dsh-permission-remote 0.1.0 → 0.2.0

package/lib/index.js

@@ -1,11 +1,13 @@
 // src/index.ts
-import { mkdir } from "node:fs/promises";
+import { mkdir as mkdir2 } from "node:fs/promises";
 import { basename } from "node:path";
 import { credentialKey } from "@deepseek-ai/dsh-credentials";
+import { ESCALATION_TARGETS } from "@deepseek-ai/dsh-sandbox";
 import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 
 // src/config.ts
 import Schema from "@deepseek-ai/schemastery";
+import { createVolatile, isVolatile, updateVolatile } from "@deepseek-ai/cosmokit";
 var Host = Schema.object({
   id: Schema.string().required(),
   name: Schema.string().default(""),
@@ -23,19 +25,55 @@ var Host = Schema.object({
   fingerprint: Schema.string().default("")
 });
 var Config = Schema.object({
-  hosts: Schema.array(Host).default([]),
+  // Settings only lists and writes fields marked volatile. Without this, the
+  // host row is dropped from describe() and every save is a silent no-op.
+  hosts: Schema.array(Host).default([]).volatile(),
   maxConnections: Schema.natural().min(1).max(32).default(4)
 });
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isHostRef(value) {
+  return isVolatile(value);
+}
+function asHostArray(value) {
+  if (!Array.isArray(value)) throw new Error("SSH host list is not an array");
+  return value;
+}
+function copyHostRows(value) {
+  if (value === void 0 || value === null) return void 0;
+  return asHostArray(value).map((item) => ({ ...item }));
+}
+function commitHosts(ref, hosts) {
+  updateVolatile(ref, createVolatile(hosts.map((host) => ({ ...host }))));
+}
 function readConfig(raw) {
-  const value = Config(raw ?? {});
+  const record = isRecord(raw) ? raw : {};
+  const incoming = record.hosts;
+  const parsed = Config({
+    ...record,
+    hosts: copyHostRows(isHostRef(incoming) ? incoming.get() : incoming)
+  });
+  const maxConnections = parsed.maxConnections ?? 4;
+  const ref = isHostRef(incoming) ? incoming : parsed.hosts;
+  if (isHostRef(ref)) return viewConfig(ref, maxConnections);
+  return { hosts: asHostArray(ref), maxConnections };
+}
+function viewConfig(ref, maxConnections) {
   return {
-    hosts: value.hosts ?? [],
-    maxConnections: value.maxConnections ?? 4
+    get hosts() {
+      return asHostArray(ref.get()).map((host) => ({ ...host }));
+    },
+    set hosts(value) {
+      commitHosts(ref, value);
+    },
+    maxConnections
   };
 }
 
 // src/execute.ts
 import { randomBytes } from "node:crypto";
+import { mkdir } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { posix as posix3 } from "node:path";
 import { FsError } from "@deepseek-ai/dsh-fs";
@@ -43,7 +81,8 @@ import {
   SandboxUnavailableError,
   approveEscalation,
   escalationHintMarker,
-  sandboxDenialMarker
+  sandboxDenialMarker,
+  validateEscalationArgs
 } from "@deepseek-ai/dsh-sandbox";
 
 // src/install-commands.ts
@@ -112,10 +151,34 @@ function composeCreatedPath(ancestorReal, missingNames) {
   return posix.normalize(posix.join(ancestorReal, ...suffix));
 }
 
+// src/shell-quote.ts
+function shQuote(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function shJoin(argv) {
+  return argv.map(shQuote).join(" ");
+}
+
 // src/profile.ts
 function bwrapProfileArgs(mode, workspaceRoot) {
   if (mode === "danger-full-access") return null;
-  const args = [
+  const args = bwrapBaseArgs();
+  if (mode === "workspace-write") {
+    args.push("--tmpfs", "/tmp", "--bind", workspaceRoot, workspaceRoot);
+  }
+  return args;
+}
+function bwrapFileProfileArgs(mode, roots) {
+  if (mode === "danger-full-access") return null;
+  const args = bwrapBaseArgs();
+  if (mode === "workspace-write") {
+    const binds = fileWritableRoots(mode, roots).slice().sort((left, right) => left.length - right.length || left.localeCompare(right));
+    for (const root of binds) args.push("--bind", root, root);
+  }
+  return args;
+}
+function bwrapBaseArgs() {
+  return [
     "--ro-bind",
     "/",
     "/",
@@ -126,10 +189,10 @@ function bwrapProfileArgs(mode, workspaceRoot) {
     "/proc",
     "--die-with-parent"
   ];
-  if (mode === "workspace-write") {
-    args.push("--tmpfs", "/tmp", "--bind", workspaceRoot, workspaceRoot);
-  }
-  return args;
+}
+function seatbeltBashCommand(mode, writable, workdir, command) {
+  const profile = seatbeltProfileArgs(mode, writable) ?? [];
+  return `cd ${shJoin([workdir])} && ${shJoin(["sandbox-exec", ...profile, "--", "bash", "-c", command])}`;
 }
 function bwrapProbeArgv() {
   return ["bwrap", ...bwrapProfileArgs("read-only", "/"), "--", "true"];
@@ -156,7 +219,7 @@ function sbplString(value) {
 }
 function fileWritableRoots(mode, roots) {
   if (mode !== "workspace-write") return [];
-  return [.../* @__PURE__ */ new Set([roots.workspaceRoot, roots.tmp, roots.userTmp])];
+  return [...new Set([roots.workspaceRoot, roots.tmp, roots.userTmp].filter((root) => root.length > 0))];
 }
 function pathInsideRoot(target, root) {
   const normalizedTarget = target.length > 1 && target.endsWith("/") ? target.slice(0, -1) : target;
@@ -183,6 +246,11 @@ function grepArgv(rg, pattern, base, include) {
 function globArgv(rg, pattern) {
   return [rg, "--no-config", "--files", "--hidden", "--iglob", pattern, "--glob", "!.git/**", "--sort", "modified"];
 }
+function atomicWriteScript(directory, tmp, target) {
+  const write = `cat > ${shJoin([tmp])} && mv -f ${shJoin([tmp, target])}`;
+  const cleanup = `{ status=$?; rm -f ${shJoin([tmp])}; exit $status; }`;
+  return `mkdir -p ${shJoin([directory])} && ${write} || ${cleanup}`;
+}
 
 // src/probe.ts
 function probeOutcome(exitCode, timedOut, stderr = "") {
@@ -194,12 +262,13 @@ function probeOutcome(exitCode, timedOut, stderr = "") {
   return { available: false, reason: "rejected" };
 }
 function hostFactsCommand() {
+  const line = (body) => `( ${body} ) || printf '\\n'`;
   return [
     "uname -s",
     "uname -m",
-    "cd /tmp && pwd -P",
-    'cd "${TMPDIR:-/tmp}" && pwd -P',
-    'printf %s "$HOME"'
+    line("cd /tmp && pwd -P"),
+    line('cd "${TMPDIR:-/tmp}" && pwd -P'),
+    `printf '%s\\n' "$HOME"`
   ].join("; ");
 }
 function parseHostFacts(stdout) {
@@ -246,8 +315,7 @@ function remoteRoot(env = process.env) {
   return path.join(home, "remote");
 }
 function isValidHostId(hostId) {
-  if (hostId.length === 0 || hostId === "." || hostId === "..") return false;
-  return /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(hostId);
+  return /^[a-z][a-z0-9-]*$/.test(hostId);
 }
 function encodeRemotePath(remotePath) {
   return Buffer.from(remotePath, "utf8").toString("base64url");
@@ -314,14 +382,6 @@ function toModelPath(remotePath, route, env = process.env) {
   return toPlaceholderPath(normalized, route.hostId, env);
 }
 
-// src/shell-quote.ts
-function shQuote(value) {
-  return `'${value.replaceAll("'", `'\\''`)}'`;
-}
-function shJoin(argv) {
-  return argv.map(shQuote).join(" ");
-}
-
 // src/execute.ts
 var require2 = createRequire(import.meta.url);
 var READ_CAP = 1024 * 1024;
@@ -332,8 +392,8 @@ async function probeHost(pool, host, secret) {
   const uname = await pool.exec(host, secret, hostFactsCommand(), 2e4);
   const facts = parseHostFacts(uname.stdout);
   const { os: os2, arch } = facts;
-  const tmp = await canonicalRemotePath(pool, host, secret, facts.tmp);
-  const userTmp = await canonicalRemotePath(pool, host, secret, facts.userTmp);
+  const tmp = await existingRemotePath(pool, host, secret, facts.tmp);
+  const userTmp = await existingRemotePath(pool, host, secret, facts.userTmp);
   const home = facts.home;
   const roots = { workspaceRoot: "/", tmp, userTmp };
   let sandbox = { available: false, reason: "missing" };
@@ -393,10 +453,8 @@ function buildResolveMode(ctx) {
   return async (exec, requested, justification, toolName, subject) => {
     const session = exec.agent?.session;
     const standing = ctx.sandboxPolicy.resolve(session === void 0 ? {} : { session }).mode;
-    if (requested === void 0 && justification === void 0) return standing;
-    if (requested === void 0 || justification === void 0) {
-      throw new Error("sandbox_permissions and justification must be sent together");
-    }
+    validateEscalationArgs(requested, justification);
+    if (requested === void 0 || justification === void 0) return standing;
     const approved = await approveEscalation({
       requestedMode: requested,
       justification,
@@ -414,9 +472,17 @@ function buildResolveMode(ctx) {
 }
 async function rootsFor(status, workspace, pool, host, secret) {
   const workspaceRoot = await canonicalRemotePath(pool, host, secret, workspace);
-  const tmp = await canonicalRemotePath(pool, host, secret, status.roots.tmp);
-  const userTmp = await canonicalRemotePath(pool, host, secret, status.roots.userTmp);
-  return { workspaceRoot, tmp, userTmp };
+  return { workspaceRoot, tmp: status.roots.tmp, userTmp: status.roots.userTmp };
+}
+var NOT_FOUND = /no such file|cannot find|not found|does not exist/i;
+async function existingRemotePath(pool, host, secret, remotePath) {
+  if (remotePath.trim().length === 0) return "";
+  try {
+    return await pool.sftpRealpath(host, secret, remotePath);
+  } catch (error) {
+    if (error instanceof Error && NOT_FOUND.test(error.message)) return "";
+    return posix3.normalize(remotePath);
+  }
 }
 async function canonicalRemotePath(pool, host, secret, remotePath) {
   try {
@@ -464,12 +530,26 @@ function commandArgv(status, mode, roots, workdir, command) {
     return `cd ${shJoin([workdir])} && ${shJoin(inner)}`;
   }
   if (status.sandboxTool === "bwrap") {
-    const profile2 = bwrapProfileArgs(mode, roots.workspaceRoot) ?? [];
-    return shJoin(["bwrap", ...profile2, "--chdir", workdir, "--", ...inner]);
+    const profile = bwrapProfileArgs(mode, roots.workspaceRoot) ?? [];
+    return shJoin(["bwrap", ...profile, "--chdir", workdir, "--", ...inner]);
   }
-  const writable = mode === "workspace-write" ? [roots.workspaceRoot, roots.tmp, roots.userTmp] : [];
-  const profile = seatbeltProfileArgs(mode, writable) ?? [];
-  return shJoin(["sandbox-exec", ...profile, "--", ...inner]);
+  const writable = mode === "workspace-write" ? fileWritableRoots(mode, roots) : [];
+  return seatbeltBashCommand(mode, writable, workdir, command);
+}
+function fileCommand(status, mode, roots, script) {
+  if (status.sandboxTool === "bwrap") {
+    const profile = bwrapFileProfileArgs(mode, roots) ?? [];
+    return shJoin(["bwrap", ...profile, "--chdir", roots.workspaceRoot, "--", "bash", "-c", script]);
+  }
+  const writable = mode === "workspace-write" ? fileWritableRoots(mode, roots) : [];
+  return seatbeltBashCommand(mode, writable, roots.workspaceRoot, script);
+}
+function finishBackground(result, note, append) {
+  if (note.length > 0) append(note);
+  return {
+    status: result.timedOut || result.signal === "KILL" ? "killed" : "completed",
+    detail: result.timedOut ? "timed out" : result.signal === "KILL" ? "cancelled" : `exit code: ${result.code ?? "null"}`
+  };
 }
 async function startBackground(hostApi, host, secret, status, route, command, workdir, cwd, mode, exec) {
   const jobs = hostApi.jobs;
@@ -487,23 +567,20 @@ async function startBackground(hostApi, host, secret, status, route, command, wo
     kind: "bash",
     label: command,
     owner: exec.agent?.session?.id,
-    toolCall: exec.callId === void 0 ? void 0 : { callId: exec.callId },
+    toolCall: exec.callId === void 0 ? void 0 : {
+      callId: exec.callId,
+      rootCallId: exec.rootCallId ?? exec.callId
+    },
     run: (job) => {
       let opened;
       let cancelled = false;
-      const done = hostApi.pool.open(host, secret, argv, 0, exec.signal).then((commandHandle) => {
+      const done = hostApi.pool.open(host, secret, argv, 0, exec.signal, void 0, (chunk) => {
+        job.append(chunk.text, { channel: chunk.stream });
+      }).then((commandHandle) => {
         opened = commandHandle;
         if (cancelled || exec.signal?.aborted === true) commandHandle.close();
         return commandHandle.done;
-      }).then((result) => {
-        const text = `${capturedText(result.stdout, result.stdoutTruncated)}${capturedText(result.stderr, result.stderrTruncated)}${note}`;
-        job.append(text);
-        return {
-          status: result.timedOut || result.signal === "KILL" ? "killed" : "completed",
-          detail: result.timedOut ? "timed out" : result.signal === "KILL" ? "cancelled" : `exit code: ${result.code ?? "null"}`,
-          result: text
-        };
-      }).catch((error) => ({
+      }).then((result) => finishBackground(result, note, (text) => job.append(text))).catch((error) => ({
         status: "failed",
         detail: error instanceof Error ? error.message : String(error)
       }));
@@ -523,8 +600,7 @@ async function runRead(hostApi, route, args, exec) {
   const host = requireHost(hostApi, route.hostId);
   const secret = await hostApi.secretOf(host);
   const remotePath = resolveRemotePath(String(args.file_path ?? ""), route.remoteCwd, route.placeholderCwd);
-  const bytes = await hostApi.pool.sftpRead(host, secret, remotePath, READ_CAP);
-  throwIfAborted(exec?.signal);
+  const bytes = await withSignal(hostApi.pool.sftpRead(host, secret, remotePath, READ_CAP), exec?.signal);
   const text = bytes.toString("utf8");
   const all = text.split(/\n/);
   const offset = typeof args.offset === "number" && args.offset > 0 ? Math.floor(args.offset) : 1;
@@ -551,8 +627,9 @@ ${hintMarker("operation")}`, "FS_SANDBOX_DENIED");
   }
   let before = null;
   try {
-    before = (await hostApi.pool.sftpRead(host, secret, target, READ_CAP)).toString("utf8");
-  } catch {
+    before = (await withSignal(hostApi.pool.sftpRead(host, secret, target, READ_CAP), exec.signal)).toString("utf8");
+  } catch (error) {
+    if (exec.signal?.aborted === true || error instanceof Error && error.name === "AbortError") throw error;
     before = null;
   }
   const content = String(args.content ?? "");
@@ -576,7 +653,7 @@ async function runEdit(hostApi, route, args, exec) {
     throw new FsError(`${denialMarker(mode)}
 ${hintMarker("operation")}`, "FS_SANDBOX_DENIED");
   }
-  const before = (await hostApi.pool.sftpRead(host, secret, real, READ_CAP)).toString("utf8");
+  const before = (await withSignal(hostApi.pool.sftpRead(host, secret, real, READ_CAP), exec.signal)).toString("utf8");
   const oldString = String(args.old_string ?? "");
   const newString = String(args.new_string ?? "");
   const replaceAll = args.replace_all === true;
@@ -587,15 +664,17 @@ ${hintMarker("operation")}`, "FS_SANDBOX_DENIED");
   await commitFile(hostApi, host, secret, status, mode, roots, real, after, exec.signal);
   return { path: toModelPath(real, route), before, after };
 }
-async function runReadImage(hostApi, route, args, save) {
+async function runReadImage(hostApi, route, args, save, exec) {
+  throwIfAborted(exec?.signal);
   const host = requireHost(hostApi, route.hostId);
   const secret = await hostApi.secretOf(host);
   const remotePath = resolveRemotePath(String(args.file_path ?? ""), route.remoteCwd, route.placeholderCwd);
-  const data = await hostApi.pool.sftpRead(host, secret, remotePath, IMAGE_CAP);
+  const data = await withSignal(hostApi.pool.sftpRead(host, secret, remotePath, IMAGE_CAP), exec?.signal);
   const image = await save(data, posix3.basename(remotePath));
   return { path: toModelPath(remotePath, route), image };
 }
-async function runGlob(hostApi, route, args) {
+async function runGlob(hostApi, route, args, exec) {
+  throwIfAborted(exec?.signal);
   const host = requireHost(hostApi, route.hostId);
   const secret = await hostApi.secretOf(host);
   const status = await hostApi.statusOf(host);
@@ -603,23 +682,24 @@ async function runGlob(hostApi, route, args) {
   const base = typeof args.path === "string" ? resolveRemotePath(args.path, route.remoteCwd, route.placeholderCwd) : route.remoteCwd;
   const pattern = String(args.pattern ?? "");
   const command = `cd ${shJoin([base])} && ${shJoin(globArgv(status.ripgrepPath, pattern))}`;
-  const result = await hostApi.pool.exec(host, secret, command, 3e4);
-  if (result.code !== 0 && result.code !== 1) throw new Error(result.stderr || "glob failed");
+  const result = await hostApi.pool.exec(host, secret, command, 3e4, exec?.signal);
+  throwIfRgFailed(result, exec?.signal, "glob");
   const paths = result.stdout.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => {
     const absolute = posix3.isAbsolute(line) ? line : posix3.join(base, line);
     return toModelPath(absolute, route);
   });
   return { root: toModelPath(base, route), paths };
 }
-async function runGrep(hostApi, route, args) {
+async function runGrep(hostApi, route, args, exec) {
+  throwIfAborted(exec?.signal);
   const host = requireHost(hostApi, route.hostId);
   const secret = await hostApi.secretOf(host);
   const status = await hostApi.statusOf(host);
   if (status.ripgrepPath.length === 0) throw new Error("ripgrep is not available on this remote host");
   const base = typeof args.path === "string" ? resolveRemotePath(args.path, route.remoteCwd, route.placeholderCwd) : route.remoteCwd;
   const argv = grepArgv(status.ripgrepPath, String(args.pattern ?? ""), base, typeof args.include === "string" ? args.include : void 0);
-  const result = await hostApi.pool.exec(host, secret, shJoin(argv), 3e4);
-  if (result.code !== 0 && result.code !== 1) throw new Error(result.stderr || "grep failed");
+  const result = await hostApi.pool.exec(host, secret, shJoin(argv), 3e4, exec?.signal);
+  throwIfRgFailed(result, exec?.signal, "grep");
   const matches = [];
   for (const row of result.stdout.split("\n")) {
     if (row.trim().length === 0) continue;
@@ -639,6 +719,24 @@ async function runGrep(hostApi, route, args) {
   }
   return { matches };
 }
+async function runWorkingDirectory(hostApi, route, args, exec, setDirectory) {
+  if (args.cd === void 0 || args.cd === "") return { cwd: route.placeholderCwd };
+  const requested = resolveRemotePath(String(args.cd), route.remoteCwd, route.placeholderCwd);
+  const host = requireHost(hostApi, route.hostId);
+  const secret = await hostApi.secretOf(host);
+  let remote;
+  try {
+    remote = await hostApi.pool.sftpRealpath(host, secret, requested);
+  } catch {
+    throw new Error(`directory does not exist on the remote host: ${requested}`);
+  }
+  const local = mapRemoteToLocal(route.hostId, remote);
+  if (local === null) throw new Error("remote directory cannot be mapped to a workspace path");
+  await mkdir(local, { recursive: true });
+  if (exec.agent === void 0) throw new Error("working_directory requires an agent Session");
+  const cwd = await setDirectory(local);
+  return { cwd };
+}
 async function resolveCreatedPath(pool, host, secret, lexicalPath) {
   let cursor = posix3.normalize(lexicalPath);
   const missing = [];
@@ -660,21 +758,33 @@ async function commitFile(hostApi, host, secret, status, mode, roots, target, co
   if (mode !== "danger-full-access" && !status.sandbox.available) {
     throw new SandboxUnavailableError(mode, "remote sandbox probe failed");
   }
-  const tmp = posix3.join(roots.workspaceRoot, `.dsh-permission-remote-${randomBytes(8).toString("hex")}`);
-  await hostApi.pool.sftpWrite(host, secret, tmp, content);
-  const command = `mkdir -p ${shJoin([posix3.dirname(target)])} && mv -f ${shJoin([tmp, target])}`;
-  const wrapped = mode === "danger-full-access" ? command : commandArgv(status, mode, roots, roots.workspaceRoot, command);
-  const result = await hostApi.pool.exec(host, secret, wrapped, 2e4, signal);
-  if (result.code !== 0) {
-    await hostApi.pool.exec(host, secret, `rm -f ${shJoin([tmp])}`, 1e4).catch(() => void 0);
-    throw new Error(result.stderr || "remote write failed");
-  }
+  const directory = posix3.dirname(target);
+  const tmp = posix3.join(directory, `.dsh-permission-remote-${randomBytes(8).toString("hex")}`);
+  const script = atomicWriteScript(directory, tmp, target);
+  const wrapped = mode === "danger-full-access" ? script : fileCommand(status, mode, roots, script);
+  const result = await hostApi.pool.exec(host, secret, wrapped, 2e4, signal, content);
+  if (result.code !== 0) throw new Error(result.stderr || "remote write failed");
 }
 function throwIfAborted(signal) {
-  if (signal?.aborted !== true) return;
+  if (signal?.aborted === true) throw abortError();
+}
+function throwIfRgFailed(result, signal, label) {
+  if (signal?.aborted === true) throw abortError();
+  if (result.code !== 0 && result.code !== 1) throw new Error(result.stderr || `${label} failed`);
+}
+function abortError() {
   const error = new Error("tool call aborted");
   error.name = "AbortError";
-  throw error;
+  return error;
+}
+function withSignal(work, signal) {
+  throwIfAborted(signal);
+  if (signal === void 0) return work;
+  return new Promise((resolve, reject) => {
+    const fail = () => reject(abortError());
+    signal.addEventListener("abort", fail, { once: true });
+    work.then(resolve, reject).finally(() => signal.removeEventListener("abort", fail));
+  });
 }
 function capturedText(text, truncated) {
   if (!truncated) return text;
@@ -698,7 +808,7 @@ function sniffImage(data) {
 }
 
 // src/shadow.ts
-var ROUTED_TOOLS = ["bash", "read", "write", "edit", "read_image", "glob", "grep"];
+var ROUTED_TOOLS = ["bash", "read", "write", "edit", "read_image", "glob", "grep", "working_directory"];
 function planShadows(visible) {
   const plans = [];
   for (const name2 of ROUTED_TOOLS) {
@@ -724,6 +834,7 @@ function dispatchShadow(official, remote, remoteExecute, args, exec) {
 
 // src/ssh-pool.ts
 import { readFile } from "node:fs/promises";
+import { StringDecoder } from "node:string_decoder";
 import { Client } from "ssh2";
 
 // src/pool-claim.ts
@@ -740,6 +851,14 @@ function claimPending(map, key, create) {
 
 // src/ssh-pool.ts
 var OUTPUT_CAP = 1024 * 1024;
+function takeChannelText(decoder, chunk) {
+  return decoder.write(chunk);
+}
+function truncationMarker(noted) {
+  if (noted.current) return "";
+  noted.current = true;
+  return "\n[output truncated]";
+}
 var SshFailure = class extends Error {
   constructor(message, stage) {
     super(message);
@@ -775,14 +894,14 @@ var SshPool = class {
     if (current === void 0) return;
     void current.then((live) => closeLive(live)).catch(() => void 0);
   }
-  async exec(host, secret, command, timeoutMs, signal) {
-    const commandHandle = await this.open(host, secret, command, timeoutMs, signal);
+  async exec(host, secret, command, timeoutMs, signal, stdin, onOutput) {
+    const commandHandle = await this.open(host, secret, command, timeoutMs, signal, stdin, onOutput);
     return commandHandle.done;
   }
   /** `timeoutMs` of 0 waits until the command exits, the signal aborts, or `close` kills its channel. */
-  async open(host, secret, command, timeoutMs, signal) {
+  async open(host, secret, command, timeoutMs, signal, stdin, onOutput) {
     const live = await this.acquire(host, secret, true);
-    const commandHandle = openChannel(live.client, command, timeoutMs);
+    const commandHandle = openChannel(live.client, command, timeoutMs, stdin, onOutput);
     if (signal !== void 0) {
       const abort = () => commandHandle.close();
       if (signal.aborted) commandHandle.close();
@@ -826,6 +945,10 @@ var SshPool = class {
     const session = await this.sftp(host, secret);
     return realpathOf(session, remotePath);
   }
+  async sftpStat(host, secret, remotePath) {
+    const session = await this.sftp(host, secret);
+    return statInfo(session, remotePath);
+  }
   async sftpList(host, secret, remotePath) {
     const session = await this.sftp(host, secret);
     const rows = await readdir(session, remotePath);
@@ -934,7 +1057,7 @@ function connect(host, secret, accept) {
     client.connect(options);
   });
 }
-function openChannel(client, command, timeoutMs) {
+function openChannel(client, command, timeoutMs, stdin, onOutput) {
   let settled = false;
   let cause = "exit";
   let stream;
@@ -948,9 +1071,33 @@ function openChannel(client, command, timeoutMs) {
   const stderr = [];
   let stdoutTruncated = false;
   let stderrTruncated = false;
+  const decoders = {
+    stdout: new StringDecoder("utf8"),
+    stderr: new StringDecoder("utf8")
+  };
+  const decoderEnded = { stdout: false, stderr: false };
+  const truncationNoted = { current: false };
+  const emit = (which, text) => {
+    if (text.length === 0 || onOutput === void 0) return;
+    try {
+      onOutput({ stream: which, text });
+    } catch {
+    }
+  };
+  const flushDecoder = (which) => {
+    if (decoderEnded[which]) return;
+    decoderEnded[which] = true;
+    emit(which, decoders[which].end());
+  };
+  const markTruncation = (which) => {
+    flushDecoder(which);
+    emit(which, truncationMarker(truncationNoted));
+  };
   const finish = (code, signal) => {
     if (settled) return;
     settled = true;
+    flushDecoder("stdout");
+    flushDecoder("stderr");
     clearTimeout(timer);
     clearTimeout(fallback);
     resolveDone({
@@ -994,24 +1141,31 @@ function openChannel(client, command, timeoutMs) {
     stream = opened;
     const push = (target, chunk, which) => {
       const used = target.reduce((sum, part) => sum + part.length, 0);
-      if (used >= OUTPUT_CAP) {
+      const room = OUTPUT_CAP - used;
+      if (room <= 0) {
         if (which === "stdout") stdoutTruncated = true;
         else stderrTruncated = true;
+        markTruncation(which);
         stop("truncate");
         return;
       }
-      if (used + chunk.length > OUTPUT_CAP) {
-        target.push(chunk.subarray(0, OUTPUT_CAP - used));
+      const kept = Buffer.from(chunk.subarray(0, Math.min(chunk.length, room)));
+      target.push(kept);
+      emit(which, takeChannelText(decoders[which], kept));
+      if (kept.length < chunk.length) {
         if (which === "stdout") stdoutTruncated = true;
         else stderrTruncated = true;
+        markTruncation(which);
         stop("truncate");
-        return;
       }
-      target.push(chunk);
     };
     stream.on("data", (chunk) => push(stdout, chunk, "stdout"));
     stream.stderr.on("data", (chunk) => push(stderr, chunk, "stderr"));
     stream.on("close", (code, signal) => finish(code, signal));
+    if (stdin !== void 0 && cause === "exit") {
+      stream.write(typeof stdin === "string" ? Buffer.from(stdin) : stdin);
+      stream.end();
+    }
     if (cause !== "exit") {
       try {
         stream.signal?.("KILL", () => void 0);
@@ -1053,14 +1207,17 @@ async function closeLive(live) {
   }
   live.client.end();
 }
-function statSize(sftp, remotePath) {
+function statInfo(sftp, remotePath) {
   return new Promise((resolve, reject) => {
     sftp.stat(remotePath, (error, stats) => {
       if (error) reject(new SshFailure(error.message, "sftp-stat"));
-      else resolve(stats.size);
+      else resolve({ isDirectory: stats.isDirectory(), size: stats.size });
     });
   });
 }
+function statSize(sftp, remotePath) {
+  return statInfo(sftp, remotePath).then((info) => info.size);
+}
 function readAll(sftp, remotePath) {
   return new Promise((resolve, reject) => {
     sftp.readFile(remotePath, (error, data) => {
@@ -1130,10 +1287,11 @@ var SshApi = class extends TypertRemoteService {
   }
   async createWorkspace(input) {
     const host = this.core.requireHost(input.hostId);
-    await this.core.pool.sftpRealpath(host, await this.core.secret(host), input.path);
+    const info = await this.core.pool.sftpStat(host, await this.core.secret(host), input.path);
+    if (!info.isDirectory) throw new Error(`remote path is not a directory: ${input.path}`);
     const local = mapRemoteToLocal(input.hostId, input.path);
     if (local === null) throw new Error("remote path must be absolute");
-    await mkdir(local, { recursive: true });
+    await mkdir2(local, { recursive: true });
     const title = input.title?.trim() || basename(input.path);
     await this.core.workspaces.create(local, title);
     return { path: local };
@@ -1161,13 +1319,6 @@ var Core = class {
   pool;
   config;
   status = /* @__PURE__ */ new Map();
-  update(config) {
-    this.config = config;
-    this.status.clear();
-  }
-  hosts() {
-    return this.config.hosts;
-  }
   requireHost(hostId) {
     const host = this.config.hosts.find((item) => item.id === hostId);
     if (host === void 0) throw new Error(`unknown SSH host ${hostId}`);
@@ -1175,10 +1326,7 @@ var Core = class {
   }
   async trust(hostId, fingerprint) {
     this.requireHost(hostId);
-    this.config = {
-      ...this.config,
-      hosts: this.config.hosts.map((item) => item.id === hostId ? { ...item, fingerprint } : item)
-    };
+    this.config.hosts = this.config.hosts.map((item) => item.id === hostId ? { ...item, fingerprint } : item);
     this.pool.invalidate(hostId);
     this.status.delete(hostId);
     await this.persistHosts();
@@ -1193,6 +1341,8 @@ var Core = class {
     return { password: record.payload.password, passphrase: record.payload.passphrase };
   }
   async saveSecret(hostId, material) {
+    assertHostId(hostId);
+    this.requireHost(hostId);
     const key = credentialKey("dsh-permission-remote", hostId);
     await this.ctx.credentials.modifyRecord(key, async (current) => {
       const previous = current?.kind === "grant" && isPayload(current.payload) ? current.payload : {};
@@ -1206,19 +1356,23 @@ var Core = class {
     });
   }
   async saveHost(host) {
+    assertHostId(host.id);
     const hosts = this.config.hosts.filter((item) => item.id !== host.id);
-    this.config = { ...this.config, hosts: [...hosts, host] };
+    this.config.hosts = [...hosts, host];
     await this.persistHosts();
   }
   async deleteHost(hostId) {
-    this.config = { ...this.config, hosts: this.config.hosts.filter((item) => item.id !== hostId) };
+    this.config.hosts = this.config.hosts.filter((item) => item.id !== hostId);
     this.pool.invalidate(hostId);
     this.status.delete(hostId);
     await this.persistHosts();
   }
   async persistHosts() {
     const row = this.ctx.settings.describe().find((item) => String(item.ns) === "permission-remote");
-    if (row === void 0) return;
+    if (row === void 0) {
+      this.ctx.logger?.warn('[@dsh-permission-remote] settings row "permission-remote" is missing; the host list changed in memory but was not persisted');
+      return;
+    }
     await this.ctx.settings.update(String(row.ns), { hosts: this.config.hosts });
   }
   probe(hostId, refresh = false) {
@@ -1246,6 +1400,9 @@ var Core = class {
     };
   }
 };
+function assertHostId(hostId) {
+  if (!isValidHostId(hostId)) throw new Error("host id must be a lowercase credential key: it starts with a letter and contains only letters, digits, and hyphens");
+}
 function isPayload(value) {
   return typeof value === "object" && value !== null;
 }
@@ -1264,7 +1421,7 @@ function markRemote(service) {
 }
 var RUNNERS = {
   bash: (host, route, args, exec) => runBash(host, route, args, exec),
-  read: (host, route, args) => runRead(host, route, args),
+  read: (host, route, args, exec) => runRead(host, route, args, exec),
   write: (host, route, args, exec) => runWrite(host, route, args, exec),
   edit: (host, route, args, exec) => runEdit(host, route, args, exec),
   read_image: (host, route, args, exec, ctx) => runReadImage(host, route, args, async (data, fileName) => {
@@ -1273,9 +1430,14 @@ var RUNNERS = {
     const mediaType = sniffImage(data);
     if (mediaType === void 0) throw new Error(`cannot read "${fileName}": the file content is not a PNG, JPEG, WebP, or GIF`);
     return attachments.saveImage({ data, mediaType, name: fileName });
-  }),
-  glob: (host, route, args) => runGlob(host, route, args),
-  grep: (host, route, args) => runGrep(host, route, args)
+  }, exec),
+  glob: (host, route, args, exec) => runGlob(host, route, args, exec),
+  grep: (host, route, args, exec) => runGrep(host, route, args, exec),
+  working_directory: (host, route, args, exec, ctx) => runWorkingDirectory(host, route, args, exec, async (directory) => {
+    const directories = ctx.get("workingDirectory");
+    if (directories === void 0 || exec.agent === void 0) throw new Error("working_directory requires an agent Session");
+    return directories.set(exec.agent, directory, exec.signal);
+  })
 };
 function apply(rawCtx, rawConfig) {
   const ctx = rawCtx;
@@ -1289,17 +1451,38 @@ function apply(rawCtx, rawConfig) {
     void core.pool.dispose();
   });
   void api;
-  ctx.on("agent/created", ({ agent }) => {
-    const cwd = agent.session?.header?.cwd;
-    const initial = routeByCwd(cwd);
+  const seen = /* @__PURE__ */ new Set();
+  const attach = (agent) => {
+    if (seen.has(agent)) return;
+    seen.add(agent);
+    let installed = false;
+    try {
+      installed = installShadows(ctx, core, agent, unregisters, () => {
+        seen.delete(agent);
+      });
+    } finally {
+      if (!installed) seen.delete(agent);
+    }
+  };
+  ctx.on("agent/created", ({ agent }) => attach(agent));
+  const agents = ctx.get("agents");
+  if (typeof agents?.list === "function") {
+    for (const agent of agents.list()) attach(agent);
+  }
+  ctx.logger?.info("[@dsh-permission-remote] loaded");
+}
+function installShadows(ctx, core, agent, unregisters, forget) {
+  const cwd = agent.session?.header?.cwd;
+  const initial = routeByCwd(cwd);
+  const disposers = [];
+  try {
     const plans = planShadows((name2) => agent.ctx.tools.get(name2, agent));
     const host = core.toolHost(agent.ctx.get("jobs"));
-    const disposers = [];
     for (const plan of plans) {
       if (plan.official === void 0 && !(plan.name === "bash" && initial.kind === "remote")) continue;
       const official = plan.official;
       const runner = RUNNERS[plan.name];
-      const unregister = agent.ctx.tools.register(withRemoteTimeout({
+      disposers.push(agent.ctx.tools.register(withRemoteTimeout({
         ...capturedSchema(agent.ctx, plan.name, agent),
         name: plan.name,
         async execute(args, exec) {
@@ -1311,19 +1494,35 @@ function apply(rawCtx, rawConfig) {
           }
           return runner(host, current, args, exec, ctx);
         }
-      }));
-      disposers.push(unregister);
+      })));
     }
-    const drop = () => {
-      for (const unregister of disposers) unregister();
-    };
-    unregisters.add(drop);
-    agent.ctx.effect(() => () => {
-      drop();
-      unregisters.delete(drop);
-    });
-  });
-  ctx.logger?.info("[@dsh-permission-remote] loaded");
+  } catch (error) {
+    for (const unregister of disposers) unregister();
+    ctx.logger?.warn(`[@dsh-permission-remote] shadow install failed for agent ${agentLabel(agent)}: ${error instanceof Error ? error.message : String(error)}`);
+    if (initial.kind === "remote") throw error;
+    return false;
+  }
+  let dropped = false;
+  const drop = () => {
+    if (dropped) return;
+    dropped = true;
+    for (const unregister of disposers) unregister();
+    unregisters.delete(drop);
+    forget();
+  };
+  unregisters.add(drop);
+  try {
+    agent.ctx.effect(() => drop);
+  } catch (error) {
+    drop();
+    ctx.logger?.warn(`[@dsh-permission-remote] shadow install failed for agent ${agentLabel(agent)}: ${error instanceof Error ? error.message : String(error)}`);
+    if (initial.kind === "remote") throw error;
+    return false;
+  }
+  return true;
+}
+function agentLabel(agent) {
+  return agent.session?.id ?? agent.session?.header?.cwd ?? "unknown";
 }
 function withRemoteTimeout(definition) {
   const parameters = definition.parameters;
@@ -1366,7 +1565,7 @@ function fallbackSchema(toolName) {
       timeoutMs: { type: "number" },
       workdir: { type: "string" },
       run_in_background: { type: "boolean" },
-      sandbox_permissions: { type: "string", enum: ["workspace-write", "danger-full-access"] },
+      sandbox_permissions: { type: "string", enum: [...ESCALATION_TARGETS] },
       justification: { type: "string" }
     },
     output: {