dsh-remote-vs 0.8.3 → 0.8.6

package/README.en.md

@@ -178,11 +178,13 @@ dsh_remote_vs/
 When a new helper is built, swap the 4-piece set (tarball + sha256 + helper.json + patch notes)
 into vendor and commit (details live in the local-only `docs/MAINTENANCE.md` §4, which is gitignored and not distributed).
 
-`.spike/` (gitignored) holds live-host verification scripts plus the local self-checks:
-`p2-router.ts` main regression (real remote + real Cordis + real router classes) and probes like
-`grep-probe.mjs` (build with `tsconfig.scratch.json`), plus `model-check.mjs` / `reveal-check.mjs` /
-`fallback-check.mjs` / `client-load-check.mjs` / `tool-schema-check.mjs` which need no host at all
-(see "Development").
+`.spike/` and `scripts/` (both gitignored, **never distributed with the repository**) hold the
+development-time verification and self-check scripts: `.spike/` has the live-host ones — `p2-router.ts`
+main regression (real remote + real Cordis + real router classes) and probes like `grep-probe.mjs`
+(build with `tsconfig.scratch.json`), plus `model-check.mjs` / `reveal-check.mjs` /
+`fallback-check.mjs` / `client-load-check.mjs` / `tool-schema-check.mjs` which need no host at all;
+`scripts/` has the plain-node regression gates (`node scripts/check-*.mjs`, with `verify-lib.mjs`
+checking the build artifact). Both are covered under "Development".
 
 ## Remote workbench (VS Code style)
 
@@ -322,8 +324,9 @@ dsh plugin --profile web add link:<absolute path of this directory>
 **How a change goes live: `pnpm run build`, then restart `dsh web` — for the host half and the client half alike.**
 **`lib/` is committed.** The package has no `prepare` script (pnpm 12 refuses to run one for a git
 dependency), so a `dsh plugin add github:…` user receives the repository as it is: **after editing
-source you must `npm run build` and commit `lib/` with it.** The first step of `pnpm check`
-(`scripts/verify-lib.mjs`) fails when `lib/` is untracked or throws while loading.
+source you must `npm run build` and commit `lib/` with it** (`node scripts/verify-lib.mjs` checks that the
+entries are present, committed and loadable; the self-check scripts live on the maintainer's machine only,
+see below).
 The Host reads plugin bundles into memory at startup (`initialBundleSnapshot`: it stats mtime/ctime/size into a
 revision, then reads the bytes; the response carries `Cache-Control: public, max-age=31536000, immutable`), so a
 **client-only** change (`src/client/**`) behaves exactly the same way: a browser refresh — `Ctrl+Shift+R`

package/README.md

@@ -169,10 +169,12 @@ dsh_remote_vs/
 新版本 helper 编好后把 4 件套（tarball + sha256 + helper.json + 补丁说明）
 换进 vendor 并提交即可（详细步骤在本地维护文档 `docs/MAINTENANCE.md` §4，该文件被 .gitignore，不随仓库分发）。
 
-`.spike/`（gitignored）是真机验证脚本 + 本地自检脚本：`p2-router.ts` 主回归（真远端 + 真
-Cordis + 真路由类）+ `grep-probe.mjs` 等探针（构建见 `tsconfig.scratch.json`），以及不需要真机的
+`.spike/` 与 `scripts/`（都 gitignored，**不随仓库分发**）是开发期的验证与自检脚本：
+`.spike/` 里是真机验证脚本 —— `p2-router.ts` 主回归（真远端 + 真 Cordis + 真路由类）+
+`grep-probe.mjs` 等探针（构建见 `tsconfig.scratch.json`），以及不需要真机的
 `model-check.mjs` / `reveal-check.mjs` / `fallback-check.mjs` / `client-load-check.mjs` /
-`tool-schema-check.mjs`（见下文“开发”）。
+`tool-schema-check.mjs`；`scripts/` 里是纯 node 的回归闸门（`node scripts/check-*.mjs`，
+其中 `verify-lib.mjs` 核对构建产物）。两者都见下文"开发"。
 
 ## 远端工作台（VS Code 式）
 
@@ -291,8 +293,8 @@ dsh plugin --profile web add link:<本目录绝对路径>
 
 **改完怎么生效：`pnpm run build` 之后重启 `dsh web` —— host 半与客户端半都是。**
 **`lib/` 是入库的**：本包没有 `prepare`（pnpm 12 会拦），别人 `dsh plugin add github:…` 拿到的是仓库内容，
-所以**改完源码必须 `npm run build` 并把 `lib/` 一起提交**——`pnpm check` 的第一步
-（`scripts/verify-lib.mjs`）会在 `lib/` 没入库或加载即抛错时直接失败。
+所以**改完源码必须 `npm run build` 并把 `lib/` 一起提交**（`node scripts/verify-lib.mjs` 会核对入口齐全、
+已入库、能加载；自检脚本只在本机，见下）。
 Host 在启动时把插件包读进内存（`initialBundleSnapshot`：先记录 mtime/ctime/size 作为 rev，再读字节；
 响应头 `Cache-Control: public, max-age=31536000, immutable`），所以**只改 `src/client/**` 也一样**：
 浏览器刷新——包括 `Ctrl+Shift+R`——只会取回启动时抓下的那批字节，rev 不变。判定方法：

package/lib/client.js

@@ -823,7 +823,7 @@ window.__ModuleLoader__.load({
 								onKeyDown: (e) => {
 									if (e.key === "Enter") go();
 								},
-								placeholder: "/home/xiray/project",
+								placeholder: "/home/user/project",
 								spellCheck: false,
 								style: {
 									flex: 1,
@@ -37978,7 +37978,7 @@ Integer Float Double Long Int32 Int64 Uint8 uint32_t int32_t uint64_t int64_t si
 					const primary = host.querySelectorAll("[class*=\"rvs-ck-\"]").length;
 					const fallback = host.querySelectorAll("span[class^=\"rvs-t-\"]").length;
 					const count = primary > 0 ? primary : fallback;
-					console.info(`[dsh-remote-vs] build 1021-1839 · ${source} · colored tokens: ${count} (${propsRef.current.path})`);
+					console.info(`[dsh-remote-vs] build 1022-1607 · ${source} · colored tokens: ${count} (${propsRef.current.path})`);
 					propsRef.current.onTokens?.(count);
 				};
 				const armFallback = () => {
@@ -39920,13 +39920,47 @@ Integer Float Double Long Int32 Int64 Uint8 uint32_t int32_t uint64_t int64_t si
 			return clean;
 		}
 		/**
-		* Name search under a remote directory. Depth-capped and `.git`/`node_modules`
-		* pruned so a huge tree cannot turn one keystroke into a minute of walking.
+		* Directory names a NAME search never walks.
+		*
+		* The old `find` prune list plus one addition: `out` is build output (the
+		* content search already prunes it), and on an AOSP tree with a populated `out/`
+		* walking it would cost far more than the depth cap it replaces ever did.
 		*/
-		async function searchFiles(alias, root, query, limit = 120, depth = 6) {
+		const NAME_PRUNE_DIRS = [
+			".git",
+			"node_modules",
+			".venv",
+			"dist",
+			"build",
+			"out"
+		];
+		/**
+		* Name search under a remote directory: `rg` when the host has it, `find` when
+		* it does not — decided BY THE HOST inside one command, so there is no probe
+		* round trip and no per-alias cache to invalidate.
+		*
+		* Why the fallback exists at all: the previous implementation was `find` with a
+		* hard `-maxdepth 6`, and that cap silently hid real files — in a monorepo of a
+		* few million files, a source file ten levels down is simply invisible to it.
+		* Measured on such a tree: `find -maxdepth 6` → 0 hits (2.0 s), `find -maxdepth
+		* 12` → the hit, but 13.5 s, an uncapped `find` → does not finish at all, and
+		* `rg --files --iglob` → the hit in ~4 s with no depth limit, because it walks
+		* the tree once with a prefiltered glob instead of stat-ing every entry.
+		*
+		* Coverage: `--no-ignore --hidden` keeps what `find` did — it never consulted
+		* .gitignore — so a generated or ignored file is still findable by name. The
+		* fallback keeps a cap (raised from 6 to 12) because an uncapped walk is not
+		* viable on a tree that size.
+		*
+		* The query is a GLOB fragment (as it always was): `*.java` still works as a
+		* pattern, and `--iglob` matches case-insensitively like `find -iname`.
+		*/
+		async function searchFiles(alias, root, query, limit = 120, depth = 12) {
 			const clean = assertQuery$1(query);
 			const cap = Math.min(Math.max(Math.floor(limit), 1), 400);
-			const lines = (await tryRun(alias, `find ${shQuote(root)} -maxdepth ${depth} \\( -name .git -o -name node_modules -o -name .venv -o -name dist -o -name build \\) -prune -o \\( -type f -o -type d \\) -iname ${shQuote(`*${clean}*`)} -printf '%p\\t%y\\n' 2>/dev/null | head -n ${cap + 1}`, 9e4)).split("\n").map((line) => line.trim()).filter((line) => line !== "");
+			const pattern = `*${clean}*`;
+			const prunes = NAME_PRUNE_DIRS.map((name) => `-g ${shQuote(`!**/${name}/**`)}`).join(" ");
+			const lines = (await tryRun(alias, `if command -v rg >/dev/null 2>&1; then ${`rg --files --no-ignore --hidden --iglob ${shQuote(pattern)} ${prunes} ${shQuote(root)} 2>/dev/null`}; else ${`find ${shQuote(root)} -maxdepth ${depth} \\( ${NAME_PRUNE_DIRS.map((name) => `-name ${shQuote(name)}`).join(" -o ")} \\) -prune -o \\( -type f -o -type d \\) -iname ${shQuote(pattern)} -printf '%p\\t%y\\n' 2>/dev/null`}; fi | head -n ${cap + 1}`, 9e4)).split("\n").map((line) => line.trim()).filter((line) => line !== "");
 			const truncated = lines.length > cap;
 			const base = root.replace(/\/+$/, "");
 			const hits = [];
@@ -40356,7 +40390,7 @@ Integer Float Double Long Int32 Int64 Uint8 uint32_t int32_t uint64_t int64_t si
 		* path decides between the bindings on it.
 		*
 		* One alias routinely carries SEVERAL bindings (the same host mounted at
-		* `/home/xiray/P710/…` and `/home/xiray/Z700/…`), so an alias-only match hands
+		* `/srv/one/…` and `/srv/two/…`), so an alias-only match hands
 		* back whichever was created first: the editor then opens the file the caller
 		* named while the sidebar, the tree and the workspace selector stay on the
 		* other workspace. The remote root the caller already holds (`summary.root`, a
@@ -40531,8 +40565,8 @@ Integer Float Double Long Int32 Int64 Uint8 uint32_t int32_t uint64_t int64_t si
 		* `bindingForWorkspacePath` answers only for the workspace path ITSELF (exact
 		* alias-dir match). A session cwd is weaker evidence: the model cd'ed into a
 		* project sub-directory, and the host commits whichever spelling the session
-		* ran in — the local alias (`C:\…\aliases\p710bb\src`) or the REMOTE path
-		* (`/home/xiray/P710/master/userdebug/P710/src`). Both are still inside exactly
+		* ran in — the local alias dir (`C:\…\aliases\<alias>\src`) or the REMOTE
+		* path (`/srv/one/src`). Both are still inside exactly
 		* one binding, so the deepest containing alias dir / remote root decides.
 		*
 		* No fallback to "the first binding": a cwd that names no known binding answers
@@ -41170,7 +41204,7 @@ Integer Float Double Long Int32 Int64 Uint8 uint32_t int32_t uint64_t int64_t si
 		* workspace showed the sidebar on another — the selector kept whatever
 		* localStorage held (or the FIRST binding, on a fresh profile), and a click in
 		* the change panel matched its binding by alias alone, which is ambiguous as
-		* soon as one host carries two workspaces (P710 and Z700 share `ssh_xiray_new`).
+		* soon as one host carries two workspaces under one alias).
 		*
 		* Resolution order, strongest evidence first (all of it inside
 		* `planWorkspaceFollow`, so the policy has exactly one home):
@@ -43037,8 +43071,8 @@ Integer Float Double Long Int32 Int64 Uint8 uint32_t int32_t uint64_t int64_t si
 						}),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 							className: "rvs-build",
-							title: `dsh-remote-vs build 1021-1839`,
-							children: "1021-1839"
+							title: `dsh-remote-vs build 1022-1607`,
+							children: "1022-1607"
 						}),
 						tokenCount !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
 							className: "rvs-build",
@@ -44859,7 +44893,25 @@ Integer Float Double Long Int32 Int64 Uint8 uint32_t int32_t uint64_t int64_t si
 			return trimmed;
 		}
 		/**
-		* Recursive content search under one absolute remote directory.
+		* Recursive content search under one absolute remote directory: `rg` when the
+		* host has it, `grep -r` when it does not.
+		*
+		* Measured on a monorepo of a few million files (two kernel source trees among
+		* them): the `grep` form was still running when a 300 s timeout killed it, while
+		* the same query scoped to one subtree answers in milliseconds — on a tree that
+		* size the SCOPE matters more than the tool, but rg is the faster one, so it is
+		* preferred, with the previous grep command kept verbatim as the fallback so
+		* behaviour can never get worse than today.
+		*
+		* Two deliberate differences on the rg path:
+		*   - it honours .gitignore (grep never did), which is what keeps build outputs
+		*     and kernel artifacts out of an interactive search — the same default VS
+		*     Code ships, and the reason `--no-ignore` is NOT passed here;
+		*   - `--hidden` keeps dotfiles searchable (`.github/workflows/*.yml`), with
+		*     `.git` excluded explicitly so `--hidden` cannot walk a nested repository.
+		*
+		* The output SHAPE is identical either way (`path\0line:text`, verified byte for
+		* byte against both tools on a real host), so `parseContentHits` is unchanged.
 		*
 		* `--null` puts a NUL between the path and the `line:text` half so a path
 		* containing `:` still parses; `cut` bounds each line and `head` bounds the
@@ -44869,16 +44921,28 @@ Integer Float Double Long Int32 Int64 Uint8 uint32_t int32_t uint64_t int64_t si
 			const pattern = assertQuery(query);
 			const max = Math.min(Math.max(Math.floor(options.maxResults), 1), 2e3);
 			const lineChars = Math.min(Math.max(Math.floor(options.maxLineChars), 80), 4e3);
-			return `${[
+			const prune = [...PRUNE_DIRS, ...options.prune ?? []];
+			const grepParts = [
 				"grep -rIn --null --binary-files=without-match",
-				...[...PRUNE_DIRS, ...options.prune ?? []].map((name) => `--exclude-dir=${shQuote(name)}`),
+				...prune.map((name) => `--exclude-dir=${shQuote(name)}`),
 				options.caseSensitive ? "" : "-i",
 				options.wholeWord ? "-w" : "",
 				options.regex ? "-E" : "-F",
 				`-e ${shQuote(pattern)}`,
 				"--",
 				shQuote(assertRemoteDir(dir))
-			].filter((part) => part !== "").join(" ")} 2>/dev/null | cut -c1-${lineChars} | head -n ${max + 1}`;
+			].filter((part) => part !== "");
+			const rgParts = [
+				"rg -n --no-heading --null --color=never --with-filename --hidden",
+				...prune.map((name) => `-g ${shQuote(`!**/${name}/**`)}`),
+				options.caseSensitive ? "" : "-i",
+				options.wholeWord ? "-w" : "",
+				options.regex ? "" : "-F",
+				`-e ${shQuote(pattern)}`,
+				shQuote(assertRemoteDir(dir))
+			].filter((part) => part !== "");
+			const grep = `${grepParts.join(" ")} 2>/dev/null`;
+			return `if command -v rg >/dev/null 2>&1; then ${`${rgParts.join(" ")} 2>/dev/null`}; else ${grep}; fi | cut -c1-${lineChars} | head -n ${max + 1}`;
 		}
 		/**
 		* Parse the NUL-separated grep output (tolerating a fallback colon format).
@@ -60869,7 +60933,7 @@ Integer Float Double Long Int32 Int64 Uint8 uint32_t int32_t uint64_t int64_t si
 			* Without this the panel opened on whatever localStorage held — and on a
 			* fresh profile on `workspaces[0]` — so a session working in one remote
 			* workspace showed another workspace's tree until the user corrected it by
-			* hand (the reported bug: a P710 session browsing Z700). The host's own
+			* hand (the reported bug: a session browsing another workspace on one host). The host's own
 			* workspace membership for the on-screen session is the only sanctioned
 			* source (`useRemoteChatTarget`), and it is a soft read: while it answers
 			* nothing the current selection stands.

package/lib/index.js

@@ -1,4 +1,4 @@
-import { a as pushPipeline, c as require_lib, d as ensurePrivateDir, f as keysDir, i as probe, l as aliasRoot, o as seedHelperCache, p as storePath, r as helperAvailability, s as RemoteFiles, t as RemoteWorlds, u as dshHome } from "./worlds-PUumRIh7.js";
+import { a as pushPipeline, c as require_lib, d as ensurePrivateDir, f as keysDir, i as probe, l as aliasRoot, o as seedHelperCache, p as storePath, r as helperAvailability, s as RemoteFiles, t as RemoteWorlds, u as dshHome } from "./worlds-C6W225o9.js";
 import z from "@deepseek-ai/schemastery";
 import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, statSync, writeSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
@@ -2529,8 +2529,8 @@ function readHeadCommand(root, paths, capBytes, totalCapBytes) {
 /**
 * Name every immediate subdirectory that is a git repository.
 *
-* A session working directory is often a CONTAINER for repositories (the
-* reference host has `/home/xiray/dsh_workbase` holding `emv-toolbox-web`), and
+* A session working directory is often a CONTAINER for repositories (a root
+* that holds another repository inside it), and
 * `git status` at the container answers 128. This is a one-level `ls`-style
 * probe — bounded work, no `find` — so it can never become the expensive part
 * of a scan.
@@ -3357,8 +3357,8 @@ var SessionChanges = class {
 	* index (1.4s measured on the reference monorepo).
 	*
 	* A session working directory is often a CONTAINER for repositories rather
-	* than one itself (the reference host has `/home/xiray/dsh_workbase` holding
-	* `emv-toolbox-web`), and `git status` there answers exit 128 — "not a git
+	* than one itself (a session root that holds another repository inside it),
+	* and `git status` there answers exit 128 — "not a git
 	* repository (or any parent up to mount point /)". When that happens the
 	* ledger looks one level down once and adopts the repository it finds, which
 	* is the same idea the SCM panel's `repoSubdir` expresses by hand.

package/lib/p2-router-fs.js

@@ -1,4 +1,4 @@
-import { l as aliasRoot, n as isWindowsAbsolute } from "./worlds-PUumRIh7.js";
+import { l as aliasRoot, n as isWindowsAbsolute } from "./worlds-C6W225o9.js";
 import { FileSystem, FsError } from "@deepseek-ai/dsh-fs";
 //#region src/p2/router-fs.ts
 /**

package/lib/types/changes/recorder.d.ts

@@ -148,8 +148,8 @@ export declare class SessionChanges {
      * index (1.4s measured on the reference monorepo).
      *
      * A session working directory is often a CONTAINER for repositories rather
-     * than one itself (the reference host has `/home/xiray/dsh_workbase` holding
-     * `emv-toolbox-web`), and `git status` there answers exit 128 — "not a git
+     * than one itself (a session root that holds another repository inside it),
+     * and `git status` there answers exit 128 — "not a git
      * repository (or any parent up to mount point /)". When that happens the
      * ledger looks one level down once and adopts the repository it finds, which
      * is the same idea the SCM panel's `repoSubdir` expresses by hand.

package/lib/types/changes/status.d.ts

@@ -175,8 +175,8 @@ export declare function readHeadCommand(root: string, paths: readonly string[],
 /**
  * Name every immediate subdirectory that is a git repository.
  *
- * A session working directory is often a CONTAINER for repositories (the
- * reference host has `/home/xiray/dsh_workbase` holding `emv-toolbox-web`), and
+ * A session working directory is often a CONTAINER for repositories (a root
+ * that holds another repository inside it), and
  * `git status` at the container answers 128. This is a one-level `ls`-style
  * probe — bounded work, no `find` — so it can never become the expensive part
  * of a scan.

package/lib/types/client/remote-file-open-target.d.ts

@@ -6,7 +6,7 @@
  * opens it through its own right-sidebar preview. That preview resolves the
  * address path against the SESSION WORKSPACE ROOT. A model that quotes a path
  * relative to its CURRENT directory (e.g. `_xfer/reports/x.md` while working
- * in `…/dsh_workbase/emv-toolbox-web`) therefore misses by one segment, and a
+ * in `<workspace>/<inner-repo>`) therefore misses by one segment, and a
  * remote session's workspace root only exists as an EMPTY local alias dir —
  * the click dies with the host-side ENOENT the user sees.
  *
@@ -67,7 +67,7 @@ export declare function bindingForWorkspacePath(table: RemoteOpenBindings, works
  * path decides between the bindings on it.
  *
  * One alias routinely carries SEVERAL bindings (the same host mounted at
- * `/home/xiray/P710/…` and `/home/xiray/Z700/…`), so an alias-only match hands
+ * `/srv/one/…` and `/srv/two/…`), so an alias-only match hands
  * back whichever was created first: the editor then opens the file the caller
  * named while the sidebar, the tree and the workspace selector stay on the
  * other workspace. The remote root the caller already holds (`summary.root`, a
@@ -199,8 +199,8 @@ export declare function selectionIsSessionBinding(options: {
  * `bindingForWorkspacePath` answers only for the workspace path ITSELF (exact
  * alias-dir match). A session cwd is weaker evidence: the model cd'ed into a
  * project sub-directory, and the host commits whichever spelling the session
- * ran in — the local alias (`C:\…\aliases\p710bb\src`) or the REMOTE path
- * (`/home/xiray/P710/master/userdebug/P710/src`). Both are still inside exactly
+ * ran in — the local alias dir (`C:\…\aliases\<alias>\src`) or the REMOTE
+ * path (`/srv/one/src`). Both are still inside exactly
  * one binding, so the deepest containing alias dir / remote root decides.
  *
  * No fallback to "the first binding": a cwd that names no known binding answers

package/lib/types/client/scm/actions.d.ts

@@ -157,8 +157,25 @@ export interface SearchHit {
     isDir: boolean;
 }
 /**
- * Name search under a remote directory. Depth-capped and `.git`/`node_modules`
- * pruned so a huge tree cannot turn one keystroke into a minute of walking.
+ * Name search under a remote directory: `rg` when the host has it, `find` when
+ * it does not — decided BY THE HOST inside one command, so there is no probe
+ * round trip and no per-alias cache to invalidate.
+ *
+ * Why the fallback exists at all: the previous implementation was `find` with a
+ * hard `-maxdepth 6`, and that cap silently hid real files — in a monorepo of a
+ * few million files, a source file ten levels down is simply invisible to it.
+ * Measured on such a tree: `find -maxdepth 6` → 0 hits (2.0 s), `find -maxdepth
+ * 12` → the hit, but 13.5 s, an uncapped `find` → does not finish at all, and
+ * `rg --files --iglob` → the hit in ~4 s with no depth limit, because it walks
+ * the tree once with a prefiltered glob instead of stat-ing every entry.
+ *
+ * Coverage: `--no-ignore --hidden` keeps what `find` did — it never consulted
+ * .gitignore — so a generated or ignored file is still findable by name. The
+ * fallback keeps a cap (raised from 6 to 12) because an uncapped walk is not
+ * viable on a tree that size.
+ *
+ * The query is a GLOB fragment (as it always was): `*.java` still works as a
+ * pattern, and `--iglob` matches case-insensitively like `find -iname`.
  */
 export declare function searchFiles(alias: string, root: string, query: string, limit?: number, depth?: number): Promise<{
     hits: SearchHit[];

package/lib/types/client/store.d.ts

@@ -222,7 +222,7 @@ export declare function setFollowSession(sessionId: string | undefined): void;
  * workspace showed the sidebar on another — the selector kept whatever
  * localStorage held (or the FIRST binding, on a fresh profile), and a click in
  * the change panel matched its binding by alias alone, which is ambiguous as
- * soon as one host carries two workspaces (P710 and Z700 share `ssh_xiray_new`).
+ * soon as one host carries two workspaces under one alias).
  *
  * Resolution order, strongest evidence first (all of it inside
  * `planWorkspaceFollow`, so the policy has exactly one home):

package/lib/types/p2/worlds.d.ts

@@ -103,7 +103,7 @@ export declare class RemoteWorlds {
      * service canonicalizes through it), and the remote fs view answers the remote
      * absolute path. That is the right spelling for display and for remote
      * processes, but it is not always a spelling the router can route BACK: two
-     * bindings may share one remote root (`mlxy:/home` + `xjp-xiray:/home`), and
+     * bindings may share one remote root (two aliases both mounted at `/home`), and
      * `/home` is then deliberately ambiguous and resolves local. A spawned child
      * session inherits exactly that committed spelling — so every subagent of a
      * remote session in one of those workspaces silently ran on the Host (and a

package/lib/types/search-ops.d.ts

@@ -16,7 +16,25 @@ export declare const DEFAULT_CONTENT_OPTIONS: ContentSearchOptions;
 /** Assert a search query (printable, bounded, no NUL/newline). */
 export declare function assertQuery(query: string): string;
 /**
- * Recursive content search under one absolute remote directory.
+ * Recursive content search under one absolute remote directory: `rg` when the
+ * host has it, `grep -r` when it does not.
+ *
+ * Measured on a monorepo of a few million files (two kernel source trees among
+ * them): the `grep` form was still running when a 300 s timeout killed it, while
+ * the same query scoped to one subtree answers in milliseconds — on a tree that
+ * size the SCOPE matters more than the tool, but rg is the faster one, so it is
+ * preferred, with the previous grep command kept verbatim as the fallback so
+ * behaviour can never get worse than today.
+ *
+ * Two deliberate differences on the rg path:
+ *   - it honours .gitignore (grep never did), which is what keeps build outputs
+ *     and kernel artifacts out of an interactive search — the same default VS
+ *     Code ships, and the reason `--no-ignore` is NOT passed here;
+ *   - `--hidden` keeps dotfiles searchable (`.github/workflows/*.yml`), with
+ *     `.git` excluded explicitly so `--hidden` cannot walk a nested repository.
+ *
+ * The output SHAPE is identical either way (`path\0line:text`, verified byte for
+ * byte against both tools on a real host), so `parseContentHits` is unchanged.
  *
  * `--null` puts a NUL between the path and the `line:text` half so a path
  * containing `:` still parses; `cut` bounds each line and `head` bounds the

package/lib/{worlds-PUumRIh7.js → worlds-C6W225o9.js}

@@ -18432,7 +18432,7 @@ var RemoteWorlds = class {
 	* service canonicalizes through it), and the remote fs view answers the remote
 	* absolute path. That is the right spelling for display and for remote
 	* processes, but it is not always a spelling the router can route BACK: two
-	* bindings may share one remote root (`mlxy:/home` + `xjp-xiray:/home`), and
+	* bindings may share one remote root (two aliases both mounted at `/home`), and
 	* `/home` is then deliberately ambiguous and resolves local. A spawned child
 	* session inherits exactly that committed spelling — so every subagent of a
 	* remote session in one of those workspaces silently ran on the Host (and a

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-remote-vs",
   "description": "VSCode-style remote development for DSH: SSH host manager (key/password), helper deploy pipeline with version check, remote file explorer + editor + terminal in dsh-better-sidebar.",
-  "version": "0.8.3",
+  "version": "0.8.6",
   "icon": "icon.svg",
   "keywords": [
     "dsh",
@@ -182,8 +182,6 @@
   },
   "scripts": {
     "build": "node -e \"require('node:fs').rmSync('lib',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && tsdown",
-    "verify:lib": "node scripts/verify-lib.mjs",
-    "check": "node scripts/verify-lib.mjs && node scripts/check-changes.mjs && node scripts/check-ledger.mjs && node scripts/check-status.mjs && node scripts/check-text-diff.mjs && node scripts/check-workspace-follow.mjs && node scripts/check-scm-stage.mjs",
     "bundle": "tsdown",
     "watch": "tsdown --watch",
     "typecheck": "tsc --noEmit"

package/src/changes/recorder.ts

@@ -600,8 +600,8 @@ export class SessionChanges {
    * index (1.4s measured on the reference monorepo).
    *
    * A session working directory is often a CONTAINER for repositories rather
-   * than one itself (the reference host has `/home/xiray/dsh_workbase` holding
-   * `emv-toolbox-web`), and `git status` there answers exit 128 — "not a git
+   * than one itself (a session root that holds another repository inside it),
+   * and `git status` there answers exit 128 — "not a git
    * repository (or any parent up to mount point /)". When that happens the
    * ledger looks one level down once and adopts the repository it finds, which
    * is the same idea the SCM panel's `repoSubdir` expresses by hand.

package/src/changes/status.ts

@@ -367,8 +367,8 @@ export function readHeadCommand(
 /**
  * Name every immediate subdirectory that is a git repository.
  *
- * A session working directory is often a CONTAINER for repositories (the
- * reference host has `/home/xiray/dsh_workbase` holding `emv-toolbox-web`), and
+ * A session working directory is often a CONTAINER for repositories (a root
+ * that holds another repository inside it), and
  * `git status` at the container answers 128. This is a one-level `ls`-style
  * probe — bounded work, no `find` — so it can never become the expensive part
  * of a scan.

package/src/client/RemoteDirectoryPicker.tsx

@@ -108,7 +108,7 @@ export function RemoteDirectoryPicker(props: {
             onKeyDown={(e) => {
               if (e.key === 'Enter') go()
             }}
-            placeholder="/home/xiray/project"
+            placeholder="/home/user/project"
             spellCheck={false}
             style={{ flex: 1, background: 'rgba(127,127,127,.12)', color: 'inherit', border: '1px solid rgba(127,127,127,.35)', borderRadius: 6, padding: '4px 8px', fontSize: 13, fontFamily: 'inherit', outline: 'none' }}
           />

package/src/client/RemoteRoot.tsx

@@ -133,7 +133,7 @@ function Shell(props: { ctx: Context; visible: boolean }): ReactNode {
    * Without this the panel opened on whatever localStorage held — and on a
    * fresh profile on `workspaces[0]` — so a session working in one remote
    * workspace showed another workspace's tree until the user corrected it by
-   * hand (the reported bug: a P710 session browsing Z700). The host's own
+   * hand (the reported bug: a session browsing another workspace on one host). The host's own
    * workspace membership for the on-screen session is the only sanctioned
    * source (`useRemoteChatTarget`), and it is a soft read: while it answers
    * nothing the current selection stands.

package/src/client/changes/ChangesDock.tsx

@@ -234,8 +234,8 @@ export function ChangesDock(props: ChangesDockProps): React.ReactNode {
       // sees what the load wrote.
       //
       // Resolved by the session's REMOTE root, never by the alias alone: one
-      // alias carries several bindings (P710 and Z700 both live on
-      // `ssh_xiray_new`), and the alias-only form picked whichever came first —
+      // alias carries several bindings (two workspaces can live on one alias),
+      // and the alias-only form picked whichever came first —
       // the file opened while the tree and the selector stayed on the other
       // workspace. That was the reported bug.
       let binding = bindingForChangedFile(remoteOpenBindings(), summary, file.path)

package/src/client/remote-file-open-target.ts

@@ -6,7 +6,7 @@
  * opens it through its own right-sidebar preview. That preview resolves the
  * address path against the SESSION WORKSPACE ROOT. A model that quotes a path
  * relative to its CURRENT directory (e.g. `_xfer/reports/x.md` while working
- * in `…/dsh_workbase/emv-toolbox-web`) therefore misses by one segment, and a
+ * in `<workspace>/<inner-repo>`) therefore misses by one segment, and a
  * remote session's workspace root only exists as an EMPTY local alias dir —
  * the click dies with the host-side ENOENT the user sees.
  *
@@ -181,7 +181,7 @@ function isRemoteAbsolute(path: string | undefined): path is string {
  * path decides between the bindings on it.
  *
  * One alias routinely carries SEVERAL bindings (the same host mounted at
- * `/home/xiray/P710/…` and `/home/xiray/Z700/…`), so an alias-only match hands
+ * `/srv/one/…` and `/srv/two/…`), so an alias-only match hands
  * back whichever was created first: the editor then opens the file the caller
  * named while the sidebar, the tree and the workspace selector stay on the
  * other workspace. The remote root the caller already holds (`summary.root`, a
@@ -396,8 +396,8 @@ function bindingForHostPath(
  * `bindingForWorkspacePath` answers only for the workspace path ITSELF (exact
  * alias-dir match). A session cwd is weaker evidence: the model cd'ed into a
  * project sub-directory, and the host commits whichever spelling the session
- * ran in — the local alias (`C:\…\aliases\p710bb\src`) or the REMOTE path
- * (`/home/xiray/P710/master/userdebug/P710/src`). Both are still inside exactly
+ * ran in — the local alias dir (`C:\…\aliases\<alias>\src`) or the REMOTE
+ * path (`/srv/one/src`). Both are still inside exactly
  * one binding, so the deepest containing alias dir / remote root decides.
  *
  * No fallback to "the first binding": a cwd that names no known binding answers

package/src/client/scm/actions.ts

@@ -411,26 +411,57 @@ function assertQuery(query: string): string {
 }
 
 /**
- * Name search under a remote directory. Depth-capped and `.git`/`node_modules`
- * pruned so a huge tree cannot turn one keystroke into a minute of walking.
+ * Directory names a NAME search never walks.
+ *
+ * The old `find` prune list plus one addition: `out` is build output (the
+ * content search already prunes it), and on an AOSP tree with a populated `out/`
+ * walking it would cost far more than the depth cap it replaces ever did.
+ */
+const NAME_PRUNE_DIRS = ['.git', 'node_modules', '.venv', 'dist', 'build', 'out']
+
+/**
+ * Name search under a remote directory: `rg` when the host has it, `find` when
+ * it does not — decided BY THE HOST inside one command, so there is no probe
+ * round trip and no per-alias cache to invalidate.
+ *
+ * Why the fallback exists at all: the previous implementation was `find` with a
+ * hard `-maxdepth 6`, and that cap silently hid real files — in a monorepo of a
+ * few million files, a source file ten levels down is simply invisible to it.
+ * Measured on such a tree: `find -maxdepth 6` → 0 hits (2.0 s), `find -maxdepth
+ * 12` → the hit, but 13.5 s, an uncapped `find` → does not finish at all, and
+ * `rg --files --iglob` → the hit in ~4 s with no depth limit, because it walks
+ * the tree once with a prefiltered glob instead of stat-ing every entry.
+ *
+ * Coverage: `--no-ignore --hidden` keeps what `find` did — it never consulted
+ * .gitignore — so a generated or ignored file is still findable by name. The
+ * fallback keeps a cap (raised from 6 to 12) because an uncapped walk is not
+ * viable on a tree that size.
+ *
+ * The query is a GLOB fragment (as it always was): `*.java` still works as a
+ * pattern, and `--iglob` matches case-insensitively like `find -iname`.
  */
 export async function searchFiles(
   alias: string,
   root: string,
   query: string,
   limit = 120,
-  depth = 6,
+  depth = 12,
 ): Promise<{ hits: SearchHit[]; truncated: boolean }> {
   const clean = assertQuery(query)
   const cap = Math.min(Math.max(Math.floor(limit), 1), 400)
-  // `-printf '%p\t%y'` carries the entry type, because `find -print` never
-  // emits a trailing slash for directories — the old `line.endsWith('/')`
-  // test could therefore never be true and every hit was reported as a file
-  // (so a directory hit was routed into openFile). GNU/BusyBox find support
-  // -printf; the content-search builder already depends on GNU grep flags.
-  const command = `find ${shQuote(root)} -maxdepth ${depth} `
-    + `\\( -name .git -o -name node_modules -o -name .venv -o -name dist -o -name build \\) -prune -o `
-    + `\\( -type f -o -type d \\) -iname ${shQuote(`*${clean}*`)} -printf '%p\\t%y\\n' 2>/dev/null | head -n ${cap + 1}`
+  const pattern = `*${clean}*`
+  const prunes = NAME_PRUNE_DIRS.map(name => `-g ${shQuote(`!**/${name}/**`)}`).join(' ')
+  const rg = `rg --files --no-ignore --hidden --iglob ${shQuote(pattern)} ${prunes} ${shQuote(root)} 2>/dev/null`
+  // `-printf '%p\t%y'` carries the entry type, because `find -print` never emits
+  // a trailing slash for directories — the old `line.endsWith('/')` test could
+  // therefore never be true and every hit was reported as a file (so a directory
+  // hit was routed into openFile). GNU/BusyBox find support -printf; the
+  // content-search builder already depends on GNU grep flags. rg's `--files`
+  // prints bare paths (files only), which the parser below already tolerates.
+  const find = `find ${shQuote(root)} -maxdepth ${depth} `
+    + `\\( ${NAME_PRUNE_DIRS.map(name => `-name ${shQuote(name)}`).join(' -o ')} \\) -prune -o `
+    + `\\( -type f -o -type d \\) -iname ${shQuote(pattern)} -printf '%p\\t%y\\n' 2>/dev/null`
+  const command = `if command -v rg >/dev/null 2>&1; then ${rg}; else ${find}; fi | head -n ${cap + 1}`
   const out = await tryRun(alias, command, 90_000)
   const lines = out.split('\n').map(line => line.trim()).filter(line => line !== '')
   const truncated = lines.length > cap

package/src/client/store.tsx

@@ -761,7 +761,7 @@ let followFlight: { sessionId: string; promise: Promise<string | undefined> } |
  * workspace showed the sidebar on another — the selector kept whatever
  * localStorage held (or the FIRST binding, on a fresh profile), and a click in
  * the change panel matched its binding by alias alone, which is ambiguous as
- * soon as one host carries two workspaces (P710 and Z700 share `ssh_xiray_new`).
+ * soon as one host carries two workspaces under one alias).
  *
  * Resolution order, strongest evidence first (all of it inside
  * `planWorkspaceFollow`, so the policy has exactly one home):

package/src/p2/router-fs.ts

@@ -189,7 +189,7 @@ export default class TransparentFileSystem extends FileSystem {
     // for remote processes), but that spelling is not guaranteed to route BACK:
     // a session path derived from it (working-directory.set commits THIS value)
     // would resolve local whenever two bindings share the remote root — that is
-    // how subagents of `mlxy`/`xjp-xiray` sessions ended up running on the Host.
+    // how subagents of a session bound to another host ended up running on the Host.
     // toSessionPath keeps the remote spelling where it is unambiguous and uses
     // the binding's unique alias spelling only where it is not.
     return this.remote.toSessionPath(world, fs.processPath(target))

package/src/p2/worlds.ts

@@ -173,8 +173,8 @@ export class RemoteWorlds {
     if (byRemotePath.length === 0) return undefined
     const longest = Math.max(...byRemotePath.map(candidate => candidate.length))
     const top = byRemotePath.filter(candidate => candidate.length === longest)
-    // Two bindings can share one remote directory — here `mlxy:/home` and
-    // `xjp-xiray:/home` do. Picking either would send a write to the wrong host,
+    // Two bindings can share one remote directory — here two aliases both
+    // mounted at `/home` do. Picking either would send a write to the wrong host,
     // and a wrong-host write is silent and destructive in a way a local one is
     // not, so an ambiguous remote-form cwd stays local instead of guessing.
     //
@@ -276,7 +276,7 @@ export class RemoteWorlds {
    * service canonicalizes through it), and the remote fs view answers the remote
    * absolute path. That is the right spelling for display and for remote
    * processes, but it is not always a spelling the router can route BACK: two
-   * bindings may share one remote root (`mlxy:/home` + `xjp-xiray:/home`), and
+   * bindings may share one remote root (two aliases both mounted at `/home`), and
    * `/home` is then deliberately ambiguous and resolves local. A spawned child
    * session inherits exactly that committed spelling — so every subagent of a
    * remote session in one of those workspaces silently ran on the Host (and a

package/src/search-ops.ts

@@ -61,7 +61,25 @@ export function assertQuery(query: string): string {
 }
 
 /**
- * Recursive content search under one absolute remote directory.
+ * Recursive content search under one absolute remote directory: `rg` when the
+ * host has it, `grep -r` when it does not.
+ *
+ * Measured on a monorepo of a few million files (two kernel source trees among
+ * them): the `grep` form was still running when a 300 s timeout killed it, while
+ * the same query scoped to one subtree answers in milliseconds — on a tree that
+ * size the SCOPE matters more than the tool, but rg is the faster one, so it is
+ * preferred, with the previous grep command kept verbatim as the fallback so
+ * behaviour can never get worse than today.
+ *
+ * Two deliberate differences on the rg path:
+ *   - it honours .gitignore (grep never did), which is what keeps build outputs
+ *     and kernel artifacts out of an interactive search — the same default VS
+ *     Code ships, and the reason `--no-ignore` is NOT passed here;
+ *   - `--hidden` keeps dotfiles searchable (`.github/workflows/*.yml`), with
+ *     `.git` excluded explicitly so `--hidden` cannot walk a nested repository.
+ *
+ * The output SHAPE is identical either way (`path\0line:text`, verified byte for
+ * byte against both tools on a real host), so `parseContentHits` is unchanged.
  *
  * `--null` puts a NUL between the path and the `line:text` half so a path
  * containing `:` still parses; `cut` bounds each line and `head` bounds the
@@ -72,7 +90,7 @@ export function contentSearchCommand(dir: string, query: string, options: Conten
   const max = Math.min(Math.max(Math.floor(options.maxResults), 1), 2000)
   const lineChars = Math.min(Math.max(Math.floor(options.maxLineChars), 80), 4000)
   const prune = [...PRUNE_DIRS, ...(options.prune ?? [])]
-  const parts = [
+  const grepParts = [
     'grep -rIn --null --binary-files=without-match',
     ...prune.map(name => `--exclude-dir=${shQuote(name)}`),
     options.caseSensitive ? '' : '-i',
@@ -82,7 +100,19 @@ export function contentSearchCommand(dir: string, query: string, options: Conten
     '--',
     shQuote(assertRemoteDir(dir)),
   ].filter(part => part !== '')
-  return `${parts.join(' ')} 2>/dev/null | cut -c1-${lineChars} | head -n ${max + 1}`
+  const rgParts = [
+    'rg -n --no-heading --null --color=never --with-filename --hidden',
+    ...prune.map(name => `-g ${shQuote(`!**/${name}/**`)}`),
+    options.caseSensitive ? '' : '-i',
+    options.wholeWord ? '-w' : '',
+    // rg is regex by default, so literal mode is the one that needs a flag.
+    options.regex ? '' : '-F',
+    `-e ${shQuote(pattern)}`,
+    shQuote(assertRemoteDir(dir)),
+  ].filter(part => part !== '')
+  const grep = `${grepParts.join(' ')} 2>/dev/null`
+  const rg = `${rgParts.join(' ')} 2>/dev/null`
+  return `if command -v rg >/dev/null 2>&1; then ${rg}; else ${grep}; fi | cut -c1-${lineChars} | head -n ${max + 1}`
 }
 
 /** One content-search hit. */