARAMS] remote: ssh requires a byossh:<label> target");
+		if (params.target.startsWith("byossh:")) {
+			if (hasSpawn) throw new Error("[E_PARAMS] remote: spawn is only for byop:<label>, not BYO-SSH");
+			return {
+				mode: params.mode ?? "oneshot",
+				display: params.target,
+				plan: this.byosshPlan(params.target, params.ssh)
+			};
+		}
 		if (hasTarget && params.target.startsWith("byop:")) {
 			const label = params.target.slice(5);
 			if (!PTY_LABEL_RE.test(label)) throw new Error(`[E_BAD_LABEL] remote: PTY label must match ${PTY_LABEL_RE.source} (got ${JSON.stringify(label)}) — e.g. target: "byop:dev3"`);
@@ -925,6 +3416,10 @@ var RemoteDriver = class {
 		}
 		if (hasSpawn) throw new Error("[E_PARAMS] remote: spawn requires a \"byop:<label>\" target — e.g. { target: \"byop:dev3\", spawn: \"ssh dev3\", cmd: \"…\" }; it is not a standalone entry point");
 		const mode = params.mode ?? "oneshot";
+		if (params.target.startsWith("hub:")) return {
+			mode,
+			display: params.target
+		};
 		const direct = /^(docker|incus|ssh):/.test(params.target);
 		return {
 			mode,
@@ -933,25 +3428,82 @@ var RemoteDriver = class {
 		};
 	}
 	async execute(params, routing, callCtx) {
+		const timeoutSec = params.timeout ?? this.opts.execTimeoutSec ?? 120;
+		const cap = this.opts.maxOutputChars ?? 3e4;
+		if (routing.display.startsWith("hub:")) {
+			const hub = this.requireHub();
+			this.hubProviders.add(hub);
+			const machine = routing.display.slice(4);
+			if (routing.mode === "pty") {
+				const result$1 = await hub.pty(machine, params.cmd, this.hubOwner, {
+					stdin: params.stdin,
+					timeout: timeoutSec
+				});
+				const out$2 = tailWindow(result$1.stdout, cap, result$1.outputStats?.stdout);
+				return {
+					...result$1,
+					stdout: out$2.text,
+					...out$2.stats ? { outputStats: {
+						...result$1.outputStats,
+						stdout: out$2.stats
+					} } : {},
+					...out$2.truncated === void 0 ? {} : { truncated: out$2.truncated }
+				};
+			}
+			const process$1 = this.own(await hub.start(machine, {
+				...params,
+				target: routing.display,
+				mode: "oneshot",
+				timeout: timeoutSec
+			}, this.hubOwner));
+			if (this.disposed) process$1.cancel("owner disposed");
+			const result = await process$1.done;
+			const stdout = process$1.read("stdout", 0), stderr = process$1.read("stderr", 0);
+			const out$1 = tailWindow(stdout.text, cap, stdout.stats);
+			const err = tailWindow(stderr.text, cap, stderr.stats);
+			return {
+				...result,
+				mode: "oneshot",
+				target: routing.display,
+				cwd: null,
+				reconnected: false,
+				stdout: (!stdout.stats && stdout.lossy ? "[truncated: peer returned only a tail; exact total/retained/dropped unavailable]\n" : "") + out$1.text,
+				stderr: [err.text, stderr.diagnostic].filter(Boolean).join("\n"),
+				...out$1.stats ? { outputStats: {
+					stdout: out$1.stats,
+					stderr: err.stats
+				} } : { outputStatsUnavailable: true },
+				...out$1.truncated === void 0 ? {} : { truncated: out$1.truncated }
+			};
+		}
 		const sessionKey = callCtx.sessionKey ?? "no-session";
 		if (routing.bare !== void 0) {
 			const resolved = await this.resolveBareName(routing.bare, sessionKey, params.mode !== "oneshot");
+			this.assertOpen();
 			if (resolved.kind === "pty") {
 				routing.pty = { label: resolved.label };
 				routing.mode = "pty";
 				routing.display = `byop:${resolved.label}`;
 			} else routing.plan = resolved;
 		}
-		const timeoutSec = params.timeout ?? this.opts.execTimeoutSec ?? 120;
-		const cap = this.opts.maxOutputChars ?? 3e4;
 		if (routing.pty !== void 0) return await this.ptyCall(routing.pty, params, sessionKey, timeoutSec, cap);
 		if (routing.mode === "oneshot") {
-			const r$1 = await runOneShot((this.opts.oneshotArgvFor ?? buildOneShotArgv)(routing.plan, params.cmd), {
-				stdin: params.stdin,
-				timeoutSec
-			});
-			const out$1 = tailWindow(r$1.stdout, cap);
-			const err = r$1.stderr.length > 0 ? tailWindow(r$1.stderr, cap) : void 0;
+			this.assertOpen();
+			const process$1 = this.own(await this.nativeProcess(routing.plan, params, timeoutSec));
+			if (this.disposed) process$1.cancel("owner disposed");
+			const result = await process$1.done;
+			const stdout = process$1.read("stdout", 0), stderr = process$1.read("stderr", 0);
+			const r$1 = {
+				...result,
+				stdout: stdout.text,
+				stderr: [stderr.text, stderr.diagnostic].filter(Boolean).join("\n"),
+				outputStats: {
+					stdout: stdout.stats,
+					stderr: stderr.stats
+				}
+			};
+			const out$1 = tailWindow(r$1.stdout, cap, r$1.outputStats?.stdout);
+			const err = r$1.stderr.length > 0 ? tailWindow(r$1.stderr, cap, r$1.outputStats?.stderr) : void 0;
 			return {
 				mode: "oneshot",
 				target: routing.display,
@@ -961,6 +3513,10 @@ var RemoteDriver = class {
 				reconnected: false,
 				stdout: out$1.text,
 				...err !== void 0 ? { stderr: err.text } : {},
+				...out$1.stats ? { outputStats: {
+					stdout: out$1.stats,
+					stderr: err?.stats ?? r$1.outputStats?.stderr
+				} } : {},
 				durationMs: r$1.durationMs,
 				...out$1.truncated !== void 0 ? { truncated: out$1.truncated } : {}
 			};
@@ -971,7 +3527,7 @@ var RemoteDriver = class {
 			stdin: params.stdin,
 			timeoutSec
 		});
-		const out = tailWindow(r.output, cap);
+		const out = tailWindow(r.output, cap, r.outputStats?.stdout);
 		return {
 			mode: "pty",
 			target: routing.display,
@@ -980,6 +3536,7 @@ var RemoteDriver = class {
 			timedOut: r.timedOut,
 			reconnected: r.reconnected,
 			stdout: out.text,
+			outputStats: out.stats ? { stdout: out.stats } : void 0,
 			durationMs: r.durationMs,
 			...out.truncated !== void 0 ? { truncated: out.truncated } : {}
 		};
@@ -1001,7 +3558,7 @@ var RemoteDriver = class {
 			stdin: params.stdin,
 			timeoutSec
 		});
-		const out = tailWindow(r.output, cap);
+		const out = tailWindow(r.output, cap, r.outputStats?.stdout);
 		return {
 			mode: "pty",
 			target: display,
@@ -1012,27 +3569,183 @@ var RemoteDriver = class {
 			reconnected: r.reconnected,
 			stdout: out.text,
 			...notice !== void 0 ? { notice } : {},
+			outputStats: out.stats ? { stdout: out.stats } : void 0,
 			durationMs: r.durationMs,
 			...out.truncated !== void 0 ? { truncated: out.truncated } : {}
 		};
 	}
-	async dispose() {
-		await this.pool.disposeAll();
+	hasHub() {
+		return this.opts.getHub?.() !== void 0;
+	}
+	requireHub() {
+		this.assertOpen();
+		const hub = this.opts.getHub?.();
+		if (!hub || hub.protocol !== 1) throw new Error("[E_HUB_UNAVAILABLE] remote: Hub transport unavailable — enable the Super D Hub body, or select an explicit SSH/Docker/Incus/BYO target");
+		return hub;
+	}
+	assertOpen() {
+		if (this.disposed) throw new Error("[E_REMOTE_DISPOSED] remote: this Agent or plugin owner has exited — create a new session or cold resume");
+	}
+	dispose() {
+		if (this.disposal) return this.disposal;
+		this.sshTargets.clear();
+		this.disposed = true;
+		this.fileAbort.abort(/* @__PURE__ */ new Error("remote owner disposed"));
+		for (const process$1 of this.processes) process$1.cancel("remote owner disposed");
+		return this.disposal = (async () => {
+			await Promise.allSettled([...this.starting]);
+			await Promise.all([
+				this.pool.disposeAll(),
+				...[...this.processes].map((p) => p.done),
+				...[...this.hubProviders].map((hub) => hub.releaseOwner(this.hubOwner))
+			]);
+			this.hubProviders.clear();
+		})();
 	}
 };
 
+//#endregion
+//#region src/remote/jobs.ts
+/** No preparation or discovery before the official registry's admission. */
+function startRemoteJob(registry, input, exec, driver) {
+	if (input.mode === "pty" || input.spawn !== void 0 || input.target?.startsWith("byop:")) throw new Error("remote: background execution requires oneshot; PTY and BYO-PTY are unsupported");
+	if (!exec.agent) throw new Error("remote: background jobs require a live Agent owner");
+	let process$1;
+	const output = ["stdout", "stderr"].map((channel) => ({
+		channel,
+		read: (fromByte) => {
+			const read = process$1?.read(channel, fromByte);
+			return read ? {
+				text: read.text,
+				nextOffset: read.nextOffset,
+				lossy: read.lossy
+			} : {
+				text: "",
+				nextOffset: fromByte,
+				lossy: false
+			};
+		}
+	}));
+	return registry.start({
+		kind: "remote",
+		owner: exec.agent.id,
+		label: `${input.target}: ${input.cmd ?? input.script}`,
+		output,
+		run() {
+			const controller = new AbortController();
+			return {
+				done: (async () => {
+					try {
+						process$1 = await driver.start({
+							...input,
+							mode: "oneshot"
+						}, controller.signal);
+						if (controller.signal.aborted) process$1.cancel(controller.signal.reason);
+						const result = await process$1.done;
+						const diagnostic = process$1.read("stderr", 0).diagnostic;
+						return {
+							status: controller.signal.aborted || result.cancelled ? "killed" : diagnostic ? "failed" : result.timedOut ? "killed" : "completed",
+							detail: diagnostic ?? (result.timedOut ? "timeout" : `exit code: ${result.exit}`)
+						};
+					} catch (error) {
+						return {
+							status: controller.signal.aborted ? "killed" : "failed",
+							detail: error instanceof Error ? error.message : String(error)
+						};
+					}
+				})(),
+				cancel(reason) {
+					if (controller.signal.aborted) return;
+					controller.abort(reason);
+					process$1?.cancel(reason);
+				}
+			};
+		}
+	});
+}
+
 //#endregion
 //#region src/remote/tool.ts
 const NO_SESSION_KEY = "remote:no-session";
 function createRemoteTool(driver, opts = {}) {
 	const getSessionKey = opts.getSessionKey ?? ((exec) => exec.agent?.id ?? NO_SESSION_KEY);
-	return defineTool({
+	const tool = defineTool({
 		name: "remote",
-		description: "Remote execution over three transports (ssh / docker / incus) plus named persistent BYO shells. Pick the call shape first:\n  {}                                 → roster: known target names from a local scan (no dialing)\n  {target}                           → on-demand status probe of that one target (for \"byop:<label>\": its session state)\n  {target, cmd}                      → run cmd — oneshot by default; mode \"pty\" for a persistent shell\n  {target:\"byop:<label>\", spawn, cmd} → BYO-PTY: create the persistent shell you named <label>\n  {target:\"byop:<label>\", cmd}        → reuse that shell (spawn is only needed to create)\nBYO-PTY labels are yours to choose, and the label alone is the whole reuse mechanism: \"byop:dev3\" is created once with `spawn` (the command that starts an interactive shell, e.g. \"docker exec -it img bash\"), and from then on you address it as {target:\"byop:dev3\", cmd} with no spawn. Repeating the same spawn for a live label is reused and the result tells you to drop it; repeating a *different* spawn is refused with [E_LABEL_CONFLICT] and nothing runs — reuse the label, or pick a new one. A label that was never created, or was reaped after the idle TTL, answers [E_NO_SESSION]: spawn is not retained, so pass it again to re-create. A spawn that fails to come up (e.g. a bad host) leaves nothing behind either — the label stays free, so just retry with a corrected spawn. Bare names match in order — ssh config, then docker, then incus, then a live pty label (on a collision the earlier source wins; a name matching none of them goes to ssh and its native error surfaces). \"byop:<label>\" / \"docker:<name>\" / \"incus:<name>\" / \"ssh:<name>\" force a channel when you must be explicit. oneshot: stateless `bash -lc`, stdout/stderr separate, the exit code is the remote process's own. pty: one persistent shell per (agent, target) — cwd/env survive across calls, streams merge, Ctrl-C interrupts without killing the session, idle sessions are reaped after 600s (a reconnect notice precedes the fresh shell). Output is tail-truncated at ~30k chars with a \"[truncated: …]\" header — redirect bulk output to a file yourself. `stdin` feeds the command; `timeout` (seconds) interrupts then kills. Native transport errors pass through verbatim — self-correct from them. Background processes must redirect their own output (`cmd > log 2>&1 &`). Status probes report \"reachable\"/\"unreachable — <native error>\" or the factual container state plus the session layer (\"idle Ns\" / \"busy\" / \"none — dials on first exec\"), always probed at call time.",
+		description: "Native rsync: {action:\"rsync\",src:\"[target:]/absolute/path\",dst:\"[target:]/absolute/path\",dryRun:true,delete:false,excludes:[\"pattern\"],preserve:true}. SSH/byossh only, optionally one local endpoint; no Docker/Incus/Hub/BYO-PTY and no copy fallback. Requires Bash/native rsync on the origin; SSH endpoints need Bash 4.1+ coprocess/dynamic-FD support and Python 3.7+ (macOS 3.10+) shared cross-process non-adjustable monotonic clock and Unix fcntl.flock (preflighted, no auto-install). Default dry-run makes no destination data changes; deletion is opt-in; preserve uses native archive (-a), false uses recursive (-r). Source trailing slash copies contents; no slash copies the named directory. Local↔SSH supports native files/new destinations. SSH↔SSH requires an existing non-symlink destination directory (files/new paths, percent-containing paths and trim-sensitive/newline destinations refused, module never widened); source symlinks are refused before transfer because its confined non-chroot daemon cannot preserve their values. Use an ordinary local↔SSH rsync leg or materialize files first. Relay source inspection also requires native find. Two-remote relay SOURCE uses a task-owned Python loopback byte proxy over its authenticated SSH work stream, bridged on the origin into the destination SSH -L tunnel; no source Linux /proc, pidfd, privileged sshd descriptor access or remote forwarding is required. Native find remains required for source inspection. The exact route must return a real rsync greeting before transfer. Identities stay on the origin, agent forwarding and reusable multiplexing are disabled; native SSH config/ProxyJump remain honored. Normal two-remote startup uses 12 SSH launches: source prerequisite/inspection clock/inspection (3), source+destination prerequisites (2), destination clock/daemon+tunnel (2), source proxy clock/owner/work (3), source rsync clock/work (2). Lost admission may require additional authenticated cleanup reconnects; no transfer retry. Native delta is uncompressed; receipt includes real exit/stdout/stderr, itemized changes and native byte stats when available. Receipt stdout/stderr retain at most 2,097,152 UTF-16 code units each; outputTruncated marks trimmed tails (changes/stats may then be incomplete). Operation/disposal settlement waits for owned tunnels/daemon/config cleanup, not pre-existing SSH sessions. Each owned command uses an extra clock-only SSH round trip and a private transient receiving lock/record. If startup loses its closed control channel before a receipt, cancellation reconnects using the same SSH identity, fences late entry through the original 8-second entry cutoff, and waits for actual owned cleanup. Restore control connectivity if observation is pending; recovery never restarts the transfer. A still-live but hidden startup or unavailable cleanup helper can keep settlement pending; receiver progress and usable authenticated control connectivity are required.\nCopy files/trees: {action:\"copy\",src:\"[target:]/absolute/path\",dst:\"[target:]/absolute/path\",verify:true,mkdir:true}. Local/SSH/byossh/Docker/Incus/Hub binary transport; BYO-PTY unsupported. CLI peers require Bash 4.1+, Python 3.7+ (macOS 3.10+), Unix fcntl.flock/shared non-adjustable monotonic clock and mktemp/mv/rm/sleep; Linux containers additionally require stdlib ctypes/permitted PR_SET_CHILD_SUBREAPER. No auto-install or origin Python requirement. Each remote export/import/digest uses three native transport starts (clock, receiving owner, raw binary work), with extra authenticated cleanup recovery only on faults. A verified local-to-CLI copy uses six starts (import plus destination digest); CLI-to-local uses six (export plus source digest); CLI-to-CLI uses twelve. verify:false skips digests, reducing these counts to three/three/six. Cancellation/failure settlement waits for actual receiving helper/group/temp cleanup. Normal binary success requires complete stream drain; there is no successful truncated-output timeout. Local/Hub file lanes are unchanged. Full origin staging, no delta/resume. Directories merge without deletion; SHA-256 verifies transferred entries only. Receipt sourceDigest/destinationDigest are canonical transferred-entry manifest digests, not a raw file sha256sum, even for one file. Copy has no dryRun; omit all rsync-only options including dryRun:false. Failures report retained scratch for diagnosis; success removes owned staging. Symlinks must resolve through incoming tree entries only; dangling links and destination aliases are rejected.\nOwned SSH/byossh oneshot commands (foreground, background, script and stdin) require remote Bash 4.1+, Python 3.7+ (macOS 3.10+), Unix fcntl.flock with a shared non-adjustable monotonic clock, and mktemp/mv/rm/sleep. No rsync is needed for ordinary commands; no new origin Python prerequisite or Linux/pidfd requirement. Each command uses three SSH startups: clock-only prerequisite, separate receiving owner/control, and literal-stdio work. Cancellation/timeout/Agent or plugin disposal waits for receiving helper and child/group cleanup; a lost startup receipt can require same-identity cleanup reconnect and restored connectivity. Receiver progress is required, not a hard-real-time guarantee. Work output gets up to 2500ms to drain after cleanup proof; unavailable drain reports incomplete output separately, and counters describe only received data. PTY/BYO-PTY behavior is unchanged.\nDocker/Incus oneshot commands use the same receiving owner: remote Bash 4.1+, Python 3.7+, fcntl/shared monotonic clock and mktemp/mv/rm/sleep; three native exec startups per command (clock, owner, work). Linux containers additionally require Python stdlib ctypes and permitted unprivileged PR_SET_CHILD_SUBREAPER, checked before business work; the helper reaps its own/adopted descendants, including containers without an init. No image/config installation, origin Python, rsync or pidfd is added. PTY paths are unchanged.\nRemote execution over three transports (ssh / docker / incus) plus named persistent BYO shells. Pick the call shape first:\n  {}                                 → roster: known target names from a local scan (no dialing)\n  {target}                           → on-demand status probe of that one target (for \"byop:<label>\": its session state)\n  {target:\"byossh:<label>\", ssh:{host,user?,port?,key?,proxyJump?}, cmd?} → register SSH identity in this Agent; optional cmd executes. No cmd means register only, no dialing. Later omit ssh and reuse target. Same spec is idempotent; different spec conflicts: use another label. key is an existing file on the origin, never inline private key. Native SSH config and ProxyJump are honored; no config writes, copied keys or credential persistence. Cold/new Agent must register again.\n  {target, cmd}                      → run cmd — oneshot by default; mode \"pty\" for a persistent shell\n  {target, script:\"/absolute/path.sh\"} → read a LOCAL script before dialing; oneshot only, sent raw over stdin to fixed `bash -s`. No cmd/stdin/spawn/PTY combination. Large scripts do not expand into argv.\n  {target:\"byop:<label>\", spawn, cmd} → BYO-PTY: create the persistent shell you named <label>\n  {target:\"byop:<label>\", cmd}        → reuse that shell (spawn is only needed to create)\nBYO-PTY labels are yours to choose, and the label alone is the whole reuse mechanism: \"byop:dev3\" is created once with `spawn` (the command that starts an interactive shell, e.g. \"docker exec -it img bash\"), and from then on you address it as {target:\"byop:dev3\", cmd} with no spawn. Repeating the same spawn for a live label is reused and the result tells you to drop it; repeating a *different* spawn is refused with [E_LABEL_CONFLICT] and nothing runs — reuse the label, or pick a new one. A label that was never created, or was reaped after the idle TTL, answers [E_NO_SESSION]: spawn is not retained, so pass it again to re-create. A spawn that fails to come up (e.g. a bad host) leaves nothing behind either — the label stays free, so just retry with a corrected spawn. Bare names match in order — ssh config, then docker, then incus, then a live pty label (on a collision the earlier source wins; a name matching none of them goes to ssh and its native error surfaces). \"byop:<label>\" / \"docker:<name>\" / \"incus:<name>\" / \"ssh:<name>\" force a channel when you must be explicit. oneshot: stateless `bash -lc`, stdout/stderr separate, the exit code is the remote process's own. pty: one persistent shell per (agent, target) — cwd/env survive across calls, streams merge, Ctrl-C interrupts without killing the session, idle sessions are reaped after 600s (a reconnect notice precedes the fresh shell). Output is tail-truncated at ~30k chars with a \"[truncated: …]\" header — redirect bulk output to a file yourself. Native/PTY hard retention is 4,000,000 UTF-16 code units per stream, not bytes; Hub oneshot is 4MiB bytes per stream. outputStats reports total/retained/dropped/returned and units; restart cannot recover discarded output. `stdin` feeds the command; `timeout` (seconds) interrupts then kills. Native transport errors pass through verbatim — self-correct from them. run_in_background:true starts an official DSH job (oneshot only); use job_output/job_kill and host completion notices. Requires the jobs service and controller. Background has no default foreground timeout; an explicit timeout still applies. Status probes report \"reachable\"/\"unreachable — <native error>\" or the factual container state plus the session layer (\"idle Ns\" / \"busy\" / \"none — dials on first exec\"), always probed at call time.",
 		parameters: {
+			action: {
+				type: "string",
+				enum: ["copy", "rsync"],
+				description: "Optional file action; omit for execution/status/roster."
+			},
+			src: {
+				type: "string",
+				description: "copy/rsync source [target:]absolute path; rsync retains trailing-slash semantics"
+			},
+			dst: {
+				type: "string",
+				description: "copy/rsync destination [target:]absolute path"
+			},
+			verify: {
+				type: "boolean",
+				description: "copy independent SHA-256 verification (default true)"
+			},
+			mkdir: {
+				type: "boolean",
+				description: "copy create missing destination parents (default true)"
+			},
+			dryRun: {
+				type: "boolean",
+				description: "rsync native dry-run (default true); false permits writes"
+			},
+			delete: {
+				type: "boolean",
+				description: "rsync delete extraneous destination entries (default false)"
+			},
+			excludes: {
+				type: "array",
+				items: { type: "string" },
+				description: "rsync native exclude patterns, passed as separate argv options"
+			},
+			preserve: {
+				type: "boolean",
+				description: "rsync archive -a (default true) versus recursive -r; remote relay refuses source symlinks"
+			},
+			run_in_background: {
+				type: "boolean",
+				description: "Oneshot only: return a native jobId immediately, read with job_output, cancel with job_kill; output is available while running. Requires official jobs service/controller."
+			},
 			target: {
 				type: "string",
-				description: "Single entry point. Bare name / IP / domain matches in order: ssh config, then docker, then incus, then a live pty label (a collision goes to the earlier source). \"byop:<label>\" / \"docker:<name>\" / \"incus:<name>\" / \"ssh:<name>\" force a channel. For \"byop:<label>\", pass spawn the first time to create it and omit spawn afterwards to reuse it. Omit cmd → status probe."
+				description: "Single entry point. byossh:<label> reuses this Agent-scoped registered SSH identity (pass ssh on first call; no cmd registers only). Bare name / IP / domain matches in order: ssh config, then docker, then incus, then a live pty label (a collision goes to the earlier source). \"byop:<label>\" / \"docker:<name>\" / \"incus:<name>\" / \"ssh:<name>\" force a channel. For \"byop:<label>\", pass spawn the first time to create it and omit spawn afterwards to reuse it. Omit cmd → status probe."
+			},
+			ssh: {
+				type: "object",
+				description: "Only for byossh:<label>: register origin-side connection; omit on reuse. No inline keys or arbitrary SSH options.",
+				additionalProperties: false,
+				properties: {
+					host: {
+						type: "string",
+						required: true,
+						description: "SSH hostname, IP or native config alias."
+					},
+					user: {
+						type: "string",
+						description: "Login user; omitted preserves native SSH config."
+					},
+					port: {
+						type: "integer",
+						description: "SSH port 1–65535; omitted preserves native SSH config."
+					},
+					key: {
+						type: "string",
+						description: "Existing origin private-key file path, not key contents; never copied or persisted."
+					},
+					proxyJump: {
+						type: "string",
+						description: "Official ProxyJump: comma-separated [user@]host[:port] or native aliases; jump identity remains in origin SSH config."
+					}
+				}
 			},
 			spawn: {
 				type: "string",
@@ -1042,6 +3755,10 @@ function createRemoteTool(driver, opts = {}) {
 				type: "string",
 				description: "One raw shell string parsed by the remote bash (multi-line = one compound; exit = last command's). Omit with target → status probe; omit everything → roster."
 			},
+			script: {
+				type: "string",
+				description: "LOCAL absolute script path. Read before any dialing, sent literally over stdin to fixed bash -s. Oneshot only; cannot combine with cmd, stdin, spawn, pty mode or byop target. Hub inline cmd remains limited to 4096; script body is not argv."
+			},
 			mode: {
 				type: "string",
 				enum: ["oneshot", "pty"],
@@ -1067,13 +3784,18 @@ function createRemoteTool(driver, opts = {}) {
 						enum: [
 							"exec",
 							"status",
-							"roster"
+							"roster",
+							"job",
+							"copy",
+							"rsync"
 						]
 					},
 					text: {
 						type: "string",
 						required: true
 					},
+					jobId: { type: "string" },
+					receipt: { type: "json" },
 					exit: { oneOf: [{ type: "integer" }, { type: "null" }] },
 					durationMs: { type: "integer" },
 					cwd: { type: "string" },
@@ -1081,6 +3803,8 @@ function createRemoteTool(driver, opts = {}) {
 					timedOut: { type: "boolean" },
 					reconnected: { type: "boolean" },
 					truncated: { type: "integer" },
+					outputStats: { type: "json" },
+					outputStatsUnavailable: { type: "boolean" },
 					session: { type: "string" },
 					notice: { type: "string" }
 				}
@@ -1091,13 +3815,105 @@ function createRemoteTool(driver, opts = {}) {
 			}]
 		},
 		async execute(args, exec) {
+			if (args.action === "copy" || args.action === "rsync") {
+				if (!args.src || !args.dst) throw new Error(`${args.action} requires src and dst absolute endpoints`);
+				if ([
+					args.cmd,
+					args.script,
+					args.stdin,
+					args.spawn,
+					args.ssh,
+					args.target,
+					args.mode,
+					args.timeout,
+					args.run_in_background
+				].some((value) => value !== void 0)) throw new Error(`${args.action} cannot be combined with execution/PTY/job arguments; register byossh separately first`);
+				if (args.action === "rsync") {
+					if ([args.verify, args.mkdir].some((value) => value !== void 0)) throw new Error("rsync cannot be combined with copy verify/mkdir options");
+					const start = Date.now();
+					const receipt$1 = await driver.rsync({
+						src: args.src,
+						dst: args.dst,
+						dryRun: args.dryRun,
+						delete: args.delete,
+						excludes: args.excludes,
+						preserve: args.preserve
+					}, exec.signal, { sessionKey: getSessionKey(exec) });
+					if (receipt$1.exit !== 0) throw new Error(JSON.stringify(receipt$1));
+					return {
+						kind: "rsync",
+						text: JSON.stringify(receipt$1),
+						receipt: receipt$1,
+						exit: receipt$1.exit,
+						durationMs: Date.now() - start
+					};
+				}
+				if ([
+					args.dryRun,
+					args.delete,
+					args.excludes,
+					args.preserve
+				].some((value) => value !== void 0)) throw new Error("copy cannot be combined with rsync options");
+				const receipt = await driver.copy({
+					src: args.src,
+					dst: args.dst,
+					verify: args.verify,
+					mkdir: args.mkdir
+				}, exec.signal, { sessionKey: getSessionKey(exec) });
+				return {
+					kind: "copy",
+					text: JSON.stringify(receipt),
+					receipt,
+					exit: null,
+					durationMs: 0
+				};
+			}
+			if ([
+				args.src,
+				args.dst,
+				args.verify,
+				args.mkdir,
+				args.dryRun,
+				args.delete,
+				args.excludes,
+				args.preserve
+			].some((value) => value !== void 0)) throw new Error("file fields require action copy or rsync");
 			const hasCmd = typeof args.cmd === "string" && args.cmd.length > 0;
 			const hasTarget = typeof args.target === "string" && args.target.length > 0;
 			const hasSpawn = typeof args.spawn === "string" && args.spawn.length > 0;
 			if (args.mode !== void 0 && args.mode !== "oneshot" && args.mode !== "pty") throw new Error(`[E_BAD_MODE] remote: mode must be 'oneshot' or 'pty' (got ${JSON.stringify(args.mode)})`);
-			if (!hasCmd) {
+			if (args.ssh !== void 0 && (!args.target?.startsWith("byossh:") || hasSpawn)) throw new Error("[E_SSH_PARAMS] remote: ssh requires a byossh:<label> target; spawn is only for byop:<label>");
+			if (args.run_in_background) {
+				if (!hasCmd && args.script === void 0) throw new Error("remote: background requires cmd or script");
+				if (args.mode === "pty" || hasSpawn || args.target?.startsWith("byop:")) throw new Error("remote: background requires oneshot; PTY and BYO-PTY are unsupported");
+				const jobs = exec.agent?.ctx.get("jobs");
+				if (!jobs) throw new Error("remote: background requires the official DSH jobs service and job_output/job_kill controller; foreground execution remains available");
+				const jobId = startRemoteJob(jobs, {
+					target: args.target,
+					cmd: args.cmd,
+					script: args.script,
+					ssh: args.ssh,
+					stdin: args.stdin,
+					mode: "oneshot",
+					timeout: args.timeout
+				}, exec, driver);
+				return {
+					kind: "job",
+					jobId,
+					text: `Started ${jobId}. Use job_output to read and job_kill to cancel; completion is reported by the host.`,
+					exit: null,
+					durationMs: 0
+				};
+			}
+			if (!hasCmd && args.script === void 0) {
 				if (args.stdin !== void 0) throw new Error("[E_STDIN_WITHOUT_CMD] remote: stdin requires cmd — status probes take no input");
 				if (hasSpawn) throw new Error("[E_PARAMS] remote: spawn is an exec channel — pass cmd (there is nothing to probe for BYO-PTY)");
+				if (args.ssh !== void 0) return {
+					kind: "status",
+					text: driver.registerSsh(args.target, args.ssh),
+					exit: null,
+					durationMs: 0
+				};
 				if (!hasTarget) return {
 					kind: "roster",
 					text: await driver.roster({ sessionKey: getSessionKey(exec) }),
@@ -1114,7 +3930,9 @@ function createRemoteTool(driver, opts = {}) {
 			const r = await driver.call({
 				target: args.target,
 				spawn: args.spawn,
+				ssh: args.ssh,
 				cmd: args.cmd,
+				script: args.script,
 				mode: args.mode === "oneshot" || args.mode === "pty" ? args.mode : void 0,
 				stdin: args.stdin,
 				timeout: args.timeout
@@ -1130,14 +3948,22 @@ function createRemoteTool(driver, opts = {}) {
 			if (r.timedOut) v.timedOut = true;
 			if (r.reconnected) v.reconnected = true;
 			if (r.truncated !== void 0) v.truncated = r.truncated;
+			if (r.outputStats !== void 0) v.outputStats = r.outputStats;
+			if (r.outputStatsUnavailable) v.outputStatsUnavailable = true;
 			if (r.session !== void 0) v.session = r.session;
 			if (r.notice !== void 0) v.notice = r.notice;
 			return v;
 		}
 	});
+	const description = tool.description;
+	Object.defineProperty(tool, "description", {
+		enumerable: true,
+		get: () => description + (driver.hasHub() ? "\nHub transport available: hub:<m4> selects a paired remote machine (never self). {} includes the Hub directory even when empty. Uses authenticated Hub HTTP oneshot / persistent WS PTY; no SSH alias needed. Hub failures never fall back to SSH." : "")
+	});
+	return tool;
 }
 function renderValue(v) {
-	if (v.kind === "status" || v.kind === "roster") return v.text;
+	if (v.kind === "status" || v.kind === "roster" || v.kind === "job" || v.kind === "copy" || v.kind === "rsync") return v.text;
 	const parts = [];
 	if (v.reconnected === true) parts.push(RECONNECT_NOTICE);
 	if (typeof v.notice === "string" && v.notice.length > 0) parts.push(v.notice);
@@ -1145,7 +3971,8 @@ function renderValue(v) {
 	const secs = ((v.durationMs ?? 0) / 1e3).toFixed(1);
 	const markers = [];
 	if (v.timedOut === true) markers.push("interrupted");
-	if (v.truncated !== void 0) markers.push(`truncated, original ${v.truncated} chars`);
+	if (v.truncated !== void 0) markers.push(`truncated, ${v.outputStatsUnavailable ? "returned peer tail" : "original"} ${v.truncated} ${v.outputStats?.stdout.unit === "bytes" ? "bytes" : "chars"}`);
+	if (v.outputStatsUnavailable) markers.push("peer output totals/retention unavailable; returned tail only");
 	const suffix = markers.length > 0 ? ` · ${markers.join(" · ")}` : "";
 	const cwdTag = typeof v.cwd === "string" && v.cwd.length > 0 ? ` · cwd ${v.cwd}` : "";
 	const sessionTag = typeof v.session === "string" && v.session.length > 0 ? ` · ${v.session}` : "";
@@ -1154,6 +3981,84 @@ function renderValue(v) {
 	return parts.join("\n");
 }
 
+//#endregion
+//#region src/remote/agent-registration.ts
+/** Host listeners attempt once per official creation edge, never on vacancy. */
+function installAgentRemote(ctx, config) {
+	return ctx.on("agent/created", ({ agent }) => {
+		const tools = agent.ctx.get("tools");
+		if (!tools) return;
+		const driver = new RemoteDriver({
+			...config,
+			getHub: () => agent.ctx.get("superdRemoteTransport")
+		});
+		let unregister;
+		try {
+			unregister = tools.register(createRemoteTool(driver, { getSessionKey: () => agent.id }));
+		} catch (error) {
+			driver.dispose();
+			if (error instanceof Error && error.message === "tool \"remote\" is already registered in this scope" && tools.get("remote", agent) !== void 0) return;
+			throw error;
+		}
+		const stopService = agent.ctx.on("internal/service", (name$1) => {
+			if (name$1 === "superdRemoteTransport") agent.ctx.emit("tools/change");
+		});
+		let disposal;
+		let ownerUndo;
+		let agentUndo;
+		const cleanup = () => {
+			if (disposal) return disposal;
+			disposal = driver.dispose();
+			unregister();
+			stopService();
+			ownerUndo?.();
+			agentUndo?.();
+			return disposal;
+		};
+		agentUndo = agent.ctx.effect(() => cleanup, "remote.agentOwner()");
+		ownerUndo = ctx.effect(() => cleanup, "remote.rowOwner()");
+	});
+}
+
+//#endregion
+//#region src/remote/file-worker.ts
+async function runFileWorker(request) {
+	const abort = new AbortController(), cancel = () => abort.abort(/* @__PURE__ */ new Error("binary file worker cancelled"));
+	process.on("SIGTERM", cancel);
+	process.on("SIGHUP", cancel);
+	const report = (value) => new Promise((resolve$1, reject) => process.stderr.write(JSON.stringify(value) + "\n", (error) => error ? reject(error) : resolve$1()));
+	try {
+		mkdirSync(request.root, { mode: 448 });
+		const endpoint = localFileEndpoint({
+			receiveRoot: request.root,
+			temporary: (path$1, active) => report({
+				temporary: path$1,
+				active
+			})
+		});
+		if (request.action === "export") await pipeline(await endpoint.exportTree(request.path, abort.signal), process.stdout, { signal: abort.signal });
+		else if (request.action === "import") await endpoint.importTree(request.path, process.stdin, {
+			mkdir: request.mkdir,
+			signal: abort.signal
+		});
+		else {
+			let metadata = "";
+			process.stdin.setEncoding("utf8");
+			for await (const chunk of process.stdin) {
+				metadata += String(chunk);
+				if (Buffer.byteLength(metadata) > FILE_MAX_METADATA) throw new Error("file selection metadata limit exceeded");
+			}
+			process.stdout.write(JSON.stringify(await endpoint.digest(request.path, abort.signal, request.selected ? JSON.parse(metadata) : void 0)));
+		}
+	} catch (error) {
+		await report({ error: error instanceof Error ? error.message : String(error) }).catch(() => {});
+		process.exitCode = 1;
+	} finally {
+		process.removeListener("SIGTERM", cancel);
+		process.removeListener("SIGHUP", cancel);
+	}
+}
+
 //#endregion
 //#region src/remote/plugin.ts
 const name = "dashr-remote";
@@ -1169,15 +4074,7 @@ const Config = Schema.object({
 });
 /** MUST stay an arrow（RM0 plugin.ts 同注：function 声明会被 cordis 当构造器 new 掉，返回的 disposer 丢失）。 */
 const apply = (ctx, config) => {
-	const driver = new RemoteDriver({
-		execTimeoutSec: config.execTimeoutSec,
-		idleTtlSec: config.idleTtlSec,
-		maxOutputChars: config.maxOutputChars
-	});
-	ctx.inject(["tools"], (toolsCtx) => {
-		toolsCtx.tools.register(createRemoteTool(driver, { getSessionKey: (exec) => exec.agent?.id ?? "remote:no-session" }));
-	});
-	return () => void driver.dispose();
+	return installAgentRemote(ctx, config);
 };
 var plugin_default = {
 	name,
@@ -1187,4 +4084,4 @@ var plugin_default = {
 };
 
 //#endregion
-export { Config, apply, plugin_default as default, inject, name };
+export { ByteTailRing, Config, FILE_FRAME_BYTES, FILE_MAX_ENTRIES, FILE_MAX_METADATA, PROCESS_CLEANUP_BOUND_MS, SshTargets, Utf16TailRing, apply, checkAbsolute, checkSelection, plugin_default as default, inject, localFileEndpoint, name, readUtf8Tail, runFileWorker, runRsync, sshArgv, startBinaryProcess, startOneShot, startRemoteJob, withSshRelay };