@cerbur/clutch-dsh-worktree 0.1.6 → 0.1.7

package/lib/contract/index.contract.js

@@ -21,6 +21,8 @@ const expectedRemoteKeys = [
     'insertWorktreeBefore',
     'listBindings',
     'bindSession',
+    'ensureWorktreePermission',
+    'normalizeDetachedWorktreePermissions',
 ];
 const managerKeysMatchSpec = true;
 const remoteKeysMatchSpec = true;

package/lib/contract/index.contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.contract.js","sourceRoot":"","sources":["../../src/contract/index.contract.ts"],"names":[],"mappings":"AASA,iDAAiD;AACjD,2HAA2H;AAC3H,MAAM,mBAAmB,GAAG;IAC1B,eAAe;IACf,sBAAsB;IACtB,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;IACtB,cAAc;IACd,aAAa;CACL,CAAC;AACX,MAAM,kBAAkB,GAAG;IACzB,eAAe;IACf,sBAAsB;IACtB,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;IACtB,cAAc;IACd,aAAa;CACL,CAAC;AA6BX,MAAM,oBAAoB,GAAyB,IAAI,CAAC;AACxD,MAAM,mBAAmB,GAAwB,IAAI,CAAC;AACtD,MAAM,+BAA+B,GAAoC,IAAI,CAAC;AAC9E,MAAM,8BAA8B,GAAmC,IAAI,CAAC;AAE5E,4DAA4D;AAC5D,6IAA6I;AAC7I,MAAM,QAAQ,GAAmB;IAC/B,UAAU,EAAE,YAAY;IACxB,WAAW,EAAE,YAAY;IACzB,YAAY,EAAE,8BAA8B;IAC5C,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACjB,CAAC;AACF,MAAM,eAAe,GAA4B;IAC/C,YAAY,EAAE,wBAAwB;IACtC,MAAM,EAAE,kBAAkB;CAC3B,CAAC;AACF,MAAM,MAAM,GAAiB;IAC3B,IAAI,EAAE,iBAAiB;IACvB,SAAS,EAAE,KAAK;IAChB,UAAU,EAAE,KAAK;CAClB,CAAC;AACF,MAAM,OAAO,GAAmB;IAC9B,WAAW,EAAE,YAAY;IACzB,UAAU,EAAE,YAAY;IACxB,SAAS,EAAE,iBAAiB;IAC5B,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF,8CAA8C;AAC9C,8FAA8F;AAC9F,KAAK,oBAAoB,CAAC;AAC1B,KAAK,mBAAmB,CAAC;AACzB,KAAK,+BAA+B,CAAC;AACrC,KAAK,8BAA8B,CAAC;AACpC,KAAK,mBAAmB,CAAC;AACzB,KAAK,kBAAkB,CAAC;AACxB,KAAK,QAAQ,CAAC;AACd,KAAK,eAAe,CAAC;AACrB,KAAK,MAAM,CAAC;AACZ,KAAK,OAAO,CAAC"}
+{"version":3,"file":"index.contract.js","sourceRoot":"","sources":["../../src/contract/index.contract.ts"],"names":[],"mappings":"AASA,iDAAiD;AACjD,2HAA2H;AAC3H,MAAM,mBAAmB,GAAG;IAC1B,eAAe;IACf,sBAAsB;IACtB,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;IACtB,cAAc;IACd,aAAa;CACL,CAAC;AACX,MAAM,kBAAkB,GAAG;IACzB,eAAe;IACf,sBAAsB;IACtB,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;IACtB,cAAc;IACd,aAAa;IACb,0BAA0B;IAC1B,sCAAsC;CAC9B,CAAC;AA6BX,MAAM,oBAAoB,GAAyB,IAAI,CAAC;AACxD,MAAM,mBAAmB,GAAwB,IAAI,CAAC;AACtD,MAAM,+BAA+B,GAAoC,IAAI,CAAC;AAC9E,MAAM,8BAA8B,GAAmC,IAAI,CAAC;AAE5E,4DAA4D;AAC5D,6IAA6I;AAC7I,MAAM,QAAQ,GAAmB;IAC/B,UAAU,EAAE,YAAY;IACxB,WAAW,EAAE,YAAY;IACzB,YAAY,EAAE,8BAA8B;IAC5C,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACjB,CAAC;AACF,MAAM,eAAe,GAA4B;IAC/C,YAAY,EAAE,wBAAwB;IACtC,MAAM,EAAE,kBAAkB;CAC3B,CAAC;AACF,MAAM,MAAM,GAAiB;IAC3B,IAAI,EAAE,iBAAiB;IACvB,SAAS,EAAE,KAAK;IAChB,UAAU,EAAE,KAAK;CAClB,CAAC;AACF,MAAM,OAAO,GAAmB;IAC9B,WAAW,EAAE,YAAY;IACzB,UAAU,EAAE,YAAY;IACxB,SAAS,EAAE,iBAAiB;IAC5B,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF,8CAA8C;AAC9C,8FAA8F;AAC9F,KAAK,oBAAoB,CAAC;AAC1B,KAAK,mBAAmB,CAAC;AACzB,KAAK,+BAA+B,CAAC;AACrC,KAAK,8BAA8B,CAAC;AACpC,KAAK,mBAAmB,CAAC;AACzB,KAAK,kBAAkB,CAAC;AACxB,KAAK,QAAQ,CAAC;AACd,KAAK,eAAe,CAAC;AACrB,KAAK,MAAM,CAAC;AACZ,KAAK,OAAO,CAAC"}

package/lib/contract/index.d.ts

@@ -1,3 +1,4 @@
+import type { WorktreePermissionNormalizationRequest, WorktreePermissionRequest, WorktreePermissionResult } from './worktree-permission.js';
 /**
  * 插件的稳定、浏览器安全契约层；这里只定义领域值与服务形状，不依赖 Git、sidecar 或 Node runtime。
  * Stable, browser-safe contract layer for the plugin; it defines domain values and service shapes without Git, sidecar, or Node runtime dependencies.
@@ -8,7 +9,7 @@
  * 跨 Host/浏览器边界保持稳定的领域错误码；新增、删除或重命名成员都属于公开契约变更。
  * Stable domain error codes shared across the Host/browser boundary; adding, removing, or renaming a member is a public contract change.
  */
-export declare const WORKTREE_ERROR_CODES: readonly ["WORKSPACE_NOT_FOUND", "WORKSPACE_NOT_GIT_REPOSITORY", "GIT_NOT_INSTALLED", "WORKTREE_REQUIRES_INITIAL_COMMIT", "WORKTREE_BRANCH_CONFLICT", "WORKTREE_NOT_FOUND", "WORKTREE_ORDER_INVALID", "WORKTREE_REMOVED", "WORKTREE_IMPORT_INVALID", "WORKTREE_ALREADY_MANAGED", "SESSION_NOT_FOUND", "SESSION_CWD_MISMATCH", "SESSION_ALREADY_BOUND", "SIDECAR_UNAVAILABLE", "SIDECAR_CORRUPT", "SIDECAR_SYNC_REQUIRED", "GIT_OPERATION_FAILED"];
+export declare const WORKTREE_ERROR_CODES: readonly ["WORKSPACE_NOT_FOUND", "WORKSPACE_NOT_GIT_REPOSITORY", "GIT_NOT_INSTALLED", "WORKTREE_REQUIRES_INITIAL_COMMIT", "WORKTREE_BRANCH_CONFLICT", "WORKTREE_NOT_FOUND", "WORKTREE_ORDER_INVALID", "WORKTREE_REMOVED", "WORKTREE_IMPORT_INVALID", "WORKTREE_ALREADY_MANAGED", "SESSION_NOT_FOUND", "SESSION_CWD_MISMATCH", "SESSION_ALREADY_BOUND", "SIDECAR_UNAVAILABLE", "SIDECAR_CORRUPT", "SIDECAR_SYNC_REQUIRED", "GIT_OPERATION_FAILED", "WORKTREE_PERMISSION_BINDING_REQUIRED"];
 export type WorktreeErrorCode = (typeof WORKTREE_ERROR_CODES)[number];
 export type WorkspaceId = string;
 export type WorktreeId = string;
@@ -19,6 +20,7 @@ export type SessionId = string;
  */
 export type WorktreeStatus = 'active' | 'removed';
 export type WorktreeSource = 'plugin' | 'external';
+export * from './worktree-permission.js';
 /** Runtime-only Git health projection; this value is never persisted in the sidecar. */
 export type WorktreeHealth = 'ready' | 'repair';
 /**
@@ -159,7 +161,7 @@ export interface WorktreeManager {
  * Browser Remote 可调用的方法白名单；runtime cwd 解析刻意不进入该边界。
  * Allowlist of Browser Remote methods; runtime cwd resolution is intentionally excluded from this boundary.
  */
-export declare const WORKTREE_REMOTE_METHODS: readonly ["listWorktrees", "listImportCandidates", "listBranches", "createWorktree", "importWorktree", "removeWorktree", "insertWorktreeBefore", "listBindings", "bindSession"];
+export declare const WORKTREE_REMOTE_METHODS: readonly ["listWorktrees", "listImportCandidates", "listBranches", "createWorktree", "importWorktree", "removeWorktree", "insertWorktreeBefore", "listBindings", "bindSession", "ensureWorktreePermission", "normalizeDetachedWorktreePermissions"];
 export type WorktreeRemoteMethod = (typeof WORKTREE_REMOTE_METHODS)[number];
 /**
  * Remote 的可辨识结果：已知领域失败作为数据返回，未知或未分类异常仍由 Host 抛出。
@@ -212,5 +214,7 @@ export interface WorktreeRemoteManager {
         worktreeId: WorktreeId;
         sessionId: SessionId;
     }): Promise<WorktreeRemoteResult<SessionBinding>>;
+    ensureWorktreePermission(input: WorktreePermissionRequest): Promise<WorktreeRemoteResult<WorktreePermissionResult>>;
+    normalizeDetachedWorktreePermissions(input: WorktreePermissionNormalizationRequest): Promise<WorktreeRemoteResult<WorktreePermissionResult>>;
 }
 //# sourceMappingURL=index.d.ts.map

package/lib/contract/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/contract/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,eAAO,MAAM,oBAAoB,mbAkBtB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AACjC,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAChC,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,CAAC;AAElD,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEnD,wFAAwF;AACxF,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,UAAU,CAAC;AAElD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,kDAAkD;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;CAChC;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAC7D,MAAM,MAAM,SAAS,GACnB,aAAa,GAAG,SAAS,SAAS,EAAE,GAAG;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAC/E,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEvE;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;CACxC;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,oBAAyB,GACjC,aAAa,CAEf;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,aAAa,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC;IAEvF,oBAAoB,CAAC,KAAK,EAAE;QAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,GAAG,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAAC;IAEhD;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC;IAEpF;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE;QACpB,WAAW,EAAE,WAAW,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAE5B,cAAc,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;KAC/B,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAE5B;;;OAGG;IACH,cAAc,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,WAAW,CAAC;QAAC,UAAU,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3F;;;;OAIG;IACH,oBAAoB,CAAC,KAAK,EAAE;QAC1B,WAAW,EAAE,WAAW,CAAC;QACzB,UAAU,EAAE,UAAU,CAAC;QACvB,gBAAgB,CAAC,EAAE,UAAU,CAAC;KAC/B,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IAEnC;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC;IAEtF;;;OAGG;IACH,WAAW,CAAC,KAAK,EAAE;QACjB,WAAW,EAAE,WAAW,CAAC;QACzB,UAAU,EAAE,UAAU,CAAC;QACvB,SAAS,EAAE,SAAS,CAAC;KACtB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7B;AAED;;;GAGG;AACH,eAAO,MAAM,uBAAuB,iLAUzB,CAAC;AAEZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E;;;GAGG;AACH,MAAM,MAAM,oBAAoB,CAAC,KAAK,IAClC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GAC5C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAE1D;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,KAAK,EAAE;QACnB,WAAW,EAAE,WAAW,CAAC;KAC1B,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC,CAAC;IAE7D,oBAAoB,CAAC,KAAK,EAAE;QAC1B,WAAW,EAAE,WAAW,CAAC;KAC1B,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAAC,CAAC;IAEtE,YAAY,CAAC,KAAK,EAAE;QAClB,WAAW,EAAE,WAAW,CAAC;KAC1B,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC,CAAC;IAE3D,cAAc,CAAC,KAAK,EAAE;QACpB,WAAW,EAAE,WAAW,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC;IAElD,cAAc,CAAC,KAAK,EAAE;QACpB,WAAW,EAAE,WAAW,CAAC;QACzB,YAAY,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC;IAElD,cAAc,CAAC,KAAK,EAAE;QACpB,WAAW,EAAE,WAAW,CAAC;QACzB,UAAU,EAAE,UAAU,CAAC;KACxB,GAAG,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;IAExC,oBAAoB,CAAC,KAAK,EAAE;QAC1B,WAAW,EAAE,WAAW,CAAC;QACzB,UAAU,EAAE,UAAU,CAAC;QACvB,gBAAgB,CAAC,EAAE,UAAU,CAAC;KAC/B,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC,CAAC;IAEzD,YAAY,CAAC,KAAK,EAAE;QAClB,WAAW,EAAE,WAAW,CAAC;KAC1B,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC,CAAC;IAE7D,WAAW,CAAC,KAAK,EAAE;QACjB,WAAW,EAAE,WAAW,CAAC;QACzB,UAAU,EAAE,UAAU,CAAC;QACvB,SAAS,EAAE,SAAS,CAAC;KACtB,GAAG,OAAO,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC;CACnD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/contract/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sCAAsC,EACtC,yBAAyB,EACzB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAElC;;;;;GAKG;AAEH;;;GAGG;AACH,eAAO,MAAM,oBAAoB,2dAmBtB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AACjC,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAChC,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,CAAC;AAElD,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEnD,cAAc,0BAA0B,CAAC;AAEzC,wFAAwF;AACxF,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,UAAU,CAAC;AAElD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,kDAAkD;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;CAChC;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAC7D,MAAM,MAAM,SAAS,GACnB,aAAa,GAAG,SAAS,SAAS,EAAE,GAAG;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAC/E,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEvE;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;CACxC;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,oBAAyB,GACjC,aAAa,CAEf;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,aAAa,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC;IAEvF,oBAAoB,CAAC,KAAK,EAAE;QAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,GAAG,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAAC;IAEhD;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC;IAEpF;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE;QACpB,WAAW,EAAE,WAAW,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAE5B,cAAc,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;KAC/B,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAE5B;;;OAGG;IACH,cAAc,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,WAAW,CAAC;QAAC,UAAU,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3F;;;;OAIG;IACH,oBAAoB,CAAC,KAAK,EAAE;QAC1B,WAAW,EAAE,WAAW,CAAC;QACzB,UAAU,EAAE,UAAU,CAAC;QACvB,gBAAgB,CAAC,EAAE,UAAU,CAAC;KAC/B,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IAEnC;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC;IAEtF;;;OAGG;IACH,WAAW,CAAC,KAAK,EAAE;QACjB,WAAW,EAAE,WAAW,CAAC;QACzB,UAAU,EAAE,UAAU,CAAC;QACvB,SAAS,EAAE,SAAS,CAAC;KACtB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7B;AAED;;;GAGG;AACH,eAAO,MAAM,uBAAuB,qPAYzB,CAAC;AAEZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E;;;GAGG;AACH,MAAM,MAAM,oBAAoB,CAAC,KAAK,IAClC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GAC5C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAE1D;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,KAAK,EAAE;QACnB,WAAW,EAAE,WAAW,CAAC;KAC1B,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC,CAAC;IAE7D,oBAAoB,CAAC,KAAK,EAAE;QAC1B,WAAW,EAAE,WAAW,CAAC;KAC1B,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAAC,CAAC;IAEtE,YAAY,CAAC,KAAK,EAAE;QAClB,WAAW,EAAE,WAAW,CAAC;KAC1B,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC,CAAC;IAE3D,cAAc,CAAC,KAAK,EAAE;QACpB,WAAW,EAAE,WAAW,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC;IAElD,cAAc,CAAC,KAAK,EAAE;QACpB,WAAW,EAAE,WAAW,CAAC;QACzB,YAAY,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC;IAElD,cAAc,CAAC,KAAK,EAAE;QACpB,WAAW,EAAE,WAAW,CAAC;QACzB,UAAU,EAAE,UAAU,CAAC;KACxB,GAAG,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;IAExC,oBAAoB,CAAC,KAAK,EAAE;QAC1B,WAAW,EAAE,WAAW,CAAC;QACzB,UAAU,EAAE,UAAU,CAAC;QACvB,gBAAgB,CAAC,EAAE,UAAU,CAAC;KAC/B,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC,CAAC;IAEzD,YAAY,CAAC,KAAK,EAAE;QAClB,WAAW,EAAE,WAAW,CAAC;KAC1B,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC,CAAC;IAE7D,WAAW,CAAC,KAAK,EAAE;QACjB,WAAW,EAAE,WAAW,CAAC;QACzB,UAAU,EAAE,UAAU,CAAC;QACvB,SAAS,EAAE,SAAS,CAAC;KACtB,GAAG,OAAO,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC;IAElD,wBAAwB,CACtB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAE3D,oCAAoC,CAClC,KAAK,EAAE,sCAAsC,GAC5C,OAAO,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,CAAC,CAAC;CAC5D"}

package/lib/contract/index.js

@@ -26,7 +26,9 @@ export const WORKTREE_ERROR_CODES = Object.freeze([
     'SIDECAR_CORRUPT',
     'SIDECAR_SYNC_REQUIRED',
     'GIT_OPERATION_FAILED',
+    'WORKTREE_PERMISSION_BINDING_REQUIRED',
 ]);
+export * from './worktree-permission.js';
 /**
  * 创建错误 DTO 而不抛出异常，供 Host 将已识别的领域失败投影到 Remote result。
  * Creates an error DTO without throwing, allowing the Host to project recognized domain failures into a Remote result.
@@ -48,5 +50,7 @@ export const WORKTREE_REMOTE_METHODS = Object.freeze([
     'insertWorktreeBefore',
     'listBindings',
     'bindSession',
+    'ensureWorktreePermission',
+    'normalizeDetachedWorktreePermissions',
 ]);
 //# sourceMappingURL=index.js.map

package/lib/contract/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/contract/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,qBAAqB;IACrB,8BAA8B;IAC9B,mBAAmB;IACnB,kCAAkC;IAClC,0BAA0B;IAC1B,oBAAoB;IACpB,wBAAwB;IACxB,kBAAkB;IAClB,yBAAyB;IACzB,0BAA0B;IAC1B,mBAAmB;IACnB,sBAAsB;IACtB,uBAAuB;IACvB,qBAAqB;IACrB,iBAAiB;IACjB,uBAAuB;IACvB,sBAAsB;CACd,CAAC,CAAC;AAiFZ;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAuB,EACvB,OAAe,EACf,UAAgC,EAAE;IAElC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AA2ED;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,CAAC;IACnD,eAAe;IACf,sBAAsB;IACtB,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;IACtB,cAAc;IACd,aAAa;CACL,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/contract/index.ts"],"names":[],"mappings":"AAMA;;;;;GAKG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,qBAAqB;IACrB,8BAA8B;IAC9B,mBAAmB;IACnB,kCAAkC;IAClC,0BAA0B;IAC1B,oBAAoB;IACpB,wBAAwB;IACxB,kBAAkB;IAClB,yBAAyB;IACzB,0BAA0B;IAC1B,mBAAmB;IACnB,sBAAsB;IACtB,uBAAuB;IACvB,qBAAqB;IACrB,iBAAiB;IACjB,uBAAuB;IACvB,sBAAsB;IACtB,sCAAsC;CAC9B,CAAC,CAAC;AAgBZ,cAAc,0BAA0B,CAAC;AAmEzC;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAuB,EACvB,OAAe,EACf,UAAgC,EAAE;IAElC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AA2ED;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,CAAC;IACnD,eAAe;IACf,sBAAsB;IACtB,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;IACtB,cAAc;IACd,aAAa;IACb,0BAA0B;IAC1B,sCAAsC;CAC9B,CAAC,CAAC"}

package/lib/contract/worktree-permission.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Browser-safe Worktree permission vocabulary. DSH runtime services are
+ * intentionally absent; the Host adapts them to these plain values.
+ */
+export declare const WORKTREE_FULL_ACCESS_PRESET: "worktree-full-access";
+export type WorktreePermissionBinding = 'active' | 'detached' | 'main' | 'unbound';
+export type WorktreePermissionSandboxMode = 'read-only' | 'workspace-write' | 'danger-full-access';
+export type WorktreePermissionApprovalPolicy = 'ask' | 'never';
+export interface WorktreePermissionCurrentState {
+    readonly preset?: string;
+    readonly sandboxMode?: WorktreePermissionSandboxMode;
+    readonly approvalPolicy?: WorktreePermissionApprovalPolicy;
+    /** True when the current process has observed an explicit native UI choice. */
+    readonly explicitUserOverride: boolean;
+}
+export interface WorktreePermissionCapability {
+    readonly permissionService: boolean;
+    readonly fullPreset: boolean;
+    readonly workspaceWrite: boolean;
+}
+export interface WorktreePermissionDecisionInput {
+    readonly binding: WorktreePermissionBinding;
+    readonly current: WorktreePermissionCurrentState;
+    readonly capability: WorktreePermissionCapability;
+}
+export type WorktreePermissionDecision = {
+    readonly kind: 'apply-full';
+    readonly preset: typeof WORKTREE_FULL_ACCESS_PRESET;
+} | {
+    readonly kind: 'preserve-user-restriction';
+} | {
+    readonly kind: 'unverified';
+} | {
+    readonly kind: 'fallback-workspace-write';
+} | {
+    readonly kind: 'normalize-workspace-write';
+} | {
+    readonly kind: 'no-op';
+};
+export type WorktreePermissionStatus = 'full-applied' | 'already-full' | 'confirmation-required' | 'fallback-workspace-write' | 'user-restricted' | 'unverified' | 'normalized-workspace-write' | 'no-op';
+export interface WorktreePermissionResult {
+    readonly status: WorktreePermissionStatus;
+    readonly preset?: string;
+    readonly sandboxMode?: WorktreePermissionSandboxMode;
+    readonly approvalPolicy?: WorktreePermissionApprovalPolicy;
+    /** Session IDs considered by a detached-worktree normalization batch. */
+    readonly sessionIds?: readonly string[];
+    readonly retryable: boolean;
+}
+export interface WorktreePermissionRequest {
+    readonly workspaceId: string;
+    readonly worktreeId: string;
+    readonly sessionId: string;
+    readonly binding?: WorktreePermissionBinding;
+    readonly confirmed?: boolean;
+}
+export interface WorktreePermissionNormalizationRequest {
+    readonly workspaceId: string;
+    readonly worktreeId: string;
+}
+/** Browser-facing permission operation; it accepts no arbitrary DSH policy. */
+export interface WorktreePermissionManager {
+    ensureWorktreePermission(input: WorktreePermissionRequest): Promise<WorktreePermissionResult>;
+    normalizeDetachedWorktreePermissions(input: WorktreePermissionNormalizationRequest): Promise<WorktreePermissionResult>;
+}
+/** Host-only adapter used by the Host composition layer. */
+export interface WorktreePermissionPort {
+    ensure(input: WorktreePermissionRequest): Promise<WorktreePermissionResult>;
+    normalize(input: WorktreePermissionRequest): Promise<WorktreePermissionResult>;
+}
+/** Decide one permission transition without reading or mutating DSH state. */
+export declare function decideWorktreePermission(input: WorktreePermissionDecisionInput): WorktreePermissionDecision;
+//# sourceMappingURL=worktree-permission.d.ts.map

package/lib/contract/worktree-permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-permission.d.ts","sourceRoot":"","sources":["../../src/contract/worktree-permission.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,2BAA2B,EAAG,sBAA+B,CAAC;AAE3E,MAAM,MAAM,yBAAyB,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;AACnF,MAAM,MAAM,6BAA6B,GACrC,WAAW,GACX,iBAAiB,GACjB,oBAAoB,CAAC;AACzB,MAAM,MAAM,gCAAgC,GAAG,KAAK,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,6BAA6B,CAAC;IACrD,QAAQ,CAAC,cAAc,CAAC,EAAE,gCAAgC,CAAC;IAC3D,+EAA+E;IAC/E,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;CACxC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,8BAA8B,CAAC;IACjD,QAAQ,CAAC,UAAU,EAAE,4BAA4B,CAAC;CACnD;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,2BAA2B,CAAA;CAAE,GACpF;IAAE,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAA;CAAE,GAC7C;IAAE,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAE/B,MAAM,MAAM,wBAAwB,GAChC,cAAc,GACd,cAAc,GACd,uBAAuB,GACvB,0BAA0B,GAC1B,iBAAiB,GACjB,YAAY,GACZ,4BAA4B,GAC5B,OAAO,CAAC;AAEZ,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,6BAA6B,CAAC;IACrD,QAAQ,CAAC,cAAc,CAAC,EAAE,gCAAgC,CAAC;IAC3D,yEAAyE;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,+EAA+E;AAC/E,MAAM,WAAW,yBAAyB;IACxC,wBAAwB,CACtB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrC,oCAAoC,CAClC,KAAK,EAAE,sCAAsC,GAC5C,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACtC;AAED,4DAA4D;AAC5D,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC5E,SAAS,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;CAChF;AASD,8EAA8E;AAC9E,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,+BAA+B,GACrC,0BAA0B,CAiB5B"}

package/lib/contract/worktree-permission.js

@@ -0,0 +1,32 @@
+/**
+ * Browser-safe Worktree permission vocabulary. DSH runtime services are
+ * intentionally absent; the Host adapts them to these plain values.
+ */
+export const WORKTREE_FULL_ACCESS_PRESET = 'worktree-full-access';
+function isFullAccess(current) {
+    return (current.preset === WORKTREE_FULL_ACCESS_PRESET ||
+        current.sandboxMode === 'danger-full-access');
+}
+/** Decide one permission transition without reading or mutating DSH state. */
+export function decideWorktreePermission(input) {
+    if (input.binding === 'main' || input.binding === 'unbound')
+        return { kind: 'no-op' };
+    if (input.binding === 'detached') {
+        return isFullAccess(input.current)
+            ? { kind: 'normalize-workspace-write' }
+            : { kind: 'no-op' };
+    }
+    if (input.current.explicitUserOverride)
+        return { kind: 'preserve-user-restriction' };
+    if (isFullAccess(input.current))
+        return { kind: 'no-op' };
+    if (!input.capability.permissionService)
+        return { kind: 'unverified' };
+    if (input.capability.fullPreset) {
+        return { kind: 'apply-full', preset: WORKTREE_FULL_ACCESS_PRESET };
+    }
+    if (input.capability.workspaceWrite)
+        return { kind: 'fallback-workspace-write' };
+    return { kind: 'unverified' };
+}
+//# sourceMappingURL=worktree-permission.js.map

package/lib/contract/worktree-permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-permission.js","sourceRoot":"","sources":["../../src/contract/worktree-permission.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,sBAA+B,CAAC;AAsF3E,SAAS,YAAY,CAAC,OAAuC;IAC3D,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,2BAA2B;QAC9C,OAAO,CAAC,WAAW,KAAK,oBAAoB,CAC7C,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,wBAAwB,CACtC,KAAsC;IAEtC,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAEtF,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;YAChC,CAAC,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE;YACvC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,oBAAoB;QAAE,OAAO,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC;IACrF,IAAI,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,iBAAiB;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACvE,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;IACjF,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAChC,CAAC"}

package/lib/host/index.d.ts

@@ -13,4 +13,8 @@ export type { DshHostReadContext } from './dsh-read-adapter.js';
 export { createWorktreeRemoteProjection } from './remote.js';
 export { WorktreeRemoteService } from './service.js';
 export type { WorktreeHostConfig } from './service.js';
+export { createDshWorktreePermissionAdapter, } from './worktree-permission.js';
+export type { DshWorktreePermissionAdapterOptions } from './worktree-permission.js';
+export { createWorktreePermissionManager, } from './worktree-permission-manager.js';
+export type { WorktreePermissionManagerOptions } from './worktree-permission-manager.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/host/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/host/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/host/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EACL,kCAAkC,GACnC,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,mCAAmC,EAAE,MAAM,0BAA0B,CAAC;AACpF,OAAO,EACL,+BAA+B,GAChC,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC"}

package/lib/host/index.js

@@ -11,4 +11,6 @@
 export { DshHostReadAdapter } from './dsh-read-adapter.js';
 export { createWorktreeRemoteProjection } from './remote.js';
 export { WorktreeRemoteService } from './service.js';
+export { createDshWorktreePermissionAdapter, } from './worktree-permission.js';
+export { createWorktreePermissionManager, } from './worktree-permission-manager.js';
 //# sourceMappingURL=index.js.map

package/lib/host/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/host/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/host/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EACL,kCAAkC,GACnC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,+BAA+B,GAChC,MAAM,kCAAkC,CAAC"}

package/lib/host/remote.d.ts

@@ -1,4 +1,4 @@
-import { type WorktreeManager, type WorktreeRemoteManager } from '../contract/index.js';
+import { type WorktreeManager, type WorktreePermissionManager, type WorktreeRemoteManager } from '../contract/index.js';
 /**
  * 将 Host 内的 Manage 能力投影为 DSH Remote 可传输的 plain-JSON contract。
  *
@@ -12,5 +12,5 @@ import { type WorktreeManager, type WorktreeRemoteManager } from '../contract/in
  * @param manager - Host 内已组合完成的用例接口。 / Fully composed Host use-case port.
  * @returns 可供生成 Remote 暴露的安全投影。 / Safe projection for generated Remote export.
  */
-export declare function createWorktreeRemoteProjection(manager: WorktreeManager): WorktreeRemoteManager;
+export declare function createWorktreeRemoteProjection(manager: WorktreeManager, permissions?: WorktreePermissionManager): WorktreeRemoteManager;
 //# sourceMappingURL=remote.d.ts.map

package/lib/host/remote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../src/host/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAE3B,MAAM,sBAAsB,CAAC;AAkC9B;;;;;;;;;;;;GAYG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,eAAe,GAAG,qBAAqB,CAmB9F"}
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../src/host/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAE3B,MAAM,sBAAsB,CAAC;AAkC9B;;;;;;;;;;;;GAYG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,eAAe,EACxB,WAAW,CAAC,EAAE,yBAAyB,GACtC,qBAAqB,CA+BvB"}

package/lib/host/remote.js

@@ -42,7 +42,7 @@ async function project(operation) {
  * @param manager - Host 内已组合完成的用例接口。 / Fully composed Host use-case port.
  * @returns 可供生成 Remote 暴露的安全投影。 / Safe projection for generated Remote export.
  */
-export function createWorktreeRemoteProjection(manager) {
+export function createWorktreeRemoteProjection(manager, permissions) {
     return {
         listWorktrees: (input) => project(() => manager.listWorktrees(input)),
         listImportCandidates: (input) => project(() => manager.listImportCandidates(input)),
@@ -59,6 +59,12 @@ export function createWorktreeRemoteProjection(manager) {
         insertWorktreeBefore: (input) => project(() => manager.insertWorktreeBefore(input)),
         listBindings: (input) => project(() => manager.listBindings(input)),
         bindSession: (input) => project(() => manager.bindSession(input)),
+        ensureWorktreePermission: (input) => project(() => permissions === undefined
+            ? Promise.resolve({ status: 'unverified', retryable: true })
+            : permissions.ensureWorktreePermission(input)),
+        normalizeDetachedWorktreePermissions: (input) => project(() => permissions === undefined
+            ? Promise.resolve({ status: 'unverified', sessionIds: [], retryable: true })
+            : permissions.normalizeDetachedWorktreePermissions(input)),
     };
 }
 //# sourceMappingURL=remote.js.map

package/lib/host/remote.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../src/host/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GAKpB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS,oBAAoB,CAAC,CAAC;AAEjE,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,SAAS,GAAG,KAA+B,CAAC;IAClD,OAAO,CACL,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;QAClC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;QACtC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;QACrC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;QACrC,SAAS,CAAC,OAAO,KAAK,IAAI;QAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CAAQ,SAA+B;IAC3D,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,SAAS,EAAE,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mDAAmD;QACnD,yDAAyD;QACzD,+EAA+E;QAC/E,qFAAqF;QACrF,oCAAoC;QACpC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;SACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAwB;IACrE,OAAO;QACL,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACrE,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACnF,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnE,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACvE,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACvE,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CACxB,OAAO,CAAC,KAAK,IAAI,EAAE;YACjB,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACpC,uDAAuD;YACvD,mFAAmF;YACnF,gCAAgC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACJ,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACnF,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnE,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;KAClE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../src/host/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GAMpB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS,oBAAoB,CAAC,CAAC;AAEjE,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,SAAS,GAAG,KAA+B,CAAC;IAClD,OAAO,CACL,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;QAClC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;QACtC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;QACrC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;QACrC,SAAS,CAAC,OAAO,KAAK,IAAI;QAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CAAQ,SAA+B;IAC3D,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,SAAS,EAAE,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mDAAmD;QACnD,yDAAyD;QACzD,+EAA+E;QAC/E,qFAAqF;QACrF,oCAAoC;QACpC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;SACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAAwB,EACxB,WAAuC;IAEvC,OAAO;QACL,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACrE,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACnF,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnE,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACvE,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACvE,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CACxB,OAAO,CAAC,KAAK,IAAI,EAAE;YACjB,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACpC,uDAAuD;YACvD,mFAAmF;YACnF,gCAAgC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACJ,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACnF,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnE,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjE,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE,CAClC,OAAO,CAAC,GAAG,EAAE,CACX,WAAW,KAAK,SAAS;YACvB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC5D,CAAC,CAAC,WAAW,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAChD;QACH,oCAAoC,EAAE,CAAC,KAAK,EAAE,EAAE,CAC9C,OAAO,CAAC,GAAG,EAAE,CACX,WAAW,KAAK,SAAS;YACvB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC5E,CAAC,CAAC,WAAW,CAAC,oCAAoC,CAAC,KAAK,CAAC,CAC5D;KACJ,CAAC;AACJ,CAAC"}

package/lib/host/service.d.ts

@@ -1,6 +1,6 @@
 import type { Context } from '@deepseek-ai/cordis';
 import { TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
-import type { BranchRecord, SessionBinding, WorktreeId, WorktreeRecord, WorktreeImportCandidate, WorkspaceId, WorktreeRemoteResult } from '../contract/index.js';
+import type { BranchRecord, SessionBinding, WorktreeId, WorktreeRecord, WorktreeImportCandidate, WorktreePermissionRequest, WorktreePermissionNormalizationRequest, WorktreePermissionResult, WorkspaceId, WorktreeRemoteResult } from '../contract/index.js';
 /**
  * Host composition 所需且由 DSH bundle 注入的配置。
  * Configuration supplied by the DSH bundle to the Host composition.
@@ -65,6 +65,8 @@ export declare class WorktreeRemoteService extends TypertRemoteService {
         readonly worktreeId: string;
         readonly sessionId: string;
     }): Promise<WorktreeRemoteResult<SessionBinding>>;
+    ensureWorktreePermission(input: WorktreePermissionRequest): Promise<WorktreeRemoteResult<WorktreePermissionResult>>;
+    normalizeDetachedWorktreePermissions(input: WorktreePermissionNormalizationRequest): Promise<WorktreeRemoteResult<WorktreePermissionResult>>;
 }
 export default WorktreeRemoteService;
 //# sourceMappingURL=service.d.ts.map

package/lib/host/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/host/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAU,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,KAAK,EACV,YAAY,EACZ,cAAc,EACd,UAAU,EACV,cAAc,EACd,uBAAuB,EACvB,WAAW,EAEX,oBAAoB,EACrB,MAAM,sBAAsB,CAAC;AAQ9B;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAI5D,MAAM,CAAC,MAAM,WAA2D;IAExE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAE/C;;;;OAIG;gBACS,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB;IAgBpD,aAAa,CAAC,KAAK,EAAE;QACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC;IAK5D,oBAAoB,CAAC,KAAK,EAAE;QAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;KACnC,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAAC;IAKrE,YAAY,CAAC,KAAK,EAAE;QAClB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC;IAK1D,cAAc,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAKjD,cAAc,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;QAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;KAC/B,GAAG,OAAO,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAKjD,cAAc,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAKvC,oBAAoB,CAAC,KAAK,EAAE;QAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;KACpC,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IAKxD,YAAY,CAAC,KAAK,EAAE;QAClB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC;IAK5D,WAAW,CAAC,KAAK,EAAE;QACjB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;CAGlD;AAED,eAAe,qBAAqB,CAAC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/host/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAU,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,KAAK,EACV,YAAY,EACZ,cAAc,EACd,UAAU,EACV,cAAc,EACd,uBAAuB,EACvB,yBAAyB,EACzB,sCAAsC,EACtC,wBAAwB,EACxB,WAAW,EAEX,oBAAoB,EACrB,MAAM,sBAAsB,CAAC;AAa9B;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAI5D,MAAM,CAAC,MAAM,WAA2D;IAExE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAE/C;;;;OAIG;gBACS,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB;IA0CpD,aAAa,CAAC,KAAK,EAAE;QACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC;IAK5D,oBAAoB,CAAC,KAAK,EAAE;QAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;KACnC,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAAC;IAKrE,YAAY,CAAC,KAAK,EAAE;QAClB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC;IAK1D,cAAc,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAKjD,cAAc,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;QAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;KAC/B,GAAG,OAAO,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAKjD,cAAc,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAKvC,oBAAoB,CAAC,KAAK,EAAE;QAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;KACpC,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IAKxD,YAAY,CAAC,KAAK,EAAE;QAClB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC;IAK5D,WAAW,CAAC,KAAK,EAAE;QACjB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAKjD,wBAAwB,CACtB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;IAK1D,oCAAoC,CAClC,KAAK,EAAE,sCAAsC,GAC5C,OAAO,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;CAG3D;AAED,eAAe,qBAAqB,CAAC"}

package/lib/host/service.js

@@ -36,6 +36,8 @@ import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import { createWorktreeManager } from '../manage/index.js';
 import { DshHostReadAdapter, } from './dsh-read-adapter.js';
 import { createWorktreeRemoteProjection } from './remote.js';
+import { createDshWorktreePermissionAdapter, } from './worktree-permission.js';
+import { createWorktreePermissionManager } from './worktree-permission-manager.js';
 /**
  * Worktree plugin 的真实 composition root。
  *
@@ -60,6 +62,8 @@ let WorktreeRemoteService = (() => {
     let _insertWorktreeBefore_decorators;
     let _listBindings_decorators;
     let _bindSession_decorators;
+    let _ensureWorktreePermission_decorators;
+    let _normalizeDetachedWorktreePermissions_decorators;
     return class WorktreeRemoteService extends _classSuper {
         static {
             const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
@@ -72,6 +76,8 @@ let WorktreeRemoteService = (() => {
             _insertWorktreeBefore_decorators = [Remote];
             _listBindings_decorators = [Remote];
             _bindSession_decorators = [Remote];
+            _ensureWorktreePermission_decorators = [Remote];
+            _normalizeDetachedWorktreePermissions_decorators = [Remote];
             __esDecorate(this, null, _listWorktrees_decorators, { kind: "method", name: "listWorktrees", static: false, private: false, access: { has: obj => "listWorktrees" in obj, get: obj => obj.listWorktrees }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _listImportCandidates_decorators, { kind: "method", name: "listImportCandidates", static: false, private: false, access: { has: obj => "listImportCandidates" in obj, get: obj => obj.listImportCandidates }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _listBranches_decorators, { kind: "method", name: "listBranches", static: false, private: false, access: { has: obj => "listBranches" in obj, get: obj => obj.listBranches }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -81,6 +87,8 @@ let WorktreeRemoteService = (() => {
             __esDecorate(this, null, _insertWorktreeBefore_decorators, { kind: "method", name: "insertWorktreeBefore", static: false, private: false, access: { has: obj => "insertWorktreeBefore" in obj, get: obj => obj.insertWorktreeBefore }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _listBindings_decorators, { kind: "method", name: "listBindings", static: false, private: false, access: { has: obj => "listBindings" in obj, get: obj => obj.listBindings }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _bindSession_decorators, { kind: "method", name: "bindSession", static: false, private: false, access: { has: obj => "bindSession" in obj, get: obj => obj.bindSession }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _ensureWorktreePermission_decorators, { kind: "method", name: "ensureWorktreePermission", static: false, private: false, access: { has: obj => "ensureWorktreePermission" in obj, get: obj => obj.ensureWorktreePermission }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _normalizeDetachedWorktreePermissions_decorators, { kind: "method", name: "normalizeDetachedWorktreePermissions", static: false, private: false, access: { has: obj => "normalizeDetachedWorktreePermissions" in obj, get: obj => obj.normalizeDetachedWorktreePermissions }, metadata: _metadata }, null, _instanceExtraInitializers);
             if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
         // Cordis 在实例化前保证这三个只读 Host 服务可用；这里不注入任何 DSH mutation API。
@@ -95,9 +103,29 @@ let WorktreeRemoteService = (() => {
          */
         constructor(ctx, config) {
             super(ctx, 'worktreeManager');
-            this.remote = createWorktreeRemoteProjection(createWorktreeManager({
-                dsh: new DshHostReadAdapter(ctx),
+            const dsh = new DshHostReadAdapter(ctx);
+            const manager = createWorktreeManager({
+                dsh,
                 dshHome: config.dshHome,
+            });
+            // Permission presets are an optional DSH capability. Read them through a
+            // structural seam so an older profile can still mount this plugin and
+            // report `unverified` instead of failing during composition.
+            const optionalServices = {
+                permissionPresets: ctx.get('permissionPresets'),
+                sandboxPolicy: ctx.get('sandboxPolicy'),
+            };
+            const permissionAdapter = createDshWorktreePermissionAdapter({
+                sessions: {
+                    get: (sessionId) => ctx.sessions.get(sessionId),
+                },
+                permissionPresets: optionalServices.permissionPresets,
+                sandboxPolicy: optionalServices.sandboxPolicy,
+            });
+            this.remote = createWorktreeRemoteProjection(manager, createWorktreePermissionManager({
+                manager,
+                dsh,
+                permissions: permissionAdapter,
             }));
         }
         // 这些方法保持为薄边界，生成的 Typert 描述符只看到 contract-safe 签名；错误归一化
@@ -132,6 +160,12 @@ let WorktreeRemoteService = (() => {
         bindSession(input) {
             return this.remote.bindSession(input);
         }
+        ensureWorktreePermission(input) {
+            return this.remote.ensureWorktreePermission(input);
+        }
+        normalizeDetachedWorktreePermissions(input) {
+            return this.remote.normalizeDetachedWorktreePermissions(input);
+        }
     };
 })();
 export { WorktreeRemoteService };

package/lib/host/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/host/service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAY/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EACL,kBAAkB,GAEnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAW7D;;;;;;;;;;;GAWG;IACU,qBAAqB;sBAAS,mBAAmB;;;;;;;;;;;iBAAjD,qBAAsB,SAAQ,WAAmB;;;yCA4B3D,MAAM;gDAON,MAAM;wCAON,MAAM;0CAON,MAAM;0CASN,MAAM;0CAQN,MAAM;gDAQN,MAAM;wCASN,MAAM;uCAON,MAAM;YA7DP,0LAAA,aAAa,6DAIZ;YAGD,+MAAA,oBAAoB,6DAInB;YAGD,uLAAA,YAAY,6DAIX;YAGD,6LAAA,cAAc,6DAMb;YAGD,6LAAA,cAAc,6DAKb;YAGD,6LAAA,cAAc,6DAKb;YAGD,+MAAA,oBAAoB,6DAMnB;YAGD,uLAAA,YAAY,6DAIX;YAGD,oLAAA,WAAW,6DAMV;;;QAhGD,0DAA0D;QAC1D,oFAAoF;QACpF,qCAAqC;QACrC,MAAM,CAAC,MAAM,GAAG,CAAC,mBAAmB,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC;QAEvD,MAAM,GANZ,mDAAqB,CAMe;QAE/C;;;;WAIG;QACH,YAAY,GAAY,EAAE,MAA0B;YAClD,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAC9B,IAAI,CAAC,MAAM,GAAG,8BAA8B,CAC1C,qBAAqB,CAAC;gBACpB,GAAG,EAAE,IAAI,kBAAkB,CAAC,GAAmC,CAAC;gBAChE,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,sDAAsD;QACtD,oDAAoD;QACpD,gFAAgF;QAChF,uFAAuF;QACvF,uCAAuC;QAEvC,aAAa,CAAC,KAEb;YACC,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAGD,oBAAoB,CAAC,KAEpB;YACC,OAAO,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QAGD,YAAY,CAAC,KAEZ;YACC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAGD,cAAc,CAAC,KAId;YACC,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAGD,cAAc,CAAC,KAGd;YACC,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAGD,cAAc,CAAC,KAGd;YACC,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAGD,oBAAoB,CAAC,KAIpB;YACC,OAAO,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QAGD,YAAY,CAAC,KAEZ;YACC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAGD,WAAW,CAAC,KAIX;YACC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;;;SAjGU,qBAAqB;AAoGlC,eAAe,qBAAqB,CAAC"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/host/service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAe/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EACL,kBAAkB,GAEnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,kCAAkC,GAEnC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AAWnF;;;;;;;;;;;GAWG;IACU,qBAAqB;sBAAS,mBAAmB;;;;;;;;;;;;;iBAAjD,qBAAsB,SAAQ,WAAmB;;;yCAsD3D,MAAM;gDAON,MAAM;wCAON,MAAM;0CAON,MAAM;0CASN,MAAM;0CAQN,MAAM;gDAQN,MAAM;wCASN,MAAM;uCAON,MAAM;oDASN,MAAM;gEAON,MAAM;YA7EP,0LAAA,aAAa,6DAIZ;YAGD,+MAAA,oBAAoB,6DAInB;YAGD,uLAAA,YAAY,6DAIX;YAGD,6LAAA,cAAc,6DAMb;YAGD,6LAAA,cAAc,6DAKb;YAGD,6LAAA,cAAc,6DAKb;YAGD,+MAAA,oBAAoB,6DAMnB;YAGD,uLAAA,YAAY,6DAIX;YAGD,oLAAA,WAAW,6DAMV;YAGD,2NAAA,wBAAwB,6DAIvB;YAGD,+PAAA,oCAAoC,6DAInC;;;QAxID,0DAA0D;QAC1D,oFAAoF;QACpF,qCAAqC;QACrC,MAAM,CAAC,MAAM,GAAG,CAAC,mBAAmB,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC;QAEvD,MAAM,GANZ,mDAAqB,CAMe;QAE/C;;;;WAIG;QACH,YAAY,GAAY,EAAE,MAA0B;YAClD,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAC9B,MAAM,GAAG,GAAG,IAAI,kBAAkB,CAAC,GAAmC,CAAC,CAAC;YACxE,MAAM,OAAO,GAAG,qBAAqB,CAAC;gBACpC,GAAG;gBACH,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,yEAAyE;YACzE,sEAAsE;YACtE,6DAA6D;YAC7D,MAAM,gBAAgB,GAGlB;gBACF,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAA6D;gBAC3G,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,eAAe,CAAyD;aAChG,CAAC;YACF,MAAM,iBAAiB,GAAG,kCAAkC,CAAC;gBAC3D,QAAQ,EAAE;oBACR,GAAG,EAAE,CAAC,SAAS,EAAE,EAAE,CAAE,GAEnB,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;iBAC3B;gBACD,iBAAiB,EAAE,gBAAgB,CAAC,iBAAiB;gBACrD,aAAa,EAAE,gBAAgB,CAAC,aAAa;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,8BAA8B,CAC1C,OAAO,EACP,+BAA+B,CAAC;gBAC9B,OAAO;gBACP,GAAG;gBACH,WAAW,EAAE,iBAAiB;aAC/B,CAAC,CACH,CAAC;QACJ,CAAC;QAED,sDAAsD;QACtD,oDAAoD;QACpD,gFAAgF;QAChF,uFAAuF;QACvF,uCAAuC;QAEvC,aAAa,CAAC,KAEb;YACC,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAGD,oBAAoB,CAAC,KAEpB;YACC,OAAO,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QAGD,YAAY,CAAC,KAEZ;YACC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAGD,cAAc,CAAC,KAId;YACC,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAGD,cAAc,CAAC,KAGd;YACC,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAGD,cAAc,CAAC,KAGd;YACC,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAGD,oBAAoB,CAAC,KAIpB;YACC,OAAO,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QAGD,YAAY,CAAC,KAEZ;YACC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAGD,WAAW,CAAC,KAIX;YACC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAGD,wBAAwB,CACtB,KAAgC;YAEhC,OAAO,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QAGD,oCAAoC,CAClC,KAA6C;YAE7C,OAAO,IAAI,CAAC,MAAM,CAAC,oCAAoC,CAAC,KAAK,CAAC,CAAC;QACjE,CAAC;;;SAzIU,qBAAqB;AA4IlC,eAAe,qBAAqB,CAAC"}

package/lib/host/worktree-permission-manager.d.ts

@@ -0,0 +1,14 @@
+import type { WorktreeManager, WorktreePermissionManager, WorktreePermissionPort } from '../contract/index.js';
+import type { DshReadAdapter } from '../provider/types.js';
+export interface WorktreePermissionManagerOptions {
+    readonly manager: Pick<WorktreeManager, 'listWorktrees' | 'listBindings'>;
+    readonly dsh: DshReadAdapter;
+    readonly permissions?: WorktreePermissionPort;
+}
+/**
+ * Compose the browser-facing permission operation with authoritative Worktree/Session
+ * facts. The caller cannot turn this into a general Session permission endpoint because
+ * the Host re-checks the active relation on every invocation.
+ */
+export declare function createWorktreePermissionManager(options: WorktreePermissionManagerOptions): WorktreePermissionManager;
+//# sourceMappingURL=worktree-permission-manager.d.ts.map

package/lib/host/worktree-permission-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-permission-manager.d.ts","sourceRoot":"","sources":["../../src/host/worktree-permission-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,yBAAyB,EAEzB,sBAAsB,EAGvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,eAAe,GAAG,cAAc,CAAC,CAAC;IAC1E,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,sBAAsB,CAAC;CAC/C;AAyBD;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,yBAAyB,CA6I3B"}

package/lib/host/worktree-permission-manager.js

@@ -0,0 +1,111 @@
+import { providerError } from '../provider/types.js';
+function unverified() {
+    return { status: 'unverified', retryable: true };
+}
+function aggregateNormalization(sessionIds, results) {
+    const hasUnverified = results.some((result) => result.status === 'unverified');
+    const hasNormalized = results.some((result) => result.status === 'normalized-workspace-write');
+    return {
+        status: hasUnverified
+            ? 'unverified'
+            : hasNormalized
+                ? 'normalized-workspace-write'
+                : 'no-op',
+        sessionIds,
+        retryable: results.some((result) => result.retryable),
+    };
+}
+/**
+ * Compose the browser-facing permission operation with authoritative Worktree/Session
+ * facts. The caller cannot turn this into a general Session permission endpoint because
+ * the Host re-checks the active relation on every invocation.
+ */
+export function createWorktreePermissionManager(options) {
+    return {
+        async ensureWorktreePermission(input) {
+            const workspace = await options.dsh.getWorkspace(input.workspaceId);
+            if (workspace === undefined) {
+                throw providerError('WORKSPACE_NOT_FOUND', `Workspace "${input.workspaceId}" was not found`, { workspaceId: input.workspaceId });
+            }
+            const [worktrees, bindings] = await Promise.all([
+                options.manager.listWorktrees({ workspaceId: input.workspaceId }),
+                options.manager.listBindings({ workspaceId: input.workspaceId }),
+            ]);
+            const worktree = worktrees.find((candidate) => candidate.workspaceId === input.workspaceId &&
+                candidate.worktreeId === input.worktreeId);
+            if (worktree === undefined) {
+                throw providerError('WORKTREE_NOT_FOUND', `Worktree "${input.worktreeId}" was not found`, { workspaceId: input.workspaceId, worktreeId: input.worktreeId });
+            }
+            if (worktree.status !== 'active' || worktree.health === 'repair') {
+                throw providerError('WORKTREE_REMOVED', `Worktree "${input.worktreeId}" is not active`, { workspaceId: input.workspaceId, worktreeId: input.worktreeId });
+            }
+            const binding = bindings.find((candidate) => candidate.workspaceId === input.workspaceId &&
+                candidate.worktreeId === input.worktreeId &&
+                candidate.sessionId === input.sessionId &&
+                candidate.status === 'active');
+            if (binding === undefined) {
+                throw providerError('WORKTREE_PERMISSION_BINDING_REQUIRED', `Session "${input.sessionId}" is not actively bound to this Worktree`, {
+                    workspaceId: input.workspaceId,
+                    worktreeId: input.worktreeId,
+                    sessionId: input.sessionId,
+                });
+            }
+            const session = await options.dsh.getSession(input.sessionId);
+            if (session === undefined) {
+                throw providerError('SESSION_NOT_FOUND', `Session "${input.sessionId}" was not found`, {
+                    sessionId: input.sessionId,
+                });
+            }
+            if ((session.workspaceId !== undefined && session.workspaceId !== workspace.workspaceId) ||
+                session.cwd !== worktree.absolutePath) {
+                throw providerError('SESSION_CWD_MISMATCH', `Session "${input.sessionId}" does not belong to this Worktree`, {
+                    workspaceId: input.workspaceId,
+                    worktreeId: input.worktreeId,
+                    sessionId: input.sessionId,
+                });
+            }
+            if (options.permissions === undefined)
+                return unverified();
+            return options.permissions.ensure({ ...input, binding: 'active' });
+        },
+        async normalizeDetachedWorktreePermissions(input) {
+            const workspace = await options.dsh.getWorkspace(input.workspaceId);
+            if (workspace === undefined) {
+                throw providerError('WORKSPACE_NOT_FOUND', `Workspace "${input.workspaceId}" was not found`, { workspaceId: input.workspaceId });
+            }
+            const [worktrees, bindings] = await Promise.all([
+                options.manager.listWorktrees({ workspaceId: input.workspaceId }),
+                options.manager.listBindings({ workspaceId: input.workspaceId }),
+            ]);
+            const worktree = worktrees.find((candidate) => candidate.workspaceId === input.workspaceId &&
+                candidate.worktreeId === input.worktreeId);
+            if (worktree === undefined) {
+                throw providerError('WORKTREE_NOT_FOUND', `Worktree "${input.worktreeId}" was not found`, { workspaceId: input.workspaceId, worktreeId: input.worktreeId });
+            }
+            if (worktree.status !== 'removed') {
+                throw providerError('WORKTREE_REMOVED', `Worktree "${input.worktreeId}" is not detached`, { workspaceId: input.workspaceId, worktreeId: input.worktreeId });
+            }
+            const detachedBindings = bindings.filter((binding) => binding.workspaceId === input.workspaceId &&
+                binding.worktreeId === input.worktreeId &&
+                binding.status === 'detached');
+            const sessionIds = detachedBindings.map((binding) => binding.sessionId);
+            if (sessionIds.length === 0) {
+                return { status: 'no-op', sessionIds, retryable: false };
+            }
+            if (options.permissions === undefined) {
+                return { ...unverified(), sessionIds };
+            }
+            const results = [];
+            for (const binding of detachedBindings) {
+                results.push(await options.permissions.normalize({
+                    workspaceId: input.workspaceId,
+                    worktreeId: input.worktreeId,
+                    sessionId: binding.sessionId,
+                    binding: 'detached',
+                }));
+            }
+            return aggregateNormalization(sessionIds, results);
+        },
+    };
+}
+//# sourceMappingURL=worktree-permission-manager.js.map

package/lib/host/worktree-permission-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-permission-manager.js","sourceRoot":"","sources":["../../src/host/worktree-permission-manager.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAQrD,SAAS,UAAU;IACjB,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,sBAAsB,CAC7B,UAA6B,EAC7B,OAA4C;IAE5C,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,4BAA4B,CAC3D,CAAC;IACF,OAAO;QACL,MAAM,EAAE,aAAa;YACnB,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,aAAa;gBACb,CAAC,CAAC,4BAA4B;gBAC9B,CAAC,CAAC,OAAO;QACb,UAAU;QACV,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,OAAyC;IAEzC,OAAO;QACL,KAAK,CAAC,wBAAwB,CAAC,KAAgC;YAC7D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACpE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,aAAa,CACjB,qBAAqB,EACrB,cAAc,KAAK,CAAC,WAAW,iBAAiB,EAChD,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CACnC,CAAC;YACJ,CAAC;YAED,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC9C,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;gBACjE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;aACjE,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAC7B,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;gBAC3C,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAC5C,CAAC;YACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,oBAAoB,EACpB,aAAa,KAAK,CAAC,UAAU,iBAAiB,EAC9C,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CACjE,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACjE,MAAM,aAAa,CACjB,kBAAkB,EAClB,aAAa,KAAK,CAAC,UAAU,iBAAiB,EAC9C,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAC3B,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;gBAC3C,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;gBACzC,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;gBACvC,SAAS,CAAC,MAAM,KAAK,QAAQ,CAChC,CAAC;YACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,aAAa,CACjB,sCAAsC,EACtC,YAAY,KAAK,CAAC,SAAS,0CAA0C,EACrE;oBACE,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CACF,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC9D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,aAAa,CAAC,mBAAmB,EAAE,YAAY,KAAK,CAAC,SAAS,iBAAiB,EAAE;oBACrF,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;YACL,CAAC;YACD,IACE,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,CAAC;gBACpF,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,YAAY,EACrC,CAAC;gBACD,MAAM,aAAa,CACjB,sBAAsB,EACtB,YAAY,KAAK,CAAC,SAAS,oCAAoC,EAC/D;oBACE,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CACF,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;gBAAE,OAAO,UAAU,EAAE,CAAC;YAC3D,OAAO,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,CAAC,oCAAoC,CACxC,KAA6C;YAE7C,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACpE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,aAAa,CACjB,qBAAqB,EACrB,cAAc,KAAK,CAAC,WAAW,iBAAiB,EAChD,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CACnC,CAAC;YACJ,CAAC;YAED,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC9C,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;gBACjE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;aACjE,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAC7B,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;gBAC3C,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAC5C,CAAC;YACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,oBAAoB,EACpB,aAAa,KAAK,CAAC,UAAU,iBAAiB,EAC9C,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CACjE,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,aAAa,CACjB,kBAAkB,EAClB,aAAa,KAAK,CAAC,UAAU,mBAAmB,EAChD,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CACtC,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;gBACzC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;gBACvC,OAAO,CAAC,MAAM,KAAK,UAAU,CAChC,CAAC;YACF,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACxE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAC3D,CAAC;YACD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACtC,OAAO,EAAE,GAAG,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC;YACzC,CAAC;YAED,MAAM,OAAO,GAA+B,EAAE,CAAC;YAC/C,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC;oBAC/C,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO,EAAE,UAAU;iBACpB,CAAC,CAAC,CAAC;YACN,CAAC;YACD,OAAO,sBAAsB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC"}