dsh-session-drag-move 0.0.0-stage → 0.1.1

package/README.md

@@ -1,3 +1,98 @@
-# Temporary Holding Version
+# dsh-session-drag-move
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+左侧栏「工作区」面板里，把**会话拖到别的工作区**——真正改归属，不只是改个名字分组。
+
+官方只支持同一工作区内部拖排序；跨工作区拖拽是**完全不响应**的（`onDrop` 只在
+`drag.accountKey === group.key` 时生效，`insertSessionBefore` 也拒绝不属于本工作区的会话）。
+这个插件只接管这段本来就是空的行为，同工作区拖拽照旧交给官方。
+
+## 它到底做了什么
+
+DSH 里会话的归属是**派生的，不是存出来的**：
+
+```
+工作区拥有「会话日志 header 的 cwd 等于本工作区路径」的那些会话
+```
+
+`~/.dsh/storages/workspace.json` 里的 `sessionIds` 只是顺序账本，path 不匹配的 id
+会在下次写入时被剪掉。所以换工作区必须改**会话日志 header 里的 cwd**。
+
+会话日志是独立 Zstandard 帧的拼接，第一帧就是 header：
+
+```
+<root>/--<projectKey(cwd)>--/<sessionId>/session.v4.jsonl.zstd
+         └ 项目目录由 cwd 决定               └ 首帧 = header，其后每帧 = 一个追加批次
+```
+
+帧彼此独立，所以移动 = **重新压缩新的第一帧 + 原文件第二个 magic 之后的字节原样复制**，
+事件数据一个字节都不动。写完再自行解压校验一遍，然后把旧目录移到备份区。
+
+最后同步正在运行的进程（否则要重启才生效）：更新 registry 的 header 缓存与
+session-path 索引，再走官方的 `attachSession` / `insertSessionBefore` / `detachSession`。
+`attachSession` 会重新读 header 并校验 cwd，它成功就证明存储层改动真的落盘了。
+
+## 安装
+
+```powershell
+# 1. 放进 profile 的 node_modules
+Copy-Item 'E:\dsh插件开发' "$env:USERPROFILE\.dsh\profiles\desktop\node_modules\dsh-session-drag-move" -Recurse -Force
+
+# 2. 在 profile 的 cordis.patch.yml 里加一行
+#   - insert:
+#       - id: session-drag-move
+#         name: 'dsh-session-drag-move'
+
+# 3. 重启 DSH
+```
+
+也可以用官方 CLI：
+
+```bash
+dsh plugin --profile desktop add dsh-session-drag-move
+```
+
+## 配置（host 半边）
+
+| 字段 | 默认 | 含义 |
+|---|---|---|
+| `root` | `~/.dsh/sessions` | 会话存储根目录 |
+| `backupRoot` | `<root>/../session-drag-move-backup` | 移动前的会话目录停放处 |
+| `allowRemote` | `false` | 默认只接受 loopback 请求；局域网部署需显式打开 |
+
+## 使用
+
+- 拖会话行到**另一个工作区的头行** → 归入该工作区（追加到末尾）
+- 拖会话行到**另一个工作区的某个会话行**上半 → 插到它前面；下半 → 插到它后面
+- 同工作区内拖拽 → 不拦截，仍是官方排序
+- 运行中 / 当前会话会被拒绝
+
+## 安全边界
+
+- 只重写第一帧；尾部原样复制；写完重新解压自检（id + cwd + 能解出 session header）
+- 旧目录**移出** sessions 根（留着会被扫到重复 id），停在备份区，可回滚
+- 目标文件已存在则整体拒绝，不做半截写入
+- 跨区移动前检查会话是否在运行
+
+## 已知限制
+
+- 依赖 `workspaceRegistry` 的内部字段（`headers` / `sessionPaths` / `host.rememberSessionPath`）
+  同步运行状态。这些是普通字段不是 `#private`，能用，但**版本敏感**——所有访问都做了
+  feature-probe，探测不到会返回结构化错误而不是抛栈。
+- 目标针对官方原版左侧栏。若启用 `dsh-better-workspace`（它会整区替换
+  `sidebar.workspaces`，且不迁移工作区），其自绘 DOM 是另一套结构，需要另加适配分支。
+- 投影缓存 `~/.dsh/storages/session_projcache/sessions/<id>.json` 里的
+  `record.identity.cwd` 目前未改写（可重建缓存，不影响归属）。
+
+## 开发
+
+```powershell
+$node = "$env:USERPROFILE\.dsh\dsh-runtimes\dsh-primary-runtime\dependencies\node\bin\node.exe"
+& $node --test tests\smoke.mjs
+```
+
+测试覆盖路径编码（与本机磁盘目录逐字比对）、header 帧定位与校验、
+真实会话日志的 cwd 改写 round-trip（含尾部字节完全一致断言）。
+
+## 许可证
+
+MIT

package/cordis.patch.yml

@@ -0,0 +1,14 @@
+# dsh-session-drag-move bundle patch.
+#
+# Manual mount equivalent (profile cordis.patch.yml):
+#
+#   - insert:
+#       - id: session-drag-move
+#         name: 'dsh-session-drag-move'
+#
+# Only the Node half loads through this row; the web client half is served
+# through the package's exports["./client"] entry and mounted by the browser
+# boot graph (window.__DSH_BOOT__).
+- insert:
+    - id: session-drag-move
+      name: 'dsh-session-drag-move'

package/lib/client.js

@@ -0,0 +1,256 @@
+/**
+ * dsh-session-drag-move — client half (plain JavaScript, no build step).
+ *
+ * The shipped workspace browser only handles drags INSIDE one workspace: its
+ * `onDrop` acts when the drag's account key equals the group's key, and
+ * `insertSessionBefore` rejects any session the workspace does not already
+ * account for. A cross-workspace drag is therefore inert today.
+ *
+ * This half intercepts only that inert case — in the CAPTURE phase, ahead of
+ * React's delegated handlers — and asks the host half to re-home the session.
+ * Same-workspace drags are deliberately left alone so official ordering keeps
+ * working exactly as it does now.
+ *
+ * Anchors come from the official DOM contract: every row carries
+ * `data-row-key`, `session:<id>` for sessions and `workspace:<workspaceId>`
+ * for workspace headers (the official buildGroup passes workspaceId as the
+ * group key). Nothing here depends on hashed CSS module class names.
+ */
+window.__ModuleLoader__.load({
+  id: 'dsh-session-drag-move',
+  factory: (_require) => {
+    const NS = 'dshSessionDragMove'
+    const API = '/session-drag-move/api/'
+    const SESSION_PREFIX = 'session:'
+    const WORKSPACE_PREFIX = 'workspace:'
+
+    const CSS = `
+[data-dsh-sm-dragging] { opacity: .45; }
+[data-dsh-sm-target] .dsh-sm-row,
+[data-dsh-sm-target] > * {
+  outline: 1px dashed var(--dsh-accent, #4c8dff);
+  outline-offset: -1px;
+  border-radius: 6px;
+  background: color-mix(in srgb, var(--dsh-accent, #4c8dff) 10%, transparent);
+}
+.${NS}-toast {
+  position: fixed; left: 50%; bottom: 28px; transform: translateX(-50%);
+  z-index: 2147483000; max-width: 78vw;
+  padding: 8px 14px; border-radius: 8px;
+  background: rgba(28,28,30,.94); color: #fff;
+  font: 12px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif;
+  box-shadow: 0 6px 24px rgba(0,0,0,.28);
+}
+`
+
+    /* ------------------------------ helpers ------------------------------ */
+
+    const rowKey = (el) => (el instanceof Element ? (el.dataset?.rowKey ?? '') : '')
+
+    const closestKey = (el, prefix) => {
+      if (!(el instanceof Element)) return null
+      const hit = el.closest(`[data-row-key^="${prefix}"]`)
+      return hit
+    }
+
+    /** The session row an event was raised on, if any. */
+    const sessionRowOf = (target) => closestKey(target, SESSION_PREFIX)
+
+    /**
+     * Which workspace a session row belongs to: walk up until an ancestor has
+     * a workspace header as one of its own children. The workspace header is
+     * the first child of the group section, so the first hit is the owner.
+     */
+    function owningWorkspaceId(row) {
+      let node = row?.parentElement
+      while (node instanceof Element) {
+        const own = node.querySelector?.(`:scope > [data-row-key^="${WORKSPACE_PREFIX}"]`)
+        if (own instanceof Element) return rowKey(own).slice(WORKSPACE_PREFIX.length)
+        for (const child of node.children) {
+          const key = rowKey(child)
+          if (key.startsWith(WORKSPACE_PREFIX)) return key.slice(WORKSPACE_PREFIX.length)
+          const nested = child.querySelector?.(`[data-row-key^="${WORKSPACE_PREFIX}"]`)
+          if (nested instanceof Element) return rowKey(nested).slice(WORKSPACE_PREFIX.length)
+        }
+        node = node.parentElement
+      }
+      return ''
+    }
+
+    /** Every session row of a group, in DOM order. */
+    function siblingSessionRows(row) {
+      let node = row?.parentElement
+      while (node instanceof Element) {
+        const rows = node.querySelectorAll(`[data-row-key^="${SESSION_PREFIX}"]`)
+        if (rows.length > 0) return Array.from(rows)
+        node = node.parentElement
+      }
+      return []
+    }
+
+    /**
+     * Resolve a drop target from the element under the pointer.
+     * @returns {{workspaceId: string, beforeSessionId?: string}|null}
+     */
+    function dropTargetOf(target, fromWorkspaceId) {
+      if (!(target instanceof Element)) return null
+
+      const workspaceRow = closestKey(target, WORKSPACE_PREFIX)
+      if (workspaceRow instanceof Element) {
+        const workspaceId = rowKey(workspaceRow).slice(WORKSPACE_PREFIX.length)
+        if (workspaceId === '' || workspaceId === fromWorkspaceId) return null
+        return { workspaceId }
+      }
+
+      const row = sessionRowOf(target)
+      if (!(row instanceof Element)) return null
+      const workspaceId = owningWorkspaceId(row)
+      if (workspaceId === '' || workspaceId === fromWorkspaceId) return null
+
+      const rect = row.getBoundingClientRect()
+      const below = target instanceof Element
+        ? (target.getBoundingClientRect().top + target.getBoundingClientRect().height / 2) > rect.top + rect.height / 2
+        : false
+      const anchorId = rowKey(row).slice(SESSION_PREFIX.length)
+
+      if (!below) return { workspaceId, beforeSessionId: anchorId }
+      const rows = siblingSessionRows(row)
+      const next = rows[rows.indexOf(row) + 1]
+      const nextId = next instanceof Element ? rowKey(next).slice(SESSION_PREFIX.length) : undefined
+      return { workspaceId, beforeSessionId: nextId }
+    }
+
+    /* ------------------------------- state ------------------------------- */
+
+    let drag = null
+    let marker = null
+    let toastTimer = null
+
+    function ensureStyle() {
+      if (document.head.querySelector(`style[data-plugin-css="${NS}"]`) !== null) return
+      const style = document.createElement('style')
+      style.setAttribute('data-plugin-css', NS)
+      style.textContent = CSS
+      document.head.appendChild(style)
+    }
+
+    function clearMarker() {
+      if (marker instanceof Element) marker.removeAttribute('data-dsh-sm-target')
+      marker = null
+    }
+
+    function markTarget(target) {
+      if (marker === target) return
+      clearMarker()
+      marker = target
+      if (target instanceof Element) target.setAttribute('data-dsh-sm-target', '')
+    }
+
+    function toast(message) {
+      const existing = document.querySelector(`.${NS}-toast`)
+      if (existing instanceof Element) existing.remove()
+      const el = document.createElement('div')
+      el.className = `${NS}-toast`
+      el.textContent = message
+      document.body.appendChild(el)
+      clearTimeout(toastTimer)
+      toastTimer = setTimeout(() => el.remove(), 3200)
+    }
+
+    async function call(method, payload) {
+      const response = await fetch(API + method, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(payload ?? {})
+      })
+      const body = await response.json().catch(() => ({ ok: false, error: { message: 'bad response' } }))
+      if (!response.ok || body.ok !== true) {
+        throw new Error(body?.error?.message ?? `request failed (${response.status})`)
+      }
+      return body.result
+    }
+
+    /* ------------------------------ listeners ---------------------------- */
+
+    function onDragStart(event) {
+      const row = sessionRowOf(event.target)
+      if (!(row instanceof Element)) return
+      const workspaceId = owningWorkspaceId(row)
+      if (workspaceId === '') return
+      drag = {
+        row,
+        sessionId: rowKey(row).slice(SESSION_PREFIX.length),
+        fromWorkspaceId: workspaceId
+      }
+      row.setAttribute('data-dsh-sm-dragging', '')
+    }
+
+    function onDragOver(event) {
+      if (drag === null) return
+      const target = dropTargetOf(event.target, drag.fromWorkspaceId)
+      if (target === null) return
+      // The official handler never preventDefaults a cross-workspace drag, so
+      // the drop would be rejected as "no drop target" without this.
+      event.preventDefault()
+      event.stopPropagation()
+      if (event.dataTransfer) event.dataTransfer.dropEffect = 'move'
+      markTarget(sessionRowOf(event.target) ?? closestKey(event.target, WORKSPACE_PREFIX) ?? null)
+    }
+
+    function onDrop(event) {
+      if (drag === null) return
+      const target = dropTargetOf(event.target, drag.fromWorkspaceId)
+      if (target === null) return
+      event.preventDefault()
+      event.stopPropagation()
+      const payload = {
+        sessionId: drag.sessionId,
+        targetWorkspaceId: target.workspaceId,
+        beforeSessionId: target.beforeSessionId
+      }
+      const source = drag
+      drag = null
+      clearMarker()
+      source.row?.removeAttribute('data-dsh-sm-dragging')
+
+      call('move', payload).catch((error) => {
+        toast(`移动会话失败：${error.message}`)
+      })
+    }
+
+    function onDragEnd(event) {
+      if (drag !== null) drag.row?.removeAttribute('data-dsh-sm-dragging')
+      drag = null
+      clearMarker()
+    }
+
+    function apply(ctx) {
+      ensureStyle()
+
+      // Capture phase: run before React's delegated listeners at the root.
+      const options = { capture: true }
+      document.addEventListener('dragstart', onDragStart, options)
+      document.addEventListener('dragover', onDragOver, options)
+      document.addEventListener('drop', onDrop, options)
+      document.addEventListener('dragend', onDragEnd, options)
+
+      ctx?.effect?.(() => () => {
+        document.removeEventListener('dragstart', onDragStart, options)
+        document.removeEventListener('dragover', onDragOver, options)
+        document.removeEventListener('drop', onDrop, options)
+        document.removeEventListener('dragend', onDragEnd, options)
+        clearMarker()
+      })
+    }
+
+    return {
+      name: 'dsh-session-drag-move',
+      // Deliberately NO inject. This half is a pure DOM enhancement bound to
+      // the official row contract; it consumes no client service. Declaring
+      // one it does not use makes the boot graph wait forever for a service
+      // that never activates, and web boot then fails with
+      // "1 entry did not activate".
+      apply
+    }
+  }
+})

package/lib/fork-tree.js

@@ -0,0 +1,100 @@
+/**
+ * Fork family resolution.
+ *
+ * A fork records where it came from in its session header's `parentSession`,
+ * so the family is derived from stored headers — never from a workspace
+ * ledger. This is what lets a move keep a branch with its origin: the rule
+ * this plugin enforces is that a fork lives in its parent's workspace, and the
+ * only way to honour it while moving is to move the subtree together.
+ *
+ * Pure functions: no filesystem, no services.
+ */
+
+/**
+ * Build the parent → children relation.
+ *
+ * A header whose `parentSession` names an id that is not in `headers` is
+ * treated as a root: the parent may have been deleted, or may live outside
+ * this store. Either way there is nothing to follow.
+ *
+ * @param {Array<{id?: string, parentSession?: string}>} headers - stored headers.
+ * @returns {{byId: Map<string, object>, children: Map<string, string[]>}}
+ */
+export function forkTree(headers) {
+  const byId = new Map()
+  for (const header of headers) {
+    if (typeof header?.id === 'string' && header.id !== '') byId.set(header.id, header)
+  }
+
+  const children = new Map()
+  for (const header of byId.values()) {
+    const parent = header.parentSession
+    if (typeof parent !== 'string' || !byId.has(parent) || parent === header.id) continue
+    const siblings = children.get(parent)
+    if (siblings === undefined) children.set(parent, [header.id])
+    else siblings.push(header.id)
+  }
+
+  return { byId, children }
+}
+
+/**
+ * Every session forked from `sessionId`, transitively — the branches to carry
+ * along. Breadth-first so the result reads parent-before-child.
+ *
+ * @param {{children: Map<string, string[]>}} tree - from {@link forkTree}.
+ * @param {string} sessionId - the session being moved.
+ * @returns {string[]} descendants, excluding `sessionId` itself.
+ */
+export function descendantsOf(tree, sessionId) {
+  const found = []
+  const seen = new Set([sessionId])
+  const queue = [sessionId]
+  while (queue.length > 0) {
+    for (const child of tree.children.get(queue.shift()) ?? []) {
+      if (seen.has(child)) continue
+      seen.add(child)
+      found.push(child)
+      queue.push(child)
+    }
+  }
+  return found
+}
+
+/**
+ * Every ancestor of `sessionId`, nearest first.
+ *
+ * Not used to move anything: dragging a branch must not silently drag its
+ * origin out from under other branches. It exists so a move can REPORT an
+ * origin left in another workspace instead of leaving the caller unaware.
+ *
+ * @param {{byId: Map<string, object>}} tree - from {@link forkTree}.
+ * @param {string} sessionId
+ * @returns {string[]} ancestors, nearest first.
+ */
+export function ancestorsOf(tree, sessionId) {
+  const found = []
+  const seen = new Set([sessionId])
+  let current = tree.byId.get(sessionId)?.parentSession
+  while (typeof current === 'string' && tree.byId.has(current) && !seen.has(current)) {
+    seen.add(current)
+    found.push(current)
+    current = tree.byId.get(current)?.parentSession
+  }
+  return found
+}
+
+/**
+ * The whole connected family: every ancestor, `sessionId`, and every
+ * descendant. Available for callers that want the invariant "one family, one
+ * workspace" enforced in a single move.
+ *
+ * @param {object} tree - from {@link forkTree}.
+ * @param {string} sessionId
+ * @returns {string[]} family members, root-first order not guaranteed.
+ */
+export function familyOf(tree, sessionId) {
+  const ancestors = ancestorsOf(tree, sessionId)
+  const root = ancestors.length > 0 ? ancestors[ancestors.length - 1] : sessionId
+  return [root, ...descendantsOf(tree, root)]
+}

package/lib/index.js

@@ -0,0 +1,358 @@
+/**
+ * dsh-session-drag-move — host half.
+ *
+ * Adds the one move the shipped workspace domain refuses: re-homing a session
+ * into another workspace. Membership is derived, never stored — a workspace
+ * owns exactly the sessions whose STORED HEADER cwd is its path — so the move
+ * is a storage operation (rewrite that header's cwd and park the log under the
+ * new project directory) followed by re-attaching the session on the registry.
+ *
+ * Exposes `POST /session-drag-move/api/<method>` over the host web server; the
+ * browser half calls `move`.
+ */
+import { homedir } from 'node:os'
+import { dirname, join } from 'node:path'
+
+import {
+  findSessionDirs,
+  indexStore,
+  readHeaderPrefix,
+  readSessionState,
+  relocateSession,
+  sessionDir
+} from './session-log.js'
+import { forkTree, descendantsOf } from './fork-tree.js'
+
+export const name = 'dsh-session-drag-move'
+
+/**
+ * Cordis inject is a LIST of service names. Only `webServer` is declared:
+ * without it there is nowhere to hang the move route. `workspaceRegistry` is
+ * resolved lazily inside the handler instead — declaring it here would leave
+ * this entry pending forever (and web boot failing with "1 entry did not
+ * activate") on any profile where that service is absent or renamed, which is
+ * exactly the failure mode a hard dependency must not have.
+ */
+export const inject = ['webServer']
+
+/** Load-time defaults; a patch entry's `config` overrides them field by field. */
+const DEFAULTS = {
+  /** Session store root; the shipped default is `~/.dsh/sessions`. */
+  root: '',
+  /** Where pre-move session directories are parked. */
+  backupRoot: '',
+  /** Refuse requests whose Host header is not loopback (LAN deploys opt in). */
+  allowRemote: false
+}
+
+const API_PREFIX = '/session-drag-move/api/'
+
+class ApiError extends Error {
+  constructor(code, message, status = 400) {
+    super(message)
+    this.code = code
+    this.status = status
+  }
+}
+
+const json = (res, status, body) => {
+  const payload = JSON.stringify(body)
+  res.writeHead(status, {
+    'content-type': 'application/json; charset=utf-8',
+    'content-length': Buffer.byteLength(payload)
+  })
+  res.end(payload)
+}
+
+/** Loopback-only by default; a LAN deployment flips `allowRemote`. */
+function trusted(req, allowRemote) {
+  if (allowRemote) return true
+  const authority = (req.headers.host ?? '').replace(/:\d+$/, '').replace(/^\[|\]$/g, '')
+  return authority === '' || authority === 'localhost' || authority === '127.0.0.1' || authority === '::1'
+}
+
+async function readBody(req) {
+  const chunks = []
+  for await (const chunk of req) chunks.push(chunk)
+  if (chunks.length === 0) return {}
+  const text = Buffer.concat(chunks).toString('utf8')
+  return text === '' ? {} : JSON.parse(text)
+}
+
+/**
+ * Resolve a service this plugin did not declare in `inject`. `ctx.get` is the
+ * documented accessor for undeclared services (the shipped workspace registry
+ * itself reads `sessions` this way); a plain property read can miss behind a
+ * context proxy.
+ */
+const serviceOf = (ctx, name) => {
+  try {
+    return ctx.get?.(name)
+  } catch {
+    return undefined
+  }
+}
+
+const isActive = (ctx, sessionId) => {
+  const sessions = serviceOf(ctx, 'sessions')
+  if (sessions === undefined) return false
+  try {
+    const live = sessions.get?.(sessionId)
+    if (live === undefined) return false
+    return live.running === true || live.active === true || live.state === 'running'
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Make the running process agree with the bytes that just moved.
+ *
+ * `WorkspaceEntity.attachSession` cannot be used here. It validates the
+ * session's cwd by calling `registry.host.readSessionHeader`, which prefers a
+ * LIVE session's in-memory header, and a live session keeps the cwd it was
+ * opened with. After a move that check therefore compares the OLD cwd against
+ * the new workspace path and throws — leaving the bytes moved and the ledger
+ * unchanged, which is the inconsistency this function exists to avoid.
+ *
+ * So the header index is taught the new truth first, and the ledger is then
+ * written through the entity's public mutators. `detachSession` runs last: it
+ * prunes by `sessionPath(id) === path`, so the source drops the id only once
+ * the index already says the session lives elsewhere.
+ */
+async function reconcile(ctx, registry, target, source, sessionId, header, beforeSessionId) {
+  registry.headers?.set(sessionId, header)
+  registry.host?.rememberSessionPath?.(sessionId, target.path)
+  registry.invalidSessionPaths?.delete(sessionId)
+
+  const accounted = (entity) => entity.record.sessionIds.includes(sessionId)
+
+  if (!accounted(target)) {
+    try {
+      await target.attachSession(sessionId)
+    } catch (error) {
+      // The official path re-validates against the live in-memory header and
+      // refuses when that header is stale. The index is already correct, so
+      // write the ledger through the entity's own single write path instead;
+      // `mutate` applies the same idempotence and path pruning as attach.
+      ctx.logger?.warn(`dsh-session-drag-move: attachSession refused '${sessionId}' (${error?.message ?? error}); writing the ledger directly`)
+      await target.mutate((record) => record.sessionIds.includes(sessionId)
+        ? record
+        : { ...record, sessionIds: [sessionId, ...record.sessionIds] })
+    }
+  }
+
+  if (accounted(target)) await target.insertSessionBefore(sessionId, beforeSessionId)
+  if (source !== undefined && accounted(source)) await source.detachSession(sessionId)
+}
+
+/**
+ * Re-home one session into another workspace.
+ *
+ * Bytes first, ledger second: the stored header's cwd is what a workspace
+ * derives membership from, so the storage rewrite is the real move, and the
+ * ledger write is bookkeeping that follows it (see {@link reconcile}).
+ */
+async function move(ctx, config, request) {
+  const registry = serviceOf(ctx, 'workspaceRegistry')
+  if (registry === undefined) throw new ApiError('no-registry', 'workspace registry is unavailable', 503)
+
+  const sessionId = String(request?.sessionId ?? '')
+  const targetWorkspaceId = String(request?.targetWorkspaceId ?? '')
+  const beforeSessionId = request?.beforeSessionId === undefined || request?.beforeSessionId === null
+    ? undefined
+    : String(request.beforeSessionId)
+
+  if (sessionId === '' || !sessionId.startsWith('session-')) throw new ApiError('bad-session', `not a session id: '${sessionId}'`)
+  if (targetWorkspaceId === '') throw new ApiError('bad-workspace', 'targetWorkspaceId is required')
+
+  const target = registry.get(targetWorkspaceId)
+  if (target === undefined) throw new ApiError('no-workspace', `unknown workspace '${targetWorkspaceId}'`, 404)
+
+  // The ledger is NOT membership: a session can sit in one workspace's ledger
+  // while its bytes already belong to another (an interrupted move leaves
+  // exactly that). Membership is the stored cwd, so source is resolved from
+  // the ledger only to know what to detach afterwards.
+  const source = registry.list().find((entity) => entity.id !== targetWorkspaceId && entity.record.sessionIds.includes(sessionId))
+
+  const root = config.root === '' ? join(homedir(), '.dsh', 'sessions') : config.root
+  const backupRoot = config.backupRoot === '' ? join(dirname(root), 'session-drag-move-backup') : config.backupRoot
+
+  // Where are the bytes, really? Scan the store instead of trusting the
+  // in-memory header, which a live session never refreshes after a move.
+  const dirs = await findSessionDirs(root, sessionId)
+
+  if (dirs.length === 0) {
+    // Bytes are nowhere under this root: either the session never persisted,
+    // or its cwd is a directory this profile cannot see. Both are refused
+    // loudly rather than guessed at.
+    if (target.record.sessionIds.includes(sessionId)) {
+      await target.insertSessionBefore(sessionId, beforeSessionId)
+      return { moved: false, reordered: true, workspaceId: targetWorkspaceId }
+    }
+    throw new ApiError('no-session-dir', `no session directory for '${sessionId}' under '${root}'`, 404)
+  }
+  if (dirs.length > 1) {
+    throw new ApiError('duplicate-session', `'${sessionId}' exists in ${dirs.length} project directories (${dirs.join(', ')}); resolve the duplicate first`, 409)
+  }
+
+  const from = dirs[0]
+  const state = await readSessionState(from, sessionId)
+  if (state === undefined) throw new ApiError('unreadable-session', `session directory '${from}' holds no readable session log`, 422)
+  const oldCwd = state.header.cwd
+
+  const alreadyThere = from === sessionDir(root, target.path, sessionId)
+
+  // Which sessions travel with this one. A fork belongs in its parent's
+  // workspace, so dragging a session carries its whole branch subtree — a
+  // branch left behind would be a fork in a different workspace from the
+  // conversation it came out of. Only DESCENDANTS move: dragging a branch must
+  // never drag its origin (and therefore its origin's other branches) along.
+  const store = await indexStore(root)
+  const tree = forkTree(await readHeadersFor(store))
+  const branch = descendantsOf(tree, sessionId)
+
+  // A pure ordering request inside one workspace — and the already-in-place
+  // case — never touches storage.
+  if (alreadyThere) {
+    if (oldCwd !== target.path) {
+      // Bytes are in the target project directory but the header still names
+      // the old one: repair the header, then fix the ledger.
+      const result = await relocateSession({ root, dir: from, newCwd: target.path, sessionId, backupRoot })
+      await reconcile(ctx, registry, target, source, sessionId, result.header, beforeSessionId)
+      return { moved: true, repaired: true, sessionId, workspaceId: targetWorkspaceId, from: source?.id, cwd: { from: oldCwd, to: target.path } }
+    }
+    await target.insertSessionBefore(sessionId, beforeSessionId)
+    if (source !== undefined) await source.detachSession(sessionId)
+    const carried = await carryBranches(ctx, registry, root, backupRoot, target, branch)
+    return { moved: false, reordered: true, workspaceId: targetWorkspaceId, branches: carried }
+  }
+
+  if (isActive(ctx, sessionId)) throw new ApiError('session-active', `session '${sessionId}' is running; stop it before moving`, 409)
+
+  const result = await relocateSession({ root, dir: from, newCwd: target.path, sessionId, backupRoot })
+  await reconcile(ctx, registry, target, source, sessionId, result.header, beforeSessionId)
+  const carried = await carryBranches(ctx, registry, root, backupRoot, target, branch)
+
+  return {
+    moved: true,
+    sessionId,
+    workspaceId: targetWorkspaceId,
+    from: source?.id,
+    cwd: { from: oldCwd, to: target.path },
+    backup: result.backup,
+    branches: carried
+  }
+}
+
+/**
+ * Read every stored header, so one session can be placed in its fork family.
+ *
+ * `indexStore` keys are already unique, so this reads each log once. Only a
+ * bounded prefix of each file is touched: a header is its first frame, while
+ * the log behind it may be many megabytes.
+ *
+ * @param {Map<string, string>} store - sessionId → directory, from indexStore.
+ * @returns {Promise<object[]>} readable headers (unreadable logs are skipped).
+ */
+async function readHeadersFor(store) {
+  const headers = []
+  for (const [id, dir] of store) {
+    const header = await readHeaderPrefix(dir, id)
+    if (header !== undefined) headers.push(header)
+  }
+  return headers
+}
+
+/**
+ * Move the branch subtree into the target workspace alongside its origin.
+ *
+ * Each branch is an independent session, so a failure on one is reported
+ * rather than aborting the rest: the dragged session has already moved by the
+ * time this runs, and rolling that back because a branch could not follow
+ * would be worse than leaving a branch behind with a reason.
+ *
+ * @returns {Promise<Array<{sessionId: string, moved: boolean, error?: string}>>}
+ */
+async function carryBranches(ctx, registry, root, backupRoot, target, branchIds) {
+  const carried = []
+  for (const branchId of branchIds) {
+    try {
+      const dirs = await findSessionDirs(root, branchId)
+      if (dirs.length !== 1) {
+        carried.push({ sessionId: branchId, moved: false, error: dirs.length === 0 ? 'no session directory' : `${dirs.length} session directories` })
+        continue
+      }
+      const state = await readSessionState(dirs[0], branchId)
+      if (state === undefined) {
+        carried.push({ sessionId: branchId, moved: false, error: 'unreadable session log' })
+        continue
+      }
+      if (state.header.cwd === target.path) {
+        carried.push({ sessionId: branchId, moved: false, error: undefined, alreadyThere: true })
+        continue
+      }
+      if (isActive(ctx, branchId)) {
+        carried.push({ sessionId: branchId, moved: false, error: 'session is running' })
+        continue
+      }
+      const source = registry.list().find((entity) => entity.id !== target.id && entity.record.sessionIds.includes(branchId))
+      const result = await relocateSession({ root, dir: dirs[0], newCwd: target.path, sessionId: branchId, backupRoot })
+      await reconcile(ctx, registry, target, source, branchId, result.header, undefined)
+      carried.push({ sessionId: branchId, moved: true })
+    } catch (error) {
+      ctx.logger?.warn(`dsh-session-drag-move: could not carry branch '${branchId}': ${error?.message ?? error}`)
+      carried.push({ sessionId: branchId, moved: false, error: error?.message ?? String(error) })
+    }
+  }
+  return carried
+}
+
+const methods = {
+  async move(ctx, config, payload) {
+    return await move(ctx, config, payload)
+  },
+  async status(ctx, config) {
+    const registry = serviceOf(ctx, 'workspaceRegistry')
+    return {
+      ok: registry !== undefined,
+      root: config.root === '' ? join(homedir(), '.dsh', 'sessions') : config.root
+    }
+  }
+}
+
+function apply(ctx, config = {}) {
+  const resolved = { ...DEFAULTS, ...config }
+  const webServer = ctx.webServer
+  if (webServer === undefined) {
+    ctx.logger?.warn('dsh-session-drag-move: no webServer service; the move API is not mounted')
+    return
+  }
+
+  ctx.effect(() => webServer.register({
+    kind: 'prefix',
+    path: '/session-drag-move/api',
+    handler: async (req, res) => {
+      if (!trusted(req, resolved.allowRemote)) return json(res, 403, { ok: false, error: { code: 'forbidden', message: 'forbidden' } })
+      if (req.method !== 'POST') return json(res, 405, { ok: false, error: { code: 'method-error', message: 'method not allowed' } })
+
+      const pathname = new URL(req.url ?? '/', 'http://dsh.internal').pathname
+      const method = pathname.startsWith(API_PREFIX) ? pathname.slice(API_PREFIX.length) : undefined
+      if (method === undefined || method.includes('/')) return json(res, 404, { ok: false, error: { code: 'not-found', message: 'unknown method' } })
+
+      try {
+        const handler = methods[method]
+        if (handler === undefined) throw new ApiError('not-found', `unknown method "${method}"`, 404)
+        const payload = await readBody(req)
+        json(res, 200, { ok: true, result: await handler(ctx, resolved, payload) })
+      } catch (error) {
+        const status = error instanceof ApiError ? error.status : 500
+        const code = error instanceof ApiError ? error.code : 'internal'
+        ctx.logger?.warn(`dsh-session-drag-move: ${method} failed: ${error?.message ?? error}`)
+        json(res, status, { ok: false, error: { code, message: error?.message ?? String(error) } })
+      }
+    }
+  }), 'dsh-session-drag-move: /session-drag-move/api routes')
+}
+
+export { apply }

package/lib/session-log.js

@@ -0,0 +1,461 @@
+/**
+ * dsh-session-drag-move — session log file helpers.
+ *
+ * The shipped session store is a per-session directory of Zstandard frames:
+ *
+ *   <root>/--<projectKey(cwd)>--/<sessionId>/session.vN.jsonl[.zstd]
+ *
+ * The FIRST frame is the physical header (one JSONL line carrying `cwd`),
+ * every later frame is an appended batch. Frames are independent, so moving a
+ * session to another project is "re-encode frame 0 with a new cwd, then copy
+ * every byte after it verbatim" — no event is ever re-serialized.
+ *
+ * `projectKey` and `encodeSegment` are transcribed from
+ * @deepseek-ai/dsh-session-persistence-jsonl (lib/index.js) so a target
+ * directory is byte-identical to the one the backend itself would choose.
+ */
+import { constants } from 'node:fs'
+import { access, mkdir, open, readFile, readdir, rename, stat, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { zstdCompressSync, zstdDecompressSync } from 'node:zlib'
+
+/** Zstandard frame magic number, `0x28B52FFD` little-endian. */
+const MAGIC = Buffer.from([0x28, 0xb5, 0x2f, 0xfd])
+
+/**
+ * Build the readable directory key for a project path.
+ * @param {string} cwd - absolute project directory.
+ * @returns {string} one filesystem-safe directory name, `--…--`.
+ */
+export function projectKey(cwd) {
+  if (cwd.length === 0) throw new Error('cannot encode an empty project path')
+  let readable = ''
+  let separatorRun = false
+  for (let i = 0; i < cwd.length; i++) {
+    const code = cwd.charCodeAt(i)
+    const ch = String.fromCharCode(code)
+    if (ch === '/' || ch === '\\' || ch === ':') {
+      if (!separatorRun) readable += '-'
+      separatorRun = true
+    } else if (ch !== '~' && /^[A-Za-z0-9._-]$/.test(ch)) {
+      readable += ch
+      separatorRun = false
+    } else {
+      readable += '~' + code.toString(16).toUpperCase().padStart(4, '0')
+      separatorRun = false
+    }
+  }
+  return `--${(readable.replace(/^-+/, '') || 'root').slice(0, 251)}--`
+}
+
+/**
+ * Encode a string as one safe path segment (session ids are unbranded input).
+ * @param {string} raw - non-empty string to encode.
+ * @returns {string} escaped segment; `session-<uuid>` round-trips unchanged.
+ */
+export function encodeSegment(raw) {
+  if (raw.length === 0) throw new Error('cannot encode an empty path segment')
+  if (raw === '.') return '~002E'
+  if (raw === '..') return '~002E~002E'
+  let out = ''
+  for (let i = 0; i < raw.length; i++) {
+    const code = raw.charCodeAt(i)
+    const ch = String.fromCharCode(code)
+    if (ch !== '~' && /^[A-Za-z0-9._-]$/.test(ch)) out += ch
+    else out += '~' + code.toString(16).toUpperCase().padStart(4, '0')
+  }
+  return out
+}
+
+/**
+ * Inverse of {@link encodeSegment}: recover the id a directory name encodes.
+ *
+ * Exact inverse only for strings this encoder produced; `undefined` means the
+ * segment is not valid encoded output, which is how a foreign directory under
+ * the store root is skipped rather than mistaken for a session.
+ *
+ * @param {string} segment - one directory name under a project directory.
+ * @returns {string|undefined} the decoded id, or `undefined` when malformed.
+ */
+export function decodeSegment(segment) {
+  if (segment.length === 0) return undefined
+  let out = ''
+  for (let i = 0; i < segment.length; ) {
+    const ch = segment[i]
+    if (ch !== '~') {
+      if (!/^[A-Za-z0-9._-]$/.test(ch)) return undefined
+      out += ch
+      i += 1
+      continue
+    }
+    const hex = segment.slice(i + 1, i + 5)
+    if (!/^[0-9A-F]{4}$/.test(hex)) return undefined
+    out += String.fromCharCode(Number.parseInt(hex, 16))
+    i += 5
+  }
+  // Re-encode to confirm this segment is canonical (e.g. `~0041` must be `A`).
+  return encodeSegment(out) === segment ? out : undefined
+}
+
+/** @param {string} root @param {string} cwd @returns {string} project directory. */
+export function projectDir(root, cwd) {
+  return join(root, projectKey(cwd))
+}
+
+/** @param {string} root @param {string} cwd @param {string} id @returns {string} */
+export function sessionDir(root, cwd, id) {
+  return join(projectDir(root, cwd), encodeSegment(id))
+}
+
+/** Whether a path exists at all. */
+const exists = async (p) => {
+  try {
+    await access(p, constants.F_OK)
+    return true
+  } catch {
+    return false
+  }
+}
+
+/** Whether a path exists and is a directory. */
+const isDir = async (p) => {
+  try {
+    return (await stat(p)).isDirectory()
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Locate a session's directory on disk. The direct `projectKey(cwd)` guess is
+ * tried first; a scan of `<root>/*` covers a cwd that was normalized
+ * differently when the log was written.
+ *
+ * @param {string} root - session store root.
+ * @param {string} cwd - the session's recorded cwd.
+ * @param {string} sessionId - session id.
+ * @returns {Promise<string|undefined>} the directory, when it exists.
+ */
+export async function locateSessionDir(root, cwd, sessionId) {
+  const direct = sessionDir(root, cwd, sessionId)
+  if (await isDir(direct)) return direct
+  let entries
+  try {
+    entries = await readdir(root, { withFileTypes: true })
+  } catch {
+    return undefined
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue
+    const candidate = join(root, entry.name, encodeSegment(sessionId))
+    if (await isDir(candidate)) return candidate
+  }
+  return undefined
+}
+
+/** Physical generation number parsed out of `session.vN.jsonl[.zstd]`. */
+const generationOf = (name) => {
+  const match = /^session(?:\.v(\d+))?\.jsonl(?:\.zstd)?$/.exec(name)
+  if (match === null) return undefined
+  return match[1] === undefined ? 0 : Number(match[1])
+}
+
+/**
+ * The session's current log file — highest released generation, like the
+ * backend's own selection.
+ * @param {string} dir - session directory.
+ * @returns {Promise<{path: string, compressed: boolean}|undefined>}
+ */
+export async function currentLogFile(dir) {
+  const entries = await readdir(dir, { withFileTypes: true })
+  let best
+  let bestGeneration = -1
+  for (const entry of entries) {
+    if (!entry.isFile()) continue
+    const generation = generationOf(entry.name)
+    if (generation === undefined || generation <= bestGeneration) continue
+    best = entry.name
+    bestGeneration = generation
+  }
+  if (best === undefined) return undefined
+  return { path: join(dir, best), compressed: best.endsWith('.zstd') }
+}
+
+/** Every offset where a Zstandard frame magic begins. */
+function magicOffsets(buf) {
+  const offsets = []
+  let at = 0
+  for (;;) {
+    const hit = buf.indexOf(MAGIC, at)
+    if (hit === -1) return offsets
+    offsets.push(hit)
+    at = hit + 4
+  }
+}
+
+/**
+ * Read the log's physical header without touching anything after it.
+ *
+ * Frame boundaries are found by magic scan and then VERIFIED: a candidate end
+ * counts only when the bytes before it decompress to a JSONL line that is a
+ * valid session header for `expectId`. A magic that happens to occur inside
+ * compressed data is therefore skipped instead of truncating the log.
+ *
+ * @param {Buffer} buf - whole log file.
+ * @param {string} expectId - session id the header must name.
+ * @returns {{frameEnd: number, header: object}|undefined}
+ */
+export function readHeader(buf, expectId) {
+  const candidates = magicOffsets(buf).slice(1)
+  candidates.push(buf.length)
+  for (const end of candidates) {
+    try {
+      const text = zstdDecompressSync(buf.subarray(0, end)).toString('utf8')
+      const line = text.split('\n')[0]
+      const header = JSON.parse(line)
+      if (header?.type !== 'session') continue
+      if (typeof header.id === 'string' && header.id !== expectId) continue
+      if (typeof header.cwd !== 'string') continue
+      return { frameEnd: end, header }
+    } catch {
+      /* not a frame boundary, or not a session header: try the next candidate */
+    }
+  }
+  return undefined
+}
+
+/**
+ * Every project directory currently holding this session.
+ *
+ * A cwd-agnostic scan, deliberately: the stored header is what says where a
+ * session *belongs*, but the directory listing is what says where its bytes
+ * *are*, and a move that failed mid-way leaves those two disagreeing. Returns
+ * every hit so the caller can notice a duplicate instead of silently picking
+ * one.
+ *
+ * @param {string} root - session store root.
+ * @param {string} sessionId - session id.
+ * @returns {Promise<string[]>} matching session directories, in scan order.
+ */
+export async function findSessionDirs(root, sessionId) {
+  let entries
+  try {
+    entries = await readdir(root, { withFileTypes: true })
+  } catch {
+    return []
+  }
+  const found = []
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue
+    const candidate = join(root, entry.name, encodeSegment(sessionId))
+    if (await isDir(candidate)) found.push(candidate)
+  }
+  return found
+}
+
+/**
+ * Every session id present in the store, with the directory holding it.
+ *
+ * Reads directory names only — no header decode — so it stays cheap enough to
+ * run on every move. `encodeSegment` is injective, so a directory name decodes
+ * back to exactly one id.
+ *
+ * @param {string} root - session store root.
+ * @returns {Promise<Map<string, string>>} sessionId → session directory.
+ */
+export async function indexStore(root) {
+  const index = new Map()
+  let projects
+  try {
+    projects = await readdir(root, { withFileTypes: true })
+  } catch {
+    return index
+  }
+  for (const project of projects) {
+    if (!project.isDirectory()) continue
+    let sessions
+    try {
+      sessions = await readdir(join(root, project.name), { withFileTypes: true })
+    } catch {
+      continue
+    }
+    for (const session of sessions) {
+      if (!session.isDirectory()) continue
+      const id = decodeSegment(session.name)
+      if (id === undefined) continue
+      // First hit wins; a duplicate id in two project directories is the
+      // caller's business (relocateSession reports it).
+      if (!index.has(id)) index.set(id, join(root, project.name, session.name))
+    }
+  }
+  return index
+}
+
+/**
+ * Read only a log's header, from a bounded prefix of the file.
+ *
+ * The header is the log's first frame and runs to a couple hundred bytes, so
+ * building the fork tree over a whole store must not read every session's full
+ * multi-megabyte log. {@link readHeader} verifies the frame boundary, so a
+ * truncated read either yields the header or yields nothing — never a
+ * half-decoded one.
+ *
+ * @param {string} dir - session directory.
+ * @param {string} sessionId - session id.
+ * @param {number} [maxBytes] - how much of the file to read.
+ * @returns {Promise<object|undefined>} the stored header, when readable.
+ */
+export async function readHeaderPrefix(dir, sessionId, maxBytes = 8192) {
+  const log = await currentLogFile(dir)
+  if (log === undefined) return undefined
+  let handle
+  try {
+    handle = await open(log.path, 'r')
+    const buffer = Buffer.alloc(maxBytes)
+    const { bytesRead } = await handle.read(buffer, 0, maxBytes, 0)
+    const prefix = buffer.subarray(0, bytesRead)
+    if (log.compressed) return readHeader(prefix, sessionId)?.header
+    return readRawHeader(prefix, sessionId).header
+  } catch {
+    return undefined
+  } finally {
+    await handle?.close()
+  }
+}
+
+/**
+ * Read a session directory's current log and stored header, without writing.
+ *
+ * @param {string} dir - session directory.
+ * @param {string} sessionId - session id.
+ * @returns {Promise<{log: {path: string, compressed: boolean}, header: object, buf: Buffer}|undefined>}
+ */
+export async function readSessionState(dir, sessionId) {
+  const log = await currentLogFile(dir)
+  if (log === undefined) return undefined
+  const buf = await readFile(log.path)
+  try {
+    const found = log.compressed ? readHeader(buf, sessionId) : readRawHeader(buf, sessionId)
+    if (found === undefined) return undefined
+    return { log, header: found.header, buf }
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Rebuild a log with the same header except for a new `cwd`.
+ *
+ * @param {Buffer} buf - original log bytes.
+ * @param {string} newCwd - the project directory the session moves to.
+ * @param {string} sessionId - session id.
+ * @returns {{content: Buffer, header: object, frameEnd: number}}
+ */
+export function rewriteHeaderCwd(buf, newCwd, sessionId) {
+  const found = readHeader(buf, sessionId)
+  if (found === undefined) throw new Error(`session log holds no readable header for '${sessionId}'`)
+  const header = { ...found.header, cwd: newCwd }
+  const line = Buffer.from(`${JSON.stringify(header)}\n`, 'utf8')
+  return {
+    content: Buffer.concat([zstdCompressSync(line), buf.subarray(found.frameEnd)]),
+    header,
+    frameEnd: found.frameEnd
+  }
+}
+
+/**
+ * Read the plain-text (compression: none) first line as a header.
+ * @param {Buffer} buf @param {string} sessionId
+ */
+export function readRawHeader(buf, sessionId) {
+  const newline = buf.indexOf(0x0a)
+  const text = buf.subarray(0, newline === -1 ? buf.length : newline).toString('utf8')
+  const header = JSON.parse(text)
+  if (header?.type !== 'session' || header.id !== sessionId) throw new Error('not a session header')
+  return { frameEnd: newline === -1 ? buf.length : newline + 1, header }
+}
+
+/**
+ * Re-encode a log's header with a new cwd.
+ * @param {Buffer} buf @param {string} newCwd @param {string} sessionId
+ * @param {boolean} compressed
+ * @returns {{content: Buffer, header: object}}
+ */
+function rewriteHeader(buf, newCwd, sessionId, compressed) {
+  if (compressed) return rewriteHeaderCwd(buf, newCwd, sessionId)
+  const found = readRawHeader(buf, sessionId)
+  return {
+    content: Buffer.concat([
+      Buffer.from(`${JSON.stringify({ ...found.header, cwd: newCwd })}\n`, 'utf8'),
+      buf.subarray(found.frameEnd)
+    ]),
+    header: { ...found.header, cwd: newCwd }
+  }
+}
+
+/**
+ * Move a session's bytes into the project directory of `newCwd`, rewriting the
+ * stored header's cwd on the way.
+ *
+ * Idempotent by construction: when the session is already in the target
+ * directory it rewrites the header in place instead of copying onto itself,
+ * and an occupied destination is a reported conflict rather than an
+ * overwrite. The old directory is relocated (never copied-and-deleted), so a
+ * crash can leave at most one of the two.
+ *
+ * @param {object} args
+ * @param {string} args.root - session store root.
+ * @param {string} args.dir - the session directory found on disk.
+ * @param {string} args.newCwd - project directory to move the session to.
+ * @param {string} args.sessionId
+ * @param {string} args.backupRoot - where the pre-move directory is parked.
+ * @returns {Promise<{header: object, from: string, to: string, backup?: string, relocated: boolean}>}
+ */
+export async function relocateSession({ root, dir, newCwd, sessionId, backupRoot }) {
+  const state = await readSessionState(dir, sessionId)
+  if (state === undefined) throw new Error(`session directory '${dir}' holds no readable session log`)
+
+  const { log, buf } = state
+  const name = log.path.slice(dir.length + 1)
+  const to = sessionDir(root, newCwd, sessionId)
+
+  // Bytes already sit in the target project directory: rewrite the header
+  // where it lies, whether or not the header agrees yet. This is the repair
+  // path for a move that landed the bytes and then failed before the header
+  // (or the ledger) caught up — the exact state that used to collide with
+  // itself and fail EEXIST on a re-drop.
+  if (to === dir) {
+    const { content, header } = rewriteHeader(buf, newCwd, sessionId, log.compressed)
+    if (!buf.equals(content)) await writeFile(log.path, content)
+    return { header, from: dir, to, relocated: false }
+  }
+
+  // A different directory already holds a log for this session: refuse rather
+  // than clobber it.
+  if ((await isDir(to)) && (await exists(join(to, name)))) {
+    throw new Error(`destination already holds a log for '${sessionId}': ${join(to, name)}`)
+  }
+
+  const { content, header } = rewriteHeader(buf, newCwd, sessionId, log.compressed)
+  if (log.compressed) {
+    const again = readHeader(content, sessionId)
+    if (again === undefined || again.header.cwd !== newCwd || again.header.id !== sessionId) {
+      throw new Error('rewritten session log failed its own header re-read')
+    }
+  }
+
+  await mkdir(to, { recursive: true })
+  await writeFile(join(to, name), content, { flag: 'wx' })
+
+  // Everything else the session owns (older generations, side artifacts).
+  for (const entry of await readdir(dir, { withFileTypes: true })) {
+    if (entry.name === name) continue
+    await rename(join(dir, entry.name), join(to, entry.name))
+  }
+
+  await mkdir(backupRoot, { recursive: true })
+  const backup = join(backupRoot, `${sessionId}-${Date.now()}`)
+  await rename(dir, backup)
+
+  return { header, from: dir, to, backup, relocated: true }
+}

package/package.json

@@ -1,6 +1,50 @@
 {
   "name": "dsh-session-drag-move",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.1",
+  "description": "宸︿晶鏍忓伐浣滃尯锛氭妸浼氳瘽鎷栧埌鍒殑宸ヤ綔鍖猴紝鐪熸鏀瑰彉褰掑睘锛堟敼鍐欎細璇濇棩蹇?header 鐨?cwd 骞惰縼绉讳細璇濈洰褰曪級銆侱rag a session onto another workspace in the DSH sidebar and it really moves: the session log header's cwd is rewritten and the log is re-homed under the target project.",
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json"
+  },
+  "engines": {
+    "node": ">=22",
+    "dsh": ">=0.1.6-alpha.2"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web"
+    }
+  },
+  "files": [
+    "lib/index.js",
+    "lib/client.js",
+    "lib/session-log.js",
+    "lib/fork-tree.js",
+    "cordis.patch.yml",
+    "README.md"
+  ],
+  "keywords": [
+    "dsh",
+    "deepseek-harness",
+    "dsh-plugin",
+    "sidebar",
+    "workspace",
+    "session",
+    "drag-and-drop"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/FurryBear2025/dsh-session-drag-move.git"
+  },
+  "homepage": "https://github.com/FurryBear2025/dsh-session-drag-move#readme",
+  "bugs": {
+    "url": "https://github.com/FurryBear2025/dsh-session-drag-move/issues"
+  }
 }