dsh-over-ssh 0.1.1 → 0.2.0

package/lib/index.js

@@ -46,8 +46,8 @@ function sshFailureToError(connectionId, input) {
     stderrTail: tail(input.stderr ?? "", 2e3)
   });
 }
-function tail(text6, maxChars) {
-  return text6.length <= maxChars ? text6 : text6.slice(text6.length - maxChars);
+function tail(text8, maxChars) {
+  return text8.length <= maxChars ? text8 : text8.slice(text8.length - maxChars);
 }
 var SshDevError, FAILURE_PATTERNS;
 var init_errors = __esm({
@@ -130,6 +130,9 @@ function quote(value) {
   }
   return `'${value.replaceAll("'", "'\\''")}'`;
 }
+function quoteAll(values) {
+  return values.map((value) => quote(value)).join(" ");
+}
 var init_shell = __esm({
   "src/host/domain/shell.ts"() {
     "use strict";
@@ -201,8 +204,8 @@ var init_capability = __esm({
 function encodeBase64(bytes) {
   return Buffer.from(bytes).toString("base64");
 }
-function decodeBase64(text6) {
-  const decoded = Buffer.from(text6, "base64");
+function decodeBase64(text8) {
+  const decoded = Buffer.from(text8, "base64");
   return decoded.byteOffset === 0 && decoded.buffer.byteLength === decoded.byteLength ? decoded : new Uint8Array(decoded);
 }
 var TIER1_REMOTE_MAY_STILL_RUN_HINT, DEFAULT_MAX_OUTPUT_BYTES, DEFAULT_MAX_READ_BYTES2;
@@ -266,6 +269,198 @@ var init_shell_quote = __esm({
   }
 });
 
+// src/host/infra/transport/forward.ts
+function isValidPort(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 65535;
+}
+function normalizeForwardRequest(request) {
+  const remoteHost = request.remoteHost.trim();
+  if (remoteHost === "") {
+    throw new SshDevError("CONNECTION_INVALID", "forward \u9700\u8981 remoteHost", {});
+  }
+  if (/[\s,]/.test(remoteHost)) {
+    throw new SshDevError("CONNECTION_INVALID", `remoteHost \u4E0D\u80FD\u5305\u542B\u7A7A\u767D\u6216\u9017\u53F7\uFF1A${JSON.stringify(remoteHost)}`, { remoteHost });
+  }
+  const bracketed = remoteHost.startsWith("[") && remoteHost.endsWith("]");
+  if (remoteHost.includes(":") && !bracketed) {
+    throw new SshDevError(
+      "CONNECTION_INVALID",
+      `remoteHost \u542B\u5192\u53F7\u65F6\u5FC5\u987B\u5199\u6210\u65B9\u62EC\u53F7 IPv6 \u5F62\u5F0F\uFF08\u4F8B\u5982 [::1]\uFF09\uFF1A${remoteHost}`,
+      { remoteHost }
+    );
+  }
+  if (!isValidPort(request.remotePort)) {
+    throw new SshDevError("CONNECTION_INVALID", `remotePort \u5FC5\u987B\u662F 1..65535 \u7684\u6574\u6570\uFF1A${String(request.remotePort)}`, {
+      remotePort: request.remotePort
+    });
+  }
+  if (request.localPort !== void 0 && !isValidPort(request.localPort)) {
+    throw new SshDevError("CONNECTION_INVALID", `localPort \u5FC5\u987B\u662F 1..65535 \u7684\u6574\u6570\uFF1A${String(request.localPort)}`, {
+      localPort: request.localPort
+    });
+  }
+  return {
+    remoteHost,
+    remotePort: request.remotePort,
+    ...request.localPort === void 0 ? {} : { localPort: request.localPort }
+  };
+}
+var FORWARD_LOCAL_HOST;
+var init_forward = __esm({
+  "src/host/infra/transport/forward.ts"() {
+    "use strict";
+    init_errors();
+    FORWARD_LOCAL_HOST = "127.0.0.1";
+  }
+});
+
+// src/host/infra/transport/forward-proxy.ts
+import { connect, createServer } from "node:net";
+async function probe(opener, request, signal) {
+  const channel = await opener(request, signal);
+  channel.destroy();
+}
+function createProxyForwarder(options) {
+  const idleTimeoutMs = options.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS;
+  const now = options.now ?? Date.now;
+  const live = /* @__PURE__ */ new Map();
+  const closeEntry = async (entry) => {
+    if (live.get(entry.handle.localPort) === entry) live.delete(entry.handle.localPort);
+    const listeners = [...entry.closedListeners];
+    entry.closedListeners.clear();
+    for (const listener of listeners) {
+      try {
+        listener();
+      } catch {
+      }
+    }
+    if (entry.timer !== void 0) clearInterval(entry.timer);
+    for (const socket of entry.sockets) socket.destroy();
+    entry.sockets.clear();
+    await new Promise((resolve3) => entry.server.close(() => resolve3()));
+  };
+  const forward = async (request, signal) => {
+    const normalized = normalizeForwardRequest(request);
+    if (signal?.aborted === true) throw new SshDevError("CANCELLED", "\u7AEF\u53E3\u8F6C\u53D1\u5DF2\u53D6\u6D88", {});
+    await probe(options.openChannel, normalized, signal);
+    const sockets = /* @__PURE__ */ new Set();
+    let boundPort = 0;
+    const server = createServer((socket) => {
+      sockets.add(socket);
+      const entry2 = live.get(boundPort);
+      if (entry2 !== void 0) entry2.lastActivityAt = now();
+      socket.once("close", () => {
+        sockets.delete(socket);
+        const current = live.get(boundPort);
+        if (current !== void 0) current.lastActivityAt = now();
+      });
+      void options.openChannel(normalized, signal).then((channel) => pipeBidirectional(socket, channel)).catch(() => {
+        socket.destroy();
+      });
+    });
+    const port = await new Promise((resolvePort, rejectPort) => {
+      const onError = (error) => {
+        server.removeListener("listening", onListening);
+        rejectPort(
+          new SshDevError("CONNECTION_UNREACHABLE", `\u672C\u5730\u7AEF\u53E3\u76D1\u542C\u5931\u8D25\uFF1A${error.message}`, {
+            ...normalized.localPort === void 0 ? {} : { localPort: normalized.localPort }
+          })
+        );
+      };
+      const onListening = () => {
+        server.removeListener("error", onError);
+        const address = server.address();
+        const bound = typeof address === "object" && address !== null ? address.port : 0;
+        if (bound === 0) {
+          rejectPort(new SshDevError("CONNECTION_UNREACHABLE", "\u672C\u5730\u7AEF\u53E3\u76D1\u542C\u540E\u62FF\u4E0D\u5230\u771F\u5B9E\u7AEF\u53E3", {}));
+          return;
+        }
+        boundPort = bound;
+        resolvePort(bound);
+      };
+      server.once("error", onError);
+      server.once("listening", onListening);
+      server.listen(normalized.localPort ?? 0, FORWARD_LOCAL_HOST);
+    });
+    let handle;
+    handle = {
+      localPort: port,
+      remoteHost: normalized.remoteHost,
+      remotePort: normalized.remotePort,
+      close: async () => {
+        const entry2 = live.get(port);
+        if (entry2 !== void 0) await closeEntry(entry2);
+      },
+      onClosed: (listener) => {
+        const entry2 = live.get(port);
+        if (entry2 === void 0) {
+          listener();
+          return;
+        }
+        entry2.closedListeners.add(listener);
+      }
+    };
+    const entry = {
+      handle,
+      server,
+      sockets,
+      lastActivityAt: now(),
+      timer: void 0,
+      closedListeners: /* @__PURE__ */ new Set()
+    };
+    live.set(port, entry);
+    const checkMs = options.idleCheckIntervalMs ?? IDLE_TICK_MS;
+    if (idleTimeoutMs > 0 && checkMs > 0) {
+      entry.timer = setInterval(() => {
+        const current = live.get(port);
+        if (current === void 0) return;
+        if (current.sockets.size > 0) {
+          current.lastActivityAt = now();
+          return;
+        }
+        const idleMs = now() - current.lastActivityAt;
+        if (idleMs < idleTimeoutMs) return;
+        void closeEntry(current).then(() => options.onReclaimed?.(handle, idleMs));
+      }, checkMs);
+      entry.timer.unref?.();
+    }
+    return handle;
+  };
+  return {
+    forward,
+    get forwards() {
+      return [...live.values()].map((entry) => entry.handle);
+    },
+    closeAll: async () => {
+      const entries = [...live.values()];
+      live.clear();
+      await Promise.all(entries.map((entry) => closeEntry(entry)));
+    }
+  };
+}
+function pipeBidirectional(socket, channel) {
+  socket.pipe(channel.writable);
+  channel.readable.pipe(socket);
+  const teardown = () => {
+    channel.destroy();
+    socket.destroy();
+  };
+  socket.once("error", teardown);
+  socket.once("close", teardown);
+  channel.readable.once("error", teardown);
+  channel.readable.once("close", teardown);
+}
+var DEFAULT_IDLE_TIMEOUT_MS, IDLE_TICK_MS;
+var init_forward_proxy = __esm({
+  "src/host/infra/transport/forward-proxy.ts"() {
+    "use strict";
+    init_errors();
+    init_forward();
+    DEFAULT_IDLE_TIMEOUT_MS = 30 * 60 * 1e3;
+    IDLE_TICK_MS = 3e4;
+  }
+});
+
 // src/host/infra/transport/transport-base.ts
 var TransportBase;
 var init_transport_base = __esm({
@@ -320,6 +515,55 @@ var init_temp_name = __esm({
   }
 });
 
+// src/host/infra/transport/ssh/ssh2-forward.ts
+function openChannel(session, request) {
+  return new Promise((resolve3, reject) => {
+    session.forwardOut(FORWARD_SRC_HOST, 0, request.remoteHost, request.remotePort, (error, stream) => {
+      if (error !== void 0) {
+        reject(
+          new SshDevError(
+            "CONNECTION_UNREACHABLE",
+            `\u8FDC\u7AEF\u62D2\u7EDD\u8F6C\u53D1\u5230 ${request.remoteHost}:${String(request.remotePort)}\uFF1A${error.message}`,
+            { remoteHost: request.remoteHost, remotePort: request.remotePort }
+          )
+        );
+        return;
+      }
+      if (stream === void 0) {
+        reject(new SshDevError("REMOTE_COMMAND_FAILED", "forwardOut \u6CA1\u6709\u8FD4\u56DE\u901A\u9053", {}));
+        return;
+      }
+      const duplex = stream;
+      resolve3({ readable: duplex, writable: duplex, destroy: () => duplex.destroy() });
+    });
+  });
+}
+function createSsh2Forwarder(options) {
+  const sessionOf = () => typeof options.session === "function" ? options.session() : options.session;
+  return createProxyForwarder({
+    connectionId: options.connectionId,
+    ...options.idleTimeoutMs === void 0 ? {} : { idleTimeoutMs: options.idleTimeoutMs },
+    ...options.now === void 0 ? {} : { now: options.now },
+    ...options.onReclaimed === void 0 ? {} : { onReclaimed: options.onReclaimed },
+    openChannel: async (request) => {
+      const session = sessionOf();
+      if (session === void 0) {
+        throw new SshDevError("CONNECTION_LOST", "SSH \u4F1A\u8BDD\u4E0D\u53EF\u7528\uFF0C\u4E0D\u80FD\u5EFA\u7ACB\u7AEF\u53E3\u8F6C\u53D1", {});
+      }
+      return openChannel(session, request);
+    }
+  });
+}
+var FORWARD_SRC_HOST;
+var init_ssh2_forward = __esm({
+  "src/host/infra/transport/ssh/ssh2-forward.ts"() {
+    "use strict";
+    init_errors();
+    init_forward_proxy();
+    FORWARD_SRC_HOST = "127.0.0.1";
+  }
+});
+
 // src/host/infra/transport/ssh/ssh2-transport.ts
 var ssh2_transport_exports = {};
 __export(ssh2_transport_exports, {
@@ -330,7 +574,7 @@ __export(ssh2_transport_exports, {
   sftpError: () => sftpError,
   versionToken: () => versionToken
 });
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 function withSftpDeadline(guard, what, path, promise) {
   if (guard.timeoutMs <= 0 && guard.signal === void 0) return promise;
   return new Promise((resolve3, reject) => {
@@ -507,10 +751,10 @@ function isSymlinkEntry(entry) {
 }
 function removeTree(sftp, directory, guard) {
   const readdir7 = sftp.readdir?.bind(sftp);
-  const rmdir = sftp.rmdir?.bind(sftp);
+  const rmdir2 = sftp.rmdir?.bind(sftp);
   return (async () => {
     throwIfCancelled(guard.signal, directory);
-    if (readdir7 === void 0 || rmdir === void 0) {
+    if (readdir7 === void 0 || rmdir2 === void 0) {
       throw new SshDevError("REMOTE_UNSUPPORTED", "\u8BE5 SFTP \u5B9E\u73B0\u6CA1\u6709\u63D0\u4F9B readdir/rmdir\uFF0C\u65E0\u6CD5\u9012\u5F52\u5220\u9664\u76EE\u5F55", { path: directory });
     }
     const entries = await withSftpDeadline(guard, "readdir", directory, new Promise((resolve3, reject) => {
@@ -534,7 +778,7 @@ function removeTree(sftp, directory, guard) {
     }
     throwIfCancelled(guard.signal, directory);
     await withSftpDeadline(guard, "rmdir", directory, new Promise((resolve3, reject) => {
-      rmdir(directory, (error) => error === void 0 ? resolve3() : reject(sftpError("rmdir", directory, error)));
+      rmdir2(directory, (error) => error === void 0 ? resolve3() : reject(sftpError("rmdir", directory, error)));
     }));
   })();
 }
@@ -644,6 +888,7 @@ var init_ssh2_transport = __esm({
     init_shell_quote();
     init_transport();
     init_transport_base();
+    init_ssh2_forward();
     SSH2_STDERR_MAX_BYTES = 256 * 1024;
     STDERR_TRUNCATION_NOTICE = "\uFF08stderr \u8FC7\u957F\uFF0C\u4EC5\u4FDD\u7559\u672B\u5C3E\u7247\u6BB5\uFF09";
     DEFAULT_SFTP_TIMEOUT_MS = 3e4;
@@ -653,6 +898,8 @@ var init_ssh2_transport = __esm({
       #now;
       #session;
       #sftp;
+      /** 懒建的转发器；`dispose()` 时收掉它的全部转发。 */
+      #forwarderInstance;
       /** The in-flight first open of the SFTP subsystem (see `#requireSftp`). */
       #sftpPending;
       #connecting;
@@ -725,7 +972,26 @@ var init_ssh2_transport = __esm({
         this.#connectingAbort?.abort();
       }
       /** Close the session. Idempotent. */
+      /** {@inheritDoc Transport.forward} */
+      async forward(request, signal) {
+        return this.#forwarder().forward(request, signal);
+      }
+      /** {@inheritDoc Transport.closeForwards} */
+      async closeForwards() {
+        const forwarder = this.#forwarderInstance;
+        if (forwarder === void 0) return;
+        await forwarder.closeAll();
+      }
+      /** 懒建转发器；与 SFTP 同一条纪律：没有转发需求就不建。 */
+      #forwarder() {
+        this.#forwarderInstance ??= createSsh2Forwarder({
+          connectionId: this.id,
+          session: () => this.#session
+        });
+        return this.#forwarderInstance;
+      }
       async dispose() {
+        await this.closeForwards().catch(() => void 0);
         this.#sftp?.end();
         this.#sftp = void 0;
         const hops = this.#session?.hops ?? [];
@@ -742,6 +1008,12 @@ var init_ssh2_transport = __esm({
       }
       /** Run one remote command over a channel of the shared session. */
       async exec(request, signal) {
+        if (request.writeRoots !== void 0 && request.writeRoots.length > 0) {
+          throw new SshDevError("REMOTE_UNSUPPORTED", "\u8BE5\u4F20\u8F93\uFF08Tier 1\uFF0C\u65E0\u4EE3\u7406\uFF09\u65E0\u6CD5\u5EFA\u7ACB Landlock \u5199\u5165\u56F4\u680F", {
+            connectionId: this.id,
+            writeRoots: [...request.writeRoots]
+          });
+        }
         await this.connect(signal);
         const command = this.#commandFor(request);
         const startedAt = this.#now();
@@ -867,7 +1139,7 @@ var init_ssh2_transport = __esm({
             await closeQuietly(sftp, handle, guard);
           }
         }
-        const digest = createHash("sha256").update(request.bytes).digest("hex");
+        const digest = createHash2("sha256").update(request.bytes).digest("hex");
         return { bytes: payload.byteLength, sha256: digest };
       }
       /**
@@ -963,7 +1235,7 @@ var init_ssh2_transport = __esm({
           await unlinkQuietly(sftp, temporary, guard);
           throw error;
         }
-        const digest = createHash("sha256").update(request.bytes).digest("hex");
+        const digest = createHash2("sha256").update(request.bytes).digest("hex");
         const stats = await statOrThrow(sftp, request.path, guard);
         return { bytes: request.bytes.byteLength, sha256: digest, version: versionToken(stats.size, stats.mtime) };
       }
@@ -1045,14 +1317,14 @@ ${buildRemoteScript(request.script)}`;
         this.#sftp = void 0;
         this.#sftpPending = void 0;
         this.markState("connecting");
-        const connect = this.#options.connect;
-        if (connect === void 0) {
+        const connect2 = this.#options.connect;
+        if (connect2 === void 0) {
           this.markState("idle");
           throw new SshDevError("CONNECTION_INVALID", "Ssh2Transport \u9700\u8981\u8FDE\u63A5\u914D\u7F6E", { connectionId: this.id });
         }
         const connector = this.#options.connector ?? defaultConnector;
         try {
-          this.#session = await connector(signal === void 0 ? connect : { ...connect, signal });
+          this.#session = await connector(signal === void 0 ? connect2 : { ...connect2, signal });
           this.#sessionCount++;
           this.markState("ready");
         } catch (error) {
@@ -1190,7 +1462,7 @@ ${stderrTail.toString("utf8")}` : stderrTail.toString("utf8"),
         keepaliveInterval: config.keepAliveMs ?? 15e3,
         ...config.hostKeyPolicy === "strict" ? {
           hostVerifier: (key) => {
-            const fingerprint2 = `SHA256:${createHash("sha256").update(key).digest("base64").replace(/=+$/, "")}`;
+            const fingerprint2 = `SHA256:${createHash2("sha256").update(key).digest("base64").replace(/=+$/, "")}`;
             return (config.trustedHostKeys ?? []).includes(fingerprint2);
           }
         } : {}
@@ -1388,6 +1660,9 @@ function store() {
   holder[STORE_KEY] = created;
   return created;
 }
+function currentSessionId() {
+  return store().getStore()?.sessionId;
+}
 function runInSession(sessionId, run) {
   return store().run({ sessionId }, run);
 }
@@ -1438,6 +1713,42 @@ function walkAncestors(ctx, sessionId) {
   }
   return { ancestors, settled };
 }
+function readSessionCwd(ctx, sessionId) {
+  const cached2 = sessionCwdCache.get(sessionId);
+  if (cached2 !== void 0) {
+    sessionCwdCache.delete(sessionId);
+    sessionCwdCache.set(sessionId, cached2);
+    return cached2.value === "" ? void 0 : cached2.value;
+  }
+  const found = walkSessionCwd(ctx, sessionId);
+  if (found.settled) {
+    sessionCwdCache.set(sessionId, { value: found.cwd ?? "" });
+    while (sessionCwdCache.size > SESSION_CWD_CACHE_MAX) {
+      const oldest = sessionCwdCache.keys().next();
+      if (oldest.done === true) break;
+      sessionCwdCache.delete(oldest.value);
+    }
+  }
+  return found.cwd;
+}
+var sessionCwdCache = /* @__PURE__ */ new Map();
+var SESSION_CWD_CACHE_MAX = 256;
+function walkSessionCwd(ctx, sessionId) {
+  let list;
+  try {
+    const sessions = ctx.get("sessions");
+    list = sessions?.list?.();
+  } catch {
+    return { cwd: void 0, settled: false };
+  }
+  if (!Array.isArray(list)) return { cwd: void 0, settled: false };
+  for (const session of list) {
+    if (session?.header?.id !== sessionId) continue;
+    const cwd = session.header.cwd;
+    return { cwd: typeof cwd === "string" && cwd !== "" ? cwd : void 0, settled: true };
+  }
+  return { cwd: void 0, settled: false };
+}
 function sessionIdentityOf(ctx, sessionId) {
   if (sessionId === void 0 || sessionId === "") return {};
   return { sessionId, ancestors: readSessionAncestors(ctx, sessionId) };
@@ -1548,7 +1859,26 @@ var Config = z.object({
      * 立刻把自己的条目淘汰掉，行为既不是"关缓存"也不是"缓存"。
      */
     readCacheTotalMaxBytes: z.natural().default(64 * 1024 * 1024),
+    /**
+     * 端口转发的空闲回收窗口（毫秒）；`0` 关闭回收。
+     *
+     * 判据是"没有任何活跃连接且距最后一次活动超过这个窗口"。没有回收的话，一个被 agent 起过、
+     * 之后没人用的转发会一直占着本地端口（用户实测关心的问题）。默认 30 分钟：比一次开发会话的
+     * 间隔长，比"忘了关一整天"短。
+     */
+    forwardIdleTimeoutMs: z.natural().default(30 * 60 * 1e3),
     terminalStateDir: z.string(),
+    /**
+     * 是否给 `remote_exec` / `remote_exec_background` 套**远端写入围栏**（Tier 2 的 Landlock）。
+     *
+     * **默认关**是刻意的：围栏只放行 workspace 根与本会话添加的目录，构建工具往 `$HOME/.cache`、
+     * `/tmp` 写缓存时会被拒——默认开启会把正常命令弄坏。关着的时候 shell 命令能碰到 SSH 用户能碰的
+     * 一切，这与"添加目录"的文件边界是两件事，工具描述里如实写着。
+     *
+     * 打开之后，`remote_exec` 只能写：命令起始的 workspace 根、本会话添加的可写根。Tier 1（无代理）
+     * 没有 Landlock 能力，此项对它们无效。
+     */
+    execWriteFence: z.boolean().default(false),
     transferChunkBytes: z.natural().default(4 * 1024 * 1024),
     /** Chunks in flight at once during a transfer. 1 restores the sequential behaviour. */
     transferConcurrency: z.natural().default(4),
@@ -1667,6 +1997,9 @@ function parseSshPath(input) {
   return { connectionId, path: normalizeRemotePath(rawPath) };
 }
 function normalizeRemotePath(path) {
+  if (/[\u0000-\u001f]/.test(path)) {
+    throw new SshDevError("ROOT_INVALID", "\u8FDC\u7A0B\u8DEF\u5F84\u4E0D\u80FD\u5305\u542B\u63A7\u5236\u5B57\u7B26", { path: JSON.stringify(path) });
+  }
   const normalized = normalizePosixPath(path);
   if (normalized !== void 0) return normalized;
   if (path === "") throw new SshDevError("ROOT_INVALID", "\u8FDC\u7A0B\u8DEF\u5F84\u4E0D\u80FD\u4E3A\u7A7A", {});
@@ -1691,6 +2024,14 @@ function remoteBasename(path) {
   const normalized = normalizeRemotePath(path);
   return normalized === "/" ? "" : normalized.slice(normalized.lastIndexOf("/") + 1);
 }
+function longestContainingRoot(roots, candidate) {
+  let best;
+  for (const root of roots) {
+    if (!remotePathContains(root, candidate)) continue;
+    if (best === void 0 || normalizeRemotePath(root).length > normalizeRemotePath(best).length) best = root;
+  }
+  return best;
+}
 
 // src/host/domain/tool-requests.ts
 init_shell();
@@ -1893,11 +2234,11 @@ function envArg(value) {
 }
 function fileModeArg(value) {
   if (value === void 0 || value === null) return { mode: void 0 };
-  const text6 = typeof value === "number" && Number.isInteger(value) ? String(value) : typeof value === "string" ? value.trim() : void 0;
-  if (text6 === void 0 || text6 === "") {
+  const text8 = typeof value === "number" && Number.isInteger(value) ? String(value) : typeof value === "string" ? value.trim() : void 0;
+  if (text8 === void 0 || text8 === "") {
     return { error: 'mode \u5FC5\u987B\u662F 3 \u6216 4 \u4F4D\u516B\u8FDB\u5236\u5B57\u7B26\u4E32\uFF08\u4F8B\u5982 "755"\uFF09\uFF0C\u6216\u7B49\u4EF7\u7684\u516B\u8FDB\u5236\u6570\u5B57\uFF08\u4F8B\u5982 755\uFF09' };
   }
-  const digits = text6.startsWith("0o") || text6.startsWith("0O") ? text6.slice(2) : text6;
+  const digits = text8.startsWith("0o") || text8.startsWith("0O") ? text8.slice(2) : text8;
   if (!/^[0-7]{3,4}$/.test(digits)) {
     return { error: `mode \u5FC5\u987B\u662F 3 \u6216 4 \u4F4D\u516B\u8FDB\u5236\u6570\u5B57\uFF08\u6536\u5230 ${JSON.stringify(value)}\uFF09\uFF1B\u4F8B\u5982 "755" \u6216 755` };
   }
@@ -2071,18 +2412,18 @@ function parseGrepOutput(stdout, maxResults) {
   }
   return { matches, truncated: false };
 }
-function boundOutput(text6, maxBytes = MAX_OUTPUT_BYTES, keep = "head") {
-  const bytes = Buffer.byteLength(text6, "utf8");
-  if (bytes <= maxBytes) return { text: text6, truncated: false };
+function boundOutput(text8, maxBytes = MAX_OUTPUT_BYTES, keep = "head") {
+  const bytes = Buffer.byteLength(text8, "utf8");
+  if (bytes <= maxBytes) return { text: text8, truncated: false };
   if (keep === "tail") {
-    let kept2 = text6.slice(-maxBytes);
+    let kept2 = text8.slice(-maxBytes);
     while (Buffer.byteLength(kept2, "utf8") > maxBytes) kept2 = kept2.slice(1);
     const firstNewline = kept2.indexOf("\n");
     if (firstNewline > 0) kept2 = kept2.slice(firstNewline + 1);
     return { text: `\u2026\uFF08\u8F93\u51FA\u88AB\u622A\u65AD\uFF1A\u4EC5\u4FDD\u7559\u672B\u5C3E ${maxBytes} \u5B57\u8282\uFF09
 ${kept2}`, truncated: true };
   }
-  let kept = text6.slice(0, maxBytes);
+  let kept = text8.slice(0, maxBytes);
   while (Buffer.byteLength(kept, "utf8") > maxBytes) kept = kept.slice(0, -1);
   const lastNewline = kept.lastIndexOf("\n");
   if (lastNewline > 0) kept = kept.slice(0, lastNewline);
@@ -3218,8 +3559,8 @@ function serializeRecycleBinIndex(entries) {
   return `${JSON.stringify(document, null, 2)}
 `;
 }
-function parseRecycleBinIndex(text6) {
-  const body = text6.charCodeAt(0) === 65279 ? text6.slice(1) : text6;
+function parseRecycleBinIndex(text8) {
+  const body = text8.charCodeAt(0) === 65279 ? text8.slice(1) : text8;
   if (body.trim() === "") {
     throw new SshDevError("TRASH_NOT_FOUND", "\u56DE\u6536\u7AD9\u7D22\u5F15\u4E3A\u7A7A\uFF0C\u65E0\u6CD5\u786E\u5B9A\u56DE\u6536\u7AD9\u5185\u5BB9", { reason: "index-unreadable" });
   }
@@ -3321,8 +3662,8 @@ function createBinWorld(deps) {
     const path = joinUnderPath(binRootOf(root), RECYCLE_BIN_INDEX_FILE);
     const info = await statFor(root, path, signal);
     if (!info.exists) return { path, entries: [], skipped: 0 };
-    const text6 = await ioFor(root).readText(path, signal);
-    const parsed = parseRecycleBinIndex(text6);
+    const text8 = await ioFor(root).readText(path, signal);
+    const parsed = parseRecycleBinIndex(text8);
     return { path, entries: parsed.entries, skipped: parsed.skipped.length };
   }
   async function writeIndex(root, path, entries, signal) {
@@ -3920,8 +4261,8 @@ function serializeSessionTrashIndex(entries) {
   return `${JSON.stringify(document, null, 2)}
 `;
 }
-function parseSessionTrashIndex(text6) {
-  const body = text6.charCodeAt(0) === 65279 ? text6.slice(1) : text6;
+function parseSessionTrashIndex(text8) {
+  const body = text8.charCodeAt(0) === 65279 ? text8.slice(1) : text8;
   if (body.trim() === "") {
     throw new SshDevError("TRASH_NOT_FOUND", "\u4F1A\u8BDD\u56DE\u6536\u7AD9\u7D22\u5F15\u4E3A\u7A7A\uFF0C\u65E0\u6CD5\u786E\u5B9A\u5185\u5BB9", { reason: "index-unreadable" });
   }
@@ -4074,22 +4415,22 @@ function createSessionAdminContext(deps) {
   );
   const entryDir = (segment) => joinPath(binRoot, "entries", segment);
   const readIndex = async () => {
-    let text6;
+    let text8;
     try {
-      text6 = await deps.readText(indexePath());
+      text8 = await deps.readText(indexePath());
     } catch (error) {
       if (isMissing(error)) return [];
       throw error;
     }
-    return parseSessionTrashIndex(text6).entries;
+    return parseSessionTrashIndex(text8).entries;
   };
   const writeIndex = async (entries) => {
-    const text6 = serializeSessionTrashIndex(entries);
+    const text8 = serializeSessionTrashIndex(entries);
     if (deps.writeTextAtomic !== void 0) {
-      await deps.writeTextAtomic(indexePath(), text6);
+      await deps.writeTextAtomic(indexePath(), text8);
       return;
     }
-    await deps.writeText(indexePath(), text6);
+    await deps.writeText(indexePath(), text8);
   };
   const inventory = async (options = {}) => {
     void options;
@@ -4456,8 +4797,8 @@ import { join } from "node:path";
 import { createZstdDecompress } from "node:zlib";
 var SESSION_HEADER_READ_BYTES = 64 * 1024;
 var SESSION_HEADER_RETRY_BYTES = 1024 * 1024;
-function parseSessionHeaderLine(text6) {
-  const firstLine = text6.split("\n")[0];
+function parseSessionHeaderLine(text8) {
+  const firstLine = text8.split("\n")[0];
   if (firstLine === void 0 || firstLine === "") return void 0;
   let header;
   try {
@@ -4487,13 +4828,13 @@ function createSessionHeaderReader(io) {
       if (log === void 0) return void 0;
       const path = join(dir, log);
       for (const [index, cap] of caps.entries()) {
-        let text6;
+        let text8;
         try {
-          text6 = await io.decompress(await io.readHead(path, cap));
+          text8 = await io.decompress(await io.readHead(path, cap));
         } catch {
           continue;
         }
-        if (text6.includes("\n") || index === caps.length - 1) return parseSessionHeaderLine(text6);
+        if (text8.includes("\n") || index === caps.length - 1) return parseSessionHeaderLine(text8);
       }
       return void 0;
     } catch {
@@ -4580,6 +4921,25 @@ function replaceLiteral(source, needle, replacement, all) {
 init_errors();
 
 // src/host/domain/roots/session-roots.ts
+function workspaceWriteArea(root, workspaceRoot, cwd, identity = {}) {
+  const sessions = root.sessions ?? [];
+  if (sessions.length > 0 && identity.sessionId !== void 0 && identity.sessionId !== "") {
+    if (addedBySession(sessions, identity)) return "whole-root";
+  } else if (sessions.length === 0 && cwd !== void 0 && cwd !== "") {
+    if ((root.workspaces ?? []).some((candidate) => sameWorkspacePath(candidate, cwd))) return "whole-root";
+  }
+  if (workspaceRoot === void 0 || workspaceRoot === "") return "deny";
+  if (root.location === "remote") {
+    const anchor = root.anchorPath;
+    if (anchor === void 0 || anchor === "") return "deny";
+    if (sameWorkspacePath(anchor, workspaceRoot) || localPathContains(anchor, workspaceRoot)) return "whole-root";
+    if (localPathContains(workspaceRoot, anchor)) return "whole-root";
+    return "deny";
+  }
+  if (localPathContains(root.path, workspaceRoot)) return "workspace-only";
+  if (cwd !== void 0 && cwd !== "" && sameWorkspacePath(root.path, cwd)) return "workspace-only";
+  return "deny";
+}
 function addedBySession(sessions, identity) {
   const sessionId = identity.sessionId;
   if (sessionId === void 0 || sessionId === "") return false;
@@ -5156,10 +5516,10 @@ var RoutedFileSystem = class _RoutedFileSystem {
    * @param options - policy, version guard and cancellation.
    * @returns the write outcome plus the resolved target.
    */
-  async writeText(input, text6, options = {}) {
+  async writeText(input, text8, options = {}) {
     const target = this.resolve(input, options.cwd === void 0 ? {} : { cwd: options.cwd });
     this.#assertWritable(target, options.sandbox ?? "workspace-write");
-    const outcome = await target.backend.writeText(target.absolute, text6, options.expectedVersion, options.signal);
+    const outcome = await target.backend.writeText(target.absolute, text8, options.expectedVersion, options.signal);
     return { ...outcome, target };
   }
   /**
@@ -5549,6 +5909,15 @@ var RootRegistry = class {
     if (this.#records.has(key)) {
       throw new SshDevError("ROOT_INVALID", `\u8BE5\u6839\u5DF2\u6CE8\u518C\uFF1A${key}`, { root: key });
     }
+    const hidden = this.#hidden.get(key);
+    if (hidden !== void 0) {
+      this.#hidden.delete(key);
+      this.#sessionWorkspaceKeys.delete(key);
+      const promoted = { key, root, backend: hidden.backend };
+      this.#records.set(key, promoted);
+      if (options.silent !== true) this.#notify();
+      return promoted;
+    }
     const backend = root.location === "remote" ? this.#options.createRemoteBackend(root) : this.#options.createLocalBackend(root);
     this.#routed.addRoot(root, backend);
     const record2 = { key, root, backend };
@@ -5626,14 +5995,19 @@ var LEGACY_DIR_NAMES = ["remote-workspace", "ssh-dev"];
 var CARRIED_FILES = ["roots.json", "user-roots.json"];
 var CARRIED_DIRS = ["roots", "state"];
 var cached;
+function dshHome() {
+  const fromEnv = process.env["DSH_HOME"];
+  if (typeof fromEnv === "string" && fromEnv.trim() !== "") return fromEnv.trim();
+  return join3(homedir(), ".dsh");
+}
 var migrationWarnings = [];
 function resolveStateDir() {
   if (cached !== void 0) return cached;
-  const home = homedir();
-  const current = join3(home, ".dsh", STATE_DIR_NAME);
+  const home = dshHome();
+  const current = join3(home, STATE_DIR_NAME);
   mkdirSync2(current, { recursive: true, mode: 448 });
   for (const name2 of LEGACY_DIR_NAMES) {
-    migrationWarnings.push(...carryMissingState(join3(home, ".dsh", name2), current, CARRIED_FILES, CARRIED_DIRS));
+    migrationWarnings.push(...carryMissingState(join3(home, name2), current, CARRIED_FILES, CARRIED_DIRS));
   }
   cached = current;
   return current;
@@ -6180,7 +6554,11 @@ function compactParams(request) {
     ...request.timeoutMs === void 0 ? {} : { timeoutMs: request.timeoutMs },
     ...request.maxBytes === void 0 ? {} : { maxBytes: request.maxBytes },
     ...request.stdin === void 0 ? {} : { stdin: request.stdin },
-    ...request.stdinBase64 === void 0 ? {} : { stdinBase64: request.stdinBase64 }
+    ...request.stdinBase64 === void 0 ? {} : { stdinBase64: request.stdinBase64 },
+    // **围栏必须上线。** 真机验收抓到过：`ExecRequest.writeRoots` 有了、`proc.start` 的
+    // `compactProcParams` 也发了，唯独同步 `proc.exec` 的这个构建函数漏了它——于是
+    // "只允许写这些根" 在同步路径上完全没生效（围栏外的写入 exit=0 成功），而且没有任何报错。
+    ...request.writeRoots === void 0 ? {} : { writeRoots: [...request.writeRoots] }
   };
 }
 var NS_PER_MS = 1e6;
@@ -6241,9 +6619,19 @@ function readJobOutput(raw) {
     lost: record2["lost"] === true,
     exitCode: typeof record2["exitCode"] === "number" ? record2["exitCode"] : 0,
     ...typeof record2["signal"] === "string" ? { signal: record2["signal"] } : {},
-    timedOut: record2["timedOut"] === true
+    timedOut: record2["timedOut"] === true,
+    ...exactBytesOf(record2)
   };
 }
+function exactBytesOf(record2) {
+  const encoded = record2["dataBase64"];
+  if (typeof encoded !== "string" || encoded === "") return {};
+  try {
+    return { exactBytes: Uint8Array.from(Buffer.from(encoded, "base64")) };
+  } catch {
+    return {};
+  }
+}
 function readLspStatus(raw) {
   const record2 = asRecord(raw) ?? {};
   return {
@@ -6271,7 +6659,8 @@ function readLspRead(raw) {
     state: typeof record2["state"] === "string" ? record2["state"] : "unknown",
     droppedBytes: typeof record2["droppedBytes"] === "number" ? record2["droppedBytes"] : 0,
     totalBytes: typeof record2["totalBytes"] === "number" ? record2["totalBytes"] : 0,
-    lost: record2["lost"] === true
+    lost: record2["lost"] === true,
+    ...exactBytesOf(record2)
   };
 }
 function compactProcParams(request) {
@@ -7081,7 +7470,7 @@ var BLOB_DRAIN_TIMEOUT_MS = 2e3;
 init_capability();
 init_errors();
 init_transport();
-import { spawn } from "node:child_process";
+import { spawn as spawn2 } from "node:child_process";
 
 // src/host/infra/transport/fs-commands.ts
 init_shell_quote();
@@ -7183,6 +7572,170 @@ ${stderr}`;
   if (index === -1) return void 0;
   return haystack.slice(index + DSH_COMMAND_ERROR.length).split("\n")[0]?.trim();
 }
+function symlinkCommand(target, linkPath) {
+  const quotedTarget = shellQuote(target);
+  const quotedLink = shellQuote(linkPath);
+  return [
+    // 用全仓统一的拒绝标记（`DSH_ERROR=`），而不是自己发明一套前缀——`commandRefusal` 只认这一种。
+    `if [ -e ${quotedLink} ] || [ -L ${quotedLink} ]; then printf '${DSH_COMMAND_ERROR}exists\\n'; exit 3; fi`,
+    `ln -s ${quotedTarget} ${quotedLink} || { printf '${DSH_COMMAND_ERROR}ln-failed\\n'; exit 4; }`
+  ].join("\n");
+}
+function readlinkCommand(absolute) {
+  const quoted = shellQuote(absolute);
+  return `if [ ! -L ${quoted} ]; then echo 'DSH_NOTLINK'; exit 0; fi
+readlink ${quoted}`;
+}
+
+// src/host/infra/transport/ssh/alias-forward.ts
+init_errors();
+init_forward_proxy();
+
+// src/host/infra/transport/ssh/ssh-argv.ts
+function credentialArgv(options) {
+  const argv = [];
+  if (options.identityFile !== void 0 && options.identityFile !== "") argv.push("-i", options.identityFile);
+  if (options.knownHostsFile !== void 0 && options.knownHostsFile !== "") {
+    argv.push("-o", `UserKnownHostsFile=${options.knownHostsFile}`);
+  }
+  if (options.user !== void 0 && options.user !== "") argv.push("-l", options.user);
+  return argv;
+}
+function commonSshOptions(options) {
+  const argv = [
+    "-o",
+    `BatchMode=${options.batchMode === false ? "no" : "yes"}`
+  ];
+  if (options.connectTimeoutMs !== void 0) {
+    argv.push("-o", `ConnectTimeout=${Math.max(1, Math.ceil(options.connectTimeoutMs / 1e3))}`);
+  }
+  if (options.hostKeyPolicy !== void 0) {
+    argv.push("-o", `StrictHostKeyChecking=${options.hostKeyPolicy === "strict" ? "yes" : "accept-new"}`);
+  }
+  for (const option of options.extraOptions ?? []) argv.push("-o", option);
+  argv.push(...credentialArgv(options));
+  return argv;
+}
+function sshPrefix(sshBinary, options) {
+  return [sshBinary, "-T", ...commonSshOptions(options), options.alias];
+}
+
+// src/host/infra/transport/ssh/forward-argv.ts
+function buildForwardChannelArgv(options) {
+  const sshArgv = {
+    alias: options.alias,
+    ...options.user === void 0 ? {} : { user: options.user },
+    ...options.identityFile === void 0 ? {} : { identityFile: options.identityFile },
+    ...options.knownHostsFile === void 0 ? {} : { knownHostsFile: options.knownHostsFile },
+    ...options.hostKeyPolicy === void 0 ? {} : { hostKeyPolicy: options.hostKeyPolicy },
+    ...options.connectTimeoutMs === void 0 ? {} : { connectTimeoutMs: options.connectTimeoutMs },
+    ...options.batchMode === void 0 ? {} : { batchMode: options.batchMode },
+    ...options.extraOptions === void 0 ? {} : { extraOptions: options.extraOptions }
+  };
+  const argv = [options.sshBinary ?? "ssh"];
+  argv.push(
+    "-o",
+    `BatchMode=${options.batchMode === false ? "no" : "yes"}`,
+    "-o",
+    "ServerAliveInterval=15",
+    "-o",
+    "ServerAliveCountMax=3",
+    ...commonSshOptions(sshArgv),
+    "-W",
+    `${options.remoteHost}:${String(options.remotePort)}`,
+    options.alias
+  );
+  return argv;
+}
+
+// src/host/infra/transport/ssh/alias-forward.ts
+function channelFromChild(child) {
+  const readable = child.stdout;
+  const writable = child.stdin;
+  if (readable === null || writable === null) {
+    child.kill();
+    throw new SshDevError("REMOTE_UNSUPPORTED", "spawner \u6CA1\u6709\u63D0\u4F9B stdio\uFF0C\u65E0\u6CD5\u4F5C\u4E3A\u8F6C\u53D1\u901A\u9053", {});
+  }
+  return { readable, writable, destroy: () => child.kill() };
+}
+var CHANNEL_FAILURE_GRACE_MS = 150;
+function createSshForwarder(options) {
+  return createProxyForwarder({
+    connectionId: options.connectionId,
+    ...options.idleTimeoutMs === void 0 ? {} : { idleTimeoutMs: options.idleTimeoutMs },
+    ...options.now === void 0 ? {} : { now: options.now },
+    ...options.onReclaimed === void 0 ? {} : { onReclaimed: options.onReclaimed },
+    openChannel: async (request) => {
+      const child = options.spawn(options.buildArgv(request), options.env === void 0 ? {} : { env: options.env });
+      const early = await Promise.race([
+        child.exited,
+        new Promise((resolve3) => setTimeout(() => resolve3(void 0), CHANNEL_FAILURE_GRACE_MS))
+      ]);
+      if (early !== void 0) {
+        const reason = child.stderr().trim();
+        throw new SshDevError(
+          "CONNECTION_UNREACHABLE",
+          `\u8FDC\u7AEF\u62D2\u7EDD\u8F6C\u53D1\u5230 ${request.remoteHost}:${String(request.remotePort)}${reason === "" ? "" : `\uFF1A${reason}`}`,
+          { remoteHost: request.remoteHost, remotePort: request.remotePort }
+        );
+      }
+      return channelFromChild(child);
+    }
+  });
+}
+
+// src/host/infra/transport/node-spawn-long.ts
+import { spawn } from "node:child_process";
+var STDERR_TAIL_BYTES = 8 * 1024;
+function createNodeLongSpawner() {
+  return (argv, options) => {
+    const [command, ...args] = argv;
+    if (command === void 0) {
+      throw new Error("\u957F\u9A7B spawn \u9700\u8981\u81F3\u5C11\u4E00\u4E2A\u547D\u4EE4");
+    }
+    const child = spawn(command, args, {
+      windowsHide: true,
+      // `-W` 通道要双向管道：stdin 写远端、stdout 读远端。stderr 单独收集用于错误文案。
+      stdio: ["pipe", "pipe", "pipe"],
+      ...options.env === void 0 ? {} : { env: { ...process.env, ...options.env } }
+    });
+    let stderrText = "";
+    let settled = false;
+    let resolveExited = () => void 0;
+    const exited = new Promise((resolve3) => {
+      resolveExited = resolve3;
+    });
+    const settle = (result) => {
+      if (settled) return;
+      settled = true;
+      resolveExited(result);
+    };
+    child.stderr?.on("data", (chunk) => {
+      stderrText += chunk.toString("utf8");
+      if (stderrText.length > STDERR_TAIL_BYTES) stderrText = stderrText.slice(-STDERR_TAIL_BYTES);
+    });
+    child.on("error", (error) => {
+      stderrText += `${stderrText === "" ? "" : "\n"}${error.message}`;
+      settle({ code: null, signal: null });
+    });
+    child.on("close", (code, signal) => {
+      settle({ code, signal: typeof signal === "string" ? signal : null });
+    });
+    return {
+      stdin: child.stdin,
+      stdout: child.stdout,
+      exited,
+      kill: () => {
+        if (settled) return;
+        try {
+          child.kill();
+        } catch {
+        }
+      },
+      stderr: () => stderrText
+    };
+  };
+}
 
 // src/host/infra/transport/agent/agent-transport.ts
 init_transport_base();
@@ -7208,6 +7761,13 @@ var AgentTransport = class extends TransportBase {
   #disposeEpoch = 0;
   /** Identifies the current session, so a stale session's exit cannot disturb its successor. */
   #sessionToken = 0;
+  /**
+   * 端口转发器（懒建）。
+   *
+   * 走**同一条** `sshArgv`：它已经含 `-l`/`-i`/known_hosts/askpass env，重新按别名拼一遍会与真实连接用的
+   * 参数漂移。`-N -L` 只多加两个参数，不改变认证与跳板链。
+   */
+  #forwarder;
   constructor(options) {
     super();
     this.id = options.connectionId;
@@ -7306,7 +7866,38 @@ var AgentTransport = class extends TransportBase {
    *
    * A later `connect` opens a fresh session, so the transport is reusable after a disconnect.
    */
+  /** {@inheritDoc Transport.forward} */
+  async forward(request, signal) {
+    return this.#forwarderOf().forward(request, signal);
+  }
+  /** {@inheritDoc Transport.closeForwards} */
+  async closeForwards() {
+    const forwarder = this.#forwarder;
+    if (forwarder === void 0) return;
+    await forwarder.closeAll();
+  }
+  /** 造（或复用）转发器：argv 与携带会话的那条 ssh 同源。 */
+  #forwarderOf() {
+    if (this.#forwarder !== void 0) return this.#forwarder;
+    const base = this.#options.sshArgv;
+    if (base === void 0 || base.length === 0) {
+      throw new SshDevError(
+        "REMOTE_UNSUPPORTED",
+        "\u8FD9\u6761\u8FDE\u63A5\u6CA1\u6709\u53EF\u76F4\u63A5\u590D\u7528\u7684 ssh \u547D\u4EE4\u884C\uFF0C\u65E0\u6CD5\u5EFA\u7ACB\u7AEF\u53E3\u8F6C\u53D1\uFF08Tier 2 \u9700\u8981 sshArgv\uFF09",
+        { connectionId: this.#options.connectionId }
+      );
+    }
+    this.#forwarder = createSshForwarder({
+      connectionId: this.#options.connectionId,
+      buildArgv: (request) => buildAgentForwardChannelArgv(base, request),
+      spawn: createNodeLongSpawner(),
+      ...this.#options.env === void 0 ? {} : { env: this.#options.env },
+      ...this.#options.forwardIdleTimeoutMs === void 0 ? {} : { idleTimeoutMs: this.#options.forwardIdleTimeoutMs }
+    });
+    return this.#forwarder;
+  }
   async dispose() {
+    await this.closeForwards().catch(() => void 0);
     this.#disposing = true;
     this.#disposeEpoch++;
     this.markState("idle");
@@ -7658,7 +8249,7 @@ var AgentTransport = class extends TransportBase {
   async probeEnv(refresh, signal) {
     const record2 = await this.#optionalRequest("env.probe", refresh ? { refresh: true } : {}, signal);
     const number = (value) => typeof value === "number" ? value : void 0;
-    const text6 = (value) => typeof value === "string" && value !== "" ? value : void 0;
+    const text8 = (value) => typeof value === "string" && value !== "" ? value : void 0;
     const tools = {};
     const rawTools = record2["tools"];
     if (rawTools !== null && typeof rawTools === "object") {
@@ -7668,19 +8259,19 @@ var AgentTransport = class extends TransportBase {
     }
     const missing = Array.isArray(record2["missing"]) ? record2["missing"].filter((name2) => typeof name2 === "string") : [];
     return {
-      os: text6(record2["os"]) ?? "",
-      arch: text6(record2["arch"]) ?? "",
+      os: text8(record2["os"]) ?? "",
+      arch: text8(record2["arch"]) ?? "",
       cpus: number(record2["cpus"]) ?? 0,
-      user: text6(record2["user"]) ?? "",
+      user: text8(record2["user"]) ?? "",
       uid: number(record2["uid"]) ?? -1,
-      home: text6(record2["home"]) ?? "",
-      path: text6(record2["path"]) ?? "",
+      home: text8(record2["home"]) ?? "",
+      path: text8(record2["path"]) ?? "",
       tools,
       missing,
       probedAt: number(record2["probedAt"]) ?? 0,
-      ...text6(record2["kernel"]) === void 0 ? {} : { kernel: text6(record2["kernel"]) },
-      ...text6(record2["distro"]) === void 0 ? {} : { distro: text6(record2["distro"]) },
-      ...text6(record2["shell"]) === void 0 ? {} : { shell: text6(record2["shell"]) },
+      ...text8(record2["kernel"]) === void 0 ? {} : { kernel: text8(record2["kernel"]) },
+      ...text8(record2["distro"]) === void 0 ? {} : { distro: text8(record2["distro"]) },
+      ...text8(record2["shell"]) === void 0 ? {} : { shell: text8(record2["shell"]) },
       ...number(record2["memTotalBytes"]) === void 0 ? {} : { memTotalBytes: number(record2["memTotalBytes"]) },
       ...number(record2["memAvailableBytes"]) === void 0 ? {} : { memAvailableBytes: number(record2["memAvailableBytes"]) },
       ...number(record2["diskFreeBytes"]) === void 0 ? {} : { diskFreeBytes: number(record2["diskFreeBytes"]) },
@@ -8438,7 +9029,7 @@ var AgentTransport = class extends TransportBase {
   }
 };
 var defaultLauncher = async (options) => {
-  const child = spawn(options.sshArgv[0] ?? "ssh", [...options.sshArgv.slice(1), options.remoteCommand], {
+  const child = spawn2(options.sshArgv[0] ?? "ssh", [...options.sshArgv.slice(1), options.remoteCommand], {
     stdio: ["pipe", "pipe", "inherit"],
     windowsHide: true,
     // Only when the connection supplied entries: a fresh env object would drop PATH.
@@ -8504,6 +9095,21 @@ var ChildProcessSession = class {
     this.#child.kill();
   }
 };
+function buildAgentForwardChannelArgv(base, request) {
+  if (base.length < 2) {
+    throw new SshDevError("REMOTE_UNSUPPORTED", "ssh argv \u592A\u77ED\uFF0C\u65E0\u6CD5\u63D2\u5165\u7AEF\u53E3\u8F6C\u53D1\u53C2\u6570", {});
+  }
+  const binary = base[0];
+  const host = base[base.length - 1];
+  const options = base.slice(1, -1);
+  return [
+    binary,
+    ...options,
+    "-W",
+    `${request.remoteHost}:${String(request.remotePort)}`,
+    host
+  ];
+}
 
 // src/host/infra/transport/agent/agent-installer.ts
 init_shell_quote();
@@ -8551,14 +9157,14 @@ async function ensureAgent(options) {
   let machine = "";
   let tool;
   try {
-    const probe = await io.exec("uname -s; uname -m", signal);
-    if (probe.exitCode !== 0) {
+    const probe2 = await io.exec("uname -s; uname -m", signal);
+    if (probe2.exitCode !== 0) {
       return tier1("probe-failed", "\u8FDC\u7AEF\u65E0\u6CD5\u6267\u884C uname\uFF0C\u65E0\u6CD5\u786E\u5B9A\u4EE3\u7406\u4EA7\u7269\uFF1B\u4FDD\u6301\u96F6\u5B89\u88C5\u6A21\u5F0F", {
-        exitCode: probe.exitCode,
-        stderr: probe.stderr.slice(-500)
+        exitCode: probe2.exitCode,
+        stderr: probe2.stderr.slice(-500)
       });
     }
-    [system = "", machine = ""] = probe.stdout.split("\n").map((line) => line.trim());
+    [system = "", machine = ""] = probe2.stdout.split("\n").map((line) => line.trim());
     tool = await io.digestTool(signal);
   } catch (error) {
     if (signal?.aborted === true) throw error;
@@ -8882,7 +9488,7 @@ var LocalBackend = class {
       version: chunk.version
     };
   }
-  async writeText(absolute, text6, expectedVersion, signal) {
+  async writeText(absolute, text8, expectedVersion, signal) {
     signal?.throwIfAborted();
     if (expectedVersion !== void 0 && expectedVersion !== "") {
       const current = await this.stat(absolute, signal);
@@ -8900,7 +9506,7 @@ var LocalBackend = class {
     } catch (error) {
       throw ioError("write (parent not writable)", directory, error);
     }
-    const payload = Buffer.from(text6, "utf8");
+    const payload = Buffer.from(text8, "utf8");
     const temporary = temporaryNameFor(absolute);
     try {
       await writeFile(temporary, payload);
@@ -9070,17 +9676,17 @@ var PlatformLocalBackend = class {
     return this.#platform.watch(target, changed, signal);
   }
   /** Fenced by the platform. An empty `expectedVersion` means "no guard", as the backend contract says. */
-  async writeText(absolute, text6, expectedVersion, signal) {
+  async writeText(absolute, text8, expectedVersion, signal, policy) {
     const target = await this.#target(absolute, signal);
     const intent = expectedVersion === void 0 || expectedVersion === "" ? void 0 : { kind: "replaceIfVersion", version: expectedVersion };
-    const outcome = await this.#platform.writeText(target, text6, intent, signal);
-    return { bytes: Buffer.byteLength(text6, "utf8"), version: String(outcome.version) };
+    const outcome = policy === void 0 ? await this.#platform.writeText(target, text8, intent, signal) : await this.#platform.writeText(target, text8, intent, signal, policy);
+    return { bytes: Buffer.byteLength(text8, "utf8"), version: String(outcome.version) };
   }
   /** Fenced by the platform; the three-state semantics are the platform's, which is what the core expects. */
-  async editText(absolute, oldString, newString, replaceAll, expectedVersion, signal) {
+  async editText(absolute, oldString, newString, replaceAll, expectedVersion, signal, policy) {
     const target = await this.#target(absolute, signal);
     const expected = expectedVersion === void 0 || expectedVersion === "" ? void 0 : { version: expectedVersion };
-    const outcome = await this.#platform.editText(target, { oldString, newString, replaceAll }, expected, signal);
+    const outcome = policy === void 0 ? await this.#platform.editText(target, { oldString, newString, replaceAll }, expected, signal) : await this.#platform.editText(target, { oldString, newString, replaceAll }, expected, signal, policy);
     return {
       bytes: Buffer.byteLength(newString, "utf8"),
       version: String(outcome.version),
@@ -9125,6 +9731,26 @@ var PlatformLocalBackend = class {
 // src/host/infra/backend/remote-backend.ts
 init_errors();
 
+// src/host/infra/transport/retry.ts
+init_errors();
+function isDisconnect(error) {
+  if (!isSshDevError(error)) return false;
+  return error.code === "CONNECTION_LOST";
+}
+async function retryOnceOnDisconnect(operation, options = {}) {
+  try {
+    return { value: await operation(), retried: false };
+  } catch (error) {
+    if (options.signal?.aborted === true) throw error;
+    if (!isDisconnect(error)) throw error;
+    await options.beforeRetry?.();
+    return { value: await operation(), retried: true };
+  }
+}
+
+// src/host/infra/backend/remote-backend.ts
+import { createHash } from "node:crypto";
+
 // src/host/infra/cache/lru.ts
 var LruCache = class {
   #maxEntries;
@@ -9431,20 +10057,118 @@ function parseListing(stdout) {
   return entries;
 }
 
-// src/host/infra/backend/remote-backend.ts
-init_shell_quote();
-function isWatchCapable(transport) {
-  if (transport === void 0) return false;
-  const candidate = transport;
-  return typeof candidate.startWatch === "function" && typeof candidate.pollWatch === "function" && typeof candidate.stopWatch === "function" && candidate.agentCapabilities?.watch === "native";
-}
-var remoteWatchSequence = 0;
-function parentRemotePath(absolute) {
-  return remoteDirname(absolute);
+// src/host/infra/backend/poll-watch.ts
+var DEFAULT_POLL_INTERVAL_MS = 2500;
+var DEFAULT_POLL_FAILURE_THRESHOLD = 3;
+var DEFAULT_POLL_MAX_BACKOFF_MS = 3e4;
+var DEFAULT_POLL_MAX_ENTRIES = 2e3;
+function defaultSleep(ms, signal) {
+  if (signal.aborted) return Promise.resolve();
+  return new Promise((resolve3) => {
+    const finish = () => {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", onAbort);
+      resolve3();
+    };
+    const onAbort = () => finish();
+    const timer = setTimeout(finish, ms);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
 }
-var DEFAULT_CACHE = { ttlMs: 5e3, maxEntries: 256, maxBytes: 8 * 1024 * 1024 };
-var STAT_MARKER = "# DSH_STAT";
-var BATCH_MARKER = "#DSH_F ";
+function listingSignature(entries) {
+  const rows = entries.map((entry) => `${entry.name}\0${entry.isDirectory ? "d" : entry.isFile ? "f" : "l"}\0${entry.size}\0${entry.mtimeMs}`).sort();
+  return rows.join("
");
+}
+function startPollWatch(deps) {
+  const intervalMs = Math.max(1, Math.floor(deps.options?.intervalMs ?? DEFAULT_POLL_INTERVAL_MS));
+  const failureThreshold = Math.max(1, Math.floor(deps.options?.failureThreshold ?? DEFAULT_POLL_FAILURE_THRESHOLD));
+  const maxBackoffMs = Math.max(intervalMs, Math.floor(deps.options?.maxBackoffMs ?? DEFAULT_POLL_MAX_BACKOFF_MS));
+  const maxEntries = Math.max(1, Math.floor(deps.options?.maxEntries ?? DEFAULT_POLL_MAX_ENTRIES));
+  const sleep2 = deps.options?.sleep ?? defaultSleep;
+  const isFatal = deps.options?.isFatal ?? (() => false);
+  const stopped = new AbortController();
+  const onCallerAbort = () => stopped.abort();
+  if (deps.signal.aborted) stopped.abort();
+  else deps.signal.addEventListener("abort", onCallerAbort, { once: true });
+  let done = false;
+  let baseline = deps.initial?.signature;
+  let failures = 0;
+  const notify = (error) => {
+    try {
+      if (error === void 0) deps.changed();
+      else deps.changed(error);
+    } catch {
+    }
+  };
+  const loop = async () => {
+    try {
+      while (!stopped.signal.aborted) {
+        try {
+          const snapshot = await deps.snapshot(stopped.signal);
+          if (stopped.signal.aborted) return;
+          if (snapshot.entries > maxEntries) {
+            notify(
+              new Error(
+                `\u8F6E\u8BE2\u76D1\u542C\u653E\u5F03\uFF1A${snapshot.entries} \u4E2A\u6761\u76EE\u8D85\u8FC7\u4E0A\u9650 ${maxEntries}\uFF08\u6BCF ${intervalMs} ms \u4F20\u56DE\u5E76\u6BD4\u8F83\u4E00\u6B21\u7684\u6210\u672C\u4E0D\u53EF\u63A5\u53D7\uFF09\uFF1B\u8BF7\u6539\u4E3A\u76D1\u542C\u66F4\u5C0F\u7684\u76EE\u5F55`
+              )
+            );
+            return;
+          }
+          if (baseline === void 0) {
+            baseline = snapshot.signature;
+          } else if (snapshot.signature !== baseline) {
+            baseline = snapshot.signature;
+            notify();
+          }
+          failures = 0;
+        } catch (error) {
+          if (stopped.signal.aborted) return;
+          if (isFatal(error)) {
+            notify(error instanceof Error ? error : new Error(String(error)));
+            return;
+          }
+          failures += 1;
+          if (failures >= failureThreshold) {
+            notify(error instanceof Error ? error : new Error(String(error)));
+            return;
+          }
+          const backoff = Math.min(maxBackoffMs, intervalMs * 2 ** (failures - 1));
+          await sleep2(backoff, stopped.signal);
+          continue;
+        }
+        await sleep2(intervalMs, stopped.signal);
+      }
+    } finally {
+      deps.signal.removeEventListener("abort", onCallerAbort);
+    }
+  };
+  void loop().catch(() => void 0);
+  return async () => {
+    if (done) return;
+    done = true;
+    stopped.abort();
+    deps.signal.removeEventListener("abort", onCallerAbort);
+  };
+}
+
+// src/host/infra/backend/remote-backend.ts
+init_shell_quote();
+function isWatchCapable(transport) {
+  if (transport === void 0) return false;
+  const candidate = transport;
+  return typeof candidate.startWatch === "function" && typeof candidate.pollWatch === "function" && typeof candidate.stopWatch === "function" && candidate.agentCapabilities?.watch === "native";
+}
+var remoteWatchSequence = 0;
+function parentRemotePath(absolute) {
+  return remoteDirname(absolute);
+}
+var UTF8 = new TextDecoder("utf-8", { ignoreBOM: true });
+var POLL_LISTING_SHARE_TTL_MS = 1e3;
+var STAT_CACHE_TTL_MS = 5e3;
+var STAT_CACHE_MAX_ENTRIES = 2048;
+var DEFAULT_CACHE = { ttlMs: 5e3, maxEntries: 256, maxBytes: 8 * 1024 * 1024 };
+var STAT_MARKER = "# DSH_STAT";
+var BATCH_MARKER = "#DSH_F ";
 var BATCH_TOTAL_BYTES = 32 * 1024 * 1024;
 function parseBatchRead(stdout, cap) {
   const chunks = /* @__PURE__ */ new Map();
@@ -9506,6 +10230,26 @@ var RemoteBackend = class {
     return isWatchCapable(this.#resolved ?? this.#options.transport);
   }
   /** Watchers started by {@link watch}, so {@link dispose} can end every poll loop. */
+  /**
+   * 轮询监听共享的目录快照：`root -> {at, promise}`。
+   *
+   * Tier 1 没有 native watcher，每个订阅各起一条 2.5 s 轮询循环。**同一个目录下的 N 个文件目标会各自
+   * 列举整层**：N=10 就是每 2.5 s 十次 exec 往返（系统 ssh 约 520 ms/次，连接直接被占满）。列一次、N 个
+   * 订阅共用，是这里唯一有效的做法；按 `root` 合并**在飞**请求，所以相位错开也只会共用一次往返。
+   */
+  #now;
+  /**
+   * 正向 `stat` 缓存：只记「存在」的结果，TTL 5 s，任何写路径都会失效它。
+   *
+   * 为什么只缓存"存在"：缓存"不存在"是危险的。`createIfAbsent` 一旦被缓存里的"不存在"骗到，就会把一个
+   * 真实文件当成新文件覆盖掉——那是数据丢失。反过来缓存"存在"最多让一次 `createIfAbsent` 保守地拒绝
+   * （用户重试即可），而版本守卫的 token 由平台持有、不经过这里，因此不会被缓存伪造。
+   *
+   * 收益：平台每打开一个文件都要先 `stat` 再读；Tier 1 每次 `stat` 是一次完整 ssh 往返（≈520 ms），
+   * 这次往返的答案（size/version）读路径刚刚才拿到。
+   */
+  #statCache = /* @__PURE__ */ new Map();
+  #pollListings = /* @__PURE__ */ new Map();
   #watchers = /* @__PURE__ */ new Set();
   #options;
   #maxReadBytes;
@@ -9522,9 +10266,11 @@ var RemoteBackend = class {
   /**
    * Read path cache (FR-2.7): fresh bodies, and stale bodies whose version a cheap `stat` just confirmed.
    *
-   * Keyed by `<path>\u0000<cap>` — the cap is part of the identity because `truncated` is a property of the
-   * *request*, not of the file: serving a 100-byte-capped entry to an 8 MiB read would silently truncate.
-   * The `\u0000` keeps `invalidatePrefix(path + '\u0000')` from also matching `/srv/a.txt2`.
+   * Keyed by **path only**. The cap used to be part of the key, which made the same file a different entry for
+   * every surface (`ctx.fs` asks for 16 MiB, `remote_read` for 8 MiB) and for every window read in the
+   * `readByteRange` fallback — double memory, half the hit rate, and window entries pushing the useful
+   * full-file entry out. A body now records **how many bytes it covers**; a request is served from it when the
+   * request's cap is at least the body length, and otherwise gets a truncated view of the same body.
    */
   #cache;
   /**
@@ -9542,6 +10288,7 @@ var RemoteBackend = class {
     }
     this.id = options.id;
     this.#options = options;
+    this.#now = options.now ?? (() => Date.now());
     this.#maxReadBytes = options.maxReadBytes ?? 16 * 1024 * 1024;
     const policy = { ...DEFAULT_CACHE, ...options.cache };
     this.#cache = new VersionedCache({
@@ -9613,9 +10360,24 @@ var RemoteBackend = class {
    * FR-2.7 stale-revalidation branch never matched either.
    */
   async stat(absolute, signal) {
+    const cachedStat = this.#statCache.get(absolute);
+    if (cachedStat !== void 0 && this.#now() - cachedStat.at < STAT_CACHE_TTL_MS) return cachedStat.info;
     const native = await this.#nativeStat(absolute, signal);
-    if (native !== void 0) return statFromNative(native);
-    return this.#shellStat(absolute, signal);
+    const info = native !== void 0 ? statFromNative(native) : await this.#shellStat(absolute, signal);
+    this.#rememberStat(absolute, info);
+    return info;
+  }
+  /** Cache a **positive** stat only (see {@link RemoteBackend.#statCache}); drop the entry otherwise. */
+  #rememberStat(absolute, info) {
+    if (!info.exists) {
+      this.#statCache.delete(absolute);
+      return;
+    }
+    this.#statCache.set(absolute, { at: this.#now(), info });
+    if (this.#statCache.size > STAT_CACHE_MAX_ENTRIES) {
+      const oldest = this.#statCache.keys().next();
+      if (!oldest.done) this.#statCache.delete(oldest.value);
+    }
   }
   /**
    * The transport's own stat, or `undefined` when there is none to use.
@@ -9692,18 +10454,21 @@ var RemoteBackend = class {
    */
   async readBytes(absolute, maxBytes, signal) {
     const cap = Math.max(0, Math.min(Math.floor(maxBytes), this.#maxReadBytes));
-    const key = `${absolute}\0${cap}`;
+    const key = absolute;
     const hit = this.#cache.get(key);
     if (hit !== void 0) {
-      if (hit.fresh) return hit.value;
+      if (hit.fresh) return cappedView(hit.value, cap);
       const current = await this.stat(absolute, signal);
       if (current.exists && current.version === hit.version) {
         this.#cache.touch(key, hit.version);
-        return hit.value;
+        return cappedView(hit.value, cap);
       }
       this.#cache.invalidate(key);
     }
-    const chunk = await (await this.#transport()).readFile({ path: absolute, maxBytes: cap }, signal);
+    const chunk = await retryOnceOnDisconnect(
+      async () => (await this.#transport()).readFile({ path: absolute, maxBytes: cap }, signal),
+      { signal }
+    ).then((outcome) => outcome.value);
     const read = {
       bytes: chunk.bytes,
       size: chunk.size,
@@ -9758,7 +10523,10 @@ var RemoteBackend = class {
   async readText(absolute, maxBytes, signal) {
     const chunk = await this.readBytes(absolute, maxBytes, signal);
     return {
-      text: Buffer.from(chunk.bytes).toString("utf8"),
+      // `TextDecoder` 直接解码字节，`Buffer.from(...).toString()` 要先**整份拷贝**再解码——9 MiB 的文件
+      // 就是白白多一次 9 MiB 的 memcpy。`fs-provider` 早就这么做了，这条读路径漏了。
+      // `ignoreBOM: true`：默认行为会把 BOM 吃掉，而 `Buffer#toString` 不会，两者必须一致。
+      text: UTF8.decode(chunk.bytes),
       size: chunk.size,
       truncated: chunk.truncated,
       version: chunk.version
@@ -9897,24 +10665,28 @@ var RemoteBackend = class {
    *
    * A plain write is one round trip plus one `stat` for the new version.
    */
-  async writeText(absolute, text6, expectedVersion, signal) {
-    const bytes = new Uint8Array(Buffer.from(text6, "utf8"));
+  async writeText(absolute, text8, expectedVersion, signal) {
+    const bytes = new Uint8Array(Buffer.from(text8, "utf8"));
     let digest;
     let nativeVersion;
     if (expectedVersion !== void 0 && expectedVersion !== "") {
-      const current = await this.stat(absolute, signal);
-      if (!current.exists) {
-        throw new SshDevError("TRANSFER_CONFLICT", "\u8FDC\u7AEF\u6587\u4EF6\u4E0D\u5B58\u5728\uFF0C\u5199\u5165\u88AB\u62D2\u7EDD", { path: absolute, expected: expectedVersion });
-      }
-      if (current.version !== expectedVersion) {
-        throw new SshDevError("TRANSFER_CONFLICT", "\u8FDC\u7AEF\u6587\u4EF6\u5DF2\u88AB\u4FEE\u6539\uFF0C\u5199\u5165\u88AB\u62D2\u7EDD", {
-          path: absolute,
-          expected: expectedVersion,
-          observed: current.version
-        });
+      const cached2 = this.#cache.get(absolute);
+      const cachedFull = cached2 !== void 0 && !cached2.value.truncated && cached2.value.version === expectedVersion ? cached2.value : void 0;
+      if (cachedFull === void 0) {
+        const current = await this.stat(absolute, signal);
+        if (!current.exists) {
+          throw new SshDevError("TRANSFER_CONFLICT", "\u8FDC\u7AEF\u6587\u4EF6\u4E0D\u5B58\u5728\uFF0C\u5199\u5165\u88AB\u62D2\u7EDD", { path: absolute, expected: expectedVersion });
+        }
+        if (current.version !== expectedVersion) {
+          throw new SshDevError("TRANSFER_CONFLICT", "\u8FDC\u7AEF\u6587\u4EF6\u5DF2\u88AB\u4FEE\u6539\uFF0C\u5199\u5165\u88AB\u62D2\u7EDD", {
+            path: absolute,
+            expected: expectedVersion,
+            observed: current.version
+          });
+        }
       }
       if ((await this.#transport()).statPath === void 0) {
-        digest = await this.#digest(absolute, signal);
+        digest = cachedFull === void 0 ? await this.#digest(absolute, signal) : sha256Hex(cachedFull.bytes);
       } else {
         nativeVersion = expectedVersion;
       }
@@ -9952,19 +10724,21 @@ var RemoteBackend = class {
    * `changed()` also covers "nothing to re-stat but something happened" — the platform's contract is
    * "re-stat this path", so events are coalesced per poll.
    *
+   * **Tier 1 没有 native watcher 时走轮询**（`poll-watch.ts`）：定时取一次"这一层"的快照并比较签名。
+   * 这是能力缺口上的兜底，不是替代品——native 可用时永远优先 native。轮询的代价被明确限住：只列被 watch
+   * 的那一层（`maxDepth = 1`）、条目数有上限、连续失败到阈值就 `changed(error)` 报死而不是静默重试。
+   *
    * @param absolute - root-absolute remote path (directory or file).
    * @param changed - platform callback: no argument = re-stat; an error = the subscription is dead.
    * @param signal - cancels the subscription; stopping is immediate and idempotent.
    * @returns the disposer (stops the watcher; idempotent).
-   * @throws SshDevError `REMOTE_UNSUPPORTED` when this connection has no native watcher, `REMOTE_NOT_FOUND`
-   *   when a file target's parent directory does not exist, `CANCELLED` when aborted during setup.
+   * @throws SshDevError `REMOTE_NOT_FOUND` when a file target's parent directory does not exist,
+   *   `CANCELLED` when aborted during setup.
    */
   async watch(absolute, changed, signal) {
     const transport = await this.#transport();
     if (!isWatchCapable(transport)) {
-      throw new SshDevError("REMOTE_UNSUPPORTED", '\u8BE5\u8FDE\u63A5\u6CA1\u6709\u4EE3\u7406\u539F\u751F\u76D1\u542C\u80FD\u529B\uFF08capabilities.watch !== "native"\uFF09\uFF1ATier 1 \u6CA1\u6709 watch \u534F\u8BAE\uFF0C\u65E0\u6CD5\u76D1\u542C\u8FDC\u7AEF\u8DEF\u5F84', {
-        path: absolute
-      });
+      return this.#watchByPolling(absolute, changed, signal);
     }
     const target = normalizeRemotePath(absolute);
     if (signal.aborted) throw new SshDevError("CANCELLED", `\u76D1\u542C ${target} \u5728\u5EFA\u7ACB\u524D\u88AB\u53D6\u6D88`, { path: target });
@@ -10015,6 +10789,96 @@ var RemoteBackend = class {
     void this.#pollRemoteWatch(transport, watcherId, directory ? void 0 : target, changed, stop, stopped.signal).catch(() => void 0);
     return stop;
   }
+  /**
+   * Tier 1 的轮询订阅：没有 native watcher 时用"定时快照 + 对比"回答"这个路径变了"。
+   *
+   * 快照**复用目录列举脚本**（`buildListScript`，`-maxdepth 1`），不写第二份：那条脚本已经处理了 GNU
+   * `find -printf` 与 BSD 回退、符号链接分类、名字里的制表符，抄一份只会多一处会分叉的实现。
+   *
+   * 文件目标监听父目录并按名字过滤（与 native 路径同形：inotify 也只能在父目录上报告单个文件的创建/
+   * 写入/删除）。目录目标直接快照自己。
+   *
+   * 建立订阅时先取一次快照：它既是"目标可读"的确认（父目录不存在时明确报 `REMOTE_NOT_FOUND`，而不是
+   * 让轮询循环在后台反复失败），也是比较的基线——所以循环不会立刻多打一次 ssh。
+   *
+   * @param absolute - root-absolute remote path (directory or file).
+   * @param changed - platform callback.
+   * @param signal - cancels the subscription.
+   * @returns the idempotent disposer.
+   */
+  async #watchByPolling(absolute, changed, signal) {
+    const target = normalizeRemotePath(absolute);
+    if (signal.aborted) throw new SshDevError("CANCELLED", `\u76D1\u542C ${target} \u5728\u5EFA\u7ACB\u524D\u88AB\u53D6\u6D88`, { path: target });
+    const info = await this.stat(target, signal);
+    const directory = info.exists && info.isDirectory;
+    const root = directory ? target : parentRemotePath(target);
+    if (!directory) {
+      const parent = await this.stat(root, signal);
+      if (!parent.exists || !parent.isDirectory) {
+        throw new SshDevError("REMOTE_NOT_FOUND", `\u65E0\u6CD5\u76D1\u542C ${target}\uFF1A\u5B83\u7684\u7236\u76EE\u5F55 ${root} \u4E0D\u5B58\u5728`, { path: target, root });
+      }
+    }
+    const fileName = directory ? void 0 : target.slice(target.lastIndexOf("/") + 1);
+    const initial = await this.#pollSnapshot(root, fileName, signal);
+    const stopPolling = startPollWatch({
+      snapshot: (pollSignal) => this.#pollSnapshot(root, fileName, pollSignal),
+      initial,
+      changed,
+      signal,
+      ...this.#options.pollWatch === void 0 ? {} : { options: this.#options.pollWatch }
+    });
+    const stop = async () => {
+      this.#watchers.delete(stop);
+      await stopPolling();
+    };
+    this.#watchers.add(stop);
+    return stop;
+  }
+  /**
+   * 取一次轮询快照。
+   *
+   * 目录目标：整层列举的签名。文件目标：只取**那一个名字**的签名——父目录里别的文件变了不该通知本订阅，
+   * 否则一个目录里 N 个文件订阅会互相放大成 N 倍通知。
+   *
+   * 文件不存在时签名是 `missing`：创建/删除都会改变它，所以"文件被创建"也能通知到。
+   *
+   * @param root - 目录目标本身，或文件目标的父目录。
+   * @param fileName - 文件目标的名字；目录目标是 `undefined`。
+   * @param signal - cancellation.
+   * @returns the comparable snapshot.
+   */
+  async #pollSnapshot(root, fileName, signal) {
+    const shared = await this.#sharedPollListing(root, signal);
+    if (fileName === void 0) return { signature: shared.signature, entries: shared.entries.length };
+    const match = shared.entries.find((entry) => entry.name === fileName);
+    return { signature: match === void 0 ? "missing" : listingSignature([match]), entries: 0 };
+  }
+  /**
+   * 取一份可共享的目录快照（TTL + 在飞合并）。
+   *
+   * 取消语义：单个订阅被 abort 时**不**取消这次共享列举——它可能正被另一个订阅用着。代价是一次已经在
+   * 路上的 exec 会跑完（它本来就是一个短命令），换来的是 N 个订阅不再互相拖垮。
+   *
+   * @param root - 要列举的目录。
+   * @param signal - 订阅方的取消信号（只用来跳过"已经不需要了"的等待，不影响共享请求本身）。
+   * @returns 词条与它们的签名。
+   */
+  async #sharedPollListing(root, signal) {
+    if (signal.aborted) throw new SshDevError("CANCELLED", "\u76D1\u542C\u5DF2\u53D6\u6D88", {});
+    const now = this.#now();
+    const cached2 = this.#pollListings.get(root);
+    if (cached2 !== void 0 && now - cached2.at < POLL_LISTING_SHARE_TTL_MS) return cached2.promise;
+    const promise = (async () => {
+      const entries = await this.#listUncached(root);
+      return { entries, signature: listingSignature(entries) };
+    })();
+    const entry = { at: now, promise };
+    this.#pollListings.set(root, entry);
+    promise.catch(() => {
+      if (this.#pollListings.get(root) === entry) this.#pollListings.delete(root);
+    });
+    return promise;
+  }
   /**
    * Stop every watcher this backend started.
    *
@@ -10022,6 +10886,8 @@ var RemoteBackend = class {
    * public so whoever retires the backend can end the poll loops, and so tests can prove they stop.
    */
   async dispose() {
+    this.#statCache.clear();
+    this.#pollListings.clear();
     await Promise.allSettled([...this.#watchers].map((stop) => stop()));
     this.#cache.clear();
     this.#listings.clear();
@@ -10085,7 +10951,8 @@ var RemoteBackend = class {
    * listing does not mention would otherwise hide it for up to a TTL.
    */
   #invalidatePath(absolute) {
-    this.#cache.invalidatePrefix(`${absolute}\0`);
+    this.#cache.invalidate(absolute);
+    this.#statCache.delete(absolute);
     const slash = absolute.lastIndexOf("/");
     if (slash > 0) this.#listings.invalidate(absolute.slice(0, slash));
   }
@@ -10173,6 +11040,33 @@ var RemoteBackend = class {
     }
     this.#invalidatePath(absolute);
   }
+  /**
+   * Create a symbolic link; refuse an existing path.
+   *
+   * Runs through `exec` for the same reason {@link chmod} does: the agent has no `fs.symlink`, and one script
+   * keeps the two tiers from disagreeing about what "create a link" means on this host.
+   */
+  async symlink(target, linkPath, signal) {
+    const result = await (await this.#transport()).exec({ script: symlinkCommand(target, linkPath), maxBytes: 64 * 1024 }, signal);
+    const refusal = commandRefusal(result.stdout, result.stderr);
+    if (refusal === "exists") {
+      throw new SshDevError("ROOT_INVALID", `\u62D2\u7EDD\u8986\u76D6\u5DF2\u5B58\u5728\u7684\u8DEF\u5F84\uFF1A${linkPath}`, { path: linkPath, target });
+    }
+    if (refusal !== void 0) {
+      throw new SshDevError("REMOTE_COMMAND_FAILED", `\u521B\u5EFA\u7B26\u53F7\u94FE\u63A5\u5931\u8D25\uFF08${refusal}\uFF09\uFF1A${linkPath}`, { path: linkPath, target, reason: refusal });
+    }
+    this.#invalidatePath(linkPath);
+  }
+  /** Read a link target; `undefined` means "this is not a link", which is an answer, not an error. */
+  async readlink(absolute, signal) {
+    const result = await (await this.#transport()).exec({ script: readlinkCommand(absolute), maxBytes: 64 * 1024 }, signal);
+    const text8 = result.stdout.trim();
+    if (text8 === "DSH_NOTLINK") return void 0;
+    if (result.exitCode !== 0) {
+      throw new SshDevError("REMOTE_COMMAND_FAILED", `\u8BFB\u53D6\u7B26\u53F7\u94FE\u63A5\u5931\u8D25\uFF1A${absolute}`, { path: absolute, stderr: result.stderr.slice(0, 200) });
+    }
+    return text8;
+  }
   /** Whether this backend's root contains a path (used by the router's `contains`). */
   contains(parent, candidate) {
     return remotePathContains(parent, candidate);
@@ -10188,6 +11082,13 @@ var RemoteBackend = class {
     return result.stdout.trim();
   }
 };
+function sha256Hex(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function cappedView(read, cap) {
+  if (read.bytes.byteLength <= cap) return read;
+  return { ...read, bytes: read.bytes.subarray(0, cap), truncated: true };
+}
 function statFromNative(native) {
   return {
     exists: native.exists,
@@ -10211,40 +11112,9 @@ function parseHeaders(stdout) {
 
 // src/host/infra/transport/ssh/alias-transport.ts
 init_capability();
-init_errors();
 import { join as join6 } from "node:path";
+init_errors();
 init_shell_quote();
-
-// src/host/infra/transport/ssh/ssh-argv.ts
-function credentialArgv(options) {
-  const argv = [];
-  if (options.identityFile !== void 0 && options.identityFile !== "") argv.push("-i", options.identityFile);
-  if (options.knownHostsFile !== void 0 && options.knownHostsFile !== "") {
-    argv.push("-o", `UserKnownHostsFile=${options.knownHostsFile}`);
-  }
-  if (options.user !== void 0 && options.user !== "") argv.push("-l", options.user);
-  return argv;
-}
-function commonSshOptions(options) {
-  const argv = [
-    "-o",
-    `BatchMode=${options.batchMode === false ? "no" : "yes"}`
-  ];
-  if (options.connectTimeoutMs !== void 0) {
-    argv.push("-o", `ConnectTimeout=${Math.max(1, Math.ceil(options.connectTimeoutMs / 1e3))}`);
-  }
-  if (options.hostKeyPolicy !== void 0) {
-    argv.push("-o", `StrictHostKeyChecking=${options.hostKeyPolicy === "strict" ? "yes" : "accept-new"}`);
-  }
-  for (const option of options.extraOptions ?? []) argv.push("-o", option);
-  argv.push(...credentialArgv(options));
-  return argv;
-}
-function sshPrefix(sshBinary, options) {
-  return [sshBinary, "-T", ...commonSshOptions(options), options.alias];
-}
-
-// src/host/infra/transport/ssh/alias-transport.ts
 init_transport();
 function createMultiplexingCache() {
   const reasons = /* @__PURE__ */ new Map();
@@ -10264,6 +11134,13 @@ var AliasTransport = class {
   id;
   #options;
   #now;
+  /**
+   * 懒建的转发器：没有转发需求时**不**创建，避免每条连接多一个长驻 spawner 实例。
+   *
+   * 它用系统 ssh 起 `ssh -N -L`，与命令/文件走同一套凭证参数（`-l`/`-i`/known_hosts/askpass env）——
+   * 两套参数漂移是"文件能读、转发连不上"这类问题的来源。
+   */
+  #forwarder;
   #state = "idle";
   #capabilities = conservativeCapabilities();
   #connecting;
@@ -10415,7 +11292,43 @@ var AliasTransport = class {
     this.#connectingAbort?.abort();
   }
   /** Close the master connection when one exists. Idempotent. */
+  /** {@inheritDoc Transport.forward} */
+  async forward(request, signal) {
+    const forwarder = this.#forwarderOf();
+    return forwarder.forward(request, signal);
+  }
+  /** {@inheritDoc Transport.closeForwards} */
+  async closeForwards() {
+    const forwarder = this.#forwarder;
+    if (forwarder === void 0) return;
+    await forwarder.closeAll();
+  }
+  /** 造（或复用）转发器：参数与命令路径同源。 */
+  #forwarderOf() {
+    if (this.#forwarder !== void 0) return this.#forwarder;
+    const options = this.#options;
+    this.#forwarder = createSshForwarder({
+      connectionId: options.connectionId,
+      buildArgv: (request) => buildForwardChannelArgv({
+        alias: options.alias,
+        remoteHost: request.remoteHost,
+        remotePort: request.remotePort,
+        ...options.sshBinary === void 0 ? {} : { sshBinary: options.sshBinary },
+        ...options.user === void 0 ? {} : { user: options.user },
+        ...options.identityFile === void 0 ? {} : { identityFile: options.identityFile },
+        ...options.knownHostsFile === void 0 ? {} : { knownHostsFile: options.knownHostsFile },
+        ...options.hostKeyPolicy === void 0 ? {} : { hostKeyPolicy: options.hostKeyPolicy },
+        ...options.connectTimeoutMs === void 0 ? {} : { connectTimeoutMs: options.connectTimeoutMs },
+        ...options.batchMode === void 0 ? {} : { batchMode: options.batchMode }
+      }),
+      spawn: createNodeLongSpawner(),
+      ...options.env === void 0 ? {} : { env: options.env },
+      ...options.forwardIdleTimeoutMs === void 0 ? {} : { idleTimeoutMs: options.forwardIdleTimeoutMs }
+    });
+    return this.#forwarder;
+  }
   async dispose() {
+    await this.closeForwards().catch(() => void 0);
     if (this.#state === "idle") return;
     this.#connectingAbort?.abort();
     const hadMaster = this.#multiplexing === "master";
@@ -10429,6 +11342,12 @@ var AliasTransport = class {
   }
   /** Run one remote command. */
   async exec(request, signal) {
+    if (request.writeRoots !== void 0 && request.writeRoots.length > 0) {
+      throw new SshDevError("REMOTE_UNSUPPORTED", "\u8BE5\u4F20\u8F93\uFF08Tier 1\uFF0C\u65E0\u4EE3\u7406\uFF09\u65E0\u6CD5\u5EFA\u7ACB Landlock \u5199\u5165\u56F4\u680F", {
+        connectionId: this.id,
+        writeRoots: [...request.writeRoots]
+      });
+    }
     await this.connect(signal);
     const command = this.#commandFor(request);
     const startedAt = this.#now();
@@ -10724,14 +11643,14 @@ function parseWriteHeaders(stdout) {
   }
   return parsed;
 }
-function sliceAfterLines(text6, lineCount) {
+function sliceAfterLines(text8, lineCount) {
   let offset = 0;
   for (let line = 0; line < lineCount; line += 1) {
-    const next = text6.indexOf("\n", offset);
+    const next = text8.indexOf("\n", offset);
     if (next < 0) return "";
     offset = next + 1;
   }
-  return text6.slice(offset);
+  return text8.slice(offset);
 }
 function parseReadHeaders(stdout) {
   const lines = stdout.split("\n");
@@ -10888,7 +11807,7 @@ function createAskpassFs() {
 }
 
 // src/host/infra/transport/node-spawn.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 var DEFAULT_MAX_BYTES2 = 4 * 1024 * 1024;
 var DEFAULT_TIMEOUT_MS = 3e4;
 function createNodeSpawner(options = {}) {
@@ -10902,7 +11821,7 @@ function createNodeSpawner(options = {}) {
     }
     const maxBytes = spawnOptions.maxBytes ?? defaultMaxBytes;
     const timeoutMs = spawnOptions.timeoutMs ?? defaultTimeoutMs;
-    const child = spawn2(command, args, {
+    const child = spawn3(command, args, {
       windowsHide: true,
       stdio: ["pipe", "pipe", "pipe"],
       // Only override the environment when a caller actually supplied entries: passing a fresh object
@@ -11007,8 +11926,8 @@ function createAgentInstallIo(options) {
   return {
     exec,
     async digestTool() {
-      const probe = await exec("command -v sha256sum >/dev/null 2>&1 && echo sha256sum || (command -v shasum >/dev/null 2>&1 && echo shasum) || echo none");
-      const answer = probe.stdout.trim();
+      const probe2 = await exec("command -v sha256sum >/dev/null 2>&1 && echo sha256sum || (command -v shasum >/dev/null 2>&1 && echo shasum) || echo none");
+      const answer = probe2.stdout.trim();
       if (answer === "sha256sum" || answer === "shasum") return answer;
       return void 0;
     },
@@ -11303,10 +12222,21 @@ var RemoteIndex = class {
       cached: index.cached
     };
   }
-  /** Drop one root (its files changed) or everything. */
+  /**
+   * Drop one root (its files changed) or everything.
+   *
+   * **Byte accounting must follow.** Dropping entries without subtracting their bytes made `#cacheBytes` grow
+   * monotonically: after a few invalidate+remember cycles the cap saw a phantom overrun and evicted every live
+   * entry except the newest one, which turned each `@` completion back into a full scan — the exact cost this
+   * cache exists to remove.
+   */
   invalidate(root) {
-    if (root === void 0) this.#cache.clear();
-    else this.#cache.delete(root);
+    if (root === void 0) {
+      this.#cache.clear();
+      this.#cacheBytes = 0;
+      return;
+    }
+    this.#forget(root);
   }
   /** Whether a root is currently cached and fresh (used by tests and by the status UI). */
   isFresh(root) {
@@ -11474,14 +12404,26 @@ function directoryProbeCommand(root) {
 function rankMatches(paths, query, limit) {
   const needle = query.trim().toLowerCase();
   if (needle === "") {
-    const order = [];
-    for (let index = 0; index < paths.length; index += 1) order.push(index);
-    const depths = new Int32Array(paths.length);
-    for (let index = 0; index < paths.length; index += 1) depths[index] = depth2(paths[index]);
-    order.sort(
-      (left, right) => depths[left] - depths[right] || (paths[left] < paths[right] ? -1 : 1)
-    );
-    return order.slice(0, limit).map((index) => paths[index]);
+    const top = [];
+    const better = (left, right) => {
+      const leftDepth = depth2(paths[left]);
+      const rightDepth = depth2(paths[right]);
+      if (leftDepth !== rightDepth) return leftDepth < rightDepth;
+      return paths[left] < paths[right];
+    };
+    for (let index = 0; index < paths.length; index += 1) {
+      if (top.length >= limit && !better(index, top[top.length - 1])) continue;
+      let low = 0;
+      let high = top.length;
+      while (low < high) {
+        const middle = low + high >> 1;
+        if (better(index, top[middle])) high = middle;
+        else low = middle + 1;
+      }
+      top.splice(low, 0, index);
+      if (top.length > limit) top.pop();
+    }
+    return top.map((index) => paths[index]);
   }
   const scored = [];
   for (const path of paths) {
@@ -11931,6 +12873,11 @@ function defaultAgentManifestPath(moduleUrl) {
 
 // src/wiring/connections.ts
 var degradedRetryMs = 3e4;
+function pruneBackendConnections(owners, liveRootKeys) {
+  for (const backendId of [...owners.keys()]) {
+    if (!liveRootKeys.has(backendId)) owners.delete(backendId);
+  }
+}
 function wireConnections(ctx, config) {
   const limits = config.limits ?? {};
   const controlDir = limits.controlDir ?? join11(resolveStateDir(), "control");
@@ -11938,7 +12885,7 @@ function wireConnections(ctx, config) {
   for (const warning of takeStateDirWarnings()) {
     ctx.logger?.warn?.(`over-ssh: \u72B6\u6001\u76EE\u5F55\u8FC1\u79FB\uFF1A${warning}`);
   }
-  const spawn3 = createNodeSpawner({ defaultTimeoutMs: limits.commandTimeoutMs ?? 3e4 });
+  const spawn4 = createNodeSpawner({ defaultTimeoutMs: limits.commandTimeoutMs ?? 3e4 });
   const multiplexingCache = createMultiplexingCache();
   const ssh2Available = isSsh2Available();
   const profiles = /* @__PURE__ */ new Map();
@@ -11974,7 +12921,9 @@ function wireConnections(ctx, config) {
     connectionId: profile.id,
     alias: profile.alias ?? profile.host,
     controlDir,
-    spawn: spawn3,
+    spawn: spawn4,
+    // 没人用的转发要能自己消失（否则本地端口一直占着）；0 = 关闭回收。
+    ...limits.forwardIdleTimeoutMs === void 0 ? {} : { forwardIdleTimeoutMs: limits.forwardIdleTimeoutMs },
     multiplexingCache,
     hostKeyPolicy: profile.hostKeyPolicy,
     // A connection that names a key must use it: the alias transport otherwise relies entirely on the
@@ -12069,6 +13018,7 @@ function wireConnections(ctx, config) {
           // Same credential source as the Tier 1 transport: an agent session that authenticates differently
           // from the ladder that installed it is exactly the drift the agent-path e2e caught. For a password
           // connection that means the same askpass helper and the same BatchMode.
+          ...limits.forwardIdleTimeoutMs === void 0 ? {} : { forwardIdleTimeoutMs: limits.forwardIdleTimeoutMs },
           sshArgv: sshPrefix("ssh", {
             alias: profile.alias ?? profile.host,
             user: profile.user,
@@ -12121,6 +13071,7 @@ function wireConnections(ctx, config) {
     // Every mutation republishes the terminal manifest, so a terminal opened right after adding a root
     // already knows where it may land.
     onChanged: (records) => {
+      pruneBackendConnections(backendConnections, new Set(records.map((record2) => rootKey(record2.root))));
       publishChain = publishChain.then(() => publishTerminalManifest(records)).then(() => publishTerminalSessions()).catch(() => void 0);
     },
     createLocalBackend: (root) => {
@@ -12299,7 +13250,7 @@ function wireConnections(ctx, config) {
       }));
     }
   };
-  return { ctx, config, limits, anchorRootDir, profiles, selector, askpass, installations, agentBridge, transports, remoteHome, forgetBackendsOf, browseBackends, readBytesRange, registry, directory, indexes, indexFor, index };
+  return { ctx, config, limits, anchorRootDir, profiles, selector, askpass, installations, agentBridge, transports, remoteHome, forgetBackendsOf, browseBackends, readBytesRange, registry, directory, indexes, indexFor, index, cacheBudget };
 }
 function readLiveSessions(ctx) {
   let list;
@@ -12321,7 +13272,7 @@ function readLiveSessions(ctx) {
 }
 
 // src/wiring/fs.ts
-import { mkdir as mkdir6 } from "node:fs/promises";
+import { mkdir as mkdir7 } from "node:fs/promises";
 
 // src/host/integration/remote/remote-face.ts
 import { Service } from "@deepseek-ai/cordis";
@@ -12594,7 +13545,7 @@ function registerSessionTools(ctx, service) {
 init_errors();
 
 // src/host/app/roots/user-roots.ts
-import { mkdir as mkdir4, readFile as readFile5, rename as rename3, writeFile as writeFile4 } from "node:fs/promises";
+import { mkdir as mkdir4, readFile as readFile5, rename as rename3, unlink as unlink3, writeFile as writeFile4 } from "node:fs/promises";
 import { join as join12 } from "node:path";
 init_errors();
 var USER_ROOTS_VERSION = 1;
@@ -12619,7 +13570,14 @@ var nodeUserRootsIo = {
   mkdir: async (path) => {
     await mkdir4(path, { recursive: true, mode: 448 });
   },
-  rename: (from, to) => rename3(from, to)
+  rename: (from, to) => rename3(from, to),
+  unlink: async (path) => {
+    try {
+      await unlink3(path);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
 };
 function emptyUserRootsState() {
   return { version: USER_ROOTS_VERSION, roots: [], connections: [] };
@@ -12634,13 +13592,13 @@ function serializeUserRoots(state) {
   return `${JSON.stringify(state, null, 2)}
 `;
 }
-function parseUserRoots(text6) {
-  if (text6 === void 0 || text6.trim() === "") {
+function parseUserRoots(text8) {
+  if (text8 === void 0 || text8.trim() === "") {
     return { state: emptyUserRootsState(), warnings: [], degraded: false };
   }
   let decoded;
   try {
-    decoded = JSON.parse(stripBom(text6));
+    decoded = JSON.parse(stripBom(text8));
   } catch (error) {
     return {
       state: emptyUserRootsState(),
@@ -12969,13 +13927,16 @@ function updateConnectionInState(state, id, patch) {
   );
   return { version: state.version, roots, connections };
 }
+var USER_ROOTS_LOCK_FILE_NAME = `${USER_ROOTS_FILE_NAME}.lock`;
 function createUserRootsStore(options) {
   const io = options.io ?? nodeUserRootsIo;
   const filePath = join12(options.dir, USER_ROOTS_FILE_NAME);
+  let cachedRaw;
+  let cachedLoad;
   const load = async () => {
-    let text6;
+    let text8;
     try {
-      text6 = await io.readFile(filePath);
+      text8 = await io.readFile(filePath);
     } catch (error) {
       if (isMissingFile(error)) return { state: emptyUserRootsState(), warnings: [], degraded: false };
       return {
@@ -12984,14 +13945,26 @@ function createUserRootsStore(options) {
         degraded: true
       };
     }
-    return parseUserRoots(text6);
+    if (cachedRaw !== void 0 && text8 === cachedRaw && cachedLoad !== void 0) return cachedLoad;
+    const parsed = parseUserRoots(text8);
+    cachedRaw = text8;
+    cachedLoad = parsed;
+    return parsed;
   };
   const write = async (next) => {
     const validated = validateState(next);
     const temporary = `${filePath}.${process.pid}-${++tempSequence2}.tmp`;
+    const text8 = serializeUserRoots(validated);
     await io.mkdir(options.dir);
-    await io.writeFile(temporary, serializeUserRoots(validated));
-    await io.rename(temporary, filePath);
+    try {
+      await io.writeFile(temporary, text8);
+      await io.rename(temporary, filePath);
+    } catch (error) {
+      await io.unlink(temporary).catch(() => void 0);
+      throw error;
+    }
+    cachedRaw = text8;
+    cachedLoad = { state: validated, warnings: [], degraded: false };
     return validated;
   };
   const queue = createSerialQueue();
@@ -13001,17 +13974,17 @@ function createUserRootsStore(options) {
     assertUserRootsWritable(await load());
     return write(next);
   });
-  const mutate = (transition) => (
-    // The read is inside the critical section on purpose: reading outside it would reintroduce exactly the
-    // lost update this serialisation exists to prevent.
-    serialize(async () => {
+  const mutate = (transition) => {
+    const locked = options.withLock;
+    const run = async () => serialize(async () => {
       const loaded = await load();
       assertUserRootsWritable(loaded);
       const wanted = transition(loaded.state);
       if (serializeUserRoots(wanted) === serializeUserRoots(loaded.state)) return loaded.state;
       return write(wanted);
-    })
-  );
+    });
+    return locked === void 0 ? run() : locked(run);
+  };
   return {
     filePath,
     load,
@@ -13069,21 +14042,34 @@ function dropDuplicates(state, warnings) {
   }
   return { version: USER_ROOTS_VERSION, roots, connections };
 }
+function isWindowsShapedLocalKey(key) {
+  if (!key.startsWith("local:")) return false;
+  const path = key.slice("local:".length);
+  return /^[A-Za-z]:/.test(path) || path.startsWith("\\\\") || path.startsWith("//");
+}
 function sameRootKey(left, right) {
   if (left === right) return true;
-  const lowered = left.toLowerCase();
-  return lowered.startsWith("local:") && lowered === right.toLowerCase();
+  if (!isWindowsShapedLocalKey(left) || !isWindowsShapedLocalKey(right)) return false;
+  return left.toLowerCase() === right.toLowerCase();
 }
 function sameUserRootKey(left, right) {
   return sameRootKey(left, right);
 }
 function normalizeLocalSpelling(path) {
+  if (/[\u0000-\u001f]/.test(path)) {
+    throw new SshDevError("ROOT_INVALID", "\u6839\u7684 path \u4E0D\u80FD\u5305\u542B\u63A7\u5236\u5B57\u7B26", { path: JSON.stringify(path) });
+  }
   const unified = path.trim().replaceAll("\\", "/");
   const collapsed = unified.replace(/\/{2,}/g, "/");
-  if (collapsed === "/" || /^[A-Za-z]:\/?$/.test(collapsed)) {
-    return collapsed.endsWith("/") ? collapsed : `${collapsed}/`;
+  const rootish = collapsed === "/" || /^[A-Za-z]:\/?$/.test(collapsed);
+  const resolved = rootish ? collapsed : normalizeLocalPath2(collapsed, { caseInsensitive: false });
+  if (!isAbsoluteLocalPath(resolved)) {
+    throw new SshDevError("ROOT_INVALID", `\u6839\u7684 path \u5FC5\u987B\u662F\u7EDD\u5BF9\u8DEF\u5F84\uFF1A${path}`, { path });
   }
-  return collapsed.replace(/\/+$/, "");
+  if (resolved === "/" || /^[A-Za-z]:\/?$/.test(resolved)) {
+    return resolved.endsWith("/") ? resolved : `${resolved}/`;
+  }
+  return resolved.replace(/\/+$/, "");
 }
 function refuseCredentialFields(source) {
   for (const field of ["password", "passphrase"]) {
@@ -13140,8 +14126,8 @@ function record(value) {
 function arrayOf(value) {
   return Array.isArray(value) ? value : [];
 }
-function stripBom(text6) {
-  return text6.charCodeAt(0) === 65279 ? text6.slice(1) : text6;
+function stripBom(text8) {
+  return text8.charCodeAt(0) === 65279 ? text8.slice(1) : text8;
 }
 function messageOf(error) {
   return error instanceof Error ? error.message : String(error);
@@ -13165,11 +14151,11 @@ async function readBody(req, maxBytes) {
   return Buffer.concat(chunks).toString("utf8");
 }
 async function readJsonObject(req, maxBytes) {
-  const text6 = (await readBody(req, maxBytes)).trim();
-  if (text6 === "") return {};
+  const text8 = (await readBody(req, maxBytes)).trim();
+  if (text8 === "") return {};
   let parsed;
   try {
-    parsed = JSON.parse(text6);
+    parsed = JSON.parse(text8);
   } catch {
     throw new SshDevError("ROOT_INVALID", "\u8BF7\u6C42\u4F53\u4E0D\u662F\u5408\u6CD5 JSON");
   }
@@ -13482,32 +14468,45 @@ async function reconcile(deps, transition) {
 }
 
 // src/host/app/roots/roots-api-roots.ts
+var addRootQueue = createSerialQueue();
 async function handleRootActions(action, body, req, res, deps) {
   switch (action) {
     case "add-root": {
-      const entry = normalizeRootEntry(pick(body, ROOT_FIELDS));
-      const reuseExisting = body["reuseExisting"] === true;
-      const key = userRootKey(entry);
-      const existing = findRootInState(await currentUserState(deps), key);
-      if (existing !== void 0 && entry.workspaces === void 0 && entry.sessions === void 0 && !reuseExisting) {
-        throw new SshDevError("ROOT_INVALID", `\u8BE5\u6839\u5DF2\u5B58\u5728\uFF1A${key}`, { key });
-      }
-      if (!await isRootLive(deps, entry)) {
-        await deps.registerRoot(existing ?? entry);
-      }
-      const state = await reconcile(deps, (current) => {
-        if (!stateHasRoot(current, key)) return addRootToState(current, entry);
-        const withWorkspaceScope = entry.workspaces === void 0 ? current : withWorkspaces(current, key, entry.workspaces);
-        return entry.sessions === void 0 ? withWorkspaceScope : withSessions(withWorkspaceScope, key, entry.sessions);
-      });
-      const anchorPath = await anchorPathOf(deps, entry);
-      send(req, res, 200, {
-        ok: true,
-        action,
-        state: publicUserState(state),
-        ...anchorPath === void 0 ? {} : { anchorPath }
+      return addRootQueue.run(async () => {
+        const entry = normalizeRootEntry(pick(body, ROOT_FIELDS));
+        const reuseExisting = body["reuseExisting"] === true;
+        const key = userRootKey(entry);
+        const existing = findRootInState(await currentUserState(deps), key);
+        if (existing !== void 0 && entry.workspaces === void 0 && entry.sessions === void 0 && !reuseExisting) {
+          throw new SshDevError("ROOT_INVALID", `\u8BE5\u6839\u5DF2\u5B58\u5728\uFF1A${key}`, { key });
+        }
+        let registeredNow = false;
+        if (!await isRootLive(deps, entry)) {
+          await deps.registerRoot(existing ?? entry);
+          registeredNow = true;
+        }
+        let state;
+        try {
+          state = await reconcile(deps, (current) => {
+            if (!stateHasRoot(current, key)) return addRootToState(current, entry);
+            const withWorkspaceScope = entry.workspaces === void 0 ? current : withWorkspaces(current, key, entry.workspaces);
+            return entry.sessions === void 0 ? withWorkspaceScope : withSessions(withWorkspaceScope, key, entry.sessions);
+          });
+          if (existing !== void 0) await refreshLiveScope(deps, key, state);
+        } catch (error) {
+          if (registeredNow) await deps.unregisterRoot(key);
+          throw error;
+        }
+        const anchorPath = await anchorPathOf(deps, entry);
+        send(req, res, 200, {
+          ok: true,
+          action,
+          state: publicUserState(state),
+          ...anchorPath === void 0 ? {} : { anchorPath }
+        });
+        return true;
+        return true;
       });
-      return true;
     }
     case "remove-root": {
       const key = requiredKey(body["key"]);
@@ -13530,6 +14529,30 @@ async function handleRootActions(action, body, req, res, deps) {
       return false;
   }
 }
+async function refreshLiveScope(deps, key, state) {
+  const persisted = findRootInState(state, key);
+  if (persisted === void 0) return;
+  const raw = await Promise.resolve(deps.listRoots());
+  const liveEntry = raw.find((candidate) => liveKeyOfRecord(candidate, persisted) !== void 0);
+  if (liveEntry === void 0) return;
+  if (liveScopeIsCurrent(liveEntry, persisted)) return;
+  const liveKey = liveKeyOfRecord(liveEntry, persisted);
+  if (liveKey === void 0) return;
+  await deps.unregisterRoot(liveKey);
+  await deps.registerRoot(persisted);
+}
+function liveScopeIsCurrent(raw, entry) {
+  const outer = asRecord2(raw) ?? {};
+  const source = asRecord2(outer["root"]) ?? outer;
+  if (source["shared"] === true) return true;
+  return sameStrings(source["workspaces"], entry.workspaces) && sameStrings(source["sessions"], entry.sessions);
+}
+function sameStrings(left, right) {
+  const asSet = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string").sort() : [];
+  const a = asSet(left);
+  const b = asSet(right);
+  return a.length === b.length && a.every((value, index) => value === b[index]);
+}
 function rootAddedBySession(state, key, sessionId) {
   const entry = findRootInState(state, key);
   return (entry?.sessions ?? []).includes(sessionId);
@@ -13607,10 +14630,10 @@ function splitKeyValue(line) {
   if (key === void 0 || value === void 0) return void 0;
   return [key.toLowerCase(), unquote(value.trim())];
 }
-function parseSshConfig(text6) {
+function parseSshConfig(text8) {
   const entries = [];
   let current;
-  const lines = text6.split(/\r?\n/);
+  const lines = text8.split(/\r?\n/);
   for (let index = 0; index < lines.length; index++) {
     const raw = lines[index] ?? "";
     const line = stripComment(raw).trim();
@@ -13730,8 +14753,8 @@ async function handleConnectionActions(action, body, req, res, deps) {
         throw new SshDevError("CONNECTION_INVALID", "\u8FD9\u4E2A\u5BBF\u4E3B\u7EC4\u5408\u6CA1\u6709\u63D0\u4F9B ~/.ssh/config \u7684\u8BFB\u53D6\u80FD\u529B", {});
       }
       const byAlias = new Map(found.candidates.map((candidate) => [candidate.alias, candidate]));
-      const text6 = await deps.readSshConfig?.();
-      const drafts = importableEntries(parseSshConfig(text6 ?? ""), { home: homedir3() }).drafts;
+      const text8 = await deps.readSshConfig?.();
+      const drafts = importableEntries(parseSshConfig(text8 ?? ""), { home: homedir3() }).drafts;
       const draftByAlias = new Map(drafts.map((draft) => [draft.alias, draft]));
       const accepted = [];
       const refused = [];
@@ -13995,9 +15018,9 @@ function publicProbeResult(raw) {
 async function sshConfigCandidates(deps, excluded) {
   const read = deps.readSshConfig;
   if (read === void 0) return void 0;
-  const text6 = await read();
-  if (text6 === void 0 || text6.trim() === "") return { candidates: [], skipped: [] };
-  const result = importableEntries(parseSshConfig(text6), { home: homedir3(), excluded });
+  const text8 = await read();
+  if (text8 === void 0 || text8.trim() === "") return { candidates: [], skipped: [] };
+  const result = importableEntries(parseSshConfig(text8), { home: homedir3(), excluded });
   const taken = new Set(excluded);
   const candidates = [];
   const skipped = [...result.skipped];
@@ -14322,20 +15345,20 @@ async function serveSnapshot(req, res, deps) {
   });
 }
 async function serveAction(req, res, deps) {
-  let text6;
+  let text8;
   try {
-    text6 = await readBody(req, ROOTS_API_MAX_BODY_BYTES);
+    text8 = await readBody(req, ROOTS_API_MAX_BODY_BYTES);
   } catch (error) {
     send(req, res, 400, { ok: false, error: messageOf2(error) });
     return;
   }
-  if (text6.trim() === "") {
+  if (text8.trim() === "") {
     send(req, res, 400, { ok: false, error: "\u8BF7\u6C42\u4F53\u4E0D\u80FD\u4E3A\u7A7A\uFF1A\u9700\u8981 { action, ... } \u7684 JSON \u5BF9\u8C61" });
     return;
   }
   let decoded;
   try {
-    decoded = JSON.parse(text6);
+    decoded = JSON.parse(text8);
   } catch (error) {
     send(req, res, 400, { ok: false, error: `\u8BF7\u6C42\u4F53\u4E0D\u662F\u5408\u6CD5 JSON\uFF1A${messageOf2(error)}` });
     return;
@@ -14374,55 +15397,172 @@ async function serveAction(req, res, deps) {
   }
 }
 
-// src/host/integration/roots/roots-wiring.ts
-function rootsRouteDiagnostic(facts) {
-  const warnings = facts.warnings.length === 0 ? "(none)" : facts.warnings.map((warning) => `[${warning}]`).join(" ");
-  return [
-    "roots panel[diag]",
-    `route=${facts.routeRegistered ? "registered" : "MISSING"}`,
-    `injectRan=${facts.injectRan}`,
-    `hasWebServerProp=${facts.hasWebServerProperty}`,
-    `tools=${facts.toolsType}`,
-    `warnings=${facts.warnings.length}`,
-    warnings
-  ].join(" ");
-}
-function createRootsWiring(deps) {
-  const store2 = createUserRootsStore({ dir: deps.stateDir, ...deps.io === void 0 ? {} : { io: deps.io } });
-  const listRemoteDirectory = deps.listRemoteDirectory;
-  const remoteHomeDirectory = deps.remoteHomeDirectory;
-  const listLocalDirectory = deps.listLocalDirectory;
-  const readSshConfig = deps.readSshConfig;
-  const remoteFiles = deps.remoteFiles;
-  const transfers = deps.transfers;
-  const readCredentials = deps.readCredentials;
-  const testConnection = deps.testConnection;
-  const apiDeps = {
-    listRoots: () => deps.listRoots(),
-    listConnections: () => deps.listConnections(),
-    loadUserState: () => store2.load(),
-    mutateUserState: (transition) => store2.mutate(transition),
-    registerRoot: async (entry) => {
-      await deps.registerRoot(entry);
-    },
-    unregisterRoot: (key) => {
-      deps.unregisterRoot(key);
-    },
-    addConnection: async (entry) => {
-      const next = await store2.addConnection(entry);
-      deps.applyConnection(entry, entry.id);
-      return next;
-    },
-    applyConnection: async (entry, previousId) => {
-      deps.applyConnection(entry, previousId);
-    },
-    removeConnection: async (id) => {
-      deps.removeConnection(id);
-    },
-    ...deps.anchorRootDir === void 0 ? {} : { anchorRootDir: deps.anchorRootDir },
-    ...listRemoteDirectory === void 0 ? {} : { listRemoteDirectory: (input) => listRemoteDirectory(input) },
-    ...remoteHomeDirectory === void 0 ? {} : { remoteHomeDirectory },
-    ...listLocalDirectory === void 0 ? {} : { listLocalDirectory: (input) => listLocalDirectory(input) },
+// src/host/integration/session/session-bin-lock.ts
+init_errors();
+import { mkdir as mkdir5, open as open3, readFile as readFile6, rm as rm3, stat as stat3 } from "node:fs/promises";
+import { dirname as dirname5 } from "node:path";
+var DEFAULT_STALE_LOCK_MS = 6e4;
+var DEFAULT_LOCK_RETRY_MS = 25;
+var DEFAULT_LOCK_TIMEOUT_MS = 3e4;
+function createSessionBinLock(options) {
+  const staleMs = options.staleMs ?? DEFAULT_STALE_LOCK_MS;
+  const retryMs = options.retryMs ?? DEFAULT_LOCK_RETRY_MS;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS;
+  const sleep2 = options.sleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
+  const now = options.now ?? (() => Date.now());
+  const owner = options.owner ?? `${process.pid}@${hostnameOf()}`;
+  const createLockFile = async () => {
+    let handle;
+    try {
+      handle = await open3(options.path, "wx");
+    } catch (error) {
+      if (error.code === "EEXIST") return void 0;
+      throw error;
+    }
+    const token = `${owner}#${now()}#${Math.random().toString(36).slice(2, 10)}`;
+    try {
+      try {
+        const record2 = { pid: process.pid, host: hostnameOf(), acquiredAtMs: now(), owner, token };
+        await handle.writeFile(`${JSON.stringify(record2)}
+`, "utf8");
+      } finally {
+        await handle.close();
+      }
+    } catch (error) {
+      await rm3(options.path, { force: true }).catch(() => void 0);
+      throw error;
+    }
+    return token;
+  };
+  const releaseIfOwned = async (token) => {
+    if (token === "") return;
+    try {
+      const text8 = await readFile6(options.path, "utf8");
+      const record2 = JSON.parse(text8);
+      if (record2.token !== token) return;
+    } catch {
+      return;
+    }
+    await rm3(options.path, { force: true });
+  };
+  const tryAcquire = async () => {
+    try {
+      return await createLockFile();
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      await mkdir5(dirname5(options.path), { recursive: true });
+      return createLockFile();
+    }
+  };
+  const reclaimIfStale = async () => {
+    if (staleMs <= 0) return false;
+    let age;
+    try {
+      const info = await stat3(options.path);
+      age = now() - info.mtimeMs;
+    } catch {
+      return true;
+    }
+    if (age < staleMs) return false;
+    try {
+      const text8 = await readFile6(options.path, "utf8");
+      const record2 = JSON.parse(text8);
+      options.onReclaim?.({ path: options.path, ageMs: age, holder: record2 });
+    } catch {
+      options.onReclaim?.({ path: options.path, ageMs: age, holder: {} });
+    }
+    await rm3(options.path, { force: true });
+    return true;
+  };
+  const withLock = async (_key, operation) => {
+    const deadline = now() + timeoutMs;
+    let token;
+    for (; ; ) {
+      token = await tryAcquire();
+      if (token !== void 0) break;
+      if (await reclaimIfStale()) continue;
+      if (now() >= deadline) {
+        throw new SshDevError("TRANSFER_CONFLICT", `\u4F1A\u8BDD\u56DE\u6536\u7AD9\u7D22\u5F15\u88AB\u53E6\u4E00\u4E2A\u8FDB\u7A0B\u5360\u7528\uFF08\u7B49\u5F85 ${timeoutMs} ms \u8D85\u65F6\uFF09`, {
+          path: options.path,
+          reason: "lock-timeout",
+          timeoutMs
+        });
+      }
+      await sleep2(retryMs);
+    }
+    try {
+      return await operation();
+    } finally {
+      if (token !== void 0) await releaseIfOwned(token);
+    }
+  };
+  return { withLock, lockPath: options.path };
+}
+function hostnameOf() {
+  try {
+    return process.env["COMPUTERNAME"] ?? process.env["HOSTNAME"] ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+// src/host/integration/roots/roots-wiring.ts
+import { join as join14 } from "node:path";
+function rootsRouteDiagnostic(facts) {
+  const warnings = facts.warnings.length === 0 ? "(none)" : facts.warnings.map((warning) => `[${warning}]`).join(" ");
+  return [
+    "roots panel[diag]",
+    `route=${facts.routeRegistered ? "registered" : "MISSING"}`,
+    `injectRan=${facts.injectRan}`,
+    `hasWebServerProp=${facts.hasWebServerProperty}`,
+    `tools=${facts.toolsType}`,
+    `warnings=${facts.warnings.length}`,
+    warnings
+  ].join(" ");
+}
+function createRootsWiring(deps) {
+  const stateLock = deps.io === void 0 ? createSessionBinLock({ path: join14(deps.stateDir, `${USER_ROOTS_LOCK_FILE_NAME}`) }) : void 0;
+  const store2 = createUserRootsStore({
+    dir: deps.stateDir,
+    ...deps.io === void 0 ? {} : { io: deps.io },
+    // With an injected `io` (tests) there is no real directory to lock, so the store keeps its in-process
+    // serialisation only — the lock is a property of the real file system, not of the pure layer.
+    ...stateLock === void 0 ? {} : { withLock: (operation) => stateLock.withLock("user-roots", operation) }
+  });
+  const listRemoteDirectory = deps.listRemoteDirectory;
+  const remoteHomeDirectory = deps.remoteHomeDirectory;
+  const listLocalDirectory = deps.listLocalDirectory;
+  const readSshConfig = deps.readSshConfig;
+  const remoteFiles = deps.remoteFiles;
+  const transfers = deps.transfers;
+  const readCredentials = deps.readCredentials;
+  const testConnection = deps.testConnection;
+  const apiDeps = {
+    listRoots: () => deps.listRoots(),
+    listConnections: () => deps.listConnections(),
+    loadUserState: () => store2.load(),
+    mutateUserState: (transition) => store2.mutate(transition),
+    registerRoot: async (entry) => {
+      await deps.registerRoot(entry);
+    },
+    unregisterRoot: (key) => {
+      deps.unregisterRoot(key);
+    },
+    addConnection: async (entry) => {
+      const next = await store2.addConnection(entry);
+      deps.applyConnection(entry, entry.id);
+      return next;
+    },
+    applyConnection: async (entry, previousId) => {
+      deps.applyConnection(entry, previousId);
+    },
+    removeConnection: async (id) => {
+      deps.removeConnection(id);
+    },
+    ...deps.anchorRootDir === void 0 ? {} : { anchorRootDir: deps.anchorRootDir },
+    ...listRemoteDirectory === void 0 ? {} : { listRemoteDirectory: (input) => listRemoteDirectory(input) },
+    ...remoteHomeDirectory === void 0 ? {} : { remoteHomeDirectory },
+    ...listLocalDirectory === void 0 ? {} : { listLocalDirectory: (input) => listLocalDirectory(input) },
     ...readSshConfig === void 0 ? {} : { readSshConfig: () => readSshConfig() },
     ...remoteFiles === void 0 ? {} : { remoteFiles },
     ...transfers === void 0 ? {} : { transfers },
@@ -14439,9 +15579,8 @@ function createRootsWiring(deps) {
       routeRegistered = true;
       return disposeRoute;
     } catch (error) {
-      routeRegistered = false;
       routeWarnings.push(routeRefusedWarning(error));
-      return () => void 0;
+      return void 0;
     }
   };
   let unregisterRoute;
@@ -14457,6 +15596,7 @@ function createRootsWiring(deps) {
         return;
       }
       const disposeRoute = registerRoute(webServer);
+      if (disposeRoute === void 0) return () => void 0;
       unregisterRoute = disposeRoute;
       return () => {
         disposeRoute();
@@ -14536,9 +15676,9 @@ function isAlreadyLive(entry, live) {
 }
 
 // src/wiring/fs-panel-routes.ts
-import { mkdir as mkdir5, readFile as readFile6, readdir as readdir4 } from "node:fs/promises";
+import { mkdir as mkdir6, readdir as readdir4, readFile as readFile7, rmdir } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 init_errors();
 
 // src/host/integration/remote/connection-test.ts
@@ -14849,21 +15989,38 @@ function readOnlySeams(env) {
   };
 }
 function rootLifecycleSeams(env, hooks) {
-  const { anchorRootDir, registry, binRootResolver, prepareBinRoots } = env;
+  const { anchorRootDir, registry, binRootResolver, prepareBinRoots, sessionRoots } = env;
   return {
     registerRoot: async (entry) => {
       const root = toRoot(entry, anchorRootDir, "user");
-      await ensureAnchorDirectory(root, { mkdir: mkdir5 });
+      await ensureAnchorDirectory(root, { mkdir: mkdir6 });
       registry.add(root);
-      await prepareBinRoots([root]);
-      hooks.runBinHousekeeping();
+      sessionRoots.invalidate();
+      const prepared = prepareBinRoots([root]);
+      void prepared.then(() => {
+        hooks.runBinHousekeeping();
+      }).catch((error) => {
+        hooks.warn?.(`\u56DE\u6536\u7AD9\u51C6\u5907\u5931\u8D25\uFF08\u6839\u4ECD\u53EF\u7528\uFF0C\u5220\u9664\u4F1A\u5148\u843D\u5728\u5386\u53F2\u4F4D\u7F6E\uFF09\uFF1A${error instanceof Error ? error.message : String(error)}`);
+      });
     },
     unregisterRoot: (key) => {
+      const anchor = anchorPathOfRecord(registry.records, key);
       const removed = registry.removeByLooseKey(key);
       binRootResolver.forget(removed ?? key);
+      sessionRoots.invalidate();
+      if (anchor !== void 0) void rmdir(anchor).catch(() => void 0);
     }
   };
 }
+function anchorPathOfRecord(records, key) {
+  const target = key.toLowerCase();
+  for (const record2 of records) {
+    if (record2.key.toLowerCase() !== target) continue;
+    const anchor = record2.root.anchorPath;
+    return typeof anchor === "string" && anchor !== "" ? anchor : void 0;
+  }
+  return void 0;
+}
 function connectionLifecycleSeams(env, hooks) {
   const { profiles, indexes, browseBackends, forgetBackendsOf, transports, askpass } = env;
   return {
@@ -14880,14 +16037,14 @@ function connectionLifecycleSeams(env, hooks) {
         profiles.delete(previousId);
         hooks.forgetPerConnection(previousId);
         indexes.delete(previousId);
-        browseBackends.delete(previousId);
+        retireBrowseBackend(browseBackends, previousId);
         forgetBackendsOf(previousId);
         void transports.release(previousId).catch(() => void 0);
       }
       hooks.forgetPerConnection(profile.id);
       askpass.revive(profile.id);
       indexes.delete(profile.id);
-      browseBackends.delete(profile.id);
+      retireBrowseBackend(browseBackends, profile.id);
       forgetBackendsOf(profile.id);
       void transports.release(profile.id).catch(() => void 0);
     },
@@ -14899,12 +16056,18 @@ function connectionLifecycleSeams(env, hooks) {
       profiles.delete(id);
       hooks.forgetPerConnection(id);
       indexes.delete(id);
-      browseBackends.delete(id);
+      retireBrowseBackend(browseBackends, id);
       forgetBackendsOf(id);
       void transports.release(id).catch(() => void 0);
     }
   };
 }
+function retireBrowseBackend(browseBackends, connectionId) {
+  const backend = browseBackends.get(connectionId);
+  if (backend === void 0) return;
+  browseBackends.delete(connectionId);
+  void backend.dispose?.();
+}
 function browsingSeams(env) {
   const { profiles, transports, remoteHome, browseBackends } = env;
   return {
@@ -14923,6 +16086,9 @@ function browsingSeams(env) {
       if (backend === void 0) {
         backend = new RemoteBackend({
           id: `browse:${connectionId}`,
+          // 浏览后端与所有根共用**同一个**缓存预算。不传的话它每连接自带 8 MiB 读 + 2 MiB 列表缓存，
+          // 十条连接就是 100 MiB，直接绕过"进程总上限"这个预算存在的理由（审计 0112 P3-12 的同一课）。
+          ...env.cacheBudget === void 0 ? {} : { cacheBudget: env.cacheBudget },
           // Looked up per use, not captured: removing a connection must stop browsing it (the registry and
           // the panel share this rule), and `requireProfile` is what reports that as CONNECTION_NOT_FOUND.
           getTransport: async () => (await transports.acquire(requireProfile(profiles, connectionId))).transport
@@ -14956,7 +16122,7 @@ function browsingSeams(env) {
     },
     readSshConfig: async () => {
       try {
-        return await readFile6(join14(homedir5(), ".ssh", "config"), "utf8");
+        return await readFile7(join15(homedir5(), ".ssh", "config"), "utf8");
       } catch (error) {
         if (error.code === "ENOENT") return void 0;
         throw error;
@@ -15080,7 +16246,7 @@ function registerConfiguredRoots(env) {
     const root = toRoot(entry, anchorRootDir, "config");
     registry.add(root);
     binRootPreparation.push(prepareBinRoots([root]));
-    void ensureAnchorDirectory(root, { mkdir: mkdir6 }).catch((error) => {
+    void ensureAnchorDirectory(root, { mkdir: mkdir7 }).catch((error) => {
       ctx.logger?.warn?.(`over-ssh: \u8FDC\u7AEF\u6839\u7684\u951A\u70B9\u76EE\u5F55\u65E0\u6CD5\u521B\u5EFA\uFF08${root.anchorPath ?? ""}\uFF09\uFF1A${error instanceof Error ? error.message : String(error)}`);
     });
   }
@@ -15178,7 +16344,11 @@ function wireFs(env) {
     });
     const runBinHousekeeping = createBinHousekeeping({ ctx, limits, binService: env.binService });
     registerConfiguredRoots({ ctx, config, anchorRootDir, registry, prepareBinRoots, runBinHousekeeping });
-    const routes = registerPanelRoutes(env, { forgetPerConnection, runBinHousekeeping });
+    const routes = registerPanelRoutes(env, {
+      forgetPerConnection,
+      runBinHousekeeping,
+      warn: (message) => ctx.logger?.warn?.(`over-ssh: ${message}`)
+    });
     const activationTimers = scheduleActivationDiagnostics({ ctx, ...routes });
     watchSessionRemovals({ ctx, rootsWiring: routes.rootsWiring, onSessionRemoved: env.onSessionRemoved });
     mergePersistedRoots({ ctx, rootsWiring: routes.rootsWiring });
@@ -15189,124 +16359,13 @@ function wireFs(env) {
 // src/wiring/roots.ts
 init_errors();
 import { mkdir as mkdir9, rename as rename5, stat as nodeStat } from "node:fs/promises";
-
-// src/host/integration/session/session-bin-lock.ts
-init_errors();
-import { mkdir as mkdir7, open as open3, readFile as readFile7, rm as rm3, stat as stat3 } from "node:fs/promises";
-import { dirname as dirname5 } from "node:path";
-var DEFAULT_STALE_LOCK_MS = 6e4;
-var DEFAULT_LOCK_RETRY_MS = 25;
-var DEFAULT_LOCK_TIMEOUT_MS = 3e4;
-function createSessionBinLock(options) {
-  const staleMs = options.staleMs ?? DEFAULT_STALE_LOCK_MS;
-  const retryMs = options.retryMs ?? DEFAULT_LOCK_RETRY_MS;
-  const timeoutMs = options.timeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS;
-  const sleep2 = options.sleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
-  const now = options.now ?? (() => Date.now());
-  const owner = options.owner ?? `${process.pid}@${hostnameOf()}`;
-  const createLockFile = async () => {
-    let handle;
-    try {
-      handle = await open3(options.path, "wx");
-    } catch (error) {
-      if (error.code === "EEXIST") return void 0;
-      throw error;
-    }
-    const token = `${owner}#${now()}#${Math.random().toString(36).slice(2, 10)}`;
-    try {
-      try {
-        const record2 = { pid: process.pid, host: hostnameOf(), acquiredAtMs: now(), owner, token };
-        await handle.writeFile(`${JSON.stringify(record2)}
-`, "utf8");
-      } finally {
-        await handle.close();
-      }
-    } catch (error) {
-      await rm3(options.path, { force: true }).catch(() => void 0);
-      throw error;
-    }
-    return token;
-  };
-  const releaseIfOwned = async (token) => {
-    if (token === "") return;
-    try {
-      const text6 = await readFile7(options.path, "utf8");
-      const record2 = JSON.parse(text6);
-      if (record2.token !== token) return;
-    } catch {
-      return;
-    }
-    await rm3(options.path, { force: true });
-  };
-  const tryAcquire = async () => {
-    try {
-      return await createLockFile();
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-      await mkdir7(dirname5(options.path), { recursive: true });
-      return createLockFile();
-    }
-  };
-  const reclaimIfStale = async () => {
-    if (staleMs <= 0) return false;
-    let age;
-    try {
-      const info = await stat3(options.path);
-      age = now() - info.mtimeMs;
-    } catch {
-      return true;
-    }
-    if (age < staleMs) return false;
-    try {
-      const text6 = await readFile7(options.path, "utf8");
-      const record2 = JSON.parse(text6);
-      options.onReclaim?.({ path: options.path, ageMs: age, holder: record2 });
-    } catch {
-      options.onReclaim?.({ path: options.path, ageMs: age, holder: {} });
-    }
-    await rm3(options.path, { force: true });
-    return true;
-  };
-  const withLock = async (_key, operation) => {
-    const deadline = now() + timeoutMs;
-    let token;
-    for (; ; ) {
-      token = await tryAcquire();
-      if (token !== void 0) break;
-      if (await reclaimIfStale()) continue;
-      if (now() >= deadline) {
-        throw new SshDevError("TRANSFER_CONFLICT", `\u4F1A\u8BDD\u56DE\u6536\u7AD9\u7D22\u5F15\u88AB\u53E6\u4E00\u4E2A\u8FDB\u7A0B\u5360\u7528\uFF08\u7B49\u5F85 ${timeoutMs} ms \u8D85\u65F6\uFF09`, {
-          path: options.path,
-          reason: "lock-timeout",
-          timeoutMs
-        });
-      }
-      await sleep2(retryMs);
-    }
-    try {
-      return await operation();
-    } finally {
-      if (token !== void 0) await releaseIfOwned(token);
-    }
-  };
-  return { withLock, lockPath: options.path };
-}
-function hostnameOf() {
-  try {
-    return process.env["COMPUTERNAME"] ?? process.env["HOSTNAME"] ?? "unknown";
-  } catch {
-    return "unknown";
-  }
-}
-
-// src/wiring/roots.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname7, join as join15 } from "node:path";
+import { dirname as dirname7, join as join16 } from "node:path";
 
 // src/host/integration/transfer/transfer-adapters.ts
 init_errors();
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { mkdir as mkdir8, open as open4, readFile as readFile8, readdir as readdir5, rename as rename4, rm as rm4, stat as stat4, writeFile as writeFile5 } from "node:fs/promises";
 import { dirname as dirname6 } from "node:path";
 function requireRemote(deps, path) {
@@ -15379,7 +16438,7 @@ function createTransferDeps(deps) {
     },
     async sha256Local(path) {
       const handle = await open4(path, "r");
-      const hash = createHash2("sha256");
+      const hash = createHash3("sha256");
       try {
         for await (const chunk of handle.createReadStream()) hash.update(chunk);
       } finally {
@@ -15495,9 +16554,9 @@ function createRecycleBinDeps(deps) {
     async readText(path) {
       return readFile8(path, "utf8");
     },
-    async writeText(path, text6) {
+    async writeText(path, text8) {
       await mkdir8(dirname6(path), { recursive: true });
-      await writeFile5(path, text6, "utf8");
+      await writeFile5(path, text8, "utf8");
     }
   };
   return {
@@ -15523,10 +16582,10 @@ function createRecycleBinDeps(deps) {
       const { backend, absolute } = resolveLocal(target, path);
       return (await backend.readText(absolute, deps.maxReadBytes)).text;
     },
-    async writeTextRemote(path, text6) {
+    async writeTextRemote(path, text8) {
       const target = deps.routed.resolve(path);
       const { backend, absolute } = resolveLocal(target, path);
-      await backend.writeText(absolute, text6, void 0);
+      await backend.writeText(absolute, text8, void 0);
     },
     moveRemote: remoteMove,
     removeRemote: remoteRemove,
@@ -15644,8 +16703,8 @@ function createBinRootResolver(deps) {
     return settle(root, choice);
   };
   async function migrateOldBin(root, choice) {
-    const note = (text6) => {
-      choice.note = choice.note === void 0 ? text6 : `${choice.note}\uFF1B${text6}`;
+    const note = (text8) => {
+      choice.note = choice.note === void 0 ? text8 : `${choice.note}\uFF1B${text8}`;
     };
     const candidates = [];
     for (const legacy of LEGACY_BIN_DIRS) {
@@ -15819,6 +16878,11 @@ function createTransferTracker(options) {
 }
 
 // src/wiring/roots.ts
+function pruneStaleLocks(locks, liveRootKeys) {
+  for (const key of [...locks.keys()]) {
+    if (!liveRootKeys.has(key)) locks.delete(key);
+  }
+}
 function wireRoots(env) {
   const { ctx, limits, profiles, transports, registry } = env;
   const binRootResolver = createBinRootResolver({
@@ -15907,6 +16971,7 @@ function wireRoots(env) {
   const transferTracker = createTransferTracker({ maxEntries: limits.transferHistoryEntries ?? 50 });
   const binLocks = /* @__PURE__ */ new Map();
   const binLockFor = (key) => {
+    pruneStaleLocks(binLocks, new Set(registry.records.map((record2) => rootKey(record2.root))));
     const existing = binLocks.get(key);
     if (existing !== void 0) return existing;
     let lockPath;
@@ -15915,7 +16980,7 @@ function wireRoots(env) {
       if (root === void 0) throw new Error("unknown root");
       lockPath = `${binRootResolver.binRootFor(root)}.lock`;
     } catch {
-      lockPath = `${limits.sessionBinRoot ?? join15(tmpdir2(), "dsh-over-ssh")}/recycle-bin-${createHash3("sha256").update(key).digest("hex").slice(0, 16)}.lock`;
+      lockPath = `${limits.sessionBinRoot ?? join16(tmpdir2(), "dsh-over-ssh")}/recycle-bin-${createHash4("sha256").update(key).digest("hex").slice(0, 16)}.lock`;
     }
     const created = createSessionBinLock({
       path: lockPath,
@@ -15956,7 +17021,7 @@ function wireRoots(env) {
 
 // src/wiring/tools.ts
 import { readFile as readFile10 } from "node:fs/promises";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 
 // src/host/integration/remote/remote-tool-backend.ts
 init_errors();
@@ -15991,8 +17056,10 @@ function toExecOutcome(result) {
 }
 function createRemoteToolBackend(deps) {
   const resolveSessionRoot = deps.resolveSessionRoot;
+  const resolveForConnection = deps.resolveRootForConnection;
   return {
     resolve: (cwd) => deps.resolveRoot(cwd),
+    ...resolveForConnection === void 0 ? {} : { resolveForConnection: (connectionId, cwd) => resolveForConnection(connectionId, cwd) },
     ...resolveSessionRoot === void 0 ? {} : { resolveSessionRoot },
     async grep(target, request, signal) {
       const transport = await deps.acquire(target.connectionId);
@@ -16076,12 +17143,14 @@ function createRemoteToolBackend(deps) {
     },
     async exec(target, request, signal) {
       const transport = await deps.acquire(target.connectionId);
+      const writeRoots = deps.execWriteRoots?.(target.connectionId, target.root);
       const result = await transport.exec(
         {
           script: request.command,
           cwd: joinUnderRoot(target.root, request.cwd),
           timeoutMs: request.timeoutMs,
           maxBytes: MAX_OUTPUT_BYTES,
+          ...writeRoots === void 0 ? {} : { writeRoots },
           // Audit 0052 P9: `env` is a *tool* parameter that already has a full transport path
           // (`ExecRequest.env` → `scriptPrefixes` for the shell transports, `compactParams` for the agent),
           // so the only missing link was this request construction. Conditionally spread because
@@ -16104,8 +17173,8 @@ function createSessionRootIndex(deps) {
   let generation = 0;
   const readEntries = async () => {
     try {
-      const text6 = await deps.readFile(deps.filePath, "utf8");
-      const parsed = parseUserRoots(text6);
+      const text8 = await deps.readFile(deps.filePath, "utf8");
+      const parsed = parseUserRoots(text8);
       return parsed.state.roots;
     } catch {
       return [];
@@ -16141,6 +17210,33 @@ function createSessionRootIndex(deps) {
   };
 }
 
+// src/host/integration/tools/mutation-guard.ts
+function mutationRefusal(what, context) {
+  const policy = context.policy;
+  if (policy === void 0) return void 0;
+  if (policy.mode === "read-only") {
+    return `\u5F53\u524D\u4F1A\u8BDD\u7684\u6C99\u7BB1\u6A21\u5F0F\u662F\u53EA\u8BFB\uFF08read-only\uFF09\uFF0C\u62D2\u7EDD\u5199\u5165\uFF1A${what}\u3002\u9700\u8981\u5199\u5165\u65F6\u5728\u5E73\u53F0\u91CC\u628A\u672C\u4F1A\u8BDD\u7684\u6A21\u5F0F\u6539\u4E3A workspace-write\uFF08\u6216\u5728\u5141\u8BB8\u7684\u573A\u666F\u4E0B\u7533\u8BF7\u5347\u7EA7\uFF09\u3002`;
+  }
+  if (policy.mode === "danger-full-access") return void 0;
+  const area = context.rootArea?.() ?? "deny";
+  if (area === "whole-root") return void 0;
+  return `\u5F53\u524D\u4F1A\u8BDD\u7684\u6C99\u7BB1\u6A21\u5F0F\u662F workspace-write\uFF0C\u800C\u8FD9\u4E2A\u6839\u4E0D\u662F\u672C\u4F1A\u8BDD\u7684 workspace\u3001\u4E5F\u4E0D\u662F\u672C\u4F1A\u8BDD\u7528\u300C\u6DFB\u52A0\u76EE\u5F55\u300D\u6DFB\u52A0\u7684\u76EE\u5F55\uFF1A${what}\u3002\u5148\u628A\u8BE5\u76EE\u5F55\u6DFB\u52A0\u5230\u4F1A\u8BDD\uFF0C\u6216\u6539\u7528\u4F1A\u8BDD\u81EA\u5DF1\u7684\u5DE5\u4F5C\u76EE\u5F55\u3002`;
+}
+
+// src/host/integration/tools/exec-write-roots.ts
+function execWriteRootsFor(input) {
+  const paths = /* @__PURE__ */ new Set([normalizeRemotePath(input.root)]);
+  for (const record2 of input.records) {
+    const candidate = record2.root;
+    if (candidate.location !== "remote") continue;
+    if (candidate.connectionId !== input.connectionId) continue;
+    if (candidate.writable === false) continue;
+    const area = workspaceWriteArea(candidate, void 0, input.cwd, input.identity);
+    if (area === "whole-root" || area === "workspace-only") paths.add(normalizeRemotePath(candidate.path));
+  }
+  return [...paths];
+}
+
 // src/host/integration/tools/remote-tools.ts
 import { defineTool as defineTool2 } from "@deepseek-ai/dsh-tools";
 
@@ -16165,6 +17261,12 @@ function resolveSessionTarget(exec, seams) {
 }
 
 // src/host/integration/tools/remote-tools.ts
+function readConnectionIds(record2) {
+  const raw = record2["connectionIds"];
+  if (!Array.isArray(raw)) return void 0;
+  const ids = [...new Set(raw.filter((item) => typeof item === "string" && item.trim() !== "").map((item) => item.trim()))];
+  return ids.length === 0 ? void 0 : ids;
+}
 function text2(value) {
   return [{ type: "text", text: value }];
 }
@@ -16303,7 +17405,7 @@ function remoteToolDefinitions(backend) {
     }),
     defineTool2({
       name: "remote_exec",
-      description: "Run one shell command on the remote host in the workspace this session is working in, and return its exit code, stdout and stderr. Output is bounded to 64 KiB per stream; when a stream is cut the result names that stream and, if the agent spilled it, the remote path holding the full text. Use this for remote builds, tests and version checks. Each call is a NEW shell: exported variables and `cd` do not carry over to the next call \u2014 pass `env` or put `source ... && cmd` in one command." + EXEC_SERIAL_NOTE,
+      description: "Run one shell command on the remote host in the workspace this session is working in, and return its exit code, stdout and stderr. **A shell command is not confined by \u300C\u6DFB\u52A0\u76EE\u5F55\u300D**: it runs with the SSH user's own permissions, so it can read and write anything that user can, not only the directories added to this conversation. (A deployment that sets `limits.execWriteFence` puts a Landlock write fence around the workspace root and the directories this session added; the tool report says when that fence is active.) Output is bounded to 64 KiB per stream; when a stream is cut the result names that stream and, if the agent spilled it, the remote path holding the full text. Use this for remote builds, tests and version checks. Each call is a NEW shell: exported variables and `cd` do not carry over to the next call \u2014 pass `env` or put `source ... && cmd` in one command." + EXEC_SERIAL_NOTE,
       parameters: {
         command: { type: "string", description: "Shell command to run on the remote host.", required: true },
         cwd: {
@@ -16318,6 +17420,11 @@ function remoteToolDefinitions(backend) {
         timeoutMs: {
           type: "number",
           description: "Cooperative timeout budget in milliseconds (default 30000, hard cap 300000). When it expires the plugin stops waiting and abandons the call; the result then reports `timedOut: true`. It does not by itself prove the remote process was killed."
+        },
+        connectionIds: {
+          type: "array",
+          items: { type: "string" },
+          description: 'Batch mode: run the same command on **each** of these connections instead of the session\'s own root, in parallel, and return per-connection results. Omit for the normal single-host call. Each connection resolves to the root that covers the session cwd (same longest-match rule as the single-host path); a connection with no covering root gets its own `error` entry and the others still run. Use this for "is it the same on every host" checks \u2014 a shell command is **not** idempotent, so do not use it to fan out a mutating command you cannot afford to run twice.'
         }
       },
       output: {
@@ -16325,22 +17432,43 @@ function remoteToolDefinitions(backend) {
           type: "object",
           additionalProperties: false,
           properties: {
-            exitCode: { type: "integer", required: true },
+            batch: {
+              type: "boolean",
+              description: "Present and true when `connectionIds` was used; the per-host answers are in `results`."
+            },
+            results: {
+              type: "array",
+              description: "Batch mode only: one entry per requested connection, in the order asked.",
+              items: {
+                type: "object",
+                additionalProperties: false,
+                properties: {
+                  connectionId: { type: "string", required: true },
+                  error: { type: "string", description: "Why this host could not run (unknown connection, no covering root, transport failure)." },
+                  exitCode: { type: "integer" },
+                  timedOut: { type: "boolean" },
+                  stdout: { type: "string" },
+                  stderr: { type: "string" },
+                  durationMs: { type: "integer" },
+                  truncated: { type: "boolean" }
+                }
+              }
+            },
+            exitCode: { type: "integer" },
             signal: {
               type: "string",
               description: "The signal that ended the command (e.g. `SIGKILL`, `timeout`). Absent when it exited on its own \u2014 this is how `exitCode = -1` becomes readable."
             },
             timedOut: {
               type: "boolean",
-              required: true,
               description: "Whether this plugin stopped waiting because the timeout budget expired. True does not prove the remote process died; false does not rule out a signal (see `signal`)."
             },
-            stdout: { type: "string", required: true },
-            stderr: { type: "string", required: true },
-            durationMs: { type: "integer", required: true },
-            truncated: { type: "boolean", required: true },
-            stdoutTruncated: { type: "boolean", required: true },
-            stderrTruncated: { type: "boolean", required: true },
+            stdout: { type: "string" },
+            stderr: { type: "string" },
+            durationMs: { type: "integer" },
+            truncated: { type: "boolean" },
+            stdoutTruncated: { type: "boolean" },
+            stderrTruncated: { type: "boolean" },
             stdoutSpillPath: { type: "string" },
             stderrSpillPath: { type: "string" },
             cwdFailure: { type: "string" },
@@ -16351,11 +17479,46 @@ function remoteToolDefinitions(backend) {
             hint: { type: "string", description: "Explanation for `remoteMayStillRun`, when present." }
           }
         },
-        render: (_args, value) => text2(formatExec(value))
+        render: (_args, value) => text2(formatExecOrBatch(value))
       },
       async execute(args, exec) {
         const parsed = parseExecArgs(args);
         if ("error" in parsed) throw new Error(parsed.error);
+        const batchIds = readConnectionIds(args ?? {});
+        if (batchIds !== void 0) {
+          if (backend.resolveForConnection === void 0) {
+            throw new Error("\u8FD9\u4E2A\u7EC4\u5408\u4E0D\u652F\u6301\u6279\u91CF\u591A\u673A\uFF08\u7F3A\u5C11\u6309\u8FDE\u63A5\u89E3\u6790\u8FDC\u7AEF\u6839\u7684\u80FD\u529B\uFF09");
+          }
+          const sessionCwd = exec.agent?.session.header.cwd;
+          if (sessionCwd === void 0 || sessionCwd === "") {
+            throw new Error("\u6279\u91CF\u591A\u673A\u9700\u8981 agent \u7684\u4F1A\u8BDD\u5DE5\u4F5C\u76EE\u5F55\uFF0C\u7528\u6765\u5B9A\u4F4D\u6BCF\u4E2A\u8FDE\u63A5\u4E0A\u7684\u6839");
+          }
+          const resolveFor = backend.resolveForConnection.bind(backend);
+          const results = await Promise.all(
+            batchIds.map(async (connectionId) => {
+              const target2 = resolveFor(connectionId, sessionCwd);
+              if (target2 === void 0) {
+                return { connectionId, error: `\u8BE5\u8FDE\u63A5\u4E0A\u6CA1\u6709\u8986\u76D6\u5F53\u524D\u5DE5\u4F5C\u76EE\u5F55 ${sessionCwd} \u7684\u8FDC\u7AEF\u6839` };
+              }
+              try {
+                const outcome2 = await backend.exec(target2, { ...parsed, cwd: resolveOrThrow(target2, parsed.cwd) }, exec.signal);
+                const flags2 = readExecTruncation(outcome2);
+                return {
+                  connectionId,
+                  exitCode: outcome2.exitCode,
+                  timedOut: outcome2.timedOut === true,
+                  stdout: outcome2.stdout,
+                  stderr: outcome2.stderr,
+                  durationMs: outcome2.durationMs,
+                  truncated: flags2.truncated
+                };
+              } catch (error) {
+                return { connectionId, error: error instanceof Error ? error.message : String(error) };
+              }
+            })
+          );
+          return { batch: true, results };
+        }
         const target = targetFor(backend, exec);
         const cwd = resolveOrThrow(target, parsed.cwd);
         const requestedCwd = parsed.cwd !== void 0;
@@ -16403,10 +17566,10 @@ function globHint(pattern, matchCount) {
   const rule = anchored ? "\u542B `/` \u7684\u6A21\u5F0F\u951A\u5B9A\u5728\u4F60\u7ED9\u7684\u76EE\u5F55\u4E0A\uFF0C`*` \u4E0D\u8DE8\u5C42\u2014\u2014\u8981\u8DE8\u5C42\u8BF7\u7528 `**`" : "\u4E0D\u542B `/` \u7684\u6A21\u5F0F\u53EA\u5339\u914D\u6587\u4EF6\u540D\uFF08\u4EFB\u610F\u5C42\u7EA7\uFF09\uFF0C\u4E0D\u662F\u8DEF\u5F84\u5B50\u4E32\u2014\u2014\u8981\u8DE8\u5C42\u8BF7\u7528 `**` \u6216\u5E26\u4E0A\u76EE\u5F55";
   return `0 \u6761\u7ED3\u679C\uFF1A\u6309 glob ${JSON.stringify(pattern)} \u6CA1\u6709\u5339\u914D\u5230\u8DEF\u5F84\u3002${rule}\u3002\u8FD4\u56DE\u7684\u8DEF\u5F84\u76F8\u5BF9\u679A\u4E3E\u76EE\u5F55\u3001\u4E0D\u5E26\u524D\u5BFC \`/\`\uFF1B\u6A21\u5F0F\u533A\u5206\u5927\u5C0F\u5199\u3002`;
 }
-function cwdFailureHint(cwd, text6, failed, requested) {
+function cwdFailureHint(cwd, text8, failed, requested) {
   if (!requested || !failed) return void 0;
-  const forkExecShaped = /fork\/exec\s+\S*sh\b[^\n]*no such file or directory/i.test(text6);
-  const cdShaped = /\bcd:\s[^\n]*(no such file or directory|not a directory|permission denied)|can't cd to/i.test(text6);
+  const forkExecShaped = /fork\/exec\s+\S*sh\b[^\n]*no such file or directory/i.test(text8);
+  const cdShaped = /\bcd:\s[^\n]*(no such file or directory|not a directory|permission denied)|can't cd to/i.test(text8);
   if (!forkExecShaped && !cdShaped) return void 0;
   const detail = forkExecShaped ? "\u8FDC\u7AEF\u62A5\u7684\u662F fork/exec \u2026/sh: no such file or directory \u2014\u2014 \u8FD9\u6761\u62A5\u9519\u6307\u5411 shell\uFF0C\u4F46\u771F\u6B63\u7684\u539F\u56E0\u51E0\u4E4E\u603B\u662F\u5DE5\u4F5C\u76EE\u5F55\u65E0\u6548\uFF08cwd \u65E0\u6548\u65F6 fork/exec \u5728 chdir \u9636\u6BB5\u5C31\u5931\u8D25\u4E86\uFF09\u3002" : "\u8FDC\u7AEF shell \u7684 cd \u5931\u8D25\u3002";
   return `cwd \u4E0D\u5B58\u5728\u6216\u4E0D\u53EF\u8FDB\u5165\uFF1A${cwd}\u3002${detail}\u8BF7\u5148\u7528 remote_glob \u6216 remote_exec \u786E\u8BA4\u8BE5\u76EE\u5F55\u5B58\u5728\u3002`;
@@ -16457,6 +17620,26 @@ ${hint2}`;
 ${hint}`;
   return `${outcome.paths.join("\n")}${semantics}${suffix}${note}`;
 }
+function formatExecOrBatch(value) {
+  if (value["batch"] === true && Array.isArray(value["results"])) {
+    const lines = [];
+    for (const raw of value["results"]) {
+      const connectionId = String(raw["connectionId"] ?? "?");
+      if (typeof raw["error"] === "string") {
+        lines.push(`${connectionId}: \u5931\u8D25 \u2014 ${raw["error"]}`);
+        continue;
+      }
+      const verdict = raw["timedOut"] === true ? "timeout" : `exit ${String(raw["exitCode"])}`;
+      lines.push(`${connectionId}: ${verdict}`);
+      const stdout = typeof raw["stdout"] === "string" ? raw["stdout"] : "";
+      if (stdout !== "") lines.push(...stdout.split("\n").map((line) => `  ${line}`));
+      const stderr = typeof raw["stderr"] === "string" ? raw["stderr"] : "";
+      if (stderr !== "") lines.push("  [stderr]", ...stderr.split("\n").map((line) => `  ${line}`));
+    }
+    return lines.join("\n");
+  }
+  return formatExec(value);
+}
 function formatExec(outcome) {
   const stdout = boundOutput(outcome.stdout);
   const stderr = boundOutput(outcome.stderr, MAX_OUTPUT_BYTES, "tail");
@@ -16590,7 +17773,7 @@ function toOutputView(output) {
     timedOut: output.timedOut
   };
 }
-function defaultSleep(ms, signal) {
+function defaultSleep2(ms, signal) {
   return new Promise((resolve3, reject) => {
     if (signal?.aborted === true) {
       reject(new SshDevError("CANCELLED", "\u7B49\u5F85\u540E\u53F0\u4F5C\u4E1A\u65F6\u88AB\u53D6\u6D88", {}));
@@ -16610,7 +17793,7 @@ function defaultSleep(ms, signal) {
 function createRemoteJobBackend(deps) {
   const pollIntervalMs = Math.max(1, Math.floor(deps.pollIntervalMs ?? DEFAULT_JOB_POLL_MS));
   const now = deps.now ?? (() => Date.now());
-  const sleep2 = deps.sleep ?? defaultSleep;
+  const sleep2 = deps.sleep ?? defaultSleep2;
   const require2 = async (target) => {
     const transport = await deps.acquire(target.connectionId);
     if (!isAgentJobCapable(transport)) throw unsupported(target.connectionId);
@@ -16625,10 +17808,12 @@ function createRemoteJobBackend(deps) {
     ...deps.resolveSessionRoot === void 0 ? {} : { resolveSessionRoot: deps.resolveSessionRoot },
     async start(target, request, signal) {
       const transport = await require2(target);
+      const writeRoots = deps.execWriteRoots?.(target.connectionId, target.root);
       const started = await transport.procStart(
         {
           script: request.command,
           cwd: request.cwd,
+          ...writeRoots === void 0 ? {} : { writeRoots },
           ...request.env === void 0 ? {} : { env: request.env },
           // `undefined` is **omitted**, not defaulted: the agent's own rule is "0 or absent means no limit",
           // and sending a default here would silently impose a deadline on a long build.
@@ -16696,7 +17881,7 @@ function targetFor2(backend, exec) {
   return resolveSessionTarget(exec, { resolve: (cwd) => backend.resolve(cwd), resolveSessionRoot: backend.resolveSessionRoot });
 }
 var PATH_SPELLING2 = "Accepts an absolute remote path inside the workspace root, or a path relative to the root. An absolute path outside the root is refused. `..` folds but never leaves the root.";
-var JOB_LIFETIME_NOTE = " Background jobs live inside this connection only: the remote agent kills every one of them when the ssh channel closes, so a job is not durable and does not survive a reconnect.";
+var JOB_LIFETIME_NOTE = " Job lifetime depends on the transport, and the difference matters for long builds. **Tier 2 (the default) runs a resident daemon**: jobs belong to the *session*, not to the ssh channel, so a dropped connection does **not** kill a running job \u2014 reconnect and read it again with the same `jobId` and `offset`. **Tier 1 (pure POSIX) and `--stdio` mode** tie jobs to the connection: closing the channel kills them. A resident daemon is reclaimed only when it goes idle for its timeout or the process stops, and that reclaim kills its jobs \u2014 so do not rely on a job surviving a long idle gap.";
 var JOB_POLL_NOTE = " Nothing is pushed: progress is observed by calling this tool, not by waiting for a notification.";
 var JOB_DROP_NOTE = " A job keeps a bounded ring of its output that drops the OLDEST bytes; the dropped amount is reported in **bytes**, not lines, and there is no spill file to recover them from.";
 function formatJobLine(job) {
@@ -16944,6 +18129,10 @@ function remoteJobToolDefinitions(backend) {
           type: "number",
           description: "`output` only: byte offset to start at (0-based, default 0). Pass the previous result's `nextOffset` to get only what is new."
         },
+        follow: {
+          type: "boolean",
+          description: "`output` only: return as soon as **new output arrives** (a tail), instead of waiting for the job to finish. Polls internally until `offset` grows, the job exits, or `timeoutMs` expires; the answer says which happened via `running` / `timedOut`. Use this to watch a build progress step by step: keep passing the previous `nextOffset`."
+        },
         wait: {
           type: "boolean",
           description: "`output` only: block until the job finishes or the timeout expires; a timed-out wait leaves the job running. Defaults to false."
@@ -17051,7 +18240,13 @@ function remoteJobToolDefinitions(backend) {
           }
           const offset = rawOffset === void 0 ? 0 : Math.floor(rawOffset);
           const waited = record2["wait"] === true;
+          const follow = record2["follow"] === true;
           let waitedMs = 0;
+          if (follow) {
+            const timeoutMs = clampInt2(record2["timeoutMs"], DEFAULT_JOB_WAIT_MS, 1, MAX_JOB_WAIT_MS);
+            const followed = await followOutput(backend, target, jobId, offset, timeoutMs, exec.signal);
+            return { action: "output", ...followed.value, summary: formatJobOutput(followed.value) };
+          }
           if (waited) {
             const timeoutMs = clampInt2(record2["timeoutMs"], DEFAULT_JOB_WAIT_MS, 1, MAX_JOB_WAIT_MS);
             const settled = await backend.waitFor(target, jobId, timeoutMs, exec.signal);
@@ -17080,6 +18275,71 @@ function remoteJobToolDefinitions(backend) {
     })
   ];
 }
+var FOLLOW_POLL_MS = 250;
+async function followOutput(backend, target, jobId, offset, timeoutMs, signal) {
+  const started = Date.now();
+  for (; ; ) {
+    const view = await backend.output(target, jobId, offset, signal);
+    const grew = view.nextOffset > offset;
+    const running = view.state === "running";
+    if (grew || !running) {
+      return {
+        value: {
+          jobId: view.id,
+          state: view.state,
+          data: view.data,
+          nextOffset: view.nextOffset,
+          droppedBytes: view.droppedBytes,
+          totalBytes: view.totalBytes,
+          lost: view.lost,
+          exitCode: view.exitCode,
+          ...view.signal === void 0 ? {} : { signal: view.signal },
+          timedOut: false,
+          running,
+          waitedMs: Date.now() - started,
+          waited: false,
+          followed: true
+        }
+      };
+    }
+    if (Date.now() - started >= timeoutMs) {
+      return {
+        value: {
+          jobId: view.id,
+          state: view.state,
+          data: view.data,
+          nextOffset: view.nextOffset,
+          droppedBytes: view.droppedBytes,
+          totalBytes: view.totalBytes,
+          lost: view.lost,
+          exitCode: view.exitCode,
+          ...view.signal === void 0 ? {} : { signal: view.signal },
+          timedOut: true,
+          running: true,
+          waitedMs: Date.now() - started,
+          waited: false,
+          followed: true
+        }
+      };
+    }
+    if (signal.aborted) throw new SshDevError("CANCELLED", "\u8DDF\u968F\u8F93\u51FA\u5DF2\u53D6\u6D88", { jobId });
+    await followWait(signal);
+  }
+}
+function followWait(signal, ms = FOLLOW_POLL_MS) {
+  if (signal.aborted) return Promise.resolve();
+  return new Promise((resolve3) => {
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve3();
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve3();
+    }, ms);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
 function resolveOrThrow2(target, path) {
   const resolved = resolveUnderRoot(target.root, path ?? "", void 0, target.connectionId);
   if (typeof resolved === "string") return resolved;
@@ -17134,8 +18394,8 @@ function createRemoteFileBackend(deps) {
       rememberVersion(target, absolute, chunk.version);
       return { text: chunk.text, size: chunk.size, truncated: chunk.truncated, version: chunk.version };
     },
-    async write(target, absolute, text6, expectedVersion, signal) {
-      const outcome = await requireBackend(target).writeText(absolute, text6, expectedVersion, signal);
+    async write(target, absolute, text8, expectedVersion, signal) {
+      const outcome = await requireBackend(target).writeText(absolute, text8, expectedVersion, signal);
       rememberVersion(target, absolute, outcome.version);
       return { bytes: outcome.bytes, version: outcome.version };
     },
@@ -17213,7 +18473,8 @@ function resolveOrThrow3(target, path) {
   if (typeof resolved === "string") return resolved;
   throw new Error(resolved.error);
 }
-function assertWritable(target, path) {
+function assertWritable(target, path, allow) {
+  allow?.(target);
   if (target.writable) return;
   throw new Error(`\u8BE5\u6839\u88AB\u6CE8\u518C\u4E3A\u53EA\u8BFB\uFF1A\u62D2\u7EDD\u5199\u5165 ${path}\uFF08\u6839\uFF1A${target.root}\uFF09`);
 }
@@ -17227,14 +18488,24 @@ function truncateLine(line, maxLineLength) {
 function buildLineWindow(source, request) {
   const offset = Math.max(1, Math.floor(request.offset));
   const limit = Math.max(1, Math.floor(request.limit));
-  const raw = source.split("\n");
-  const lines = raw.length > 0 && raw[raw.length - 1] === "" ? raw.slice(0, -1) : raw;
-  const totalLines = lines.length;
   const selected = [];
-  for (let index = offset - 1; index < totalLines && selected.length < limit; index++) {
-    selected.push({ number: index + 1, text: truncateLine(stripCarriageReturn(lines[index] ?? ""), request.maxLineLength) });
+  let lineNumber = 0;
+  let start = 0;
+  for (; ; ) {
+    const newline = source.indexOf("\n", start);
+    const end = newline === -1 ? source.length : newline;
+    if (newline === -1 && end === start) break;
+    lineNumber += 1;
+    if (lineNumber >= offset && selected.length < limit) {
+      selected.push({
+        number: lineNumber,
+        text: truncateLine(stripCarriageReturn(source.slice(start, end)), request.maxLineLength)
+      });
+    }
+    if (newline === -1) break;
+    start = newline + 1;
   }
-  return { lines: selected, totalLines };
+  return { lines: selected, totalLines: lineNumber };
 }
 function formatRead(view) {
   const endLine = view.lines.at(-1)?.number ?? Math.max(0, view.offset - 1);
@@ -17302,7 +18573,7 @@ function clampInt3(value, fallback, min, max) {
   if (number < min) return min;
   return Math.min(number, max);
 }
-function remoteFileToolDefinitions(backend) {
+function remoteFileToolDefinitions(backend, allowMutation) {
   return [
     defineTool4({
       name: "remote_read",
@@ -17436,7 +18707,7 @@ function remoteFileToolDefinitions(backend) {
         if ("error" in parsedMode) throw new Error(parsedMode.error);
         const target = targetFor3(backend, exec);
         const path = resolveOrThrow3(target, requested);
-        assertWritable(target, path);
+        assertWritable(target, path, allowMutation);
         let effective = expected ?? backend.recall(target, path);
         if (effective === void 0 && record2["force"] !== true) {
           const info = await backend.stat(target, path, exec.signal);
@@ -17510,7 +18781,7 @@ function remoteFileToolDefinitions(backend) {
         }
         const target = targetFor3(backend, exec);
         const path = resolveOrThrow3(target, requested);
-        assertWritable(target, path);
+        assertWritable(target, path, allowMutation);
         const effective = expected ?? backend.recall(target, path);
         const fast = await backend.edit?.(target, path, old, replacement, all, effective, exec.signal);
         if (fast !== void 0) {
@@ -17585,7 +18856,7 @@ function remoteFileToolDefinitions(backend) {
         }
         const target = targetFor3(backend, exec);
         const path = resolveOrThrow3(target, requested);
-        assertWritable(target, path);
+        assertWritable(target, path, allowMutation);
         const effective = expected ?? backend.recall(target, path);
         const outcome = await backend.patch(target, path, diff, effective, exec.signal);
         return { path, hunks: outcome.hunks, bytes: outcome.bytes, version: outcome.version };
@@ -17622,7 +18893,7 @@ function remoteFileToolDefinitions(backend) {
         const from = resolveOrThrow3(target, rawFrom);
         const to = resolveOrThrow3(target, rawTo);
         if (from === to) throw new Error(`\u6E90\u4E0E\u76EE\u6807\u662F\u540C\u4E00\u4E2A\u8DEF\u5F84\uFF1A${from}`);
-        assertWritable(target, to);
+        assertWritable(target, to, allowMutation);
         const createParents = record2["createParents"] !== false;
         await backend.move(target, from, to, createParents, exec.signal);
         return { from, to, createParents };
@@ -17672,8 +18943,8 @@ function remoteFileToolDefinitions(backend) {
     })
   ];
 }
-function registerRemoteFileTools(ctx, backend) {
-  const disposers = remoteFileToolDefinitions(backend).map((definition) => ctx.tools.register(definition));
+function registerRemoteFileTools(ctx, backend, options) {
+  const disposers = remoteFileToolDefinitions(backend, options?.allowMutation).map((definition) => ctx.tools.register(definition));
   return () => {
     for (const dispose of disposers.splice(0)) dispose();
   };
@@ -17822,14 +19093,14 @@ var LspSession = class _LspSession {
   #sentText = /* @__PURE__ */ new Map();
   #sentTextBytes = 0;
   static #SENT_TEXT_BUDGET_BYTES = 16 * 1024 * 1024;
-  #rememberSentText(uri, text6) {
+  #rememberSentText(uri, text8) {
     const previous = this.#sentText.get(uri);
     if (previous !== void 0) {
       this.#sentTextBytes -= previous.length;
       this.#sentText.delete(uri);
     }
-    this.#sentText.set(uri, text6);
-    this.#sentTextBytes += text6.length;
+    this.#sentText.set(uri, text8);
+    this.#sentTextBytes += text8.length;
     while (this.#sentTextBytes > _LspSession.#SENT_TEXT_BUDGET_BYTES && this.#sentText.size > 1) {
       const oldest = this.#sentText.keys().next();
       if (oldest.done === true) break;
@@ -17910,11 +19181,11 @@ var LspSession = class _LspSession {
    * than an error — "no diagnostics" and "did not answer" look the same to a caller that only wants to
    * know whether the file is clean.
    */
-  async diagnostics(uri, text6, signal, timeoutMs = DEFAULT_REQUEST_TIMEOUT_MS) {
-    const unchanged = this.#sentText.get(uri) === text6;
+  async diagnostics(uri, text8, signal, timeoutMs = DEFAULT_REQUEST_TIMEOUT_MS) {
+    const unchanged = this.#sentText.get(uri) === text8;
     const cached2 = this.#diagnostics.get(uri);
     if (unchanged && cached2 !== void 0) return { diagnostics: cached2, answered: true };
-    this.openDocument(uri, text6);
+    this.openDocument(uri, text8);
     this.#diagnostics.delete(uri);
     const answered = await this.#waitForDiagnostics(uri, signal, timeoutMs);
     return { diagnostics: this.#diagnostics.get(uri) ?? [], answered };
@@ -17925,16 +19196,16 @@ var LspSession = class _LspSession {
    * Position-based queries (`hover`, `definition`) need this first: a server answers about documents it
    * knows, and an unopened file gets an empty result rather than an error — which reads as "no symbol here".
    */
-  openDocument(uri, text6) {
-    if (this.#sentText.get(uri) === text6) return;
+  openDocument(uri, text8) {
+    if (this.#sentText.get(uri) === text8) return;
     if (this.#opened.has(uri)) {
-      this.notify("textDocument/didChange", { textDocument: { uri, version: this.#nextVersion(uri) }, contentChanges: [{ text: text6 }] });
-      this.#rememberSentText(uri, text6);
+      this.notify("textDocument/didChange", { textDocument: { uri, version: this.#nextVersion(uri) }, contentChanges: [{ text: text8 }] });
+      this.#rememberSentText(uri, text8);
       return;
     }
-    this.notify("textDocument/didOpen", { textDocument: { uri, languageId: this.#languageId(uri), version: 1, text: text6 } });
+    this.notify("textDocument/didOpen", { textDocument: { uri, languageId: this.#languageId(uri), version: 1, text: text8 } });
     this.#opened.add(uri);
-    this.#rememberSentText(uri, text6);
+    this.#rememberSentText(uri, text8);
   }
   /** Diagnostics already received for a URI, without asking again. */
   cachedDiagnostics(uri) {
@@ -18142,8 +19413,8 @@ var LspSession = class _LspSession {
     }
     if (method === "window/logMessage" || method === "window/showMessage") {
       const record2 = asRecord3(params);
-      const text6 = typeof record2?.["message"] === "string" ? record2["message"] : "";
-      if (text6 !== "") this.#options.onLog?.(text6);
+      const text8 = typeof record2?.["message"] === "string" ? record2["message"] : "";
+      if (text8 !== "") this.#options.onLog?.(text8);
     }
   }
   /**
@@ -18453,8 +19724,535 @@ ${describeInstalled(available)}`);
   };
 }
 
-// src/host/integration/tools/remote-lsp-tools.ts
+// src/host/integration/tools/forward-tools.ts
+init_errors();
 import { defineTool as defineTool5 } from "@deepseek-ai/dsh-tools";
+function createForwardToolBackend(acquire) {
+  const records = /* @__PURE__ */ new Map();
+  let sequence2 = 0;
+  return {
+    async start(connectionId, request, signal) {
+      const transport = await acquire(connectionId);
+      if (transport.forward === void 0) {
+        throw new SshDevError(
+          "REMOTE_UNSUPPORTED",
+          `\u8FDE\u63A5 ${connectionId} \u4E0D\u652F\u6301\u7AEF\u53E3\u8F6C\u53D1\uFF08\u8BE5\u4F20\u8F93\u6CA1\u6709\u5B9E\u73B0 forward\uFF1B\u7CFB\u7EDF ssh \u7684 Tier 1/\u9ED8\u8BA4 Tier 2 \u652F\u6301\uFF0Cssh2 \u4F20\u8F93\u4E0D\u652F\u6301\uFF09`,
+          { connectionId }
+        );
+      }
+      const handle = await transport.forward(request, signal);
+      sequence2 += 1;
+      const id = `fwd-${String(sequence2)}`;
+      records.set(id, {
+        record: {
+          id,
+          connectionId,
+          localPort: handle.localPort,
+          remoteHost: handle.remoteHost,
+          remotePort: handle.remotePort
+        },
+        handle
+      });
+      handle.onClosed?.(() => {
+        records.delete(id);
+      });
+      return handle;
+    },
+    async stop(forwardId) {
+      const entry = records.get(forwardId);
+      if (entry === void 0) return false;
+      records.delete(forwardId);
+      await entry.handle.close();
+      return true;
+    },
+    list: () => [...records.values()].map((entry) => entry.record),
+    async closeAll() {
+      const entries = [...records.values()];
+      records.clear();
+      await Promise.all(entries.map((entry) => entry.handle.close().catch(() => void 0)));
+    }
+  };
+}
+function formatResult(value) {
+  if (Array.isArray(value["forwards"])) {
+    const forwards = value["forwards"];
+    if (forwards.length === 0) return "\u5F53\u524D\u6CA1\u6709\u8F6C\u53D1\u3002";
+    return forwards.map((forward) => `${forward.id}  http://127.0.0.1:${String(forward.localPort)} -> ${forward.remoteHost}:${String(forward.remotePort)}  (${forward.connectionId})`).join("\n");
+  }
+  if (typeof value["localPort"] === "number") {
+    return `\u5DF2\u8F6C\u53D1\uFF1Ahttp://127.0.0.1:${String(value["localPort"])} -> ${String(value["remoteHost"])}:${String(value["remotePort"])}\uFF08id ${String(value["forwardId"])}\uFF0C\u7528\u5B8C\u8BF7 stop\uFF09`;
+  }
+  return String(value["summary"] ?? "");
+}
+function text5(value) {
+  return [{ type: "text", text: value }];
+}
+function remoteForwardDefinition(backend) {
+  return defineTool5({
+    name: "remote_forward",
+    description: "Forward one remote TCP port to a local one, so a service the agent started on the remote host becomes reachable from this machine (and from the DSH browser sidebar). Typical use: start a dev server with `remote_exec_background`, then `remote_forward` its port and open the returned `http://127.0.0.1:<port>` URL. The local listener binds **127.0.0.1 only** \u2014 never the LAN; open it up via the host sshd's `GatewayPorts` if that is really what you want. `start` returns the real local port (auto-picked when omitted) plus a `forwardId`; `list` shows what is live; `stop` closes one and is idempotent. Forwards live as long as the connection and are closed automatically when the plugin unloads, so a forgotten one does not leak a port forever \u2014 but stop the ones you are done with.",
+    parameters: {
+      action: {
+        type: "string",
+        enum: ["start", "stop", "list"],
+        description: "`start` opens a forward, `stop` closes one, `list` shows the live ones.",
+        required: true
+      },
+      connectionId: { type: "string", description: "`start` only: which configured connection to forward through." },
+      remoteHost: {
+        type: "string",
+        description: "`start` only: the host to connect to **from the remote side** (`localhost` means the remote host itself, which is the common case). IPv6 must be bracketed, e.g. `[::1]`."
+      },
+      remotePort: { type: "integer", description: "`start` only: the port on that remote host (1..65535)." },
+      localPort: { type: "integer", description: "`start` only: requested local port; omit to let the system pick a free one." },
+      forwardId: { type: "string", description: "`stop` only: the id returned by `start`." }
+    },
+    output: {
+      schema: {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+          action: { type: "string", required: true },
+          forwardId: { type: "string" },
+          localPort: { type: "integer" },
+          remoteHost: { type: "string" },
+          remotePort: { type: "integer" },
+          connectionId: { type: "string" },
+          stopped: { type: "boolean", description: "`stop`: whether a forward was actually closed (false = already gone)." },
+          forwards: {
+            type: "array",
+            description: "`list` only.",
+            items: {
+              type: "object",
+              additionalProperties: false,
+              properties: {
+                id: { type: "string", required: true },
+                connectionId: { type: "string", required: true },
+                localPort: { type: "integer", required: true },
+                remoteHost: { type: "string", required: true },
+                remotePort: { type: "integer", required: true }
+              }
+            }
+          },
+          summary: { type: "string", required: true }
+        }
+      },
+      render: (_args, value) => text5(formatResult(value))
+    },
+    async execute(args, exec) {
+      const record2 = args ?? {};
+      const action = record2["action"];
+      if (action === "list") {
+        const forwards = backend.list();
+        return { action, forwards: [...forwards], summary: formatResult({ forwards }) };
+      }
+      if (action === "stop") {
+        const forwardId = typeof record2["forwardId"] === "string" ? record2["forwardId"] : "";
+        if (forwardId === "") throw new Error("stop \u9700\u8981 forwardId");
+        const stopped = await backend.stop(forwardId);
+        return {
+          action,
+          stopped,
+          summary: stopped ? `\u5DF2\u5173\u95ED ${forwardId}\u3002` : `${forwardId} \u5DF2\u7ECF\u4E0D\u5B58\u5728\uFF08stop \u662F\u5E42\u7B49\u7684\uFF09\u3002`
+        };
+      }
+      if (action !== "start") throw new Error("action \u5FC5\u987B\u662F start / stop / list");
+      const connectionId = typeof record2["connectionId"] === "string" ? record2["connectionId"] : "";
+      if (connectionId === "") throw new Error("start \u9700\u8981 connectionId");
+      const remoteHost = typeof record2["remoteHost"] === "string" ? record2["remoteHost"] : "localhost";
+      const remotePort = record2["remotePort"];
+      if (typeof remotePort !== "number" || !Number.isInteger(remotePort)) throw new Error("remotePort \u5FC5\u987B\u662F\u6574\u6570");
+      const localPort = record2["localPort"];
+      const handle = await backend.start(
+        connectionId,
+        {
+          remoteHost,
+          remotePort,
+          ...typeof localPort === "number" && Number.isInteger(localPort) ? { localPort } : {}
+        },
+        exec.signal
+      );
+      const created = backend.list().find((entry) => entry.localPort === handle.localPort && entry.connectionId === connectionId);
+      const value = {
+        action,
+        ...created === void 0 ? {} : { forwardId: created.id },
+        localPort: handle.localPort,
+        remoteHost: handle.remoteHost,
+        remotePort: handle.remotePort,
+        connectionId
+      };
+      return { ...value, summary: formatResult(value) };
+    }
+  });
+}
+function registerRemoteForwardTool(ctx, backend) {
+  return ctx.tools.register(remoteForwardDefinition(backend));
+}
+
+// src/host/integration/tools/remote-git-tools.ts
+init_shell();
+import { defineTool as defineTool6 } from "@deepseek-ai/dsh-tools";
+var READ_ACTIONS = ["status", "diff", "log", "show", "branch"];
+var WRITE_ACTIONS = ["add", "commit", "checkout", "restore", "stash"];
+var ACTIONS = [...READ_ACTIONS, ...WRITE_ACTIONS];
+var GIT_ENV = {
+  // 缺凭据时立刻失败。没有这一条，`git pull` 能挂到超时，而 agent 会以为是网络慢。
+  GIT_TERMINAL_PROMPT: "0",
+  GIT_ASKPASS: "echo",
+  // 分页器在非 TTY 下本应自动关闭，但用户的 `core.pager` 配置可能强制打开。
+  GIT_PAGER: "cat",
+  // 输出不随用户的 locale 变（`git status` 的文案会被翻译，parsed 会全错）。
+  LC_ALL: "C",
+  // `-z` 之外的中文文件名：不转义成 `\346\226\207`，否则路径对不上 root 内的真实文件。
+  GIT_CONFIG_PARAMETERS: "'core.quotepath=false'"
+};
+var MAX_LINES_DEFAULT = 400;
+var DEFAULT_TIMEOUT_MS3 = 6e4;
+var PORCELAIN_CODE = /^[ MADRCUT?!][ MADRCUT?!]$/;
+function capLines(text8, maxLines) {
+  if (maxLines <= 0) return { text: "", truncated: text8.length > 0 };
+  const lines = text8.split("\n");
+  if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+  if (lines.length <= maxLines) return { text: lines.join("\n"), truncated: false };
+  return { text: lines.slice(0, maxLines).join("\n"), truncated: true };
+}
+function parseStatus(stdout) {
+  const entries = [];
+  let branch;
+  for (const rawLine of stdout.split("\n")) {
+    const line = rawLine.replace(/\r$/, "");
+    if (line === "") continue;
+    if (line.startsWith("## ")) {
+      branch = parseBranchHeader(line.slice(3));
+      continue;
+    }
+    if (line.length < 3) continue;
+    const code = line.slice(0, 2);
+    if (!PORCELAIN_CODE.test(code)) continue;
+    const rest = line.slice(3);
+    if (code.includes("R") || code.includes("C")) {
+      const arrow = rest.lastIndexOf(" -> ");
+      if (arrow >= 0) {
+        entries.push({
+          code,
+          path: rest.slice(arrow + 4),
+          from: rest.slice(0, arrow),
+          staged: code[0] !== " " && code[0] !== "?",
+          unstaged: code[1] !== " " && code[1] !== "?",
+          untracked: false
+        });
+        continue;
+      }
+    }
+    const untracked = code === "??";
+    entries.push({
+      code,
+      path: rest,
+      staged: !untracked && code[0] !== " " && code[0] !== "?",
+      unstaged: !untracked && code[1] !== void 0 && code[1] !== " ",
+      untracked
+    });
+  }
+  return { ...branch === void 0 ? {} : { branch }, entries };
+}
+function parseBranchHeader(header) {
+  const noBranch = /^HEAD \(no branch\)$/.exec(header);
+  if (noBranch !== null) return { branch: "HEAD", detached: true, ahead: 0, behind: 0 };
+  const trackMatch = /^(.+?)(?:\.\.\.(\S+))?(?:\s+\[(.+)\])?$/.exec(header);
+  if (trackMatch === null) return { branch: header.trim(), detached: false, ahead: 0, behind: 0 };
+  const [, branch = header, upstream, counts] = trackMatch;
+  let ahead = 0;
+  let behind = 0;
+  for (const part of (counts ?? "").split(",")) {
+    const trimmed = part.trim();
+    const aheadMatch = /^ahead (\d+)$/.exec(trimmed);
+    if (aheadMatch !== null) ahead = Number(aheadMatch[1]);
+    const behindMatch = /^behind (\d+)$/.exec(trimmed);
+    if (behindMatch !== null) behind = Number(behindMatch[1]);
+  }
+  return {
+    branch: branch.trim(),
+    detached: false,
+    ahead,
+    behind,
+    ...upstream === void 0 ? {} : { upstream }
+  };
+}
+function parseLog(stdout) {
+  const entries = [];
+  for (const line of stdout.split("\n")) {
+    if (line.trim() === "") continue;
+    const [hash, shortHash, author, date, subject] = line.split("");
+    if (hash === void 0 || shortHash === void 0) continue;
+    entries.push({
+      hash,
+      shortHash,
+      author: author ?? "",
+      date: date ?? "",
+      subject: subject ?? ""
+    });
+  }
+  return entries;
+}
+function buildGitArgv(action, axis) {
+  switch (action) {
+    case "status":
+      return ["git", "status", "--porcelain=v1", "--branch", "--untracked-files=normal"];
+    case "diff": {
+      const argv = ["git", "diff", "--no-color", "--no-ext-diff"];
+      if (axis.staged === true) argv.push("--staged");
+      if (axis.ref !== void 0) argv.push(axis.ref);
+      if (axis.path !== void 0) argv.push("--", axis.path);
+      return argv;
+    }
+    case "log": {
+      const argv = [
+        "git",
+        "log",
+        "--no-color",
+        `--pretty=format:%H%x1f%h%x1f%an%x1f%aI%x1f%s`,
+        "-n",
+        String(Math.max(1, Math.min(500, axis.maxCount ?? 20)))
+      ];
+      if (axis.path !== void 0) argv.push("--", axis.path);
+      else if (axis.ref !== void 0) argv.push(axis.ref);
+      return argv;
+    }
+    case "show": {
+      if (axis.ref === void 0) throw new Error("show \u9700\u8981 ref");
+      return ["git", "show", "--no-color", "--no-ext-diff", axis.ref];
+    }
+    case "branch":
+      return ["git", "branch", "--no-color", "--format=%(HEAD) %(refname:short) %(upstream:short)"];
+    case "add": {
+      if (axis.all === true) return ["git", "add", "--all"];
+      const files = axis.files ?? (axis.path === void 0 ? [] : [axis.path]);
+      if (files.length === 0) throw new Error("add \u9700\u8981 files \u6216 all: true");
+      return ["git", "add", "--", ...files];
+    }
+    case "commit": {
+      if (axis.message === void 0 || axis.message.trim() === "") throw new Error("commit \u9700\u8981 message");
+      return ["git", "commit", "--no-verify", "-m", axis.message];
+    }
+    case "checkout": {
+      if (axis.ref === void 0) throw new Error("checkout \u9700\u8981 ref");
+      const argv = ["git", "checkout", axis.ref];
+      if (axis.path !== void 0) argv.push("--", axis.path);
+      return argv;
+    }
+    case "restore": {
+      const argv = ["git", "restore"];
+      if (axis.staged === true) argv.push("--staged");
+      const files = axis.files ?? (axis.path === void 0 ? [] : [axis.path]);
+      if (files.length === 0) throw new Error("restore \u9700\u8981 files \u6216 path\uFF08\u4E0D\u63D0\u4F9B\u5C31\u662F\u6574\u68F5\u6811\u7684\u7834\u574F\u6027\u64CD\u4F5C\uFF0C\u4E0D\u652F\u6301\uFF09");
+      argv.push("--", ...files);
+      return argv;
+    }
+    case "stash": {
+      const sub = axis.stashAction ?? "list";
+      if (sub !== "list" && sub !== "push" && sub !== "pop" && sub !== "apply") {
+        throw new Error(`stash \u7684 stashAction \u53EA\u63A5\u53D7 list / push / pop / apply\uFF0C\u6536\u5230 ${sub}`);
+      }
+      const argv = ["git", "stash", sub];
+      if (sub === "push" && axis.message !== void 0) argv.push("-m", axis.message);
+      return argv;
+    }
+    default: {
+      const exhaustive = action;
+      throw new Error(`\u672A\u77E5\u7684 git \u52A8\u4F5C\uFF1A${String(exhaustive)}`);
+    }
+  }
+}
+function formatOutcome(value) {
+  const parts = [];
+  if (Array.isArray(value["log"])) {
+    for (const entry of value["log"]) parts.push(`${entry.shortHash} ${entry.date} ${entry.author}  ${entry.subject}`);
+  }
+  if (Array.isArray(value["entries"])) {
+    for (const entry of value["entries"]) parts.push(`${entry.code} ${entry.path}`);
+  }
+  if (typeof value["diff"] === "string" && value["diff"] !== "") parts.push(value["diff"]);
+  const body = parts.length > 0 ? parts.join("\n") : value["stdout"];
+  const suffix = value["truncated"] === true ? "\n[\u8F93\u51FA\u5DF2\u622A\u65AD]" : "";
+  return `${value["action"]} \u2192 exit ${value["exitCode"]}
+${body}${suffix}`;
+}
+function remoteGitDefinition(backend) {
+  return defineTool6({
+    name: "remote_git",
+    description: "Run a git operation on the remote repository this session is working in, and return its **parsed** result instead of raw terminal text. Prefer this over `remote_exec git ... : the parse is done here (branch/ahead/behind, status entries, log entries), so a new git version's wording cannot break your reading. Read-only actions: `status`, `diff`, `log`, `show`, `branch`. Mutating actions: `add`, `commit`, `checkout`, `restore`, `stash` \u2014 these change the user's repository, so state the intent in your message first. Deliberately **not** offered: `reset --hard`, `clean -fd`, `push --force`, `checkout .`. Those have no safe preview; use `remote_exec` explicitly if you really need one. Git is run with `GIT_TERMINAL_PROMPT=0`, so a missing credential **fails** instead of hanging on a password prompt. Read-only actions may overlap with other read-only remote calls.",
+    parameters: {
+      action: {
+        type: "string",
+        enum: [...ACTIONS],
+        description: "Which git operation. Read-only: status/diff/log/show/branch. Mutating: add/commit/checkout/restore/stash.",
+        required: true
+      },
+      cwd: {
+        type: "string",
+        description: "Directory inside the remote repository. Defaults to the workspace root; git itself walks up to find the repo."
+      },
+      path: { type: "string", description: "Repo-relative path to narrow the operation (diff/log/checkout/restore/add)." },
+      files: {
+        type: "array",
+        items: { type: "string" },
+        description: "Explicit repo-relative paths for add/restore. Mutually redundant with `path`; prefer this when touching several files."
+      },
+      ref: { type: "string", description: "A revision for diff/show/checkout (branch, tag, `HEAD~2`, a hash)." },
+      message: { type: "string", description: "Commit message for `commit`, or the stash message for `stash push`." },
+      staged: { type: "boolean", description: "diff/restore only: operate on the index instead of the working tree." },
+      all: { type: "boolean", description: "add only: stage every change (`git add --all`), including deletions." },
+      maxCount: { type: "integer", description: "log only: how many entries (1\u2013500, default 20)." },
+      stashAction: { type: "string", enum: ["list", "push", "pop", "apply"], description: "stash only: sub-action, default `list`." },
+      maxLines: { type: "integer", description: `Cap on returned lines per stream (default ${MAX_LINES_DEFAULT}).` },
+      timeoutMs: { type: "integer", description: `Cooperative budget in ms (default ${DEFAULT_TIMEOUT_MS3}); large repositories can be slow.` }
+    },
+    output: {
+      schema: {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+          action: { type: "string", required: true },
+          exitCode: { type: "integer", required: true },
+          stdout: { type: "string", required: true },
+          stderr: { type: "string", required: true },
+          durationMs: { type: "integer", required: true },
+          truncated: { type: "boolean", required: true, description: "Whether a stream hit `maxLines`." },
+          branch: {
+            type: "object",
+            additionalProperties: false,
+            description: "status only: the parsed `##` header.",
+            properties: {
+              branch: { type: "string", required: true },
+              detached: { type: "boolean", required: true },
+              ahead: { type: "integer", required: true },
+              behind: { type: "integer", required: true },
+              upstream: { type: "string" }
+            }
+          },
+          entries: {
+            type: "array",
+            description: "status only: parsed porcelain entries.",
+            items: {
+              type: "object",
+              additionalProperties: false,
+              properties: {
+                code: { type: "string", required: true },
+                path: { type: "string", required: true },
+                from: { type: "string" },
+                staged: { type: "boolean", required: true },
+                unstaged: { type: "boolean", required: true },
+                untracked: { type: "boolean", required: true }
+              }
+            }
+          },
+          log: {
+            type: "array",
+            description: "log only: parsed entries, newest first.",
+            items: {
+              type: "object",
+              additionalProperties: false,
+              properties: {
+                hash: { type: "string", required: true },
+                shortHash: { type: "string", required: true },
+                author: { type: "string", required: true },
+                date: { type: "string", required: true },
+                subject: { type: "string", required: true }
+              }
+            }
+          },
+          branches: { type: "array", items: { type: "string" }, description: "branch only: one line per local branch." },
+          diff: { type: "string", description: "diff/show only: the patch text (already line-capped)." }
+        }
+      },
+      render: (_args, value) => text6(formatOutcome(value))
+    },
+    async execute(args, exec) {
+      const record2 = args ?? {};
+      const action = readAction(record2["action"]);
+      const maxLines = readPositiveInt2(record2["maxLines"], MAX_LINES_DEFAULT);
+      const target = resolveTarget(backend, exec);
+      const argv = buildGitArgv(action, {
+        path: readString3(record2["path"]),
+        ref: readString3(record2["ref"]),
+        message: readString3(record2["message"]),
+        files: readStringArray2(record2["files"]),
+        staged: record2["staged"] === true,
+        maxCount: readPositiveInt2(record2["maxCount"], 20),
+        stashAction: readString3(record2["stashAction"]),
+        all: record2["all"] === true
+      });
+      const outcome = await backend.exec(target, {
+        command: quoteAll(argv),
+        cwd: resolveCwd(target, readString3(record2["cwd"])),
+        env: { ...GIT_ENV },
+        timeoutMs: readPositiveInt2(record2["timeoutMs"], DEFAULT_TIMEOUT_MS3)
+      }, exec.signal);
+      const capped = capLines(outcome.stdout, maxLines);
+      const errCapped = capLines(outcome.stderr, maxLines);
+      const base = {
+        action,
+        exitCode: outcome.exitCode,
+        stdout: capped.text,
+        stderr: errCapped.text,
+        durationMs: outcome.durationMs,
+        truncated: capped.truncated || errCapped.truncated
+      };
+      if (action === "status") {
+        const parsed = parseStatus(outcome.stdout);
+        return {
+          ...base,
+          ...parsed.branch === void 0 ? {} : { branch: parsed.branch },
+          entries: [...parsed.entries]
+        };
+      }
+      if (action === "log") return { ...base, log: [...parseLog(outcome.stdout)] };
+      if (action === "branch") {
+        const branches = outcome.stdout.split("\n").map((line) => line.trim()).filter((line) => line !== "");
+        return { ...base, branches };
+      }
+      if (action === "diff" || action === "show") return { ...base, diff: capped.text };
+      return base;
+    }
+  });
+}
+function resolveTarget(backend, exec) {
+  return resolveSessionTarget(exec, {
+    resolve: (cwd) => backend.resolve(cwd),
+    resolveSessionRoot: backend.resolveSessionRoot
+  });
+}
+function resolveCwd(target, cwd) {
+  if (cwd === void 0 || cwd === "") return target.root;
+  const normalized = cwd.replace(/\\/g, "/");
+  if (normalized.startsWith("/")) return normalized;
+  return `${target.root.replace(/\/+$/, "")}/${normalized}`.replace(/\/{2,}/g, "/");
+}
+function readAction(value) {
+  if (typeof value === "string" && ACTIONS.includes(value)) return value;
+  throw new Error(`action \u5FC5\u987B\u662F ${ACTIONS.join(" / ")} \u4E4B\u4E00`);
+}
+function readString3(value) {
+  return typeof value === "string" && value !== "" ? value : void 0;
+}
+function readStringArray2(value) {
+  if (!Array.isArray(value)) return void 0;
+  const out = value.filter((item) => typeof item === "string" && item !== "");
+  return out.length === 0 ? void 0 : out;
+}
+function readPositiveInt2(value, fallback) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return fallback;
+  return Math.floor(value);
+}
+function text6(value) {
+  return [{ type: "text", text: value }];
+}
+function registerRemoteGitTool(ctx, backend) {
+  return ctx.tools.register(remoteGitDefinition(backend));
+}
+
+// src/host/integration/tools/remote-lsp-tools.ts
+import { defineTool as defineTool7 } from "@deepseek-ai/dsh-tools";
 function toView(diagnostic) {
   return {
     line: diagnostic.line + 1,
@@ -18506,7 +20304,7 @@ function parseServer(value) {
 function remoteLspToolDefinitions(deps) {
   const { backend, registry } = deps;
   return [
-    defineTool5({
+    defineTool7({
       name: "remote_lsp",
       description: 'Ask a **language server running on the remote host** about a file: diagnostics, hover, or definition. Use this instead of running the compiler and reading its text output \u2014 the answer is structured and scoped to one document, and it is the only way to ask "what does this symbol mean" or "where is this defined". The server is started on first use and reused; it takes seconds to index a project, so the first call is slow and later ones are fast. Line and column are **1-based**, matching `remote_read`. Requires a language server installed on the remote host (gopls, rust-analyzer, typescript-language-server, pylsp, clangd); pass `server` to use a different one. NOT concurrency-safe: it changes remote state (starts a process), so it never joins a parallel group.',
       parameters: {
@@ -18714,7 +20512,7 @@ function registerRemoteLspTools(ctx, deps) {
 
 // src/wiring/tools-session.ts
 import { cp, mkdir as mkdir10, readFile as readFile9, readdir as readdir6, rename as rename6, rm as rm5, stat as nodeStat2, writeFile as writeFile6 } from "node:fs/promises";
-import { dirname as dirname8, join as join16 } from "node:path";
+import { dirname as dirname8, join as join17 } from "node:path";
 import { homedir as homedir6 } from "node:os";
 
 // src/host/integration/session/session-labels.ts
@@ -18765,11 +20563,11 @@ function createWorkspaceTitleResolver(ctx) {
 // src/wiring/tools-session.ts
 function wireSessionAdmin(env) {
   const { ctx, limits, notifySessionRemoved: notifySessionRemoved2 } = env;
-  const sessionsRoot = limits.sessionsRoot ?? join16(homedir6(), ".dsh", "sessions");
-  const storagesRoot = join16(homedir6(), ".dsh", "storages");
-  const sessionBinRoot = limits.sessionBinRoot ?? join16(storagesRoot, "over-ssh", "session-trash");
+  const sessionsRoot = limits.sessionsRoot ?? join17(homedir6(), ".dsh", "sessions");
+  const storagesRoot = join17(homedir6(), ".dsh", "storages");
+  const sessionBinRoot = limits.sessionBinRoot ?? join17(storagesRoot, "over-ssh", "session-trash");
   if (limits.sessionBinRoot === void 0) {
-    const carried = carryDirectory(join16(storagesRoot, "remote-workspace", "session-trash"), sessionBinRoot);
+    const carried = carryDirectory(join17(storagesRoot, "remote-workspace", "session-trash"), sessionBinRoot);
     if (carried.error !== void 0) {
       const reason = carried.error instanceof Error ? carried.error.message : String(carried.error);
       ctx.logger?.warn?.(`\u4F1A\u8BDD\u56DE\u6536\u7AD9\u4ECE\u65E7\u76EE\u5F55\u642C\u8FC1\u5931\u8D25\uFF08${reason}\uFF09\uFF1B\u65B0\u76EE\u5F55\u4ECD\u53EF\u7528\uFF0C\u65E7\u76EE\u5F55\u7559\u7740\u53EF\u4EBA\u5DE5\u6062\u590D`);
@@ -18794,7 +20592,7 @@ function wireSessionAdmin(env) {
           let bytes = 0;
           let mtimeMs = 0;
           try {
-            const stat5 = await nodeStat2(join16(path, entry.name));
+            const stat5 = await nodeStat2(join17(path, entry.name));
             mtimeMs = stat5.mtimeMs;
             if (entry.isFile()) bytes = stat5.size;
           } catch {
@@ -18821,14 +20619,14 @@ function wireSessionAdmin(env) {
       }
     },
     readText: (path) => readFile9(path, "utf8"),
-    writeText: async (path, text6) => {
+    writeText: async (path, text8) => {
       await mkdir10(dirname8(path), { recursive: true });
-      await writeFile6(path, text6, "utf8");
+      await writeFile6(path, text8, "utf8");
     },
-    writeTextAtomic: async (path, text6) => {
+    writeTextAtomic: async (path, text8) => {
       await mkdir10(dirname8(path), { recursive: true });
       const temp = `${path}.${process.pid}.${Date.now()}.tmp`;
-      await writeFile6(temp, text6, "utf8");
+      await writeFile6(temp, text8, "utf8");
       try {
         await rename6(temp, path);
       } catch (error) {
@@ -18892,8 +20690,8 @@ init_errors();
 
 // src/host/integration/tools/management-tools.ts
 import { isAbsolute as isAbsolute3, resolve as resolve2 } from "node:path";
-import { defineTool as defineTool6 } from "@deepseek-ai/dsh-tools";
-function text5(value) {
+import { defineTool as defineTool8 } from "@deepseek-ai/dsh-tools";
+function text7(value) {
   return [{ type: "text", text: value }];
 }
 function targetFor4(backend, exec) {
@@ -18967,7 +20765,7 @@ function formatEnv(result) {
 }
 function managementToolDefinitions(backend) {
   return [
-    defineTool6({
+    defineTool8({
       name: "remote_transfer",
       description: "Upload one local file to the remote workspace this session is working in, or download one remote file to the local machine. Chunked with progress; pass `resume: true` to continue an interrupted transfer instead of rewriting the whole file (the prefix is **compared with the source** before it is kept, so a changed source degrades to a full retransfer instead of splicing two files). The result reports bytes, chunk count, whether it resumed, the absolute local path the bytes landed at, and \u2014 when the host can hash \u2014 the digest of the content that actually landed. `localPath` must be **absolute**: the plugin resolves it in its own process, so a relative spelling would land under the plugin's working directory instead of anywhere the caller expects. An upload that would overwrite an **existing** remote file is refused unless you pass `expectedVersion` (from `remote_stat`/`remote_read`) or `force: true`: a silent overwrite is the one operation that destroys someone else's work without a trace.",
       parameters: {
@@ -19027,7 +20825,7 @@ function managementToolDefinitions(backend) {
             }
           }
         },
-        render: (_args, value) => text5(formatTransfer(value))
+        render: (_args, value) => text7(formatTransfer(value))
       },
       async execute(args, exec) {
         const record2 = args ?? {};
@@ -19105,7 +20903,7 @@ function managementToolDefinitions(backend) {
         };
       }
     }),
-    defineTool6({
+    defineTool8({
       name: "remote_delete",
       description: 'Delete one path inside the remote workspace. `mode: "recycle"` (the default) moves it to the workspace recycle bin, where it is recoverable and can be undone; `mode: "permanent"` removes it for good and requires user approval. Omitting `mode` is therefore the safe call, and the result always names which mode ran.',
       parameters: {
@@ -19132,7 +20930,7 @@ function managementToolDefinitions(backend) {
             warning: { type: "string" }
           }
         },
-        render: (_args, value) => text5(formatDiscard(value))
+        render: (_args, value) => text7(formatDiscard(value))
       },
       async execute(args, exec) {
         const record2 = args ?? {};
@@ -19153,7 +20951,7 @@ function managementToolDefinitions(backend) {
         };
       }
     }),
-    defineTool6({
+    defineTool8({
       name: "remote_restore",
       description: "Undo a delete. With `id`, puts that bin entry back at the path it was deleted from; without `id`, undoes the most recent discard; with `list: true`, shows what the bin holds for this session's root and changes nothing. `remote_delete` returns the entry id as `entryId`. The bin is subject to retention limits (`binMaxEntries` / `binMaxBytes` / `binMaxAgeMs`), so an old entry may already be gone.",
       parameters: {
@@ -19193,7 +20991,7 @@ function managementToolDefinitions(backend) {
             message: { type: "string" }
           }
         },
-        render: (_args, value) => text5(formatRestore(value))
+        render: (_args, value) => text7(formatRestore(value))
       },
       async execute(args, exec) {
         const record2 = args ?? {};
@@ -19215,7 +21013,7 @@ function managementToolDefinitions(backend) {
         return { action: "undone", id: outcome.id, message: outcome.message };
       }
     }),
-    defineTool6({
+    defineTool8({
       name: "remote_copy",
       description: "Copy one file to another path **on the remote host**. Both paths are inside this session's remote root. On a Tier 2 (agent) connection the copy happens on the remote side, so the bytes never cross this machine; otherwise they are relayed through it, and the result says which happened in `via`. Pass `recursive: true` to copy a whole directory tree in one round trip (Tier 2 only \u2014 it refuses rather than relaying a tree file by file). The destination must not exist, or be an empty directory: a recursive copy never deletes anything.",
       parameters: {
@@ -19245,7 +21043,7 @@ function managementToolDefinitions(backend) {
             durationMs: { type: "integer", required: true }
           }
         },
-        render: (_args, value) => text5(formatCopy(value))
+        render: (_args, value) => text7(formatCopy(value))
       },
       async execute(args, exec) {
         const record2 = args ?? {};
@@ -19278,7 +21076,7 @@ function managementToolDefinitions(backend) {
         };
       }
     }),
-    defineTool6({
+    defineTool8({
       name: "remote_env",
       description: "Sample what the remote host is and what it can do: OS/arch/distro/kernel, shell, CPU count, memory and disk, user and home, and **which commands exist** (rg, fd, git, python3, gcc, docker, ...). Ask this once instead of guessing and retrying: the answer is cached on the agent until `refresh: true`, so a repeat call costs one round trip and no resampling.",
       parameters: {
@@ -19310,7 +21108,7 @@ function managementToolDefinitions(backend) {
             diskTotalBytes: { type: "integer", description: "Total size of the home filesystem in bytes." }
           }
         },
-        render: (_args, value) => text5(formatEnv(value))
+        render: (_args, value) => text7(formatEnv(value))
       },
       async execute(args, exec) {
         const record2 = args ?? {};
@@ -19435,10 +21233,20 @@ async function relayCopy(deps, transport, request, source) {
   }
   const total = source.size;
   const staging = deps.renameRemote !== void 0 && deps.removeRemote !== void 0;
-  const destination = staging ? `${request.to}.dsh-part` : request.to;
+  const destination = staging ? `${request.to}.dsh-part-${process.pid}-${Math.random().toString(36).slice(2, 10)}` : request.to;
   const publish = async () => {
-    if (staging) await deps.renameRemote?.(destination, request.to);
+    if (!staging) return;
+    if (request.overwrite) await deps.removeRemote?.(request.to);
+    await deps.renameRemote?.(destination, request.to);
   };
+  if (!staging && request.overwrite) {
+    if (deps.removeRemote === void 0) {
+      throw new SshDevError("REMOTE_UNSUPPORTED", "\u8BE5\u8FDE\u63A5\u4E0D\u652F\u6301\u5220\u9664\u539F\u8BED\uFF0C\u65E0\u6CD5\u5728 relay \u8DEF\u5F84\u4E0A\u5B89\u5168\u8986\u76D6\u5DF2\u6709\u6587\u4EF6", {
+        to: request.to
+      });
+    }
+    await deps.removeRemote(request.to);
+  }
   try {
     let offset = 0;
     if (total === 0) {
@@ -19602,11 +21410,40 @@ function wireManagementTools(env) {
 
 // src/wiring/tools.ts
 function sessionRootsFilePath() {
-  return join17(resolveStateDir(), USER_ROOTS_FILE_NAME);
+  return join18(resolveStateDir(), USER_ROOTS_FILE_NAME);
+}
+var platformMutationPolicy = (context) => {
+  const service = context.get("sandboxPolicy");
+  if (service?.resolve === void 0) return {};
+  const sessionId = currentSessionId();
+  const sessions = context.get("sessions");
+  const session = sessionId === void 0 || sessions?.get === void 0 ? void 0 : sessions.get(sessionId);
+  try {
+    const resolved = service.resolve(session === void 0 ? {} : { session });
+    if (resolved.mode === void 0 || resolved.workspaceRoot === void 0) return {};
+    const mode = resolved.mode;
+    if (mode !== "read-only" && mode !== "workspace-write" && mode !== "danger-full-access") return {};
+    return { policy: { mode, workspaceRoot: resolved.workspaceRoot } };
+  } catch {
+    return {};
+  }
+};
+function execWriteRootsSeam(env) {
+  if (env.limits.execWriteFence !== true) return void 0;
+  return (connectionId, root) => {
+    const sessionId = currentSessionId();
+    return execWriteRootsFor({
+      connectionId,
+      root,
+      records: env.registry.records,
+      identity: sessionIdentityOf(env.ctx, sessionId),
+      cwd: sessionId === void 0 || sessionId === "" ? void 0 : readSessionCwd(env.ctx, sessionId)
+    });
+  };
 }
 function wireTools(env) {
   const { ctx, limits, profiles, transports, registry, indexFor, transferService, transferTracker, binService, notifySessionRemoved: notifySessionRemoved2 } = env;
-  const { sessionRoots, toolBackend, disposeTools } = wireAgentTools({ ctx, profiles, transports, registry, indexFor });
+  const { sessionRoots, toolBackend, disposeTools } = wireAgentTools({ ctx, limits, profiles, transports, registry, indexFor });
   const {
     recordFor,
     disposeJobTools,
@@ -19650,12 +21487,13 @@ function wireTools(env) {
   };
 }
 function wireAgentTools(env) {
-  const { ctx, profiles, transports, registry, indexFor } = env;
+  const { ctx, limits, profiles, transports, registry, indexFor } = env;
   const sessionRoots = createSessionRootIndex({
     filePath: sessionRootsFilePath(),
     readFile: readFile10,
     ttlMs: 2e3
   });
+  const execWriteRootsForCommand = execWriteRootsSeam({ ctx, limits, registry });
   const toolBackend = createRemoteToolBackend({
     resolveRoot: (cwd) => {
       const resolved = registry.routed.tryResolve(cwd);
@@ -19667,13 +21505,35 @@ function wireAgentTools(env) {
     // ADR-0013: the session id (plus its fork lineage) is the strict scope; `cwd` alone cannot separate
     // two conversations opened on the same directory.
     resolveSessionRoot: (cwd, sessionId) => sessionRoots.outcomeFor(cwd, sessionIdentityOf(ctx, sessionId)),
+    // 批量多机：把**指定的**连接解析成覆盖 cwd 的那个根。选"覆盖 cwd 的最长根"与单机路径同一条规则
+    // （`longestContainingRoot`），所以同一个 cwd 在两处不会落到不同的根上。
+    resolveRootForConnection: (connectionId, cwd) => {
+      const candidates = registry.records.filter((record2) => record2.root.location === "remote" && record2.root.connectionId === connectionId).map((record2) => record2.root.path);
+      const covering = longestContainingRoot(candidates, normalizeRemotePath(cwd));
+      return covering === void 0 ? void 0 : { connectionId, root: covering };
+    },
     acquire: async (connectionId) => (await transports.acquire(requireProfile(profiles, connectionId))).transport,
     enumerate: async (connectionId, root, signal) => {
       const result = await indexFor(connectionId).enumerate(root, signal === void 0 ? {} : { signal });
       return { paths: result.paths, truncated: result.truncated, source: result.source };
-    }
+    },
+    // 可选写入围栏（`limits.execWriteFence`）。默认 undefined = 不套：围栏会挡掉构建工具写
+    // `$HOME/.cache` / `/tmp`，默认开启会弄坏正常命令。打开时只放行"命令起始根 + 本会话添加的可写根"。
+    execWriteRoots: execWriteRootsForCommand
   });
-  const disposeTools = registerRemoteTools(ctx, toolBackend);
+  const disposeRemoteTools = registerRemoteTools(ctx, toolBackend);
+  const disposeGitTool = registerRemoteGitTool(ctx, toolBackend);
+  const forwardBackend = createForwardToolBackend(async (connectionId) => {
+    const transport = (await transports.acquire(requireProfile(profiles, connectionId))).transport;
+    return transport;
+  });
+  const disposeForwardTool = registerRemoteForwardTool(ctx, forwardBackend);
+  const disposeTools = () => {
+    disposeRemoteTools();
+    disposeGitTool();
+    disposeForwardTool();
+    void forwardBackend.closeAll();
+  };
   return { sessionRoots, toolBackend, disposeTools };
 }
 function wireFileAndJobTools(env) {
@@ -19688,8 +21548,10 @@ function wireFileAndJobTools(env) {
   const recordFor = (target) => registry.records.find(
     (record2) => record2.root.location === "remote" && record2.root.connectionId === target.connectionId && record2.root.path === target.root
   );
+  const execWriteRootsForCommand = execWriteRootsSeam({ ctx, limits, registry });
   const jobBackend = createRemoteJobBackend({
     resolveRoot: remoteRootFor,
+    execWriteRoots: execWriteRootsForCommand,
     // ADR-0013: the session id (plus its fork lineage) is the strict scope; `cwd` alone cannot separate
     // two conversations opened on the same directory.
     resolveSessionRoot: (cwd, sessionId) => sessionRoots.outcomeFor(cwd, sessionIdentityOf(ctx, sessionId)),
@@ -19707,7 +21569,21 @@ function wireFileAndJobTools(env) {
     backendFor: (target) => recordFor(target)?.backend,
     ...limits.maxReadBytes === void 0 ? {} : { maxReadBytes: limits.maxReadBytes }
   });
-  const disposeFileTools = registerRemoteFileTools(ctx, fileBackend);
+  const allowMutation = (target) => {
+    const refusal = mutationRefusal(
+      `${target.connectionId}:${target.root}`,
+      {
+        ...platformMutationPolicy(ctx),
+        rootArea: () => {
+          const record2 = recordFor(target);
+          if (record2 === void 0) return "deny";
+          return workspaceWriteArea(record2.root, void 0, void 0, sessionIdentityOf(ctx, currentSessionId()));
+        }
+      }
+    );
+    if (refusal !== void 0) throw new Error(refusal);
+  };
+  const disposeFileTools = registerRemoteFileTools(ctx, fileBackend, { allowMutation });
   const lspRegistry = createLspRegistry({
     acquire: async (connectionId) => (await transports.acquire(requireProfile(profiles, connectionId))).transport,
     onLog: (connectionId, message) => {