@dsh-electron/dsh-plugin-multi-root-workspace 0.1.12 → 0.1.13

package/lib/registry.js

@@ -1,3 +1,3 @@
-import { a as MultiRootRegistry, c as multiRootDomainSpec, i as MAX_ALIAS_LENGTH, n as DOMAIN_NAME, o as REGISTRY_CONTENDED_MESSAGE, r as MAX_ADDITIONAL_ROOTS_CEILING, s as TABLE_NAME, t as DEFAULT_MAX_ADDITIONAL_ROOTS } from "./registry-YTUOjmVu.js";
-import { o as nativeHostAvailability } from "./protocol-4zdwV7u4.js";
+import { a as MultiRootRegistry, c as multiRootDomainSpec, i as MAX_ALIAS_LENGTH, n as DOMAIN_NAME, o as REGISTRY_CONTENDED_MESSAGE, r as MAX_ADDITIONAL_ROOTS_CEILING, s as TABLE_NAME, t as DEFAULT_MAX_ADDITIONAL_ROOTS } from "./registry-Bv431TfO.js";
+import { o as nativeHostAvailability } from "./protocol-CJOvAvOS.js";
 export { DEFAULT_MAX_ADDITIONAL_ROOTS, DOMAIN_NAME, MAX_ADDITIONAL_ROOTS_CEILING, MAX_ALIAS_LENGTH, MultiRootRegistry, MultiRootRegistry as default, REGISTRY_CONTENDED_MESSAGE, TABLE_NAME, multiRootDomainSpec, nativeHostAvailability };

package/lib/scope.js

@@ -154,6 +154,10 @@ var MultiRootScopeService = class extends Service {
 	/** Additional roots keyed by canonical primary root; empty until roots are registered. */
 	rootsByPrimary = /* @__PURE__ */ new Map();
 	listeners = /* @__PURE__ */ new Set();
+	/** Enclosing {@link MultiRootScopeService.batch} depth; inner calls nest. */
+	batchDepth = 0;
+	/** True when a batched write coalesced its notification into the flush. */
+	batchDirty = false;
 	admissionProof;
 	/**
 	* The registry-authority fact the registry row publishes. Defaults to
@@ -183,6 +187,36 @@ var MultiRootScopeService = class extends Service {
 		};
 	}
 	/**
+	* Run `body` as one notification round: `setAdditionalRoots()` and
+	* `setRegistryAuthority()` apply their state immediately (a same-value
+	* authority write still stays silent), but subscriber invocations coalesce
+	* into a single flush when the OUTERMOST batch ends — also when `body`
+	* throws, because the state already landed. A write a subscriber makes
+	* during the flush is not part of the batch and notifies synchronously
+	* under the normal rules.
+	* @param body - the writes to run as one round.
+	* @returns the body's return value.
+	*/
+	batch(body) {
+		this.batchDepth++;
+		try {
+			return body();
+		} finally {
+			if (--this.batchDepth === 0 && this.batchDirty) {
+				this.batchDirty = false;
+				for (const listener of this.listeners) listener();
+			}
+		}
+	}
+	/** Notify subscribers now, or coalesce into the enclosing batch's flush. */
+	notifySubscribers() {
+		if (this.batchDepth > 0) {
+			this.batchDirty = true;
+			return;
+		}
+		for (const listener of this.listeners) listener();
+	}
+	/**
 	* The sorted names of the tools `toolAccess` caps — read-only for the
 	* prompt contribution. An invalid config is not enumerated (it caps every
 	* call but is not a listable tool set).
@@ -403,7 +437,7 @@ var MultiRootScopeService = class extends Service {
 		const key = canonicalPath(primaryRoot);
 		if (roots.length === 0) this.rootsByPrimary.delete(key);
 		else this.rootsByPrimary.set(key, [...roots]);
-		for (const listener of this.listeners) listener();
+		this.notifySubscribers();
 	}
 	/**
 	* Publish the registry-authority fact. This is the REGISTRY's write port —
@@ -420,7 +454,7 @@ var MultiRootScopeService = class extends Service {
 		const next = available ? "available" : "unavailable";
 		if (this.registryAuthority === next) return;
 		this.registryAuthority = next;
-		for (const listener of this.listeners) listener();
+		this.notifySubscribers();
 	}
 };
 //#endregion

package/lib/types/authority/protocol.d.ts

@@ -46,7 +46,7 @@ export declare class AuthorityClient {
     private closed;
     epoch: string | undefined;
     private constructor();
-    static connect(endpoint: string, store: string, limit: number, onChange: (snapshot: Snapshot) => void, disconnected: () => void): Promise<AuthorityClient>;
+    static connect(endpoint: string, store: string, limit: number, onChange: (snapshot: Snapshot) => void, disconnected: () => void, signal?: AbortSignal): Promise<AuthorityClient>;
     request(method: Method, args: readonly unknown[]): Promise<unknown>;
     close(): void;
 }

package/lib/types/authority/recovery.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Bounded background retry for the registry authority: one pending timer and
+ * one in-flight attempt per instance, post-completion backoff, and local
+ * cancellation on dispose. The scheduler owns NO policy — the caller supplies
+ * `run` (one recovery attempt) and `eligible` (whether a degraded state still
+ * wants recovery), so the same object can drive contended, follower
+ * resync, and retryable storage failures.
+ *
+ * @module @dsh-electron/dsh-plugin-multi-root-workspace/authority/recovery
+ */
+/** Injectable clock so fake-timer specs can drive the scheduler exactly. */
+export interface RecoveryTimers {
+    setTimeout: typeof setTimeout;
+    clearTimeout: typeof clearTimeout;
+    random(): number;
+    now(): number;
+}
+/** What the scheduler is doing, for diagnostics surfaces. */
+export type RecoveryPhase = 'idle' | 'waiting' | 'attempting' | 'disabled';
+export declare class RecoveryScheduler {
+    private readonly run;
+    private readonly eligible;
+    private readonly enabled;
+    private readonly timers;
+    private timer;
+    private inFlight;
+    private disposed;
+    private attempts;
+    private retryAt;
+    constructor(options: {
+        run: () => Promise<void>;
+        eligible: () => boolean;
+        enabled: boolean;
+        timers?: RecoveryTimers;
+    });
+    /**
+     * Ask for a recovery attempt. Called after every `ensureAuthority()` and on
+     * every downgrade event. A healthy state (`!eligible()`) resets the backoff;
+     * a pending timer or in-flight attempt is never duplicated or reset.
+     */
+    arm(): void;
+    /**
+     * Progress event (a follower connection was just adopted): the backoff is
+     * earned, so reset it and run the next attempt immediately — still through
+     * the single pending timer.
+     */
+    kick(): void;
+    /** Stop scheduling. An in-flight attempt is left to finish on its own. */
+    dispose(): void;
+    get state(): {
+        phase: RecoveryPhase;
+        attempts: number;
+        nextRetryAt: number | undefined;
+    };
+    private clearTimer;
+    private delay;
+    private tick;
+}

package/lib/types/client/RootSwitcher.d.ts

@@ -32,9 +32,12 @@
  *   the same element's `closest('[data-dockkit-content]')` — the dockkit
  *   tabHost section — with a generated fallback where the hook is absent.
  *
- * The selected root is component state on purpose: every tab render
- * occurrence gets its own, and reopening the pane resets to the primary
- * root. There is no cross-tab or persisted selection.
+ * The selected root lives in the inject product's session-scoped snapshot,
+ * keyed by that dockkit tab id — component state could not survive the
+ * remount every file open causes (the opened tab takes the pane, the Files
+ * body unmounts with the whole occupant subtree). One selection per tab;
+ * session switches mint a fresh inject product, so no selection crosses
+ * sessions, and a registry eviction reconciles it back to primary.
  *
  * @module @dsh-electron/dsh-plugin-multi-root-workspace/client/RootSwitcher
  */

package/lib/types/client/files-tree/adapter.d.ts

@@ -25,19 +25,72 @@
  */
 import type { Context as ClientContext } from '@deepseek-ai/cordis';
 import type { ClientRemote } from '@deepseek-ai/dsh-api-remotes/client';
-import type { BoundActions } from '@deepseek-ai/dsh-client-store';
+import { type BoundActions, type SnapshotSelectorHook } from '@deepseek-ai/dsh-client-store';
+import type { HostObservable } from '@deepseek-ai/dsh-client-ui-slots';
+import type { TabId } from '@deepseek-ai/dsh-client-ui-dockkit';
 import type { SessionId } from '@deepseek-ai/dsh-session/types';
 import { type FilesInjected } from './face.ts';
 import { createFilesStore } from './store.ts';
 import { filesTreeSurfaceSupported } from './primitives.ts';
 import type { FilesTreeProps } from './FilesTree.tsx';
+import type { RootView } from '../../contract.ts';
 import { NS } from './locales.ts';
+/**
+ * One session's per-tab additional-root selections, keyed by the pane's
+ * dockkit tab id. An absent entry means the primary root.
+ */
+export type TreeSelection = Readonly<Record<string, RootView>>;
+/**
+ * The lifetimes a selection runs under, keyed by tab like the store bucket:
+ * while an entry's signal is live the tree keeps its loaded levels, watches,
+ * expansion, and scroll — exactly what upstream's tab-record signal gives the
+ * native tree across a body remount (opening a file deactivates this tab,
+ * unmounting its body without ending the record).
+ */
+export interface FilesTreeTakeover {
+    /**
+     * The live signal for (tabId, root); reuses the live entry so a remounted
+     * body finds its bucket and watches intact. A different root — or an entry
+     * already aborted — ends the previous controller before minting the next.
+     * @param tabId - the pane's dockkit tab id.
+     * @param root - absolute path of the root being browsed.
+     * @param section - the dockkit tabHost section the caller mounted under; a
+     *   live entry keeps an observer on it that ends the takeover whenever the
+     *   section leaves the document — the record's real end — including when the
+     *   body that mounted it has long been unmounted itself.
+     * @returns the signal the forked tree lives under.
+     */
+    readonly signal: (tabId: TabId, root: string, section?: Element) => AbortSignal;
+    /**
+     * Abort and drop one tab's takeover: the reader deselected or switched
+     * roots, or the tab record itself went away.
+     * @param tabId - the pane's dockkit tab id.
+     */
+    readonly end: (tabId: TabId) => void;
+}
 /** The inject face the registration composes onto the occupant's props. */
 export interface FilesTreeInjected {
     /** The verbatim files face (list/watch bookkeeping included). */
     readonly face: FilesInjected;
     /** Open one `dsh-resource://file` address in the host viewer. */
     readonly openFile: (address: string) => void;
+    /**
+     * The reserved inject compartment: the slot renderer binds each source to a
+     * `use<Name>` selector hook, so `treeSelection` reaches the component as
+     * `useTreeSelection`, never as a prop under its own key.
+     */
+    readonly hooks: {
+        readonly treeSelection: HostObservable<TreeSelection>;
+    };
+    /**
+     * Persist one pane's selected root; `'primary'` drops its entry. The
+     * session-scoped snapshot survives the body remount a file open causes.
+     * @param tabId - the pane's dockkit tab id.
+     * @param root - the selected root, or `'primary'` to browse the session root.
+     */
+    readonly selectRoot: (tabId: TabId, root: RootView | 'primary') => void;
+    /** The forked tree's lifetimes; see {@link FilesTreeTakeover}. */
+    readonly takeover: FilesTreeTakeover;
 }
 /** Everything `FilesTree` needs that the slot framework does not synthesize. */
 export interface FilesTreeSurface {
@@ -47,6 +100,12 @@ export interface FilesTreeSurface {
     readonly face: FilesInjected;
     readonly openFile: (address: string) => void;
     readonly t: FilesTreeProps['t'];
+    /** Selector hook over this session's per-tab root selections. */
+    readonly useTreeSelection: SnapshotSelectorHook<TreeSelection>;
+    /** The selection's write side; see {@link FilesTreeInjected.selectRoot}. */
+    readonly selectRoot: FilesTreeInjected['selectRoot'];
+    /** The forked tree's lifetimes; see {@link FilesTreeTakeover}. */
+    readonly takeover: FilesTreeTakeover;
 }
 /**
  * A `ClientRemote` stand-in that resolves the real service per call.
@@ -89,6 +148,9 @@ export declare function createFilesTreeSurface(props: {
     readonly actions: FilesTreeSurface['actions'];
     readonly face: FilesInjected | undefined;
     readonly openFile: ((address: string) => void) | undefined;
+    readonly useTreeSelection: FilesTreeSurface['useTreeSelection'] | undefined;
+    readonly selectRoot: FilesTreeSurface['selectRoot'] | undefined;
+    readonly takeover: FilesTreeSurface['takeover'] | undefined;
 }, t: FilesTreeProps['t']): FilesTreeSurface | undefined;
 export { filesTreeSurfaceSupported, NS as FILES_TREE_NS };
 export { FilesTree } from './FilesTree.tsx';

package/lib/types/registry.d.ts

@@ -70,6 +70,28 @@ export declare const REGISTRY_CONTENDED_MESSAGE = "the root registry is owned by
 export declare const DEFAULT_MAX_ADDITIONAL_ROOTS = 16;
 /** Hard ceiling for `maxAdditionalRoots`: values above it are config-invalid. */
 export declare const MAX_ADDITIONAL_ROOTS_CEILING = 64;
+/**
+ * The recovery class of a `storage-failed` authority: `retryable` failures
+ * (open/listen/acquire) may be re-attempted by `ensureAuthority`, while
+ * `config` (a row the operator must fix) and `quarantine` (an unknown durable
+ * outcome, isolated until restart) make the state terminal.
+ */
+export type StorageFailureRecovery = 'retryable' | 'config' | 'quarantine';
+/** The recovery class a degraded authority belongs to (see {@link StorageFailureRecovery}). */
+export type RecoveryClass = 'retryable' | 'config' | 'quarantine';
+/** Operator-facing read-only picture of the registry authority and its recovery. */
+export interface RegistryDiagnostics {
+    readonly authorityState: RegistryAuthorityState;
+    readonly epoch: string | undefined;
+    readonly connectionFailure: string | undefined;
+    readonly recoveryClass: RecoveryClass | undefined;
+    readonly recovery: {
+        readonly phase: 'idle' | 'waiting' | 'attempting' | 'disabled' | 'requires-restart';
+        readonly attempts: number;
+        readonly nextRetryAt: number | undefined;
+        readonly pendingSync: number;
+    };
+}
 /**
  * Whether this process is the Registry Authority for the store-wide domain
  * medium. Contended and storage-failed are both fail-closed: the scope stays
@@ -85,6 +107,7 @@ export type RegistryAuthorityState = {
 } | {
     readonly kind: 'storage-failed';
     readonly reason: string;
+    readonly recovery: StorageFailureRecovery;
 } | {
     readonly kind: 'config-invalid';
     readonly reason: string;
@@ -110,6 +133,12 @@ export interface Config {
      * exactly what classification grants — only new adds are refused.
      */
     readonly maxAdditionalRoots?: number;
+    /**
+     * Whether the registry retries a degraded authority in the background
+     * (bounded backoff, `unref`ed). Defaults to `true`; `false` leaves
+     * recovery to on-demand calls (refresh, the panel Retry button).
+     */
+    readonly backgroundRecovery?: boolean;
 }
 declare module '@deepseek-ai/cordis' {
     interface Context {
@@ -206,8 +235,18 @@ export declare class MultiRootRegistry extends Service {
     private client;
     private connectionFailure;
     private connectionGeneration;
+    /** Local cancel of the in-flight handshake; teardown must not wait out hello. */
+    private connectionAbort;
     private remoteProjectionReady;
     private readonly remoteRevisions;
+    /**
+     * Primary roots whose projection must still be synced after a follower
+     * reconnect — populated from the tracked cache keys at adoption, removed as
+     * each `applySnapshot` lands. Recovery completes only when it empties.
+     */
+    private pendingSync;
+    /** Bounded background retry for degraded authority states (ADR-0026 R1). */
+    private readonly recovery;
     private readonly operationProof;
     /** Whether this process currently owns the store. */
     private authorityState;
@@ -215,6 +254,8 @@ export declare class MultiRootRegistry extends Service {
     private lease;
     /** Open domain handle; present only while {@link authority} is `active`. */
     private domain;
+    /** The last failed `openDomain` reason; a repeat failure is not re-logged. */
+    private lastOpenFailure;
     /** The open table; present once this process is the authority. */
     private table;
     /** Last classified status list per canonical primary root. */
@@ -271,6 +312,23 @@ export declare class MultiRootRegistry extends Service {
     get shared(): boolean;
     get available(): boolean;
     get authority(): RegistryAuthorityState;
+    /** The class a degraded authority belongs to; `undefined` when healthy. */
+    private get recoveryClass();
+    /**
+     * Read-only diagnostics for operators: the authority state, the epoch, the
+     * last connection failure, and what the recovery scheduler is doing.
+     * `requires-restart` marks classes no timer will ever fix — a `config`
+     * row or a `quarantine`d store must NOT read as "retrying". Purely a read;
+     * it never arms or runs anything.
+     */
+    get diagnostics(): RegistryDiagnostics;
+    /** The last logged `(kind, recoveryClass)` pair; dedupes transition logs. */
+    private loggedRecovery;
+    /**
+     * Log one line per authority/recovery-class TRANSITION — never per tick:
+     * waiting↔attempting moves say nothing an operator did not already know.
+     */
+    private noteRecoveryTransition;
     /**
      * The configured cap on stored additional-root records per primary root.
      * Surfaces show it next to the count so "N of LIMIT" is always explainable.
@@ -423,6 +481,12 @@ export declare class MultiRootRegistry extends Service {
     grantedFor(policy: SandboxExecutionPolicy): readonly string[];
     /** Classify one stored record set and cache it. */
     private accept;
+    /**
+     * The pure half of {@link accept}: classification plus the over-limit
+     * warning, without writing the cache or the scope. {@link openDomain}
+     * staging uses it so a half-opened domain cannot materialize rows.
+     */
+    private classify;
     /**
      * The statuses of one key, from memory where possible: the cache, else what
      * storage holds, else empty. A cached answer is never re-checked here — that
@@ -482,8 +546,42 @@ export declare class MultiRootRegistry extends Service {
     private snapshotOf;
     private captureSnapshot;
     private notifyShared;
+    /** Depth of {@link commit}; nested calls share the outer round's buffers. */
+    private commitDepth;
+    /** Keys whose publish inside a commit produced deferred notifications, first-seen order. */
+    private readonly commitNotifications;
+    /**
+     * Run `body` as one Registry commit: scope writes inside it go through
+     * `multiRootScope.batch`, and the `notifyShared` broadcasts plus Registry
+     * listener calls `publish()` produces are collected per key instead of
+     * delivered. When the OUTERMOST commit ends — also when `body` throws — the
+     * scope batch flushes first, then the broadcasts go out in first-seen key
+     * order, then the listeners: no synchronous callback can observe a
+     * half-committed state.
+     */
+    private commit;
+    /** Deliver one key's notifications now, or collect them inside a commit. */
+    private deliverNotifications;
     private applySnapshot;
     private remoteUnavailable;
+    /**
+     * Resynchronize each still-pending tracked primary outside the authority
+     * queue: per-key snapshots through the live client. A failed key stays in
+     * `pendingSync` for the next tick; a lost connection abandons the round —
+     * `remoteUnavailable` already emptied the set.
+     */
+    private syncProjection;
+    /**
+     * Write one key's withheld-only projection into the scope, keeping
+     * `published` truthful: the signature records what the scope HOLDS, never
+     * what `publish()` last computed — a withheld signature can never equal a
+     * publish signature, so an empty snapshot afterwards really writes the
+     * retraction. A repeated write of the same withheld projection is a no-op
+     * (the same-signature skip is also the republish gate of a repeated
+     * downgrade). `metadataPublished` is untouched: a withheld write announces
+     * nothing to the Registry view.
+     */
+    private withholdScope;
     private remoteSnapshot;
     private remote;
     private dispatchShared;

package/lib/types/scope.d.ts

@@ -208,6 +208,10 @@ export declare class MultiRootScopeService extends Service {
     /** Additional roots keyed by canonical primary root; empty until roots are registered. */
     private readonly rootsByPrimary;
     private readonly listeners;
+    /** Enclosing {@link MultiRootScopeService.batch} depth; inner calls nest. */
+    private batchDepth;
+    /** True when a batched write coalesced its notification into the flush. */
+    private batchDirty;
     private admissionProof;
     /**
      * The registry-authority fact the registry row publishes. Defaults to
@@ -231,6 +235,20 @@ export declare class MultiRootScopeService extends Service {
     private readonly dshHome;
     /** Observe registry publications; consumers still resolve authority from scopeOf(). */
     subscribe(listener: () => void): () => void;
+    /**
+     * Run `body` as one notification round: `setAdditionalRoots()` and
+     * `setRegistryAuthority()` apply their state immediately (a same-value
+     * authority write still stays silent), but subscriber invocations coalesce
+     * into a single flush when the OUTERMOST batch ends — also when `body`
+     * throws, because the state already landed. A write a subscriber makes
+     * during the flush is not part of the batch and notifies synchronously
+     * under the normal rules.
+     * @param body - the writes to run as one round.
+     * @returns the body's return value.
+     */
+    batch<T>(body: () => T): T;
+    /** Notify subscribers now, or coalesce into the enclosing batch's flush. */
+    private notifySubscribers;
     /**
      * The sorted names of the tools `toolAccess` caps — read-only for the
      * prompt contribution. An invalid config is not enumerated (it caps every

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dsh-electron/dsh-plugin-multi-root-workspace",
   "description": "Multi-root Workspace for DeepSeek Harness: adds N additional roots to the workspace sandbox scope as an out-of-tree bundle",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",