@dsh-electron/dsh-plugin-multi-root-workspace 0.1.11 → 0.1.13

package/lib/registry-operation-C2ZV3Jhw.js

@@ -0,0 +1,116 @@
+import { randomUUID } from "node:crypto";
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/registry-operation.ts
+/**
+* Host-local operation context after ordered Registry authority admission.
+* This is Host-only state, never a wire permit or a reusable cached grant.
+*/
+const operations = new AsyncLocalStorage();
+function currentRegistryOperation(proof) {
+	const frame = operations.getStore();
+	return frame?.active === true && frame.proof === proof ? frame.operation : void 0;
+}
+/** Capture by value: neither later publication nor a caller can mutate admission. */
+function freezeOperationScope(scope) {
+	return Object.freeze({
+		...scope,
+		additionalRoots: Object.freeze([...scope.additionalRoots]),
+		roots: Object.freeze(scope.roots.map((root) => Object.freeze({ ...root }))),
+		writableRoots: Object.freeze([...scope.writableRoots]),
+		deniedRoots: Object.freeze([...scope.deniedRoots])
+	});
+}
+/** Execute outside the authority queue; completion also expires async descendants. */
+async function runRegistryOperation(scope, kind, authorityEpoch, revision, body, proof, mode) {
+	let active = true;
+	const operation = Object.freeze({
+		identity: Object.freeze({
+			operationId: randomUUID(),
+			kind,
+			authorityEpoch,
+			revision,
+			mode,
+			primaryRoot: scope.primaryRoot
+		}),
+		get scope() {
+			if (!active) throw new Error("multi-root registry: operation admission has expired");
+			return scope;
+		}
+	});
+	const frame = {
+		proof,
+		operation,
+		active: true,
+		profiles: []
+	};
+	try {
+		return await operations.run(frame, () => body(operation));
+	} finally {
+		active = false;
+		frame.active = false;
+	}
+}
+/** Optional Registry seam for public consumers; the legacy composition stays exact. */
+async function withRegistryRead(ctx, primary, kind, body) {
+	const registry = ctx.get("multiRootRegistry");
+	return registry?.shared ? registry.withOperation({
+		workspaceRoot: primary,
+		mode: "read-only"
+	}, kind, () => body()) : body();
+}
+async function withRegistryAdmission(ctx, policy, kind, body) {
+	const registry = ctx.get("multiRootRegistry");
+	return registry?.shared ? registry.withOperation(policy, kind, () => body()) : body();
+}
+/** Preserve a legacy synchronous entry while granting only the safe primary-root fallback. */
+function runPrimaryOperation(scope, mode, proof, body) {
+	let active = true;
+	const frame = {
+		proof,
+		operation: Object.freeze({
+			identity: Object.freeze({
+				operationId: randomUUID(),
+				kind: "process",
+				authorityEpoch: void 0,
+				revision: 0,
+				mode,
+				primaryRoot: scope.primaryRoot
+			}),
+			get scope() {
+				if (!active) throw new Error("operation admission has expired");
+				return scope;
+			}
+		}),
+		active: true,
+		profiles: []
+	};
+	const finish = () => {
+		active = false;
+		frame.active = false;
+	};
+	try {
+		const result = operations.run(frame, body);
+		if (typeof result?.then === "function") return Promise.resolve(result).finally(finish);
+		finish();
+		return result;
+	} catch (error) {
+		finish();
+		throw error;
+	}
+}
+/** Only profiles produced within this exact admission can reach a sync spawn. */
+function rememberOperationProfile(proof, argv, capped) {
+	const frame = operations.getStore();
+	if (frame?.active !== true || frame.proof !== proof) return;
+	if (frame.profiles.length >= 128) throw new Error("too many confined profiles in one operation");
+	frame.profiles.push({
+		argv: [...argv],
+		capped
+	});
+}
+function operationPermitsProfile(proof, argv, capped) {
+	const frame = operations.getStore();
+	return frame?.active === true && frame.proof === proof && frame.profiles.some((profile) => profile.capped === capped && profile.argv.length <= argv.length && profile.argv.every((arg, i) => argv[i] === arg));
+}
+//#endregion
+export { runPrimaryOperation as a, withRegistryRead as c, rememberOperationProfile as i, freezeOperationScope as n, runRegistryOperation as o, operationPermitsProfile as r, withRegistryAdmission as s, currentRegistryOperation as t };

package/lib/registry.js

@@ -1,2 +1,3 @@
-import { a as MultiRootRegistry, c as multiRootDomainSpec, i as MAX_ALIAS_LENGTH, n as DOMAIN_NAME, o as REGISTRY_CONTENDED_MESSAGE, r as MAX_ADDITIONAL_ROOTS_CEILING, s as TABLE_NAME, t as DEFAULT_MAX_ADDITIONAL_ROOTS } from "./registry-KSsmU393.js";
-export { DEFAULT_MAX_ADDITIONAL_ROOTS, DOMAIN_NAME, MAX_ADDITIONAL_ROOTS_CEILING, MAX_ALIAS_LENGTH, MultiRootRegistry, MultiRootRegistry as default, REGISTRY_CONTENDED_MESSAGE, TABLE_NAME, multiRootDomainSpec };
+import { a as MultiRootRegistry, c as multiRootDomainSpec, i as MAX_ALIAS_LENGTH, n as DOMAIN_NAME, o as REGISTRY_CONTENDED_MESSAGE, r as MAX_ADDITIONAL_ROOTS_CEILING, s as TABLE_NAME, t as DEFAULT_MAX_ADDITIONAL_ROOTS } from "./registry-Bv431TfO.js";
+import { o as nativeHostAvailability } from "./protocol-CJOvAvOS.js";
+export { DEFAULT_MAX_ADDITIONAL_ROOTS, DOMAIN_NAME, MAX_ADDITIONAL_ROOTS_CEILING, MAX_ALIAS_LENGTH, MultiRootRegistry, MultiRootRegistry as default, REGISTRY_CONTENDED_MESSAGE, TABLE_NAME, multiRootDomainSpec, nativeHostAvailability };

package/lib/{review-context-AH-SXHmj.js → review-context-NDpKeMCc.js}

@@ -1,5 +1,5 @@
 import { t as effectiveDirectory } from "./session-directory-BLOstut1.js";
-import { s as touchedPathOfToolCall } from "./instructions-MePoRigy.js";
+import { s as touchedPathOfToolCall } from "./instructions-KsUwUFE0.js";
 import { l as isCanonicallyUnder } from "./roots-Ca_W1S9n.js";
 import { createHash } from "node:crypto";
 import { resolve } from "node:path";

package/lib/review-context.js

@@ -1,2 +1,2 @@
-import { t as MultiRootReviewContext } from "./review-context-AH-SXHmj.js";
+import { t as MultiRootReviewContext } from "./review-context-NDpKeMCc.js";
 export { MultiRootReviewContext, MultiRootReviewContext as default };

package/lib/sandbox-C-vCJCp3.js

@@ -0,0 +1,278 @@
+import { a as parseWindowsProfile, i as isWindowsNetworkOrDevicePath, n as assertWindowsDenyCapacity, t as DialectUnrecognizedError } from "./windows-runner-contract-B5R2K3mM.js";
+import { a as splitConfined, c as mapConfined, i as restrictProfileArgs, l as widenConfined, o as widenProfileArgs, r as graftProfileArgs, t as denyProfileArgs } from "./dialects-Dr4rDR-H.js";
+import { brandMultiRootProvider } from "./providers.js";
+import { SandboxUnavailableError, canonicalPath } from "@deepseek-ai/dsh-sandbox";
+import { fileURLToPath } from "node:url";
+import { LocalSandboxProvider } from "@deepseek-ai/dsh-sandbox-local";
+//#region src/windows-profile.ts
+/** Windows runner argv and capability identity. No Win32 calls at module load. */
+/** Recognize the upstream runner, then select our ambient deny-token path.
+*
+* `protectedHome` is a diagnostics label only: when it names one of the deny
+* roots it is forwarded as `--protected-home` so the runner can word its
+* hardlink/scan remediation for the protected `$DSH_HOME`. It never changes
+* which roots are denied or how.
+*/
+function restrictWindowsProfile(profile, deniedRoots, protectedHome) {
+	assertWindowsDenyCapacity(deniedRoots.length);
+	if (profile.length < 2 || profile[0] === void 0 || profile[1]?.startsWith("--")) throw new DialectUnrecognizedError("Windows ACL runner invocation is not [node, runner, ...flags]");
+	const parsed = parseWindowsProfile(profile.slice(2));
+	if (deniedRoots.length === 0) throw new DialectUnrecognizedError("Windows ambient restriction requires at least one deny root");
+	for (const root of [parsed.workspace, ...deniedRoots]) if (isWindowsNetworkOrDevicePath(root)) throw new DialectUnrecognizedError(`Windows ACL confinement cannot cover network or device paths: ${root}`);
+	const label = protectedHome !== void 0 && deniedRoots.some((root) => root.toLowerCase() === protectedHome.toLowerCase()) ? ["--protected-home", protectedHome] : [];
+	return [
+		profile[0],
+		fileURLToPath(new URL("./windows-runner.js", import.meta.url)),
+		"--upstream-runner",
+		profile[1],
+		"--workspace",
+		parsed.workspace,
+		"--temp",
+		parsed.temp,
+		"--mode",
+		"danger-full-access",
+		...deniedRoots.flatMap((root) => ["--deny-root", root]),
+		...label
+	];
+}
+function widenWindowsProfile(profile, roots, deniedRoots, primaryRoot) {
+	if (profile.length < 2 || profile[0] === void 0 || profile[1]?.startsWith("--")) throw new DialectUnrecognizedError("Windows ACL runner invocation is not [node, runner, ...flags]");
+	const parsed = parseWindowsProfile(profile.slice(2));
+	for (const root of [parsed.workspace, ...roots]) if (isWindowsNetworkOrDevicePath(root)) throw new DialectUnrecognizedError(`Windows ACL confinement cannot cover network or device paths: ${root}`);
+	if (primaryRoot !== void 0 && canonicalPath(parsed.workspace) !== primaryRoot) throw new DialectUnrecognizedError("Windows ACL profile workspace does not match the policy root");
+	{
+		const granted = parsed.mode === "workspace-write" ? [
+			parsed.workspace,
+			parsed.temp,
+			...roots
+		] : roots;
+		const covered = deniedRoots.filter((root) => granted.some((target) => windowsContained(root, target) || windowsContained(target, root)));
+		if (covered.length > 0) throw new DialectUnrecognizedError(`Windows ACL cannot deny [${covered.join(", ")}] inside a writable grant — the restricted-token model only grants`);
+	}
+	if (roots.length === 0) return [...profile];
+	return [
+		profile[0],
+		fileURLToPath(new URL("./windows-runner.js", import.meta.url)),
+		"--upstream-runner",
+		profile[1],
+		...profile.slice(2),
+		...roots.flatMap((root) => ["--additional-root", root])
+	];
+}
+/**
+* Containment over Windows SPELLINGS, not the host OS: the profile this
+* function rewrites may be produced for a Windows host while the check runs
+* in tests on POSIX, so the comparison cannot borrow the host's separator or
+* case rules.
+*/
+function windowsContained(candidate, root) {
+	const normalize = (path) => path.replaceAll("/", "\\").replace(/\\+$/, "").toLowerCase();
+	const target = normalize(candidate);
+	const base = normalize(root);
+	return target === base || target.startsWith(`${base}\\`);
+}
+//#endregion
+//#region src/sandbox.ts
+/**
+* Local process-sandbox provider over the multi-root scope. Registers as
+* `ctx.sandbox`; the runner chain, probing, denial dialects, and Windows ACL
+* grant mechanics stay the upstream implementation's.
+*/
+var MultiRootSandboxProvider = class extends LocalSandboxProvider {
+	static inject = ["sandboxPolicy", "multiRootScope"];
+	constructor(ctx, config) {
+		super(ctx, config);
+		brandMultiRootProvider(this, "sandbox");
+	}
+	/**
+	* Wrap `argv` so it executes confined under `policy` on this host, granting
+	* the scope's additional roots inside the SAME dialect profile.
+	*
+	* Under `read-only` nothing is added (the mode denies every write, additional
+	* roots included), and `danger-full-access` never reaches here at all: the
+	* bash executor and the PTY backend both hand their argv straight to the local
+	* runtime in that mode. Widening therefore only ever ADDS the scope's
+	* additional roots to an upstream `workspace-write` profile.
+	*
+	* The return shape is the INSTALLED upstream provider's: synchronous on a
+	* release with a synchronous `confine`, a promise on a release with an
+	* asynchronous one. `widenConfined` preserves whichever it is — see
+	* `./compat/sandbox-confine.ts`.
+	* @param argv - the exact argv the caller is about to spawn.
+	* @param policy - the file-effect policy this execution runs under.
+	* @param signal - cancellation, forwarded to releases that accept it.
+	* @returns the argv to spawn instead, plus the selected backend's facts.
+	*/
+	confine(argv, policy, signal) {
+		const scope = this.ctx.multiRootScope.resolve(policy);
+		const remember = (facts) => {
+			this.ctx.multiRootScope.rememberProfile(facts.argv);
+			return facts;
+		};
+		if (policy.mode === "workspace-write" && scope.authority === "unavailable") {
+			const prefix = this.clampedExecution(policy, scope.deniedRoots, signal);
+			return widenConfined(() => prefix, (facts) => remember({
+				...facts,
+				argv: [...facts.argv, ...argv]
+			}), argv, policy, signal);
+		}
+		const base = super.confine;
+		return widenConfined(base.bind(this), (confined) => remember(this.widenForScope(confined, argv, policy, scope)), argv, policy, signal);
+	}
+	/**
+	* Graft the scope's effective grants and denies onto one upstream `confine`
+	* result.
+	*
+	* Pure with respect to the upstream call: it only ever reads the scope and
+	* rewrites `argv`. `enforcement`, `denialSignatures` and `runnerFailureRules`
+	* are passed through untouched, because the bash executor derives its denial
+	* and enforcement reporting from them.
+	*
+	* Mode behavior (B9, R2): `workspace-write` widens the grant with the
+	* effective writable roots AND denies any restricted root the upstream
+	* grants could reach (a `read-only` root registered under the platform
+	* temp). `read-only` grafts the fixed `read-write` roots back onto the
+	* deny-all baseline — the three-state matrix's standout cell — and then
+	* applies the SAME deny pass: a grafted writable parent must not silently
+	* swallow a denied child (Seatbelt appends the deny after the allow, bwrap
+	* adds a mandatory `--ro-bind`, Landlock / windows-acl refuse the
+	* unrepresentable subtraction). `danger-full-access` never reaches
+	* here (consumers bypass `confine`); its deny semantics live in
+	* {@link restrictedArgvPrefix}.
+	* @param confined - the upstream result for this call.
+	* @param argv - the caller's argv, needed to re-split the wrapped form.
+	* @param policy - the per-call policy.
+	* @param scope - the authorization snapshot taken at dispatch.
+	* @returns the upstream result element for element, or one with a rewritten argv.
+	*/
+	widenForScope(confined, argv, policy, scope) {
+		if (scope.authority === "unavailable" || policy.mode !== "workspace-write" && policy.mode !== "read-only") return confined;
+		const writable = scope.writableRoots;
+		const denied = scope.deniedRoots;
+		if (writable.length === 0 && (denied.length === 0 || policy.mode === "read-only")) return confined;
+		try {
+			const shape = splitConfined(confined.argv, argv);
+			if (shape.dialect === "windows-acl") return {
+				...confined,
+				argv: [
+					...widenWindowsProfile(shape.profileArgs, writable, denied, scope.primaryRoot),
+					"--",
+					...argv
+				]
+			};
+			const widened = policy.mode === "workspace-write" ? widenProfileArgs(shape.dialect, shape.profileArgs, policy, writable) : graftProfileArgs(shape.dialect, shape.profileArgs, writable);
+			const profileArgs = denyProfileArgs(shape.dialect, widened, denied);
+			return {
+				...confined,
+				argv: [
+					...profileArgs,
+					"--",
+					...argv
+				]
+			};
+		} catch (error) {
+			if (!(error instanceof DialectUnrecognizedError)) throw error;
+			throw new SandboxUnavailableError(policy.mode, `multi-root workspace: cannot apply the additional workspace roots (writable: [${writable.join(", ")}], denied: [${denied.join(", ")}]) under the primary root ${scope.primaryRoot} — ${error.message}`);
+		}
+	}
+	/**
+	* Build the runner-prefix that confines an ambient-writable execution to
+	* everything EXCEPT `deniedRoots` — the `danger-full-access` + explicit
+	* `read-only` cell, which the shell, PTY and PTC consumers never route
+	* through `confine()` at all.
+	*
+	* The restricted profile does not depend on the callee's argv, so the prefix
+	* is computed once per call here and the synchronous `ctx.subprocess.spawn`
+	* seam only has to prepend it. The upstream profile builders stay private:
+	* this probes `confine` under `read-only` for the runner's argument skeleton
+	* and rewrites the file-effect part per dialect. Windows selects the
+	* standalone ambient deny-token runner. Landlock cannot express
+	* "everything except", so this combination selects bubblewrap; unusable
+	* runners fail without spawning an unconfined command.
+	*
+	* The return preserves the installed `confine` shape: a synchronous result
+	* on a synchronous release, a promise on an asynchronous one.
+	* @param policy - the caller's policy (mode must be `danger-full-access`).
+	* @param deniedRoots - canonical roots this execution must not write.
+	* @param signal - cancellation, forwarded to releases that accept it.
+	* @param protectedHome - diagnostics label: which deny root is the
+	*   protected `$DSH_HOME`. Forwarded to the Windows runner only when it is
+	*   a member of `deniedRoots`; it never changes authorization.
+	* @returns the argv prefix, ending at the `--` separator.
+	*/
+	restrictedArgvPrefix(policy, deniedRoots, signal, protectedHome) {
+		const result = this.restrictedExecution(policy, deniedRoots, signal, protectedHome);
+		return mapConfined(result, (confined) => confined.argv);
+	}
+	/** Full-access restriction and the actual selected backend's diagnostics. */
+	restrictedExecution(policy, deniedRoots, signal, protectedHome) {
+		const probePolicy = {
+			mode: "read-only",
+			workspaceRoot: policy.workspaceRoot,
+			...policy.sessionId === void 0 ? {} : { sessionId: policy.sessionId }
+		};
+		const probe = super.confine.call(this, ["true"], probePolicy, signal);
+		const restrict = (confined) => {
+			try {
+				const shape = splitConfined(confined.argv, ["true"]);
+				const argv = [...shape.dialect === "windows-acl" ? restrictWindowsProfile(shape.profileArgs, deniedRoots, protectedHome) : restrictProfileArgs(shape.dialect, shape.profileArgs, deniedRoots), "--"];
+				return shape.dialect === "landlock" ? {
+					argv,
+					enforcement: "full",
+					denialSignatures: ["read-only file system"],
+					runnerFailureRules: [{ fatalSignatures: ["bwrap: "] }]
+				} : {
+					...confined,
+					argv
+				};
+			} catch (error) {
+				if (!(error instanceof DialectUnrecognizedError)) throw error;
+				throw new SandboxUnavailableError(policy.mode, `multi-root workspace: cannot confine an ambient execution away from the denied roots [${deniedRoots.join(", ")}] — ${error.message}`);
+			}
+		};
+		return widenConfined(() => probe, (facts) => {
+			const result = restrict(facts);
+			this.ctx.multiRootScope.rememberProfile(result.argv);
+			return result;
+		}, ["true"], probePolicy, signal);
+	}
+	/**
+	* Limit an execution with unknown registry authority to the primary root.
+	* Shared temp grants are unsafe: another process may have registered a
+	* read-only root beneath them. Harvest the upstream read-only skeleton and
+	* graft only the primary root, retaining diagnostics and the sync/async shape.
+	* Explicit denies still win; an unrepresentable overlap refuses launch.
+	* @param policy - the caller's execution policy.
+	* @param deniedRoots - known negative boundaries, including protected home.
+	* @param signal - cancellation forwarded to upstream.
+	* @returns the confined prefix ending at `--`, without the caller's command.
+	*/
+	clampedExecution(policy, deniedRoots, signal) {
+		const probePolicy = {
+			mode: "read-only",
+			workspaceRoot: policy.workspaceRoot,
+			...policy.sessionId === void 0 ? {} : { sessionId: policy.sessionId }
+		};
+		const probe = super.confine.call(this, ["true"], probePolicy, signal);
+		const clamp = (confined) => {
+			try {
+				const shape = splitConfined(confined.argv, ["true"]);
+				const profileArgs = shape.dialect === "windows-acl" ? widenWindowsProfile(shape.profileArgs, [canonicalPath(policy.workspaceRoot)], deniedRoots, canonicalPath(policy.workspaceRoot)) : denyProfileArgs(shape.dialect, graftProfileArgs(shape.dialect, shape.profileArgs, [canonicalPath(policy.workspaceRoot)]), deniedRoots);
+				return {
+					...confined,
+					argv: [...profileArgs, "--"]
+				};
+			} catch (error) {
+				if (!(error instanceof DialectUnrecognizedError)) throw error;
+				throw new SandboxUnavailableError(policy.mode, `multi-root workspace: cannot limit an execution to the primary root while the registry authority is unavailable — ${error.message}`);
+			}
+		};
+		return widenConfined(() => probe, (facts) => {
+			const result = clamp(facts);
+			this.ctx.multiRootScope.rememberProfile(result.argv);
+			return result;
+		}, ["true"], probePolicy, signal);
+	}
+};
+//#endregion
+export { MultiRootSandboxProvider as t };

package/lib/sandbox.js

@@ -1,3 +1,3 @@
-import { t as MultiRootSandboxProvider } from "./sandbox-CXk5h-ct.js";
 import "./providers.js";
+import { t as MultiRootSandboxProvider } from "./sandbox-C-vCJCp3.js";
 export { MultiRootSandboxProvider, MultiRootSandboxProvider as default };

package/lib/scope.js

@@ -1,3 +1,4 @@
+import { i as rememberOperationProfile, r as operationPermitsProfile, t as currentRegistryOperation } from "./registry-operation-C2ZV3Jhw.js";
 import { t as aroundTool } from "./tool-context-CpgIFcCB.js";
 import { r as effectiveRootAccess } from "./contract-CStSEOcK.js";
 import { statSync } from "node:fs";
@@ -153,6 +154,11 @@ var MultiRootScopeService = class extends Service {
 	/** Additional roots keyed by canonical primary root; empty until roots are registered. */
 	rootsByPrimary = /* @__PURE__ */ new Map();
 	listeners = /* @__PURE__ */ new Set();
+	/** Enclosing {@link MultiRootScopeService.batch} depth; inner calls nest. */
+	batchDepth = 0;
+	/** True when a batched write coalesced its notification into the flush. */
+	batchDirty = false;
+	admissionProof;
 	/**
 	* The registry-authority fact the registry row publishes. Defaults to
 	* `available`: a composition without a registry row can never have
@@ -181,6 +187,36 @@ var MultiRootScopeService = class extends Service {
 		};
 	}
 	/**
+	* Run `body` as one notification round: `setAdditionalRoots()` and
+	* `setRegistryAuthority()` apply their state immediately (a same-value
+	* authority write still stays silent), but subscriber invocations coalesce
+	* into a single flush when the OUTERMOST batch ends — also when `body`
+	* throws, because the state already landed. A write a subscriber makes
+	* during the flush is not part of the batch and notifies synchronously
+	* under the normal rules.
+	* @param body - the writes to run as one round.
+	* @returns the body's return value.
+	*/
+	batch(body) {
+		this.batchDepth++;
+		try {
+			return body();
+		} finally {
+			if (--this.batchDepth === 0 && this.batchDirty) {
+				this.batchDirty = false;
+				for (const listener of this.listeners) listener();
+			}
+		}
+	}
+	/** Notify subscribers now, or coalesce into the enclosing batch's flush. */
+	notifySubscribers() {
+		if (this.batchDepth > 0) {
+			this.batchDirty = true;
+			return;
+		}
+		for (const listener of this.listeners) listener();
+	}
+	/**
 	* The sorted names of the tools `toolAccess` caps — read-only for the
 	* prompt contribution. An invalid config is not enumerated (it caps every
 	* call but is not a listable tool set).
@@ -220,7 +256,7 @@ var MultiRootScopeService = class extends Service {
 					const session = assembly.agent?.session;
 					if (session === void 0) return "";
 					const policy = scope.sandboxPolicy.resolve({ session });
-					const resolved = this.resolve(policy);
+					const resolved = this.snapshot(policy);
 					if (resolved.roots.length === 0 && resolved.authority !== "unavailable" && resolved.protectedHome === void 0) return "";
 					return renderWorkspaceRootsContext({
 						platform: process.platform,
@@ -241,9 +277,52 @@ var MultiRootScopeService = class extends Service {
 	* @param policy - the upstream policy whose workspace root is the primary root.
 	* @returns the canonical scope; `additionalRoots` is empty when none are registered.
 	*/
-	resolve(policy) {
+	requireAdmission(proof) {
+		this.admissionProof = proof;
+	}
+	rememberProfile(argv) {
+		if (this.admissionProof !== void 0) rememberOperationProfile(this.admissionProof, argv, this.capped());
+	}
+	permitsProfile(argv) {
+		return this.admissionProof === void 0 || operationPermitsProfile(this.admissionProof, argv, this.capped());
+	}
+	get admissionRequired() {
+		return this.admissionProof !== void 0;
+	}
+	admissionPathsValid() {
+		if (this.admissionProof === void 0) return true;
+		const operation = currentRegistryOperation(this.admissionProof);
+		return operation !== void 0 && operation.scope.additionalRoots.every((root) => {
+			try {
+				return canonicalPath(root) === root && statSync(root).isDirectory();
+			} catch {
+				return false;
+			}
+		});
+	}
+	hasAdmission() {
+		return this.admissionProof === void 0 || currentRegistryOperation(this.admissionProof) !== void 0;
+	}
+	/** Trusted display/review projection, never an execution permit. */
+	snapshot(policy) {
 		return this.project(policy, this.capped());
 	}
+	resolveSnapshot(policy, roots, available) {
+		return this.project(policy, this.capped(), roots, available ? "available" : "unavailable");
+	}
+	resolve(policy) {
+		if (this.admissionProof === void 0) return this.project(policy, this.capped());
+		const operation = currentRegistryOperation(this.admissionProof);
+		if (operation !== void 0 && operation.identity.mode === policy.mode && operation.scope.primaryRoot === canonicalPath(policy.workspaceRoot)) {
+			const snapshot = operation.scope;
+			return this.capped() ? {
+				...snapshot,
+				writableRoots: [],
+				deniedRoots: [.../* @__PURE__ */ new Set([...snapshot.deniedRoots, ...snapshot.additionalRoots])]
+			} : snapshot;
+		}
+		return this.project(policy, true, void 0, "unavailable");
+	}
 	/** Read-only pending-dispatch projection. Does not mint an ALS execution grant. */
 	previewForTool(policy, toolName) {
 		return this.project(policy, this.capForTool(toolName));
@@ -252,14 +331,15 @@ var MultiRootScopeService = class extends Service {
 	capForTool(toolName) {
 		return this.capsInvalid || toolCapStore.getStore()?.capped === true || this.caps[toolName] === "read-only";
 	}
-	project(policy, capped) {
+	project(policy, capped, recorded, authority = this.registryAuthority) {
 		const primaryRoot = canonicalPath(policy.workspaceRoot);
-		const roots = this.membersOf(primaryRoot);
-		const writable = capped || this.registryAuthority === "unavailable" ? [] : roots.filter((root) => effectivelyWritable(policy.mode, root.access)).map((root) => root.path);
-		const denied = (this.rootsByPrimary.get(primaryRoot) ?? []).filter((root) => typeof root.recordedPath === "string" && root.recordedPath !== "" && root.recordedPath !== primaryRoot && (capped || !effectivelyWritable(policy.mode, root.access))).map((root) => root.recordedPath);
+		const registered = recorded ?? this.rootsByPrimary.get(primaryRoot) ?? [];
+		const roots = authority === "unavailable" ? [] : sanitizeMembers(primaryRoot, registered);
+		const writable = capped || authority === "unavailable" ? [] : roots.filter((root) => effectivelyWritable(policy.mode, root.access)).map((root) => root.path);
+		const denied = registered.filter((root) => typeof root.recordedPath === "string" && root.recordedPath !== "" && root.recordedPath !== primaryRoot && (capped || !effectivelyWritable(policy.mode, root.access))).map((root) => root.recordedPath);
 		const deniedRoots = [...new Set(denied)];
 		let protectedHome;
-		if (this.dshHome !== void 0 && policy.mode === "danger-full-access" && (deniedRoots.length > 0 || this.registryAuthority === "unavailable")) {
+		if (this.dshHome !== void 0 && policy.mode === "danger-full-access" && (deniedRoots.length > 0 || authority === "unavailable")) {
 			const home = canonicalPath(this.dshHome);
 			if (!deniedRoots.includes(home)) {
 				deniedRoots.push(home);
@@ -272,7 +352,7 @@ var MultiRootScopeService = class extends Service {
 			roots,
 			writableRoots: writable,
 			deniedRoots,
-			authority: this.registryAuthority,
+			authority,
 			...protectedHome === void 0 ? {} : { protectedHome }
 		};
 	}
@@ -298,6 +378,16 @@ var MultiRootScopeService = class extends Service {
 	* @returns the canonical additional roots; empty when none are registered.
 	*/
 	scopeOf(primaryRoot) {
+		if (this.admissionProof !== void 0) {
+			const operation = currentRegistryOperation(this.admissionProof);
+			return operation?.scope.primaryRoot === canonicalPath(primaryRoot) ? operation.scope.additionalRoots.filter((root) => {
+				try {
+					return canonicalPath(root) === root && statSync(root).isDirectory();
+				} catch {
+					return false;
+				}
+			}) : [];
+		}
 		return this.membersOf(primaryRoot).map((root) => root.path);
 	}
 	/**
@@ -323,7 +413,7 @@ var MultiRootScopeService = class extends Service {
 	*   registry cannot prove none does.
 	*/
 	hasActiveDenyRoots() {
-		if (this.registryAuthority === "unavailable") return true;
+		if (this.registryAuthority === "unavailable" || !this.hasAdmission()) return true;
 		for (const members of this.rootsByPrimary.values()) if (members.some((root) => root.access === "read-only") || members.length > 0 && this.capped()) return true;
 		return false;
 	}
@@ -347,7 +437,7 @@ var MultiRootScopeService = class extends Service {
 		const key = canonicalPath(primaryRoot);
 		if (roots.length === 0) this.rootsByPrimary.delete(key);
 		else this.rootsByPrimary.set(key, [...roots]);
-		for (const listener of this.listeners) listener();
+		this.notifySubscribers();
 	}
 	/**
 	* Publish the registry-authority fact. This is the REGISTRY's write port —
@@ -364,7 +454,7 @@ var MultiRootScopeService = class extends Service {
 		const next = available ? "available" : "unavailable";
 		if (this.registryAuthority === next) return;
 		this.registryAuthority = next;
-		for (const listener of this.listeners) listener();
+		this.notifySubscribers();
 	}
 };
 //#endregion