dsh-linked-workspace 0.8.1 → 0.8.3

package/lib/index.js

@@ -16,7 +16,7 @@
  * addresses and workspace paths.
  */
 import { randomUUID } from 'node:crypto'
-import { chmodSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs'
+import { chmodSync, closeSync, cpSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs'
 import { spawn } from 'node:child_process'
 import { mkdir, readdir, stat as fsStat } from 'node:fs/promises'
 import { homedir, tmpdir } from 'node:os'
@@ -61,6 +61,7 @@ const LINKED_SYNC_BYTES = 50 * 1024 * 1024
 const LINKED_SYNC_FILE = 20 * 1024 * 1024
 const LINKED_SYNC_EXCLUDES = new Set(['.git', 'node_modules', '__pycache__', '.conda', '.venv', '.mypy_cache', '.pytest_cache', '.ipynb_checkpoints', '.ruff_cache'])
 const LINKED_SYNC_TIMEOUT_MS = 30_000
+const LINKED_SYNC_MAX_DEPTH = 24
 const LINKED_OPEN_FILE_CAP = 64 * 1024 * 1024
 const MAX_BODY_BYTES = 16 * 1024 * 1024
 const EDITABLE_LIMIT = 2 * 1024 * 1024
@@ -82,6 +83,32 @@ const IMAGE_MIME = Object.freeze({
 const MAX_NAME_LENGTH = 120
 const CONNECT_TIMEOUT_MS = 20_000
 const OP_TIMEOUT_MS = 60_000
+// Directory listings are paged so a folder with tens of thousands of entries
+// cannot stall the Host or flood the renderer.
+const LIST_PAGE_SIZE = 500
+const LIST_PAGE_MAX = 5000
+// SFTP readdir has no paging, so a directory is always read in one call. A
+// freshly read listing is kept briefly so "load more" does not repeat the same
+// expensive scan; a first page (offset 0) is always re-read.
+const LISTING_CACHE_TTL_MS = 5000
+const LISTING_CACHE_LIMIT = 128
+const listingCache = new Map()
+const listingCacheKey = (scope, target) => `${scope.kind === 'linked' ? 'L' : 'W'}:${scope.id}:${target}`
+const rememberListing = (key, listing) => {
+  listingCache.delete(key)
+  listingCache.set(key, { at: Date.now(), listing })
+  while (listingCache.size > LISTING_CACHE_LIMIT) {
+    listingCache.delete(listingCache.keys().next().value)
+  }
+}
+const forgetListings = () => listingCache.clear()
+
+/** Clamp a requested page window to the listing limits. */
+const pageWindow = (params = {}, total = 0) => {
+  const limit = Math.min(Math.max(Number(params.limit) || LIST_PAGE_SIZE, 1), LIST_PAGE_MAX)
+  const offset = Math.min(Math.max(Number(params.offset) || 0, 0), Math.max(total, 0))
+  return { limit, offset }
+}
 
 const LOG_PREFIX = '[dsh-linked-workspace]'
 
@@ -99,6 +126,7 @@ const ERROR_STATUS = {
   FS_IS_DIR: 400,
   FS_NOT_DIR: 400,
   FS_TOO_LARGE: 413,
+  FS_INCOMPLETE: 500,
   FS_EXISTS: 409,
   CONFLICT: 409,
   INTERNAL: 500,
@@ -505,10 +533,31 @@ function mapLocalFsError(error, fallback = 'INTERNAL') {
   if (code === 'ENOENT') return new ApiError('FS_NOT_FOUND', '本地路径不存在')
   if (code === 'EACCES' || code === 'EPERM') return new ApiError('FS_PERMISSION', '没有权限访问本地路径')
   if (code === 'ENOTDIR') return new ApiError('FS_NOT_DIR', '本地路径不是目录')
-  if (code === 'EEXIST') return new ApiError('BAD_REQUEST', '同名文件夹已存在')
+  if (code === 'EEXIST') return new ApiError('FS_EXISTS', '同名文件或文件夹已存在')
   return new ApiError(fallback, error && error.message ? error.message : String(error))
 }
 
+/**
+ * Read at most `maxBytes` from the start of a local file.
+ * Unlike readFileSync this never maps the whole file, so a peek at a huge
+ * (or larger-than-2-GiB) file stays cheap.
+ */
+function readHeadSync(absolute, maxBytes) {
+  const fd = openSync(absolute, 'r')
+  try {
+    const buffer = Buffer.allocUnsafe(Math.max(1, Math.min(maxBytes, 16 * 1024 * 1024)))
+    let filled = 0
+    while (filled < buffer.length) {
+      const read = readSync(fd, buffer, filled, buffer.length - filled, filled)
+      if (read <= 0) break
+      filled += read
+    }
+    return buffer.subarray(0, filled)
+  } finally {
+    closeSync(fd)
+  }
+}
+
 function localDrives() {
   if (process.platform !== 'win32') return []
   const drives = []
@@ -670,6 +719,7 @@ class HostPool {
     this.knownHostsFile = knownHostsFile
     this.records = new Map() // hostId -> HostRecord
     this.connections = new Map() // hostId -> { authority, remote: RemoteHost }
+    this.connecting = new Map() // hostId -> { authority, promise }
     this.statuses = new Map() // hostId -> { state, message?, latencyMs?, checkedAt }
   }
 
@@ -684,6 +734,12 @@ class HostPool {
         this.connections.delete(hostId)
       }
     }
+    // In-flight connects for removed or re-addressed hosts must not be reused:
+    // the attempt itself notices the lost map entry and disposes its socket.
+    for (const [hostId, pending] of [...this.connecting]) {
+      const host = this.records.get(hostId)
+      if (!host || `${host.host}:${host.port}` !== pending.authority) this.connecting.delete(hostId)
+    }
   }
 
   host(hostId) {
@@ -703,8 +759,8 @@ class HostPool {
   }
 
   async remote(hostRecord) {
-    const existing = this.connections.get(hostRecord.id)
     const authority = `${hostRecord.host}:${hostRecord.port}`
+    const existing = this.connections.get(hostRecord.id)
     if (existing && existing.authority === authority) {
       try {
         await existing.remote.ensureConnected()
@@ -715,15 +771,41 @@ class HostPool {
         throw error
       }
     }
+    // Two concurrent first requests for one host must share one connection;
+    // otherwise the second RemoteHost overwrites the map entry and the first
+    // SSH socket leaks. The pending attempt is bound to the address it dials,
+    // so a host edit during connect never hands the old socket to the new
+    // address.
+    const pending = this.connecting.get(hostRecord.id)
+    if (pending && pending.authority === authority) return pending.promise
     const remote = new RemoteHost({
       host: hostRecord,
       knownHostsFile: this.knownHostsFile,
       connectTimeoutMs: CONNECT_TIMEOUT_MS,
       logger: log,
     })
-    this.connections.set(hostRecord.id, { authority, remote })
-    await remote.connect()
-    return remote
+    const entry = { authority, remote }
+    this.connections.set(hostRecord.id, entry)
+    const attempt = (async () => {
+      try {
+        await remote.connect()
+        // The host may have been removed while the socket was connecting: keep
+        // the map state authoritative so the unused connection is closed.
+        if (this.connections.get(hostRecord.id) !== entry) {
+          remote.dispose().catch(() => {})
+        }
+        return remote
+      } catch (error) {
+        if (this.connections.get(hostRecord.id) === entry) this.connections.delete(hostRecord.id)
+        remote.dispose().catch(() => {})
+        throw error
+      } finally {
+        const current = this.connecting.get(hostRecord.id)
+        if (current && current.promise === attempt) this.connecting.delete(hostRecord.id)
+      }
+    })()
+    this.connecting.set(hostRecord.id, { authority, promise: attempt })
+    return attempt
   }
 
   async disposeAll() {
@@ -1107,8 +1189,11 @@ export function apply(ctx) {
         const seen = new Set()
         const shouldStop = () => job.cancel || job.files >= job.maxFiles || job.bytes >= job.maxBytes
         const visit = async (directory, depth) => {
-          if (depth > 24 || shouldStop()) {
-            if (shouldStop() && !job.cancel) job.truncated = true
+          // Hitting the depth limit makes the scan incomplete, exactly like the
+          // file/byte caps: flag it so the removal pass is skipped and the UI
+          // can say the archive is partial.
+          if (depth > LINKED_SYNC_MAX_DEPTH || shouldStop()) {
+            if (!job.cancel) job.truncated = true
             return
           }
           let listing
@@ -1325,7 +1410,15 @@ export function apply(ctx) {
   const remoteCopyRecursive = async (remote, source, target) => {
     const stat = await remote.stat(source)
     if (stat.type !== 'dir') {
+      // readFile truncates silently, so an oversized source has to be refused
+      // here: copying only its first 64 MiB would corrupt the destination.
+      if (stat.size > LINKED_OPEN_FILE_CAP) {
+        throw new ApiError('FS_TOO_LARGE', `${posix.basename(source)} 超过 64 MB，无法复制`)
+      }
       const read = await remote.readFile(source, { maxBytes: LINKED_OPEN_FILE_CAP })
+      if (read.truncated || read.data.length !== stat.size) {
+        throw new ApiError('FS_INCOMPLETE', `${posix.basename(source)} 读取不完整，已取消复制`)
+      }
       await remote.writeFileAtomic(target, read.data)
       return 1
     }
@@ -1532,6 +1625,7 @@ export function apply(ctx) {
   // ── document bridge (Markdown/PDF/DOCX/XLSX/PPTX) ──────────────────────
 
   const DOC_MAX_BYTES = 80 * 1024 * 1024
+  const DOC_PDF_SUFFIX_MAX = 999
   const DOC_TOOL = join(dirname(fileURLToPath(import.meta.url)), '..', 'scripts', 'doc_tool.py')
   const DOC_KIND_BY_EXT = new Map([
     ['.md', 'markdown'], ['.markdown', 'markdown'],
@@ -1804,17 +1898,34 @@ export function apply(ctx) {
       const target = params.path === undefined || params.path === ''
         ? scope.root
         : scopeTarget(scope, params.path)
-      const listing = await scope.remote.listDir(target)
+      const limit = Math.min(Math.max(Number(params.limit) || LIST_PAGE_SIZE, 1), LIST_PAGE_MAX)
+      const requestedOffset = Math.max(Number(params.offset) || 0, 0)
+      const key = listingCacheKey(scope, target)
+      let listing
+      if (requestedOffset > 0) {
+        const hit = listingCache.get(key)
+        if (hit && Date.now() - hit.at < LISTING_CACHE_TTL_MS) listing = hit.listing
+      }
+      if (!listing) {
+        listing = await scope.remote.listDir(target)
+        rememberListing(key, listing)
+      }
+      const all = listing.entries.map((entry) => ({
+        name: entry.name,
+        path: entry.path,
+        type: entry.type,
+        size: entry.size,
+        mtime: entry.mtime,
+        relative: scopeRelative(scope, entry.path),
+      }))
+      const page = pageWindow({ limit, offset: requestedOffset }, all.length)
       return {
         path: target,
-        entries: listing.entries.map((entry) => ({
-          name: entry.name,
-          path: entry.path,
-          type: entry.type,
-          size: entry.size,
-          mtime: entry.mtime,
-          relative: scopeRelative(scope, entry.path),
-        })),
+        entries: all.slice(page.offset, page.offset + page.limit),
+        total: all.length,
+        offset: page.offset,
+        limit: page.limit,
+        hasMore: page.offset + page.limit < all.length,
       }
     },
 
@@ -1876,6 +1987,7 @@ export function apply(ctx) {
         if (apiError.code !== 'FS_NOT_FOUND') throw apiError
         current = undefined
       }
+      if (params.createOnly === true && current) throw new ApiError('FS_EXISTS', '目标已存在，请使用其他名称')
       if (current && current.type === 'dir') throw new ApiError('FS_IS_DIR', '目标是目录，无法写入')
       if (current && typeof params.expectedMtime === 'number' && params.expectedMtime > 0) {
         const currentSeconds = Math.floor(current.mtime / 1000)
@@ -1889,6 +2001,7 @@ export function apply(ctx) {
         mode: current ? current.mode : undefined,
       })
       await scopeMirror(scope, target, data)
+      forgetListings()
       return { path: target, size: info.size, mtime: info.mtime }
     },
 
@@ -2013,19 +2126,21 @@ export function apply(ctx) {
         const directory = posix.dirname(outputPath)
         let candidate = outputPath
         let index = 1
-        while (await target.scope.remote.stat(candidate).catch(() => null)) {
+        while (index <= DOC_PDF_SUFFIX_MAX && await target.scope.remote.stat(candidate).catch(() => null)) {
           candidate = posix.join(directory, posix.basename(base) + '-' + index + '.pdf')
           index += 1
         }
+        if (index > DOC_PDF_SUFFIX_MAX) throw new ApiError('FS_EXISTS', '同名 PDF 过多，请先清理目录中的旧导出')
         outputPath = candidate
       } else {
         const directory = dirname(outputPath)
         let candidate = outputPath
         let index = 1
-        while (existsSync(candidate)) {
+        while (index <= DOC_PDF_SUFFIX_MAX && existsSync(candidate)) {
           candidate = join(directory, basename(base) + '-' + index + '.pdf')
           index += 1
         }
+        if (index > DOC_PDF_SUFFIX_MAX) throw new ApiError('FS_EXISTS', '同名 PDF 过多，请先清理目录中的旧导出')
         outputPath = candidate
       }
       const temp = await makeDocTemp()
@@ -2059,7 +2174,19 @@ export function apply(ctx) {
       const scope = await requireScope(params)
       const target = scopeTarget(scope, params.path)
       if (target === scope.root) throw new ApiError('BAD_REQUEST', '不能创建工作区根目录')
+      if (params.createOnly === true) {
+        let current
+        try {
+          current = await scope.remote.stat(target)
+        } catch (error) {
+          const apiError = asApiError(error)
+          if (apiError.code !== 'FS_NOT_FOUND') throw apiError
+          current = undefined
+        }
+        if (current) throw new ApiError('FS_EXISTS', '目标已存在，请使用其他名称')
+      }
       await scope.remote.mkdirp(target)
+      forgetListings()
       return {}
     },
 
@@ -2070,6 +2197,7 @@ export function apply(ctx) {
       if (from === scope.root) throw new ApiError('BAD_REQUEST', '不能移动工作区根目录')
       await scope.remote.rename(from, to)
       await scopeMirrorRemove(scope, from)
+      forgetListings()
       return {}
     },
 
@@ -2091,6 +2219,7 @@ export function apply(ctx) {
       if (await scope.remote.stat(target).catch(() => null)) throw new ApiError('FS_EXISTS', '目标目录中已存在同名文件或文件夹')
       await scope.remote.rename(source, target)
       await scopeMirrorRemove(scope, source)
+      forgetListings()
       return { path: target }
     },
 
@@ -2100,6 +2229,7 @@ export function apply(ctx) {
       if (target === scope.root) throw new ApiError('BAD_REQUEST', '不能删除工作区根目录')
       await remoteDeleteRecursive(scope.remote, target)
       await scopeMirrorRemove(scope, target)
+      forgetListings()
       return {}
     },
 
@@ -2107,7 +2237,9 @@ export function apply(ctx) {
       const scope = await requireScope(params)
       if (scope.kind !== 'linked') throw new ApiError('BAD_REQUEST', '只有联动工作区支持文件传输')
       if (params.side === 'local') {
-        return await transferLocalToRemote(scope.record, scope.remote, params.path)
+        const result = await transferLocalToRemote(scope.record, scope.remote, params.path)
+        forgetListings()
+        return result
       }
       const target = scopeTarget(scope, params.path)
       return await transferToMirror(scope.record, scope.remote, target)
@@ -2138,7 +2270,16 @@ export function apply(ctx) {
         throw new ApiError('BAD_REQUEST', '不能把目录复制到自身内部')
       }
       const target = await remoteUniqueTarget(scope.remote, parent, posix.basename(source))
-      const files = await remoteCopyRecursive(scope.remote, source, target)
+      let files
+      try {
+        files = await remoteCopyRecursive(scope.remote, source, target)
+      } catch (error) {
+        // A half-copied tree is worse than a clean failure: remove what this
+        // call created (the target name was unique, so nothing else lives there).
+        await remoteDeleteRecursive(scope.remote, target).catch(() => {})
+        throw error
+      }
+      forgetListings()
       return { path: target, files }
     },
 
@@ -2187,32 +2328,43 @@ export function apply(ctx) {
         throw mapLocalFsError(error)
       }
       if (!info.isDirectory()) throw new ApiError('FS_NOT_DIR', '本地路径不是目录')
-      let rawEntries
-      try {
-        rawEntries = await readdir(target, { withFileTypes: true })
-      } catch (error) {
+      const rawEntries = await readdir(target, { withFileTypes: true }).catch((error) => {
         throw mapLocalFsError(error)
-      }
+      })
       const entries = []
-      for (const entry of rawEntries) {
-        const full = join(target, entry.name)
-        let stat
-        try {
-          stat = await fsStat(full)
-        } catch {
-          continue
-        }
-        let type = 'file'
-        if (stat.isDirectory()) type = 'dir'
-        else if (stat.isSymbolicLink()) type = 'symlink'
-        entries.push({ name: entry.name, path: full, type, size: stat.size, mtime: stat.mtimeMs })
+      // Stat in small parallel batches: one await per entry is slow for big
+      // folders, but an unbounded Promise.all can exhaust file descriptors.
+      for (let start = 0; start < rawEntries.length; start += 128) {
+        const batch = rawEntries.slice(start, start + 128)
+        const stated = await Promise.all(batch.map(async (entry) => {
+          const full = join(target, entry.name)
+          let stat
+          try {
+            stat = await fsStat(full)
+          } catch {
+            return null
+          }
+          let type = 'file'
+          if (stat.isDirectory()) type = 'dir'
+          else if (stat.isSymbolicLink()) type = 'symlink'
+          return { name: entry.name, path: full, type, size: stat.size, mtime: stat.mtimeMs }
+        }))
+        for (const item of stated) if (item) entries.push(item)
       }
       entries.sort((left, right) => {
         if (left.type === 'dir' && right.type !== 'dir') return -1
         if (right.type === 'dir' && left.type !== 'dir') return 1
         return left.name.localeCompare(right.name)
       })
-      return { path: target, entries }
+      const page = pageWindow(params, entries.length)
+      return {
+        path: target,
+        entries: entries.slice(page.offset, page.offset + page.limit),
+        total: entries.length,
+        offset: page.offset,
+        limit: page.limit,
+        hasMore: page.offset + page.limit < entries.length,
+      }
     },
 
     async 'local.stat'(params = {}) {
@@ -2246,13 +2398,15 @@ export function apply(ctx) {
       if (info.isDirectory()) throw new ApiError('FS_IS_DIR', '目标是目录，无法作为文件读取')
       const tooLarge = info.size > EDITABLE_LIMIT
       const cap = tooLarge ? PEEK_LIMIT : READ_CAP
+      // Read at most `cap` bytes. Reading the whole file first would pull
+      // multi-gigabyte files into Host memory (and on Windows readFileSync
+      // throws ERR_FS_FILE_TOO_LARGE above 2 GiB even for a peek).
       let data
       try {
-        data = readFileSync(absolute)
+        data = readHeadSync(absolute, cap)
       } catch (error) {
         throw mapLocalFsError(error)
       }
-      if (data.length > cap) data = data.subarray(0, cap)
       const binary = looksBinary(data)
       return {
         path: absolute,
@@ -2640,7 +2794,6 @@ export function apply(ctx) {
       if (nextName.length > MAX_NAME_LENGTH) throw new ApiError('BAD_REQUEST', '工作区名称过长')
       const nextMirror = typeof params.mirror === 'boolean' ? params.mirror : record.mirror
       const renamed = nextName !== '' && nextName !== record.name
-      if (renamed && nextName === '') throw new ApiError('BAD_REQUEST', '名称不能为空')
       record.name = nextName !== '' ? nextName : record.name
       record.mirror = nextMirror
       if (nextMirror === false) {
@@ -2919,8 +3072,11 @@ export function apply(ctx) {
             return toolText(`${target} (${stat.size} B, mtime ${stat.mtime}) is a binary file; use list_dir/stat or download it locally.`)
           }
           const content = decodeUtf8(read.data)
-          const suffix = read.data.length < stat.size ? `\n...(truncated at ${read.data.length} of ${stat.size} bytes)` : ''
-          await mirrorWrite(link, target, read.data)
+          const truncated = read.data.length < stat.size
+          const suffix = truncated ? `\n...(truncated at ${read.data.length} of ${stat.size} bytes)` : ''
+          // Only a complete read may be archived: mirroring a truncated prefix
+          // would leave a silently corrupt copy under .remote.
+          if (!truncated) await mirrorWrite(link, target, read.data)
           return toolText(`${target} (${stat.size} B, mtime ${stat.mtime})${suffix}\n\n${content}`)
         }
 
@@ -2993,7 +3149,9 @@ export function apply(ctx) {
         if (action === 'delete') {
           if (target === root) throw new ApiError('BAD_REQUEST', '不能删除联动工作区根目录')
           const stat = await remote.stat(target)
-          if (stat.type === 'dir') await remote.rmdir(target)
+          // rmdir only removes empty directories (same as the UI's fs.delete,
+          // which uses this recursive helper).
+          if (stat.type === 'dir') await remoteDeleteRecursive(remote, target)
           else await remote.unlink(target)
           await linkedFs.removeMirrorPath(link.localPath, linkedRelative(link, target)).catch(() => {})
           return toolText(`Deleted ${target}`)

package/lib/linked.js

@@ -509,6 +509,35 @@ function isContained(realRoot, realTarget) {
   return offset !== '' && !offset.startsWith('..') && !isAbsolute(offset)
 }
 
+/**
+ * Resolve a path the way the OS does. The JS `realpathSync` does not follow
+ * Windows junctions, so a junction pointing outside the workspace would pass a
+ * plain string containment test; the native call resolves it correctly.
+ */
+function realPathOf(target) {
+  return typeof realpathSync.native === 'function' ? realpathSync.native(target) : realpathSync(target)
+}
+
+/**
+ * True for symlinks and for Windows junctions, which `lstatSync` reports as
+ * ordinary directories (mode 40666, `isSymbolicLink() === false`).
+ */
+function isLinkLike(target, stats) {
+  if (stats && stats.isSymbolicLink()) return true
+  if (process.platform !== 'win32') return false
+  try {
+    return realPathOf(target) !== resolve(target)
+  } catch {
+    return false
+  }
+}
+
+function unsafeLinkError(target, detail) {
+  const error = new Error(`refusing to remove ${target}: ${detail}`)
+  error.code = 'ELINKED_UNSAFE'
+  return error
+}
+
 /**
  * Remove empty parent directories of `target`, stopping at `stopAt` (exclusive).
  * Best effort: the first non-empty or unreadable directory ends the walk.
@@ -550,8 +579,8 @@ export async function removeMirrorPath(localPath, relativePath) {
   const mirrorRoot = join(root, MIRROR_DIR)
   const target = join(mirrorRoot, ...relativeValue.split('/'))
 
-  // A symlinked `.remote` would redirect every operation outside the
-  // workspace; refuse instead of deleting through it.
+  // A symlinked or junctioned `.remote` would redirect every operation
+  // outside the workspace; refuse instead of deleting through it.
   let mirrorStats
   try {
     mirrorStats = lstatSync(mirrorRoot)
@@ -559,12 +588,13 @@ export async function removeMirrorPath(localPath, relativePath) {
     if (error && error.code === 'ENOENT') return false
     throw error
   }
-  if (mirrorStats.isSymbolicLink()) {
-    const error = new Error(
-      `refusing to remove ${target}: ${mirrorRoot} is a symbolic link`,
-    )
-    error.code = 'ELINKED_UNSAFE'
-    throw error
+  if (isLinkLike(mirrorRoot, mirrorStats)) {
+    throw unsafeLinkError(target, `${mirrorRoot} is a symbolic link`)
+  }
+  const realRoot = realPathOf(root)
+  const realMirror = realPathOf(mirrorRoot)
+  if (!isContained(realRoot, realMirror)) {
+    throw unsafeLinkError(target, `${mirrorRoot} resolves outside ${root}`)
   }
 
   let stats
@@ -576,18 +606,13 @@ export async function removeMirrorPath(localPath, relativePath) {
     throw error
   }
 
-  if (stats.isSymbolicLink()) {
+  if (isLinkLike(target, stats)) {
     // Delete the link itself, never what it points at.
     removeSymlink(target)
   } else {
-    const realMirror = realpathSync(mirrorRoot)
-    const realTarget = realpathSync(target)
+    const realTarget = realPathOf(target)
     if (!isContained(realMirror, realTarget)) {
-      const error = new Error(
-        `refusing to remove ${target}: it resolves outside ${mirrorRoot}`,
-      )
-      error.code = 'ELINKED_UNSAFE'
-      throw error
+      throw unsafeLinkError(target, `it resolves outside ${mirrorRoot}`)
     }
     rmSync(target, { recursive: true, force: true, maxRetries: 3 })
   }
@@ -626,18 +651,15 @@ function removeOwnedDir(target, root) {
     if (error && error.code === 'ENOENT') return false
     throw error
   }
-  if (stats.isSymbolicLink()) {
+  if (isLinkLike(target, stats)) {
+    // A junction/symlink owns only the link: remove it, keep the data outside.
     removeSymlink(target)
     return true
   }
-  const realRoot = realpathSync(root)
-  const realTarget = realpathSync(target)
+  const realRoot = realPathOf(root)
+  const realTarget = realPathOf(target)
   if (!isContained(realRoot, realTarget)) {
-    const error = new Error(
-      `refusing to remove ${target}: it resolves outside ${root}`,
-    )
-    error.code = 'ELINKED_UNSAFE'
-    throw error
+    throw unsafeLinkError(target, `it resolves outside ${root}`)
   }
   rmSync(target, { recursive: true, force: true, maxRetries: 3 })
   return true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-linked-workspace",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "description": "Linked local ⇄ remote workspaces and SSH-backed remote directories for DeepSeek Harness: theme-aware split editor, file-type icons, and an agent tool that edits remote files directly.",
   "type": "module",
   "main": "lib/index.js",
@@ -72,7 +72,7 @@
   },
   "scripts": {
     "build": "node scripts/build-client.mjs",
-    "test": "node --test test/linked.test.mjs test/parts.test.mjs test/git.test.mjs && node test/client-smoke.mjs",
+    "test": "node --test test/linked.test.mjs test/parts.test.mjs test/git.test.mjs test/file-creation.test.mjs && node test/client-smoke.mjs",
     "prepack": "node scripts/build-client.mjs"
   },
   "repository": {

package/scripts/doc_tool.py

@@ -106,18 +106,25 @@ def read_xlsx(path):
     sheets = []
     for sheet in workbook.worksheets[:20]:
         rows = []
-        max_row = min(sheet.max_row or 0, MAX_SHEET_ROWS)
-        max_col = min(sheet.max_column or 0, MAX_SHEET_COLS)
+        total_row = sheet.max_row or 0
+        total_col = sheet.max_column or 0
+        max_row = min(total_row, MAX_SHEET_ROWS)
+        max_col = min(total_col, MAX_SHEET_COLS)
         for row in sheet.iter_rows(min_row=1, max_row=max_row, min_col=1, max_col=max_col):
             rows.append([json_value(cell.value) for cell in row])
         sheets.append({
             "name": sheet.title,
             "rows": rows,
+            # maxRow/maxCol stay the rendered window so the client can size the
+            # grid; totalRow/totalCol/truncated tell it the sheet is larger.
             "maxRow": max_row,
             "maxCol": max_col,
+            "totalRow": total_row,
+            "totalCol": total_col,
+            "truncated": total_row > max_row or total_col > max_col,
             "frozen": bool(sheet.freeze_panes),
         })
-    emit({"kind": "xlsx", "sheets": sheets, "sheetCount": len(workbook.worksheets)})
+    emit({"kind": "xlsx", "sheets": sheets, "sheetCount": len(workbook.worksheets), "sheetLimit": 20})
 
 
 def write_xlsx(source, data, out):