@dsh-electron/dsh-plugin-multi-root-workspace 0.1.10 → 0.1.12

package/lib/{command-BGdz7VBH.js → command-CmLekG1M.js}

@@ -2,6 +2,7 @@ import { t as effectiveDirectory } from "./session-directory-BLOstut1.js";
 import { r as canonicalPath$1 } from "./windows-runner-contract-B5R2K3mM.js";
 import { i as canonicalRoot, o as entryRootRef, p as resolveRootRef, r as availableRoots, t as RootValidationError } from "./roots-Ca_W1S9n.js";
 import { c as skillsRequestSchema, i as parsePanelCall, r as effectiveRootAccess, s as SKILLS_ENDPOINTS, t as PANEL_CHANNEL } from "./contract-CStSEOcK.js";
+import { n as AuthorityRpcError } from "./protocol-4zdwV7u4.js";
 import { closeSync, lstatSync, openSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { isAbsolute, join } from "node:path";
 import "@deepseek-ai/cordis";
@@ -878,7 +879,7 @@ async function report(registry, primaryRoot, mode) {
 }
 /** Render a failure the way the composer displays it. */
 function failureText(error) {
-	if (error instanceof RootValidationError) return `/${COMMAND_NAME}: ${error.code}: ${error.message}`;
+	if (error instanceof RootValidationError || error instanceof AuthorityRpcError) return `/${COMMAND_NAME}: ${error.code}: ${error.message}`;
 	return `/${COMMAND_NAME}: ${error instanceof Error ? error.message : String(error)}`;
 }
 /**
@@ -1268,7 +1269,7 @@ async function dispatchPanelRequest(ctx, endpoint, payload, signal) {
 			}
 		}
 	} catch (error) {
-		if (error instanceof RootValidationError) return {
+		if (error instanceof RootValidationError || error instanceof AuthorityRpcError) return {
 			ok: false,
 			error: {
 				code: error.code,

package/lib/command.js

@@ -1,2 +1,2 @@
-import { a as renderRootsReport, c as revealArgv, i as parseFoldersCommand, n as apply, o as resolvePanelPrimaryRoot, r as inject, s as revealAccepted, t as COMMAND_NAME } from "./command-BGdz7VBH.js";
+import { a as renderRootsReport, c as revealArgv, i as parseFoldersCommand, n as apply, o as resolvePanelPrimaryRoot, r as inject, s as revealAccepted, t as COMMAND_NAME } from "./command-CmLekG1M.js";
 export { COMMAND_NAME, apply, inject, parseFoldersCommand, renderRootsReport, resolvePanelPrimaryRoot, revealAccepted, revealArgv };

package/lib/{compat-D-MljsPV.js → compat-Bg2HFVMX.js}

@@ -51,7 +51,10 @@ const SUPPORTED_DSH_RELEASES = [
 	"0.2.1-alpha.5",
 	"0.2.1-rc.1",
 	"0.2.1-rc.2",
-	"0.2.1-rc.3"
+	"0.2.1-rc.3",
+	"0.2.1-rc.4",
+	"0.2.1-rc.5",
+	"0.2.2-alpha.2"
 ];
 /**
 * Packages whose absence means this plugin cannot function at all: every one of
@@ -72,6 +75,7 @@ const REQUIRED_CORE_PACKAGES = [
 * that is the mixed-installation failure this contract exists to catch.
 */
 const OPTIONAL_CORE_PACKAGES = [
+	"@deepseek-ai/dsh-storage-json",
 	"@deepseek-ai/dsh-skill",
 	"@deepseek-ai/dsh-skill-filesystem",
 	"@deepseek-ai/dsh-settings",
@@ -101,6 +105,7 @@ const OPTIONAL_CORE_PACKAGES = [
 * that disagrees with the host is a real mixed installation, not a phantom.
 */
 const RUNTIME_OPTIONAL_PACKAGES = [
+	"@deepseek-ai/dsh-storage-json",
 	"@deepseek-ai/dsh-skill",
 	"@deepseek-ai/dsh-skill-filesystem",
 	"@deepseek-ai/dsh-agent-instructions",

package/lib/compat.js

@@ -1,2 +1,2 @@
-import { a as inject, i as assertSupportedInstallation, n as MultiRootCompatService, r as apply, t as DshCompatUnsupportedError } from "./compat-D-MljsPV.js";
+import { a as inject, i as assertSupportedInstallation, n as MultiRootCompatService, r as apply, t as DshCompatUnsupportedError } from "./compat-Bg2HFVMX.js";
 export { DshCompatUnsupportedError, MultiRootCompatService, apply, assertSupportedInstallation, inject };

package/lib/{sandbox-CXk5h-ct.js → dialects-Dr4rDR-H.js}

@@ -1,10 +1,6 @@
-import { a as parseWindowsProfile, i as isWindowsNetworkOrDevicePath, n as assertWindowsDenyCapacity, t as DialectUnrecognizedError } from "./windows-runner-contract-B5R2K3mM.js";
+import { t as DialectUnrecognizedError } from "./windows-runner-contract-B5R2K3mM.js";
 import { l as isCanonicallyUnder } from "./roots-Ca_W1S9n.js";
-import { brandMultiRootProvider } from "./providers.js";
 import { posix } from "node:path";
-import { SandboxUnavailableError, canonicalPath } from "@deepseek-ai/dsh-sandbox";
-import { fileURLToPath } from "node:url";
-import { LocalSandboxProvider } from "@deepseek-ai/dsh-sandbox-local";
 //#region src/compat/sandbox-confine.ts
 /** Whether a value is a thenable, i.e. whether the installed `confine` is async. */
 function isThenable(value) {
@@ -30,6 +26,10 @@ function widenConfined(base, widen, argv, policy, signal) {
 	const confined = base(argv, policy, signal);
 	return isThenable(confined) ? confined.then(widen) : widen(confined);
 }
+/** Public consumer call with the installed provider's arity and return shape. */
+function confineInstalled(provider, argv, policy, signal) {
+	return provider.confine.call(provider, argv, policy, signal);
+}
 //#endregion
 //#region src/dialects.ts
 /**
@@ -482,262 +482,4 @@ function restrictProfileArgs(dialect, profileArgs, deniedRoots) {
 	}
 }
 //#endregion
-//#region src/windows-profile.ts
-/** Windows runner argv and capability identity. No Win32 calls at module load. */
-/** Recognize the upstream runner, then select our ambient deny-token path.
-*
-* `protectedHome` is a diagnostics label only: when it names one of the deny
-* roots it is forwarded as `--protected-home` so the runner can word its
-* hardlink/scan remediation for the protected `$DSH_HOME`. It never changes
-* which roots are denied or how.
-*/
-function restrictWindowsProfile(profile, deniedRoots, protectedHome) {
-	assertWindowsDenyCapacity(deniedRoots.length);
-	if (profile.length < 2 || profile[0] === void 0 || profile[1]?.startsWith("--")) throw new DialectUnrecognizedError("Windows ACL runner invocation is not [node, runner, ...flags]");
-	const parsed = parseWindowsProfile(profile.slice(2));
-	if (deniedRoots.length === 0) throw new DialectUnrecognizedError("Windows ambient restriction requires at least one deny root");
-	for (const root of [parsed.workspace, ...deniedRoots]) if (isWindowsNetworkOrDevicePath(root)) throw new DialectUnrecognizedError(`Windows ACL confinement cannot cover network or device paths: ${root}`);
-	const label = protectedHome !== void 0 && deniedRoots.some((root) => root.toLowerCase() === protectedHome.toLowerCase()) ? ["--protected-home", protectedHome] : [];
-	return [
-		profile[0],
-		fileURLToPath(new URL("./windows-runner.js", import.meta.url)),
-		"--upstream-runner",
-		profile[1],
-		"--workspace",
-		parsed.workspace,
-		"--temp",
-		parsed.temp,
-		"--mode",
-		"danger-full-access",
-		...deniedRoots.flatMap((root) => ["--deny-root", root]),
-		...label
-	];
-}
-function widenWindowsProfile(profile, roots, deniedRoots, primaryRoot) {
-	if (profile.length < 2 || profile[0] === void 0 || profile[1]?.startsWith("--")) throw new DialectUnrecognizedError("Windows ACL runner invocation is not [node, runner, ...flags]");
-	const parsed = parseWindowsProfile(profile.slice(2));
-	for (const root of [parsed.workspace, ...roots]) if (isWindowsNetworkOrDevicePath(root)) throw new DialectUnrecognizedError(`Windows ACL confinement cannot cover network or device paths: ${root}`);
-	if (primaryRoot !== void 0 && canonicalPath(parsed.workspace) !== primaryRoot) throw new DialectUnrecognizedError("Windows ACL profile workspace does not match the policy root");
-	{
-		const granted = parsed.mode === "workspace-write" ? [
-			parsed.workspace,
-			parsed.temp,
-			...roots
-		] : roots;
-		const covered = deniedRoots.filter((root) => granted.some((target) => windowsContained(root, target) || windowsContained(target, root)));
-		if (covered.length > 0) throw new DialectUnrecognizedError(`Windows ACL cannot deny [${covered.join(", ")}] inside a writable grant — the restricted-token model only grants`);
-	}
-	if (roots.length === 0) return [...profile];
-	return [
-		profile[0],
-		fileURLToPath(new URL("./windows-runner.js", import.meta.url)),
-		"--upstream-runner",
-		profile[1],
-		...profile.slice(2),
-		...roots.flatMap((root) => ["--additional-root", root])
-	];
-}
-/**
-* Containment over Windows SPELLINGS, not the host OS: the profile this
-* function rewrites may be produced for a Windows host while the check runs
-* in tests on POSIX, so the comparison cannot borrow the host's separator or
-* case rules.
-*/
-function windowsContained(candidate, root) {
-	const normalize = (path) => path.replaceAll("/", "\\").replace(/\\+$/, "").toLowerCase();
-	const target = normalize(candidate);
-	const base = normalize(root);
-	return target === base || target.startsWith(`${base}\\`);
-}
-//#endregion
-//#region src/sandbox.ts
-/**
-* Local process-sandbox provider over the multi-root scope. Registers as
-* `ctx.sandbox`; the runner chain, probing, denial dialects, and Windows ACL
-* grant mechanics stay the upstream implementation's.
-*/
-var MultiRootSandboxProvider = class extends LocalSandboxProvider {
-	static inject = ["sandboxPolicy", "multiRootScope"];
-	constructor(ctx, config) {
-		super(ctx, config);
-		brandMultiRootProvider(this, "sandbox");
-	}
-	/**
-	* Wrap `argv` so it executes confined under `policy` on this host, granting
-	* the scope's additional roots inside the SAME dialect profile.
-	*
-	* Under `read-only` nothing is added (the mode denies every write, additional
-	* roots included), and `danger-full-access` never reaches here at all: the
-	* bash executor and the PTY backend both hand their argv straight to the local
-	* runtime in that mode. Widening therefore only ever ADDS the scope's
-	* additional roots to an upstream `workspace-write` profile.
-	*
-	* The return shape is the INSTALLED upstream provider's: synchronous on a
-	* release with a synchronous `confine`, a promise on a release with an
-	* asynchronous one. `widenConfined` preserves whichever it is — see
-	* `./compat/sandbox-confine.ts`.
-	* @param argv - the exact argv the caller is about to spawn.
-	* @param policy - the file-effect policy this execution runs under.
-	* @param signal - cancellation, forwarded to releases that accept it.
-	* @returns the argv to spawn instead, plus the selected backend's facts.
-	*/
-	confine(argv, policy, signal) {
-		const scope = this.ctx.multiRootScope.resolve(policy);
-		if (policy.mode === "workspace-write" && scope.authority === "unavailable") {
-			const prefix = this.clampedExecution(policy, scope.deniedRoots, signal);
-			return widenConfined(() => prefix, (facts) => ({
-				...facts,
-				argv: [...facts.argv, ...argv]
-			}), argv, policy, signal);
-		}
-		const base = super.confine;
-		return widenConfined(base.bind(this), (confined) => this.widenForScope(confined, argv, policy, scope), argv, policy, signal);
-	}
-	/**
-	* Graft the scope's effective grants and denies onto one upstream `confine`
-	* result.
-	*
-	* Pure with respect to the upstream call: it only ever reads the scope and
-	* rewrites `argv`. `enforcement`, `denialSignatures` and `runnerFailureRules`
-	* are passed through untouched, because the bash executor derives its denial
-	* and enforcement reporting from them.
-	*
-	* Mode behavior (B9, R2): `workspace-write` widens the grant with the
-	* effective writable roots AND denies any restricted root the upstream
-	* grants could reach (a `read-only` root registered under the platform
-	* temp). `read-only` grafts the fixed `read-write` roots back onto the
-	* deny-all baseline — the three-state matrix's standout cell — and then
-	* applies the SAME deny pass: a grafted writable parent must not silently
-	* swallow a denied child (Seatbelt appends the deny after the allow, bwrap
-	* adds a mandatory `--ro-bind`, Landlock / windows-acl refuse the
-	* unrepresentable subtraction). `danger-full-access` never reaches
-	* here (consumers bypass `confine`); its deny semantics live in
-	* {@link restrictedArgvPrefix}.
-	* @param confined - the upstream result for this call.
-	* @param argv - the caller's argv, needed to re-split the wrapped form.
-	* @param policy - the per-call policy.
-	* @param scope - the authorization snapshot taken at dispatch.
-	* @returns the upstream result element for element, or one with a rewritten argv.
-	*/
-	widenForScope(confined, argv, policy, scope) {
-		if (scope.authority === "unavailable" || policy.mode !== "workspace-write" && policy.mode !== "read-only") return confined;
-		const writable = scope.writableRoots;
-		const denied = scope.deniedRoots;
-		if (writable.length === 0 && (denied.length === 0 || policy.mode === "read-only")) return confined;
-		try {
-			const shape = splitConfined(confined.argv, argv);
-			if (shape.dialect === "windows-acl") return {
-				...confined,
-				argv: [
-					...widenWindowsProfile(shape.profileArgs, writable, denied, scope.primaryRoot),
-					"--",
-					...argv
-				]
-			};
-			const widened = policy.mode === "workspace-write" ? widenProfileArgs(shape.dialect, shape.profileArgs, policy, writable) : graftProfileArgs(shape.dialect, shape.profileArgs, writable);
-			const profileArgs = denyProfileArgs(shape.dialect, widened, denied);
-			return {
-				...confined,
-				argv: [
-					...profileArgs,
-					"--",
-					...argv
-				]
-			};
-		} catch (error) {
-			if (!(error instanceof DialectUnrecognizedError)) throw error;
-			throw new SandboxUnavailableError(policy.mode, `multi-root workspace: cannot apply the additional workspace roots (writable: [${writable.join(", ")}], denied: [${denied.join(", ")}]) under the primary root ${scope.primaryRoot} — ${error.message}`);
-		}
-	}
-	/**
-	* Build the runner-prefix that confines an ambient-writable execution to
-	* everything EXCEPT `deniedRoots` — the `danger-full-access` + explicit
-	* `read-only` cell, which the shell, PTY and PTC consumers never route
-	* through `confine()` at all.
-	*
-	* The restricted profile does not depend on the callee's argv, so the prefix
-	* is computed once per call here and the synchronous `ctx.subprocess.spawn`
-	* seam only has to prepend it. The upstream profile builders stay private:
-	* this probes `confine` under `read-only` for the runner's argument skeleton
-	* and rewrites the file-effect part per dialect. Windows selects the
-	* standalone ambient deny-token runner. Landlock cannot express
-	* "everything except", so this combination selects bubblewrap; unusable
-	* runners fail without spawning an unconfined command.
-	*
-	* The return preserves the installed `confine` shape: a synchronous result
-	* on a synchronous release, a promise on an asynchronous one.
-	* @param policy - the caller's policy (mode must be `danger-full-access`).
-	* @param deniedRoots - canonical roots this execution must not write.
-	* @param signal - cancellation, forwarded to releases that accept it.
-	* @param protectedHome - diagnostics label: which deny root is the
-	*   protected `$DSH_HOME`. Forwarded to the Windows runner only when it is
-	*   a member of `deniedRoots`; it never changes authorization.
-	* @returns the argv prefix, ending at the `--` separator.
-	*/
-	restrictedArgvPrefix(policy, deniedRoots, signal, protectedHome) {
-		return mapConfined(this.restrictedExecution(policy, deniedRoots, signal, protectedHome), (confined) => confined.argv);
-	}
-	/** Full-access restriction and the actual selected backend's diagnostics. */
-	restrictedExecution(policy, deniedRoots, signal, protectedHome) {
-		const probePolicy = {
-			mode: "read-only",
-			workspaceRoot: policy.workspaceRoot,
-			...policy.sessionId === void 0 ? {} : { sessionId: policy.sessionId }
-		};
-		const probe = super.confine.call(this, ["true"], probePolicy, signal);
-		const restrict = (confined) => {
-			try {
-				const shape = splitConfined(confined.argv, ["true"]);
-				const argv = [...shape.dialect === "windows-acl" ? restrictWindowsProfile(shape.profileArgs, deniedRoots, protectedHome) : restrictProfileArgs(shape.dialect, shape.profileArgs, deniedRoots), "--"];
-				return shape.dialect === "landlock" ? {
-					argv,
-					enforcement: "full",
-					denialSignatures: ["read-only file system"],
-					runnerFailureRules: [{ fatalSignatures: ["bwrap: "] }]
-				} : {
-					...confined,
-					argv
-				};
-			} catch (error) {
-				if (!(error instanceof DialectUnrecognizedError)) throw error;
-				throw new SandboxUnavailableError(policy.mode, `multi-root workspace: cannot confine an ambient execution away from the denied roots [${deniedRoots.join(", ")}] — ${error.message}`);
-			}
-		};
-		return widenConfined(() => probe, restrict, ["true"], probePolicy, signal);
-	}
-	/**
-	* Limit an execution with unknown registry authority to the primary root.
-	* Shared temp grants are unsafe: another process may have registered a
-	* read-only root beneath them. Harvest the upstream read-only skeleton and
-	* graft only the primary root, retaining diagnostics and the sync/async shape.
-	* Explicit denies still win; an unrepresentable overlap refuses launch.
-	* @param policy - the caller's execution policy.
-	* @param deniedRoots - known negative boundaries, including protected home.
-	* @param signal - cancellation forwarded to upstream.
-	* @returns the confined prefix ending at `--`, without the caller's command.
-	*/
-	clampedExecution(policy, deniedRoots, signal) {
-		const probePolicy = {
-			mode: "read-only",
-			workspaceRoot: policy.workspaceRoot,
-			...policy.sessionId === void 0 ? {} : { sessionId: policy.sessionId }
-		};
-		const probe = super.confine.call(this, ["true"], probePolicy, signal);
-		const clamp = (confined) => {
-			try {
-				const shape = splitConfined(confined.argv, ["true"]);
-				const profileArgs = shape.dialect === "windows-acl" ? widenWindowsProfile(shape.profileArgs, [canonicalPath(policy.workspaceRoot)], deniedRoots, canonicalPath(policy.workspaceRoot)) : denyProfileArgs(shape.dialect, graftProfileArgs(shape.dialect, shape.profileArgs, [canonicalPath(policy.workspaceRoot)]), deniedRoots);
-				return {
-					...confined,
-					argv: [...profileArgs, "--"]
-				};
-			} catch (error) {
-				if (!(error instanceof DialectUnrecognizedError)) throw error;
-				throw new SandboxUnavailableError(policy.mode, `multi-root workspace: cannot limit an execution to the primary root while the registry authority is unavailable — ${error.message}`);
-			}
-		};
-		return widenConfined(() => probe, clamp, ["true"], probePolicy, signal);
-	}
-};
-//#endregion
-export { widenConfined as n, MultiRootSandboxProvider as t };
+export { splitConfined as a, mapConfined as c, restrictProfileArgs as i, widenConfined as l, detectDialect as n, widenProfileArgs as o, graftProfileArgs as r, confineInstalled as s, denyProfileArgs as t };

package/lib/{fs-BTXySwSG.js → fs-CfzJq2wd.js}

@@ -1,6 +1,7 @@
 import { brandMultiRootProvider } from "./providers.js";
+import { statSync } from "node:fs";
 import { dirname, sep } from "node:path";
-import { writableRoots } from "@deepseek-ai/dsh-sandbox";
+import { canonicalPath, writableRoots } from "@deepseek-ai/dsh-sandbox";
 import { stat } from "node:fs/promises";
 import { FsError } from "@deepseek-ai/dsh-fs";
 import { LocalFileSystem } from "@deepseek-ai/dsh-fs-local";
@@ -88,7 +89,8 @@ var MultiRootFileSystem = class extends LocalFileSystem {
 	* @returns the write outcome from the inherited backend.
 	*/
 	async writeText(target, content, expected, signal, sandboxPolicy) {
-		return super.writeText(await this.checkedTarget(target, sandboxPolicy), content, expected, signal);
+		const policy = structuredClone(sandboxPolicy ?? this.ctx.sandboxPolicy.resolve());
+		return this.withOperation(policy, "fs-write", async (scope) => super.writeText(await this.checkedTarget(target, policy, scope), content, expected, signal));
 	}
 	/**
 	* Fence the edit by the per-call policy, then delegate to the inherited
@@ -102,7 +104,14 @@ var MultiRootFileSystem = class extends LocalFileSystem {
 	* @returns the edit outcome from the inherited backend.
 	*/
 	async editText(target, edit, expected, signal, sandboxPolicy) {
-		return super.editText(await this.checkedTarget(target, sandboxPolicy), edit, expected, signal);
+		const policy = structuredClone(sandboxPolicy ?? this.ctx.sandboxPolicy.resolve());
+		return this.withOperation(policy, "fs-edit", async (scope) => super.editText(await this.checkedTarget(target, policy, scope), edit, expected, signal));
+	}
+	/** The provider must also work without the gated registry (ADR-0009). */
+	async withOperation(policy, kind, body) {
+		const registry = this.ctx.get("multiRootRegistry");
+		if (registry !== void 0) return registry.withOperation(policy, kind, (operation) => body(operation.scope));
+		return body(this.ctx.multiRootScope.resolve(policy));
 	}
 	/**
 	* The writable roots of one confined call: the upstream derivation (primary
@@ -121,7 +130,14 @@ var MultiRootFileSystem = class extends LocalFileSystem {
 	rootsFor(policy, scope) {
 		if (scope.authority === "unavailable") return policy.mode === "read-only" ? [] : [scope.primaryRoot];
 		const roots = writableRoots(policy);
-		for (const root of scope.writableRoots) if (!roots.includes(root)) roots.push(root);
+		for (const root of scope.writableRoots) {
+			try {
+				if (canonicalPath(root) !== root || !statSync(root).isDirectory()) continue;
+			} catch {
+				continue;
+			}
+			if (!roots.includes(root)) roots.push(root);
+		}
 		return roots;
 	}
 	/**
@@ -149,12 +165,11 @@ var MultiRootFileSystem = class extends LocalFileSystem {
 	* to primary-root-only writes (no shared temp or additional-root grants)
 	* until the authority returns.
 	* @param target - the resolved target about to be mutated.
-	* @param sandboxPolicy - the per-call policy; omit for the deployment fallback.
+	* @param policy - the per-call policy captured before admission.
+	* @param scope - the admission snapshot shared by every fence check.
 	* @returns the fresh canonical target the mutation must use.
 	*/
-	async checkedTarget(target, sandboxPolicy) {
-		const policy = sandboxPolicy ?? this.ctx.sandboxPolicy.resolve();
-		const scope = this.ctx.multiRootScope.resolve(policy);
+	async checkedTarget(target, policy, scope) {
 		const effectiveMode = scope.authority === "unavailable" && policy.mode === "danger-full-access" ? "workspace-write" : policy.mode;
 		if (effectiveMode === "danger-full-access" && scope.deniedRoots.length === 0) return target;
 		const fresh = await this.resolve(target.displayPath);

package/lib/fs.js

@@ -1,3 +1,3 @@
 import "./providers.js";
-import { t as MultiRootFileSystem } from "./fs-BTXySwSG.js";
+import { t as MultiRootFileSystem } from "./fs-CfzJq2wd.js";
 export { MultiRootFileSystem, MultiRootFileSystem as default };

package/lib/index.js

@@ -1,14 +1,15 @@
 import { i as renderInstructions, n as instructionsApi, t as createInstructionMessage } from "./llm-message-fYORacvh.js";
-import { a as composeInstructionMessage, r as PLUGIN_SOURCE, t as DEFAULT_MAX_BYTES } from "./instructions-MePoRigy.js";
+import { a as composeInstructionMessage, r as PLUGIN_SOURCE, t as DEFAULT_MAX_BYTES } from "./instructions-KsUwUFE0.js";
 import { a as classifyStoredRoots, c as indexedStatuses, i as canonicalRoot, l as isCanonicallyUnder, m as validateRootCandidate, n as additionalRootId, p as resolveRootRef, r as availableRoots, s as expandRootInput, t as RootValidationError, u as removeStatusAt } from "./roots-Ca_W1S9n.js";
-import { _ as classifyInstallation, c as agentPtyMarkerVerdict, d as HOST_SERVICE_PACKAGES, f as OPTIONAL_CORE_PACKAGES, g as SUPPORTED_DSH_RELEASES, h as RUNTIME_OPTIONAL_PACKAGES, i as assertSupportedInstallation, l as assertAgentPtyMarker, m as RUNNER_ANCHORED_PACKAGES, n as MultiRootCompatService, o as AGENT_PTY_MARKER, p as REQUIRED_CORE_PACKAGES, s as PtyMarkerContractError, t as DshCompatUnsupportedError, u as CORE_PACKAGES, v as compatEnforcement, y as readInstalledVersion } from "./compat-D-MljsPV.js";
-import { n as widenConfined, t as MultiRootSandboxProvider } from "./sandbox-CXk5h-ct.js";
+import { _ as classifyInstallation, c as agentPtyMarkerVerdict, d as HOST_SERVICE_PACKAGES, f as OPTIONAL_CORE_PACKAGES, g as SUPPORTED_DSH_RELEASES, h as RUNTIME_OPTIONAL_PACKAGES, i as assertSupportedInstallation, l as assertAgentPtyMarker, m as RUNNER_ANCHORED_PACKAGES, n as MultiRootCompatService, o as AGENT_PTY_MARKER, p as REQUIRED_CORE_PACKAGES, s as PtyMarkerContractError, t as DshCompatUnsupportedError, u as CORE_PACKAGES, v as compatEnforcement, y as readInstalledVersion } from "./compat-Bg2HFVMX.js";
+import { l as widenConfined } from "./dialects-Dr4rDR-H.js";
 import { MULTI_ROOT_PROVIDER_BRAND, MultiRootProviders, brandMultiRootProvider, isMultiRootProvider } from "./providers.js";
-import { t as MultiRootFileSystem } from "./fs-BTXySwSG.js";
+import { t as MultiRootFileSystem } from "./fs-CfzJq2wd.js";
+import { t as MultiRootSandboxProvider } from "./sandbox-C-vCJCp3.js";
 import { a as parseRevealedView, i as parsePanelCall, n as PANEL_ENDPOINTS, o as parseRootsView, t as PANEL_CHANNEL } from "./contract-CStSEOcK.js";
 import { MultiRootScopeService, renderWorkspaceRootsContext, sanitizeAdditionalRoots } from "./scope.js";
-import { a as MultiRootRegistry, c as multiRootDomainSpec, i as MAX_ALIAS_LENGTH, l as RegistryAuthorityLease, n as DOMAIN_NAME, o as REGISTRY_CONTENDED_MESSAGE, r as MAX_ADDITIONAL_ROOTS_CEILING, t as DEFAULT_MAX_ADDITIONAL_ROOTS, u as RegistryLeaseContendedError } from "./registry-KSsmU393.js";
-import { a as renderRootsReport, c as revealArgv, i as parseFoldersCommand, o as resolvePanelPrimaryRoot, t as COMMAND_NAME } from "./command-BGdz7VBH.js";
+import { a as MultiRootRegistry, c as multiRootDomainSpec, i as MAX_ALIAS_LENGTH, l as RegistryAuthorityLease, n as DOMAIN_NAME, o as REGISTRY_CONTENDED_MESSAGE, r as MAX_ADDITIONAL_ROOTS_CEILING, t as DEFAULT_MAX_ADDITIONAL_ROOTS, u as RegistryLeaseContendedError } from "./registry-YTUOjmVu.js";
+import { a as renderRootsReport, c as revealArgv, i as parseFoldersCommand, o as resolvePanelPrimaryRoot, t as COMMAND_NAME } from "./command-CmLekG1M.js";
 //#region src/index.ts
 /**
 * Carrier plugin face for the bare-package-name loader row (see the module

package/lib/{instructions-MePoRigy.js → instructions-KsUwUFE0.js}

@@ -1,4 +1,5 @@
 import { t as effectiveDirectory } from "./session-directory-BLOstut1.js";
+import { c as withRegistryRead, s as withRegistryAdmission } from "./registry-operation-C2ZV3Jhw.js";
 import { n as instructionsApi, t as createInstructionMessage } from "./llm-message-fYORacvh.js";
 import { t as aroundTool } from "./tool-context-CpgIFcCB.js";
 import { l as isCanonicallyUnder } from "./roots-Ca_W1S9n.js";
@@ -6,8 +7,8 @@ import { createHash } from "node:crypto";
 import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import "@deepseek-ai/cordis";
 import { canonicalPath } from "@deepseek-ai/dsh-sandbox";
-import { stat } from "node:fs/promises";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { stat } from "node:fs/promises";
 //#region src/compat/tool-result.ts
 /**
 * Whether a tool-result message reports failure, on every supported release.
@@ -367,39 +368,43 @@ function apply(ctx, config = {}) {
 				return [...states.get(session)?.provenanceRoots ?? []];
 			},
 			async snapshot(agent, roots, target, signal) {
-				signal.throwIfAborted();
-				if (roots.length === 0) return [];
-				const api = await instructionsApi();
-				if (api === void 0) throw new Error("review-context: instruction discovery unavailable");
-				const existing = states.get(agent.session);
-				if (existing?.overflow) throw new Error("review-context: successful work index exceeded");
-				const state = {
-					scopes: new Map([...existing?.scopes ?? []].map(([key, value]) => [key, {
-						...value,
-						digest: void 0
-					}])),
-					provenanceRoots: new Set(existing?.provenanceRoots),
-					touched: /* @__PURE__ */ new Set([...existing?.touched ?? [], ...existing?.worked ?? []]),
-					worked: /* @__PURE__ */ new Set()
-				};
-				for (const path of replayedInstructionTargets(agent.session.snapshotEvents(), agent.session.header.cwd)) state.touched.add(path);
-				if (target !== void 0) state.touched.add(target);
-				const cwd = effectiveDirectory(scope, agent.session);
-				const reviewCwd = cwd === void 0 ? void 0 : canonicalPath(cwd);
-				const result = [];
-				for (const root of roots) {
-					const plan = await planRoot(scope, api, root, config, state, signal, true, reviewCwd);
-					for (const { file } of plan.deliveries) result.push({
-						root,
-						path: file.absolutePath,
-						relativeDirectory: relativeDirectoryOf(root, dirname(file.absolutePath)),
-						digest: digestOf(file.content),
-						text: file.content
-					});
-				}
-				signal.throwIfAborted();
-				if (Buffer.byteLength(JSON.stringify(result), "utf8") > maxBytes) throw new Error("review-context: instruction budget exceeded");
-				return result;
+				return withRegistryRead(scope, scope.sandboxPolicy.resolve({ session: agent.session }).workspaceRoot, "instructions", async () => {
+					const allowed = new Set(scope.multiRootScope.scopeOf(scope.sandboxPolicy.resolve({ session: agent.session }).workspaceRoot));
+					roots = roots.filter((root) => allowed.has(root));
+					signal.throwIfAborted();
+					if (roots.length === 0) return [];
+					const api = await instructionsApi();
+					if (api === void 0) throw new Error("review-context: instruction discovery unavailable");
+					const existing = states.get(agent.session);
+					if (existing?.overflow) throw new Error("review-context: successful work index exceeded");
+					const state = {
+						scopes: new Map([...existing?.scopes ?? []].map(([key, value]) => [key, {
+							...value,
+							digest: void 0
+						}])),
+						provenanceRoots: new Set(existing?.provenanceRoots),
+						touched: /* @__PURE__ */ new Set([...existing?.touched ?? [], ...existing?.worked ?? []]),
+						worked: /* @__PURE__ */ new Set()
+					};
+					for (const path of replayedInstructionTargets(agent.session.snapshotEvents(), agent.session.header.cwd)) state.touched.add(path);
+					if (target !== void 0) state.touched.add(target);
+					const cwd = effectiveDirectory(scope, agent.session);
+					const reviewCwd = cwd === void 0 ? void 0 : canonicalPath(cwd);
+					const result = [];
+					for (const root of roots) {
+						const plan = await planRoot(scope, api, root, config, state, signal, true, reviewCwd);
+						for (const { file } of plan.deliveries) result.push({
+							root,
+							path: file.absolutePath,
+							relativeDirectory: relativeDirectoryOf(root, dirname(file.absolutePath)),
+							digest: digestOf(file.content),
+							text: file.content
+						});
+					}
+					signal.throwIfAborted();
+					if (Buffer.byteLength(JSON.stringify(result), "utf8") > maxBytes) throw new Error("review-context: instruction budget exceeded");
+					return result;
+				});
 			}
 		});
 		scope.on("fs/observed", (target, _observation, actor) => {
@@ -412,7 +417,7 @@ function apply(ctx, config = {}) {
 		scope.on("agent/pre-step", async ({ agent, messages, signal }, next) => {
 			const decision = await next();
 			if (decision.kind !== "enter") return decision;
-			const seeded = await pending(scope, states, agent, config, maxBytes, signal, decision.messages);
+			const seeded = await withRegistryAdmission(scope, scope.sandboxPolicy.resolve({ session: agent.session }), "instructions", () => pending(scope, states, agent, config, maxBytes, signal, decision.messages));
 			if (seeded === void 0) return decision;
 			signal.throwIfAborted();
 			const lastClaimed = decision.messages.findLastIndex((message) => messages.includes(message));
@@ -436,8 +441,9 @@ function apply(ctx, config = {}) {
 * @param signal - the turn's cancellation signal.
 * @returns the message to inject, or `undefined`.
 */
-async function pending(ctx, states, agent, config, maxBytes, signal, messages) {
+async function pending(ctx, states, agent, config, maxBytes, signal, messages, retried = false) {
 	const session = agent.session;
+	const sourceEpoch = ctx.get("multiRootRegistry")?.epoch;
 	const state = states.get(session) ?? {
 		scopes: /* @__PURE__ */ new Map(),
 		provenanceRoots: /* @__PURE__ */ new Set(),
@@ -508,7 +514,7 @@ async function pending(ctx, states, agent, config, maxBytes, signal, messages) {
 			}
 		}
 	}
-	const current = new Set(ctx.multiRootScope.resolve(ctx.sandboxPolicy.resolve({ session })).additionalRoots);
+	const current = new Set(await withRegistryAdmission(ctx, ctx.sandboxPolicy.resolve({ session }), "instructions", () => ctx.multiRootScope.resolve(ctx.sandboxPolicy.resolve({ session })).additionalRoots));
 	const revoked = [...new Set([...state.scopes.values()].map((entry) => entry.root))].filter((root) => !current.has(root));
 	const liveUpdates = updates.filter((entry) => current.has(entry.scope.root));
 	const text = composeInstructionMessage(rendered.filter((entry) => current.has(entry.root)), revoked, gone.filter((entry) => current.has(entry.scope.root)).map((entry) => entry.scope));
@@ -517,6 +523,16 @@ async function pending(ctx, states, agent, config, maxBytes, signal, messages) {
 		plugin: PLUGIN_SOURCE
 	});
 	signal.throwIfAborted();
+	if (ctx.get("multiRootRegistry")?.shared) {
+		const final = await withRegistryAdmission(ctx, ctx.sandboxPolicy.resolve({ session }), "instructions", () => ({
+			roots: ctx.multiRootScope.resolve(ctx.sandboxPolicy.resolve({ session })).additionalRoots,
+			epoch: ctx.get("multiRootRegistry")?.epoch
+		}));
+		if (sourceEpoch !== final.epoch || final.roots.length !== current.size || final.roots.some((root) => !current.has(root))) {
+			if (retried) return void 0;
+			return withRegistryAdmission(ctx, ctx.sandboxPolicy.resolve({ session }), "instructions", () => pending(ctx, states, agent, config, maxBytes, signal, messages, true));
+		}
+	}
 	if (!retryTouches) for (const touch of evaluatedTouches) state.touched.delete(touch);
 	if (text !== void 0 || liveUpdates.length > 0) {
 		for (const root of revoked) for (const [key, entry] of state.scopes) if (entry.root === root) state.scopes.delete(key);

package/lib/instructions.js

@@ -1,2 +1,2 @@
-import { a as composeInstructionMessage, i as apply, n as DEFAULT_MAX_SOURCE_BYTES, o as inject, r as PLUGIN_SOURCE, s as touchedPathOfToolCall, t as DEFAULT_MAX_BYTES } from "./instructions-MePoRigy.js";
+import { a as composeInstructionMessage, i as apply, n as DEFAULT_MAX_SOURCE_BYTES, o as inject, r as PLUGIN_SOURCE, s as touchedPathOfToolCall, t as DEFAULT_MAX_BYTES } from "./instructions-KsUwUFE0.js";
 export { DEFAULT_MAX_BYTES, DEFAULT_MAX_SOURCE_BYTES, PLUGIN_SOURCE, apply, composeInstructionMessage, inject, touchedPathOfToolCall };

package/lib/lsp.js

@@ -1,4 +1,5 @@
 import { t as wrapMethod } from "./method-wrapper-CFY3p3j2.js";
+import { c as withRegistryRead } from "./registry-operation-C2ZV3Jhw.js";
 import { t as aroundTool } from "./tool-context-CpgIFcCB.js";
 import { t as routeWorkspacePath } from "./workspace-routing-YPxaQ4V3.js";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -17,25 +18,27 @@ function apply(ctx) {
 			const session = callers.getStore();
 			const primary = session === void 0 ? request.workspaceRoot : session.header.cwd ?? scope.get("sandboxPolicy")?.resolve({ session }).workspaceRoot;
 			if (primary === void 0) throw new Error("multi-root workspace: LSP caller has no session origin or deployment policy");
-			if (scope.multiRootScope.scopeOf(primary).length === 0 && session === void 0) return original.call(this, request, signal);
-			const route = await routeWorkspacePath(scope, primary, request.filePath, signal, request.workspaceRoot);
-			if (route === void 0) {
-				const target = await scope.fs.resolve(request.filePath, {
-					cwd: request.workspaceRoot,
-					...signal === void 0 ? {} : { signal }
-				});
+			return await withRegistryRead(scope, primary, "lsp", async () => {
+				if (scope.multiRootScope.scopeOf(primary).length === 0 && session === void 0) return original.call(this, request, signal);
+				const route = await routeWorkspacePath(scope, primary, request.filePath, signal, request.workspaceRoot);
+				if (route === void 0) {
+					const target = await scope.fs.resolve(request.filePath, {
+						cwd: request.workspaceRoot,
+						...signal === void 0 ? {} : { signal }
+					});
+					return original.call(this, {
+						...request,
+						workspaceRoot: primary,
+						filePath: scope.fs.processPath(target)
+					}, signal);
+				}
+				if (session === void 0 && route.workspaceRoot === route.primaryRoot) return original.call(this, request, signal);
 				return original.call(this, {
 					...request,
-					workspaceRoot: primary,
-					filePath: scope.fs.processPath(target)
+					workspaceRoot: route.workspaceRoot,
+					filePath: route.absolutePath
 				}, signal);
-			}
-			if (session === void 0 && route.workspaceRoot === route.primaryRoot) return original.call(this, request, signal);
-			return original.call(this, {
-				...request,
-				workspaceRoot: route.workspaceRoot,
-				filePath: route.absolutePath
-			}, signal);
+			});
 		}), "multi-root:lsp routing");
 	});
 }