dsh-over-ssh 0.1.0 → 0.2.0

package/lib/fs.js

@@ -128,6 +128,33 @@ var LruCache = class {
     this.#bytes -= entry.bytes;
     return true;
   }
+  /**
+   * Remove every entry whose key starts with `prefix`, in one pass over the internal map.
+   *
+   * 存在的理由：调用方（`VersionedCache.invalidatePrefix`）在**每次写**之后都要按前缀失效，而在此之前
+   * 它只有 `keys()` 可用——`keys()` 会把整张表**物化**成一个数组，随后又用 `delete(key)` 逐个做哈希
+   * 查找。这里直接在 `#entries` 上过一遍：不建中间数组，字节记账就地扣减，边迭代边删除（Map 迭代器
+   * 规范保证删除当前条目后仍会访问后续条目）。
+   *
+   * **为什么是"前缀"而不是更通用的"谓词"**：谓词要为每条 key 付一次 JS 回调，而一次 `keys()` 物化只是
+   * 一次指针批量拷贝。实测（20 000 条 × 2 000 次，只命中 1 条）旧写法 1 289 ms、前缀版 962 ms、
+   * 谓词版 953 ms——两者同量级；但在**生产上限**（读缓存 256 条 / 目录缓存 512 条）下谓词版反而比旧
+   * 写法慢（20 000 次：160 ms vs 148 ms），前缀版打平（147 ms）。也就是说：谓词版只在大表上不亏，
+   * 在小表上亏；前缀版两边都不亏。热路径上的方法按真实规模选形状。
+   *
+   * @param prefix - key prefix.
+   * @returns the number of removed entries.
+   */
+  deleteByPrefix(prefix) {
+    let removed = 0;
+    for (const [key, entry] of this.#entries) {
+      if (!key.startsWith(prefix)) continue;
+      this.#entries.delete(key);
+      this.#bytes -= entry.bytes;
+      removed++;
+    }
+    return removed;
+  }
   /** Remove everything. */
   clear() {
     this.#entries.clear();
@@ -148,16 +175,38 @@ var LruCache = class {
       rejectedOversize: this.#rejectedOversize
     };
   }
+  /**
+   * Drop the least-recently-used entry.
+   *
+   * Exposed so a shared {@link CacheBudget} can make this cache give bytes back; `#evictToBounds` is the
+   * same operation driven by this cache's own limits.
+   *
+   * @returns `false` when the cache is empty (the caller must not retry in a loop).
+   */
+  evictOldest() {
+    const oldest = this.#entries.keys().next();
+    if (oldest.done === true) return false;
+    const entry = this.#entries.get(oldest.value);
+    if (entry === void 0) return false;
+    this.#entries.delete(oldest.value);
+    this.#bytes -= entry.bytes;
+    this.#evictions++;
+    return true;
+  }
+  /**
+   * Come down to `maxBytes` by dropping the oldest entries.
+   *
+   * @param maxBytes - the ceiling to reach.
+   * @returns how many entries were dropped.
+   */
+  trimTo(maxBytes) {
+    let dropped = 0;
+    while (this.#bytes > maxBytes && this.evictOldest()) dropped++;
+    return dropped;
+  }
   #evictToBounds() {
     while (this.#entries.size > this.#maxEntries || this.#bytes > this.#maxBytes) {
-      const oldest = this.#entries.keys().next();
-      if (oldest.done === true) return;
-      const key = oldest.value;
-      const entry = this.#entries.get(key);
-      if (entry === void 0) return;
-      this.#entries.delete(key);
-      this.#bytes -= entry.bytes;
-      this.#evictions++;
+      if (!this.evictOldest()) return;
     }
   }
 };
@@ -167,6 +216,7 @@ var VersionedCache = class {
   #ttlMs;
   #now;
   #lru;
+  #budget;
   #hits = 0;
   #misses = 0;
   #freshHits = 0;
@@ -177,6 +227,29 @@ var VersionedCache = class {
     this.#ttlMs = options.ttlMs;
     this.#now = options.now ?? Date.now;
     this.#lru = new LruCache({ maxEntries: options.maxEntries, maxBytes: options.maxBytes }, (entry) => sizeOf(entry.value));
+    this.#budget = options.budget;
+    this.#budget?.join(this);
+  }
+  /** Bytes this cache holds (the budget member contract). */
+  get bytes() {
+    return this.#lru.stats.bytes;
+  }
+  /** Drop oldest entries down to `maxBytes` (the budget member contract). */
+  trimTo(maxBytes) {
+    return this.#lru.trimTo(maxBytes);
+  }
+  /** Drop the oldest entry (the budget member contract). */
+  evictOldest() {
+    return this.#lru.evictOldest();
+  }
+  /**
+   * Leave the shared budget, so a retired cache stops counting against the total.
+   *
+   * Called by whoever owns the cache when its root goes away. Without it a removed root's cache stayed in the
+   * accounting forever, which is the leak the budget exists to prevent.
+   */
+  leaveBudget() {
+    this.#budget?.leave(this);
   }
   /**
    * Look up an entry.
@@ -199,7 +272,9 @@ var VersionedCache = class {
   }
   /** Insert or replace an entry, stamping it as just-read. */
   set(key, value, version) {
-    return this.#lru.set(key, { value, version, storedAt: this.#now() });
+    const stored = this.#lru.set(key, { value, version, storedAt: this.#now() });
+    if (stored) this.#budget?.enforce(this);
+    return stored;
   }
   /**
    * Refresh an entry's timestamp after a cheap remote version check matched.
@@ -226,11 +301,7 @@ var VersionedCache = class {
    * @returns the number of removed entries.
    */
   invalidatePrefix(prefix) {
-    let removed = 0;
-    for (const key of this.#lru.keys()) {
-      if (key.startsWith(prefix) && this.#lru.delete(key)) removed++;
-    }
-    return removed;
+    return this.#lru.deleteByPrefix(prefix);
   }
   /** Remove everything. */
   clear() {
@@ -267,12 +338,35 @@ function isSshDevError(value) {
   return value instanceof SshDevError;
 }
 
-// src/host/domain/path-grammar.ts
-function normalizeRemotePath(path) {
-  if (path === "") throw new SshDevError("ROOT_INVALID", "\u8FDC\u7A0B\u8DEF\u5F84\u4E0D\u80FD\u4E3A\u7A7A", {});
-  if (!path.startsWith("/")) {
-    throw new SshDevError("ROOT_INVALID", `\u8FDC\u7A0B\u8DEF\u5F84\u5FC5\u987B\u662F\u7EDD\u5BF9\u8DEF\u5F84\uFF1A${path}`, { path });
+// src/shared/root-keys.ts
+function normalizeLocalPath(path, options = {}) {
+  const caseInsensitive = options.caseInsensitive ?? false;
+  const unified = path.replace(/\\/g, "/");
+  const unc = unified.startsWith("//");
+  const posixAbsolute = unified.startsWith("/");
+  const driveMatch = /^([A-Za-z]):/.exec(unified);
+  const driveLetter = driveMatch?.[1];
+  const drive = driveLetter === void 0 ? "" : `${driveLetter.toUpperCase()}:`;
+  const rest = unc ? unified.slice(2) : drive === "" ? unified : unified.slice(2);
+  const segments = [];
+  for (const segment of rest.split("/")) {
+    if (segment === "" || segment === ".") continue;
+    if (segment === "..") {
+      segments.pop();
+      continue;
+    }
+    segments.push(segment);
   }
+  const body = segments.join("/");
+  let normalized;
+  if (unc) normalized = `//${body}`;
+  else if (drive !== "") normalized = body === "" ? `${drive}/` : `${drive}/${body}`;
+  else if (posixAbsolute) normalized = body === "" ? "/" : `/${body}`;
+  else normalized = body === "" ? "." : body;
+  return caseInsensitive ? normalized.toLowerCase() : normalized;
+}
+function normalizePosixPath(path) {
+  if (!path.startsWith("/")) return void 0;
   const segments = [];
   for (const segment of path.split("/")) {
     if (segment === "" || segment === ".") continue;
@@ -284,12 +378,31 @@ function normalizeRemotePath(path) {
   }
   return segments.length === 0 ? "/" : `/${segments.join("/")}`;
 }
+
+// src/host/domain/path-grammar.ts
+function normalizeRemotePath(path) {
+  if (/[\u0000-\u001f]/.test(path)) {
+    throw new SshDevError("ROOT_INVALID", "\u8FDC\u7A0B\u8DEF\u5F84\u4E0D\u80FD\u5305\u542B\u63A7\u5236\u5B57\u7B26", { path: JSON.stringify(path) });
+  }
+  const normalized = normalizePosixPath(path);
+  if (normalized !== void 0) return normalized;
+  if (path === "") throw new SshDevError("ROOT_INVALID", "\u8FDC\u7A0B\u8DEF\u5F84\u4E0D\u80FD\u4E3A\u7A7A", {});
+  throw new SshDevError("ROOT_INVALID", `\u8FDC\u7A0B\u8DEF\u5F84\u5FC5\u987B\u662F\u7EDD\u5BF9\u8DEF\u5F84\uFF1A${path}`, { path });
+}
 function remotePathContains(root, candidate) {
   const normalizedRoot = normalizeRemotePath(root);
   const normalizedCandidate = normalizeRemotePath(candidate);
   if (normalizedRoot === "/") return true;
   return normalizedCandidate === normalizedRoot || normalizedCandidate.startsWith(`${normalizedRoot}/`);
 }
+function longestContainingRoot(roots, candidate) {
+  let best;
+  for (const root of roots) {
+    if (!remotePathContains(root, candidate)) continue;
+    if (best === void 0 || normalizeRemotePath(root).length > normalizeRemotePath(best).length) best = root;
+  }
+  return best;
+}
 
 // src/host/infra/transport/git-status.ts
 function isGitStatusTransport(value) {
@@ -429,31 +542,27 @@ function relativeDirectory(root, path) {
 }
 
 // src/host/domain/roots/root.ts
-function normalizeLocalPath(path, options = {}) {
-  const caseInsensitive = options.caseInsensitive ?? process.platform === "win32";
-  const unified = path.replace(/\\/g, "/");
-  const unc = unified.startsWith("//");
-  const posixAbsolute = unified.startsWith("/");
-  const driveMatch = /^([A-Za-z]):/.exec(unified);
-  const driveLetter = driveMatch?.[1];
-  const drive = driveLetter === void 0 ? "" : `${driveLetter.toUpperCase()}:`;
-  const rest = unc ? unified.slice(2) : drive === "" ? unified : unified.slice(2);
-  const segments = [];
-  for (const segment of rest.split("/")) {
-    if (segment === "" || segment === ".") continue;
-    if (segment === "..") {
-      segments.pop();
-      continue;
-    }
-    segments.push(segment);
+function normalizeLocalPath2(path, options = {}) {
+  return normalizeLocalPath(path, { caseInsensitive: options.caseInsensitive ?? process.platform === "win32" });
+}
+function localPathContains(root, candidate, options = {}) {
+  const normalizedRoot = normalizeLocalPath2(root, options);
+  const normalizedCandidate = normalizeLocalPath2(candidate, options);
+  if (normalizedRoot === "/" || /^[a-z]:\/$/.test(normalizedRoot)) {
+    return normalizedCandidate.startsWith(normalizedRoot);
   }
-  const body = segments.join("/");
-  let normalized;
-  if (unc) normalized = `//${body}`;
-  else if (drive !== "") normalized = body === "" ? `${drive}/` : `${drive}/${body}`;
-  else if (posixAbsolute) normalized = body === "" ? "/" : `/${body}`;
-  else normalized = body === "" ? "." : body;
-  return caseInsensitive ? normalized.toLowerCase() : normalized;
+  return normalizedCandidate === normalizedRoot || normalizedCandidate.startsWith(`${normalizedRoot}/`);
+}
+
+// src/host/app/roots/user-roots.ts
+var USER_ROOTS_FILE_NAME = "user-roots.json";
+var USER_ROOTS_LOCK_FILE_NAME = `${USER_ROOTS_FILE_NAME}.lock`;
+
+// src/shared/routes.ts
+function asRouteHost(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const register = value.register;
+  return typeof register === "function" ? value : void 0;
 }
 
 // src/host/app/roots/roots-api-contract.ts
@@ -507,14 +616,14 @@ function parseAuthority(authority) {
 }
 
 // src/host/app/roots/roots-api-http.ts
-async function readBody(req) {
+async function readBody(req, maxBytes) {
   const chunks = [];
   let total = 0;
   for await (const chunk of req) {
     const buffer = toBytes(chunk);
     total += buffer.length;
-    if (total > ROOTS_API_MAX_BODY_BYTES) {
-      throw new Error(`\u8BF7\u6C42\u4F53\u8D85\u8FC7\u4E0A\u9650 ${ROOTS_API_MAX_BODY_BYTES} \u5B57\u8282\uFF0C\u62D2\u7EDD`);
+    if (total > maxBytes) {
+      throw new SshDevError("ROOT_INVALID", `\u8BF7\u6C42\u4F53\u8D85\u8FC7\u4E0A\u9650 ${maxBytes} \u5B57\u8282\uFF0C\u62D2\u7EDD`);
     }
     chunks.push(buffer);
   }
@@ -543,11 +652,6 @@ function messageOf(error) {
 
 // src/host/infra/transport/git-status-route.ts
 var GIT_STATUS_API_PATH = "/api/over-ssh/git-status";
-function asRouteHost(value) {
-  if (typeof value !== "object" || value === null) return void 0;
-  const register = value.register;
-  return typeof register === "function" ? value : void 0;
-}
 function toPublicAnswer(snapshot) {
   return {
     ok: true,
@@ -579,7 +683,7 @@ function createGitStatusApi(deps) {
       return;
     }
     try {
-      const body = asRecord(JSON.parse(await readBody(req)));
+      const body = asRecord(JSON.parse(await readBody(req, ROOTS_API_MAX_BODY_BYTES)));
       const connectionId = body?.["connectionId"];
       const path = body?.["path"];
       if (typeof connectionId !== "string" || connectionId === "") {
@@ -641,15 +745,8 @@ function wireGitStatus(ctx) {
     resolveRoot: (connectionId, path) => {
       const registry = ctx.get("sshDevRoots");
       if (registry === void 0) return void 0;
-      const normalized = normalizeRemotePath(path);
-      let best;
-      for (const record of registry.records) {
-        const root = record.root;
-        if (root.location !== "remote" || root.connectionId !== connectionId) continue;
-        if (!remotePathContains(root.path, normalized)) continue;
-        if (best === void 0 || root.path.length > best.length) best = root.path;
-      }
-      return best;
+      const roots = registry.records.map((record) => record.root).filter((root) => root.location === "remote" && root.connectionId === connectionId).map((root) => root.path);
+      return longestContainingRoot(roots, normalizeRemotePath(path));
     }
   });
   registerGitStatusRoute(ctx, { service });
@@ -699,9 +796,20 @@ var ancestorCache = /* @__PURE__ */ new Map();
 var ANCESTOR_CACHE_MAX = 256;
 function readSessionAncestors(ctx, sessionId) {
   const cached = ancestorCache.get(sessionId);
-  if (cached !== void 0) return cached;
+  if (cached !== void 0) {
+    ancestorCache.delete(sessionId);
+    ancestorCache.set(sessionId, cached);
+    return cached;
+  }
   const walked = walkAncestors(ctx, sessionId);
-  if (walked.settled && ancestorCache.size < ANCESTOR_CACHE_MAX) ancestorCache.set(sessionId, walked.ancestors);
+  if (walked.settled) {
+    ancestorCache.set(sessionId, walked.ancestors);
+    while (ancestorCache.size > ANCESTOR_CACHE_MAX) {
+      const oldest = ancestorCache.keys().next();
+      if (oldest.done === true) break;
+      ancestorCache.delete(oldest.value);
+    }
+  }
   return walked.ancestors;
 }
 function walkAncestors(ctx, sessionId) {
@@ -730,6 +838,92 @@ function walkAncestors(ctx, sessionId) {
   }
   return { ancestors, settled };
 }
+function readSessionCwd(ctx, sessionId) {
+  const cached = sessionCwdCache.get(sessionId);
+  if (cached !== void 0) {
+    sessionCwdCache.delete(sessionId);
+    sessionCwdCache.set(sessionId, cached);
+    return cached.value === "" ? void 0 : cached.value;
+  }
+  const found = walkSessionCwd(ctx, sessionId);
+  if (found.settled) {
+    sessionCwdCache.set(sessionId, { value: found.cwd ?? "" });
+    while (sessionCwdCache.size > SESSION_CWD_CACHE_MAX) {
+      const oldest = sessionCwdCache.keys().next();
+      if (oldest.done === true) break;
+      sessionCwdCache.delete(oldest.value);
+    }
+  }
+  return found.cwd;
+}
+function readSessionCwds(ctx) {
+  let list;
+  try {
+    const sessions = ctx.get("sessions");
+    list = sessions?.list?.();
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(list)) return [];
+  const cwds = [];
+  for (const session of list) {
+    const cwd = session?.header?.cwd;
+    if (typeof cwd === "string" && cwd !== "") cwds.push(cwd);
+  }
+  return cwds;
+}
+var sessionCwdCache = /* @__PURE__ */ new Map();
+var SESSION_CWD_CACHE_MAX = 256;
+function walkSessionCwd(ctx, sessionId) {
+  let list;
+  try {
+    const sessions = ctx.get("sessions");
+    list = sessions?.list?.();
+  } catch {
+    return { cwd: void 0, settled: false };
+  }
+  if (!Array.isArray(list)) return { cwd: void 0, settled: false };
+  for (const session of list) {
+    if (session?.header?.id !== sessionId) continue;
+    const cwd = session.header.cwd;
+    return { cwd: typeof cwd === "string" && cwd !== "" ? cwd : void 0, settled: true };
+  }
+  return { cwd: void 0, settled: false };
+}
+
+// src/host/domain/roots/session-roots.ts
+function workspaceWriteArea(root, workspaceRoot, cwd, identity = {}) {
+  const sessions = root.sessions ?? [];
+  if (sessions.length > 0 && identity.sessionId !== void 0 && identity.sessionId !== "") {
+    if (addedBySession(sessions, identity)) return "whole-root";
+  } else if (sessions.length === 0 && cwd !== void 0 && cwd !== "") {
+    if ((root.workspaces ?? []).some((candidate) => sameWorkspacePath(candidate, cwd))) return "whole-root";
+  }
+  if (workspaceRoot === void 0 || workspaceRoot === "") return "deny";
+  if (root.location === "remote") {
+    const anchor = root.anchorPath;
+    if (anchor === void 0 || anchor === "") return "deny";
+    if (sameWorkspacePath(anchor, workspaceRoot) || localPathContains(anchor, workspaceRoot)) return "whole-root";
+    if (localPathContains(workspaceRoot, anchor)) return "whole-root";
+    return "deny";
+  }
+  if (localPathContains(root.path, workspaceRoot)) return "workspace-only";
+  if (cwd !== void 0 && cwd !== "" && sameWorkspacePath(root.path, cwd)) return "workspace-only";
+  return "deny";
+}
+function addedBySession(sessions, identity) {
+  const sessionId = identity.sessionId;
+  if (sessionId === void 0 || sessionId === "") return false;
+  if (sessions.includes(sessionId)) return true;
+  return (identity.ancestors ?? []).some((ancestor) => sessions.includes(ancestor));
+}
+function sameWorkspacePath(left, right) {
+  const fold = (value) => {
+    const normalized = normalizeLocalPath2(value, { caseInsensitive: false }).replace(/\/+/g, "/");
+    return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+  };
+  return fold(left) === fold(right);
+}
 
 // src/host/integration/fs/fs-provider.ts
 var MAX_WHOLE_READ_BYTES = 16 * 1024 * 1024;
@@ -798,7 +992,7 @@ var RoutedFsProvider = class extends FileSystem {
    */
   processPathFromHostPath(hostPath) {
     if (!isAbsoluteHostPath(hostPath)) return void 0;
-    return normalizeLocalPath(hostPath, { caseInsensitive: false });
+    return normalizeLocalPath2(hostPath, { caseInsensitive: false });
   }
   /** Canonical `file:` URI in the target's world. */
   fileUrl(target) {
@@ -932,16 +1126,6 @@ var RoutedFsProvider = class extends FileSystem {
     const chunk = await this.call(() => routed.backend.readBytes(routed.absolute, end, signal));
     return chunk.bytes.subarray(start, Math.min(end, chunk.bytes.byteLength));
   }
-  /**
-   * Read a window through the injected offset reader.
-   *
-   * Kept as a thin method so the instance is the receiver here (a direct call is fine); the work happens in
-   * the free {@link readChunkedWindow}, because the public read path invokes it from inside `this.call(...)`,
-   * where `this` is the Cordis service Proxy and instance state would not be reachable.
-   */
-  #readChunkedWindow(routed, offset, length, signal) {
-    return readChunkedWindow(this.rangeReader, this.rangeChunkBytes, routed, offset, length, signal);
-  }
   /** Direct children, in stable name order, with resolved child targets. */
   async listDir(target, signal) {
     const routed = this.routedTarget(target);
@@ -968,7 +1152,7 @@ var RoutedFsProvider = class extends FileSystem {
     }
     const guard = expected?.kind === "replaceIfVersion" ? expected.version : void 0;
     const outcome = await this.call(
-      () => routed.backend.writeText(routed.absolute, content, guard, signal)
+      () => routed.backend.writeText(routed.absolute, content, guard, signal, sandboxPolicy)
     ).catch((error) => {
       throw mapWriteError(error, routed.displayPath);
     });
@@ -1013,7 +1197,8 @@ var RoutedFsProvider = class extends FileSystem {
             edit.newString,
             edit.replaceAll === true,
             chunk.version,
-            signal
+            signal,
+            sandboxPolicy
           )
         );
         return { version: FsVersion(native.version), before, after };
@@ -1024,7 +1209,7 @@ var RoutedFsProvider = class extends FileSystem {
       }
     }
     const outcome = await this.call(
-      () => routed.backend.writeText(routed.absolute, restoreLineEndings(after, lineEndings), chunk.version, signal)
+      () => routed.backend.writeText(routed.absolute, restoreLineEndings(after, lineEndings), chunk.version, signal, sandboxPolicy)
     ).catch((error) => {
       throw mapWriteError(error, routed.displayPath);
     });
@@ -1153,7 +1338,24 @@ var RoutedFsProvider = class extends FileSystem {
       throw isSshDevError(error) ? toFsError(error) : error;
     }
   }
-  /** Enforce the per-call policy and the root's own writability. */
+  /**
+   * Enforce the per-call policy and the root's own writability.
+   *
+   * Three gates, in order:
+   *  1. `read-only` denies every mutation (the platform's own contract);
+   *  2. a root registered `writable: false` denies;
+   *  3. under **`workspace-write`**, the target must be inside the session's workspace — where "workspace"
+   *     includes the directories **this session added** (product decision 2026-11-04: 「添加到会话的目录」=
+   *     该目录临时成为 workspace 的一部分). Before that decision the plugin admitted every writable root it
+   *     could route, which made the mode wider than the platform's own `fs-sandbox` fence
+   *     (`workspace-write` = "canonicalizes under `workspaceRoot` or the platform temp area").
+   *
+   * A call without a per-call policy keeps the historical behaviour (the mode comes from
+   * {@link sandboxMode}); the area rule needs `workspaceRoot`, which only the policy carries.
+   *
+   * @param routed - the resolved target.
+   * @param policy - the per-call sandbox policy the tool layer resolved.
+   */
   assertWritable(routed, policy) {
     const mode = policy?.mode ?? this.sandboxMode;
     if (mode === "read-only") {
@@ -1162,6 +1364,19 @@ var RoutedFsProvider = class extends FileSystem {
     if (routed.root.writable === false) {
       throw platformFsError(`the root of "${routed.displayPath}" is registered read-only`, "FS_SANDBOX_DENIED");
     }
+    if (mode !== "workspace-write" || policy === void 0) return;
+    const sessionId = currentSessionId();
+    const identity = sessionId === void 0 || sessionId === "" ? {} : { sessionId, ancestors: this.sessionAncestors(sessionId) };
+    const cwd = sessionId === void 0 || sessionId === "" ? void 0 : this.sessionWorkspaceCwdOf(sessionId);
+    const area = workspaceWriteArea(routed.root, policy.workspaceRoot, cwd, identity);
+    if (area === "whole-root") return;
+    if (area === "workspace-only" && routed.root.location === "local" && localPathContains(policy.workspaceRoot, routed.absolute, { caseInsensitive: process.platform === "win32" })) {
+      return;
+    }
+    throw platformFsError(
+      `sandbox denies writing "${routed.displayPath}": the path is outside this session's workspace (its workspace, or a directory this session added with \u300C\u6DFB\u52A0\u76EE\u5F55\u300D)`,
+      "FS_SANDBOX_DENIED"
+    );
   }
   /**
    * Previous text content, when it is readable text inside the cap; `undefined` otherwise.
@@ -1177,9 +1392,8 @@ var RoutedFsProvider = class extends FileSystem {
       return void 0;
     });
     if (chunk === void 0 || chunk.truncated) return void 0;
-    const bytes = Buffer.from(chunk.text, "utf8");
-    const sniff = bytes.subarray(0, BINARY_SNIFF_BYTES);
-    if (sniff.includes(0)) return void 0;
+    const nul = chunk.text.indexOf("\0");
+    if (nul !== -1 && nul < BINARY_SNIFF_BYTES) return void 0;
     return chunk.text;
   }
   /** Run a backend call, translating domain errors into core codes. */
@@ -1269,38 +1483,6 @@ function sessionSyncSignature(cwds, registry) {
   const roots = registry.sessionWorkspaceRecords.map((record) => record.key).join("\0");
   return `${cwds.join("\0")}
${roots}`;
 }
-function readSessionCwd(ctx, sessionId) {
-  let list;
-  try {
-    const sessions = ctx.get("sessions");
-    list = sessions?.list?.();
-  } catch {
-    return void 0;
-  }
-  if (!Array.isArray(list)) return void 0;
-  for (const session of list) {
-    if (session?.header?.id !== sessionId) continue;
-    const cwd = session.header.cwd;
-    return typeof cwd === "string" && cwd !== "" ? cwd : void 0;
-  }
-  return void 0;
-}
-function readSessionCwds(ctx) {
-  let list;
-  try {
-    const sessions = ctx.get("sessions");
-    list = sessions?.list?.();
-  } catch {
-    return [];
-  }
-  if (!Array.isArray(list)) return [];
-  const cwds = [];
-  for (const session of list) {
-    const cwd = session?.header?.cwd;
-    if (typeof cwd === "string" && cwd !== "") cwds.push(cwd);
-  }
-  return cwds;
-}
 function assertText(displayPath, bytes) {
   if (bytes.subarray(0, BINARY_SNIFF_BYTES).includes(0)) {
     throw platformFsError(`cannot read "${displayPath}": not a UTF-8 text file`, "FS_NOT_TEXT");