dsh-over-ssh 0.2.1 → 0.2.2

package/lib/index.js

@@ -420,7 +420,7 @@ function createProxyForwarder(options) {
         }
         const idleMs = now() - current.lastActivityAt;
         if (idleMs < idleTimeoutMs) return;
-        void closeEntry(current).then(() => options.onReclaimed?.(handle, idleMs));
+        void closeEntry(current).then(() => options.onReclaimed?.(handle, idleMs)).catch(() => void 0);
       }, checkMs);
       entry.timer.unref?.();
     }
@@ -1267,6 +1267,13 @@ ${buildRemoteScript(request.script)}`;
           ...request.env === void 0 ? {} : { env: request.env }
         });
       }
+      /** Mark the transport lost **only if the dead session is still the current one** (a reconnect may have won). */
+      #markSessionLost(session) {
+        if (this.#session !== session) return;
+        this.#sftp = void 0;
+        this.#sftpPending = void 0;
+        this.markState("lost");
+      }
       #requireSession() {
         if (this.#session === void 0) {
           throw new SshDevError("CONNECTION_LOST", "SSH \u4F1A\u8BDD\u5C1A\u672A\u5EFA\u7ACB", { connectionId: this.id });
@@ -1324,8 +1331,13 @@ ${buildRemoteScript(request.script)}`;
         }
         const connector = this.#options.connector ?? defaultConnector;
         try {
-          this.#session = await connector(signal === void 0 ? connect2 : { ...connect2, signal });
+          const session = await connector(signal === void 0 ? connect2 : { ...connect2, signal });
+          this.#session = session;
           this.#sessionCount++;
+          const onLost = () => this.#markSessionLost(session);
+          session.on?.("close", onLost);
+          session.on?.("error", onLost);
+          session.on?.("end", onLost);
           this.markState("ready");
         } catch (error) {
           this.markState("lost");
@@ -1651,6 +1663,35 @@ var TransportService = class {
 
 // src/host/integration/session-scope.ts
 import { AsyncLocalStorage } from "node:async_hooks";
+
+// src/host/integration/session-fork-pending.ts
+var pending = /* @__PURE__ */ new Map();
+var MAX_PENDING = 256;
+function markForkInheritancePending(childSessionId, sourceSessionId) {
+  const child = childSessionId.trim();
+  const source = sourceSessionId.trim();
+  if (child === "" || source === "" || child === source) return;
+  pending.delete(child);
+  pending.set(child, source);
+  while (pending.size > MAX_PENDING) {
+    const oldest = pending.keys().next();
+    if (oldest.done === true) break;
+    pending.delete(oldest.value);
+  }
+}
+function pendingForkSources(sessionId) {
+  if (sessionId === void 0 || sessionId === "") return [];
+  const source = pending.get(sessionId);
+  return source === void 0 ? [] : [source];
+}
+function clearForkInheritancePending(childSessionId) {
+  pending.delete(childSessionId);
+}
+function clearAllForkInheritancePending() {
+  pending.clear();
+}
+
+// src/host/integration/session-scope.ts
 var STORE_KEY = /* @__PURE__ */ Symbol.for("dsh-over-ssh/session-scope");
 function store() {
   const holder = globalThis;
@@ -1670,6 +1711,15 @@ var MAX_FORK_DEPTH = 32;
 var ancestorCache = /* @__PURE__ */ new Map();
 var ANCESTOR_CACHE_MAX = 256;
 function readSessionAncestors(ctx, sessionId) {
+  const pending2 = pendingForkSources(sessionId);
+  if (pending2.length > 0) {
+    const inherited = /* @__PURE__ */ new Set();
+    for (const source of pending2) {
+      inherited.add(source);
+      for (const ancestor of walkAncestors(ctx, source).ancestors) inherited.add(ancestor);
+    }
+    return [...inherited];
+  }
   const cached2 = ancestorCache.get(sessionId);
   if (cached2 !== void 0) {
     ancestorCache.delete(sessionId);
@@ -2193,6 +2243,7 @@ var MAX_OUTPUT_BYTES = 64 * 1024;
 var DEFAULT_EXEC_TIMEOUT_MS = 3e4;
 var MAX_EXEC_TIMEOUT_MS = 3e5;
 var MAX_EXEC_ENV_ENTRIES = 64;
+var MAX_EXEC_BATCH_CONNECTIONS = 8;
 var ENV_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function stringArg(value) {
   if (typeof value !== "string") return void 0;
@@ -3016,16 +3067,16 @@ function createTransferService(dependencies) {
   };
   const partialBytesOnRemote = async (absolute, context, signal) => {
     try {
-      const stat5 = await dependencies.statRemote(absolute);
-      return stat5.exists && stat5.isFile ? stat5.size : void 0;
+      const stat7 = await dependencies.statRemote(absolute);
+      return stat7.exists && stat7.isFile ? stat7.size : void 0;
     } catch (error) {
       throw failureFrom(error, "remote-stat-failed", "\u8BFB\u53D6\u8FDC\u7AEF\u76EE\u6807\u4FE1\u606F\u5931\u8D25\uFF08\u7EED\u4F20\u524D\u9700\u8981\u786E\u8BA4\u5DF2\u6709\u957F\u5EA6\uFF09", { ...context }, signal);
     }
   };
   const partialBytesOnLocal = async (path, context, signal) => {
     try {
-      const stat5 = await dependencies.statLocal(path);
-      return stat5.exists && stat5.isFile ? stat5.size : void 0;
+      const stat7 = await dependencies.statLocal(path);
+      return stat7.exists && stat7.isFile ? stat7.size : void 0;
     } catch (error) {
       throw failureFrom(error, "local-stat-failed", "\u8BFB\u53D6\u672C\u5730\u76EE\u6807\u4FE1\u606F\u5931\u8D25\uFF08\u7EED\u4F20\u524D\u9700\u8981\u786E\u8BA4\u5DF2\u6709\u957F\u5EA6\uFF09", { ...context }, signal);
     }
@@ -4494,13 +4545,14 @@ function createSessionAdminContext(deps) {
       const dir = joinPath(joinPath(sessionsRoot, project), session.name);
       const contents = await deps.listDir(dir);
       let bytes = 0;
-      let updatedAtMs = session.mtimeMs;
+      let updatedAtMs = Math.trunc(session.mtimeMs);
       for (const item of contents) {
         if (item.isDirectory) continue;
         bytes += item.bytes;
-        if (item.mtimeMs > updatedAtMs) updatedAtMs = item.mtimeMs;
+        const itemMs = Math.trunc(item.mtimeMs);
+        if (itemMs > updatedAtMs) updatedAtMs = itemMs;
       }
-      const header = await deps.readHeader(dir);
+      const header = await deps.readHeader(dir, contents);
       if (header === void 0) {
         return {
           id: session.name,
@@ -4803,7 +4855,6 @@ function createSessionAdminService(deps) {
     const ordered = [...entries].sort((left, right) => left.deletedAtMs - right.deletedAtMs);
     const doomed = [];
     const nowMs = deps.now();
-    let keptBytes = ordered.reduce((sum, item) => sum + item.bytes, 0);
     if (policy.maxAgeMs > 0) {
       for (const entry of ordered) {
         if (nowMs - entry.deletedAtMs > policy.maxAgeMs) doomed.push(entry);
@@ -4812,6 +4863,7 @@ function createSessionAdminService(deps) {
     const doomedIds = new Set(doomed.map((entry) => entry.id));
     const survivors = ordered.filter((entry) => !doomedIds.has(entry.id));
     if (policy.maxBytes > 0) {
+      let keptBytes = survivors.reduce((sum, item) => sum + item.bytes, 0);
       for (const entry of survivors) {
         if (keptBytes <= policy.maxBytes) break;
         doomed.push(entry);
@@ -4824,7 +4876,7 @@ function createSessionAdminService(deps) {
       const excess = stillKept.length - policy.maxEntries;
       for (const entry of stillKept.slice(0, excess)) {
         doomed.push(entry);
-        keptBytes -= entry.bytes;
+        doomedIds.add(entry.id);
       }
     }
     const outcome = await purgeEntries(doomed, entries);
@@ -4840,11 +4892,54 @@ function createSessionAdminService(deps) {
 }
 
 // src/host/integration/session/session-header.ts
-import { open, readdir } from "node:fs/promises";
+import { open, readdir, stat } from "node:fs/promises";
 import { join } from "node:path";
 import { createZstdDecompress } from "node:zlib";
 var SESSION_HEADER_READ_BYTES = 64 * 1024;
 var SESSION_HEADER_RETRY_BYTES = 1024 * 1024;
+function createCachedSessionHeaderReader(io, options = {}) {
+  const inner = createSessionHeaderReader(io);
+  const stat7 = io.stat;
+  if (stat7 === void 0) return inner;
+  const maxEntries = Math.max(1, Math.floor(options.maxEntries ?? SESSION_HEADER_CACHE_MAX));
+  const cache = /* @__PURE__ */ new Map();
+  return async (dir, listing) => {
+    let signature;
+    if (listing !== void 0) {
+      const log = listing.find((entry) => entry.name.startsWith("session.v") && entry.name.endsWith(".zstd"));
+      if (log !== void 0) signature = `${log.size}:${Math.trunc(log.mtimeMs)}`;
+    } else {
+      try {
+        const names = await io.listDir(dir);
+        const log = names.find((name2) => name2.startsWith("session.v") && name2.endsWith(".zstd"));
+        if (log !== void 0) {
+          const info = await stat7(join(dir, log));
+          signature = `${info.size}:${Math.trunc(info.mtimeMs)}`;
+        }
+      } catch {
+      }
+    }
+    if (signature !== void 0) {
+      const hit = cache.get(dir);
+      if (hit !== void 0 && hit.signature === signature) {
+        cache.delete(dir);
+        cache.set(dir, hit);
+        return hit.header;
+      }
+    }
+    const header = await inner(dir);
+    if (signature !== void 0) {
+      cache.set(dir, { signature, header });
+      while (cache.size > maxEntries) {
+        const oldest = cache.keys().next();
+        if (oldest.done === true) break;
+        cache.delete(oldest.value);
+      }
+    }
+    return header;
+  };
+}
+var SESSION_HEADER_CACHE_MAX = 2048;
 function parseSessionHeaderLine(text8) {
   const firstLine = text8.split("\n")[0];
   if (firstLine === void 0 || firstLine === "") return void 0;
@@ -4930,11 +5025,16 @@ function createDiskSessionHeaderIo() {
   return {
     listDir: (dir) => readdir(dir),
     readHead: readHeadFromDisk,
-    decompress: decompressPrefix
+    decompress: decompressPrefix,
+    // The cache's only input: `(size, mtime)` is what a session log's append changes.
+    stat: async (path) => {
+      const info = await stat(path);
+      return { size: info.size, mtimeMs: info.mtimeMs };
+    }
   };
 }
 function createDiskSessionHeaderReader() {
-  return createSessionHeaderReader(createDiskSessionHeaderIo());
+  return createCachedSessionHeaderReader(createDiskSessionHeaderIo());
 }
 
 // src/host/app/routed-fs.ts
@@ -5820,17 +5920,25 @@ var RootRegistry = class {
    * sessions at all: an empty list means "the session service was not readable", not "no session is live", and
    * dropping every grant on a transient read failure would break live turns.
    *
-   * @param cwds - working directories of the live sessions.
+   * @param cwds - working directories of the live sessions, optionally with the session id that owns each one.
+   *   With an id the root carries `sessions: [id]` and is writable **only by that session**; without one it is a
+   *   workspace-scoped root (the legacy shape tests and agentless compositions use).
    * @returns the session roots this call added (empty when every cwd was already covered).
    */
   syncSessionWorkspaces(cwds) {
     if (cwds.length === 0) return [];
     const live = /* @__PURE__ */ new Set();
     const added = [];
-    for (const cwd of cwds) {
+    for (const item of cwds) {
+      const cwd = typeof item === "string" ? item : item.cwd;
+      const sessionId = typeof item === "string" ? void 0 : item.sessionId;
       if (typeof cwd !== "string" || cwd === "") continue;
       if (!isAbsoluteLocalPath(normalizeLocalPath2(cwd, { caseInsensitive: false }))) continue;
-      const root = makeLocalRoot(cwd, { workspaces: [cwd], writable: true });
+      const root = makeLocalRoot(cwd, {
+        workspaces: [cwd],
+        ...sessionId === void 0 || sessionId === "" ? {} : { sessions: [sessionId] },
+        writable: true
+      });
       const key = rootKey(root);
       live.add(key);
       if (this.#localRootCovers(cwd)) continue;
@@ -6007,7 +6115,7 @@ function carryMissingState(legacy, current, files, dirs) {
       renameSync(temp, to);
     } catch (error) {
       rmSync(temp, { force: true });
-      failures.push(`${from} \u2192 ${to}\uFF1A${describe(error)}`);
+      if (!existsSync(to)) failures.push(`${from} \u2192 ${to}\uFF1A${describe(error)}`);
     }
   }
   for (const name2 of dirs) {
@@ -6020,7 +6128,7 @@ function carryMissingState(legacy, current, files, dirs) {
       renameSync(temp, to);
     } catch (error) {
       rmSync(temp, { recursive: true, force: true });
-      failures.push(`${from} \u2192 ${to}\uFF1A${describe(error)}`);
+      if (!existsSync(to)) failures.push(`${from} \u2192 ${to}\uFF1A${describe(error)}`);
     }
   }
   return failures;
@@ -6446,9 +6554,9 @@ var AgentFrameParser = class {
    */
   #append(chunk) {
     if (chunk.byteLength === 0) return;
-    const pending = this.#end - this.#start;
-    if (this.#store.byteLength - this.#start < pending + chunk.byteLength) {
-      const needed = pending + chunk.byteLength;
+    const pending2 = this.#end - this.#start;
+    if (this.#store.byteLength - this.#start < pending2 + chunk.byteLength) {
+      const needed = pending2 + chunk.byteLength;
       if (this.#store.byteLength >= needed) {
         this.#store.copyWithin(0, this.#start, this.#end);
       } else {
@@ -6457,7 +6565,7 @@ var AgentFrameParser = class {
         this.#store = grown;
       }
       this.#start = 0;
-      this.#end = pending;
+      this.#end = pending2;
     }
     this.#store.set(chunk, this.#end);
     this.#end += chunk.byteLength;
@@ -7242,9 +7350,9 @@ var AgentProtocolClient = class {
   failConnection(error) {
     if (this.#lost !== void 0) return;
     this.#lost = error;
-    const pending = [...this.#pending.values()];
+    const pending2 = [...this.#pending.values()];
     this.#pending.clear();
-    for (const entry of pending) entry.settle({ error });
+    for (const entry of pending2) entry.settle({ error });
     for (const channel of this.#blobQueue) channel.fail(error);
     this.#blobQueue.length = 0;
     this.#blobById.clear();
@@ -8129,14 +8237,14 @@ var AgentTransport = class extends TransportBase {
         }
       }
       if (expectedVersion === void 0) {
-        let stat5;
+        let stat7;
         try {
-          stat5 = asRecord(await client.request("fs.stat", { path: request.path }, this.#requestOptions(void 0, signal)));
+          stat7 = asRecord(await client.request("fs.stat", { path: request.path }, this.#requestOptions(void 0, signal)));
         } catch (error) {
           throw this.#translate(error);
         }
-        const exists = stat5?.["exists"] === true;
-        const observed = typeof stat5?.["version"] === "string" ? stat5["version"] : void 0;
+        const exists = stat7?.["exists"] === true;
+        const observed = typeof stat7?.["version"] === "string" ? stat7["version"] : void 0;
         if (!exists || observed === void 0 || observed !== expected) {
           throw new SshDevError("TRANSFER_CONFLICT", "\u8FDC\u7AEF\u6587\u4EF6\u7248\u672C\u4E0E\u8C03\u7528\u65B9\u7ED9\u51FA\u7684\u5B88\u536B\u4E0D\u4E00\u81F4\uFF0C\u5199\u5165\u88AB\u62D2\u7EDD", {
             connectionId: this.id,
@@ -9394,7 +9502,7 @@ function localVersion(info) {
 init_temp_name();
 init_errors();
 import { constants } from "node:fs";
-import { access, chmod, lstat, mkdir, open as open2, readdir as readdir2, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
+import { access, chmod, lstat, mkdir, open as open2, readdir as readdir2, rename, rm, stat as stat2, unlink, writeFile } from "node:fs/promises";
 import { dirname as dirname3, join as join5 } from "node:path";
 var LIST_STAT_CONCURRENCY = 32;
 var LocalBackend = class {
@@ -9407,12 +9515,12 @@ var LocalBackend = class {
     this.id = options.id;
     this.sandboxMode = options.sandboxMode ?? "workspace-write";
     this.#maxReadBytes = options.maxReadBytes ?? 16 * 1024 * 1024;
-    this.#statEntry = options.statEntry ?? ((path) => stat(path));
+    this.#statEntry = options.statEntry ?? ((path) => stat2(path));
   }
   async stat(absolute, signal) {
     signal?.throwIfAborted();
     try {
-      const info = await stat(absolute);
+      const info = await stat2(absolute);
       return {
         exists: true,
         isDirectory: info.isDirectory(),
@@ -10069,7 +10177,9 @@ function buildListScript(absolute) {
     `if [ ! -d "$p" ]; then printf 'DSH_ERROR=not-a-dir\\n'; exit 4; fi`,
     // GNU find (Linux). `-printf ''` is the cheap capability probe: it fails on BSD/macOS find.
     `if find "$p" -maxdepth 1 -printf '' >/dev/null 2>&1; then`,
-    `  find "$p" -mindepth 1 -maxdepth 1 -printf '%y\\t%Y\\t%s\\t%T@\\t%f\\n'`,
+    // **NUL 分隔**：文件名可以含换行（POSIX 合法，`git checkout` 就能造出来），按行切会把一个条目拆成
+    // 两行、解析出一个不存在的名字并丢掉真条目（审计 2026-11-06 第 3 轮 P1）。
+    `  find "$p" -mindepth 1 -maxdepth 1 -printf '%y\\t%Y\\t%s\\t%T@\\t%f\\0'`,
     `else`,
     `  for entry in "$p"/* "$p"/.[!.]*; do`,
     `    [ -e "$entry" ] || continue`,
@@ -10077,28 +10187,28 @@ function buildListScript(absolute) {
     `    if [ -d "$entry" ]; then kind=d; elif [ -L "$entry" ]; then kind=l; else kind=f; fi`,
     `    size=$(wc -c < "$entry" 2>/dev/null | tr -d ' ' || echo 0)`,
     `    mtime=$(stat -c '%Y' "$entry" 2>/dev/null || stat -f '%m' "$entry" 2>/dev/null || echo 0)`,
-    `    printf '%s\\t%s\\t%s\\t%s\\t%s\\n' "$kind" "$kind" "$size" "$mtime" "$name"`,
+    `    printf '%s\\t%s\\t%s\\t%s\\t%s\\0' "$kind" "$kind" "$size" "$mtime" "$name"`,
     `  done`,
     `fi`
   ].join("\n");
 }
 function parseListing(stdout) {
   const entries = [];
-  for (const line of stdout.split("\n")) {
-    if (line === "" || line.startsWith("DSH_")) continue;
-    const parts = line.split("	");
+  for (const record2 of stdout.split("\0")) {
+    if (record2 === "" || record2.startsWith("DSH_")) continue;
+    const parts = record2.split("	");
     if (parts.length < 5) continue;
     const [typeChar, targetChar, sizeText, mtimeText] = parts;
     const kind = typeChar === "d" ? "d" : typeChar === "l" ? targetChar === "d" ? "d" : "l" : "f";
     const size = Number.parseInt(sizeText, 10);
-    const seconds = Number.parseInt(mtimeText, 10);
+    const seconds = Number.parseFloat(mtimeText);
     entries.push({
       name: parts.slice(4).join("	"),
       isDirectory: kind === "d",
       isFile: kind === "f",
       isSymlink: kind === "l",
       size: Number.isFinite(size) ? size : 0,
-      mtimeMs: (Number.isFinite(seconds) ? seconds : 0) * 1e3
+      mtimeMs: Number.isFinite(seconds) ? Math.trunc(seconds * 1e3) : 0
     });
   }
   entries.sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
@@ -10486,6 +10596,13 @@ var RemoteBackend = class {
     if (result.stdout.includes("DSH_ERROR=not-a-dir")) {
       throw new SshDevError("REMOTE_NOT_FOUND", `\u8FDC\u7AEF\u76EE\u5F55\u4E0D\u5B58\u5728\uFF1A${absolute}`, { path: absolute });
     }
+    if (result.truncated === true) {
+      throw new SshDevError("REMOTE_COMMAND_FAILED", `\u76EE\u5F55\u6761\u76EE\u8FC7\u591A\uFF0C\u5217\u4E3E\u7ED3\u679C\u88AB\u622A\u65AD\uFF1A${absolute}`, {
+        path: absolute,
+        reason: "listing-truncated",
+        maxBytes: 4 * 1024 * 1024
+      });
+    }
     return parseListing(result.stdout);
   }
   /**
@@ -11127,7 +11244,21 @@ var RemoteBackend = class {
     }
     const command = tool === "sha256sum" ? "sha256sum" : "shasum -a 256";
     const result = await (await this.#transport()).exec({ argv: ["sh", "-c", `${command} -- "$1" | cut -d' ' -f1`, "dsh-digest", absolute] }, signal);
-    return result.stdout.trim();
+    if (result.exitCode !== 0) {
+      throw new SshDevError("REMOTE_COMMAND_FAILED", `\u65E0\u6CD5\u8BA1\u7B97\u8FDC\u7AEF\u6587\u4EF6\u7684 sha256\uFF08\u6458\u8981\u547D\u4EE4\u9000\u51FA\u7801 ${result.exitCode}\uFF09\uFF1A${absolute}`, {
+        path: absolute,
+        exitCode: result.exitCode,
+        stderr: result.stderr.slice(0, 200)
+      });
+    }
+    const digest = result.stdout.trim();
+    if (!/^[0-9a-f]{64}$/.test(digest)) {
+      throw new SshDevError("REMOTE_COMMAND_FAILED", `\u8FDC\u7AEF\u6458\u8981\u5DE5\u5177\u8FD4\u56DE\u4E86\u975E\u6CD5\u6458\u8981\uFF08\u4E0D\u662F 64 \u4F4D\u5C0F\u5199\u5341\u516D\u8FDB\u5236\uFF09\uFF1A${absolute}`, {
+        path: absolute,
+        digest: digest.slice(0, 120)
+      });
+    }
+    return digest;
   }
 };
 function sha256Hex(bytes) {
@@ -11958,12 +12089,12 @@ init_ssh2_transport();
 
 // src/host/integration/agent/agent-install-io.ts
 init_shell_quote();
-import { readFile as readFile2, stat as stat2 } from "node:fs/promises";
+import { readFile as readFile2, stat as stat3 } from "node:fs/promises";
 var DEFAULT_MAX_UPLOAD_BYTES = 32 * 1024 * 1024;
 function createAgentInstallIo(options) {
   const maxUploadBytes = options.maxUploadBytes ?? DEFAULT_MAX_UPLOAD_BYTES;
   const readLocal = options.readLocalFile ?? ((path) => readFile2(path).then((buffer) => new Uint8Array(buffer)));
-  const sizeOf = options.localSize ?? ((path) => stat2(path).then((info) => info.size));
+  const sizeOf = options.localSize ?? ((path) => stat3(path).then((info) => info.size));
   const exec = async (command, signal) => {
     const result = await options.transport.exec(
       { argv: ["/bin/sh", "-c", command], maxBytes: options.probeMaxBytes ?? 256 * 1024 },
@@ -12046,14 +12177,14 @@ function reviseToTier1(profile, decision, reason, hint) {
 // src/host/integration/agent/askpass-registry.ts
 function createAskpassRegistry(options) {
   const handles = /* @__PURE__ */ new Map();
-  const pending = /* @__PURE__ */ new Map();
+  const pending2 = /* @__PURE__ */ new Map();
   const retired = /* @__PURE__ */ new Set();
   const prepare = async (profile) => {
     if (!needsAskpass(profile.auth.kind)) return void 0;
     if (retired.has(profile.id)) return void 0;
     const existing = handles.get(profile.id);
     if (existing !== void 0) return existing.env;
-    const inflight = pending.get(profile.id);
+    const inflight = pending2.get(profile.id);
     if (inflight !== void 0) return inflight;
     const attempt = (async () => {
       try {
@@ -12070,16 +12201,16 @@ function createAskpassRegistry(options) {
         return void 0;
       }
     })().finally(() => {
-      pending.delete(profile.id);
+      pending2.delete(profile.id);
     });
-    pending.set(profile.id, attempt);
+    pending2.set(profile.id, attempt);
     return attempt;
   };
   const forget = async (connectionId) => {
     retired.add(connectionId);
     const handle = handles.get(connectionId);
     handles.delete(connectionId);
-    pending.delete(connectionId);
+    pending2.delete(connectionId);
     if (handle !== void 0) await handle.dispose().catch(() => void 0);
   };
   return {
@@ -12097,7 +12228,7 @@ function createAskpassRegistry(options) {
       retired.delete(connectionId);
     },
     disposeAll: async () => {
-      const ids = /* @__PURE__ */ new Set([...handles.keys(), ...pending.keys()]);
+      const ids = /* @__PURE__ */ new Set([...handles.keys(), ...pending2.keys()]);
       for (const id of ids) retired.add(id);
       await Promise.all([...ids].map((id) => forget(id)));
     }
@@ -13455,12 +13586,8 @@ function wireConnections(ctx, config) {
 }
 function readLiveSessions(ctx) {
   let list;
-  try {
-    const sessions = ctx.get("sessions");
-    list = sessions?.list?.();
-  } catch {
-    return [];
-  }
+  const sessions = ctx.get("sessions");
+  list = sessions?.list?.();
   if (!Array.isArray(list)) return [];
   const live = [];
   for (const session of list) {
@@ -13482,9 +13609,9 @@ import { bindTypertRemote } from "@deepseek-ai/dsh-typert-protocol";
 // src/shared/remote-identity.ts
 var SSH_DEV_REMOTE_NAMESPACE = "sshdev";
 var SSH_DEV_REMOTE_SERVICE = "sshDevRemote";
+var SSH_DEV_REMOTE_METHOD = "connections";
 
 // src/host/integration/remote/remote-face.ts
-var SSH_DEV_REMOTE_CONNECTIONS_METHOD = "connections";
 var NOT_CONNECTED_NOTE = "\u5C1A\u672A\u5EFA\u7ACB\u8FDE\u63A5\uFF1A\u4F20\u8F93\u51B3\u7B56\u5728\u9996\u6B21\u8FDE\u63A5\u65F6\u786E\u5B9A\u3002";
 function buildConnectionStatusRows(source) {
   return source.profiles().map((profile) => {
@@ -13549,7 +13676,7 @@ var SshDevRemoteFace = class extends Service {
     return buildConnectionStatusRows(this.#source);
   }
 };
-markRemoteMethod(SshDevRemoteFace.prototype, SSH_DEV_REMOTE_CONNECTIONS_METHOD);
+markRemoteMethod(SshDevRemoteFace.prototype, SSH_DEV_REMOTE_METHOD);
 function installRemoteFace(ctx) {
   return new SshDevRemoteFace(ctx, {
     profiles: () => ctx.get("sshDevConnections")?.list() ?? [],
@@ -13753,7 +13880,7 @@ import { defineTool as defineTool2 } from "@deepseek-ai/dsh-tools";
 init_errors();
 
 // src/host/app/roots/user-roots.ts
-import { mkdir as mkdir4, readFile as readFile5, rename as rename3, unlink as unlink3, writeFile as writeFile4 } from "node:fs/promises";
+import { mkdir as mkdir4, readFile as readFile5, rename as rename3, stat as stat4, unlink as unlink3, writeFile as writeFile4 } from "node:fs/promises";
 import { join as join12 } from "node:path";
 init_errors();
 var USER_ROOTS_VERSION = 1;
@@ -13779,6 +13906,10 @@ var nodeUserRootsIo = {
     await mkdir4(path, { recursive: true, mode: 448 });
   },
   rename: (from, to) => rename3(from, to),
+  stat: async (path) => {
+    const info = await stat4(path);
+    return { size: info.size, mtimeMs: info.mtimeMs };
+  },
   unlink: async (path) => {
     try {
       await unlink3(path);
@@ -14141,7 +14272,19 @@ function createUserRootsStore(options) {
   const filePath = join12(options.dir, USER_ROOTS_FILE_NAME);
   let cachedRaw;
   let cachedLoad;
+  let cachedSignature;
+  const signatureOf = async () => {
+    if (io.stat === void 0) return void 0;
+    try {
+      const info = await io.stat(filePath);
+      return `${info.size}:${Math.trunc(info.mtimeMs)}`;
+    } catch {
+      return void 0;
+    }
+  };
   const load = async () => {
+    const signature = await signatureOf();
+    if (signature !== void 0 && signature === cachedSignature && cachedLoad !== void 0) return cachedLoad;
     let text8;
     try {
       text8 = await io.readFile(filePath);
@@ -14153,10 +14296,14 @@ function createUserRootsStore(options) {
         degraded: true
       };
     }
-    if (cachedRaw !== void 0 && text8 === cachedRaw && cachedLoad !== void 0) return cachedLoad;
+    if (cachedRaw !== void 0 && text8 === cachedRaw && cachedLoad !== void 0) {
+      cachedSignature = signature;
+      return cachedLoad;
+    }
     const parsed = parseUserRoots(text8);
     cachedRaw = text8;
     cachedLoad = parsed;
+    cachedSignature = signature;
     return parsed;
   };
   const write = async (next, preparedText) => {
@@ -14173,6 +14320,7 @@ function createUserRootsStore(options) {
     }
     cachedRaw = text8;
     cachedLoad = { state: validated, warnings: [], degraded: false };
+    cachedSignature = void 0;
     return validated;
   };
   const queue = createSerialQueue();
@@ -14404,6 +14552,9 @@ var STATUS_BY_CODE = {
   ROOT_INVALID: 400,
   CONNECTION_INVALID: 400,
   CONNECTION_NOT_FOUND: 400,
+  // 路径不在任何已注册的根内 / 根没有注册：客户端换一个路径或先加根就能成功，不是服务器故障。
+  // 它此前漏在表外，于是**所有**经 HTTP 暴露的根外访问都报 500（审计 2026-11-06 第 4 轮 P1）。
+  ROOT_OUTSIDE: 400,
   // 目标不存在 / 状态冲突 / 本组合不支持：客户端可以据此换一条路。
   TRASH_NOT_FOUND: 404,
   TRANSFER_CONFLICT: 409,
@@ -14446,6 +14597,9 @@ function optionalPath(value) {
       reason: "invalid-path"
     });
   }
+  if (/[\u0000-\u001f]/.test(value)) {
+    throw new SshDevError("ROOT_INVALID", "path \u4E0D\u80FD\u5305\u542B\u63A7\u5236\u5B57\u7B26\uFF08\u542B NUL\uFF09", { reason: "invalid-path" });
+  }
   return value.trim();
 }
 function pick(source, fields) {
@@ -14492,6 +14646,15 @@ function connectionIdFromAlias(alias) {
 // src/host/app/roots/session-directories.ts
 var SESSION_DIRECTORY_MAX_ROOTS = 32;
 var SYSTEM_TREES = ["/etc", "/usr", "/bin", "/sbin", "/lib", "/lib64", "/boot", "/sys", "/proc", "/dev", "/var", "/root"];
+var REMOTE_SYSTEM_TREES = ["/etc", "/usr", "/bin", "/sbin", "/lib", "/lib64", "/boot", "/sys", "/proc", "/dev", "/var", "/root"];
+var REMOTE_BROAD_ROOTS = [...REMOTE_SYSTEM_TREES, "/home", "/opt", "/srv", "/mnt", "/media", "/tmp"];
+function remotePathTooBroad(normalized) {
+  if (REMOTE_BROAD_ROOTS.includes(normalized)) return true;
+  for (const tree of REMOTE_SYSTEM_TREES) {
+    if (normalized === tree || normalized.startsWith(`${tree}/`)) return true;
+  }
+  return false;
+}
 function directoryRefusal(request) {
   const trimmed = request.path.trim();
   if (trimmed === "") return "\u76EE\u5F55\u8DEF\u5F84\u4E3A\u7A7A\u3002";
@@ -14507,6 +14670,9 @@ function directoryRefusal(request) {
       return error instanceof Error ? error.message : `\u8FDC\u7AEF\u8DEF\u5F84\u4E0D\u5408\u6CD5\uFF1A${trimmed}`;
     }
     if (normalized2 === "/") return "\u4E0D\u5141\u8BB8\u628A\u8FDC\u7AEF\u7684\u6839\u76EE\u5F55 / \u6DFB\u52A0\u5230\u4F1A\u8BDD\u3002";
+    if (remotePathTooBroad(normalized2)) {
+      return `\u4E0D\u5141\u8BB8\u628A\u8FC7\u5BBD\u7684\u8FDC\u7AEF\u76EE\u5F55\u6DFB\u52A0\u5230\u4F1A\u8BDD\uFF08${normalized2}\uFF09\uFF1A\u8BF7\u9009\u5230\u5177\u4F53\u9879\u76EE\u76EE\u5F55\u3002`;
+    }
     return void 0;
   }
   const normalized = trimmed.replace(/\/+$/u, "") || "/";
@@ -14644,6 +14810,15 @@ async function ensureLiveAndReadAnchor(deps, key, state) {
   }
   return readAnchor(await Promise.resolve(deps.listRoots()));
 }
+async function liveScopeWarning(deps, key, state) {
+  const persisted = findRootInState(state, key);
+  if (persisted === void 0) return void 0;
+  const roots = await Promise.resolve(deps.listRoots());
+  const liveEntry = roots.find((candidate) => liveKeyOfRecord(candidate, persisted) !== void 0);
+  if (liveEntry === void 0) return `\u6DFB\u52A0\u76EE\u5F55\uFF1A\u6839 ${key} \u4E0D\u5728\u5B9E\u65F6\u6CE8\u518C\u8868\u91CC\uFF0C\u91CD\u542F\u524D\u53EF\u80FD\u4E0D\u53EF\u7528`;
+  if (liveScopeIsCurrent(liveEntry, persisted)) return void 0;
+  return `\u6DFB\u52A0\u76EE\u5F55\uFF1A\u6839 ${key} \u7684\u5B9E\u65F6\u4F5C\u7528\u57DF\u4E0E\u6587\u4EF6\u4E0D\u4E00\u81F4\uFF0C\u53E6\u4E00\u4E2A\u4F1A\u8BDD\u53EF\u80FD\u8981\u91CD\u542F\u540E\u624D\u53EF\u89C1`;
+}
 async function findLiveKey(deps, entry) {
   for (const raw of await Promise.resolve(deps.listRoots())) {
     const key = liveKeyOfRecord(raw, entry);
@@ -14910,9 +15085,25 @@ function publicRoot(raw) {
     ...typeof source["connectionId"] === "string" ? { connectionId: source["connectionId"] } : {},
     path: String(source["path"] ?? ""),
     ...typeof source["label"] === "string" ? { label: source["label"] } : {},
-    ...typeof source["writable"] === "boolean" ? { writable: source["writable"] } : {}
+    ...typeof source["writable"] === "boolean" ? { writable: source["writable"] } : {},
+    ...stringList(source["workspaces"]) === void 0 ? {} : { workspaces: stringList(source["workspaces"]) },
+    ...stringList(source["sessions"]) === void 0 ? {} : { sessions: stringList(source["sessions"]) }
   };
 }
+function liveRootScopes(raw) {
+  const outer = asRecord2(raw) ?? {};
+  const source = asRecord2(outer["root"]) ?? outer;
+  const sessions = stringList(source["sessions"]);
+  const workspaces = stringList(source["workspaces"]);
+  return {
+    ...sessions === void 0 ? {} : { sessions },
+    ...workspaces === void 0 ? {} : { workspaces }
+  };
+}
+function stringList(value) {
+  if (!Array.isArray(value)) return void 0;
+  return value.filter((item) => typeof item === "string");
+}
 function publicConnection(raw) {
   const source = asRecord2(raw) ?? {};
   const authKind = source["authKind"] ?? asRecord2(source["auth"])?.["kind"];
@@ -15038,21 +15229,34 @@ async function handleRootActions(action, body, req, res, deps) {
           if (registeredNow) await deps.unregisterRoot(key);
           throw error;
         }
+        const warnings = [];
+        if (existing !== void 0) {
+          const warning = await liveScopeWarning(deps, key, state);
+          if (warning !== void 0) warnings.push(warning);
+        }
         const anchorPath = await anchorPathOf(deps, entry);
         send(req, res, 200, {
           ok: true,
           action,
           state: publicUserState(state),
-          ...anchorPath === void 0 ? {} : { anchorPath }
+          ...anchorPath === void 0 ? {} : { anchorPath },
+          ...warnings.length === 0 ? {} : { warnings }
         });
         return true;
-        return true;
       });
     }
     case "remove-root": {
       const key = requiredKey(body["key"]);
       const workspace = optionalWorkspaceName(body["workspace"]);
       const session = optionalSessionName(body["session"]);
+      if (session !== void 0) {
+        const current = await currentUserState(deps);
+        const entry = findRootInState(current, key);
+        const owners = entry?.sessions ?? [];
+        if (owners.length > 0 && !owners.includes(session)) {
+          throw new SshDevError("ROOT_INVALID", "\u8FD9\u4E2A\u76EE\u5F55\u662F\u53E6\u4E00\u4E2A\u4F1A\u8BDD\u6DFB\u52A0\u7684\uFF1B\u8BF7\u5230\u6DFB\u52A0\u5B83\u7684\u4F1A\u8BDD\u91CC\u79FB\u9664", { key });
+        }
+      }
       const state = await reconcile(deps, (current) => {
         if (session !== void 0 && rootAddedBySession(current, key, session)) {
           return removeRootFromSession(current, key, session);
@@ -15734,16 +15938,40 @@ async function serveSnapshot(req, res, deps) {
     Promise.resolve(deps.listConnections()),
     Promise.resolve(deps.loadUserState())
   ]);
+  const query = queryOf(req.url);
+  const requestedSession = (query.get("session") ?? "").trim();
+  const requestedWorkspace = (query.get("workspace") ?? "").trim();
+  const ancestorsOf = deps.resolveSessionAncestors;
+  const canFilter = requestedWorkspace !== "" || ancestorsOf !== void 0;
+  const filtered = !canFilter || requestedSession === "" && requestedWorkspace === "" ? void 0 : {
+    ids: new Set(
+      requestedSession === "" ? [] : [requestedSession, ...ancestorsOf?.(requestedSession) ?? []]
+    ),
+    workspace: requestedWorkspace
+  };
+  const roots = filtered === void 0 ? liveRoots.map(publicRoot) : liveRoots.filter((raw) => visibleToSession(liveRootScopes(raw), filtered.ids, filtered.workspace)).map(publicRoot);
   send(req, res, 200, {
     ok: true,
+    // 两个标记分开写：客户端只认 `scopedForSession`，而只带 workspace 的调用方也能看出"这份列表被过滤过"。
+    ...filtered === void 0 ? {} : requestedSession === "" ? { scopedForWorkspace: requestedWorkspace } : { scopedForSession: requestedSession },
     // The plugin's **anchor root**, not the roots' individual anchor paths: see `RootsApiDeps.anchorRootDir`.
     ...deps.anchorRootDir === void 0 ? {} : { anchorRoot: deps.anchorRootDir },
-    roots: liveRoots.map(publicRoot),
+    roots,
     connections: liveConnections.map(publicConnection),
     userRoots: publicUserState(loaded.state),
     warnings: [...loaded.warnings]
   });
 }
+function queryOf(url) {
+  const index = url === void 0 ? -1 : url.indexOf("?");
+  return new URLSearchParams(index === -1 || url === void 0 ? "" : url.slice(index + 1));
+}
+function visibleToSession(row, sessionIds, workspace) {
+  const sessions = row.sessions ?? [];
+  if (sessions.length > 0) return sessions.some((id) => sessionIds.has(id));
+  if (workspace === "") return false;
+  return (row.workspaces ?? []).some((candidate) => sameWorkspacePath(candidate, workspace));
+}
 async function serveAction(req, res, deps) {
   let text8;
   try {
@@ -15799,7 +16027,7 @@ async function serveAction(req, res, deps) {
 
 // src/host/integration/session/session-bin-lock.ts
 init_errors();
-import { mkdir as mkdir5, open as open3, readFile as readFile6, rm as rm3, stat as stat3 } from "node:fs/promises";
+import { mkdir as mkdir5, open as open3, readFile as readFile6, rm as rm3, stat as stat5 } from "node:fs/promises";
 import { dirname as dirname5 } from "node:path";
 var DEFAULT_STALE_LOCK_MS = 6e4;
 var DEFAULT_LOCK_RETRY_MS = 25;
@@ -15857,21 +16085,35 @@ function createSessionBinLock(options) {
   const reclaimIfStale = async () => {
     if (staleMs <= 0) return false;
     let age;
+    let malformed = false;
     try {
-      const info = await stat3(options.path);
+      const info = await stat5(options.path);
+      malformed = info.isDirectory();
       age = now() - info.mtimeMs;
     } catch {
       return true;
     }
-    if (age < staleMs) return false;
-    try {
-      const text8 = await readFile6(options.path, "utf8");
-      const record2 = JSON.parse(text8);
-      options.onReclaim?.({ path: options.path, ageMs: age, holder: record2 });
-    } catch {
+    if (!malformed && age < staleMs) return false;
+    if (!malformed) {
+      try {
+        const text8 = await readFile6(options.path, "utf8");
+        const record2 = JSON.parse(text8);
+        options.onReclaim?.({ path: options.path, ageMs: age, holder: record2 });
+      } catch {
+        options.onReclaim?.({ path: options.path, ageMs: age, holder: {} });
+      }
+    } else {
       options.onReclaim?.({ path: options.path, ageMs: age, holder: {} });
     }
-    await rm3(options.path, { force: true });
+    try {
+      await rm3(options.path, { force: true, recursive: malformed });
+    } catch (error) {
+      throw new SshDevError("TRANSFER_CONFLICT", `\u4F1A\u8BDD\u56DE\u6536\u7AD9\u9501\u4F4D\u7F6E\u662F\u4E00\u4E2A\u76EE\u5F55\uFF0C\u4E14\u65E0\u6CD5\u5220\u9664\uFF1A${options.path}`, {
+        path: options.path,
+        reason: "malformed-lock",
+        cause: error instanceof Error ? error.message : String(error)
+      });
+    }
     return true;
   };
   const withLock = async (_key, operation) => {
@@ -15999,6 +16241,7 @@ function createRootsWiring(deps) {
       deps.removeConnection(id);
     },
     ...deps.anchorRootDir === void 0 ? {} : { anchorRootDir: deps.anchorRootDir },
+    ...deps.resolveSessionAncestors === void 0 ? {} : { resolveSessionAncestors: deps.resolveSessionAncestors },
     ...listRemoteDirectory === void 0 ? {} : { listRemoteDirectory: (input) => listRemoteDirectory(input) },
     ...remoteHomeDirectory === void 0 ? {} : { remoteHomeDirectory },
     ...listLocalDirectory === void 0 ? {} : { listLocalDirectory: (input) => listLocalDirectory(input) },
@@ -16072,10 +16315,55 @@ function createRootsWiring(deps) {
     }
     return { roots, connections, warnings };
   };
+  const inheritAddedRoots = async (sourceSessionId, childSessionId) => {
+    const source = sourceSessionId.trim();
+    const child = childSessionId.trim();
+    if (source === "" || child === "") return;
+    const keys = [];
+    await store2.mutate((current) => {
+      let next = current;
+      for (const entry of current.roots) {
+        const sessions = entry.sessions ?? [];
+        if (!sessions.includes(source) || sessions.includes(child)) continue;
+        const key = userRootKey(entry);
+        next = withSessions(next, key, [child]);
+        keys.push(key);
+      }
+      return next;
+    });
+    if (keys.length > 0) {
+      const { state } = await store2.load();
+      for (const key of keys) await refreshLiveScope(apiDeps, key, state);
+    }
+  };
+  const pruneSession = async (sessionId) => {
+    const trimmed = sessionId.trim();
+    if (trimmed === "") return { changed: [], removed: [] };
+    const before = (await store2.load()).state;
+    const touched = before.roots.filter((entry) => (entry.sessions ?? []).includes(trimmed));
+    if (touched.length === 0) return { changed: [], removed: [] };
+    const after = await store2.mutate((current) => pruneSessionFromRoots(current, trimmed));
+    const afterKeys = new Set(after.roots.map(userRootKey));
+    const removed = [];
+    const changed = [];
+    for (const entry of touched) {
+      const key = userRootKey(entry);
+      if (!afterKeys.has(key)) {
+        removed.push(key);
+        await deps.unregisterRoot(key);
+      } else {
+        changed.push(key);
+      }
+    }
+    for (const key of changed) await refreshLiveScope(apiDeps, key, after);
+    return { changed, removed };
+  };
   return {
     api,
     store: store2,
     sessionDirectories,
+    inheritAddedRoots,
+    pruneSession,
     mergeUserRoots,
     routeWarnings: () => [...routeWarnings],
     routeFacts: () => ({ injectRan, routeRegistered, warnings: [...routeWarnings] }),
@@ -16352,7 +16640,11 @@ async function serveActionWithSignal(action, body, req, res, deps, service, sign
         return;
       }
       const result = await service.purge(entryId, options);
-      send(req, res, 200, { ok: true, purged: result.purged, indexStale: result.indexStale });
+      send(req, res, 200, {
+        ...result.indexStale === true ? { ok: false, error: "\u56DE\u6536\u7AD9\u7D22\u5F15\u66F4\u65B0\u5931\u8D25\uFF1A\u6761\u76EE\u5DF2\u5220\u9664\uFF0C\u4F46\u7D22\u5F15\u4ECD\u5217\u7740\u5B83\uFF08\u4E0B\u6B21\u8FD8\u539F\u4F1A\u5931\u8D25\uFF09\u3002\u91CD\u542F\u540E\u91CD\u8BD5 sweep\u3002", reason: "index-stale" } : { ok: true },
+        purged: result.purged,
+        indexStale: result.indexStale
+      });
       return;
     }
     case "sweep": {
@@ -16365,8 +16657,9 @@ async function serveActionWithSignal(action, body, req, res, deps, service, sign
         return;
       }
       const result = await service.sweep(deps.policy(), options);
+      const stale = result.purged.filter((item) => item.indexStale === true).length;
       send(req, res, 200, {
-        ok: true,
+        ...stale > 0 ? { ok: false, error: `\u56DE\u6536\u7AD9\u7D22\u5F15\u66F4\u65B0\u5931\u8D25\uFF1A${stale} \u4E2A\u6761\u76EE\u5DF2\u5220\u9664\u4F46\u7D22\u5F15\u4ECD\u5217\u7740\u5B83\u4EEC\uFF08\u4E0B\u6B21\u8FD8\u539F\u4F1A\u5931\u8D25\uFF09\u3002`, reason: "index-stale" } : { ok: true },
         purged: result.purged.map((item) => ({ entryId: String(item.id), sessionId: item.sessionId, indexStale: item.indexStale })),
         failed: result.failed.map((item) => ({ entryId: String(item.id), reason: item.reason })),
         remainingEntries: result.remainingEntries,
@@ -16441,6 +16734,56 @@ function createSessionRouteWiring(deps) {
   };
 }
 
+// src/host/integration/roots/fork-inheritance.ts
+var PATCHED = /* @__PURE__ */ Symbol.for("dsh-over-ssh/fork-inheritance");
+function sourceIdOf(source) {
+  if (typeof source === "string") return source === "" ? void 0 : source;
+  if (typeof source !== "object" || source === null) return void 0;
+  const candidate = source;
+  const id = candidate.header?.id ?? candidate.id;
+  return typeof id === "string" && id !== "" ? id : void 0;
+}
+function installForkInheritance(ctx, deps) {
+  const service = ctx.get("sessions");
+  const original = service?.fork;
+  if (typeof service !== "object" || service === null || typeof original !== "function") {
+    return { installed: false, dispose: () => void 0 };
+  }
+  if (original[PATCHED] === true) {
+    return { installed: true, dispose: () => void 0 };
+  }
+  const invoke = original;
+  const patched2 = function patchedFork(...args) {
+    const child = invoke.apply(this, args);
+    try {
+      const sourceId = sourceIdOf(args[0]);
+      const childId = sourceIdOf(child);
+      if (sourceId !== void 0 && childId !== void 0) {
+        markForkInheritancePending(childId, sourceId);
+        void deps.inherit(sourceId, childId).catch((error) => {
+          deps.warn?.(`fork \u7EE7\u627F\u6DFB\u52A0\u76EE\u5F55\u5931\u8D25\uFF08source=${sourceId} child=${childId}\uFF09\uFF1A${error instanceof Error ? error.message : String(error)}`);
+        }).finally(() => {
+          clearForkInheritancePending(childId);
+        });
+      }
+    } catch (error) {
+      deps.warn?.(`fork \u7EE7\u627F\u6DFB\u52A0\u76EE\u5F55\u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}`);
+    }
+    return child;
+  };
+  patched2[PATCHED] = true;
+  service.fork = patched2;
+  return {
+    installed: true,
+    dispose: () => {
+      if (service.fork === patched2) {
+        service.fork = original;
+      }
+      clearAllForkInheritancePending();
+    }
+  };
+}
+
 // src/wiring/fs-panel-routes.ts
 function readOnlySeams(env) {
   const { ctx, profiles, registry, transports } = env;
@@ -16658,6 +17001,8 @@ function registerPanelRoutes(env, hooks) {
     stateDir: resolveStateDir(),
     // Published in the GET snapshot so a client can recognise a session whose cwd is a remote workspace.
     anchorRootDir: env.anchorRootDir,
+    // fork 继承父会话添加的目录（ADR-0013）：血缘只有宿主知道，所以 `GET /roots?session=` 由这里回答。
+    resolveSessionAncestors: (sessionId) => readSessionAncestors(env.ctx, sessionId),
     ...readOnlySeams(env),
     ...rootLifecycleSeams(env, hooks),
     ...connectionLifecycleSeams(env, hooks),
@@ -16665,7 +17010,11 @@ function registerPanelRoutes(env, hooks) {
     ...remoteFileSeams(env),
     webServerProvider: ctx
   });
-  return { sessionWiring, rootsWiring };
+  const forkInheritance = installForkInheritance(ctx, {
+    inherit: (sourceSessionId, childSessionId) => rootsWiring.inheritAddedRoots(sourceSessionId, childSessionId),
+    warn: (message) => ctx.logger?.warn?.(`over-ssh: ${message}`)
+  });
+  return { sessionWiring, rootsWiring, disposeForkInheritance: () => forkInheritance.dispose() };
 }
 
 // src/wiring/fs.ts
@@ -16706,7 +17055,9 @@ function provideAgentStatus(env) {
     }
   };
   const forgetPerConnection = (connectionId) => {
-    void forgetPerConnectionAsync(connectionId);
+    void forgetPerConnectionAsync(connectionId).catch((error) => {
+      ctx.logger?.warn?.(`over-ssh: \u5FD8\u8BB0\u8FDE\u63A5 ${connectionId} \u7684\u4EE3\u7406\u5B89\u88C5\u8BB0\u5F55\u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}`);
+    });
   };
   const disposeAgent = ctx.provide("sshDevAgent", {
     outcome: (connectionId) => agentBridge.installationFor(connectionId),
@@ -16739,7 +17090,9 @@ function registerConfiguredRoots(env) {
       ctx.logger?.warn?.(`over-ssh: \u8FDC\u7AEF\u6839\u7684\u951A\u70B9\u76EE\u5F55\u65E0\u6CD5\u521B\u5EFA\uFF08${root.anchorPath ?? ""}\uFF09\uFF1A${error instanceof Error ? error.message : String(error)}`);
     });
   }
-  void Promise.allSettled(binRootPreparation).then(runBinHousekeeping);
+  void Promise.allSettled(binRootPreparation).then(runBinHousekeeping).catch((error) => {
+    ctx.logger?.warn?.(`over-ssh: \u56DE\u6536\u7AD9\u6E05\u7406\u7531\u672C\u6B21\u542F\u52A8\u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}`);
+  });
 }
 function scheduleActivationDiagnostics(env) {
   const { ctx, rootsWiring, sessionWiring } = env;
@@ -16765,7 +17118,7 @@ function scheduleActivationDiagnostics(env) {
 function watchSessionRemovals(env) {
   const { ctx, rootsWiring, onSessionRemoved } = env;
   onSessionRemoved((sessionId) => {
-    void rootsWiring.store.pruneSession(sessionId).catch((error) => {
+    void rootsWiring.pruneSession(sessionId).catch((error) => {
       ctx.logger?.warn?.(
         `dsh-over-ssh: \u6E05\u7406\u5DF2\u5220\u4F1A\u8BDD ${sessionId} \u7684\u6839\u8BB0\u5F55\u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}`
       );
@@ -16784,6 +17137,7 @@ function createTeardown(env) {
   const { activationTimers, routes, hostServices, disposeAgent, tools, disposeSessionDirectories } = env;
   return async () => {
     for (const timer of activationTimers) clearTimeout(timer);
+    routes.disposeForkInheritance();
     routes.rootsWiring.dispose();
     routes.sessionWiring.dispose();
     tools.disposeManagement();
@@ -16861,7 +17215,7 @@ import { dirname as dirname7, join as join16 } from "node:path";
 // src/host/integration/transfer/transfer-adapters.ts
 init_errors();
 import { createHash as createHash3 } from "node:crypto";
-import { mkdir as mkdir8, open as open4, readFile as readFile8, readdir as readdir5, rename as rename4, rm as rm4, stat as stat4, writeFile as writeFile5 } from "node:fs/promises";
+import { mkdir as mkdir8, open as open4, readFile as readFile8, readdir as readdir5, rename as rename4, rm as rm4, stat as stat6, writeFile as writeFile5 } from "node:fs/promises";
 import { dirname as dirname6 } from "node:path";
 function requireRemote(deps, path) {
   const target = deps.routed.resolve(path);
@@ -16925,7 +17279,7 @@ function createTransferDeps(deps) {
     },
     async statLocal(path) {
       try {
-        const info = await stat4(path);
+        const info = await stat6(path);
         return toBackendStat(info, localVersion(info));
       } catch {
         return toBackendStat(void 0, "0:0");
@@ -17676,7 +18030,7 @@ function createSessionRootIndex(deps) {
   const now = deps.now ?? (() => Date.now());
   let cachedAt;
   let cached2 = [];
-  let pending;
+  let pending2;
   let generation = 0;
   const readEntries = async () => {
     try {
@@ -17690,14 +18044,14 @@ function createSessionRootIndex(deps) {
   const entriesNow = () => {
     const at = cachedAt;
     const fresh = at !== void 0 && now() - at < deps.ttlMs;
-    if (!fresh && pending === void 0) {
+    if (!fresh && pending2 === void 0) {
       const startedAt = generation;
-      pending = readEntries().then((entries) => {
+      pending2 = readEntries().then((entries) => {
         if (startedAt === generation) {
           cached2 = entries;
           cachedAt = now();
         }
-        pending = void 0;
+        pending2 = void 0;
         return entries;
       });
     }
@@ -17712,7 +18066,7 @@ function createSessionRootIndex(deps) {
       generation += 1;
       cachedAt = void 0;
       cached2 = [];
-      pending = void 0;
+      pending2 = void 0;
     }
   };
 }
@@ -17771,8 +18125,12 @@ function resolveSessionTarget(exec, seams) {
 function readConnectionIds(record2) {
   const raw = record2["connectionIds"];
   if (!Array.isArray(raw)) return void 0;
+  if (raw.length > MAX_EXEC_BATCH_CONNECTIONS) {
+    throw new Error(`connectionIds \u4E00\u6B21\u6700\u591A ${MAX_EXEC_BATCH_CONNECTIONS} \u4E2A\uFF08\u6536\u5230 ${raw.length} \u4E2A\uFF09\u3002\u8BF7\u5206\u6279\u6267\u884C\u3002`);
+  }
   const ids = [...new Set(raw.filter((item) => typeof item === "string" && item.trim() !== "").map((item) => item.trim()))];
-  return ids.length === 0 ? void 0 : ids;
+  if (ids.length === 0) return void 0;
+  return ids;
 }
 function text2(value) {
   return [{ type: "text", text: value }];
@@ -18239,6 +18597,7 @@ var DEFAULT_JOB_POLL_MS = 500;
 var WAIT_SLICE_MS = 5e3;
 var DEFAULT_JOB_OUTPUT_BYTES = 1 << 20;
 var MAX_JOB_OUTPUT_BYTES = 8 << 20;
+var MAX_JOB_STDIN_BYTES = 1 << 20;
 function isAgentJobCapable(transport) {
   if (transport === null || typeof transport !== "object") return false;
   const candidate = transport;
@@ -18598,6 +18957,11 @@ function remoteJobToolDefinitions(backend) {
         const maxOutputBytes = clampInt2(record2["maxOutputBytes"], DEFAULT_JOB_OUTPUT_BYTES, 1, MAX_JOB_OUTPUT_BYTES);
         const stdinText = record2["stdin"];
         if (stdinText !== void 0 && typeof stdinText !== "string") throw new Error("stdin \u5FC5\u987B\u662F\u5B57\u7B26\u4E32");
+        if (typeof stdinText === "string" && Buffer.byteLength(stdinText, "utf8") > MAX_JOB_STDIN_BYTES) {
+          throw new Error(
+            `stdin \u4E00\u6B21\u6700\u591A ${MAX_JOB_STDIN_BYTES} \u5B57\u8282\uFF08\u6536\u5230 ${Buffer.byteLength(stdinText, "utf8")}\uFF09\u3002\u8BF7\u7528 interactive:true \u542F\u52A8\uFF0C\u518D\u7528 remote_job {action:"stdin"} \u5206\u5757\u5199\u5165\u3002`
+          );
+        }
         const interactive = record2["interactive"] === true;
         const target = targetFor2(backend, exec);
         const cwd = resolveOrThrow2(target, stringArg2(record2["cwd"]));
@@ -18717,6 +19081,9 @@ function remoteJobToolDefinitions(backend) {
           };
         }
         if (action === "stdin") {
+          if (typeof record2["data"] === "string" && typeof record2["dataBase64"] === "string") {
+            throw new Error("data \u4E0E dataBase64 \u53EA\u80FD\u7ED9\u4E00\u4E2A");
+          }
           const result = await backend.stdin(
             target,
             jobId,
@@ -18935,16 +19302,16 @@ function createRemoteFileBackend(deps) {
       if (carried !== void 0) rememberVersion(target, to, carried);
     },
     async stat(target, absolute, signal) {
-      const stat5 = await requireBackend(target).stat(absolute, signal);
-      if (stat5.exists) rememberVersion(target, absolute, stat5.version);
+      const stat7 = await requireBackend(target).stat(absolute, signal);
+      if (stat7.exists) rememberVersion(target, absolute, stat7.version);
       return {
-        exists: stat5.exists,
-        isDirectory: stat5.isDirectory,
-        isFile: stat5.isFile,
-        isSymlink: stat5.isSymlink,
-        size: stat5.size,
-        mtimeMs: stat5.mtimeMs,
-        version: stat5.version
+        exists: stat7.exists,
+        isDirectory: stat7.isDirectory,
+        isFile: stat7.isFile,
+        isSymlink: stat7.isSymlink,
+        size: stat7.size,
+        mtimeMs: stat7.mtimeMs,
+        version: stat7.version
       };
     },
     async patch(target, absolute, diff, expectedVersion, signal) {
@@ -19400,6 +19767,9 @@ function remoteFileToolDefinitions(backend, allowMutation) {
         const from = resolveOrThrow3(target, rawFrom);
         const to = resolveOrThrow3(target, rawTo);
         if (from === to) throw new Error(`\u6E90\u4E0E\u76EE\u6807\u662F\u540C\u4E00\u4E2A\u8DEF\u5F84\uFF1A${from}`);
+        if (to.startsWith(from.endsWith("/") ? from : `${from}/`)) {
+          throw new Error(`\u4E0D\u80FD\u628A\u76EE\u5F55\u79FB\u52A8\u5230\u5B83\u81EA\u5DF1\u7684\u5B50\u76EE\u5F55\u91CC\uFF1A${from} \u2192 ${to}`);
+        }
         assertWritable(target, to, allowMutation);
         const createParents = record2["createParents"] !== false;
         await backend.move(target, from, to, createParents, exec.signal);
@@ -19436,15 +19806,15 @@ function remoteFileToolDefinitions(backend, allowMutation) {
         const requested = requiredString3(record2["path"], "path");
         const target = targetFor3(backend, exec);
         const path = resolveOrThrow3(target, requested);
-        const stat5 = await backend.stat(target, path, exec.signal);
-        const kind = !stat5.exists ? "missing" : stat5.isSymlink ? "symlink" : stat5.isDirectory ? "directory" : "file";
+        const stat7 = await backend.stat(target, path, exec.signal);
+        const kind = !stat7.exists ? "missing" : stat7.isSymlink ? "symlink" : stat7.isDirectory ? "directory" : "file";
         return {
           path,
-          exists: stat5.exists,
+          exists: stat7.exists,
           kind,
-          size: stat5.exists ? stat5.size : 0,
-          mtimeMs: stat5.exists ? stat5.mtimeMs : 0,
-          version: stat5.exists ? stat5.version : ""
+          size: stat7.exists ? stat7.size : 0,
+          mtimeMs: stat7.exists ? stat7.mtimeMs : 0,
+          version: stat7.exists ? stat7.version : ""
         };
       }
     })
@@ -19524,11 +19894,11 @@ var LspFrameParser = class {
   #append(bytes) {
     if (bytes.length === 0) return;
     if (this.#end + bytes.length > this.#store.length) {
-      const pending = this.#end - this.#start;
+      const pending2 = this.#end - this.#start;
       if (this.#start > 0) {
         this.#store.copyWithin(0, this.#start, this.#end);
         this.#start = 0;
-        this.#end = pending;
+        this.#end = pending2;
       }
       if (this.#end + bytes.length > this.#store.length) {
         let capacity = Math.max(this.#store.length, 64 * 1024);
@@ -19537,7 +19907,7 @@ var LspFrameParser = class {
         this.#store.copy(next, 0, this.#start, this.#end);
         this.#store = next;
         this.#start = 0;
-        this.#end = pending;
+        this.#end = pending2;
       }
     }
     this.#store.set(bytes, this.#end);
@@ -19749,11 +20119,11 @@ var LspSession = class _LspSession {
       throw error;
     }
     const onAbort = () => {
-      const pending = this.#pending.get(id);
-      if (pending === void 0) return;
+      const pending2 = this.#pending.get(id);
+      if (pending2 === void 0) return;
       this.#pending.delete(id);
-      clearTimeout(pending.timer);
-      pending.reject(new LspSessionError("\u7B49\u5F85\u8BED\u8A00\u670D\u52A1\u5668\u65F6\u88AB\u53D6\u6D88"));
+      clearTimeout(pending2.timer);
+      pending2.reject(new LspSessionError("\u7B49\u5F85\u8BED\u8A00\u670D\u52A1\u5668\u65F6\u88AB\u53D6\u6D88"));
     };
     signal.addEventListener("abort", onAbort, { once: true });
     try {
@@ -19877,15 +20247,15 @@ var LspSession = class _LspSession {
     if (typeof message["method"] !== "string") {
       const id = message["id"];
       if (typeof id === "number") {
-        const pending = this.#pending.get(id);
-        if (pending === void 0) return;
+        const pending2 = this.#pending.get(id);
+        if (pending2 === void 0) return;
         this.#pending.delete(id);
-        clearTimeout(pending.timer);
+        clearTimeout(pending2.timer);
         const error = message["error"];
         if (error !== void 0 && error !== null) {
-          pending.reject(new LspSessionError(`${pending.method} \u5931\u8D25\uFF1A${describeError(error)}`));
+          pending2.reject(new LspSessionError(`${pending2.method} \u5931\u8D25\uFF1A${describeError(error)}`));
         } else {
-          pending.resolve(message["result"]);
+          pending2.resolve(message["result"]);
         }
       }
       return;
@@ -19941,10 +20311,10 @@ var LspSession = class _LspSession {
   }
   #failAll(error) {
     this.#exitReason ??= error;
-    for (const [id, pending] of this.#pending) {
-      clearTimeout(pending.timer);
+    for (const [id, pending2] of this.#pending) {
+      clearTimeout(pending2.timer);
       this.#pending.delete(id);
-      pending.reject(error);
+      pending2.reject(error);
     }
   }
 };
@@ -20108,8 +20478,12 @@ function describeInstalled(available) {
   return `\u8BE5\u4E3B\u673A\u4E0A\u63A2\u6D4B\u5230\u7684\u8BED\u8A00\u670D\u52A1\u5668\uFF1A${list}\u3002`;
 }
 var MAX_SESSIONS = 8;
-function sessionKey(target, language) {
-  return `${target.connectionId}\0${target.root}\0${language}`;
+function sessionKeyPrefix(target, language) {
+  return `${target.connectionId}\0${target.root}\0${language}\0`;
+}
+function sessionKey(target, language, override) {
+  const server = override === void 0 ? "" : `${override.command}\0${(override.args ?? []).join("\0")}`;
+  return `${sessionKeyPrefix(target, language)}${server}`;
 }
 function createLspRegistry(deps) {
   const sessions = /* @__PURE__ */ new Map();
@@ -20128,15 +20502,15 @@ function createLspRegistry(deps) {
   }
   return {
     async session(target, language, override, signal) {
-      const key = sessionKey(target, language);
+      const key = sessionKey(target, language, override);
       const existing = sessions.get(key);
       if (existing !== void 0 && !existing.session.stopped) {
         sessions.delete(key);
         sessions.set(key, existing);
         return existing.session;
       }
-      const pending = inFlight.get(key);
-      if (pending !== void 0) return pending;
+      const pending2 = inFlight.get(key);
+      if (pending2 !== void 0) return pending2;
       const attempt = (async () => {
         const command = override ?? defaultServerFor(language);
         if (command === void 0) {
@@ -20208,17 +20582,21 @@ ${describeInstalled(available)}`);
       }));
     },
     async stop(target, language, signal) {
-      const key = sessionKey(target, language);
-      const starting = inFlight.get(key);
-      if (starting !== void 0) {
-        retired.add(key);
-        await starting.catch(() => void 0);
-        retired.delete(key);
-      }
-      const entry = sessions.get(key);
-      if (entry === void 0) return starting !== void 0;
-      sessions.delete(key);
-      await entry.session.close(signal);
+      const prefix = sessionKeyPrefix(target, language);
+      const keys = [...new Set([...sessions.keys(), ...inFlight.keys()].filter((key) => key.startsWith(prefix)))];
+      if (keys.length === 0) return false;
+      for (const key of keys) {
+        const starting = inFlight.get(key);
+        if (starting !== void 0) {
+          retired.add(key);
+          await starting.catch(() => void 0);
+          retired.delete(key);
+        }
+        const entry = sessions.get(key);
+        if (entry === void 0) continue;
+        sessions.delete(key);
+        await entry.session.close(signal);
+      }
       return true;
     },
     async disposeAll() {
@@ -21020,7 +21398,6 @@ function registerRemoteLspTools(ctx, deps) {
 // src/wiring/tools-session.ts
 import { cp, mkdir as mkdir10, readFile as readFile9, readdir as readdir6, rename as rename6, rm as rm5, stat as nodeStat2, writeFile as writeFile6 } from "node:fs/promises";
 import { dirname as dirname8, join as join17 } from "node:path";
-import { homedir as homedir6 } from "node:os";
 
 // src/host/integration/session/session-labels.ts
 function normalizePath(path) {
@@ -21070,8 +21447,8 @@ function createWorkspaceTitleResolver(ctx) {
 // src/wiring/tools-session.ts
 function wireSessionAdmin(env) {
   const { ctx, limits, notifySessionRemoved: notifySessionRemoved2 } = env;
-  const sessionsRoot = limits.sessionsRoot ?? join17(homedir6(), ".dsh", "sessions");
-  const storagesRoot = join17(homedir6(), ".dsh", "storages");
+  const sessionsRoot = limits.sessionsRoot ?? join17(dshHome(), "sessions");
+  const storagesRoot = join17(dshHome(), "storages");
   const sessionBinRoot = limits.sessionBinRoot ?? join17(storagesRoot, "over-ssh", "session-trash");
   if (limits.sessionBinRoot === void 0) {
     const carried = carryDirectory(join17(storagesRoot, "remote-workspace", "session-trash"), sessionBinRoot);
@@ -21122,15 +21499,19 @@ function wireSessionAdmin(env) {
         throw error;
       }
     },
-    readHeader: (dir) => readSessionHeader(dir),
+    // The listing is already in hand: hand it over so the header cache can key on it instead of re-listing.
+    readHeader: (dir, listing) => readSessionHeader(
+      dir,
+      listing?.map((entry) => ({ name: entry.name, size: entry.bytes, mtimeMs: entry.mtimeMs }))
+    ),
     // Both resolvers are optional: a profile without the platform services still lists sessions, labelled
     // by their directory and id rather than by name.
     resolveSessionTitle: createSessionTitleResolver(ctx),
     resolveWorkspaceTitle: createWorkspaceTitleResolver(ctx),
     stat: async (path) => {
       try {
-        const stat5 = await nodeStat2(path);
-        return { isDirectory: stat5.isDirectory(), bytes: stat5.size };
+        const stat7 = await nodeStat2(path);
+        return { isDirectory: stat7.isDirectory(), bytes: stat7.size };
       } catch {
         return void 0;
       }
@@ -21371,6 +21752,7 @@ function managementToolDefinitions(backend) {
           throw new Error("expectedVersion / expectedSha256 / force \u53EA\u5BF9 upload \u6709\u610F\u4E49\uFF1B\u4E0B\u8F7D\u7531\u672C\u5730\u6587\u4EF6\u7CFB\u7EDF\u8986\u76D6\uFF0C\u4E0D\u505A\u8FDC\u7AEF\u5B88\u536B");
         }
         const target = targetFor4(backend, exec);
+        if (direction === "upload") backend.assertWritable?.(target, "\u4E0A\u4F20\u8FDC\u7AEF\u6587\u4EF6");
         if (direction === "upload" && backend.statRemote !== void 0 && (expectedVersion !== void 0 || !force && expectedSha256 === void 0)) {
           const absolute = resolveUnderRoot(target.root, remotePath);
           if (typeof absolute !== "string") throw new Error(absolute.error);
@@ -21458,6 +21840,7 @@ function managementToolDefinitions(backend) {
         const target = targetFor4(backend, exec);
         const resolved = resolveUnderRoot(target.root, requested, void 0, target.connectionId);
         if (typeof resolved !== "string") throw new Error(resolved.error);
+        backend.assertWritable?.(target, mode === "permanent" ? "\u6C38\u4E45\u5220\u9664\u8FDC\u7AEF\u6587\u4EF6" : "\u5220\u9664\u8FDC\u7AEF\u6587\u4EF6");
         const result = await backend.discard({ target, path: resolved, mode, signal: exec.signal });
         return {
           mode: result.mode,
@@ -21517,6 +21900,8 @@ function managementToolDefinitions(backend) {
           throw new Error("id \u5FC5\u987B\u662F\u975E\u7A7A\u5B57\u7B26\u4E32\uFF08\u7701\u7565\u5B83\u8868\u793A\u64A4\u9500\u6700\u8FD1\u4E00\u6B21\u5220\u9664\uFF09");
         }
         const target = targetFor4(backend, exec);
+        const listing = record2["list"] === true;
+        if (!listing) backend.assertWritable?.(target, "\u4ECE\u56DE\u6536\u7AD9\u6062\u590D\u8FDC\u7AEF\u6587\u4EF6");
         const outcome = await backend.restore({
           target,
           id: typeof id === "string" ? id : void 0,
@@ -21573,6 +21958,7 @@ function managementToolDefinitions(backend) {
         if (typeof source !== "string") throw new Error(source.error);
         const destination = resolveUnderRoot(target.root, to, void 0, target.connectionId);
         if (typeof destination !== "string") throw new Error(destination.error);
+        backend.assertWritable?.(target, "\u590D\u5236\u8FDC\u7AEF\u6587\u4EF6");
         const outcome = await backend.copy({
           target,
           from: source,
@@ -21807,6 +22193,8 @@ function wireManagementTools(env) {
   )?.root;
   const managementBackend = {
     resolve: (cwd) => toolBackend.resolve(cwd),
+    // 管理工具（上传/删除/恢复/复制）之前完全不过写闸：read-only 会话照样能删文件（审计 2026-11-06 宿主 P0）。
+    assertWritable: (target, action) => env.assertWritable(target, action),
     // ADR-0013: the session id (plus its fork lineage) is the strict scope; `cwd` alone cannot separate
     // two conversations opened on the same directory.
     resolveSessionRoot: (cwd, sessionId) => sessionRoots.outcomeFor(cwd, sessionIdentityOf(ctx, sessionId)),
@@ -21926,6 +22314,7 @@ function wireManagementTools(env) {
 }
 
 // src/wiring/tools.ts
+init_errors();
 function sessionRootsFilePath() {
   return join18(resolveStateDir(), USER_ROOTS_FILE_NAME);
 }
@@ -21966,7 +22355,8 @@ function wireTools(env) {
     disposeJobTools,
     disposeFileTools,
     lspRegistry,
-    disposeLspTools
+    disposeLspTools,
+    assertWritable: assertWritable2
   } = wireFileAndJobTools({ ctx, limits, profiles, transports, registry, sessionRoots });
   const sessionAdmin = wireSessionAdmin({ ctx, limits, notifySessionRemoved: notifySessionRemoved2 });
   const { dispose: disposeManagement } = wireManagementTools({
@@ -21980,7 +22370,8 @@ function wireTools(env) {
     sessionRoots,
     recordFor,
     transferService,
-    transferTracker
+    transferTracker,
+    assertWritable: assertWritable2
   });
   const disposeStrictArguments = strictArgumentsGate(ctx);
   return {
@@ -22049,7 +22440,9 @@ function wireAgentTools(env) {
     disposeRemoteTools();
     disposeGitTool();
     disposeForwardTool();
-    void forwardBackend.closeAll();
+    void forwardBackend.closeAll().catch((error) => {
+      ctx.logger?.warn?.(`over-ssh: \u5173\u95ED\u7AEF\u53E3\u8F6C\u53D1\u65F6\u51FA\u9519\uFF1A${error instanceof Error ? error.message : String(error)}`);
+    });
   };
   return { sessionRoots, toolBackend, disposeTools };
 }
@@ -22086,21 +22479,33 @@ function wireFileAndJobTools(env) {
     backendFor: (target) => recordFor(target)?.backend,
     ...limits.maxReadBytes === void 0 ? {} : { maxReadBytes: limits.maxReadBytes }
   });
-  const allowMutation = (target) => {
+  const allowMutation = (target, action) => {
+    const policy = platformMutationPolicy(ctx);
+    const sessionId = currentSessionId();
+    const cwd = sessionId === void 0 || sessionId === "" ? void 0 : readSessionCwd(ctx, sessionId);
     const refusal = mutationRefusal(
-      `${target.connectionId}:${target.root}`,
+      action === void 0 ? `${target.connectionId}:${target.root}` : `${action}\uFF1A${target.connectionId}:${target.root}`,
       {
-        ...platformMutationPolicy(ctx),
+        ...policy,
         rootArea: () => {
           const record2 = recordFor(target);
           if (record2 === void 0) return "deny";
-          return workspaceWriteArea(record2.root, void 0, void 0, sessionIdentityOf(ctx, currentSessionId()));
+          return workspaceWriteArea(record2.root, policy.policy?.workspaceRoot, cwd, sessionIdentityOf(ctx, sessionId));
         }
       }
     );
     if (refusal !== void 0) throw new Error(refusal);
   };
   const disposeFileTools = registerRemoteFileTools(ctx, fileBackend, { allowMutation });
+  const assertWritable2 = (target, action) => {
+    allowMutation(target, action);
+    if (recordFor(target)?.root.writable === false) {
+      throw new SshDevError("SANDBOX_DENIED", `\u8FD9\u4E2A\u6839\u5728\u914D\u7F6E\u91CC\u662F\u53EA\u8BFB\u7684\uFF08writable: false\uFF09\uFF0C\u62D2\u7EDD\u5199\u5165\uFF1A${action}`, {
+        connectionId: target.connectionId,
+        root: target.root
+      });
+    }
+  };
   const lspRegistry = createLspRegistry({
     acquire: async (connectionId) => (await transports.acquire(requireProfile(profiles, connectionId))).transport,
     onLog: (connectionId, message) => {
@@ -22108,7 +22513,7 @@ function wireFileAndJobTools(env) {
     }
   });
   const disposeLspTools = registerRemoteLspTools(ctx, { backend: fileBackend, registry: lspRegistry });
-  return { recordFor, disposeJobTools, disposeFileTools, lspRegistry, disposeLspTools };
+  return { recordFor, disposeJobTools, disposeFileTools, lspRegistry, disposeLspTools, assertWritable: assertWritable2 };
 }
 
 // src/index.ts