dsh-pentester 1.0.0 → 2.2.0

package/lib/index.js

@@ -1,10 +1,11 @@
 import { existsSync, readFileSync, readdirSync } from "node:fs";
-import { dirname, join, posix } from "node:path";
+import { dirname, isAbsolute, join, posix, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
+import { performance } from "node:perf_hooks";
 import Schema from "@deepseek-ai/schemastery";
-import { appendFile, copyFile, cp, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { appendFile, copyFile, cp, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { createHash, randomBytes } from "node:crypto";
+import { createHash } from "node:crypto";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import tar from "tar-stream";
@@ -26,6 +27,7 @@ const SUBAGENT_PROVIDER = "spawn";
 * DSH tools.restrict() 对未知名字做严格存在性校验。
 */
 const WORKER_TOOL_FILTER = { deny: [
+	"pentester_start",
 	"pentester_delegate",
 	"pentester_cancel_delegation",
 	"pentester_advance_stage",
@@ -265,35 +267,213 @@ function isStageId(value) {
 	return STAGE_IDS.includes(value);
 }
 //#endregion
-//#region src/store.ts
+//#region src/targets.ts
 /**
-* store.ts — the single run.json snapshot per Project (docs/workspace.md).
-* Atomic write via tmp+rename; no event log, no replay.
+* targets.ts — Target Registry: multi-target workspace isolation.
+*
+* Project workspace is shared only as a container for Target workspaces.
+* Every Target has an isolated Root Session, PentestRun, PTES timeline,
+* filesystem tree, Git history and Toolbox runtime.
+*
+* TargetContext is the mandatory resolver for all target-specific code.
+* No target-scoped function accepts a bare projectDir.
 */
-const RUN_DIR = ".dsh-pentester";
-const RUN_FILE = "run.json";
-/** 工作区交付树：`<project>/workspace` = 容器 `/workspace`（共享 volume 的宿主镜像）。 */
 const WORKSPACE_DIR = "workspace";
-var StoreError = class extends Error {};
-function runFilePath(projectDir) {
-	return join(workspaceDir(projectDir), RUN_DIR, RUN_FILE);
+const RUN_DIR$1 = ".dsh-pentester";
+const RUN_FILE = "run.json";
+const TARGETS_FILE = "targets.json";
+const TARGETS_SUBDIR = "targets";
+const TARGET_REGISTRY_SCHEMA = 1;
+/**
+* Conservative canonicalization: trim, lowercase hostname portion,
+* strip trailing slash/path for URLs. Preserves port and scheme distinctions.
+* Never merges semantically different targets.
+*/
+function canonicalizeTarget(raw) {
+	let cleaned = raw.trim();
+	if (cleaned === "") return cleaned;
+	let scheme = "";
+	const schemeMatch = /^(https?:\/\/)/i.exec(cleaned);
+	if (schemeMatch !== null) {
+		scheme = schemeMatch[1].toLowerCase();
+		cleaned = cleaned.slice(schemeMatch[1].length);
+	}
+	const hostEnd = cleaned.indexOf("/");
+	if (hostEnd !== -1) cleaned = cleaned.slice(0, hostEnd);
+	cleaned = cleaned.replace(/:$/, "");
+	const portMatch = /^(.+):(\d+)$/.exec(cleaned);
+	if (portMatch !== null) cleaned = `${portMatch[1].toLowerCase()}:${portMatch[2]}`;
+	else cleaned = cleaned.toLowerCase();
+	return scheme === "" ? cleaned : `${scheme}${cleaned}`;
+}
+/** 8-char hex digest for stable short id. */
+function makeTargetId(canonicalTarget) {
+	return createHash("sha1").update(canonicalTarget).digest("hex").slice(0, 8);
+}
+/**
+* Slug-safe directory name from a target string.
+* Replaces path-unsafe characters with hyphens.
+* Format: <readable-slug>-<short-hash>
+*/
+function makeTargetDirName(target, id) {
+	return `${target.replace(/^https?:\/\//, "").replace(/[^a-zA-Z0-9._-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 40)}-${id}`;
 }
-function workspaceDir(projectDir) {
+function projectWorkspaceDir(projectDir) {
 	return join(projectDir, WORKSPACE_DIR);
 }
+function targetRegistryPath(projectDir) {
+	return join(projectWorkspaceDir(projectDir), RUN_DIR$1, TARGETS_FILE);
+}
+function targetsRoot(projectDir) {
+	return join(projectWorkspaceDir(projectDir), TARGETS_SUBDIR);
+}
+function runFilePath(ctx) {
+	return join(ctx.targetRoot, RUN_DIR$1, RUN_FILE);
+}
+function eventsFilePath(ctx) {
+	return join(ctx.targetRoot, RUN_DIR$1, "events.jsonl");
+}
+function targetInputDir(ctx) {
+	return join(ctx.targetRoot, "target", "inputs");
+}
+function stagesDir(ctx) {
+	return join(ctx.targetRoot, "stages");
+}
+function stageDelegationsDir(ctx, stage) {
+	return join(stagesDir(ctx), stageDir(stage), "delegations");
+}
+/** Host-side delegation directory: `<targetRoot>/stages/<NN>-<stage>/delegations/D-00N`. */
+function delegationHostDir(ctx, stage, id) {
+	return join(stageDelegationsDir(ctx, stage), id);
+}
+/** Container-side delegation directory: `/workspace/stages/<NN>-<stage>/delegations/D-00N`. */
+function delegationContainerDir(stage, id) {
+	return `/workspace/stages/${stageDir(stage)}/delegations/${id}`;
+}
+var TargetRegistryError = class extends Error {};
+/**
+* Load the workspace target registry. Returns empty registry if file does not
+* exist (no targets yet). Throws on corruption.
+*/
+async function loadTargetRegistry(projectDir) {
+	const file = targetRegistryPath(projectDir);
+	if (!existsSync(file)) return {
+		schemaVersion: TARGET_REGISTRY_SCHEMA,
+		targets: []
+	};
+	let parsed;
+	try {
+		parsed = JSON.parse(await readFile(file, "utf8"));
+	} catch (error) {
+		throw new TargetRegistryError(`targets.json is corrupted: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (parsed === null || typeof parsed !== "object") throw new TargetRegistryError("targets.json must be an object");
+	const record = parsed;
+	if (record.schemaVersion !== TARGET_REGISTRY_SCHEMA) throw new TargetRegistryError(`targets.json: unsupported schemaVersion ${String(record.schemaVersion)}`);
+	if (!Array.isArray(record.targets)) throw new TargetRegistryError("targets.json: targets must be an array");
+	return record;
+}
+/** Atomic write via tmp+rename. */
+async function saveTargetRegistry(projectDir, registry) {
+	const file = targetRegistryPath(projectDir);
+	await mkdir(join(projectWorkspaceDir(projectDir), RUN_DIR$1), { recursive: true });
+	const tmp = `${file}.${crypto.randomUUID().slice(0, 8)}.tmp`;
+	await writeFile(tmp, `${JSON.stringify(registry, null, 2)}\n`);
+	await rename(tmp, file);
+}
+const registryQueue = /* @__PURE__ */ new Map();
+/**
+* Serial read-modify-write for targets.json. Keyed by projectDir.
+* Concurrent inserts from different sessions are serialized to prevent
+* lost updates.
+*/
+async function updateTargetRegistry(projectDir, fn) {
+	const next = (registryQueue.get(projectDir) ?? Promise.resolve()).then(async () => {
+		const registry = await loadTargetRegistry(projectDir);
+		await fn(registry);
+		await saveTargetRegistry(projectDir, registry);
+	});
+	registryQueue.set(projectDir, next.catch(() => void 0).then(() => {}));
+	return next;
+}
+function listTargetRecords(registry) {
+	return registry.targets;
+}
+function resolveTargetByCanonicalTarget(registry, canonicalTarget) {
+	return registry.targets.find((t) => t.canonicalTarget === canonicalTarget);
+}
+function resolveTargetByRootSession(registry, sessionId) {
+	return registry.targets.find((t) => t.rootSessionId === sessionId);
+}
+/**
+* Find a TargetRecord whose PentestRun contains a Delegation with the given
+* worker sessionId. Returns undefined if no active run matches.
+* This is a heavier query that requires loading each target's run.json.
+*/
+async function resolveTargetByWorkerSession(projectDir, registry, sessionId) {
+	for (const record of registry.targets) {
+		const runFile = runFilePath(buildTargetContext(projectDir, record));
+		if (!existsSync(runFile)) continue;
+		try {
+			const run = JSON.parse(await readFile(runFile, "utf8"));
+			const delegations = run?.delegations;
+			if (!Array.isArray(delegations)) continue;
+			if (delegations.some((d) => d.sessionId === sessionId)) return {
+				record,
+				run
+			};
+		} catch {
+			continue;
+		}
+	}
+}
+function buildTargetContext(projectDir, record) {
+	const targetRootPath = join(targetsRoot(projectDir), record.dirName);
+	return {
+		projectDir,
+		workspaceRoot: projectWorkspaceDir(projectDir),
+		targetId: record.id,
+		target: record.target,
+		canonicalTarget: record.canonicalTarget,
+		dirName: record.dirName,
+		targetRoot: targetRootPath,
+		rootSessionId: record.rootSessionId
+	};
+}
 /**
-* 非异常版加载：文件不存在返回 null（不要用 try/catch 判存在性）；
-* 文件损坏仍抛 StoreError（不吞损坏，防止用新 Run 覆盖坏文件）。
+* Resolve the TargetContext for the given Root session.
+* Returns undefined if this session is not bound to any target.
 */
+async function resolveSessionTargetContext(projectDir, sessionId) {
+	const record = resolveTargetByRootSession(await loadTargetRegistry(projectDir), sessionId);
+	if (record === void 0) return void 0;
+	return buildTargetContext(projectDir, record);
+}
+/**
+* Resolve TargetContext for a worker session (via delegation binding).
+* Returns undefined if no delegation matches this session.
+*/
+async function resolveWorkerTargetContext(projectDir, sessionId) {
+	const result = await resolveTargetByWorkerSession(projectDir, await loadTargetRegistry(projectDir), sessionId);
+	if (result === void 0) return void 0;
+	return buildTargetContext(projectDir, result.record);
+}
+//#endregion
+//#region src/store.ts
 /**
-* 唯一 PentestRun 解析入口（docs/plan.md §6）：文件不存在 → null；
-* 文件损坏 → StoreError。插件侧所有消费者统一走这里。
+* store.ts — target-scoped PentestRun persistence (docs/workspace.md).
+* Atomic write via tmp+rename; no event log, no replay.
+*
+* All run I/O requires a TargetContext (from src/targets.ts). Bare projectDir
+* is no longer accepted for run-level operations.
 */
-async function resolvePentestRun(projectDir) {
-	return tryLoadRun(projectDir);
+const RUN_DIR = ".dsh-pentester";
+var StoreError = class extends Error {};
+async function resolvePentestRun(ctx) {
+	return tryLoadRun(ctx);
 }
-async function tryLoadRun(projectDir) {
-	const file = runFilePath(projectDir);
+async function tryLoadRun(ctx) {
+	const file = runFilePath(ctx);
 	if (!existsSync(file)) return null;
 	let parsed;
 	try {
@@ -303,14 +483,13 @@ async function tryLoadRun(projectDir) {
 	}
 	return validateRun(parsed, file);
 }
-async function saveRun(projectDir, run) {
-	const file = runFilePath(projectDir);
-	await mkdir(join(workspaceDir(projectDir), RUN_DIR), { recursive: true });
+async function saveRun(ctx, run) {
+	const file = runFilePath(ctx);
+	await mkdir(join(ctx.targetRoot, RUN_DIR), { recursive: true });
 	const tmp = `${file}.${crypto.randomUUID().slice(0, 8)}.tmp`;
 	await writeFile(tmp, `${JSON.stringify(run, null, 2)}\n`);
 	await rename(tmp, file);
 }
-/** Linear advance only; the host never judges information sufficiency. */
 function advanceStage(run, reason) {
 	if (run.currentStage === null || run.status === "completed") throw new StoreError("run is already completed; cannot advance");
 	const current = run.currentStage;
@@ -335,8 +514,6 @@ function advanceStage(run, reason) {
 	});
 	return target;
 }
-/** 当前 stage 状态（缺省：currentStage=active，其余=pending）。 */
-/** 把当前 stage 标为 reviewing（最后一个 delegation 结算时调用）。 */
 function markStageReviewing(run) {
 	if (run.currentStage === null) return;
 	run.stageStatuses = {
@@ -344,14 +521,6 @@ function markStageReviewing(run) {
 		[run.currentStage]: "reviewing"
 	};
 }
-/** 当前 stage 的 delegation 目录：`workspace/stages/<NN>-<stage>/delegations/`。 */
-function stageDelegationsDir(projectDir, stage) {
-	return join(workspaceDir(projectDir), "stages", stageDir(stage), "delegations");
-}
-/** 某 delegation 的工作区目录：`workspace/stages/<NN>-<stage>/delegations/D-00N`。 */
-function delegationWorkspaceDir(projectDir, stage, id) {
-	return join(stageDelegationsDir(projectDir, stage), id);
-}
 function nextDelegationId(run) {
 	let max = 0;
 	for (const delegation of run.delegations) {
@@ -366,7 +535,7 @@ function findDelegation(run, id) {
 function validateRun(value, file) {
 	if (value === null || typeof value !== "object") throw new StoreError(`${file}: run.json must be an object`);
 	const record = value;
-	if (record.schemaVersion !== 1) throw new StoreError(`${file}: unsupported schemaVersion ${String(record.schemaVersion)}`);
+	if (record.schemaVersion !== 2 && record.schemaVersion !== 1) throw new StoreError(`${file}: unsupported schemaVersion ${String(record.schemaVersion)}`);
 	if (record.currentStage !== null && (typeof record.currentStage !== "string" || !isStageId(record.currentStage))) throw new StoreError(`${file}: invalid currentStage`);
 	if (!Array.isArray(record.delegations)) throw new StoreError(`${file}: delegations must be an array`);
 	return record;
@@ -374,33 +543,34 @@ function validateRun(value, file) {
 //#endregion
 //#region src/workspace.ts
 /**
-* workspace.ts — 工作区布局初始化与宿主侧产物。
+* workspace.ts — target-scoped workspace initialization and host-side artifacts.
 *
-* 固定骨架（每次 run 结构完全一致，见 docs/workspace.md）：
+* New layout (per docs/workspace.md, updated for multi-target):
 *
-*   <project>/workspace/            = 容器 /workspace（共享 volume 的宿主镜像）
-*   ├── .gitignore                  # traffic/ *.pcap *.mitm tmp/ cache/ *.log
-*   ├── STATUS.md                   # 宿主自动生成的可读状态
-*   ├── target/  target.json scope/ roe/ inputs/
-*   ├── assets/  assets.json
-*   ├── stages/  <NN>-<stage>/  summary.md delegations/
-*   ├── findings/
-*   ├── report/
-*   └── traffic/
-*
-* 宿主侧状态（不随 volume 同步）：<project>/.dsh-pentester/run.json、
-* workspace.json、events.jsonl（append-only）。
+*   <project>/workspace/
+*   ├── .dsh-pentester/
+*   │   └── targets.json           ← Target registry (workspace-level)
+*   └── targets/
+*       └── <target-id>/
+*           ├── .git/
+*           ├── .dsh-pentester/
+*           │   ├── run.json
+*           │   ├── workspace.json
+*           │   └── events.jsonl
+*           ├── target/
+*           ├── assets/
+*           ├── findings/
+*           ├── stages/
+*           ├── report/
+*           └── traffic/
 */
-function workspaceFilePath(projectDir) {
-	return join(workspaceDir(projectDir), RUN_DIR, "workspace.json");
-}
-function eventsFilePath(projectDir) {
-	return join(workspaceDir(projectDir), RUN_DIR, "events.jsonl");
+function workspaceFilePath(ctx) {
+	return join(ctx.targetRoot, RUN_DIR, "workspace.json");
 }
-/** 追加一条事件（失败不阻塞主流程）。 */
-async function appendEvent(projectDir, event) {
+/** Append an event to the target's events.jsonl (best-effort, never blocks). */
+async function appendEvent(ctx, event) {
 	try {
-		await appendFile(eventsFilePath(projectDir), `${JSON.stringify({
+		await appendFile(eventsFilePath(ctx), `${JSON.stringify({
 			ts: event.ts,
 			type: event.type,
 			data: event.data
@@ -408,14 +578,14 @@ async function appendEvent(projectDir, event) {
 	} catch {}
 }
 /**
-* 初始化工作区固定骨架 + 宿主侧状态文件。幂等：已存在则只补齐缺失目录。
-* @param target 初始目标（pre-engagement 确认后写入 target/target.json）。
-* @param scope 用户确认后的 Scope 文本（写入 target/scope.md，不做机器 enforcement）。
-* @param roe 用户确认后的 RoE / Authorization 事实（写入 target/roe.md，不做程序级语义解析）。
+* Initialize a target workspace with the full skeleton.
+* Creates: .dsh-pentester/, target/, assets/, findings/, stages/,
+* report/, traffic/, .gitignore.
+* Idempotent: only creates missing directories.
 */
-async function initWorkspace(projectDir, options = {}) {
-	const root = workspaceDir(projectDir);
-	const metaPath = workspaceFilePath(projectDir);
+async function initTargetWorkspace(ctx, options = {}) {
+	const root = ctx.targetRoot;
+	const metaPath = workspaceFilePath(ctx);
 	await mkdir(join(root, RUN_DIR), { recursive: true });
 	let meta;
 	if (existsSync(metaPath)) meta = JSON.parse(await readFile(metaPath, "utf8"));
@@ -429,7 +599,7 @@ async function initWorkspace(projectDir, options = {}) {
 			gitBranch: "main"
 		};
 		await writeFile(metaPath, `${JSON.stringify(meta, null, 2)}\n`, "utf8");
-		await appendEvent(projectDir, {
+		await appendEvent(ctx, {
 			ts: meta.createdAt,
 			type: "run.created",
 			data: { target: meta.target }
@@ -454,37 +624,30 @@ async function initWorkspace(projectDir, options = {}) {
 		};
 		await writeFile(metaPath, `${JSON.stringify(meta, null, 2)}\n`, "utf8");
 	}
-	await writeTarget(projectDir, meta.target);
+	await writeTarget(ctx, meta.target);
 	if (options.scope !== void 0) await writeFile(join(root, "target", "scope.md"), options.scope.endsWith("\n") ? options.scope : `${options.scope}\n`, "utf8");
 	if (options.roe !== void 0) await writeFile(join(root, "target", "roe.md"), options.roe.endsWith("\n") ? options.roe : `${options.roe}\n`, "utf8");
 	return meta;
 }
-/** 写 target/target.json（幂等；仅当文件不存在或 target 变化时更新）。 */
-async function writeTarget(projectDir, target) {
+/** Write target/target.json (idempotent). */
+async function writeTarget(ctx, target) {
 	if (target === void 0) return;
-	const file = join(workspaceDir(projectDir), "target", "target.json");
+	const file = join(ctx.targetRoot, "target", "target.json");
 	if ((existsSync(file) ? JSON.parse(await readFile(file, "utf8")) : void 0)?.target === target) return;
 	await writeFile(file, `${JSON.stringify({
 		target,
 		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
 	}, null, 2)}\n`, "utf8");
 }
-/**
-* 写 stage 的 summary.md（Stage handoff）。内容由 Root 通过
-* pentester_advance_stage(summary) 提供，Host 只负责写磁盘、不解析。
-*/
-async function writeStageSummary(projectDir, stage, summary) {
+/** Write stage summary.md. */
+async function writeStageSummary(ctx, stage, summary) {
 	const text = summary.trim();
 	if (text === "") return;
-	await writeFile(join(workspaceDir(projectDir), "stages", stageDir(stage), "summary.md"), `# ${stageDir(stage)}\n\n${text}\n`, "utf8");
+	await writeFile(join(ctx.targetRoot, "stages", stageDir(stage), "summary.md"), `# ${stageDir(stage)}\n\n${text}\n`, "utf8");
 }
-/**
-* 提升某 delegation 目录中的 canonical 产物（仅 threat-model.md）。
-* assets.json 和 findings.md 现在由 promoteAssets / promoteFindings
-* （src/pentest/）负责聚合提升，不再走简单 copyFile。
-*/
-async function promoteDeliverables(projectDir, dir) {
-	const root = workspaceDir(projectDir);
+/** Promote threat-model.md from delegation dir to canonical findings/. */
+async function promoteDeliverables(ctx, dir) {
+	const root = ctx.targetRoot;
 	for (const [name, relative] of [["threat-model.md", "findings/threat-model.md"]]) {
 		const source = join(dir, name);
 		if (!existsSync(source)) continue;
@@ -493,13 +656,9 @@ async function promoteDeliverables(projectDir, dir) {
 		await copyFile(source, target);
 	}
 }
-/**
-* 将 Pre-engagement 用户确认的完整授权信息写入
-* `target/inputs/pre-engagement.md` 作为原始输入 provenance。
-* 在 bootstrap（首次 advance）时调用。
-*/
-async function writePreEngagementInput(projectDir, options) {
-	const inputsDir = join(workspaceDir(projectDir), "target", "inputs");
+/** Write pre-engagement provenance to target/inputs/pre-engagement.md. */
+async function writePreEngagementInput(ctx, options) {
+	const inputsDir = targetInputDir(ctx);
 	await mkdir(inputsDir, { recursive: true });
 	const content = [
 		"# Pre-engagement Confirmation",
@@ -507,7 +666,7 @@ async function writePreEngagementInput(projectDir, options) {
 		`**Recorded**: ${(/* @__PURE__ */ new Date()).toISOString()}`,
 		"",
 		"## Target",
-		...options.targets.map((t) => `- ${t}`),
+		`- ${options.target}`,
 		"",
 		"## Scope",
 		options.scope,
@@ -532,7 +691,7 @@ async function writePreEngagementInput(projectDir, options) {
 * durable Session that survives across turns and can accept followup messages
 * from Root or user. The plugin only manages PTES domain state.
 *
-* 目录契约（docs/workspace.md）：`workspace/stages/<NN>-<stage>/delegations/D-00N/`
+* 目录契约：`<targetRoot>/stages/<NN>-<stage>/delegations/D-00N/`
 *   input/  work/  artifacts/  evidence/  result.md
 * Worker 只写自己的 delegation 目录；宿主写 input/task_prompt.md 快照。
 * result.md 是当前 Delegation 的"最新正式可交付结果"，不是 child Session
@@ -562,11 +721,6 @@ const PROFILE_CATEGORIES = {
 	"threat-model": []
 };
 var DelegationError = class extends Error {};
-/**
-* Worker persona（官方 ContinuableStartSpec.request.persona）：常驻规则 +
-* AgentProfile 角色。Worker 是长期存在的 continuable child，可能收到多轮
-* 来自 Root 或用户的消息。
-*/
 const WORKER_BASELINE = `You are a long-lived PTES execution worker — a continuable child agent.
 
 You may receive multiple rounds of tasks from:
@@ -604,7 +758,10 @@ Standing rules:
 - One round ending does NOT mean your Delegation is permanently over. You may
   receive follow-up messages from Root or a user.
 - Your final response each round must summarize: what you did, what you found,
-  which files you wrote, and what you recommend investigating next.`;
+  which files you wrote, and what you recommend investigating next.
+- Set the timeout duration for invoking the tool to 1800000 milliseconds.
+  For operations such as enumeration, directory scanning, brute force cracking, etc.,
+  a longer duration such as 1 hour or 2 hours can be set.`;
 function buildWorkerPersona(profile, catalogText, toolPrompt) {
 	const parts = [WORKER_BASELINE];
 	if (toolPrompt !== void 0 && toolPrompt.length > 0) parts.push(toolPrompt);
@@ -615,16 +772,15 @@ function buildWorkerPersona(profile, catalogText, toolPrompt) {
 /**
 * Worker 首轮 user message（官方 ContinuableStartSpec.request.prompt）：
 * standalone task context。官方 continuable child 不继承 parent transcript，
-* 所以这里必须自包含：Delegation ID / Stage / Target / Scope / RoE /
-* 目录路径 / 完成契约 / task_prompt。
+* 所以必须自包含。
 */
 function buildWorkerTaskPrompt(options) {
-	const { run, delegation, projectDir } = options;
-	const stage = stageDefinition(delegation.stageId);
-	const containerDir = delegation.workspaceDir.startsWith(projectDir) ? delegation.workspaceDir.slice(projectDir.length).replace(/\\/g, "/") : `/workspace/stages/${stage === void 0 ? delegation.stageId : stage.id}`;
+	const { run, delegation, stageId } = options;
+	const stage = stageDefinition(stageId);
+	const containerDir = delegationContainerDir(stageId, delegation.id);
 	const metadata = [
 		`Delegation ID: ${delegation.id}`,
-		`Stage: ${delegation.stageId}${stage === void 0 ? "" : ` — ${stage.name}`}`,
+		`Stage: ${stageId}${stage === void 0 ? "" : ` — ${stage.name}`}`,
 		`Project workspace root: /workspace (READ-ONLY outside your own directory)`,
 		`Your deliverable directory: ${containerDir}`,
 		`  work/        scratch working files (default container cwd)`,
@@ -633,7 +789,7 @@ function buildWorkerTaskPrompt(options) {
 		`  result.md    current formal deliverable — write/update it as results accumulate`,
 		`Write policy: write files ONLY inside ${containerDir}; never modify`,
 		`  .git/, .dsh-pentester/, target/, other delegation directories or the workspace root.`,
-		run.targets.length > 0 ? `Targets: ${run.targets.join(", ")}` : "Targets: (not yet recorded)",
+		`Target: ${run.target || "(not yet recorded)"}`,
 		run.rulesOfEngagement === void 0 ? "" : `Rules of Engagement: ${run.rulesOfEngagement}`
 	].filter((line) => line !== "");
 	return [
@@ -656,11 +812,6 @@ function buildWorkerTaskPrompt(options) {
 		`  use the report tool to notify the Root Agent.`
 	].join("\n");
 }
-/**
-* 把 tools.json 的 categories 渲染成 compact 文本，注入 Worker persona。
-* 先输出 profile 匹配的 Recommended 工具，再输出 Other。
-* raw 格式由 gen-tools-json.sh 固定（categories: { name, bin, description, examples }[]）。
-*/
 function renderToolCatalog(raw, profileId) {
 	const data = raw;
 	if (data === null || data === void 0) return "";
@@ -698,25 +849,13 @@ var DelegationService = class {
 		this.dsh = dsh;
 		this.docker = docker;
 	}
-	/**
-	* 创建一个或多个 continuable Worker。
-	*
-	* 流程：
-	* validate PentestRun → validate Stage → validate AgentProfile →
-	* allocate D-xxx → scaffold Delegation → build standalone initial prompt →
-	* persist Delegation → ctx.subagents.startContinuable() →
-	* 得到 childId + messageId → Delegation.childSessionId = childId →
-	* Delegation.status = active → persist run.json → return
-	*
-	* startContinuable() resolve 的含义只是初始 prompt 已进入 child inbox，
-	* 不是 Worker 已完成任务。
-	*/
 	async delegate(deps, assignments) {
 		if (assignments.length === 0) throw new DelegationError("assignments must not be empty");
 		if (deps.run.status === "completed" || deps.run.currentStage === null) throw new DelegationError("PentestRun is completed; cannot delegate new work");
 		const stage = stageDefinition(deps.run.currentStage);
 		if (stage === void 0) throw new DelegationError(`unknown stage: ${deps.run.currentStage}`);
 		if (!this.dsh.subagentAvailable) throw new DelegationError("subagent infrastructure unavailable: ctx.subagents provider \"spawn\" is not registered");
+		const ctx = deps.targetContext;
 		const created = [];
 		for (const assignment of assignments) {
 			const profile = deps.profiles.get(assignment.agent);
@@ -725,8 +864,7 @@ var DelegationService = class {
 			if (assignment.objective.trim() === "" || assignment.taskPrompt.trim() === "") throw new DelegationError("objective and task_prompt must not be empty");
 			if (/delegations\/D-\d+/.test(assignment.taskPrompt)) throw new DelegationError("task_prompt must not contain concrete delegation paths (e.g. delegations/D-001). The Host manages D-ID allocation and directory structure. Reference deliverables by their logical names (e.g. \"the recon scan results from intelligence-gathering\").");
 			const id = nextDelegationId(deps.run);
-			const dir = delegationWorkspaceDir(deps.projectDir, deps.run.currentStage, id);
-			await scaffoldDelegationDir(dir, {
+			await scaffoldDelegationDir(delegationHostDir(ctx, deps.run.currentStage, id), {
 				id,
 				stage: deps.run.currentStage,
 				agent: profile.id,
@@ -739,13 +877,12 @@ var DelegationService = class {
 				agentId: profile.id,
 				objective: assignment.objective,
 				taskPrompt: assignment.taskPrompt,
-				workspaceDir: dir,
 				status: "starting",
 				createdAt: (/* @__PURE__ */ new Date()).toISOString()
 			};
 			deps.run.delegations.push(delegation);
-			await saveRun(deps.projectDir, deps.run);
-			await appendEvent(deps.projectDir, {
+			await saveRun(ctx, deps.run);
+			await appendEvent(ctx, {
 				ts: (/* @__PURE__ */ new Date()).toISOString(),
 				type: "delegation.created",
 				data: {
@@ -756,23 +893,20 @@ var DelegationService = class {
 			});
 			created.push(delegation);
 		}
-		await saveRun(deps.projectDir, deps.run);
-		await this.docker.pushWorkspace(deps.run.id, deps.projectDir).catch(() => void 0);
+		await saveRun(ctx, deps.run);
+		await this.docker.pushWorkspace(deps.run.id, ctx).catch(() => void 0);
 		const toolbox = await this.docker.ensureImage("kali");
 		const containerId = await this.docker.ensureRunContainer({
 			runId: deps.run.id,
+			targetId: ctx.targetId,
+			target: ctx.canonicalTarget,
 			toolbox,
-			projectDir: deps.projectDir
+			targetRoot: ctx.targetRoot
 		});
 		for (const delegation of created) await this.dispatch(deps, delegation, containerId);
-		await saveRun(deps.projectDir, deps.run);
+		await saveRun(ctx, deps.run);
 		return created;
 	}
-	/**
-	* 派发一个 delegation：创建 continuable child。
-	* startContinuable() resolve 时 child 已接受 prompt 但尚未开始执行。
-	* 之后 child 作为 durable Session 持续存在，可接受 followup。
-	*/
 	async dispatch(deps, delegation, containerId) {
 		const profile = deps.profiles.get(delegation.agentId);
 		let catalogText;
@@ -789,15 +923,15 @@ var DelegationService = class {
 			prompt: buildWorkerTaskPrompt({
 				run: deps.run,
 				delegation,
-				projectDir: deps.projectDir
+				stageId: delegation.stageId
 			}),
 			...profile.model === void 0 ? {} : { model: profile.model }
 		};
 		const start = await this.dsh.startContinuableWorker(input, deps.parent, deps.signal);
 		delegation.sessionId = start.childId;
 		delegation.status = "active";
-		await saveRun(deps.projectDir, deps.run);
-		await appendEvent(deps.projectDir, {
+		await saveRun(deps.targetContext, deps.run);
+		await appendEvent(deps.targetContext, {
 			ts: (/* @__PURE__ */ new Date()).toISOString(),
 			type: "delegation.dispatched",
 			data: {
@@ -807,15 +941,6 @@ var DelegationService = class {
 			}
 		});
 	}
-	/**
-	* 关闭 PTES Delegation。
-	*
-	* 流程：
-	* resolve D-ID → resolve childSessionId → 如有 live turn：interrupt child →
-	* Delegation.status = closed → persist。
-	*
-	* 不删除 durable Child Session transcript。用户以后仍然可以看到历史。
-	*/
 	async cancel(deps, delegationId, reason) {
 		const delegation = findDelegation(deps.run, delegationId);
 		if (delegation === void 0) throw new DelegationError(`unknown delegation: ${delegationId}`);
@@ -828,8 +953,8 @@ var DelegationService = class {
 		delegation.status = "closed";
 		delegation.resultSummary = reason ?? "closed by Root";
 		delegation.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
-		await saveRun(deps.projectDir, deps.run);
-		await appendEvent(deps.projectDir, {
+		await saveRun(deps.targetContext, deps.run);
+		await appendEvent(deps.targetContext, {
 			ts: (/* @__PURE__ */ new Date()).toISOString(),
 			type: "delegation.closed",
 			data: {
@@ -839,29 +964,21 @@ var DelegationService = class {
 		});
 		return delegation;
 	}
-	/**
-	* 当前 stage 全部 delegation 是否都已 settled（没有 active/starting）。
-	* 用于 advance 前的机械检查。
-	*/
 	stageHasPendingWork(run, stageId) {
 		return run.delegations.some((d) => d.stageId === stageId && (d.status === "active" || d.status === "starting"));
 	}
-	/**
-	* 当前 stage 全部 delegation 中没有 active/starting → 标记 reviewing。
-	*/
 	async maybeMarkReviewing(deps) {
 		if (deps.run.currentStage === null) return;
 		if (this.stageHasPendingWork(deps.run, deps.run.currentStage)) return;
 		markStageReviewing(deps.run);
-		await saveRun(deps.projectDir, deps.run);
-		await appendEvent(deps.projectDir, {
+		await saveRun(deps.targetContext, deps.run);
+		await appendEvent(deps.targetContext, {
 			ts: (/* @__PURE__ */ new Date()).toISOString(),
 			type: "stage.reviewing",
 			data: { stage: deps.run.currentStage }
 		});
 	}
 };
-/** 预建 delegation 目录骨架 + input/task_prompt 快照。 */
 async function scaffoldDelegationDir(dir, info) {
 	for (const sub of [
 		"input",
@@ -943,8 +1060,8 @@ function readJsonArray(file) {
 * deduplicate, and write the canonical `assets/assets.json` and (if any
 * services found) `assets/services.json`.
 */
-async function promoteAssets(projectDir, stage, delegationDirs, delegationIds) {
-	const root = workspaceDir(projectDir);
+async function promoteAssets(ctx, stage, delegationDirs, delegationIds) {
+	const root = ctx.targetRoot;
 	const updatedAt = (/* @__PURE__ */ new Date()).toISOString();
 	const assetMap = /* @__PURE__ */ new Map();
 	for (let index = 0; index < delegationDirs.length; index += 1) {
@@ -1004,8 +1121,8 @@ async function promoteAssets(projectDir, stage, delegationDirs, delegationIds) {
 * If a delegation produces `artifacts/findings.md`, its content is copied
 * into the canonical detail file with a provenance header.
 */
-async function promoteFindings(projectDir, stage, delegationDirs, delegationIds) {
-	const root = workspaceDir(projectDir);
+async function promoteFindings(ctx, stage, delegationDirs, delegationIds) {
+	const root = ctx.targetRoot;
 	const findingsDir = join(root, "findings");
 	await mkdir(findingsDir, { recursive: true });
 	const updatedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -1055,8 +1172,268 @@ function loadExistingIndex(findingsDir) {
 	}
 }
 //#endregion
+//#region src/pentest/pre-engagement.ts
+/**
+* pre-engagement.ts — fixed one-batch Pre-engagement questionnaire.
+*
+* The Root Agent calls ask_user_question EXACTLY ONCE with every question
+* in a single array. The host validates this contract mechanically before
+* pentester_start executes any side effect.
+*
+* Two planes:
+* 1. Pure domain constants (question IDs, definitions, answer helpers).
+* 2. Host-side session-event validator (reads persisted ask_user_question
+*    invocations from the Root Session via sessionQuery).
+*/
+/** Fixed question IDs in strict order. */
+const PRE_ENGAGEMENT_QUESTION_IDS = [
+	"target_confirm",
+	"scope_confirm",
+	"exclusions_confirm",
+	"roe_confirm",
+	"language_confirm",
+	"final_confirm"
+];
+/**
+* Parse the ask_user_question result's answers array into an id→answer map.
+*/
+function parseAnswers(answers) {
+	const map = /* @__PURE__ */ new Map();
+	if (answers !== void 0) {
+		for (const entry of answers) if (typeof entry.id === "string") map.set(entry.id, entry);
+	}
+	return map;
+}
+/**
+* Check whether a single answer is a "confirmed" (not "rejected") choice.
+* For questions that use options, we check the selected label.
+*/
+function isAnswerAccepted(questionId, answer) {
+	if (answer === void 0) return false;
+	const selected = (answer.selected ?? [])[0];
+	if (selected === void 0) return false;
+	switch (questionId) {
+		case "target_confirm": return selected !== "目标不正确";
+		case "scope_confirm": return selected !== "范围不正确";
+		case "exclusions_confirm": return selected === "无额外排除项";
+		case "roe_confirm": return selected === "标准 RoE" || selected === "仅非侵入式测试";
+		case "language_confirm": return selected === "中文" || selected === "English";
+		case "final_confirm": return selected === "确认并开始";
+	}
+}
+/**
+* True when ALL six questions received confirmed answers.
+*/
+function isPreEngagementConfirmed(answersById) {
+	return PRE_ENGAGEMENT_QUESTION_IDS.every((id) => isAnswerAccepted(id, answersById.get(id)));
+}
+/**
+* Validate that the current Root Session contains exactly one completed
+* ask_user_question invocation with the six canonical Pre-engagement questions
+* in the canonical order, all confirmed, matching the start arguments.
+*
+* Reads from the session event log via sessionQuery — never trusts model
+* arguments or browser state.
+*/
+async function validatePreEngagementBatch(sessionQuery, sessionId, startArgs) {
+	const events = (await sessionQuery.readSession(sessionId)).events;
+	let bestCall;
+	let bestResult;
+	for (let i = events.length - 1; i >= 0; i--) {
+		const event = events[i];
+		if (event.type !== "tool/call") continue;
+		const data = event.data;
+		if (data === void 0 || data.name !== "ask_user_question") continue;
+		if (isExistingTargetActionCall(data)) continue;
+		const result = findMatchingResult(events, data.callId);
+		if (result === void 0) continue;
+		bestCall = data;
+		bestResult = result;
+		break;
+	}
+	if (bestCall === void 0 || bestResult === void 0) return {
+		ok: false,
+		code: "pre_engagement_missing",
+		message: "No completed ask_user_question invocation found in this session. Ask all six Pre-engagement questions together in one ask_user_question call: " + PRE_ENGAGEMENT_QUESTION_IDS.join(", ") + "."
+	};
+	let questions;
+	try {
+		const parsed = JSON.parse(bestCall.arguments);
+		questions = Array.isArray(parsed.questions) ? parsed.questions : [];
+	} catch {
+		return {
+			ok: false,
+			code: "pre_engagement_missing",
+			message: "The ask_user_question invocation has malformed arguments."
+		};
+	}
+	const questionIds = questions.map((q) => typeof q?.id === "string" ? q.id : "");
+	if (questionIds.length !== PRE_ENGAGEMENT_QUESTION_IDS.length) return {
+		ok: false,
+		code: "pre_engagement_wrong_question_count",
+		message: `Pre-engagement requires exactly ${PRE_ENGAGEMENT_QUESTION_IDS.length} questions, got ${questionIds.length}. Re-ask all six questions together in one batch.`
+	};
+	for (let i = 0; i < PRE_ENGAGEMENT_QUESTION_IDS.length; i++) if (questionIds[i] !== PRE_ENGAGEMENT_QUESTION_IDS[i]) return {
+		ok: false,
+		code: "pre_engagement_wrong_question_order",
+		message: `Pre-engagement question at position ${i + 1} must be "${PRE_ENGAGEMENT_QUESTION_IDS[i]}", got "${questionIds[i]}". The six questions must be in this exact order: ` + PRE_ENGAGEMENT_QUESTION_IDS.join(", ") + "."
+	};
+	if (new Set(questionIds).size !== questionIds.length) return {
+		ok: false,
+		code: "pre_engagement_wrong_question_order",
+		message: "Pre-engagement question IDs must be unique. Re-ask all six questions together."
+	};
+	if (bestResult.error !== void 0) return {
+		ok: false,
+		code: "pre_engagement_incomplete",
+		message: `The Pre-engagement questionnaire was not answered (error: ${bestResult.error.code}). Re-ask all six questions together.`
+	};
+	let answers;
+	try {
+		const rawContent = bestResult.message.content;
+		const toolResultBlock = rawContent.find((b) => b.type === "tool-result");
+		if (toolResultBlock !== void 0) {
+			if (toolResultBlock.isError === true) return {
+				ok: false,
+				code: "pre_engagement_incomplete",
+				message: "The Pre-engagement questionnaire result returned an error. Re-ask all six questions together."
+			};
+			const innerText = (toolResultBlock.content ?? []).find((b) => b.type === "text");
+			if (innerText === void 0 || innerText.text === void 0) return {
+				ok: false,
+				code: "pre_engagement_incomplete",
+				message: "The Pre-engagement questionnaire result is empty (tool-result block has no text content). Re-ask all six questions together."
+			};
+			const parsed = JSON.parse(innerText.text);
+			answers = Array.isArray(parsed.answers) ? parsed.answers : [];
+		} else {
+			const textBlock = rawContent.find((b) => b.type === "text");
+			if (textBlock !== void 0 && textBlock.text !== void 0) {
+				const parsed = JSON.parse(textBlock.text);
+				answers = Array.isArray(parsed.answers) ? parsed.answers : [];
+			} else return {
+				ok: false,
+				code: "pre_engagement_incomplete",
+				message: `The Pre-engagement questionnaire result is in an unrecognized format. Found content types: ${JSON.stringify(rawContent.map((b) => b.type))}. Re-ask all six questions together.`
+			};
+		}
+	} catch {
+		return {
+			ok: false,
+			code: "pre_engagement_incomplete",
+			message: "The Pre-engagement questionnaire result is malformed. Re-ask all six questions together."
+		};
+	}
+	const answersById = parseAnswers(answers);
+	const unanswered = PRE_ENGAGEMENT_QUESTION_IDS.filter((id) => !answersById.has(id));
+	if (unanswered.length > 0) return {
+		ok: false,
+		code: "pre_engagement_incomplete",
+		message: `Pre-engagement questions not answered: ${unanswered.join(", ")}. Re-ask all six questions together.`
+	};
+	if (!isPreEngagementConfirmed(answersById)) return {
+		ok: false,
+		code: "pre_engagement_not_confirmed",
+		message: "Not all Pre-engagement questions were confirmed. The user must confirm all six questions before starting."
+	};
+	if (!isAnswerAccepted("final_confirm", answersById.get("final_confirm"))) return {
+		ok: false,
+		code: "pre_engagement_not_confirmed",
+		message: "The final confirmation was not accepted. The user must select \"确认并开始\" to proceed."
+	};
+	const targetAnswer = answersById.get("target_confirm");
+	if (targetAnswer !== void 0) {
+		const selected = (targetAnswer.selected ?? [])[0];
+		if (selected !== void 0 && selected !== "目标不正确") {}
+	}
+	const proofAnswers = Object.fromEntries(PRE_ENGAGEMENT_QUESTION_IDS.map((id) => [id, answersById.get(id)]));
+	return {
+		ok: true,
+		invocationCallId: bestCall.callId,
+		answers: proofAnswers
+	};
+}
+/**
+* Require a valid pre-engagement proof. Throws with a descriptive error
+* message on failure.
+*/
+async function requirePreEngagementProof(sessionQuery, sessionId, startArgs) {
+	const result = await validatePreEngagementBatch(sessionQuery, sessionId, startArgs);
+	if (!result.ok) throw new Error(`[${result.code}] ${result.message}`);
+	return result;
+}
+/**
+* Check whether an ask_user_question call is the existing_target_action
+* selector ("Continue/Restart") rather than the Pre-engagement batch.
+*/
+function isExistingTargetActionCall(data) {
+	try {
+		const parsed = JSON.parse(data.arguments);
+		const questions = Array.isArray(parsed.questions) ? parsed.questions : [];
+		return questions.length === 1 && typeof questions[0]?.id === "string" && questions[0].id === "existing_target_action";
+	} catch {
+		return false;
+	}
+}
+/**
+* Find the tool/result event matching a given tool/call by callId.
+* Checks both `data.message.source.callId` (standard) and `data.callId` (fallback).
+*/
+function findMatchingResult(events, callId) {
+	for (const event of events) {
+		if (event.type !== "tool/result") continue;
+		const data = event.data;
+		if (data === void 0) continue;
+		if (data.message?.source?.callId === callId) return data;
+		if (data.callId === callId) return data;
+	}
+}
+//#endregion
 //#region src/tools.ts
 const ROOT_TOOL_SCHEMAS = {
+	pentester_start: {
+		type: "object",
+		additionalProperties: false,
+		required: [
+			"target",
+			"scope",
+			"rules_of_engagement",
+			"language",
+			"summary",
+			"mode"
+		],
+		properties: {
+			target: {
+				type: "string",
+				description: "Primary target (hostname, IP, URL)."
+			},
+			scope: {
+				type: "string",
+				description: "Authorized scope description."
+			},
+			rules_of_engagement: {
+				type: "string",
+				description: "Rules of Engagement text."
+			},
+			language: {
+				type: "string",
+				description: "Output language (e.g. zh-CN, en)."
+			},
+			summary: {
+				type: "string",
+				description: "Pre-engagement confirmation summary."
+			},
+			mode: {
+				type: "string",
+				enum: ["new", "restart"],
+				description: "new for fresh target, restart for existing target."
+			},
+			expected_target_id: {
+				type: "string",
+				description: "For restart: expected target id to prevent race."
+			}
+		}
+	},
 	pentester_delegate: {
 		type: "object",
 		additionalProperties: false,
@@ -1076,7 +1453,7 @@ const ROOT_TOOL_SCHEMAS = {
 				properties: {
 					agent: {
 						type: "string",
-						description: "AgentProfile id attached to the current Stage (see Available AgentProfiles in your run state)."
+						description: "AgentProfile id attached to the current Stage."
 					},
 					objective: {
 						type: "string",
@@ -1084,7 +1461,7 @@ const ROOT_TOOL_SCHEMAS = {
 					},
 					task_prompt: {
 						type: "string",
-						description: "Full task context for the worker: known facts, gaps to close, references to existing deliverables."
+						description: "Full task context for the worker."
 					}
 				}
 			}
@@ -1103,28 +1480,10 @@ const ROOT_TOOL_SCHEMAS = {
 		type: "object",
 		additionalProperties: false,
 		required: ["summary"],
-		properties: {
-			summary: {
-				type: "string",
-				description: "Stage handoff summary (what was done, confirmed, key results, next-stage focus). The host writes it to stages/<stage>/summary.md verbatim and never parses it."
-			},
-			run: {
-				type: "object",
-				additionalProperties: false,
-				description: "Only for the FIRST advance of a new run (bootstrap): records the user-confirmed targets/RoE and output language. The host creates the PentestRun and completes pre-engagement.",
-				properties: {
-					targets: {
-						type: "array",
-						items: { type: "string" }
-					},
-					rules_of_engagement: { type: "string" },
-					language: {
-						type: "string",
-						description: "Output language for host-generated files (e.g. zh-CN, en)."
-					}
-				}
-			}
-		}
+		properties: { summary: {
+			type: "string",
+			description: "Stage handoff summary."
+		} }
 	},
 	pentester_rollback_stage: {
 		type: "object",
@@ -1133,7 +1492,7 @@ const ROOT_TOOL_SCHEMAS = {
 		properties: {
 			stage: {
 				type: "string",
-				description: "Domain StageId to roll back to (e.g. intelligence-gathering); its completed checkpoint becomes the new timeline root."
+				description: "Domain StageId to roll back to."
 			},
 			reason: {
 				type: "string",
@@ -1171,6 +1530,13 @@ function registerRootTools(tools, deps) {
 			text: JSON.stringify(value)
 		}]
 	};
+	tools.register({
+		name: "pentester_start",
+		description: ROOT_TOOL_DESCRIPTIONS.pentester_start,
+		parameters: ROOT_TOOL_SCHEMAS.pentester_start,
+		output,
+		execute: (args, exec) => startRun(deps, args, exec)
+	});
 	tools.register({
 		name: "pentester_delegate",
 		description: ROOT_TOOL_DESCRIPTIONS.pentester_delegate,
@@ -1200,6 +1566,7 @@ function registerRootTools(tools, deps) {
 		execute: (args, exec) => rollback(deps, args, exec)
 	});
 	return [
+		"pentester_start",
 		"pentester_delegate",
 		"pentester_cancel_delegation",
 		"pentester_advance_stage",
@@ -1207,44 +1574,231 @@ function registerRootTools(tools, deps) {
 	];
 }
 const ROOT_TOOL_DESCRIPTIONS = {
-	pentester_delegate: "Creates a new long-lived continuable PTES worker. IMPORTANT: Before calling this tool, first tell the user which worker you are creating, what it will do, and why the current PTES stage needs it. Do not call this tool silently. Each call creates a NEW durable child Session. For follow-up work with an existing child, do not call pentester_delegate again; use send_message through the continuation interface.",
-	pentester_cancel_delegation: "Close a PTES Delegation. Interrupts the live child turn if active, then marks the Delegation as closed. The child Session transcript is preserved for future reference. Use send_message/interrupt_agent for follow-up or interruption without closing.",
-	pentester_advance_stage: "Advance to the next PTES stage after you judge the exit criteria satisfied. The host only verifies linear order and that no active/starting delegations remain. On the FIRST call (no PentestRun yet) pass run (targets / rules_of_engagement / language) + summary: the host bootstraps the workspace, run.json, target files, git and completes pre-engagement.",
-	pentester_rollback_stage: "Roll the timeline back to a completed stage checkpoint and start a rework branch from the next stage. Closes active delegations, saves a WIP backup branch, never rewrites history."
+	pentester_start: "Initialize or restart a PentestRun for a target. Must be called before any other pentester tool. Mode \"new\" creates a fresh target; mode \"restart\" resets an existing target (old data destroyed).",
+	pentester_delegate: "Creates a new long-lived continuable PTES worker. IMPORTANT: explain to the user which worker you are creating before calling this tool.",
+	pentester_cancel_delegation: "Close a PTES Delegation. Interrupts the live child turn if active, then marks the Delegation as closed.",
+	pentester_advance_stage: "Advance to the next PTES stage. The host verifies linear order and that no active/starting delegations remain.",
+	pentester_rollback_stage: "Roll the timeline back to a completed stage checkpoint and start a rework branch."
 };
-async function delegate(deps, args, exec) {
+async function startRun(deps, args, exec) {
 	const caller = requireRootCaller(exec);
 	const projectDir = caller.cwd;
-	const parent = agentOf(exec);
-	if (parent === void 0) throw new Error("pentester_delegate requires a calling agent (exec.agent was undefined)");
-	const signal = signalOf(exec);
-	const run = await requireRun(caller, deps);
-	const assignments = parseAssignments(args.assignments);
-	const created = await deps.delegations.delegate({
-		projectDir,
-		run,
-		profiles: deps.profiles,
+	const sessionId = caller.sessionId;
+	const target = typeof args.target === "string" ? args.target.trim() : "";
+	const scope = typeof args.scope === "string" ? args.scope : "";
+	const roe = typeof args.rules_of_engagement === "string" ? args.rules_of_engagement : "";
+	const language = typeof args.language === "string" ? args.language : "zh-CN";
+	const summary = typeof args.summary === "string" ? args.summary : "";
+	const mode = args.mode === "restart" ? "restart" : "new";
+	const expectedTargetId = typeof args.expected_target_id === "string" ? args.expected_target_id : void 0;
+	if (target === "") throw new Error("pentester_start requires a non-empty target");
+	if (scope === "") throw new Error("pentester_start requires a non-empty scope");
+	if (summary.trim() === "") throw new Error("pentester_start requires a non-empty summary");
+	await requirePreEngagementProof(deps.sessionQuery, sessionId, {
+		target,
+		scope,
+		language
+	});
+	const canonical = canonicalizeTarget(target);
+	if (canonical === "") throw new Error(`invalid target: "${target}"`);
+	const registry = await loadTargetRegistry(projectDir);
+	const existingBinding = resolveTargetByRootSession(registry, sessionId);
+	if (existingBinding !== void 0 && existingBinding.canonicalTarget !== canonical) throw new Error(`This session is already bound to target "${existingBinding.target}". Create a new Pentester Session for a different target.`);
+	const existingTarget = resolveTargetByCanonicalTarget(registry, canonical);
+	if (mode === "new") {
+		if (existingTarget !== void 0) throw new Error(`Target "${canonical}" already exists. Use mode "restart" to restart it, or open the existing Root Session for this target.`);
+		return bootstrapNewTarget(deps, projectDir, caller, registry, {
+			target,
+			canonical,
+			scope,
+			roe,
+			language,
+			summary
+		});
+	}
+	if (existingTarget === void 0) throw new Error(`Target "${canonical}" does not exist. Use mode "new" to create it.`);
+	if (expectedTargetId !== void 0 && expectedTargetId !== existingTarget.id) throw new Error(`Target id mismatch: expected ${expectedTargetId}, got ${existingTarget.id}. The target may have been modified concurrently.`);
+	return restartTarget(deps, projectDir, caller, registry, existingTarget, {
+		target,
+		canonical,
+		scope,
+		roe,
+		language,
+		summary
+	});
+}
+async function bootstrapNewTarget(deps, projectDir, caller, registry, opts) {
+	const id = makeTargetId(opts.canonical);
+	const dirName = makeTargetDirName(opts.target, id);
+	await updateTargetRegistry(projectDir, (r) => {
+		r.targets.push({
+			id,
+			target: opts.target,
+			canonicalTarget: opts.canonical,
+			dirName,
+			rootSessionId: caller.sessionId,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	});
+	const ctx = buildTargetContext(projectDir, {
+		id,
+		target: opts.target,
+		canonicalTarget: opts.canonical,
+		dirName,
 		rootSessionId: caller.sessionId,
-		parent,
-		signal
-	}, assignments);
-	return {
-		...rootState(run, deps.profiles),
-		created: created.map((d) => ({
-			id: d.id,
-			agent: d.agentId,
-			status: d.status,
-			...d.sessionId === void 0 ? {} : { childSessionId: d.sessionId }
-		}))
+		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	});
+	await initTargetWorkspace(ctx, {
+		target: opts.target,
+		language: opts.language,
+		scope: opts.scope,
+		roe: opts.roe
+	});
+	await writePreEngagementInput(ctx, {
+		target: opts.target,
+		scope: opts.scope,
+		roe: opts.roe,
+		language: opts.language
+	});
+	const run = {
+		schemaVersion: 2,
+		id: crypto.randomUUID(),
+		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+		target: opts.canonical,
+		scope: opts.scope,
+		rulesOfEngagement: opts.roe,
+		language: opts.language,
+		status: "active",
+		currentStage: "pre-engagement",
+		stageHistory: [{
+			stage: "pre-engagement",
+			enteredAt: (/* @__PURE__ */ new Date()).toISOString()
+		}],
+		delegations: []
+	};
+	await saveRun(ctx, run);
+	await deps.git.init(ctx, opts.target);
+	await writeStageSummary(ctx, "pre-engagement", opts.summary);
+	advanceStage(run, opts.summary);
+	await saveRun(ctx, run);
+	await deps.git.checkpointStage(ctx, "pre-engagement");
+	await appendEvent(ctx, {
+		ts: (/* @__PURE__ */ new Date()).toISOString(),
+		type: "stage.completed",
+		data: {
+			stage: "pre-engagement",
+			next: run.currentStage
+		}
+	});
+	await deps.pushWorkspace(ctx, run).catch(() => void 0);
+	return {
+		mode: "new",
+		targetId: id,
+		target: opts.canonical,
+		...rootState(run, deps.profiles)
 	};
 }
-async function cancel(deps, args, exec) {
+async function restartTarget(deps, projectDir, caller, registry, existing, opts) {
+	const ctx = buildTargetContext(projectDir, existing);
+	const oldRun = await resolvePentestRun(ctx);
+	if (oldRun !== null) await deps.pushWorkspace(ctx, oldRun).catch(() => void 0);
+	const { rm } = await import("node:fs/promises");
+	await rm(ctx.targetRoot, {
+		recursive: true,
+		force: true
+	}).catch(() => void 0);
+	await initTargetWorkspace(ctx, {
+		target: opts.target,
+		language: opts.language,
+		scope: opts.scope,
+		roe: opts.roe
+	});
+	await writePreEngagementInput(ctx, {
+		target: opts.target,
+		scope: opts.scope,
+		roe: opts.roe,
+		language: opts.language
+	});
+	const run = {
+		schemaVersion: 2,
+		id: crypto.randomUUID(),
+		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+		target: opts.canonical,
+		scope: opts.scope,
+		rulesOfEngagement: opts.roe,
+		language: opts.language,
+		status: "active",
+		currentStage: "pre-engagement",
+		stageHistory: [{
+			stage: "pre-engagement",
+			enteredAt: (/* @__PURE__ */ new Date()).toISOString()
+		}],
+		delegations: []
+	};
+	await saveRun(ctx, run);
+	await deps.git.init(ctx, opts.target);
+	await updateTargetRegistry(projectDir, (r) => {
+		const rec = r.targets.find((t) => t.id === existing.id);
+		if (rec !== void 0) {
+			rec.rootSessionId = caller.sessionId;
+			rec.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+		}
+	});
+	await writeStageSummary(ctx, "pre-engagement", opts.summary);
+	advanceStage(run, opts.summary);
+	await saveRun(ctx, run);
+	await deps.git.checkpointStage(ctx, "pre-engagement");
+	await appendEvent(ctx, {
+		ts: (/* @__PURE__ */ new Date()).toISOString(),
+		type: "stage.completed",
+		data: {
+			stage: "pre-engagement",
+			next: run.currentStage
+		}
+	});
+	await deps.pushWorkspace(ctx, run).catch(() => void 0);
+	return {
+		mode: "restart",
+		targetId: existing.id,
+		target: opts.canonical,
+		...rootState(run, deps.profiles)
+	};
+}
+async function delegate(deps, args, exec) {
 	const caller = requireRootCaller(exec);
-	const run = await requireRun(caller, deps);
+	const projectDir = caller.cwd;
+	const parent = agentOf(exec);
+	if (parent === void 0) throw new Error("pentester_delegate requires a calling agent (exec.agent was undefined)");
+	const signal = signalOf(exec);
+	const { ctx, run } = await requireTargetRun(caller);
+	const assignments = parseAssignments(args.assignments);
+	const created = await deps.delegations.delegate({
+		projectDir,
+		targetContext: ctx,
+		run,
+		profiles: deps.profiles,
+		rootSessionId: caller.sessionId,
+		parent,
+		signal
+	}, assignments);
+	return {
+		...rootState(run, deps.profiles),
+		created: created.map((d) => ({
+			id: d.id,
+			agent: d.agentId,
+			status: d.status,
+			...d.sessionId === void 0 ? {} : { childSessionId: d.sessionId }
+		}))
+	};
+}
+async function cancel(deps, args, exec) {
+	const { ctx, run } = await requireTargetRun(requireRootCaller(exec));
 	const delegationId = typeof args.delegation_id === "string" ? args.delegation_id : "";
 	const reason = typeof args.reason === "string" ? args.reason : void 0;
 	const cancelled = await deps.delegations.cancel({
-		projectDir: caller.cwd,
+		targetContext: ctx,
 		run
 	}, delegationId, reason);
 	return {
@@ -1256,27 +1810,25 @@ async function cancel(deps, args, exec) {
 	};
 }
 async function advance(deps, args, exec) {
-	const projectDir = requireRootCaller(exec).cwd;
+	const caller = requireRootCaller(exec);
 	const summary = typeof args.summary === "string" ? args.summary : "";
 	if (summary.trim() === "") throw new Error("pentester_advance_stage requires a non-empty summary (stage handoff text)");
-	let run = await resolvePentestRun(projectDir);
-	if (run === null) run = await bootstrapRun(deps, projectDir, parseRunInfo(args.run));
-	else await initWorkspace(projectDir, { language: run.language });
+	const { ctx, run } = await requireTargetRun(caller);
 	if (run.status === "completed" || run.currentStage === null) throw new Error("PentestRun is already completed; no stage to advance");
 	const previous = run.currentStage;
 	if (deps.delegations.stageHasPendingWork(run, previous)) throw new Error(`stage ${previous} still has active or starting delegations; close them with pentester_cancel_delegation before advancing`);
-	await deps.syncWorkspace(projectDir, run).catch(() => void 0);
+	await deps.syncWorkspace(ctx, run).catch(() => void 0);
 	const stageDelegations = run.delegations.filter((d) => d.stageId === previous);
-	const delegationDirs = stageDelegations.map((d) => d.workspaceDir);
+	const delegationDirs = stageDelegations.map((d) => delegationHostDir(ctx, previous, d.id));
 	const delegationIds = stageDelegations.map((d) => d.id);
-	await promoteAssets(projectDir, previous, delegationDirs, delegationIds);
-	await promoteFindings(projectDir, previous, delegationDirs, delegationIds);
-	for (const delegation of stageDelegations) await promoteDeliverables(projectDir, delegation.workspaceDir);
-	await writeStageSummary(projectDir, previous, summary);
+	await promoteAssets(ctx, previous, delegationDirs, delegationIds);
+	await promoteFindings(ctx, previous, delegationDirs, delegationIds);
+	for (const delegation of stageDelegations) await promoteDeliverables(ctx, delegationHostDir(ctx, previous, delegation.id));
+	await writeStageSummary(ctx, previous, summary);
 	const target = advanceStage(run, summary);
-	await saveRun(projectDir, run);
-	const tag = await deps.git.checkpointStage(projectDir, previous);
-	await appendEvent(projectDir, {
+	await saveRun(ctx, run);
+	const tag = await deps.git.checkpointStage(ctx, previous);
+	await appendEvent(ctx, {
 		ts: (/* @__PURE__ */ new Date()).toISOString(),
 		type: "stage.completed",
 		data: {
@@ -1285,7 +1837,7 @@ async function advance(deps, args, exec) {
 			next: target
 		}
 	});
-	await deps.pushWorkspace(projectDir, run).catch(() => void 0);
+	await deps.pushWorkspace(ctx, run).catch(() => void 0);
 	return {
 		previous,
 		...target === null ? { completed: true } : { next: target },
@@ -1294,9 +1846,7 @@ async function advance(deps, args, exec) {
 	};
 }
 async function rollback(deps, args, exec) {
-	const caller = requireRootCaller(exec);
-	const projectDir = caller.cwd;
-	const run = await requireRun(caller, deps);
+	const { ctx, run } = await requireTargetRun(requireRootCaller(exec));
 	const stageArg = typeof args.stage === "string" ? args.stage : "";
 	const reason = typeof args.reason === "string" ? args.reason : "";
 	if (!isStageId(stageArg)) throw new Error(`pentester_rollback_stage: unknown stage "${stageArg}"`);
@@ -1305,17 +1855,17 @@ async function rollback(deps, args, exec) {
 	if (!run.stageHistory.some((entry) => entry.stage === stageArg)) throw new Error(`pentester_rollback_stage: stage ${stageArg} has no completed checkpoint on this timeline`);
 	const active = run.delegations.filter((d) => d.status === "active" || d.status === "starting");
 	for (const delegation of active) await deps.delegations.cancel({
-		projectDir,
+		targetContext: ctx,
 		run
 	}, delegation.id, "rolled back by Root");
 	let backup;
-	if (await deps.git.hasChanges(projectDir)) backup = await deps.git.createBackupBranch(projectDir, stageArg);
-	const checkpoint = await deps.git.findStageCheckpoint(projectDir, stageArg);
+	if (await deps.git.hasChanges(ctx)) backup = await deps.git.createBackupBranch(ctx, stageArg);
+	const checkpoint = await deps.git.findStageCheckpoint(ctx, stageArg);
 	if (checkpoint === void 0) throw new Error(`pentester_rollback_stage: no checkpoint commit found for stage ${stageArg}`);
-	const branch = await deps.git.createReworkBranch(projectDir, checkpoint, stageDir(next));
-	const authoritativeRun = await resolvePentestRun(projectDir);
+	const branch = await deps.git.createReworkBranch(ctx, checkpoint, stageDir(next));
+	const authoritativeRun = await resolvePentestRun(ctx);
 	if (authoritativeRun === null) throw new Error("pentester_rollback_stage: run.json disappeared after checkout — this is a bug");
-	await appendEvent(projectDir, {
+	await appendEvent(ctx, {
 		ts: (/* @__PURE__ */ new Date()).toISOString(),
 		type: "stage.rollback",
 		data: {
@@ -1326,7 +1876,7 @@ async function rollback(deps, args, exec) {
 			reason
 		}
 	});
-	await deps.pushWorkspace(projectDir, authoritativeRun).catch(() => void 0);
+	await deps.pushWorkspace(ctx, authoritativeRun).catch(() => void 0);
 	return {
 		reopenedStage: stageArg,
 		currentStage: stageArg,
@@ -1336,56 +1886,17 @@ async function rollback(deps, args, exec) {
 		...rootState(authoritativeRun, deps.profiles)
 	};
 }
-const NO_RUN_MESSAGE = "No PentestRun exists. Complete pre-engagement and call pentester_advance_stage first — pass run (targets / rules_of_engagement / language) + summary to initialize the run.";
-async function requireRun(caller, _deps) {
+const NO_RUN_MESSAGE = "No PentestRun exists. Complete pre-engagement and call pentester_start first.";
+async function requireTargetRun(caller) {
 	const projectDir = caller.cwd;
-	await initWorkspace(projectDir, { language: void 0 });
-	const run = await resolvePentestRun(projectDir);
+	const ctx = await resolveSessionTargetContext(projectDir, caller.sessionId);
+	if (ctx === void 0) throw new Error("This session is not bound to any target. Start a pentest with pentester_start first.");
+	const run = await resolvePentestRun(ctx);
 	if (run === null) throw new Error(NO_RUN_MESSAGE);
-	return run;
-}
-async function bootstrapRun(deps, projectDir, runInfo) {
-	if (runInfo === void 0 || runInfo.targets === void 0 || runInfo.targets.length === 0) throw new Error(NO_RUN_MESSAGE);
-	const primary = runInfo.targets[0];
-	await initWorkspace(projectDir, {
-		target: primary,
-		language: runInfo.language,
-		scope: renderScope(runInfo.targets),
-		roe: runInfo.rulesOfEngagement
-	});
-	await writePreEngagementInput(projectDir, {
-		targets: runInfo.targets,
-		scope: renderScope(runInfo.targets),
-		roe: runInfo.rulesOfEngagement ?? "Standard RoE",
-		language: runInfo.language ?? "zh-CN"
-	});
-	const created = {
-		schemaVersion: 1,
-		id: crypto.randomUUID(),
-		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-		targets: [...runInfo.targets],
-		...runInfo.rulesOfEngagement === void 0 ? {} : { rulesOfEngagement: runInfo.rulesOfEngagement },
-		...runInfo.language === void 0 ? {} : { language: runInfo.language },
-		status: "active",
-		currentStage: "pre-engagement",
-		stageHistory: [{
-			stage: "pre-engagement",
-			enteredAt: (/* @__PURE__ */ new Date()).toISOString()
-		}],
-		delegations: []
+	return {
+		ctx,
+		run
 	};
-	await saveRun(projectDir, created);
-	await deps.git.init(projectDir, primary);
-	return created;
-}
-function renderScope(targets) {
-	return [
-		"# Scope",
-		"",
-		`- Primary Target: ${targets[0] ?? ""}`,
-		...targets.slice(1).map((target) => `- ${target}`),
-		""
-	].join("\n");
 }
 function parseAssignments(value) {
 	if (!Array.isArray(value) || value.length === 0) throw new Error("assignments must be a non-empty array");
@@ -1400,19 +1911,6 @@ function parseAssignments(value) {
 		};
 	});
 }
-function parseRunInfo(value) {
-	if (value === void 0) return void 0;
-	if (value === null || typeof value !== "object") throw new Error("invalid run info");
-	const record = value;
-	const targets = Array.isArray(record.targets) ? record.targets.map(String) : void 0;
-	const roe = typeof record.rules_of_engagement === "string" ? record.rules_of_engagement : void 0;
-	const language = typeof record.language === "string" && record.language.length > 0 ? record.language : void 0;
-	return {
-		...targets === void 0 ? {} : { targets },
-		...roe === void 0 ? {} : { rulesOfEngagement: roe },
-		...language === void 0 ? {} : { language }
-	};
-}
 function rootState(run, profiles) {
 	const stage = run.currentStage === null ? void 0 : stageDefinition(run.currentStage);
 	const allowedProfiles = (stage?.agentIds ?? []).map((id) => profiles.get(id)).filter((profile) => profile !== void 0).map((profile) => ({
@@ -1423,7 +1921,8 @@ function rootState(run, profiles) {
 		run: {
 			currentStage: run.currentStage,
 			status: run.status ?? "active",
-			targets: run.targets
+			target: run.target,
+			scope: run.scope
 		},
 		stage: stage === void 0 ? null : {
 			id: stage.id,
@@ -1709,9 +2208,28 @@ const CAP_ADD_ALLOWLIST = [
 	"NET_RAW",
 	"NET_BIND_SERVICE"
 ];
-/** Toolbox container name: dsh-pentester-xxxxxxxx (8 lowercase hex). */
-function createToolboxContainerName() {
-	return `dsh-pentester-${randomBytes(4).toString("hex")}`;
+/** Sanitize a target string into a valid Docker container name segment.
+*
+*  - trim, lowercase
+*  - strip http://, https://
+*  - keep [a-z0-9._-], replace everything else with -
+*  - collapse consecutive dashes
+*  - strip leading/trailing non-alphanumeric
+*  - cap length
+*/
+function sanitizeDockerTargetName(target) {
+	let name = target.trim().toLowerCase();
+	name = name.replace(/^https?:\/\//, "");
+	name = name.replace(/[^a-z0-9._-]/g, "-");
+	name = name.replace(/-{2,}/g, "-");
+	name = name.replace(/^[^a-z0-9]+/, "").replace(/[^a-z0-9]+$/, "");
+	if (name.length > 114) name = name.slice(0, 114);
+	if (name.length === 0) name = "pentest";
+	return name;
+}
+/** Generate a human-readable Docker container name for a target. */
+function containerNameForTarget(target) {
+	return `dsh-pentester-${sanitizeDockerTargetName(target)}`;
 }
 /** 固定注入 Toolbox 容器的代理环境变量（容器内部代理服务）。 */
 const FIXED_CONTAINER_ENV = ["HTTP_PROXY=http://127.0.0.1:8080", "HTTPS_PROXY=http://127.0.0.1:8080"];
@@ -1740,11 +2258,11 @@ function safeEnv(env) {
 	}
 	return safe;
 }
-function volumeNameFor(projectDir) {
-	return `dsh-pentester-ws-${createHash("sha1").update(projectDir).digest("hex").slice(0, 12)}`;
+function volumeNameFor(targetId, runId) {
+	return `dsh-pentester-${createHash("sha1").update(`${targetId}:${runId}`).digest("hex").slice(0, 12)}`;
 }
-function localMirrorDir(projectDir) {
-	return workspaceDir(projectDir);
+function localMirrorDir(targetRoot) {
+	return targetRoot;
 }
 var DockerRuntime = class {
 	engine;
@@ -1797,7 +2315,7 @@ var DockerRuntime = class {
 	* reused while running.
 	*/
 	async ensureRunContainer(options) {
-		const volume = this.remote ? await this.ensureWorkspaceVolume(options.projectDir) : void 0;
+		const volume = this.remote ? await this.ensureWorkspaceVolume(options.targetId, options.runId) : void 0;
 		const label = "dsh.pentester.run";
 		const existing = await this.engine.listContainers({
 			all: true,
@@ -1814,15 +2332,11 @@ var DockerRuntime = class {
 			ensure.finally(() => this.ensuring.delete(options.runId));
 		}
 		const containerId = await ensure;
-		if (this.remote && volume?.created === true) await this.pushLocalMirror(containerId, options.projectDir).catch(() => void 0);
+		if (this.remote && volume?.created === true) await this.pushLocalMirror(containerId, options.targetRoot).catch(() => void 0);
 		return containerId;
 	}
-	/**
-	* 远程 workspace volume：存在则复用（§24 recovery 优先级），不存在才创建。
-	* `created: true` 表示本轮新建 —— 调用方据此决定是否从本地恢复数据。
-	*/
-	async ensureWorkspaceVolume(projectDir) {
-		const volume = volumeNameFor(projectDir);
+	async ensureWorkspaceVolume(targetId, runId) {
+		const volume = volumeNameFor(targetId, runId);
 		if (this.volumes.has(volume)) return {
 			name: volume,
 			created: false
@@ -1838,7 +2352,8 @@ var DockerRuntime = class {
 			Name: volume,
 			Labels: {
 				"dsh.pentester.managed": "true",
-				"dsh.pentester.project": volume
+				"dsh.pentester.run": runId,
+				"dsh.pentester.target": targetId
 			}
 		});
 		this.volumes.add(created.Name);
@@ -1851,7 +2366,7 @@ var DockerRuntime = class {
 		const hostConfig = {
 			Mounts: [volume === void 0 ? {
 				Type: "bind",
-				Source: localMirrorDir(options.projectDir),
+				Source: localMirrorDir(options.targetRoot),
 				Target: "/workspace"
 			} : {
 				Type: "volume",
@@ -1862,14 +2377,15 @@ var DockerRuntime = class {
 			AutoRemove: false
 		};
 		assertSafeHostConfig(hostConfig);
-		const containerName = createToolboxContainerName();
+		const containerName = containerNameForTarget(options.target);
 		const container = await this.engine.createContainer({
 			name: containerName,
 			Image: options.toolbox.image,
 			Env: [...FIXED_CONTAINER_ENV],
 			Labels: {
 				[label]: options.runId,
-				"dsh.pentester.managed": "true"
+				"dsh.pentester.managed": "true",
+				"dsh.pentester.target": options.targetId
 			},
 			HostConfig: hostConfig,
 			WorkingDir: "/workspace",
@@ -1908,7 +2424,7 @@ var DockerRuntime = class {
 	* 本地 bind mount 下 host == container，直接读本地文件系统。
 	* @returns result.md 内容（缺失 undefined）与相对文件清单。
 	*/
-	async readDelegationDelivery(runId, projectDir, delegationDir) {
+	async readDelegationDelivery(runId, ctx, delegationDir) {
 		if (!this.remote) {
 			const { readdir, readFile } = await import("node:fs/promises");
 			const { join } = await import("node:path");
@@ -1939,7 +2455,7 @@ var DockerRuntime = class {
 				files: files.sort()
 			};
 		}
-		const containerPath = delegationDir.startsWith(projectDir) ? delegationDir.slice(projectDir.length).replace(/\\/g, "/") : "/workspace";
+		const containerPath = delegationDir.startsWith(ctx.targetRoot) ? "/workspace" + delegationDir.slice(ctx.targetRoot.length).replace(/\\/g, "/") : "/workspace";
 		const containerId = await this.findRunContainer(runId);
 		if (containerId === void 0) return { files: [] };
 		const files = ((await this.exec(containerId, { argv: [
@@ -1959,17 +2475,17 @@ var DockerRuntime = class {
 	* target/、stage scaffold。排除 .git（Worker 不可改 Git）。
 	* 本地 bind mount 下 host == container，无操作直接返回。
 	*/
-	async pushWorkspace(runId, projectDir) {
+	async pushWorkspace(runId, ctx) {
 		if (!this.remote) return;
-		const key = `${runId}:${projectDir}`;
+		const key = `${runId}:${ctx.targetRoot}`;
 		const inFlight = this.pushing.get(key);
 		if (inFlight !== void 0) return inFlight;
-		const task = this.findRunContainer(runId).then((containerId) => containerId === void 0 ? void 0 : this.pushLocalMirror(containerId, projectDir)).finally(() => this.pushing.delete(key));
+		const task = this.findRunContainer(runId).then((containerId) => containerId === void 0 ? void 0 : this.pushLocalMirror(containerId, ctx.targetRoot)).finally(() => this.pushing.delete(key));
 		this.pushing.set(key, task);
 		return task;
 	}
-	async pushLocalMirror(containerId, projectDir) {
-		const archive = await packDirectory(localMirrorDir(projectDir), { exclude: (name) => name === ".git" });
+	async pushLocalMirror(containerId, targetRoot) {
+		const archive = await packDirectory(localMirrorDir(targetRoot), { exclude: (name) => name === ".git" });
 		await this.engine.getContainer(containerId).putArchive(archive, { path: "/workspace" });
 	}
 	/**
@@ -1980,12 +2496,12 @@ var DockerRuntime = class {
 	* 幽灵文件会被删除。Host 控制态（.git / .dsh-pentester）不参与 pull，
 	* 防止 remote stale state 覆盖宿主 run.json（§19）。
 	*/
-	async syncWorkspace(runId, projectDir) {
+	async syncWorkspace(runId, ctx) {
 		if (!this.remote) return;
-		const key = `${runId}:${projectDir}`;
+		const key = `${runId}:${ctx.targetRoot}`;
 		const inFlight = this.syncing.get(key);
 		if (inFlight !== void 0) return inFlight;
-		const task = this.findRunContainer(runId).then((containerId) => containerId === void 0 ? void 0 : this.pullWorkspace(containerId, projectDir)).finally(() => this.syncing.delete(key));
+		const task = this.findRunContainer(runId).then((containerId) => containerId === void 0 ? void 0 : this.pullWorkspace(containerId, ctx.targetRoot)).finally(() => this.syncing.delete(key));
 		this.syncing.set(key, task);
 		return task;
 	}
@@ -1999,8 +2515,8 @@ var DockerRuntime = class {
 		});
 		return matches.length > 0 ? String(matches[0].Id) : void 0;
 	}
-	async pullWorkspace(containerId, projectDir) {
-		const localDir = localMirrorDir(projectDir);
+	async pullWorkspace(containerId, targetRoot) {
+		const localDir = localMirrorDir(targetRoot);
 		const tarStream = await this.engine.getContainer(containerId).getArchive({ path: "/workspace" });
 		const extract = tar.extract();
 		const done = new Promise((resolve, reject) => {
@@ -2235,35 +2751,35 @@ function makeContainerExecExecutor(docker, toolboxName = "kali") {
 		if (caller === void 0 || !caller.isSubagent) throw new WorkerToolError("pentester_container_exec is reserved for delegated pentester workers");
 		const projectDir = caller.cwd;
 		if (projectDir === void 0) throw new WorkerToolError("worker session has no trusted workspace cwd");
-		const run = await resolvePentestRun(projectDir);
-		if (run === null) throw new WorkerToolError("no PentestRun in this project; the Root Agent must start one first");
+		const ctx = await resolveWorkerTargetContext(projectDir, caller.sessionId);
+		if (ctx === void 0) throw new WorkerToolError(`session ${caller.sessionId} is not bound to any delegation; only delegated workers may execute commands`);
+		const run = await resolvePentestRun(ctx);
+		if (run === null) throw new WorkerToolError("no PentestRun for this target; the Root Agent must start one first");
 		const delegation = run.delegations.find((candidate) => candidate.sessionId === caller.sessionId);
 		if (delegation === void 0) throw new WorkerToolError(`session ${caller.sessionId} is not bound to any delegation; only delegated workers may execute commands`);
 		const toolbox = await docker.ensureImage(toolboxName);
 		const containerId = await docker.ensureRunContainer({
 			runId: run.id,
+			targetId: ctx.targetId,
+			target: ctx.canonicalTarget,
 			toolbox,
-			projectDir
+			targetRoot: ctx.targetRoot
 		});
 		const input = {
 			argv: Array.isArray(args.argv) ? args.argv.map(String) : [],
-			...typeof args.cwd === "string" ? { cwd: args.cwd } : { cwd: workerContainerWorkDir(projectDir, delegation) },
+			...typeof args.cwd === "string" ? { cwd: args.cwd } : { cwd: workerContainerWorkDir(ctx, delegation) },
 			...isStringRecord(args.env) ? { env: args.env } : {},
 			...typeof args.timeoutMs === "number" ? { timeoutMs: args.timeoutMs } : {}
 		};
 		const result = await docker.exec(containerId, input);
-		docker.syncWorkspace(run.id, projectDir).catch(() => void 0);
+		docker.syncWorkspace(run.id, ctx).catch(() => void 0);
 		return result;
 	};
 }
 /** Worker 的容器工作目录：`/workspace/stages/<NN>-<stage>/delegations/D-00N/work`。 */
-function workerContainerWorkDir(projectDir, delegation) {
-	return `${delegation.workspaceDir.startsWith(projectDir) ? delegation.workspaceDir.slice(projectDir.length).replace(/\\/g, "/") : delegation.workspaceDir}/work`;
+function workerContainerWorkDir(ctx, delegation) {
+	return `${delegationContainerDir(delegation.stageId, delegation.id)}/work`;
 }
-/**
-* 在调用者给定的 tools registry 上注册 pentester_container_exec（run-state.mjs
-* 把它注册进 pentester preset 的 standing scope；Root 看不到、Worker 独享）。
-*/
 function registerContainerExecTool(tools, docker) {
 	const execute = makeContainerExecExecutor(docker);
 	tools.register({
@@ -2893,8 +3409,1101 @@ var PentesterDockerTypertService = class extends TypertRemoteService {
 		return dispatchDockerRpc(this.deps, parsed.value);
 	}
 };
-/** 插件的 Typert manifest（仅 Docker Engine 设置面）。 */
-const TYPERT_MANIFEST = {
+//#endregion
+//#region src/ui-view/snapshot.ts
+/**
+* ui-view/snapshot.ts — Build read-model views from run.json + filesystem.
+*
+* Core snapshot: run, stages, delegations, findings, trace — NO output trees.
+* Output trees: lazy via listOutput().
+* File reads: async, bounded concurrency, partial preview.
+*/
+const STAGE_SHORT = {
+	"pre-engagement": "Pre",
+	"intelligence-gathering": "Intel",
+	"threat-modeling": "Threat",
+	"vulnerability-analysis": "Vuln",
+	"exploitation": "Exploit",
+	"post-exploitation": "Post",
+	"reporting": "Report"
+};
+function stageStatus(run, stageId) {
+	const statuses = run.stageStatuses ?? {};
+	if (run.currentStage === stageId) return statuses[stageId] ?? "active";
+	return statuses[stageId] ?? "pending";
+}
+function buildRunView(run) {
+	return {
+		id: run.id,
+		status: run.status ?? "active",
+		currentStage: run.currentStage,
+		targets: [run.target],
+		createdAt: run.createdAt
+	};
+}
+function buildStageViews(run) {
+	return STAGE_IDS.map((id) => {
+		const def = STAGE_DEFINITIONS.find((d) => d.id === id);
+		const delegations = run.delegations.filter((d) => d.stageId === id);
+		return {
+			id,
+			name: def?.name ?? id,
+			shortName: STAGE_SHORT[id] ?? id.slice(0, 4),
+			status: stageStatus(run, id),
+			delegationCount: delegations.length,
+			activeDelegationCount: delegations.filter((d) => d.status === "active" || d.status === "starting").length
+		};
+	});
+}
+function buildDelegationViews(run) {
+	return run.delegations.map((d) => ({
+		id: d.id,
+		stageId: d.stageId,
+		agentId: d.agentId,
+		...d.sessionId === void 0 ? {} : { sessionId: d.sessionId },
+		objective: d.objective,
+		status: d.status,
+		createdAt: d.createdAt,
+		...d.finishedAt === void 0 ? {} : { finishedAt: d.finishedAt }
+	}));
+}
+async function parseFindingsIndex(ctx) {
+	const indexFile = join(ctx.targetRoot, "findings", "findings.json");
+	if (!existsSync(indexFile)) return [];
+	try {
+		const raw = await readFile(indexFile, "utf8");
+		const entries = JSON.parse(raw);
+		if (!Array.isArray(entries)) return [];
+		return entries.filter((e) => e !== null && typeof e === "object").map((e) => {
+			const detailFile = typeof e.detailFile === "string" ? e.detailFile : "";
+			const id = detailFile.replace(/-findings\.md$/, "");
+			return {
+				id,
+				title: id,
+				severity: typeof e.severity === "string" ? e.severity : "info",
+				sourceStage: typeof e.sourceStage === "string" ? e.sourceStage : "",
+				sourceDelegationId: typeof e.sourceDelegationId === "string" ? e.sourceDelegationId : "",
+				detailFile,
+				updatedAt: typeof e.updatedAt === "string" ? e.updatedAt : ""
+			};
+		});
+	} catch {
+		return [];
+	}
+}
+async function parseAssetsCount(ctx) {
+	const assetsFile = join(ctx.targetRoot, "assets", "assets.json");
+	if (!existsSync(assetsFile)) return 0;
+	try {
+		const raw = await readFile(assetsFile, "utf8");
+		const parsed = JSON.parse(raw);
+		return Array.isArray(parsed) ? parsed.length : 0;
+	} catch {
+		return 0;
+	}
+}
+function buildTraceModel(run, ctx, findings) {
+	const nodes = [];
+	const edges = [];
+	nodes.push({
+		id: "start",
+		kind: "start",
+		label: "Start",
+		timestamp: run.createdAt
+	});
+	let prevStageId = null;
+	for (const stageId of STAGE_IDS) {
+		const status = stageStatus(run, stageId);
+		const stageNodeId = `stage:${stageId}`;
+		const stageEntry = run.stageHistory.find((h) => h.stage === stageId);
+		nodes.push({
+			id: stageNodeId,
+			kind: "stage",
+			label: STAGE_SHORT[stageId] ?? stageId,
+			status,
+			nav: {
+				tab: "stages",
+				focus: stageId
+			},
+			...stageEntry?.enteredAt === void 0 ? {} : { timestamp: stageEntry.enteredAt }
+		});
+		if (prevStageId === null) edges.push({
+			id: `edge:start-${stageId}`,
+			source: "start",
+			target: stageNodeId,
+			kind: "transition"
+		});
+		else edges.push({
+			id: `edge:${prevStageId}-${stageId}`,
+			source: `stage:${prevStageId}`,
+			target: stageNodeId,
+			kind: "transition"
+		});
+		const stageDelegations = run.delegations.filter((d) => d.stageId === stageId);
+		for (const d of stageDelegations) {
+			const delNodeId = `delegation:${d.id}`;
+			nodes.push({
+				id: delNodeId,
+				kind: "delegation",
+				label: `${d.id} · ${d.agentId}`,
+				status: d.status,
+				sublabel: d.objective.slice(0, 60),
+				timestamp: d.createdAt
+			});
+			edges.push({
+				id: `edge:${stageNodeId}-${d.id}`,
+				source: stageNodeId,
+				target: delNodeId,
+				kind: "delegate"
+			});
+		}
+		const stageFindings = findings.filter((f) => f.sourceStage === stageId);
+		for (const f of stageFindings) {
+			nodes.push({
+				id: `finding:${f.id}`,
+				kind: "finding",
+				label: f.title,
+				status: f.severity.toUpperCase(),
+				nav: {
+					tab: "findings",
+					focus: f.id
+				}
+			});
+			edges.push({
+				id: `edge:found-${f.id}`,
+				source: `delegation:${f.sourceDelegationId}`,
+				target: `finding:${f.id}`,
+				kind: "found"
+			});
+		}
+		prevStageId = stageId;
+	}
+	const seen = /* @__PURE__ */ new Set();
+	return {
+		nodes,
+		edges: edges.filter((e) => {
+			const k = `${e.source}->${e.target}`;
+			if (seen.has(k)) return false;
+			seen.add(k);
+			return true;
+		})
+	};
+}
+const snapshotPerf = typeof process !== "undefined" && process.env?.DSH_PENTESTER_PERF === "1";
+async function buildSnapshot(ctx) {
+	const t0 = performance.now();
+	const [run, findings, assetCount, registry] = await Promise.all([
+		tryLoadRun(ctx),
+		parseFindingsIndex(ctx),
+		parseAssetsCount(ctx),
+		loadTargetRegistry(ctx.projectDir).catch(() => null)
+	]);
+	const tData = (performance.now() - t0).toFixed(1);
+	if (snapshotPerf) console.log(`[SESSION_SWITCH_PERF] snapshot data-load=${tData}ms (run+findings+assets+registry)`);
+	const targets = [];
+	if (registry !== null) for (const record of listTargetRecords(registry)) targets.push({
+		id: record.id,
+		target: record.target,
+		canonicalTarget: record.canonicalTarget,
+		rootSessionId: record.rootSessionId,
+		status: "unknown",
+		currentStage: null,
+		createdAt: record.createdAt
+	});
+	if (run === null) return {
+		run: null,
+		stats: {
+			assets: 0,
+			findings: 0,
+			delegations: 0
+		},
+		stages: STAGE_IDS.map((id) => ({
+			id,
+			name: STAGE_DEFINITIONS.find((d) => d.id === id)?.name ?? id,
+			shortName: STAGE_SHORT[id] ?? id.slice(0, 4),
+			status: "pending",
+			delegationCount: 0,
+			activeDelegationCount: 0
+		})),
+		delegations: [],
+		findings,
+		trace: {
+			nodes: [{
+				id: "start",
+				kind: "start",
+				label: "Start"
+			}],
+			edges: []
+		},
+		targets
+	};
+	const result = {
+		run: buildRunView(run),
+		stats: {
+			assets: assetCount,
+			findings: findings.length,
+			delegations: run.delegations.length
+		},
+		stages: buildStageViews(run),
+		delegations: buildDelegationViews(run),
+		findings,
+		trace: buildTraceModel(run, ctx, findings),
+		targets
+	};
+	const totalMs = (performance.now() - t0).toFixed(1);
+	if (snapshotPerf) console.log(`[SESSION_SWITCH_PERF] snapshot projection=${(Number(totalMs) - Number(tData)).toFixed(1)}ms total=${totalMs}ms`);
+	return result;
+}
+const outputCache = /* @__PURE__ */ new Map();
+const OUTPUT_CACHE_TTL = 1e4;
+const outputInflight = /* @__PURE__ */ new Map();
+const FS_SEMAPHORE = 16;
+let fsInFlight = 0;
+const fsWaiters = [];
+function fsAcquire() {
+	if (fsInFlight < FS_SEMAPHORE) {
+		fsInFlight++;
+		return Promise.resolve();
+	}
+	return new Promise((resolve) => {
+		fsWaiters.push(resolve);
+	});
+}
+function fsRelease() {
+	fsInFlight--;
+	const next = fsWaiters.shift();
+	if (next !== void 0) {
+		fsInFlight++;
+		next();
+	}
+}
+async function buildOutputTreeForTarget(ctx, targetId, signal) {
+	let targetCtx = ctx;
+	if (targetId !== void 0 && targetId !== ctx.targetId) {
+		const record = (await loadTargetRegistry(ctx.projectDir)).targets.find((t) => t.id === targetId);
+		if (record === void 0) throw new Error("target not found");
+		targetCtx = buildTargetContext(ctx.projectDir, record);
+	}
+	const cacheKey = targetCtx.targetId;
+	const cached = outputCache.get(cacheKey);
+	if (cached !== void 0 && Date.now() - cached.builtAt < OUTPUT_CACHE_TTL) {
+		console.log(`[OUTPUT_SCAN] cache=hit targetId=${cacheKey}`);
+		return {
+			targetId: cacheKey,
+			target: targetCtx.target,
+			current: cacheKey === ctx.targetId,
+			children: cached.tree
+		};
+	}
+	const inflight = outputInflight.get(cacheKey);
+	if (inflight !== void 0) {
+		console.log(`[OUTPUT_SCAN] inflight=dedup targetId=${cacheKey}`);
+		const tree = await inflight;
+		return {
+			targetId: cacheKey,
+			target: targetCtx.target,
+			current: cacheKey === ctx.targetId,
+			children: tree
+		};
+	}
+	console.log(`[OUTPUT_SCAN] cache=miss targetId=${cacheKey}`);
+	const promise = buildOutputTree(targetCtx, signal);
+	outputInflight.set(cacheKey, promise);
+	try {
+		const tree = await promise;
+		outputCache.set(cacheKey, {
+			tree,
+			builtAt: Date.now()
+		});
+		return {
+			targetId: cacheKey,
+			target: targetCtx.target,
+			current: cacheKey === ctx.targetId,
+			children: tree
+		};
+	} finally {
+		outputInflight.delete(cacheKey);
+	}
+}
+async function buildOutputTree(ctx, signal) {
+	const root = ctx.targetRoot;
+	if (!existsSync(root)) return [];
+	const entries = [];
+	const stats = {
+		dirs: 0,
+		files: 0,
+		statCalls: 0,
+		readdirCalls: 0,
+		maxDepth: 0,
+		maxDirEntries: 0
+	};
+	const categoryTimings = {};
+	const categoryCounts = {};
+	for (const cat of [
+		{
+			dir: "report",
+			label: "Reports",
+			category: "report"
+		},
+		{
+			dir: "findings",
+			label: "Findings",
+			category: "finding"
+		},
+		{
+			dir: "assets",
+			label: "Artifacts",
+			category: "artifact"
+		},
+		{
+			dir: "evidence",
+			label: "Evidence",
+			category: "evidence"
+		}
+	]) {
+		signal?.throwIfAborted();
+		const catDir = join(root, cat.dir);
+		if (!existsSync(catDir)) continue;
+		const tCat = performance.now();
+		const children = await scanDir(catDir, root, cat.category, 0, stats, signal);
+		const catMs = performance.now() - tCat;
+		categoryTimings[cat.dir] = catMs;
+		categoryCounts[cat.dir] = children.length;
+		if (children.length > 0) entries.push({
+			path: cat.dir,
+			name: cat.label,
+			kind: "directory",
+			category: cat.category,
+			children: flattenSingleChildDirs(children)
+		});
+	}
+	const stagesDir = join(root, "stages");
+	if (existsSync(stagesDir)) {
+		const tStages = performance.now();
+		let stageEntryCount = 0;
+		for (let i = 0; i < STAGE_IDS.length; i++) {
+			signal?.throwIfAborted();
+			const stageId = STAGE_IDS[i];
+			const stageSubDir = join(stagesDir, `${String(i + 1).padStart(2, "0")}-${stageId}`);
+			if (!existsSync(stageSubDir)) continue;
+			const children = [];
+			const summaryFile = join(stageSubDir, "summary.md");
+			if (existsSync(summaryFile)) {
+				stats.statCalls++;
+				const st = await stat(summaryFile);
+				children.push({
+					path: relative(root, summaryFile),
+					name: "summary.md",
+					kind: "file",
+					size: st.size,
+					mtime: st.mtime.toISOString(),
+					category: "stage",
+					sourceStage: stageId
+				});
+			}
+			const delegationsDir = join(stageSubDir, "delegations");
+			if (existsSync(delegationsDir)) {
+				stats.readdirCalls++;
+				const delDirs = await readdir(delegationsDir, { withFileTypes: true });
+				for (const delDir of delDirs) {
+					if (!delDir.isDirectory()) continue;
+					const delId = delDir.name;
+					const resultFile = join(delegationsDir, delId, "result.md");
+					if (existsSync(resultFile)) {
+						stats.statCalls++;
+						const st = await stat(resultFile);
+						children.push({
+							path: relative(root, resultFile),
+							name: `${delId}/result.md`,
+							kind: "file",
+							size: st.size,
+							mtime: st.mtime.toISOString(),
+							category: "stage",
+							sourceStage: stageId,
+							sourceDelegationId: delId
+						});
+					}
+					const evidenceDir = join(delegationsDir, delId, "evidence");
+					if (existsSync(evidenceDir)) children.push(...flattenSingleChildDirs(await scanDir(evidenceDir, root, "evidence", 0, stats, signal, stageId, delId)));
+					const artifactsDir = join(delegationsDir, delId, "artifacts");
+					if (existsSync(artifactsDir)) children.push(...flattenSingleChildDirs(await scanDir(artifactsDir, root, "artifact", 0, stats, signal, stageId, delId)));
+				}
+			}
+			if (children.length > 0) {
+				stageEntryCount += children.length;
+				entries.push({
+					path: relative(root, stageSubDir),
+					name: STAGE_SHORT[stageId] ?? stageId,
+					kind: "directory",
+					category: "stage",
+					children: flattenSingleChildDirs(children)
+				});
+			}
+		}
+		categoryTimings["stages"] = performance.now() - tStages;
+		categoryCounts["stages"] = stageEntryCount;
+	}
+	const totalMs = Object.values(categoryTimings).reduce((a, b) => a + b, 0);
+	const catReport = Object.entries(categoryTimings).map(([cat, ms]) => `${cat}=${ms.toFixed(0)}ms entries=${categoryCounts[cat] ?? 0}`).join("\n");
+	const totalEntries = Object.values(categoryCounts).reduce((a, b) => a + b, 0);
+	console.log(`[OUTPUT_SCAN]\n${catReport}\nstages=${categoryTimings["stages"]?.toFixed(0) ?? "0"}ms entries=${categoryCounts["stages"] ?? 0}\ntotal=${totalMs.toFixed(0)}ms entries=${totalEntries}\ndirs=${stats.dirs} files=${stats.files} stat=${stats.statCalls} readdir=${stats.readdirCalls} maxDepth=${stats.maxDepth} maxDirEntries=${stats.maxDirEntries}`);
+	return entries;
+}
+const SCAN_CONCURRENCY = 16;
+async function scanDir(dir, root, parentCategory, depth = 0, stats, signal, sourceStage, sourceDelegationId) {
+	if (depth > 3) return [];
+	signal?.throwIfAborted();
+	try {
+		if (stats) {
+			stats.dirs++;
+			if (depth > stats.maxDepth) stats.maxDepth = depth;
+		}
+		await fsAcquire();
+		if (stats) stats.readdirCalls++;
+		const items = await readdir(dir, { withFileTypes: true });
+		fsRelease();
+		if (stats && items.length > stats.maxDirEntries) stats.maxDirEntries = items.length;
+		const filtered = items.filter((i) => !i.name.startsWith(".") && i.name !== "tmp" && i.name !== "cache" && i.name !== ".dsh-pentester" && i.name !== ".git");
+		const entries = [];
+		for (let batch = 0; batch < filtered.length; batch += SCAN_CONCURRENCY) {
+			const batchItems = filtered.slice(batch, batch + SCAN_CONCURRENCY);
+			const results = await Promise.all(batchItems.map(async (item) => {
+				signal?.throwIfAborted();
+				const fullPath = join(dir, item.name);
+				const relPath = relative(root, fullPath);
+				if (item.isDirectory()) {
+					const children = await scanDir(fullPath, root, parentCategory, depth + 1, stats, signal, sourceStage, sourceDelegationId);
+					if (children.length === 0) return null;
+					return {
+						path: relPath,
+						name: item.name,
+						kind: "directory",
+						category: parentCategory,
+						...sourceStage !== void 0 ? { sourceStage } : {},
+						...sourceDelegationId !== void 0 ? { sourceDelegationId } : {},
+						children
+					};
+				}
+				try {
+					if (stats) {
+						stats.files++;
+						stats.statCalls++;
+					}
+					await fsAcquire();
+					const st = await stat(fullPath);
+					fsRelease();
+					return {
+						path: relPath,
+						name: item.name,
+						kind: "file",
+						size: st.size,
+						mtime: st.mtime.toISOString(),
+						category: parentCategory,
+						...sourceStage !== void 0 ? { sourceStage } : {},
+						...sourceDelegationId !== void 0 ? { sourceDelegationId } : {}
+					};
+				} catch {
+					return null;
+				}
+			}));
+			for (const r of results) if (r !== null) entries.push(r);
+		}
+		return entries.sort((a, b) => a.kind !== b.kind ? a.kind === "directory" ? -1 : 1 : a.name.localeCompare(b.name));
+	} catch {
+		return [];
+	}
+}
+function flattenSingleChildDirs(entries) {
+	const result = [];
+	for (const entry of entries) {
+		if (entry.kind !== "directory" || entry.children === void 0 || entry.children.length !== 1 || entry.children[0].kind !== "directory") {
+			result.push(entry);
+			continue;
+		}
+		const child = entry.children[0];
+		result.push({
+			path: child.path,
+			name: `${entry.name}/${child.name}`,
+			kind: "directory",
+			category: entry.category,
+			...entry.sourceStage !== void 0 ? { sourceStage: entry.sourceStage } : {},
+			...entry.sourceDelegationId !== void 0 ? { sourceDelegationId: entry.sourceDelegationId } : {},
+			children: child.children !== void 0 ? flattenSingleChildDirs(child.children) : void 0
+		});
+	}
+	return result;
+}
+const MAX_PREVIEW = 1048576;
+async function readOutputFile(ctx, relativePath) {
+	if (relativePath.includes("..") || relativePath.startsWith("/") || isAbsolute(relativePath) || relativePath.includes("\0")) return {
+		ok: false,
+		error: "path denied"
+	};
+	const root = ctx.targetRoot;
+	const fullPath = join(root, relativePath);
+	const { realpathSync } = await import("node:fs");
+	let realRoot, realFile;
+	try {
+		realRoot = realpathSync(root);
+		realFile = realpathSync(fullPath);
+	} catch {
+		return {
+			ok: false,
+			error: "file not found"
+		};
+	}
+	if (!realFile.startsWith(realRoot + sep) && realFile !== realRoot) return {
+		ok: false,
+		error: "path escape denied"
+	};
+	try {
+		const st = await stat(fullPath);
+		if (st.isDirectory()) return {
+			ok: false,
+			error: "is a directory"
+		};
+		const ext = relativePath.split(".").pop()?.toLowerCase() ?? "";
+		if ((/* @__PURE__ */ new Set([
+			"png",
+			"jpg",
+			"jpeg",
+			"gif",
+			"webp",
+			"bmp",
+			"ico",
+			"pdf",
+			"zip",
+			"gz",
+			"tar",
+			"pcap",
+			"mitm",
+			"bin",
+			"exe",
+			"dll",
+			"so"
+		])).has(ext)) return {
+			ok: true,
+			content: `[Binary file: ${ext.toUpperCase()} — ${(st.size / 1024).toFixed(1)} KB]`,
+			mime: "binary",
+			size: st.size,
+			mtime: st.mtime.toISOString(),
+			name: relativePath.split("/").pop() ?? relativePath
+		};
+		const fh = await open(fullPath, "r");
+		const buf = Buffer.alloc(Math.min(st.size, MAX_PREVIEW));
+		await fh.read(buf, 0, buf.length, 0);
+		await fh.close();
+		let content = buf.toString("utf8");
+		if (st.size > MAX_PREVIEW) content += `\n\n... [truncated: ${(st.size / 1024).toFixed(1)} KB total]`;
+		let mime = "text";
+		if (ext === "md") mime = "markdown";
+		else if (ext === "json") mime = "json";
+		return {
+			ok: true,
+			content,
+			mime,
+			size: st.size,
+			mtime: st.mtime.toISOString(),
+			name: relativePath.split("/").pop() ?? relativePath
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			error: error instanceof Error ? error.message : "read error"
+		};
+	}
+}
+//#endregion
+//#region src/ui-view/binding.ts
+const cache = /* @__PURE__ */ new Map();
+async function resolveBinding(deps, sessionId) {
+	const t0 = performance.now();
+	const perf = deps.verbose || typeof process !== "undefined" && process.env?.DSH_PENTESTER_PERF === "1";
+	const cached = cache.get(sessionId);
+	if (cached !== void 0) {
+		if (perf) console.log(`[SESSION_SWITCH_PERF] binding session=${sessionId.slice(0, 8)} source=cache total=${(performance.now() - t0).toFixed(1)}ms`);
+		return cached;
+	}
+	const tLive = performance.now();
+	const projectDir = deps.getLiveSessionCwd(sessionId);
+	const liveMs = (performance.now() - tLive).toFixed(1);
+	let source = "live";
+	let resolvedDir = projectDir;
+	if (resolvedDir === void 0) {
+		const tWs = performance.now();
+		resolvedDir = deps.getWorkspaceForSession(sessionId);
+		const wsMs = (performance.now() - tWs).toFixed(1);
+		source = "workspace-index";
+		if (perf) console.log(`[SESSION_SWITCH_PERF] binding session=${sessionId.slice(0, 8)} workspaceLookup=${wsMs}ms`);
+	}
+	if (resolvedDir === void 0 || resolvedDir === "") {
+		const totalMs = (performance.now() - t0).toFixed(1);
+		if (perf) console.log(`[SESSION_SWITCH_PERF] binding session=${sessionId.slice(0, 8)} source=${source} result=unbound total=${totalMs}ms`);
+		return {
+			kind: "unbound",
+			projectDir: ""
+		};
+	}
+	const tTarget = performance.now();
+	const targetCtx = await resolveSessionTargetContext(resolvedDir, sessionId);
+	const targetMs = (performance.now() - tTarget).toFixed(1);
+	if (targetCtx !== void 0) {
+		const result = {
+			kind: "bound",
+			projectDir: resolvedDir,
+			targetContext: targetCtx
+		};
+		cache.set(sessionId, result);
+		const totalMs = (performance.now() - t0).toFixed(1);
+		if (perf) console.log(`[SESSION_SWITCH_PERF] binding session=${sessionId.slice(0, 8)} source=${source} cwd=${resolvedDir} liveLookup=${liveMs}ms targetLookup=${targetMs}ms total=${totalMs}ms`);
+		if (Number(totalMs) > 100) console.warn(`[SESSION_SWITCH_PERF] slow binding ${totalMs}ms source=${source}`);
+		return result;
+	}
+	const totalMs = (performance.now() - t0).toFixed(1);
+	if (perf) console.log(`[SESSION_SWITCH_PERF] binding session=${sessionId.slice(0, 8)} source=${source} result=target-unresolved total=${totalMs}ms`);
+	return {
+		kind: "unbound",
+		projectDir: resolvedDir
+	};
+}
+//#endregion
+//#region src/build-id.ts
+/**
+* build-id.ts — Build identity injected at build time.
+*
+* Generated by scripts/build-id.mjs before each build.
+* Both host (tsdown) and client (esbuild) import this module.
+*
+* Format: version+shortSha (e.g. "1.1.0+391bfd6")
+*/
+const BUILD_ID = "2.2.0+478786d";
+//#endregion
+//#region src/ui-view/invocations.ts
+/**
+* ui-view/invocations.ts — Pentester View 的 Typert 调用描述符与 schemas。
+*
+* 仅包含纯数据常量：客户端和宿主两侧均可安全导入，无 Node.js 依赖。
+*/
+const pentesterViewInputSchema$1 = z.discriminatedUnion("kind", [
+	z.object({ kind: z.literal("health") }),
+	z.object({
+		kind: z.literal("snapshot"),
+		sessionId: z.string()
+	}),
+	z.object({
+		kind: z.literal("listOutput"),
+		sessionId: z.string(),
+		targetId: z.string().optional()
+	}),
+	z.object({
+		kind: z.literal("readOutput"),
+		sessionId: z.string(),
+		targetId: z.string().optional(),
+		path: z.string()
+	}),
+	z.object({
+		kind: z.literal("readFinding"),
+		sessionId: z.string(),
+		detailFile: z.string()
+	})
+]);
+const snapshotResultSchema = z.object({
+	run: z.union([z.object({
+		id: z.string(),
+		status: z.enum(["active", "completed"]),
+		currentStage: z.string().nullable(),
+		targets: z.array(z.string()),
+		createdAt: z.string()
+	}), z.null()]),
+	stats: z.object({
+		assets: z.number(),
+		findings: z.number(),
+		delegations: z.number()
+	}),
+	stages: z.array(z.object({
+		id: z.string(),
+		name: z.string(),
+		shortName: z.string(),
+		status: z.string(),
+		delegationCount: z.number(),
+		activeDelegationCount: z.number()
+	})),
+	delegations: z.array(z.object({
+		id: z.string(),
+		stageId: z.string(),
+		agentId: z.string(),
+		sessionId: z.string().optional(),
+		objective: z.string(),
+		status: z.string(),
+		createdAt: z.string(),
+		finishedAt: z.string().optional()
+	})),
+	findings: z.array(z.object({
+		id: z.string(),
+		title: z.string(),
+		severity: z.string(),
+		status: z.string().optional(),
+		sourceStage: z.string(),
+		sourceDelegationId: z.string(),
+		detailFile: z.string(),
+		affectedAsset: z.string().optional(),
+		description: z.string().optional(),
+		updatedAt: z.string()
+	})),
+	trace: z.object({
+		nodes: z.array(z.object({
+			id: z.string(),
+			kind: z.string(),
+			label: z.string(),
+			status: z.string().optional(),
+			sublabel: z.string().optional(),
+			timestamp: z.string().optional()
+		})),
+		edges: z.array(z.object({
+			id: z.string(),
+			source: z.string(),
+			target: z.string(),
+			kind: z.string(),
+			label: z.string().optional()
+		}))
+	}),
+	targets: z.array(z.object({
+		id: z.string(),
+		target: z.string(),
+		canonicalTarget: z.string(),
+		rootSessionId: z.string().nullable(),
+		status: z.string(),
+		currentStage: z.string().nullable(),
+		createdAt: z.string()
+	}))
+});
+const unboundResultSchema = z.object({
+	kind: z.literal("unbound"),
+	targets: z.array(z.object({
+		id: z.string(),
+		target: z.string(),
+		canonicalTarget: z.string(),
+		rootSessionId: z.string().nullable(),
+		status: z.string(),
+		currentStage: z.string().nullable(),
+		createdAt: z.string()
+	}))
+});
+const outputFileResultSchema = z.object({
+	path: z.string(),
+	name: z.string(),
+	size: z.number(),
+	mtime: z.string(),
+	mime: z.enum([
+		"text",
+		"markdown",
+		"json",
+		"image",
+		"binary"
+	]),
+	content: z.string().optional()
+});
+const outputTreeResultSchema = z.object({
+	targetId: z.string(),
+	target: z.string(),
+	current: z.boolean(),
+	children: z.array(z.unknown())
+});
+/** 客户端 remote 贡献的 invocation 描述符 */
+const PENTESTER_VIEW_INVOCATION = {
+	id: "dsh-pentester#pentesterView/command",
+	service: "pentesterView",
+	namespace: "pentesterView",
+	method: "command",
+	invocation: { kind: "direct" },
+	cancellation: { parameter: "signal" },
+	parameters: [{
+		name: "input",
+		wire: "input",
+		source: "json",
+		codec: {
+			mode: "strict",
+			typeSymbol: "dsh-pentester#PentesterViewInput",
+			schema: pentesterViewInputSchema$1
+		}
+	}],
+	result: {
+		mode: "strict",
+		typeSymbol: "dsh-pentester#PentesterViewResult",
+		schema: z.object({
+			ok: z.boolean(),
+			value: z.union([
+				snapshotResultSchema,
+				outputTreeResultSchema,
+				outputFileResultSchema,
+				unboundResultSchema,
+				z.object({
+					ready: z.literal(true),
+					buildId: z.string()
+				})
+			]).optional(),
+			error: z.string().optional(),
+			code: z.string().optional()
+		})
+	}
+};
+//#endregion
+//#region src/ui-view/rpc.ts
+const pentesterViewInputSchema = z.discriminatedUnion("kind", [
+	z.object({ kind: z.literal("health") }),
+	z.object({
+		kind: z.literal("snapshot"),
+		sessionId: z.string()
+	}),
+	z.object({
+		kind: z.literal("listOutput"),
+		sessionId: z.string(),
+		targetId: z.string().optional()
+	}),
+	z.object({
+		kind: z.literal("readOutput"),
+		sessionId: z.string(),
+		targetId: z.string().optional(),
+		path: z.string()
+	}),
+	z.object({
+		kind: z.literal("readFinding"),
+		sessionId: z.string(),
+		detailFile: z.string()
+	})
+]);
+let requestSeq = 0;
+const HOST_PERF = typeof process !== "undefined" && process.env?.DSH_PENTESTER_PERF === "1";
+var PentesterViewTypertService = class extends TypertRemoteService {
+	deps;
+	constructor(ctx, deps) {
+		super(ctx, "pentesterView");
+		this.deps = deps;
+	}
+	async command(input, signal) {
+		const requestId = ++requestSeq;
+		const t0 = performance.now();
+		if (HOST_PERF) console.log(`[PENTESTER_RPC_HOST] #${requestId} ENTER +0ms`);
+		const parsed = pentesterViewInputSchema.safeParse(input);
+		if (!parsed.success) {
+			if (HOST_PERF) console.log(`[PENTESTER_RPC_HOST] #${requestId} INVALID_REQUEST +${(performance.now() - t0).toFixed(1)}ms`);
+			return {
+				ok: false,
+				error: "invalid_request",
+				code: "invalid_request"
+			};
+		}
+		const data = parsed.data;
+		if (HOST_PERF) console.log(`[PENTESTER_RPC_HOST] #${requestId} PARSED kind=${data.kind} +${(performance.now() - t0).toFixed(1)}ms`);
+		try {
+			signal?.throwIfAborted();
+			if (data.kind === "health") {
+				if (HOST_PERF) console.log(`[PENTESTER_RPC_HOST] #${requestId} HEALTH +${(performance.now() - t0).toFixed(1)}ms`);
+				return {
+					ok: true,
+					value: {
+						ready: true,
+						buildId: BUILD_ID
+					}
+				};
+			}
+			if (data.kind === "snapshot") {
+				signal?.throwIfAborted();
+				if (HOST_PERF) console.log(`[PENTESTER_RPC_HOST] #${requestId} BINDING_START +${(performance.now() - t0).toFixed(1)}ms`);
+				const tResolve = performance.now();
+				const resolution = await resolveBinding(this.deps, data.sessionId);
+				const resolveMs = (performance.now() - tResolve).toFixed(1);
+				if (HOST_PERF) console.log(`[PENTESTER_RPC_HOST] #${requestId} BINDING_END kind=${resolution.kind} +${(performance.now() - t0).toFixed(1)}ms`);
+				if (resolution.kind === "bound") {
+					signal?.throwIfAborted();
+					if (HOST_PERF) console.log(`[PENTESTER_RPC_HOST] #${requestId} SNAPSHOT_START +${(performance.now() - t0).toFixed(1)}ms`);
+					const tBuild = performance.now();
+					const snapshot = await buildSnapshot(resolution.targetContext);
+					const buildMs = (performance.now() - tBuild).toFixed(1);
+					if (HOST_PERF) console.log(`[PENTESTER_RPC_HOST] #${requestId} SNAPSHOT_END +${(performance.now() - t0).toFixed(1)}ms`);
+					signal?.throwIfAborted();
+					const totalMs = (performance.now() - t0).toFixed(1);
+					if (HOST_PERF) {
+						const payload = JSON.stringify(snapshot).length;
+						console.log(`[PENTESTER_RPC_HOST] #${requestId} RETURN binding=${resolveMs}ms build=${buildMs}ms total=${totalMs}ms payload=${(payload / 1024).toFixed(0)}KB`);
+					}
+					if (Number(totalMs) > 1e3) console.warn(`[PENTESTER_RPC_HOST] #${requestId} slow ${totalMs}ms`);
+					return {
+						ok: true,
+						value: snapshot
+					};
+				}
+				if (resolution.projectDir !== "") return buildUnboundSnapshot(resolution.projectDir);
+				if (HOST_PERF) console.log(`[PENTESTER_RPC_HOST] #${requestId} RETURN unbound +${(performance.now() - t0).toFixed(1)}ms`);
+				return {
+					ok: true,
+					value: {
+						kind: "unbound",
+						targets: []
+					}
+				};
+			}
+			if (data.kind === "listOutput") {
+				signal?.throwIfAborted();
+				const tResolve = performance.now();
+				console.log(`[PENTESTER_OUTPUT_PERF] #${requestId} ENTER`);
+				console.log(`[PENTESTER_OUTPUT_PERF] #${requestId} BINDING_START`);
+				const resolution = await resolveBinding(this.deps, data.sessionId);
+				if (resolution.kind !== "bound") return {
+					ok: false,
+					error: "not bound",
+					code: "no_binding"
+				};
+				console.log(`[PENTESTER_OUTPUT_PERF] #${requestId} BINDING_END ${(performance.now() - tResolve).toFixed(1)}ms`);
+				signal?.throwIfAborted();
+				console.log(`[PENTESTER_OUTPUT_PERF] #${requestId} TREE_START targetId=${data.targetId ?? "default"}`);
+				const tTree = performance.now();
+				const tree = await buildOutputTreeForTarget(resolution.targetContext, data.targetId, signal);
+				const treeMs = (performance.now() - tTree).toFixed(1);
+				console.log(`[PENTESTER_OUTPUT_PERF] #${requestId} TREE_END ${treeMs}ms`);
+				signal?.throwIfAborted();
+				const totalMs = (performance.now() - t0).toFixed(1);
+				const payload = JSON.stringify(tree).length;
+				console.log(`[PENTESTER_OUTPUT_PERF] #${requestId} RETURN total=${totalMs}ms entryCount=${tree.children.length} payload=${(payload / 1024).toFixed(0)}KB`);
+				return {
+					ok: true,
+					value: tree
+				};
+			}
+			if (data.kind === "readOutput") {
+				signal?.throwIfAborted();
+				const resolution = await resolveBinding(this.deps, data.sessionId);
+				if (resolution.kind !== "bound") return {
+					ok: false,
+					error: "not bound",
+					code: "no_binding"
+				};
+				const path = data.path;
+				if (path === "") return {
+					ok: false,
+					error: "path required",
+					code: "invalid_request"
+				};
+				let targetCtx = resolution.targetContext;
+				if (data.targetId !== void 0 && data.targetId !== resolution.targetContext.targetId) {
+					const record = (await loadTargetRegistry(resolution.projectDir)).targets.find((t) => t.id === data.targetId);
+					if (record === void 0) return {
+						ok: false,
+						error: "target not found",
+						code: "invalid_target"
+					};
+					targetCtx = buildTargetContext(resolution.projectDir, record);
+				}
+				const result = await readOutputFile(targetCtx, path);
+				if (!result.ok) return {
+					ok: false,
+					error: result.error,
+					code: "read_error"
+				};
+				return {
+					ok: true,
+					value: {
+						path,
+						name: result.name,
+						size: result.size,
+						mtime: result.mtime,
+						mime: result.mime,
+						content: result.content
+					}
+				};
+			}
+			if (data.kind === "readFinding") {
+				signal?.throwIfAborted();
+				const resolution = await resolveBinding(this.deps, data.sessionId);
+				if (resolution.kind !== "bound") return {
+					ok: false,
+					error: "not bound",
+					code: "no_binding"
+				};
+				const detailFile = data.detailFile;
+				if (detailFile === "") return {
+					ok: false,
+					error: "detailFile required",
+					code: "invalid_request"
+				};
+				const result = await readOutputFile(resolution.targetContext, `findings/${detailFile}`);
+				if (!result.ok) return {
+					ok: false,
+					error: result.error,
+					code: "read_error"
+				};
+				return {
+					ok: true,
+					value: {
+						path: `findings/${detailFile}`,
+						name: detailFile,
+						size: result.size,
+						mtime: result.mtime,
+						mime: "markdown",
+						content: result.content
+					}
+				};
+			}
+			return {
+				ok: false,
+				error: "unknown kind",
+				code: "invalid_request"
+			};
+		} catch (error) {
+			if (error instanceof Error && error.name === "AbortError") {
+				if (HOST_PERF) console.log(`[PENTESTER_RPC_HOST] #${requestId} ABORTED +${(performance.now() - t0).toFixed(1)}ms`);
+				return {
+					ok: false,
+					error: "aborted",
+					code: "aborted"
+				};
+			}
+			const totalMs = (performance.now() - t0).toFixed(1);
+			if (HOST_PERF) console.error(`[PENTESTER_RPC_HOST] #${requestId} FAILED kind=${data.kind} +${totalMs}ms: ${error instanceof Error ? error.message : "error"}`);
+			return {
+				ok: false,
+				error: error instanceof Error ? error.message : "failed",
+				code: "snapshot_error"
+			};
+		}
+	}
+};
+async function buildUnboundSnapshot(projectDir) {
+	const registry = await loadTargetRegistry(projectDir);
+	const targets = [];
+	for (const record of registry.targets) {
+		const run = await tryLoadRun(buildTargetContext(projectDir, record));
+		targets.push({
+			id: record.id,
+			target: record.target,
+			canonicalTarget: record.canonicalTarget,
+			rootSessionId: record.rootSessionId,
+			status: run?.status ?? "unknown",
+			currentStage: run?.currentStage ?? null,
+			createdAt: record.createdAt
+		});
+	}
+	return {
+		ok: true,
+		value: {
+			kind: "unbound",
+			targets
+		}
+	};
+}
+//#endregion
+//#region src/host-manifest.ts
+/**
+* host-manifest.ts — Single unified Typert host manifest for dsh-pentester.
+*
+* Combines pentesterDocker (Settings UI) and pentesterView (Pentester panel)
+* invocations into ONE manifest. Two separate register() calls with the same
+* package name cause the first to be withdrawn (SRC fallback denied).
+*
+* Client uses the same invocation constants via PENTESTER_REMOTE and
+* PENTESTER_VIEW_REMOTE — no duplication of endpoint definitions.
+*/
+const PENTESTER_HOST_MANIFEST = {
 	package: "dsh-pentester",
 	face: "host",
 	schemas: [],
@@ -2907,26 +4516,35 @@ const TYPERT_MANIFEST = {
 			members: [{
 				kind: "method",
 				name: "command",
-				signature: "command(input: object): Promise<{ok:boolean; value?: {dockerHost:string; effective:string; remote:boolean}; error?: string; code?: string}>"
+				signature: "command(input: object): Promise<{ok:boolean; value?:any; error?:string; code?:string}>"
+			}],
+			types: []
+		}, {
+			key: "pentesterView",
+			exportName: "PentesterViewTypertService",
+			description: "Pentester View 数据服务（snapshot / readOutput）。",
+			tags: [],
+			members: [{
+				kind: "method",
+				name: "command",
+				signature: "command(input: {kind:string; ...}): Promise<{ok:boolean; value?:any; error?:string; code?:string}>"
 			}],
 			types: []
 		}],
 		events: [],
 		objects: []
 	},
-	invocations: [PENTESTER_DOCKER_INVOCATION]
+	invocations: [PENTESTER_DOCKER_INVOCATION, PENTESTER_VIEW_INVOCATION]
 };
 //#endregion
 //#region src/git.ts
 /**
-* git.ts — GitCheckpointService：workspace 的 git 仓库管理（宿主侧）。
+* git.ts — GitCheckpointService：target-scoped git 仓库管理（宿主侧）。
 *
-* 仓库根 = <project>/workspace（= 容器 /workspace 的宿主镜像；.git 不随
-* volume 同步，Worker 物理上无法改 Git 状态）。约定式提交：
+* 仓库根 = targetRoot（每 Target 独立 .git）。
+* 约定式提交：
 *   - 初始：`workspace: initialize <target>`
 *   - 阶段完成：`ptes(<NN>-<stage>): complete` + tag `ptes/<NN>-<stage>`
-*
-* git 命令经注入的 runner 执行（生产 = child_process.execFile，测试 = fake）。
 */
 var GitCheckpointError = class extends Error {};
 function realGitRunner() {
@@ -2943,7 +4561,6 @@ function realGitRunner() {
 		});
 	});
 }
-/** workspace git 仓库管理（幂等 init；阶段完成 checkpoint）。 */
 var GitCheckpointService = class {
 	runner;
 	userName;
@@ -2955,23 +4572,17 @@ var GitCheckpointService = class {
 		this.userEmail = deps.userEmail ?? "dsh-pentester@local";
 		this.isRepoOverride = deps.isRepo;
 	}
-	/** 仓库根目录（<project>/workspace）。 */
-	repoDir(projectDir) {
-		return workspaceDir(projectDir);
+	repoDir(ctx) {
+		return ctx.targetRoot;
 	}
-	/** 是否已是 git 仓库（存在 .git）。 */
-	async isRepo(projectDir) {
-		if (this.isRepoOverride !== void 0) return this.isRepoOverride(projectDir);
-		return existsSync(join(this.repoDir(projectDir), ".git"));
+	async isRepo(ctx) {
+		if (this.isRepoOverride !== void 0) return this.isRepoOverride(ctx);
+		return existsSync(join(this.repoDir(ctx), ".git"));
 	}
-	/**
-	* 初始化仓库：`git init -b main` + 本地身份 + 初始提交。
-	* 幂等：已是仓库则直接返回。
-	*/
-	async init(projectDir, target) {
-		const cwd = this.repoDir(projectDir);
+	async init(ctx, target) {
+		const cwd = this.repoDir(ctx);
 		await mkdir(cwd, { recursive: true });
-		if (await this.isRepo(projectDir)) return;
+		if (await this.isRepo(ctx)) return;
 		await this.runner([
 			"init",
 			"-b",
@@ -2997,10 +4608,9 @@ var GitCheckpointService = class {
 		await this.runner(["add", "-A"], cwd);
 		await this.commit(cwd, `workspace: initialize ${target ?? "pentest"}`);
 	}
-	/** 阶段完成 checkpoint：`git add -A` → commit → tag。返回 tag 名。 */
-	async checkpointStage(projectDir, stage) {
-		if (!await this.isRepo(projectDir)) throw new GitCheckpointError("workspace is not a git repository; run initWorkspace first");
-		const cwd = this.repoDir(projectDir);
+	async checkpointStage(ctx, stage) {
+		if (!await this.isRepo(ctx)) throw new GitCheckpointError("workspace is not a git repository; run initTargetWorkspace first");
+		const cwd = this.repoDir(ctx);
 		const dir = stageDir(stage);
 		await this.runner(["add", "-A"], cwd);
 		await this.commit(cwd, `ptes(${dir}): complete`);
@@ -3012,23 +4622,16 @@ var GitCheckpointService = class {
 		], cwd).then((out) => out.trim().length > 0, () => false)) await this.runner(["tag", tag], cwd);
 		return tag;
 	}
-	/** 当前 git 分支名（rollback / Root state 用）。 */
-	async currentBranch(projectDir) {
-		const cwd = this.repoDir(projectDir);
+	async currentBranch(ctx) {
+		const cwd = this.repoDir(ctx);
 		return (await this.runner(["branch", "--show-current"], cwd).catch(() => "")).trim() || "main";
 	}
-	/** working tree 是否有未提交变更（rollback 前决定是否建 backup branch）。 */
-	async hasChanges(projectDir) {
-		const cwd = this.repoDir(projectDir);
+	async hasChanges(ctx) {
+		const cwd = this.repoDir(ctx);
 		return (await this.runner(["status", "--porcelain"], cwd).catch(() => "")).trim() !== "";
 	}
-	/**
-	* 在 HEAD 的 first-parent reachable 历史中找目标 stage 的 completion commit
-	* （subject `ptes(<NN>-<stage>): complete`）。不假设 tag 属于当前 branch
-	* namespace（§31）；tag 只是人类可读 ref。找不到返回 undefined。
-	*/
-	async findStageCheckpoint(projectDir, stage) {
-		const cwd = this.repoDir(projectDir);
+	async findStageCheckpoint(ctx, stage) {
+		const cwd = this.repoDir(ctx);
 		const dir = stageDir(stage);
 		const out = await this.runner([
 			"log",
@@ -3043,9 +4646,8 @@ var GitCheckpointService = class {
 			if (hash !== void 0 && subject === `ptes(${dir}): complete`) return hash;
 		}
 	}
-	/** 建 backup branch：`backup/rollback-<ts>` + WIP commit（只在有变更时调用）。 */
-	async createBackupBranch(projectDir, stage) {
-		const cwd = this.repoDir(projectDir);
+	async createBackupBranch(ctx, stage) {
+		const cwd = this.repoDir(ctx);
 		const branch = `backup/rollback-${Date.now()}`;
 		await this.runner([
 			"checkout",
@@ -3056,12 +4658,8 @@ var GitCheckpointService = class {
 		await this.commit(cwd, `wip: before rollback to ${stage}`);
 		return branch;
 	}
-	/**
-	* 从 checkpoint commit 建 rework branch：`rework/<next-stage-slug>-<n>`。
-	* n 自动找下一个可用值（已有分支 +1）。
-	*/
-	async createReworkBranch(projectDir, checkpoint, nextStageSlug) {
-		const cwd = this.repoDir(projectDir);
+	async createReworkBranch(ctx, checkpoint, nextStageSlug) {
+		const cwd = this.repoDir(ctx);
 		const existing = await this.runner(["branch", "--format=%(refname:short)"], cwd).catch(() => "");
 		const prefix = `rework/${nextStageSlug}-`;
 		let n = 1;
@@ -3078,9 +4676,8 @@ var GitCheckpointService = class {
 		], cwd);
 		return branch;
 	}
-	/** checkout 到已有分支 / commit（rollback 收尾）。 */
-	async checkout(projectDir, ref) {
-		const cwd = this.repoDir(projectDir);
+	async checkout(ctx, ref) {
+		const cwd = this.repoDir(ctx);
 		await this.runner(["checkout", ref], cwd);
 	}
 	async commit(cwd, message) {
@@ -3101,15 +4698,44 @@ var GitCheckpointService = class {
 * index.ts — cordis plugin entry (contract per docs/architecture.md):
 * publish the pentester preset, then wire the Root tools over the
 * DSH agents seam。Workers 的工具面 restrict 到 pentester_container_exec。
+*
+* RPC endpoints (pentesterDocker, pentesterView) are registered in the
+* main fiber — NOT a child plugin. Their lifetime equals the dsh-pentester
+* plugin lifetime. sessions/workspaceRegistry are resolved dynamically
+* via ctx.get() on each command invocation, so their lifecycle does not
+* affect RPC endpoint registration.
 */
 const name = "dsh-pentester";
-const inject = ["tools", "subagents"];
+const inject = [
+	"tools",
+	"subagents",
+	"typert"
+];
 const Config = Schema.object({
 	verbose: Schema.boolean().default(false),
 	dockerHost: Schema.string().default(""),
 	toolboxImages: Schema.object({}).default({})
 });
 async function apply(ctx, config) {
+	console.log(`[dsh-pentester] host build=${BUILD_ID}`);
+	const perf = config.verbose || typeof process !== "undefined" && process.env?.DSH_PENTESTER_PERF === "1";
+	if (perf) {
+		const INTERVAL = 100;
+		let expected = performance.now() + INTERVAL;
+		setInterval(() => {
+			const now = performance.now();
+			const lag = now - expected;
+			if (lag > 250) console.warn(`[HOST_EVENT_LOOP_LAG] ${lag.toFixed(0)}ms (expected interval=${INTERVAL}ms)`);
+			expected = now + INTERVAL;
+		}, INTERVAL).unref();
+		console.log("[dsh-pentester] event loop stall detector active (interval=100ms, warn>250ms)");
+	}
+	if (perf) try {
+		const typertLocal = ctx.typert?.local;
+		if (typertLocal?.subscribe !== void 0) typertLocal.subscribe((event) => {
+			if (event.key === "pentesterView/command") console.log(`[PENTESTER_RPC_LIFECYCLE] pentesterView/command ${event.kind}`);
+		});
+	} catch {}
 	const profiles = loadAgentProfiles(agentsRoot());
 	const presetDir = await publishPentesterPreset();
 	if (presetDir !== void 0) await writeStageProfilesManifest(presetDir, profiles);
@@ -3126,35 +4752,62 @@ async function apply(ctx, config) {
 			delegations,
 			profiles,
 			git,
-			pushWorkspace: async (projectDir, run) => {
-				await docker.pushWorkspace(run.id, projectDir);
+			pushWorkspace: async (targetCtx, run) => {
+				await docker.pushWorkspace(run.id, targetCtx);
 			},
-			syncWorkspace: async (projectDir, run) => {
-				await docker.syncWorkspace(run.id, projectDir);
-			}
+			syncWorkspace: async (targetCtx, run) => {
+				await docker.syncWorkspace(run.id, targetCtx);
+			},
+			sessionQuery: { readSession: async (sessionId) => {
+				const sq = ctx.get?.("sessionQuery");
+				if (sq === void 0) throw new Error("sessionQuery service unavailable");
+				return sq.readSession(sessionId);
+			} }
 		}),
 		registerContainerExecTool: (tools) => registerContainerExecTool(tools, docker)
 	});
-	ctx.inject(["typert"], (inner) => {
-		new PentesterDockerTypertService(inner, {
-			getSettings: () => ensureSettings(),
-			getConfigHost: () => config.dockerHost ?? "",
-			saveDockerHost: async (dockerHost) => {
-				const next = {
-					...await ensureSettings(),
-					dockerHost
-				};
-				await saveSettings(next);
-				return next;
-			},
-			saveSettings: async (next) => {
-				await saveSettings(next);
-			},
-			docker,
-			applyHost: (host) => docker.updateHost(host)
-		});
-		inner.typert.register(TYPERT_MANIFEST);
+	ctx.typert.register(PENTESTER_HOST_MANIFEST);
+	new PentesterDockerTypertService(ctx, {
+		getSettings: () => ensureSettings(),
+		getConfigHost: () => config.dockerHost ?? "",
+		saveDockerHost: async (dockerHost) => {
+			const next = {
+				...await ensureSettings(),
+				dockerHost
+			};
+			await saveSettings(next);
+			return next;
+		},
+		saveSettings: async (next) => {
+			await saveSettings(next);
+		},
+		applyHost: (host) => docker.updateHost(host),
+		docker
 	});
+	new PentesterViewTypertService(ctx, {
+		getLiveSessionCwd(sessionId) {
+			try {
+				const cwd = ((ctx.get?.("sessions"))?.get?.(sessionId))?.header?.cwd;
+				if (typeof cwd === "string" && cwd.length > 0 && cwd.startsWith("/")) return cwd;
+			} catch {}
+		},
+		getWorkspaceForSession(sessionId) {
+			try {
+				const registry = ctx.get?.("workspaceRegistry");
+				if (registry?.list === void 0) return void 0;
+				for (const workspace of registry.list()) if (workspace.sessionIds.includes(sessionId)) return workspace.path;
+			} catch {}
+		},
+		verbose: config.verbose
+	});
+	const typertLocal = ctx.typert.local;
+	const dockerEndpoint = typertLocal.get("pentesterDocker/command");
+	const viewEndpoint = typertLocal.get("pentesterView/command");
+	if (dockerEndpoint === void 0 || viewEndpoint === void 0) throw new Error(`dsh-pentester startup failed: RPC descriptors not registered. docker=${dockerEndpoint !== void 0 ? "ok" : "MISSING"} view=${viewEndpoint !== void 0 ? "ok" : "MISSING"}`);
+	console.log(`[dsh-pentester] RPC ready build=${BUILD_ID}`);
+	console.log(`  pentesterDocker/command = registered`);
+	console.log(`  pentesterView/command  = registered`);
+	console.log(`  host module = ${import.meta.url}`);
 	if (config.verbose) console.log(`[dsh-pentester] loaded with ${profiles.size} agent profiles`);
 }
 function agentsRoot() {
@@ -3162,13 +4815,7 @@ function agentsRoot() {
 	for (const candidate of [join(here, "..", "agents"), join(process.cwd(), "agents")]) if (existsSync(candidate)) return candidate;
 	return join(process.cwd(), "agents");
 }
-/** run-state.mjs 读取的 stage → AgentProfile 清单文件名（与 preset 同目录发布）。 */
 const STAGE_PROFILES_FILE = "stage-profiles.json";
-/**
-* 生成并发布 stage → [{id, name}] 清单（docs/plan.md §7：Root compact state
-* 的 Available AgentProfiles 从 STAGE_DEFINITIONS + AgentProfile registry 生成，
-* 不硬编码第二套映射）。随 preset 目录发布，run-state.mjs 同目录读取。
-*/
 async function writeStageProfilesManifest(presetDir, profiles) {
 	const manifest = Object.fromEntries(STAGE_DEFINITIONS.map((definition) => [definition.id, definition.agentIds.map((id) => profiles.get(id)).filter((profile) => profile !== void 0).map((profile) => ({
 		id: profile.id,
@@ -3176,7 +4823,6 @@ async function writeStageProfilesManifest(presetDir, profiles) {
 	}))]));
 	await writeFile(join(presetDir, STAGE_PROFILES_FILE), `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
 }
-/** 把随包发布的 pentester preset 拷贝到 DSH 用户 preset 根目录。 */
 async function publishPentesterPreset(home) {
 	const source = shippedPresetDir();
 	if (source === void 0) return void 0;