kczx-user-management 1.6.0 → 1.6.3

package/README.md

@@ -88,7 +88,7 @@ node scripts/ensure-deps.mjs                     # 仅当上述解析不到 sche
 |---|---|
 | 用户增删改查 | 用户表每行一个「编辑」**全屏页**：基本资料（部门 / 角色）+ 账号操作（重置密码 / 重置两步验证 / 禁用启用 / 删除）+ 权限与配额，集中一屏；改动类走「保存」，破坏性操作仍是各自带确认的按钮 |
 | 所属部门（1.6.0 起支持多层级） | 账号资料字段，支持**多层级路径**：用 `/` 分层，例如 `和平分局/刑侦大队/一中队`（`\` 也认，存的时候统一成 `/`）。新增用户时可填，编辑页可随时改或清空；编辑时框下会把层级摊开显示，并列出**已在用的层级**供一键接续；变更写进操作日志。规则（服务端为准，界面同款提示在前面）：最多 **5 级**、每一级 ≤ **24 字**、整串 ≤ **64 字**（含分隔符）；层级里不能有 `\ / : * ? " < > |`，也不能是 `.` / `..`——因为这些层级要变成目录名。写不进去的值**报错而不是悄悄改写**（理由同长度上限） |
-| 新建账号即建工作区 | 新增用户时勾选「同时创建该用户的工作区」：路径预填 `<harness 根>/<部门各级>/<用户名>`，**一级部门一个目录**（`…\和平分局\刑侦大队\zhang`；可改成任意绝对路径）；提交后目录按需创建、登记进 dsh 工作区列表，并把该路径写进这个账号的工作区白名单。部门不合法时**先报 400，再建目录**——不会留下半棵树 |
+| 新建账号即建工作区 | 新增用户时勾选「同时创建该用户的工作区」：路径预填 `<harness 根>/workspace/<部门各级>/<用户名>`，**一级部门一个目录**（`…\workspace\和平分局\刑侦大队\zhang`；可改成任意绝对路径）；提交后目录按需创建、登记进 dsh 工作区列表，并把该路径写进这个账号的工作区白名单。部门不合法时**先报 400，再建目录**——不会留下半棵树 |
 | 工作区白名单 | **留空 = 不允许任何工作区**（白名单默认拒绝）；填写后只允许这些目录下的工作区；条目 `*` = 允许全部。Windows 路径折叠大小写，末尾斜杠自动忽略 |
 | 工作区归属跟踪 | 谁创建的工作区归谁：别人看不到、也不能删改；删除后释放，账号删除后清理 |
 | 会话可见性（1.6.0 起） | 会话按**会话自己的工作目录**判定：目录不在本账号白名单内、或落在别人认领的工作区里，这个会话就不下发。**为什么必须有**：前端把「没有被任何可见工作区认领」的会话统统塞进「未分组」那一组——只藏工作区行的话，里面的会话会带着标题、点开即读的历史原地复活。**三个入口一起堵**：① `session.list`（0.1.1）/ `session/list`（0.1.2+）的一元响应；② 0.1.1 的 `host/session-added` 实时推送（`GET /api/events.host` 的 SSE——每个新建会话都会被推给所有在线浏览器，只改一元响应的话，别人新建一条就会把行实时推回来）；③ 0.1.2+ 的 `api-session/added`（`$events` mux 流上的 emit 帧）。`session.search` 沿用列表刚藏掉的 id 清单摘命中片段。判定只看 `cwd`：`blank` **不**豁免（别人目录里的「新建会话」行也还是别人的目录），只有子代理行（`origin: subagent`，前端本来就不列）和**读不到 cwd** 的行保留——「判断不了」不等于「不该看」 |
@@ -231,7 +231,8 @@ user-management:
 
 ### 部门层级（1.6.0 起）
 
-部门的「多层级」不是一张独立的部门表，而是**一个字符串里的路径**：`和平分局/刑侦大队/一中队`。这么定有两个好处——老数据不用迁移（原来的 `平台组` 就是单级），而且它正好就是工作区目录的形状：勾了「同时创建该用户的工作区」的账号，目录会一级一个文件夹地铺开。
+部门的「多层级」不是一张独立的部门表，而是**一个字符串里的路径**：`和平分局/刑侦大队/一中队`。这么定有两个好处——老数据不用迁移（原来的 `平台组` 就是单级），而且它正好就是工作区目录的形状：勾了「同时创建该用户的工作区」的账号，目录会一级一个文件夹地铺开
+（都挂在 `<harness 根>/workspace/` 这一层下面）。
 
 | 规则 | 值 |
 |---|---|
@@ -248,7 +249,8 @@ user-management:
 ### 新建用户时一并创建工作区（1.5.0 起）
 
 「用户 → 新增用户」多了一个复选框「同时创建该用户的工作区」。勾上后出现路径框，**预填**默认路径
-`<harness 根>/<部门>/<用户名>`（部门留空就少一层，只到用户名），可以直接改成任意绝对路径；下方一行小字写着默认值，
+`<harness 根>/workspace/<部门各级>/<用户名>`（部门留空就少一层，只到用户名；所有账号都在同一个 `workspace` 目录下，
+根目录因此不会被一堆部门目录铺满），可以直接改成任意绝对路径；下方一行小字写着默认值，
 改过之后还有「恢复默认」。不勾选则一切照旧。
 
 提交时服务端按这个顺序做事，**能失败的都在写账号之前失败**：

package/client/bundle.js

@@ -309,7 +309,7 @@ window.__ModuleLoader__.load({
       cfgFieldOtpFailLimit: '两步验证失败上限',
       cfgFieldOtpLockoutSeconds: '两步验证锁定时长（秒）',
       cfgFieldWorkspaceRoot: '新账号工作区根路径',
-      cfgHintWorkspaceRoot: '新建用户勾选「同时创建该用户的工作区」时，默认路径为 <根路径>/<部门>/<用户名>。留空 = 用宿主提供的工作区根路径（dsh 默认是 harness 所在目录）。',
+      cfgHintWorkspaceRoot: '新建用户勾选「同时创建该用户的工作区」时，默认路径为 <根路径>/workspace/<部门各级>/<用户名>。留空 = 用宿主提供的工作区根路径（dsh 默认是 harness 所在目录）。',
     }
 
     const EN = {
@@ -576,7 +576,7 @@ window.__ModuleLoader__.load({
       cfgFieldOtpFailLimit: '2FA failure limit',
       cfgFieldOtpLockoutSeconds: '2FA lockout (seconds)',
       cfgFieldWorkspaceRoot: 'Workspace root for new accounts',
-      cfgHintWorkspaceRoot: 'When a new account is created with “also create its workspace”, the default path is <root>/<department>/<username>. Empty = use the host’s own workspace root (dsh defaults to the harness directory).',
+      cfgHintWorkspaceRoot: 'When a new account is created with “also create its workspace”, the default path is <root>/workspace/<department levels>/<username>. Empty = use the host’s own workspace root (dsh defaults to the harness directory).',
     }
 
     /** Ledger event type → locale key (also the login-log type filter). */
@@ -634,6 +634,13 @@ window.__ModuleLoader__.load({
      * one that decides.
      */
     const DEPARTMENT_MAX_DEPTH = 5
+
+    /**
+     * The directory every default workspace lives under (mirror of
+     * WORKSPACE_SUBDIR in src/workspace-create.js): the preview must name the same
+     * folder the server will build, level for level.
+     */
+    const WORKSPACE_SUBDIR = 'workspace'
     const DEPARTMENT_MAX_LEVEL_LEN = 24
     const DEPARTMENT_MAX_LEN = 64
 
@@ -676,7 +683,7 @@ window.__ModuleLoader__.load({
 
     /**
      * The default workspace path, as the create-user dialog shows it:
-     * `<root>/<一级>/<二级>/…/<username>`.
+     * `<root>/workspace/<一级>/<二级>/…/<username>`.
      *
      * This is the DISPLAY twin of the host half's rule (src/workspace-create.js):
      * one folder PER department level, each folded into a directory name, joined
@@ -689,7 +696,7 @@ window.__ModuleLoader__.load({
       // No root = no preview: the dialog then asks for an absolute path instead of
       // showing a path relative to nothing.
       if (base === '') return ''
-      const parts = [base]
+      const parts = [base, WORKSPACE_SUBDIR]
       // The username is folded by the same rule as a level: it is one segment too.
       for (const raw of [...departmentLevels(department), username]) {
         const segment = String(raw === undefined || raw === null ? '' : raw)
@@ -1576,7 +1583,8 @@ window.__ModuleLoader__.load({
      *
      * Split out from the tab that opens it because the workspace half is the part
      * worth pinning down: the checkbox reveals a path box pre-filled with the
-     * default (`<harness root>/<department>/<username>`) and left editable, so the
+     * default (`<harness root>/workspace/<department levels>/<username>`) and left
+     * editable, so the
      * admin either accepts it or types another absolute path. As a component of its
      * own it can be rendered on demand — the tab's dialog otherwise only exists
      * after a click, which a contract test cannot perform.

package/client/index.js

@@ -299,7 +299,7 @@ const ZH = {
   cfgFieldOtpFailLimit: '两步验证失败上限',
   cfgFieldOtpLockoutSeconds: '两步验证锁定时长（秒）',
   cfgFieldWorkspaceRoot: '新账号工作区根路径',
-  cfgHintWorkspaceRoot: '新建用户勾选「同时创建该用户的工作区」时，默认路径为 <根路径>/<部门>/<用户名>。留空 = 用宿主提供的工作区根路径（dsh 默认是 harness 所在目录）。',
+  cfgHintWorkspaceRoot: '新建用户勾选「同时创建该用户的工作区」时，默认路径为 <根路径>/workspace/<部门各级>/<用户名>。留空 = 用宿主提供的工作区根路径（dsh 默认是 harness 所在目录）。',
 }
 
 const EN = {
@@ -566,7 +566,7 @@ const EN = {
   cfgFieldOtpFailLimit: '2FA failure limit',
   cfgFieldOtpLockoutSeconds: '2FA lockout (seconds)',
   cfgFieldWorkspaceRoot: 'Workspace root for new accounts',
-  cfgHintWorkspaceRoot: 'When a new account is created with “also create its workspace”, the default path is <root>/<department>/<username>. Empty = use the host’s own workspace root (dsh defaults to the harness directory).',
+  cfgHintWorkspaceRoot: 'When a new account is created with “also create its workspace”, the default path is <root>/workspace/<department levels>/<username>. Empty = use the host’s own workspace root (dsh defaults to the harness directory).',
 }
 
 /** Ledger event type → locale key (also the login-log type filter). */
@@ -624,6 +624,13 @@ function interpolate(template, vars) {
  * one that decides.
  */
 const DEPARTMENT_MAX_DEPTH = 5
+
+/**
+ * The directory every default workspace lives under (mirror of
+ * WORKSPACE_SUBDIR in src/workspace-create.js): the preview must name the same
+ * folder the server will build, level for level.
+ */
+const WORKSPACE_SUBDIR = 'workspace'
 const DEPARTMENT_MAX_LEVEL_LEN = 24
 const DEPARTMENT_MAX_LEN = 64
 
@@ -666,7 +673,7 @@ function departmentProblem(levels, t) {
 
 /**
  * The default workspace path, as the create-user dialog shows it:
- * `<root>/<一级>/<二级>/…/<username>`.
+ * `<root>/workspace/<一级>/<二级>/…/<username>`.
  *
  * This is the DISPLAY twin of the host half's rule (src/workspace-create.js):
  * one folder PER department level, each folded into a directory name, joined
@@ -679,7 +686,7 @@ function workspaceDefaultPath(root, sep, department, username) {
   // No root = no preview: the dialog then asks for an absolute path instead of
   // showing a path relative to nothing.
   if (base === '') return ''
-  const parts = [base]
+  const parts = [base, WORKSPACE_SUBDIR]
   // The username is folded by the same rule as a level: it is one segment too.
   for (const raw of [...departmentLevels(department), username]) {
     const segment = String(raw === undefined || raw === null ? '' : raw)
@@ -1566,7 +1573,8 @@ function EditUserPage({ user, me, departments, onClose, onDone, onTempPassword,
  *
  * Split out from the tab that opens it because the workspace half is the part
  * worth pinning down: the checkbox reveals a path box pre-filled with the
- * default (`<harness root>/<department>/<username>`) and left editable, so the
+ * default (`<harness root>/workspace/<department levels>/<username>`) and left
+ * editable, so the
  * admin either accepts it or types another absolute path. As a component of its
  * own it can be rendered on demand — the tab's dialog otherwise only exists
  * after a click, which a contract test cannot perform.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kczx-user-management",
-  "version": "1.6.0",
+  "version": "1.6.3",
   "type": "module",
   "description": "dsh 插件 · 登录门 + 账号 / 权限 / 配额 / 审计台账（dsh-passwords 的功能已并入）：HTTPS 登录网关与自签证书、用户增删改查（可一并创建工作区）、工作区白名单与归属跟踪、每小时 token 与每日时长配额、沙盒档位下限、上传/git 开关、三本审计台账（登录/访问/操作）、IP 封禁、TOTP 两步验证。",
   "license": "MIT",

package/src/dsh-wire.js

@@ -66,6 +66,9 @@ const SESSION_SEARCH_RE = /^\/api\/session[.\/]search$/
 /** 0.1.1's host event stream (SSE) — the live session-list push rides here. */
 const HOST_EVENT_STREAM_RE = /^\/api\/events[.\/]host$/
 
+/** 0.1.1's session event stream (SSE) — the live permission projection rides here. */
+const MUX_EVENT_STREAM_RE = /^\/api\/events[.\/]mux$/
+
 /** The forwarded event that asks a human for an allow/reject decision. */
 const APPROVAL_EVENT = 'approval/request'
 
@@ -152,6 +155,39 @@ function parseJsonObject(text) {
   return decoded
 }
 
+/**
+ * Parse one host→browser message of the 0.1.1 event-stream WebSocket.
+ *
+ * The generation difference that matters here: /api/events.mux and
+ * /api/events.host are not SSE responses to a browser — the host upgrades
+ * them to a WebSocket and sends ONE JSON ServerRequest envelope per text
+ * message ({ type:'server-request', rpcId, method, payload }, where method
+ * mirrors payload.type). The browser sends no business data on either
+ * socket; a client message makes the host close the connection.
+ *
+ * A validating reader, for the same reason as the mux half: an unparsed
+ * message is forwarded byte for byte, so a false positive would mean
+ * mis-reading somebody else's traffic.
+ */
+function parseServerRequestMessage(text) {
+  const value = parseJsonObject(text)
+  if (value === null) return null
+  if (value.type !== 'server-request') return null
+  if (value.payload === null || typeof value.payload !== 'object' || Array.isArray(value.payload)) return null
+  return value
+}
+
+/**
+ * Re-encode one replaced message of the same stream.
+ *
+ * `method` is kept in step with `payload.type` because the host writes both
+ * from one frame, and a client that reads `method` would otherwise be told
+ * about a frame the message is not carrying.
+ */
+function encodeServerRequestMessage(message, payload) {
+  return JSON.stringify({ ...message, method: payload.type, payload })
+}
+
 /** One workspace entry as the registry projects it. */
 function isWorkspaceView(value) {
   return value !== null && typeof value === 'object'
@@ -270,25 +306,82 @@ function sessionRowVisible(row, decide) {
 }
 
 /**
- * One `host/session-added` frame (0.1.1's host event stream), or null when the
- * frame is something else.
+ * Decide what to do with one frame of the host event stream.
+ *
+ * Why this is not the unary list rewrite alone: the 0.1.1 host PUSHES its
+ * registry news to every connected client over one stream — /api/events.host,
+ * which the host upgrades to a WebSocket (one ServerRequest text message per
+ * frame). A sidebar therefore grows rows for somebody else's conversation and
+ * GROUPS for somebody else's workspace without a single workspace.list or
+ * session.list call, and re-fetching the list (a page refresh) makes the
+ * leaked row vanish again: the unary answer was filtered, the push was not.
+ * That asymmetry is the whole reason this planner exists.
+ *
+ * Every frame carrying a workspace is judged by the SAME rules the list
+ * rewrite uses (visibleView / visibleId), so the two can never disagree:
+ *   - host/session-added — judged by its cwd, exactly like a list row;
+ *   - host/workspace-changed — the full new WorkspaceView after every durable
+ *     mutation, which includes ATTACHING a session to a workspace (creating a
+ *     session in it is what makes an invisible workspace reappear);
+ *   - host/workspace-removed — nothing to hide (it removes a row), but the
+ *     id→path harvest is dropped with it;
+ *   - host/workspace-order-changed — the registry order, filtered to the ids
+ *     this account may see, so a hidden workspace is not even named.
  *
- * The session list is not only a unary answer: the host also PUSHES every newly
- * created session to every connected client, which is how a row for somebody
- * else's conversation appears in a sidebar without a single `session.list`
- * call. The frame carries the same `cwd` the list row does, so it is judged by
- * the same rule.
+ * `views` carries EVERY workspace the frame described, visible or not, so the
+ * caller can harvest the id→path pairs a later session.create needs; the same
+ * posture as the workspace/follow stream of the newer generation.
  *
- * @returns 'drop' when the frame must not reach the browser, else null.
+ * @param frame - one ServerRequest envelope as the host writes it.
+ * @param decide - `{ visibleView(view), visibleId(id), sessionVisible(cwd) }`.
+ * @returns `{ action, value, views, removedId }` where action is
+ *          'pass' | 'drop' | 'replace' and `value` is the replacement payload
+ *          (only for 'replace').
  */
-function planHostSessionAdded(frame, decide) {
-  if (frame === null || typeof frame !== 'object') return null
-  if (frame.type !== 'server-request') return null
+function planHostFrame(frame, decide) {
+  const none = { action: 'pass', value: null, views: [], removedId: null }
+  if (frame === null || typeof frame !== 'object') return none
+  if (frame.type !== 'server-request') return none
   const payload = frame.payload
-  if (payload === null || typeof payload !== 'object' || payload.type !== 'host/session-added') return null
-  return sessionRowVisible(payload, decide) ? null : 'drop'
+  if (payload === null || typeof payload !== 'object' || Array.isArray(payload)) return none
+
+  if (payload.type === 'host/session-added') {
+    return sessionRowVisible(payload, decide) ? none : { ...none, action: 'drop' }
+  }
+
+  if (payload.type === 'host/workspace-changed') {
+    const workspace = payload.workspace
+    if (!isWorkspaceView(workspace)) return none
+    const views = [workspace]
+    // Dropping the push is what keeps an invisible workspace out of the
+    // client's list: the browser upserts whatever arrives, and its own list is
+    // never re-filtered until the next full fetch.
+    return decide.visibleView(workspace)
+      ? { ...none, views }
+      : { ...none, action: 'drop', views }
+  }
+
+  if (payload.type === 'host/workspace-removed') {
+    return {
+      ...none,
+      removedId: typeof payload.workspaceId === 'string' ? payload.workspaceId : null,
+    }
+  }
+
+  if (payload.type === 'host/workspace-order-changed') {
+    if (!Array.isArray(payload.workspaceIds)) return none
+    const kept = payload.workspaceIds.filter((id) => typeof id !== 'string' || decide.visibleId(id))
+    if (kept.length === payload.workspaceIds.length) return none
+    return { ...none, action: 'replace', value: { ...payload, workspaceIds: kept } }
+  }
+
+  // host/session-removed, host/session-status, host/agent-error,
+  // host/archived-sessions-changed, host/remote-event and anything a later
+  // host adds: no workspace and no session ROW to judge, so they pass.
+  return none
 }
 
+
 /**
  * One `api-session/added` forwarded event (0.1.2+), or null when the item is
  * something else.
@@ -306,6 +399,35 @@ function planForwardedSessionAdded(value, decide) {
   return sessionRowVisible(summary, decide) ? null : 'drop'
 }
 
+/**
+ * Clamp one `session/projection` or `session/event` frame from 0.1.1's session
+ * event stream, or null when the frame is something else (or needed no change).
+ *
+ * The live half of the sandbox cap. The unary history response carries the
+ * projection once, but every later change — including the one a picker click
+ * causes — arrives as a push on `/api/events.mux`, so a gateway that rewrites
+ * only the response leaves the browser showing a mode the account was refused.
+ *
+ * @param frame - one parsed SSE frame (the `server-request` envelope).
+ * @param clamp - the caller's `clampSessionHistorySandbox`; it mutates in place
+ *        and returns whether anything changed.
+ * @returns the same frame when it changed, else null (caller keeps the bytes).
+ */
+function planMuxStreamFrame(frame, clamp) {
+  if (frame === null || typeof frame !== 'object' || frame.type !== 'server-request') return null
+  const payload = frame.payload
+  if (payload === null || typeof payload !== 'object') return null
+  if (payload.type === 'session/projection' && payload.key === 'permissions') {
+    return clamp(payload) ? frame : null
+  }
+  if (payload.type === 'session/event' && payload.event !== null && typeof payload.event === 'object') {
+    const kind = payload.event.type
+    if (kind !== 'permission/preset' && kind !== 'sandbox/mode' && kind !== 'approval/policy') return null
+    return clamp(payload) ? frame : null
+  }
+  return null
+}
+
 /**
  * Drop the session rows an account may not see.
  *
@@ -458,6 +580,7 @@ export {
   SESSION_LIST_RE,
   SESSION_SEARCH_RE,
   HOST_EVENT_STREAM_RE,
+  MUX_EVENT_STREAM_RE,
   APPROVAL_EVENT,
   APPROVAL_GRANT,
   APPROVAL_DENIAL,
@@ -470,11 +593,14 @@ export {
   isWorkspaceView,
   parseMuxClientMessage,
   parseMuxServerMessage,
+  parseServerRequestMessage,
+  encodeServerRequestMessage,
   planWorkspaceFollowFrame,
   planSessionListFilter,
   planSessionSearchFilter,
-  planHostSessionAdded,
+  planHostFrame,
   planForwardedSessionAdded,
+  planMuxStreamFrame,
   sessionRowVisible,
   isApprovalGrant,
   denyRemoteEventResult,

package/src/gateway-core.js

@@ -60,6 +60,7 @@ import {
   APPROVAL_EVENT,
   EVENTS_RESULT_PATH,
   HOST_EVENT_STREAM_RE,
+  MUX_EVENT_STREAM_RE,
   REMOTE_MUX_PATH,
   SESSION_LIST_RE,
   SESSION_PAGE_RE,
@@ -74,8 +75,11 @@ import {
   isWorkspaceFollowEndpoint,
   parseMuxClientMessage,
   parseMuxServerMessage,
+  parseServerRequestMessage,
+  encodeServerRequestMessage,
   planForwardedSessionAdded,
-  planHostSessionAdded,
+  planHostFrame,
+  planMuxStreamFrame,
   planSessionListFilter,
   planSessionSearchFilter,
   planWorkspaceFollowFrame,
@@ -407,6 +411,14 @@ function createGateway(options) {
    * unary `session.list` answer alone still lets another account's conversation
    * appear as a row (under "未分组", since its workspace is hidden too).
    *
+   * This is the SSE carrier only, and no browser ever reaches it: the host
+   * answers `/api/events.host` to a browser with a WebSocket UPGRADE, which
+   * never becomes an HTTP response here (see createEventStreamInterceptor for
+   * that half, and note that both halves run the same planner). It is kept
+   * because the path is an SSE GET on the in-process fetch carrier, and because
+   * a non-upgrading client — a probe, a test fixture — must not be the reason
+   * the filter has a hole in it.
+   *
    * Returns null for every other request — in particular for a deployment on
    * 0.1.2+, which has no host event stream at all (its pushes ride the mux, see
    * createMuxInterceptor).
@@ -417,13 +429,26 @@ function createGateway(options) {
     const visibility = workspaceVisibility(req.umSession, permissionsFor(req.umSession))
     if (visibility === null) return null
     return createSseFilter({
-      onFrame: (frame) => {
-        visibility.refresh()
-        return planHostSessionAdded(frame, visibility)
-      },
+      onFrame: (frame) => planHostStreamDecision(frame, visibility),
     })
   }
 
+  /**
+   * One host-stream frame as the SSE carrier wants it: the bytes to keep, or a
+   * replacement document. The WebSocket carrier (createEventStreamInterceptor)
+   * asks the same planner and re-encodes it its own way — the two must never
+   * disagree about WHICH frames a restricted account may receive.
+   */
+  function planHostStreamDecision(frame, visibility) {
+    visibility.refresh()
+    const plan = planHostFrame(frame, visibility)
+    if (plan.action === 'drop') return 'drop'
+    if (plan.action === 'replace') {
+      return { ...frame, method: plan.value.type, payload: plan.value }
+    }
+    return null
+  }
+
   /**
    * Frame-level enforcement for one accepted Remote mux connection.
    *
@@ -434,10 +459,15 @@ function createGateway(options) {
    *
    * Returns null — leaving the connection a plain byte pipe — when the account
    * has neither a workspace restriction nor a sandbox cap, or when the upgrade
-   * is not the mux at all (a 0.1.1-rc.2 host has no mux route).
+   * is not one of this layer's streams: a 0.1.1-rc.2 host has no mux route at
+   * all, and its own two event streams are handled by
+   * createEventStreamInterceptor.
    */
   function createMuxInterceptor(req) {
-    if (requestPath(req) !== REMOTE_MUX_PATH) return null
+    const path = requestPath(req)
+    // Two generations, two WebSocket shapes: the multiplexed mux above, and
+    // the 0.1.1 event streams the host upgrades one-per-path.
+    if (path !== REMOTE_MUX_PATH) return createEventStreamInterceptor(req, path)
     const session = req.umSession || null
     const perms = permissionsFor(session)
     const visibility = workspaceVisibility(session, perms)
@@ -495,6 +525,77 @@ function createGateway(options) {
     })
   }
 
+  /**
+   * Frame-level enforcement for one accepted 0.1.1-rc.2 event-stream upgrade.
+   *
+   * The transport difference that hid this door: `/api/events.host` and
+   * `/api/events.mux` LOOK like the SSE responses streamFilterFor rewrites, and
+   * on the in-process (fetch) carrier they are. A BROWSER never sees that
+   * shape — the host upgrades both paths to a WebSocket and sends one
+   * `ServerRequest` text message per frame — so the SSE filter never ran for a
+   * real client and every live push arrived unfiltered while the unary answers
+   * stayed filtered. That asymmetry is exactly what a person sees as "the
+   * workspace appears in the other account's sidebar, and a refresh takes it
+   * away again": workspace.list was rewritten, host/workspace-changed was not.
+   *
+   * One rule per stream:
+   *   - `/api/events.host` carries the registry news — a session was added, a
+   *     workspace was changed (the host pushes the whole new WorkspaceView
+   *     after every durable mutation, and attaching a session to a workspace
+   *     IS one), removed, or reordered — judged by the same plan the unary
+   *     rewrites use;
+   *   - `/api/events.mux` carries live session frames, clamped to the
+   *     account's sandbox cap exactly like the history response.
+   *
+   * Returns null — leaving the connection a plain byte pipe — for an account
+   * that hides nothing and has no sandbox cap, and for every other upgrade.
+   */
+  function createEventStreamInterceptor(req, path) {
+    const isHostStream = HOST_EVENT_STREAM_RE.test(path)
+    const isMuxStream = MUX_EVENT_STREAM_RE.test(path)
+    if (!isHostStream && !isMuxStream) return null
+
+    const session = req.umSession || null
+    const perms = permissionsFor(session)
+    const visibility = isHostStream ? workspaceVisibility(session, perms) : null
+    const allowedMode = isMuxStream && perms && typeof perms.sandboxMode === 'string' && perms.sandboxMode !== ''
+      ? perms.sandboxMode
+      : null
+    if (visibility === null && allowedMode === null) return null
+
+    return createMuxFilter({
+      // Downlink only: the host closes the socket on any client message, so
+      // there is nothing to read and nothing to remember.
+      parseClientMessage: () => null,
+      parseServerMessage: parseServerRequestMessage,
+      encodeServerMessage: encodeServerRequestMessage,
+      onServerMessage: (message) => {
+        if (visibility !== null) {
+          visibility.refresh()
+          const plan = planHostFrame(message, visibility)
+          // Harvest first, filter second — including workspaces this account
+          // cannot see, so a later session.create that names one by id still
+          // resolves to a path and is refused for the right reason.
+          for (const view of plan.views) workspacePathById.set(view.workspaceId, view.path)
+          if (plan.removedId !== null) workspacePathById.delete(plan.removedId)
+          if (plan.action === 'drop') return { action: 'drop' }
+          if (plan.action === 'replace') return { action: 'replace', value: plan.value }
+        }
+        if (allowedMode !== null) {
+          // planMuxStreamFrame knows the 0.1.1 frame vocabulary (session/event,
+          // session/projection) that clampStreamItem does not: it serves the
+          // 0.1.2 session/follow items instead.
+          const planned = planMuxStreamFrame(
+            message,
+            (payload) => clampSessionHistorySandbox(payload, allowedMode),
+          )
+          if (planned !== null) return { action: 'replace', value: planned.payload }
+        }
+        return null
+      },
+    })
+  }
+
   /**
    * The workspace-visibility rules for one account, in the shape BOTH the
    * unary list rewrite and the 0.1.2+ follow stream need.

package/src/index.js

@@ -718,7 +718,8 @@ async function handleApi(req, res, deps) {
    * The root the console builds per-account workspaces under.
    *
    * Read by the create-user form so it can prefill the default path
-   * (<root>/<department levels>/<username>, one folder per level). Admin-only:
+   * (<root>/workspace/<department levels>/<username>, one folder per level).
+   * Admin-only:
    * the value is a path on the
    * host, which is exactly what a plain account must not be handed.
    */
@@ -1112,7 +1113,8 @@ const Config = z.object({
   lockoutSeconds: z.natural().min(1).default(60),
   // ── per-account workspaces (the "create user" flow) ──────────────────────
   // Root the console builds a new account's workspace under:
-  // <workspaceRoot>/<department>/<username>. Empty (the default) asks the
+  // <workspaceRoot>/workspace/<department levels>/<username>. Empty (the
+  // default) asks the
   // running host for it — the sandbox policy's own workspaceRoot, which dsh
   // defaults to the harness's process cwd — and falls back to process.cwd().
   // Set it explicitly to park every account folder on another volume.

package/src/mux-filter.js

@@ -1,14 +1,24 @@
 'use strict'
 
 /**
- * The Remote-mux frame transformer: the WebSocket half of the 0.1.2+ API.
+ * The WebSocket frame transformer: the codec every live dsh stream is
+ * enforced through.
  *
- * dsh multiplexes every Remote stream over one WebSocket (`/api/remote.mux`),
- * where each logical stream is a `streamId` the browser opened with an
- * `{ type:'open', streamId, endpoint, payload }` text message. Enforcement
- * that used to be a response rewrite (the workspace list) or a request rewrite
- * (an approval answer) therefore has to happen inside the frames — which is
- * what this module does, and why it owns a WebSocket codec at all.
+ * Two generations share it, and they differ only in vocabulary:
+ *   - 0.1.2+ multiplexes every Remote stream over one WebSocket
+ *     (`/api/remote.mux`), where each logical stream is a `streamId` the
+ *     browser opened with an `{ type:'open', streamId, endpoint, payload }`
+ *     text message;
+ *   - 0.1.1-rc.2 upgrades `/api/events.host` and `/api/events.mux` to a
+ *     WebSocket of their own and sends one `ServerRequest` envelope per text
+ *     message (`{ type:'server-request', rpcId, method, payload }`), with no
+ *     client traffic at all.
+ *
+ * Enforcement that used to be a response rewrite (the workspace list) or a
+ * request rewrite (an approval answer) therefore has to happen inside the
+ * frames — which is what this module does, and why it owns a WebSocket codec
+ * at all. The parsers and the replacement encoder are injected by the caller,
+ * so this file stays transport mechanics and the policy stays in gateway-core.
  *
  * Scope, deliberately narrow:
  *   - only server→browser frames are ever rewritten; the browser→host
@@ -135,9 +145,11 @@ function encodeTextFrame(text) {
  * Build the per-connection transformer.
  *
  * @param handlers - `{ onClientMessage(message), onServerMessage(message,
- *        endpoint) }`. `onServerMessage` returns null/'pass' to leave the
- *        frame alone, `{ action: 'drop' }` to swallow it, or
- *        `{ action: 'replace', value }` to send a different item value.
+ *        endpoint), encodeServerMessage(message, value) }`. `onServerMessage`
+ *        returns null/'pass' to leave the frame alone, `{ action: 'drop' }` to
+ *        swallow it, or `{ action: 'replace', value }` to send a different
+ *        value. `encodeServerMessage` is optional and owns the replacement's
+ *        wire shape; without it the Remote mux item envelope is assumed.
  * @returns `{ observeClientChunk, filterServerChunk, streamEndpoint,
  *          pendingBytes, disabled }`.
  */
@@ -209,6 +221,23 @@ function createMuxFilter(handlers) {
     return out.length === 1 ? out[0] : Buffer.concat(out)
   }
 
+  /**
+   * Re-encode one replaced message. The default is the Remote mux's own item
+   * shape; the 0.1.1 event streams carry a different envelope and pass their
+   * own encoder, because the two generations share this codec but not their
+   * wire vocabulary. An encoder that throws or returns nothing keeps the
+   * original bytes: a replacement nobody could encode is not worth a frame.
+   */
+  function encodeReplacement(message, value) {
+    if (typeof options.encodeServerMessage === 'function') {
+      try {
+        const text = options.encodeServerMessage(message, value)
+        return typeof text === 'string' && text !== '' ? text : null
+      } catch { return null }
+    }
+    return JSON.stringify({ type: 'item', streamId: message.streamId, value })
+  }
+
   function transformServerFrame(frame) {
     if (!frame.fin || frame.opcode !== OPCODE_TEXT) return frame.raw
     const message = parseServer(frame)
@@ -218,7 +247,8 @@ function createMuxFilter(handlers) {
     if (decision === null) return frame.raw
     if (decision.action === 'drop') return null
     if (decision.action === 'replace') {
-      return encodeTextFrame(JSON.stringify({ type: 'item', streamId: message.streamId, value: decision.value }))
+      const text = encodeReplacement(message, decision.value)
+      return text === null ? frame.raw : encodeTextFrame(text)
     }
     return frame.raw
   }

package/src/permissions.js

@@ -354,8 +354,17 @@ function sanitizeHiddenUnicodeJson(value, depth = 0) {
  * wider mode without a single action from anyone — an escalation with no
  * approval step to intercept.
  *
- * Rewrites in place: `permission/preset` events, `sandbox/mode` events, and
- * the projected `currentValue` the client displays as the active preset.
+ * Rewrites in place: `permission/preset` events, `sandbox/mode` events, the
+ * projected `currentValue` the client displays as the active preset, and the
+ * `options` list the picker renders.
+ *
+ * Why the OPTIONS list matters: clamping only the active value leaves the wider
+ * presets on the menu. They stay clickable, and the click is refused a round
+ * trip later — which reads as "the cap does not work" even though the mode never
+ * changed. Only presets the rank table KNOWS to be wider are removed; anything
+ * unrecognised (a deployment's own preset name) is left alone, because hiding a
+ * narrow custom preset would be worse than listing it, and the request gate
+ * still refuses it fail-closed if it really is wider.
  *
  * @returns whether anything changed.
  */
@@ -383,6 +392,13 @@ function clampSessionHistorySandbox(value, allowedMode, depth = 0) {
     value.currentValue = allowedMode
     changed = true
   }
+  if (Array.isArray(value.options) && typeof value.currentValue === 'string') {
+    const kept = value.options.filter((option) => !widerThan(option && option.value))
+    if (kept.length !== value.options.length) {
+      value.options = kept
+      changed = true
+    }
+  }
 
   for (const key of Object.keys(value)) {
     const nested = value[key]

package/src/proxy.js

@@ -553,6 +553,13 @@ function createProxy(upstream, getAuthenticatedUrl, hooks) {
             socket.write(split.header)
             writeFiltered(upstreamSocket, socket, mux, split.rest)
             upstreamSocket.on('data', (next) => writeFiltered(upstreamSocket, socket, mux, next))
+            // The plain path lets pipe() carry the upstream's FIN to the
+            // browser; once frames go through a filter there is no pipe, so the
+            // end has to be forwarded by hand. Without it the browser answers
+            // the close frame and then waits for a transport close that never
+            // comes: the socket (and the tab's half of it) hangs around forever.
+            upstreamSocket.on('end', () => { if (!socket.writableEnded) socket.end() })
+            upstreamSocket.on('error', () => { if (!socket.destroyed) socket.destroy() })
             // Observational only: the browser's bytes reach the host
             // unchanged, so a parse miss costs the connection nothing.
             socket.on('data', (browserChunk) => mux.observeClientChunk(browserChunk))

package/src/sse-filter.js

@@ -56,11 +56,18 @@ function dataPayload(block) {
   return parts.length === 0 ? null : parts.join('\n')
 }
 
+/** Re-encode one event block from a replaced payload. */
+function encodeBlock(payload) {
+  return Buffer.from(`data: ${JSON.stringify(payload)}\n\n`, 'utf8')
+}
+
 /**
  * Build the per-connection filter.
  *
- * @param handlers - `{ onFrame(parsedJson) }`, returning 'drop' to swallow the
- *        event block it was given (anything else keeps it).
+ * @param handlers - `{ onFrame(parsedJson) }`. Return 'drop' to swallow the
+ *        event block, a different object to REPLACE it (re-encoded as one
+ *        `data:` block — the caller mutated it in place), or anything else to
+ *        keep the original bytes.
  * @returns `{ push(chunk), disabled(), pendingBytes() }`.
  */
 function createSseFilter(handlers) {
@@ -90,7 +97,10 @@ function createSseFilter(handlers) {
       const taken = takeBlock(buffer)
       if (taken === null) break
       buffer = taken.rest
-      if (decide(taken.block) !== 'drop') out.push(taken.block)
+      const decision = decide(taken.block)
+      if (decision === 'drop') continue
+      if (decision !== null && typeof decision === 'object') out.push(encodeBlock(decision))
+      else out.push(taken.block)
     }
     if (buffer.length > MAX_PENDING_BYTES) {
       out.push(buffer)
@@ -110,4 +120,4 @@ function createSseFilter(handlers) {
   }
 }
 
-export { createSseFilter, MAX_PENDING_BYTES }
+export { createSseFilter, encodeBlock, MAX_PENDING_BYTES }

package/src/workspace-create.js

@@ -4,8 +4,9 @@
  * Workspace provisioning for the console's "create user" flow.
  *
  * An account created by an administrator may come with its own workspace. The
- * DEFAULT home is `<harness root>/<department levels>/<username>` (one folder
- * per department level); the admin may type any other absolute path instead. This module owns the pure half of that — the
+ * DEFAULT home is `<harness root>/workspace/<department levels>/<username>`
+ * (one folder per department level, all of them under a single `workspace`
+ * directory); the admin may type any other absolute path instead. This module owns the pure half of that — the
  * path arithmetic and its validation — plus the directory step, so both are
  * verifiable without a store, a request or a running dsh.
  *
@@ -26,6 +27,16 @@ import { departmentLevels, StoreError } from './store.js'
 
 /** Longest path this module will hand to the filesystem. */
 const MAX_PATH_LEN = 1024
+/**
+ * The single directory every default workspace lives under:
+ * `<root>/workspace/<department levels>/<username>`.
+ *
+ * One level between the harness root and the accounts, so the root keeps its
+ * own files (the checkout, its config, whatever else lives there) beside a
+ * single `workspace` folder instead of being mixed with one folder per
+ * department.
+ */
+const WORKSPACE_SUBDIR = 'workspace'
 /** Longest directory name built out of free text (a department is capped at 64
  *  characters by the store, and a username at 32). */
 const MAX_SEGMENT_LEN = 64
@@ -55,10 +66,10 @@ export function sanitizeSegment(value) {
 
 /**
  * The default workspace for one account:
- * `<root>/<一级>/<二级>/…/<username>`.
+ * `<root>/workspace/<一级>/<二级>/…/<username>`.
  *
  * A multi-level department becomes NESTED folders, one per level, so the tree on
- * disk mirrors the organisation: `E:\work\和平分局\刑侦大队\zhang`. A blank
+ * disk mirrors the organisation: `E:\work\workspace\和平分局\刑侦大队\zhang`. A blank
  * department drops its segments instead of inventing a placeholder — the username
  * alone is already unique, and a folder named after nothing is worse than one
  * level less.
@@ -75,7 +86,7 @@ export function sanitizeSegment(value) {
  * @returns an absolute path built with the host separator.
  */
 export function defaultWorkspacePath(root, department, username) {
-  const parts = [String(root === undefined || root === null ? '' : root).trim()]
+  const parts = [String(root === undefined || root === null ? '' : root).trim(), WORKSPACE_SUBDIR]
   for (const level of departmentLevels(department)) {
     const segment = sanitizeSegment(level)
     if (segment !== '') parts.push(segment)
@@ -127,6 +138,12 @@ export function resolveWorkspaceTarget({ root, department, username, custom } =
   if (sameWorkspacePath(path, base)) {
     throw new StoreError('bad_workspace_path', '工作区不能就是 harness 根目录本身（该目录是所有账号工作区的父目录）')
   }
+  // The container is off limits for the same reason: a username that sanitizes
+  // away would otherwise turn the folder every account lives under into one
+  // account's workspace.
+  if (sameWorkspacePath(path, join(base, WORKSPACE_SUBDIR))) {
+    throw new StoreError('bad_workspace_path', `工作区不能就是 ${WORKSPACE_SUBDIR} 目录本身（该目录是所有账号工作区的父目录）`)
+  }
   return { path, root: base, source }
 }