dsh-super-code 0.3.9 → 0.3.11

package/docs/en/EvaluationResults.md

@@ -2,6 +2,22 @@
 
 [中文](../EvaluationResults.md) · English
 
+## Pro100: continuous-environment comparison
+
+All runs use Harness `0.2.1-rc.2`, `deepseek-v4.1-flash-1017`, high reasoning effort, and legacy budgets. Each group reuses its environment continuously across tasks. These are full 100-task results, sorted by tasks passed.
+
+| Configuration | Passed/valid | Mean total tokens (M) | Mean time (min) | Mean model calls | Mean tool calls | Cache rate |
+|---|---:|---:|---:|---:|---:|---:|
+| Super Code 0.3.5 | **51/100** | 6.435 | 24.751 | 76.660 | 75.840 | 98.927% |
+| Official Standard | 50/100 | 8.030 | 17.198 | 91.990 | 113.880 | 99.167% |
+| Unmodified dsh-ops 0.4.4 · Standard | 49/100 | 7.099 | 23.132 | 82.500 | 102.360 | 99.062% |
+| Official Standard + billion-context 0.1.209 | 45/100 | 6.359 | 18.471 | 108.950 | 131.140 | 97.654% |
+| Unmodified dsh-ops 0.4.4 · PTC | 44/100 | 7.322 | 23.695 | 81.490 | 80.960 | 99.056% |
+
+M means one million tokens, including reasoning tokens. Time includes some in-run service waits. Super Code `0.3.5` is the continuous legacy-budget baseline for this batch.
+
+This batch uses different environment-reuse and time-accounting conventions from the historical budget experiments below. They remain separate; pass counts, times, and efficiency percentages are not mixed. The historical `49/100` and `46/100` results are from earlier runs, rather than the `51/100` and `50/100` in this table. Existing per-task files still describe their original runs.
+
 ## Evaluation design
 
 ### Task set
@@ -10,17 +26,17 @@ SWE-bench Pro hard-100 (frozen ID `swebench-pro-hard-100-ddd22492f1c38839`), gra
 
 - "hard-100" is this project's selection of 100 tasks by an existing difficulty method, not an official hardest-100 list.
 - Tuning uses only 33 valid hard tasks selected from the SWE-bench dev split. hard-100 is used only to evaluate frozen candidates and investigate issues, **never for tuning**, to avoid overfitting to the evaluation tasks.
-- All scores include later reviews (see [Grading corrections](#grading-corrections)); every run has 100 valid scores.
+- The historical scores below include later reviews (see [Grading corrections](#grading-corrections)); every run has 100 valid scores.
 
 ### Baseline
 
-The baseline is the official Standard preset rather than Minimal. On the old host, Standard + high passed 51 tasks and Minimal + high passed 46, with Standard using 23.5% fewer tokens per task. Comparing against the stronger baseline gives a stricter conclusion.
+Baselines include the official Standard preset and third-party plugin configurations. The historical official-preset comparison uses Standard rather than Minimal: on the old host, Standard + high passed 51 tasks and Minimal + high passed 46, with Standard using 23.5% fewer tokens per task.
 
 ### Controlled variables
 
-Within each comparison, host, model, reasoning effort, and budgets are held constant; only the Agent preset differs. Where the host or model changes, this is stated explicitly.
+Comparisons on the same host keep model, reasoning effort, and budgets fixed while comparing preset and plugin combinations. Host or model changes are identified separately. The continuous-environment table above includes some in-run service waits; historical budget experiments use net time, excluding failed requests and retry waits.
 
-### Process
+### Historical process
 
 1. **Old-host baseline**: official presets and plugin versions were evaluated on DSH `0.1.5-rc.2` with `deepseek-v4.1-flash`. The Super Code `0.3.0` candidate passed 56 tasks, above the best official result (Standard + high, 51).
 2. **Regression after the host upgrade**: on DSH `0.2.1-rc.2` with `deepseek-v4.1-flash-1017`, under default budgets Standard fell to 46 and Super Code `0.3.4` to 41, below Standard.
@@ -28,7 +44,7 @@ Within each comparison, host, model, reasoning effort, and budgets are held cons
 4. **Retest with legacy budgets**: both sides switched to legacy budgets. Standard stayed at 46; Super Code `0.3.5` rose to 49. Based on this, the plugin uses legacy budgets by default from `0.3.6`.
 5. **Cross-model check**: compared with native ZCode on `glm-5.3-flash` to test whether the approach depends on a specific model.
 
-## Summary
+## Historical summary
 
 | Comparison | Result |
 |---|---|

package/docs/en/UsageGuide.md

@@ -11,6 +11,7 @@ New here? Read the Install and Use sections of the [README](../../README.en.md)
 - [Sidebar](#sidebar)
 - [Batched tool calls](#batched-tool-calls)
 - [Runtime budgets](#runtime-budgets)
+- [Windows command environment](#windows-command-environment)
 - [Deletion protection](#deletion-protection)
 - [MCP connection](#mcp-connection)
 - [Frontend Skill](#frontend-skill)
@@ -41,7 +42,7 @@ Before plugin 0.2.0, the settings page lives under **Plugins → Plugin configur
 | Tab | Contents |
 |---|---|
 | Home | Preset status and versions, deletion-protection level, MCP switch, connected/past conversation counts |
-| Preset configuration | Install, reinstall, rename |
+| Preset configuration | Install, reinstall, rename, Windows command environment |
 | Context settings | [Runtime budgets](#runtime-budgets) |
 | Deletion protection | [Deletion protection](#deletion-protection) |
 | Connection | [MCP connection](#mcp-connection) |
@@ -73,13 +74,27 @@ Settings shows the **plugin version** and the **preset version** separately.
 
 **Safety**:
 
-- Only presets verifiably installed by this plugin are replaced (directory: install record, UUID, path, directory identity; declarative: source marker or install record). Unmarked old copies and same-name declarations are left alone.
+- Directory preset status, language synchronization, and reinstallation verify the install record, UUID, path, and directory identity. Declarative presets verify the source marker or install record. Older copies and same-name declarations with unverified ownership are left unchanged and remain readable.
 - The old content is backed up in `.super-code-backup-*`: under the user preset root for directory hosts, under the current profile for declarative hosts (ownership records in `.super-code-presets.json`).
-- A failed install restores automatically. After an unexpected crash, restore manually from the backup.
+- Failed installs roll back their writes and check directory identity before cleanup; substituted directories are preserved. The host then attempts to reload the restored configuration. An originally absent configuration file stays absent. After a crash, or if ownership records remain unwritable, inspect the backup before restoring manually.
+
+### Continuing after uninstall
+
+After loading a plugin version with recovery support, you can still read existing history when Super Code is uninstalled. Former Super Code conversations continue with the official Standard preset and display a one-time switch notice. The model, working directory and host permissions are preserved. Conversations already using an official preset keep that preset.
+
+Turning off deletion protection, disabling its official-preset scope, or disabling or uninstalling the plugin revokes previously injected deletion rules on the next continuation, including Minimal's rules. Switching between strict and relaxed modes retires the previous rule; cold restarts do not add the same rule again. Original history and your own deletion instructions are preserved. If an older rule has already been compacted into a summary, an explicit revocation is added without discarding the summary's other context.
+
+Disabling or uninstalling the plugin also releases its command filters, budget adapters, and MCP service. Host permission restrictions and changes owned by other plugins are preserved.
+
+If the plugin is reinstalled or the selected preset changes during recovery, the current installation and latest selection take precedence over the fallback. Recovery module updates retain existing conversation registrations and stop late writes from the retired module.
+
+If another process changes local recovery or preset ownership records while DSH is running, the plugin stops writing and preserves those files. Check the files, then restart DSH to reload them. An unrelated broken preset does not prevent other usable conversations from being registered.
+
+The profile retains `.super-code-recovery` and its configuration entry so recovery works after a cold start without the npm package. It restores registered conversations and revokes old plugin deletion rules; it contains no Super Code tools or model configuration. An upgrade registers older conversations whose preset definitions still exist. If a preset was deleted or renamed before registration, first restore its definition from the installation backup, then reinstall and load the plugin to register the conversation. If Standard is also unavailable, the error is preserved rather than silently choosing another preset.
 
 ## Sidebar
 
-In the right sidebar choose **Super Code**. Three sections, at most one open at a time, Tasks by default. Click the open heading to collapse all sections. Switching keeps reading position, filters, and drafts. The UI follows Harness's Chinese/English setting.
+In the right sidebar choose **Super Code**. Exactly one of the three sections stays open, Tasks by default. Clicking the open heading keeps it expanded. Switching keeps reading position, filters, and drafts. The UI follows Harness's Chinese/English setting.
 
 ### Tasks
 
@@ -87,6 +102,7 @@ Read-only. Shows what's already recorded in the session:
 
 - **Goal**: the recorded task goal, or the user's original message if there is none.
 - **Steps**: todos the model wrote down, shown as done/total. No steps means no invented plan or progress.
+- **Earlier requests**: prior user requests and their recorded steps stay visible as history, separate from current progress.
 - **Tool calls**: success, failure, and running counts grouped by tool.
 - **Files**: successful file changes that can be confirmed from tool arguments or diffs, including nested PTC calls.
 
@@ -99,11 +115,11 @@ Notes:
 
 ### Agent execution
 
-The Agent tree, with status, usage, and cache rate for each Agent.
+The Agent tree, with status, usage, and cache rate for each Agent. Usage counts only calls made by that Agent; forked history is not charged again to the child or the tree total.
 
 - Drag empty space to pan; zoom with the wheel or buttons.
 - Click a node to open its details in a new sidebar tab. The main conversation stays put.
-- Details are shown as a chat: user task, Agent replies, expandable tool calls and results. The header shows status, tokens, and cache; open **Details** for more usage, task records, and memory activity.
+- Details are shown as a chat: user task, Agent replies, expandable tool calls and results, including PTC sub-calls and terminal failures. Harness's Markdown and code components render lists, tables, and highlighted code, while tool arguments and output remain literal. The header shows status, tokens, and cache; open **Details** for more usage, task records, and memory activity.
 - Running animations respect the system's reduced-motion setting.
 
 The [task](../images/task-status.png) and [tree screenshots](../images/agent-tree.png) render the current plugin with official frontend components and sample data. They illustrate the UI, not model quality.
@@ -180,9 +196,26 @@ maxContextBytes: 32768       # Super Code: task-memory context bytes
 ```
 
 - A shorter deadline set explicitly on a call still applies.
+- After disabling or uninstalling the plugin, PTC calls whose execution inputs have not yet been resolved use the host deadline. Already-started calls keep their original deadline and are not restarted to restore settings.
 - Older hosts time PTC by busy CPU time; newer hosts by elapsed time. The two aren't comparable.
 - Raising `maxTasks` or `maxContextBytes` uses more context. The defaults are usually fine.
 
+## Windows command environment
+
+See [Compatibility](Compatibility.md) for the tested scope.
+
+On Windows, Super Code defaults to bundled GNU Bash, BusyBox and GNU grep. Common Bash commands work without installing Git for its shell. Developer tools such as Git, Node and Python still need separate installation. macOS and Linux keep the host's existing environment.
+
+Turn off **Preset configuration → Command environment → Use bundled Bash (Windows)** to use the host's PowerShell for new conversations. Changes save automatically; running Agents retain their environment, and child Agents inherit their conversation's shell and tool restrictions. Reinstall an older installed preset to pick up the new shell entry. Selection follows the DSH server's platform, independently of the browser's operating system. These switches are editable only on Windows hosts; other platforms show gray, disabled switches with an **Only available on Windows** hover tooltip.
+
+Enable **Also apply to official presets** in the same section to use bundled Bash in Standard, PTC and Create; it is off by default. This choice is independent of the budget and deletion-protection scopes. Turning off the main Bash switch also restores the original shell for new official Agents while retaining the saved scope choice. Minimal keeps its persistent terminal; custom presets are not changed automatically. Official presets can use this setting without an installed Super Code preset copy.
+
+The plugin carries its runtime and prepares it offline under `%LOCALAPPDATA%\dsh-super-code\shell` on first use. It does not change the system PATH. Settings shows readiness and preparation errors; turn the switch off to use the host environment after an error. Failed commands are never replayed through a different shell. DSH continues to own approvals, deletion protection and process management.
+
+The official Windows sandbox blocks the internal named pipes MSYS requires. Bash calls under `read-only` or `workspace-write` therefore fail explicitly before the command runs. If still needed, the Agent can request DSH approval for the **exact same command** with `sandbox_permissions="danger-full-access"` and a justification. Approval permits only that invocation; rejection, cancellation, or disabled approvals leave it unexecuted. The plugin never changes session permissions or switches shells automatically. If the outer PTC `run_code` program also needs wider access, it requires its own host approval; approving Bash does not authorize that outer program.
+
+Programs still run on Windows. BusyBox does not implement every GNU option; `.cmd` quoting and native `/` arguments differ from Linux. MSYS converts some paths automatically. Use `MSYS2_ARG_CONV_EXCL` for an individual invocation that needs literal arguments rather than disabling conversion globally. The bundle does not include `trash`, and permanent deletion is never presented as a recycle-bin operation. On ARM64 Windows, Bash, grep and the MSYS DLLs run through x64 emulation. See [Compatibility](Compatibility.md) for tested scope and the [runtime notes](../../runtime/windows/README.md) for sources and licenses.
+
 ## Deletion protection
 
 Under the **Deletion protection** tab. Default is **Relaxed**.
@@ -227,6 +260,7 @@ Directories:
 
 - The DSH workspace list is reread every time you open the tab. On first setup, existing workspaces are preselected; workspaces added later are **not** granted access automatically.
 - Add directories with the directory picker. Uncheck to revoke; unchecking the last one also turns MCP off.
+- After revocation, the old directory request reports rejection. The caller must submit a new request to ask for access again.
 
 Connections:
 
@@ -234,7 +268,7 @@ Connections:
 - Disconnect clients from the Connection tab; idle connections drop after 10 minutes. Disconnecting doesn't cancel accepted tasks.
 - "Connected conversations" on Home means the linked MCP connection is still online, regardless of whether the task finished. After disconnect they count as past conversations.
 
-Port conflicts are reported directly. Use the URL shown on the page.
+Port conflicts are reported directly. Choose another port, or resolve the conflict and click **Retry**. If settings were saved but connection cleanup failed, **Retry** restores the connection using those settings. Failed saves retain your draft for retry. Use the URL shown on the page.
 
 ### Configure the client
 
@@ -250,10 +284,10 @@ Whether a client can set up MCP from the prompt by itself depends on the client.
 |---|---|
 | `dsh_status` | Inspect directories, policies, capacity, blocking tasks, and recovery guidance |
 | `dsh_models` | List exact model/effort IDs for `dsh_run` and `dsh_send`; omission retains the current/default selection |
-| `dsh_read` | Page through owned conversations and managed children, including public messages, tool results, and failure details; excludes reasoning and private configuration |
+| `dsh_read` | Page through owned conversations and managed children, including public messages, tool calls/results (also PTC sub-calls), and failure details; excludes reasoning and private configuration |
 | `dsh_approve` | Approve or reject one exact pending operation only when caller approval is enabled |
 | `dsh_sessions` | Call first after connecting: lists recent conversations per directory with status, whether they can be reused, connection capacity, and task concurrency |
-| `dsh_run` | Start a task. Pass `taskId` to reuse a specific conversation, or `newConversation: true` for a new one (passing neither also creates new). It **never** picks the latest conversation on its own. Same `requestId` + same input won't dispatch twice; different input is a conflict |
+| `dsh_run` | Start a task. Pass `taskId` to reuse a specific conversation, or `newConversation: true` for a new one (passing neither also creates new). `newConversation: false` requires `taskId` and never creates or automatically picks the latest conversation. Same `requestId` + same input won't dispatch twice; different input is a conflict |
 | `dsh_wait` | Read task status, output, workspace changes, and new events, waiting up to 30 seconds. Without a task ID, lists all tasks page by page |
 | `dsh_send` | Add a follow-up or continue in the same conversation, with a new `requestId`. Never approves permissions for you |
 | `dsh_request_directory` | Ask for a new working directory; you approve it in DSH |
@@ -263,6 +297,8 @@ Whether a client can set up MCP from the prompt by itself depends on the client.
 
 The client calls `dsh_request_directory` with a `requestId`, an existing absolute `path`, and a `reason`. DSH shows a global dialog (Settings doesn't need to be open) with the client name, directory, and reason.
 
+Before approval, DSH rechecks the requested directory's identity and the request status. Replacing the directory at the same path, expiry, or withdrawal prevents the old request from granting access; use a new `requestId` to request consent again. Ordinary file changes inside that directory do not invalidate consent.
+
 - Access is granted only when you click **Allow access**. A model's auto-approval can't do it for you.
 - Repeat the same call to check status: `pending` / `approved` / `rejected` / `expired`.
 - Tasks can't run in that directory until it's approved.
@@ -278,6 +314,9 @@ The client calls `dsh_request_directory` with a `requestId`, an existing absolut
 - `finished`: execution ended, but `acceptance` is always `not-verified`. The caller must check the result.
 - Returned file info is an observation of the Git workspace, including changes that existed before the task, so it doesn't prove the task made them. Non-Git directories or exceeded limits are marked unavailable.
 - Wait timeouts and client disconnects don't cancel tasks. Turning off the connection just stops new requests.
+- Requests still being prepared recheck authorization before creating a conversation, selecting a model, and sending a prompt. Closing the service, revoking its directory, or disconnecting stops unsent prompts; submitted tasks keep running. Reconnecting never automatically resends a saved intent, and an unsent continuation preserves the previous turn's state.
+- Creation, continuation, and cancellation stop if saving their intent fails. A restart during continuation preparation preserves the previous turn's tracking. An unconfirmed new prompt never inherits completion from the previous turn. Task records share a 64 MiB read/write limit; oversized writes are refused without replacing the saved file.
+- Cancelling an MCP wait or approval request prevents a late form answer from granting permission. Service, directory and caller-approval settings are checked again before the decision. A one-time approval already decided is neither undone nor granted again by a later cancellation.
 - After a restart, prompts are never resent automatically. Find the ID via `dsh_sessions` or the task list, check the state, then continue explicitly. If the state can't be confirmed, it shows `interrupted` or `unavailable`; tasks not confirmed as stopped keep their concurrency slot.
 
 On capacity refusal, retain the same `requestId` and input and wait through `dsh_status` and `dsh_wait`. Do not cancel other clients' tasks or reconfigure the serving app. Release SDK sessions with `transport.terminateSession()` before `client.close()`; closing alone does not release server capacity. The packaged `super-code-mcp` CLI accepts JSON on stdin and reads its token from the private `DSH_MCP_TOKEN` environment variable.

package/lib/connection/directories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"directories.d.ts","sourceRoot":"","sources":["../../src/connection/directories.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,oBAAoB;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACzF,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAC/F,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;CACzD;AACD,0FAA0F;AAC1F,qBAAa,iBAAiB;IAGhB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAkB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAF1E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsC;IAC/D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;gBACvB,OAAO,EAAE,MAAM,MAAM,EAAE,EAAmB,GAAG,GAAE,MAAM,MAAiB;IACnG,OAAO,CAAC,MAAM;IAKR,OAAO,CAAC,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAsBrF,OAAO,IAAI,gBAAgB,EAAE;IACvB,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,GAAG,UAAU,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;IAarJ,aAAa,IAAI,IAAI;CACtB"}
+{"version":3,"file":"directories.d.ts","sourceRoot":"","sources":["../../src/connection/directories.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,oBAAoB;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACzF,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAC/F,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;CACzD;AACD,0FAA0F;AAC1F,qBAAa,iBAAiB;IAGhB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAkB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAF1E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsC;IAC/D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgE;gBAC3D,OAAO,EAAE,MAAM,MAAM,EAAE,EAAmB,GAAG,GAAE,MAAM,MAAiB;IACnG,OAAO,CAAC,MAAM;IAMR,OAAO,CAAC,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAsBrF,OAAO,IAAI,gBAAgB,EAAE;IACvB,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,GAAG,UAAU,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;IAmBrJ,aAAa,IAAI,IAAI;CACtB"}

package/lib/connection/directories.js

@@ -17,22 +17,25 @@ export class DirectoryRequests {
         for (const row of this.requests.values()) {
             if (row.status === 'pending' && this.now() - row.createdAt >= 5 * 60 * 1000)
                 row.status = 'expired';
+            if (row.status === 'approved' && !this.allowed().some(parent => withinDirectory(parent, row.path)))
+                row.status = 'rejected';
         }
     }
     async request(input, client) {
         this.expire();
         const existing = this.requests.get(input.requestId);
         if (existing) {
-            if (this.sources.get(input.requestId) !== input.path || existing.reason !== input.reason)
+            if (this.sources.get(input.requestId)?.path !== input.path || existing.reason !== input.reason)
                 throw new ConnectionError('request-conflict');
             return { ...existing };
         }
         if (!isAbsolute(input.path))
             throw new ConnectionError('absolute-directory-required');
-        let path;
+        let path, identity;
         try {
             path = await realpath(input.path);
-            if (!(await stat(path)).isDirectory())
+            identity = await stat(path, { bigint: true });
+            if (!identity.isDirectory())
                 throw new Error();
         }
         catch {
@@ -50,7 +53,7 @@ export class DirectoryRequests {
         const row = { id: randomUUID(), ...input, path, client: client.slice(0, 80), createdAt: this.now(),
             status: this.allowed().some(parent => withinDirectory(parent, path)) ? 'approved' : 'pending' };
         this.requests.set(input.requestId, row);
-        this.sources.set(input.requestId, input.path);
+        this.sources.set(input.requestId, { path: input.path, dev: identity.dev, ino: identity.ino });
         return { ...row };
     }
     pending() { this.expire(); return [...this.requests.values()].filter(row => row.status === 'pending').map(row => ({ ...row })); }
@@ -63,13 +66,19 @@ export class DirectoryRequests {
             return { status: row.status };
         if (decision === 'approved') {
             try {
-                if (await realpath(row.path) !== row.path || !(await stat(row.path)).isDirectory())
+                if (await realpath(row.path) !== row.path)
+                    throw new Error();
+                const source = this.sources.get(row.requestId), identity = await stat(row.path, { bigint: true });
+                if (!source || !identity.isDirectory() || identity.dev !== source.dev || identity.ino !== source.ino)
                     throw new Error();
             }
             catch {
                 row.status = 'rejected';
                 throw new ConnectionError('directory-changed');
             }
+            this.expire();
+            if (row.status !== 'pending')
+                return { status: row.status };
             await grant(row.path);
         }
         row.status = decision;

package/lib/connection/directories.js.map

@@ -1 +1 @@
-{"version":3,"file":"directories.js","sourceRoot":"","sources":["../../src/connection/directories.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAO5C,0FAA0F;AAC1F,MAAM,OAAO,iBAAiB;IAGC;IAA0C;IAFtD,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAA;IAC9C,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;IACpD,YAA6B,OAAuB,EAAmB,MAAoB,IAAI,CAAC,GAAG;QAAtE,YAAO,GAAP,OAAO,CAAgB;QAAmB,QAAG,GAAH,GAAG,CAAyB;IAAG,CAAC;IAC/F,MAAM;QACZ,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;gBAAE,GAAG,CAAC,MAAM,GAAG,SAAS,CAAA;QACrG,CAAC;IACH,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,KAA2B,EAAE,MAAc;QACvD,IAAI,CAAC,MAAM,EAAE,CAAA;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;YACvI,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAA;QACxB,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,6BAA6B,CAAC,CAAA;QACrF,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAA;QAAC,CAAC;QACnG,MAAM,CAAC;YAAC,MAAM,IAAI,eAAe,CAAC,uBAAuB,CAAC,CAAA;QAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAA;QACpF,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAA;YACvF,IAAI,MAAM,EAAE,CAAC;gBAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;YAAC,CAAC;QACjF,CAAC;QACD,MAAM,GAAG,GAAqB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YAClH,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;QACjG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAC7C,OAAO,EAAE,GAAG,GAAG,EAAE,CAAA;IACnB,CAAC;IACD,OAAO,KAAyB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAA,CAAC,CAAC;IACpJ,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,QAAiC,EAAE,KAAsC;QACjG,IAAI,CAAC,MAAM,EAAE,CAAA;QACb,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QAClE,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,eAAe,CAAC,6BAA6B,CAAC,CAAA;QAClE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;QAC3D,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC;gBAAC,IAAI,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;oBAAE,MAAM,IAAI,KAAK,EAAE,CAAA;YAAC,CAAC;YAC7G,MAAM,CAAC;gBAAC,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC;gBAAC,MAAM,IAAI,eAAe,CAAC,mBAAmB,CAAC,CAAA;YAAC,CAAC;YACjF,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACvB,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAA;QACrB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;IAC/B,CAAC;IACD,aAAa,KAAW,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,GAAG,CAAC,MAAM,GAAG,UAAU,CAAA,CAAC,CAAC;CAC1H"}
+{"version":3,"file":"directories.js","sourceRoot":"","sources":["../../src/connection/directories.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAO5C,0FAA0F;AAC1F,MAAM,OAAO,iBAAiB;IAGC;IAA0C;IAFtD,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAA;IAC9C,OAAO,GAAG,IAAI,GAAG,EAAsD,CAAA;IACxF,YAA6B,OAAuB,EAAmB,MAAoB,IAAI,CAAC,GAAG;QAAtE,YAAO,GAAP,OAAO,CAAgB;QAAmB,QAAG,GAAH,GAAG,CAAyB;IAAG,CAAC;IAC/F,MAAM;QACZ,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;gBAAE,GAAG,CAAC,MAAM,GAAG,SAAS,CAAA;YACnG,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBAAE,GAAG,CAAC,MAAM,GAAG,UAAU,CAAA;QAC7H,CAAC;IACH,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,KAA2B,EAAE,MAAc;QACvD,IAAI,CAAC,MAAM,EAAE,CAAA;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;YAC7I,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAA;QACxB,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,6BAA6B,CAAC,CAAA;QACrF,IAAI,IAAY,EAAE,QAAqB,CAAA;QACvC,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAA;QAAC,CAAC;QACxI,MAAM,CAAC;YAAC,MAAM,IAAI,eAAe,CAAC,uBAAuB,CAAC,CAAA;QAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAA;QACpF,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAA;YACvF,IAAI,MAAM,EAAE,CAAC;gBAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;YAAC,CAAC;QACjF,CAAC;QACD,MAAM,GAAG,GAAqB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YAClH,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;QACjG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAA;QAC7F,OAAO,EAAE,GAAG,GAAG,EAAE,CAAA;IACnB,CAAC;IACD,OAAO,KAAyB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAA,CAAC,CAAC;IACpJ,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,QAAiC,EAAE,KAAsC;QACjG,IAAI,CAAC,MAAM,EAAE,CAAA;QACb,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QAClE,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,eAAe,CAAC,6BAA6B,CAAC,CAAA;QAClE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;QAC3D,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,IAAI,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,EAAE,CAAA;gBAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;gBACjG,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;oBAAE,MAAM,IAAI,KAAK,EAAE,CAAA;YACzH,CAAC;YACD,MAAM,CAAC;gBAAC,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC;gBAAC,MAAM,IAAI,eAAe,CAAC,mBAAmB,CAAC,CAAA;YAAC,CAAC;YACjF,IAAI,CAAC,MAAM,EAAE,CAAA;YACb,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;YAC3D,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACvB,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAA;QACrB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;IAC/B,CAAC;IACD,aAAa,KAAW,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,GAAG,CAAC,MAAM,GAAG,UAAU,CAAA,CAAC,CAAC;CAC1H"}

package/lib/connection/guidance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guidance.d.ts","sourceRoot":"","sources":["../../src/connection/guidance.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,EAAE,MAAmnD,CAAA;AAExpD,MAAM,WAAW,QAAQ;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE;AACxG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAqBzD"}
+{"version":3,"file":"guidance.d.ts","sourceRoot":"","sources":["../../src/connection/guidance.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,EAAE,MAAmnD,CAAA;AAExpD,MAAM,WAAW,QAAQ;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE;AACxG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CA2BzD"}

package/lib/connection/guidance.js

@@ -7,6 +7,9 @@ export function connectionRecovery(code) {
             return { action: 'inspect-capacity', message: 'No prompt was admitted. Call dsh_status, wait for blocking tasks with dsh_wait, then retry the same requestId and input. Do not change cwd to evade a shared Git worktree lock or cancel another task.', retryable: true, retryAfterMs: 30000 };
         case 'new-conversation-disabled':
             return { action: 'choose-history', message: 'No new conversation was created. Call dsh_sessions and choose an existing taskId, or ask the user to enable creation.', retryable: false };
+        case 'task-id-required':
+        case 'conflicting-session-options':
+            return { action: 'choose-history', message: 'No prompt was sent. Call dsh_sessions and choose an exact taskId to reuse. newConversation=false requires taskId; newConversation=true cannot be combined with taskId. Do not automatically choose the latest conversation.', retryable: false };
         case 'directory-not-allowed':
             return { action: 'request-directory', message: 'Use dsh_status to inspect grants or dsh_request_directory to request user consent. Do not edit DSH settings or bypass this boundary.', retryable: false };
         case 'caller-approval-disabled':
@@ -20,6 +23,10 @@ export function connectionRecovery(code) {
             return { action: 'recover-task-id', message: 'Call dsh_sessions for the same cwd or dsh_wait without taskId to recover service-owned IDs. Do not recreate or resend an uncertain request.', retryable: false };
         case 'request-conflict':
             return { action: 'check-request', message: 'This requestId already identifies different input. Inspect the prior task; use a new requestId only for a genuinely new operation.', retryable: false };
+        case 'request-aborted':
+            return { action: 'inspect-task', message: 'This call stopped before dispatching its next action. Inspect the same requestId, taskId or pending approval; saved prompt intents are never automatically resent. Cancellation does not cancel prompts already submitted to DSH or undo approvals already decided.', retryable: false };
+        case 'task-storage-full':
+            return { action: 'report-storage-limit', message: 'The task history exceeds the 64 MiB storage limit. This write was refused without replacing the saved history. Do not resend an uncertain request or edit the serving profile; report the limit to the user.', retryable: false };
         default:
             return { action: 'report-error', message: 'Report the failure and inspect service/task state through MCP. Do not fall back to controlling the serving DSH application or editing its profile.', retryable: false };
     }

package/lib/connection/guidance.js.map

@@ -1 +1 @@
-{"version":3,"file":"guidance.js","sourceRoot":"","sources":["../../src/connection/guidance.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAW,0mDAA0mD,CAAA;AAGxpD,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,gBAAgB,CAAC;QAAC,KAAK,mBAAmB;YAC7C,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,wMAAwM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;QAChS,KAAK,2BAA2B;YAC9B,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,uHAAuH,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QACzL,KAAK,uBAAuB;YAC1B,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,sIAAsI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QAC3M,KAAK,0BAA0B;YAC7B,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,gHAAgH,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QACrL,KAAK,oBAAoB,CAAC;QAAC,KAAK,mBAAmB;YACjD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,mIAAmI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QACvM,KAAK,sBAAsB;YACzB,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,uLAAuL,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QAC5P,KAAK,gBAAgB;YACnB,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,6IAA6I,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QAChN,KAAK,kBAAkB;YACrB,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,oIAAoI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QACrM;YACE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,oJAAoJ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IACtN,CAAC;AACH,CAAC"}
+{"version":3,"file":"guidance.js","sourceRoot":"","sources":["../../src/connection/guidance.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAW,0mDAA0mD,CAAA;AAGxpD,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,gBAAgB,CAAC;QAAC,KAAK,mBAAmB;YAC7C,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,wMAAwM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;QAChS,KAAK,2BAA2B;YAC9B,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,uHAAuH,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QACzL,KAAK,kBAAkB,CAAC;QAAC,KAAK,6BAA6B;YACzD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,6NAA6N,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QAC/R,KAAK,uBAAuB;YAC1B,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,sIAAsI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QAC3M,KAAK,0BAA0B;YAC7B,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,gHAAgH,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QACrL,KAAK,oBAAoB,CAAC;QAAC,KAAK,mBAAmB;YACjD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,mIAAmI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QACvM,KAAK,sBAAsB;YACzB,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,uLAAuL,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QAC5P,KAAK,gBAAgB;YACnB,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,6IAA6I,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QAChN,KAAK,kBAAkB;YACrB,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,oIAAoI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QACrM,KAAK,iBAAiB;YACpB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,qQAAqQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QACrU,KAAK,mBAAmB;YACtB,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE,8MAA8M,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QACtR;YACE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,oJAAoJ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IACtN,CAAC;AACH,CAAC"}

package/lib/connection/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/connection/http.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAGnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAIhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAiB9E,KAAK,gBAAgB,GAAG,CAAC,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;AAClG,KAAK,UAAU,GAAG,MAAM,MAAM,CAAA;AAC9B,KAAK,gBAAgB,GAAG,MAAM;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAkBrG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,KAAK,WAAW,EAAE,YAAY,SAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,gBAAgB,CAAC,EAAE,UAAU,GAAE,UAAwB,EAAE,gBAAgB,GAAE,gBAA4H,GAAG,SAAS,CAgE1Y;AAQD,MAAM,WAAW,eAAe;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAKrH,8FAA8F;AAC9F,qBAAa,cAAc;IAMb,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAkB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IALrF,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,QAAQ,CAAI;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAC9D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,KAAK,CAAgD;gBAChC,KAAK,EAAE,cAAc,EAAmB,gBAAgB,GAAE,gBAAgB,GAAG,SAAqB;IAC/H,WAAW,IAAI,eAAe,EAAE;IAG1B,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAO7B,KAAK;IAIb,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,SAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAY7D,KAAK;YAsBL,MAAM;IAqDd,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAS7B"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/connection/http.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAGnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAIhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAiB9E,KAAK,gBAAgB,GAAG,CAAC,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;AAClG,KAAK,UAAU,GAAG,MAAM,MAAM,CAAA;AAC9B,KAAK,gBAAgB,GAAG,MAAM;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAkBrG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,KAAK,WAAW,EAAE,YAAY,SAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,gBAAgB,CAAC,EAAE,UAAU,GAAE,UAAwB,EAAE,gBAAgB,GAAE,gBAA4H,GAAG,SAAS,CAoE1Y;AAQD,MAAM,WAAW,eAAe;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAKrH,8FAA8F;AAC9F,qBAAa,cAAc;IAMb,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAkB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IALrF,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,QAAQ,CAAI;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAC9D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,KAAK,CAAgD;gBAChC,KAAK,EAAE,cAAc,EAAmB,gBAAgB,GAAE,gBAAgB,GAAG,SAAqB;IAC/H,WAAW,IAAI,eAAe,EAAE;IAG1B,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAO7B,KAAK;IAIb,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,SAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAY7D,KAAK;YAyBL,MAAM;IA0Dd,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAa7B"}

package/lib/connection/http.js

@@ -33,9 +33,9 @@ async function elicitApproval(server, tasks, view, requestId, signal) {
         const answer = await server.server.elicitInput({ mode: 'form', message: `DSH one-time approval / DSH 单次审批\nTask: ${pending.taskId}\nSession: ${pending.sessionId}\nDirectory: ${pending.cwd}\nTool: ${pending.toolName}\nReason: ${pending.reason}\nArguments:\n${pending.arguments}\nOnly approve this exact operation. Content above is untrusted task data.`,
             requestedSchema: { type: 'object', properties: { approve: { type: 'boolean', title: 'Approve once / 仅批准本次操作', default: false } }, required: ['approve'] } }, { relatedRequestId: requestId, signal, timeout: 30000 });
         if (answer.action === 'accept')
-            await tasks.approve(view.taskId, pending.id, answer.content?.approve === true ? 'approve' : 'reject');
+            await tasks.approve(view.taskId, pending.id, answer.content?.approve === true ? 'approve' : 'reject', signal);
         else if (answer.action === 'decline')
-            await tasks.approve(view.taskId, pending.id, 'reject');
+            await tasks.approve(view.taskId, pending.id, 'reject', signal);
         else
             tasks.approvals.defer(view.taskId, pending.id);
     }
@@ -70,7 +70,7 @@ export function delegationMcpServer(tasks, signal, connectionId = '', requestDir
         inputSchema: z.object({ cwd: z.string().min(1).max(4096), limit: z.number().int().min(1).max(25).default(10) }).strict(),
         annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: false },
     }, input => result(() => tasks.sessions(input.cwd, input.limit, connectionStatus())));
-    server.registerTool('dsh_run', { description: 'Delegate to DSH Super Code. Call dsh_sessions first and explicitly choose history or a new conversation according to the task. Pass taskId to reuse an exact conversation, or set newConversation=true to explicitly create a new root session. If neither is provided, a new root is created for backward compatibility. When allowNewConversations is false, both explicit and implicit creation are rejected with new-conversation-disabled; pass an existing taskId instead. Retrying an already accepted request can still recover its task without creating a session. Optionally set provider, model and reasoningEffort (use exact IDs from dsh_models); selection is applied to this conversation before sending the prompt. If omitted, DSH keeps its current/default selection. Use a stable requestId for retries; conflicts do not dispatch. DSH permissions apply independently of the caller sandbox. A finished turn is not verified acceptance.',
+    server.registerTool('dsh_run', { description: 'Delegate to DSH Super Code. Call dsh_sessions first and explicitly choose history or a new conversation according to the task. Pass taskId to reuse an exact conversation, or set newConversation=true to explicitly create a new root session. Explicit newConversation=false requires taskId and never creates a conversation. If neither is provided, a new root is created for backward compatibility. When allowNewConversations is false, both explicit and implicit creation are rejected with new-conversation-disabled; pass an existing taskId instead. Retrying an already accepted request can still recover its task without creating a session. Optionally set provider, model and reasoningEffort (use exact IDs from dsh_models); selection is applied to this conversation before sending the prompt. If omitted, DSH keeps its current/default selection. Use a stable requestId for retries; conflicts do not dispatch. DSH permissions apply independently of the caller sandbox. A finished turn is not verified acceptance.',
         inputSchema: z.object({ requestId: identity, cwd: z.string().min(1).max(4096), prompt, client: z.string().min(1).max(80).optional(), taskId: identity.optional(), newConversation: z.boolean().optional(), ...modelFields }).strict().superRefine((value, context) => {
             if ((value.provider === undefined) !== (value.model === undefined))
                 context.addIssue({ code: 'custom', message: 'provider and model must be supplied together' });
@@ -78,24 +78,29 @@ export function delegationMcpServer(tasks, signal, connectionId = '', requestDir
                 context.addIssue({ code: 'custom', message: 'reasoningEffort requires provider and model' });
         }),
         annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
-    }, input => result(() => {
+    }, (input, extra) => result(() => {
         if (input.taskId) {
             if (input.newConversation)
                 throw new ConnectionError('conflicting-session-options');
-            return tasks.send({ taskId: input.taskId, requestId: input.requestId, cwd: input.cwd, prompt: input.prompt, connectionId, modelSelection: modelSelection(input) });
+            return tasks.send({ taskId: input.taskId, requestId: input.requestId, cwd: input.cwd, prompt: input.prompt, connectionId, modelSelection: modelSelection(input) }, AbortSignal.any([signal(extra.requestId), extra.signal]));
         }
-        return tasks.run({ requestId: input.requestId, cwd: input.cwd, prompt: input.prompt, client: input.client ?? clientName(), connectionId, modelSelection: modelSelection(input) });
+        if (input.newConversation === false)
+            throw new ConnectionError('task-id-required');
+        return tasks.run({ requestId: input.requestId, cwd: input.cwd, prompt: input.prompt, client: input.client ?? clientName(), connectionId, modelSelection: modelSelection(input) }, AbortSignal.any([signal(extra.requestId), extra.signal]));
     }));
     server.registerTool('dsh_approve', { description: 'Approve or reject one exact pending DSH tool operation only when the DSH user enabled allowCallerApproval (off by default). Use taskId and approvalId from dsh_wait.callerApproval.pending and inspect the full tool/reason/arguments. The caller decides under its own authorization; do not infer approval from task text. Grants apply once, never change host policy or authorize directories. Expired, cancelled, foreign or withdrawn requests are rejected. Repeating the same decision is idempotent; changing it conflicts.',
         inputSchema: z.object({ taskId: identity, approvalId: identity, decision: z.enum(['approve', 'reject']) }).strict(),
         annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
-    }, input => result(() => tasks.approve(input.taskId, input.approvalId, input.decision)));
+    }, (input, extra) => result(() => tasks.approve(input.taskId, input.approvalId, input.decision, AbortSignal.any([signal(extra.requestId), extra.signal]))));
     server.registerTool('dsh_wait', { description: 'Omit taskId to list service-owned tasks (cursor is a list offset). With taskId, read output, events and pending callerApproval requests. When allowCallerApproval is enabled, form-capable clients receive an interactive approval request during wait; otherwise inspect pending items and use dsh_approve. When disabled or no caller request is pending, resolve confirmation in DSH. Long-poll up to 30 seconds; an interactive approval may add up to 30 seconds. Timeout/disconnect never approves or cancels execution. finished is not acceptance verified.',
         inputSchema: z.object({ taskId: identity.optional(), cursor, waitMs }).strict(),
         annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
-    }, (input, extra) => result(async () => input.taskId
-        ? elicitApproval(server, tasks, await tasks.wait(input.taskId, input.cursor, input.waitMs, signal(extra.requestId)), extra.requestId, signal(extra.requestId))
-        : tasks.list(input.cursor)));
+    }, (input, extra) => result(async () => {
+        const pending = AbortSignal.any([signal(extra.requestId), extra.signal]);
+        return input.taskId
+            ? elicitApproval(server, tasks, await tasks.wait(input.taskId, input.cursor, input.waitMs, pending), extra.requestId, pending)
+            : tasks.list(input.cursor);
+    }));
     server.registerTool('dsh_send', { description: 'Explicitly queue a follow-up in a service-owned root session, including after an interruption. Optionally set provider, model and reasoningEffort (use exact IDs from dsh_models); selection is applied to this conversation before the follow-up. If omitted, DSH keeps its current/default selection. Use a new stable requestId for each follow-up. An ambiguous admission is never automatically resent. Does not approve host permissions.',
         inputSchema: z.object({ taskId: identity, requestId: identity, prompt, ...modelFields }).strict().superRefine((value, context) => {
             if ((value.provider === undefined) !== (value.model === undefined))
@@ -104,8 +109,8 @@ export function delegationMcpServer(tasks, signal, connectionId = '', requestDir
                 context.addIssue({ code: 'custom', message: 'reasoningEffort requires provider and model' });
         }),
         annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
-    }, input => result(() => tasks.send({ taskId: input.taskId, requestId: input.requestId, prompt: input.prompt,
-        connectionId, modelSelection: modelSelection(input) })));
+    }, (input, extra) => result(() => tasks.send({ taskId: input.taskId, requestId: input.requestId, prompt: input.prompt,
+        connectionId, modelSelection: modelSelection(input) }, AbortSignal.any([signal(extra.requestId), extra.signal]))));
     server.registerTool('dsh_cancel', { description: 'Request cancellation of a service-owned root and its managed descendants. Check the returned status; cancelling/unavailable do not confirm that all execution stopped. Already accepted external side effects cannot be undone.',
         inputSchema: z.object({ taskId: identity }).strict(),
         annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
@@ -158,7 +163,7 @@ export class ConnectionHttp {
     async start(port, token, maxConnections = 3) {
         if (this.server)
             throw new ConnectionError('already-listening');
-        const server = createServer((req, res) => { void this.handle(req, res, port, token, maxConnections).catch(() => { if (!res.headersSent)
+        const server = createServer((req, res) => { void this.handle(req, res, server, port, token, maxConnections).catch(() => { if (!res.headersSent)
             reply(res, 500, 'Request failed');
         else
             res.end(); }); });
@@ -174,10 +179,13 @@ export class ConnectionHttp {
         this.timer = setInterval(() => { void this.prune().catch(() => { }); }, 5000);
         this.timer.unref();
     }
-    async admit(body, maxConnections) {
+    async admit(body, maxConnections, server, signal) {
         if (!body || typeof body !== 'object' || body.method !== 'initialize')
             return false;
         await this.prune();
+        // Closing or restarting the listener invalidates admissions already awaiting I/O.
+        if (this.server !== server || signal.aborted)
+            return false;
         if (this.clients.size >= maxConnections)
             throw new ConnectionError('connection-limit');
         const id = randomUUID(), now = Date.now(), lifetime = new AbortController(), calls = new Map();
@@ -201,9 +209,17 @@ export class ConnectionHttp {
             await this.disconnect(id);
             throw error;
         }
+        if (this.server !== server || signal.aborted || lifetime.signal.aborted) {
+            await this.disconnect(id);
+            return false;
+        }
         return client;
     }
-    async handle(req, res, port, token, maxConnections) {
+    async handle(req, res, server, port, token, maxConnections) {
+        if (this.server !== server) {
+            reply(res, 503, 'MCP listener has closed');
+            return;
+        }
         const address = '127.0.0.1:' + port;
         if (req.headers.host !== address && req.headers.host !== 'localhost:' + port) {
             reply(res, 403, 'Invalid Host');
@@ -269,6 +285,10 @@ export class ConnectionHttp {
                     return;
                 }
             }
+            if (this.server !== server) {
+                reply(res, 503, 'MCP listener has closed');
+                return;
+            }
             const session = req.headers['mcp-session-id'];
             if (session !== undefined) {
                 client = typeof session === 'string' ? this.clients.get(session) ?? false : false;
@@ -279,7 +299,7 @@ export class ConnectionHttp {
             }
             else {
                 try {
-                    client = await this.admit(body, maxConnections);
+                    client = await this.admit(body, maxConnections, server, abort.signal);
                     admitted = !!client;
                 }
                 catch (error) {
@@ -311,16 +331,20 @@ export class ConnectionHttp {
             await client.transport.handleRequest(req, res, body);
         }
         finally {
-            if (client) {
-                client.active--;
-                client.lastSeen = Date.now();
-                if (requestId !== false && client.calls.get(requestId) === abort)
-                    client.calls.delete(requestId);
-                if (admitted && (!client.transport.sessionId || res.statusCode >= 400))
-                    await this.disconnect(client.id);
+            try {
+                if (client) {
+                    client.active--;
+                    client.lastSeen = Date.now();
+                    if (requestId !== false && client.calls.get(requestId) === abort)
+                        client.calls.delete(requestId);
+                    if (admitted && (!client.transport.sessionId || res.statusCode >= 400 || res.destroyed && !res.writableFinished))
+                        await this.disconnect(client.id);
+                }
+            }
+            finally {
+                this.pending.delete(abort);
+                this.requests--;
             }
-            this.pending.delete(abort);
-            this.requests--;
         }
     }
     async close() {
@@ -332,11 +356,16 @@ export class ConnectionHttp {
         }
         for (const pending of this.pending)
             pending.abort();
-        await Promise.all([...this.clients.keys()].map(id => this.disconnect(id)));
-        if (!server)
-            return;
-        server.closeAllConnections();
-        await new Promise(resolve => server.close(() => resolve()));
+        const clients = await Promise.allSettled([...this.clients.keys()].map(id => this.disconnect(id)));
+        if (server) {
+            server.closeAllConnections();
+            await new Promise(resolve => server.close(() => resolve()));
+        }
+        const failures = clients.filter(result => result.status === 'rejected').map(result => result.reason);
+        if (failures.length === 1)
+            throw failures[0];
+        if (failures.length > 1)
+            throw new AggregateError(failures, 'MCP client cleanup failed');
     }
 }
 //# sourceMappingURL=http.js.map