dsh-over-ssh 0.2.1 → 0.2.2

package/README.md

@@ -35,6 +35,15 @@ shell:
 
 不配也能用，只是 Web 终端永远开在本地（远程文件、远端执行、`@` 补全不受影响）。
 
+## 0.2.2 更新
+
+- 「添加目录」按会话作用域显示与删除，fork 子会话继承父会话的目录且立即可见。
+- 会话面板：删除/还原/清理都有确认与部分失败说明；运行中的会话拒绝删除；回收站条目显示标题与删除时间。
+- SSH 传输：连接闪断后自动重建（不再永久超时）；版本守卫会校验摘要来源，损坏/缺失的摘要不再当守卫。
+- 宿主 HTTP：请求体超限、路径含 NUL、根外访问返回 400 而不是 500；`?workspace=` 单独给出时也生效。
+- 性能：会话面板刷新的日志头读取加签名缓存（31 会话冷 17 ms → 热 1.3–3.7 ms）；`GET /roots` 与
+  `user-roots.json` 读取走 stat 短路；`?session=` 过滤先过滤后投影。
+
 ## 发布说明
 
 包里带了两个平台的 Tier 2 代理二进制（纯静态，远端零依赖）。源码在配套的 Go 仓库
@@ -45,10 +54,10 @@ shell:
 
 | 平台 | 字节 | sha256 |
 |---|---|---|
-| linux-amd64 | 4,944,032 | `fd5a5d6f8be07e786cc7c34a1aad8e2f040f1de3b7f124e739d2209df5ab5038` |
-| linux-arm64 | 4,653,216 | `202f4be3d1c1d98ccae27b9ccaa4879fa148c741981063f8be98689674b3ad2e` |
+| linux-amd64 | 4,944,032 | `d45237ef1bfec1955fb5e6a2391bd651ffeaffb89e781e1c518e9e9836eec974` |
+| linux-arm64 | 4,653,216 | `237a3cc9f5ae57f752f62eee4f8a57bd8c4684fd4d3fa6ab5851115baa844ccd` |
 
-- 代理版本：`0.2.1-e019f2d`
+- 代理版本：`0.2.2-e019f2d`
 - 源码提交：`e019f2d`（Go 仓 `dsh-over-ssh-agent` 的这个提交）
 - 清单原文：包内 `agents/agent-manifest.json`
 - 核对：`sha256sum agents/<平台>/dsh-over-ssh-agent` 与上表比对；按上面的提交检出 Go 仓后

package/agents/agent-manifest.json

@@ -1,19 +1,19 @@
 {
   "version": 1,
-  "generatedAt": "2026-11-05T23:45:29.528Z",
-  "agentVersion": "0.2.1-e019f2d",
+  "generatedAt": "2026-11-06T16:15:01.747Z",
+  "agentVersion": "0.2.2-e019f2d",
   "sourceCommit": "e019f2d",
   "artifacts": [
     {
       "platform": "linux-amd64",
       "path": "linux-amd64/dsh-over-ssh-agent",
-      "sha256": "fd5a5d6f8be07e786cc7c34a1aad8e2f040f1de3b7f124e739d2209df5ab5038",
+      "sha256": "d45237ef1bfec1955fb5e6a2391bd651ffeaffb89e781e1c518e9e9836eec974",
       "bytes": 4944032
     },
     {
       "platform": "linux-arm64",
       "path": "linux-arm64/dsh-over-ssh-agent",
-      "sha256": "202f4be3d1c1d98ccae27b9ccaa4879fa148c741981063f8be98689674b3ad2e",
+      "sha256": "237a3cc9f5ae57f752f62eee4f8a57bd8c4684fd4d3fa6ab5851115baa844ccd",
       "bytes": 4653216
     }
   ]

package/lib/client.js

@@ -1698,8 +1698,8 @@ function parseRootsSnapshot(value) {
     const row = toRootRow(entry, "config", false);
     const identity = row === void 0 ? void 0 : rootKeyIdentity(row.key);
     if (row !== void 0 && identity !== void 0 && !seen.has(identity)) {
-      const scoped = userWorkspaces.get(identity);
-      const scopedSessions = userSessions.get(identity);
+      const scoped = row.workspaces ?? userWorkspaces.get(identity);
+      const scopedSessions = row.sessions ?? userSessions.get(identity);
       roots.push({
         ...row,
         inUserFile: userKeys.has(identity),
@@ -1723,7 +1723,14 @@ function parseRootsSnapshot(value) {
   }
   const warnings = (Array.isArray(payload.warnings) ? payload.warnings : []).filter((item) => typeof item === "string");
   const anchorRoot = readString(payload, "anchorRoot");
-  return { roots, connections, warnings, ...anchorRoot === void 0 ? {} : { anchorRoot } };
+  const scopedForSession = readString(payload, "scopedForSession");
+  return {
+    roots,
+    connections,
+    warnings,
+    ...anchorRoot === void 0 ? {} : { anchorRoot },
+    ...scopedForSession === void 0 ? {} : { scopedForSession }
+  };
 }
 function isAbsoluteRemotePath(path) {
   if (!path.startsWith("/")) return false;
@@ -1912,13 +1919,27 @@ async function requestSnapshot(fetchImpl, path, init) {
       const reason = typeof body?.error === "string" ? body.error : transportFailureReason(response.status, path);
       return { ok: false, error: reason };
     }
+    if (typeof body === "object" && body !== null && body["ok"] === false && typeof body["error"] === "string") {
+      return { ok: false, error: body["error"] };
+    }
     return { ok: true, value: parseRootsSnapshot(body) };
   } catch (error) {
     return { ok: false, error: error instanceof Error ? error.name : "network" };
   }
 }
 function createRootsApi(fetchImpl, path = ROOTS_API_PATH) {
-  const load = async (signal) => requestSnapshot(fetchImpl, path, { method: "GET", headers: { accept: "application/json" }, ...signal === void 0 ? {} : { signal } });
+  const load = async (options = {}) => {
+    const normalized = options instanceof AbortSignal ? { signal: options } : options;
+    const query = new URLSearchParams();
+    if (normalized.session !== void 0 && normalized.session !== "") query.set("session", normalized.session);
+    if (normalized.workspace !== void 0 && normalized.workspace !== "") query.set("workspace", normalized.workspace);
+    const suffix = query.size === 0 ? "" : `?${query.toString()}`;
+    return requestSnapshot(fetchImpl, `${path}${suffix}`, {
+      method: "GET",
+      headers: { accept: "application/json" },
+      ...normalized.signal === void 0 ? {} : { signal: normalized.signal }
+    });
+  };
   const send = async (payload) => requestSnapshot(fetchImpl, path, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(payload) });
   const sendRaw = async (payload) => {
     try {
@@ -2435,7 +2456,16 @@ function createTransferProgress(options) {
       setState(transferPanelPollStarted(state, showLoading));
       const options_ = mode === "park" ? { waitMs, signal: controller.signal } : { signal: controller.signal };
       issued += 1;
-      const result = await options.io.list(options_);
+      let result;
+      try {
+        result = await options.io.list(options_);
+      } catch (error) {
+        if (controller.signal.aborted || disposed) {
+          if (inFlight === controller) inFlight = void 0;
+          continue;
+        }
+        result = { ok: false, error: error instanceof Error ? error.message : "list-failed" };
+      }
       if (inFlight === controller) inFlight = void 0;
       if (disposed) return;
       if (mine !== generation) {
@@ -2476,6 +2506,7 @@ function createTransferProgress(options) {
     },
     clear: () => {
       if (disposed) return;
+      if (state.clearing) return;
       setState(transferPanelClearing(state));
       void options.io.clear().then((result) => {
         if (disposed) return;
@@ -2574,7 +2605,9 @@ var ROOTS_EDIT_BACKDROP_CLASS = classes(CLASS.backdrop, CLASS.backdropSettings);
 function createRootsPanelController(options) {
   let state = initialRootsPanelState();
   const listeners = /* @__PURE__ */ new Set();
-  let token = 0;
+  let readToken = 0;
+  let writeToken = 0;
+  let epoch = 0;
   let disposed = false;
   const requests = createAbortGate();
   const dispatch = (action) => {
@@ -2583,22 +2616,30 @@ function createRootsPanelController(options) {
     state = next;
     for (const listener of [...listeners]) listener();
   };
-  const latest = (mine) => !disposed && mine === token;
+  const latestRead = (mine, issuedEpoch) => !disposed && mine === readToken && issuedEpoch === epoch;
+  const latestWrite = (mine) => !disposed && mine === writeToken;
   const reload = async () => {
-    const mine = ++token;
+    const mine = ++readToken;
+    const issuedEpoch = epoch;
     const signal = requests.begin();
     dispatch({ type: "load" });
     const result = await options.api.load(signal);
-    if (!latest(mine)) return;
+    if (!latestRead(mine, issuedEpoch)) return;
+    if (result.ok && result.value.warnings.includes("roots-invalid-answer")) {
+      dispatch({ type: "failed", error: "roots-invalid-answer" });
+      return;
+    }
     if (result.ok) dispatch({ type: "loaded", snapshot: result.value });
     else dispatch({ type: "failed", error: result.error });
   };
   const settle = async (mine, scope, result, resetDrafts) => {
-    if (!latest(mine)) return;
+    if (!latestWrite(mine)) return;
     if (!result.ok) {
       dispatch({ type: "failed", error: result.error, scope });
       return;
     }
+    epoch += 1;
+    void result.value;
     dispatch({ type: "succeeded", scope, ...resetDrafts ? { resetDrafts: true } : {} });
     await reload();
   };
@@ -2611,7 +2652,7 @@ function createRootsPanelController(options) {
       dispatch({ type: "refused", scope: "roots", message: validated.message });
       return;
     }
-    const mine = ++token;
+    const mine = ++writeToken;
     dispatch({ type: "submitted" });
     const result = await options.api.send({ action: "add-root", ...validated.value });
     await settle(mine, "roots", result, true);
@@ -2637,7 +2678,7 @@ function createRootsPanelController(options) {
       dispatch({ type: "refused", scope: "connection", message: validated.message });
       return;
     }
-    const mine = ++token;
+    const mine = ++writeToken;
     dispatch({ type: "submitted" });
     const result = await options.api.send({ action: "add-connection", ...validated.value });
     await settle(mine, "connection", result, true);
@@ -2646,7 +2687,7 @@ function createRootsPanelController(options) {
     const row = selectRootsView(state).rows.find((candidate) => candidate.key === key);
     if (row === void 0 || !row.removable) return;
     if (!canEdit(state)) return;
-    const mine = ++token;
+    const mine = ++writeToken;
     dispatch({ type: "remove", key });
     const result = await options.api.send({ action: "remove-root", key });
     await settle(mine, "roots", result, false);
@@ -2702,7 +2743,7 @@ function createRootsPanelController(options) {
       dispatch({ type: "refused", scope: "edit", message: validated.message });
       return;
     }
-    const mine = ++token;
+    const mine = ++writeToken;
     dispatch({ type: "submitted" });
     const result = await options.api.send({ action: "update-connection", id: editingId, ...validated.value });
     await settle(mine, "edit", result, true);
@@ -2716,16 +2757,16 @@ function createRootsPanelController(options) {
   const confirmRemoveConnection = async (id) => {
     if (state.confirmingRemove !== id) return;
     if (!canEdit(state)) return;
-    const mine = ++token;
+    const mine = ++writeToken;
     dispatch({ type: "submitted" });
     const result = await options.api.send({ action: "remove-connection", id });
     await settle(mine, "edit", result, true);
   };
   const loadImport = async () => {
-    const mine = ++token;
+    const mine = ++readToken;
     dispatch({ type: "import-busy" });
     const result = await options.api.sendRaw({ action: "list-ssh-config" });
-    if (!latest(mine)) return;
+    if (disposed || mine !== readToken) return;
     if (!result.ok) {
       dispatch({ type: "import-failed", error: result.error });
       return;
@@ -2739,10 +2780,10 @@ function createRootsPanelController(options) {
   const submitImport = async () => {
     const selected = state.importSelected ?? [];
     if (selected.length === 0) return;
-    const mine = ++token;
+    const mine = ++writeToken;
     dispatch({ type: "import-busy" });
     const result = await options.api.sendRaw({ action: "import-ssh-config", aliases: selected });
-    if (!latest(mine)) return;
+    if (!latestWrite(mine)) return;
     if (!result.ok) {
       dispatch({ type: "import-failed", error: result.error });
       return;
@@ -3625,10 +3666,10 @@ function buildPanelModel(copy, options = {}) {
 // src/shared/remote-identity.ts
 var SSH_DEV_REMOTE_NAMESPACE = "sshdev";
 var SSH_DEV_REMOTE_SERVICE = "sshDevRemote";
-
-// src/client/core/remote.ts
 var SSH_DEV_REMOTE_METHOD = "connections";
 var SSH_DEV_REMOTE_PACKAGE = "dsh-over-ssh";
+
+// src/client/core/remote.ts
 var SSH_DEV_CONNECTIONS_DESCRIPTOR = {
   id: `${SSH_DEV_REMOTE_PACKAGE}#${SSH_DEV_REMOTE_NAMESPACE}/${SSH_DEV_REMOTE_METHOD}`,
   service: SSH_DEV_REMOTE_SERVICE,
@@ -4526,6 +4567,7 @@ function createSessionRowActionStore(deps) {
     };
   });
   let cancelAutoClose;
+  let postInFlight = false;
   const stopAutoClose = () => {
     cancelAutoClose?.();
     cancelAutoClose = void 0;
@@ -4550,18 +4592,21 @@ function createSessionRowActionStore(deps) {
   const confirm = async () => {
     const request = state.request;
     const row = state.row;
-    if (disposed || request === void 0 || state.busy) return;
+    if (disposed || request === void 0 || state.busy || postInFlight) return;
     if (state.phase !== "ready" || row === void 0 || !row.deletable) return;
     const stillPending = () => {
       const current = state.request;
       return current !== void 0 && current.kind === request.kind && current.sessionId === request.sessionId;
     };
+    postInFlight = true;
     dispatch({ ...state, busy: true, outcome: void 0 });
     let result;
     try {
       result = await deleteSessions(deps.io, [request.sessionId], request.kind === "delete" ? { permanent: true } : {});
     } catch {
       result = { kind: "error", message: { key: "sessionResultActionFailed" } };
+    } finally {
+      postInFlight = false;
     }
     if (disposed || !stillPending()) return;
     dispatch({ ...state, busy: false, outcome: result });
@@ -4584,7 +4629,7 @@ function createSessionRowActionStore(deps) {
     request: (request) => {
       if (disposed) return;
       stopAutoClose();
-      dispatch({ request, phase: "loading", row: void 0, busy: false, outcome: void 0 });
+      dispatch({ request, phase: "loading", row: void 0, busy: postInFlight, outcome: void 0 });
     },
     load,
     confirm,
@@ -5281,7 +5326,7 @@ function DirectoryBrowserSection({
   listRef
 }) {
   const view = selectDirectoryBrowserView(state);
-  const gate = disabled;
+  const gate = disabled || state.pending;
   const connectionFieldId = `${idPrefix}-connection`;
   const modeButton = (mode, label) => Button({
     // The active world is the brand-filled one: the switch reads without an extra attribute, and both
@@ -5503,12 +5548,18 @@ function createSessionDirectoryIo(options) {
   });
   const rootsApi = createRootsApi(options.fetchImpl, path);
   const loadRoots = async (workspacePath, sessionId) => {
-    const result = await rootsApi.load();
+    const result = await rootsApi.load({
+      ...sessionId === void 0 || sessionId === "" ? {} : { session: sessionId },
+      ...workspacePath === void 0 || workspacePath === "" ? {} : { workspace: workspacePath }
+    });
     if (!result.ok) return result;
     if (result.value.warnings.includes("roots-invalid-answer")) {
       return { ok: false, error: "roots-invalid-answer" };
     }
     const all = result.value.roots;
+    if (sessionId !== void 0 && sessionId !== "" && result.value.scopedForSession === sessionId) {
+      return { ok: true, value: all };
+    }
     if (workspacePath === void 0 || workspacePath === "") return { ok: true, value: [] };
     return {
       ok: true,
@@ -5651,7 +5702,11 @@ function selectSessionDirectoryView(state, copy) {
         title: row.label ?? (row.location === "remote" ? `${row.connectionId ?? ""}:${row.path}` : row.path),
         subtitle: row.label === void 0 ? "" : row.path,
         badge: row.location === "remote" ? copy["rootsBadgeRemote"] : copy["rootsBadgeLocal"],
-        removable: row.inUserFile
+        // fork 继承来的行没有删除按钮：它在父亲那里才是"本会话添加的"，在这里点删除会把父会话的
+        // 目录拿走（宿主也会拒绝）。没有 sessions 字段的历史条目按文件权限判定，保持旧行为。
+        removable: row.inUserFile && // 会话型条目只有**本会话**能删；`state.sessionId` 还没到也不能放行（那会把父会话的目录
+        // 交给 fork 去删，宿主会拒，用户看到的是一次"按了没反应"）。历史条目（无 sessions）按文件权限。
+        (row.sessions === void 0 || state.sessionId !== void 0 && row.sessions.includes(state.sessionId))
       }))
     ],
     rootsPending: state.rootsPending,
@@ -5706,11 +5761,14 @@ function createSessionDirectory(deps) {
   const commit = async (path, connectionId) => {
     if (disposed || state.pending) return;
     const location = connectionId === void 0 ? "local" : "remote";
-    const validated = validateRootDraft({
-      location,
-      path,
-      ...connectionId === void 0 ? {} : { connectionId }
-    });
+    const validated = validateRootDraft(
+      {
+        location,
+        path,
+        ...connectionId === void 0 ? {} : { connectionId }
+      },
+      state.roots
+    );
     if (!validated.ok) {
       dispatch({ type: "refused", message: validated.message });
       return;
@@ -5819,7 +5877,10 @@ function SessionDirectorySection({
       { className: CLASS.block },
       (0, import_react11.createElement)("h4", { className: CLASS.blockTitle }, copy.sessionRootsTitle),
       (0, import_react11.createElement)("p", { className: CLASS.hint }, copy.sessionRootsHint),
-      view.roots.filter((row) => row.workspace !== true).length === 0 ? view.rootsReading ? Notice({ role: "status", tone: "info", children: copy.sessionRootsLoading }) : (
+      // **有行就画列表**：工作区那一行是合成行，它不属于"已添加目录"，但它是这张卡片最重要的一行。
+      // 旧条件按"有没有已添加目录"决定画不画整张列表，结果是新会话只看到「还没有添加目录」，连会话
+      // 自己在哪个工作区都不显示，必须先去添加一个目录才冒出来（审计 2026-11-06，用户截图）。
+      view.roots.length === 0 ? view.rootsReading ? Notice({ role: "status", tone: "info", children: copy.sessionRootsLoading }) : (
         // A failed read is not an empty list: the error notice below is the whole truth there, and
         // 「还没有添加目录」 next to it would contradict it (same rule as the import dialog, ui P2-2/P2-3).
         view.notice === "" ? (0, import_react11.createElement)("p", { className: CLASS.empty }, copy.sessionRootsEmpty) : null
@@ -5839,7 +5900,9 @@ function SessionDirectorySection({
               Button({
                 variant: "ghost",
                 size: "compact",
-                disabled: view.rootsPending,
+                // 刷新在飞时也禁用：否则一次点击会叠加"删除 + 一次刷新"两次远端写
+                // （审计 2026-11-06 客户端 P2）。
+                disabled: view.rootsPending || view.rootsReading,
                 onClick: () => actions.onRemoveRoot(row.key),
                 children: copy.rootsRemove
               })
@@ -5847,6 +5910,8 @@ function SessionDirectorySection({
           )
         )
       ),
+      // 列表里只剩工作区行时，"还没有添加目录"仍然是有用的下一步提示；但它不再替换列表。
+      view.roots.length > 0 && view.roots.filter((row) => row.workspace !== true).length === 0 && !view.rootsReading && view.notice === "" ? (0, import_react11.createElement)("p", { className: CLASS.empty }, copy.sessionRootsEmpty) : null,
       (0, import_react11.createElement)(
         "div",
         { className: CLASS.actions },
@@ -5886,20 +5951,22 @@ function readWorkspacePath(props) {
   const fromWorkspace = workspaces === void 0 ? void 0 : workspaces(
     (snapshot) => sessionId === void 0 || sessionId === "" ? void 0 : snapshot?.items?.find((item) => item.sessionIds?.includes(sessionId) === true)?.path
   );
-  if (typeof fromSession === "string" && fromSession !== "") return fromSession;
   if (typeof fromWorkspace === "string" && fromWorkspace !== "") return fromWorkspace;
+  if (typeof fromSession === "string" && fromSession !== "") return fromSession;
   return void 0;
 }
 function rootsQueryKey(state) {
   if (!state.open) return "closed";
-  if (state.workspacePath === void 0 || state.workspacePath === "") return "open:";
-  return `open:${state.workspacePath}\0${state.sessionId ?? ""}`;
+  const workspace = state.workspacePath === void 0 || state.workspacePath === "" ? "unknown" : state.workspacePath;
+  const session = state.sessionId === void 0 || state.sessionId === "" ? "unknown" : state.sessionId;
+  return `open:${workspace}\0${session}`;
 }
 function SessionDirectoryContainer(props) {
   const { copy, io } = props;
   const copyRef = (0, import_react11.useRef)(copy);
   copyRef.current = copy;
-  const [controller] = (0, import_react11.useState)(() => createSessionDirectory({ io, copy: () => copyRef.current }));
+  const injected = props.controller;
+  const [controller] = (0, import_react11.useState)(() => injected ?? createSessionDirectory({ io, copy: () => copyRef.current }));
   const state = (0, import_react11.useSyncExternalStore)(controller.subscribe, controller.getState);
   const workspacePath = readWorkspacePath(props);
   const titleId = (0, import_react11.useId)();
@@ -5924,8 +5991,10 @@ function SessionDirectoryContainer(props) {
   useCardTabTrap(state.open, portal.container);
   (0, import_react11.useEffect)(() => {
     controller.activate();
-    return () => controller.dispose();
-  }, [controller]);
+    return () => {
+      if (injected === void 0) controller.dispose();
+    };
+  }, [controller, injected]);
   (0, import_react11.useLayoutEffect)(() => {
     if (!state.open) return;
     focusOrigin.current = captureFocusOrigin(browserPortalDocument());
@@ -6889,6 +6958,7 @@ function apply(ctx) {
         return await chooser.pickDirectory();
       }
     });
+    const controller = createSessionDirectory({ io, copy: () => copy() });
     const registerSessionEntry = () => ctx.slots.inject(
       SESSION_DIRECTORY_SLOT,
       () => ctx.slots.register(
@@ -6896,7 +6966,7 @@ function apply(ctx) {
           name: SESSION_DIRECTORY_SLOT,
           id: SESSION_DIRECTORY_ID,
           order: SESSION_DIRECTORY_ORDER,
-          inject: () => ({ copy: copy(), io })
+          inject: () => ({ copy: copy(), io, controller })
         },
         SessionDirectoryContainer
       )
@@ -6909,6 +6979,7 @@ function apply(ctx) {
     return () => {
       offLocaleChange();
       disposeEntry();
+      controller.dispose();
     };
   });
   ctx.effect(() => {

package/lib/file-references.js

@@ -154,11 +154,28 @@ function normalizeLocalPath2(path, options = {}) {
   return normalizeLocalPath(path, { caseInsensitive: options.caseInsensitive ?? process.platform === "win32" });
 }
 
+// src/host/integration/session-fork-pending.ts
+var pending = /* @__PURE__ */ new Map();
+function pendingForkSources(sessionId) {
+  if (sessionId === void 0 || sessionId === "") return [];
+  const source = pending.get(sessionId);
+  return source === void 0 ? [] : [source];
+}
+
 // src/host/integration/session-scope.ts
 var MAX_FORK_DEPTH = 32;
 var ancestorCache = /* @__PURE__ */ new Map();
 var ANCESTOR_CACHE_MAX = 256;
 function readSessionAncestors(ctx, sessionId) {
+  const pending2 = pendingForkSources(sessionId);
+  if (pending2.length > 0) {
+    const inherited = /* @__PURE__ */ new Set();
+    for (const source of pending2) {
+      inherited.add(source);
+      for (const ancestor of walkAncestors(ctx, source).ancestors) inherited.add(ancestor);
+    }
+    return [...inherited];
+  }
   const cached = ancestorCache.get(sessionId);
   if (cached !== void 0) {
     ancestorCache.delete(sessionId);