dsh-pentester 0.0.1 → 1.0.0

package/lib/index.js

@@ -0,0 +1,3200 @@
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { dirname, join, posix } from "node:path";
+import { fileURLToPath } from "node:url";
+import Schema from "@deepseek-ai/schemastery";
+import { appendFile, copyFile, cp, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { createHash, randomBytes } from "node:crypto";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import tar from "tar-stream";
+import Dockerode from "dockerode";
+import { Service } from "@deepseek-ai/cordis";
+import { z } from "zod";
+import { execFile } from "node:child_process";
+//#region src/dsh.ts
+const PRESET_ID = "pentester";
+/** dsh-base 已注册的官方 in-process spawn provider 名。 */
+const SUBAGENT_PROVIDER = "spawn";
+/**
+* Worker 工具面：deny Root 编排能力 + 用户交互。
+*
+* 使用 deny-list 而非 allow-list：Worker 继承 Parent 的 pentester preset
+* standing scope。deny 只移除 Worker 不应拥有的工具，其余继承能力完整保留。
+*
+* 重要：deny 中只能出现当前 composition 中确实注册过的工具名。
+* DSH tools.restrict() 对未知名字做严格存在性校验。
+*/
+const WORKER_TOOL_FILTER = { deny: [
+	"pentester_delegate",
+	"pentester_cancel_delegation",
+	"pentester_advance_stage",
+	"pentester_rollback_stage",
+	"ask_user_question"
+] };
+function isPentesterAgentPreset(preset) {
+	return preset === PRESET_ID;
+}
+function resolveSessionPreset(session) {
+	const events = session.events ?? [];
+	for (let index = events.length - 1; index >= 0; index -= 1) {
+		const event = events[index];
+		if (event?.type !== "agent-preset/selected") continue;
+		const data = event.data;
+		if (typeof data?.agentPreset === "string" && data.agentPreset.length > 0) return data.agentPreset;
+	}
+	return session.header.agentPreset;
+}
+function trustedCallerFromAgent(agent) {
+	if (agent === null || typeof agent !== "object") return void 0;
+	const record = agent;
+	const session = record.session;
+	if (session === null || typeof session !== "object" || session.header === null || typeof session.header !== "object") return void 0;
+	const sessionId = typeof record.id === "string" && record.id.length > 0 ? record.id : session.id;
+	if (typeof sessionId !== "string" || sessionId.length === 0) return void 0;
+	const agentPreset = resolveSessionPreset({
+		header: session.header,
+		events: session.events
+	});
+	const isSubagent = session.header.origin === "subagent" || typeof session.header.delegationDepth === "number" && session.header.delegationDepth >= 1;
+	return {
+		sessionId,
+		...agentPreset === void 0 ? {} : { agentPreset },
+		isSubagent,
+		isPentesterRoot: !isSubagent && isPentesterAgentPreset(agentPreset),
+		...typeof session.header.cwd === "string" && session.header.cwd.length > 0 ? { cwd: session.header.cwd } : {}
+	};
+}
+function legacySessionIdFromExec(exec) {
+	if (exec === null || typeof exec !== "object") return void 0;
+	const record = exec;
+	if (typeof record.sessionId === "string" && record.sessionId.length > 0) return record.sessionId;
+	const session = record.session;
+	if (session !== null && typeof session === "object") {
+		const id = session.id;
+		if (typeof id === "string") return id;
+	}
+}
+function trustedCallerFromExec(exec) {
+	const agent = exec === null || typeof exec !== "object" ? void 0 : exec.agent;
+	const fromAgent = agent !== null && typeof agent === "object" ? trustedCallerFromAgent(agent) : void 0;
+	if (fromAgent !== void 0) return fromAgent;
+	const sessionId = legacySessionIdFromExec(exec);
+	if (sessionId === void 0) return void 0;
+	return {
+		sessionId,
+		isSubagent: false,
+		isPentesterRoot: false
+	};
+}
+var DshClient = class {
+	ctx;
+	constructor(ctx) {
+		this.ctx = ctx;
+	}
+	get subagentAvailable() {
+		return this.ctx.subagents !== void 0 && this.ctx.subagents.getProvider("spawn") !== void 0;
+	}
+	/**
+	* 创建 continuable Worker：reserve durable child id → resolve provider
+	* creation spec → create child Agent → submit initial prompt。
+	* resolve 时 child 已接受 prompt 但尚未开始执行 —— 不等于 Worker 已完成。
+	*/
+	async startContinuableWorker(input, parent, signal) {
+		if (!this.subagentAvailable) throw new Error(`subagent provider "${SUBAGENT_PROVIDER}" is unavailable`);
+		const spec = {
+			provider: SUBAGENT_PROVIDER,
+			label: input.label,
+			request: {
+				prompt: [{
+					type: "text",
+					text: input.prompt
+				}],
+				parent,
+				toolFilter: WORKER_TOOL_FILTER,
+				persona: input.persona,
+				maxDepth: 1,
+				...input.model === void 0 ? {} : { agentOptions: { model: input.model } }
+			},
+			signal
+		};
+		const start = await this.ctx.subagents.startContinuable(spec);
+		return {
+			childId: start.childId,
+			messageId: start.messageId
+		};
+	}
+	/**
+	* 中断 continuable child 的当前轮次。fire-and-return：cancel signal 发出后
+	* 立即返回；child 观察到 signal 后当前轮结束，未消费的 inbox 消息保留。
+	* 不存在的 target 是 accepted no-op。
+	*/
+	interruptWorker(targetSessionId, authority) {
+		this.ctx.subagents.interrupt(targetSessionId, authority);
+	}
+};
+//#endregion
+//#region src/stages.ts
+const STAGE_DEFINITIONS = [
+	{
+		id: "pre-engagement",
+		name: "Pre-engagement",
+		goal: "与用户确认目标、授权范围和交战规则，建立 PentestRun 基线。",
+		instructions: "收集并确认 objectives、targets、Rules of Engagement。所有输入必须经 ask_user_question 与用户确认。",
+		exitCriteria: [
+			"测试目标已经明确并经用户确认",
+			"授权范围（targets / 排除项）已经记录",
+			"Rules of Engagement 已确认（时间窗、强度、凭据模式）"
+		],
+		deliverables: ["scope-summary"],
+		agentIds: []
+	},
+	{
+		id: "intelligence-gathering",
+		name: "Intelligence Gathering",
+		goal: "获得足够的目标资产、服务和技术栈信息。",
+		instructions: "尽可能建立目标攻击面认知。避免重复已经完成的侦察；复用 pentest/intelligence-gathering/ 下已有成果。",
+		exitCriteria: [
+			"目标范围已经明确",
+			"主要资产已经识别",
+			"重要开放服务已经识别",
+			"Web/API 技术栈已有基本认知"
+		],
+		deliverables: [
+			"assets",
+			"services",
+			"technology-summary"
+		],
+		agentIds: ["recon", "web"]
+	},
+	{
+		id: "threat-modeling",
+		name: "Threat Modeling",
+		goal: "从攻击者视角梳理攻击路径与优先级。",
+		instructions: "基于情报阶段成果建模：入口、信任边界、高价值资产、候选攻击路径。",
+		exitCriteria: [
+			"攻击面已梳理成结构化模型",
+			"候选攻击路径已按价值与可行性排序",
+			"明确了后续验证的优先级清单"
+		],
+		deliverables: ["threat-model"],
+		agentIds: ["threat-model"]
+	},
+	{
+		id: "vulnerability-analysis",
+		name: "Vulnerability Analysis",
+		goal: "识别并评估候选安全问题。",
+		instructions: "针对威胁模型优先级验证候选问题，输出带证据的 findings。",
+		exitCriteria: [
+			"优先攻击路径均已分析",
+			"候选问题有可复验的证据支撑",
+			"每个问题标注了置信度与建议验证方式"
+		],
+		deliverables: ["findings"],
+		agentIds: ["web", "vulnerability"]
+	},
+	{
+		id: "exploitation",
+		name: "Exploitation",
+		goal: "在授权范围内验证可利用性并确认影响。",
+		instructions: "只验证已确认的候选问题；控制强度与影响；保留过程证据。",
+		exitCriteria: [
+			"高价值候选问题已完成验证（可利用 / 不可利用）",
+			"每次验证有可复现步骤与证据",
+			"未验证项已记录原因"
+		],
+		deliverables: ["validation-results"],
+		agentIds: ["validation"]
+	},
+	{
+		id: "post-exploitation",
+		name: "Post Exploitation",
+		goal: "评估横向移动、持久性与业务影响。",
+		instructions: "基于已验证的立足点评估影响范围；遵守 RoE 边界；不做超出授权的影响操作。",
+		exitCriteria: [
+			"影响范围已评估",
+			"业务影响已量化或明确描述",
+			"清理与恢复动作已记录"
+		],
+		deliverables: ["impact-assessment"],
+		agentIds: ["impact"]
+	},
+	{
+		id: "reporting",
+		name: "Reporting",
+		goal: "产出最终交付报告。",
+		instructions: "reporter 读取整个 pentest/ 目录，整理最终报告写入 reporting/report.md。报告是普通 Stage：delegate reporter 即可。",
+		exitCriteria: [
+			"report.md 已生成且覆盖全部阶段成果",
+			"每个确认的问题有证据、影响与修复建议",
+			"用户已确认报告可交付"
+		],
+		deliverables: ["report.md"],
+		agentIds: ["reporting"]
+	}
+];
+function stageDefinition(stage) {
+	return STAGE_DEFINITIONS.find((definition) => definition.id === stage);
+}
+//#endregion
+//#region src/model.ts
+/**
+* model.ts — the 6 domain concepts (see docs/plan.md §1 and CONTEXT.md).
+* Deliverables are files; there are no store entities beyond Delegation records.
+*/
+const STAGE_IDS = [
+	"pre-engagement",
+	"intelligence-gathering",
+	"threat-modeling",
+	"vulnerability-analysis",
+	"exploitation",
+	"post-exploitation",
+	"reporting"
+];
+/** 阶段目录名：`01-pre-engagement` … `07-reporting`（与 STAGE_IDS 同序）。 */
+function stageDir(stage) {
+	const index = STAGE_IDS.indexOf(stage);
+	return `${String(index + 1).padStart(2, "0")}-${stage}`;
+}
+function nextStage(stage) {
+	const index = STAGE_IDS.indexOf(stage);
+	if (index < 0 || index === STAGE_IDS.length - 1) return void 0;
+	return STAGE_IDS[index + 1];
+}
+function isStageId(value) {
+	return STAGE_IDS.includes(value);
+}
+//#endregion
+//#region src/store.ts
+/**
+* store.ts — the single run.json snapshot per Project (docs/workspace.md).
+* Atomic write via tmp+rename; no event log, no replay.
+*/
+const RUN_DIR = ".dsh-pentester";
+const RUN_FILE = "run.json";
+/** 工作区交付树：`<project>/workspace` = 容器 `/workspace`（共享 volume 的宿主镜像）。 */
+const WORKSPACE_DIR = "workspace";
+var StoreError = class extends Error {};
+function runFilePath(projectDir) {
+	return join(workspaceDir(projectDir), RUN_DIR, RUN_FILE);
+}
+function workspaceDir(projectDir) {
+	return join(projectDir, WORKSPACE_DIR);
+}
+/**
+* 非异常版加载：文件不存在返回 null（不要用 try/catch 判存在性）；
+* 文件损坏仍抛 StoreError（不吞损坏，防止用新 Run 覆盖坏文件）。
+*/
+/**
+* 唯一 PentestRun 解析入口（docs/plan.md §6）：文件不存在 → null；
+* 文件损坏 → StoreError。插件侧所有消费者统一走这里。
+*/
+async function resolvePentestRun(projectDir) {
+	return tryLoadRun(projectDir);
+}
+async function tryLoadRun(projectDir) {
+	const file = runFilePath(projectDir);
+	if (!existsSync(file)) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(await readFile(file, "utf8"));
+	} catch (error) {
+		throw new StoreError(`run.json is corrupted: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	return validateRun(parsed, file);
+}
+async function saveRun(projectDir, run) {
+	const file = runFilePath(projectDir);
+	await mkdir(join(workspaceDir(projectDir), RUN_DIR), { recursive: true });
+	const tmp = `${file}.${crypto.randomUUID().slice(0, 8)}.tmp`;
+	await writeFile(tmp, `${JSON.stringify(run, null, 2)}\n`);
+	await rename(tmp, file);
+}
+/** Linear advance only; the host never judges information sufficiency. */
+function advanceStage(run, reason) {
+	if (run.currentStage === null || run.status === "completed") throw new StoreError("run is already completed; cannot advance");
+	const current = run.currentStage;
+	const target = nextStage(current);
+	if (target === void 0) {
+		const statuses = { ...run.stageStatuses ?? {} };
+		statuses[current] = "completed";
+		run.stageStatuses = statuses;
+		run.status = "completed";
+		run.currentStage = null;
+		return null;
+	}
+	const statuses = { ...run.stageStatuses ?? {} };
+	statuses[current] = "completed";
+	statuses[target] = "active";
+	run.stageStatuses = statuses;
+	run.currentStage = target;
+	run.stageHistory.push({
+		stage: target,
+		enteredAt: (/* @__PURE__ */ new Date()).toISOString(),
+		reason
+	});
+	return target;
+}
+/** 当前 stage 状态（缺省：currentStage=active，其余=pending）。 */
+/** 把当前 stage 标为 reviewing（最后一个 delegation 结算时调用）。 */
+function markStageReviewing(run) {
+	if (run.currentStage === null) return;
+	run.stageStatuses = {
+		...run.stageStatuses ?? {},
+		[run.currentStage]: "reviewing"
+	};
+}
+/** 当前 stage 的 delegation 目录：`workspace/stages/<NN>-<stage>/delegations/`。 */
+function stageDelegationsDir(projectDir, stage) {
+	return join(workspaceDir(projectDir), "stages", stageDir(stage), "delegations");
+}
+/** 某 delegation 的工作区目录：`workspace/stages/<NN>-<stage>/delegations/D-00N`。 */
+function delegationWorkspaceDir(projectDir, stage, id) {
+	return join(stageDelegationsDir(projectDir, stage), id);
+}
+function nextDelegationId(run) {
+	let max = 0;
+	for (const delegation of run.delegations) {
+		const match = /^D-(\d+)$/.exec(delegation.id);
+		if (match !== null) max = Math.max(max, Number(match[1]));
+	}
+	return `D-${String(max + 1).padStart(3, "0")}`;
+}
+function findDelegation(run, id) {
+	return run.delegations.find((delegation) => delegation.id === id);
+}
+function validateRun(value, file) {
+	if (value === null || typeof value !== "object") throw new StoreError(`${file}: run.json must be an object`);
+	const record = value;
+	if (record.schemaVersion !== 1) throw new StoreError(`${file}: unsupported schemaVersion ${String(record.schemaVersion)}`);
+	if (record.currentStage !== null && (typeof record.currentStage !== "string" || !isStageId(record.currentStage))) throw new StoreError(`${file}: invalid currentStage`);
+	if (!Array.isArray(record.delegations)) throw new StoreError(`${file}: delegations must be an array`);
+	return record;
+}
+//#endregion
+//#region src/workspace.ts
+/**
+* workspace.ts — 工作区布局初始化与宿主侧产物。
+*
+* 固定骨架（每次 run 结构完全一致，见 docs/workspace.md）：
+*
+*   <project>/workspace/            = 容器 /workspace（共享 volume 的宿主镜像）
+*   ├── .gitignore                  # traffic/ *.pcap *.mitm tmp/ cache/ *.log
+*   ├── STATUS.md                   # 宿主自动生成的可读状态
+*   ├── target/  target.json scope/ roe/ inputs/
+*   ├── assets/  assets.json
+*   ├── stages/  <NN>-<stage>/  summary.md delegations/
+*   ├── findings/
+*   ├── report/
+*   └── traffic/
+*
+* 宿主侧状态（不随 volume 同步）：<project>/.dsh-pentester/run.json、
+* workspace.json、events.jsonl（append-only）。
+*/
+function workspaceFilePath(projectDir) {
+	return join(workspaceDir(projectDir), RUN_DIR, "workspace.json");
+}
+function eventsFilePath(projectDir) {
+	return join(workspaceDir(projectDir), RUN_DIR, "events.jsonl");
+}
+/** 追加一条事件（失败不阻塞主流程）。 */
+async function appendEvent(projectDir, event) {
+	try {
+		await appendFile(eventsFilePath(projectDir), `${JSON.stringify({
+			ts: event.ts,
+			type: event.type,
+			data: event.data
+		})}\n`, "utf8");
+	} catch {}
+}
+/**
+* 初始化工作区固定骨架 + 宿主侧状态文件。幂等：已存在则只补齐缺失目录。
+* @param target 初始目标（pre-engagement 确认后写入 target/target.json）。
+* @param scope 用户确认后的 Scope 文本（写入 target/scope.md，不做机器 enforcement）。
+* @param roe 用户确认后的 RoE / Authorization 事实（写入 target/roe.md，不做程序级语义解析）。
+*/
+async function initWorkspace(projectDir, options = {}) {
+	const root = workspaceDir(projectDir);
+	const metaPath = workspaceFilePath(projectDir);
+	await mkdir(join(root, RUN_DIR), { recursive: true });
+	let meta;
+	if (existsSync(metaPath)) meta = JSON.parse(await readFile(metaPath, "utf8"));
+	else {
+		meta = {
+			schemaVersion: 1,
+			id: crypto.randomUUID(),
+			target: options.target,
+			language: options.language ?? "zh-CN",
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			gitBranch: "main"
+		};
+		await writeFile(metaPath, `${JSON.stringify(meta, null, 2)}\n`, "utf8");
+		await appendEvent(projectDir, {
+			ts: meta.createdAt,
+			type: "run.created",
+			data: { target: meta.target }
+		});
+	}
+	await mkdir(root, { recursive: true });
+	const dirs = [
+		"target/inputs",
+		"assets",
+		"findings",
+		"report",
+		"traffic",
+		...STAGE_IDS.map((stage) => join("stages", stageDir(stage), "delegations"))
+	];
+	for (const dir of dirs) await mkdir(join(root, dir), { recursive: true });
+	const gitignore = join(root, ".gitignore");
+	if (!existsSync(gitignore)) await writeFile(gitignore, `tmp/\ncache/\n*.log\n`, "utf8");
+	if (options.target !== void 0 && meta.target === void 0) {
+		meta = {
+			...meta,
+			target: options.target
+		};
+		await writeFile(metaPath, `${JSON.stringify(meta, null, 2)}\n`, "utf8");
+	}
+	await writeTarget(projectDir, meta.target);
+	if (options.scope !== void 0) await writeFile(join(root, "target", "scope.md"), options.scope.endsWith("\n") ? options.scope : `${options.scope}\n`, "utf8");
+	if (options.roe !== void 0) await writeFile(join(root, "target", "roe.md"), options.roe.endsWith("\n") ? options.roe : `${options.roe}\n`, "utf8");
+	return meta;
+}
+/** 写 target/target.json（幂等；仅当文件不存在或 target 变化时更新）。 */
+async function writeTarget(projectDir, target) {
+	if (target === void 0) return;
+	const file = join(workspaceDir(projectDir), "target", "target.json");
+	if ((existsSync(file) ? JSON.parse(await readFile(file, "utf8")) : void 0)?.target === target) return;
+	await writeFile(file, `${JSON.stringify({
+		target,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	}, null, 2)}\n`, "utf8");
+}
+/**
+* 写 stage 的 summary.md（Stage handoff）。内容由 Root 通过
+* pentester_advance_stage(summary) 提供，Host 只负责写磁盘、不解析。
+*/
+async function writeStageSummary(projectDir, stage, summary) {
+	const text = summary.trim();
+	if (text === "") return;
+	await writeFile(join(workspaceDir(projectDir), "stages", stageDir(stage), "summary.md"), `# ${stageDir(stage)}\n\n${text}\n`, "utf8");
+}
+/**
+* 提升某 delegation 目录中的 canonical 产物（仅 threat-model.md）。
+* assets.json 和 findings.md 现在由 promoteAssets / promoteFindings
+* （src/pentest/）负责聚合提升，不再走简单 copyFile。
+*/
+async function promoteDeliverables(projectDir, dir) {
+	const root = workspaceDir(projectDir);
+	for (const [name, relative] of [["threat-model.md", "findings/threat-model.md"]]) {
+		const source = join(dir, name);
+		if (!existsSync(source)) continue;
+		const target = join(root, relative);
+		await mkdir(dirname(target), { recursive: true });
+		await copyFile(source, target);
+	}
+}
+/**
+* 将 Pre-engagement 用户确认的完整授权信息写入
+* `target/inputs/pre-engagement.md` 作为原始输入 provenance。
+* 在 bootstrap（首次 advance）时调用。
+*/
+async function writePreEngagementInput(projectDir, options) {
+	const inputsDir = join(workspaceDir(projectDir), "target", "inputs");
+	await mkdir(inputsDir, { recursive: true });
+	const content = [
+		"# Pre-engagement Confirmation",
+		"",
+		`**Recorded**: ${(/* @__PURE__ */ new Date()).toISOString()}`,
+		"",
+		"## Target",
+		...options.targets.map((t) => `- ${t}`),
+		"",
+		"## Scope",
+		options.scope,
+		"",
+		"## Rules of Engagement",
+		options.roe,
+		"",
+		"## Language",
+		options.language,
+		""
+	].join("\n");
+	await writeFile(join(inputsDir, "pre-engagement.md"), `${content}\n`, "utf8");
+}
+//#endregion
+//#region src/delegations.ts
+/**
+* delegations.ts — Delegation lifecycle: one Delegation = one DSH continuable
+* child Session (docs/plan.md §3, §26).
+*
+* Worker execution uses the DeepSeek Harness official Continuable Subagent seam
+* (`ctx.subagents.startContinuable()` → provider `spawn`). The child is a
+* durable Session that survives across turns and can accept followup messages
+* from Root or user. The plugin only manages PTES domain state.
+*
+* 目录契约（docs/workspace.md）：`workspace/stages/<NN>-<stage>/delegations/D-00N/`
+*   input/  work/  artifacts/  evidence/  result.md
+* Worker 只写自己的 delegation 目录；宿主写 input/task_prompt.md 快照。
+* result.md 是当前 Delegation 的"最新正式可交付结果"，不是 child Session
+* 终止标记。Worker 后续可以更新 result.md。
+*/
+/** Profile → category 映射：决定 compact catalog 中哪些工具标记为 Recommended。 */
+const PROFILE_CATEGORIES = {
+	recon: [
+		"network-discovery",
+		"dns-osint",
+		"web-discovery",
+		"network"
+	],
+	web: ["web-discovery", "vulnerability"],
+	vulnerability: ["vulnerability", "web-discovery"],
+	validation: [
+		"vulnerability",
+		"password",
+		"smb-ad"
+	],
+	impact: [
+		"smb-ad",
+		"network",
+		"misc"
+	],
+	reporting: [],
+	"threat-model": []
+};
+var DelegationError = class extends Error {};
+/**
+* Worker persona（官方 ContinuableStartSpec.request.persona）：常驻规则 +
+* AgentProfile 角色。Worker 是长期存在的 continuable child，可能收到多轮
+* 来自 Root 或用户的消息。
+*/
+const WORKER_BASELINE = `You are a long-lived PTES execution worker — a continuable child agent.
+
+You may receive multiple rounds of tasks from:
+- The Root Agent (via send_message)
+- A human user (direct chat in your session)
+
+All messages belong to the same ongoing Delegation Session. You must retain
+context from previous turns and build on earlier results.
+
+Your responsibilities:
+- Execute the assigned task using available tools.
+- Stay inside the Primary Target, Scope, and Rules of Engagement.
+- Produce reusable artifacts and evidence.
+- Write or update result.md as the current formal deliverable of this Delegation.
+- When an important finding affects the Root's next step, use the report tool
+  to notify the Root Agent proactively.
+
+You must NOT:
+- Advance or rollback PTES stages (Root-only).
+- Create or cancel delegations (Root-only).
+- Ask the user questions (Root-only).
+- Create more subagents or fork yourself.
+- Expand scope beyond what is authorized.
+
+Standing rules:
+- Operate only within the authorized assessment recorded for this run.
+- Execute commands via available tools.
+- NEVER run git commands. The host owns git checkpoints; .git is not present
+  in the container.
+- ALL container network traffic is recorded (pcap + optional mitmproxy on
+  :8080). This is an audit trail, not a limitation.
+- Write ALL output in the language of your task prompt: your final response
+  AND the content of every file you generate, including reports. Tool raw
+  output stays as-is.
+- One round ending does NOT mean your Delegation is permanently over. You may
+  receive follow-up messages from Root or a user.
+- Your final response each round must summarize: what you did, what you found,
+  which files you wrote, and what you recommend investigating next.`;
+function buildWorkerPersona(profile, catalogText, toolPrompt) {
+	const parts = [WORKER_BASELINE];
+	if (toolPrompt !== void 0 && toolPrompt.length > 0) parts.push(toolPrompt);
+	parts.push(`# Agent Profile: ${profile.name}`, profile.systemPrompt);
+	if (catalogText !== void 0 && catalogText.length > 0) parts.push(catalogText);
+	return parts.join("\n\n");
+}
+/**
+* Worker 首轮 user message（官方 ContinuableStartSpec.request.prompt）：
+* standalone task context。官方 continuable child 不继承 parent transcript，
+* 所以这里必须自包含：Delegation ID / Stage / Target / Scope / RoE /
+* 目录路径 / 完成契约 / task_prompt。
+*/
+function buildWorkerTaskPrompt(options) {
+	const { run, delegation, projectDir } = options;
+	const stage = stageDefinition(delegation.stageId);
+	const containerDir = delegation.workspaceDir.startsWith(projectDir) ? delegation.workspaceDir.slice(projectDir.length).replace(/\\/g, "/") : `/workspace/stages/${stage === void 0 ? delegation.stageId : stage.id}`;
+	const metadata = [
+		`Delegation ID: ${delegation.id}`,
+		`Stage: ${delegation.stageId}${stage === void 0 ? "" : ` — ${stage.name}`}`,
+		`Project workspace root: /workspace (READ-ONLY outside your own directory)`,
+		`Your deliverable directory: ${containerDir}`,
+		`  work/        scratch working files (default container cwd)`,
+		`  artifacts/   final deliverables for later workers`,
+		`  evidence/    reproducible evidence (commands + outputs)`,
+		`  result.md    current formal deliverable — write/update it as results accumulate`,
+		`Write policy: write files ONLY inside ${containerDir}; never modify`,
+		`  .git/, .dsh-pentester/, target/, other delegation directories or the workspace root.`,
+		run.targets.length > 0 ? `Targets: ${run.targets.join(", ")}` : "Targets: (not yet recorded)",
+		run.rulesOfEngagement === void 0 ? "" : `Rules of Engagement: ${run.rulesOfEngagement}`
+	].filter((line) => line !== "");
+	return [
+		`# Task for ${delegation.id}`,
+		"",
+		...metadata,
+		"",
+		`# Objective`,
+		delegation.objective,
+		"",
+		`# task_prompt (task context from the Root Agent)`,
+		delegation.taskPrompt,
+		"",
+		`# Completion contract`,
+		`- This is a continuable session. You may receive follow-up messages.`,
+		`- When you have results, write or update result.md in ${containerDir}`,
+		`  (summary + what you found). result.md is the current formal deliverable —`,
+		`  it does NOT terminate your session.`,
+		`- If you discover something important that affects the Root's next step,`,
+		`  use the report tool to notify the Root Agent.`
+	].join("\n");
+}
+/**
+* 把 tools.json 的 categories 渲染成 compact 文本，注入 Worker persona。
+* 先输出 profile 匹配的 Recommended 工具，再输出 Other。
+* raw 格式由 gen-tools-json.sh 固定（categories: { name, bin, description, examples }[]）。
+*/
+function renderToolCatalog(raw, profileId) {
+	const data = raw;
+	if (data === null || data === void 0) return "";
+	const categories = data.categories;
+	if (categories === void 0) return "";
+	const image = typeof data.image === "string" ? data.image : "dsh-pentester-kali";
+	const recommended = PROFILE_CATEGORIES[profileId];
+	const recommendedSet = recommended !== void 0 ? new Set(recommended) : /* @__PURE__ */ new Set();
+	const recLines = [];
+	const otherLines = [];
+	for (const [catName, tools] of Object.entries(categories)) {
+		if (!Array.isArray(tools)) continue;
+		const lines = recommendedSet.has(catName) ? recLines : otherLines;
+		for (const tool of tools) {
+			if (typeof tool.name !== "string" || typeof tool.description !== "string") continue;
+			lines.push(`  ${tool.name} — ${tool.description}`);
+		}
+	}
+	const parts = [
+		"## Toolbox Capabilities",
+		"",
+		`Image: ${image} · All execution via \`pentester_container_exec\`.`,
+		"Discovery: `tool-list` for full catalog, `tool-info <name>` for single tool details.",
+		"If you need specific parameters, use `<tool> -h` or `<tool> --help`."
+	];
+	if (recLines.length > 0) parts.push("", "### Recommended for this profile", ...recLines);
+	if (otherLines.length > 0) parts.push("", "### Other capabilities", ...otherLines);
+	parts.push("", "## Tool Selection", "", "1. Match tool to task — prefer narrow specialized tools over curl/bash scripts.", "2. Do NOT run multiple overlapping scanners without a specific reason.", "3. Broad scanners are discovery aids, not vulnerability proof.", "4. Validate important findings before reporting them.", "5. Stay strictly within Target / Scope / RoE.");
+	return parts.join("\n");
+}
+var DelegationService = class {
+	dsh;
+	docker;
+	constructor(dsh, docker) {
+		this.dsh = dsh;
+		this.docker = docker;
+	}
+	/**
+	* 创建一个或多个 continuable Worker。
+	*
+	* 流程：
+	* validate PentestRun → validate Stage → validate AgentProfile →
+	* allocate D-xxx → scaffold Delegation → build standalone initial prompt →
+	* persist Delegation → ctx.subagents.startContinuable() →
+	* 得到 childId + messageId → Delegation.childSessionId = childId →
+	* Delegation.status = active → persist run.json → return
+	*
+	* startContinuable() resolve 的含义只是初始 prompt 已进入 child inbox，
+	* 不是 Worker 已完成任务。
+	*/
+	async delegate(deps, assignments) {
+		if (assignments.length === 0) throw new DelegationError("assignments must not be empty");
+		if (deps.run.status === "completed" || deps.run.currentStage === null) throw new DelegationError("PentestRun is completed; cannot delegate new work");
+		const stage = stageDefinition(deps.run.currentStage);
+		if (stage === void 0) throw new DelegationError(`unknown stage: ${deps.run.currentStage}`);
+		if (!this.dsh.subagentAvailable) throw new DelegationError("subagent infrastructure unavailable: ctx.subagents provider \"spawn\" is not registered");
+		const created = [];
+		for (const assignment of assignments) {
+			const profile = deps.profiles.get(assignment.agent);
+			if (profile === void 0) throw new DelegationError(`unknown AgentProfile: ${assignment.agent}`);
+			if (!stage.agentIds.includes(profile.id)) throw new DelegationError(`AgentProfile ${profile.id} is not attached to current stage ${deps.run.currentStage}. Allowed profiles: ${stage.agentIds.join(", ")}`);
+			if (assignment.objective.trim() === "" || assignment.taskPrompt.trim() === "") throw new DelegationError("objective and task_prompt must not be empty");
+			if (/delegations\/D-\d+/.test(assignment.taskPrompt)) throw new DelegationError("task_prompt must not contain concrete delegation paths (e.g. delegations/D-001). The Host manages D-ID allocation and directory structure. Reference deliverables by their logical names (e.g. \"the recon scan results from intelligence-gathering\").");
+			const id = nextDelegationId(deps.run);
+			const dir = delegationWorkspaceDir(deps.projectDir, deps.run.currentStage, id);
+			await scaffoldDelegationDir(dir, {
+				id,
+				stage: deps.run.currentStage,
+				agent: profile.id,
+				objective: assignment.objective,
+				taskPrompt: assignment.taskPrompt
+			});
+			const delegation = {
+				id,
+				stageId: deps.run.currentStage,
+				agentId: profile.id,
+				objective: assignment.objective,
+				taskPrompt: assignment.taskPrompt,
+				workspaceDir: dir,
+				status: "starting",
+				createdAt: (/* @__PURE__ */ new Date()).toISOString()
+			};
+			deps.run.delegations.push(delegation);
+			await saveRun(deps.projectDir, deps.run);
+			await appendEvent(deps.projectDir, {
+				ts: (/* @__PURE__ */ new Date()).toISOString(),
+				type: "delegation.created",
+				data: {
+					id,
+					agent: profile.id,
+					stage: deps.run.currentStage
+				}
+			});
+			created.push(delegation);
+		}
+		await saveRun(deps.projectDir, deps.run);
+		await this.docker.pushWorkspace(deps.run.id, deps.projectDir).catch(() => void 0);
+		const toolbox = await this.docker.ensureImage("kali");
+		const containerId = await this.docker.ensureRunContainer({
+			runId: deps.run.id,
+			toolbox,
+			projectDir: deps.projectDir
+		});
+		for (const delegation of created) await this.dispatch(deps, delegation, containerId);
+		await saveRun(deps.projectDir, deps.run);
+		return created;
+	}
+	/**
+	* 派发一个 delegation：创建 continuable child。
+	* startContinuable() resolve 时 child 已接受 prompt 但尚未开始执行。
+	* 之后 child 作为 durable Session 持续存在，可接受 followup。
+	*/
+	async dispatch(deps, delegation, containerId) {
+		const profile = deps.profiles.get(delegation.agentId);
+		let catalogText;
+		try {
+			catalogText = renderToolCatalog(await this.docker.readToolCatalog(containerId), delegation.agentId);
+		} catch {}
+		let toolPrompt;
+		try {
+			toolPrompt = (await this.docker.exec(containerId, { argv: ["cat", "/pentester/PROMPT.md"] })).stdout;
+		} catch {}
+		const input = {
+			label: `${delegation.id} · ${profile.name}`,
+			persona: buildWorkerPersona(profile, catalogText, toolPrompt),
+			prompt: buildWorkerTaskPrompt({
+				run: deps.run,
+				delegation,
+				projectDir: deps.projectDir
+			}),
+			...profile.model === void 0 ? {} : { model: profile.model }
+		};
+		const start = await this.dsh.startContinuableWorker(input, deps.parent, deps.signal);
+		delegation.sessionId = start.childId;
+		delegation.status = "active";
+		await saveRun(deps.projectDir, deps.run);
+		await appendEvent(deps.projectDir, {
+			ts: (/* @__PURE__ */ new Date()).toISOString(),
+			type: "delegation.dispatched",
+			data: {
+				id: delegation.id,
+				childId: start.childId,
+				messageId: start.messageId
+			}
+		});
+	}
+	/**
+	* 关闭 PTES Delegation。
+	*
+	* 流程：
+	* resolve D-ID → resolve childSessionId → 如有 live turn：interrupt child →
+	* Delegation.status = closed → persist。
+	*
+	* 不删除 durable Child Session transcript。用户以后仍然可以看到历史。
+	*/
+	async cancel(deps, delegationId, reason) {
+		const delegation = findDelegation(deps.run, delegationId);
+		if (delegation === void 0) throw new DelegationError(`unknown delegation: ${delegationId}`);
+		if (delegation.sessionId !== void 0) try {
+			this.dsh.interruptWorker(delegation.sessionId, {
+				kind: "user",
+				parentSessionId: delegation.sessionId
+			});
+		} catch {}
+		delegation.status = "closed";
+		delegation.resultSummary = reason ?? "closed by Root";
+		delegation.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+		await saveRun(deps.projectDir, deps.run);
+		await appendEvent(deps.projectDir, {
+			ts: (/* @__PURE__ */ new Date()).toISOString(),
+			type: "delegation.closed",
+			data: {
+				id: delegationId,
+				reason
+			}
+		});
+		return delegation;
+	}
+	/**
+	* 当前 stage 全部 delegation 是否都已 settled（没有 active/starting）。
+	* 用于 advance 前的机械检查。
+	*/
+	stageHasPendingWork(run, stageId) {
+		return run.delegations.some((d) => d.stageId === stageId && (d.status === "active" || d.status === "starting"));
+	}
+	/**
+	* 当前 stage 全部 delegation 中没有 active/starting → 标记 reviewing。
+	*/
+	async maybeMarkReviewing(deps) {
+		if (deps.run.currentStage === null) return;
+		if (this.stageHasPendingWork(deps.run, deps.run.currentStage)) return;
+		markStageReviewing(deps.run);
+		await saveRun(deps.projectDir, deps.run);
+		await appendEvent(deps.projectDir, {
+			ts: (/* @__PURE__ */ new Date()).toISOString(),
+			type: "stage.reviewing",
+			data: { stage: deps.run.currentStage }
+		});
+	}
+};
+/** 预建 delegation 目录骨架 + input/task_prompt 快照。 */
+async function scaffoldDelegationDir(dir, info) {
+	for (const sub of [
+		"input",
+		"work",
+		"artifacts",
+		"evidence"
+	]) await mkdir(join(dir, sub), { recursive: true });
+	await writeFile(join(dir, "input", "task_prompt.md"), info.taskPrompt, "utf8");
+}
+//#endregion
+//#region src/pentest/assets.ts
+/**
+* assets.ts — PentestRun canonical asset inventory promotion.
+*
+* Workers produce local `artifacts/assets.json` and `artifacts/services.json`
+* inside their delegation directories. On stage advance, the host aggregates
+* every delegation's assets from the completed stage, deduplicates them, and
+* writes the canonical `assets/assets.json` and `assets/services.json` at the
+* workspace root. Worker-local artifacts are never moved or deleted.
+*
+* Dedup keys:
+*   asset:  type + normalized value
+*   service: asset value + protocol + port
+*/
+function assetKey(entry) {
+	const type = typeof entry.type === "string" ? entry.type : "unknown";
+	const value = typeof entry.value === "string" ? entry.value.trim().toLowerCase() : "";
+	if (value === "") return "";
+	return `${type}:${value}`;
+}
+function serviceKey(entry) {
+	const asset = typeof entry.asset === "string" ? entry.asset.trim().toLowerCase() : "";
+	const protocol = typeof entry.protocol === "string" ? entry.protocol.trim().toLowerCase() : "";
+	const port = typeof entry.port === "number" ? entry.port : 0;
+	if (asset === "" || protocol === "" || port === 0) return "";
+	return `${asset}:${protocol}:${port}`;
+}
+/** Normalize a worker's asset entry to canonical form. */
+function normalizeAsset(entry, sourceDelegationId, sourceStage, updatedAt) {
+	return {
+		type: typeof entry.type === "string" && entry.type.length > 0 ? entry.type : "unknown",
+		value: typeof entry.value === "string" ? entry.value.trim() : "",
+		...entry.meta !== void 0 && typeof entry.meta === "object" && entry.meta !== null ? { meta: entry.meta } : {},
+		sourceDelegationId,
+		sourceStage,
+		updatedAt
+	};
+}
+/** Normalize a worker's service entry to canonical form. */
+function normalizeService(entry, sourceDelegationId, sourceStage, updatedAt) {
+	return {
+		asset: typeof entry.asset === "string" ? entry.asset.trim() : "",
+		protocol: typeof entry.protocol === "string" ? entry.protocol.trim() : "",
+		port: typeof entry.port === "number" ? entry.port : 0,
+		...typeof entry.name === "string" && entry.name.length > 0 ? { name: entry.name } : {},
+		...typeof entry.version === "string" && entry.version.length > 0 ? { version: entry.version } : {},
+		...typeof entry.banner === "string" && entry.banner.length > 0 ? { banner: entry.banner } : {},
+		...entry.meta !== void 0 && typeof entry.meta === "object" && entry.meta !== null ? { meta: entry.meta } : {},
+		sourceDelegationId,
+		sourceStage,
+		updatedAt
+	};
+}
+function readJsonFile(file) {
+	if (!existsSync(file)) return void 0;
+	try {
+		return JSON.parse(readFileSync(file, "utf8"));
+	} catch {
+		return;
+	}
+}
+function readJsonArray(file) {
+	const parsed = readJsonFile(file);
+	if (Array.isArray(parsed)) return parsed.filter((entry) => entry !== null && typeof entry === "object");
+	return [];
+}
+/**
+* Aggregate assets from every delegation directory in the completed stage,
+* deduplicate, and write the canonical `assets/assets.json` and (if any
+* services found) `assets/services.json`.
+*/
+async function promoteAssets(projectDir, stage, delegationDirs, delegationIds) {
+	const root = workspaceDir(projectDir);
+	const updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+	const assetMap = /* @__PURE__ */ new Map();
+	for (let index = 0; index < delegationDirs.length; index += 1) {
+		const delegationId = delegationIds[index] ?? `D-${String(index + 1).padStart(3, "0")}`;
+		const entries = readJsonArray(join(delegationDirs[index], "assets.json"));
+		for (const entry of entries) {
+			const key = assetKey(entry);
+			if (key === "") continue;
+			if (!assetMap.has(key)) assetMap.set(key, normalizeAsset(entry, delegationId, stage, updatedAt));
+		}
+	}
+	if (assetMap.size > 0) {
+		const assetsDir = join(root, "assets");
+		await mkdir(assetsDir, { recursive: true });
+		const canonical = [...assetMap.values()].sort((a, b) => a.value.localeCompare(b.value));
+		await writeFile(join(assetsDir, "assets.json"), `${JSON.stringify(canonical, null, 2)}\n`, "utf8");
+	}
+	const serviceMap = /* @__PURE__ */ new Map();
+	for (let index = 0; index < delegationDirs.length; index += 1) {
+		const delegationId = delegationIds[index] ?? `D-${String(index + 1).padStart(3, "0")}`;
+		const entries = readJsonArray(join(delegationDirs[index], "services.json"));
+		for (const entry of entries) {
+			const key = serviceKey(entry);
+			if (key === "") continue;
+			if (!serviceMap.has(key)) serviceMap.set(key, normalizeService(entry, delegationId, stage, updatedAt));
+		}
+	}
+	if (serviceMap.size > 0) {
+		const assetsDir = join(root, "assets");
+		await mkdir(assetsDir, { recursive: true });
+		const canonical = [...serviceMap.values()].sort((a, b) => `${a.asset}:${a.protocol}:${a.port}`.localeCompare(`${b.asset}:${b.protocol}:${b.port}`));
+		await writeFile(join(assetsDir, "services.json"), `${JSON.stringify(canonical, null, 2)}\n`, "utf8");
+	}
+}
+//#endregion
+//#region src/pentest/findings.ts
+/**
+* findings.ts — PentestRun canonical finding registry promotion.
+*
+* Workers produce `artifacts/findings.md` (human-readable) and optionally
+* `artifacts/findings.json` (structured) inside their delegation directories.
+* On stage advance, the host aggregates every delegation's findings from the
+* completed stage, indexes them in `findings/findings.json`, and writes each
+* delegation's finding detail as `findings/<delegationId>-findings.md` with a
+* provenance header. Worker-local artifacts are never moved.
+*
+* Dedup: within a single stage, findings from the same delegation are kept
+* as one entry (the delegation's findings.md is the authoritative unit).
+* Exploitation updates to an existing finding are reflected in the index
+* when the exploitation stage advances.
+*/
+/**
+* Aggregate findings from every delegation directory in the completed stage,
+* index them in `findings/findings.json`, and write each delegation's detail
+* as `findings/<delegationId>-findings.md`.
+*
+* If a delegation produces `artifacts/findings.md`, its content is copied
+* into the canonical detail file with a provenance header.
+*/
+async function promoteFindings(projectDir, stage, delegationDirs, delegationIds) {
+	const root = workspaceDir(projectDir);
+	const findingsDir = join(root, "findings");
+	await mkdir(findingsDir, { recursive: true });
+	const updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+	const entries = [];
+	const existingIndex = loadExistingIndex(findingsDir);
+	for (let index = 0; index < delegationDirs.length; index += 1) {
+		const delegationId = delegationIds[index] ?? `D-${String(index + 1).padStart(3, "0")}`;
+		const delegationDir = delegationDirs[index];
+		const sourceFile = join(delegationDir, "findings.md");
+		if (!existsSync(sourceFile)) continue;
+		const content = readFileSync(sourceFile, "utf8").trim();
+		if (content === "") continue;
+		const detailFile = `${delegationId}-findings.md`;
+		const detailPath = join(findingsDir, detailFile);
+		await writeFile(detailPath, `# ${delegationId} Findings\n\n**Source Stage**: ${stage}\n**Updated**: ${updatedAt}\n\n---\n\n${content}\n`, "utf8");
+		const existing = existingIndex.get(delegationId);
+		if (existing !== void 0) existingIndex.set(delegationId, {
+			...existing,
+			updatedAt,
+			sourceStage: stage
+		});
+		else entries.push({
+			sourceDelegationId: delegationId,
+			sourceStage: stage,
+			detailFile,
+			updatedAt
+		});
+	}
+	for (const [id, entry] of existingIndex) if (!delegationIds.includes(id)) entries.push(entry);
+	entries.sort((a, b) => a.sourceDelegationId.localeCompare(b.sourceDelegationId));
+	if (entries.length > 0) await writeFile(join(findingsDir, "findings.json"), `${JSON.stringify(entries, null, 2)}\n`, "utf8");
+}
+function loadExistingIndex(findingsDir) {
+	const file = join(findingsDir, "findings.json");
+	if (!existsSync(file)) return /* @__PURE__ */ new Map();
+	try {
+		const parsed = JSON.parse(readFileSync(file, "utf8"));
+		if (!Array.isArray(parsed)) return /* @__PURE__ */ new Map();
+		const map = /* @__PURE__ */ new Map();
+		for (const entry of parsed) if (entry !== null && typeof entry === "object" && typeof entry.sourceDelegationId === "string") {
+			const id = entry.sourceDelegationId;
+			map.set(id, entry);
+		}
+		return map;
+	} catch {
+		return /* @__PURE__ */ new Map();
+	}
+}
+//#endregion
+//#region src/tools.ts
+const ROOT_TOOL_SCHEMAS = {
+	pentester_delegate: {
+		type: "object",
+		additionalProperties: false,
+		required: ["assignments"],
+		properties: { assignments: {
+			type: "array",
+			minItems: 1,
+			description: "Parallel delegations; each spawns one continuable worker session with its own deliverable directory.",
+			items: {
+				type: "object",
+				additionalProperties: false,
+				required: [
+					"agent",
+					"objective",
+					"task_prompt"
+				],
+				properties: {
+					agent: {
+						type: "string",
+						description: "AgentProfile id attached to the current Stage (see Available AgentProfiles in your run state)."
+					},
+					objective: {
+						type: "string",
+						description: "One-line objective (recorded in run.json)."
+					},
+					task_prompt: {
+						type: "string",
+						description: "Full task context for the worker: known facts, gaps to close, references to existing deliverables."
+					}
+				}
+			}
+		} }
+	},
+	pentester_cancel_delegation: {
+		type: "object",
+		additionalProperties: false,
+		required: ["delegation_id"],
+		properties: {
+			delegation_id: { type: "string" },
+			reason: { type: "string" }
+		}
+	},
+	pentester_advance_stage: {
+		type: "object",
+		additionalProperties: false,
+		required: ["summary"],
+		properties: {
+			summary: {
+				type: "string",
+				description: "Stage handoff summary (what was done, confirmed, key results, next-stage focus). The host writes it to stages/<stage>/summary.md verbatim and never parses it."
+			},
+			run: {
+				type: "object",
+				additionalProperties: false,
+				description: "Only for the FIRST advance of a new run (bootstrap): records the user-confirmed targets/RoE and output language. The host creates the PentestRun and completes pre-engagement.",
+				properties: {
+					targets: {
+						type: "array",
+						items: { type: "string" }
+					},
+					rules_of_engagement: { type: "string" },
+					language: {
+						type: "string",
+						description: "Output language for host-generated files (e.g. zh-CN, en)."
+					}
+				}
+			}
+		}
+	},
+	pentester_rollback_stage: {
+		type: "object",
+		additionalProperties: false,
+		required: ["stage", "reason"],
+		properties: {
+			stage: {
+				type: "string",
+				description: "Domain StageId to roll back to (e.g. intelligence-gathering); its completed checkpoint becomes the new timeline root."
+			},
+			reason: {
+				type: "string",
+				description: "Why the stage result needs rework."
+			}
+		}
+	}
+};
+function requireRootCaller(exec) {
+	const caller = trustedCallerFromExec(exec);
+	if (caller === void 0 || !caller.isPentesterRoot) throw new Error("this tool is reserved for the Pentester Root Agent");
+	if (caller.cwd === void 0) throw new Error("Root session has no trusted workspace cwd");
+	return caller;
+}
+function agentOf(exec) {
+	if (exec === null || typeof exec !== "object") return void 0;
+	const agent = exec.agent;
+	return agent !== null && typeof agent === "object" ? agent : void 0;
+}
+function signalOf(exec) {
+	if (exec !== null && typeof exec === "object") {
+		const signal = exec.signal;
+		if (signal instanceof AbortSignal) return signal;
+	}
+	return new AbortController().signal;
+}
+function registerRootTools(tools, deps) {
+	const output = {
+		schema: {
+			type: "object",
+			additionalProperties: true
+		},
+		render: (_args, value) => [{
+			type: "text",
+			text: JSON.stringify(value)
+		}]
+	};
+	tools.register({
+		name: "pentester_delegate",
+		description: ROOT_TOOL_DESCRIPTIONS.pentester_delegate,
+		parameters: ROOT_TOOL_SCHEMAS.pentester_delegate,
+		output,
+		execute: (args, exec) => delegate(deps, args, exec)
+	});
+	tools.register({
+		name: "pentester_cancel_delegation",
+		description: ROOT_TOOL_DESCRIPTIONS.pentester_cancel_delegation,
+		parameters: ROOT_TOOL_SCHEMAS.pentester_cancel_delegation,
+		output,
+		execute: (args, exec) => cancel(deps, args, exec)
+	});
+	tools.register({
+		name: "pentester_advance_stage",
+		description: ROOT_TOOL_DESCRIPTIONS.pentester_advance_stage,
+		parameters: ROOT_TOOL_SCHEMAS.pentester_advance_stage,
+		output,
+		execute: (args, exec) => advance(deps, args, exec)
+	});
+	tools.register({
+		name: "pentester_rollback_stage",
+		description: ROOT_TOOL_DESCRIPTIONS.pentester_rollback_stage,
+		parameters: ROOT_TOOL_SCHEMAS.pentester_rollback_stage,
+		output,
+		execute: (args, exec) => rollback(deps, args, exec)
+	});
+	return [
+		"pentester_delegate",
+		"pentester_cancel_delegation",
+		"pentester_advance_stage",
+		"pentester_rollback_stage"
+	];
+}
+const ROOT_TOOL_DESCRIPTIONS = {
+	pentester_delegate: "Creates a new long-lived continuable PTES worker. IMPORTANT: Before calling this tool, first tell the user which worker you are creating, what it will do, and why the current PTES stage needs it. Do not call this tool silently. Each call creates a NEW durable child Session. For follow-up work with an existing child, do not call pentester_delegate again; use send_message through the continuation interface.",
+	pentester_cancel_delegation: "Close a PTES Delegation. Interrupts the live child turn if active, then marks the Delegation as closed. The child Session transcript is preserved for future reference. Use send_message/interrupt_agent for follow-up or interruption without closing.",
+	pentester_advance_stage: "Advance to the next PTES stage after you judge the exit criteria satisfied. The host only verifies linear order and that no active/starting delegations remain. On the FIRST call (no PentestRun yet) pass run (targets / rules_of_engagement / language) + summary: the host bootstraps the workspace, run.json, target files, git and completes pre-engagement.",
+	pentester_rollback_stage: "Roll the timeline back to a completed stage checkpoint and start a rework branch from the next stage. Closes active delegations, saves a WIP backup branch, never rewrites history."
+};
+async function delegate(deps, args, exec) {
+	const caller = requireRootCaller(exec);
+	const projectDir = caller.cwd;
+	const parent = agentOf(exec);
+	if (parent === void 0) throw new Error("pentester_delegate requires a calling agent (exec.agent was undefined)");
+	const signal = signalOf(exec);
+	const run = await requireRun(caller, deps);
+	const assignments = parseAssignments(args.assignments);
+	const created = await deps.delegations.delegate({
+		projectDir,
+		run,
+		profiles: deps.profiles,
+		rootSessionId: caller.sessionId,
+		parent,
+		signal
+	}, assignments);
+	return {
+		...rootState(run, deps.profiles),
+		created: created.map((d) => ({
+			id: d.id,
+			agent: d.agentId,
+			status: d.status,
+			...d.sessionId === void 0 ? {} : { childSessionId: d.sessionId }
+		}))
+	};
+}
+async function cancel(deps, args, exec) {
+	const caller = requireRootCaller(exec);
+	const run = await requireRun(caller, deps);
+	const delegationId = typeof args.delegation_id === "string" ? args.delegation_id : "";
+	const reason = typeof args.reason === "string" ? args.reason : void 0;
+	const cancelled = await deps.delegations.cancel({
+		projectDir: caller.cwd,
+		run
+	}, delegationId, reason);
+	return {
+		cancelled: {
+			id: cancelled.id,
+			status: cancelled.status
+		},
+		...rootState(run, deps.profiles)
+	};
+}
+async function advance(deps, args, exec) {
+	const projectDir = requireRootCaller(exec).cwd;
+	const summary = typeof args.summary === "string" ? args.summary : "";
+	if (summary.trim() === "") throw new Error("pentester_advance_stage requires a non-empty summary (stage handoff text)");
+	let run = await resolvePentestRun(projectDir);
+	if (run === null) run = await bootstrapRun(deps, projectDir, parseRunInfo(args.run));
+	else await initWorkspace(projectDir, { language: run.language });
+	if (run.status === "completed" || run.currentStage === null) throw new Error("PentestRun is already completed; no stage to advance");
+	const previous = run.currentStage;
+	if (deps.delegations.stageHasPendingWork(run, previous)) throw new Error(`stage ${previous} still has active or starting delegations; close them with pentester_cancel_delegation before advancing`);
+	await deps.syncWorkspace(projectDir, run).catch(() => void 0);
+	const stageDelegations = run.delegations.filter((d) => d.stageId === previous);
+	const delegationDirs = stageDelegations.map((d) => d.workspaceDir);
+	const delegationIds = stageDelegations.map((d) => d.id);
+	await promoteAssets(projectDir, previous, delegationDirs, delegationIds);
+	await promoteFindings(projectDir, previous, delegationDirs, delegationIds);
+	for (const delegation of stageDelegations) await promoteDeliverables(projectDir, delegation.workspaceDir);
+	await writeStageSummary(projectDir, previous, summary);
+	const target = advanceStage(run, summary);
+	await saveRun(projectDir, run);
+	const tag = await deps.git.checkpointStage(projectDir, previous);
+	await appendEvent(projectDir, {
+		ts: (/* @__PURE__ */ new Date()).toISOString(),
+		type: "stage.completed",
+		data: {
+			stage: previous,
+			tag,
+			next: target
+		}
+	});
+	await deps.pushWorkspace(projectDir, run).catch(() => void 0);
+	return {
+		previous,
+		...target === null ? { completed: true } : { next: target },
+		tag,
+		...rootState(run, deps.profiles)
+	};
+}
+async function rollback(deps, args, exec) {
+	const caller = requireRootCaller(exec);
+	const projectDir = caller.cwd;
+	const run = await requireRun(caller, deps);
+	const stageArg = typeof args.stage === "string" ? args.stage : "";
+	const reason = typeof args.reason === "string" ? args.reason : "";
+	if (!isStageId(stageArg)) throw new Error(`pentester_rollback_stage: unknown stage "${stageArg}"`);
+	const next = nextStage(stageArg);
+	if (next === void 0) throw new Error(`pentester_rollback_stage: cannot roll back to the final stage ${stageArg}`);
+	if (!run.stageHistory.some((entry) => entry.stage === stageArg)) throw new Error(`pentester_rollback_stage: stage ${stageArg} has no completed checkpoint on this timeline`);
+	const active = run.delegations.filter((d) => d.status === "active" || d.status === "starting");
+	for (const delegation of active) await deps.delegations.cancel({
+		projectDir,
+		run
+	}, delegation.id, "rolled back by Root");
+	let backup;
+	if (await deps.git.hasChanges(projectDir)) backup = await deps.git.createBackupBranch(projectDir, stageArg);
+	const checkpoint = await deps.git.findStageCheckpoint(projectDir, stageArg);
+	if (checkpoint === void 0) throw new Error(`pentester_rollback_stage: no checkpoint commit found for stage ${stageArg}`);
+	const branch = await deps.git.createReworkBranch(projectDir, checkpoint, stageDir(next));
+	const authoritativeRun = await resolvePentestRun(projectDir);
+	if (authoritativeRun === null) throw new Error("pentester_rollback_stage: run.json disappeared after checkout — this is a bug");
+	await appendEvent(projectDir, {
+		ts: (/* @__PURE__ */ new Date()).toISOString(),
+		type: "stage.rollback",
+		data: {
+			stage: stageArg,
+			checkpoint,
+			branch,
+			backup,
+			reason
+		}
+	});
+	await deps.pushWorkspace(projectDir, authoritativeRun).catch(() => void 0);
+	return {
+		reopenedStage: stageArg,
+		currentStage: stageArg,
+		branch,
+		...backup === void 0 ? {} : { backupBranch: backup },
+		reason,
+		...rootState(authoritativeRun, deps.profiles)
+	};
+}
+const NO_RUN_MESSAGE = "No PentestRun exists. Complete pre-engagement and call pentester_advance_stage first — pass run (targets / rules_of_engagement / language) + summary to initialize the run.";
+async function requireRun(caller, _deps) {
+	const projectDir = caller.cwd;
+	await initWorkspace(projectDir, { language: void 0 });
+	const run = await resolvePentestRun(projectDir);
+	if (run === null) throw new Error(NO_RUN_MESSAGE);
+	return run;
+}
+async function bootstrapRun(deps, projectDir, runInfo) {
+	if (runInfo === void 0 || runInfo.targets === void 0 || runInfo.targets.length === 0) throw new Error(NO_RUN_MESSAGE);
+	const primary = runInfo.targets[0];
+	await initWorkspace(projectDir, {
+		target: primary,
+		language: runInfo.language,
+		scope: renderScope(runInfo.targets),
+		roe: runInfo.rulesOfEngagement
+	});
+	await writePreEngagementInput(projectDir, {
+		targets: runInfo.targets,
+		scope: renderScope(runInfo.targets),
+		roe: runInfo.rulesOfEngagement ?? "Standard RoE",
+		language: runInfo.language ?? "zh-CN"
+	});
+	const created = {
+		schemaVersion: 1,
+		id: crypto.randomUUID(),
+		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+		targets: [...runInfo.targets],
+		...runInfo.rulesOfEngagement === void 0 ? {} : { rulesOfEngagement: runInfo.rulesOfEngagement },
+		...runInfo.language === void 0 ? {} : { language: runInfo.language },
+		status: "active",
+		currentStage: "pre-engagement",
+		stageHistory: [{
+			stage: "pre-engagement",
+			enteredAt: (/* @__PURE__ */ new Date()).toISOString()
+		}],
+		delegations: []
+	};
+	await saveRun(projectDir, created);
+	await deps.git.init(projectDir, primary);
+	return created;
+}
+function renderScope(targets) {
+	return [
+		"# Scope",
+		"",
+		`- Primary Target: ${targets[0] ?? ""}`,
+		...targets.slice(1).map((target) => `- ${target}`),
+		""
+	].join("\n");
+}
+function parseAssignments(value) {
+	if (!Array.isArray(value) || value.length === 0) throw new Error("assignments must be a non-empty array");
+	return value.map((entry) => {
+		if (entry === null || typeof entry !== "object") throw new Error("invalid assignment");
+		const record = entry;
+		if (typeof record.agent !== "string" || typeof record.objective !== "string" || typeof record.task_prompt !== "string") throw new Error("assignment requires agent, objective and task_prompt");
+		return {
+			agent: record.agent,
+			objective: record.objective,
+			taskPrompt: record.task_prompt
+		};
+	});
+}
+function parseRunInfo(value) {
+	if (value === void 0) return void 0;
+	if (value === null || typeof value !== "object") throw new Error("invalid run info");
+	const record = value;
+	const targets = Array.isArray(record.targets) ? record.targets.map(String) : void 0;
+	const roe = typeof record.rules_of_engagement === "string" ? record.rules_of_engagement : void 0;
+	const language = typeof record.language === "string" && record.language.length > 0 ? record.language : void 0;
+	return {
+		...targets === void 0 ? {} : { targets },
+		...roe === void 0 ? {} : { rulesOfEngagement: roe },
+		...language === void 0 ? {} : { language }
+	};
+}
+function rootState(run, profiles) {
+	const stage = run.currentStage === null ? void 0 : stageDefinition(run.currentStage);
+	const allowedProfiles = (stage?.agentIds ?? []).map((id) => profiles.get(id)).filter((profile) => profile !== void 0).map((profile) => ({
+		id: profile.id,
+		name: profile.name
+	}));
+	return {
+		run: {
+			currentStage: run.currentStage,
+			status: run.status ?? "active",
+			targets: run.targets
+		},
+		stage: stage === void 0 ? null : {
+			id: stage.id,
+			name: stage.name,
+			goal: stage.goal,
+			exitCriteria: stage.exitCriteria,
+			allowedProfiles
+		},
+		delegations: run.delegations.map((d) => ({
+			id: d.id,
+			stage: d.stageId,
+			agent: d.agentId,
+			status: d.status,
+			...d.sessionId === void 0 ? {} : { childSessionId: d.sessionId },
+			...d.finishedAt === void 0 ? {} : { finishedAt: d.finishedAt }
+		}))
+	};
+}
+//#endregion
+//#region src/profiles.ts
+/**
+* profiles.ts — AgentProfile registry loaded from agents/<id>/profile.yml.
+* The YAML subset is fixed by this schema: scalar keys, one block scalar
+* (`systemPrompt: |`), and two string lists. No external yaml dependency.
+*/
+var ProfileError = class extends Error {};
+function parseProfileYaml(text, file) {
+	const lines = text.split("\n");
+	const scalars = /* @__PURE__ */ new Map();
+	const lists = /* @__PURE__ */ new Map();
+	let key;
+	let block;
+	let listKey;
+	const closeBlock = () => {
+		if (key !== void 0 && block !== void 0) scalars.set(key, block.join("\n").replace(/\n+$/, ""));
+		key = void 0;
+		block = void 0;
+	};
+	for (const raw of lines) {
+		if (block !== void 0 && (raw.startsWith("  ") || raw.trim() === "")) {
+			block.push(raw.replace(/^ {2}/, ""));
+			continue;
+		}
+		closeBlock();
+		const line = raw.trimEnd();
+		if (line.trim() === "" || line.trim().startsWith("#")) continue;
+		const listItem = /^\s*-\s+(.*)$/.exec(line);
+		if (listItem !== null && listKey !== void 0) {
+			lists.get(listKey).push(listItem[1].trim());
+			continue;
+		}
+		const pair = /^([A-Za-z][A-Za-z0-9]*):\s*(.*)$/.exec(line);
+		if (pair === null) throw new ProfileError(`${file}: unparsable line: ${line}`);
+		const [, name, value] = pair;
+		if (value === "|" || value === "|-" || value === ">") {
+			key = name;
+			block = [];
+			listKey = void 0;
+			continue;
+		}
+		if (value === "") {
+			listKey = name;
+			lists.set(name, []);
+			continue;
+		}
+		scalars.set(name, value.trim());
+		listKey = void 0;
+	}
+	closeBlock();
+	const id = scalars.get("id");
+	const name = scalars.get("name");
+	const description = scalars.get("description");
+	const systemPrompt = scalars.get("systemPrompt");
+	if (id === void 0 || name === void 0 || systemPrompt === void 0) throw new ProfileError(`${file}: id, name and systemPrompt are required`);
+	return {
+		id,
+		name,
+		description: description ?? "",
+		systemPrompt,
+		skills: lists.get("skills") ?? [],
+		mcpServers: lists.get("mcpServers") ?? [],
+		...scalar(scalars, "model") === void 0 ? {} : { model: scalar(scalars, "model") }
+	};
+}
+function scalar(scalars, key) {
+	const value = scalars.get(key);
+	return value !== void 0 && value.length > 0 ? value : void 0;
+}
+function loadAgentProfiles(root) {
+	const profiles = /* @__PURE__ */ new Map();
+	let entries;
+	try {
+		entries = readdirSync(root, { withFileTypes: true });
+	} catch {
+		return profiles;
+	}
+	for (const entry of entries) {
+		if (!entry.isDirectory()) continue;
+		const file = join(root, entry.name, "profile.yml");
+		let text;
+		try {
+			text = readFileSync(file, "utf8");
+		} catch {
+			continue;
+		}
+		const profile = parseProfileYaml(text, file);
+		if (profiles.has(profile.id)) throw new ProfileError(`duplicate AgentProfile id: ${profile.id}`);
+		profiles.set(profile.id, profile);
+	}
+	return profiles;
+}
+//#endregion
+//#region src/docker/host.ts
+/**
+* docker/host.ts — docker 连接层：host 解析（本地优先回退链）、连接探测、
+* 引擎连接构造。与执行细节无关，可独立测试。
+*/
+const DEFAULT_UNIX_SOCKET = "/var/run/docker.sock";
+var DockerError = class extends Error {};
+function parseDockerHost(value) {
+	const raw = value.trim();
+	if (raw === "") throw new DockerError("empty docker host");
+	if (raw.startsWith("unix://")) return { socketPath: raw.slice(7) || "/var/run/docker.sock" };
+	if (raw.startsWith("/") && !raw.includes("://")) return { socketPath: raw };
+	for (const scheme of [
+		"tcp://",
+		"http://",
+		"https://"
+	]) {
+		if (!raw.startsWith(scheme)) continue;
+		const protocol = scheme === "tcp://" ? "http" : scheme.replace("://", "");
+		const [host, portText] = raw.slice(scheme.length).replace(/\/.*$/, "").split(":");
+		if (host === void 0 || host === "") throw new DockerError(`docker host missing hostname: ${raw}`);
+		const port = portText === void 0 ? 2375 : Number(portText);
+		if (!Number.isInteger(port)) throw new DockerError(`docker host invalid port: ${raw}`);
+		return {
+			protocol,
+			host,
+			port
+		};
+	}
+	if (/^[^/:]+:\d+$/.test(raw)) {
+		const [host, portText] = raw.split(":");
+		return {
+			protocol: "http",
+			host,
+			port: Number(portText)
+		};
+	}
+	throw new DockerError(`unsupported docker host: ${raw} (use unix:///path, tcp://host:port or http://host:port)`);
+}
+/**
+* 本地 Docker socket 候选路径（按平台常见布局，先命中先用）。
+* macOS：OrbStack / Docker Desktop；Linux：系统 socket。
+*/
+function localSocketCandidates() {
+	const home = process.env.HOME ?? "";
+	return [DEFAULT_UNIX_SOCKET, ...home === "" ? [] : [join(home, ".orbstack", "run", "docker.sock"), join(home, ".docker", "run", "docker.sock")]];
+}
+/**
+* 解析全局 docker host。优先级：
+*   1. 显式配置（settings.json / 插件配置）
+*   2. 本地 socket（候选路径中第一个存在的 —— “未指定优先使用本地的”）
+*   3. DOCKER_HOST 环境变量
+*   4. 默认 unix socket
+*/
+function resolveDockerHost(configured, deps = {}) {
+	if (configured !== void 0 && configured.trim() !== "") return parseDockerHost(configured);
+	return resolveDockerHostWithSource("", "", deps).host;
+}
+/**
+* 带来源的完整解析。优先级：
+*   settings.json（Settings UI 保存的显式配置）
+*   > 插件配置 dockerHost
+*   > 本地 socket（自动发现 —— “未指定优先使用本地的”）
+*   > DOCKER_HOST 环境变量
+*   > 默认 unix socket
+*/
+function resolveDockerHostWithSource(settingsHost, configHost, deps = {}) {
+	if (settingsHost.trim() !== "") return {
+		host: parseDockerHost(settingsHost),
+		source: "settings"
+	};
+	if (configHost.trim() !== "") return {
+		host: parseDockerHost(configHost),
+		source: "config"
+	};
+	const exists = deps.socketExists ?? existsSync;
+	const local = localSocketCandidates().find((candidate) => exists(candidate));
+	if (local !== void 0) return {
+		host: { socketPath: local },
+		source: "local"
+	};
+	const env = process.env.DOCKER_HOST;
+	if (env !== void 0 && env.trim() !== "") return {
+		host: parseDockerHost(env),
+		source: "env"
+	};
+	return {
+		host: { socketPath: DEFAULT_UNIX_SOCKET },
+		source: "default"
+	};
+}
+/**
+* 探测一个 docker host 是否可用（GET /version）。engine 可注入用于测试。
+*/
+async function probeDockerHost(host, engine) {
+	const target = engine ?? engineFromOptions({ host });
+	const endpoint = formatDockerHost(host);
+	try {
+		const info = await target.version();
+		return {
+			reachable: true,
+			endpoint,
+			...typeof info.Version === "string" ? { version: info.Version } : {},
+			...typeof info.ApiVersion === "string" ? { apiVersion: info.ApiVersion } : {},
+			...typeof info.Os === "string" ? { os: info.Os } : {}
+		};
+	} catch (error) {
+		return {
+			reachable: false,
+			endpoint,
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+function isRemoteHost(host) {
+	return host.protocol !== void 0;
+}
+function formatDockerHost(host) {
+	if (host.socketPath !== void 0) return `unix://${host.socketPath}`;
+	return `${host.protocol}://${host.host}:${host.port}`;
+}
+function engineFromOptions(options) {
+	const host = options.host;
+	const connection = host === void 0 || host.socketPath !== void 0 ? { socketPath: host?.socketPath ?? "/var/run/docker.sock" } : {
+		protocol: host.protocol,
+		host: host.host,
+		port: host.port
+	};
+	return new Dockerode(connection);
+}
+//#endregion
+//#region src/docker/images.ts
+/**
+* docker/images.ts — 镜像层：Toolbox 白名单、inspect 原语。
+* 函数式无状态，引擎实例由调用方传入。
+*/
+const TOOLBOX_ALLOWLIST = [{
+	name: "kali",
+	image: "fb0sh/dsh-pentester-kali:latest"
+}];
+function toolboxFor(name, overrides) {
+	const spec = TOOLBOX_ALLOWLIST.find((toolbox) => toolbox.name === name);
+	if (spec === void 0) throw new DockerError(`unknown toolbox: ${name}`);
+	const image = overrides?.[name];
+	return image === void 0 ? spec : {
+		...spec,
+		image
+	};
+}
+/** 镜像是否已就绪（本地存在）。 */
+async function imageReady(engine, image) {
+	try {
+		await engine.getImage(image).inspect();
+		return true;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/docker/runtime.ts
+/**
+* docker/runtime.ts — 执行运行时：硬化 HostConfig、容器/卷生命周期、
+* exec demux、volume→本地镜像同步、工具目录读取；镜像原语委托给
+* docker/images.ts。不变量见 docs/plan.md 与 ADR 0007。
+*/
+const MAX_EXEC_TIMEOUT_MS = 6e5;
+const MAX_OUTPUT_CHARS = 2e5;
+const BLOCKED_ENV_PREFIXES = ["DOCKER", "DSH_"];
+const CAP_ADD_ALLOWLIST = [
+	"NET_ADMIN",
+	"NET_RAW",
+	"NET_BIND_SERVICE"
+];
+/** Toolbox container name: dsh-pentester-xxxxxxxx (8 lowercase hex). */
+function createToolboxContainerName() {
+	return `dsh-pentester-${randomBytes(4).toString("hex")}`;
+}
+/** 固定注入 Toolbox 容器的代理环境变量（容器内部代理服务）。 */
+const FIXED_CONTAINER_ENV = ["HTTP_PROXY=http://127.0.0.1:8080", "HTTPS_PROXY=http://127.0.0.1:8080"];
+/** Defense in depth: validate the HostConfig we are about to submit. */
+function assertSafeHostConfig(hostConfig) {
+	if (hostConfig.Privileged === true) throw new DockerError("privileged containers are forbidden");
+	if (hostConfig.NetworkMode === "host") throw new DockerError("host network is forbidden");
+	if (hostConfig.PidMode === "host") throw new DockerError("host pid namespace is forbidden");
+	if (hostConfig.IpcMode === "host") throw new DockerError("host ipc namespace is forbidden");
+	const binds = hostConfig.Binds;
+	if (Array.isArray(binds)) for (const bind of binds) {
+		if (typeof bind !== "string") continue;
+		const source = bind.split(":")[0];
+		if (source === "/" || source.endsWith("/docker.sock")) throw new DockerError(`forbidden bind source: ${source}`);
+	}
+	const capAdd = hostConfig.CapAdd;
+	if (Array.isArray(capAdd)) {
+		for (const cap of capAdd) if (typeof cap === "string" && !CAP_ADD_ALLOWLIST.includes(cap)) throw new DockerError(`capability ${cap} is not in the allowlist`);
+	}
+}
+function safeEnv(env) {
+	const safe = {};
+	for (const [key, value] of Object.entries(env ?? {})) {
+		if (BLOCKED_ENV_PREFIXES.some((prefix) => key.startsWith(prefix))) throw new DockerError(`environment key ${key} is not allowed`);
+		safe[key] = value;
+	}
+	return safe;
+}
+function volumeNameFor(projectDir) {
+	return `dsh-pentester-ws-${createHash("sha1").update(projectDir).digest("hex").slice(0, 12)}`;
+}
+function localMirrorDir(projectDir) {
+	return workspaceDir(projectDir);
+}
+var DockerRuntime = class {
+	engine;
+	host;
+	imageOverrides;
+	ensuring = /* @__PURE__ */ new Map();
+	volumes = /* @__PURE__ */ new Set();
+	syncing = /* @__PURE__ */ new Map();
+	pushing = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.engine = options.engine ?? engineFromOptions(options);
+		this.host = options.host ?? { socketPath: "/var/run/docker.sock" };
+		this.imageOverrides = options.imageOverrides;
+	}
+	/** 更新 toolbox 镜像覆盖（Settings UI 保存后热生效）。 */
+	updateToolboxImage(toolbox, image) {
+		const next = { ...this.imageOverrides ?? {} };
+		if (image === void 0 || image.trim() === "") delete next[toolbox];
+		else next[toolbox] = image.trim();
+		this.imageOverrides = next;
+	}
+	/**
+	* 切换 docker host（Settings UI 保存后调用）。重建底层连接并清空
+	* 卷/容器缓存；卷与容器按标签在新 daemon 上重新发现。
+	*/
+	updateHost(host) {
+		this.engine = engineFromOptions({ host });
+		this.host = host;
+		this.volumes.clear();
+		this.ensuring.clear();
+	}
+	get endpoint() {
+		return formatDockerHost(this.host);
+	}
+	get remote() {
+		return isRemoteHost(this.host);
+	}
+	async ensureImage(toolboxName) {
+		const spec = toolboxFor(toolboxName, this.imageOverrides);
+		try {
+			await this.engine.getImage(spec.image).inspect();
+			return spec;
+		} catch {
+			throw new DockerError(`toolbox image ${spec.image} not found; ensure the image exists on the Docker host`);
+		}
+	}
+	/**
+	* One docker volume per project (all stages, all containers of the project
+	* mount the same volume at /workspace). The container is per PentestRun and
+	* reused while running.
+	*/
+	async ensureRunContainer(options) {
+		const volume = this.remote ? await this.ensureWorkspaceVolume(options.projectDir) : void 0;
+		const label = "dsh.pentester.run";
+		const existing = await this.engine.listContainers({
+			all: true,
+			filters: { label: [`${label}=${options.runId}`] }
+		});
+		for (const match of existing) {
+			if (match.State === "running") return String(match.Id);
+			await this.engine.getContainer(String(match.Id)).remove({ force: true }).catch(() => void 0);
+		}
+		let ensure = this.ensuring.get(options.runId);
+		if (ensure === void 0) {
+			ensure = this.createRunContainer(options, volume, label);
+			this.ensuring.set(options.runId, ensure);
+			ensure.finally(() => this.ensuring.delete(options.runId));
+		}
+		const containerId = await ensure;
+		if (this.remote && volume?.created === true) await this.pushLocalMirror(containerId, options.projectDir).catch(() => void 0);
+		return containerId;
+	}
+	/**
+	* 远程 workspace volume：存在则复用（§24 recovery 优先级），不存在才创建。
+	* `created: true` 表示本轮新建 —— 调用方据此决定是否从本地恢复数据。
+	*/
+	async ensureWorkspaceVolume(projectDir) {
+		const volume = volumeNameFor(projectDir);
+		if (this.volumes.has(volume)) return {
+			name: volume,
+			created: false
+		};
+		if (await this.engine.getVolume(volume).inspect().then(() => true, () => false)) {
+			this.volumes.add(volume);
+			return {
+				name: volume,
+				created: false
+			};
+		}
+		const created = await this.engine.createVolume({
+			Name: volume,
+			Labels: {
+				"dsh.pentester.managed": "true",
+				"dsh.pentester.project": volume
+			}
+		});
+		this.volumes.add(created.Name);
+		return {
+			name: created.Name,
+			created: true
+		};
+	}
+	async createRunContainer(options, volume, label) {
+		const hostConfig = {
+			Mounts: [volume === void 0 ? {
+				Type: "bind",
+				Source: localMirrorDir(options.projectDir),
+				Target: "/workspace"
+			} : {
+				Type: "volume",
+				Source: volume.name,
+				Target: "/workspace"
+			}],
+			CapAdd: [...CAP_ADD_ALLOWLIST],
+			AutoRemove: false
+		};
+		assertSafeHostConfig(hostConfig);
+		const containerName = createToolboxContainerName();
+		const container = await this.engine.createContainer({
+			name: containerName,
+			Image: options.toolbox.image,
+			Env: [...FIXED_CONTAINER_ENV],
+			Labels: {
+				[label]: options.runId,
+				"dsh.pentester.managed": "true"
+			},
+			HostConfig: hostConfig,
+			WorkingDir: "/workspace",
+			Tty: false,
+			OpenStdin: false,
+			Cmd: ["sleep", "infinity"]
+		});
+		await container.start();
+		this.exec(container.id, { argv: ["/pentester/bin/record-traffic.sh"] }).catch(() => void 0);
+		return container.id;
+	}
+	catalogs = /* @__PURE__ */ new Map();
+	/**
+	* 读取镜像内的工具目录（/pentester/tools.json），按 containerId 缓存一次。
+	* 供 worker prompt 注入“有什么工具、怎么用”的摘要。
+	*/
+	async readToolCatalog(containerId) {
+		let cached = this.catalogs.get(containerId);
+		if (cached === void 0) {
+			cached = this.exec(containerId, { argv: ["cat", "/pentester/tools.json"] }).then((result) => JSON.parse(result.stdout));
+			this.catalogs.set(containerId, cached);
+			cached.catch(() => this.catalogs.delete(containerId));
+		}
+		return cached;
+	}
+	async stopRunContainer(runId) {
+		const matches = await this.engine.listContainers({
+			all: true,
+			filters: { label: [`dsh.pentester.run=${runId}`] }
+		});
+		for (const match of matches) await this.engine.getContainer(String(match.Id)).remove({ force: true }).catch(() => void 0);
+	}
+	/**
+	* Delegation settle 的轻量交付读取（§12：settle 不做全量 Workspace sync）。
+	* 远程模式直接通过 exec 读 result.md 并列出 delegation 目录文件；
+	* 本地 bind mount 下 host == container，直接读本地文件系统。
+	* @returns result.md 内容（缺失 undefined）与相对文件清单。
+	*/
+	async readDelegationDelivery(runId, projectDir, delegationDir) {
+		if (!this.remote) {
+			const { readdir, readFile } = await import("node:fs/promises");
+			const { join } = await import("node:path");
+			const walk = async (dir, prefix, out) => {
+				let entries;
+				try {
+					entries = await readdir(dir);
+				} catch {
+					return;
+				}
+				for (const entry of entries) {
+					const abs = join(dir, entry);
+					const rel = prefix === "" ? entry : `${prefix}/${entry}`;
+					if ((await import("node:fs").then((fs) => fs.statSync(abs)).catch(() => void 0))?.isDirectory()) await walk(abs, rel, out);
+					else out.push(rel);
+				}
+			};
+			const files = [];
+			await walk(delegationDir, "", files);
+			let result;
+			try {
+				result = await readFile(join(delegationDir, "result.md"), "utf8");
+			} catch {
+				result = void 0;
+			}
+			return {
+				result,
+				files: files.sort()
+			};
+		}
+		const containerPath = delegationDir.startsWith(projectDir) ? delegationDir.slice(projectDir.length).replace(/\\/g, "/") : "/workspace";
+		const containerId = await this.findRunContainer(runId);
+		if (containerId === void 0) return { files: [] };
+		const files = ((await this.exec(containerId, { argv: [
+			"sh",
+			"-c",
+			`find '${containerPath}' -type f | sort`
+		] }).catch(() => void 0))?.stdout ?? "").split("\n").map((line) => line.trim()).filter((line) => line.startsWith(`${containerPath}/`)).map((line) => line.slice(containerPath.length + 1));
+		const resultText = await this.exec(containerId, { argv: ["cat", `${containerPath}/result.md`] }).catch(() => void 0);
+		return {
+			result: resultText !== void 0 && resultText.exitCode === 0 && resultText.stdout.trim() !== "" ? resultText.stdout : void 0,
+			files
+		};
+	}
+	/**
+	* Push 方向：把宿主侧 workspace/（本地镜像）打包解压进容器 /workspace。
+	* 派发 delegation / advance 后调用，让 Worker 看到宿主写好的
+	* target/、stage scaffold。排除 .git（Worker 不可改 Git）。
+	* 本地 bind mount 下 host == container，无操作直接返回。
+	*/
+	async pushWorkspace(runId, projectDir) {
+		if (!this.remote) return;
+		const key = `${runId}:${projectDir}`;
+		const inFlight = this.pushing.get(key);
+		if (inFlight !== void 0) return inFlight;
+		const task = this.findRunContainer(runId).then((containerId) => containerId === void 0 ? void 0 : this.pushLocalMirror(containerId, projectDir)).finally(() => this.pushing.delete(key));
+		this.pushing.set(key, task);
+		return task;
+	}
+	async pushLocalMirror(containerId, projectDir) {
+		const archive = await packDirectory(localMirrorDir(projectDir), { exclude: (name) => name === ".git" });
+		await this.engine.getContainer(containerId).putArchive(archive, { path: "/workspace" });
+	}
+	/**
+	* Pull the volume's /workspace tree down into the local mirror. Works for
+	* remote daemons; concurrent calls coalesce. Fire-and-forget after writes,
+	* awaited before the Root wake. 本地 bind mount 下 host == container，无操作。
+	* Mirror 语义（§20）：create/update/delete 都反映 —— 容器中不存在的本地
+	* 幽灵文件会被删除。Host 控制态（.git / .dsh-pentester）不参与 pull，
+	* 防止 remote stale state 覆盖宿主 run.json（§19）。
+	*/
+	async syncWorkspace(runId, projectDir) {
+		if (!this.remote) return;
+		const key = `${runId}:${projectDir}`;
+		const inFlight = this.syncing.get(key);
+		if (inFlight !== void 0) return inFlight;
+		const task = this.findRunContainer(runId).then((containerId) => containerId === void 0 ? void 0 : this.pullWorkspace(containerId, projectDir)).finally(() => this.syncing.delete(key));
+		this.syncing.set(key, task);
+		return task;
+	}
+	async findRunContainer(runId) {
+		const matches = await this.engine.listContainers({
+			all: true,
+			filters: {
+				label: [`dsh.pentester.run=${runId}`],
+				status: ["running"]
+			}
+		});
+		return matches.length > 0 ? String(matches[0].Id) : void 0;
+	}
+	async pullWorkspace(containerId, projectDir) {
+		const localDir = localMirrorDir(projectDir);
+		const tarStream = await this.engine.getContainer(containerId).getArchive({ path: "/workspace" });
+		const extract = tar.extract();
+		const done = new Promise((resolve, reject) => {
+			extract.on("error", reject);
+			extract.on("finish", () => resolve());
+		});
+		const seen = /* @__PURE__ */ new Set();
+		extract.on("entry", async (header, entryStream, next) => {
+			try {
+				const relative = normalizeArchivePath(header.name);
+				if (relative !== void 0 && header.type === "file") {
+					seen.add(relative);
+					const target = join(localDir, relative);
+					await mkdir(dirname(target), { recursive: true });
+					const chunks = [];
+					entryStream.on("data", (chunk) => chunks.push(chunk));
+					entryStream.on("end", () => {
+						writeFile(target, Buffer.concat(chunks)).then(next, next);
+					});
+				} else {
+					entryStream.resume();
+					entryStream.on("end", next);
+				}
+			} catch (error) {
+				extract.destroy(error);
+			}
+		});
+		await Promise.all([pipeline(Readable.from(tarStream), extract), done]);
+		await deleteMissing(localDir, seen, /* @__PURE__ */ new Set([".git", ".dsh-pentester"]));
+	}
+	/** 镜像是否已就绪（本地存在）。 */
+	async imageReady(image) {
+		return imageReady(this.engine, image);
+	}
+	async exec(containerId, input) {
+		if (input.argv.length === 0) throw new DockerError("argv must not be empty");
+		const timeoutMs = Math.min(input.timeoutMs ?? 6e5, MAX_EXEC_TIMEOUT_MS);
+		const exec = await this.engine.getContainer(containerId).exec({
+			Cmd: [...input.argv],
+			AttachStdout: true,
+			AttachStderr: true,
+			...input.cwd === void 0 ? {} : { WorkingDir: input.cwd },
+			Env: Object.entries(safeEnv(input.env)).map(([key, value]) => `${key}=${value}`)
+		});
+		const stdoutChunks = [];
+		const stderrChunks = [];
+		const stream = await exec.start({
+			hijack: true,
+			stdin: false
+		});
+		const demux = demuxChunks(stream, stdoutChunks, stderrChunks);
+		let timedOut = false;
+		const timer = setTimeout(() => {
+			timedOut = true;
+			stream.destroy?.(/* @__PURE__ */ new Error("exec timeout"));
+		}, timeoutMs);
+		let exitCode = 0;
+		try {
+			await demux;
+			exitCode = (await exec.inspect().catch(() => void 0))?.ExitCode ?? 0;
+		} finally {
+			clearTimeout(timer);
+		}
+		return {
+			exitCode: timedOut ? 124 : exitCode,
+			stdout: truncate(Buffer.concat(stdoutChunks).toString("utf8")),
+			stderr: truncate(Buffer.concat(stderrChunks).toString("utf8")),
+			timedOut
+		};
+	}
+};
+/** docker cp archive names look like `workspace/stage/D-001/file`; strip the root. */
+function normalizeArchivePath(name) {
+	const cleaned = name.replace(/\\/g, "/").replace(/^\.\//, "");
+	const segments = posix.normalize(cleaned).split("/").filter((segment) => segment !== "" && segment !== ".");
+	if (segments.length === 0) return void 0;
+	if (segments[0] === "workspace") segments.shift();
+	if (segments.some((segment) => segment === "..")) return void 0;
+	return segments.join("/");
+}
+function demuxChunks(stream, stdout, stderr) {
+	return new Promise((resolve, reject) => {
+		let header;
+		stream.on("data", (chunk) => {
+			let buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+			while (buffer.length > 0) {
+				if (header === void 0) {
+					if (buffer.length < 8) {
+						header = buffer;
+						return;
+					}
+					header = buffer.subarray(0, 8);
+					buffer = buffer.subarray(8);
+				}
+				const type = header[0];
+				const length = header.readUInt32BE(4);
+				const available = Math.min(length, buffer.length);
+				const payload = buffer.subarray(0, available);
+				if (type === 2) stderr.push(payload);
+				else stdout.push(payload);
+				buffer = buffer.subarray(available);
+				if (available < length) {
+					header = void 0;
+					return;
+				}
+				header = void 0;
+			}
+		});
+		stream.on("end", () => resolve());
+		stream.on("error", (error) => reject(error instanceof Error ? error : new Error(String(error))));
+	});
+}
+function truncate(text) {
+	return text.length > MAX_OUTPUT_CHARS ? `${text.slice(0, MAX_OUTPUT_CHARS)}\n[output truncated]` : text;
+}
+/**
+* Mirror 语义：递归删除 `root` 下不在 `seen` 中的文件（幽灵文件清理）。
+* `excluded` 顶层目录（如 .git / .dsh-pentester 控制态）整体跳过。
+*/
+async function deleteMissing(root, seen, excluded) {
+	const walk = async (dir, prefix) => {
+		let entries;
+		try {
+			entries = await readdir(dir);
+		} catch {
+			return;
+		}
+		for (const entry of entries) {
+			const rel = prefix === "" ? entry : `${prefix}/${entry}`;
+			if (prefix === "" && excluded.has(entry)) continue;
+			const abs = join(dir, entry);
+			let info;
+			try {
+				info = await stat(abs);
+			} catch {
+				continue;
+			}
+			if (info.isDirectory()) {
+				await walk(abs, rel);
+				if ((await readdir(abs).catch(() => [])).length === 0 && !excluded.has(entry)) await rm(abs, {
+					recursive: true,
+					force: true
+				}).catch(() => void 0);
+			} else if (!seen.has(rel)) await rm(abs, { force: true }).catch(() => void 0);
+		}
+	};
+	await walk(root, "");
+}
+/** 把目录打包成 tar 流（push 方向；可排除顶层子目录如 .git）。 */
+async function packDirectory(root, options = {}) {
+	const { readdir, readFile, stat } = await import("node:fs/promises");
+	const pack = tar.pack();
+	(async () => {
+		const walk = async (dir, prefix) => {
+			let entries;
+			try {
+				entries = await readdir(dir);
+			} catch {
+				return;
+			}
+			for (const entry of entries) {
+				if (prefix === "" && options.exclude?.(entry) === true) continue;
+				const abs = join(dir, entry);
+				const rel = prefix === "" ? entry : `${posix.join(prefix, entry)}`;
+				let info;
+				try {
+					info = await stat(abs);
+				} catch {
+					continue;
+				}
+				if (info.isDirectory()) await walk(abs, rel);
+				else if (info.isFile()) {
+					const content = await readFile(abs);
+					await new Promise((resolve, reject) => {
+						pack.entry({
+							name: rel,
+							mode: info.mode,
+							size: content.length
+						}, content, (error) => error === void 0 || error === null ? resolve() : reject(error));
+					});
+				}
+			}
+		};
+		try {
+			await walk(root, "");
+			pack.finalize();
+		} catch (error) {
+			pack.destroy(error instanceof Error ? error : new DockerError(String(error)));
+		}
+	})();
+	return pack;
+}
+//#endregion
+//#region src/worker-tools.ts
+/**
+* worker-tools.ts — pentester_container_exec：唯一命令执行工具。
+* Registered inside the pentester preset scope（run-state.mjs 经宿主
+* pentester service）；Root 的 per-agent restrict 隐藏、Worker child 经官方
+* toolFilter allow 独享。运行期仍做 caller 授权（§33：child SessionId 必须
+* 已绑定到某个 Delegation）。
+*/
+const CONTAINER_EXEC_SCHEMA = {
+	type: "object",
+	additionalProperties: false,
+	required: ["argv"],
+	properties: {
+		argv: {
+			type: "array",
+			items: { type: "string" },
+			minItems: 1,
+			description: "Command and arguments, no shell. e.g. [\"nmap\", \"-sV\", \"TARGET\"]."
+		},
+		cwd: {
+			type: "string",
+			description: "Working directory inside the container. Defaults to your delegation work/."
+		},
+		env: {
+			type: "object",
+			additionalProperties: { type: "string" },
+			description: "Optional environment variables."
+		},
+		timeoutMs: {
+			type: "number",
+			description: "Optional timeout in milliseconds (bounded by the host max)."
+		}
+	}
+};
+var WorkerToolError = class extends Error {};
+function makeContainerExecExecutor(docker, toolboxName = "kali") {
+	return async (args, exec) => {
+		const caller = trustedCallerFromExec(exec);
+		if (caller === void 0 || !caller.isSubagent) throw new WorkerToolError("pentester_container_exec is reserved for delegated pentester workers");
+		const projectDir = caller.cwd;
+		if (projectDir === void 0) throw new WorkerToolError("worker session has no trusted workspace cwd");
+		const run = await resolvePentestRun(projectDir);
+		if (run === null) throw new WorkerToolError("no PentestRun in this project; the Root Agent must start one first");
+		const delegation = run.delegations.find((candidate) => candidate.sessionId === caller.sessionId);
+		if (delegation === void 0) throw new WorkerToolError(`session ${caller.sessionId} is not bound to any delegation; only delegated workers may execute commands`);
+		const toolbox = await docker.ensureImage(toolboxName);
+		const containerId = await docker.ensureRunContainer({
+			runId: run.id,
+			toolbox,
+			projectDir
+		});
+		const input = {
+			argv: Array.isArray(args.argv) ? args.argv.map(String) : [],
+			...typeof args.cwd === "string" ? { cwd: args.cwd } : { cwd: workerContainerWorkDir(projectDir, delegation) },
+			...isStringRecord(args.env) ? { env: args.env } : {},
+			...typeof args.timeoutMs === "number" ? { timeoutMs: args.timeoutMs } : {}
+		};
+		const result = await docker.exec(containerId, input);
+		docker.syncWorkspace(run.id, projectDir).catch(() => void 0);
+		return result;
+	};
+}
+/** Worker 的容器工作目录：`/workspace/stages/<NN>-<stage>/delegations/D-00N/work`。 */
+function workerContainerWorkDir(projectDir, delegation) {
+	return `${delegation.workspaceDir.startsWith(projectDir) ? delegation.workspaceDir.slice(projectDir.length).replace(/\\/g, "/") : delegation.workspaceDir}/work`;
+}
+/**
+* 在调用者给定的 tools registry 上注册 pentester_container_exec（run-state.mjs
+* 把它注册进 pentester preset 的 standing scope；Root 看不到、Worker 独享）。
+*/
+function registerContainerExecTool(tools, docker) {
+	const execute = makeContainerExecExecutor(docker);
+	tools.register({
+		name: "pentester_container_exec",
+		description: "Execute a command in the project run Toolbox container (/workspace = 共享交付 volume)。pentester 会话专用。",
+		parameters: CONTAINER_EXEC_SCHEMA,
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: true
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: JSON.stringify(value)
+			}]
+		},
+		execute
+	});
+}
+function isStringRecord(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	return Object.values(value).every((entry) => typeof entry === "string");
+}
+//#endregion
+//#region src/settings-store.ts
+/**
+* settings-store.ts — 插件全局设置存储（Docker Engine 等宿主级偏好）。
+*
+* 存放位置：`$DSH_HOME/dsh-pentester/settings.json`（DSH_HOME 未设置时用
+* `~/.dsh`）。原子写（tmp + rename），单对象快照，无事件日志。
+* 该存储中的 dockerHost 是全局唯一 Docker 连接的显式配置；未设置时
+* 按本地优先的回退链解析（见 docker.ts 的 resolveDockerHost）。
+*/
+/** 设置文件当前 schema 版本。 */
+const SETTINGS_VERSION = 1;
+var SettingsError = class extends Error {};
+/** 解析 DSH 根目录（优先 DSH_HOME 环境变量）。 */
+function dshHome() {
+	return process.env.DSH_HOME ?? join(homedir(), ".dsh");
+}
+function settingsFilePath(home = dshHome()) {
+	return join(home, "dsh-pentester", "settings.json");
+}
+/** 读取全局设置；文件不存在时返回默认值（不落盘）。 */
+async function loadSettings(home = dshHome()) {
+	const file = settingsFilePath(home);
+	if (!existsSync(file)) return {
+		schemaVersion: SETTINGS_VERSION,
+		dockerHost: "",
+		toolboxImages: {}
+	};
+	let parsed;
+	try {
+		parsed = JSON.parse(await readFile(file, "utf8"));
+	} catch (error) {
+		throw new SettingsError(`settings.json 解析失败: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (parsed === null || typeof parsed !== "object" || parsed.schemaVersion !== SETTINGS_VERSION) throw new SettingsError("settings.json 版本不受支持");
+	const record = parsed;
+	const toolboxImages = {};
+	if (record.toolboxImages !== null && typeof record.toolboxImages === "object" && !Array.isArray(record.toolboxImages)) {
+		for (const [key, value] of Object.entries(record.toolboxImages)) if (typeof value === "string" && value.trim() !== "") toolboxImages[key] = value.trim();
+	}
+	return {
+		schemaVersion: SETTINGS_VERSION,
+		dockerHost: typeof record.dockerHost === "string" ? record.dockerHost : "",
+		toolboxImages
+	};
+}
+/** 确保 settings.json 存在：不存在则立即写入默认值（插件加载时调用）。 */
+async function ensureSettings(home = dshHome()) {
+	const existing = await loadSettings(home);
+	if (!existsSync(settingsFilePath(home))) await saveSettings(existing, home);
+	return existing;
+}
+/** 原子保存全局设置。 */
+async function saveSettings(settings, home = dshHome()) {
+	const file = settingsFilePath(home);
+	await mkdir(dirname(file), { recursive: true });
+	const tmp = `${file}.tmp`;
+	await writeFile(tmp, `${JSON.stringify(settings, null, 2)}\n`);
+	await rename(tmp, file);
+}
+//#endregion
+//#region node_modules/.pnpm/@deepseek-ai+dsh-typert-protocol@0.1.0-rc.7_@deepseek-ai+cordis@4.0.1_@deepseek-ai+dsh-_d73d8b8dfb7ef1310693b69e6082fcb0/node_modules/@deepseek-ai/dsh-typert-protocol/lib/index.js
+/**
+* Remote decorators and explicit Gateway bindings backed only by private
+* module state. Strict reflection remains a Typert compiler responsibility.
+* @module @deepseek-ai/dsh-typert-protocol
+*/
+const TYPERT_REMOTE_SEGMENT_PATTERN = /^[A-Za-z0-9_$.-]+$/;
+/**
+* Test one generated Remote name against the Connection endpoint grammar.
+* @param value - namespace, method, lookup, or Context segment.
+* @returns whether the value can cross the shared RPC carrier unchanged.
+*/
+function isTypertRemoteSegment(value) {
+	return value !== "." && value !== ".." && TYPERT_REMOTE_SEGMENT_PATTERN.test(value);
+}
+/**
+* Bind one visible Service field to a Cordis key and Remote namespace.
+* @param service - owning Service instance, normally `this`.
+* @param serviceKey - exact Cordis service key.
+* @param options - optional distinct wire namespace.
+* @returns a frozen, inspectable binding with no compiler-injected metadata.
+*/
+function bindTypertRemote(service, serviceKey, options = {}) {
+	validateName("service key", serviceKey);
+	const namespace = options.namespace ?? serviceKey;
+	validateName("namespace", namespace);
+	return Object.freeze({
+		service,
+		serviceKey,
+		namespace
+	});
+}
+/** Cordis Service base that exposes its registered name through Typert Gateway. */
+var TypertRemoteService = class extends Service {
+	/** Visible binding consumed by the Gateway's source-mode discovery. */
+	typertRemote;
+	/**
+	* Register the Service and bind the same key to Typert Gateway.
+	* @param ctx - owning Cordis Context.
+	* @param serviceKey - exact Cordis service key and default wire namespace.
+	* @param options - optional distinct wire namespace.
+	*/
+	constructor(ctx, serviceKey, options = {}) {
+		super(ctx, serviceKey);
+		this.typertRemote = bindTypertRemote(this, this.name, options);
+	}
+};
+function validateName(subject, value) {
+	if (!isTypertRemoteSegment(value)) throw new TypeError(`typert-protocol: ${subject} must contain only RPC endpoint segment characters`);
+}
+//#endregion
+//#region src/invocations.ts
+/**
+* invocations.ts — `remote.pentesterDocker` 的严格调用描述符。
+*
+* 宿主（Typert manifest）与客户端（remote 网关贡献）共用同一份：
+* 官方 api-gateway 契约要求客户端贡献必须携带 strict codec，
+* “Client Remote refuses to mount SRC descriptors that lack strict
+* codecs” —— 缺 codec 的描述符会被客户端网关拒绝挂载（此前 UI 报
+* rpc_unavailable 的根因）。本模块只依赖 zod，两侧均可安全导入。
+*/
+/** 传输层输入 schema（宽松外壳，分发前再严格校验）。 */
+const dockerRpcInputSchema = z.object({ kind: z.string() }).passthrough();
+const dockerHostStateSchema = z.object({
+	dockerHost: z.string(),
+	effective: z.string(),
+	remote: z.boolean(),
+	source: z.enum([
+		"settings",
+		"config",
+		"local",
+		"env",
+		"default"
+	])
+});
+const dockerProbeSchema = z.object({
+	reachable: z.boolean(),
+	endpoint: z.string(),
+	version: z.string().optional(),
+	apiVersion: z.string().optional(),
+	os: z.string().optional(),
+	error: z.string().optional()
+});
+/** `remote.pentesterDocker.command` 的严格描述符（含 codec 与 result schema）。 */
+const PENTESTER_DOCKER_INVOCATION = {
+	id: "dsh-pentester#pentesterDocker/command",
+	service: "pentesterDocker",
+	namespace: "pentesterDocker",
+	method: "command",
+	invocation: { kind: "direct" },
+	parameters: [{
+		name: "input",
+		wire: "input",
+		source: "json",
+		codec: {
+			mode: "strict",
+			typeSymbol: "dsh-pentester#DockerRpcInput",
+			schema: dockerRpcInputSchema
+		}
+	}],
+	result: {
+		mode: "strict",
+		typeSymbol: "dsh-pentester#DockerRpcResult",
+		schema: z.object({
+			ok: z.boolean(),
+			value: z.union([
+				dockerHostStateSchema,
+				dockerProbeSchema,
+				z.record(z.string(), z.unknown())
+			]).optional(),
+			error: z.string().optional(),
+			code: z.string().optional()
+		})
+	}
+};
+//#endregion
+//#region src/docker/connection.ts
+/**
+* docker/connection.ts — 远程 Docker 连接管理（Settings “Docker Host” 卡片的后端）。
+*
+* 职责：连接字符串解析（Node URL 类）、高级连接参数（TLS / SSH）→ dockerode
+* 构造参数、连接测试（GET /version + 超时）。只服务于 Settings 页的“测试连接”，
+* 不改变当前生效连接（全局 host 解析仍走 host.ts）。
+*/
+/**
+* 用 Node 内置 URL 类解析连接字符串（与 DOCKER_HOST 同格式）。
+* 支持的协议：tcp: / http: / https: / unix:（或裸 socket 路径）。
+* tcp/http 缺省端口 2375，https 缺省 2376。
+*/
+function parseConnectionString(value) {
+	const raw = value.trim();
+	if (raw === "") throw new DockerError("empty docker host");
+	if (raw.startsWith("/") && !raw.includes("://")) return {
+		protocol: "unix",
+		socketPath: raw
+	};
+	const schemeMatch = /^(tcp|http|https):\/\//i.exec(raw);
+	if (schemeMatch !== null) {
+		const authority = raw.slice(schemeMatch[0].length).replace(/\/.*$/, "");
+		if (authority === "" || authority.startsWith(":")) throw new DockerError(`docker host missing hostname: ${raw}`);
+	}
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		throw new DockerError(`无法解析的连接字符串：${raw}`);
+	}
+	const scheme = url.protocol.replace(":", "");
+	if (scheme === "unix") {
+		let socketPath = url.pathname;
+		if (socketPath === "" || socketPath === "/") socketPath = url.hostname !== "" ? `/${url.hostname}` : DEFAULT_UNIX_SOCKET;
+		return {
+			protocol: "unix",
+			socketPath
+		};
+	}
+	if (scheme !== "tcp" && scheme !== "http" && scheme !== "https") throw new DockerError(`unsupported docker host: ${raw} (use tcp://host:port, http://host:port or unix:///path)`);
+	if (url.hostname === "") throw new DockerError(`docker host missing hostname: ${raw}`);
+	const port = url.port === "" ? scheme === "https" ? 2376 : 2375 : Number(url.port);
+	if (!Number.isInteger(port)) throw new DockerError(`docker host invalid port: ${raw}`);
+	return {
+		protocol: scheme,
+		host: url.hostname,
+		port
+	};
+}
+/** 高级设置面板 → 连接规格。 */
+function advancedToSpec(advanced) {
+	const host = advanced.host.trim();
+	if (host === "") throw new DockerError("高级设置：缺少主机地址");
+	if (advanced.protocol === "unix") return {
+		protocol: "unix",
+		socketPath: host
+	};
+	return {
+		protocol: advanced.protocol,
+		host,
+		port: advanced.port ?? 2375
+	};
+}
+/**
+* 构建 dockerode 构造参数。
+*   tcp/http 无 TLS → { host, port }；TLS → 附 ca/cert/key（modem 自动切 https）
+*   ssh → { protocol:'ssh', username, password | sshOptions.privateKey }
+*   unix → { socketPath }
+*/
+function buildDockerOptions(spec, auth) {
+	if (spec.protocol === "unix") return { socketPath: spec.socketPath ?? "/var/run/docker.sock" };
+	const host = spec.host ?? "";
+	const port = spec.port ?? 2375;
+	if (auth !== void 0 && auth.type === "ssh") {
+		const options = {
+			protocol: "ssh",
+			host,
+			port
+		};
+		if (auth.username !== void 0 && auth.username !== "") options.username = auth.username;
+		if (auth.privateKey !== void 0 && auth.privateKey !== "") options.sshOptions = { privateKey: auth.privateKey };
+		else if (auth.password !== void 0 && auth.password !== "") options.password = auth.password;
+		return options;
+	}
+	if (auth !== void 0 && auth.type === "tls") {
+		const options = {
+			host,
+			port
+		};
+		if (auth.ca !== void 0) options.ca = auth.ca;
+		if (auth.cert !== void 0) options.cert = auth.cert;
+		if (auth.key !== void 0) options.key = auth.key;
+		return options;
+	}
+	if (spec.protocol === "https") return {
+		protocol: "https",
+		host,
+		port
+	};
+	return {
+		host,
+		port
+	};
+}
+/** 探测结果的 endpoint 展示（与 host.ts 的 formatDockerHost 对齐）。 */
+function endpointFor(spec, auth) {
+	if (spec.protocol === "unix") return `unix://${spec.socketPath ?? "/var/run/docker.sock"}`;
+	if (auth !== void 0 && auth.type === "ssh") return `ssh://${auth.username !== void 0 && auth.username !== "" ? `${auth.username}@` : ""}${spec.host}:${spec.port}`;
+	return formatDockerHost(spec.protocol === "tcp" ? {
+		protocol: "http",
+		host: spec.host,
+		port: spec.port
+	} : {
+		protocol: spec.protocol,
+		host: spec.host,
+		port: spec.port
+	});
+}
+/** 请求 → dockerode 构造参数 + 展示 endpoint。 */
+function resolveConnection(input) {
+	if (input.connectionString !== void 0 && input.connectionString.trim() !== "") {
+		const spec = parseConnectionString(input.connectionString);
+		return {
+			options: buildDockerOptions(spec),
+			endpoint: endpointFor(spec)
+		};
+	}
+	if (input.advanced !== void 0) {
+		const spec = advancedToSpec(input.advanced);
+		const auth = input.advanced.auth;
+		return {
+			options: buildDockerOptions(spec, auth),
+			endpoint: endpointFor(spec, auth)
+		};
+	}
+	throw new DockerError("empty docker host");
+}
+/**
+* 测试一个（未保存的）连接：GET /version，成功返回版本信息，
+* 失败返回友好错误（含超时）。私钥/密码只进 dockerode 构造，不回传。
+*/
+async function testDockerConnection(input, deps = {}) {
+	let resolved;
+	try {
+		resolved = resolveConnection(input);
+	} catch (error) {
+		return {
+			reachable: false,
+			endpoint: "",
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+	const { options, endpoint } = resolved;
+	const timeoutMs = deps.timeoutMs ?? 1e4;
+	const engine = deps.engine ?? new Dockerode(options);
+	try {
+		const info = await withTimeout(engine.version(), timeoutMs);
+		return {
+			reachable: true,
+			endpoint,
+			...typeof info.Version === "string" ? { version: info.Version } : {},
+			...typeof info.ApiVersion === "string" ? { apiVersion: info.ApiVersion } : {},
+			...typeof info.Os === "string" ? { os: info.Os } : {}
+		};
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		return {
+			reachable: false,
+			endpoint,
+			error: message.startsWith("连接超时") ? message : `连接失败：${message}`
+		};
+	}
+}
+function withTimeout(promise, ms) {
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`连接超时（${ms / 1e3}s）`)), ms);
+		promise.then((value) => {
+			clearTimeout(timer);
+			resolve(value);
+		}, (error) => {
+			clearTimeout(timer);
+			reject(error);
+		});
+	});
+}
+//#endregion
+//#region src/rpc.ts
+/**
+* rpc.ts — Docker Engine 设置的 Typert RPC（宿主侧）。
+*
+* Settings UI 的 "Docker Engine" Tab 通过 `remote.pentesterDocker` 命名空间
+* 调用 `command(input)`；输入是类型化的 `{ kind: 'get' | 'set', ... }`，
+* 与旧 Config RPC 同构（单一 command 通道 + 双层信封解包）。
+* 不含任何自然语言命令；宿主侧校验后委托给 settings-store 与 DockerRuntime。
+*/
+/** 传输层输入 schema（宽松外壳 + 严格分发校验）。 */
+const dockerRpcSchema = dockerRpcInputSchema;
+/** 高级连接参数校验（Settings "Docker Host" 卡片的 advanced 面板）。 */
+const connectionAuthSchema = z.discriminatedUnion("type", [
+	z.object({ type: z.literal("none") }),
+	z.object({
+		type: z.literal("tls"),
+		ca: z.string().optional(),
+		cert: z.string().optional(),
+		key: z.string().optional()
+	}),
+	z.object({
+		type: z.literal("ssh"),
+		username: z.string().optional(),
+		password: z.string().optional(),
+		privateKey: z.string().optional()
+	})
+]);
+const advancedConnectionSchema = z.object({
+	protocol: z.enum([
+		"tcp",
+		"http",
+		"unix"
+	]),
+	host: z.string(),
+	port: z.number().int().min(1).max(65535).optional(),
+	auth: connectionAuthSchema.optional()
+});
+/** 校验一条输入（严格模式：未知 kind / 非法 host 直接拒绝）。 */
+function parseDockerRpcInput(input) {
+	let parsed;
+	try {
+		parsed = dockerRpcSchema.parse(input);
+	} catch {
+		return {
+			ok: false,
+			reason: "invalid_request"
+		};
+	}
+	if (parsed.kind === "get") return {
+		ok: true,
+		value: { kind: "get" }
+	};
+	if (parsed.kind === "test") {
+		const raw = parsed.dockerHost;
+		const advancedRaw = parsed.advanced;
+		let advanced;
+		if (advancedRaw !== void 0) {
+			const check = advancedConnectionSchema.safeParse(advancedRaw);
+			if (!check.success) return {
+				ok: false,
+				reason: "invalid_advanced"
+			};
+			advanced = check.data;
+		}
+		if (raw === void 0) return {
+			ok: true,
+			value: {
+				kind: "test",
+				...advanced !== void 0 ? { advanced } : {}
+			}
+		};
+		if (typeof raw !== "string") return {
+			ok: false,
+			reason: "invalid_docker_host"
+		};
+		if (raw.trim() !== "") try {
+			parseDockerHost(raw);
+		} catch (error) {
+			return {
+				ok: false,
+				reason: error instanceof Error ? error.message : "invalid_docker_host"
+			};
+		}
+		return {
+			ok: true,
+			value: {
+				kind: "test",
+				...raw.trim() !== "" ? { dockerHost: raw.trim() } : {},
+				...advanced !== void 0 ? { advanced } : {}
+			}
+		};
+	}
+	if (parsed.kind === "image.status") return {
+		ok: true,
+		value: { kind: "image.status" }
+	};
+	if (parsed.kind === "image.set") {
+		const imageValue = parsed.image;
+		const image = typeof imageValue === "string" ? imageValue.trim() : void 0;
+		if (image === void 0) return {
+			ok: false,
+			reason: "image_required"
+		};
+		return {
+			ok: true,
+			value: {
+				kind: "image.set",
+				image
+			}
+		};
+	}
+	if (parsed.kind === "set") {
+		const hostValue = parsed.dockerHost;
+		const host = typeof hostValue === "string" ? hostValue : void 0;
+		if (host === void 0) return {
+			ok: false,
+			reason: "dockerHost_required"
+		};
+		if (host.trim() !== "") try {
+			parseDockerHost(host);
+		} catch (error) {
+			return {
+				ok: false,
+				reason: error instanceof Error ? error.message : "invalid_docker_host"
+			};
+		}
+		return {
+			ok: true,
+			value: {
+				kind: "set",
+				dockerHost: host.trim()
+			}
+		};
+	}
+	return {
+		ok: false,
+		reason: "unsupported_kind"
+	};
+}
+/** 计算某个显式配置下的状态快照。 */
+function dockerHostState(settings, resolved) {
+	return {
+		dockerHost: settings.dockerHost,
+		effective: formatDockerHost(resolved.host),
+		remote: isRemoteHost(resolved.host),
+		source: resolved.source
+	};
+}
+/** 分发一条已校验的输入。 */
+async function dispatchDockerRpc(deps, input) {
+	const resolve = deps.resolve ?? ((settingsHost, configHost) => resolveDockerHostWithSource(settingsHost, configHost));
+	const probe = deps.probe ?? ((host) => probeDockerHost(host));
+	try {
+		if (input.kind === "get") {
+			const settings = await deps.getSettings();
+			return {
+				ok: true,
+				value: dockerHostState(settings, resolve(settings.dockerHost, deps.getConfigHost()))
+			};
+		}
+		if (input.kind === "test") {
+			const testConnection = deps.testConnection ?? testDockerConnection;
+			if (input.dockerHost !== void 0 && input.dockerHost !== "") return {
+				ok: true,
+				value: await testConnection({ connectionString: input.dockerHost })
+			};
+			if (input.advanced !== void 0) return {
+				ok: true,
+				value: await testConnection({ advanced: input.advanced })
+			};
+			const host = resolve((await deps.getSettings()).dockerHost, deps.getConfigHost()).host;
+			return {
+				ok: true,
+				value: await probe(host)
+			};
+		}
+		if (input.kind === "image.status") {
+			const image = toolboxFor("kali", (await deps.getSettings()).toolboxImages).image;
+			return {
+				ok: true,
+				value: {
+					image,
+					ready: await deps.docker.imageReady(image),
+					defaultImage: TOOLBOX_ALLOWLIST[0].image
+				}
+			};
+		}
+		if (input.kind === "image.set") {
+			const settings = await deps.getSettings();
+			const next = {
+				...settings,
+				toolboxImages: { ...settings.toolboxImages }
+			};
+			if (input.image === "") delete next.toolboxImages.kali;
+			else next.toolboxImages.kali = input.image;
+			await deps.saveSettings(next);
+			deps.docker.updateToolboxImage("kali", input.image === "" ? void 0 : input.image);
+			const image = toolboxFor("kali", next.toolboxImages).image;
+			return {
+				ok: true,
+				value: {
+					image,
+					ready: await deps.docker.imageReady(image),
+					defaultImage: TOOLBOX_ALLOWLIST[0].image
+				}
+			};
+		}
+		const settings = await deps.saveDockerHost(input.dockerHost);
+		const resolved = resolve(settings.dockerHost, deps.getConfigHost());
+		deps.applyHost(resolved.host);
+		return {
+			ok: true,
+			value: dockerHostState(settings, resolved)
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			error: error instanceof Error ? error.message : "docker_rpc_failed",
+			code: "docker_rpc_failed"
+		};
+	}
+}
+/**
+* 宿主 Typert 服务：绑定到 `pentesterDocker` 命名空间。
+* Settings 页面是根级贡献，无 Agent 查找 —— 单参数 command。
+*/
+var PentesterDockerTypertService = class extends TypertRemoteService {
+	deps;
+	constructor(ctx, deps) {
+		super(ctx, "pentesterDocker");
+		this.deps = deps;
+	}
+	command(input) {
+		const parsed = parseDockerRpcInput(input);
+		if (!parsed.ok) return Promise.resolve({
+			ok: false,
+			error: parsed.reason,
+			code: "invalid_request"
+		});
+		return dispatchDockerRpc(this.deps, parsed.value);
+	}
+};
+/** 插件的 Typert manifest（仅 Docker Engine 设置面）。 */
+const TYPERT_MANIFEST = {
+	package: "dsh-pentester",
+	face: "host",
+	schemas: [],
+	model: {
+		services: [{
+			key: "pentesterDocker",
+			exportName: "PentesterDockerTypertService",
+			description: "Pentester Docker Engine 设置（Settings UI Docker Engine Tab）。",
+			tags: [],
+			members: [{
+				kind: "method",
+				name: "command",
+				signature: "command(input: object): Promise<{ok:boolean; value?: {dockerHost:string; effective:string; remote:boolean}; error?: string; code?: string}>"
+			}],
+			types: []
+		}],
+		events: [],
+		objects: []
+	},
+	invocations: [PENTESTER_DOCKER_INVOCATION]
+};
+//#endregion
+//#region src/git.ts
+/**
+* git.ts — GitCheckpointService：workspace 的 git 仓库管理（宿主侧）。
+*
+* 仓库根 = <project>/workspace（= 容器 /workspace 的宿主镜像；.git 不随
+* volume 同步，Worker 物理上无法改 Git 状态）。约定式提交：
+*   - 初始：`workspace: initialize <target>`
+*   - 阶段完成：`ptes(<NN>-<stage>): complete` + tag `ptes/<NN>-<stage>`
+*
+* git 命令经注入的 runner 执行（生产 = child_process.execFile，测试 = fake）。
+*/
+var GitCheckpointError = class extends Error {};
+function realGitRunner() {
+	return (args, cwd) => new Promise((resolve, reject) => {
+		execFile("git", [...args], {
+			cwd,
+			maxBuffer: 10485760
+		}, (error, stdout) => {
+			if (error !== null && error !== void 0) {
+				reject(new GitCheckpointError(`git ${args[0] ?? ""} failed: ${error.message}`));
+				return;
+			}
+			resolve(stdout);
+		});
+	});
+}
+/** workspace git 仓库管理（幂等 init；阶段完成 checkpoint）。 */
+var GitCheckpointService = class {
+	runner;
+	userName;
+	userEmail;
+	isRepoOverride;
+	constructor(deps = {}) {
+		this.runner = deps.runner ?? realGitRunner();
+		this.userName = deps.userName ?? "dsh-pentester";
+		this.userEmail = deps.userEmail ?? "dsh-pentester@local";
+		this.isRepoOverride = deps.isRepo;
+	}
+	/** 仓库根目录（<project>/workspace）。 */
+	repoDir(projectDir) {
+		return workspaceDir(projectDir);
+	}
+	/** 是否已是 git 仓库（存在 .git）。 */
+	async isRepo(projectDir) {
+		if (this.isRepoOverride !== void 0) return this.isRepoOverride(projectDir);
+		return existsSync(join(this.repoDir(projectDir), ".git"));
+	}
+	/**
+	* 初始化仓库：`git init -b main` + 本地身份 + 初始提交。
+	* 幂等：已是仓库则直接返回。
+	*/
+	async init(projectDir, target) {
+		const cwd = this.repoDir(projectDir);
+		await mkdir(cwd, { recursive: true });
+		if (await this.isRepo(projectDir)) return;
+		await this.runner([
+			"init",
+			"-b",
+			"main"
+		], cwd).catch(async () => {
+			await this.runner(["init"], cwd);
+			await this.runner([
+				"checkout",
+				"-b",
+				"main"
+			], cwd).catch(() => void 0);
+		});
+		await this.runner([
+			"config",
+			"user.name",
+			this.userName
+		], cwd);
+		await this.runner([
+			"config",
+			"user.email",
+			this.userEmail
+		], cwd);
+		await this.runner(["add", "-A"], cwd);
+		await this.commit(cwd, `workspace: initialize ${target ?? "pentest"}`);
+	}
+	/** 阶段完成 checkpoint：`git add -A` → commit → tag。返回 tag 名。 */
+	async checkpointStage(projectDir, stage) {
+		if (!await this.isRepo(projectDir)) throw new GitCheckpointError("workspace is not a git repository; run initWorkspace first");
+		const cwd = this.repoDir(projectDir);
+		const dir = stageDir(stage);
+		await this.runner(["add", "-A"], cwd);
+		await this.commit(cwd, `ptes(${dir}): complete`);
+		const tag = `ptes/${dir}`;
+		if (!await this.runner([
+			"tag",
+			"-l",
+			tag
+		], cwd).then((out) => out.trim().length > 0, () => false)) await this.runner(["tag", tag], cwd);
+		return tag;
+	}
+	/** 当前 git 分支名（rollback / Root state 用）。 */
+	async currentBranch(projectDir) {
+		const cwd = this.repoDir(projectDir);
+		return (await this.runner(["branch", "--show-current"], cwd).catch(() => "")).trim() || "main";
+	}
+	/** working tree 是否有未提交变更（rollback 前决定是否建 backup branch）。 */
+	async hasChanges(projectDir) {
+		const cwd = this.repoDir(projectDir);
+		return (await this.runner(["status", "--porcelain"], cwd).catch(() => "")).trim() !== "";
+	}
+	/**
+	* 在 HEAD 的 first-parent reachable 历史中找目标 stage 的 completion commit
+	* （subject `ptes(<NN>-<stage>): complete`）。不假设 tag 属于当前 branch
+	* namespace（§31）；tag 只是人类可读 ref。找不到返回 undefined。
+	*/
+	async findStageCheckpoint(projectDir, stage) {
+		const cwd = this.repoDir(projectDir);
+		const dir = stageDir(stage);
+		const out = await this.runner([
+			"log",
+			"--first-parent",
+			"--format=%H%x00%s",
+			"HEAD"
+		], cwd).catch(() => "");
+		for (const line of out.split("\n")) {
+			if (line.trim() === "") continue;
+			const [hash, ...subjectParts] = line.split("\0");
+			const subject = subjectParts.join("\0");
+			if (hash !== void 0 && subject === `ptes(${dir}): complete`) return hash;
+		}
+	}
+	/** 建 backup branch：`backup/rollback-<ts>` + WIP commit（只在有变更时调用）。 */
+	async createBackupBranch(projectDir, stage) {
+		const cwd = this.repoDir(projectDir);
+		const branch = `backup/rollback-${Date.now()}`;
+		await this.runner([
+			"checkout",
+			"-b",
+			branch
+		], cwd);
+		await this.runner(["add", "-A"], cwd);
+		await this.commit(cwd, `wip: before rollback to ${stage}`);
+		return branch;
+	}
+	/**
+	* 从 checkpoint commit 建 rework branch：`rework/<next-stage-slug>-<n>`。
+	* n 自动找下一个可用值（已有分支 +1）。
+	*/
+	async createReworkBranch(projectDir, checkpoint, nextStageSlug) {
+		const cwd = this.repoDir(projectDir);
+		const existing = await this.runner(["branch", "--format=%(refname:short)"], cwd).catch(() => "");
+		const prefix = `rework/${nextStageSlug}-`;
+		let n = 1;
+		for (const line of existing.split("\n")) {
+			const match = /^rework\/[^/]+-(\d+)$/.exec(line.trim());
+			if (match !== null) n = Math.max(n, Number(match[1]) + 1);
+		}
+		const branch = `${prefix}${n}`;
+		await this.runner([
+			"checkout",
+			"-b",
+			branch,
+			checkpoint
+		], cwd);
+		return branch;
+	}
+	/** checkout 到已有分支 / commit（rollback 收尾）。 */
+	async checkout(projectDir, ref) {
+		const cwd = this.repoDir(projectDir);
+		await this.runner(["checkout", ref], cwd);
+	}
+	async commit(cwd, message) {
+		await this.runner([
+			"commit",
+			"-m",
+			message
+		], cwd).catch((error) => {
+			const text = error instanceof Error ? error.message : String(error);
+			if (text.includes("nothing to commit") || text.includes("nothing added")) return;
+			throw error;
+		});
+	}
+};
+//#endregion
+//#region src/index.ts
+/**
+* index.ts — cordis plugin entry (contract per docs/architecture.md):
+* publish the pentester preset, then wire the Root tools over the
+* DSH agents seam。Workers 的工具面 restrict 到 pentester_container_exec。
+*/
+const name = "dsh-pentester";
+const inject = ["tools", "subagents"];
+const Config = Schema.object({
+	verbose: Schema.boolean().default(false),
+	dockerHost: Schema.string().default(""),
+	toolboxImages: Schema.object({}).default({})
+});
+async function apply(ctx, config) {
+	const profiles = loadAgentProfiles(agentsRoot());
+	const presetDir = await publishPentesterPreset();
+	if (presetDir !== void 0) await writeStageProfilesManifest(presetDir, profiles);
+	const settings = await ensureSettings();
+	const explicit = settings.dockerHost !== "" ? settings.dockerHost : config.dockerHost;
+	const docker = new DockerRuntime({
+		host: resolveDockerHost(explicit === "" ? void 0 : explicit),
+		...config.toolboxImages === void 0 || Object.keys(config.toolboxImages).length === 0 ? {} : { imageOverrides: config.toolboxImages }
+	});
+	const delegations = new DelegationService(new DshClient(ctx), docker);
+	const git = new GitCheckpointService();
+	ctx.provide("pentester", {
+		registerRootTools: (tools) => registerRootTools(tools, {
+			delegations,
+			profiles,
+			git,
+			pushWorkspace: async (projectDir, run) => {
+				await docker.pushWorkspace(run.id, projectDir);
+			},
+			syncWorkspace: async (projectDir, run) => {
+				await docker.syncWorkspace(run.id, projectDir);
+			}
+		}),
+		registerContainerExecTool: (tools) => registerContainerExecTool(tools, docker)
+	});
+	ctx.inject(["typert"], (inner) => {
+		new PentesterDockerTypertService(inner, {
+			getSettings: () => ensureSettings(),
+			getConfigHost: () => config.dockerHost ?? "",
+			saveDockerHost: async (dockerHost) => {
+				const next = {
+					...await ensureSettings(),
+					dockerHost
+				};
+				await saveSettings(next);
+				return next;
+			},
+			saveSettings: async (next) => {
+				await saveSettings(next);
+			},
+			docker,
+			applyHost: (host) => docker.updateHost(host)
+		});
+		inner.typert.register(TYPERT_MANIFEST);
+	});
+	if (config.verbose) console.log(`[dsh-pentester] loaded with ${profiles.size} agent profiles`);
+}
+function agentsRoot() {
+	const here = dirname(fileURLToPath(import.meta.url));
+	for (const candidate of [join(here, "..", "agents"), join(process.cwd(), "agents")]) if (existsSync(candidate)) return candidate;
+	return join(process.cwd(), "agents");
+}
+/** run-state.mjs 读取的 stage → AgentProfile 清单文件名（与 preset 同目录发布）。 */
+const STAGE_PROFILES_FILE = "stage-profiles.json";
+/**
+* 生成并发布 stage → [{id, name}] 清单（docs/plan.md §7：Root compact state
+* 的 Available AgentProfiles 从 STAGE_DEFINITIONS + AgentProfile registry 生成，
+* 不硬编码第二套映射）。随 preset 目录发布，run-state.mjs 同目录读取。
+*/
+async function writeStageProfilesManifest(presetDir, profiles) {
+	const manifest = Object.fromEntries(STAGE_DEFINITIONS.map((definition) => [definition.id, definition.agentIds.map((id) => profiles.get(id)).filter((profile) => profile !== void 0).map((profile) => ({
+		id: profile.id,
+		name: profile.name
+	}))]));
+	await writeFile(join(presetDir, STAGE_PROFILES_FILE), `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+}
+/** 把随包发布的 pentester preset 拷贝到 DSH 用户 preset 根目录。 */
+async function publishPentesterPreset(home) {
+	const source = shippedPresetDir();
+	if (source === void 0) return void 0;
+	const dest = join(home ?? process.env.DSH_HOME ?? join(homedir(), ".dsh"), ".agent-presets", "pentester");
+	await mkdir(dirname(dest), { recursive: true });
+	await cp(source, dest, { recursive: true });
+	await readFile(join(dest, "agent.cordis.yml"), "utf8");
+	return dest;
+}
+function shippedPresetDir() {
+	const here = dirname(fileURLToPath(import.meta.url));
+	return [
+		join(here, "..", "presets", "pentester"),
+		join(here, "presets", "pentester"),
+		join(process.cwd(), "presets", "pentester")
+	].find((path) => existsSync(join(path, "agent.cordis.yml")));
+}
+//#endregion
+export { Config, STAGE_PROFILES_FILE, apply, inject, name, publishPentesterPreset, writeStageProfilesManifest };
+
+//# sourceMappingURL=index.js.map