Merge remote-tracking branch 'origin/master' into fix-webplugins-watch-flake

# Conflicts:
#	packages/host/webserver/src/web-plugins.ts
#	packages/host/webserver/tests/web-plugins.spec.ts

packages/examples/tui-demo/tests/tui-agent.spec.ts

@@ -1,4 +1,5 @@
 import { describe, expect, it } from 'vitest'
+import { join } from 'node:path'
 import type { Context } from 'cordis'
 import Loader from '@cordisjs/plugin-loader'
 import { TOOL_ORDER_REST } from '@deepseek-ai/dsh-system-prompt'
@@ -60,7 +61,7 @@ describe('dsh-tui-demo app', () => {
     ])
     expect(calls[0]?.config).toBeUndefined()
     expect(calls[2]?.config).toEqual({ root: '/tmp/tui-sessions', compression: 'none' })
-    expect(calls[4]?.config).toEqual({ path: '/tmp/tui-sessions/session-query.db' })
+    expect(calls[4]?.config).toEqual({ path: join('/tmp/tui-sessions', 'session-query.db') })
     expect(calls[5]?.config).toEqual({
       maxReferences: 2,
       candidateLimit: 7,

packages/fs/tool-fs/tests/tools.spec.ts

@@ -7,7 +7,7 @@ import { describe, expect, it, vi } from 'vitest'
 import { Context } from 'cordis'
 import { mkdirSync, mkdtempSync, realpathSync, rmSync, symlinkSync } from 'node:fs'
 import { tmpdir } from 'node:os'
-import { join, sep } from 'node:path'
+import { join, resolve, sep } from 'node:path'
 import { CallId } from '@deepseek-ai/dsh-llm'
 import SystemPrompt, { renderPrompt } from '@deepseek-ai/dsh-system-prompt'
 import ToolRegistry from '@deepseek-ai/dsh-tools'
@@ -729,13 +729,13 @@ describe('sandbox escalation surface (write/edit)', () => {
   it('a plain write stamps the default mode with the calling session root', async () => {
     const { ctx, fs } = await setupConfining()
     await call(ctx, 'write', { file_path: 'a.txt', content: 'x' }, escalationAgent())
-    expect(fs.stamped).toEqual([{ mode: 'workspace-write', workspaceRoot: '/session-project' }])
+    expect(fs.stamped).toEqual([{ mode: 'workspace-write', workspaceRoot: resolve('/session-project') }])
   })
 
   it('a standing session override folds onto the stamp', async () => {
     const { ctx, fs } = await setupConfining()
     await call(ctx, 'write', { file_path: 'a.txt', content: 'x' }, escalationAgent([{ type: 'sandbox/mode', data: { mode: 'read-only' } }]))
-    expect(fs.stamped).toEqual([{ mode: 'read-only', workspaceRoot: '/session-project' }])
+    expect(fs.stamped).toEqual([{ mode: 'read-only', workspaceRoot: resolve('/session-project') }])
   })
 
   it('a denied write maps to the shared marker plus the escalation hint (isError)', async () => {
@@ -768,7 +768,7 @@ describe('sandbox escalation surface (write/edit)', () => {
       agent: escalationAgent() as never,
       signal: new AbortController().signal,
     })
-    expect(fs.stamped).toEqual([{ mode: 'danger-full-access', workspaceRoot: '/session-project' }])
+    expect(fs.stamped).toEqual([{ mode: 'danger-full-access', workspaceRoot: resolve('/session-project') }])
   })
 
   it('a rejected escalation fails closed with its own text and never mutates', async () => {

packages/host/webserver/README.md

@@ -8,6 +8,8 @@ Client-disconnect detection hangs off the **response** `close` event, not the re
 
 A request whose handling throws (a malformed %-escape hitting `decodeURIComponent`, a client dropping mid-body) is answered 400 — or the socket destroyed when headers are already out — and reported to `onError`; it never becomes a process-killing unhandled rejection.
 
+In development, the client-plugin registry synchronously captures each built bundle's stat baseline before it returns, then polls those baselines and re-hashes changed content. Each rescan stages its candidate table, graph, and watch map before publishing them, so a baseline failure preserves the prior graph. An immediate rebuild therefore cannot disappear into an asynchronously established watch baseline; a rename window marks the path dirty, retains the last successful baseline, and forces a re-hash when the bundle reappears even with identical metadata.
+
 ## Model Experience
 
 None, as the package is a pure HTTP carrier between the browser and the injected API handler; nothing here reaches a model request.

packages/host/webserver/src/web-plugins.ts

@@ -22,7 +22,7 @@
  */
 
 import { createHash } from 'node:crypto'
-import { readFileSync, statSync } from 'node:fs'
+import { readFileSync, statSync, type Stats } from 'node:fs'
 import { dirname, join } from 'node:path'
 import type { Context } from 'cordis'
 
@@ -105,13 +105,10 @@ export interface WebPluginRegistryDeps {
   /** Sink for rescan failures (the initial scan throws instead — misconfiguration fails loud at load). */
   onError: (err: Error) => void
   /**
-   * Dev-mode bundle watching: one registry-owned interval stat-polls every
-   * scanned row's client bundle (polling by design: network mounts deliver no
-   * inotify events) and re-hashes + notifies onRebuilt subscribers on change.
-   * Each row's stat baseline is captured synchronously before its content is
-   * hashed, so a rebuild landing while the registry constructs is still
-   * detected on the first tick (fs.watchFile's asynchronous baseline lost
-   * that window). Absent = no watching (prod composition).
+   * Dev-mode bundle watching: stat-poll every scanned row's client bundle
+   * with an explicit stat baseline (polling by design: network mounts deliver
+   * no inotify events) and re-hash + notify onRebuilt subscribers on change.
+   * Absent = no watching (prod composition).
    */
   watch?: {
     /** Stat-poll interval in milliseconds; default 500 (the build-side watcher's polling default). */
@@ -130,15 +127,13 @@ interface DshClientDeclaration {
 interface WebPluginRecord {
   entry: WebBootEntry
   clientPath: string
-  /**
-   * Bundle stat captured immediately BEFORE the content read that produced
-   * `entry.rev` — the watch baseline. The stat→read order makes a write
-   * racing the scan converge instead of being absorbed: landing between stat
-   * and read leaves the hash newer than the baseline (next tick re-hashes to
-   * the same rev, no spurious notify); landing after the read leaves the
-   * baseline older (next tick detects, re-hashes, notifies).
-   */
-  stat: { mtimeMs: number; size: number }
+}
+
+interface WatchedBundle {
+  path: string
+  mtimeMs: number
+  size: number
+  dirty: boolean
 }
 
 /** Narrow an unknown parsed JSON value to the dshClient declaration, throwing on malformed fields. */
@@ -215,59 +210,84 @@ export function createHostWebPluginRegistry(deps: WebPluginRegistryDeps): HostWe
     throw new Error(`web-plugins: watch.intervalMs must be a positive integer (got ${String(deps.watch?.intervalMs)})`)
   }
 
+  const stageWatches = (
+    candidateTable: Map<string, WebPluginRecord>,
+    currentWatches: Map<string, WatchedBundle>,
+  ): Map<string, WatchedBundle> => {
+    const candidateWatches = new Map<string, WatchedBundle>()
+    if (watchInterval === undefined) return candidateWatches
+    for (const [id, record] of candidateTable) {
+      const current = currentWatches.get(id)
+      if (current?.path === record.clientPath) {
+        candidateWatches.set(id, { ...current })
+        continue
+      }
+      const baseline = statSync(record.clientPath)
+      candidateWatches.set(id, {
+        path: record.clientPath,
+        mtimeMs: baseline.mtimeMs,
+        size: baseline.size,
+        dirty: false,
+      })
+    }
+    return candidateWatches
+  }
+
   let table = scan(deps)
   let graph = composeGraph(table)
+  let watched = stageWatches(table, new Map())
   const rebuildListeners = new Set<(id: string, rev: string) => void>()
 
   const rebuilt = (id: string): string | undefined => {
     const record = table.get(id)
     if (record === undefined) return undefined
-    // stat BEFORE read, like scan(): a write racing this pair converges (see
-    // WebPluginRecord.stat) instead of desynchronizing baseline and rev.
-    const stat = statSync(record.clientPath)
     const rev = shortHash(readFileSync(record.clientPath))
-    record.stat = { mtimeMs: stat.mtimeMs, size: stat.size }
     record.entry = graphRow(id, rev, record.entry.inject, record.entry.immediately === true)
     graph = composeGraph(table)
     return rev
   }
 
-  // Dev bundle watch: one registry-owned setInterval stat-polls every table
-  // row against the record's own baseline. fs.watchFile is unusable here: it
-  // captures its comparison baseline with an ASYNCHRONOUS first stat, so a
-  // rebuild landing between scan()'s content read and that stat is absorbed
-  // into the baseline and never reported — and the missed window is exactly
-  // registry construction, when a dev build is most likely to be finishing.
-  // The record baseline has no such window: scan()/rebuilt() stat before they
-  // read, so any write the hash missed is newer than the baseline and lands
-  // on the next tick. A torn read of a half-written bundle self-heals the
-  // same way — the ongoing write keeps changing the stats.
-  const pollTick = (): void => {
-    for (const [id, record] of table) {
-      let stat: { mtimeMs: number; size: number }
+  // Dev bundle watch: capture every row's baseline synchronously before the
+  // registry is returned, then poll those baselines. fs.watchFile establishes
+  // its first baseline asynchronously, so an immediate rebuild can otherwise
+  // become the baseline and disappear without an observed delta.
+  const pollWatches = (): void => {
+    for (const [id, watch] of watched) {
+      let current: Stats
       try {
-        stat = statSync(record.clientPath)
+        current = statSync(watch.path)
       } catch (error) {
         const code = (error as NodeJS.ErrnoException).code
-        if (code === 'ENOENT') continue // mid-rename window; the completed write lands on a later tick
+        if (code === 'ENOENT') {
+          watch.dirty = true
+          continue
+        }
         deps.onError(error instanceof Error ? error : new Error(String(error)))
         continue
       }
-      if (stat.mtimeMs === record.stat.mtimeMs && stat.size === record.stat.size) continue
-      const before = record.entry.rev
+      if (!watch.dirty && current.mtimeMs === watch.mtimeMs && current.size === watch.size) continue
+      const before = table.get(id)?.entry.rev
       let rev: string | undefined
       try {
         rev = rebuilt(id)
       } catch (error) {
         const code = (error as NodeJS.ErrnoException).code
-        if (code === 'ENOENT') continue // vanished between stat and read; same self-heal
+        if (code === 'ENOENT') {
+          watch.dirty = true
+          continue
+        }
+        watch.mtimeMs = current.mtimeMs
+        watch.size = current.size
         deps.onError(error instanceof Error ? error : new Error(String(error)))
         continue
       }
+      watch.mtimeMs = current.mtimeMs
+      watch.size = current.size
+      watch.dirty = false
       if (rev === undefined || rev === before) continue
       for (const notify of rebuildListeners) {
-        // A throwing subscriber must not skip later subscribers or escape
-        // into the timer callback (that would kill the process).
+        // A throwing subscriber must not skip later subscribers or escape the
+        // polling callback into the process event loop.
         try {
           notify(id, rev)
         } catch (error) {
@@ -276,8 +296,8 @@ export function createHostWebPluginRegistry(deps: WebPluginRegistryDeps): HostWe
       }
     }
   }
-  const pollTimer = watchInterval === undefined ? undefined : setInterval(pollTick, watchInterval)
-  pollTimer?.unref()
+  const watchTimer = watchInterval === undefined ? undefined : setInterval(pollWatches, watchInterval)
+  watchTimer?.unref()
 
   let pending = false
   const unsubscribe = deps.ctx.on('internal/plugin', () => {
@@ -286,10 +306,12 @@ export function createHostWebPluginRegistry(deps: WebPluginRegistryDeps): HostWe
     queueMicrotask(() => {
       pending = false
       try {
-        // The poll iterates `table` directly, so the swap also retargets the
-        // watch: fresh records carry fresh stat baselines from scan().
-        table = scan(deps)
-        graph = composeGraph(table)
+        const candidateTable = scan(deps)
+        const candidateGraph = composeGraph(candidateTable)
+        const candidateWatches = stageWatches(candidateTable, watched)
+        table = candidateTable
+        graph = candidateGraph
+        watched = candidateWatches
       } catch (error) {
         // Keep serving the previous graph: a mid-flight rescan failure must not
         // take down the boot manifest for plugins that were fine.
@@ -308,7 +330,8 @@ export function createHostWebPluginRegistry(deps: WebPluginRegistryDeps): HostWe
     },
     dispose: () => {
       unsubscribe()
-      if (pollTimer !== undefined) clearInterval(pollTimer)
+      if (watchTimer !== undefined) clearInterval(watchTimer)
+      watched.clear()
       rebuildListeners.clear()
     },
   }
@@ -330,13 +353,8 @@ function scan(deps: WebPluginRegistryDeps): Map<string, WebPluginRecord> {
       throw new Error(`web-plugins: ${name} declares dshClient but exports no "./client" bundle`)
     }
     const clientPath = join(dirname(pkgPath), clientRel)
-    const stat = statSync(clientPath)
     const rev = shortHash(readFileSync(clientPath))
-    table.set(name, {
-      entry: graphRow(name, rev, decl.inject, decl.immediately === true),
-      clientPath,
-      stat: { mtimeMs: stat.mtimeMs, size: stat.size },
-    })
+    table.set(name, { entry: graphRow(name, rev, decl.inject, decl.immediately === true), clientPath })
   }
   return table
 }

packages/host/webserver/tests/web-plugins.spec.ts

@@ -1,11 +1,41 @@
-import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
+import {
+  mkdirSync,
+  mkdtempSync,
+  statSync,
+  type PathLike,
+  type Stats,
+  unlinkSync,
+  utimesSync,
+  writeFileSync,
+} from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { Context } from 'cordis'
-import { describe, expect, it, vi } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import { createHostWebPluginRegistry, injectBootManifest } from '../src/index.ts'
 import type { LoaderEntryView, WebPluginRegistryDeps } from '../src/index.ts'
 
+const fsControl = vi.hoisted(() => ({ failNextStatPath: undefined as string | undefined }))
+
+vi.mock('node:fs', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('node:fs')>()
+  return {
+    ...actual,
+    statSync: (path: PathLike): Stats => {
+      if (String(path) === fsControl.failNextStatPath) {
+        fsControl.failNextStatPath = undefined
+        throw Object.assign(new Error('staged bundle missing'), { code: 'ENOENT' })
+      }
+      return actual.statSync(path)
+    },
+  }
+})
+
+afterEach(() => {
+  fsControl.failNextStatPath = undefined
+  vi.useRealTimers()
+})
+
 /** Write a fake installed package (package.json + optional client bundle) and return its package.json path. */
 function makePkg(root: string, name: string, pkg: Record<string, unknown>, withBundle = true): string {
   const dir = join(root, name.replaceAll('/', '__'))
@@ -151,8 +181,8 @@ describe('createHostWebPluginRegistry', () => {
     // The old fs.watchFile watch captured its comparison baseline with an
     // ASYNCHRONOUS first stat; a rewrite in the same tick as construction was
     // absorbed into that baseline and never reported (the CI flake). The
-    // record-baseline poll stats synchronously before hashing, so this exact
-    // timing must now always notify.
+    // synchronous stageWatches baseline stats before the registry returns, so
+    // this exact timing must now always notify.
     const { deps, root } = makeDeps([{ name: 'watched', pkg: webDecl() }])
     deps.watch = { intervalMs: 20 }
     const registry = createHostWebPluginRegistry(deps)
@@ -168,6 +198,58 @@ describe('createHostWebPluginRegistry', () => {
     registry.dispose()
   })
 
+  it('watch mode: a failed rescan baseline preserves the published table and graph', async () => {
+    const { deps, entries, errors, ctx, root } = makeDeps([
+      { name: 'stable', pkg: webDecl() },
+      { name: 'late', pkg: webDecl(), loaded: false },
+    ])
+    deps.watch = { intervalMs: 1_000 }
+    const registry = createHostWebPluginRegistry(deps)
+    const before = registry.graph()
+
+    ;(entries[1] as { fiber?: unknown }).fiber = {}
+    fsControl.failNextStatPath = join(root, 'late', 'lib', 'client.js')
+    ctx.emit('internal/plugin', ctx.fiber)
+    await Promise.resolve()
+
+    expect(errors[0]?.message).toContain('staged bundle missing')
+    expect(registry.graph()).toBe(before)
+    expect(registry.clientPath('late')).toBeUndefined()
+
+    ctx.emit('internal/plugin', ctx.fiber)
+    await Promise.resolve()
+    expect(registry.graph().entries.map(row => row.id)).toEqual(['stable', 'late'])
+    registry.dispose()
+  })
+
+  it('watch mode: a missing bundle forces a re-hash when identical metadata reappears', async () => {
+    vi.useFakeTimers()
+    const { deps, root } = makeDeps([{ name: 'watched', pkg: webDecl() }])
+    const bundle = join(root, 'watched', 'lib', 'client.js')
+    const fixedTime = new Date(1_600_000_000_000)
+    utimesSync(bundle, fixedTime, fixedTime)
+    deps.watch = { intervalMs: 20 }
+    const registry = createHostWebPluginRegistry(deps)
+    const baseline = statSync(bundle)
+    const rebuilds: { id: string; rev: string }[] = []
+    registry.onRebuilt((id, rev) => rebuilds.push({ id, rev }))
+
+    unlinkSync(bundle)
+    await vi.advanceTimersByTimeAsync(20)
+    writeFileSync(bundle, 'x'.repeat(baseline.size))
+    utimesSync(bundle, fixedTime, fixedTime)
+    const restored = statSync(bundle)
+    expect({ mtimeMs: restored.mtimeMs, size: restored.size }).toEqual({
+      mtimeMs: baseline.mtimeMs,
+      size: baseline.size,
+    })
+    await vi.advanceTimersByTimeAsync(20)
+
+    expect(rebuilds).toHaveLength(1)
+    expect(registry.graph().entries[0]?.rev).toBe(rebuilds[0]?.rev)
+    registry.dispose()
+  })
+
   it('rejects a non-positive or non-integer watch interval at build time', () => {
     for (const intervalMs of [0, -5, 1.5]) {
       const { deps } = makeDeps([{ name: 'p', pkg: webDecl() }])

packages/pty/pty-local/README.md

@@ -1,12 +1,12 @@
 # @deepseek-ai/dsh-pty-local
 
-Local `node-pty` backend for `ctx.pty`. It starts an interactive shell under the shared `ctx.sandboxPolicy`, strips credential-shaped ambient environment variables, retains bounded line-oriented output, detects readiness, and tears down the captured process tree rooted at the `node-pty` child.
+Local Linux/macOS `node-pty` backend for `ctx.pty`; loading it on another platform fails as unsupported. It starts an interactive shell under the shared `ctx.sandboxPolicy`, strips credential-shaped ambient environment variables, retains bounded line-oriented output, detects readiness, and tears down the captured process tree rooted at the `node-pty` child.
 
 ## Plugin (`pty-local`)
 
 The plugin injects `pty`, `sandbox`, and `sandboxPolicy`, then registers the configured backend type (`shell`). `danger-full-access` starts the shell directly; confined modes wrap the exact shell argv through `ctx.sandbox`. The effective session mode is resolved at spawn. A change to a different effective mode is rejected before its `sandbox/mode` event commits while that owner has an open PTY or a spawn in progress; the fence is attached to the exact owner and therefore outlives a local-provider reload that retains existing sessions. Wait for creation to settle and close the sessions before changing modes, so a terminal opened with wider access cannot survive a downgrade.
 
-Linux readiness combines a foreground-verified private bash prompt marker, foreground-process-group syscall inspection, silence fallback, and absolute timeout. macOS uses the verified prompt marker plus silence/timeout because it has no `/proc` syscall surface. A marker is not ready until printable prompt text arrives, including when the OSC marker and `PS1` are split across data callbacks. Unrecognized or unreadable process state is never a positive exact-idle signal. During unpublished startup, a fallback requires observed output; zero-output silence cannot publish an empty session, and timeout rejects the spawn. Cancellation closes the unpublished shell and rejects with the caller's exact abort reason even when its foreground process group is not observable yet; if that close fails, `PtyBackendCleanupError` separately preserves the cleanup failure for registry disposal. Incomplete terminal-control sequences are bounded by `maxReadBytes` and discarded through their terminator after crossing that limit; a trailing carriage return is carried across callbacks so split CRLF becomes one newline.
+Linux readiness combines a foreground-verified private bash prompt marker, foreground-process-group syscall inspection, silence fallback, and absolute timeout. macOS uses the verified prompt marker plus silence/timeout because it has no `/proc` syscall surface. A marker is not ready until printable prompt text arrives, including when the OSC marker and `PS1` are split across data callbacks; when bash prints the marker before the kernel publishes its return to the foreground process group, polling retains the candidate until bash ownership is observable or the ordinary silence bound expires. An interactive child that inherits `PROMPT_COMMAND` therefore cannot suppress inferred-idle readiness until the absolute timeout. Unrecognized or unreadable process state is never a positive exact-idle signal. During unpublished startup, a fallback requires observed output; zero-output silence cannot publish an empty session, and timeout rejects the spawn. Cancellation closes the unpublished shell and rejects with the caller's exact abort reason even when its foreground process group is not observable yet; if that close fails, `PtyBackendCleanupError` separately preserves the cleanup failure for registry disposal. Incomplete terminal-control sequences are bounded by `maxReadBytes` and discarded through their terminator after crossing that limit; a trailing carriage return is carried across callbacks so split CRLF becomes one newline.
 
 Send cancellation resolves the current foreground process group and delivers a real `SIGINT`; it never emulates interruption by writing `\x03`, so raw-mode programs remain cancellable. Close sends `SIGTERM` to descendants, waits, then sends `SIGKILL` to the union of captured survivors and newly scanned descendants so reparenting cannot hide a process from teardown. It verifies that every retained identity is gone or, on Linux, a non-executing zombie before stopping the shell; zombie entries are quiescent and are reaped as the shell exits. A survivor failure does not cache a permanently rejected close; a later close retries the teardown.
 

packages/pty/pty-local/src/session.ts

@@ -288,11 +288,12 @@ export class LocalPtySession implements PtyBackendSession {
     if (sanitized.prompt) {
       const foregroundPgid = this.inspector.foregroundPgid(this.pid)
       if (this.shellPgid === undefined) this.shellPgid = foregroundPgid
-      if (foregroundPgid !== undefined && foregroundPgid === this.shellPgid) {
-        this.promptSeen = true
-        this.promptTextSeen = sanitized.promptText === true
-        this.lastOutputAt = Date.now()
-      }
+      // Bash can print PROMPT_COMMAND before the kernel publishes its return
+      // to the foreground process group. Retain the marker; polling below is
+      // the authority that accepts it only after bash owns the foreground.
+      this.promptSeen = true
+      this.promptTextSeen = sanitized.promptText === true
+      this.lastOutputAt = Date.now()
     } else if (this.promptSeen && sanitized.promptText === true) {
       this.promptTextSeen = true
     }
@@ -312,8 +313,11 @@ export class LocalPtySession implements PtyBackendSession {
       return
     }
     if (this.promptSeen && this.promptTextSeen && Date.now() - this.lastOutputAt >= this.config.pollIntervalMs) {
-      this.settleActive('stdin_read')
-      return
+      const pgid = this.inspector.foregroundPgid(this.pid)
+      if (this.shellPgid !== undefined && pgid === this.shellPgid) {
+        this.settleActive('stdin_read')
+        return
+      }
     }
     const elapsed = Date.now() - operation.startedAt
     const startupHasOutput = !this.initializing || this.scrollback.snapshot().text.length > 0
@@ -324,6 +328,10 @@ export class LocalPtySession implements PtyBackendSession {
         return
       }
     }
+    // A prompt candidate can race bash's foreground handoff, but an interactive
+    // child also inherits PROMPT_COMMAND. Silence therefore remains the bound
+    // on waiting for shell ownership instead of letting a child marker suppress
+    // readiness until the absolute timeout.
     if (startupHasOutput && Date.now() - this.lastOutputAt >= this.config.idleSilenceMs) {
       this.settleActive('inferred_idle')
       return

packages/pty/pty-local/tests/index.spec.ts

@@ -187,7 +187,12 @@ describe('LocalPtyBackend startup rollback', () => {
       kill() { exitListener?.({ exitCode: 0, signal: 15 }) },
       resize() {}, clear() {}, pause() {}, resume() {},
     } as IPty
-    const backend = new LocalPtyBackend(ctx, config(), inspector, () => terminal)
+    const backend = new LocalPtyBackend(
+      ctx,
+      config(),
+      { ...inspector, foregroundPgid: () => terminal.pid },
+      () => terminal,
+    )
     const session = await backend.spawn(spec(agent(ctx)))
     expect(session.motd).toBe('dsh> ')
     await session.close('test complete')

packages/pty/pty-local/tests/session.spec.ts

@@ -286,7 +286,7 @@ describe('LocalPtySession readiness and output', () => {
     expect(session.motd).toBe('dsh> ')
   })
 
-  it('trusts prompt markers only while the startup shell owns the foreground group', async () => {
+  it('retains a prompt marker until the startup shell regains the foreground group', async () => {
     vi.useFakeTimers()
     const terminal = new FakeTerminal()
     const inspector = new FakeInspector()
@@ -297,15 +297,30 @@ describe('LocalPtySession readiness and output', () => {
     let settled = false
     void operation.done.then(() => { settled = true })
     inspector.pgid = 789
-    terminal.emitData('\x1b]133;D;0\x07spoofed')
-    await vi.advanceTimersByTimeAsync(10)
+    terminal.emitData('\x1b]133;D;0\x07dsh> ')
+    await vi.advanceTimersByTimeAsync(40)
     expect(settled).toBe(false)
 
     inspector.pgid = 456
-    terminal.emitData('\x1b]133;D;0\x07dsh> ')
     await vi.advanceTimersByTimeAsync(10)
+    expect(settled).toBe(true)
     expect((await operation.done).waitReason).toBe('stdin_read')
   })
+
+  it('falls back to inferred idle when a foreground child emits an inherited prompt marker', async () => {
+    vi.useFakeTimers()
+    const terminal = new FakeTerminal()
+    const inspector = new FakeInspector()
+    const session = new LocalPtySession(terminal.asPty(), inspector, config())
+    await initialize(session, terminal)
+
+    const operation = session.startSend({ text: 'bash -i', submit: true })
+    inspector.pgid = 789
+    terminal.emitData('\x1b]133;D;0\x07child> ')
+    await vi.advanceTimersByTimeAsync(100)
+
+    expect((await operation.done).waitReason).toBe('inferred_idle')
+  })
 })
 
 describe('LocalPtySession bounds, signals, and teardown', () => {

packages/sandbox/sandbox-policy/tests/policy.spec.ts

@@ -69,7 +69,7 @@ describe('SandboxPolicyService', () => {
     })
   })
 
-  it('resolves a symlink-sensitive session cwd with filesystem semantics', async () => {
+  it.skipIf(process.platform === 'win32')('resolves a symlink-sensitive session cwd with POSIX component semantics', async () => {
     const root = mkdtempSync(join(tmpdir(), 'dsh-policy-cwd-'))
     try {
       const lexical = join(root, 'lexical')
@@ -78,7 +78,7 @@ describe('SandboxPolicyService', () => {
       mkdirSync(lexical)
       mkdirSync(child, { recursive: true })
       const link = join(lexical, 'link')
-      symlinkSync(child, link, process.platform === 'win32' ? 'junction' : 'dir')
+      symlinkSync(child, link, 'dir')
       const cwd = `${link}${sep}..`
       const ctx = await mounted({ mode: 'workspace-write', workspaceRoot: '/fallback' })
 

packages/sandbox/sandbox/tests/roots.spec.ts

@@ -14,7 +14,7 @@ import { canonicalPath, writableRoots } from '@deepseek-ai/dsh-sandbox'
 describe('canonicalPath', () => {
   it('resolves symlinks (an existing path realpaths)', () => {
     const dir = mkdtempSync(join(tmpdir(), 'dsh-roots-'))
-    expect(canonicalPath(dir)).toBe(realpathSync(dir))
+    expect(canonicalPath(dir)).toBe(realpathSync.native(dir))
   })
 
   it('returns the spelling as-is when the path cannot be resolved (conservative — matches nothing until it exists)', () => {
@@ -30,9 +30,9 @@ describe('writableRoots', () => {
   it('workspace-write grants the workspace root plus the platform temp areas, canonical and deduplicated', () => {
     const ws = mkdtempSync(join(tmpdir(), 'dsh-ws-'))
     const roots = writableRoots({ mode: 'workspace-write', workspaceRoot: ws })
-    expect(roots).toContain(realpathSync(ws))
+    expect(roots).toContain(realpathSync.native(ws))
     expect(roots).toContain(canonicalPath('/tmp'))
-    expect(roots).toContain(realpathSync(tmpdir()))
+    expect(roots).toContain(realpathSync.native(tmpdir()))
     // Deduplicated after canonicalization (/tmp and os.tmpdir() may coincide).
     expect(new Set(roots).size).toBe(roots.length)
   })

packages/sdk/create-sdk/tests/link-workspace.e2e.ts

@@ -1,7 +1,7 @@
 import { execFile } from 'node:child_process'
 import { existsSync } from 'node:fs'
 import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
+import { homedir, tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { promisify } from 'node:util'
@@ -20,6 +20,15 @@ const repoRoot = fileURLToPath(new URL('../../../../', import.meta.url))
 const builtScripts = join(repoRoot, 'packages/sdk/scripts/lib/bin.js')
 const temporary: string[] = []
 
+function resolveCorepackHome(): string {
+  return process.env.COREPACK_HOME ?? join(
+    process.env.XDG_CACHE_HOME
+      ?? process.env.LOCALAPPDATA
+      ?? join(homedir(), process.platform === 'win32' ? 'AppData/Local' : '.cache'),
+    'node/corepack',
+  )
+}
+
 afterEach(async () => {
   await Promise.all(temporary.splice(0).map(path => rm(path, { recursive: true, force: true })))
 })
@@ -71,13 +80,16 @@ describe.skipIf(!existsSync(builtScripts))('live-linked generated projects', ()
         }
       `)
       const cacheRoot = join(tmpdir(), 'dsh-sdk-link-cache', name)
+      const pnpmStore = name === 'pnpm'
+        ? (await execFileAsync(name, ['store', 'path', '--silent'], { encoding: 'utf8' })).stdout.trim()
+        : undefined
       const commandEnvironment = {
         ...scrubEnvironment(),
-        COREPACK_HOME: join(cacheRoot, 'corepack'),
-        XDG_CACHE_HOME: join(cacheRoot, 'cache'),
+        COREPACK_HOME: resolveCorepackHome(),
+        ...name === 'pnpm' ? {} : { XDG_CACHE_HOME: join(cacheRoot, 'cache') },
         XDG_DATA_HOME: join(cacheRoot, 'data'),
         npm_config_cache: join(cacheRoot, 'npm'),
-        pnpm_config_store_dir: join(cacheRoot, 'pnpm-store'),
+        ...pnpmStore === undefined ? {} : { pnpm_config_store_dir: pnpmStore },
       }
       await execFileAsync(name, manager.installCommand(), {
         cwd: root,

packages/session-persistence/session-persistence-jsonl/tests/jsonl.spec.ts

@@ -251,17 +251,15 @@ describe('SessionPersistenceJsonl: durability and crash semantics', () => {
   })
 
   it('surfaces non-ENOENT snapshot stat failures after discovery', async () => {
-    const blocker = join(root, 'snapshot-not-a-directory')
-    await writeFile(blocker, 'x')
     const persistence = ctx.sessionPersistence as unknown as {
       listArtifacts(): Promise<Array<{ header: SessionHeader; path: string }>>
     }
     const discovery = vi.spyOn(persistence, 'listArtifacts').mockResolvedValue([{
       header: meta('snapshot-stat-failure'),
-      path: join(blocker, 'session.jsonl'),
+      path: `${root}\0snapshot-stat-failure`,
     }])
 
-    await expect(ctx.sessionPersistence.listSnapshots()).rejects.toThrow(/ENOTDIR/)
+    await expect(ctx.sessionPersistence.listSnapshots()).rejects.toThrow(/null bytes/)
     discovery.mockRestore()
   })
 

packages/support/acp-snapshot/README.md

@@ -6,7 +6,7 @@ Four layers, importable separately:
 
 - **`launchAcpTestAgent` (launcher)** — boots a source agent under tsx or a built `lib` agent under plain Node from a supplied cwd, connects the SDK client over a raw-byte stdout tee, collects session updates and stderr, surfaces asynchronous spawn failures through startup, fails closed on unhandled permission requests, and owns graceful or signalled shutdown. Shutdown waits for process exit, inherited stdio closure, and ACP parser exhaustion before resolving or propagating a child error, so captures are complete and callers can remove owned paths after either outcome. When Windows accepts forced termination but publishes its exit marker asynchronously, shutdown gives that marker a bounded grace before treating fallback refusal as a second failure. Snapshot and ordinary e2e suites share this process boundary; a test supplies only agent paths, cwd, environment overrides, and any permission policy.
 - **`runScenario` (harness)** — drives ACP JSON-RPC stdio from a deterministic `input.json` script through the launcher, tees raw stdout for the expected-output and purity checks, and harvests every persisted raw JSONL session log (parent and subagent children, primary-first) after graceful stdin EOF. `AgentUnderTest` supplies absolute `binScript`, optional `libBinScript`, `configPath`, and `tsconfigPath` paths because the subprocess cwd is outside the repo; `workspaceParent` may move the generated child cwd from the platform temp directory when that grant is itself under test. Startup failures preserve captured agent stderr in the rejected diagnostic.
-- **Normalizers** — pure functions turning the two captured surfaces into stable text: `normalizeStdout` (JSON-RPC ids → first-seen sequence; UUIDs/cwd → tokens; cwd-rooted separators selected as canonical `/` or host-native; `session_info_update.updatedAt` → `{{updatedAt}}`; doubles as the stdout-purity check), `normalizeSessionLog` (times zeroed, `seq` kept, the same cwd-path policy), `scrubSystemPrompts` (prompt text → `{{system}}`), `scrubToolSchemas` (schema bulk → `{{tools}}`), and `scrubRequestHeaders` (all header bulk → `{{system}}`/`{{tools}}`/`{{messagePrefix}}` outside each pin, structure kept — [pinned-header Agent Note](../../../.agents/notes/implemented/testing/2026-07-06-pin-request-header-content-in-one-scenario.md)).
+- **Normalizers** — pure functions turning the two captured surfaces into stable text: `normalizeStdout` (JSON-RPC ids → first-seen sequence; UUIDs and every native/JavaScript filesystem spelling of the generated cwd → tokens, longest-first; cwd-rooted separators selected as canonical `/` or host-native; `session_info_update.updatedAt` → `{{updatedAt}}`; doubles as the stdout-purity check), `normalizeSessionLog` (times zeroed, `seq` kept, the same cwd-path policy), `scrubSystemPrompts` (prompt text → `{{system}}`), `scrubToolSchemas` (schema bulk → `{{tools}}`), and `scrubRequestHeaders` (all header bulk → `{{system}}`/`{{tools}}`/`{{messagePrefix}}` outside each pin, structure kept — [pinned-header Agent Note](../../../.agents/notes/implemented/testing/2026-07-06-pin-request-header-content-in-one-scenario.md)).
 - **`defineAcpSnapshotSuite` (factory)** — registers the whole describe/it tree for a scenario table: per-scenario expected-output and re-persisted-log comparisons, record/refresh fixture write-back, rejection of structured `UNKNOWN_TOOL` results, the per-header-class pin (`system-prompt.expected.md` plus `tool-schemas.expected.json`) with its live uniformity guard, and the fixture guard block (no orphan scenario dirs, required files present, exactly one pin per class, every JSONL prompt/schema-scrubbed, non-pinning fixtures fully header-scrubbed). Refresh expands packed timing envelopes before aligning existing volatile event times, so switching between packed and unpacked layouts cannot shift later records; fresh chunk-fragment arrays remain authoritative. A newly inserted `session/title` receives its preceding event's time so feature-driven insertions do not churn the remainder of a fixture. Each scenario directory's `session.jsonl` plus contiguous `session.<n>.jsonl` siblings are the ordered primary/child inventory; the scenario table does not duplicate their count. Must be called at vitest collection time.
 
 A consuming `*.snapshot.ts` is the scenario table plus one factory call:

packages/support/acp-snapshot/src/harness.ts

@@ -17,7 +17,7 @@
  */
 
 import { cp, mkdtemp, readFile, readdir, rm } from 'node:fs/promises'
-import { existsSync } from 'node:fs'
+import { existsSync, realpathSync } from 'node:fs'
 import { createHash } from 'node:crypto'
 import { tmpdir } from 'node:os'
 import { basename, dirname, join, delimiter } from 'node:path'
@@ -141,6 +141,8 @@ export interface RunResult {
   sessionId?: string
   /** The generated cwd the session ran in (the bash workspace). */
   cwd: string
+  /** Filesystem-resolved spellings of {@link cwd} that child processes may report. */
+  cwdAliases: string[]
   /**
    * Every persisted session log harvested after the run, ordered primary-first:
    * the top-level (parent) session — the one with no `parentSession` — then each
@@ -222,6 +224,7 @@ export function snapshotSpillRoot(
  */
 export async function runScenario(input: InputScript, opts: RunOptions): Promise<RunResult> {
   const cwd = await mkdtemp(join(opts.workspaceParent ?? tmpdir(), 'acp-snap-cwd-'))
+  const cwdAliases = [...new Set([realpathSync(cwd), realpathSync.native(cwd)])]
   const sessionsRoot = await mkdtemp(join(tmpdir(), 'acp-snap-sessions-'))
   // Fixed path length: spill-policy budgets the preview against the REAL path
   // before stdout normalization, so tmpdir() length differences churn expected outputs.
@@ -329,6 +332,7 @@ export async function runScenario(input: InputScript, opts: RunOptions): Promise
       rawStdout: launched.rawStdout(),
       stderr: launched.stderr(),
       cwd,
+      cwdAliases,
       ...sessionId !== undefined ? { sessionId } : {},
       sessionLogs,
     }

packages/support/acp-snapshot/src/normalize.ts

@@ -46,6 +46,8 @@ export interface NormalizeContext {
   sessionIds: string[]
   /** The generated cwd the run used — replaced with `{{cwd}}`. */
   cwd: string
+  /** Other filesystem spellings of the same cwd (for example Windows short and long paths). */
+  cwdAliases?: readonly string[]
 }
 
 /** How cwd-rooted path separators are represented after the cwd is tokenized. */
@@ -60,9 +62,13 @@ export interface NormalizeOptions {
 /** Replace cwd, session ids, and any stray UUID with stable tokens in a string. */
 function scrubString(value: string, ctx: NormalizeContext, cwdPathMode: CwdPathMode): string {
   let out = value
-  // cwd first (longest, most specific), then explicit session ids, then any
-  // residual UUID (covers ids that appear in places we didn't enumerate).
-  out = out.split(ctx.cwd).join(CWD)
+  // Filesystem APIs can report one directory with several spellings. Replace
+  // every known spelling longest-first so a shorter alias cannot corrupt a
+  // longer one before it is tokenized.
+  const cwdSpellings = [...new Set([ctx.cwd, ...ctx.cwdAliases ?? []])]
+    .filter(spelling => spelling.length > 0)
+    .sort((left, right) => right.length - left.length)
+  for (const spelling of cwdSpellings) out = out.split(spelling).join(CWD)
   out = out.split(`/private${CWD}`).join(CWD)
   if (cwdPathMode === 'canonical') {
     // Restrict separator conversion to paths rooted at the cwd token. A global

packages/support/acp-snapshot/src/suite.ts

@@ -629,6 +629,7 @@ export function defineAcpSnapshotSuite(options: SnapshotSuiteOptions): void {
             ...result.sessionLogs.map(l => l.id),
           ],
           cwd: result.cwd,
+          cwdAliases: result.cwdAliases,
         }
 
         // Record writes live model fixtures; keyless refresh writes every comparable replayed

packages/support/acp-snapshot/tests/normalize.spec.ts

@@ -44,6 +44,24 @@ describe('normalizeStdout', () => {
     expect(out).not.toContain(ctx.sessionIds[0] as string)
   })
 
+  it('scrubs every filesystem spelling of the cwd longest-first', () => {
+    const longCwd = String.raw`C:\Users\runneradmin\AppData\Local\Temp\acp-snapshot`
+    const aliasedCtx: NormalizeContext = {
+      sessionIds: [],
+      cwd: String.raw`C:\Users\RUNNER~1\AppData\Local\Temp\acp-snapshot`,
+      cwdAliases: [
+        longCwd,
+        String.raw`C:\Users\runneradmin\AppData\Local\Temp\acp`,
+      ],
+    }
+    const raw = JSON.stringify({
+      cwd: longCwd,
+      path: `${longCwd}\\nested\\proof.txt`,
+    })
+    const frame = JSON.parse(normalizeStdout(raw, aliasedCtx)) as { cwd: string; path: string }
+    expect(frame).toEqual({ cwd: '{{cwd}}', path: '{{cwd}}/nested/proof.txt' })
+  })
+
   it('canonicalizes only cwd-rooted path separators', () => {
     const windowsCtx: NormalizeContext = {
       sessionIds: [],

packages/ui/tui/tests/tui.spec.ts

@@ -1877,7 +1877,7 @@ describe('pi-tui chat lifecycle and transcript', () => {
     await mkdir(join(cwd, 'docs'), { recursive: true })
     await writeFile(join(cwd, 'src', 'source-file.ts'), 'export const source = true\n')
     await writeFile(join(cwd, 'docs', 'design notes.md'), '# Design\n')
-    await writeFile(join(cwd, 'unsafe\nfile.ts'), 'unsafe name\n')
+    await writeFile(join(cwd, 'unsafe\u007ffile.ts'), 'unsafe name\n')
     const result = await setup({
       cwd,
       tools: {