dsh-over-ssh 0.1.1 → 0.2.1

package/lib/types/src/config.d.ts

@@ -105,7 +105,26 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
          * 立刻把自己的条目淘汰掉，行为既不是"关缓存"也不是"缓存"。
          */
         readCacheTotalMaxBytes: z<number, number, "defined">;
+        /**
+         * 端口转发的空闲回收窗口（毫秒）；`0` 关闭回收。
+         *
+         * 判据是"没有任何活跃连接且距最后一次活动超过这个窗口"。没有回收的话，一个被 agent 起过、
+         * 之后没人用的转发会一直占着本地端口（用户实测关心的问题）。默认 30 分钟：比一次开发会话的
+         * 间隔长，比"忘了关一整天"短。
+         */
+        forwardIdleTimeoutMs: z<number, number, "defined">;
         terminalStateDir: z<string, string, "plain">;
+        /**
+         * 是否给 `remote_exec` / `remote_exec_background` 套**远端写入围栏**（Tier 2 的 Landlock）。
+         *
+         * **默认关**是刻意的：围栏只放行 workspace 根与本会话添加的目录，构建工具往 `$HOME/.cache`、
+         * `/tmp` 写缓存时会被拒——默认开启会把正常命令弄坏。关着的时候 shell 命令能碰到 SSH 用户能碰的
+         * 一切，这与"添加目录"的文件边界是两件事，工具描述里如实写着。
+         *
+         * 打开之后，`remote_exec` 只能写：命令起始的 workspace 根、本会话添加的可写根。Tier 1（无代理）
+         * 没有 Landlock 能力，此项对它们无效。
+         */
+        execWriteFence: z<boolean, boolean, "defined">;
         transferChunkBytes: z<number, number, "defined">;
         /** Chunks in flight at once during a transfer. 1 restores the sequential behaviour. */
         transferConcurrency: z<number, number, "defined">;
@@ -172,7 +191,26 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
          * 立刻把自己的条目淘汰掉，行为既不是"关缓存"也不是"缓存"。
          */
         readCacheTotalMaxBytes: z<number, number, "defined">;
+        /**
+         * 端口转发的空闲回收窗口（毫秒）；`0` 关闭回收。
+         *
+         * 判据是"没有任何活跃连接且距最后一次活动超过这个窗口"。没有回收的话，一个被 agent 起过、
+         * 之后没人用的转发会一直占着本地端口（用户实测关心的问题）。默认 30 分钟：比一次开发会话的
+         * 间隔长，比"忘了关一整天"短。
+         */
+        forwardIdleTimeoutMs: z<number, number, "defined">;
         terminalStateDir: z<string, string, "plain">;
+        /**
+         * 是否给 `remote_exec` / `remote_exec_background` 套**远端写入围栏**（Tier 2 的 Landlock）。
+         *
+         * **默认关**是刻意的：围栏只放行 workspace 根与本会话添加的目录，构建工具往 `$HOME/.cache`、
+         * `/tmp` 写缓存时会被拒——默认开启会把正常命令弄坏。关着的时候 shell 命令能碰到 SSH 用户能碰的
+         * 一切，这与"添加目录"的文件边界是两件事，工具描述里如实写着。
+         *
+         * 打开之后，`remote_exec` 只能写：命令起始的 workspace 根、本会话添加的可写根。Tier 1（无代理）
+         * 没有 Landlock 能力，此项对它们无效。
+         */
+        execWriteFence: z<boolean, boolean, "defined">;
         transferChunkBytes: z<number, number, "defined">;
         /** Chunks in flight at once during a transfer. 1 restores the sequential behaviour. */
         transferConcurrency: z<number, number, "defined">;
@@ -285,7 +323,26 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
          * 立刻把自己的条目淘汰掉，行为既不是"关缓存"也不是"缓存"。
          */
         readCacheTotalMaxBytes: z<number, number, "defined">;
+        /**
+         * 端口转发的空闲回收窗口（毫秒）；`0` 关闭回收。
+         *
+         * 判据是"没有任何活跃连接且距最后一次活动超过这个窗口"。没有回收的话，一个被 agent 起过、
+         * 之后没人用的转发会一直占着本地端口（用户实测关心的问题）。默认 30 分钟：比一次开发会话的
+         * 间隔长，比"忘了关一整天"短。
+         */
+        forwardIdleTimeoutMs: z<number, number, "defined">;
         terminalStateDir: z<string, string, "plain">;
+        /**
+         * 是否给 `remote_exec` / `remote_exec_background` 套**远端写入围栏**（Tier 2 的 Landlock）。
+         *
+         * **默认关**是刻意的：围栏只放行 workspace 根与本会话添加的目录，构建工具往 `$HOME/.cache`、
+         * `/tmp` 写缓存时会被拒——默认开启会把正常命令弄坏。关着的时候 shell 命令能碰到 SSH 用户能碰的
+         * 一切，这与"添加目录"的文件边界是两件事，工具描述里如实写着。
+         *
+         * 打开之后，`remote_exec` 只能写：命令起始的 workspace 根、本会话添加的可写根。Tier 1（无代理）
+         * 没有 Landlock 能力，此项对它们无效。
+         */
+        execWriteFence: z<boolean, boolean, "defined">;
         transferChunkBytes: z<number, number, "defined">;
         /** Chunks in flight at once during a transfer. 1 restores the sequential behaviour. */
         transferConcurrency: z<number, number, "defined">;
@@ -352,7 +409,26 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
          * 立刻把自己的条目淘汰掉，行为既不是"关缓存"也不是"缓存"。
          */
         readCacheTotalMaxBytes: z<number, number, "defined">;
+        /**
+         * 端口转发的空闲回收窗口（毫秒）；`0` 关闭回收。
+         *
+         * 判据是"没有任何活跃连接且距最后一次活动超过这个窗口"。没有回收的话，一个被 agent 起过、
+         * 之后没人用的转发会一直占着本地端口（用户实测关心的问题）。默认 30 分钟：比一次开发会话的
+         * 间隔长，比"忘了关一整天"短。
+         */
+        forwardIdleTimeoutMs: z<number, number, "defined">;
         terminalStateDir: z<string, string, "plain">;
+        /**
+         * 是否给 `remote_exec` / `remote_exec_background` 套**远端写入围栏**（Tier 2 的 Landlock）。
+         *
+         * **默认关**是刻意的：围栏只放行 workspace 根与本会话添加的目录，构建工具往 `$HOME/.cache`、
+         * `/tmp` 写缓存时会被拒——默认开启会把正常命令弄坏。关着的时候 shell 命令能碰到 SSH 用户能碰的
+         * 一切，这与"添加目录"的文件边界是两件事，工具描述里如实写着。
+         *
+         * 打开之后，`remote_exec` 只能写：命令起始的 workspace 根、本会话添加的可写根。Tier 1（无代理）
+         * 没有 Landlock 能力，此项对它们无效。
+         */
+        execWriteFence: z<boolean, boolean, "defined">;
         transferChunkBytes: z<number, number, "defined">;
         /** Chunks in flight at once during a transfer. 1 restores the sequential behaviour. */
         transferConcurrency: z<number, number, "defined">;

package/lib/types/src/host/app/backend.d.ts

@@ -69,6 +69,17 @@ export interface BackendWrite {
 }
 /** How a backend confines writes, mirroring the core's `SandboxMode`. */
 export type BackendSandboxMode = 'read-only' | 'workspace-write' | 'danger-full-access';
+/**
+ * Per-call write fence; structurally compatible with the platform's `SandboxExecutionPolicy`.
+ *
+ * 用结构化类型而不是 `import type { SandboxExecutionPolicy } from '@deepseek-ai/dsh-sandbox'`：app 层的端口
+ * 不该依赖平台包（`tests/architecture.test.ts` 的可测性规则）。只有真正把写入交给平台沙箱的
+ * {@link PlatformLocalBackend} 会读它，其余后端各有一套自己的围栏。
+ */
+export interface BackendWritePolicy {
+    readonly mode: BackendSandboxMode;
+    readonly workspaceRoot: string;
+}
 /** One backend serving one root. */
 export interface Backend {
     /** Stable id, also the namespace prefix of every target key it produces. */
@@ -113,8 +124,11 @@ export interface Backend {
      * Write text, atomically where the backend can.
      *
      * @param expectedVersion - when non-empty the write must fail if the current version differs.
+     * @param policy - the per-call sandbox policy, when the caller has one. Only backends that delegate to a
+     *   platform sandbox consume it ({@link PlatformLocalBackend}); the others enforce their own fence and
+     *   ignore it. Structural on purpose — the app layer must not import platform types.
      */
-    writeText(absolute: string, text: string, expectedVersion: string | undefined, signal?: AbortSignal): Promise<BackendWrite>;
+    writeText(absolute: string, text: string, expectedVersion: string | undefined, signal?: AbortSignal, policy?: BackendWritePolicy): Promise<BackendWrite>;
     /**
      * Apply a unified diff to one file, atomically.
      *
@@ -131,9 +145,10 @@ export interface Backend {
      * apply the **same** three-state semantics as that fallback (not found / ambiguous / replaceAll) and
      * must honour `expectedVersion` across its own read-modify-write.
      */
-    editText?(absolute: string, oldString: string, newString: string, replaceAll: boolean, expectedVersion: string | undefined, signal?: AbortSignal): Promise<BackendWrite & {
+    editText?(absolute: string, oldString: string, newString: string, replaceAll: boolean, expectedVersion: string | undefined, signal?: AbortSignal, policy?: BackendWritePolicy): Promise<BackendWrite & {
         readonly replaced: number;
     }>;
+    /** Per-call write fence, structurally compatible with the platform's `SandboxExecutionPolicy`. */
     /**
      * Create a directory, and its parents when asked (FR-2.2.2: the file tree's 「新建目录」).
      *
@@ -171,6 +186,24 @@ export interface Backend {
      * caller's `755` is octal digits, not decimal seven hundred and fifty-five, and that confusion is silent.
      */
     chmod?(absolute: string, mode: string, signal?: AbortSignal): Promise<void>;
+    /**
+     * Create a symbolic link at `linkPath` pointing at `target`.
+     *
+     * Optional, and it must **refuse** an existing path rather than replace it: silently turning a real file
+     * into a symlink is data loss, and "there used to be a file here" is not recoverable from the link.
+     *
+     * @param target - what the link points at (kept verbatim; a relative target resolves against the link's dir).
+     * @param linkPath - the link to create.
+     * @param signal - cancellation.
+     */
+    symlink?(target: string, linkPath: string, signal?: AbortSignal): Promise<void>;
+    /**
+     * Read a symbolic link's target, or `undefined` when the path is not a link.
+     *
+     * `undefined` (not an error) is the honest answer for "not a link": the caller asked a question whose
+     * answer is "no". Only a real failure throws.
+     */
+    readlink?(absolute: string, signal?: AbortSignal): Promise<string | undefined>;
     /** Host path a child process in this backend's world can open, if any. */
     processPath?(absolute: string): string | undefined;
     /** `file:` URL for this path in the backend's world. */

package/lib/types/src/host/domain/roots/session-roots.d.ts

@@ -56,6 +56,29 @@ export interface SessionIdentity {
     /** The asking session's fork ancestors, nearest first. */
     readonly ancestors?: readonly string[] | undefined;
 }
+/**
+ * How much of one root counts as **the session's workspace** for a `workspace-write` mutation.
+ *
+ * 产品决定（2026-11-04，用户明确）：**「添加到会话的目录」= 该目录临时成为 workspace 的一部分，可写。**
+ * 在此之前插件对 `workspace-write` 只做两件事（`read-only` 拒绝、`root.writable === false` 拒绝），写入
+ * 范围实际是"本会话能看见的任何可写根"——比平台声明宽，且和"添加目录"的语义没有关系。
+ *
+ * 三个取值：
+ *  - `whole-root`：整个根都属于 workspace（会话自己添加的目录；或映射到 workspace 的远端根——远端根与
+ *    本地锚点是 1:1 的，锚点就是 workspace）；
+ *  - `workspace-only`：根包含 workspace，但只有 `workspaceRoot` 之内可写（平台自己的语义：`target` 必须
+ *    canonicalize 到 `workspaceRoot` 或其临时目录下）；
+ *  - `deny`：既不是会话添加的目录，也不是 workspace 本身。
+ *
+ * @param root - 一个已注册的根。
+ * @param workspaceRoot - 平台为本次调用解析出的 workspace 根（绝对本地路径）。
+ * @param cwd - 调用方的会话工作目录，用于判定历史条目（ADR-0013 之前只有 `workspaces`）。
+ * @param identity - 调用方的会话身份，用于判定本会话添加的条目。
+ * @returns 该根在 `workspace-write` 下的可写范围。
+ */
+export declare function workspaceWriteArea(root: RootRef, workspaceRoot: string | undefined, cwd: string | undefined, identity?: SessionIdentity): WorkspaceWriteArea;
+/** See {@link workspaceWriteArea}. */
+export type WorkspaceWriteArea = 'whole-root' | 'workspace-only' | 'deny';
 /** The target shape the tools consume; kept structural so this module imports no integration code. */
 export interface SessionRootTarget {
     readonly connectionId: string;

package/lib/types/src/host/domain/session/session-admin.d.ts

@@ -158,6 +158,11 @@ export interface DeleteDecision {
  *     默认不可被单独删除);
  *  5. selecting a parent **always** takes its whole descendant subtree along, ordered **children first**.
  *
+ * Rule 4 has one exception: an **orphan** sub-session — its parent is not in the inventory, or the parent is
+ * itself unreadable — can never be deleted "with its parent", because the parent does not exist to delete. Left
+ * refused, such a row is visible in the panel and permanently undeletable (审计 2026-11-05 session P2). It is
+ * therefore treated as a root: deletable on its own, and its own subtree still comes along by rule 5.
+ *
  * Rule 5 is unconditional on purpose. It used to be an opt-in `includeSubsessions` switch, and that was the
  * wrong shape: leaving a parent's children behind orphans their logs — the parent is gone, so nothing
  * navigates to them, and the platform's listing hides them by `parentId` nesting, so the bytes stay on disk

package/lib/types/src/host/infra/transport/forward.d.ts

@@ -0,0 +1,75 @@
+/**
+ * 端口转发：请求 / 句柄 / 转发器三个形状，以及请求校验。
+ *
+ * 为什么单独一个模块：两个 Tier 都要实现同一份契约，而调用方（Lead 之后接进 `Transport`）只需要这一份。
+ * 放在 `infra/transport/` 顶层而不是 `ssh/` 下，是因为它是**跨适配器**的端口：`alias-forward` 与
+ * `ssh2-forward` 各自实现它，谁都不该 import 对方。
+ *
+ * 本地端一律绑 `127.0.0.1`：转发出去的端口是给本机浏览器用的（DSH 侧栏只能开本地 URL），绑到
+ * `0.0.0.0` 等于把一个远端服务暴露给整个局域网。这是一条安全决定，不是默认值凑巧。
+ *
+ * @module dsh-over-ssh/infra/transport/forward
+ */
+/** 本地监听地址；固定环回，见模块注释。 */
+export declare const FORWARD_LOCAL_HOST = "127.0.0.1";
+/** 一次转发请求。 */
+export interface ForwardRequest {
+    /** 远端要连的主机（相对**远端**解析；`localhost` 指远端自己）。 */
+    readonly remoteHost: string;
+    /** 远端端口，1..65535。 */
+    readonly remotePort: number;
+    /** 本地端口；省略则自动选一个空闲端口。 */
+    readonly localPort?: number;
+}
+/** 一次已建立的转发。 */
+export interface ForwardHandle {
+    /** 真实的本地端口（自动选择时也一定有值，调用方拿它开 URL）。 */
+    readonly localPort: number;
+    readonly remoteHost: string;
+    readonly remotePort: number;
+    /** 幂等：第二次调用是 no-op，不抛错。 */
+    close(): Promise<void>;
+    /**
+     * 订阅「这条转发已经关掉」，无论关闭的**原因**是什么。
+     *
+     * 为什么需要它：空闲回收（默认 30 分钟）、连接退役、`closeAll` 都能让一条转发消失，而调用方手里只有
+     * 一个 handle；没有这个回调时，调用方的台账（`remote_forward list`）会一直列出已经关掉的转发。
+     *
+     * 可选：只有实现了回收的传输才提供。回调恰好触发一次；可重复订阅。
+     *
+     * @param listener - 收到关闭通知（含回收）时调用。
+     */
+    readonly onClosed?: (listener: () => void) => void;
+}
+/** 一个连接的转发台账。 */
+export interface Forwarder {
+    /** 建立一条转发；失败必须不留本地监听、也不留子进程。 */
+    forward(req: ForwardRequest, signal?: AbortSignal): Promise<ForwardHandle>;
+    /** 当前活着的转发（只读快照语义：调用方不得依赖它的身份稳定）。 */
+    readonly forwards: readonly ForwardHandle[];
+    /** 收掉全部转发，供 dispose 使用；幂等。 */
+    closeAll(): Promise<void>;
+}
+/**
+ * 校验并规整一个转发请求。
+ *
+ * **为什么在拼 argv 之前就校验**：`-L` 的规格串是 `local:remoteHost:remotePort`，靠冒号分隔。主机名里
+ * 多一个冒号（`host:80`、裸 `::1`）会把参数解析成完全不同的目标；空白与逗号同理。ssh 对这些的报错
+ * 文案不稳定，映射不成可操作的错误码，所以这里主动拒绝。
+ *
+ * 方括号 IPv6（`[::1]`）是**允许**的：那是 ssh 自己的写法，`-L` 里的冒号被方括号包住，解析无歧义。
+ *
+ * @param request - 调用方的原始请求。
+ * @returns 去掉首尾空白、字段已校验的请求。
+ * @throws SshDevError `CONNECTION_INVALID` 当主机或端口不合法。
+ */
+export declare function normalizeForwardRequest(request: ForwardRequest): ForwardRequest;
+/**
+ * 一行描述一条转发，日志与错误文案共用。
+ *
+ * `localPort` 缺席时写 `?`：那时端口还没选出来，写 0 会被误读成"转发到 0 号端口"。
+ *
+ * @param forward - 部分句柄（至少要有远端目标）。
+ * @returns 形如 `127.0.0.1:8080 -> db:5432` 的一行。
+ */
+export declare function forwardLabel(forward: Pick<ForwardHandle, 'remoteHost' | 'remotePort'> & Partial<Pick<ForwardHandle, 'localPort'>>): string;

package/lib/types/src/host/infra/transport/ssh/ssh2-transport.d.ts

@@ -27,6 +27,7 @@ import type { HostKeyPolicy } from '../../../domain/roots/connection.ts';
 import { SshDevError } from '../../../domain/errors.ts';
 import { type ExecRequest, type ExecResult, type ReadFileRangeRequest, type ReadFileRequest, type RemoteFileChunk, type RemoteWriteOutcome, type RemoveRequest, type RenameRequest, type Transport, type WriteFileRangeRequest, type WriteFileRequest } from '../transport.ts';
 import { TransportBase } from '../transport-base.ts';
+import type { ForwardHandle, ForwardRequest } from '../forward.ts';
 /** Authentication material for one hop. */
 export interface Ssh2Auth {
     readonly password?: string;
@@ -227,6 +228,10 @@ export declare class Ssh2Transport extends TransportBase implements Transport {
      */
     connect(signal?: AbortSignal): Promise<void>;
     /** Close the session. Idempotent. */
+    /** {@inheritDoc Transport.forward} */
+    forward(request: ForwardRequest, signal?: AbortSignal): Promise<ForwardHandle>;
+    /** {@inheritDoc Transport.closeForwards} */
+    closeForwards(): Promise<void>;
     dispose(): Promise<void>;
     /** Run one remote command over a channel of the shared session. */
     exec(request: ExecRequest, signal?: AbortSignal): Promise<ExecResult>;

package/lib/types/src/host/infra/transport/transport.d.ts

@@ -7,6 +7,7 @@
  *
  * @module dsh-over-ssh/infra/transport/transport
  */
+import type { ForwardHandle, ForwardRequest } from './forward.ts';
 import type { RemoteCapabilities } from '../../domain/capability.ts';
 /** Lifecycle of one transport instance. */
 export type TransportState = 'idle' | 'connecting' | 'ready' | 'lost';
@@ -35,6 +36,15 @@ export interface ExecRequest {
      * *encoded* payload into the file, i.e. silent corruption).
      */
     readonly stdinBase64?: string;
+    /**
+     * Landlock write fence: when non-empty, the command may only write under these roots.
+     *
+     * **Tier 2 only.** The agent builds the fence before `exec` and refuses with `REMOTE_UNSUPPORTED` when it
+     * cannot (no Landlock, missing root); a Tier 1 transport has no fence at all and must refuse the field
+     * rather than silently run unfenced — "the fence was requested but skipped" is a security lie, not a
+     * degradation. Surfaced through `limits.execWriteFence`.
+     */
+    readonly writeRoots?: readonly string[];
 }
 /** One finished remote command. */
 export interface ExecResult {
@@ -458,6 +468,22 @@ export interface Transport {
      * hunk matching rules, which is where a patch applier goes wrong.
      */
     patchFile?(request: PatchFileRequest, signal?: AbortSignal): Promise<PatchFileResult>;
+    /**
+     * 建立一条本地 → 远端的 TCP 转发（端口转发）。
+     *
+     * 可选：**系统 ssh 的两条路径（Tier 1 与默认 Tier 2）都实现了它**，`ssh2` 传输没有——那一条会诚实
+     * 地不声明这个方法，调用方据此报"该连接不支持端口转发"，而不是给一个连不上的端口。
+     *
+     * 只绑 `127.0.0.1`：转发出来的端口是给本机浏览器/客户端用的，绑 `0.0.0.0` 等于把一个远端服务暴露给
+     * 整个局域网。要给别人用请走 SSH 自己的 `GatewayPorts` 配置，而不是让插件默认放宽。
+     *
+     * @param request - 远端目标与可选本地端口。
+     * @param signal - 取消建立过程（已建立的转发不会因此关闭）。
+     * @returns 句柄，`localPort` 一定是真实端口（自动选择时也回填）。
+     */
+    forward?(request: ForwardRequest, signal?: AbortSignal): Promise<ForwardHandle>;
+    /** 关掉这条传输上的所有转发（dispose 时调用）；幂等。 */
+    closeForwards?(): Promise<void>;
     /** Native delete (`fs.remove`); absent on Tier 1, which uses its shell primitive instead. */
     removePath?(request: RemovePathRequest, signal?: AbortSignal): Promise<void>;
     /** Native rename/move (`fs.rename`); absent on Tier 1, which uses its shell primitive. */

package/lib/types/src/host/integration/fs/fs-provider.d.ts

@@ -284,7 +284,24 @@ export declare class RoutedFsProvider extends FileSystem {
      */
     private syncSessionRoots;
     private routedTarget;
-    /** Enforce the per-call policy and the root's own writability. */
+    /**
+     * Enforce the per-call policy and the root's own writability.
+     *
+     * Three gates, in order:
+     *  1. `read-only` denies every mutation (the platform's own contract);
+     *  2. a root registered `writable: false` denies;
+     *  3. under **`workspace-write`**, the target must be inside the session's workspace — where "workspace"
+     *     includes the directories **this session added** (product decision 2026-11-04: 「添加到会话的目录」=
+     *     该目录临时成为 workspace 的一部分). Before that decision the plugin admitted every writable root it
+     *     could route, which made the mode wider than the platform's own `fs-sandbox` fence
+     *     (`workspace-write` = "canonicalizes under `workspaceRoot` or the platform temp area").
+     *
+     * A call without a per-call policy keeps the historical behaviour (the mode comes from
+     * {@link sandboxMode}); the area rule needs `workspaceRoot`, which only the policy carries.
+     *
+     * @param routed - the resolved target.
+     * @param policy - the per-call sandbox policy the tool layer resolved.
+     */
     private assertWritable;
     /**
      * Previous text content, when it is readable text inside the cap; `undefined` otherwise.

package/lib/types/src/wiring/helpers.d.ts

@@ -60,7 +60,16 @@ export declare function resolveAuth(ctx: Context, profile: ConnectionProfile): P
 export declare function resolvePasswordSecret(credentials: CredentialsLike, key: string): Promise<string | undefined>;
 /** Whether the optional `ssh2` dependency can be loaded in this installation. */
 export declare function isSsh2Available(): boolean;
-/** Expand a leading `~` to the user's home directory. */
+/**
+ * Expand a leading `~` to the user's home directory.
+ *
+ * **One implementation.** 这里原来自己写了一份，和 `host/domain/roots/ssh-config.ts` 的那份并存；两份对
+ * `~\\seg` 的处理并不同（`join` 折叠分隔符，字符串拼接不会），同一个配置在"连接凭据路径"与"ssh-config
+ * 导入"两条路上可能落到不同路径。domain 的那份是纯函数（`home` 由调用方传入），全仓只保留它。
+ *
+ * @param path - the configured path, possibly starting with `~`.
+ * @returns the absolute path, or the input unchanged when it has no leading `~`.
+ */
 export declare function expandHome(path: string): string;
 /** One configured connection. */
 export interface ConnectionEntry {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-over-ssh",
-  "version": "0.1.1",
+  "version": "0.2.1",
   "description": "SSH remote development for DeepSeek Harness: connections (key/password/ProxyJump/ssh config), remote files without sync, remote terminal, remote workspaces, remote @-completion, upload/download.",
   "type": "module",
   "main": "lib/index.js",