版本号改为 0.1.7-beta.1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -2,6 +2,19 @@
 
 每个版本一节，标题写成 `## [版本号]`，可以在后面加日期。发布流程（`.github/workflows/release.yml`）把与 tag 同版本的那一节原样作为更新说明：显示在 GitHub Release 和官网的更新日志里（ShellRS 的更新对话框用「查看更新内容」打开官网的更新日志），用 Markdown 书写，面向使用者。
 
+## [0.1.7-beta.1]
+
+### 修复
+
+- 修复经部分堡垒机上传文件失败、编辑器保存时 SFTP 连接断开。
+
+## [0.1.6]
+
+### 新增
+
+- 外部 CLI 新增 `shellrs exec --terminal`：在 ShellRS 已打开的终端里执行命令，适用于只允许登录一次的堡垒机。
+- 终端右侧显示滚动条，可拖动翻看历史输出。
+
 ## [0.1.6-beta.1]
 
 ### 新增

CLAUDE.md

@@ -280,6 +280,7 @@ cargo test -- --ignored                     # 会读写真实钥匙串的测试
 - **每个标签独立连接、独立传输引擎。** 引擎一次只跑一批，其余在 `TransferQueue` 里排队，引擎的 `Idle` 推动队列前进；进度只归队首；停止的批次挡在队首，等用户继续或移出。
 - **SFTP 独立于终端。** 关闭终端不停传输；断开或删除主机会停止传输，并保留续传数据。
 - **下载严格按偏移顺序写 `.filepart`**，因为续传只信它的长度。
+- **只发 WinSCP 也发的请求**：用户的堡垒机对 `fsetstat` 回 Failure，收到 `fsync@openssh.com`（即使宣称支持）就断开整个会话。所以上传关闭文件后才按路径 `setstat` 设时间和权限；不用任何扩展：不发 fsync，覆盖也不用 `posix-rename@openssh.com`，而是先把旧文件改名成备份、发布后再删（不是原子的）。`protocol_tests` 的 `bastion_server` 对 `fsetstat` 和所有扩展请求都断开会话，守着这条。
 - **文件操作从不跟随符号链接**：删除只删链接本身，改权限跳过链接，传输原样创建链接。
 - **空闲时也要发现断网**：通道流包一层 `WatchedStream`。等待时只持有 `Weak`，不能攥着 `Arc<SftpClient>`，否则「断开」关不掉连接。
 - **选择归面板，不归表格。** `DataTable` 设成 `row_selectable(false)`，`FilePane` 持有按名称保存的 `Selection`。「名称」单元格才是项目，拖文件只从图标和文件名开始，其余地方按下拖动是框选。

Cargo.lock

@@ -7738,7 +7738,7 @@ dependencies = [
 
 [[package]]
 name = "shellrs"
-version = "0.1.6-beta.1"
+version = "0.1.7-beta.1"
 dependencies = [
  "alacritty_terminal",
  "anyhow",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "shellrs"
-version = "0.1.6-beta.1"
+version = "0.1.7-beta.1"
 edition = "2024"
 publish = false
 description = "SSH client and host manager: terminal, SFTP, port forwarding"

README.md

@@ -13,6 +13,7 @@
   <a href="#license"><img src="https://img.shields.io/badge/license-GPL--3.0-blue" alt="License: GPL-3.0"></a>
   <img src="https://img.shields.io/badge/platform-macOS%20%7C%20Windows%20%7C%20Linux-lightgrey" alt="Platform: macOS | Windows | Linux">
   <img src="https://img.shields.io/badge/rust-1.98-orange" alt="Rust 1.98">
+  <a href="https://linux.do"><img src="https://img.shields.io/badge/LINUX-DO-FFB003.svg?logo=data:image/svg%2bxml;base64,DQo8c3ZnIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgd2lkdGg9IjEwMCIgaGVpZ2h0PSIxMDAiPjxwYXRoIGQ9Ik00Ni44Mi0uMDU1aDYuMjVxMjMuOTY5IDIuMDYyIDM4IDIxLjQyNmM1LjI1OCA3LjY3NiA4LjIxNSAxNi4xNTYgOC44NzUgMjUuNDV2Ni4yNXEtMi4wNjQgMjMuOTY4LTIxLjQzIDM4LTExLjUxMiA3Ljg4NS0yNS40NDUgOC44NzRoLTYuMjVxLTIzLjk3LTIuMDY0LTM4LjAwNC0yMS40M1EuOTcxIDY3LjA1Ni0uMDU0IDUzLjE4di02LjQ3M0MxLjM2MiAzMC43ODEgOC41MDMgMTguMTQ4IDIxLjM3IDguODE3IDI5LjA0NyAzLjU2MiAzNy41MjcuNjA0IDQ2LjgyMS0uMDU2IiBzdHlsZT0ic3Ryb2tlOm5vbmU7ZmlsbC1ydWxlOmV2ZW5vZGQ7ZmlsbDojZWNlY2VjO2ZpbGwtb3BhY2l0eToxIi8+PHBhdGggZD0iTTQ3LjI2NiAyLjk1N3EyMi41My0uNjUgMzcuNzc3IDE1LjczOGE0OS43IDQ5LjcgMCAwIDEgNi44NjcgMTAuMTU3cS00MS45NjQuMjIyLTgzLjkzIDAgOS43NS0xOC42MTYgMzAuMDI0LTI0LjM4N2E2MSA2MSAwIDAgMSA5LjI2Mi0xLjUwOCIgc3R5bGU9InN0cm9rZTpub25lO2ZpbGwtcnVsZTpldmVub2RkO2ZpbGw6IzE5MTkxOTtmaWxsLW9wYWNpdHk6MSIvPjxwYXRoIGQ9Ik03Ljk4IDcwLjkyNmMyNy45NzctLjAzNSA1NS45NTQgMCA4My45My4xMTNRODMuNDI2IDg3LjQ3MyA2Ni4xMyA5NC4wODZxLTE4LjgxIDYuNTQ0LTM2LjgzMi0xLjg5OC0xNC4yMDMtNy4wOS0yMS4zMTctMjEuMjYyIiBzdHlsZT0ic3Ryb2tlOm5vbmU7ZmlsbC1ydWxlOmV2ZW5vZGQ7ZmlsbDojZjlhZjAwO2ZpbGwtb3BhY2l0eToxIi8+PC9zdmc+" alt="LINUX DO"></a>
 </p>
 
 <p align="center"><b>English</b> | <a href="README.zh-CN.md">简体中文</a></p>

README.zh-CN.md

@@ -13,6 +13,7 @@
   <a href="#许可证"><img src="https://img.shields.io/badge/license-GPL--3.0-blue" alt="License: GPL-3.0"></a>
   <img src="https://img.shields.io/badge/platform-macOS%20%7C%20Windows%20%7C%20Linux-lightgrey" alt="Platform: macOS | Windows | Linux">
   <img src="https://img.shields.io/badge/rust-1.98-orange" alt="Rust 1.98">
+  <a href="https://linux.do"><img src="https://img.shields.io/badge/LINUX-DO-FFB003.svg?logo=data:image/svg%2bxml;base64,DQo8c3ZnIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgd2lkdGg9IjEwMCIgaGVpZ2h0PSIxMDAiPjxwYXRoIGQ9Ik00Ni44Mi0uMDU1aDYuMjVxMjMuOTY5IDIuMDYyIDM4IDIxLjQyNmM1LjI1OCA3LjY3NiA4LjIxNSAxNi4xNTYgOC44NzUgMjUuNDV2Ni4yNXEtMi4wNjQgMjMuOTY4LTIxLjQzIDM4LTExLjUxMiA3Ljg4NS0yNS40NDUgOC44NzRoLTYuMjVxLTIzLjk3LTIuMDY0LTM4LjAwNC0yMS40M1EuOTcxIDY3LjA1Ni0uMDU0IDUzLjE4di02LjQ3M0MxLjM2MiAzMC43ODEgOC41MDMgMTguMTQ4IDIxLjM3IDguODE3IDI5LjA0NyAzLjU2MiAzNy41MjcuNjA0IDQ2LjgyMS0uMDU2IiBzdHlsZT0ic3Ryb2tlOm5vbmU7ZmlsbC1ydWxlOmV2ZW5vZGQ7ZmlsbDojZWNlY2VjO2ZpbGwtb3BhY2l0eToxIi8+PHBhdGggZD0iTTQ3LjI2NiAyLjk1N3EyMi41My0uNjUgMzcuNzc3IDE1LjczOGE0OS43IDQ5LjcgMCAwIDEgNi44NjcgMTAuMTU3cS00MS45NjQuMjIyLTgzLjkzIDAgOS43NS0xOC42MTYgMzAuMDI0LTI0LjM4N2E2MSA2MSAwIDAgMSA5LjI2Mi0xLjUwOCIgc3R5bGU9InN0cm9rZTpub25lO2ZpbGwtcnVsZTpldmVub2RkO2ZpbGw6IzE5MTkxOTtmaWxsLW9wYWNpdHk6MSIvPjxwYXRoIGQ9Ik03Ljk4IDcwLjkyNmMyNy45NzctLjAzNSA1NS45NTQgMCA4My45My4xMTNRODMuNDI2IDg3LjQ3MyA2Ni4xMyA5NC4wODZxLTE4LjgxIDYuNTQ0LTM2LjgzMi0xLjg5OC0xNC4yMDMtNy4wOS0yMS4zMTctMjEuMjYyIiBzdHlsZT0ic3Ryb2tlOm5vbmU7ZmlsbC1ydWxlOmV2ZW5vZGQ7ZmlsbDojZjlhZjAwO2ZpbGwtb3BhY2l0eToxIi8+PC9zdmc+" alt="LINUX DO"></a>
 </p>
 
 <p align="center"><a href="README.md">English</a> | <b>简体中文</b></p>

docs/manual.en.md

@@ -193,6 +193,7 @@ Remote terminal tabs and SFTP tabs use the host’s system badge as their icon (
 
 The terminal’s context menu has “Copy”, “Paste”, “Find…” and “Clear screen”; a remote terminal’s also has “Open SFTP”, “Reconnect” and “Disconnect”. “Disconnect” disconnects only this tab: the tab stays and can reconnect at any time, and other tabs and SFTP for the same host aren’t affected.
 
+- **Scrollback**: each terminal keeps the last 10,000 lines. Scroll up with the wheel or trackpad and a scrollbar appears on the right (as in the app’s other lists, following the system’s “Show scroll bars” setting); drag it, or click the track to jump there. Full-screen programs such as vim, less and top have no scrollback and show no scrollbar.
 - **Find** (⌘F, or Ctrl+Shift+F on Windows and Linux): opens the find bar at the top right of the terminal and searches the screen and the scrollback for the literal text. An all-lowercase query ignores case; one with capital letters matches case. All matches are highlighted, the current one darker, and the find bar shows “current/total”. Enter or ⌘G (F3) goes to the next match (newer output), Shift+Enter or ⌘⇧G (Shift+F3) to the previous one (older output), wrapping around at the ends. Esc closes it. If text is selected when it opens, that text becomes the query.
 - **Clear screen** (⌘K, or Ctrl+Shift+K on Windows and Linux; when the terminal doesn’t have focus, ⌘K still focuses the sidebar’s search box): clears the screen and the scrollback, leaving only the prompt line the cursor is on, including anything typed but not yet entered. Clearing happens only locally; nothing is sent to the server. It isn’t available while a full-screen program such as vim or top is running.
 - **Links**: `http://` and `https://` addresses in the output, and links that programs mark explicitly (such as `ls --hyperlink` and gcc’s error messages), are shown in blue and underlined. Hold ⌘ (Ctrl on Windows and Linux) and click to open one in the system browser; a plain click still selects text. Rest the pointer on a link for a moment to see its real address: for a link a program marks, the text shown can differ from the address. A trailing period, comma or unmatched closing parenthesis isn’t part of the address, and a long address wrapped over two lines is still one link. Other schemes (such as `file://`) aren’t treated as links.
@@ -384,7 +385,7 @@ Works like WinSCP’s queue panel: it appears below the two panes when there are
 
 ## Resuming and replacing
 
-Files are first written to `<destination file name>.filepart`. Write requests go through a bounded pipeline, and the real file is published only after every write has been acknowledged and the file has closed successfully; when the server supports it, `fsync@openssh.com` is called first. Servers that support `posix-rename@openssh.com` replace the file atomically; on other servers, the old file is first moved to `.shellrs-<UUID>.backup` and then the new file is published, a compatibility path that isn’t guaranteed to be atomic. If the reply to a publish is lost, ShellRS recovers using the managed temporary path, the stage, the type and the size; when it can’t tell safely, it keeps the recovery files and reports it.
+Files are first written to `<destination file name>.filepart`. Write requests go through a bounded pipeline, and once every write has been acknowledged and the file has closed successfully, its modification time (and, over an existing file, that file’s permissions) is set by path before the real file is published. Over an existing file, the old file is first moved to `.shellrs-<UUID>.backup`, then the new file is published and the backup deleted; this replacement isn’t atomic, as the destination is briefly missing between the two renames. Like WinSCP, transfers use no SFTP extensions (`fsync@openssh.com`, `posix-rename@openssh.com` and so on) and set no attributes on an open file: some bastion hosts refuse these requests, or even end the whole session over them. If the reply to a publish is lost, ShellRS recovers using the managed temporary path, the stage, the type and the size; when it can’t tell safely, it keeps the recovery files and reports it.
 
 Resume records are kept in `upload-resume/` in the app’s data folder, as versioned JSON written atomically; they never contain passwords, passphrases or private keys, and they don’t change the database schema. A record ties together the endpoint, host fingerprint, source, destination and safe-replace stage. Resuming works as in WinSCP: ShellRS reads the current size of the remote `.filepart`, skips that much of the local file and carries on; it’s up to you to make sure the source is still the same version. Uploads never read the remote file back to verify it.
 

docs/manual.md

@@ -199,6 +199,7 @@ ShellRS /sessionname=标签名 sftp://用户[:密码]@地址[:端口]
 
 右键终端内容区可复制、粘贴、查找、清屏；远程终端另有打开 SFTP、重新连接和断开连接。断开连接只断开这一个标签，标签保留，可随时重新连接，同一台主机的其他标签和 SFTP 不受影响。
 
+- **回滚历史**：每个终端保留最近 10000 行。用滚轮或触控板往上翻看，这时右侧出现滚动条（和应用里其他列表一样，按系统的「显示滚动条」设置），可以拖动，点轨道直接跳到那个位置。vim、less、top 这类全屏程序没有回滚历史，不显示滚动条。
 - **查找**（⌘F，其他平台 Ctrl+Shift+F）：在终端右上角打开查找条，按字面量搜索屏幕和回滚历史。查询全为小写时不区分大小写，含大写字母时区分。所有匹配高亮显示，当前项颜色更深，查找条显示「当前项/总数」。回车或 ⌘G（F3）跳到下一项（更新的输出），Shift+回车或 ⌘⇧G（Shift+F3）跳到上一项（更早的输出），到头后循环。Esc 关闭。打开时如有选中文字，会作为查询词。
 - **清屏**（⌘K，其他平台 Ctrl+Shift+K；焦点不在终端时 ⌘K 仍是聚焦侧栏的搜索框）：清掉屏幕和回滚历史，只留下光标所在的提示符行，包括已输入但未回车的内容。清屏只在本地进行，不向服务器发送任何内容。vim、top 等全屏程序运行时不可用。
 - **链接**：输出里的 `http://`、`https://` 地址，以及程序明确标出的链接（如 `ls --hyperlink`、gcc 的报错），显示为带下划线的蓝色。按住 ⌘（其他平台 Ctrl）单击，用系统浏览器打开；不按时单击照旧是选择文字。鼠标在链接上停一会儿会显示它真正的地址：程序标出的链接，显示的文字可以和地址不同。地址末尾的句号、逗号和不成对的右括号不算在内；被折成两行的长地址仍是一个链接。其他协议（如 `file://`）不当作链接。
@@ -390,7 +391,7 @@ bash 在 shell 退出时才把这次执行的命令写进历史文件，所以
 
 ## 断点续传和替换
 
-文件先写入 `<目标文件名>.filepart`。写入请求采用有界流水线，收到每个写入确认并关闭成功后才发布正式文件；服务器支持时先调用 `fsync@openssh.com`。支持 `posix-rename@openssh.com` 的服务器使用原子替换；其他服务器先将旧文件移到 `.shellrs-<UUID>.backup`，再发布新文件，此兼容路径不保证原子性。发布响应丢失时根据受管理临时路径、阶段、类型和大小恢复，无法安全判断则保留恢复文件并报告。
+文件先写入 `<目标文件名>.filepart`。写入请求采用有界流水线，收到每个写入确认并关闭成功后，按路径设置修改时间（覆盖时还有原文件的权限），再发布正式文件。覆盖已有文件时，先将旧文件移到 `.shellrs-<UUID>.backup`，再发布新文件，最后删除备份；这样替换不是原子的，两次改名之间目标短暂不存在。和 WinSCP 一样，传输不用任何 SFTP 扩展（`fsync@openssh.com`、`posix-rename@openssh.com` 等），也不对打开的文件设置属性：有的堡垒机拒绝这些请求，甚至因此断开整个会话。发布响应丢失时根据受管理临时路径、阶段、类型和大小恢复，无法安全判断则保留恢复文件并报告。
 
 续传记录保存在应用数据目录的 `upload-resume/`，采用版本化 JSON 和原子写入，不写入密码、口令或私钥，不改变数据库结构。记录用于绑定端点、主机指纹、来源、目标和安全替换阶段。续传方式与 WinSCP 相同：读取远端 `.filepart` 的当前大小，在本地文件中跳过相同长度并继续传输；使用者需确保来源仍是同一版本。上传过程不会为了校验而回读远端文件内容。
 

locales/sftp.yml

@@ -305,9 +305,6 @@ sftp.client.no_path:
 sftp.client.no_link_target:
   zh-CN: 无法读取链接目标
   en: Couldn’t read the link target
-sftp.client.bad_rename_reply:
-  zh-CN: 服务器返回了无效的重命名响应
-  en: The server sent an invalid reply to the rename
 sftp.client.ambiguous_name:
   zh-CN: 远端名称包含无法可靠表示的字符，已停止操作
   en: A remote name has characters that can’t be shown reliably, so the operation stopped

src/sftp/client.rs

@@ -6,7 +6,7 @@ use anyhow::{Result, anyhow, bail};
 use futures::StreamExt as _;
 use russh_sftp::{
     client::{RawSftpSession, error::Error},
-    protocol::{FileAttributes, OpenFlags, Packet, StatusCode},
+    protocol::{FileAttributes, OpenFlags, StatusCode},
 };
 use std::{
     pin::Pin,
@@ -34,25 +34,29 @@ pub(crate) trait RemoteFs {
     async fn open_read(&self, path: &RemotePath) -> Result<String>;
     /// Up to `len` bytes at `offset`; may return fewer. `None` at end of file.
     async fn read(&self, handle: &str, offset: u64, len: u32) -> Result<Option<Vec<u8>>>;
-    async fn sync(&self, handle: &str) -> Result<()>;
     async fn write(&self, handle: &str, offset: u64, bytes: Vec<u8>) -> Result<()>;
     async fn close(&self, handle: &str) -> Result<()>;
+    /// Set the modification time and permission bits of a closed file by its
+    /// path (`setstat`), as WinSCP does: a bastion host has been seen to
+    /// refuse `fsetstat` on a file still open.
     async fn attributes(
         &self,
-        handle: &str,
+        path: &RemotePath,
         modified: Option<u32>,
         permissions: Option<u32>,
     ) -> Result<()>;
     async fn mkdir(&self, path: &RemotePath) -> Result<()>;
     async fn symlink(&self, target: &str, path: &RemotePath) -> Result<()>;
     async fn readlink(&self, path: &RemotePath) -> Result<String>;
-    async fn rename(&self, from: &RemotePath, to: &RemotePath, replace: bool) -> Result<()>;
+    /// A plain `rename`, which fails when `to` is there: replacing a file
+    /// moves the old one aside first, as WinSCP never sends
+    /// `posix-rename@openssh.com` either.
+    async fn rename(&self, from: &RemotePath, to: &RemotePath) -> Result<()>;
     async fn remove(&self, path: &RemotePath) -> Result<()>;
     /// Remove an empty directory.
     async fn rmdir(&self, path: &RemotePath) -> Result<()>;
     /// Set the permission bits of a path (`setstat`, which follows links).
     async fn set_permissions(&self, path: &RemotePath, permissions: u32) -> Result<()>;
-    fn atomic_replace(&self) -> bool;
 }
 
 pub(crate) struct SftpClient {
@@ -61,8 +65,6 @@ pub(crate) struct SftpClient {
     /// Turns true once the server side of the SFTP stream has ended.
     closed: watch::Receiver<bool>,
     fingerprint: String,
-    atomic_replace: bool,
-    fsync: bool,
 }
 impl SftpClient {
     pub async fn connect(
@@ -92,21 +94,14 @@ impl SftpClient {
         if version.version != 3 {
             bail!(t!("sftp.client.no_v3"));
         }
-        let atomic_replace = version
-            .extensions
-            .get("posix-rename@openssh.com")
-            .is_some_and(|v| v == "1");
-        let fsync = version
-            .extensions
-            .get("fsync@openssh.com")
-            .is_some_and(|v| v == "1");
+        // No extension is used, even when offered: a bastion host that offers
+        // `fsync@openssh.com` has been seen to end the whole session on it.
+        // WinSCP sends none of them for a transfer.
         Ok(Self {
             raw,
             ssh,
             closed,
             fingerprint,
-            atomic_replace,
-            fsync,
         })
     }
     /// Only the Unix tests have a local `sftp-server` to talk to.
@@ -281,12 +276,6 @@ impl RemoteFs for SftpClient {
             Err(error) => Err(error.into()),
         }
     }
-    async fn sync(&self, handle: &str) -> Result<()> {
-        if self.fsync {
-            self.raw.fsync(handle).await?;
-        }
-        Ok(())
-    }
     async fn write(&self, handle: &str, offset: u64, bytes: Vec<u8>) -> Result<()> {
         self.raw.write(handle, offset, bytes).await?;
         Ok(())
@@ -298,13 +287,13 @@ impl RemoteFs for SftpClient {
 
     async fn attributes(
         &self,
-        handle: &str,
+        path: &RemotePath,
         modified: Option<u32>,
         permissions: Option<u32>,
     ) -> Result<()> {
         self.raw
-            .fsetstat(
-                handle,
+            .setstat(
+                path.as_str(),
                 FileAttributes {
                     mtime: modified,
                     atime: modified,
@@ -337,25 +326,8 @@ impl RemoteFs for SftpClient {
                 .filename,
         )
     }
-    async fn rename(&self, from: &RemotePath, to: &RemotePath, replace: bool) -> Result<()> {
-        if replace {
-            let mut payload = Vec::new();
-            for value in [from.as_str(), to.as_str()] {
-                payload.extend_from_slice(&(value.len() as u32).to_be_bytes());
-                payload.extend_from_slice(value.as_bytes());
-            }
-            match self
-                .raw
-                .extended("posix-rename@openssh.com", payload)
-                .await?
-            {
-                Packet::Status(status) if status.status_code == StatusCode::Ok => {}
-                Packet::Status(status) => return Err(Error::Status(status).into()),
-                _ => bail!(t!("sftp.client.bad_rename_reply")),
-            }
-        } else {
-            self.raw.rename(from.as_str(), to.as_str()).await?;
-        }
+    async fn rename(&self, from: &RemotePath, to: &RemotePath) -> Result<()> {
+        self.raw.rename(from.as_str(), to.as_str()).await?;
         Ok(())
     }
     async fn remove(&self, path: &RemotePath) -> Result<()> {
@@ -381,9 +353,6 @@ impl RemoteFs for SftpClient {
             .await?;
         Ok(())
     }
-    fn atomic_replace(&self) -> bool {
-        self.atomic_replace
-    }
 }
 fn metadata(attrs: &FileAttributes) -> FileMetadata {
     // Compare the whole type field: russh-sftp's `is_dir()` tests one bit,

src/sftp/edit.rs

@@ -381,10 +381,7 @@ pub(crate) async fn write_in_place<F: RemoteFs>(
         let message = format!("{error:#}");
         error.context(SaveFailure::Interrupted(message))
     };
-    let written = match write_all(fs, &handle, bytes).await {
-        Ok(()) => fs.sync(&handle).await,
-        Err(error) => Err(error),
-    };
+    let written = write_all(fs, &handle, bytes).await;
     let close = fs.close(&handle).await;
     written.map_err(interrupted)?;
     close.map_err(interrupted)?;

src/sftp/operations.rs

@@ -18,7 +18,7 @@ pub(crate) async fn run<F: RemoteFs>(fs: &F, operation: &RemoteOperation) -> Res
             if fs.metadata(to).await?.is_some() {
                 bail!(t!("sftp.error.exists", name = to.file_name()));
             }
-            fs.rename(from, to, false).await
+            fs.rename(from, to).await
         }
         RemoteOperation::CreateDirectory { path } => {
             if fs.metadata(path).await?.is_some() {

src/sftp/protocol_tests.rs

@@ -29,6 +29,7 @@ struct TestServer {
     interrupts: Arc<AtomicUsize>,
     hangup: Arc<tokio::sync::Notify>,
     unsupported: bool,
+    bastion: bool,
 }
 struct Handler {
     directory: PathBuf,
@@ -39,6 +40,8 @@ struct Handler {
     /// Ends an SFTP session while nothing is asked of it.
     hangup: Arc<tokio::sync::Notify>,
     unsupported: bool,
+    /// Ends the SFTP session on what a bastion host refuses.
+    bastion: bool,
     channels: HashMap<ChannelId, russh::Channel<server::Msg>>,
 }
 impl server::Server for TestServer {
@@ -52,6 +55,7 @@ impl server::Server for TestServer {
             interrupts: self.interrupts.clone(),
             hangup: self.hangup.clone(),
             unsupported: self.unsupported,
+            bastion: self.bastion,
             channels: HashMap::new(),
         }
     }
@@ -120,6 +124,7 @@ impl server::Handler for Handler {
         let directory = self.directory.clone();
         let interrupts = self.interrupts.clone();
         let hangup = self.hangup.clone();
+        let bastion = self.bastion;
         tokio::spawn(async move {
             let executable = if cfg!(target_os = "macos") {
                 "/usr/libexec/sftp-server"
@@ -149,6 +154,9 @@ impl server::Handler for Handler {
                     }
                     let mut bytes = vec![0; size as usize];
                     reader.read_exact(&mut bytes).await?;
+                    if bastion && refused_by_bastion(&bytes) {
+                        return Err::<(), _>(std::io::Error::other("refused by the bastion host"));
+                    }
                     // SSH_FXP_WRITE (6) for uploads, SSH_FXP_READ (5) for downloads.
                     if matches!(bytes.first(), Some(&5) | Some(&6)) {
                         writes += 1;
@@ -192,7 +200,27 @@ impl Drop for Running {
         self.task.abort();
     }
 }
+/// What a bastion host in front of OpenSSH was seen to refuse, though it
+/// passes on OpenSSH's offer of extensions: `SSH_FXP_FSETSTAT` (10), which it
+/// answered with a failure, and `fsync@openssh.com`, on which it ended the
+/// session. Here every `SSH_FXP_EXTENDED` (200) is refused: like WinSCP,
+/// ShellRS uses none to transfer or save a file.
+fn refused_by_bastion(packet: &[u8]) -> bool {
+    matches!(packet.first(), Some(10 | 200))
+}
 async fn server(directory: PathBuf, interrupts: usize, unsupported: bool) -> Option<Running> {
+    serve(directory, interrupts, unsupported, false).await
+}
+/// A server that ends the SFTP session on what a bastion host refuses.
+async fn bastion_server(directory: PathBuf) -> Option<Running> {
+    serve(directory, 0, false, true).await
+}
+async fn serve(
+    directory: PathBuf,
+    interrupts: usize,
+    unsupported: bool,
+    bastion: bool,
+) -> Option<Running> {
     let listener = match tokio::net::TcpListener::bind(("127.0.0.1", 0)).await {
         Ok(l) => l,
         Err(e) if e.kind() == std::io::ErrorKind::PermissionDenied => {
@@ -215,6 +243,7 @@ async fn server(directory: PathBuf, interrupts: usize, unsupported: bool) -> Opt
         interrupts: interrupts.clone(),
         hangup: hangup.clone(),
         unsupported,
+        bastion,
     };
     let key = russh::keys::PrivateKey::random(
         &mut russh::keys::key::safe_rng(),
@@ -696,3 +725,109 @@ fn scp_style_transfers_land_where_scp_would_put_them() {
         assert!(!remote.join("missing").exists());
     });
 }
+
+/// Behind a bastion host that refuses `fsetstat` and extensions, an upload,
+/// an upload over that file and an editor's save all finish on the one
+/// connection, and the upload keeps the local file's modification time.
+#[test]
+fn uploads_and_saves_get_past_a_bastion_host_that_refuses_fsetstat_and_extensions() {
+    runtime().block_on(async {
+        let temp = tempfile::tempdir().unwrap();
+        let remote = temp.path().join("remote");
+        std::fs::create_dir(&remote).unwrap();
+        let Some(server) = bastion_server(remote.clone()).await else {
+            return;
+        };
+        let worker = worker(server.port, temp.path());
+        let home = loop {
+            match next(&worker).await {
+                SftpEvent::Connected { home } => break home,
+                SftpEvent::Disconnected(e) => panic!("connect failed: {e}"),
+                _ => {}
+            }
+        };
+        let source = temp.path().join("README.md");
+        let modified = std::time::UNIX_EPOCH + Duration::from_secs(1_500_000_000);
+        let write_source = |bytes: &[u8]| {
+            std::fs::write(&source, bytes).unwrap();
+            std::fs::File::options()
+                .write(true)
+                .open(&source)
+                .unwrap()
+                .set_modified(modified)
+                .unwrap();
+        };
+        let upload =
+            || SftpCommand::Upload(UploadRequest::new(vec![source.clone()], home.clone()).unwrap());
+        let uploaded = remote.join("README.md");
+
+        write_source(b"first");
+        let done = transfer(&worker, upload()).await;
+        assert_eq!(done.phase(), TransferPhase::Completed);
+        assert_eq!(std::fs::read(&uploaded).unwrap(), b"first");
+        assert_eq!(
+            std::fs::metadata(&uploaded).unwrap().modified().unwrap(),
+            modified
+        );
+
+        write_source(b"second");
+        worker.commands.send(upload()).await.unwrap();
+        loop {
+            match next(&worker).await {
+                SftpEvent::Question(question) => {
+                    assert_eq!(question.kind(), TransferQuestionKind::Conflict);
+                    worker
+                        .commands
+                        .send(SftpCommand::Answer {
+                            request_id: question.id(),
+                            answer: TransferAnswer::new(TransferChoice::Overwrite, false),
+                        })
+                        .await
+                        .unwrap();
+                }
+                SftpEvent::Progress(p) if p.phase() == TransferPhase::Completed => {
+                    assert_eq!(p.succeeded(), 1);
+                    break;
+                }
+                SftpEvent::Progress(p)
+                    if matches!(
+                        p.phase(),
+                        TransferPhase::Stopped | TransferPhase::Reconnecting
+                    ) =>
+                {
+                    panic!("the upload over the file broke off: {p:?}")
+                }
+                _ => {}
+            }
+        }
+        assert_eq!(std::fs::read(&uploaded).unwrap(), b"second");
+        assert_eq!(
+            std::fs::metadata(&uploaded).unwrap().modified().unwrap(),
+            modified
+        );
+
+        worker
+            .commands
+            .send(SftpCommand::WriteFile {
+                request_id: 7,
+                path: home.join("README.md").unwrap(),
+                bytes: b"edited".to_vec(),
+                expected: None,
+            })
+            .await
+            .unwrap();
+        loop {
+            match next(&worker).await {
+                SftpEvent::FileWritten { request_id, result } => {
+                    assert_eq!(request_id, 7);
+                    result.unwrap();
+                    break;
+                }
+                SftpEvent::Disconnected(e) => panic!("the save broke off: {e}"),
+                _ => {}
+            }
+        }
+        assert_eq!(std::fs::read(&uploaded).unwrap(), b"edited");
+        assert_eq!(server.connections.load(Ordering::SeqCst), 1);
+    });
+}

src/sftp/tests.rs

@@ -41,11 +41,10 @@ struct Remote {
     reads: Cell<usize>,
     short_reads: Cell<bool>,
     renames: Cell<usize>,
-    atomic: bool,
     denied: RefCell<Option<String>>,
 }
 impl Remote {
-    fn new(atomic: bool) -> Self {
+    fn new() -> Self {
         Self {
             nodes: RefCell::new(BTreeMap::new()),
             fault: Cell::new(None),
@@ -55,7 +54,6 @@ impl Remote {
             reads: Cell::new(0),
             short_reads: Cell::new(false),
             renames: Cell::new(0),
-            atomic,
             denied: RefCell::new(None),
         }
     }
@@ -225,9 +223,6 @@ impl RemoteFs for Remote {
         self.writes.set(self.writes.get() + 1);
         self.fail(Fault::Write(self.writes.get()))
     }
-    async fn sync(&self, _: &str) -> Result<()> {
-        Ok(())
-    }
     async fn close(&self, _: &str) -> Result<()> {
         if self.fault.get() == Some(Fault::ChangeTargetOnClose) {
             self.fault.set(None);
@@ -241,12 +236,12 @@ impl RemoteFs for Remote {
     }
     async fn attributes(
         &self,
-        handle: &str,
+        path: &RemotePath,
         modified: Option<u32>,
         permissions: Option<u32>,
     ) -> Result<()> {
         let mut nodes = self.nodes.borrow_mut();
-        let n = nodes.get_mut(handle).unwrap();
+        let n = nodes.get_mut(path.as_str()).unwrap();
         n.metadata = FileMetadata::new(
             EntryKind::File,
             n.data.len() as u64,
@@ -283,13 +278,13 @@ impl RemoteFs for Remote {
     async fn readlink(&self, path: &RemotePath) -> Result<String> {
         Ok(self.nodes.borrow()[path.as_str()].link.clone())
     }
-    async fn rename(&self, from: &RemotePath, to: &RemotePath, replace: bool) -> Result<()> {
+    async fn rename(&self, from: &RemotePath, to: &RemotePath) -> Result<()> {
         if self.fault.get() == Some(Fault::RejectRename(self.renames.get() + 1)) {
             self.fault.set(None);
             bail!("publish denied");
         }
         let mut nodes = self.nodes.borrow_mut();
-        if !replace && nodes.contains_key(to.as_str()) {
+        if nodes.contains_key(to.as_str()) {
             bail!("target exists");
         }
         let node = nodes
@@ -331,9 +326,6 @@ impl RemoteFs for Remote {
         );
         Ok(())
     }
-    fn atomic_replace(&self) -> bool {
-        self.atomic
-    }
 }
 impl Remote {
     /// The path a link chain ends at, as a server's `open` follows it.
@@ -496,7 +488,7 @@ fn recursive_upload_deduplicates_sources_and_preserves_empty_directories_and_lin
         )
         .await
         .unwrap();
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         run(&mut batch, &remote, &answers.control).await.unwrap();
         assert_eq!(remote.bytes("/dest/中文 目录/large.bin"), data);
         assert_eq!(remote.bytes("/dest/中文 目录/零 字节"), Vec::<u8>::new());
@@ -540,7 +532,7 @@ fn winscp_style_upload_finishes_without_a_verification_phase() {
             &answers.control,
         )
         .await;
-        let remote = Remote::new(true);
+        let remote = Remote::new();
 
         run(&mut batch, &remote, &answers.control).await.unwrap();
         tokio::task::yield_now().await;
@@ -583,7 +575,7 @@ fn resume_uses_remote_filepart_size_and_preserves_old_target() {
         let data = vec![71; 150_000];
         std::fs::write(&source, &data).unwrap();
         let journal = Journal::new(tmp.path().join("journal"));
-        let remote = Remote::new(false);
+        let remote = Remote::new();
         remote.file("/dest/file", b"old file intact");
         remote.fault.set(Some(Fault::Write(2)));
         let answers = Answers::new(vec![TransferChoice::Overwrite]);
@@ -633,7 +625,7 @@ fn filepart_larger_than_source_requires_explicit_restart() {
         let source = tmp.path().join("file");
         std::fs::write(&source, vec![1; 100_000]).unwrap();
         let journal = Journal::new(tmp.path().join("journal"));
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.fault.set(Some(Fault::Write(2)));
         let answers = Answers::new(vec![]);
         let mut first = batch(&source, journal.clone(), &answers.control).await;
@@ -663,7 +655,7 @@ fn winscp_style_resume_does_not_prevalidate_the_source_version() {
         let data = vec![1; 100_000];
         std::fs::write(&source, &data).unwrap();
         let journal = Journal::new(tmp.path().join("journal"));
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.fault.set(Some(Fault::Write(2)));
         let answers = Answers::new(vec![]);
         let mut first = batch(&source, journal.clone(), &answers.control).await;
@@ -700,7 +692,7 @@ fn winscp_style_resume_detects_filepart_without_a_local_record() {
         let source = tmp.path().join("file");
         let data = vec![3; 100_000];
         std::fs::write(&source, &data).unwrap();
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.file("/dest/file.filepart", &data[..32_768]);
         let answers = Answers::new(vec![TransferChoice::Resume]);
         let mut upload = batch(
@@ -724,17 +716,12 @@ fn winscp_style_resume_detects_filepart_without_a_local_record() {
 #[test]
 fn lost_replies_at_backup_publish_and_close_are_reconciled() {
     runtime().block_on(async {
-        for (atomic, fault) in [
-            (true, Fault::Rename(1)),
-            (false, Fault::Rename(1)),
-            (false, Fault::Rename(2)),
-            (false, Fault::Close),
-        ] {
+        for fault in [Fault::Rename(1), Fault::Rename(2), Fault::Close] {
             let tmp = tempfile::tempdir_in(std::env::temp_dir().canonicalize().unwrap()).unwrap();
             let source = tmp.path().join("file");
             std::fs::write(&source, b"new contents").unwrap();
             let journal = Journal::new(tmp.path().join("journal"));
-            let remote = Remote::new(atomic);
+            let remote = Remote::new();
             remote.file("/dest/file", b"original");
             remote.fault.set(Some(fault));
             let answers = Answers::new(vec![TransferChoice::Overwrite]);
@@ -756,7 +743,7 @@ fn cancellation_retains_journal_and_skip_does_not_overwrite() {
         let tmp = tempfile::tempdir_in(std::env::temp_dir().canonicalize().unwrap()).unwrap();
         let source = tmp.path().join("file");
         std::fs::write(&source, b"new").unwrap();
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.file("/dest/file", b"old");
         let answers = Answers::new(vec![TransferChoice::Skip]);
         let journal = Journal::new(tmp.path().join("journal"));
@@ -783,7 +770,7 @@ fn directory_permission_error_is_reported_as_failure() {
         let tmp = tempfile::tempdir_in(std::env::temp_dir().canonicalize().unwrap()).unwrap();
         let source = tmp.path().join("blocked");
         std::fs::create_dir(&source).unwrap();
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         *remote.denied.borrow_mut() = Some("/dest/blocked".into());
         let answers = Answers::new(vec![TransferChoice::Skip]);
         let mut batch = batch(
@@ -842,7 +829,7 @@ fn retrying_an_unreadable_folder_adds_only_its_files_to_the_upload() {
         set_mode(0o755);
         assert_eq!(batch.meter.progress.total_bytes(), 10_000);
 
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         run(&mut batch, &remote, &answers.control).await.unwrap();
         assert_eq!(batch.meter.progress.failed(), 0);
         assert_eq!(batch.meter.progress.total_bytes(), 10_300);
@@ -859,7 +846,7 @@ fn retrying_an_unreadable_folder_adds_only_its_files_to_the_download() {
         let tmp = tempfile::tempdir_in(std::env::temp_dir().canonicalize().unwrap()).unwrap();
         let out = tmp.path().join("out");
         std::fs::create_dir(&out).unwrap();
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.nodes.borrow_mut().insert(
             "/srv/folder".into(),
             Node {
@@ -1066,7 +1053,7 @@ fn failed_compatibility_publish_restores_old_target_and_reports_failure() {
         let temp = tempfile::tempdir().unwrap();
         let source = temp.path().join("file");
         std::fs::write(&source, b"new").unwrap();
-        let remote = Remote::new(false);
+        let remote = Remote::new();
         remote.file("/dest/file", b"original");
         remote.fault.set(Some(Fault::RejectRename(2)));
         let answers = Answers::new(vec![TransferChoice::Overwrite, TransferChoice::Skip]);
@@ -1097,7 +1084,7 @@ fn target_changed_during_upload_requires_another_conflict_answer() {
         let temp = tempfile::tempdir().unwrap();
         let source = temp.path().join("file");
         std::fs::write(&source, b"new").unwrap();
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.file("/dest/file", b"original");
         remote.fault.set(Some(Fault::ChangeTargetOnClose));
         let answers = Answers::new(vec![TransferChoice::Overwrite, TransferChoice::Skip]);
@@ -1140,7 +1127,7 @@ fn target_removed_during_upload_still_requires_confirmation() {
         let temp = tempfile::tempdir().unwrap();
         let source = temp.path().join("file");
         std::fs::write(&source, b"new").unwrap();
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.file("/dest/file", b"old");
         remote.fault.set(Some(Fault::RemoveTargetOnClose));
         let answers = Answers::new(vec![TransferChoice::Overwrite, TransferChoice::Skip]);
@@ -1170,7 +1157,7 @@ fn remote_path(path: &str) -> RemotePath {
 #[test]
 fn deleting_a_tree_removes_links_but_never_what_they_point_to() {
     runtime().block_on(async {
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.dir("/keep", 0o755);
         remote.file("/keep/important", b"data");
         remote.dir("/gone", 0o755);
@@ -1198,7 +1185,7 @@ fn deleting_a_tree_removes_links_but_never_what_they_point_to() {
 #[test]
 fn recursive_permissions_skip_links_and_can_keep_directories_searchable() {
     runtime().block_on(async {
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.dir("/site", 0o700);
         remote.dir("/site/css", 0o700);
         remote.file("/site/css/a.css", b"a");
@@ -1231,7 +1218,7 @@ fn recursive_permissions_skip_links_and_can_keep_directories_searchable() {
 #[test]
 fn rename_and_create_refuse_existing_names() {
     runtime().block_on(async {
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.file("/a", b"a");
         remote.file("/b", b"b");
         let error = super::operations::run(
@@ -1329,7 +1316,7 @@ fn download_copies_trees_links_and_empty_directories_in_order() {
         for short_reads in [false, true] {
             let out = tmp.path().join(format!("out-{short_reads}"));
             std::fs::create_dir(&out).unwrap();
-            let remote = Remote::new(true);
+            let remote = Remote::new();
             remote.short_reads.set(short_reads);
             remote.dir("/srv/中文 目录", 0o755);
             remote.file("/srv/中文 目录/large.bin", &data);
@@ -1385,7 +1372,7 @@ fn download_resumes_from_the_partial_file_after_a_lost_connection() {
     runtime().block_on(async {
         let tmp = tempfile::tempdir_in(std::env::temp_dir().canonicalize().unwrap()).unwrap();
         let data: Vec<u8> = (0..300_000).map(|i| (i % 253) as u8).collect();
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.file("/big", &data);
         remote.fault.set(Some(Fault::Read(5)));
         let journal = DownloadJournal::new(tmp.path().join("journal"));
@@ -1440,7 +1427,7 @@ fn download_asks_before_overwriting_and_keeps_the_replaced_permissions() {
             use std::os::unix::fs::PermissionsExt as _;
             std::fs::set_permissions(&target, std::fs::Permissions::from_mode(0o600)).unwrap();
         }
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.file("/file", b"new contents");
         let journal = DownloadJournal::new(tmp.path().join("journal"));
         let answers = Answers::new(vec![TransferChoice::Skip]);
@@ -1484,7 +1471,7 @@ fn download_asks_before_overwriting_and_keeps_the_replaced_permissions() {
 fn a_changed_remote_file_is_not_resumed_and_discard_cleans_up() {
     runtime().block_on(async {
         let tmp = tempfile::tempdir_in(std::env::temp_dir().canonicalize().unwrap()).unwrap();
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.file("/file", &vec![7; 200_000]);
         remote.fault.set(Some(Fault::Read(4)));
         let journal = DownloadJournal::new(tmp.path().join("journal"));
@@ -1554,7 +1541,7 @@ fn a_changed_remote_file_is_not_resumed_and_discard_cleans_up() {
 fn download_cancellation_keeps_the_partial_file() {
     runtime().block_on(async {
         let tmp = tempfile::tempdir_in(std::env::temp_dir().canonicalize().unwrap()).unwrap();
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.file("/file", &vec![1; 100_000]);
         let answers = Answers::new(vec![]);
         let mut batch = download_batch(
@@ -1745,7 +1732,7 @@ fn an_scp_upload_takes_the_destination_name_and_keeps_the_execute_bits() {
         let source = tmp.path().join("build.sh");
         std::fs::write(&source, b"#!/bin/sh\n").unwrap();
         std::fs::set_permissions(&source, std::fs::Permissions::from_mode(0o755)).unwrap();
-        let remote = Remote::new(true);
+        let remote = Remote::new();
 
         let request = UploadRequest::scp(source.clone(), remote_path("/dest/deploy.sh"))
             .resolved(remote_path("/dest"), Some("deploy.sh".into()));
@@ -1797,7 +1784,7 @@ fn an_scp_download_takes_the_destination_name_and_keeps_the_execute_bits() {
         let tmp = tempfile::tempdir_in(std::env::temp_dir().canonicalize().unwrap()).unwrap();
         let out = tmp.path().join("out");
         std::fs::create_dir(&out).unwrap();
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.file("/srv/run.sh", b"#!/bin/sh\n");
         remote
             .nodes
@@ -1856,7 +1843,7 @@ fn an_scp_download_takes_the_destination_name_and_keeps_the_execute_bits() {
 #[test]
 fn a_text_file_is_read_whole_through_short_and_reordered_reads() {
     runtime().block_on(async {
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         let text: String = (0..40_000).map(|i| format!("line {i}\n")).collect();
         remote.file("/etc/app.conf", text.as_bytes());
         remote.short_reads.set(true);
@@ -1875,7 +1862,7 @@ fn a_text_file_is_read_whole_through_short_and_reordered_reads() {
 #[test]
 fn a_link_is_followed_to_the_file_it_points_at() {
     runtime().block_on(async {
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.file("/srv/real.conf", b"old\n");
         remote.link("/etc/app.conf", "/srv/real.conf");
         let path = remote_path("/etc/app.conf");
@@ -1896,7 +1883,7 @@ fn a_link_is_followed_to_the_file_it_points_at() {
 #[test]
 fn directories_large_files_and_binary_files_are_refused() {
     runtime().block_on(async {
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.dir("/etc", 0o755);
         remote.file("/var/big.log", &vec![b'x'; EDIT_LIMIT as usize + 1]);
         let mut binary = vec![b'a'; 1_000_000];
@@ -1924,7 +1911,7 @@ fn directories_large_files_and_binary_files_are_refused() {
 #[test]
 fn a_save_writes_in_place_and_keeps_the_permissions() {
     runtime().block_on(async {
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         let long: Vec<u8> = (0..100_000u32).map(|i| (i % 251) as u8 + 1).collect();
         remote.file("/etc/app.conf", &long);
         let path = remote_path("/etc/app.conf");
@@ -1952,7 +1939,7 @@ fn a_save_writes_in_place_and_keeps_the_permissions() {
 #[test]
 fn a_save_over_a_file_changed_or_removed_since_is_refused() {
     runtime().block_on(async {
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.file("/etc/app.conf", b"mine\n");
         let path = remote_path("/etc/app.conf");
         let file = read_text(&remote, &path).await.unwrap();
@@ -1980,7 +1967,7 @@ fn a_save_over_a_file_changed_or_removed_since_is_refused() {
 #[test]
 fn a_save_that_fails_after_truncating_is_interrupted() {
     runtime().block_on(async {
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.file("/etc/app.conf", &vec![b'a'; 200_000]);
         remote.fault.set(Some(Fault::Write(2)));
         let error = write_in_place(
@@ -2123,7 +2110,7 @@ fn local_files_are_edited_in_place_through_links() {
 #[test]
 fn a_binary_file_is_read_whole_for_a_preview_within_its_limit() {
     runtime().block_on(async {
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         let image: Vec<u8> = (0..300_000u32).map(|i| (i % 256) as u8).collect();
         remote.file("/srv/photo.png", &image);
         remote.short_reads.set(true);
@@ -2169,7 +2156,7 @@ fn a_sync_copies_only_what_changed_since_the_last() {
             .unwrap();
         std::fs::write(dist.join("assets/logo.png"), b"png").unwrap();
         std::os::unix::fs::symlink("index.html", dist.join("home.html")).unwrap();
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.dir("/srv", 0o755);
 
         let answers = Answers::new(vec![]);
@@ -2217,7 +2204,7 @@ fn a_sync_with_delete_removes_what_is_not_here_and_nothing_it_cannot_see() {
         std::fs::set_permissions(dist.join("locked"), std::fs::Permissions::from_mode(0o000))
             .unwrap();
 
-        let remote = Remote::new(true);
+        let remote = Remote::new();
         remote.dir("/srv/app", 0o755);
         remote.file("/srv/app/keep.txt", b"k");
         remote.file("/srv/app/extra.txt", b"x");

src/sftp/upload.rs

@@ -532,25 +532,6 @@ impl UploadBatch {
                 uploaded += length;
                 self.meter.advance(length, uploaded, control);
             }
-            control
-                .run(
-                    fs.attributes(
-                        &handle,
-                        u32::try_from(source_metadata.modified_ns / 1_000_000_000).ok(),
-                        record
-                            .original
-                            .as_ref()
-                            .and_then(FileMetadata::permissions)
-                            .or_else(|| {
-                                self.preserve_mode
-                                    .then(|| item.metadata.permissions())
-                                    .flatten()
-                                    .map(|mode| mode & 0o777)
-                            }),
-                    ),
-                )
-                .await?;
-            control.run(fs.sync(&handle)).await?;
             Ok(())
         }
         .await;
@@ -559,7 +540,24 @@ impl UploadBatch {
         let close = fs.close(&handle).await;
         result?;
         close?;
-        Ok(())
+        control
+            .run(
+                fs.attributes(
+                    &record.temporary,
+                    u32::try_from(source_metadata.modified_ns / 1_000_000_000).ok(),
+                    record
+                        .original
+                        .as_ref()
+                        .and_then(FileMetadata::permissions)
+                        .or_else(|| {
+                            self.preserve_mode
+                                .then(|| item.metadata.permissions())
+                                .flatten()
+                                .map(|mode| mode & 0o777)
+                        }),
+                ),
+            )
+            .await
     }
     async fn matches_expected_item<F: RemoteFs>(
         &self,
@@ -603,7 +601,7 @@ impl UploadBatch {
             if fs.metadata(&record.target).await?.is_none()
                 && fs.metadata(&record.backup).await?.is_some()
             {
-                fs.rename(&record.backup, &record.target, false).await?;
+                fs.rename(&record.backup, &record.target).await?;
             }
             bail!(t!("sftp.upload.publish_unconfirmed"));
         }
@@ -635,24 +633,22 @@ impl UploadBatch {
             record.original = current;
             self.journal.save(record).await?;
             if let Some(source_metadata) = &record.source_metadata {
-                let handle = control.run(fs.open(&record.temporary, false)).await?;
-                let result = control
+                control
                     .run(fs.attributes(
-                        &handle,
+                        &record.temporary,
                         u32::try_from(source_metadata.modified_ns / 1_000_000_000).ok(),
                         record.original.as_ref().and_then(FileMetadata::permissions),
                     ))
-                    .await;
-                let closed = fs.close(&handle).await;
-                result?;
-                closed?;
+                    .await?;
             }
         }
-        if backup.is_none() && record.original.is_some() && !fs.atomic_replace() {
+        // Over a file, the old one is moved aside first and removed once
+        // the new one is in its place: no `posix-rename@openssh.com`.
+        if backup.is_none() && record.original.is_some() {
             record.phase = PublishPhase::BackingUp;
             self.journal.save(record).await?;
             control
-                .run(fs.rename(&record.target, &record.backup, false))
+                .run(fs.rename(&record.target, &record.backup))
                 .await?;
             record.phase = PublishPhase::BackedUp;
             self.journal.save(record).await?;
@@ -660,11 +656,7 @@ impl UploadBatch {
         record.phase = PublishPhase::Publishing;
         self.journal.save(record).await?;
         let result = control
-            .run(fs.rename(
-                &record.temporary,
-                &record.target,
-                fs.atomic_replace() && record.original.is_some() && backup.is_none(),
-            ))
+            .run(fs.rename(&record.temporary, &record.target))
             .await;
         if let Err(error) = result {
             if !super::client::is_network_error(&error)
@@ -672,7 +664,7 @@ impl UploadBatch {
                 && fs.metadata(&record.target).await?.is_none()
                 && fs.metadata(&record.backup).await?.is_some()
             {
-                fs.rename(&record.backup, &record.target, false).await?;
+                fs.rename(&record.backup, &record.target).await?;
                 record.phase = PublishPhase::Ready;
                 self.journal.save(record).await?;
             }
@@ -701,7 +693,7 @@ impl UploadBatch {
         )?;
         if fs.metadata(&record.backup).await?.is_some() {
             if fs.metadata(&record.target).await?.is_none() {
-                fs.rename(&record.backup, &record.target, false).await?;
+                fs.rename(&record.backup, &record.target).await?;
             } else {
                 bail!(t!("sftp.upload.backup_and_target"));
             }

src/terminal/engine.rs

@@ -63,6 +63,8 @@ pub struct TerminalSnapshot {
     pub cursor_shape: CursorShape,
     pub cursor_blinking: bool,
     pub display_offset: usize,
+    /// The lines above the screen, which the view can scroll back through.
+    pub history_size: usize,
     pub colors: [Option<Rgb>; COUNT],
     /// The addresses of the links on screen, by the cells' `link`.
     pub links: Vec<gpui_kit::SharedString>,
@@ -360,6 +362,11 @@ impl TerminalEngine {
         cx.notify();
     }
 
+    /// Scrolls the view without a context, for the scrollbar's drag.
+    pub fn scrollback(&self) -> Scrollback {
+        Scrollback(self.runtime.term.clone())
+    }
+
     pub fn start_selection(
         &mut self,
         point: Point,
@@ -588,12 +595,35 @@ impl TerminalEngine {
             cursor_shape: content.cursor.shape,
             cursor_blinking: term.cursor_style().blinking,
             display_offset: content.display_offset,
+            history_size: term.grid().history_size(),
             colors: std::array::from_fn(|index| content.colors[index]),
             links: links.into_links(),
         }
     }
 }
 
+/// A terminal's view of its history, for the scrollbar, whose drag hands
+/// over a position and no context: whoever draws the terminal is told to
+/// redraw it. Taken for each frame, as a restart replaces the terminal.
+#[derive(Clone)]
+pub struct Scrollback(Arc<FairMutex<AlacrittyTerm>>);
+
+impl Scrollback {
+    /// Show the history from `lines` below its oldest line.
+    pub fn scroll_to(&self, lines: usize) {
+        scroll_to(&mut self.0.lock(), lines);
+    }
+}
+
+/// Lines are counted from the top, which stays put while output arrives
+/// below: the view stays where the pointer let it go.
+fn scroll_to(term: &mut AlacrittyTerm, lines: usize) {
+    let grid = term.grid();
+    let offset = grid.history_size().saturating_sub(lines);
+    let delta = offset as i32 - grid.display_offset() as i32;
+    term.scroll_display(Scroll::Delta(delta));
+}
+
 /// The text of the line the cursor is on, or of the nearest line above it
 /// on screen that has any: where a program that rings for an answer has
 /// its question.
@@ -1592,6 +1622,21 @@ mod tests {
         assert_eq!(cells[2].search, SearchMark::None);
     }
 
+    #[test]
+    fn the_scrollbar_counts_lines_from_the_top_of_the_history() {
+        let mut term = test_term(8, 2);
+        feed(&mut term, "1\r\n2\r\n3\r\n4\r\n5".as_bytes());
+        assert_eq!(term.grid().history_size(), 3);
+
+        scroll_to(&mut term, 0);
+        assert_eq!(term.grid().display_offset(), 3);
+        scroll_to(&mut term, 2);
+        assert_eq!(term.grid().display_offset(), 1);
+        // Past the bottom is the bottom.
+        scroll_to(&mut term, 10);
+        assert_eq!(term.grid().display_offset(), 0);
+    }
+
     #[test]
     fn user_input_returns_to_bottom_and_clears_selection() {
         let mut term = test_term(8, 2);

src/terminal/mod.rs

@@ -11,6 +11,7 @@ mod model;
 mod mouse;
 mod notices;
 mod run;
+mod scrollbar;
 mod search;
 mod terminal_panel;
 mod terminal_view;

src/terminal/run_tests.rs

@@ -444,7 +444,11 @@ mod sh {
 
         // Several lines, and a command killed by a signal.
         let (found, _) = run_line("cd /\npwd\nkill -TERM $$");
-        assert_eq!(found[1], Scanned::Output(b"/\n".to_vec()));
+        // dash, as the sh that waits for it, also says "Terminated" there.
+        let Scanned::Output(output) = &found[1] else {
+            panic!("{found:?}");
+        };
+        assert!(output.starts_with(b"/\n"), "{found:?}");
         assert_eq!(found[2], Scanned::End(143));
         let (found, _) = run_line("kill -INT $$");
         assert_eq!(found.last(), Some(&Scanned::End(130)));

src/terminal/scrollbar.rs

@@ -0,0 +1,103 @@
+//! The terminal's scrollbar: gpui-kit's, over the scrollback.
+//!
+//! The grid is drawn afresh each frame and scrolls by whole lines, so there
+//! is no scroll handle for gpui-kit's `Scrollbar` to follow. This one gives
+//! it the history in pixels: a line is a row's height, the content is the
+//! scrollbar's own height plus the history, and the offset is how far the
+//! view is from the oldest line.
+
+use std::cell::Cell;
+use std::rc::Rc;
+
+use gpui_kit::component::scroll::ScrollbarHandle;
+use gpui_kit::{Bounds, Pixels, Point, Size, point, px, size};
+
+use super::TerminalSnapshot;
+use super::engine::Scrollback;
+
+#[derive(Clone)]
+pub(super) struct ScrollbackHandle {
+    scrollback: Scrollback,
+    history_size: usize,
+    display_offset: usize,
+    line_height: Pixels,
+    /// Where the scrollbar lies, which the canvas under it notes before the
+    /// scrollbar is laid out in the same frame.
+    viewport: Rc<Cell<Bounds<Pixels>>>,
+}
+
+impl ScrollbackHandle {
+    pub(super) fn new(
+        scrollback: Scrollback,
+        snapshot: &TerminalSnapshot,
+        line_height: Pixels,
+    ) -> Self {
+        Self {
+            scrollback,
+            history_size: snapshot.history_size,
+            display_offset: snapshot.display_offset,
+            line_height,
+            viewport: Rc::default(),
+        }
+    }
+
+    pub(super) fn set_viewport(&self, bounds: Bounds<Pixels>) {
+        self.viewport.set(bounds);
+    }
+}
+
+impl ScrollbarHandle for ScrollbackHandle {
+    fn viewport_bounds(&self) -> Bounds<Pixels> {
+        self.viewport.get()
+    }
+
+    fn offset(&self) -> Point<Pixels> {
+        point(
+            px(0.),
+            offset(self.history_size, self.display_offset, self.line_height),
+        )
+    }
+
+    fn set_offset(&self, offset: Point<Pixels>) {
+        self.scrollback
+            .scroll_to(lines_from_top(offset.y, self.line_height));
+    }
+
+    fn content_size(&self) -> Size<Pixels> {
+        let viewport = self.viewport.get().size;
+        size(
+            viewport.width,
+            viewport.height + self.line_height * self.history_size as f32,
+        )
+    }
+}
+
+/// How far the view is scrolled down from the oldest line, as gpui-kit
+/// counts it: zero at the top, negative below.
+fn offset(history_size: usize, display_offset: usize, line_height: Pixels) -> Pixels {
+    -(line_height * history_size.saturating_sub(display_offset) as f32)
+}
+
+/// The line at the top of the view for a scroll `offset`.
+fn lines_from_top(offset: Pixels, line_height: Pixels) -> usize {
+    (-offset / line_height).round().max(0.) as usize
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_offset_counts_whole_lines_from_the_oldest() {
+        let line = px(17.);
+        // At the bottom of 100 lines of history, 100 lines down.
+        assert_eq!(offset(100, 0, line), px(-1700.));
+        // At the top.
+        assert_eq!(offset(100, 100, line), px(0.));
+        assert_eq!(lines_from_top(offset(100, 40, line), line), 60);
+        // A drag lands between lines; past the top is the top.
+        assert_eq!(lines_from_top(px(-25.), line), 1);
+        assert_eq!(lines_from_top(px(-26.), line), 2);
+        assert_eq!(lines_from_top(px(5.), line), 0);
+    }
+}

src/terminal/terminal_view.rs

@@ -14,6 +14,7 @@ use gpui_kit::component::{
     h_flex,
     input::{Input, InputEvent, InputState},
     menu::PopupMenu,
+    scroll::Scrollbar,
     tooltip::Tooltip,
     v_flex,
 };
@@ -29,6 +30,7 @@ use crate::connection::{ConnectionPromptReply, Latency};
 use crate::i18n::{UiLocale, t};
 
 use super::mouse::{self, MouseReport, ReportButton, ReportKind};
+use super::scrollbar::ScrollbackHandle;
 use super::search::SearchMark;
 use super::{
     SearchDirection, SharedTerminalTransportFactory, TerminalColors, TerminalEngine, TerminalEvent,
@@ -915,6 +917,12 @@ impl EntityInputHandler for TerminalView {
 impl Render for TerminalView {
     fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
         let snapshot = self.engine.read(cx).snapshot();
+        let font = TerminalFont::current(cx);
+        let scrollback = ScrollbackHandle::new(
+            self.engine.read(cx).scrollback(),
+            &snapshot,
+            font.row_height(window),
+        );
         let view = cx.entity();
         let context_menu = self.context_menu.clone();
         let element = TerminalElement {
@@ -927,7 +935,6 @@ impl Render for TerminalView {
             requested_size: self.requested_size,
         };
 
-        let font = TerminalFont::current(cx);
         let terminal = div()
             .id(self.element_id.clone())
             .test_support()
@@ -984,6 +991,26 @@ impl Render for TerminalView {
             // the terminal's too.
             .bg(TerminalColors::current(cx).background())
             .child(terminal)
+            // Over the whole margin, so the thumb lies mostly beside the text.
+            .child(
+                div()
+                    .absolute()
+                    .inset_0()
+                    .child(
+                        canvas(
+                            {
+                                let scrollback = scrollback.clone();
+                                move |bounds, _, _| scrollback.set_viewport(bounds)
+                            },
+                            |_, _, _, _| {},
+                        )
+                        .absolute()
+                        .top_0()
+                        .left_0()
+                        .size_full(),
+                    )
+                    .child(Scrollbar::vertical(&scrollback).id("terminal-scrollbar")),
+            )
             .when_some(self.find.as_ref(), |container, find| {
                 container.child(self.render_find_bar(find, cx))
             })

tests/ui/terminal.rs

@@ -921,6 +921,25 @@ async fn programs_that_ask_for_the_mouse_hear_clicks_and_the_wheel(cx: &mut Test
     take_written(cx, handle, &factory, "\x1b[<64;5;2M").await;
 }
 
+#[gpui_kit::test]
+async fn the_scrollbar_scrolls_back_through_the_history(cx: &mut TestAppContext) {
+    let text: String = (1..=200).map(|line| format!("line {line}\r\n")).collect();
+    let (handle, workspace, _) = terminal_printing(cx, String::leak(text + "end"), "end").await;
+    let screen = |cx: &mut TestAppContext| cx.read(|cx| local_screen(&workspace, cx));
+    assert!(!screen(cx).lines().any(|line| line == "line 1"));
+
+    // A click at the top of the scrollbar's track, in the margin beside the
+    // text, goes to the oldest line.
+    in_frame(cx, handle, |window, cx| {
+        let terminal = window.find(("local-terminal", 1_u64)).bounds();
+        let top = point(terminal.right() + px(2.), terminal.top() + px(2.));
+        click_at(window, top, gpui_kit::Modifiers::none(), cx);
+    });
+    let lines = screen(cx);
+    assert!(lines.lines().any(|line| line == "line 1"), "{lines}");
+    assert!(!lines.contains("end"), "{lines}");
+}
+
 #[gpui_kit::test]
 async fn a_program_copies_to_the_local_clipboard(cx: &mut TestAppContext) {
     // 「你好」 in base64.