dsh-over-ssh 0.2.0 → 0.2.2

package/lib/index.js

@@ -420,7 +420,7 @@ function createProxyForwarder(options) {
         }
         const idleMs = now() - current.lastActivityAt;
         if (idleMs < idleTimeoutMs) return;
-        void closeEntry(current).then(() => options.onReclaimed?.(handle, idleMs));
+        void closeEntry(current).then(() => options.onReclaimed?.(handle, idleMs)).catch(() => void 0);
       }, checkMs);
       entry.timer.unref?.();
     }
@@ -1267,6 +1267,13 @@ ${buildRemoteScript(request.script)}`;
           ...request.env === void 0 ? {} : { env: request.env }
         });
       }
+      /** Mark the transport lost **only if the dead session is still the current one** (a reconnect may have won). */
+      #markSessionLost(session) {
+        if (this.#session !== session) return;
+        this.#sftp = void 0;
+        this.#sftpPending = void 0;
+        this.markState("lost");
+      }
       #requireSession() {
         if (this.#session === void 0) {
           throw new SshDevError("CONNECTION_LOST", "SSH \u4F1A\u8BDD\u5C1A\u672A\u5EFA\u7ACB", { connectionId: this.id });
@@ -1324,8 +1331,13 @@ ${buildRemoteScript(request.script)}`;
         }
         const connector = this.#options.connector ?? defaultConnector;
         try {
-          this.#session = await connector(signal === void 0 ? connect2 : { ...connect2, signal });
+          const session = await connector(signal === void 0 ? connect2 : { ...connect2, signal });
+          this.#session = session;
           this.#sessionCount++;
+          const onLost = () => this.#markSessionLost(session);
+          session.on?.("close", onLost);
+          session.on?.("error", onLost);
+          session.on?.("end", onLost);
           this.markState("ready");
         } catch (error) {
           this.markState("lost");
@@ -1651,6 +1663,35 @@ var TransportService = class {
 
 // src/host/integration/session-scope.ts
 import { AsyncLocalStorage } from "node:async_hooks";
+
+// src/host/integration/session-fork-pending.ts
+var pending = /* @__PURE__ */ new Map();
+var MAX_PENDING = 256;
+function markForkInheritancePending(childSessionId, sourceSessionId) {
+  const child = childSessionId.trim();
+  const source = sourceSessionId.trim();
+  if (child === "" || source === "" || child === source) return;
+  pending.delete(child);
+  pending.set(child, source);
+  while (pending.size > MAX_PENDING) {
+    const oldest = pending.keys().next();
+    if (oldest.done === true) break;
+    pending.delete(oldest.value);
+  }
+}
+function pendingForkSources(sessionId) {
+  if (sessionId === void 0 || sessionId === "") return [];
+  const source = pending.get(sessionId);
+  return source === void 0 ? [] : [source];
+}
+function clearForkInheritancePending(childSessionId) {
+  pending.delete(childSessionId);
+}
+function clearAllForkInheritancePending() {
+  pending.clear();
+}
+
+// src/host/integration/session-scope.ts
 var STORE_KEY = /* @__PURE__ */ Symbol.for("dsh-over-ssh/session-scope");
 function store() {
   const holder = globalThis;
@@ -1670,6 +1711,15 @@ var MAX_FORK_DEPTH = 32;
 var ancestorCache = /* @__PURE__ */ new Map();
 var ANCESTOR_CACHE_MAX = 256;
 function readSessionAncestors(ctx, sessionId) {
+  const pending2 = pendingForkSources(sessionId);
+  if (pending2.length > 0) {
+    const inherited = /* @__PURE__ */ new Set();
+    for (const source of pending2) {
+      inherited.add(source);
+      for (const ancestor of walkAncestors(ctx, source).ancestors) inherited.add(ancestor);
+    }
+    return [...inherited];
+  }
   const cached2 = ancestorCache.get(sessionId);
   if (cached2 !== void 0) {
     ancestorCache.delete(sessionId);
@@ -2193,6 +2243,7 @@ var MAX_OUTPUT_BYTES = 64 * 1024;
 var DEFAULT_EXEC_TIMEOUT_MS = 3e4;
 var MAX_EXEC_TIMEOUT_MS = 3e5;
 var MAX_EXEC_ENV_ENTRIES = 64;
+var MAX_EXEC_BATCH_CONNECTIONS = 8;
 var ENV_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function stringArg(value) {
   if (typeof value !== "string") return void 0;
@@ -3016,16 +3067,16 @@ function createTransferService(dependencies) {
   };
   const partialBytesOnRemote = async (absolute, context, signal) => {
     try {
-      const stat5 = await dependencies.statRemote(absolute);
-      return stat5.exists && stat5.isFile ? stat5.size : void 0;
+      const stat7 = await dependencies.statRemote(absolute);
+      return stat7.exists && stat7.isFile ? stat7.size : void 0;
     } catch (error) {
       throw failureFrom(error, "remote-stat-failed", "\u8BFB\u53D6\u8FDC\u7AEF\u76EE\u6807\u4FE1\u606F\u5931\u8D25\uFF08\u7EED\u4F20\u524D\u9700\u8981\u786E\u8BA4\u5DF2\u6709\u957F\u5EA6\uFF09", { ...context }, signal);
     }
   };
   const partialBytesOnLocal = async (path, context, signal) => {
     try {
-      const stat5 = await dependencies.statLocal(path);
-      return stat5.exists && stat5.isFile ? stat5.size : void 0;
+      const stat7 = await dependencies.statLocal(path);
+      return stat7.exists && stat7.isFile ? stat7.size : void 0;
     } catch (error) {
       throw failureFrom(error, "local-stat-failed", "\u8BFB\u53D6\u672C\u5730\u76EE\u6807\u4FE1\u606F\u5931\u8D25\uFF08\u7EED\u4F20\u524D\u9700\u8981\u786E\u8BA4\u5DF2\u6709\u957F\u5EA6\uFF09", { ...context }, signal);
     }
@@ -3126,7 +3177,13 @@ function createTransferService(dependencies) {
           ...request.signal === void 0 ? {} : { signal: request.signal }
         })
       });
-      const digest = await lookupDigest(dependencies, localPath);
+      const degradations = [...decision.degradations];
+      let digest = { sha256: void 0, degradation: void 0 };
+      const needsLocalDigest = move.writerSha256 !== void 0 || decision.resumed;
+      if (needsLocalDigest) {
+        digest = await lookupDigest(dependencies, localPath);
+        if (digest.degradation !== void 0) degradations.push(digest.degradation);
+      }
       if (move.writerSha256 !== void 0 && digest.sha256 !== void 0 && !digestsMatch(move.writerSha256, digest.sha256)) {
         throw transferFailure(
           "verify-failed",
@@ -3134,12 +3191,15 @@ function createTransferService(dependencies) {
           { ...context, bytesTransferred: move.bytesTransferred, chunks: move.chunks, localSha256: digest.sha256, remoteSha256: move.writerSha256 }
         );
       }
-      const degradations = [...decision.degradations, ...digest.degradation === void 0 ? [] : [digest.degradation]];
       let landed = move.writerSha256;
       if (decision.resumed && landed === void 0) {
         const remote = await lookupRemoteDigest(dependencies, target.absolute, request.signal);
         if (remote.degradation !== void 0) degradations.push(remote.degradation);
         if (remote.sha256 !== void 0) {
+          if (digest.sha256 === void 0) {
+            digest = await lookupDigest(dependencies, localPath);
+            if (digest.degradation !== void 0) degradations.push(digest.degradation);
+          }
           if (digest.sha256 !== void 0 && !digestsMatch(remote.sha256, digest.sha256)) {
             throw transferFailure(
               "verify-failed",
@@ -4182,7 +4242,7 @@ function planDelete(records, request) {
       refusals.push({ id, reason: "unreadable" });
       continue;
     }
-    if (record2.classification === "subsession") {
+    if (record2.classification === "subsession" && !isOrphanSubsession(record2, byId)) {
       deferred.push(id);
       continue;
     }
@@ -4203,6 +4263,11 @@ function planDelete(records, request) {
   for (const id of ordered) bytes += byId.get(id)?.bytes ?? 0;
   return { delete: ordered, refusals, bytes };
 }
+function isOrphanSubsession(record2, byId) {
+  if (record2.parentSessionId === void 0) return true;
+  const parent = byId.get(record2.parentSessionId);
+  return parent === void 0 || parent.classification === "unreadable";
+}
 function descendantsOf(records, rootId) {
   const children = /* @__PURE__ */ new Map();
   for (const record2 of records) {
@@ -4391,6 +4456,11 @@ function createSerialQueue() {
   };
 }
 
+// src/shared/path-fold.ts
+function foldPathKey(path) {
+  return path.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+}
+
 // src/host/app/session-admin/session-admin-context.ts
 function isMissing(error) {
   const code = error?.code;
@@ -4406,18 +4476,18 @@ function createSessionAdminContext(deps) {
       reason: "bin-inside-sessions-root"
     });
   }
-  const indexePath = () => joinPath(binRoot, SESSION_TRASH_INDEX_FILE);
+  const indexPath = () => joinPath(binRoot, SESSION_TRASH_INDEX_FILE);
   const queue = createSerialQueue();
   const serialized = (operation) => (
     // Order matters: take the in-process slot **first** (the queue), then the cross-process lock. Holding a file
     // lock while queued behind another in-process call would serialize on the wrong resource.
-    queue.run(() => deps.withLock === void 0 ? operation() : deps.withLock(indexePath(), operation))
+    queue.run(() => deps.withLock === void 0 ? operation() : deps.withLock(indexPath(), operation))
   );
   const entryDir = (segment) => joinPath(binRoot, "entries", segment);
   const readIndex = async () => {
     let text8;
     try {
-      text8 = await deps.readText(indexePath());
+      text8 = await deps.readText(indexPath());
     } catch (error) {
       if (isMissing(error)) return [];
       throw error;
@@ -4427,77 +4497,105 @@ function createSessionAdminContext(deps) {
   const writeIndex = async (entries) => {
     const text8 = serializeSessionTrashIndex(entries);
     if (deps.writeTextAtomic !== void 0) {
-      await deps.writeTextAtomic(indexePath(), text8);
+      await deps.writeTextAtomic(indexPath(), text8);
       return;
     }
-    await deps.writeText(indexePath(), text8);
+    await deps.writeText(indexPath(), text8);
+  };
+  const INVENTORY_CONCURRENCY = 8;
+  const mapWithLimit = async (items, limit, task) => {
+    const results = new Array(items.length);
+    let next = 0;
+    const workers = Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, async () => {
+      for (; ; ) {
+        const index = next;
+        next += 1;
+        if (index >= items.length) return;
+        results[index] = await task(items[index], index);
+      }
+    });
+    await Promise.all(workers);
+    return results;
+  };
+  const throwIfAborted = (signal) => {
+    if (signal?.aborted === true) {
+      throw new SshDevError("CANCELLED", "\u64CD\u4F5C\u5DF2\u53D6\u6D88", { reason: "aborted" });
+    }
   };
   const inventory = async (options = {}) => {
-    void options;
+    const signal = options.signal;
+    throwIfAborted(signal);
     const projects = await deps.listDir(sessionsRoot);
-    const records = [];
-    for (const project of projects) {
-      if (!project.isDirectory) continue;
-      const projectDir = joinPath(sessionsRoot, project.name);
+    const projectNames = projects.filter((project) => project.isDirectory).map((project) => project.name);
+    const perProject = await mapWithLimit(projectNames, INVENTORY_CONCURRENCY, async (project) => {
+      const projectDir = joinPath(sessionsRoot, project);
       const sessions = await deps.listDir(projectDir);
-      for (const session of sessions) {
-        if (!session.isDirectory) continue;
-        const dir = joinPath(projectDir, session.name);
-        const contents = await deps.listDir(dir);
-        let bytes = 0;
-        let updatedAtMs = session.mtimeMs;
-        for (const item of contents) {
-          if (item.isDirectory) continue;
-          bytes += item.bytes;
-          if (item.mtimeMs > updatedAtMs) updatedAtMs = item.mtimeMs;
-        }
-        const header = await deps.readHeader(dir);
-        if (header === void 0) {
-          records.push({
-            id: session.name,
-            projectDir: project.name,
-            segment: session.name,
-            cwd: void 0,
-            title: void 0,
-            workspaceTitle: void 0,
-            parentSessionId: void 0,
-            bytes,
-            updatedAtMs,
-            live: false,
-            running: false,
-            classification: "unreadable"
-          });
-          continue;
-        }
-        const title = header.title ?? deps.resolveSessionTitle?.(header);
-        records.push({
-          id: header.id,
-          projectDir: project.name,
+      return sessions.filter((session) => session.isDirectory).map((session) => ({ project, session }));
+    });
+    throwIfAborted(signal);
+    const entries = perProject.flat();
+    const workspaceTitles = /* @__PURE__ */ new Map();
+    const workspaceTitleOf = (cwd) => {
+      if (cwd === void 0) return void 0;
+      if (!workspaceTitles.has(cwd)) workspaceTitles.set(cwd, deps.resolveWorkspaceTitle?.(cwd));
+      return workspaceTitles.get(cwd);
+    };
+    return mapWithLimit(entries, INVENTORY_CONCURRENCY, async ({ project, session }) => {
+      throwIfAborted(signal);
+      const dir = joinPath(joinPath(sessionsRoot, project), session.name);
+      const contents = await deps.listDir(dir);
+      let bytes = 0;
+      let updatedAtMs = Math.trunc(session.mtimeMs);
+      for (const item of contents) {
+        if (item.isDirectory) continue;
+        bytes += item.bytes;
+        const itemMs = Math.trunc(item.mtimeMs);
+        if (itemMs > updatedAtMs) updatedAtMs = itemMs;
+      }
+      const header = await deps.readHeader(dir, contents);
+      if (header === void 0) {
+        return {
+          id: session.name,
+          projectDir: project,
           segment: session.name,
-          cwd: header.cwd,
-          title,
-          workspaceTitle: deps.resolveWorkspaceTitle?.(header.cwd),
-          parentSessionId: header.parentSessionId,
+          cwd: void 0,
+          title: void 0,
+          workspaceTitle: void 0,
+          parentSessionId: void 0,
           bytes,
           updatedAtMs,
-          live: deps.isLive(header.id),
-          running: deps.isRunning(header.id),
-          classification: header.parentSessionId === void 0 ? "normal" : "subsession"
-        });
+          live: false,
+          running: false,
+          classification: "unreadable"
+        };
       }
-    }
-    return records;
+      const title = header.title ?? deps.resolveSessionTitle?.(header);
+      return {
+        id: header.id,
+        projectDir: project,
+        segment: session.name,
+        cwd: header.cwd,
+        title,
+        workspaceTitle: workspaceTitleOf(header.cwd),
+        parentSessionId: header.parentSessionId,
+        bytes,
+        updatedAtMs,
+        live: deps.isLive(header.id),
+        running: deps.isRunning(header.id),
+        classification: header.parentSessionId === void 0 ? "normal" : "subsession"
+      };
+    });
   };
-  return { deps, sessionsRoot, binRoot, indexePath, serialized, entryDir, readIndex, writeIndex, inventory };
+  return { deps, sessionsRoot, binRoot, indexPath, serialized, entryDir, readIndex, writeIndex, inventory, throwIfAborted };
 }
 function normalizePathKey(path) {
-  return path.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+  return foldPathKey(path);
 }
 
 // src/host/app/session-admin/session-admin-delete.ts
 init_errors();
 function createSessionAdminDelete(ctx) {
-  const { deps, sessionsRoot, serialized, entryDir, readIndex, writeIndex, inventory } = ctx;
+  const { deps, sessionsRoot, serialized, entryDir, readIndex, writeIndex, inventory, throwIfAborted } = ctx;
   const previewDelete = async (ids, options = {}) => {
     const records = await inventory(options);
     return planDelete(records, {
@@ -4505,10 +4603,11 @@ function createSessionAdminDelete(ctx) {
       ...options.keep === void 0 ? {} : { keep: options.keep }
     });
   };
-  const deletePermanently = async (decision, byId) => {
+  const deletePermanently = async (decision, byId, options = {}) => {
     let bytes = 0;
     const deleted = [];
     for (const id of decision.delete) {
+      throwIfAborted(options.signal);
       const record2 = byId.get(id);
       if (record2 === void 0) continue;
       if (deps.isRunning(id)) {
@@ -4523,7 +4622,7 @@ function createSessionAdminDelete(ctx) {
     }
     return { mode: "permanent", entry: void 0, recoverable: false, verified: true, copied: false, refusals: decision.refusals, bytes };
   };
-  const moveIntoBin = async (decision, byId) => {
+  const moveIntoBin = async (decision, byId, options = {}) => {
     let bytes = 0;
     let entry;
     let verified = false;
@@ -4544,6 +4643,7 @@ function createSessionAdminDelete(ctx) {
     };
     try {
       for (const id of decision.delete) {
+        throwIfAborted(options.signal);
         const record2 = byId.get(id);
         if (record2 === void 0) continue;
         if (deps.isRunning(id)) {
@@ -4631,7 +4731,7 @@ function createSessionAdminDelete(ctx) {
       ...options.keep === void 0 ? {} : { keep: options.keep }
     });
     const byId = new Map(records.map((record2) => [record2.id, record2]));
-    return mode === "permanent" ? deletePermanently(decision, byId) : moveIntoBin(decision, byId);
+    return mode === "permanent" ? deletePermanently(decision, byId, options) : moveIntoBin(decision, byId, options);
   });
   const purgeEntry = async (entryId) => {
     const entries = await readIndex();
@@ -4755,7 +4855,6 @@ function createSessionAdminService(deps) {
     const ordered = [...entries].sort((left, right) => left.deletedAtMs - right.deletedAtMs);
     const doomed = [];
     const nowMs = deps.now();
-    let keptBytes = ordered.reduce((sum, item) => sum + item.bytes, 0);
     if (policy.maxAgeMs > 0) {
       for (const entry of ordered) {
         if (nowMs - entry.deletedAtMs > policy.maxAgeMs) doomed.push(entry);
@@ -4764,6 +4863,7 @@ function createSessionAdminService(deps) {
     const doomedIds = new Set(doomed.map((entry) => entry.id));
     const survivors = ordered.filter((entry) => !doomedIds.has(entry.id));
     if (policy.maxBytes > 0) {
+      let keptBytes = survivors.reduce((sum, item) => sum + item.bytes, 0);
       for (const entry of survivors) {
         if (keptBytes <= policy.maxBytes) break;
         doomed.push(entry);
@@ -4776,7 +4876,7 @@ function createSessionAdminService(deps) {
       const excess = stillKept.length - policy.maxEntries;
       for (const entry of stillKept.slice(0, excess)) {
         doomed.push(entry);
-        keptBytes -= entry.bytes;
+        doomedIds.add(entry.id);
       }
     }
     const outcome = await purgeEntries(doomed, entries);
@@ -4792,11 +4892,54 @@ function createSessionAdminService(deps) {
 }
 
 // src/host/integration/session/session-header.ts
-import { open, readdir } from "node:fs/promises";
+import { open, readdir, stat } from "node:fs/promises";
 import { join } from "node:path";
 import { createZstdDecompress } from "node:zlib";
 var SESSION_HEADER_READ_BYTES = 64 * 1024;
 var SESSION_HEADER_RETRY_BYTES = 1024 * 1024;
+function createCachedSessionHeaderReader(io, options = {}) {
+  const inner = createSessionHeaderReader(io);
+  const stat7 = io.stat;
+  if (stat7 === void 0) return inner;
+  const maxEntries = Math.max(1, Math.floor(options.maxEntries ?? SESSION_HEADER_CACHE_MAX));
+  const cache = /* @__PURE__ */ new Map();
+  return async (dir, listing) => {
+    let signature;
+    if (listing !== void 0) {
+      const log = listing.find((entry) => entry.name.startsWith("session.v") && entry.name.endsWith(".zstd"));
+      if (log !== void 0) signature = `${log.size}:${Math.trunc(log.mtimeMs)}`;
+    } else {
+      try {
+        const names = await io.listDir(dir);
+        const log = names.find((name2) => name2.startsWith("session.v") && name2.endsWith(".zstd"));
+        if (log !== void 0) {
+          const info = await stat7(join(dir, log));
+          signature = `${info.size}:${Math.trunc(info.mtimeMs)}`;
+        }
+      } catch {
+      }
+    }
+    if (signature !== void 0) {
+      const hit = cache.get(dir);
+      if (hit !== void 0 && hit.signature === signature) {
+        cache.delete(dir);
+        cache.set(dir, hit);
+        return hit.header;
+      }
+    }
+    const header = await inner(dir);
+    if (signature !== void 0) {
+      cache.set(dir, { signature, header });
+      while (cache.size > maxEntries) {
+        const oldest = cache.keys().next();
+        if (oldest.done === true) break;
+        cache.delete(oldest.value);
+      }
+    }
+    return header;
+  };
+}
+var SESSION_HEADER_CACHE_MAX = 2048;
 function parseSessionHeaderLine(text8) {
   const firstLine = text8.split("\n")[0];
   if (firstLine === void 0 || firstLine === "") return void 0;
@@ -4882,11 +5025,16 @@ function createDiskSessionHeaderIo() {
   return {
     listDir: (dir) => readdir(dir),
     readHead: readHeadFromDisk,
-    decompress: decompressPrefix
+    decompress: decompressPrefix,
+    // The cache's only input: `(size, mtime)` is what a session log's append changes.
+    stat: async (path) => {
+      const info = await stat(path);
+      return { size: info.size, mtimeMs: info.mtimeMs };
+    }
   };
 }
 function createDiskSessionHeaderReader() {
-  return createSessionHeaderReader(createDiskSessionHeaderIo());
+  return createCachedSessionHeaderReader(createDiskSessionHeaderIo());
 }
 
 // src/host/app/routed-fs.ts
@@ -5772,17 +5920,25 @@ var RootRegistry = class {
    * sessions at all: an empty list means "the session service was not readable", not "no session is live", and
    * dropping every grant on a transient read failure would break live turns.
    *
-   * @param cwds - working directories of the live sessions.
+   * @param cwds - working directories of the live sessions, optionally with the session id that owns each one.
+   *   With an id the root carries `sessions: [id]` and is writable **only by that session**; without one it is a
+   *   workspace-scoped root (the legacy shape tests and agentless compositions use).
    * @returns the session roots this call added (empty when every cwd was already covered).
    */
   syncSessionWorkspaces(cwds) {
     if (cwds.length === 0) return [];
     const live = /* @__PURE__ */ new Set();
     const added = [];
-    for (const cwd of cwds) {
+    for (const item of cwds) {
+      const cwd = typeof item === "string" ? item : item.cwd;
+      const sessionId = typeof item === "string" ? void 0 : item.sessionId;
       if (typeof cwd !== "string" || cwd === "") continue;
       if (!isAbsoluteLocalPath(normalizeLocalPath2(cwd, { caseInsensitive: false }))) continue;
-      const root = makeLocalRoot(cwd, { workspaces: [cwd], writable: true });
+      const root = makeLocalRoot(cwd, {
+        workspaces: [cwd],
+        ...sessionId === void 0 || sessionId === "" ? {} : { sessions: [sessionId] },
+        writable: true
+      });
       const key = rootKey(root);
       live.add(key);
       if (this.#localRootCovers(cwd)) continue;
@@ -5959,7 +6115,7 @@ function carryMissingState(legacy, current, files, dirs) {
       renameSync(temp, to);
     } catch (error) {
       rmSync(temp, { force: true });
-      failures.push(`${from} \u2192 ${to}\uFF1A${describe(error)}`);
+      if (!existsSync(to)) failures.push(`${from} \u2192 ${to}\uFF1A${describe(error)}`);
     }
   }
   for (const name2 of dirs) {
@@ -5972,7 +6128,7 @@ function carryMissingState(legacy, current, files, dirs) {
       renameSync(temp, to);
     } catch (error) {
       rmSync(temp, { recursive: true, force: true });
-      failures.push(`${from} \u2192 ${to}\uFF1A${describe(error)}`);
+      if (!existsSync(to)) failures.push(`${from} \u2192 ${to}\uFF1A${describe(error)}`);
     }
   }
   return failures;
@@ -6398,9 +6554,9 @@ var AgentFrameParser = class {
    */
   #append(chunk) {
     if (chunk.byteLength === 0) return;
-    const pending = this.#end - this.#start;
-    if (this.#store.byteLength - this.#start < pending + chunk.byteLength) {
-      const needed = pending + chunk.byteLength;
+    const pending2 = this.#end - this.#start;
+    if (this.#store.byteLength - this.#start < pending2 + chunk.byteLength) {
+      const needed = pending2 + chunk.byteLength;
       if (this.#store.byteLength >= needed) {
         this.#store.copyWithin(0, this.#start, this.#end);
       } else {
@@ -6409,7 +6565,7 @@ var AgentFrameParser = class {
         this.#store = grown;
       }
       this.#start = 0;
-      this.#end = pending;
+      this.#end = pending2;
     }
     this.#store.set(chunk, this.#end);
     this.#end += chunk.byteLength;
@@ -7194,9 +7350,9 @@ var AgentProtocolClient = class {
   failConnection(error) {
     if (this.#lost !== void 0) return;
     this.#lost = error;
-    const pending = [...this.#pending.values()];
+    const pending2 = [...this.#pending.values()];
     this.#pending.clear();
-    for (const entry of pending) entry.settle({ error });
+    for (const entry of pending2) entry.settle({ error });
     for (const channel of this.#blobQueue) channel.fail(error);
     this.#blobQueue.length = 0;
     this.#blobById.clear();
@@ -8081,14 +8237,14 @@ var AgentTransport = class extends TransportBase {
         }
       }
       if (expectedVersion === void 0) {
-        let stat5;
+        let stat7;
         try {
-          stat5 = asRecord(await client.request("fs.stat", { path: request.path }, this.#requestOptions(void 0, signal)));
+          stat7 = asRecord(await client.request("fs.stat", { path: request.path }, this.#requestOptions(void 0, signal)));
         } catch (error) {
           throw this.#translate(error);
         }
-        const exists = stat5?.["exists"] === true;
-        const observed = typeof stat5?.["version"] === "string" ? stat5["version"] : void 0;
+        const exists = stat7?.["exists"] === true;
+        const observed = typeof stat7?.["version"] === "string" ? stat7["version"] : void 0;
         if (!exists || observed === void 0 || observed !== expected) {
           throw new SshDevError("TRANSFER_CONFLICT", "\u8FDC\u7AEF\u6587\u4EF6\u7248\u672C\u4E0E\u8C03\u7528\u65B9\u7ED9\u51FA\u7684\u5B88\u536B\u4E0D\u4E00\u81F4\uFF0C\u5199\u5165\u88AB\u62D2\u7EDD", {
             connectionId: this.id,
@@ -9346,7 +9502,7 @@ function localVersion(info) {
 init_temp_name();
 init_errors();
 import { constants } from "node:fs";
-import { access, chmod, lstat, mkdir, open as open2, readdir as readdir2, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
+import { access, chmod, lstat, mkdir, open as open2, readdir as readdir2, rename, rm, stat as stat2, unlink, writeFile } from "node:fs/promises";
 import { dirname as dirname3, join as join5 } from "node:path";
 var LIST_STAT_CONCURRENCY = 32;
 var LocalBackend = class {
@@ -9359,12 +9515,12 @@ var LocalBackend = class {
     this.id = options.id;
     this.sandboxMode = options.sandboxMode ?? "workspace-write";
     this.#maxReadBytes = options.maxReadBytes ?? 16 * 1024 * 1024;
-    this.#statEntry = options.statEntry ?? ((path) => stat(path));
+    this.#statEntry = options.statEntry ?? ((path) => stat2(path));
   }
   async stat(absolute, signal) {
     signal?.throwIfAborted();
     try {
-      const info = await stat(absolute);
+      const info = await stat2(absolute);
       return {
         exists: true,
         isDirectory: info.isDirectory(),
@@ -10021,7 +10177,9 @@ function buildListScript(absolute) {
     `if [ ! -d "$p" ]; then printf 'DSH_ERROR=not-a-dir\\n'; exit 4; fi`,
     // GNU find (Linux). `-printf ''` is the cheap capability probe: it fails on BSD/macOS find.
     `if find "$p" -maxdepth 1 -printf '' >/dev/null 2>&1; then`,
-    `  find "$p" -mindepth 1 -maxdepth 1 -printf '%y\\t%Y\\t%s\\t%T@\\t%f\\n'`,
+    // **NUL 分隔**：文件名可以含换行（POSIX 合法，`git checkout` 就能造出来），按行切会把一个条目拆成
+    // 两行、解析出一个不存在的名字并丢掉真条目（审计 2026-11-06 第 3 轮 P1）。
+    `  find "$p" -mindepth 1 -maxdepth 1 -printf '%y\\t%Y\\t%s\\t%T@\\t%f\\0'`,
     `else`,
     `  for entry in "$p"/* "$p"/.[!.]*; do`,
     `    [ -e "$entry" ] || continue`,
@@ -10029,28 +10187,28 @@ function buildListScript(absolute) {
     `    if [ -d "$entry" ]; then kind=d; elif [ -L "$entry" ]; then kind=l; else kind=f; fi`,
     `    size=$(wc -c < "$entry" 2>/dev/null | tr -d ' ' || echo 0)`,
     `    mtime=$(stat -c '%Y' "$entry" 2>/dev/null || stat -f '%m' "$entry" 2>/dev/null || echo 0)`,
-    `    printf '%s\\t%s\\t%s\\t%s\\t%s\\n' "$kind" "$kind" "$size" "$mtime" "$name"`,
+    `    printf '%s\\t%s\\t%s\\t%s\\t%s\\0' "$kind" "$kind" "$size" "$mtime" "$name"`,
     `  done`,
     `fi`
   ].join("\n");
 }
 function parseListing(stdout) {
   const entries = [];
-  for (const line of stdout.split("\n")) {
-    if (line === "" || line.startsWith("DSH_")) continue;
-    const parts = line.split("	");
+  for (const record2 of stdout.split("\0")) {
+    if (record2 === "" || record2.startsWith("DSH_")) continue;
+    const parts = record2.split("	");
     if (parts.length < 5) continue;
     const [typeChar, targetChar, sizeText, mtimeText] = parts;
     const kind = typeChar === "d" ? "d" : typeChar === "l" ? targetChar === "d" ? "d" : "l" : "f";
     const size = Number.parseInt(sizeText, 10);
-    const seconds = Number.parseInt(mtimeText, 10);
+    const seconds = Number.parseFloat(mtimeText);
     entries.push({
       name: parts.slice(4).join("	"),
       isDirectory: kind === "d",
       isFile: kind === "f",
       isSymlink: kind === "l",
       size: Number.isFinite(size) ? size : 0,
-      mtimeMs: (Number.isFinite(seconds) ? seconds : 0) * 1e3
+      mtimeMs: Number.isFinite(seconds) ? Math.trunc(seconds * 1e3) : 0
     });
   }
   entries.sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
@@ -10438,6 +10596,13 @@ var RemoteBackend = class {
     if (result.stdout.includes("DSH_ERROR=not-a-dir")) {
       throw new SshDevError("REMOTE_NOT_FOUND", `\u8FDC\u7AEF\u76EE\u5F55\u4E0D\u5B58\u5728\uFF1A${absolute}`, { path: absolute });
     }
+    if (result.truncated === true) {
+      throw new SshDevError("REMOTE_COMMAND_FAILED", `\u76EE\u5F55\u6761\u76EE\u8FC7\u591A\uFF0C\u5217\u4E3E\u7ED3\u679C\u88AB\u622A\u65AD\uFF1A${absolute}`, {
+        path: absolute,
+        reason: "listing-truncated",
+        maxBytes: 4 * 1024 * 1024
+      });
+    }
     return parseListing(result.stdout);
   }
   /**
@@ -11079,7 +11244,21 @@ var RemoteBackend = class {
     }
     const command = tool === "sha256sum" ? "sha256sum" : "shasum -a 256";
     const result = await (await this.#transport()).exec({ argv: ["sh", "-c", `${command} -- "$1" | cut -d' ' -f1`, "dsh-digest", absolute] }, signal);
-    return result.stdout.trim();
+    if (result.exitCode !== 0) {
+      throw new SshDevError("REMOTE_COMMAND_FAILED", `\u65E0\u6CD5\u8BA1\u7B97\u8FDC\u7AEF\u6587\u4EF6\u7684 sha256\uFF08\u6458\u8981\u547D\u4EE4\u9000\u51FA\u7801 ${result.exitCode}\uFF09\uFF1A${absolute}`, {
+        path: absolute,
+        exitCode: result.exitCode,
+        stderr: result.stderr.slice(0, 200)
+      });
+    }
+    const digest = result.stdout.trim();
+    if (!/^[0-9a-f]{64}$/.test(digest)) {
+      throw new SshDevError("REMOTE_COMMAND_FAILED", `\u8FDC\u7AEF\u6458\u8981\u5DE5\u5177\u8FD4\u56DE\u4E86\u975E\u6CD5\u6458\u8981\uFF08\u4E0D\u662F 64 \u4F4D\u5C0F\u5199\u5341\u516D\u8FDB\u5236\uFF09\uFF1A${absolute}`, {
+        path: absolute,
+        digest: digest.slice(0, 120)
+      });
+    }
+    return digest;
   }
 };
 function sha256Hex(bytes) {
@@ -11910,12 +12089,12 @@ init_ssh2_transport();
 
 // src/host/integration/agent/agent-install-io.ts
 init_shell_quote();
-import { readFile as readFile2, stat as stat2 } from "node:fs/promises";
+import { readFile as readFile2, stat as stat3 } from "node:fs/promises";
 var DEFAULT_MAX_UPLOAD_BYTES = 32 * 1024 * 1024;
 function createAgentInstallIo(options) {
   const maxUploadBytes = options.maxUploadBytes ?? DEFAULT_MAX_UPLOAD_BYTES;
   const readLocal = options.readLocalFile ?? ((path) => readFile2(path).then((buffer) => new Uint8Array(buffer)));
-  const sizeOf = options.localSize ?? ((path) => stat2(path).then((info) => info.size));
+  const sizeOf = options.localSize ?? ((path) => stat3(path).then((info) => info.size));
   const exec = async (command, signal) => {
     const result = await options.transport.exec(
       { argv: ["/bin/sh", "-c", command], maxBytes: options.probeMaxBytes ?? 256 * 1024 },
@@ -11998,14 +12177,14 @@ function reviseToTier1(profile, decision, reason, hint) {
 // src/host/integration/agent/askpass-registry.ts
 function createAskpassRegistry(options) {
   const handles = /* @__PURE__ */ new Map();
-  const pending = /* @__PURE__ */ new Map();
+  const pending2 = /* @__PURE__ */ new Map();
   const retired = /* @__PURE__ */ new Set();
   const prepare = async (profile) => {
     if (!needsAskpass(profile.auth.kind)) return void 0;
     if (retired.has(profile.id)) return void 0;
     const existing = handles.get(profile.id);
     if (existing !== void 0) return existing.env;
-    const inflight = pending.get(profile.id);
+    const inflight = pending2.get(profile.id);
     if (inflight !== void 0) return inflight;
     const attempt = (async () => {
       try {
@@ -12022,16 +12201,16 @@ function createAskpassRegistry(options) {
         return void 0;
       }
     })().finally(() => {
-      pending.delete(profile.id);
+      pending2.delete(profile.id);
     });
-    pending.set(profile.id, attempt);
+    pending2.set(profile.id, attempt);
     return attempt;
   };
   const forget = async (connectionId) => {
     retired.add(connectionId);
     const handle = handles.get(connectionId);
     handles.delete(connectionId);
-    pending.delete(connectionId);
+    pending2.delete(connectionId);
     if (handle !== void 0) await handle.dispose().catch(() => void 0);
   };
   return {
@@ -12049,7 +12228,7 @@ function createAskpassRegistry(options) {
       retired.delete(connectionId);
     },
     disposeAll: async () => {
-      const ids = /* @__PURE__ */ new Set([...handles.keys(), ...pending.keys()]);
+      const ids = /* @__PURE__ */ new Set([...handles.keys(), ...pending2.keys()]);
       for (const id of ids) retired.add(id);
       await Promise.all([...ids].map((id) => forget(id)));
     }
@@ -12166,6 +12345,27 @@ var RemoteIndex = class {
    * root is correct, just slower.
    */
   #scannedOnce = /* @__PURE__ */ new Set();
+  /**
+   * In-flight enumerations, so a burst of callers on a cold root does **one** scan.
+   *
+   * 审计 2026-11-05 ts.md P1：`enumerate` 没有 single-flight——同一次键入可能同时发出 `index.scan` 与
+   * `index.find`（file-reference 一次 list 最多两个枚举，可指向同一 root），于是两次远端扫描都跑、
+   * 结果只留一份。键里带 signal 身份：不同请求的取消不能互相传染（A 的 abort 不该杀掉 B 的扫描）。
+   */
+  #inFlight = /* @__PURE__ */ new Map();
+  /** Stable identity per `AbortSignal`, only used to keep in-flight keys apart. */
+  #signalIds = /* @__PURE__ */ new WeakMap();
+  #nextSignalId = 0;
+  #inFlightKey(root, signal) {
+    if (signal === void 0) return `${root}\0`;
+    let id = this.#signalIds.get(signal);
+    if (id === void 0) {
+      this.#nextSignalId += 1;
+      id = this.#nextSignalId;
+      this.#signalIds.set(signal, id);
+    }
+    return `${root}\0${id}`;
+  }
   constructor(options) {
     this.#tiers = options.tiers;
     this.#ttlMs = options.ttlMs ?? DEFAULTS.ttlMs;
@@ -12195,9 +12395,20 @@ var RemoteIndex = class {
         };
       }
     }
-    const result = await this.#enumerateFresh(root, maxEntries, options.budgetMs ?? this.#budgetMs, options.signal);
-    if (result.cacheable) this.#remember(root, result);
-    return result;
+    const key = this.#inFlightKey(root, options.signal);
+    const running = this.#inFlight.get(key);
+    if (running !== void 0) return running;
+    const attempt = (async () => {
+      const result = await this.#enumerateFresh(root, maxEntries, options.budgetMs ?? this.#budgetMs, options.signal);
+      if (result.cacheable) this.#remember(root, result);
+      return result;
+    })();
+    this.#inFlight.set(key, attempt);
+    try {
+      return await attempt;
+    } finally {
+      if (this.#inFlight.get(key) === attempt) this.#inFlight.delete(key);
+    }
   }
   /**
    * Completion for a partially typed `@` query.
@@ -12712,6 +12923,129 @@ import { join as join9 } from "node:path";
 import { homedir as homedir2 } from "node:os";
 import { createRequire } from "node:module";
 import "@deepseek-ai/cordis";
+
+// src/host/domain/roots/ssh-config.ts
+function stripComment(line) {
+  let inQuotes = false;
+  for (let index = 0; index < line.length; index++) {
+    const char = line[index];
+    if (char === '"') inQuotes = !inQuotes;
+    else if (char === "#" && !inQuotes) return line.slice(0, index);
+  }
+  return line;
+}
+function unquote(value) {
+  if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) return value.slice(1, -1);
+  return value;
+}
+function splitKeyValue(line) {
+  const match = /^([A-Za-z][A-Za-z0-9]*)\s*(?:=|\s)\s*(.*)$/.exec(line);
+  if (match === null) return void 0;
+  const key = match[1];
+  const value = match[2];
+  if (key === void 0 || value === void 0) return void 0;
+  return [key.toLowerCase(), unquote(value.trim())];
+}
+function parseSshConfig(text8) {
+  const entries = [];
+  let current;
+  const lines = text8.split(/\r?\n/);
+  for (let index = 0; index < lines.length; index++) {
+    const raw = lines[index] ?? "";
+    const line = stripComment(raw).trim();
+    if (line === "") continue;
+    const pair = splitKeyValue(line);
+    if (pair === void 0) continue;
+    const [key, value] = pair;
+    if (key === "host") {
+      const patterns = value.split(/\s+/).filter((part) => part !== "");
+      if (patterns.length === 0) continue;
+      current = { patterns, identityFiles: [], includes: [], line: index + 1 };
+      entries.push(current);
+      continue;
+    }
+    if (current === void 0) continue;
+    switch (key) {
+      case "hostname":
+        current.hostName ??= value;
+        break;
+      case "user":
+        current.user ??= value;
+        break;
+      case "port": {
+        if (current.port !== void 0) break;
+        const port = Number.parseInt(value, 10);
+        if (Number.isInteger(port) && port > 0 && port <= 65535) current.port = port;
+        break;
+      }
+      case "identityfile":
+        current.identityFiles.push(value);
+        break;
+      case "proxyjump":
+        current.proxyJump ??= value.toLowerCase() === "none" ? "" : value;
+        break;
+      case "include":
+        current.includes.push(value);
+        break;
+      default:
+        break;
+    }
+  }
+  return entries.map((entry) => ({
+    patterns: entry.patterns,
+    ...entry.hostName === void 0 ? {} : { hostName: entry.hostName },
+    ...entry.user === void 0 ? {} : { user: entry.user },
+    ...entry.port === void 0 ? {} : { port: entry.port },
+    identityFiles: entry.identityFiles,
+    ...entry.proxyJump === void 0 || entry.proxyJump === "" ? {} : { proxyJump: entry.proxyJump },
+    includes: entry.includes,
+    line: entry.line
+  }));
+}
+function isConcretePattern(pattern) {
+  return !/[*?!]/.test(pattern);
+}
+function expandHome(path, home) {
+  if (path === "~") return home;
+  if (path.startsWith("~/") || path.startsWith("~\\")) return `${home.replace(/[\\/]+$/, "")}${path.slice(1)}`;
+  return path;
+}
+function importableEntries(entries, options = {}) {
+  const home = options.home ?? "";
+  const excluded = new Set(options.excluded ?? []);
+  const seen = /* @__PURE__ */ new Set();
+  const drafts = [];
+  const skipped = [];
+  for (const entry of entries) {
+    for (const pattern of entry.patterns) {
+      if (!isConcretePattern(pattern)) {
+        skipped.push({ pattern, reason: "wildcard", line: entry.line });
+        continue;
+      }
+      if (seen.has(pattern)) {
+        skipped.push({ pattern, reason: "duplicate", line: entry.line });
+        continue;
+      }
+      if (excluded.has(pattern)) {
+        skipped.push({ pattern, reason: "already-imported", line: entry.line });
+        continue;
+      }
+      seen.add(pattern);
+      const identityFile = entry.identityFiles[0];
+      drafts.push({
+        alias: pattern,
+        hostName: entry.hostName ?? pattern,
+        ...entry.user === void 0 ? {} : { user: entry.user },
+        ...entry.port === void 0 ? {} : { port: entry.port },
+        ...identityFile === void 0 ? {} : { identityFile: home === "" ? identityFile : expandHome(identityFile, home) },
+        ...entry.proxyJump === void 0 ? {} : { proxyJump: entry.proxyJump }
+      });
+    }
+  }
+  return { drafts, skipped };
+}
+
+// src/wiring/helpers.ts
 init_errors();
 init_ssh2_transport();
 
@@ -12800,7 +13134,7 @@ async function resolveAuth(ctx, profile) {
     return agent === void 0 ? {} : { agent };
   }
   if (spec.kind === "key") {
-    const path = expandHome(spec.keyPath);
+    const path = expandHome2(spec.keyPath);
     const privateKey = await readFile4(path).catch((error) => {
       const message = error instanceof Error ? error.message : String(error);
       throw new SshDevError("AUTH_FAILED", `\u65E0\u6CD5\u8BFB\u53D6\u79C1\u94A5 ${path}\uFF1A${message}`, { path });
@@ -12832,10 +13166,8 @@ function isSsh2Available() {
     return false;
   }
 }
-function expandHome(path) {
-  if (path === "~") return homedir2();
-  if (path.startsWith("~/") || path.startsWith("~\\")) return join9(homedir2(), path.slice(2));
-  return path;
+function expandHome2(path) {
+  return expandHome(path, homedir2());
 }
 var readSessionHeader = createDiskSessionHeaderReader();
 
@@ -12928,8 +13260,8 @@ function wireConnections(ctx, config) {
     hostKeyPolicy: profile.hostKeyPolicy,
     // A connection that names a key must use it: the alias transport otherwise relies entirely on the
     // user's own ~/.ssh/config, which silently ignores the plugin's `keyPath`.
-    ...profile.auth.kind === "key" ? { identityFile: expandHome(profile.auth.keyPath) } : {},
-    ...limits.knownHostsFile === void 0 ? {} : { knownHostsFile: expandHome(limits.knownHostsFile) },
+    ...profile.auth.kind === "key" ? { identityFile: expandHome2(profile.auth.keyPath) } : {},
+    ...limits.knownHostsFile === void 0 ? {} : { knownHostsFile: expandHome2(limits.knownHostsFile) },
     // The connection's `user` must reach ssh; otherwise a bare host falls back to the local username.
     ...profile.user === "" ? {} : { user: profile.user },
     // Password connections authenticate through an SSH_ASKPASS helper: they must stop forbidding prompts
@@ -13022,8 +13354,8 @@ function wireConnections(ctx, config) {
           sshArgv: sshPrefix("ssh", {
             alias: profile.alias ?? profile.host,
             user: profile.user,
-            ...profile.auth.kind === "key" ? { identityFile: expandHome(profile.auth.keyPath) } : {},
-            ...limits.knownHostsFile === void 0 ? {} : { knownHostsFile: expandHome(limits.knownHostsFile) },
+            ...profile.auth.kind === "key" ? { identityFile: expandHome2(profile.auth.keyPath) } : {},
+            ...limits.knownHostsFile === void 0 ? {} : { knownHostsFile: expandHome2(limits.knownHostsFile) },
             hostKeyPolicy: profile.hostKeyPolicy,
             connectTimeoutMs: limits.connectTimeoutMs ?? profile.connectTimeoutMs,
             ...passwordOptions.batchMode === void 0 ? {} : { batchMode: passwordOptions.batchMode }
@@ -13120,11 +13452,11 @@ function wireConnections(ctx, config) {
         port: profile.port,
         user: profile.user,
         authKind: profile.auth.kind,
-        ...profile.auth.kind === "key" ? { identityFile: expandHome(profile.auth.keyPath) } : {},
+        ...profile.auth.kind === "key" ? { identityFile: expandHome2(profile.auth.keyPath) } : {},
         connectTimeoutMs: profile.connectTimeoutMs
       },
       {
-        ...limits.knownHostsFile === void 0 ? {} : { knownHostsFile: expandHome(limits.knownHostsFile) },
+        ...limits.knownHostsFile === void 0 ? {} : { knownHostsFile: expandHome2(limits.knownHostsFile) },
         ...limits.connectTimeoutMs === void 0 ? {} : { connectTimeoutMs: limits.connectTimeoutMs }
       }
     );
@@ -13254,12 +13586,8 @@ function wireConnections(ctx, config) {
 }
 function readLiveSessions(ctx) {
   let list;
-  try {
-    const sessions = ctx.get("sessions");
-    list = sessions?.list?.();
-  } catch {
-    return [];
-  }
+  const sessions = ctx.get("sessions");
+  list = sessions?.list?.();
   if (!Array.isArray(list)) return [];
   const live = [];
   for (const session of list) {
@@ -13277,9 +13605,13 @@ import { mkdir as mkdir7 } from "node:fs/promises";
 // src/host/integration/remote/remote-face.ts
 import { Service } from "@deepseek-ai/cordis";
 import { bindTypertRemote } from "@deepseek-ai/dsh-typert-protocol";
+
+// src/shared/remote-identity.ts
 var SSH_DEV_REMOTE_NAMESPACE = "sshdev";
 var SSH_DEV_REMOTE_SERVICE = "sshDevRemote";
-var SSH_DEV_REMOTE_CONNECTIONS_METHOD = "connections";
+var SSH_DEV_REMOTE_METHOD = "connections";
+
+// src/host/integration/remote/remote-face.ts
 var NOT_CONNECTED_NOTE = "\u5C1A\u672A\u5EFA\u7ACB\u8FDE\u63A5\uFF1A\u4F20\u8F93\u51B3\u7B56\u5728\u9996\u6B21\u8FDE\u63A5\u65F6\u786E\u5B9A\u3002";
 function buildConnectionStatusRows(source) {
   return source.profiles().map((profile) => {
@@ -13344,7 +13676,7 @@ var SshDevRemoteFace = class extends Service {
     return buildConnectionStatusRows(this.#source);
   }
 };
-markRemoteMethod(SshDevRemoteFace.prototype, SSH_DEV_REMOTE_CONNECTIONS_METHOD);
+markRemoteMethod(SshDevRemoteFace.prototype, SSH_DEV_REMOTE_METHOD);
 function installRemoteFace(ctx) {
   return new SshDevRemoteFace(ctx, {
     profiles: () => ctx.get("sshDevConnections")?.list() ?? [],
@@ -13541,11 +13873,14 @@ function registerSessionTools(ctx, service) {
   };
 }
 
-// src/host/app/roots/roots-api-http.ts
+// src/host/integration/tools/session-directory-tools.ts
+import { defineTool as defineTool2 } from "@deepseek-ai/dsh-tools";
+
+// src/host/app/roots/session-directories.ts
 init_errors();
 
 // src/host/app/roots/user-roots.ts
-import { mkdir as mkdir4, readFile as readFile5, rename as rename3, unlink as unlink3, writeFile as writeFile4 } from "node:fs/promises";
+import { mkdir as mkdir4, readFile as readFile5, rename as rename3, stat as stat4, unlink as unlink3, writeFile as writeFile4 } from "node:fs/promises";
 import { join as join12 } from "node:path";
 init_errors();
 var USER_ROOTS_VERSION = 1;
@@ -13571,6 +13906,10 @@ var nodeUserRootsIo = {
     await mkdir4(path, { recursive: true, mode: 448 });
   },
   rename: (from, to) => rename3(from, to),
+  stat: async (path) => {
+    const info = await stat4(path);
+    return { size: info.size, mtimeMs: info.mtimeMs };
+  },
   unlink: async (path) => {
     try {
       await unlink3(path);
@@ -13933,7 +14272,19 @@ function createUserRootsStore(options) {
   const filePath = join12(options.dir, USER_ROOTS_FILE_NAME);
   let cachedRaw;
   let cachedLoad;
+  let cachedSignature;
+  const signatureOf = async () => {
+    if (io.stat === void 0) return void 0;
+    try {
+      const info = await io.stat(filePath);
+      return `${info.size}:${Math.trunc(info.mtimeMs)}`;
+    } catch {
+      return void 0;
+    }
+  };
   const load = async () => {
+    const signature = await signatureOf();
+    if (signature !== void 0 && signature === cachedSignature && cachedLoad !== void 0) return cachedLoad;
     let text8;
     try {
       text8 = await io.readFile(filePath);
@@ -13945,16 +14296,20 @@ function createUserRootsStore(options) {
         degraded: true
       };
     }
-    if (cachedRaw !== void 0 && text8 === cachedRaw && cachedLoad !== void 0) return cachedLoad;
+    if (cachedRaw !== void 0 && text8 === cachedRaw && cachedLoad !== void 0) {
+      cachedSignature = signature;
+      return cachedLoad;
+    }
     const parsed = parseUserRoots(text8);
     cachedRaw = text8;
     cachedLoad = parsed;
+    cachedSignature = signature;
     return parsed;
   };
-  const write = async (next) => {
+  const write = async (next, preparedText) => {
     const validated = validateState(next);
     const temporary = `${filePath}.${process.pid}-${++tempSequence2}.tmp`;
-    const text8 = serializeUserRoots(validated);
+    const text8 = preparedText ?? serializeUserRoots(validated);
     await io.mkdir(options.dir);
     try {
       await io.writeFile(temporary, text8);
@@ -13965,6 +14320,7 @@ function createUserRootsStore(options) {
     }
     cachedRaw = text8;
     cachedLoad = { state: validated, warnings: [], degraded: false };
+    cachedSignature = void 0;
     return validated;
   };
   const queue = createSerialQueue();
@@ -13974,16 +14330,18 @@ function createUserRootsStore(options) {
     assertUserRootsWritable(await load());
     return write(next);
   });
+  const applyTransition = async (transition) => {
+    const loaded = await load();
+    assertUserRootsWritable(loaded);
+    const wanted = transition(loaded.state);
+    if (wanted === loaded.state) return loaded.state;
+    const wantedText = serializeUserRoots(wanted);
+    if (cachedRaw !== void 0 && wantedText === cachedRaw) return loaded.state;
+    return write(wanted, wantedText);
+  };
   const mutate = (transition) => {
     const locked = options.withLock;
-    const run = async () => serialize(async () => {
-      const loaded = await load();
-      assertUserRootsWritable(loaded);
-      const wanted = transition(loaded.state);
-      if (serializeUserRoots(wanted) === serializeUserRoots(loaded.state)) return loaded.state;
-      return write(wanted);
-    });
-    return locked === void 0 ? run() : locked(run);
+    return serialize(() => locked === void 0 ? applyTransition(transition) : locked(() => applyTransition(transition)));
   };
   return {
     filePath,
@@ -14137,6 +14495,7 @@ function isMissingFile(error) {
 }
 
 // src/host/app/roots/roots-api-http.ts
+init_errors();
 async function readBody(req, maxBytes) {
   const chunks = [];
   let total = 0;
@@ -14193,11 +14552,17 @@ var STATUS_BY_CODE = {
   ROOT_INVALID: 400,
   CONNECTION_INVALID: 400,
   CONNECTION_NOT_FOUND: 400,
+  // 路径不在任何已注册的根内 / 根没有注册：客户端换一个路径或先加根就能成功，不是服务器故障。
+  // 它此前漏在表外，于是**所有**经 HTTP 暴露的根外访问都报 500（审计 2026-11-06 第 4 轮 P1）。
+  ROOT_OUTSIDE: 400,
   // 目标不存在 / 状态冲突 / 本组合不支持：客户端可以据此换一条路。
   TRASH_NOT_FOUND: 404,
   TRANSFER_CONFLICT: 409,
   SESSION_ACTIVE: 409,
-  REMOTE_UNSUPPORTED: 501
+  REMOTE_UNSUPPORTED: 501,
+  // 调用方主动取消（客户端断开/关掉面板）。499 是 nginx 的 "client closed request" 约定：它不是一个错误，
+  // 只是说明"没人等这个回答了"；映射成 500 会让日志里出现一堆假故障。
+  CANCELLED: 499
 };
 function codeOf(error) {
   const code = asRecord2(error)?.["code"];
@@ -14232,6 +14597,9 @@ function optionalPath(value) {
       reason: "invalid-path"
     });
   }
+  if (/[\u0000-\u001f]/.test(value)) {
+    throw new SshDevError("ROOT_INVALID", "path \u4E0D\u80FD\u5305\u542B\u63A7\u5236\u5B57\u7B26\uFF08\u542B NUL\uFF09", { reason: "invalid-path" });
+  }
   return value.trim();
 }
 function pick(source, fields) {
@@ -14275,27 +14643,375 @@ function connectionIdFromAlias(alias) {
   return isValidConnectionId(folded) ? folded : void 0;
 }
 
-// src/shared/routes.ts
-var ROOTS_API_PATH = "/api/over-ssh/roots";
-var SESSION_API_PATH = "/api/over-ssh/sessions";
-function asRouteHost(value) {
-  if (typeof value !== "object" || value === null) return void 0;
-  const register = value.register;
-  return typeof register === "function" ? value : void 0;
+// src/host/app/roots/session-directories.ts
+var SESSION_DIRECTORY_MAX_ROOTS = 32;
+var SYSTEM_TREES = ["/etc", "/usr", "/bin", "/sbin", "/lib", "/lib64", "/boot", "/sys", "/proc", "/dev", "/var", "/root"];
+var REMOTE_SYSTEM_TREES = ["/etc", "/usr", "/bin", "/sbin", "/lib", "/lib64", "/boot", "/sys", "/proc", "/dev", "/var", "/root"];
+var REMOTE_BROAD_ROOTS = [...REMOTE_SYSTEM_TREES, "/home", "/opt", "/srv", "/mnt", "/media", "/tmp"];
+function remotePathTooBroad(normalized) {
+  if (REMOTE_BROAD_ROOTS.includes(normalized)) return true;
+  for (const tree of REMOTE_SYSTEM_TREES) {
+    if (normalized === tree || normalized.startsWith(`${tree}/`)) return true;
+  }
+  return false;
 }
-
-// src/host/app/roots/roots-api-contract.ts
-var ROOTS_API_MAX_BODY_BYTES = 64 * 1024;
-var DIRECTORY_LIST_MAX_ENTRIES = 2e3;
-var REMOTE_LIST_MAX_ENTRIES = DIRECTORY_LIST_MAX_ENTRIES;
-var LOCAL_LIST_MAX_ENTRIES = DIRECTORY_LIST_MAX_ENTRIES;
-var ROOTS_API_ACTIONS = [
-  "add-root",
-  "remove-root",
-  "add-connection",
-  "update-connection",
-  "test-connection",
-  "remove-connection",
+function directoryRefusal(request) {
+  const trimmed = request.path.trim();
+  if (trimmed === "") return "\u76EE\u5F55\u8DEF\u5F84\u4E3A\u7A7A\u3002";
+  if (request.location === "remote") {
+    if (request.connectionId === void 0 || request.connectionId === "") {
+      return "\u8FDC\u7AEF\u76EE\u5F55\u9700\u8981 connectionId\uFF08\u5148\u786E\u8BA4\u76EE\u6807\u8FDE\u63A5\uFF09\u3002";
+    }
+    if (!trimmed.startsWith("/")) return `\u8FDC\u7AEF\u76EE\u5F55\u5FC5\u987B\u662F\u7EDD\u5BF9\u8DEF\u5F84\uFF1A${trimmed}`;
+    let normalized2;
+    try {
+      normalized2 = normalizeRemotePath(trimmed);
+    } catch (error) {
+      return error instanceof Error ? error.message : `\u8FDC\u7AEF\u8DEF\u5F84\u4E0D\u5408\u6CD5\uFF1A${trimmed}`;
+    }
+    if (normalized2 === "/") return "\u4E0D\u5141\u8BB8\u628A\u8FDC\u7AEF\u7684\u6839\u76EE\u5F55 / \u6DFB\u52A0\u5230\u4F1A\u8BDD\u3002";
+    if (remotePathTooBroad(normalized2)) {
+      return `\u4E0D\u5141\u8BB8\u628A\u8FC7\u5BBD\u7684\u8FDC\u7AEF\u76EE\u5F55\u6DFB\u52A0\u5230\u4F1A\u8BDD\uFF08${normalized2}\uFF09\uFF1A\u8BF7\u9009\u5230\u5177\u4F53\u9879\u76EE\u76EE\u5F55\u3002`;
+    }
+    return void 0;
+  }
+  const normalized = trimmed.replace(/\/+$/u, "") || "/";
+  if (!isAbsoluteLocalPath(normalized)) return `\u672C\u5730\u76EE\u5F55\u5FC5\u987B\u662F\u7EDD\u5BF9\u8DEF\u5F84\uFF1A${trimmed}`;
+  if (normalized === "/") return "\u4E0D\u5141\u8BB8\u628A\u672C\u673A\u7684\u6839\u76EE\u5F55 / \u6DFB\u52A0\u5230\u4F1A\u8BDD\u3002";
+  if (SYSTEM_TREES.some((tree) => normalized === tree || localPathContains(tree, normalized))) {
+    return `\u4E0D\u5141\u8BB8\u628A\u7CFB\u7EDF\u76EE\u5F55\u6DFB\u52A0\u5230\u4F1A\u8BDD\uFF1A${normalized}`;
+  }
+  const workspace = request.workspacePath.trim();
+  if (workspace !== "") {
+    if (normalized === workspace || localPathContains(normalized, workspace)) {
+      return `\u4E0D\u5141\u8BB8\u6DFB\u52A0\u5F53\u524D\u5DE5\u4F5C\u533A\u7684\u7956\u5148\u76EE\u5F55\uFF08${normalized}\uFF09\uFF1A\u90A3\u4F1A\u628A\u6574\u68F5\u7236\u6811\u7EB3\u5165\u53EF\u5199\u8303\u56F4\u3002\u8BF7\u6DFB\u52A0\u5DE5\u4F5C\u533A\u5185\u90E8\u6216\u4E0E\u5B83\u5E76\u5217\u7684\u76EE\u5F55\u3002`;
+    }
+  }
+  return void 0;
+}
+function createSessionDirectories(deps) {
+  return {
+    async add(request) {
+      const refusal = directoryRefusal(request);
+      if (refusal !== void 0) return { ok: false, reason: refusal };
+      if (request.workspacePath.trim() === "") return { ok: false, reason: "\u62FF\u4E0D\u5230\u5F53\u524D\u5DE5\u4F5C\u533A\u8DEF\u5F84\uFF0C\u65E0\u6CD5\u6DFB\u52A0\u76EE\u5F55\u3002" };
+      if (request.sessionId.trim() === "") return { ok: false, reason: "\u62FF\u4E0D\u5230\u5F53\u524D\u4F1A\u8BDD id\uFF0C\u65E0\u6CD5\u6DFB\u52A0\u76EE\u5F55\u3002" };
+      const entry = {
+        location: request.location,
+        path: request.path.trim(),
+        ...request.connectionId === void 0 ? {} : { connectionId: request.connectionId },
+        writable: true,
+        workspaces: [request.workspacePath],
+        sessions: [request.sessionId]
+      };
+      const key = userRootKey(entry);
+      let state;
+      try {
+        state = await deps.mutateUserState((current) => {
+          const existing = findRootInState(current, key);
+          if (existing === void 0) {
+            const scoped = current.roots.filter(
+              (candidate) => (candidate.sessions ?? []).includes(request.sessionId) || (candidate.workspaces ?? []).includes(request.workspacePath)
+            ).length;
+            if (scoped >= SESSION_DIRECTORY_MAX_ROOTS) {
+              throw new SshDevError(
+                "ROOT_INVALID",
+                `\u672C\u4F1A\u8BDD\u5DF2\u6DFB\u52A0 ${scoped} \u4E2A\u76EE\u5F55\uFF0C\u8FBE\u5230\u4E0A\u9650 ${SESSION_DIRECTORY_MAX_ROOTS}\uFF1B\u8BF7\u5148\u79FB\u9664\u4E0D\u518D\u9700\u8981\u7684\u76EE\u5F55\u3002`,
+                { limit: SESSION_DIRECTORY_MAX_ROOTS }
+              );
+            }
+            return addRootToState(current, entry);
+          }
+          return withSessions(withWorkspaces(current, key, [request.workspacePath]), key, [request.sessionId]);
+        });
+      } catch (error) {
+        return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+      }
+      return { ok: true, key, ...await ensureLiveAndReadAnchor(deps, key, state) };
+    },
+    async remove(request) {
+      if (request.sessionId.trim() === "") return { ok: false, reason: "\u62FF\u4E0D\u5230\u5F53\u524D\u4F1A\u8BDD id\uFF0C\u65E0\u6CD5\u79FB\u9664\u76EE\u5F55" };
+      let key = request.key?.trim() ?? "";
+      let before;
+      let state;
+      try {
+        state = await deps.mutateUserState((current) => {
+          const resolved = resolveRemoveKey(current, request);
+          if (resolved === void 0) {
+            throw new SshDevError(
+              "ROOT_INVALID",
+              request.path === void 0 ? `\u6CA1\u6709\u627E\u5230\u8981\u79FB\u9664\u7684\u76EE\u5F55\uFF1A${key}` : `\u672C\u4F1A\u8BDD\u6CA1\u6709\u8FD9\u4E2A\u76EE\u5F55\uFF1A${request.path}`,
+              { key, path: request.path }
+            );
+          }
+          key = resolved.key;
+          before = resolved.entry;
+          if (!(resolved.entry.sessions ?? []).includes(request.sessionId)) {
+            throw new SshDevError("ROOT_INVALID", "\u53EA\u80FD\u79FB\u9664\u672C\u4F1A\u8BDD\u81EA\u5DF1\u6DFB\u52A0\u7684\u76EE\u5F55\uFF1B\u8FD9\u6761\u4E0D\u662F\u672C\u4F1A\u8BDD\u52A0\u7684\u3002", { key });
+          }
+          return removeRootFromSession(current, key, request.sessionId);
+        });
+      } catch (error) {
+        return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+      }
+      if (before === void 0) return { ok: false, reason: `\u6CA1\u6709\u627E\u5230\u8981\u79FB\u9664\u7684\u76EE\u5F55\uFF1A${key}` };
+      if (!stateHasRoot(state, key)) {
+        const liveKey = await findLiveKey(deps, before);
+        if (liveKey !== void 0) await deps.unregisterRoot(liveKey);
+        return { ok: true, key };
+      }
+      await refreshLiveScope(deps, key, state);
+      return { ok: true, key };
+    }
+  };
+}
+function resolveRemoveKey(state, request) {
+  const wantedKey = request.key?.trim();
+  if (wantedKey !== void 0 && wantedKey !== "") {
+    const entry = findRootInState(state, wantedKey);
+    return entry === void 0 ? void 0 : { key: wantedKey, entry };
+  }
+  const path = request.path?.trim();
+  if (path === void 0 || path === "") return void 0;
+  const wanted = request.connectionId === void 0 ? userRootKey({ location: "local", path }) : userRootKey({ location: "remote", path, connectionId: request.connectionId });
+  for (const entry of state.roots) {
+    if (userRootKey(entry) === wanted) return { key: wanted, entry };
+  }
+  if (request.connectionId === void 0) {
+    const matches = state.roots.filter((entry) => entry.path === path);
+    if (matches.length === 1) return { key: userRootKey(matches[0]), entry: matches[0] };
+  }
+  return void 0;
+}
+async function ensureLiveAndReadAnchor(deps, key, state) {
+  const persisted = findRootInState(state, key);
+  if (persisted === void 0) return {};
+  const readAnchor = (roots2) => {
+    for (const raw of roots2) {
+      if (liveKeyOfRecord(raw, persisted) === void 0) continue;
+      const source = raw?.root ?? raw;
+      const anchor = source["anchorPath"];
+      if (typeof anchor === "string" && anchor !== "") return { anchorPath: anchor };
+      return {};
+    }
+    return {};
+  };
+  const roots = await Promise.resolve(deps.listRoots());
+  const liveEntry = roots.find((candidate) => liveKeyOfRecord(candidate, persisted) !== void 0);
+  if (liveEntry === void 0) {
+    await deps.registerRoot(persisted);
+    return readAnchor(await Promise.resolve(deps.listRoots()));
+  }
+  if (liveScopeIsCurrent(liveEntry, persisted)) return readAnchor(roots);
+  const liveKey = liveKeyOfRecord(liveEntry, persisted);
+  if (liveKey !== void 0) {
+    await deps.unregisterRoot(liveKey);
+    await deps.registerRoot(persisted);
+  }
+  return readAnchor(await Promise.resolve(deps.listRoots()));
+}
+async function liveScopeWarning(deps, key, state) {
+  const persisted = findRootInState(state, key);
+  if (persisted === void 0) return void 0;
+  const roots = await Promise.resolve(deps.listRoots());
+  const liveEntry = roots.find((candidate) => liveKeyOfRecord(candidate, persisted) !== void 0);
+  if (liveEntry === void 0) return `\u6DFB\u52A0\u76EE\u5F55\uFF1A\u6839 ${key} \u4E0D\u5728\u5B9E\u65F6\u6CE8\u518C\u8868\u91CC\uFF0C\u91CD\u542F\u524D\u53EF\u80FD\u4E0D\u53EF\u7528`;
+  if (liveScopeIsCurrent(liveEntry, persisted)) return void 0;
+  return `\u6DFB\u52A0\u76EE\u5F55\uFF1A\u6839 ${key} \u7684\u5B9E\u65F6\u4F5C\u7528\u57DF\u4E0E\u6587\u4EF6\u4E0D\u4E00\u81F4\uFF0C\u53E6\u4E00\u4E2A\u4F1A\u8BDD\u53EF\u80FD\u8981\u91CD\u542F\u540E\u624D\u53EF\u89C1`;
+}
+async function findLiveKey(deps, entry) {
+  for (const raw of await Promise.resolve(deps.listRoots())) {
+    const key = liveKeyOfRecord(raw, entry);
+    if (key !== void 0) return key;
+  }
+  return void 0;
+}
+async function refreshLiveScope(deps, key, state) {
+  const persisted = findRootInState(state, key);
+  if (persisted === void 0) return;
+  const roots = await Promise.resolve(deps.listRoots());
+  const liveEntry = roots.find((candidate) => liveKeyOfRecord(candidate, persisted) !== void 0);
+  if (liveEntry === void 0) return;
+  if (liveScopeIsCurrent(liveEntry, persisted)) return;
+  const liveKey = liveKeyOfRecord(liveEntry, persisted);
+  if (liveKey === void 0) return;
+  await deps.unregisterRoot(liveKey);
+  await deps.registerRoot(persisted);
+}
+function liveScopeIsCurrent(raw, entry) {
+  const outer = raw ?? {};
+  const source = outer.root ?? outer;
+  if (source["shared"] === true) return true;
+  return sameStrings(source["workspaces"], entry.workspaces) && sameStrings(source["sessions"], entry.sessions);
+}
+function sameStrings(left, right) {
+  const asSet = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string").sort() : [];
+  const a = asSet(left);
+  const b = asSet(right);
+  return a.length === b.length && a.every((value, index) => value === b[index]);
+}
+
+// src/host/integration/tools/session-directory-tools.ts
+var SESSION_DIRECTORY_TOOL_NAMES = {
+  // **必须以 `remote_` 开头**：插件的严格参数校验网关按这个名字前缀覆盖它的全部工具
+  //（`strict-arguments.ts` 的 `STRICT_TOOL_PREFIX`），换个前缀就会静默逃过参数校验。
+  add: "remote_add_directory",
+  remove: "remote_remove_directory"
+};
+function sessionDirectoryToolDefinitions(deps) {
+  return [
+    defineTool2({
+      name: SESSION_DIRECTORY_TOOL_NAMES.add,
+      description: `Add a directory to **this conversation**, so its file tools and \`@\` completion can use it. The directory becomes part of the session workspace: under \`workspace-write\` it is readable and writable, and it is visible to this conversation only (the user's card lists it). **Requires human approval** \u2014 the call is refused when the deployment has no approval surface. Refused: a relative path, the machine root \`/\`, a system tree, a directory that is the current workspace **or one of its ancestors** (that would hand the model the whole parent tree), and more than ${SESSION_DIRECTORY_MAX_ROOTS} directories in one conversation. Prefer asking the user to add a directory when you are unsure: this tool changes your own permission boundary.`,
+      parameters: {
+        path: {
+          type: "string",
+          description: "Absolute path. Local spelling for a local directory, absolute remote path when `connectionId` is given.",
+          required: true
+        },
+        connectionId: {
+          type: "string",
+          description: "Configured connection id when the directory is on a remote host. Omit for a local directory."
+        }
+      },
+      output: {
+        schema: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            path: { type: "string", required: true },
+            added: { type: "boolean", required: true },
+            anchorPath: { type: "string" },
+            note: { type: "string" }
+          }
+        },
+        render: (_args, value) => {
+          const record2 = value;
+          const anchor = typeof record2["anchorPath"] === "string" ? `\uFF08\u951A\u70B9 ${record2["anchorPath"]}\uFF09` : "";
+          return [{ type: "text", text: `\u5DF2\u52A0\u5165\u672C\u4F1A\u8BDD\uFF1A${String(record2["path"] ?? "")}${anchor}\u3002` }];
+        }
+      },
+      async execute(args, exec) {
+        const record2 = args ?? {};
+        const path = typeof record2["path"] === "string" ? record2["path"].trim() : "";
+        if (path === "") throw new Error("path \u5FC5\u987B\u662F\u975E\u7A7A\u5B57\u7B26\u4E32");
+        const sessionId = deps.sessionId();
+        if (sessionId === void 0 || sessionId === "") throw new Error("\u62FF\u4E0D\u5230\u5F53\u524D\u4F1A\u8BDD id\uFF0C\u65E0\u6CD5\u6DFB\u52A0\u76EE\u5F55");
+        const workspacePath = deps.workspacePathOf(sessionId);
+        if (workspacePath === void 0 || workspacePath === "") {
+          throw new Error("\u62FF\u4E0D\u5230\u5F53\u524D\u5DE5\u4F5C\u533A\u8DEF\u5F84\uFF0C\u65E0\u6CD5\u628A\u76EE\u5F55\u52A0\u5165\u672C\u4F1A\u8BDD");
+        }
+        const connectionId = typeof record2["connectionId"] === "string" && record2["connectionId"] !== "" ? record2["connectionId"] : void 0;
+        const outcome = await deps.directories.add({
+          location: connectionId === void 0 ? "local" : "remote",
+          path,
+          ...connectionId === void 0 ? {} : { connectionId },
+          workspacePath,
+          sessionId
+        });
+        if (!outcome.ok) throw new Error(outcome.reason);
+        return {
+          path,
+          added: true,
+          ...outcome.anchorPath === void 0 ? {} : { anchorPath: outcome.anchorPath },
+          note: "\u5DF2\u52A0\u5165\u672C\u4F1A\u8BDD\uFF1B`workspace-write` \u4E0B\u8BE5\u76EE\u5F55\u53EF\u8BFB\u53EF\u5199\u3002"
+        };
+      }
+    }),
+    defineTool2({
+      name: SESSION_DIRECTORY_TOOL_NAMES.remove,
+      description: "Remove a directory that **this conversation added** from its list. The directory stays registered for any other conversation that added it; a directory the user added in the plugin settings, and the conversation workspace itself, cannot be removed here. Removing only narrows access, so it needs no approval.",
+      parameters: {
+        path: { type: "string", description: "Absolute path of the directory to remove, as it was added.", required: true },
+        connectionId: {
+          type: "string",
+          description: "Connection id when the directory is remote; must match the one it was added with."
+        }
+      },
+      output: {
+        schema: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            path: { type: "string", required: true },
+            removed: { type: "boolean", required: true },
+            note: { type: "string" }
+          }
+        },
+        render: (_args, value) => {
+          const record2 = value;
+          return [{ type: "text", text: `\u5DF2\u4ECE\u672C\u4F1A\u8BDD\u79FB\u9664\uFF1A${String(record2["path"] ?? "")}\u3002` }];
+        }
+      },
+      async execute(args) {
+        const record2 = args ?? {};
+        const path = typeof record2["path"] === "string" ? record2["path"].trim() : "";
+        if (path === "") throw new Error("path \u5FC5\u987B\u662F\u975E\u7A7A\u5B57\u7B26\u4E32");
+        const sessionId = deps.sessionId();
+        if (sessionId === void 0 || sessionId === "") throw new Error("\u62FF\u4E0D\u5230\u5F53\u524D\u4F1A\u8BDD id\uFF0C\u65E0\u6CD5\u79FB\u9664\u76EE\u5F55");
+        const workspacePath = deps.workspacePathOf(sessionId);
+        if (workspacePath === void 0 || workspacePath === "") {
+          throw new Error("\u62FF\u4E0D\u5230\u5F53\u524D\u5DE5\u4F5C\u533A\u8DEF\u5F84\uFF0C\u65E0\u6CD5\u79FB\u9664\u76EE\u5F55");
+        }
+        const connectionId = typeof record2["connectionId"] === "string" && record2["connectionId"] !== "" ? record2["connectionId"] : void 0;
+        const outcome = await deps.directories.remove({
+          path,
+          ...connectionId === void 0 ? {} : { connectionId },
+          workspacePath,
+          sessionId
+        });
+        if (!outcome.ok) throw new Error(outcome.reason);
+        return { path, removed: true, note: "\u5DF2\u4ECE\u672C\u4F1A\u8BDD\u79FB\u9664\u3002" };
+      }
+    })
+  ];
+}
+function sessionDirectoryApprovalGate(ctx) {
+  return ctx.on("tools/pre-execute", async (exec, next) => {
+    if (exec.name !== SESSION_DIRECTORY_TOOL_NAMES.add) return next();
+    const args = exec.arguments ?? {};
+    const target = String(args["path"] ?? "");
+    const where = typeof args["connectionId"] === "string" && args["connectionId"] !== "" ? `${args["connectionId"]}:${target}` : target;
+    return {
+      kind: "ask",
+      reason: `${SESSION_DIRECTORY_TOOL_NAMES.add} \u60F3\u628A ${where} \u52A0\u5165\u672C\u4F1A\u8BDD\uFF08\u4F1A\u6269\u5927\u6A21\u578B\u53EF\u8BFB\u5199\u7684\u8303\u56F4\uFF09`,
+      displayReason: {
+        en: `Add ${where} to this conversation? It becomes readable and writable by the model.`,
+        zh: `\u628A ${where} \u52A0\u5165\u672C\u4F1A\u8BDD\uFF1F\u52A0\u5165\u540E\u6A21\u578B\u53EF\u8BFB\u5199\u8BE5\u76EE\u5F55\u3002`
+      }
+    };
+  });
+}
+function registerSessionDirectoryTools(ctx, deps) {
+  const disposers = sessionDirectoryToolDefinitions(deps).map((definition) => ctx.tools.register(definition));
+  const disposeGate = sessionDirectoryApprovalGate(ctx);
+  return () => {
+    for (const dispose of disposers.splice(0)) dispose();
+    disposeGate();
+  };
+}
+
+// src/shared/routes.ts
+var ROOTS_API_PATH = "/api/over-ssh/roots";
+var SESSION_API_PATH = "/api/over-ssh/sessions";
+function asRouteHost(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const register = value.register;
+  return typeof register === "function" ? value : void 0;
+}
+
+// src/host/app/roots/roots-api-contract.ts
+var ROOTS_API_MAX_BODY_BYTES = 64 * 1024;
+var DIRECTORY_LIST_MAX_ENTRIES = 2e3;
+var REMOTE_LIST_MAX_ENTRIES = DIRECTORY_LIST_MAX_ENTRIES;
+var LOCAL_LIST_MAX_ENTRIES = DIRECTORY_LIST_MAX_ENTRIES;
+var ROOTS_API_ACTIONS = [
+  "add-root",
+  "remove-root",
+  "add-connection",
+  "update-connection",
+  "test-connection",
+  "remove-connection",
   "list-remote",
   "list-local",
   "list-ssh-config",
@@ -14369,9 +15085,25 @@ function publicRoot(raw) {
     ...typeof source["connectionId"] === "string" ? { connectionId: source["connectionId"] } : {},
     path: String(source["path"] ?? ""),
     ...typeof source["label"] === "string" ? { label: source["label"] } : {},
-    ...typeof source["writable"] === "boolean" ? { writable: source["writable"] } : {}
+    ...typeof source["writable"] === "boolean" ? { writable: source["writable"] } : {},
+    ...stringList(source["workspaces"]) === void 0 ? {} : { workspaces: stringList(source["workspaces"]) },
+    ...stringList(source["sessions"]) === void 0 ? {} : { sessions: stringList(source["sessions"]) }
   };
 }
+function liveRootScopes(raw) {
+  const outer = asRecord2(raw) ?? {};
+  const source = asRecord2(outer["root"]) ?? outer;
+  const sessions = stringList(source["sessions"]);
+  const workspaces = stringList(source["workspaces"]);
+  return {
+    ...sessions === void 0 ? {} : { sessions },
+    ...workspaces === void 0 ? {} : { workspaces }
+  };
+}
+function stringList(value) {
+  if (!Array.isArray(value)) return void 0;
+  return value.filter((item) => typeof item === "string");
+}
 function publicConnection(raw) {
   const source = asRecord2(raw) ?? {};
   const authKind = source["authKind"] ?? asRecord2(source["auth"])?.["kind"];
@@ -14497,21 +15229,34 @@ async function handleRootActions(action, body, req, res, deps) {
           if (registeredNow) await deps.unregisterRoot(key);
           throw error;
         }
+        const warnings = [];
+        if (existing !== void 0) {
+          const warning = await liveScopeWarning(deps, key, state);
+          if (warning !== void 0) warnings.push(warning);
+        }
         const anchorPath = await anchorPathOf(deps, entry);
         send(req, res, 200, {
           ok: true,
           action,
           state: publicUserState(state),
-          ...anchorPath === void 0 ? {} : { anchorPath }
+          ...anchorPath === void 0 ? {} : { anchorPath },
+          ...warnings.length === 0 ? {} : { warnings }
         });
         return true;
-        return true;
       });
     }
     case "remove-root": {
       const key = requiredKey(body["key"]);
       const workspace = optionalWorkspaceName(body["workspace"]);
       const session = optionalSessionName(body["session"]);
+      if (session !== void 0) {
+        const current = await currentUserState(deps);
+        const entry = findRootInState(current, key);
+        const owners = entry?.sessions ?? [];
+        if (owners.length > 0 && !owners.includes(session)) {
+          throw new SshDevError("ROOT_INVALID", "\u8FD9\u4E2A\u76EE\u5F55\u662F\u53E6\u4E00\u4E2A\u4F1A\u8BDD\u6DFB\u52A0\u7684\uFF1B\u8BF7\u5230\u6DFB\u52A0\u5B83\u7684\u4F1A\u8BDD\u91CC\u79FB\u9664", { key });
+        }
+      }
       const state = await reconcile(deps, (current) => {
         if (session !== void 0 && rootAddedBySession(current, key, session)) {
           return removeRootFromSession(current, key, session);
@@ -14529,30 +15274,6 @@ async function handleRootActions(action, body, req, res, deps) {
       return false;
   }
 }
-async function refreshLiveScope(deps, key, state) {
-  const persisted = findRootInState(state, key);
-  if (persisted === void 0) return;
-  const raw = await Promise.resolve(deps.listRoots());
-  const liveEntry = raw.find((candidate) => liveKeyOfRecord(candidate, persisted) !== void 0);
-  if (liveEntry === void 0) return;
-  if (liveScopeIsCurrent(liveEntry, persisted)) return;
-  const liveKey = liveKeyOfRecord(liveEntry, persisted);
-  if (liveKey === void 0) return;
-  await deps.unregisterRoot(liveKey);
-  await deps.registerRoot(persisted);
-}
-function liveScopeIsCurrent(raw, entry) {
-  const outer = asRecord2(raw) ?? {};
-  const source = asRecord2(outer["root"]) ?? outer;
-  if (source["shared"] === true) return true;
-  return sameStrings(source["workspaces"], entry.workspaces) && sameStrings(source["sessions"], entry.sessions);
-}
-function sameStrings(left, right) {
-  const asSet = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string").sort() : [];
-  const a = asSet(left);
-  const b = asSet(right);
-  return a.length === b.length && a.every((value, index) => value === b[index]);
-}
 function rootAddedBySession(state, key, sessionId) {
   const entry = findRootInState(state, key);
   return (entry?.sessions ?? []).includes(sessionId);
@@ -14607,129 +15328,6 @@ function optionalWorkspaceName(value) {
 // src/host/app/roots/roots-api-connections.ts
 init_errors();
 import { homedir as homedir3 } from "node:os";
-
-// src/host/domain/roots/ssh-config.ts
-function stripComment(line) {
-  let inQuotes = false;
-  for (let index = 0; index < line.length; index++) {
-    const char = line[index];
-    if (char === '"') inQuotes = !inQuotes;
-    else if (char === "#" && !inQuotes) return line.slice(0, index);
-  }
-  return line;
-}
-function unquote(value) {
-  if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) return value.slice(1, -1);
-  return value;
-}
-function splitKeyValue(line) {
-  const match = /^([A-Za-z][A-Za-z0-9]*)\s*(?:=|\s)\s*(.*)$/.exec(line);
-  if (match === null) return void 0;
-  const key = match[1];
-  const value = match[2];
-  if (key === void 0 || value === void 0) return void 0;
-  return [key.toLowerCase(), unquote(value.trim())];
-}
-function parseSshConfig(text8) {
-  const entries = [];
-  let current;
-  const lines = text8.split(/\r?\n/);
-  for (let index = 0; index < lines.length; index++) {
-    const raw = lines[index] ?? "";
-    const line = stripComment(raw).trim();
-    if (line === "") continue;
-    const pair = splitKeyValue(line);
-    if (pair === void 0) continue;
-    const [key, value] = pair;
-    if (key === "host") {
-      const patterns = value.split(/\s+/).filter((part) => part !== "");
-      if (patterns.length === 0) continue;
-      current = { patterns, identityFiles: [], includes: [], line: index + 1 };
-      entries.push(current);
-      continue;
-    }
-    if (current === void 0) continue;
-    switch (key) {
-      case "hostname":
-        current.hostName ??= value;
-        break;
-      case "user":
-        current.user ??= value;
-        break;
-      case "port": {
-        if (current.port !== void 0) break;
-        const port = Number.parseInt(value, 10);
-        if (Number.isInteger(port) && port > 0 && port <= 65535) current.port = port;
-        break;
-      }
-      case "identityfile":
-        current.identityFiles.push(value);
-        break;
-      case "proxyjump":
-        current.proxyJump ??= value.toLowerCase() === "none" ? "" : value;
-        break;
-      case "include":
-        current.includes.push(value);
-        break;
-      default:
-        break;
-    }
-  }
-  return entries.map((entry) => ({
-    patterns: entry.patterns,
-    ...entry.hostName === void 0 ? {} : { hostName: entry.hostName },
-    ...entry.user === void 0 ? {} : { user: entry.user },
-    ...entry.port === void 0 ? {} : { port: entry.port },
-    identityFiles: entry.identityFiles,
-    ...entry.proxyJump === void 0 || entry.proxyJump === "" ? {} : { proxyJump: entry.proxyJump },
-    includes: entry.includes,
-    line: entry.line
-  }));
-}
-function isConcretePattern(pattern) {
-  return !/[*?!]/.test(pattern);
-}
-function expandHome2(path, home) {
-  if (path === "~") return home;
-  if (path.startsWith("~/") || path.startsWith("~\\")) return `${home.replace(/[\\/]+$/, "")}${path.slice(1)}`;
-  return path;
-}
-function importableEntries(entries, options = {}) {
-  const home = options.home ?? "";
-  const excluded = new Set(options.excluded ?? []);
-  const seen = /* @__PURE__ */ new Set();
-  const drafts = [];
-  const skipped = [];
-  for (const entry of entries) {
-    for (const pattern of entry.patterns) {
-      if (!isConcretePattern(pattern)) {
-        skipped.push({ pattern, reason: "wildcard", line: entry.line });
-        continue;
-      }
-      if (seen.has(pattern)) {
-        skipped.push({ pattern, reason: "duplicate", line: entry.line });
-        continue;
-      }
-      if (excluded.has(pattern)) {
-        skipped.push({ pattern, reason: "already-imported", line: entry.line });
-        continue;
-      }
-      seen.add(pattern);
-      const identityFile = entry.identityFiles[0];
-      drafts.push({
-        alias: pattern,
-        hostName: entry.hostName ?? pattern,
-        ...entry.user === void 0 ? {} : { user: entry.user },
-        ...entry.port === void 0 ? {} : { port: entry.port },
-        ...identityFile === void 0 ? {} : { identityFile: home === "" ? identityFile : expandHome2(identityFile, home) },
-        ...entry.proxyJump === void 0 ? {} : { proxyJump: entry.proxyJump }
-      });
-    }
-  }
-  return { drafts, skipped };
-}
-
-// src/host/app/roots/roots-api-connections.ts
 async function handleConnectionActions(action, body, req, res, deps) {
   switch (action) {
     case "list-ssh-config": {
@@ -14748,14 +15346,12 @@ async function handleConnectionActions(action, body, req, res, deps) {
       }
       if (wanted.length === 0) throw new SshDevError("CONNECTION_INVALID", "\u6CA1\u6709\u9009\u62E9\u8981\u5BFC\u5165\u7684\u522B\u540D", {});
       const before = await currentUserState(deps);
-      const found = await sshConfigCandidates(deps, before.connections.map((entry) => entry.id));
-      if (found === void 0) {
+      const plan = await planSshImport(deps, before.connections.map((entry) => entry.id));
+      if (plan === void 0) {
         throw new SshDevError("CONNECTION_INVALID", "\u8FD9\u4E2A\u5BBF\u4E3B\u7EC4\u5408\u6CA1\u6709\u63D0\u4F9B ~/.ssh/config \u7684\u8BFB\u53D6\u80FD\u529B", {});
       }
-      const byAlias = new Map(found.candidates.map((candidate) => [candidate.alias, candidate]));
-      const text8 = await deps.readSshConfig?.();
-      const drafts = importableEntries(parseSshConfig(text8 ?? ""), { home: homedir3() }).drafts;
-      const draftByAlias = new Map(drafts.map((draft) => [draft.alias, draft]));
+      const byAlias = new Map(plan.candidates.map((candidate) => [candidate.alias, candidate]));
+      const draftByAlias = new Map(plan.drafts.map((draft) => [draft.alias, draft]));
       const accepted = [];
       const refused = [];
       const seenIds = new Set(before.connections.map((entry) => entry.id));
@@ -14773,7 +15369,10 @@ async function handleConnectionActions(action, body, req, res, deps) {
         seenIds.add(candidate.suggestedId);
         accepted.push(connectionRecordFromCandidate(draft, candidate.suggestedId));
       }
-      for (const record2 of accepted) await deps.addConnection(record2);
+      if (accepted.length > 0) {
+        if (deps.addConnections !== void 0) await deps.addConnections(accepted);
+        else for (const record2 of accepted) await deps.addConnection(record2);
+      }
       const state = await reconcile(deps, (current) => {
         let next = current;
         for (const record2 of accepted) {
@@ -15015,11 +15614,11 @@ function publicProbeResult(raw) {
     ms
   };
 }
-async function sshConfigCandidates(deps, excluded) {
+async function planSshImport(deps, excluded) {
   const read = deps.readSshConfig;
   if (read === void 0) return void 0;
   const text8 = await read();
-  if (text8 === void 0 || text8.trim() === "") return { candidates: [], skipped: [] };
+  if (text8 === void 0 || text8.trim() === "") return { candidates: [], skipped: [], drafts: [] };
   const result = importableEntries(parseSshConfig(text8), { home: homedir3(), excluded });
   const taken = new Set(excluded);
   const candidates = [];
@@ -15045,7 +15644,12 @@ async function sshConfigCandidates(deps, excluded) {
       suggestedId
     });
   }
-  return { candidates, skipped };
+  return { candidates, skipped, drafts: result.drafts };
+}
+async function sshConfigCandidates(deps, excluded) {
+  const plan = await planSshImport(deps, excluded);
+  if (plan === void 0) return void 0;
+  return { candidates: plan.candidates, skipped: plan.skipped };
 }
 function connectionRecordFromCandidate(draft, id) {
   const keyPath = draft.identityFile === void 0 || draft.identityFile === "" ? void 0 : draft.identityFile;
@@ -15334,16 +15938,40 @@ async function serveSnapshot(req, res, deps) {
     Promise.resolve(deps.listConnections()),
     Promise.resolve(deps.loadUserState())
   ]);
+  const query = queryOf(req.url);
+  const requestedSession = (query.get("session") ?? "").trim();
+  const requestedWorkspace = (query.get("workspace") ?? "").trim();
+  const ancestorsOf = deps.resolveSessionAncestors;
+  const canFilter = requestedWorkspace !== "" || ancestorsOf !== void 0;
+  const filtered = !canFilter || requestedSession === "" && requestedWorkspace === "" ? void 0 : {
+    ids: new Set(
+      requestedSession === "" ? [] : [requestedSession, ...ancestorsOf?.(requestedSession) ?? []]
+    ),
+    workspace: requestedWorkspace
+  };
+  const roots = filtered === void 0 ? liveRoots.map(publicRoot) : liveRoots.filter((raw) => visibleToSession(liveRootScopes(raw), filtered.ids, filtered.workspace)).map(publicRoot);
   send(req, res, 200, {
     ok: true,
+    // 两个标记分开写：客户端只认 `scopedForSession`，而只带 workspace 的调用方也能看出"这份列表被过滤过"。
+    ...filtered === void 0 ? {} : requestedSession === "" ? { scopedForWorkspace: requestedWorkspace } : { scopedForSession: requestedSession },
     // The plugin's **anchor root**, not the roots' individual anchor paths: see `RootsApiDeps.anchorRootDir`.
     ...deps.anchorRootDir === void 0 ? {} : { anchorRoot: deps.anchorRootDir },
-    roots: liveRoots.map(publicRoot),
+    roots,
     connections: liveConnections.map(publicConnection),
     userRoots: publicUserState(loaded.state),
     warnings: [...loaded.warnings]
   });
 }
+function queryOf(url) {
+  const index = url === void 0 ? -1 : url.indexOf("?");
+  return new URLSearchParams(index === -1 || url === void 0 ? "" : url.slice(index + 1));
+}
+function visibleToSession(row, sessionIds, workspace) {
+  const sessions = row.sessions ?? [];
+  if (sessions.length > 0) return sessions.some((id) => sessionIds.has(id));
+  if (workspace === "") return false;
+  return (row.workspaces ?? []).some((candidate) => sameWorkspacePath(candidate, workspace));
+}
 async function serveAction(req, res, deps) {
   let text8;
   try {
@@ -15399,7 +16027,7 @@ async function serveAction(req, res, deps) {
 
 // src/host/integration/session/session-bin-lock.ts
 init_errors();
-import { mkdir as mkdir5, open as open3, readFile as readFile6, rm as rm3, stat as stat3 } from "node:fs/promises";
+import { mkdir as mkdir5, open as open3, readFile as readFile6, rm as rm3, stat as stat5 } from "node:fs/promises";
 import { dirname as dirname5 } from "node:path";
 var DEFAULT_STALE_LOCK_MS = 6e4;
 var DEFAULT_LOCK_RETRY_MS = 25;
@@ -15457,21 +16085,35 @@ function createSessionBinLock(options) {
   const reclaimIfStale = async () => {
     if (staleMs <= 0) return false;
     let age;
+    let malformed = false;
     try {
-      const info = await stat3(options.path);
+      const info = await stat5(options.path);
+      malformed = info.isDirectory();
       age = now() - info.mtimeMs;
     } catch {
       return true;
     }
-    if (age < staleMs) return false;
-    try {
-      const text8 = await readFile6(options.path, "utf8");
-      const record2 = JSON.parse(text8);
-      options.onReclaim?.({ path: options.path, ageMs: age, holder: record2 });
-    } catch {
+    if (!malformed && age < staleMs) return false;
+    if (!malformed) {
+      try {
+        const text8 = await readFile6(options.path, "utf8");
+        const record2 = JSON.parse(text8);
+        options.onReclaim?.({ path: options.path, ageMs: age, holder: record2 });
+      } catch {
+        options.onReclaim?.({ path: options.path, ageMs: age, holder: {} });
+      }
+    } else {
       options.onReclaim?.({ path: options.path, ageMs: age, holder: {} });
     }
-    await rm3(options.path, { force: true });
+    try {
+      await rm3(options.path, { force: true, recursive: malformed });
+    } catch (error) {
+      throw new SshDevError("TRANSFER_CONFLICT", `\u4F1A\u8BDD\u56DE\u6536\u7AD9\u9501\u4F4D\u7F6E\u662F\u4E00\u4E2A\u76EE\u5F55\uFF0C\u4E14\u65E0\u6CD5\u5220\u9664\uFF1A${options.path}`, {
+        path: options.path,
+        reason: "malformed-lock",
+        cause: error instanceof Error ? error.message : String(error)
+      });
+    }
     return true;
   };
   const withLock = async (_key, operation) => {
@@ -15537,6 +16179,12 @@ function createRootsWiring(deps) {
   const transfers = deps.transfers;
   const readCredentials = deps.readCredentials;
   const testConnection = deps.testConnection;
+  const sessionDirectories = createSessionDirectories({
+    mutateUserState: (transition) => store2.mutate(transition),
+    listRoots: () => deps.listRoots(),
+    registerRoot: deps.registerRoot,
+    unregisterRoot: deps.unregisterRoot
+  });
   const apiDeps = {
     listRoots: () => deps.listRoots(),
     listConnections: () => deps.listConnections(),
@@ -15553,6 +16201,39 @@ function createRootsWiring(deps) {
       deps.applyConnection(entry, entry.id);
       return next;
     },
+    addConnections: async (entries) => {
+      if (entries.length === 0) return store2.load().then((loaded) => loaded.state);
+      const applied = [];
+      try {
+        for (const entry of entries) {
+          deps.applyConnection(entry, entry.id);
+          applied.push(entry.id);
+        }
+      } catch (error) {
+        for (const id of applied) {
+          try {
+            deps.removeConnection(id);
+          } catch {
+          }
+        }
+        throw error;
+      }
+      try {
+        return await store2.mutate((state) => {
+          let next = state;
+          for (const entry of entries) next = stateHasConnection(next, entry.id) ? next : addConnectionToState(next, entry);
+          return next;
+        });
+      } catch (error) {
+        for (const id of applied) {
+          try {
+            deps.removeConnection(id);
+          } catch {
+          }
+        }
+        throw error;
+      }
+    },
     applyConnection: async (entry, previousId) => {
       deps.applyConnection(entry, previousId);
     },
@@ -15560,6 +16241,7 @@ function createRootsWiring(deps) {
       deps.removeConnection(id);
     },
     ...deps.anchorRootDir === void 0 ? {} : { anchorRootDir: deps.anchorRootDir },
+    ...deps.resolveSessionAncestors === void 0 ? {} : { resolveSessionAncestors: deps.resolveSessionAncestors },
     ...listRemoteDirectory === void 0 ? {} : { listRemoteDirectory: (input) => listRemoteDirectory(input) },
     ...remoteHomeDirectory === void 0 ? {} : { remoteHomeDirectory },
     ...listLocalDirectory === void 0 ? {} : { listLocalDirectory: (input) => listLocalDirectory(input) },
@@ -15633,9 +16315,55 @@ function createRootsWiring(deps) {
     }
     return { roots, connections, warnings };
   };
+  const inheritAddedRoots = async (sourceSessionId, childSessionId) => {
+    const source = sourceSessionId.trim();
+    const child = childSessionId.trim();
+    if (source === "" || child === "") return;
+    const keys = [];
+    await store2.mutate((current) => {
+      let next = current;
+      for (const entry of current.roots) {
+        const sessions = entry.sessions ?? [];
+        if (!sessions.includes(source) || sessions.includes(child)) continue;
+        const key = userRootKey(entry);
+        next = withSessions(next, key, [child]);
+        keys.push(key);
+      }
+      return next;
+    });
+    if (keys.length > 0) {
+      const { state } = await store2.load();
+      for (const key of keys) await refreshLiveScope(apiDeps, key, state);
+    }
+  };
+  const pruneSession = async (sessionId) => {
+    const trimmed = sessionId.trim();
+    if (trimmed === "") return { changed: [], removed: [] };
+    const before = (await store2.load()).state;
+    const touched = before.roots.filter((entry) => (entry.sessions ?? []).includes(trimmed));
+    if (touched.length === 0) return { changed: [], removed: [] };
+    const after = await store2.mutate((current) => pruneSessionFromRoots(current, trimmed));
+    const afterKeys = new Set(after.roots.map(userRootKey));
+    const removed = [];
+    const changed = [];
+    for (const entry of touched) {
+      const key = userRootKey(entry);
+      if (!afterKeys.has(key)) {
+        removed.push(key);
+        await deps.unregisterRoot(key);
+      } else {
+        changed.push(key);
+      }
+    }
+    for (const key of changed) await refreshLiveScope(apiDeps, key, after);
+    return { changed, removed };
+  };
   return {
     api,
     store: store2,
+    sessionDirectories,
+    inheritAddedRoots,
+    pruneSession,
     mergeUserRoots,
     routeWarnings: () => [...routeWarnings],
     routeFacts: () => ({ injectRan, routeRegistered, warnings: [...routeWarnings] }),
@@ -15778,13 +16506,34 @@ function createSessionApi(deps) {
   return { handle, dispose: () => {
   } };
 }
+function abortOnDisconnect(res) {
+  const controller = new AbortController();
+  const closable = res;
+  const onClose = () => {
+    if (closable.writableEnded !== true) controller.abort();
+  };
+  if (typeof closable.on === "function") closable.on("close", onClose);
+  return {
+    signal: controller.signal,
+    dispose: () => {
+      if (typeof closable.off === "function") closable.off("close", onClose);
+    }
+  };
+}
 async function serveSnapshot2(req, res, deps) {
   const service = deps.service();
   if (service === void 0) {
     send(req, res, 200, { ok: true, available: false, sessions: [], bin: [], policy: deps.policy() });
     return;
   }
-  const [sessions, bin] = await Promise.all([service.inventory(), service.list()]);
+  const connection = abortOnDisconnect(res);
+  let sessions;
+  let bin;
+  try {
+    [sessions, bin] = await Promise.all([service.inventory({ signal: connection.signal }), service.list()]);
+  } finally {
+    connection.dispose();
+  }
   send(req, res, 200, {
     ok: true,
     available: true,
@@ -15801,10 +16550,19 @@ async function serveAction2(req, res, deps) {
     return;
   }
   const service = requireService(deps);
+  const connection = abortOnDisconnect(res);
+  try {
+    return await serveActionWithSignal(action, body, req, res, deps, service, connection.signal);
+  } finally {
+    connection.dispose();
+  }
+}
+async function serveActionWithSignal(action, body, req, res, deps, service, signal) {
+  const options = { signal };
   switch (action) {
     case "preview": {
       const ids = readIds(body);
-      const decision = await service.previewDelete(ids);
+      const decision = await service.previewDelete(ids, options);
       send(req, res, 200, { ok: true, delete: decision.delete, refusals: decision.refusals, bytes: decision.bytes });
       return;
     }
@@ -15819,7 +16577,7 @@ async function serveAction2(req, res, deps) {
         });
         return;
       }
-      const result = await service.deleteSession(ids, { mode });
+      const result = await service.deleteSession(ids, { mode, ...options });
       send(req, res, 200, {
         ok: true,
         mode: result.mode,
@@ -15847,7 +16605,7 @@ async function serveAction2(req, res, deps) {
         });
         return;
       }
-      const result = await service.deleteWorkspaceSessions(cwd, { mode });
+      const result = await service.deleteWorkspaceSessions(cwd, { mode, ...options });
       send(req, res, 200, {
         ok: true,
         mode: result.mode,
@@ -15867,7 +16625,7 @@ async function serveAction2(req, res, deps) {
         send(req, res, 400, { ok: false, error: "entryId \u5FC5\u987B\u662F\u975E\u7A7A\u5B57\u7B26\u4E32" });
         return;
       }
-      const result = await service.restore(entryId);
+      const result = await service.restore(entryId, options);
       send(req, res, 200, { ok: true, restoredPath: result.restoredPath, movedBy: result.movedBy });
       return;
     }
@@ -15881,14 +16639,27 @@ async function serveAction2(req, res, deps) {
         send(req, res, 400, { ok: false, error: "purge \u9700\u8981 confirm: true\uFF08\u4E0D\u53EF\u6062\u590D\uFF09", reason: "confirmation-required" });
         return;
       }
-      const result = await service.purge(entryId);
-      send(req, res, 200, { ok: true, purged: result.purged, indexStale: result.indexStale });
+      const result = await service.purge(entryId, options);
+      send(req, res, 200, {
+        ...result.indexStale === true ? { ok: false, error: "\u56DE\u6536\u7AD9\u7D22\u5F15\u66F4\u65B0\u5931\u8D25\uFF1A\u6761\u76EE\u5DF2\u5220\u9664\uFF0C\u4F46\u7D22\u5F15\u4ECD\u5217\u7740\u5B83\uFF08\u4E0B\u6B21\u8FD8\u539F\u4F1A\u5931\u8D25\uFF09\u3002\u91CD\u542F\u540E\u91CD\u8BD5 sweep\u3002", reason: "index-stale" } : { ok: true },
+        purged: result.purged,
+        indexStale: result.indexStale
+      });
       return;
     }
     case "sweep": {
-      const result = await service.sweep(deps.policy());
+      if (body["confirm"] !== true) {
+        send(req, res, 400, {
+          ok: false,
+          error: "sweep \u9700\u8981 confirm: true\uFF08\u4E0D\u53EF\u6062\u590D\uFF09",
+          reason: "confirmation-required"
+        });
+        return;
+      }
+      const result = await service.sweep(deps.policy(), options);
+      const stale = result.purged.filter((item) => item.indexStale === true).length;
       send(req, res, 200, {
-        ok: true,
+        ...stale > 0 ? { ok: false, error: `\u56DE\u6536\u7AD9\u7D22\u5F15\u66F4\u65B0\u5931\u8D25\uFF1A${stale} \u4E2A\u6761\u76EE\u5DF2\u5220\u9664\u4F46\u7D22\u5F15\u4ECD\u5217\u7740\u5B83\u4EEC\uFF08\u4E0B\u6B21\u8FD8\u539F\u4F1A\u5931\u8D25\uFF09\u3002`, reason: "index-stale" } : { ok: true },
         purged: result.purged.map((item) => ({ entryId: String(item.id), sessionId: item.sessionId, indexStale: item.indexStale })),
         failed: result.failed.map((item) => ({ entryId: String(item.id), reason: item.reason })),
         remainingEntries: result.remainingEntries,
@@ -15963,6 +16734,56 @@ function createSessionRouteWiring(deps) {
   };
 }
 
+// src/host/integration/roots/fork-inheritance.ts
+var PATCHED = /* @__PURE__ */ Symbol.for("dsh-over-ssh/fork-inheritance");
+function sourceIdOf(source) {
+  if (typeof source === "string") return source === "" ? void 0 : source;
+  if (typeof source !== "object" || source === null) return void 0;
+  const candidate = source;
+  const id = candidate.header?.id ?? candidate.id;
+  return typeof id === "string" && id !== "" ? id : void 0;
+}
+function installForkInheritance(ctx, deps) {
+  const service = ctx.get("sessions");
+  const original = service?.fork;
+  if (typeof service !== "object" || service === null || typeof original !== "function") {
+    return { installed: false, dispose: () => void 0 };
+  }
+  if (original[PATCHED] === true) {
+    return { installed: true, dispose: () => void 0 };
+  }
+  const invoke = original;
+  const patched2 = function patchedFork(...args) {
+    const child = invoke.apply(this, args);
+    try {
+      const sourceId = sourceIdOf(args[0]);
+      const childId = sourceIdOf(child);
+      if (sourceId !== void 0 && childId !== void 0) {
+        markForkInheritancePending(childId, sourceId);
+        void deps.inherit(sourceId, childId).catch((error) => {
+          deps.warn?.(`fork \u7EE7\u627F\u6DFB\u52A0\u76EE\u5F55\u5931\u8D25\uFF08source=${sourceId} child=${childId}\uFF09\uFF1A${error instanceof Error ? error.message : String(error)}`);
+        }).finally(() => {
+          clearForkInheritancePending(childId);
+        });
+      }
+    } catch (error) {
+      deps.warn?.(`fork \u7EE7\u627F\u6DFB\u52A0\u76EE\u5F55\u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}`);
+    }
+    return child;
+  };
+  patched2[PATCHED] = true;
+  service.fork = patched2;
+  return {
+    installed: true,
+    dispose: () => {
+      if (service.fork === patched2) {
+        service.fork = original;
+      }
+      clearAllForkInheritancePending();
+    }
+  };
+}
+
 // src/wiring/fs-panel-routes.ts
 function readOnlySeams(env) {
   const { ctx, profiles, registry, transports } = env;
@@ -16008,10 +16829,15 @@ function rootLifecycleSeams(env, hooks) {
       const removed = registry.removeByLooseKey(key);
       binRootResolver.forget(removed ?? key);
       sessionRoots.invalidate();
-      if (anchor !== void 0) void rmdir(anchor).catch(() => void 0);
+      if (anchor !== void 0 && !anchorStillUsedBy(registry.records, anchor)) {
+        void rmdir(anchor).catch(() => void 0);
+      }
     }
   };
 }
+function anchorStillUsedBy(records, anchor) {
+  return records.some((record2) => record2.root.anchorPath === anchor);
+}
 function anchorPathOfRecord(records, key) {
   const target = key.toLowerCase();
   for (const record2 of records) {
@@ -16030,18 +16856,18 @@ function connectionLifecycleSeams(env, hooks) {
     // Keeping them across an edit answered for the previous host (audit finding: changing a connection's
     // host left its remote roots connected to the old machine); keeping them across a rename answered under
     // the new name for the old host.
-    applyConnection: (entry, previousId) => {
+    applyConnection: async (entry, previousId) => {
       const profile = validateConnectionProfile(toProfileInput({ ...entry, transport: "agent" }));
       profiles.set(profile.id, profile);
       if (previousId !== profile.id) {
         profiles.delete(previousId);
-        hooks.forgetPerConnection(previousId);
+        await hooks.forgetPerConnection(previousId);
         indexes.delete(previousId);
         retireBrowseBackend(browseBackends, previousId);
         forgetBackendsOf(previousId);
         void transports.release(previousId).catch(() => void 0);
       }
-      hooks.forgetPerConnection(profile.id);
+      await hooks.forgetPerConnection(profile.id);
       askpass.revive(profile.id);
       indexes.delete(profile.id);
       retireBrowseBackend(browseBackends, profile.id);
@@ -16175,6 +17001,8 @@ function registerPanelRoutes(env, hooks) {
     stateDir: resolveStateDir(),
     // Published in the GET snapshot so a client can recognise a session whose cwd is a remote workspace.
     anchorRootDir: env.anchorRootDir,
+    // fork 继承父会话添加的目录（ADR-0013）：血缘只有宿主知道，所以 `GET /roots?session=` 由这里回答。
+    resolveSessionAncestors: (sessionId) => readSessionAncestors(env.ctx, sessionId),
     ...readOnlySeams(env),
     ...rootLifecycleSeams(env, hooks),
     ...connectionLifecycleSeams(env, hooks),
@@ -16182,7 +17010,11 @@ function registerPanelRoutes(env, hooks) {
     ...remoteFileSeams(env),
     webServerProvider: ctx
   });
-  return { sessionWiring, rootsWiring };
+  const forkInheritance = installForkInheritance(ctx, {
+    inherit: (sourceSessionId, childSessionId) => rootsWiring.inheritAddedRoots(sourceSessionId, childSessionId),
+    warn: (message) => ctx.logger?.warn?.(`over-ssh: ${message}`)
+  });
+  return { sessionWiring, rootsWiring, disposeForkInheritance: () => forkInheritance.dispose() };
 }
 
 // src/wiring/fs.ts
@@ -16213,11 +17045,19 @@ function provideHostServices(env) {
 }
 function provideAgentStatus(env) {
   const { ctx, agentBridge, installations, askpass, remoteHome } = env;
-  const forgetPerConnection = (connectionId) => {
+  const forgetPerConnectionAsync = async (connectionId) => {
     agentBridge.forget(connectionId);
     installations.forget(connectionId);
-    void askpass.forget(connectionId);
     remoteHome.forget(connectionId);
+    try {
+      await askpass.forget(connectionId);
+    } catch {
+    }
+  };
+  const forgetPerConnection = (connectionId) => {
+    void forgetPerConnectionAsync(connectionId).catch((error) => {
+      ctx.logger?.warn?.(`over-ssh: \u5FD8\u8BB0\u8FDE\u63A5 ${connectionId} \u7684\u4EE3\u7406\u5B89\u88C5\u8BB0\u5F55\u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}`);
+    });
   };
   const disposeAgent = ctx.provide("sshDevAgent", {
     outcome: (connectionId) => agentBridge.installationFor(connectionId),
@@ -16225,7 +17065,7 @@ function provideAgentStatus(env) {
       forgetPerConnection(connectionId);
     }
   });
-  return { forgetPerConnection, disposeAgent };
+  return { forgetPerConnection, forgetPerConnectionAsync, disposeAgent };
 }
 function createBinHousekeeping(env) {
   const { ctx, limits, binService } = env;
@@ -16250,7 +17090,9 @@ function registerConfiguredRoots(env) {
       ctx.logger?.warn?.(`over-ssh: \u8FDC\u7AEF\u6839\u7684\u951A\u70B9\u76EE\u5F55\u65E0\u6CD5\u521B\u5EFA\uFF08${root.anchorPath ?? ""}\uFF09\uFF1A${error instanceof Error ? error.message : String(error)}`);
     });
   }
-  void Promise.allSettled(binRootPreparation).then(runBinHousekeeping);
+  void Promise.allSettled(binRootPreparation).then(runBinHousekeeping).catch((error) => {
+    ctx.logger?.warn?.(`over-ssh: \u56DE\u6536\u7AD9\u6E05\u7406\u7531\u672C\u6B21\u542F\u52A8\u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}`);
+  });
 }
 function scheduleActivationDiagnostics(env) {
   const { ctx, rootsWiring, sessionWiring } = env;
@@ -16276,7 +17118,7 @@ function scheduleActivationDiagnostics(env) {
 function watchSessionRemovals(env) {
   const { ctx, rootsWiring, onSessionRemoved } = env;
   onSessionRemoved((sessionId) => {
-    void rootsWiring.store.pruneSession(sessionId).catch((error) => {
+    void rootsWiring.pruneSession(sessionId).catch((error) => {
       ctx.logger?.warn?.(
         `dsh-over-ssh: \u6E05\u7406\u5DF2\u5220\u4F1A\u8BDD ${sessionId} \u7684\u6839\u8BB0\u5F55\u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}`
       );
@@ -16292,9 +17134,10 @@ function mergePersistedRoots(env) {
   });
 }
 function createTeardown(env) {
-  const { activationTimers, routes, hostServices, disposeAgent, tools } = env;
+  const { activationTimers, routes, hostServices, disposeAgent, tools, disposeSessionDirectories } = env;
   return async () => {
     for (const timer of activationTimers) clearTimeout(timer);
+    routes.disposeForkInheritance();
     routes.rootsWiring.dispose();
     routes.sessionWiring.dispose();
     tools.disposeManagement();
@@ -16305,6 +17148,7 @@ function createTeardown(env) {
     await tools.disposeLsp();
     hostServices.disposeBin();
     hostServices.disposeSessionTools();
+    disposeSessionDirectories();
     hostServices.disposeSessionRoots();
     hostServices.disposeRange();
     hostServices.disposeTransfer();
@@ -16335,7 +17179,7 @@ function wireFs(env) {
       sessionRoots: env.sessionRoots,
       readBytesRange: env.readBytesRange
     });
-    const { forgetPerConnection, disposeAgent } = provideAgentStatus({
+    const { forgetPerConnectionAsync, disposeAgent } = provideAgentStatus({
       ctx,
       agentBridge: env.agentBridge,
       installations: env.installations,
@@ -16345,14 +17189,19 @@ function wireFs(env) {
     const runBinHousekeeping = createBinHousekeeping({ ctx, limits, binService: env.binService });
     registerConfiguredRoots({ ctx, config, anchorRootDir, registry, prepareBinRoots, runBinHousekeeping });
     const routes = registerPanelRoutes(env, {
-      forgetPerConnection,
+      forgetPerConnection: forgetPerConnectionAsync,
       runBinHousekeeping,
       warn: (message) => ctx.logger?.warn?.(`over-ssh: ${message}`)
     });
+    const disposeSessionDirectories = registerSessionDirectoryTools(ctx, {
+      directories: routes.rootsWiring.sessionDirectories,
+      sessionId: () => currentSessionId(),
+      workspacePathOf: (sessionId) => readSessionCwd(ctx, sessionId)
+    });
     const activationTimers = scheduleActivationDiagnostics({ ctx, ...routes });
     watchSessionRemovals({ ctx, rootsWiring: routes.rootsWiring, onSessionRemoved: env.onSessionRemoved });
     mergePersistedRoots({ ctx, rootsWiring: routes.rootsWiring });
-    return createTeardown({ activationTimers, routes, hostServices, disposeAgent, tools: env });
+    return createTeardown({ activationTimers, routes, hostServices, disposeAgent, tools: env, disposeSessionDirectories });
   });
 }
 
@@ -16366,7 +17215,7 @@ import { dirname as dirname7, join as join16 } from "node:path";
 // src/host/integration/transfer/transfer-adapters.ts
 init_errors();
 import { createHash as createHash3 } from "node:crypto";
-import { mkdir as mkdir8, open as open4, readFile as readFile8, readdir as readdir5, rename as rename4, rm as rm4, stat as stat4, writeFile as writeFile5 } from "node:fs/promises";
+import { mkdir as mkdir8, open as open4, readFile as readFile8, readdir as readdir5, rename as rename4, rm as rm4, stat as stat6, writeFile as writeFile5 } from "node:fs/promises";
 import { dirname as dirname6 } from "node:path";
 function requireRemote(deps, path) {
   const target = deps.routed.resolve(path);
@@ -16430,7 +17279,7 @@ function createTransferDeps(deps) {
     },
     async statLocal(path) {
       try {
-        const info = await stat4(path);
+        const info = await stat6(path);
         return toBackendStat(info, localVersion(info));
       } catch {
         return toBackendStat(void 0, "0:0");
@@ -16645,6 +17494,7 @@ function trimSlashes(value) {
 // src/host/integration/roots/bin-root-resolver.ts
 function createBinRootResolver(deps) {
   const choices = /* @__PURE__ */ new Map();
+  const inFlight = /* @__PURE__ */ new Map();
   const fallback = (root, note) => ({
     binRoot: binRootInsideRoot(root, deps.binDir),
     placement: "inside",
@@ -16665,6 +17515,17 @@ function createBinRootResolver(deps) {
     const key = rootKey(root);
     const existing = choices.get(key);
     if (existing !== void 0) return existing;
+    const running = inFlight.get(key);
+    if (running !== void 0) return running;
+    const attempt = resolveBinRoot(root);
+    inFlight.set(key, attempt);
+    try {
+      return await attempt;
+    } finally {
+      if (inFlight.get(key) === attempt) inFlight.delete(key);
+    }
+  };
+  const resolveBinRoot = async (root) => {
     const beside = binRootBesideRoot(root, deps.binDir);
     const parent = binParentDirectory(root);
     if (beside === void 0 || parent === void 0) {
@@ -17169,7 +18030,7 @@ function createSessionRootIndex(deps) {
   const now = deps.now ?? (() => Date.now());
   let cachedAt;
   let cached2 = [];
-  let pending;
+  let pending2;
   let generation = 0;
   const readEntries = async () => {
     try {
@@ -17183,14 +18044,14 @@ function createSessionRootIndex(deps) {
   const entriesNow = () => {
     const at = cachedAt;
     const fresh = at !== void 0 && now() - at < deps.ttlMs;
-    if (!fresh && pending === void 0) {
+    if (!fresh && pending2 === void 0) {
       const startedAt = generation;
-      pending = readEntries().then((entries) => {
+      pending2 = readEntries().then((entries) => {
         if (startedAt === generation) {
           cached2 = entries;
           cachedAt = now();
         }
-        pending = void 0;
+        pending2 = void 0;
         return entries;
       });
     }
@@ -17205,7 +18066,7 @@ function createSessionRootIndex(deps) {
       generation += 1;
       cachedAt = void 0;
       cached2 = [];
-      pending = void 0;
+      pending2 = void 0;
     }
   };
 }
@@ -17238,7 +18099,7 @@ function execWriteRootsFor(input) {
 }
 
 // src/host/integration/tools/remote-tools.ts
-import { defineTool as defineTool2 } from "@deepseek-ai/dsh-tools";
+import { defineTool as defineTool3 } from "@deepseek-ai/dsh-tools";
 
 // src/host/integration/tools/session-target.ts
 var NO_SESSION_CWD = "\u65E0\u6CD5\u786E\u5B9A\u8C03\u7528\u65B9\u7684\u8FDC\u7AEF\u6839\uFF1A\u8BE5\u5DE5\u5177\u9700\u8981 agent \u7684\u4F1A\u8BDD\u5DE5\u4F5C\u76EE\u5F55";
@@ -17264,8 +18125,12 @@ function resolveSessionTarget(exec, seams) {
 function readConnectionIds(record2) {
   const raw = record2["connectionIds"];
   if (!Array.isArray(raw)) return void 0;
+  if (raw.length > MAX_EXEC_BATCH_CONNECTIONS) {
+    throw new Error(`connectionIds \u4E00\u6B21\u6700\u591A ${MAX_EXEC_BATCH_CONNECTIONS} \u4E2A\uFF08\u6536\u5230 ${raw.length} \u4E2A\uFF09\u3002\u8BF7\u5206\u6279\u6267\u884C\u3002`);
+  }
   const ids = [...new Set(raw.filter((item) => typeof item === "string" && item.trim() !== "").map((item) => item.trim()))];
-  return ids.length === 0 ? void 0 : ids;
+  if (ids.length === 0) return void 0;
+  return ids;
 }
 function text2(value) {
   return [{ type: "text", text: value }];
@@ -17283,7 +18148,7 @@ var READONLY_CONCURRENCY_NOTE = " Read-only: calls to this tool may overlap with
 var EXEC_SERIAL_NOTE = " This tool is deliberately NOT concurrency-safe: remote commands run one at a time per session, so `Promise.all` over several remote_exec calls produces no overlap. That protects a shared build server from concurrent `make` runs; use one command (`a && b`) or a background job instead of relying on parallelism.";
 function remoteToolDefinitions(backend) {
   return [
-    defineTool2({
+    defineTool3({
       name: "remote_grep",
       description: "Search file contents inside the remote workspace this session is working in. Returns matching lines with their file and 1-based line number. Case-insensitive and ignore-aware by default; `caseSensitive` and `noIgnore` change that. Bounded: at most 200 matches, and the result says so when the cap was reached. When the agent answers, `noIgnore` also stops `.gitignore` from hiding files; on the plain-`grep` fallback tier VCS ignores were never applied, so there the flag only controls the built-in noise directories. The result names the tier that answered in `strategy`." + READONLY_CONCURRENCY_NOTE,
       isConcurrencySafe: () => true,
@@ -17356,7 +18221,7 @@ function remoteToolDefinitions(backend) {
         };
       }
     }),
-    defineTool2({
+    defineTool3({
       name: "remote_glob",
       description: "List files in the remote workspace this session is working in by **glob pattern**, matched the same way on every transport. A pattern without `/` matches the file name at any depth (`*.h` finds `app/include/header.h`); a pattern with `/` is anchored at the directory you pass in and `*` never crosses a `/`. `**` crosses zero or more segments, `?` is one character, `[abc]` and `[!abc]` are character classes, `{a,b}` alternates. Matching is case-sensitive. Paths are returned relative to the enumerated directory. An invalid pattern (an unclosed `[` or `{`) is rejected rather than answered with an empty list. Bounded: at most 500 paths, and the result says so when the cap was reached." + READONLY_CONCURRENCY_NOTE,
       isConcurrencySafe: () => true,
@@ -17403,7 +18268,7 @@ function remoteToolDefinitions(backend) {
         };
       }
     }),
-    defineTool2({
+    defineTool3({
       name: "remote_exec",
       description: "Run one shell command on the remote host in the workspace this session is working in, and return its exit code, stdout and stderr. **A shell command is not confined by \u300C\u6DFB\u52A0\u76EE\u5F55\u300D**: it runs with the SSH user's own permissions, so it can read and write anything that user can, not only the directories added to this conversation. (A deployment that sets `limits.execWriteFence` puts a Landlock write fence around the workspace root and the directories this session added; the tool report says when that fence is active.) Output is bounded to 64 KiB per stream; when a stream is cut the result names that stream and, if the agent spilled it, the remote path holding the full text. Use this for remote builds, tests and version checks. Each call is a NEW shell: exported variables and `cd` do not carry over to the next call \u2014 pass `env` or put `source ... && cmd` in one command." + EXEC_SERIAL_NOTE,
       parameters: {
@@ -17725,13 +18590,14 @@ function strictArgumentsGate(ctx) {
 
 // src/host/integration/tools/remote-job-tools.ts
 init_errors();
-import { defineTool as defineTool3 } from "@deepseek-ai/dsh-tools";
+import { defineTool as defineTool4 } from "@deepseek-ai/dsh-tools";
 var DEFAULT_JOB_WAIT_MS = 3e4;
 var MAX_JOB_WAIT_MS = 6e5;
 var DEFAULT_JOB_POLL_MS = 500;
 var WAIT_SLICE_MS = 5e3;
 var DEFAULT_JOB_OUTPUT_BYTES = 1 << 20;
 var MAX_JOB_OUTPUT_BYTES = 8 << 20;
+var MAX_JOB_STDIN_BYTES = 1 << 20;
 function isAgentJobCapable(transport) {
   if (transport === null || typeof transport !== "object") return false;
   const candidate = transport;
@@ -18036,7 +18902,7 @@ function clampInt2(value, fallback, min, max) {
 }
 function remoteJobToolDefinitions(backend) {
   return [
-    defineTool3({
+    defineTool4({
       name: "remote_exec_background",
       description: 'Start one shell command on the remote host as a background job and return immediately with its job id, instead of blocking until it finishes. Use it for anything that takes minutes: a full `m -j16` tree build, a test sweep, a long transfer. Read its output, wait for it, list jobs and cancel with `remote_job` (`action: "output" | "status" | "list" | "kill"`) \u2014 that tool also explains how output is retained. Pass `interactive: true` to keep stdin open so `remote_job { action: "stdin" }` can feed it later; without it the job reads EOF immediately.' + // 只保留「作业随连接结束」这一条：它必须出现在**启动**的地方，因为「后台 = 持久」正是这里最
       // 容易产生的错误预期。轮询与环形缓冲的细节归 `remote_job`，那里才是读输出的地方。
@@ -18091,6 +18957,11 @@ function remoteJobToolDefinitions(backend) {
         const maxOutputBytes = clampInt2(record2["maxOutputBytes"], DEFAULT_JOB_OUTPUT_BYTES, 1, MAX_JOB_OUTPUT_BYTES);
         const stdinText = record2["stdin"];
         if (stdinText !== void 0 && typeof stdinText !== "string") throw new Error("stdin \u5FC5\u987B\u662F\u5B57\u7B26\u4E32");
+        if (typeof stdinText === "string" && Buffer.byteLength(stdinText, "utf8") > MAX_JOB_STDIN_BYTES) {
+          throw new Error(
+            `stdin \u4E00\u6B21\u6700\u591A ${MAX_JOB_STDIN_BYTES} \u5B57\u8282\uFF08\u6536\u5230 ${Buffer.byteLength(stdinText, "utf8")}\uFF09\u3002\u8BF7\u7528 interactive:true \u542F\u52A8\uFF0C\u518D\u7528 remote_job {action:"stdin"} \u5206\u5757\u5199\u5165\u3002`
+          );
+        }
         const interactive = record2["interactive"] === true;
         const target = targetFor2(backend, exec);
         const cwd = resolveOrThrow2(target, stringArg2(record2["cwd"]));
@@ -18114,7 +18985,7 @@ function remoteJobToolDefinitions(backend) {
         };
       }
     }),
-    defineTool3({
+    defineTool4({
       name: "remote_job",
       description: "Observe or control a background job started with `remote_exec_background`; `action` decides which: `status` reads one job's state (still running, exit code, how long it ran, bytes produced, bytes dropped); `output` reads its output from a byte offset; `list` shows every job this connection has started, running and finished; `kill` requests termination \u2014 asynchronous, so this reports the request and `status` confirms the end, and the agent kills the whole process group; `stdin` writes to a job started with `interactive: true`, and `close: true` signals EOF; `forget` drops a settled job from the list so it stops crowding `list` (a running job is refused)." + JOB_LIFETIME_NOTE + JOB_POLL_NOTE + JOB_DROP_NOTE + " `list` is per connection: it is not a cross-host task queue.",
       parameters: {
@@ -18210,6 +19081,9 @@ function remoteJobToolDefinitions(backend) {
           };
         }
         if (action === "stdin") {
+          if (typeof record2["data"] === "string" && typeof record2["dataBase64"] === "string") {
+            throw new Error("data \u4E0E dataBase64 \u53EA\u80FD\u7ED9\u4E00\u4E2A");
+          }
           const result = await backend.stdin(
             target,
             jobId,
@@ -18354,7 +19228,7 @@ function registerRemoteJobTools(ctx, backend) {
 
 // src/host/integration/fs/remote-file-tools.ts
 init_errors();
-import { defineTool as defineTool4 } from "@deepseek-ai/dsh-tools";
+import { defineTool as defineTool5 } from "@deepseek-ai/dsh-tools";
 var DEFAULT_READ_LINES = 2e3;
 var MAX_READ_LINES = 5e3;
 var DEFAULT_MAX_LINE_LENGTH = 2e3;
@@ -18428,16 +19302,16 @@ function createRemoteFileBackend(deps) {
       if (carried !== void 0) rememberVersion(target, to, carried);
     },
     async stat(target, absolute, signal) {
-      const stat5 = await requireBackend(target).stat(absolute, signal);
-      if (stat5.exists) rememberVersion(target, absolute, stat5.version);
+      const stat7 = await requireBackend(target).stat(absolute, signal);
+      if (stat7.exists) rememberVersion(target, absolute, stat7.version);
       return {
-        exists: stat5.exists,
-        isDirectory: stat5.isDirectory,
-        isFile: stat5.isFile,
-        isSymlink: stat5.isSymlink,
-        size: stat5.size,
-        mtimeMs: stat5.mtimeMs,
-        version: stat5.version
+        exists: stat7.exists,
+        isDirectory: stat7.isDirectory,
+        isFile: stat7.isFile,
+        isSymlink: stat7.isSymlink,
+        size: stat7.size,
+        mtimeMs: stat7.mtimeMs,
+        version: stat7.version
       };
     },
     async patch(target, absolute, diff, expectedVersion, signal) {
@@ -18566,7 +19440,7 @@ function formatWrite(view) {
 }
 function requiredString3(value, field) {
   if (typeof value !== "string" || value.trim() === "") throw new Error(`${field} \u5FC5\u987B\u662F\u975E\u7A7A\u5B57\u7B26\u4E32`);
-  return value;
+  return value.trim();
 }
 function clampInt3(value, fallback, min, max) {
   const number = typeof value === "number" && Number.isFinite(value) ? Math.floor(value) : fallback;
@@ -18575,7 +19449,7 @@ function clampInt3(value, fallback, min, max) {
 }
 function remoteFileToolDefinitions(backend, allowMutation) {
   return [
-    defineTool4({
+    defineTool5({
       name: "remote_read",
       description: "Read one text file in the remote workspace this session is working in, with **1-based line numbers**, and return a window of it controlled by `offset` (first line) and `limit` (how many lines). Use this instead of `cat` through `remote_exec`: `remote_exec` truncates at 64 KiB and prints no line numbers. The result carries the file's `version` token \u2014 pass it back as `expectedVersion` to `remote_write` or `remote_edit` so a concurrent change is refused instead of overwritten. Read-only: calls to this tool may overlap with other read-only remote calls.",
       // Read-only: it observes one remote file and changes nothing.
@@ -18657,7 +19531,7 @@ function remoteFileToolDefinitions(backend, allowMutation) {
         };
       }
     }),
-    defineTool4({
+    defineTool5({
       name: "remote_write",
       description: "Write one text file in the remote workspace this session is working in, replacing its whole content. Pass `expectedVersion` (from `remote_read`) to make the write refuse when the remote file changed since that read. An existing target without a version guard is **refused** unless `force: true`: a blind overwrite silently discards content this process never saw, including an edit made by another user on a shared machine. Parent directories are created when missing. Pass `mode` to set permission bits in the same call, which is what makes a written build or probe script runnable. NOT concurrency-safe: it changes remote state, so it never joins a parallel group.",
       parameters: {
@@ -18735,7 +19609,7 @@ function remoteFileToolDefinitions(backend, allowMutation) {
         };
       }
     }),
-    defineTool4({
+    defineTool5({
       name: "remote_edit",
       description: "Replace a **literal** string inside one file in the remote workspace this session is working in. `old` is matched verbatim \u2014 a backslash-n in `old` matches the two characters `\\` and `n`, never a newline, so write real newlines when you mean them. `new` is inserted verbatim, so `$&`, `$1` and shell variables in it are not expanded. By default `old` must occur **exactly once**: zero matches and multiple matches are both refused, and the multiple-match refusal reports how many there were. Pass `all: true` to replace every occurrence on purpose. Prefer this over patching through `remote_exec` + python/sed: it cannot mis-escape your text, and `expectedVersion` (from `remote_read`) refuses the edit when the file changed in the meantime. NOT concurrency-safe: it changes remote state, so it never joins a parallel group.",
       parameters: {
@@ -18817,7 +19691,7 @@ function remoteFileToolDefinitions(backend, allowMutation) {
         };
       }
     }),
-    defineTool4({
+    defineTool5({
       name: "remote_patch",
       description: "Apply a **unified diff** to one file in the remote workspace, atomically: every hunk lands in one round trip, and if any hunk fails, nothing is written. Use this instead of calling `remote_edit` three times \u2014 three edits are three read-modify-write cycles, and a failure in the middle leaves the file half changed. Hunks are located by **context, not by line number**: the numbers in `@@ -a,b +c,d @@` are used only in error messages, so a diff generated against a slightly older file still applies as long as the context is right. Each hunk's old text must occur exactly once \u2014 zero occurrences means the file changed, several means the context is not distinctive enough; both are refused rather than guessed at.",
       parameters: {
@@ -18862,7 +19736,7 @@ function remoteFileToolDefinitions(backend, allowMutation) {
         return { path, hunks: outcome.hunks, bytes: outcome.bytes, version: outcome.version };
       }
     }),
-    defineTool4({
+    defineTool5({
       name: "remote_move",
       description: 'Move or rename one path in the remote workspace. `createParents` decides whether a missing destination directory is created (default true) or refused. A cross-device move **fails** rather than silently copying: a silent copy would turn "move then delete the source" into data loss when the delete lands first. Moving onto an existing directory is refused too \u2014 the caller meant a rename, and replacing a directory is not that. Use `remote_copy` when you want a copy that stays put. NOT concurrency-safe: it changes remote state, so it never joins a parallel group.',
       parameters: {
@@ -18893,13 +19767,16 @@ function remoteFileToolDefinitions(backend, allowMutation) {
         const from = resolveOrThrow3(target, rawFrom);
         const to = resolveOrThrow3(target, rawTo);
         if (from === to) throw new Error(`\u6E90\u4E0E\u76EE\u6807\u662F\u540C\u4E00\u4E2A\u8DEF\u5F84\uFF1A${from}`);
+        if (to.startsWith(from.endsWith("/") ? from : `${from}/`)) {
+          throw new Error(`\u4E0D\u80FD\u628A\u76EE\u5F55\u79FB\u52A8\u5230\u5B83\u81EA\u5DF1\u7684\u5B50\u76EE\u5F55\u91CC\uFF1A${from} \u2192 ${to}`);
+        }
         assertWritable(target, to, allowMutation);
         const createParents = record2["createParents"] !== false;
         await backend.move(target, from, to, createParents, exec.signal);
         return { from, to, createParents };
       }
     }),
-    defineTool4({
+    defineTool5({
       name: "remote_stat",
       description: 'Read one path\'s **metadata** in the remote workspace without reading its content: whether it exists, whether it is a file, directory or symlink, its size, its modification time and its version token. Use this instead of `remote_read` when you only need to know "does it exist / how big / when did it change" \u2014 reading a file to answer that costs the whole file. The `version` it returns is the same token `remote_read` reports, so it can be passed to `remote_write` / `remote_edit` / `remote_patch` as `expectedVersion`. NOT concurrency-safe: read-only, but it never joins a parallel group.',
       parameters: {
@@ -18929,15 +19806,15 @@ function remoteFileToolDefinitions(backend, allowMutation) {
         const requested = requiredString3(record2["path"], "path");
         const target = targetFor3(backend, exec);
         const path = resolveOrThrow3(target, requested);
-        const stat5 = await backend.stat(target, path, exec.signal);
-        const kind = !stat5.exists ? "missing" : stat5.isSymlink ? "symlink" : stat5.isDirectory ? "directory" : "file";
+        const stat7 = await backend.stat(target, path, exec.signal);
+        const kind = !stat7.exists ? "missing" : stat7.isSymlink ? "symlink" : stat7.isDirectory ? "directory" : "file";
         return {
           path,
-          exists: stat5.exists,
+          exists: stat7.exists,
           kind,
-          size: stat5.exists ? stat5.size : 0,
-          mtimeMs: stat5.exists ? stat5.mtimeMs : 0,
-          version: stat5.exists ? stat5.version : ""
+          size: stat7.exists ? stat7.size : 0,
+          mtimeMs: stat7.exists ? stat7.mtimeMs : 0,
+          version: stat7.exists ? stat7.version : ""
         };
       }
     })
@@ -19017,11 +19894,11 @@ var LspFrameParser = class {
   #append(bytes) {
     if (bytes.length === 0) return;
     if (this.#end + bytes.length > this.#store.length) {
-      const pending = this.#end - this.#start;
+      const pending2 = this.#end - this.#start;
       if (this.#start > 0) {
         this.#store.copyWithin(0, this.#start, this.#end);
         this.#start = 0;
-        this.#end = pending;
+        this.#end = pending2;
       }
       if (this.#end + bytes.length > this.#store.length) {
         let capacity = Math.max(this.#store.length, 64 * 1024);
@@ -19030,7 +19907,7 @@ var LspFrameParser = class {
         this.#store.copy(next, 0, this.#start, this.#end);
         this.#store = next;
         this.#start = 0;
-        this.#end = pending;
+        this.#end = pending2;
       }
     }
     this.#store.set(bytes, this.#end);
@@ -19242,11 +20119,11 @@ var LspSession = class _LspSession {
       throw error;
     }
     const onAbort = () => {
-      const pending = this.#pending.get(id);
-      if (pending === void 0) return;
+      const pending2 = this.#pending.get(id);
+      if (pending2 === void 0) return;
       this.#pending.delete(id);
-      clearTimeout(pending.timer);
-      pending.reject(new LspSessionError("\u7B49\u5F85\u8BED\u8A00\u670D\u52A1\u5668\u65F6\u88AB\u53D6\u6D88"));
+      clearTimeout(pending2.timer);
+      pending2.reject(new LspSessionError("\u7B49\u5F85\u8BED\u8A00\u670D\u52A1\u5668\u65F6\u88AB\u53D6\u6D88"));
     };
     signal.addEventListener("abort", onAbort, { once: true });
     try {
@@ -19370,15 +20247,15 @@ var LspSession = class _LspSession {
     if (typeof message["method"] !== "string") {
       const id = message["id"];
       if (typeof id === "number") {
-        const pending = this.#pending.get(id);
-        if (pending === void 0) return;
+        const pending2 = this.#pending.get(id);
+        if (pending2 === void 0) return;
         this.#pending.delete(id);
-        clearTimeout(pending.timer);
+        clearTimeout(pending2.timer);
         const error = message["error"];
         if (error !== void 0 && error !== null) {
-          pending.reject(new LspSessionError(`${pending.method} \u5931\u8D25\uFF1A${describeError(error)}`));
+          pending2.reject(new LspSessionError(`${pending2.method} \u5931\u8D25\uFF1A${describeError(error)}`));
         } else {
-          pending.resolve(message["result"]);
+          pending2.resolve(message["result"]);
         }
       }
       return;
@@ -19434,10 +20311,10 @@ var LspSession = class _LspSession {
   }
   #failAll(error) {
     this.#exitReason ??= error;
-    for (const [id, pending] of this.#pending) {
-      clearTimeout(pending.timer);
+    for (const [id, pending2] of this.#pending) {
+      clearTimeout(pending2.timer);
       this.#pending.delete(id);
-      pending.reject(error);
+      pending2.reject(error);
     }
   }
 };
@@ -19601,8 +20478,12 @@ function describeInstalled(available) {
   return `\u8BE5\u4E3B\u673A\u4E0A\u63A2\u6D4B\u5230\u7684\u8BED\u8A00\u670D\u52A1\u5668\uFF1A${list}\u3002`;
 }
 var MAX_SESSIONS = 8;
-function sessionKey(target, language) {
-  return `${target.connectionId}\0${target.root}\0${language}`;
+function sessionKeyPrefix(target, language) {
+  return `${target.connectionId}\0${target.root}\0${language}\0`;
+}
+function sessionKey(target, language, override) {
+  const server = override === void 0 ? "" : `${override.command}\0${(override.args ?? []).join("\0")}`;
+  return `${sessionKeyPrefix(target, language)}${server}`;
 }
 function createLspRegistry(deps) {
   const sessions = /* @__PURE__ */ new Map();
@@ -19621,15 +20502,15 @@ function createLspRegistry(deps) {
   }
   return {
     async session(target, language, override, signal) {
-      const key = sessionKey(target, language);
+      const key = sessionKey(target, language, override);
       const existing = sessions.get(key);
       if (existing !== void 0 && !existing.session.stopped) {
         sessions.delete(key);
         sessions.set(key, existing);
         return existing.session;
       }
-      const pending = inFlight.get(key);
-      if (pending !== void 0) return pending;
+      const pending2 = inFlight.get(key);
+      if (pending2 !== void 0) return pending2;
       const attempt = (async () => {
         const command = override ?? defaultServerFor(language);
         if (command === void 0) {
@@ -19701,17 +20582,21 @@ ${describeInstalled(available)}`);
       }));
     },
     async stop(target, language, signal) {
-      const key = sessionKey(target, language);
-      const starting = inFlight.get(key);
-      if (starting !== void 0) {
-        retired.add(key);
-        await starting.catch(() => void 0);
-        retired.delete(key);
-      }
-      const entry = sessions.get(key);
-      if (entry === void 0) return starting !== void 0;
-      sessions.delete(key);
-      await entry.session.close(signal);
+      const prefix = sessionKeyPrefix(target, language);
+      const keys = [...new Set([...sessions.keys(), ...inFlight.keys()].filter((key) => key.startsWith(prefix)))];
+      if (keys.length === 0) return false;
+      for (const key of keys) {
+        const starting = inFlight.get(key);
+        if (starting !== void 0) {
+          retired.add(key);
+          await starting.catch(() => void 0);
+          retired.delete(key);
+        }
+        const entry = sessions.get(key);
+        if (entry === void 0) continue;
+        sessions.delete(key);
+        await entry.session.close(signal);
+      }
       return true;
     },
     async disposeAll() {
@@ -19726,7 +20611,7 @@ ${describeInstalled(available)}`);
 
 // src/host/integration/tools/forward-tools.ts
 init_errors();
-import { defineTool as defineTool5 } from "@deepseek-ai/dsh-tools";
+import { defineTool as defineTool6 } from "@deepseek-ai/dsh-tools";
 function createForwardToolBackend(acquire) {
   const records = /* @__PURE__ */ new Map();
   let sequence2 = 0;
@@ -19788,7 +20673,7 @@ function text5(value) {
   return [{ type: "text", text: value }];
 }
 function remoteForwardDefinition(backend) {
-  return defineTool5({
+  return defineTool6({
     name: "remote_forward",
     description: "Forward one remote TCP port to a local one, so a service the agent started on the remote host becomes reachable from this machine (and from the DSH browser sidebar). Typical use: start a dev server with `remote_exec_background`, then `remote_forward` its port and open the returned `http://127.0.0.1:<port>` URL. The local listener binds **127.0.0.1 only** \u2014 never the LAN; open it up via the host sshd's `GatewayPorts` if that is really what you want. `start` returns the real local port (auto-picked when omitted) plus a `forwardId`; `list` shows what is live; `stop` closes one and is idempotent. Forwards live as long as the connection and are closed automatically when the plugin unloads, so a forgotten one does not leak a port forever \u2014 but stop the ones you are done with.",
     parameters: {
@@ -19891,7 +20776,7 @@ function registerRemoteForwardTool(ctx, backend) {
 
 // src/host/integration/tools/remote-git-tools.ts
 init_shell();
-import { defineTool as defineTool6 } from "@deepseek-ai/dsh-tools";
+import { defineTool as defineTool7 } from "@deepseek-ai/dsh-tools";
 var READ_ACTIONS = ["status", "diff", "log", "show", "branch"];
 var WRITE_ACTIONS = ["add", "commit", "checkout", "restore", "stash"];
 var ACTIONS = [...READ_ACTIONS, ...WRITE_ACTIONS];
@@ -20078,7 +20963,7 @@ function formatOutcome(value) {
 ${body}${suffix}`;
 }
 function remoteGitDefinition(backend) {
-  return defineTool6({
+  return defineTool7({
     name: "remote_git",
     description: "Run a git operation on the remote repository this session is working in, and return its **parsed** result instead of raw terminal text. Prefer this over `remote_exec git ... : the parse is done here (branch/ahead/behind, status entries, log entries), so a new git version's wording cannot break your reading. Read-only actions: `status`, `diff`, `log`, `show`, `branch`. Mutating actions: `add`, `commit`, `checkout`, `restore`, `stash` \u2014 these change the user's repository, so state the intent in your message first. Deliberately **not** offered: `reset --hard`, `clean -fd`, `push --force`, `checkout .`. Those have no safe preview; use `remote_exec` explicitly if you really need one. Git is run with `GIT_TERMINAL_PROMPT=0`, so a missing credential **fails** instead of hanging on a password prompt. Read-only actions may overlap with other read-only remote calls.",
     parameters: {
@@ -20252,7 +21137,7 @@ function registerRemoteGitTool(ctx, backend) {
 }
 
 // src/host/integration/tools/remote-lsp-tools.ts
-import { defineTool as defineTool7 } from "@deepseek-ai/dsh-tools";
+import { defineTool as defineTool8 } from "@deepseek-ai/dsh-tools";
 function toView(diagnostic) {
   return {
     line: diagnostic.line + 1,
@@ -20304,7 +21189,7 @@ function parseServer(value) {
 function remoteLspToolDefinitions(deps) {
   const { backend, registry } = deps;
   return [
-    defineTool7({
+    defineTool8({
       name: "remote_lsp",
       description: 'Ask a **language server running on the remote host** about a file: diagnostics, hover, or definition. Use this instead of running the compiler and reading its text output \u2014 the answer is structured and scoped to one document, and it is the only way to ask "what does this symbol mean" or "where is this defined". The server is started on first use and reused; it takes seconds to index a project, so the first call is slow and later ones are fast. Line and column are **1-based**, matching `remote_read`. Requires a language server installed on the remote host (gopls, rust-analyzer, typescript-language-server, pylsp, clangd); pass `server` to use a different one. NOT concurrency-safe: it changes remote state (starts a process), so it never joins a parallel group.',
       parameters: {
@@ -20513,11 +21398,10 @@ function registerRemoteLspTools(ctx, deps) {
 // src/wiring/tools-session.ts
 import { cp, mkdir as mkdir10, readFile as readFile9, readdir as readdir6, rename as rename6, rm as rm5, stat as nodeStat2, writeFile as writeFile6 } from "node:fs/promises";
 import { dirname as dirname8, join as join17 } from "node:path";
-import { homedir as homedir6 } from "node:os";
 
 // src/host/integration/session/session-labels.ts
 function normalizePath(path) {
-  return path.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+  return foldPathKey(path);
 }
 function createSessionTitleResolver(ctx) {
   return (header) => {
@@ -20563,8 +21447,8 @@ function createWorkspaceTitleResolver(ctx) {
 // src/wiring/tools-session.ts
 function wireSessionAdmin(env) {
   const { ctx, limits, notifySessionRemoved: notifySessionRemoved2 } = env;
-  const sessionsRoot = limits.sessionsRoot ?? join17(homedir6(), ".dsh", "sessions");
-  const storagesRoot = join17(homedir6(), ".dsh", "storages");
+  const sessionsRoot = limits.sessionsRoot ?? join17(dshHome(), "sessions");
+  const storagesRoot = join17(dshHome(), "storages");
   const sessionBinRoot = limits.sessionBinRoot ?? join17(storagesRoot, "over-ssh", "session-trash");
   if (limits.sessionBinRoot === void 0) {
     const carried = carryDirectory(join17(storagesRoot, "remote-workspace", "session-trash"), sessionBinRoot);
@@ -20587,33 +21471,47 @@ function wireSessionAdmin(env) {
     listDir: async (path) => {
       try {
         const entries = await readdir6(path, { withFileTypes: true });
-        const out = [];
-        for (const entry of entries) {
-          let bytes = 0;
-          let mtimeMs = 0;
-          try {
-            const stat5 = await nodeStat2(join17(path, entry.name));
-            mtimeMs = stat5.mtimeMs;
-            if (entry.isFile()) bytes = stat5.size;
-          } catch {
+        const statLimit = 16;
+        const out = new Array(entries.length);
+        let next = 0;
+        const workers = Array.from({ length: Math.max(1, Math.min(statLimit, entries.length)) }, async () => {
+          for (; ; ) {
+            const index = next;
+            next += 1;
+            if (index >= entries.length) return;
+            const entry = entries[index];
+            if (entry === void 0) return;
+            let bytes = 0;
+            let mtimeMs = 0;
+            try {
+              const info = await nodeStat2(join17(path, entry.name));
+              mtimeMs = info.mtimeMs;
+              if (entry.isFile()) bytes = info.size;
+            } catch {
+            }
+            out[index] = { name: entry.name, isDirectory: entry.isDirectory(), bytes, mtimeMs };
           }
-          out.push({ name: entry.name, isDirectory: entry.isDirectory(), bytes, mtimeMs });
-        }
+        });
+        await Promise.all(workers);
         return out;
       } catch (error) {
         if (error.code === "ENOENT") return [];
         throw error;
       }
     },
-    readHeader: (dir) => readSessionHeader(dir),
+    // The listing is already in hand: hand it over so the header cache can key on it instead of re-listing.
+    readHeader: (dir, listing) => readSessionHeader(
+      dir,
+      listing?.map((entry) => ({ name: entry.name, size: entry.bytes, mtimeMs: entry.mtimeMs }))
+    ),
     // Both resolvers are optional: a profile without the platform services still lists sessions, labelled
     // by their directory and id rather than by name.
     resolveSessionTitle: createSessionTitleResolver(ctx),
     resolveWorkspaceTitle: createWorkspaceTitleResolver(ctx),
     stat: async (path) => {
       try {
-        const stat5 = await nodeStat2(path);
-        return { isDirectory: stat5.isDirectory(), bytes: stat5.size };
+        const stat7 = await nodeStat2(path);
+        return { isDirectory: stat7.isDirectory(), bytes: stat7.size };
       } catch {
         return void 0;
       }
@@ -20690,7 +21588,7 @@ init_errors();
 
 // src/host/integration/tools/management-tools.ts
 import { isAbsolute as isAbsolute3, resolve as resolve2 } from "node:path";
-import { defineTool as defineTool8 } from "@deepseek-ai/dsh-tools";
+import { defineTool as defineTool9 } from "@deepseek-ai/dsh-tools";
 function text7(value) {
   return [{ type: "text", text: value }];
 }
@@ -20765,7 +21663,7 @@ function formatEnv(result) {
 }
 function managementToolDefinitions(backend) {
   return [
-    defineTool8({
+    defineTool9({
       name: "remote_transfer",
       description: "Upload one local file to the remote workspace this session is working in, or download one remote file to the local machine. Chunked with progress; pass `resume: true` to continue an interrupted transfer instead of rewriting the whole file (the prefix is **compared with the source** before it is kept, so a changed source degrades to a full retransfer instead of splicing two files). The result reports bytes, chunk count, whether it resumed, the absolute local path the bytes landed at, and \u2014 when the host can hash \u2014 the digest of the content that actually landed. `localPath` must be **absolute**: the plugin resolves it in its own process, so a relative spelling would land under the plugin's working directory instead of anywhere the caller expects. An upload that would overwrite an **existing** remote file is refused unless you pass `expectedVersion` (from `remote_stat`/`remote_read`) or `force: true`: a silent overwrite is the one operation that destroys someone else's work without a trace.",
       parameters: {
@@ -20854,6 +21752,7 @@ function managementToolDefinitions(backend) {
           throw new Error("expectedVersion / expectedSha256 / force \u53EA\u5BF9 upload \u6709\u610F\u4E49\uFF1B\u4E0B\u8F7D\u7531\u672C\u5730\u6587\u4EF6\u7CFB\u7EDF\u8986\u76D6\uFF0C\u4E0D\u505A\u8FDC\u7AEF\u5B88\u536B");
         }
         const target = targetFor4(backend, exec);
+        if (direction === "upload") backend.assertWritable?.(target, "\u4E0A\u4F20\u8FDC\u7AEF\u6587\u4EF6");
         if (direction === "upload" && backend.statRemote !== void 0 && (expectedVersion !== void 0 || !force && expectedSha256 === void 0)) {
           const absolute = resolveUnderRoot(target.root, remotePath);
           if (typeof absolute !== "string") throw new Error(absolute.error);
@@ -20903,7 +21802,7 @@ function managementToolDefinitions(backend) {
         };
       }
     }),
-    defineTool8({
+    defineTool9({
       name: "remote_delete",
       description: 'Delete one path inside the remote workspace. `mode: "recycle"` (the default) moves it to the workspace recycle bin, where it is recoverable and can be undone; `mode: "permanent"` removes it for good and requires user approval. Omitting `mode` is therefore the safe call, and the result always names which mode ran.',
       parameters: {
@@ -20941,6 +21840,7 @@ function managementToolDefinitions(backend) {
         const target = targetFor4(backend, exec);
         const resolved = resolveUnderRoot(target.root, requested, void 0, target.connectionId);
         if (typeof resolved !== "string") throw new Error(resolved.error);
+        backend.assertWritable?.(target, mode === "permanent" ? "\u6C38\u4E45\u5220\u9664\u8FDC\u7AEF\u6587\u4EF6" : "\u5220\u9664\u8FDC\u7AEF\u6587\u4EF6");
         const result = await backend.discard({ target, path: resolved, mode, signal: exec.signal });
         return {
           mode: result.mode,
@@ -20951,7 +21851,7 @@ function managementToolDefinitions(backend) {
         };
       }
     }),
-    defineTool8({
+    defineTool9({
       name: "remote_restore",
       description: "Undo a delete. With `id`, puts that bin entry back at the path it was deleted from; without `id`, undoes the most recent discard; with `list: true`, shows what the bin holds for this session's root and changes nothing. `remote_delete` returns the entry id as `entryId`. The bin is subject to retention limits (`binMaxEntries` / `binMaxBytes` / `binMaxAgeMs`), so an old entry may already be gone.",
       parameters: {
@@ -21000,6 +21900,8 @@ function managementToolDefinitions(backend) {
           throw new Error("id \u5FC5\u987B\u662F\u975E\u7A7A\u5B57\u7B26\u4E32\uFF08\u7701\u7565\u5B83\u8868\u793A\u64A4\u9500\u6700\u8FD1\u4E00\u6B21\u5220\u9664\uFF09");
         }
         const target = targetFor4(backend, exec);
+        const listing = record2["list"] === true;
+        if (!listing) backend.assertWritable?.(target, "\u4ECE\u56DE\u6536\u7AD9\u6062\u590D\u8FDC\u7AEF\u6587\u4EF6");
         const outcome = await backend.restore({
           target,
           id: typeof id === "string" ? id : void 0,
@@ -21013,7 +21915,7 @@ function managementToolDefinitions(backend) {
         return { action: "undone", id: outcome.id, message: outcome.message };
       }
     }),
-    defineTool8({
+    defineTool9({
       name: "remote_copy",
       description: "Copy one file to another path **on the remote host**. Both paths are inside this session's remote root. On a Tier 2 (agent) connection the copy happens on the remote side, so the bytes never cross this machine; otherwise they are relayed through it, and the result says which happened in `via`. Pass `recursive: true` to copy a whole directory tree in one round trip (Tier 2 only \u2014 it refuses rather than relaying a tree file by file). The destination must not exist, or be an empty directory: a recursive copy never deletes anything.",
       parameters: {
@@ -21056,6 +21958,7 @@ function managementToolDefinitions(backend) {
         if (typeof source !== "string") throw new Error(source.error);
         const destination = resolveUnderRoot(target.root, to, void 0, target.connectionId);
         if (typeof destination !== "string") throw new Error(destination.error);
+        backend.assertWritable?.(target, "\u590D\u5236\u8FDC\u7AEF\u6587\u4EF6");
         const outcome = await backend.copy({
           target,
           from: source,
@@ -21076,7 +21979,7 @@ function managementToolDefinitions(backend) {
         };
       }
     }),
-    defineTool8({
+    defineTool9({
       name: "remote_env",
       description: "Sample what the remote host is and what it can do: OS/arch/distro/kernel, shell, CPU count, memory and disk, user and home, and **which commands exist** (rg, fd, git, python3, gcc, docker, ...). Ask this once instead of guessing and retrying: the answer is cached on the agent until `refresh: true`, so a repeat call costs one round trip and no resampling.",
       parameters: {
@@ -21290,6 +22193,8 @@ function wireManagementTools(env) {
   )?.root;
   const managementBackend = {
     resolve: (cwd) => toolBackend.resolve(cwd),
+    // 管理工具（上传/删除/恢复/复制）之前完全不过写闸：read-only 会话照样能删文件（审计 2026-11-06 宿主 P0）。
+    assertWritable: (target, action) => env.assertWritable(target, action),
     // ADR-0013: the session id (plus its fork lineage) is the strict scope; `cwd` alone cannot separate
     // two conversations opened on the same directory.
     resolveSessionRoot: (cwd, sessionId) => sessionRoots.outcomeFor(cwd, sessionIdentityOf(ctx, sessionId)),
@@ -21409,6 +22314,7 @@ function wireManagementTools(env) {
 }
 
 // src/wiring/tools.ts
+init_errors();
 function sessionRootsFilePath() {
   return join18(resolveStateDir(), USER_ROOTS_FILE_NAME);
 }
@@ -21449,7 +22355,8 @@ function wireTools(env) {
     disposeJobTools,
     disposeFileTools,
     lspRegistry,
-    disposeLspTools
+    disposeLspTools,
+    assertWritable: assertWritable2
   } = wireFileAndJobTools({ ctx, limits, profiles, transports, registry, sessionRoots });
   const sessionAdmin = wireSessionAdmin({ ctx, limits, notifySessionRemoved: notifySessionRemoved2 });
   const { dispose: disposeManagement } = wireManagementTools({
@@ -21463,7 +22370,8 @@ function wireTools(env) {
     sessionRoots,
     recordFor,
     transferService,
-    transferTracker
+    transferTracker,
+    assertWritable: assertWritable2
   });
   const disposeStrictArguments = strictArgumentsGate(ctx);
   return {
@@ -21532,7 +22440,9 @@ function wireAgentTools(env) {
     disposeRemoteTools();
     disposeGitTool();
     disposeForwardTool();
-    void forwardBackend.closeAll();
+    void forwardBackend.closeAll().catch((error) => {
+      ctx.logger?.warn?.(`over-ssh: \u5173\u95ED\u7AEF\u53E3\u8F6C\u53D1\u65F6\u51FA\u9519\uFF1A${error instanceof Error ? error.message : String(error)}`);
+    });
   };
   return { sessionRoots, toolBackend, disposeTools };
 }
@@ -21569,21 +22479,33 @@ function wireFileAndJobTools(env) {
     backendFor: (target) => recordFor(target)?.backend,
     ...limits.maxReadBytes === void 0 ? {} : { maxReadBytes: limits.maxReadBytes }
   });
-  const allowMutation = (target) => {
+  const allowMutation = (target, action) => {
+    const policy = platformMutationPolicy(ctx);
+    const sessionId = currentSessionId();
+    const cwd = sessionId === void 0 || sessionId === "" ? void 0 : readSessionCwd(ctx, sessionId);
     const refusal = mutationRefusal(
-      `${target.connectionId}:${target.root}`,
+      action === void 0 ? `${target.connectionId}:${target.root}` : `${action}\uFF1A${target.connectionId}:${target.root}`,
       {
-        ...platformMutationPolicy(ctx),
+        ...policy,
         rootArea: () => {
           const record2 = recordFor(target);
           if (record2 === void 0) return "deny";
-          return workspaceWriteArea(record2.root, void 0, void 0, sessionIdentityOf(ctx, currentSessionId()));
+          return workspaceWriteArea(record2.root, policy.policy?.workspaceRoot, cwd, sessionIdentityOf(ctx, sessionId));
         }
       }
     );
     if (refusal !== void 0) throw new Error(refusal);
   };
   const disposeFileTools = registerRemoteFileTools(ctx, fileBackend, { allowMutation });
+  const assertWritable2 = (target, action) => {
+    allowMutation(target, action);
+    if (recordFor(target)?.root.writable === false) {
+      throw new SshDevError("SANDBOX_DENIED", `\u8FD9\u4E2A\u6839\u5728\u914D\u7F6E\u91CC\u662F\u53EA\u8BFB\u7684\uFF08writable: false\uFF09\uFF0C\u62D2\u7EDD\u5199\u5165\uFF1A${action}`, {
+        connectionId: target.connectionId,
+        root: target.root
+      });
+    }
+  };
   const lspRegistry = createLspRegistry({
     acquire: async (connectionId) => (await transports.acquire(requireProfile(profiles, connectionId))).transport,
     onLog: (connectionId, message) => {
@@ -21591,7 +22513,7 @@ function wireFileAndJobTools(env) {
     }
   });
   const disposeLspTools = registerRemoteLspTools(ctx, { backend: fileBackend, registry: lspRegistry });
-  return { recordFor, disposeJobTools, disposeFileTools, lspRegistry, disposeLspTools };
+  return { recordFor, disposeJobTools, disposeFileTools, lspRegistry, disposeLspTools, assertWritable: assertWritable2 };
 }
 
 // src/index.ts