dsh-over-ssh 0.2.0 → 0.2.1

package/lib/index.js

@@ -3126,7 +3126,13 @@ function createTransferService(dependencies) {
           ...request.signal === void 0 ? {} : { signal: request.signal }
         })
       });
-      const digest = await lookupDigest(dependencies, localPath);
+      const degradations = [...decision.degradations];
+      let digest = { sha256: void 0, degradation: void 0 };
+      const needsLocalDigest = move.writerSha256 !== void 0 || decision.resumed;
+      if (needsLocalDigest) {
+        digest = await lookupDigest(dependencies, localPath);
+        if (digest.degradation !== void 0) degradations.push(digest.degradation);
+      }
       if (move.writerSha256 !== void 0 && digest.sha256 !== void 0 && !digestsMatch(move.writerSha256, digest.sha256)) {
         throw transferFailure(
           "verify-failed",
@@ -3134,12 +3140,15 @@ function createTransferService(dependencies) {
           { ...context, bytesTransferred: move.bytesTransferred, chunks: move.chunks, localSha256: digest.sha256, remoteSha256: move.writerSha256 }
         );
       }
-      const degradations = [...decision.degradations, ...digest.degradation === void 0 ? [] : [digest.degradation]];
       let landed = move.writerSha256;
       if (decision.resumed && landed === void 0) {
         const remote = await lookupRemoteDigest(dependencies, target.absolute, request.signal);
         if (remote.degradation !== void 0) degradations.push(remote.degradation);
         if (remote.sha256 !== void 0) {
+          if (digest.sha256 === void 0) {
+            digest = await lookupDigest(dependencies, localPath);
+            if (digest.degradation !== void 0) degradations.push(digest.degradation);
+          }
           if (digest.sha256 !== void 0 && !digestsMatch(remote.sha256, digest.sha256)) {
             throw transferFailure(
               "verify-failed",
@@ -4182,7 +4191,7 @@ function planDelete(records, request) {
       refusals.push({ id, reason: "unreadable" });
       continue;
     }
-    if (record2.classification === "subsession") {
+    if (record2.classification === "subsession" && !isOrphanSubsession(record2, byId)) {
       deferred.push(id);
       continue;
     }
@@ -4203,6 +4212,11 @@ function planDelete(records, request) {
   for (const id of ordered) bytes += byId.get(id)?.bytes ?? 0;
   return { delete: ordered, refusals, bytes };
 }
+function isOrphanSubsession(record2, byId) {
+  if (record2.parentSessionId === void 0) return true;
+  const parent = byId.get(record2.parentSessionId);
+  return parent === void 0 || parent.classification === "unreadable";
+}
 function descendantsOf(records, rootId) {
   const children = /* @__PURE__ */ new Map();
   for (const record2 of records) {
@@ -4391,6 +4405,11 @@ function createSerialQueue() {
   };
 }
 
+// src/shared/path-fold.ts
+function foldPathKey(path) {
+  return path.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+}
+
 // src/host/app/session-admin/session-admin-context.ts
 function isMissing(error) {
   const code = error?.code;
@@ -4406,18 +4425,18 @@ function createSessionAdminContext(deps) {
       reason: "bin-inside-sessions-root"
     });
   }
-  const indexePath = () => joinPath(binRoot, SESSION_TRASH_INDEX_FILE);
+  const indexPath = () => joinPath(binRoot, SESSION_TRASH_INDEX_FILE);
   const queue = createSerialQueue();
   const serialized = (operation) => (
     // Order matters: take the in-process slot **first** (the queue), then the cross-process lock. Holding a file
     // lock while queued behind another in-process call would serialize on the wrong resource.
-    queue.run(() => deps.withLock === void 0 ? operation() : deps.withLock(indexePath(), operation))
+    queue.run(() => deps.withLock === void 0 ? operation() : deps.withLock(indexPath(), operation))
   );
   const entryDir = (segment) => joinPath(binRoot, "entries", segment);
   const readIndex = async () => {
     let text8;
     try {
-      text8 = await deps.readText(indexePath());
+      text8 = await deps.readText(indexPath());
     } catch (error) {
       if (isMissing(error)) return [];
       throw error;
@@ -4427,77 +4446,104 @@ function createSessionAdminContext(deps) {
   const writeIndex = async (entries) => {
     const text8 = serializeSessionTrashIndex(entries);
     if (deps.writeTextAtomic !== void 0) {
-      await deps.writeTextAtomic(indexePath(), text8);
+      await deps.writeTextAtomic(indexPath(), text8);
       return;
     }
-    await deps.writeText(indexePath(), text8);
+    await deps.writeText(indexPath(), text8);
+  };
+  const INVENTORY_CONCURRENCY = 8;
+  const mapWithLimit = async (items, limit, task) => {
+    const results = new Array(items.length);
+    let next = 0;
+    const workers = Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, async () => {
+      for (; ; ) {
+        const index = next;
+        next += 1;
+        if (index >= items.length) return;
+        results[index] = await task(items[index], index);
+      }
+    });
+    await Promise.all(workers);
+    return results;
+  };
+  const throwIfAborted = (signal) => {
+    if (signal?.aborted === true) {
+      throw new SshDevError("CANCELLED", "\u64CD\u4F5C\u5DF2\u53D6\u6D88", { reason: "aborted" });
+    }
   };
   const inventory = async (options = {}) => {
-    void options;
+    const signal = options.signal;
+    throwIfAborted(signal);
     const projects = await deps.listDir(sessionsRoot);
-    const records = [];
-    for (const project of projects) {
-      if (!project.isDirectory) continue;
-      const projectDir = joinPath(sessionsRoot, project.name);
+    const projectNames = projects.filter((project) => project.isDirectory).map((project) => project.name);
+    const perProject = await mapWithLimit(projectNames, INVENTORY_CONCURRENCY, async (project) => {
+      const projectDir = joinPath(sessionsRoot, project);
       const sessions = await deps.listDir(projectDir);
-      for (const session of sessions) {
-        if (!session.isDirectory) continue;
-        const dir = joinPath(projectDir, session.name);
-        const contents = await deps.listDir(dir);
-        let bytes = 0;
-        let updatedAtMs = session.mtimeMs;
-        for (const item of contents) {
-          if (item.isDirectory) continue;
-          bytes += item.bytes;
-          if (item.mtimeMs > updatedAtMs) updatedAtMs = item.mtimeMs;
-        }
-        const header = await deps.readHeader(dir);
-        if (header === void 0) {
-          records.push({
-            id: session.name,
-            projectDir: project.name,
-            segment: session.name,
-            cwd: void 0,
-            title: void 0,
-            workspaceTitle: void 0,
-            parentSessionId: void 0,
-            bytes,
-            updatedAtMs,
-            live: false,
-            running: false,
-            classification: "unreadable"
-          });
-          continue;
-        }
-        const title = header.title ?? deps.resolveSessionTitle?.(header);
-        records.push({
-          id: header.id,
-          projectDir: project.name,
+      return sessions.filter((session) => session.isDirectory).map((session) => ({ project, session }));
+    });
+    throwIfAborted(signal);
+    const entries = perProject.flat();
+    const workspaceTitles = /* @__PURE__ */ new Map();
+    const workspaceTitleOf = (cwd) => {
+      if (cwd === void 0) return void 0;
+      if (!workspaceTitles.has(cwd)) workspaceTitles.set(cwd, deps.resolveWorkspaceTitle?.(cwd));
+      return workspaceTitles.get(cwd);
+    };
+    return mapWithLimit(entries, INVENTORY_CONCURRENCY, async ({ project, session }) => {
+      throwIfAborted(signal);
+      const dir = joinPath(joinPath(sessionsRoot, project), session.name);
+      const contents = await deps.listDir(dir);
+      let bytes = 0;
+      let updatedAtMs = session.mtimeMs;
+      for (const item of contents) {
+        if (item.isDirectory) continue;
+        bytes += item.bytes;
+        if (item.mtimeMs > updatedAtMs) updatedAtMs = item.mtimeMs;
+      }
+      const header = await deps.readHeader(dir);
+      if (header === void 0) {
+        return {
+          id: session.name,
+          projectDir: project,
           segment: session.name,
-          cwd: header.cwd,
-          title,
-          workspaceTitle: deps.resolveWorkspaceTitle?.(header.cwd),
-          parentSessionId: header.parentSessionId,
+          cwd: void 0,
+          title: void 0,
+          workspaceTitle: void 0,
+          parentSessionId: void 0,
           bytes,
           updatedAtMs,
-          live: deps.isLive(header.id),
-          running: deps.isRunning(header.id),
-          classification: header.parentSessionId === void 0 ? "normal" : "subsession"
-        });
+          live: false,
+          running: false,
+          classification: "unreadable"
+        };
       }
-    }
-    return records;
+      const title = header.title ?? deps.resolveSessionTitle?.(header);
+      return {
+        id: header.id,
+        projectDir: project,
+        segment: session.name,
+        cwd: header.cwd,
+        title,
+        workspaceTitle: workspaceTitleOf(header.cwd),
+        parentSessionId: header.parentSessionId,
+        bytes,
+        updatedAtMs,
+        live: deps.isLive(header.id),
+        running: deps.isRunning(header.id),
+        classification: header.parentSessionId === void 0 ? "normal" : "subsession"
+      };
+    });
   };
-  return { deps, sessionsRoot, binRoot, indexePath, serialized, entryDir, readIndex, writeIndex, inventory };
+  return { deps, sessionsRoot, binRoot, indexPath, serialized, entryDir, readIndex, writeIndex, inventory, throwIfAborted };
 }
 function normalizePathKey(path) {
-  return path.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+  return foldPathKey(path);
 }
 
 // src/host/app/session-admin/session-admin-delete.ts
 init_errors();
 function createSessionAdminDelete(ctx) {
-  const { deps, sessionsRoot, serialized, entryDir, readIndex, writeIndex, inventory } = ctx;
+  const { deps, sessionsRoot, serialized, entryDir, readIndex, writeIndex, inventory, throwIfAborted } = ctx;
   const previewDelete = async (ids, options = {}) => {
     const records = await inventory(options);
     return planDelete(records, {
@@ -4505,10 +4551,11 @@ function createSessionAdminDelete(ctx) {
       ...options.keep === void 0 ? {} : { keep: options.keep }
     });
   };
-  const deletePermanently = async (decision, byId) => {
+  const deletePermanently = async (decision, byId, options = {}) => {
     let bytes = 0;
     const deleted = [];
     for (const id of decision.delete) {
+      throwIfAborted(options.signal);
       const record2 = byId.get(id);
       if (record2 === void 0) continue;
       if (deps.isRunning(id)) {
@@ -4523,7 +4570,7 @@ function createSessionAdminDelete(ctx) {
     }
     return { mode: "permanent", entry: void 0, recoverable: false, verified: true, copied: false, refusals: decision.refusals, bytes };
   };
-  const moveIntoBin = async (decision, byId) => {
+  const moveIntoBin = async (decision, byId, options = {}) => {
     let bytes = 0;
     let entry;
     let verified = false;
@@ -4544,6 +4591,7 @@ function createSessionAdminDelete(ctx) {
     };
     try {
       for (const id of decision.delete) {
+        throwIfAborted(options.signal);
         const record2 = byId.get(id);
         if (record2 === void 0) continue;
         if (deps.isRunning(id)) {
@@ -4631,7 +4679,7 @@ function createSessionAdminDelete(ctx) {
       ...options.keep === void 0 ? {} : { keep: options.keep }
     });
     const byId = new Map(records.map((record2) => [record2.id, record2]));
-    return mode === "permanent" ? deletePermanently(decision, byId) : moveIntoBin(decision, byId);
+    return mode === "permanent" ? deletePermanently(decision, byId, options) : moveIntoBin(decision, byId, options);
   });
   const purgeEntry = async (entryId) => {
     const entries = await readIndex();
@@ -12166,6 +12214,27 @@ var RemoteIndex = class {
    * root is correct, just slower.
    */
   #scannedOnce = /* @__PURE__ */ new Set();
+  /**
+   * In-flight enumerations, so a burst of callers on a cold root does **one** scan.
+   *
+   * 审计 2026-11-05 ts.md P1：`enumerate` 没有 single-flight——同一次键入可能同时发出 `index.scan` 与
+   * `index.find`（file-reference 一次 list 最多两个枚举，可指向同一 root），于是两次远端扫描都跑、
+   * 结果只留一份。键里带 signal 身份：不同请求的取消不能互相传染（A 的 abort 不该杀掉 B 的扫描）。
+   */
+  #inFlight = /* @__PURE__ */ new Map();
+  /** Stable identity per `AbortSignal`, only used to keep in-flight keys apart. */
+  #signalIds = /* @__PURE__ */ new WeakMap();
+  #nextSignalId = 0;
+  #inFlightKey(root, signal) {
+    if (signal === void 0) return `${root}\0`;
+    let id = this.#signalIds.get(signal);
+    if (id === void 0) {
+      this.#nextSignalId += 1;
+      id = this.#nextSignalId;
+      this.#signalIds.set(signal, id);
+    }
+    return `${root}\0${id}`;
+  }
   constructor(options) {
     this.#tiers = options.tiers;
     this.#ttlMs = options.ttlMs ?? DEFAULTS.ttlMs;
@@ -12195,9 +12264,20 @@ var RemoteIndex = class {
         };
       }
     }
-    const result = await this.#enumerateFresh(root, maxEntries, options.budgetMs ?? this.#budgetMs, options.signal);
-    if (result.cacheable) this.#remember(root, result);
-    return result;
+    const key = this.#inFlightKey(root, options.signal);
+    const running = this.#inFlight.get(key);
+    if (running !== void 0) return running;
+    const attempt = (async () => {
+      const result = await this.#enumerateFresh(root, maxEntries, options.budgetMs ?? this.#budgetMs, options.signal);
+      if (result.cacheable) this.#remember(root, result);
+      return result;
+    })();
+    this.#inFlight.set(key, attempt);
+    try {
+      return await attempt;
+    } finally {
+      if (this.#inFlight.get(key) === attempt) this.#inFlight.delete(key);
+    }
   }
   /**
    * Completion for a partially typed `@` query.
@@ -12712,6 +12792,129 @@ import { join as join9 } from "node:path";
 import { homedir as homedir2 } from "node:os";
 import { createRequire } from "node:module";
 import "@deepseek-ai/cordis";
+
+// src/host/domain/roots/ssh-config.ts
+function stripComment(line) {
+  let inQuotes = false;
+  for (let index = 0; index < line.length; index++) {
+    const char = line[index];
+    if (char === '"') inQuotes = !inQuotes;
+    else if (char === "#" && !inQuotes) return line.slice(0, index);
+  }
+  return line;
+}
+function unquote(value) {
+  if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) return value.slice(1, -1);
+  return value;
+}
+function splitKeyValue(line) {
+  const match = /^([A-Za-z][A-Za-z0-9]*)\s*(?:=|\s)\s*(.*)$/.exec(line);
+  if (match === null) return void 0;
+  const key = match[1];
+  const value = match[2];
+  if (key === void 0 || value === void 0) return void 0;
+  return [key.toLowerCase(), unquote(value.trim())];
+}
+function parseSshConfig(text8) {
+  const entries = [];
+  let current;
+  const lines = text8.split(/\r?\n/);
+  for (let index = 0; index < lines.length; index++) {
+    const raw = lines[index] ?? "";
+    const line = stripComment(raw).trim();
+    if (line === "") continue;
+    const pair = splitKeyValue(line);
+    if (pair === void 0) continue;
+    const [key, value] = pair;
+    if (key === "host") {
+      const patterns = value.split(/\s+/).filter((part) => part !== "");
+      if (patterns.length === 0) continue;
+      current = { patterns, identityFiles: [], includes: [], line: index + 1 };
+      entries.push(current);
+      continue;
+    }
+    if (current === void 0) continue;
+    switch (key) {
+      case "hostname":
+        current.hostName ??= value;
+        break;
+      case "user":
+        current.user ??= value;
+        break;
+      case "port": {
+        if (current.port !== void 0) break;
+        const port = Number.parseInt(value, 10);
+        if (Number.isInteger(port) && port > 0 && port <= 65535) current.port = port;
+        break;
+      }
+      case "identityfile":
+        current.identityFiles.push(value);
+        break;
+      case "proxyjump":
+        current.proxyJump ??= value.toLowerCase() === "none" ? "" : value;
+        break;
+      case "include":
+        current.includes.push(value);
+        break;
+      default:
+        break;
+    }
+  }
+  return entries.map((entry) => ({
+    patterns: entry.patterns,
+    ...entry.hostName === void 0 ? {} : { hostName: entry.hostName },
+    ...entry.user === void 0 ? {} : { user: entry.user },
+    ...entry.port === void 0 ? {} : { port: entry.port },
+    identityFiles: entry.identityFiles,
+    ...entry.proxyJump === void 0 || entry.proxyJump === "" ? {} : { proxyJump: entry.proxyJump },
+    includes: entry.includes,
+    line: entry.line
+  }));
+}
+function isConcretePattern(pattern) {
+  return !/[*?!]/.test(pattern);
+}
+function expandHome(path, home) {
+  if (path === "~") return home;
+  if (path.startsWith("~/") || path.startsWith("~\\")) return `${home.replace(/[\\/]+$/, "")}${path.slice(1)}`;
+  return path;
+}
+function importableEntries(entries, options = {}) {
+  const home = options.home ?? "";
+  const excluded = new Set(options.excluded ?? []);
+  const seen = /* @__PURE__ */ new Set();
+  const drafts = [];
+  const skipped = [];
+  for (const entry of entries) {
+    for (const pattern of entry.patterns) {
+      if (!isConcretePattern(pattern)) {
+        skipped.push({ pattern, reason: "wildcard", line: entry.line });
+        continue;
+      }
+      if (seen.has(pattern)) {
+        skipped.push({ pattern, reason: "duplicate", line: entry.line });
+        continue;
+      }
+      if (excluded.has(pattern)) {
+        skipped.push({ pattern, reason: "already-imported", line: entry.line });
+        continue;
+      }
+      seen.add(pattern);
+      const identityFile = entry.identityFiles[0];
+      drafts.push({
+        alias: pattern,
+        hostName: entry.hostName ?? pattern,
+        ...entry.user === void 0 ? {} : { user: entry.user },
+        ...entry.port === void 0 ? {} : { port: entry.port },
+        ...identityFile === void 0 ? {} : { identityFile: home === "" ? identityFile : expandHome(identityFile, home) },
+        ...entry.proxyJump === void 0 ? {} : { proxyJump: entry.proxyJump }
+      });
+    }
+  }
+  return { drafts, skipped };
+}
+
+// src/wiring/helpers.ts
 init_errors();
 init_ssh2_transport();
 
@@ -12800,7 +13003,7 @@ async function resolveAuth(ctx, profile) {
     return agent === void 0 ? {} : { agent };
   }
   if (spec.kind === "key") {
-    const path = expandHome(spec.keyPath);
+    const path = expandHome2(spec.keyPath);
     const privateKey = await readFile4(path).catch((error) => {
       const message = error instanceof Error ? error.message : String(error);
       throw new SshDevError("AUTH_FAILED", `\u65E0\u6CD5\u8BFB\u53D6\u79C1\u94A5 ${path}\uFF1A${message}`, { path });
@@ -12832,10 +13035,8 @@ function isSsh2Available() {
     return false;
   }
 }
-function expandHome(path) {
-  if (path === "~") return homedir2();
-  if (path.startsWith("~/") || path.startsWith("~\\")) return join9(homedir2(), path.slice(2));
-  return path;
+function expandHome2(path) {
+  return expandHome(path, homedir2());
 }
 var readSessionHeader = createDiskSessionHeaderReader();
 
@@ -12928,8 +13129,8 @@ function wireConnections(ctx, config) {
     hostKeyPolicy: profile.hostKeyPolicy,
     // A connection that names a key must use it: the alias transport otherwise relies entirely on the
     // user's own ~/.ssh/config, which silently ignores the plugin's `keyPath`.
-    ...profile.auth.kind === "key" ? { identityFile: expandHome(profile.auth.keyPath) } : {},
-    ...limits.knownHostsFile === void 0 ? {} : { knownHostsFile: expandHome(limits.knownHostsFile) },
+    ...profile.auth.kind === "key" ? { identityFile: expandHome2(profile.auth.keyPath) } : {},
+    ...limits.knownHostsFile === void 0 ? {} : { knownHostsFile: expandHome2(limits.knownHostsFile) },
     // The connection's `user` must reach ssh; otherwise a bare host falls back to the local username.
     ...profile.user === "" ? {} : { user: profile.user },
     // Password connections authenticate through an SSH_ASKPASS helper: they must stop forbidding prompts
@@ -13022,8 +13223,8 @@ function wireConnections(ctx, config) {
           sshArgv: sshPrefix("ssh", {
             alias: profile.alias ?? profile.host,
             user: profile.user,
-            ...profile.auth.kind === "key" ? { identityFile: expandHome(profile.auth.keyPath) } : {},
-            ...limits.knownHostsFile === void 0 ? {} : { knownHostsFile: expandHome(limits.knownHostsFile) },
+            ...profile.auth.kind === "key" ? { identityFile: expandHome2(profile.auth.keyPath) } : {},
+            ...limits.knownHostsFile === void 0 ? {} : { knownHostsFile: expandHome2(limits.knownHostsFile) },
             hostKeyPolicy: profile.hostKeyPolicy,
             connectTimeoutMs: limits.connectTimeoutMs ?? profile.connectTimeoutMs,
             ...passwordOptions.batchMode === void 0 ? {} : { batchMode: passwordOptions.batchMode }
@@ -13120,11 +13321,11 @@ function wireConnections(ctx, config) {
         port: profile.port,
         user: profile.user,
         authKind: profile.auth.kind,
-        ...profile.auth.kind === "key" ? { identityFile: expandHome(profile.auth.keyPath) } : {},
+        ...profile.auth.kind === "key" ? { identityFile: expandHome2(profile.auth.keyPath) } : {},
         connectTimeoutMs: profile.connectTimeoutMs
       },
       {
-        ...limits.knownHostsFile === void 0 ? {} : { knownHostsFile: expandHome(limits.knownHostsFile) },
+        ...limits.knownHostsFile === void 0 ? {} : { knownHostsFile: expandHome2(limits.knownHostsFile) },
         ...limits.connectTimeoutMs === void 0 ? {} : { connectTimeoutMs: limits.connectTimeoutMs }
       }
     );
@@ -13277,8 +13478,12 @@ import { mkdir as mkdir7 } from "node:fs/promises";
 // src/host/integration/remote/remote-face.ts
 import { Service } from "@deepseek-ai/cordis";
 import { bindTypertRemote } from "@deepseek-ai/dsh-typert-protocol";
+
+// src/shared/remote-identity.ts
 var SSH_DEV_REMOTE_NAMESPACE = "sshdev";
 var SSH_DEV_REMOTE_SERVICE = "sshDevRemote";
+
+// src/host/integration/remote/remote-face.ts
 var SSH_DEV_REMOTE_CONNECTIONS_METHOD = "connections";
 var NOT_CONNECTED_NOTE = "\u5C1A\u672A\u5EFA\u7ACB\u8FDE\u63A5\uFF1A\u4F20\u8F93\u51B3\u7B56\u5728\u9996\u6B21\u8FDE\u63A5\u65F6\u786E\u5B9A\u3002";
 function buildConnectionStatusRows(source) {
@@ -13541,7 +13746,10 @@ function registerSessionTools(ctx, service) {
   };
 }
 
-// src/host/app/roots/roots-api-http.ts
+// src/host/integration/tools/session-directory-tools.ts
+import { defineTool as defineTool2 } from "@deepseek-ai/dsh-tools";
+
+// src/host/app/roots/session-directories.ts
 init_errors();
 
 // src/host/app/roots/user-roots.ts
@@ -13951,10 +14159,10 @@ function createUserRootsStore(options) {
     cachedLoad = parsed;
     return parsed;
   };
-  const write = async (next) => {
+  const write = async (next, preparedText) => {
     const validated = validateState(next);
     const temporary = `${filePath}.${process.pid}-${++tempSequence2}.tmp`;
-    const text8 = serializeUserRoots(validated);
+    const text8 = preparedText ?? serializeUserRoots(validated);
     await io.mkdir(options.dir);
     try {
       await io.writeFile(temporary, text8);
@@ -13974,16 +14182,18 @@ function createUserRootsStore(options) {
     assertUserRootsWritable(await load());
     return write(next);
   });
+  const applyTransition = async (transition) => {
+    const loaded = await load();
+    assertUserRootsWritable(loaded);
+    const wanted = transition(loaded.state);
+    if (wanted === loaded.state) return loaded.state;
+    const wantedText = serializeUserRoots(wanted);
+    if (cachedRaw !== void 0 && wantedText === cachedRaw) return loaded.state;
+    return write(wanted, wantedText);
+  };
   const mutate = (transition) => {
     const locked = options.withLock;
-    const run = async () => serialize(async () => {
-      const loaded = await load();
-      assertUserRootsWritable(loaded);
-      const wanted = transition(loaded.state);
-      if (serializeUserRoots(wanted) === serializeUserRoots(loaded.state)) return loaded.state;
-      return write(wanted);
-    });
-    return locked === void 0 ? run() : locked(run);
+    return serialize(() => locked === void 0 ? applyTransition(transition) : locked(() => applyTransition(transition)));
   };
   return {
     filePath,
@@ -14137,6 +14347,7 @@ function isMissingFile(error) {
 }
 
 // src/host/app/roots/roots-api-http.ts
+init_errors();
 async function readBody(req, maxBytes) {
   const chunks = [];
   let total = 0;
@@ -14197,7 +14408,10 @@ var STATUS_BY_CODE = {
   TRASH_NOT_FOUND: 404,
   TRANSFER_CONFLICT: 409,
   SESSION_ACTIVE: 409,
-  REMOTE_UNSUPPORTED: 501
+  REMOTE_UNSUPPORTED: 501,
+  // 调用方主动取消（客户端断开/关掉面板）。499 是 nginx 的 "client closed request" 约定：它不是一个错误，
+  // 只是说明"没人等这个回答了"；映射成 500 会让日志里出现一堆假故障。
+  CANCELLED: 499
 };
 function codeOf(error) {
   const code = asRecord2(error)?.["code"];
@@ -14275,80 +14489,407 @@ function connectionIdFromAlias(alias) {
   return isValidConnectionId(folded) ? folded : void 0;
 }
 
-// src/shared/routes.ts
-var ROOTS_API_PATH = "/api/over-ssh/roots";
-var SESSION_API_PATH = "/api/over-ssh/sessions";
-function asRouteHost(value) {
-  if (typeof value !== "object" || value === null) return void 0;
-  const register = value.register;
-  return typeof register === "function" ? value : void 0;
-}
-
-// src/host/app/roots/roots-api-contract.ts
-var ROOTS_API_MAX_BODY_BYTES = 64 * 1024;
-var DIRECTORY_LIST_MAX_ENTRIES = 2e3;
-var REMOTE_LIST_MAX_ENTRIES = DIRECTORY_LIST_MAX_ENTRIES;
-var LOCAL_LIST_MAX_ENTRIES = DIRECTORY_LIST_MAX_ENTRIES;
-var ROOTS_API_ACTIONS = [
-  "add-root",
-  "remove-root",
-  "add-connection",
-  "update-connection",
-  "test-connection",
-  "remove-connection",
-  "list-remote",
-  "list-local",
-  "list-ssh-config",
-  "import-ssh-config",
-  "mkdir-remote",
-  "rename-remote",
-  "remove-remote",
-  "list-transfers",
-  "clear-transfers"
-];
-var ROOT_FIELDS = ["location", "path", "connectionId", "label", "writable", "workspaces", "sessions"];
-var CONNECTION_FIELDS = ["id", "host", "user", "port", "authKind", "keyPath", "credentialKey", "transport"];
-var UPDATE_CONNECTION_FIELDS = ["host", "user", "port", "authKind", "keyPath", "credentialKey", "transport"];
-function trustVerdict(req) {
-  const host = headerOf(req, "host");
-  if (host === void 0) return "no-host";
-  const hostUrl = parseAuthority(host);
-  if (hostUrl === void 0) return "bad-host";
-  if (headerOf(req, "sec-fetch-site") === "cross-site") return "cross-site";
-  const origin = headerOf(req, "origin");
-  if (origin === void 0) return "ok";
-  const trimmed = origin.trim();
-  if (trimmed === "" || trimmed === "null") return "bad-origin";
-  let originUrl;
-  try {
-    originUrl = new URL(trimmed);
-  } catch {
-    return "bad-origin";
+// src/host/app/roots/session-directories.ts
+var SESSION_DIRECTORY_MAX_ROOTS = 32;
+var SYSTEM_TREES = ["/etc", "/usr", "/bin", "/sbin", "/lib", "/lib64", "/boot", "/sys", "/proc", "/dev", "/var", "/root"];
+function directoryRefusal(request) {
+  const trimmed = request.path.trim();
+  if (trimmed === "") return "\u76EE\u5F55\u8DEF\u5F84\u4E3A\u7A7A\u3002";
+  if (request.location === "remote") {
+    if (request.connectionId === void 0 || request.connectionId === "") {
+      return "\u8FDC\u7AEF\u76EE\u5F55\u9700\u8981 connectionId\uFF08\u5148\u786E\u8BA4\u76EE\u6807\u8FDE\u63A5\uFF09\u3002";
+    }
+    if (!trimmed.startsWith("/")) return `\u8FDC\u7AEF\u76EE\u5F55\u5FC5\u987B\u662F\u7EDD\u5BF9\u8DEF\u5F84\uFF1A${trimmed}`;
+    let normalized2;
+    try {
+      normalized2 = normalizeRemotePath(trimmed);
+    } catch (error) {
+      return error instanceof Error ? error.message : `\u8FDC\u7AEF\u8DEF\u5F84\u4E0D\u5408\u6CD5\uFF1A${trimmed}`;
+    }
+    if (normalized2 === "/") return "\u4E0D\u5141\u8BB8\u628A\u8FDC\u7AEF\u7684\u6839\u76EE\u5F55 / \u6DFB\u52A0\u5230\u4F1A\u8BDD\u3002";
+    return void 0;
   }
-  if (originUrl.protocol !== "http:" && originUrl.protocol !== "https:") return "bad-origin";
-  if (originUrl.host === hostUrl.host) return "ok";
-  if (originUrl.port === "" && originUrl.hostname === hostUrl.hostname) return "ok";
-  return "bad-origin";
-}
-function trustMessage(verdict) {
-  switch (verdict) {
-    case "no-host":
-      return "\u8BF7\u6C42\u7F3A\u5C11 Host \u5934\uFF0C\u62D2\u7EDD";
-    case "bad-host":
-      return "Host \u5934\u65E0\u6CD5\u89E3\u6790\uFF0C\u62D2\u7EDD";
-    case "cross-site":
-      return "\u8DE8\u7AD9\u8BF7\u6C42\uFF08Sec-Fetch-Site: cross-site\uFF09\u88AB\u62D2\u7EDD";
-    case "bad-origin":
-      return "\u8BF7\u6C42\u7684 Origin \u4E0E Host \u4E0D\u540C\u6E90\uFF0C\u62D2\u7EDD";
-    default:
-      return "ok";
+  const normalized = trimmed.replace(/\/+$/u, "") || "/";
+  if (!isAbsoluteLocalPath(normalized)) return `\u672C\u5730\u76EE\u5F55\u5FC5\u987B\u662F\u7EDD\u5BF9\u8DEF\u5F84\uFF1A${trimmed}`;
+  if (normalized === "/") return "\u4E0D\u5141\u8BB8\u628A\u672C\u673A\u7684\u6839\u76EE\u5F55 / \u6DFB\u52A0\u5230\u4F1A\u8BDD\u3002";
+  if (SYSTEM_TREES.some((tree) => normalized === tree || localPathContains(tree, normalized))) {
+    return `\u4E0D\u5141\u8BB8\u628A\u7CFB\u7EDF\u76EE\u5F55\u6DFB\u52A0\u5230\u4F1A\u8BDD\uFF1A${normalized}`;
   }
+  const workspace = request.workspacePath.trim();
+  if (workspace !== "") {
+    if (normalized === workspace || localPathContains(normalized, workspace)) {
+      return `\u4E0D\u5141\u8BB8\u6DFB\u52A0\u5F53\u524D\u5DE5\u4F5C\u533A\u7684\u7956\u5148\u76EE\u5F55\uFF08${normalized}\uFF09\uFF1A\u90A3\u4F1A\u628A\u6574\u68F5\u7236\u6811\u7EB3\u5165\u53EF\u5199\u8303\u56F4\u3002\u8BF7\u6DFB\u52A0\u5DE5\u4F5C\u533A\u5185\u90E8\u6216\u4E0E\u5B83\u5E76\u5217\u7684\u76EE\u5F55\u3002`;
+    }
+  }
+  return void 0;
+}
+function createSessionDirectories(deps) {
+  return {
+    async add(request) {
+      const refusal = directoryRefusal(request);
+      if (refusal !== void 0) return { ok: false, reason: refusal };
+      if (request.workspacePath.trim() === "") return { ok: false, reason: "\u62FF\u4E0D\u5230\u5F53\u524D\u5DE5\u4F5C\u533A\u8DEF\u5F84\uFF0C\u65E0\u6CD5\u6DFB\u52A0\u76EE\u5F55\u3002" };
+      if (request.sessionId.trim() === "") return { ok: false, reason: "\u62FF\u4E0D\u5230\u5F53\u524D\u4F1A\u8BDD id\uFF0C\u65E0\u6CD5\u6DFB\u52A0\u76EE\u5F55\u3002" };
+      const entry = {
+        location: request.location,
+        path: request.path.trim(),
+        ...request.connectionId === void 0 ? {} : { connectionId: request.connectionId },
+        writable: true,
+        workspaces: [request.workspacePath],
+        sessions: [request.sessionId]
+      };
+      const key = userRootKey(entry);
+      let state;
+      try {
+        state = await deps.mutateUserState((current) => {
+          const existing = findRootInState(current, key);
+          if (existing === void 0) {
+            const scoped = current.roots.filter(
+              (candidate) => (candidate.sessions ?? []).includes(request.sessionId) || (candidate.workspaces ?? []).includes(request.workspacePath)
+            ).length;
+            if (scoped >= SESSION_DIRECTORY_MAX_ROOTS) {
+              throw new SshDevError(
+                "ROOT_INVALID",
+                `\u672C\u4F1A\u8BDD\u5DF2\u6DFB\u52A0 ${scoped} \u4E2A\u76EE\u5F55\uFF0C\u8FBE\u5230\u4E0A\u9650 ${SESSION_DIRECTORY_MAX_ROOTS}\uFF1B\u8BF7\u5148\u79FB\u9664\u4E0D\u518D\u9700\u8981\u7684\u76EE\u5F55\u3002`,
+                { limit: SESSION_DIRECTORY_MAX_ROOTS }
+              );
+            }
+            return addRootToState(current, entry);
+          }
+          return withSessions(withWorkspaces(current, key, [request.workspacePath]), key, [request.sessionId]);
+        });
+      } catch (error) {
+        return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+      }
+      return { ok: true, key, ...await ensureLiveAndReadAnchor(deps, key, state) };
+    },
+    async remove(request) {
+      if (request.sessionId.trim() === "") return { ok: false, reason: "\u62FF\u4E0D\u5230\u5F53\u524D\u4F1A\u8BDD id\uFF0C\u65E0\u6CD5\u79FB\u9664\u76EE\u5F55" };
+      let key = request.key?.trim() ?? "";
+      let before;
+      let state;
+      try {
+        state = await deps.mutateUserState((current) => {
+          const resolved = resolveRemoveKey(current, request);
+          if (resolved === void 0) {
+            throw new SshDevError(
+              "ROOT_INVALID",
+              request.path === void 0 ? `\u6CA1\u6709\u627E\u5230\u8981\u79FB\u9664\u7684\u76EE\u5F55\uFF1A${key}` : `\u672C\u4F1A\u8BDD\u6CA1\u6709\u8FD9\u4E2A\u76EE\u5F55\uFF1A${request.path}`,
+              { key, path: request.path }
+            );
+          }
+          key = resolved.key;
+          before = resolved.entry;
+          if (!(resolved.entry.sessions ?? []).includes(request.sessionId)) {
+            throw new SshDevError("ROOT_INVALID", "\u53EA\u80FD\u79FB\u9664\u672C\u4F1A\u8BDD\u81EA\u5DF1\u6DFB\u52A0\u7684\u76EE\u5F55\uFF1B\u8FD9\u6761\u4E0D\u662F\u672C\u4F1A\u8BDD\u52A0\u7684\u3002", { key });
+          }
+          return removeRootFromSession(current, key, request.sessionId);
+        });
+      } catch (error) {
+        return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+      }
+      if (before === void 0) return { ok: false, reason: `\u6CA1\u6709\u627E\u5230\u8981\u79FB\u9664\u7684\u76EE\u5F55\uFF1A${key}` };
+      if (!stateHasRoot(state, key)) {
+        const liveKey = await findLiveKey(deps, before);
+        if (liveKey !== void 0) await deps.unregisterRoot(liveKey);
+        return { ok: true, key };
+      }
+      await refreshLiveScope(deps, key, state);
+      return { ok: true, key };
+    }
+  };
+}
+function resolveRemoveKey(state, request) {
+  const wantedKey = request.key?.trim();
+  if (wantedKey !== void 0 && wantedKey !== "") {
+    const entry = findRootInState(state, wantedKey);
+    return entry === void 0 ? void 0 : { key: wantedKey, entry };
+  }
+  const path = request.path?.trim();
+  if (path === void 0 || path === "") return void 0;
+  const wanted = request.connectionId === void 0 ? userRootKey({ location: "local", path }) : userRootKey({ location: "remote", path, connectionId: request.connectionId });
+  for (const entry of state.roots) {
+    if (userRootKey(entry) === wanted) return { key: wanted, entry };
+  }
+  if (request.connectionId === void 0) {
+    const matches = state.roots.filter((entry) => entry.path === path);
+    if (matches.length === 1) return { key: userRootKey(matches[0]), entry: matches[0] };
+  }
+  return void 0;
+}
+async function ensureLiveAndReadAnchor(deps, key, state) {
+  const persisted = findRootInState(state, key);
+  if (persisted === void 0) return {};
+  const readAnchor = (roots2) => {
+    for (const raw of roots2) {
+      if (liveKeyOfRecord(raw, persisted) === void 0) continue;
+      const source = raw?.root ?? raw;
+      const anchor = source["anchorPath"];
+      if (typeof anchor === "string" && anchor !== "") return { anchorPath: anchor };
+      return {};
+    }
+    return {};
+  };
+  const roots = await Promise.resolve(deps.listRoots());
+  const liveEntry = roots.find((candidate) => liveKeyOfRecord(candidate, persisted) !== void 0);
+  if (liveEntry === void 0) {
+    await deps.registerRoot(persisted);
+    return readAnchor(await Promise.resolve(deps.listRoots()));
+  }
+  if (liveScopeIsCurrent(liveEntry, persisted)) return readAnchor(roots);
+  const liveKey = liveKeyOfRecord(liveEntry, persisted);
+  if (liveKey !== void 0) {
+    await deps.unregisterRoot(liveKey);
+    await deps.registerRoot(persisted);
+  }
+  return readAnchor(await Promise.resolve(deps.listRoots()));
+}
+async function findLiveKey(deps, entry) {
+  for (const raw of await Promise.resolve(deps.listRoots())) {
+    const key = liveKeyOfRecord(raw, entry);
+    if (key !== void 0) return key;
+  }
+  return void 0;
+}
+async function refreshLiveScope(deps, key, state) {
+  const persisted = findRootInState(state, key);
+  if (persisted === void 0) return;
+  const roots = await Promise.resolve(deps.listRoots());
+  const liveEntry = roots.find((candidate) => liveKeyOfRecord(candidate, persisted) !== void 0);
+  if (liveEntry === void 0) return;
+  if (liveScopeIsCurrent(liveEntry, persisted)) return;
+  const liveKey = liveKeyOfRecord(liveEntry, persisted);
+  if (liveKey === void 0) return;
+  await deps.unregisterRoot(liveKey);
+  await deps.registerRoot(persisted);
+}
+function liveScopeIsCurrent(raw, entry) {
+  const outer = raw ?? {};
+  const source = outer.root ?? outer;
+  if (source["shared"] === true) return true;
+  return sameStrings(source["workspaces"], entry.workspaces) && sameStrings(source["sessions"], entry.sessions);
+}
+function sameStrings(left, right) {
+  const asSet = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string").sort() : [];
+  const a = asSet(left);
+  const b = asSet(right);
+  return a.length === b.length && a.every((value, index) => value === b[index]);
+}
+
+// src/host/integration/tools/session-directory-tools.ts
+var SESSION_DIRECTORY_TOOL_NAMES = {
+  // **必须以 `remote_` 开头**：插件的严格参数校验网关按这个名字前缀覆盖它的全部工具
+  //（`strict-arguments.ts` 的 `STRICT_TOOL_PREFIX`），换个前缀就会静默逃过参数校验。
+  add: "remote_add_directory",
+  remove: "remote_remove_directory"
+};
+function sessionDirectoryToolDefinitions(deps) {
+  return [
+    defineTool2({
+      name: SESSION_DIRECTORY_TOOL_NAMES.add,
+      description: `Add a directory to **this conversation**, so its file tools and \`@\` completion can use it. The directory becomes part of the session workspace: under \`workspace-write\` it is readable and writable, and it is visible to this conversation only (the user's card lists it). **Requires human approval** \u2014 the call is refused when the deployment has no approval surface. Refused: a relative path, the machine root \`/\`, a system tree, a directory that is the current workspace **or one of its ancestors** (that would hand the model the whole parent tree), and more than ${SESSION_DIRECTORY_MAX_ROOTS} directories in one conversation. Prefer asking the user to add a directory when you are unsure: this tool changes your own permission boundary.`,
+      parameters: {
+        path: {
+          type: "string",
+          description: "Absolute path. Local spelling for a local directory, absolute remote path when `connectionId` is given.",
+          required: true
+        },
+        connectionId: {
+          type: "string",
+          description: "Configured connection id when the directory is on a remote host. Omit for a local directory."
+        }
+      },
+      output: {
+        schema: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            path: { type: "string", required: true },
+            added: { type: "boolean", required: true },
+            anchorPath: { type: "string" },
+            note: { type: "string" }
+          }
+        },
+        render: (_args, value) => {
+          const record2 = value;
+          const anchor = typeof record2["anchorPath"] === "string" ? `\uFF08\u951A\u70B9 ${record2["anchorPath"]}\uFF09` : "";
+          return [{ type: "text", text: `\u5DF2\u52A0\u5165\u672C\u4F1A\u8BDD\uFF1A${String(record2["path"] ?? "")}${anchor}\u3002` }];
+        }
+      },
+      async execute(args, exec) {
+        const record2 = args ?? {};
+        const path = typeof record2["path"] === "string" ? record2["path"].trim() : "";
+        if (path === "") throw new Error("path \u5FC5\u987B\u662F\u975E\u7A7A\u5B57\u7B26\u4E32");
+        const sessionId = deps.sessionId();
+        if (sessionId === void 0 || sessionId === "") throw new Error("\u62FF\u4E0D\u5230\u5F53\u524D\u4F1A\u8BDD id\uFF0C\u65E0\u6CD5\u6DFB\u52A0\u76EE\u5F55");
+        const workspacePath = deps.workspacePathOf(sessionId);
+        if (workspacePath === void 0 || workspacePath === "") {
+          throw new Error("\u62FF\u4E0D\u5230\u5F53\u524D\u5DE5\u4F5C\u533A\u8DEF\u5F84\uFF0C\u65E0\u6CD5\u628A\u76EE\u5F55\u52A0\u5165\u672C\u4F1A\u8BDD");
+        }
+        const connectionId = typeof record2["connectionId"] === "string" && record2["connectionId"] !== "" ? record2["connectionId"] : void 0;
+        const outcome = await deps.directories.add({
+          location: connectionId === void 0 ? "local" : "remote",
+          path,
+          ...connectionId === void 0 ? {} : { connectionId },
+          workspacePath,
+          sessionId
+        });
+        if (!outcome.ok) throw new Error(outcome.reason);
+        return {
+          path,
+          added: true,
+          ...outcome.anchorPath === void 0 ? {} : { anchorPath: outcome.anchorPath },
+          note: "\u5DF2\u52A0\u5165\u672C\u4F1A\u8BDD\uFF1B`workspace-write` \u4E0B\u8BE5\u76EE\u5F55\u53EF\u8BFB\u53EF\u5199\u3002"
+        };
+      }
+    }),
+    defineTool2({
+      name: SESSION_DIRECTORY_TOOL_NAMES.remove,
+      description: "Remove a directory that **this conversation added** from its list. The directory stays registered for any other conversation that added it; a directory the user added in the plugin settings, and the conversation workspace itself, cannot be removed here. Removing only narrows access, so it needs no approval.",
+      parameters: {
+        path: { type: "string", description: "Absolute path of the directory to remove, as it was added.", required: true },
+        connectionId: {
+          type: "string",
+          description: "Connection id when the directory is remote; must match the one it was added with."
+        }
+      },
+      output: {
+        schema: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            path: { type: "string", required: true },
+            removed: { type: "boolean", required: true },
+            note: { type: "string" }
+          }
+        },
+        render: (_args, value) => {
+          const record2 = value;
+          return [{ type: "text", text: `\u5DF2\u4ECE\u672C\u4F1A\u8BDD\u79FB\u9664\uFF1A${String(record2["path"] ?? "")}\u3002` }];
+        }
+      },
+      async execute(args) {
+        const record2 = args ?? {};
+        const path = typeof record2["path"] === "string" ? record2["path"].trim() : "";
+        if (path === "") throw new Error("path \u5FC5\u987B\u662F\u975E\u7A7A\u5B57\u7B26\u4E32");
+        const sessionId = deps.sessionId();
+        if (sessionId === void 0 || sessionId === "") throw new Error("\u62FF\u4E0D\u5230\u5F53\u524D\u4F1A\u8BDD id\uFF0C\u65E0\u6CD5\u79FB\u9664\u76EE\u5F55");
+        const workspacePath = deps.workspacePathOf(sessionId);
+        if (workspacePath === void 0 || workspacePath === "") {
+          throw new Error("\u62FF\u4E0D\u5230\u5F53\u524D\u5DE5\u4F5C\u533A\u8DEF\u5F84\uFF0C\u65E0\u6CD5\u79FB\u9664\u76EE\u5F55");
+        }
+        const connectionId = typeof record2["connectionId"] === "string" && record2["connectionId"] !== "" ? record2["connectionId"] : void 0;
+        const outcome = await deps.directories.remove({
+          path,
+          ...connectionId === void 0 ? {} : { connectionId },
+          workspacePath,
+          sessionId
+        });
+        if (!outcome.ok) throw new Error(outcome.reason);
+        return { path, removed: true, note: "\u5DF2\u4ECE\u672C\u4F1A\u8BDD\u79FB\u9664\u3002" };
+      }
+    })
+  ];
+}
+function sessionDirectoryApprovalGate(ctx) {
+  return ctx.on("tools/pre-execute", async (exec, next) => {
+    if (exec.name !== SESSION_DIRECTORY_TOOL_NAMES.add) return next();
+    const args = exec.arguments ?? {};
+    const target = String(args["path"] ?? "");
+    const where = typeof args["connectionId"] === "string" && args["connectionId"] !== "" ? `${args["connectionId"]}:${target}` : target;
+    return {
+      kind: "ask",
+      reason: `${SESSION_DIRECTORY_TOOL_NAMES.add} \u60F3\u628A ${where} \u52A0\u5165\u672C\u4F1A\u8BDD\uFF08\u4F1A\u6269\u5927\u6A21\u578B\u53EF\u8BFB\u5199\u7684\u8303\u56F4\uFF09`,
+      displayReason: {
+        en: `Add ${where} to this conversation? It becomes readable and writable by the model.`,
+        zh: `\u628A ${where} \u52A0\u5165\u672C\u4F1A\u8BDD\uFF1F\u52A0\u5165\u540E\u6A21\u578B\u53EF\u8BFB\u5199\u8BE5\u76EE\u5F55\u3002`
+      }
+    };
+  });
+}
+function registerSessionDirectoryTools(ctx, deps) {
+  const disposers = sessionDirectoryToolDefinitions(deps).map((definition) => ctx.tools.register(definition));
+  const disposeGate = sessionDirectoryApprovalGate(ctx);
+  return () => {
+    for (const dispose of disposers.splice(0)) dispose();
+    disposeGate();
+  };
+}
+
+// src/shared/routes.ts
+var ROOTS_API_PATH = "/api/over-ssh/roots";
+var SESSION_API_PATH = "/api/over-ssh/sessions";
+function asRouteHost(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const register = value.register;
+  return typeof register === "function" ? value : void 0;
+}
+
+// src/host/app/roots/roots-api-contract.ts
+var ROOTS_API_MAX_BODY_BYTES = 64 * 1024;
+var DIRECTORY_LIST_MAX_ENTRIES = 2e3;
+var REMOTE_LIST_MAX_ENTRIES = DIRECTORY_LIST_MAX_ENTRIES;
+var LOCAL_LIST_MAX_ENTRIES = DIRECTORY_LIST_MAX_ENTRIES;
+var ROOTS_API_ACTIONS = [
+  "add-root",
+  "remove-root",
+  "add-connection",
+  "update-connection",
+  "test-connection",
+  "remove-connection",
+  "list-remote",
+  "list-local",
+  "list-ssh-config",
+  "import-ssh-config",
+  "mkdir-remote",
+  "rename-remote",
+  "remove-remote",
+  "list-transfers",
+  "clear-transfers"
+];
+var ROOT_FIELDS = ["location", "path", "connectionId", "label", "writable", "workspaces", "sessions"];
+var CONNECTION_FIELDS = ["id", "host", "user", "port", "authKind", "keyPath", "credentialKey", "transport"];
+var UPDATE_CONNECTION_FIELDS = ["host", "user", "port", "authKind", "keyPath", "credentialKey", "transport"];
+function trustVerdict(req) {
+  const host = headerOf(req, "host");
+  if (host === void 0) return "no-host";
+  const hostUrl = parseAuthority(host);
+  if (hostUrl === void 0) return "bad-host";
+  if (headerOf(req, "sec-fetch-site") === "cross-site") return "cross-site";
+  const origin = headerOf(req, "origin");
+  if (origin === void 0) return "ok";
+  const trimmed = origin.trim();
+  if (trimmed === "" || trimmed === "null") return "bad-origin";
+  let originUrl;
+  try {
+    originUrl = new URL(trimmed);
+  } catch {
+    return "bad-origin";
+  }
+  if (originUrl.protocol !== "http:" && originUrl.protocol !== "https:") return "bad-origin";
+  if (originUrl.host === hostUrl.host) return "ok";
+  if (originUrl.port === "" && originUrl.hostname === hostUrl.hostname) return "ok";
+  return "bad-origin";
+}
+function trustMessage(verdict) {
+  switch (verdict) {
+    case "no-host":
+      return "\u8BF7\u6C42\u7F3A\u5C11 Host \u5934\uFF0C\u62D2\u7EDD";
+    case "bad-host":
+      return "Host \u5934\u65E0\u6CD5\u89E3\u6790\uFF0C\u62D2\u7EDD";
+    case "cross-site":
+      return "\u8DE8\u7AD9\u8BF7\u6C42\uFF08Sec-Fetch-Site: cross-site\uFF09\u88AB\u62D2\u7EDD";
+    case "bad-origin":
+      return "\u8BF7\u6C42\u7684 Origin \u4E0E Host \u4E0D\u540C\u6E90\uFF0C\u62D2\u7EDD";
+    default:
+      return "ok";
+  }
+}
+function headerOf(req, name2) {
+  const value = req.headers[name2] ?? req.headers[name2.toLowerCase()];
+  if (value === void 0) return void 0;
+  return Array.isArray(value) ? value[0] : value;
 }
-function headerOf(req, name2) {
-  const value = req.headers[name2] ?? req.headers[name2.toLowerCase()];
-  if (value === void 0) return void 0;
-  return Array.isArray(value) ? value[0] : value;
-}
 function parseAuthority(authority) {
   try {
     return new URL(`http://${authority}`);
@@ -14529,30 +15070,6 @@ async function handleRootActions(action, body, req, res, deps) {
       return false;
   }
 }
-async function refreshLiveScope(deps, key, state) {
-  const persisted = findRootInState(state, key);
-  if (persisted === void 0) return;
-  const raw = await Promise.resolve(deps.listRoots());
-  const liveEntry = raw.find((candidate) => liveKeyOfRecord(candidate, persisted) !== void 0);
-  if (liveEntry === void 0) return;
-  if (liveScopeIsCurrent(liveEntry, persisted)) return;
-  const liveKey = liveKeyOfRecord(liveEntry, persisted);
-  if (liveKey === void 0) return;
-  await deps.unregisterRoot(liveKey);
-  await deps.registerRoot(persisted);
-}
-function liveScopeIsCurrent(raw, entry) {
-  const outer = asRecord2(raw) ?? {};
-  const source = asRecord2(outer["root"]) ?? outer;
-  if (source["shared"] === true) return true;
-  return sameStrings(source["workspaces"], entry.workspaces) && sameStrings(source["sessions"], entry.sessions);
-}
-function sameStrings(left, right) {
-  const asSet = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string").sort() : [];
-  const a = asSet(left);
-  const b = asSet(right);
-  return a.length === b.length && a.every((value, index) => value === b[index]);
-}
 function rootAddedBySession(state, key, sessionId) {
   const entry = findRootInState(state, key);
   return (entry?.sessions ?? []).includes(sessionId);
@@ -14607,129 +15124,6 @@ function optionalWorkspaceName(value) {
 // src/host/app/roots/roots-api-connections.ts
 init_errors();
 import { homedir as homedir3 } from "node:os";
-
-// src/host/domain/roots/ssh-config.ts
-function stripComment(line) {
-  let inQuotes = false;
-  for (let index = 0; index < line.length; index++) {
-    const char = line[index];
-    if (char === '"') inQuotes = !inQuotes;
-    else if (char === "#" && !inQuotes) return line.slice(0, index);
-  }
-  return line;
-}
-function unquote(value) {
-  if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) return value.slice(1, -1);
-  return value;
-}
-function splitKeyValue(line) {
-  const match = /^([A-Za-z][A-Za-z0-9]*)\s*(?:=|\s)\s*(.*)$/.exec(line);
-  if (match === null) return void 0;
-  const key = match[1];
-  const value = match[2];
-  if (key === void 0 || value === void 0) return void 0;
-  return [key.toLowerCase(), unquote(value.trim())];
-}
-function parseSshConfig(text8) {
-  const entries = [];
-  let current;
-  const lines = text8.split(/\r?\n/);
-  for (let index = 0; index < lines.length; index++) {
-    const raw = lines[index] ?? "";
-    const line = stripComment(raw).trim();
-    if (line === "") continue;
-    const pair = splitKeyValue(line);
-    if (pair === void 0) continue;
-    const [key, value] = pair;
-    if (key === "host") {
-      const patterns = value.split(/\s+/).filter((part) => part !== "");
-      if (patterns.length === 0) continue;
-      current = { patterns, identityFiles: [], includes: [], line: index + 1 };
-      entries.push(current);
-      continue;
-    }
-    if (current === void 0) continue;
-    switch (key) {
-      case "hostname":
-        current.hostName ??= value;
-        break;
-      case "user":
-        current.user ??= value;
-        break;
-      case "port": {
-        if (current.port !== void 0) break;
-        const port = Number.parseInt(value, 10);
-        if (Number.isInteger(port) && port > 0 && port <= 65535) current.port = port;
-        break;
-      }
-      case "identityfile":
-        current.identityFiles.push(value);
-        break;
-      case "proxyjump":
-        current.proxyJump ??= value.toLowerCase() === "none" ? "" : value;
-        break;
-      case "include":
-        current.includes.push(value);
-        break;
-      default:
-        break;
-    }
-  }
-  return entries.map((entry) => ({
-    patterns: entry.patterns,
-    ...entry.hostName === void 0 ? {} : { hostName: entry.hostName },
-    ...entry.user === void 0 ? {} : { user: entry.user },
-    ...entry.port === void 0 ? {} : { port: entry.port },
-    identityFiles: entry.identityFiles,
-    ...entry.proxyJump === void 0 || entry.proxyJump === "" ? {} : { proxyJump: entry.proxyJump },
-    includes: entry.includes,
-    line: entry.line
-  }));
-}
-function isConcretePattern(pattern) {
-  return !/[*?!]/.test(pattern);
-}
-function expandHome2(path, home) {
-  if (path === "~") return home;
-  if (path.startsWith("~/") || path.startsWith("~\\")) return `${home.replace(/[\\/]+$/, "")}${path.slice(1)}`;
-  return path;
-}
-function importableEntries(entries, options = {}) {
-  const home = options.home ?? "";
-  const excluded = new Set(options.excluded ?? []);
-  const seen = /* @__PURE__ */ new Set();
-  const drafts = [];
-  const skipped = [];
-  for (const entry of entries) {
-    for (const pattern of entry.patterns) {
-      if (!isConcretePattern(pattern)) {
-        skipped.push({ pattern, reason: "wildcard", line: entry.line });
-        continue;
-      }
-      if (seen.has(pattern)) {
-        skipped.push({ pattern, reason: "duplicate", line: entry.line });
-        continue;
-      }
-      if (excluded.has(pattern)) {
-        skipped.push({ pattern, reason: "already-imported", line: entry.line });
-        continue;
-      }
-      seen.add(pattern);
-      const identityFile = entry.identityFiles[0];
-      drafts.push({
-        alias: pattern,
-        hostName: entry.hostName ?? pattern,
-        ...entry.user === void 0 ? {} : { user: entry.user },
-        ...entry.port === void 0 ? {} : { port: entry.port },
-        ...identityFile === void 0 ? {} : { identityFile: home === "" ? identityFile : expandHome2(identityFile, home) },
-        ...entry.proxyJump === void 0 ? {} : { proxyJump: entry.proxyJump }
-      });
-    }
-  }
-  return { drafts, skipped };
-}
-
-// src/host/app/roots/roots-api-connections.ts
 async function handleConnectionActions(action, body, req, res, deps) {
   switch (action) {
     case "list-ssh-config": {
@@ -14748,14 +15142,12 @@ async function handleConnectionActions(action, body, req, res, deps) {
       }
       if (wanted.length === 0) throw new SshDevError("CONNECTION_INVALID", "\u6CA1\u6709\u9009\u62E9\u8981\u5BFC\u5165\u7684\u522B\u540D", {});
       const before = await currentUserState(deps);
-      const found = await sshConfigCandidates(deps, before.connections.map((entry) => entry.id));
-      if (found === void 0) {
+      const plan = await planSshImport(deps, before.connections.map((entry) => entry.id));
+      if (plan === void 0) {
         throw new SshDevError("CONNECTION_INVALID", "\u8FD9\u4E2A\u5BBF\u4E3B\u7EC4\u5408\u6CA1\u6709\u63D0\u4F9B ~/.ssh/config \u7684\u8BFB\u53D6\u80FD\u529B", {});
       }
-      const byAlias = new Map(found.candidates.map((candidate) => [candidate.alias, candidate]));
-      const text8 = await deps.readSshConfig?.();
-      const drafts = importableEntries(parseSshConfig(text8 ?? ""), { home: homedir3() }).drafts;
-      const draftByAlias = new Map(drafts.map((draft) => [draft.alias, draft]));
+      const byAlias = new Map(plan.candidates.map((candidate) => [candidate.alias, candidate]));
+      const draftByAlias = new Map(plan.drafts.map((draft) => [draft.alias, draft]));
       const accepted = [];
       const refused = [];
       const seenIds = new Set(before.connections.map((entry) => entry.id));
@@ -14773,7 +15165,10 @@ async function handleConnectionActions(action, body, req, res, deps) {
         seenIds.add(candidate.suggestedId);
         accepted.push(connectionRecordFromCandidate(draft, candidate.suggestedId));
       }
-      for (const record2 of accepted) await deps.addConnection(record2);
+      if (accepted.length > 0) {
+        if (deps.addConnections !== void 0) await deps.addConnections(accepted);
+        else for (const record2 of accepted) await deps.addConnection(record2);
+      }
       const state = await reconcile(deps, (current) => {
         let next = current;
         for (const record2 of accepted) {
@@ -15015,11 +15410,11 @@ function publicProbeResult(raw) {
     ms
   };
 }
-async function sshConfigCandidates(deps, excluded) {
+async function planSshImport(deps, excluded) {
   const read = deps.readSshConfig;
   if (read === void 0) return void 0;
   const text8 = await read();
-  if (text8 === void 0 || text8.trim() === "") return { candidates: [], skipped: [] };
+  if (text8 === void 0 || text8.trim() === "") return { candidates: [], skipped: [], drafts: [] };
   const result = importableEntries(parseSshConfig(text8), { home: homedir3(), excluded });
   const taken = new Set(excluded);
   const candidates = [];
@@ -15045,7 +15440,12 @@ async function sshConfigCandidates(deps, excluded) {
       suggestedId
     });
   }
-  return { candidates, skipped };
+  return { candidates, skipped, drafts: result.drafts };
+}
+async function sshConfigCandidates(deps, excluded) {
+  const plan = await planSshImport(deps, excluded);
+  if (plan === void 0) return void 0;
+  return { candidates: plan.candidates, skipped: plan.skipped };
 }
 function connectionRecordFromCandidate(draft, id) {
   const keyPath = draft.identityFile === void 0 || draft.identityFile === "" ? void 0 : draft.identityFile;
@@ -15537,6 +15937,12 @@ function createRootsWiring(deps) {
   const transfers = deps.transfers;
   const readCredentials = deps.readCredentials;
   const testConnection = deps.testConnection;
+  const sessionDirectories = createSessionDirectories({
+    mutateUserState: (transition) => store2.mutate(transition),
+    listRoots: () => deps.listRoots(),
+    registerRoot: deps.registerRoot,
+    unregisterRoot: deps.unregisterRoot
+  });
   const apiDeps = {
     listRoots: () => deps.listRoots(),
     listConnections: () => deps.listConnections(),
@@ -15553,6 +15959,39 @@ function createRootsWiring(deps) {
       deps.applyConnection(entry, entry.id);
       return next;
     },
+    addConnections: async (entries) => {
+      if (entries.length === 0) return store2.load().then((loaded) => loaded.state);
+      const applied = [];
+      try {
+        for (const entry of entries) {
+          deps.applyConnection(entry, entry.id);
+          applied.push(entry.id);
+        }
+      } catch (error) {
+        for (const id of applied) {
+          try {
+            deps.removeConnection(id);
+          } catch {
+          }
+        }
+        throw error;
+      }
+      try {
+        return await store2.mutate((state) => {
+          let next = state;
+          for (const entry of entries) next = stateHasConnection(next, entry.id) ? next : addConnectionToState(next, entry);
+          return next;
+        });
+      } catch (error) {
+        for (const id of applied) {
+          try {
+            deps.removeConnection(id);
+          } catch {
+          }
+        }
+        throw error;
+      }
+    },
     applyConnection: async (entry, previousId) => {
       deps.applyConnection(entry, previousId);
     },
@@ -15636,6 +16075,7 @@ function createRootsWiring(deps) {
   return {
     api,
     store: store2,
+    sessionDirectories,
     mergeUserRoots,
     routeWarnings: () => [...routeWarnings],
     routeFacts: () => ({ injectRan, routeRegistered, warnings: [...routeWarnings] }),
@@ -15778,13 +16218,34 @@ function createSessionApi(deps) {
   return { handle, dispose: () => {
   } };
 }
+function abortOnDisconnect(res) {
+  const controller = new AbortController();
+  const closable = res;
+  const onClose = () => {
+    if (closable.writableEnded !== true) controller.abort();
+  };
+  if (typeof closable.on === "function") closable.on("close", onClose);
+  return {
+    signal: controller.signal,
+    dispose: () => {
+      if (typeof closable.off === "function") closable.off("close", onClose);
+    }
+  };
+}
 async function serveSnapshot2(req, res, deps) {
   const service = deps.service();
   if (service === void 0) {
     send(req, res, 200, { ok: true, available: false, sessions: [], bin: [], policy: deps.policy() });
     return;
   }
-  const [sessions, bin] = await Promise.all([service.inventory(), service.list()]);
+  const connection = abortOnDisconnect(res);
+  let sessions;
+  let bin;
+  try {
+    [sessions, bin] = await Promise.all([service.inventory({ signal: connection.signal }), service.list()]);
+  } finally {
+    connection.dispose();
+  }
   send(req, res, 200, {
     ok: true,
     available: true,
@@ -15801,10 +16262,19 @@ async function serveAction2(req, res, deps) {
     return;
   }
   const service = requireService(deps);
+  const connection = abortOnDisconnect(res);
+  try {
+    return await serveActionWithSignal(action, body, req, res, deps, service, connection.signal);
+  } finally {
+    connection.dispose();
+  }
+}
+async function serveActionWithSignal(action, body, req, res, deps, service, signal) {
+  const options = { signal };
   switch (action) {
     case "preview": {
       const ids = readIds(body);
-      const decision = await service.previewDelete(ids);
+      const decision = await service.previewDelete(ids, options);
       send(req, res, 200, { ok: true, delete: decision.delete, refusals: decision.refusals, bytes: decision.bytes });
       return;
     }
@@ -15819,7 +16289,7 @@ async function serveAction2(req, res, deps) {
         });
         return;
       }
-      const result = await service.deleteSession(ids, { mode });
+      const result = await service.deleteSession(ids, { mode, ...options });
       send(req, res, 200, {
         ok: true,
         mode: result.mode,
@@ -15847,7 +16317,7 @@ async function serveAction2(req, res, deps) {
         });
         return;
       }
-      const result = await service.deleteWorkspaceSessions(cwd, { mode });
+      const result = await service.deleteWorkspaceSessions(cwd, { mode, ...options });
       send(req, res, 200, {
         ok: true,
         mode: result.mode,
@@ -15867,7 +16337,7 @@ async function serveAction2(req, res, deps) {
         send(req, res, 400, { ok: false, error: "entryId \u5FC5\u987B\u662F\u975E\u7A7A\u5B57\u7B26\u4E32" });
         return;
       }
-      const result = await service.restore(entryId);
+      const result = await service.restore(entryId, options);
       send(req, res, 200, { ok: true, restoredPath: result.restoredPath, movedBy: result.movedBy });
       return;
     }
@@ -15881,12 +16351,20 @@ async function serveAction2(req, res, deps) {
         send(req, res, 400, { ok: false, error: "purge \u9700\u8981 confirm: true\uFF08\u4E0D\u53EF\u6062\u590D\uFF09", reason: "confirmation-required" });
         return;
       }
-      const result = await service.purge(entryId);
+      const result = await service.purge(entryId, options);
       send(req, res, 200, { ok: true, purged: result.purged, indexStale: result.indexStale });
       return;
     }
     case "sweep": {
-      const result = await service.sweep(deps.policy());
+      if (body["confirm"] !== true) {
+        send(req, res, 400, {
+          ok: false,
+          error: "sweep \u9700\u8981 confirm: true\uFF08\u4E0D\u53EF\u6062\u590D\uFF09",
+          reason: "confirmation-required"
+        });
+        return;
+      }
+      const result = await service.sweep(deps.policy(), options);
       send(req, res, 200, {
         ok: true,
         purged: result.purged.map((item) => ({ entryId: String(item.id), sessionId: item.sessionId, indexStale: item.indexStale })),
@@ -16008,10 +16486,15 @@ function rootLifecycleSeams(env, hooks) {
       const removed = registry.removeByLooseKey(key);
       binRootResolver.forget(removed ?? key);
       sessionRoots.invalidate();
-      if (anchor !== void 0) void rmdir(anchor).catch(() => void 0);
+      if (anchor !== void 0 && !anchorStillUsedBy(registry.records, anchor)) {
+        void rmdir(anchor).catch(() => void 0);
+      }
     }
   };
 }
+function anchorStillUsedBy(records, anchor) {
+  return records.some((record2) => record2.root.anchorPath === anchor);
+}
 function anchorPathOfRecord(records, key) {
   const target = key.toLowerCase();
   for (const record2 of records) {
@@ -16030,18 +16513,18 @@ function connectionLifecycleSeams(env, hooks) {
     // Keeping them across an edit answered for the previous host (audit finding: changing a connection's
     // host left its remote roots connected to the old machine); keeping them across a rename answered under
     // the new name for the old host.
-    applyConnection: (entry, previousId) => {
+    applyConnection: async (entry, previousId) => {
       const profile = validateConnectionProfile(toProfileInput({ ...entry, transport: "agent" }));
       profiles.set(profile.id, profile);
       if (previousId !== profile.id) {
         profiles.delete(previousId);
-        hooks.forgetPerConnection(previousId);
+        await hooks.forgetPerConnection(previousId);
         indexes.delete(previousId);
         retireBrowseBackend(browseBackends, previousId);
         forgetBackendsOf(previousId);
         void transports.release(previousId).catch(() => void 0);
       }
-      hooks.forgetPerConnection(profile.id);
+      await hooks.forgetPerConnection(profile.id);
       askpass.revive(profile.id);
       indexes.delete(profile.id);
       retireBrowseBackend(browseBackends, profile.id);
@@ -16213,11 +16696,17 @@ function provideHostServices(env) {
 }
 function provideAgentStatus(env) {
   const { ctx, agentBridge, installations, askpass, remoteHome } = env;
-  const forgetPerConnection = (connectionId) => {
+  const forgetPerConnectionAsync = async (connectionId) => {
     agentBridge.forget(connectionId);
     installations.forget(connectionId);
-    void askpass.forget(connectionId);
     remoteHome.forget(connectionId);
+    try {
+      await askpass.forget(connectionId);
+    } catch {
+    }
+  };
+  const forgetPerConnection = (connectionId) => {
+    void forgetPerConnectionAsync(connectionId);
   };
   const disposeAgent = ctx.provide("sshDevAgent", {
     outcome: (connectionId) => agentBridge.installationFor(connectionId),
@@ -16225,7 +16714,7 @@ function provideAgentStatus(env) {
       forgetPerConnection(connectionId);
     }
   });
-  return { forgetPerConnection, disposeAgent };
+  return { forgetPerConnection, forgetPerConnectionAsync, disposeAgent };
 }
 function createBinHousekeeping(env) {
   const { ctx, limits, binService } = env;
@@ -16292,7 +16781,7 @@ function mergePersistedRoots(env) {
   });
 }
 function createTeardown(env) {
-  const { activationTimers, routes, hostServices, disposeAgent, tools } = env;
+  const { activationTimers, routes, hostServices, disposeAgent, tools, disposeSessionDirectories } = env;
   return async () => {
     for (const timer of activationTimers) clearTimeout(timer);
     routes.rootsWiring.dispose();
@@ -16305,6 +16794,7 @@ function createTeardown(env) {
     await tools.disposeLsp();
     hostServices.disposeBin();
     hostServices.disposeSessionTools();
+    disposeSessionDirectories();
     hostServices.disposeSessionRoots();
     hostServices.disposeRange();
     hostServices.disposeTransfer();
@@ -16335,7 +16825,7 @@ function wireFs(env) {
       sessionRoots: env.sessionRoots,
       readBytesRange: env.readBytesRange
     });
-    const { forgetPerConnection, disposeAgent } = provideAgentStatus({
+    const { forgetPerConnectionAsync, disposeAgent } = provideAgentStatus({
       ctx,
       agentBridge: env.agentBridge,
       installations: env.installations,
@@ -16345,14 +16835,19 @@ function wireFs(env) {
     const runBinHousekeeping = createBinHousekeeping({ ctx, limits, binService: env.binService });
     registerConfiguredRoots({ ctx, config, anchorRootDir, registry, prepareBinRoots, runBinHousekeeping });
     const routes = registerPanelRoutes(env, {
-      forgetPerConnection,
+      forgetPerConnection: forgetPerConnectionAsync,
       runBinHousekeeping,
       warn: (message) => ctx.logger?.warn?.(`over-ssh: ${message}`)
     });
+    const disposeSessionDirectories = registerSessionDirectoryTools(ctx, {
+      directories: routes.rootsWiring.sessionDirectories,
+      sessionId: () => currentSessionId(),
+      workspacePathOf: (sessionId) => readSessionCwd(ctx, sessionId)
+    });
     const activationTimers = scheduleActivationDiagnostics({ ctx, ...routes });
     watchSessionRemovals({ ctx, rootsWiring: routes.rootsWiring, onSessionRemoved: env.onSessionRemoved });
     mergePersistedRoots({ ctx, rootsWiring: routes.rootsWiring });
-    return createTeardown({ activationTimers, routes, hostServices, disposeAgent, tools: env });
+    return createTeardown({ activationTimers, routes, hostServices, disposeAgent, tools: env, disposeSessionDirectories });
   });
 }
 
@@ -16645,6 +17140,7 @@ function trimSlashes(value) {
 // src/host/integration/roots/bin-root-resolver.ts
 function createBinRootResolver(deps) {
   const choices = /* @__PURE__ */ new Map();
+  const inFlight = /* @__PURE__ */ new Map();
   const fallback = (root, note) => ({
     binRoot: binRootInsideRoot(root, deps.binDir),
     placement: "inside",
@@ -16665,6 +17161,17 @@ function createBinRootResolver(deps) {
     const key = rootKey(root);
     const existing = choices.get(key);
     if (existing !== void 0) return existing;
+    const running = inFlight.get(key);
+    if (running !== void 0) return running;
+    const attempt = resolveBinRoot(root);
+    inFlight.set(key, attempt);
+    try {
+      return await attempt;
+    } finally {
+      if (inFlight.get(key) === attempt) inFlight.delete(key);
+    }
+  };
+  const resolveBinRoot = async (root) => {
     const beside = binRootBesideRoot(root, deps.binDir);
     const parent = binParentDirectory(root);
     if (beside === void 0 || parent === void 0) {
@@ -17238,7 +17745,7 @@ function execWriteRootsFor(input) {
 }
 
 // src/host/integration/tools/remote-tools.ts
-import { defineTool as defineTool2 } from "@deepseek-ai/dsh-tools";
+import { defineTool as defineTool3 } from "@deepseek-ai/dsh-tools";
 
 // src/host/integration/tools/session-target.ts
 var NO_SESSION_CWD = "\u65E0\u6CD5\u786E\u5B9A\u8C03\u7528\u65B9\u7684\u8FDC\u7AEF\u6839\uFF1A\u8BE5\u5DE5\u5177\u9700\u8981 agent \u7684\u4F1A\u8BDD\u5DE5\u4F5C\u76EE\u5F55";
@@ -17283,7 +17790,7 @@ var READONLY_CONCURRENCY_NOTE = " Read-only: calls to this tool may overlap with
 var EXEC_SERIAL_NOTE = " This tool is deliberately NOT concurrency-safe: remote commands run one at a time per session, so `Promise.all` over several remote_exec calls produces no overlap. That protects a shared build server from concurrent `make` runs; use one command (`a && b`) or a background job instead of relying on parallelism.";
 function remoteToolDefinitions(backend) {
   return [
-    defineTool2({
+    defineTool3({
       name: "remote_grep",
       description: "Search file contents inside the remote workspace this session is working in. Returns matching lines with their file and 1-based line number. Case-insensitive and ignore-aware by default; `caseSensitive` and `noIgnore` change that. Bounded: at most 200 matches, and the result says so when the cap was reached. When the agent answers, `noIgnore` also stops `.gitignore` from hiding files; on the plain-`grep` fallback tier VCS ignores were never applied, so there the flag only controls the built-in noise directories. The result names the tier that answered in `strategy`." + READONLY_CONCURRENCY_NOTE,
       isConcurrencySafe: () => true,
@@ -17356,7 +17863,7 @@ function remoteToolDefinitions(backend) {
         };
       }
     }),
-    defineTool2({
+    defineTool3({
       name: "remote_glob",
       description: "List files in the remote workspace this session is working in by **glob pattern**, matched the same way on every transport. A pattern without `/` matches the file name at any depth (`*.h` finds `app/include/header.h`); a pattern with `/` is anchored at the directory you pass in and `*` never crosses a `/`. `**` crosses zero or more segments, `?` is one character, `[abc]` and `[!abc]` are character classes, `{a,b}` alternates. Matching is case-sensitive. Paths are returned relative to the enumerated directory. An invalid pattern (an unclosed `[` or `{`) is rejected rather than answered with an empty list. Bounded: at most 500 paths, and the result says so when the cap was reached." + READONLY_CONCURRENCY_NOTE,
       isConcurrencySafe: () => true,
@@ -17403,7 +17910,7 @@ function remoteToolDefinitions(backend) {
         };
       }
     }),
-    defineTool2({
+    defineTool3({
       name: "remote_exec",
       description: "Run one shell command on the remote host in the workspace this session is working in, and return its exit code, stdout and stderr. **A shell command is not confined by \u300C\u6DFB\u52A0\u76EE\u5F55\u300D**: it runs with the SSH user's own permissions, so it can read and write anything that user can, not only the directories added to this conversation. (A deployment that sets `limits.execWriteFence` puts a Landlock write fence around the workspace root and the directories this session added; the tool report says when that fence is active.) Output is bounded to 64 KiB per stream; when a stream is cut the result names that stream and, if the agent spilled it, the remote path holding the full text. Use this for remote builds, tests and version checks. Each call is a NEW shell: exported variables and `cd` do not carry over to the next call \u2014 pass `env` or put `source ... && cmd` in one command." + EXEC_SERIAL_NOTE,
       parameters: {
@@ -17725,7 +18232,7 @@ function strictArgumentsGate(ctx) {
 
 // src/host/integration/tools/remote-job-tools.ts
 init_errors();
-import { defineTool as defineTool3 } from "@deepseek-ai/dsh-tools";
+import { defineTool as defineTool4 } from "@deepseek-ai/dsh-tools";
 var DEFAULT_JOB_WAIT_MS = 3e4;
 var MAX_JOB_WAIT_MS = 6e5;
 var DEFAULT_JOB_POLL_MS = 500;
@@ -18036,7 +18543,7 @@ function clampInt2(value, fallback, min, max) {
 }
 function remoteJobToolDefinitions(backend) {
   return [
-    defineTool3({
+    defineTool4({
       name: "remote_exec_background",
       description: 'Start one shell command on the remote host as a background job and return immediately with its job id, instead of blocking until it finishes. Use it for anything that takes minutes: a full `m -j16` tree build, a test sweep, a long transfer. Read its output, wait for it, list jobs and cancel with `remote_job` (`action: "output" | "status" | "list" | "kill"`) \u2014 that tool also explains how output is retained. Pass `interactive: true` to keep stdin open so `remote_job { action: "stdin" }` can feed it later; without it the job reads EOF immediately.' + // 只保留「作业随连接结束」这一条：它必须出现在**启动**的地方，因为「后台 = 持久」正是这里最
       // 容易产生的错误预期。轮询与环形缓冲的细节归 `remote_job`，那里才是读输出的地方。
@@ -18114,7 +18621,7 @@ function remoteJobToolDefinitions(backend) {
         };
       }
     }),
-    defineTool3({
+    defineTool4({
       name: "remote_job",
       description: "Observe or control a background job started with `remote_exec_background`; `action` decides which: `status` reads one job's state (still running, exit code, how long it ran, bytes produced, bytes dropped); `output` reads its output from a byte offset; `list` shows every job this connection has started, running and finished; `kill` requests termination \u2014 asynchronous, so this reports the request and `status` confirms the end, and the agent kills the whole process group; `stdin` writes to a job started with `interactive: true`, and `close: true` signals EOF; `forget` drops a settled job from the list so it stops crowding `list` (a running job is refused)." + JOB_LIFETIME_NOTE + JOB_POLL_NOTE + JOB_DROP_NOTE + " `list` is per connection: it is not a cross-host task queue.",
       parameters: {
@@ -18354,7 +18861,7 @@ function registerRemoteJobTools(ctx, backend) {
 
 // src/host/integration/fs/remote-file-tools.ts
 init_errors();
-import { defineTool as defineTool4 } from "@deepseek-ai/dsh-tools";
+import { defineTool as defineTool5 } from "@deepseek-ai/dsh-tools";
 var DEFAULT_READ_LINES = 2e3;
 var MAX_READ_LINES = 5e3;
 var DEFAULT_MAX_LINE_LENGTH = 2e3;
@@ -18566,7 +19073,7 @@ function formatWrite(view) {
 }
 function requiredString3(value, field) {
   if (typeof value !== "string" || value.trim() === "") throw new Error(`${field} \u5FC5\u987B\u662F\u975E\u7A7A\u5B57\u7B26\u4E32`);
-  return value;
+  return value.trim();
 }
 function clampInt3(value, fallback, min, max) {
   const number = typeof value === "number" && Number.isFinite(value) ? Math.floor(value) : fallback;
@@ -18575,7 +19082,7 @@ function clampInt3(value, fallback, min, max) {
 }
 function remoteFileToolDefinitions(backend, allowMutation) {
   return [
-    defineTool4({
+    defineTool5({
       name: "remote_read",
       description: "Read one text file in the remote workspace this session is working in, with **1-based line numbers**, and return a window of it controlled by `offset` (first line) and `limit` (how many lines). Use this instead of `cat` through `remote_exec`: `remote_exec` truncates at 64 KiB and prints no line numbers. The result carries the file's `version` token \u2014 pass it back as `expectedVersion` to `remote_write` or `remote_edit` so a concurrent change is refused instead of overwritten. Read-only: calls to this tool may overlap with other read-only remote calls.",
       // Read-only: it observes one remote file and changes nothing.
@@ -18657,7 +19164,7 @@ function remoteFileToolDefinitions(backend, allowMutation) {
         };
       }
     }),
-    defineTool4({
+    defineTool5({
       name: "remote_write",
       description: "Write one text file in the remote workspace this session is working in, replacing its whole content. Pass `expectedVersion` (from `remote_read`) to make the write refuse when the remote file changed since that read. An existing target without a version guard is **refused** unless `force: true`: a blind overwrite silently discards content this process never saw, including an edit made by another user on a shared machine. Parent directories are created when missing. Pass `mode` to set permission bits in the same call, which is what makes a written build or probe script runnable. NOT concurrency-safe: it changes remote state, so it never joins a parallel group.",
       parameters: {
@@ -18735,7 +19242,7 @@ function remoteFileToolDefinitions(backend, allowMutation) {
         };
       }
     }),
-    defineTool4({
+    defineTool5({
       name: "remote_edit",
       description: "Replace a **literal** string inside one file in the remote workspace this session is working in. `old` is matched verbatim \u2014 a backslash-n in `old` matches the two characters `\\` and `n`, never a newline, so write real newlines when you mean them. `new` is inserted verbatim, so `$&`, `$1` and shell variables in it are not expanded. By default `old` must occur **exactly once**: zero matches and multiple matches are both refused, and the multiple-match refusal reports how many there were. Pass `all: true` to replace every occurrence on purpose. Prefer this over patching through `remote_exec` + python/sed: it cannot mis-escape your text, and `expectedVersion` (from `remote_read`) refuses the edit when the file changed in the meantime. NOT concurrency-safe: it changes remote state, so it never joins a parallel group.",
       parameters: {
@@ -18817,7 +19324,7 @@ function remoteFileToolDefinitions(backend, allowMutation) {
         };
       }
     }),
-    defineTool4({
+    defineTool5({
       name: "remote_patch",
       description: "Apply a **unified diff** to one file in the remote workspace, atomically: every hunk lands in one round trip, and if any hunk fails, nothing is written. Use this instead of calling `remote_edit` three times \u2014 three edits are three read-modify-write cycles, and a failure in the middle leaves the file half changed. Hunks are located by **context, not by line number**: the numbers in `@@ -a,b +c,d @@` are used only in error messages, so a diff generated against a slightly older file still applies as long as the context is right. Each hunk's old text must occur exactly once \u2014 zero occurrences means the file changed, several means the context is not distinctive enough; both are refused rather than guessed at.",
       parameters: {
@@ -18862,7 +19369,7 @@ function remoteFileToolDefinitions(backend, allowMutation) {
         return { path, hunks: outcome.hunks, bytes: outcome.bytes, version: outcome.version };
       }
     }),
-    defineTool4({
+    defineTool5({
       name: "remote_move",
       description: 'Move or rename one path in the remote workspace. `createParents` decides whether a missing destination directory is created (default true) or refused. A cross-device move **fails** rather than silently copying: a silent copy would turn "move then delete the source" into data loss when the delete lands first. Moving onto an existing directory is refused too \u2014 the caller meant a rename, and replacing a directory is not that. Use `remote_copy` when you want a copy that stays put. NOT concurrency-safe: it changes remote state, so it never joins a parallel group.',
       parameters: {
@@ -18899,7 +19406,7 @@ function remoteFileToolDefinitions(backend, allowMutation) {
         return { from, to, createParents };
       }
     }),
-    defineTool4({
+    defineTool5({
       name: "remote_stat",
       description: 'Read one path\'s **metadata** in the remote workspace without reading its content: whether it exists, whether it is a file, directory or symlink, its size, its modification time and its version token. Use this instead of `remote_read` when you only need to know "does it exist / how big / when did it change" \u2014 reading a file to answer that costs the whole file. The `version` it returns is the same token `remote_read` reports, so it can be passed to `remote_write` / `remote_edit` / `remote_patch` as `expectedVersion`. NOT concurrency-safe: read-only, but it never joins a parallel group.',
       parameters: {
@@ -19726,7 +20233,7 @@ ${describeInstalled(available)}`);
 
 // src/host/integration/tools/forward-tools.ts
 init_errors();
-import { defineTool as defineTool5 } from "@deepseek-ai/dsh-tools";
+import { defineTool as defineTool6 } from "@deepseek-ai/dsh-tools";
 function createForwardToolBackend(acquire) {
   const records = /* @__PURE__ */ new Map();
   let sequence2 = 0;
@@ -19788,7 +20295,7 @@ function text5(value) {
   return [{ type: "text", text: value }];
 }
 function remoteForwardDefinition(backend) {
-  return defineTool5({
+  return defineTool6({
     name: "remote_forward",
     description: "Forward one remote TCP port to a local one, so a service the agent started on the remote host becomes reachable from this machine (and from the DSH browser sidebar). Typical use: start a dev server with `remote_exec_background`, then `remote_forward` its port and open the returned `http://127.0.0.1:<port>` URL. The local listener binds **127.0.0.1 only** \u2014 never the LAN; open it up via the host sshd's `GatewayPorts` if that is really what you want. `start` returns the real local port (auto-picked when omitted) plus a `forwardId`; `list` shows what is live; `stop` closes one and is idempotent. Forwards live as long as the connection and are closed automatically when the plugin unloads, so a forgotten one does not leak a port forever \u2014 but stop the ones you are done with.",
     parameters: {
@@ -19891,7 +20398,7 @@ function registerRemoteForwardTool(ctx, backend) {
 
 // src/host/integration/tools/remote-git-tools.ts
 init_shell();
-import { defineTool as defineTool6 } from "@deepseek-ai/dsh-tools";
+import { defineTool as defineTool7 } from "@deepseek-ai/dsh-tools";
 var READ_ACTIONS = ["status", "diff", "log", "show", "branch"];
 var WRITE_ACTIONS = ["add", "commit", "checkout", "restore", "stash"];
 var ACTIONS = [...READ_ACTIONS, ...WRITE_ACTIONS];
@@ -20078,7 +20585,7 @@ function formatOutcome(value) {
 ${body}${suffix}`;
 }
 function remoteGitDefinition(backend) {
-  return defineTool6({
+  return defineTool7({
     name: "remote_git",
     description: "Run a git operation on the remote repository this session is working in, and return its **parsed** result instead of raw terminal text. Prefer this over `remote_exec git ... : the parse is done here (branch/ahead/behind, status entries, log entries), so a new git version's wording cannot break your reading. Read-only actions: `status`, `diff`, `log`, `show`, `branch`. Mutating actions: `add`, `commit`, `checkout`, `restore`, `stash` \u2014 these change the user's repository, so state the intent in your message first. Deliberately **not** offered: `reset --hard`, `clean -fd`, `push --force`, `checkout .`. Those have no safe preview; use `remote_exec` explicitly if you really need one. Git is run with `GIT_TERMINAL_PROMPT=0`, so a missing credential **fails** instead of hanging on a password prompt. Read-only actions may overlap with other read-only remote calls.",
     parameters: {
@@ -20252,7 +20759,7 @@ function registerRemoteGitTool(ctx, backend) {
 }
 
 // src/host/integration/tools/remote-lsp-tools.ts
-import { defineTool as defineTool7 } from "@deepseek-ai/dsh-tools";
+import { defineTool as defineTool8 } from "@deepseek-ai/dsh-tools";
 function toView(diagnostic) {
   return {
     line: diagnostic.line + 1,
@@ -20304,7 +20811,7 @@ function parseServer(value) {
 function remoteLspToolDefinitions(deps) {
   const { backend, registry } = deps;
   return [
-    defineTool7({
+    defineTool8({
       name: "remote_lsp",
       description: 'Ask a **language server running on the remote host** about a file: diagnostics, hover, or definition. Use this instead of running the compiler and reading its text output \u2014 the answer is structured and scoped to one document, and it is the only way to ask "what does this symbol mean" or "where is this defined". The server is started on first use and reused; it takes seconds to index a project, so the first call is slow and later ones are fast. Line and column are **1-based**, matching `remote_read`. Requires a language server installed on the remote host (gopls, rust-analyzer, typescript-language-server, pylsp, clangd); pass `server` to use a different one. NOT concurrency-safe: it changes remote state (starts a process), so it never joins a parallel group.',
       parameters: {
@@ -20517,7 +21024,7 @@ import { homedir as homedir6 } from "node:os";
 
 // src/host/integration/session/session-labels.ts
 function normalizePath(path) {
-  return path.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+  return foldPathKey(path);
 }
 function createSessionTitleResolver(ctx) {
   return (header) => {
@@ -20587,18 +21094,28 @@ function wireSessionAdmin(env) {
     listDir: async (path) => {
       try {
         const entries = await readdir6(path, { withFileTypes: true });
-        const out = [];
-        for (const entry of entries) {
-          let bytes = 0;
-          let mtimeMs = 0;
-          try {
-            const stat5 = await nodeStat2(join17(path, entry.name));
-            mtimeMs = stat5.mtimeMs;
-            if (entry.isFile()) bytes = stat5.size;
-          } catch {
+        const statLimit = 16;
+        const out = new Array(entries.length);
+        let next = 0;
+        const workers = Array.from({ length: Math.max(1, Math.min(statLimit, entries.length)) }, async () => {
+          for (; ; ) {
+            const index = next;
+            next += 1;
+            if (index >= entries.length) return;
+            const entry = entries[index];
+            if (entry === void 0) return;
+            let bytes = 0;
+            let mtimeMs = 0;
+            try {
+              const info = await nodeStat2(join17(path, entry.name));
+              mtimeMs = info.mtimeMs;
+              if (entry.isFile()) bytes = info.size;
+            } catch {
+            }
+            out[index] = { name: entry.name, isDirectory: entry.isDirectory(), bytes, mtimeMs };
           }
-          out.push({ name: entry.name, isDirectory: entry.isDirectory(), bytes, mtimeMs });
-        }
+        });
+        await Promise.all(workers);
         return out;
       } catch (error) {
         if (error.code === "ENOENT") return [];
@@ -20690,7 +21207,7 @@ init_errors();
 
 // src/host/integration/tools/management-tools.ts
 import { isAbsolute as isAbsolute3, resolve as resolve2 } from "node:path";
-import { defineTool as defineTool8 } from "@deepseek-ai/dsh-tools";
+import { defineTool as defineTool9 } from "@deepseek-ai/dsh-tools";
 function text7(value) {
   return [{ type: "text", text: value }];
 }
@@ -20765,7 +21282,7 @@ function formatEnv(result) {
 }
 function managementToolDefinitions(backend) {
   return [
-    defineTool8({
+    defineTool9({
       name: "remote_transfer",
       description: "Upload one local file to the remote workspace this session is working in, or download one remote file to the local machine. Chunked with progress; pass `resume: true` to continue an interrupted transfer instead of rewriting the whole file (the prefix is **compared with the source** before it is kept, so a changed source degrades to a full retransfer instead of splicing two files). The result reports bytes, chunk count, whether it resumed, the absolute local path the bytes landed at, and \u2014 when the host can hash \u2014 the digest of the content that actually landed. `localPath` must be **absolute**: the plugin resolves it in its own process, so a relative spelling would land under the plugin's working directory instead of anywhere the caller expects. An upload that would overwrite an **existing** remote file is refused unless you pass `expectedVersion` (from `remote_stat`/`remote_read`) or `force: true`: a silent overwrite is the one operation that destroys someone else's work without a trace.",
       parameters: {
@@ -20903,7 +21420,7 @@ function managementToolDefinitions(backend) {
         };
       }
     }),
-    defineTool8({
+    defineTool9({
       name: "remote_delete",
       description: 'Delete one path inside the remote workspace. `mode: "recycle"` (the default) moves it to the workspace recycle bin, where it is recoverable and can be undone; `mode: "permanent"` removes it for good and requires user approval. Omitting `mode` is therefore the safe call, and the result always names which mode ran.',
       parameters: {
@@ -20951,7 +21468,7 @@ function managementToolDefinitions(backend) {
         };
       }
     }),
-    defineTool8({
+    defineTool9({
       name: "remote_restore",
       description: "Undo a delete. With `id`, puts that bin entry back at the path it was deleted from; without `id`, undoes the most recent discard; with `list: true`, shows what the bin holds for this session's root and changes nothing. `remote_delete` returns the entry id as `entryId`. The bin is subject to retention limits (`binMaxEntries` / `binMaxBytes` / `binMaxAgeMs`), so an old entry may already be gone.",
       parameters: {
@@ -21013,7 +21530,7 @@ function managementToolDefinitions(backend) {
         return { action: "undone", id: outcome.id, message: outcome.message };
       }
     }),
-    defineTool8({
+    defineTool9({
       name: "remote_copy",
       description: "Copy one file to another path **on the remote host**. Both paths are inside this session's remote root. On a Tier 2 (agent) connection the copy happens on the remote side, so the bytes never cross this machine; otherwise they are relayed through it, and the result says which happened in `via`. Pass `recursive: true` to copy a whole directory tree in one round trip (Tier 2 only \u2014 it refuses rather than relaying a tree file by file). The destination must not exist, or be an empty directory: a recursive copy never deletes anything.",
       parameters: {
@@ -21076,7 +21593,7 @@ function managementToolDefinitions(backend) {
         };
       }
     }),
-    defineTool8({
+    defineTool9({
       name: "remote_env",
       description: "Sample what the remote host is and what it can do: OS/arch/distro/kernel, shell, CPU count, memory and disk, user and home, and **which commands exist** (rg, fd, git, python3, gcc, docker, ...). Ask this once instead of guessing and retrying: the answer is cached on the agent until `refresh: true`, so a repeat call costs one round trip and no resampling.",
       parameters: {