feat(serve): support SSH workspaces without a remote daemon - #12255

SSH workspace E2E report

Result: 77 independent checks passed. The final bundle reran 58 checks (main 50 + boundary 8); the lifecycle and default-shell groups had passed before the narrow text metadata/list/glob fixes. Verification used the exact committed source; pre-commit formatting and lint hooks made no further source changes.

Before implementation, the global CLI returned HTTP 400 with invalid_path for ssh://localhost/absolute/project. Before the final fixes, the boundary fixture reproduced lost BOM/CRLF bytes and a 503 response for the 2002-entry directory. After the fixes, actual remote bytes retained EF BB BF and CRLF, the directory returned HTTP 200 with truncated: true, and the maximum-limit glob request returned HTTP 200 with exactly the expected two matches.

The tests used a real isolated macOS OpenSSH server, Python 3.9.6, temporary keys/known-hosts configuration, separate local and remote project directories, and a loopback mock model. Shell output was compared with actual remote marker contents. No remote Qwen service was started, no real model API was called, and all test daemons and SSH listeners were stopped afterward. Missing Python was simulated using a fixture-specific SSH forced command.

Additional validation: full build, typecheck and bundle passed; changed-file ESLint and Prettier passed. Focused suites included daemon server 1307/1307, core Config 814/814, CLI Config plus SSH dispatch/storage 471/471, Web Shell components 114/114, terminal 44/44 and SSH execution environment 29/29. After the boundary fixes, the filesystem adapter suite passed 10/10 and the SSH Python script suite passed 12/12. Independent review findings were fixed and re-reviewed.

Limits: Linux and Windows, ProxyJump, browser-rendered interaction, and an actual network interruption during an in-flight write or command were not tested. Outage checks stop the SSH listener before the next request; terminal reconnect uses a live listener. Cancellation is covered by focused transport unit tests, and interrupted operations explicitly report uncertain remote status. This report does not claim a completed automated /review verdict or a full repository test-suite run.

The reusable fixture scripts and full local evidence remain in the repository's ignored working-artifact directories, following the project convention; they are not part of the committed feature diff.

中文摘要：累计 77 项独立检查通过，最终 bundle 重跑其中 58 项。验证使用真实隔离 SSH、macOS/Python 3.9.6 和本地模拟模型，检查了实际远程文件字节及命令标记。BOM/CRLF、大目录截断和最大结果数搜索问题已复现、修复并验证。Linux/Windows、ProxyJump、浏览器交互和操作进行中的实际断网尚未实测；未将未完成的自动 /review 计为通过，也未宣称运行整个仓库测试集。

Fixed the seven failing Ubuntu unit tests. The session route fixtures omitted the required workspace filesystem factory, so the SSH workspace check returned HTTP 500 before the existing validation and prompt handling ran. The repair supplies typed local factory mocks in both fixtures; production behavior and all existing assertions are unchanged.

Validation: reproduced the same seven failures locally before the fix; all 41 focused session and SSH boundary tests pass afterward. Full build, typecheck (including integration types), bundle, targeted ESLint and Prettier checks pass. The new CI run will validate the complete workspace suite.

Linux verification round — real SSH host, real daemon, real bundle

The first report on this PR covered macOS; the PR body and docs/design/ssh-workspaces.md both mark Linux as not exercised. This round closes that gap: I built the branch head (a75c998) into dist/cli.js, ran the daemon against an isolated OpenSSH server on Linux (its own host key, its own authorized key, its own port, Python 3.13 on the target), and drove the real Web Shell in Chromium against that daemon.

Result: 121 independent checks passed, 0 failed. No blocking defect found; 5 non-blocking observations below.

Before/after control on Linux: the globally installed CLI (0.22.2) answers 400 invalid_path for POST /workspaces {"cwd":"ssh://[email protected]:<port>/…"}; the branch build answers 201 with a private anchor under $QWEN_HOME/ssh-workspaces/<sha256(url)>/workspace.

What ran

Package gates on the branch head: packages/cli 12 files / 1957 tests, packages/core 8 files / 1474 tests, packages/web-shell AddWorkspaceDialog 43 tests — all passing. ESLint --max-warnings 0 over all 56 changed .ts/.tsx files is clean, Prettier is clean, and npm run build -- --cli-only + npm run bundle succeed from a clean checkout of the head.

Screenshots (real browser against the live daemon)

Sidebar after adding two connections to the same remote project — [email protected]:<port> and the SSH-config alias qwen-ssh-lab — each with its own identity beside the local workspace:

Approval card for a remote shell command — the title names the SSH host and the remote project directory:

The integrated terminal attached to the same workspace, showing the remote working directory and the remote project listing (including the marker the approved command created):

Add-workspace dialog, default state vs. an ssh:// URL typed into the same field (see N1):

Non-blocking observations

N1 — the new SSH guidance is invisible in the default Web Shell. sidebar.addWorkspaceHint (the string this PR rewrote to mention ssh://…, key auth, host key and Python 3) is rendered only in the !browseDirectories branch (AddWorkspaceDialog.tsx:573-577). With the directory browser on — the default for a local daemon — the dialog renders workspaceHost.browseHint ("Choose a folder below, or type an absolute path.") instead, and the path field is pre-filled with the daemon's cwd, so the new placeholder "/absolute/path or ssh://user@host/project" never appears either. Typing an ssh:// URL works (Enter submits it, verified in the browser), but nothing in the dialog tells the user it is possible. Consider appending the SSH sentence to the browse hint, or adding an "SSH" entry to the Folder source selector, which still reads "This computer".

N2 — the HTTP ACP transport is closed for SSH workspaces, the WebSocket one is not. registerSshWorkspaceBoundary rejects POST /workspaces/:id/acp with 501 before the dispatcher runs, so an ACP client that speaks only Streamable-HTTP cannot use an SSH workspace at all; the SSH_METHODS allowlist added in acp-http/dispatch.ts is reachable only over the WS transport (where I verified it, including the negative control). Fail-closed is defensible, but the two transports now differ — worth either an /acp passthrough or a line in the design doc.

N3 — SSH_EXECUTION_TOOL_NAMES lists ToolNames.LS, but list_directory is never registered under default settings (Config skips it when isLsToolEnabled() is false, which is also true for local workspaces). The SSH list branch in SshExecutionEnvironment.execute is therefore unreachable in a default install; the agent lists remote directories through glob/shell instead. Not a regression, just dead weight unless the tool is enabled.

N4 — slash-command messaging. help is in the SSH allowlist but ACP sessions reject /help anyway ("not supported in this mode" — same for local workspaces), and a blocked command surfaces the generic This action is not supported in this standalone session. rather than the SSH-specific reason added in nonInteractiveCliCommands.ts. /model, /compress, /context, /effort work as intended.

N5 — documentation status lines. docs/design/ssh-workspaces.md still says "A Linux target has not yet been exercised", and the PR body's Tested on table marks Linux ⚠️. Both can be updated with this round.

Environment

Linux 6.12 (Debian 13), Node.js 22.22.2, branch head a75c998 built locally (build --cli-only + bundle). Target: a dedicated sshd on loopback with its own host key, key-only auth, StrictHostKeyChecking=yes satisfied from a private known_hosts, Python 3.13.5; the daemon's ~/.ssh was redirected into the lab through a private mount namespace, so no shared SSH configuration was touched. Model traffic went to a local OpenAI-compatible stub — no live model API, no Qwen on the target. The lab sshd, the daemon and the stub were stopped afterwards, and the fixtures live entirely in a scratch directory.

Verdict from this round: merge-ready on Linux. The five items above are follow-ups, not blockers.

🤖 Generated with Claude Code — Claude Opus 5 (1M context)

Review follow-up verification for 1988bf9.

All 67 existing review threads were reconciled against the current source. The body-only R3-1 finding is fixed: saving a workflow default on an SSH workspace no longer persists the value and then returns 500 while trying to activate an unsupported workflow in a live session. N1/N2 are fixed (visible SSH prerequisites and POST ACP admission); N3 retains the ordinary opt-in LS gate; N4 preserves the actual unsupported slash-command reason; N5 now cites the existing Linux report accurately.

Reproduction and real SSH verification

• Global CLI baseline: SSH registration rejected with HTTP 400.

• Reviewed a75c998 baseline: 12 findings reproduced (11 against isolated macOS OpenSSH, one with native/Windows path models).

• After the review fixes: all 12 checks passed, plus 13 supplementary checks for remote terminal cwd/replay, exit 255 versus disconnect, untrusted mutation denial, tool discovery, capability metadata, file format/hash handling, and trusted HTTP create/conditional edit.

• The final ignore-rule run covered ordinary and nested Qwen rules, Git ignoring the rule files themselves, a 19,000-file ignored directory exceeding the old 4 MiB enumeration bound, multiple literal candidate batches and an unreadable-directory control. All 34 checks passed after the HTTP completeness fix; 5 further real ACP checks passed (39/39), including complete results, result caps and unreadable entries. A subsequent one-line literal-directory correction passed 9/9 checks on the final bundle: ordinary and magic-looking directory names honor both Git and Qwen rules, includeIgnored returns correct flags, and local files remain unchanged.

• The last timeout correction passed 7/7 real-SSH checks: invalid defaults use 120000 ms, zero remains disabled, ordinary commands return remote output, and oversized explicit deadlines are rejected with zero SSH launches. These later narrow checks followed the earlier ignore/list runs; their bundle fingerprints are recorded separately.

Build and test evidence

Root build, bundle, full typecheck, changed-file ESLint/Prettier and git diff --check passed after the last source fix. Focused suites include 102 core SSH tests, 214 CLI routing/terminal/management tests, 194 Web Shell tests, the SSH daemon capability/primary checks and ACP session checks. The final filesystem/HTTP/ACP regression set passed 226 tests, including both local and SSH filesystem contracts.

The native review also ran broader workspace suites. Web Shell, ACP bridge, SDK, Qwen Live and VS Code companion passed. CLI/core broad runs were not fully green. Isolated reruns and a clean QWEN_HOME control distinguished local-profile contamination from remaining Git/macOS fixture failures in unchanged review/Git test paths. The remaining normal-profile failures include macOS non-UTF-8/worktree fixtures and an Apple Git 2.50.1 error-message assertion. Their test and implementation paths are unchanged from the merge base. A control with GIT_CONFIG_GLOBAL=/dev/null also failed two fixtures that deliberately use global filters, so that control is not counted as a full-suite success. No unrelated source was changed to suppress these failures. These results are disclosed rather than counted as full-suite success.

Audit evidence

The full pending diff was audited repeatedly in open-ended and reverse passes. Earlier passes found a missing local control in a capability test, a nested Git-ignored Qwen rule leak, the later transport-to-HTTP glob completeness loss, literal Git directory handling and raw timeout-setting normalization. Each finding reset the clean-pass count. The final stable 39-file diff then passed two consecutive independent open-ended and reverse reviews with no further confirmed findings. The exact pre-commit diff SHA-256 was de99f92fbab55ab97984a4b3eba8e171297c16373c2b9351d3efc54e3596d8de. The native high-effort command separately timed out after 40 minutes with no verdict; it is not counted as an approval or a clean pass. No code was committed while those issues remained open.

Scope and environment

macOS arm64, Node 22.22.2, isolated OpenSSH/Python 3.9.6 and a loopback model fixture; no remote Qwen daemon or paid model API. Latest Linux execution and actual Windows execution were not rerun. The separate Debian 13 / Python 3.13.5 report records 121 checks on a75c998, not this follow-up commit. Browser behavior was checked through component tests rather than captured screenshots. Test services were stopped and temporary permission changes restored.

Deliberate boundaries are documented in both languages: the private SSH anchor namespace fails closed; skills and the declared remote project services remain unsupported; submodule search reports incompleteness; dubious Git ownership does not alter Git trust; abrupt remote termination cannot guarantee temporary-file cleanup.

Follow-up fixes are in aa60679, which also incorporates main 97b1b25. This supplies the current lint gate and the Runtime Broker module required by Java CI. The prior fix commit is 1988bf9.

The late review's remaining defects are addressed: reusable compound-shell permissions and substitution warnings; effective default/custom ignore files (including relative and equivalent ./ paths and an explicit empty list); denial auditing for public filesystem validation with nested-event deduplication and existing privacy preserved; and truthful secondary ACP capability advertisement. Reverse review additionally found and fixed SSH participation in channel restoration/ownership and missing GET/DELETE admission for ACP HTTP event streams.

Final verification on the rebuilt artifact:

• Root build, bundle and complete typecheck passed. Whole-repository ESLint and Prettier passed. Java 21 Runtime Broker tests passed 11/11. Generated Java coverage output was moved into ignored investigation artifacts before whole-repository formatting/lint checks; no lint rule or source exclusion was weakened.
• Final core SSH unit tests: 112/112. Final CLI configuration, complete daemon-startup, filesystem, ACP and SSH-route suites: 987/987. Earlier merged-tree Web Shell checks passed 340/340 and the actual SSH integration suite passed 25 groups, including an ACP prompt-to-remote-shell round trip.
• Real SSH follow-up: 20 ignore-rule wire cases plus 32 CLI calls passed; saved compound permissions still allow the same command after recreating the permission manager; seven public filesystem rejection scenarios each produce exactly one denial, with raw-path privacy and a nested remote-conflict control verified.
• Secondary Streamable HTTP passed 7/7: initialize 200, GET SSE 200, POST stat/read 202 with actual remote results on SSE, DELETE 202 with EOF, and the closed connection rejected with 404. This uses HTTP/SSE, not WebSocket.
• Two consecutive independent open-ended/reverse audit rounds found no further confirmed issue in the 18-file follow-up and the overlapping main integration paths. The commit tree was checked byte-for-byte against the audited staged tree after pre-commit hooks.

The carried review-body questions were also checked against current behavior: untrusted SSH file reads follow the existing read-intent policy while writes remain gated; search completeness survives through the transport and HTTP/ACP consumers; and local SSH-session setting writes succeed while unsupported workflow execution remains disabled. The private ssh-workspaces namespace remains intentionally fail-closed, with the rationale recorded in its thread. Root canonicalization and codeModeOnly were already fixed in 1988bf9.

Limitations remain explicit: the earlier native review timed out without a verdict, and broader local suites had environment-dependent failures documented in the previous report. This comment does not claim those suites passed, or claim Windows/Linux execution that was not performed. Fresh hosted CI is being checked separately.

补充修复及主分支同步已提交为 aa60679。最新真实 SSH、权限持久化、忽略规则、拒绝审计和 ACP HTTP 事件流验证通过；构建、类型检查、全仓库 Lint/格式检查，以及 112 项核心与 987 项 CLI 定向测试通过。提交前完成连续两轮独立无方向审计和反向审计，提交树与审查版本一致。仍保留此前全量测试和平台验证的明确限制，不将超时审查或未执行的平台检查计为通过。

Final hosted CI receipt (aa60679)

Qwen Code CI completed successfully, including Lint & Static, Linux Node 22 tests, no-AK integration tests, Linux/Windows Desktop Shell and the dependent Web Shell browser E2E smoke. The Linux test log confirms 32,882 CLI tests passed (92 skipped) and 29,755 Core tests passed (10 skipped). Java SDK platform/version lanes and real-daemon E2E, Serve A/B, TUI parity/no-flicker, Web Shell visual capture and macOS Live Host also passed. As of 2026-09-21 16:44 UTC, the PR has 24 successful checks, 26 configured skips and no failed checks; only the separate automatic GitHub review is still running. All 74 existing review threads are resolved. The PR is mergeable and has not been merged.

最新 CI 已通过，包含 Linux 全量单测、Java 多平台测试及 Web Shell 浏览器 E2E。74 条现有评论均已处理；仅 GitHub 自动评审仍在运行。

SSH workspace verification on a real LAN host (aa60679)

This round tests the PR against a second physical Linux machine over the LAN, not a loopback sshd, and uses a real model to drive the agent through the real Web Shell. The target differs from both earlier reports:

• Ubuntu 22.04 on arm64 (Orange Pi 5)
• /bin/sh is dash
• Python 3.10.12 and Git 2.34.1
• root's login shell is zsh
• the connection uses the maintainer's everyday ~/.ssh key and known_hosts, with no lab-only configuration

I started on 1988bf9. The head moved to aa60679 partway through, so I rebuilt and re-ran everything below on aa60679. Results from 1988bf9 appear only where they add something.

Result on aa60679: 93 checks passed and 3 failed. The daemon and Web Shell boundary held in every area I tested: trust, containment, symlinks, hostile names, outages, persistence, Git, the terminal and ACP. All the failures are in the agent's SSH execution path. That path differs from the local tools in ways a real model runs into immediately on a stock Debian or Ubuntu host (F1 and F2 below). I measured a third problem separately: timed-out or cancelled commands stay running on the remote host (F4). A candidate patch fixes all three on the same host: 4 files, +103/−15 lines including 3 tests. A full re-run on the patched build passed 89 of 89 checks.

What ran on aa60679

Per-route cost on this link (median of 3):

Every connection is a full SSH handshake, which takes about 0.6 s to this board.

Add Workspace dialog with an ssh:// URL; the SSH prerequisites now show in the default browse mode.	Agent report for the remote project (left) and the integrated terminal on orangepi5 (right). The after-timeout/after-cancel files come from F4.

Findings

F1: the shell tool promises bash -c, but the SSH host runs /bin/sh. In the request log, all 33 model requests from SSH sessions describe run_shell_command as "Executes a given shell command (as bash -c <command>)" and "Exact bash command to execute as bash -c <command>" (packages/core/src/tools/shell.ts:5262, :5315). The remote script actually runs ['/bin/sh', '-c', command] (packages/core/src/services/ssh-workspace-script.ts:278). On Debian and Ubuntu /bin/sh is dash, so [[ ]], source, set -o pipefail and brace expansion all fail. In a real run over SSH, the same prompt printed /bin/sh: 1: [[: not found and shell is /bin/sh. On the local workspace it printed DOUBLE_BRACKET_OK and shell is bash. The model can adapt after a failure; it switched to . on the next turn. Still, every miss costs a turn, and a failed set -o pipefail aborts the whole command. The earlier Linux round also used Debian but did not try bash syntax.

F2: the agent's edit and write_file over SSH skip the line-ending and BOM handling that the local tools apply. prepareChange splits the raw remote text on the model's old_string and writes content exactly as sent (packages/core/src/services/ssh-execution-environment.ts:304, :316). The local edit.ts and write-file.ts compare after converting CRLF to LF, then write back using the file's detected line ending and BOM. A real run on a BOM+CRLF file gave these results:

• Multi-line edit: every attempt failed with old_string was not found in the remote file. The model tried LF, CRLF and whole-file variants, then concluded that it "cannot transmit a literal carriage return". That took 35 tool calls, 5 min 43 s and 320k input tokens, and the file was not changed. On the local workspace the same change took one edit, 8 tool calls and 37 s.
• write_file: the remote bytes became red\ngreen\nblue\n. The BOM was silently dropped and CRLF became LF. The local workspace kept EF BB BF and CRLF.

The PR's tests cover a single-line edit on a CRLF file, and a new file whose BOM is supplied verbatim, but neither of these two cases. The description says "existing-file writes preserve UTF-8 BOM and line endings". That is true for the Web Shell file routes (verified above) but not for the agent.

F4: a timed-out or cancelled command keeps running on the host. I ran sleep 6; touch after-timeout with a 1.5 s timeout over a healthy connection. The call returned the "status is uncertain" error, but /bin/sh -c sleep 6… kept running on the host, and the marker file appeared 7 s later. A user cancel through AbortSignal behaved the same way. The client kills only its local ssh process (packages/core/src/services/ssh-workspace.ts:349), and nothing stops the remote process group. The design accepts uncertainty when the connection drops, but here the connection was fine. As a result, if the agent runs npm run dev, tail -f or a long build that times out, the process stays on the remote host with no end.

Candidate patch (verified on the same host)

The patch touches 4 files (+103/−15 lines):

• ssh-workspace-script.ts: prefer /bin/bash and fall back to /bin/sh. Start the command in its own session and watch fd 1 for POLLERR/POLLHUP; sshd closes that fd when the client goes away. When that happens, send SIGTERM and then SIGKILL to the command's process group.
• ssh-execution-environment.ts: compare text after converting CRLF to LF and removing the BOM, then write back in the file's detected format. This uses the same detectLineEnding as the local tools.

Results on orangepi5 with the patched build:

• F1: the command printed DOUBLE_BRACKET_OK and shell is /bin/bash; pipefail and source work.
• F2: one edit call, 0 tool errors. The bytes are EF BB BF alpha\r\nbeta-and-gamma\r\n and EF BB BF red\r\ngreen\r\nblue\r\n, identical to the local workspace.
• F4: the remote process disappears immediately after the timeout, and the marker file is absent after both the timeout and the cancel.
• A 1.29 MB output plus stderr and exit code 4 still arrive intact.
• A regression re-run on the patched build passed 89 of 89 checks (trust, files, Git, registration, hostile names, outage, transport).

The patch adds three tests. The two that run on macOS fail against the aa60679 sources and pass with the patch. The disconnect test is Linux-only, because macOS poll() does not report a pipe whose reader has closed. I ran its scenario on the target with the built script, and no marker file was created. With the patch, the core SSH test files show 114 passed and 1 skipped, and eslint, prettier and tsc are clean. The full diff is at the end of this comment.

Observations (non-blocking)

• O1: the approval card does not say where the command runs. The card subtitle shows the model's description when one is present. It falls back to run_shell_command on [email protected]: /root/… only when the description is missing (getDescriptionText in ToolApproval.tsx). Exec cards also don't render the SSH warning. qwen3.8-max always sends a description, so the card showed no host at all (image below). The earlier report's screenshot showed the host only because that command had no description.
• O2: session tooltips show the private anchor path (…/ssh-workspaces/<sha256>/workspace) instead of the remote path. The workspace header already uses the SSH label.
• O3: errors say "The remote command may still be running…" even when nothing started. This appears on connection refused, authentication failure, host-key failure and rejection of a symlinked cwd.
• O4: after an ssh:// URL is typed, the dialog still shows "Browse…" and "Choose a folder below". Both refer to the local daemon's filesystem.
• O5: latency. Each operation opens a new SSH connection, so Git inspection takes 3–5 s on this LAN. The daemon uses the user's normal OpenSSH configuration, so documenting ControlMaster/ControlPersist might help. I did not test that here.

Test suites and CI

On 1988bf9, before the head moved, the PR's 29 changed test files all passed: 1515 core, 3892 CLI and 194 Web Shell tests. Two notes about this Mac: the tests that run python3 need DEVELOPER_DIR set, otherwise the Xcode license prompt makes 34 core and 12 CLI tests fail, and client.test.ts needs a larger heap. I did not re-run the full suites on aa60679; its changes are covered by hosted CI, which shows 24 passed, 26 skipped, and only review-pr still pending.

Environment

• Local side: macOS 26 (Apple silicon), Node 24.18.1. The daemon ran from dist/cli.js built at aa60679 (pnpm worktree bootstrap, then npm run build && npm run bundle), with an isolated QWEN_HOME and folder trust enabled. Playwright Chromium drove the Web Shell.
• Target: Orange Pi 5, Armbian 25.8.1 on an Ubuntu 22.04 base, kernel 5.10, aarch64, OpenSSH on port 22. root's login shell is zsh and /bin/sh is dash. Python 3.10.12, Git 2.34.1. No Qwen and nothing else was installed.
• Model: qwen3.8-max (DashScope).
• Cleanup: the fixtures in /root/pr12255-lab have been removed. The temporary firewall rule rejected only new port-22 connections from the daemon host, was set to remove itself after 75 s, and is confirmed gone.

diff --git a/packages/core/src/services/ssh-execution-environment.test.ts b/packages/core/src/services/ssh-execution-environment.test.ts
index ec4294253b..54defc775d 100644
--- a/packages/core/src/services/ssh-execution-environment.test.ts
+++ b/packages/core/src/services/ssh-execution-environment.test.ts
@@ -258,6 +258,24 @@ describe('SshExecutionEnvironment', () => {
     expect((await read(`${remote}/new.txt`)).llmContent).toBe(content);
   });
 
+  it('matches LF edits against BOM+CRLF files and keeps their format on overwrite', async () => {
+    files.set(`${remote}/crlf.txt`, '\uFEFFalpha\r\nbeta\r\ngamma\r\n');
+    await read(`${remote}/crlf.txt`);
+    await execute(ToolNames.EDIT, {
+      file_path: `${remote}/crlf.txt`,
+      old_string: 'beta\ngamma',
+      new_string: 'beta-and-gamma',
+    });
+    expect(files.get(`${remote}/crlf.txt`)).toBe(
+      '\uFEFFalpha\r\nbeta-and-gamma\r\n',
+    );
+    await execute(ToolNames.WRITE_FILE, {
+      file_path: `${remote}/crlf.txt`,
+      content: 'red\ngreen\n',
+    });
+    expect(files.get(`${remote}/crlf.txt`)).toBe('\uFEFFred\r\ngreen\r\n');
+  });
+
   it('honors manually edited proposals and confirmation payloads', async () => {
     await read();
     await environment.prepare(
diff --git a/packages/core/src/services/ssh-execution-environment.ts b/packages/core/src/services/ssh-execution-environment.ts
index aaf358d17a..51d561cc39 100644
--- a/packages/core/src/services/ssh-execution-environment.ts
+++ b/packages/core/src/services/ssh-execution-environment.ts
@@ -11,6 +11,7 @@ import {
   splitCommands,
 } from '../utils/shell-utils.js';
 import { extractCommandRules } from '../utils/shellAstParser.js';
+import { detectLineEnding } from './fileSystemService.js';
 import type { PermissionDecision } from '../permissions/types.js';
 import { createPatchSmart } from '../tools/diffOptions.js';
 import { ToolNames } from '../tools/tool-names.js';
@@ -298,10 +299,21 @@ export class SshExecutionEnvironment implements ExecutionEnvironment {
         'Read the remote file with read_file before editing or overwriting it; it is unread or changed since the last read.',
       );
     }
+    // Match the local edit/write tools: compare with LF and no BOM, then
+    // write back in the existing file's BOM and line-ending format.
+    const bom = read?.content.startsWith('\uFEFF') ?? false;
+    const lineEnding = read ? detectLineEnding(read.content) : 'lf';
+    const normalized = (text: string) => text.replace(/\r\n/g, '\n');
+    const toFileFormat = (text: string): string => {
+      const body = normalized(text.startsWith('\uFEFF') ? text.slice(1) : text);
+      const ended = lineEnding === 'crlf' ? body.replace(/\n/g, '\r\n') : body;
+      return bom ? `\uFEFF${ended}` : ended;
+    };
     if (toolName === ToolNames.WRITE_FILE) {
+      const content = stringParam(params, 'content');
       return {
         current: read?.content ?? null,
-        proposed: stringParam(params, 'content'),
+        proposed: read ? toFileFormat(content) : content,
         hash: read?.hash,
       };
     }
@@ -313,7 +325,9 @@ export class SshExecutionEnvironment implements ExecutionEnvironment {
     }
     if (!oldString)
       throw new Error('old_string must not be empty for an existing file.');
-    const pieces = read.content.split(oldString);
+    const pieces = normalized(bom ? read.content.slice(1) : read.content).split(
+      normalized(oldString),
+    );
     if (pieces.length === 1)
       throw new Error('old_string was not found in the remote file.');
     if (pieces.length > 2 && params['replace_all'] !== true)
@@ -322,7 +336,7 @@ export class SshExecutionEnvironment implements ExecutionEnvironment {
       );
     return {
       current: read.content,
-      proposed: pieces.join(newString),
+      proposed: toFileFormat(pieces.join(normalized(newString))),
       hash: read.hash,
     };
   }
diff --git a/packages/core/src/services/ssh-workspace-script.test.ts b/packages/core/src/services/ssh-workspace-script.test.ts
index dd3db59f6b..18e33e4daa 100644
--- a/packages/core/src/services/ssh-workspace-script.test.ts
+++ b/packages/core/src/services/ssh-workspace-script.test.ts
@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { execFileSync, spawnSync } from 'node:child_process';
+import { execFileSync, spawn, spawnSync } from 'node:child_process';
 import {
   mkdtempSync,
   realpathSync,
@@ -410,6 +410,47 @@ describe.skipIf(process.platform === 'win32')('SSH filesystem script', () => {
     ).toBe(`${join(root, "quoted ' directory")}\nvalue\n`);
     expect(child.stderr).toBe('');
   });
+  it('runs commands with bash to honour the bash -c tool contract', () => {
+    const child = spawnSync('python3', ['-c', SSH_WORKSPACE_SCRIPT], {
+      input: JSON.stringify({
+        root,
+        operation: 'execute',
+        params: { command: '[[ -d . ]] && echo "$0"' },
+      }),
+      encoding: 'utf8',
+    });
+    const frames = child.stdout
+      .trim()
+      .split('\n')
+      .map((line) => JSON.parse(line));
+    expect(frames.at(-1)).toEqual({ ok: true, result: { exitCode: 0 } });
+    expect(Buffer.from(frames[0].data, 'base64').toString()).toMatch(/bash\n$/);
+  });
+
+  // SSH targets are Linux; macOS poll() does not flag a pipe whose reader closed.
+  it.skipIf(process.platform !== 'linux')(
+    'stops the command when the SSH client stops reading',
+    async () => {
+      const marker = join(root, 'after-disconnect');
+      const child = spawn('python3', ['-c', SSH_WORKSPACE_SCRIPT], {
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+      child.stdin.end(
+        JSON.stringify({
+          root,
+          operation: 'execute',
+          params: { command: `sleep 2; touch '${marker}'` },
+        }),
+      );
+      await new Promise((resolve) => setTimeout(resolve, 500));
+      child.stdout.destroy();
+      await new Promise((resolve) => child.on('close', resolve));
+      await new Promise((resolve) => setTimeout(resolve, 2500));
+      expect(existsSync(marker)).toBe(false);
+    },
+    10_000,
+  );
+
   it('lists FIFOs without opening them and rejects reading one', () => {
     execFileSync('mkfifo', [join(root, 'pipe')]);
     expect(request('list')).toMatchObject({
diff --git a/packages/core/src/services/ssh-workspace-script.ts b/packages/core/src/services/ssh-workspace-script.ts
index 788050812d..ab669756e8 100644
--- a/packages/core/src/services/ssh-workspace-script.ts
+++ b/packages/core/src/services/ssh-workspace-script.ts
@@ -8,7 +8,7 @@ import { getQwenIgnoreFileNames } from '../utils/qwenIgnoreParser.js';
 
 // Sent as a Python -c argument; requests arrive on stdin, never in shell text.
 export const SSH_WORKSPACE_SCRIPT = String.raw`
-import base64, errno, fcntl, fnmatch, hashlib, json, os, re, selectors, stat, subprocess, sys, time, uuid
+import base64, errno, fcntl, fnmatch, hashlib, json, os, re, select, selectors, signal, stat, subprocess, sys, time, uuid
 
 MAX_BYTES = 16 * 1024 * 1024
 MAX_ENTRIES = 50000
@@ -275,22 +275,37 @@ def dispatch(operation, params):
         command = params.get('command')
         if not isinstance(command, str) or '\0' in command:
             fail('invalid_argument', 'Invalid remote shell command.')
-        process = subprocess.Popen(['/bin/sh', '-c', command], stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-        selector = selectors.DefaultSelector()
-        selector.register(process.stdout, selectors.EVENT_READ, 'stdout')
-        selector.register(process.stderr, selectors.EVENT_READ, 'stderr')
+        # The shell tool contract is bash -c; fall back to sh only without bash.
+        shell = next((candidate for candidate in ['/bin/bash', '/usr/bin/bash'] if os.access(candidate, os.X_OK)), '/bin/sh')
+        process = subprocess.Popen([shell, '-c', command], stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.PIPE, start_new_session=True)
+        streams = {process.stdout.fileno(): 'stdout', process.stderr.fileno(): 'stderr'}
+        poller = select.poll()
+        for fd in streams:
+            poller.register(fd, select.POLLIN)
+        # sshd closes our stdout when the client disconnects, times out or
+        # cancels; stop the command's process group instead of orphaning it.
+        poller.register(1, 0)
         try:
-            while selector.get_map():
-                for key, event in selector.select():
-                    chunk = os.read(key.fd, 65536)
+            while streams:
+                for fd, event in poller.poll():
+                    if fd == 1:
+                        if event & (select.POLLERR | select.POLLHUP):
+                            os.killpg(process.pid, signal.SIGTERM)
+                            try:
+                                process.wait(timeout=2)
+                            except subprocess.TimeoutExpired:
+                                os.killpg(process.pid, signal.SIGKILL)
+                            os._exit(1)
+                        continue
+                    chunk = os.read(fd, 65536)
                     if not chunk:
-                        selector.unregister(key.fileobj)
+                        poller.unregister(fd)
+                        del streams[fd]
                         continue
-                    print(json.dumps({'stream': key.data, 'data': base64.b64encode(chunk).decode('ascii')}), flush=True)
+                    print(json.dumps({'stream': streams[fd], 'data': base64.b64encode(chunk).decode('ascii')}), flush=True)
             code = process.wait()
             return {'exitCode': code if code >= 0 else 128 - code}
         finally:
-            selector.close()
             process.stdout.close()
             process.stderr.close()
     if operation == 'stat':

Follow-up to the real LAN report: F1, F2 and F4 are fixed in 0fbecd3.

• F1: remote agent commands now execute with Bash, and SSH tool descriptions/command schemas use the same Bash contract even when the local daemon would normally use cmd.exe or PowerShell. Bash is an explicit prerequisite for shell commands, with no silent fallback to sh; the visible hint and both design documents are updated.
• F2: multiline edits normalize CRLF/LF for matching, while writes, edits and manually revised proposals preserve existing BOM and line-ending format. Whole-file edits copied from BOM-prefixed reads remain valid, new files retain supplied text, and freshness checks still use hashes of the original bytes.
• F4: execute requests keep SSH stdin open after a bounded JSON line. EOF or output failure triggers remote process-group cleanup: SIGTERM, a two-second grace period, then SIGKILL before reaping the leader. Monitoring continues after output redirection. This also handles a leader that exits while a child ignores SIGTERM. Network partitions may delay disconnect detection, and deliberately detached descendants remain outside the guarantee.

The proposed stdout-poll patch was not applied verbatim: it missed redirected output, surviving TERM-ignoring children and macOS pipe behavior. The input-channel mechanism is verified on Linux over real SSH and through direct-script cancellation tests on macOS.

Reproduction and verification

All three defects were independently reproduced against aa60679 on the reported LAN Linux host (Ubuntu 22.04 arm64, Python 3.10.12, /bin/sh=dash). The global CLI was tried first and rejected SSH registration; the follow-up used the actual CLI tool chain with isolated runtime state and a local model fixture, with no paid model or remote Qwen service.

On the rebuilt artifact, the same shell/agent edit/write scenarios pass. Remote bytes are exactly EF BB BF alpha\r\nbeta-and-gamma\r\n and EF BB BF red\r\ngreen\r\nblue\r\n, identical to the local-tool controls. Timeout and AbortSignal cancellation prevent the delayed markers. A separate parent/child pair ignoring SIGTERM disappears before its natural six-second deadline, and the child's marker remains absent. Normal completion with closed output streams, pre-abort/late-abort behavior, remote exit 255 and a 1,290,004-byte UTF-8 stdout payload plus separate stderr and exit code 4 all pass. Test processes, services and independently created remote directories were cleaned; the local anchor stayed untouched.

Build, bundle and complete repository typecheck passed. Relevant core SSH/shell tests passed 482/482, execution integration tests 22/22, CLI configuration 467/467 and Web Shell 47/47. The script's complete 45-test file was rerun successfully after a test-cleanup correction. Changed-file ESLint/Prettier passed. These are targeted local tests, not a fresh full-suite claim. Windows shell declarations are tested through platform controls; no real Windows SSH session was run. The tested CLI bundle SHA256 is 60597317b39167986fe00709ef062d5c93ea15a48b276bb491573345f83dfd3c.

Pre-commit audit

The first reverse pass found that an empty test PID file could be interpreted as process group zero; its cleanup was corrected and the clean-pass count reset. The complete 11-file increment then passed two consecutive independent open-ended/reverse audits. The reviewed diff SHA256 is 5a3dcfde8489289af8004191df592fa1506c796ecf5dafa00150079a071107a0. After commit hooks, the committed tree exactly matched the audited tree 740eb88c970c4a41f424d84884819014d93d901f. The earlier six-hour GitHub review timeout produced no verdict and is not counted as an approval. New CI is running for this commit.

Non-blocking observations explicitly deferred

This PR has already undergone several review rounds; the repository guidance now limits additions to correctness fixes. O1–O5 remain recorded for follow-up rather than being silently treated as fixed:

• O1: always show the SSH host/target on approval cards even when the model supplies a description.
• O2: show the remote path in session tooltips instead of the private anchor.
• O3: distinguish failures before command start from uncertain execution outcomes in wording.
• O4: hide local folder browsing suggestions while entering an SSH address.
• O5: separately evaluate and document OpenSSH connection sharing and its latency impact; it was not evaluated here.

针对真实 LAN 报告的 F1、F2、F4 已在 0fbecd37e3 修复：SSH 统一声明并执行 Bash；agent 多行编辑、写入和手工修改提案保留 BOM/换行格式；超时和取消会清理远端命令进程组，包括重定向输出及忽略 SIGTERM 的子进程。已在同一台 Linux 主机独立复现并验证修复，正常输出、stderr、退出码和取消边界均通过，测试进程与目录已清理。

提交前完成连续两轮独立无方向审计与反向审计，发现测试清理风险后曾重置计数；提交树与审计树完全一致。构建、打包、全仓类型检查、改动文件 Lint/格式检查及上述定向测试通过。GitHub 自动评审此前因六小时时限失败，没有结论，不计为批准。新提交 CI 正在运行。

O1–O5 按仓库多轮评审后的范围要求明确延期：审批卡片始终显示主机、会话 tooltip 远端路径、执行前失败措辞、SSH 输入时隐藏本地浏览建议，以及 SSH 连接复用的延迟评估；本次没有宣称这些观察项已修复。

Verdict: merge-ready — 167/167 scripted assertions passed, 0 failed. Verified head 0fbecd37e389a64865a65aed5cdf191404816aa6 (base 97b1b252e3aae5e8be34a2d2f33290cbdd4b0198, defect arm aa60679971ea980f87a292065e096c15a2bf0c19).

This is a follow-up round to the real LAN report and the 0fbecd37 follow-up. What this round adds: two physically different SSH targets (Linux aarch64 and macOS x86_64 — the first macOS SSH target in any round), a defect-arm A/B that re-runs F1/F2/F4 against aa60679971 on both targets, a real-daemon HTTP E2E (56 checks), and a mutation matrix over the fix's own tests.

Previous findings: status at 0fbecd37

All carried-forward measurements were re-run at the new head, on both targets — not quoted from the earlier rounds.

Central claim and A/B

Central claim: at head, agent SSH commands run under the advertised Bash contract, agent file edits preserve existing BOM/line-endings, and client-side timeout/cancel terminates the remote process group — with no regression to the transport or to local workspaces.

Protocol-level A/B (real ssh client → real remote Python executor → real remote bytes; harness harnesses/ssh-protocol.mjs drives the built dist/ of each arm):

The defect-arm cells are assertions that the defect reproduces; their red-is-expected outcomes are encoded in the harness (expect=broken), so a green cell means the A/B can actually tell the two builds apart. Witness images: 01-head-linux-all-pass.png, 02-prev-linux-defects-reproduced.png, 03-head-macos-all-pass.png, 04-prev-macos-defects-reproduced.png.

Transport controls (identical on all 4 cells): separate stdout/stderr/exit-code framing (exit 4, exit 255), multi-byte UTF-8, 1,000,000-byte stdout payload, pre-abort rejection, fs read/list/grep. The macOS target runs the executor against Python 3.9 and the Bash contract against bash 3.2 — both hold.

Daemon E2E at head (56/56)

Real bundled daemon (dist/cli.js serve, isolated QWEN_HOME, folder trust enabled, trust toggled through the QWEN_CODE_TRUSTED_FOLDERS_PATH seam) driving both SSH targets plus a local primary workspace. Witness image: 05-daemon-e2e-56-checks.png.

• Registration: both targets register (201, distinct ids); :22 and implicit port are distinct identities. 8 invalid descriptors all 400 with no catalog entry: password, query, fragment, missing path, missing directory, file-as-directory, unreachable host (10 s ConnectTimeout), unknown user (BatchMode auth failure). Identical-URL re-registration returns 200 with the same id and no second entry (idempotent; the 409 the LAN report saw was for a different path resolving to the same canonical root — not retested here).
• Trust gate: untrusted → read 200, write/upload/git 403 untrusted_workspace, no remote side effect; trusting the anchor via hot reload flips writes to 201 without a restart.
• File routes (both targets): LF write into a BOM+CRLF file keeps EF BB BF …\r\n byte-for-byte; stale hash → 409 and the file is untouched; ../ and symlink escapes → 400; ignore rules honoured (nested .qwenignore, 500-file node_modules excluded).
• Large files: byte window at 18 MiB of a 20 MiB file returns 200; full read → 413 file_too_large.
• Git: /git branch+counts, /git/diff, /git/diff/file hunks match the host's own git; commit/checkout → 501 ssh_workspace_operation_unsupported; host HEAD unchanged.
• ACP over HTTP: initialize mints a connection id, GET with Accept: text/event-stream returns the SSE stream (406 without it, 400 for DELETE without the connection header — both contract-correct), DELETE → 202, and subsequent non-initialize requests on the torn-down connection → 404.
• Persistence and non-regression: daemon restart restores the persisted SSH workspace (read works without re-registration); local workspace file routes work throughout.

Mutation matrix (fix's own tests are not vacuous)

Each mutant applied to head sources, then the affected test file run; all four killed by exactly the intended tests. Witness image: 06-mutation-matrix.png.

M1/M2/M3 land in the same file as the tests that catch them, so the runner-level and file-level controls coincide. (A first M3 attempt silently no-ops because /usr/bin/python3 hit the Xcode license prompt — the "mutation applied" assertion is what caught it; rerun with DEVELOPER_DIR set died as expected.)

Targeted gates

• Unit tests (head worktree): core SSH/shell files 1069/1070; config.test.ts 824/825; CLI 19 files incl. all SSH routes/fs/store/dispatch/guards 4349/4356; Web Shell 194/194. Failure attribution (same test file + same test name run on main tip 0adae3c254): the config.test.ts lease failure and client.test.ts microcompaction failure reproduce byte-identically on main; the 3 acpAgent.test.ts failures and the run-qwen-serve metrics-flush failure reproduce on main; 3 further failures seen only under parallel load (session shell on trusted loopback, two SSE tests) pass in isolation on both head and main — load-correlated flake, not signal. No failure is attributable to this PR.
• Typecheck: npm run typecheck clean in the head worktree (log typecheck.log).
• Trial merge: git merge-tree origin/main × head exits clean, 0 conflicts. Since the base, main touched 3 files this PR also touches (packages/cli/src/serve/server.ts, server.test.ts, packages/web-shell/client/i18n.tsx); all merge textually clean, and the merged state is what the PR's merge-ref CI runs. At report time the only pending PR check is review-pr.
• One observability note, resolved: a truncated:true flip seen across cells was traced (by labeling every incomplete source in the remote script) to my own harness deleting a fixture directory while its files remained in the Git index — the flag was correctly reporting "enumerated files missing on disk". After rebuilding the fixture, truncated:false is stable across 6/6 runs on both targets. The incomplete-results signal works and is conservative in the right direction.

Corrections

None. The earlier rounds' descriptions I re-measured (Bash contract, BOM/CRLF bytes, cancellation semantics, trust gate, 501 boundary, ACP lifecycle, per-operation SSH handshake) are accurate at head.

Not covered

• Real-model Web Shell end-to-end (approval cards, tooltips, dialog copy — O1/O2/O4): previous rounds covered these; the head delta does not touch them.
• Outage/partition injection (firewall drop mid-session): deliberately not repeated here — the LAN report covered it and this round's two targets are other maintainers' machines; I did not touch their firewalls. Registration-time failures (unreachable host, auth failure) are covered above and fail without any local fallback.
• Windows SSH target and ProxyJump: no Windows host available; consistent with the PR's own stated scope.
• Per-commit attribution: verified the aggregate diff and the aa60679971..0fbecd37 delta directly; the PR's middle commits were not individually exercised.
• Sub-modules of the feature not exercised over the wire: interactive pty terminal route, workspace settings hot-path, MCP/LSP/subagents (explicitly unsupported per the PR).
• Repo-wide full test suite and lint: not re-run (PR's own CI covers them; only review-pr was pending at report time).

Methodology

macOS 26 (Apple silicon), Node 24.18.1. Two scratch worktrees (tmp/pr12255-head @ 0fbecd37, tmp/pr12255-prev @ aa60679971) each installed with the pinned pnpm bootstrap and built (npm run build && npm run bundle); readlink -f on node_modules/@qwen-code/qwen-code-core confirmed each tree's internal links resolve into itself, so the A/B arms cannot cross-load. Harnesses (kept in tmp/pr12255-verify-20260922-085449/harnesses/) drive the built dist/ output directly — the SshWorkspaceClient/SshExecutionEnvironment protocol path over real ssh processes, and the bundled daemon over real HTTP — against isolated fixture workspaces on two LAN machines ([email protected] Orange Pi aarch64 Linux; [email protected] Intel Mac). No mocks of the code under test anywhere; remote-byte oracles are od dumps read back over a second SSH channel, and Git oracles are the host's own git. Raw logs per cell live in tmp/pr12255-verify-20260922-085449/logs/; assertions counted here are exactly the scripted ASSERT lines plus the mutation, merge and truncated-stability checks. Remote fixtures were removed from both targets after the run (/root/pr12255-lab-x8 and /Users/wenshao/pr12255-lab-x8, verified absent), and everything the daemon wrote lived inside its isolated state directory.

Evidence

Head 0fbecd37 on the Linux aarch64 target — F1/F2/F4 fixed behaviors all present (28/28).	Defect arm aa60679971 on the same Linux target — all three defects reproduce (22/22 expected-outcome assertions).
Head on the macOS 15.7.9 x86_64 target (bash 3.2, Python 3.9) — first macOS SSH target in any round; stdin-EOF cancellation works there too (28/28).	Defect arm on the same macOS target — contract violation visible as shell=/bin/sh, edit fails on CRLF, markers appear after timeout/cancel (22/22).
Real bundled daemon over real SSH to both targets — registration/trust/files/git/ACP/persistence/local non-regression (56/56).	Mutation matrix over the fix's own tests — each of the 4 mutants dies at exactly the intended test(s).

@qwen-code /triage