@dsh-cc/session-cwd 0.5.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,45 @@
+# @dsh-cc/session-cwd
+
+Session-scoped working directory for DeepSeek Harness CC — the WS1 + WS2
+foundation of the [worktree-session-isolation design](../../../docs/plans/worktree-session-isolation.md).
+
+## What it owns
+
+- **`worktree/entered` session event** (WS1): registered into the persistence
+  layer's `KNOWN_SESSION_EVENT_TYPES` at module load, so logs containing it
+  resume cleanly. Payload: `{ path }` — the new absolute session cwd.
+  `ExitWorktree` restores the previous directory through the same event
+  (last-wins fold).
+- **Foldable state** (`src/state.ts`): `foldSessionCwd` folds the current cwd
+  out of the event log; a process-local `SessionCwdStore` overlays the live
+  value so reads are immediate and sessions stay independent in one process.
+- **APIs** (`src/api.ts`): `getSessionCwd(agent)` (live overlay → durable fold
+  → session header → fallback) and `setSessionCwd(agent, path)` (durable
+  event + overlay; absolute paths only).
+- **Workspace boundary guard** (WS2, `src/listener.ts`): a
+  `tools/pre-execute` listener registered with `{ prepend: true }` — ahead of
+  the permission-rules waterfall — that checks every fs-family call's target
+  path against the session cwd. Out-of-workspace targets return
+  `{ kind: 'ask' }` ("Operation targets path outside session workspace") in
+  every mode except `bypassPermissions`, which allows (the existing audit
+  trail covers it). Non-fs tools, pathless calls, and agents without a
+  resolvable cwd pass through untouched; the guard is a pre-execute
+  convenience, not a hard security boundary.
+
+## Consumers
+
+- `tool-git-worktree`: `EnterWorktree` calls `setSessionCwd(worktreePath)`;
+  `ExitWorktree` restores `session.originalCwd` the same way.
+- TUI driver: project/history resolution prefers the durable fold over the
+  boot-time header cwd.
+- CC preset (`packages/preset/cc/agent.cordis.yml`) composes the plugin, which
+  installs the boundary guard.
+
+## Tests
+
+```bash
+cd packages/workspace/session-cwd && npx vitest run tests/
+```
+
+(In a worktree whose root `node_modules` is a symlink the sandbox cannot write
+into, add `--configLoader runner` to skip the `.vite-temp` bundle step.)

package/lib/api.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Session cwd APIs. `getSessionCwd` resolves the authoritative session
+ * working directory (live overlay → durable `worktree/entered` fold →
+ * session header → fallback); `setSessionCwd` records the change durably by
+ * appending a `worktree/entered` event and updating the live overlay.
+ *
+ * @module @dsh-cc/session-cwd/api
+ */
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import { type SessionCwdStore } from './state.ts';
+/** Options accepted by the cwd APIs; default to the shared process store. */
+export interface SessionCwdOptions {
+    /** The store to read/write; defaults to the process-wide singleton. */
+    store?: SessionCwdStore;
+    /** Final fallback when neither the log nor the header records a cwd. */
+    fallback?: string;
+}
+/**
+ * Read the authoritative session working directory. Resolution order: the
+ * live store overlay, the durable `worktree/entered` fold, the session
+ * header cwd, then the caller's fallback (defaulting to the process cwd).
+ * @param agent - the live agent whose session cwd is being read.
+ * @param options - store and fallback overrides.
+ * @returns the absolute session cwd.
+ */
+export declare function getSessionCwd(agent: Agent, options?: SessionCwdOptions): string;
+/**
+ * Change the session's working directory: append a durable `worktree/entered`
+ * event (last-wins fold) and update the live overlay. The path must be
+ * absolute and is normalized before writing.
+ * @param agent - the live agent whose session cwd is changing.
+ * @param path - the new absolute working directory.
+ * @param options - store override.
+ */
+export declare function setSessionCwd(agent: Agent, path: string, options?: SessionCwdOptions): void;
+//# sourceMappingURL=api.d.ts.map

package/lib/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAEnD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAA;AAElE,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,KAAK,CAAC,EAAE,eAAe,CAAA;IACvB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,GAAE,iBAAsB,GAAG,MAAM,CAOnF;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,IAAI,CAQ/F"}

package/lib/api.js

@@ -0,0 +1,45 @@
+/**
+ * Session cwd APIs. `getSessionCwd` resolves the authoritative session
+ * working directory (live overlay → durable `worktree/entered` fold →
+ * session header → fallback); `setSessionCwd` records the change durably by
+ * appending a `worktree/entered` event and updating the live overlay.
+ *
+ * @module @dsh-cc/session-cwd/api
+ */
+import { isAbsolute, resolve } from 'node:path';
+import { appendWorktreeEntered } from "./events.js";
+import { sessionCwdStore } from "./state.js";
+/**
+ * Read the authoritative session working directory. Resolution order: the
+ * live store overlay, the durable `worktree/entered` fold, the session
+ * header cwd, then the caller's fallback (defaulting to the process cwd).
+ * @param agent - the live agent whose session cwd is being read.
+ * @param options - store and fallback overrides.
+ * @returns the absolute session cwd.
+ */
+export function getSessionCwd(agent, options = {}) {
+    const { store = sessionCwdStore, fallback } = options;
+    const sessionId = String(agent.session.id);
+    return store.resolve(sessionId, agent.session.events)
+        ?? agent.session.header.cwd
+        ?? fallback
+        ?? process.cwd();
+}
+/**
+ * Change the session's working directory: append a durable `worktree/entered`
+ * event (last-wins fold) and update the live overlay. The path must be
+ * absolute and is normalized before writing.
+ * @param agent - the live agent whose session cwd is changing.
+ * @param path - the new absolute working directory.
+ * @param options - store override.
+ */
+export function setSessionCwd(agent, path, options = {}) {
+    if (!isAbsolute(path)) {
+        throw new TypeError(`session cwd must be an absolute path: "${path}"`);
+    }
+    const { store = sessionCwdStore } = options;
+    const normalized = resolve(path);
+    appendWorktreeEntered(agent.session, normalized);
+    store.set(String(agent.session.id), normalized);
+}
+//# sourceMappingURL=api.js.map

package/lib/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAE/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,EAAE,eAAe,EAAwB,MAAM,YAAY,CAAA;AAUlE;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAY,EAAE,UAA6B,EAAE;IACzE,MAAM,EAAE,KAAK,GAAG,eAAe,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IACrD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;WAChD,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;WACxB,QAAQ;WACR,OAAO,CAAC,GAAG,EAAE,CAAA;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAY,EAAE,IAAY,EAAE,UAA6B,EAAE;IACvF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,SAAS,CAAC,0CAA0C,IAAI,GAAG,CAAC,CAAA;IACxE,CAAC;IACD,MAAM,EAAE,KAAK,GAAG,eAAe,EAAE,GAAG,OAAO,CAAA;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAChC,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAChD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAA;AACjD,CAAC"}

package/lib/events.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Durable session cwd events. This module registers the `worktree/entered`
+ * session event type into the upstream `KNOWN_SESSION_EVENT_TYPES` set at
+ * load (required for persistence-layer compatibility: persistence refuses
+ * unknown event types unless the type is registered there). The set is typed
+ * `ReadonlySet` but is a live `Set` — same cross-repo registration pattern as
+ * `permission/mode` in `@dsh-cc/permission-rules`.
+ *
+ * The event payload is a local wire face (`WorktreeEnteredWire`) rather than
+ * `SessionEventMap['worktree/entered']` so both the CI pin (type absent from
+ * the typed map) and a newer local harness typecheck: `Session.append` is
+ * compiler-validated against the upstream event map, so appends go through a
+ * widened function face.
+ *
+ * @module @dsh-cc/session-cwd/events
+ */
+import type { Session, SessionEvent } from '@deepseek-ai/dsh-session';
+/** The session event type carrying a session cwd change. */
+export declare const WORKTREE_ENTERED_EVENT = "worktree/entered";
+/**
+ * The `worktree/entered` payload as written by this plugin: the new absolute
+ * session working directory. `ExitWorktree` restores the previous directory
+ * through the same event (last-wins fold), so one type covers both moves.
+ */
+export interface WorktreeEnteredEventData {
+    path: string;
+}
+/**
+ * Fold the session's current working directory from its event log: the last
+ * `worktree/entered` path, or `undefined` when the session never recorded one
+ * (callers apply the process/session default).
+ * @param events - session events in log order (other event types are skipped).
+ * @returns the last recorded cwd, or `undefined` without one.
+ */
+export declare function foldSessionCwd(events: readonly SessionEvent[]): string | undefined;
+/**
+ * Append one durable `worktree/entered` event. `path` must be absolute; it is
+ * written verbatim (callers normalize before calling).
+ * @param session - the session the cwd change belongs to.
+ * @param path - the new absolute session working directory.
+ */
+export declare function appendWorktreeEntered(session: Session, path: string): void;
+//# sourceMappingURL=events.d.ts.map

package/lib/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAErE,4DAA4D;AAC5D,eAAO,MAAM,sBAAsB,qBAAqB,CAEvD;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAA;CACb;AAaD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,GAAG,SAAS,CAQlF;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAG1E"}

package/lib/events.js

@@ -0,0 +1,51 @@
+/**
+ * Durable session cwd events. This module registers the `worktree/entered`
+ * session event type into the upstream `KNOWN_SESSION_EVENT_TYPES` set at
+ * load (required for persistence-layer compatibility: persistence refuses
+ * unknown event types unless the type is registered there). The set is typed
+ * `ReadonlySet` but is a live `Set` — same cross-repo registration pattern as
+ * `permission/mode` in `@dsh-cc/permission-rules`.
+ *
+ * The event payload is a local wire face (`WorktreeEnteredWire`) rather than
+ * `SessionEventMap['worktree/entered']` so both the CI pin (type absent from
+ * the typed map) and a newer local harness typecheck: `Session.append` is
+ * compiler-validated against the upstream event map, so appends go through a
+ * widened function face.
+ *
+ * @module @dsh-cc/session-cwd/events
+ */
+import { KNOWN_SESSION_EVENT_TYPES } from '@deepseek-ai/dsh-session';
+/** The session event type carrying a session cwd change. */
+export const WORKTREE_ENTERED_EVENT = 'worktree/entered';
+KNOWN_SESSION_EVENT_TYPES.add(WORKTREE_ENTERED_EVENT);
+/** Read a log event through the extended `worktree/entered` face. */
+function asEnteredEvent(event) {
+    return event;
+}
+/**
+ * Fold the session's current working directory from its event log: the last
+ * `worktree/entered` path, or `undefined` when the session never recorded one
+ * (callers apply the process/session default).
+ * @param events - session events in log order (other event types are skipped).
+ * @returns the last recorded cwd, or `undefined` without one.
+ */
+export function foldSessionCwd(events) {
+    for (let i = events.length - 1; i >= 0; i--) {
+        const event = asEnteredEvent(events[i]);
+        if (event.type === WORKTREE_ENTERED_EVENT && typeof event.data?.path === 'string') {
+            return event.data.path;
+        }
+    }
+    return undefined;
+}
+/**
+ * Append one durable `worktree/entered` event. `path` must be absolute; it is
+ * written verbatim (callers normalize before calling).
+ * @param session - the session the cwd change belongs to.
+ * @param path - the new absolute session working directory.
+ */
+export function appendWorktreeEntered(session, path) {
+    const data = { path };
+    session.append(WORKTREE_ENTERED_EVENT, data);
+}
+//# sourceMappingURL=events.js.map

package/lib/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AAGpE,4DAA4D;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAEvD;AAAC,yBAAyC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;AAiBvE,qEAAqE;AACrE,SAAS,cAAc,CAAC,KAAmB;IACzC,OAAO,KAAuC,CAAA;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAA+B;IAC5D,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAA;QACxC,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,IAAI,OAAO,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAA;QACxB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB,EAAE,IAAY;IAClE,MAAM,IAAI,GAA6B,EAAE,IAAI,EAAE,CAC9C;IAAC,OAAO,CAAC,MAAkF,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAA;AAC5H,CAAC"}

package/lib/index.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Session-scoped working directory for DeepSeek Harness CC (WS1 + WS2).
+ * Registers the `worktree/entered` session event type at load (required for
+ * persistence compatibility), maintains foldable session cwd state, exposes
+ * `getSessionCwd` / `setSessionCwd`, and installs the `tools/pre-execute`
+ * workspace boundary guard (prepend, ahead of permission-rules) that routes
+ * out-of-workspace fs targets to an approval ask.
+ *
+ * @module @dsh-cc/session-cwd
+ */
+import z from '@deepseek-ai/schemastery';
+import './events.ts';
+import type { Context } from '@deepseek-ai/cordis';
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import { type SessionCwdStore } from './state.ts';
+import { type SessionCwdOptions } from './api.ts';
+export { WORKTREE_ENTERED_EVENT, foldSessionCwd, appendWorktreeEntered, type WorktreeEnteredEventData } from './events.ts';
+export { SessionCwdStore, sessionCwdStore, foldSessionCwdState, reduceSessionCwdState, EMPTY_SESSION_CWD_STATE, type SessionCwdState } from './state.ts';
+export { getSessionCwd, setSessionCwd, type SessionCwdOptions } from './api.ts';
+export { registerSessionCwdBoundary, boundaryDecision, isFsTool, targetPathOf, isInsideWorkspace, readPermissionMode, DEFAULT_FS_TOOLS, type BoundaryListenerConfig, } from './listener.ts';
+/** Plugin runtime configuration. All optional; the schema applies the defaults shown. */
+export interface Config {
+    /** Whether the pre-execute workspace boundary guard is installed (default true). */
+    boundaryEnabled?: boolean;
+    /** Tool names treated as filesystem operations; defaults to the standard fs set. */
+    fsTools?: string[];
+}
+/** Runtime configuration schema. */
+export declare const Config: z<Config>;
+/** The plugin module face consumed by the Cordis loader. */
+export declare const inject: readonly string[];
+/**
+ * Plugin entry point: install the workspace boundary guard. The event-type
+ * registration happens at module load (the `./events.ts` side-effect import
+ * above), so even API-only consumers register the type.
+ * @param ctx - the Cordis context.
+ * @param config - runtime configuration.
+ */
+export declare function apply(ctx: Context, config?: Config): void;
+/** Convenience face for host code that does not import the pure APIs directly. */
+export declare const sessionCwd: {
+    /** Read the authoritative session working directory. */
+    get(agent: Agent, options?: SessionCwdOptions): string;
+    /** Change the session working directory (durable `worktree/entered` event). */
+    set(agent: Agent, path: string, options?: SessionCwdOptions): void;
+    /** The process-wide cwd overlay. */
+    store: SessionCwdStore;
+};
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAIxC,OAAO,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAKnD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAA;AAClE,OAAO,EAAgC,KAAK,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAE/E,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,qBAAqB,EAAE,KAAK,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAC1H,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAA;AACxJ,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,KAAK,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAC/E,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,QAAQ,EACR,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,sBAAsB,GAC5B,MAAM,eAAe,CAAA;AAEtB,yFAAyF;AACzF,MAAM,WAAW,MAAM;IACrB,oFAAoF;IACpF,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,oCAAoC;AACpC,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAG3B,CAAA;AAEF,4DAA4D;AAC5D,eAAO,MAAM,MAAM,EAAE,SAAS,MAAM,EAAO,CAAA;AAE3C;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,MAAW,GAAG,IAAI,CAO7D;AAED,kFAAkF;AAClF,eAAO,MAAM,UAAU;IACrB,wDAAwD;eAC7C,KAAK,YAAY,iBAAiB,GAAG,MAAM;IAGtD,+EAA+E;eACpE,KAAK,QAAQ,MAAM,YAAY,iBAAiB,GAAG,IAAI;IAGlE,oCAAoC;WACV,eAAe;CAC1C,CAAA"}

package/lib/index.js

@@ -0,0 +1,60 @@
+/**
+ * Session-scoped working directory for DeepSeek Harness CC (WS1 + WS2).
+ * Registers the `worktree/entered` session event type at load (required for
+ * persistence compatibility), maintains foldable session cwd state, exposes
+ * `getSessionCwd` / `setSessionCwd`, and installs the `tools/pre-execute`
+ * workspace boundary guard (prepend, ahead of permission-rules) that routes
+ * out-of-workspace fs targets to an approval ask.
+ *
+ * @module @dsh-cc/session-cwd
+ */
+import z from '@deepseek-ai/schemastery';
+// Side-effect module import: adds `worktree/entered` to the persistence
+// layer's known-event-type set at plugin load — required even when only the
+// pure APIs are consumed.
+import "./events.js";
+import { registerSessionCwdBoundary, } from "./listener.js";
+import { sessionCwdStore } from "./state.js";
+import { getSessionCwd, setSessionCwd } from "./api.js";
+export { WORKTREE_ENTERED_EVENT, foldSessionCwd, appendWorktreeEntered } from "./events.js";
+export { SessionCwdStore, sessionCwdStore, foldSessionCwdState, reduceSessionCwdState, EMPTY_SESSION_CWD_STATE } from "./state.js";
+export { getSessionCwd, setSessionCwd } from "./api.js";
+export { registerSessionCwdBoundary, boundaryDecision, isFsTool, targetPathOf, isInsideWorkspace, readPermissionMode, DEFAULT_FS_TOOLS, } from "./listener.js";
+/** Runtime configuration schema. */
+export const Config = z.object({
+    boundaryEnabled: z.boolean().default(true),
+    fsTools: z.array(z.string()),
+});
+/** The plugin module face consumed by the Cordis loader. */
+export const inject = [];
+/**
+ * Plugin entry point: install the workspace boundary guard. The event-type
+ * registration happens at module load (the `./events.ts` side-effect import
+ * above), so even API-only consumers register the type.
+ * @param ctx - the Cordis context.
+ * @param config - runtime configuration.
+ */
+export function apply(ctx, config = {}) {
+    if (config.boundaryEnabled ?? true) {
+        const listenerConfig = {
+            ...config.fsTools !== undefined ? { fsTools: config.fsTools } : {},
+        };
+        registerSessionCwdBoundary(ctx, listenerConfig);
+    }
+}
+/** Convenience face for host code that does not import the pure APIs directly. */
+export const sessionCwd = {
+    /** Read the authoritative session working directory. */
+    get(agent, options) {
+        return getSessionCwd(agent, options);
+    },
+    /** Change the session working directory (durable `worktree/entered` event). */
+    set(agent, path, options) {
+        setSessionCwd(agent, path, options);
+    },
+    /** The process-wide cwd overlay. */
+    store: sessionCwdStore,
+};
+// No default export: cordis-plugin-loader unwrapExports prefers `.default`, so
+// a convenience object without `apply` fails preset mount as "invalid plugin".
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,wEAAwE;AACxE,4EAA4E;AAC5E,0BAA0B;AAC1B,OAAO,aAAa,CAAA;AAGpB,OAAO,EACL,0BAA0B,GAE3B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,eAAe,EAAwB,MAAM,YAAY,CAAA;AAClE,OAAO,EAAE,aAAa,EAAE,aAAa,EAA0B,MAAM,UAAU,CAAA;AAE/E,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,qBAAqB,EAAiC,MAAM,aAAa,CAAA;AAC1H,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,uBAAuB,EAAwB,MAAM,YAAY,CAAA;AACxJ,OAAO,EAAE,aAAa,EAAE,aAAa,EAA0B,MAAM,UAAU,CAAA;AAC/E,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,QAAQ,EACR,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,eAAe,CAAA;AAUtB,oCAAoC;AACpC,MAAM,CAAC,MAAM,MAAM,GAAc,CAAC,CAAC,MAAM,CAAC;IACxC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAA;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,MAAM,GAAsB,EAAE,CAAA;AAE3C;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAAiB,EAAE;IACrD,IAAI,MAAM,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;QACnC,MAAM,cAAc,GAA2B;YAC7C,GAAG,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE;SACnE,CAAA;QACD,0BAA0B,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IACjD,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,wDAAwD;IACxD,GAAG,CAAC,KAAY,EAAE,OAA2B;QAC3C,OAAO,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACtC,CAAC;IACD,+EAA+E;IAC/E,GAAG,CAAC,KAAY,EAAE,IAAY,EAAE,OAA2B;QACzD,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACrC,CAAC;IACD,oCAAoC;IACpC,KAAK,EAAE,eAAkC;CAC1C,CAAA;AAED,+EAA+E;AAC/E,+EAA+E"}

package/lib/listener.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Filesystem boundary enforcement (WS2). A `tools/pre-execute` listener
+ * registered with `{ prepend: true }` — ahead of the permission-rules
+ * waterfall — that inspects every `fs`-family call, resolves its target path
+ * against the session cwd (WS1), and routes out-of-workspace targets to an
+ * approval ask unless the session is in `bypassPermissions` (allowed with the
+ * existing audit trail). The guard is a pre-execute convenience, not a hard
+ * security boundary: it does not intercept system calls.
+ *
+ * @module @dsh-cc/session-cwd/listener
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { SessionEvent } from '@deepseek-ai/dsh-session';
+import type { PreToolDecision, ToolExecution } from '@dsh-cc/tools';
+import { type SessionCwdStore } from './state.ts';
+/** Listener configuration. */
+export interface BoundaryListenerConfig {
+    /** Tool names treated as filesystem operations; defaults to {@link DEFAULT_FS_TOOLS}. */
+    fsTools?: readonly string[];
+    /** The store the listener resolves the session cwd from; defaults to the shared one. */
+    store?: SessionCwdStore;
+}
+/** The standard fs/edit tool set, matched case-insensitively. */
+export declare const DEFAULT_FS_TOOLS: readonly string[];
+/** Whether one tool name is an fs operation (case-insensitive match). */
+export declare function isFsTool(name: string, fsTools?: readonly string[]): boolean;
+/**
+ * Extract the target path of one call from its arguments. The first present
+ * string-valued target key wins; tools without a path argument yield
+ * `undefined` (the listener then passes them through untouched).
+ * @param exec - the pending tool execution.
+ * @returns the raw target path, or `undefined` when the call has none.
+ */
+export declare function targetPathOf(exec: ToolExecution): string | undefined;
+/**
+ * Whether a target path lies inside the workspace root (boundary is
+ * workspace-scoped, not path-scoped). Both sides are resolved, so `..`
+ * segments and relative targets cannot slip past.
+ * @param target - the raw target path.
+ * @param root - the workspace root (the session cwd).
+ * @returns true when the target is the root or inside it.
+ */
+export declare function isInsideWorkspace(target: string, root: string): boolean;
+/**
+ * Read the session's current permission mode from its event log: the last
+ * `permission/mode` value, or `undefined` without one. Local wire-face fold —
+ * the mode is an upstream-extensible session event, not owned here.
+ * @param events - session events in log order.
+ * @returns the recorded mode, or `undefined`.
+ */
+export declare function readPermissionMode(events: readonly SessionEvent[]): string | undefined;
+/**
+ * The boundary decision for one call, factored out of the listener for direct
+ * testing. `undefined` means "not my decision" (the caller must call `next`).
+ * @param exec - the pending tool execution.
+ * @param config - listener configuration.
+ * @returns an ask decision for out-of-workspace targets, `allow` for
+ *   bypassPermissions, or `undefined` when the guard has no opinion.
+ */
+export declare function boundaryDecision(exec: ToolExecution, config?: BoundaryListenerConfig): PreToolDecision | undefined;
+/**
+ * Register the boundary guard on `tools/pre-execute` with `{ prepend: true }`
+ * so it runs before the permission-rules waterfall and every later listener.
+ * Non-fs tools, pathless calls, agents without a resolvable cwd, and
+ * in-workspace targets pass through to `next` untouched.
+ * @param ctx - the Cordis context.
+ * @param config - listener configuration.
+ * @returns a disposer that unregisters the listener.
+ */
+export declare function registerSessionCwdBoundary(ctx: Context, config?: BoundaryListenerConfig): () => void;
+//# sourceMappingURL=listener.d.ts.map

package/lib/listener.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"listener.d.ts","sourceRoot":"","sources":["../src/listener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACnE,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAA;AAElE,8BAA8B;AAC9B,MAAM,WAAW,sBAAsB;IACrC,yFAAyF;IACzF,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,wFAAwF;IACxF,KAAK,CAAC,EAAE,eAAe,CAAA;CACxB;AAED,iEAAiE;AACjE,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAS7C,CAAA;AAED,yEAAyE;AACzE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,SAAS,MAAM,EAAqB,GAAG,OAAO,CAG7F;AAKD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAQpE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAOvE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,GAAG,SAAS,CAQtF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,aAAa,EACnB,MAAM,GAAE,sBAA2B,GAClC,eAAe,GAAG,SAAS,CAe7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,sBAA2B,GAAG,MAAM,IAAI,CAMxG"}

package/lib/listener.js

@@ -0,0 +1,129 @@
+/**
+ * Filesystem boundary enforcement (WS2). A `tools/pre-execute` listener
+ * registered with `{ prepend: true }` — ahead of the permission-rules
+ * waterfall — that inspects every `fs`-family call, resolves its target path
+ * against the session cwd (WS1), and routes out-of-workspace targets to an
+ * approval ask unless the session is in `bypassPermissions` (allowed with the
+ * existing audit trail). The guard is a pre-execute convenience, not a hard
+ * security boundary: it does not intercept system calls.
+ *
+ * @module @dsh-cc/session-cwd/listener
+ */
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+import { sessionCwdStore } from "./state.js";
+/** The standard fs/edit tool set, matched case-insensitively. */
+export const DEFAULT_FS_TOOLS = [
+    'edit',
+    'write',
+    'read',
+    'multi_edit',
+    'notebook_edit',
+    'str_replace_editor',
+    'glob',
+    'grep',
+];
+/** Whether one tool name is an fs operation (case-insensitive match). */
+export function isFsTool(name, fsTools = DEFAULT_FS_TOOLS) {
+    const normalized = name.toLowerCase();
+    return fsTools.some(tool => tool.toLowerCase() === normalized);
+}
+/** Argument keys inspected, in order, for a call's target path. */
+const TARGET_KEYS = ['file_path', 'notebook_path', 'path', 'workdir', 'cwd'];
+/**
+ * Extract the target path of one call from its arguments. The first present
+ * string-valued target key wins; tools without a path argument yield
+ * `undefined` (the listener then passes them through untouched).
+ * @param exec - the pending tool execution.
+ * @returns the raw target path, or `undefined` when the call has none.
+ */
+export function targetPathOf(exec) {
+    const args = exec.arguments;
+    if (args === undefined || typeof args !== 'object')
+        return undefined;
+    for (const key of TARGET_KEYS) {
+        const value = args[key];
+        if (typeof value === 'string' && value.length > 0)
+            return value;
+    }
+    return undefined;
+}
+/**
+ * Whether a target path lies inside the workspace root (boundary is
+ * workspace-scoped, not path-scoped). Both sides are resolved, so `..`
+ * segments and relative targets cannot slip past.
+ * @param target - the raw target path.
+ * @param root - the workspace root (the session cwd).
+ * @returns true when the target is the root or inside it.
+ */
+export function isInsideWorkspace(target, root) {
+    // Relative targets resolve against the workspace root, not the process cwd.
+    const targetPath = isAbsolute(target) ? resolve(target) : resolve(root, target);
+    const rootPath = resolve(root);
+    if (targetPath === rootPath)
+        return true;
+    const rel = relative(rootPath, targetPath);
+    return rel !== '' && rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+/**
+ * Read the session's current permission mode from its event log: the last
+ * `permission/mode` value, or `undefined` without one. Local wire-face fold —
+ * the mode is an upstream-extensible session event, not owned here.
+ * @param events - session events in log order.
+ * @returns the recorded mode, or `undefined`.
+ */
+export function readPermissionMode(events) {
+    for (let i = events.length - 1; i >= 0; i--) {
+        const event = events[i];
+        if (event.type === 'permission/mode' && typeof event.data?.mode === 'string') {
+            return event.data.mode;
+        }
+    }
+    return undefined;
+}
+/**
+ * The boundary decision for one call, factored out of the listener for direct
+ * testing. `undefined` means "not my decision" (the caller must call `next`).
+ * @param exec - the pending tool execution.
+ * @param config - listener configuration.
+ * @returns an ask decision for out-of-workspace targets, `allow` for
+ *   bypassPermissions, or `undefined` when the guard has no opinion.
+ */
+export function boundaryDecision(exec, config = {}) {
+    if (!isFsTool(exec.name, config.fsTools ?? DEFAULT_FS_TOOLS))
+        return undefined;
+    const target = targetPathOf(exec);
+    if (target === undefined)
+        return undefined;
+    const agent = exec.agent;
+    if (agent === undefined)
+        return undefined;
+    const store = config.store ?? sessionCwdStore;
+    const root = store.resolve(String(agent.session.id), agent.session.events) ?? agent.session.header.cwd;
+    if (root === undefined)
+        return undefined;
+    if (isInsideWorkspace(target, root))
+        return undefined;
+    if (readPermissionMode(agent.session.events) === 'bypassPermissions')
+        return { kind: 'allow' };
+    return {
+        kind: 'ask',
+        reason: `Operation targets path outside session workspace: ${resolve(target)} (workspace: ${resolve(root)})`,
+    };
+}
+/**
+ * Register the boundary guard on `tools/pre-execute` with `{ prepend: true }`
+ * so it runs before the permission-rules waterfall and every later listener.
+ * Non-fs tools, pathless calls, agents without a resolvable cwd, and
+ * in-workspace targets pass through to `next` untouched.
+ * @param ctx - the Cordis context.
+ * @param config - listener configuration.
+ * @returns a disposer that unregisters the listener.
+ */
+export function registerSessionCwdBoundary(ctx, config = {}) {
+    const dispose = ctx.on('tools/pre-execute', async (exec, next) => {
+        const decision = boundaryDecision(exec, config);
+        return decision ?? next();
+    }, { prepend: true });
+    return dispose;
+}
+//# sourceMappingURL=listener.js.map

package/lib/listener.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listener.js","sourceRoot":"","sources":["../src/listener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAI9D,OAAO,EAAE,eAAe,EAAwB,MAAM,YAAY,CAAA;AAUlE,iEAAiE;AACjE,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,MAAM;IACN,OAAO;IACP,MAAM;IACN,YAAY;IACZ,eAAe;IACf,oBAAoB;IACpB,MAAM;IACN,MAAM;CACP,CAAA;AAED,yEAAyE;AACzE,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,UAA6B,gBAAgB;IAClF,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IACrC,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,CAAA;AAChE,CAAC;AAED,mEAAmE;AACnE,MAAM,WAAW,GAAsB,CAAC,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;AAE/F;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAgD,CAAA;IAClE,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACpE,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;IACjE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,IAAY;IAC5D,4EAA4E;IAC5E,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC/E,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IAC1C,OAAO,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;AACtF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA+B;IAChE,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAA2D,CAAA;QACjF,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,IAAI,OAAO,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAA;QACxB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAmB,EACnB,SAAiC,EAAE;IAEnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC;QAAE,OAAO,SAAS,CAAA;IAC9E,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;IACxB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,eAAe,CAAA;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAA;IACtG,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACxC,IAAI,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IACrD,IAAI,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,mBAAmB;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC9F,OAAO;QACL,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,qDAAqD,OAAO,CAAC,MAAM,CAAC,gBAAgB,OAAO,CAAC,IAAI,CAAC,GAAG;KAC7G,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAY,EAAE,SAAiC,EAAE;IAC1F,MAAM,OAAO,GAAG,GAAG,CAAC,EAAE,CAAC,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAA4B,EAAE;QACzF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC/C,OAAO,QAAQ,IAAI,IAAI,EAAE,CAAA;IAC3B,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IACrB,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/lib/state.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Foldable session cwd state. The durable state is the session event log
+ * itself (`worktree/entered`, last-wins); this module folds it into a typed
+ * state value and adds a process-local live overlay for the current session
+ * (the same pattern as tool-git-worktree's active worktree session), which
+ * lets `getSessionCwd` read back before the event round-trips and keeps
+ * sessions independent inside one process.
+ *
+ * @module @dsh-cc/session-cwd/state
+ */
+import type { SessionEvent } from '@deepseek-ai/dsh-session';
+/** The folded cwd state of one session: the current cwd, when known. */
+export interface SessionCwdState {
+    readonly cwd?: string;
+}
+/** The empty state: no cwd recorded in this fold. */
+export declare const EMPTY_SESSION_CWD_STATE: SessionCwdState;
+/**
+ * Reduce one event into the state. Only `worktree/entered` events change the
+ * state; everything else passes through unchanged (a fold, not a filter).
+ * @param state - the state so far.
+ * @param event - the next session event in log order.
+ * @returns the next state.
+ */
+export declare function reduceSessionCwdState(state: SessionCwdState, event: SessionEvent): SessionCwdState;
+/**
+ * Fold the cwd state over a session event log, in log order.
+ * @param events - session events in log order.
+ * @returns the folded state (empty when no event applied).
+ */
+export declare function foldSessionCwdState(events: readonly SessionEvent[]): SessionCwdState;
+/**
+ * Process-local cwd overlay keyed by session id. Writes are applied on
+ * `setSessionCwd`; reads fall through to the durable event-log fold so a
+ * restarted process still resolves the cwd from the persisted session.
+ */
+export declare class SessionCwdStore {
+    private readonly live;
+    /**
+     * Record the live cwd for one session.
+     * @param sessionId - the session key.
+     * @param cwd - the new absolute cwd.
+     */
+    set(sessionId: string, cwd: string): void;
+    /** The live cwd for one session, or `undefined` without a local write. */
+    get(sessionId: string): string | undefined;
+    /**
+     * Resolve the authoritative cwd for one session: the live overlay first,
+     * then the durable event-log fold.
+     * @param sessionId - the session key.
+     * @param events - the session's event log, in log order.
+     * @returns the resolved cwd, or `undefined` when nothing is recorded.
+     */
+    resolve(sessionId: string, events: readonly SessionEvent[]): string | undefined;
+    /** Drop the live overlay for one session (used on session dispose). */
+    clear(sessionId: string): void;
+}
+/** The process-wide cwd overlay shared by the plugin, APIs, and listener. */
+export declare const sessionCwdStore: SessionCwdStore;
+//# sourceMappingURL=state.d.ts.map

package/lib/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAG5D,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,qDAAqD;AACrD,eAAO,MAAM,uBAAuB,EAAE,eAAoB,CAAA;AAE1D;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,GAAG,eAAe,CAIlG;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,eAAe,CAIpF;AAED;;;;GAIG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IAEjD;;;;OAIG;IACH,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;IAIzC,0EAA0E;IAC1E,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI1C;;;;;;OAMG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,GAAG,SAAS;IAI/E,uEAAuE;IACvE,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;CAG/B;AAED,6EAA6E;AAC7E,eAAO,MAAM,eAAe,iBAAwB,CAAA"}

package/lib/state.js

@@ -0,0 +1,74 @@
+/**
+ * Foldable session cwd state. The durable state is the session event log
+ * itself (`worktree/entered`, last-wins); this module folds it into a typed
+ * state value and adds a process-local live overlay for the current session
+ * (the same pattern as tool-git-worktree's active worktree session), which
+ * lets `getSessionCwd` read back before the event round-trips and keeps
+ * sessions independent inside one process.
+ *
+ * @module @dsh-cc/session-cwd/state
+ */
+import { foldSessionCwd } from "./events.js";
+/** The empty state: no cwd recorded in this fold. */
+export const EMPTY_SESSION_CWD_STATE = {};
+/**
+ * Reduce one event into the state. Only `worktree/entered` events change the
+ * state; everything else passes through unchanged (a fold, not a filter).
+ * @param state - the state so far.
+ * @param event - the next session event in log order.
+ * @returns the next state.
+ */
+export function reduceSessionCwdState(state, event) {
+    const wire = event;
+    if (wire.type !== 'worktree/entered' || typeof wire.data?.path !== 'string')
+        return state;
+    return { cwd: wire.data.path };
+}
+/**
+ * Fold the cwd state over a session event log, in log order.
+ * @param events - session events in log order.
+ * @returns the folded state (empty when no event applied).
+ */
+export function foldSessionCwdState(events) {
+    let state = EMPTY_SESSION_CWD_STATE;
+    for (const event of events)
+        state = reduceSessionCwdState(state, event);
+    return state;
+}
+/**
+ * Process-local cwd overlay keyed by session id. Writes are applied on
+ * `setSessionCwd`; reads fall through to the durable event-log fold so a
+ * restarted process still resolves the cwd from the persisted session.
+ */
+export class SessionCwdStore {
+    live = new Map();
+    /**
+     * Record the live cwd for one session.
+     * @param sessionId - the session key.
+     * @param cwd - the new absolute cwd.
+     */
+    set(sessionId, cwd) {
+        this.live.set(sessionId, cwd);
+    }
+    /** The live cwd for one session, or `undefined` without a local write. */
+    get(sessionId) {
+        return this.live.get(sessionId);
+    }
+    /**
+     * Resolve the authoritative cwd for one session: the live overlay first,
+     * then the durable event-log fold.
+     * @param sessionId - the session key.
+     * @param events - the session's event log, in log order.
+     * @returns the resolved cwd, or `undefined` when nothing is recorded.
+     */
+    resolve(sessionId, events) {
+        return this.live.get(sessionId) ?? foldSessionCwd(events);
+    }
+    /** Drop the live overlay for one session (used on session dispose). */
+    clear(sessionId) {
+        this.live.delete(sessionId);
+    }
+}
+/** The process-wide cwd overlay shared by the plugin, APIs, and listener. */
+export const sessionCwdStore = new SessionCwdStore();
+//# sourceMappingURL=state.js.map

package/lib/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAO5C,qDAAqD;AACrD,MAAM,CAAC,MAAM,uBAAuB,GAAoB,EAAE,CAAA;AAE1D;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAsB,EAAE,KAAmB;IAC/E,MAAM,IAAI,GAAG,KAA+D,CAAA;IAC5E,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACzF,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA+B;IACjE,IAAI,KAAK,GAAG,uBAAuB,CAAA;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,KAAK,GAAG,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACvE,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,eAAe;IACT,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAA;IAEjD;;;;OAIG;IACH,GAAG,CAAC,SAAiB,EAAE,GAAW;QAChC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC;IAED,0EAA0E;IAC1E,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACjC,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,SAAiB,EAAE,MAA+B;QACxD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,CAAA;IAC3D,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,SAAiB;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC7B,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAA"}

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@dsh-cc/session-cwd",
+  "description": "Session-scoped working directory state for DeepSeek Harness CC: durable worktree/entered session events, foldable cwd state, getSessionCwd/setSessionCwd APIs, and a pre-execute workspace boundary guard",
+  "version": "0.5.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dsh-cc/dsh-cc.git",
+    "directory": "packages/workspace/session-cwd"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib"
+  ],
+  "license": "Apache-2.0",
+  "peerDependencies": {
+    "@deepseek-ai/cordis": ">=0.1.1-rc.2",
+    "@deepseek-ai/dsh-agent": ">=0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm": ">=0.1.1-rc.2",
+    "@deepseek-ai/dsh-session": ">=0.1.1-rc.2",
+    "@deepseek-ai/schemastery": "^3.18.1",
+    "@dsh-cc/tools": "^0.5.0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "link:../../../../deepseek-harness/vendor/cordis",
+    "@deepseek-ai/dsh-agent": "link:../../../../deepseek-harness/packages/core/agent",
+    "@deepseek-ai/dsh-llm": "link:../../../../deepseek-harness/packages/llm/llm",
+    "@deepseek-ai/dsh-session": "link:../../../../deepseek-harness/packages/core/session",
+    "@deepseek-ai/schemastery": "link:../../../../deepseek-harness/vendor/schemastery",
+    "@dsh-cc/tools": "link:../../core/tools"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}