flymysql · flymysql · Sep 17, 2026 · Sep 17, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,19 @@
 
 All notable changes to **dsh-remote**.
 
+## 0.8.19 — 2026-09-17
+### 侧栏文件接口按会话绑定机器（Desktop 多机阻断项）
+
+- `/dsh-remote/ls`、`/read`、`/write`、`/fs` 接受 `sessionId`（或 `local=` 镜像路径），走与 `rw_*` 相同的 mirror binding；本地会话返回 403，不再落到「当前机器」连接池。
+- 工作区选择器仍不带 `sessionId`，继续使用当前机器（设为当前后再浏览）。
+- 客户端 explorer / 文件 tab / 原生右侧栏都会把 `sessionId` 附在请求上；保存使用 `expectedMtime` 乐观锁。
+- 大文件预览改为 SFTP `readPartial` 范围读，不再整文件 `fastGet` 到可预测的临时路径。
+- 同步默认 `depth=8` / `maxFiles=2000`，结果带明确 `TRUNCATED`；POSIX 远端 `rw_search` 优先 `rg`/`grep -R`，失败再 SFTP walk。
+- 拆出 `lib/pool.js`、`lib/routes-fs.js`、`lib/remote-fs.js`；host-key TOFU 守卫进 `lib/hostkey.js`。
+- 文档：中英文 README / `package.json` 工具数（20）/ `PUBLISH.md` 对齐当前功能。
+
+**验证**：`npm test`；新增 session-fs / desktop-fs / remote-fs 回归。Desktop 完整 GUI 仍标实验性，但侧栏选机阻断项已修。
+
 ## 0.8.18 — 2026-09-16
 ### 变更：解除 dsh-better-sidebar 硬绑定
 

diff --git a/PUBLISH.md b/PUBLISH.md
@@ -1,57 +1,54 @@
 # Publish Guide — dsh-remote
 
-## 1. Create the GitHub repository
+Current product: a **remote-work assistant** for DeepSeek Harness (multi-machine
+SSH, remote workspace picker, 20 `rw_*` tools, conflict-aware SFTP sync, port
+forwarding, optional sidebar editor). This is **not** the early “print SSH
+tunnel commands” plugin.
 
-https://github.com/new → name **`dsh-remote`**, Public, description:
+## 1. Version and changelog
 
-> Remote-access assistant for DeepSeek Harness: /remote command and a settings page that print the exact SSH tunnel / reverse-tunnel / reverse-proxy commands (harness intentionally binds loopback only).
+Bump `package.json` `version`, add a section to `CHANGELOG.md`, keep
+`README.md` / `README.zh.md` in sync (tool list, Desktop notes).
 
-Add topic **`dsh-plugin`** (plus `deepseek-harness`, `remote`, `ssh`).
-
-## 2. Push
+## 2. Checks
 
 ```bash
-cd dsh-remote
-git init -b main && git add -A
-git commit -m "feat: dsh-remote — remote-access assistant for DeepSeek Harness
-
-- /remote slash command printing exact tunnel commands
-- Settings page (远程访问) with live port, LAN IPs, copy buttons
-- local-forward / autossh / reverse-tunnel / reverse-proxy guidance
-- respects the harness safety design (loopback-only, no 0.0.0.0 hack)"
-git branch -M main
-git remote add origin https://github.com/flymysql/dsh-remote.git
-git push -u origin main
+for f in lib/*.js; do node --check "$f"; done
+node check.mjs
+npm test
 ```
 
+Optional: `scripts/boot-smoke.sh` if a desktop harness is installed.
+
 ## 3. Publish to npm
 
 ```bash
-npm publish    # needs a Granular Access Token with Bypass-2FA (npm 2026 policy)
+npm publish    # Granular Access Token with Bypass-2FA (npm 2026 policy)
+```
+
+GitHub: tag `vX.Y.Z` and paste the CHANGELOG section into the release notes.
+
+## 4. Topics / discovery
+
+Repo **About → Topics**:
+
+```
+dsh-plugin  deepseek-harness  remote  ssh  tunnel  plugin
 ```
 
-## 4. Community submissions
+README must reference `docs/cover.png` with a **relative** path so GitHub Topics
+can show a card image.
 
-Open issues in the awesome lists with this template (see the dsh-memory run: https://github.com/flymysql/dsh-memory):
+## 5. Install blurb (awesome lists)
 
 ```markdown
 ## dsh-remote
 
-Remote-access assistant for DeepSeek Harness: the harness web GUI intentionally
-binds loopback only (--host 0.0.0.0 is rejected for safety), so remote access is a
-tunneling workflow. This plugin makes it copy-paste easy.
+Remote-work assistant for DeepSeek Harness: connect to SSH machines, pick a
+remote workspace, and let the agent operate there (list/read/edit/exec/sync)
+without exposing the harness on `0.0.0.0`.
 
 - **Repo**: https://github.com/flymysql/dsh-remote
 - **npm**: https://www.npmjs.com/package/dsh-remote
-- **Topic**: dsh-plugin
-- **Category**: productivity / remote
-
-### What it does
-`/remote [user@host]` prints the exact commands: SSH local forward, autossh
-keepalive, reverse tunnel (NAT-friendly), reverse-proxy with --trusted-host.
-Settings → 远程访问 shows the live port, LAN IPs, trusted hosts and one-click
-copy. Respects the official safety design — no 0.0.0.0 hack.
-
-### Install
-npm install dsh-remote, then add `{ id: dsh-remote, name: dsh-remote }` to cordis.yml.
+- **Install**: `dsh plugin add dsh-remote`
 ```
diff --git a/README.md b/README.md
@@ -41,10 +41,10 @@ Real capture (host scrubbed to a placeholder):
   - **远程 / Remote** — the picker is a **centered modal**. Pick a **machine** → on Windows hosts the root shows a **"This PC" drive view** (`C:\`, `D:\`, `E:\`… instead of the Git Bash MSYS root) and the path field live **autocompletes** directories (accepts `C:\Users\…` or `/c/Users/…` — Windows paths are rewritten to the Git Bash form underneath); selecting a directory immediately lists its next level. A **浏览…** floating browser (Windows-aware breadcrumb `此电脑 / C:\ / Users / dev`, drive rows, size + mtime, dirs first, follows symlinks) fills the field without committing; the **回上一级** button works at any depth (even when the browser was opened at the path bar's value). **最近 workspaces** quick-pick, **`~` 主目录** shortcut and **新建目录** are one click away. On confirm it creates a **real local mirror** under `$DSH_HOME/remote-workspaces/<host>-<user>-<port>/<base>` that passes `fs.realpath` → the harness adopts it as a real workspace while dsh-remote keeps it synced over SFTP.
 - **Git Bash default terminal (Windows remotes)** — the remote platform is auto-detected (`cmd /c ver`, plus an `uname -s` MINGW/MSYS probe as fallback); on Windows the plugin locates Git Bash (`config.shell` can pin a path or `native` disables wrapping) and pipes every command to `bash -s` over the exec channel, so quoting/backslash escaping is never an issue regardless of the SSH default shell. `rw_exec` runs with a Git Bash cwd (`/c/Users/…` form). `/dsh-remote/status`, `rw_info` and the 测试连接 button report the detected platform + shell.
 - **Windows path auto-conversion** — typing `C:\Users\dev\project` (or `C:/…`, `/c/…`, `/C:/…`) is normalized underneath to the Git Bash form `/c/Users/dev/project` for shell commands, while workspaces are stored and shown Windows-style (`C:\Users\dev\project`). All model tools accept and report both forms; SFTP access uses the Win32-OpenSSH `/D:/…` form (see `toSftpPath`).
-- **Bidirectional SFTP sync, conflict-aware** — `rw_sync` (remote → mirror) and `rw_push` (mirror → remote) are **three-way** (remote vs local vs last-synced snapshot): files changed on both sides are **reported as conflicts and never silently overwritten** (`force=true` overrides). Both support **dry-run**, **background tasks**, and honor **gitignore-style ignore rules** (`.dsh-remote-ignore` under `remote-workspaces`, defaults cover `.git/node_modules/target/dist/build/…`).
+- **Bidirectional SFTP sync, conflict-aware** — `rw_sync` (remote → mirror) and `rw_push` (mirror → remote) are **three-way** (remote vs local vs last-synced snapshot): files changed on both sides are **reported as conflicts and never silently overwritten** (`force=true` overrides). Defaults are **depth 8 / 2000 files**; hitting a cap is reported as **`TRUNCATED`**. Both support **dry-run**, **background tasks**, and honor **gitignore-style ignore rules**.
 - **Model tools** — 20 tools, all Windows/POSIX portable via SFTP: `rw_info`, `rw_connect` (with `save`), `rw_pick_workspace`, `rw_list_dir` (size+mtime), `rw_stat`, `rw_read_file` (encoding-aware: utf-8/gbk), `rw_write_file`, **`rw_edit`** (literal replace + mtime optimistic lock), `rw_append`, `rw_mkdir`, `rw_remove` (recursive, bounded), `rw_move`, `rw_exec` (pty/env), **`rw_search`** (SFTP tree walk — works on Windows too, honors ignore rules, context lines), `rw_download`/`rw_upload` (streaming fastGet/fastPut + size caps), **`rw_forward`** (SSH tunnels), `rw_sync`, `rw_push`, `rw_disconnect`.
 - **Port forwarding panel** — create/start/stop/remove **local** (`127.0.0.1:port → remote`) and **reverse** (`remote → local`) tunnels in the Settings page or via `rw_forward`; definitions persist, auto-restart on reconnect when enabled, all tunnels stop on disconnect.
-- **Sidebar remote editing** — the better-sidebar remote file tab is now **editable**: click **编辑** → edit → **保存到远程** with an mtime optimistic lock (409 + "重新读取" on concurrent change). The explorer rows show file sizes and have a **right-click menu** (下载到本地镜像 / 重命名 / 删除 / 新建目录).
+- **Sidebar remote editing** — the remote file tab is **editable**: click **编辑** → edit → **保存到远程** with an mtime optimistic lock (409 + "重新读取" on concurrent change). File ops are **session-bound** (v0.8.19): the explorer sends `sessionId` so two conversations on different hosts do not share the active-machine pool. The explorer rows show file sizes and have a **right-click menu** (下载到本地镜像 / 重命名 / 删除 / 新建目录).
 - **Command audit log** — every `rw_exec`/write/remove/move/forward is appended to `$DSH_HOME/remote-workspaces/audit.log` (time · user@host · op · exit code · command); the Settings page shows the last 30.
 - **Async long tasks** — `rw_sync`/`rw_push` with `async: true` return a `taskId`; progress/result/cancel via `/dsh-remote/task` (single-flight queue).
 - **Connection health** — a **「测试连接」** button validates host/user/key/password (with per-category error hints: auth / network / host key / timeout) before you save a machine; latency is cached on the machine record.
@@ -77,19 +77,17 @@ core or require a listening Web server:
 - `dsh-better-sidebar` is not bundled. Web hosts may install it separately;
   official Desktop uses the native right-sidebar integration instead.
 
-Validation so far covers Host startup, Desktop IPC JSON requests, read-only
-SSH connection/list/read, and opening the settings/import UI. Native file-tab
-navigation, editing/sync, concurrent sessions on different machines, and the
-full legacy Web UI still need end-to-end acceptance before release. In
-particular, existing sidebar file endpoints use the active-machine pool;
-session-scoped tab addresses alone do **not** make those endpoints
-session-bound. This is not a claim of production-ready multi-machine Desktop
-support.
-
-Desktop's package installer may also require an explicit policy for the
-optional `ssh2` / `cpu-features` build scripts. The isolated transport test
-disabled those optional scripts; this change does not loosen an application's
-build allowlist or automatically approve dependency scripts.
+Since **v0.8.19**, sidebar `/ls` `/read` `/write` `/fs` resolve the session's
+mirror binding (same path as `rw_*`) when the client sends `sessionId`. Two
+sessions on different hosts no longer share the active-machine pool for file
+ops. Host-side tests cover that routing plus the editor 409/re-read/save path.
+
+Official Desktop's native file-tab GUI, failed/cancelled dialogs, non-macOS
+hosts, and a full legacy Web UI pass are still experimental. Desktop's package
+installer may also require an explicit policy for the optional `ssh2` /
+`cpu-features` build scripts. The isolated transport test disabled those
+optional scripts; this change does not loosen an application's build allowlist
+or automatically approve dependency scripts.
 
 ### Published Web bundle