@dsh-electron/dsh-plugin-multi-root-workspace 0.1.13 → 0.1.15

package/CHANGELOG.en.md

@@ -8,6 +8,39 @@ This file records the user-visible changes of every **released** version.
 - For installation sources, the supported upstream runtimes, and known limitations, see the [README](./README.en.md).
 - The evidence, numbering, and release state of each version live in the [roadmap progress ledger](./docs/plans/active/2026-09-12-multi-root-workspace.md#进度总账). The body of each GitHub Release is generated from the commit history by `scripts/release-notes.mjs` and is the complete raw list behind this file.
 
+## [0.1.15] - 2026-11-06
+
+### Changed
+
+- **Upgrade note for custom compositions: the Registry now requires shared mode**. `multi-root-registry` must configure `sharedStorageRoot`; without it, startup fails with `config-invalid` and neither single-process storage nor additional-root grants are opened. The default bundle has configured shared mode since `v0.1.12` and needs no change. Registry keys now follow the upstream Session's original primary-directory spelling, with migration from legacy canonical keys. Clearing a migrated root table persists an empty record so refreshes and restarts cannot revive old registrations ([ADR-0028](./docs/decisions/ADR-0028-upstream-primary-identity-and-shared-only-registry.md), Chinese).
+
+### Added
+
+- **The `/add-dirs` alias**: `/add-dirs [absolute path] [--inherit|--read-only|--read-write]` reuses `/workspace-folders add` path parsing, directory picker, access options, and validation. It does not replace dsh-TUI's built-in `/add-dir`.
+- **OPS compatibility mode (experimental, off by default)**: explicitly enable `multi-root-ops-compatibility.enabled` in the plugin settings card on DSH `0.2.*` releases within the existing exact support matrix. On `0.1.*` the setting is unavailable and a manually configured `true` stays inactive. Each UI activation requires acknowledging and confirming the host's risk dialog; disabling saves directly. OPS and Auto Review have independent switches.
+- **Conservative execution protection and context while OPS mode is enabled**: on macOS/Linux, Full-access Workers receive kernel confinement when read-only roots or tool caps create deny boundaries. Windows calls with deny boundaries, WW/RO calls with non-writable roots or caps, and calls in any mode without Registry authority are conservatively refused before preparation; reads may also be refused. Proven live successful file targets can trigger additional-directory instruction discovery. Auto Review still requires exactly DSH `0.2.1-rc.2` and fails technically when historical evidence is missing, pending targets are dynamic, or the snapshot changes. **This is not full OPS compatibility**: false refusals, blocked background cleanup, retained caches, and the lack of durable activity remain; full compatibility recovery is deferred indefinitely. With the mode disabled, OPS may still write to explicitly read-only additional roots ([capabilities and limitations](./README.en.md#dsh-ops-adaptation-status-capability-notes), [ADR-0029](./docs/decisions/ADR-0029-ops-file-authorization-and-activity-adapter.md), Chinese).
+
+### Fixed
+
+- **Re-registering a root no longer transfers its grant to a replacement target (BYP-02)**: revival requires the original grant target. Changed targets must be removed and explicitly added again. The panel offers re-registration only for missing records, not redirected or invalid ones.
+- **Additional-root registration refuses protected directories**: new and revived roots cannot equal, contain, or sit inside `$DSH_HOME`, the physical Registry store, or its lease directory. Existing overlapping records are withheld while retaining deny boundaries. Shared followers apply their own protected set to every filesystem/process admission too; Windows network/device paths are refused before local resolution or forwarding ([ADR-0027](./docs/decisions/ADR-0027-revive-target-and-protected-paths.md), Chinese).
+- **Replacing the primary directory no longer drops existing deny boundaries (MRW-01)**: Registry/scope identity uses the upstream primary spelling, canonical paths serve geometry only, and deny boundaries take precedence over primary-root overlap. Write authority for the primary root itself still follows upstream semantics. Trusted human confirmation for root management (BYP-01) remains a known residual risk outside this release's fixes ([scope and maintainer decisions](./docs/plans/completed/2026-11-05-root-authorization-security-fixes.md), Chinese).
+
+## [0.1.14] - 2026-11-05
+
+### Added
+
+- **Exact support for DSH `0.2.2-alpha.3` and `0.2.2-rc.1`**: the support matrix now covers 22 exact releases and the dev pin moves to `0.2.2-rc.1` (cordis `4.1.0` / Schemastery `3.19.0`). From `alpha.3` upstream routes `patchText` / `deleteFile` / `moveFile` through the same filesystem fence and Registry admission (a move's source and target share one admission snapshot), binds the Connection RPC getter to the consuming fiber that owns the routes (fixing the panel channel's HTTP 405 under the new Cordis), and switches the Files tab to the host-provided file-tree Factory; `rc.1` differs from `alpha.3` only in version numbers and vendor stabilization — no new interface shapes, so no new adapter branch. The upgrade script's stable-vendor selector now picks only the newest stable patch inside the host's declared minor line, keeping an old Cordis out of the new loader. The optional Auto Review entry stays pinned to its `0.2.1-rc.2` baseline ([interface review](./docs/reference/dsh-0.2.2-migration.md)).
+- **An experimental "Multi-root Auto Review" switch on the plugin detail page's settings card (off by default)**: equivalent to the same-named Loader row in Plugin Manager — it persists through `remote.pluginManager.setPluginEnabled`, applies hot, and shows a restart Toast when `restart-required`; the row is not rendered when the host has no pluginManager Remote or the composition does not list the optional row, and it shares the single `plugins.bundle.config` settings cell with additional-root Skills.
+- **Rich plugin-manager detail page**: localized `meta.detail` (`locale/en|zh.json` exposed through the `./locale/*.json` export) plus a self-contained 640×300 preview image (`detail/`), following the upstream plugin-detail convention.
+
+### Fixed
+
+- **The `profile-core-mixed` / `profile-core-copy` launcher warnings ([issue #30](https://github.com/cherrchen/dsh-plugin-multi-root-workspace/issues/30))**: `schemastery` and `node-addon-system` moved into `peerDependencies` — the two shared upstream singletons are now supplied once by the host's `dsh-sandbox-local`; as `dependencies` they let the package manager install a second copy inside the profile (`^3.18.2` does not match the host prerelease, producing `3.18.5` plus `cosmokit@1.8.6`). `compat:check` and the tests now hard-reject any `@deepseek-ai/*` name in `dependencies` / `optionalDependencies`; profiles that already installed an older version need a remove + add to rebuild `node_modules` ([troubleshooting](./docs/troubleshooting/profile-core-mixed.md)).
+- **Silent SIGBUS exits of installed copies on darwin-arm64**: `koffi` is now always resolved to the host's copy through `loadHostKoffi()` (`src/compat/koffi.ts`, anchored on the required peer `dsh-fs-local`) — a profile install lays down a private koffi that, next to the `koffi.node` image the host already loaded, forms a second native image in one process and dies under pointer validation; only when no host copy resolves does it fall back to the bundled one.
+- **Settings-card concurrent-refresh race**: when a `plugin-manager/changed` refresh and the post-`setEnabled()` refresh overlap, the older response could land last and overwrite the new snapshot, leaving the switch on its pre-write value; a `refreshSeq` generation counter now drops every non-latest `listPlugins()` response.
+- **Settings-card error feedback moved to Toast banners**: the inline `role=alert` copy on the Auto Review and Skills rows is replaced by top Toast notices that dismiss themselves when their state source disappears.
+
 ## [0.1.13] - 2026-10-31
 
 ### Added
@@ -214,7 +247,9 @@ The first release: the three MVP milestones (M1–M3).
 
 - All eight findings of the pre-release external review (three of them release-blocking) are fixed, each with a regression test: a registered directory replaced by a symlink transplanting its authority (which introduced `recordedPath` — **re-resolving a path is not re-authorizing it**), concurrent registry mutations losing a write or reviving a revoked grant (per-primary-root mutations are serialized), a refresh not re-checking directories, a typed path being overwritten by the directory picker, the `reveal` response contract and failure code, duplicate ids not validated, the primary root missing from nesting validation, and CI testing before building.
 
-[Unreleased]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.13...HEAD
+[Unreleased]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.15...HEAD
+[0.1.15]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.14...v0.1.15
+[0.1.14]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.13...v0.1.14
 [0.1.13]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.12...v0.1.13
 [0.1.12]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.11...v0.1.12
 [0.1.11]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.10...v0.1.11

package/CHANGELOG.md

@@ -8,6 +8,39 @@ English: [CHANGELOG.en.md](./CHANGELOG.en.md)
 - 安装方式、受支持的上游运行时与已知限制见 [README](./README.md)。
 - 每个版本的实施证据、编号口径与发布状态见[路线图 §进度总账](./docs/plans/active/2026-09-12-multi-root-workspace.md#进度总账)；GitHub Release 的正文由 `scripts/release-notes.mjs` 从 commit 历史生成，是本文件之外的完整原始清单。
 
+## [0.1.15] - 2026-11-06
+
+### Changed
+
+- **自定义组合升级注意：Registry 只保留共享模式**。`multi-root-registry` 必须配置 `sharedStorageRoot`；缺失时以 `config-invalid` 拒绝启动，不再打开单进程存储或授予附加根。默认 bundle 自 `v0.1.12` 起已配置共享模式，无需另行修改。主根登记表改为按上游 Session 原始目录拼写查找，升级时迁移旧 canonical key；清空后的空表会持久保留，防止刷新或重启复活旧登记（[ADR-0028](./docs/decisions/ADR-0028-upstream-primary-identity-and-shared-only-registry.md)）。
+
+### Added
+
+- **`/add-dirs` 命令别名**：`/add-dirs [absolute path] [--inherit|--read-only|--read-write]` 复用 `/workspace-folders add` 的路径解析、目录选择器、访问选项和校验，不接管 dsh-TUI 的内置 `/add-dir`。
+- **OPS 兼容模式（实验性，默认关闭）**：在插件设置卡中显式开启 `multi-root-ops-compatibility.enabled`，仅适用于现有精确支持矩阵内的 DSH `0.2.*`；`0.1.*` 不提供该设置入口，手工写入 `true` 也不启用。从 UI 开启须先在宿主风险弹窗中勾选并确认，每次重新开启都需确认；关闭直接保存，OPS 与 Auto Review 开关独立。
+- **启用 OPS 模式后的保守执行保护与上下文**：macOS/Linux 的 Full-access 有只读或 tool-cap 拒写边界时，以内核围栏保护 Worker；Windows 有拒写边界、WW/RO 有不可写根或 cap，以及所有模式 Registry 失权时，执行调用在准备前保守拒绝，读取也可能被拒。可证明的实时成功文件目标可触发附属目录指令发现；Auto Review 仍仅支持精确 DSH `0.2.1-rc.2`，缺少历史证据、动态待审目标或快照变化时技术失败。**不声明完整 OPS 兼容**：合法操作误拒、后台清理与缓存残留、无持久活动等限制保留，完整兼容恢复无限期延后；关闭模式后 OPS 仍可能写入显式只读附加根（[能力与限制](./README.md#dsh-ops-适配现状受限能力说明)、[ADR-0029](./docs/decisions/ADR-0029-ops-file-authorization-and-activity-adapter.md)）。
+
+### Fixed
+
+- **重新登记不再把旧授权转移到新目标（BYP-02）**：只有目录恢复到原 grant 目标时才能 revive；目标已改变的记录必须先移除再显式新增。面板只为 missing 记录提供重新登记，不为 redirected/invalid 记录提供该动作。
+- **附加根登记拒绝覆盖受保护目录**：新增与 revive 不得等于、包含或位于 `$DSH_HOME`、Registry 物理介质或 lease 目录；重叠存量记录 withheld 并保留拒写边界。共享 follower 在每次 fs/进程准入时同样按自己的保护集合收窄；Windows 网络/设备路径在本地解析和转发前拒绝（[ADR-0027](./docs/decisions/ADR-0027-revive-target-and-protected-paths.md)）。
+- **主根目录置换不再丢失已有拒写边界（MRW-01）**：Registry/scope 使用上游主根拼写作为身份，canonical 路径只用于几何判断，拒写边界优先于主根重叠。主根本身的写授权继续遵循上游语义；根管理的可信人工确认（BYP-01）仍是已知残余风险，不在本版修复范围（[范围与维护者决定](./docs/plans/completed/2026-11-05-root-authorization-security-fixes.md)）。
+
+## [0.1.14] - 2026-11-05
+
+### Added
+
+- **精确支持 DSH `0.2.2-alpha.3` 与 `0.2.2-rc.1`**：支持矩阵扩至 22 个精确版本，开发 pin 提升到 `0.2.2-rc.1`（cordis `4.1.0` / Schemastery `3.19.0`）。`alpha.3` 起上游把 `patchText` / `deleteFile` / `moveFile` 纳入同一文件系统围栏与 Registry admission（移动的源与目标共用同一准入快照）、Connection RPC getter 绑定拥有路由的消费 fiber（修复新版 Cordis 下面板通道 HTTP 405）、Files 页签改用宿主提供的文件树 Factory；`rc.1` 相对 `alpha.3` 仅有版本号与 vendor 稳定化，没有新接口形状，未新增适配分支。升级脚本的稳定 vendor 选择器改为只取宿主声明 minor 线内的最新稳定 patch，避免旧版 Cordis 混入新 loader。可选 Auto Review 仍钉 `0.2.1-rc.2` 基线（[接口审查](./docs/reference/dsh-0.2.2-migration.md)）。
+- **插件详情页「多根 Auto Review」设置开关（实验性，默认关闭）**：与插件管理页同名 Loader 行等价，经 `remote.pluginManager.setPluginEnabled` 持久化并热应用，`restart-required` 时以 Toast 提示重启；宿主无 pluginManager Remote 或组合未列该可选行时该行不渲染，与附属根 Skills 共用单一 `plugins.bundle.config` 设置单元格。
+- **插件管理页富文本详情**：本地化 `meta.detail`（`locale/en|zh.json` 经 `./locale/*.json` 导出）与 640×300 自包含预览图（`detail/`），遵循上游插件详情页惯例。
+
+### Fixed
+
+- **`profile-core-mixed` / `profile-core-copy` 启动器告警（[issue #30](https://github.com/cherrchen/dsh-plugin-multi-root-workspace/issues/30)）**：`schemastery` 与 `node-addon-system` 移入 `peerDependencies`——两个共享上游单例改由宿主 `dsh-sandbox-local` 供给唯一副本；此前它们作为 `dependencies` 会让包管理器在 profile 里装出第二份（`^3.18.2` 不匹配宿主 prerelease，装出 `3.18.5` 连带 `cosmokit@1.8.6`）。`compat:check` 与测试现在硬性拒绝 `dependencies` / `optionalDependencies` 里的任何 `@deepseek-ai/*`；已装旧版的 profile 需 remove + add 重建 `node_modules`（[排查](./docs/troubleshooting/profile-core-mixed.md)）。
+- **darwin-arm64 上安装副本无声 SIGBUS 退出**：`koffi` 一律经 `loadHostKoffi()`（`src/compat/koffi.ts`，以必需 peer `dsh-fs-local` 为锚）解析宿主副本——profile 安装会再装一份私有 koffi，与宿主已加载的 `koffi.node` 构成同进程第二个原生镜像，在指针校验下直接 SIGBUS；解析不到宿主副本时才回退包内自带。
+- **设置卡并发刷新竞态**：`plugin-manager/changed` 刷新与 `setEnabled()` 后的刷新并发时，旧响应后到会覆盖新快照、开关停留在写入前的值；新增 `refreshSeq` 代际计数，非最新请求的结果直接丢弃。
+- **设置卡错误反馈改 Toast 横幅**：Auto Review 与 Skills 设置行的内联 `role=alert` 文案改为顶部 Toast 提示，状态源消失时自动撤下。
+
 ## [0.1.13] - 2026-10-31
 
 ### Added
@@ -214,7 +247,9 @@ English: [CHANGELOG.en.md](./CHANGELOG.en.md)
 
 - 发布前外部评审提出的 8 项发现（其中 3 项发布阻断）全部修复，每项各带一个回归测试：登记目录被替换为符号链接后授权转移（引入 `recordedPath`，**重新解析路径不等于重新授权**）、并发修改注册表丢写或复活已撤销的授权（每个主根的变更串行）、刷新不重新检查目录、手输路径被目录选择器覆盖、`reveal` 的应答契约与失败码、重复 id 未校验、主根未纳入嵌套校验、CI 先测后构建。
 
-[Unreleased]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.13...HEAD
+[Unreleased]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.15...HEAD
+[0.1.15]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.14...v0.1.15
+[0.1.14]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.13...v0.1.14
 [0.1.13]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.12...v0.1.13
 [0.1.12]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.11...v0.1.12
 [0.1.11]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.10...v0.1.11

package/README.en.md

@@ -15,13 +15,13 @@ By default, [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)
 Not every project is a monorepo. A real development project is usually several independent Git repositories, and working across them meant juggling sessions. Peer harnesses already support adding multiple folders to a single workspace. This plugin brings the same capability to DSH — register the other repositories as additional roots, grant each read-only, read-write, or unrestricted access, and the agent can work in them within that grant.
 
 - **No new tools**: the agent keeps using the native `read` / `write` / `edit` / `bash`; only the granted directories grow.
-- **Sandbox confinement**: an additional root may inherit the session's (primary root's) permission setting, or be pinned to read-only or read-write; under read-only and read-write, confinement does not rest on system prompts — it is enforced by an in-process filesystem fence plus kernel-level sandboxes (macOS Seatbelt / Linux bwrap / Landlock / Windows ACL), with files and bash sharing one and the same scope.
+- **Sandbox confinement**: an additional root may inherit the session's (primary root's) permission setting, or be pinned to read-only or read-write; under read-only and read-write, confinement does not rest on system prompts — it is enforced by an in-process filesystem fence plus kernel-level sandboxes (macOS Seatbelt / Linux bwrap / Landlock / Windows ACL), with native filesystem and bash calls passing through these fences sharing the same scope. Third-party tools that launch their own Workers need separate validation; see the current dsh-ops limitations below.
 - **Browse additional roots in the Files tab**: the Files tab header switches between the primary root and any registered additional root; an additional root's directory renders in the same native Files view, with open-file, open-in-app, and auto-refresh behaving identically.
 - **Optional Auto review (off by default)**: a fork of upstream's experimental auto-review that gives the reviewer the additional directories' context — the current workspace topology, each root's access level, and live instruction files; it ships disabled and only takes effect once the `@dsh-electron/dsh-plugin-multi-root-workspace/auto-review` row is explicitly enabled in the Plugin Manager row list, taking over the official bundle while on.
 - **Additional-root Skills**: discovers `.dsh/skills` and `.agents/skills` inside additional folders, invoked through the namespaced `/alias-id:skill-name` reference and the native `skill` tool; each root has an independent toggle and editable `aliasId`, with a global setting that defaults to on.
 - **Absent when absent**: with no additional root configured, its behavior is item-for-item identical to an uninstalled harness; every misconfiguration fails loudly instead of silently degrading.
 
-Current released version: `v0.1.13`. The user-visible changes of each version live in the [CHANGELOG](./CHANGELOG.en.md); progress and release state live in the [roadmap progress ledger](./docs/plans/active/2026-09-12-multi-root-workspace.md#进度总账).
+Current released version: `v0.1.15`. The user-visible changes of each version live in the [CHANGELOG](./CHANGELOG.en.md); progress and release state live in the [roadmap progress ledger](./docs/plans/active/2026-09-12-multi-root-workspace.md#进度总账).
 
 ## Quick Start
 
@@ -51,11 +51,11 @@ The agent can now read, write, and run bash in that directory — the default is
 | `0.1.7` | `0.1.7-alpha.1`, `0.1.7-alpha.2`, `0.1.7-rc.1`, `0.1.7-rc.2` |
 | `0.2.0` | `0.2.0-rc.1`, `0.2.0-rc.2` |
 | `0.2.1` | `0.2.1-alpha.1`, `0.2.1-alpha.2`, `0.2.1-alpha.3`, `0.2.1-alpha.4`, `0.2.1-alpha.5`, `0.2.1-rc.1`, `0.2.1-rc.2`, `0.2.1-rc.3`, `0.2.1-rc.4`, `0.2.1-rc.5` |
-| `0.2.2` | `0.2.2-alpha.2` |
+| `0.2.2` | `0.2.2-alpha.2`, `0.2.2-alpha.3`, `0.2.2-rc.1` |
 
 The plugin does not start — as if it were not installed — when the DSH release is not in the table or the `@deepseek-ai/dsh-*` packages disagree on a version.
 
-**Building from source / contributing**: Node.js `^22.19.0 || >=24`, pnpm `11.25.0` (enable via corepack); the dev-pinned DSH is `0.2.2-alpha.2` (Node ≥24.9).
+**Building from source / contributing**: Node.js `^22.19.0 || >=24`, pnpm `11.25.0` (enable via corepack); the dev-pinned DSH is `0.2.2-rc.1` (Node ≥24.9).
 
 **Platforms**: macOS (Seatbelt), Linux (bwrap / Landlock), Windows (root-set ACL runner).
 
@@ -94,8 +94,8 @@ This installs pre-built artifacts; the first install needs the `allowBuilds` add
 ```sh
 pnpm pack @dsh-electron/dsh-plugin-multi-root-workspace
 # or download the tgz from the GitHub Release assets, e.g.:
-# https://github.com/cherrchen/dsh-plugin-multi-root-workspace/releases/download/v0.1.13/dsh-electron-dsh-plugin-multi-root-workspace-0.1.13.tgz
-dsh plugin --profile web add ./dsh-electron-dsh-plugin-multi-root-workspace-0.1.13.tgz
+# https://github.com/cherrchen/dsh-plugin-multi-root-workspace/releases/download/v0.1.15/dsh-electron-dsh-plugin-multi-root-workspace-0.1.15.tgz
+dsh plugin --profile web add ./dsh-electron-dsh-plugin-multi-root-workspace-0.1.15.tgz
 ```
 
 Also pre-built, handy for air-gapped or offline delivery; the first install needs the same `allowBuilds` addition.
@@ -114,10 +114,10 @@ allowBuilds:
   koffi: true
 ```
 
-Pinning a version (e.g. `#v0.1.13`) is recommended so a later push cannot silently change what actually runs:
+Pinning a version (e.g. `#v0.1.15`) is recommended so a later push cannot silently change what actually runs:
 
 ```sh
-dsh plugin --profile web add github:cherrchen/dsh-plugin-multi-root-workspace#v0.1.13
+dsh plugin --profile web add github:cherrchen/dsh-plugin-multi-root-workspace#v0.1.15
 ```
 
 ### Install from a local clone
@@ -208,6 +208,7 @@ The upstream `fs-sandbox` and `sandbox` rows are disabled and taken over by the
 ```text
 /workspace-folders [list]                                                    # list the primary root and the additional roots (access and state included)
 /workspace-folders add <absolute path> [--inherit|--read-only|--read-write]  # no path opens the OS directory picker; new registrations default to inherit
+/add-dirs [absolute path] [--inherit|--read-only|--read-write]               # shortcut for /workspace-folders add
 /workspace-folders access <n|path> inherit|read-only|read-write              # switch access (widening requires the root to be available right now)
 /workspace-folders skills <n|path> on|off                                    # toggle additional-root Skills independently of write access
 /workspace-folders alias-id <n|path> <kebab-case>                             # edit the stable Skill namespace
@@ -254,7 +255,7 @@ The additional-root topology is injected into the system prompt so the model kno
 
 ## Optional Auto Review integration
 
-For multi-root reviewer context, enable the default-disabled [Auto Review row](./src/auto-review/README.en.md) in the main package’s Plugin Manager row list. The joint integration targets only DSH `0.2.1-rc.2`; ordinary installation keeps the existing support matrix and does not enable or select Auto.
+For multi-root reviewer context, enable the default-disabled [Auto Review row](./src/auto-review/README.en.md) in the main package’s Plugin Manager row list; the experimental "Multi-root Auto Review" switch in the same detail page's settings card is equivalent to that row switch and is off by default as well. The joint integration targets only DSH `0.2.1-rc.2`; ordinary installation keeps the existing support matrix and does not enable or select Auto.
 
 ## Project Structure
 
@@ -296,7 +297,11 @@ Issues and PRs are welcome:
 
 ## Known Limitations
 
-- An additional root's instruction files arrive as they become relevant: the one at the root's top level is injected before the session's first step, and a subdirectory's is injected once the session has **successfully** worked in that directory. A nested file is re-examined only when its directory is examined (the root's own every step; a subdirectory's because it was delivered from, or because of a fresh touch), delivery state is in-process (so a resumed session may be told again), and only the `read` / `write` / `edit` tool names count. The primary root's chain and the user-global file remain upstream's job, and this plugin does not inject them a second time ([ADR-0010](./docs/decisions/ADR-0010-additional-root-instruction-scope.md)).
+- **dsh-ops bypassed an explicit read-only root restriction (F01, historical baseline)**: in the audited versions under Full access, the Native `ops_write_file` tool actually changed a file in an additional root pinned read-only, while the native filesystem control was denied. With OPS compatibility mode enabled, this round's limited adaptation makes the explicit RO/cap deny boundary effective for OPS Native and real PTC under Full access (deny-execution re-verification in [audit §16](./docs/reviews/dsh-ops-compatibility-audit.md#16-适配后复验)); see the [compatibility audit](./docs/reviews/dsh-ops-compatibility-audit.md) (Chinese) for versions, scope, and original evidence.
+- **Legal additional-root writes and nested instructions had gaps with dsh-ops (F04/F05, historical baseline)**: OPS preflight still rejects inherited or pinned read-write additional roots under workspace-write and pinned read-write roots under read-only (F04 unresolved). The nested-instruction gap (F05) is re-verified as recovered with the mode enabled this round: with the live index, real AgentLoop evidence shows successful Native and PTC touches delivering the subdirectory chain into the next model request (see [audit §16](./docs/reviews/dsh-ops-compatibility-audit.md#16-适配后复验)). The tested root-level instructions and Skills paths still work.
+- **Linux bwrap workspace-write batch/result is degraded (F07)**: with the audited shared Registry composition, every `ops_batch` / `ops_result` call (including `page`) that reaches the launch branch with a valid cache loses its argv ownership proof when OPS adds a bind after confinement. The source path rejects the Worker launch with `EXECUTOR_UNAVAILABLE`. The function-level conflict is reproduced; Linux end-to-end execution is untested. Ordinary read-only, Landlock, and no-cache controls are outside this conclusion. An OPS interface to declare cache requirements before confinement is needed; no MR-only workaround has been validated. See [F07](./docs/reviews/dsh-ops-compatibility-audit.md#131-n1--f07confine-后的-cache-bind-与严格证明冲突).
+- **Other OPS availability limits**: under shared workspace-write, purge outside dispatch is rejected without a live admission, so result caches may remain with a warning. Nested PTC calls and background Bash also risk rejection from mismatched or expired proofs. The conservative refusal boundaries have been validated on all three platforms. Normal background execution and cleanup remain unavailable and are deferred indefinitely; see the [final scope in ADR-0029](./docs/decisions/ADR-0029-ops-file-authorization-and-activity-adapter.md#最终范围与无限期延后2026-11-05) (Chinese).
+- An additional root's instruction files arrive as they become relevant: the one at the root's top level is injected before the session's first step, and a subdirectory's is injected once the session has **successfully** worked in that directory. A nested file is re-examined only when its directory is examined (the root's own every step; a subdirectory's because it was delivered from, or because of a fresh touch), delivery state is in-process (so a resumed session may be told again); officially the `read` / `write` / `edit` tool names count, and OPS tools also drive delivery through live evidence when OPS compatibility mode is enabled (OPS history without live evidence does not count after a resume). The primary root's chain and the user-global file remain upstream's job, and this plugin does not inject them a second time ([ADR-0010](./docs/decisions/ADR-0010-additional-root-instruction-scope.md)).
 - Hosts share one Registry service: one Host owns storage and each instance obtains admission for new operations. Disconnection stops new additional-root grants; a successor takes over through the kernel lease. Sharing is local to one user and lock namespace; Linux requires SO_PEERPIDFD, and Windows is limited to one login session. Existing processes and PTYs retain their launch snapshot ([architecture](./docs/architecture/registry-authority-service.md), Chinese).
 - The supported matrix is an exact-version allowlist: on a host whose release is not on the list, or whose core packages disagree about the release, the `fs` / `sandbox` / `registry` / `instructions` / `lsp` / `workspace-files` rows **do not start** and the composition degrades to "the plugin is not installed" ([ADR-0009](./docs/decisions/ADR-0009-dsh-compat-contract.md)).
 - The Windows multi-root runner inherits upstream partial enforcement, caller-owned directory requirements, and private-temp isolation. Running processes retain their initial roots; later processes use the updated set ([ADR-0011](./docs/decisions/ADR-0011-multi-root-workspace-consumers.md)).
@@ -308,6 +313,18 @@ Issues and PRs are welcome:
 - The command's own output text is English (a host-side handler has no active locale to consult); the panel is bilingual.
 - The Workspace Folders panel is a sidebar footer action plus a dialog rather than a full panel: `sidebar.footer.action` is offered by every supported release, whereas `sidebar.panellist` / `main` are not.
 
+## dsh-ops adaptation status (capability notes)
+
+The implementation is available through **OPS compatibility mode (experimental; limitations may apply)**. Set `multi-root-ops-compatibility.enabled` under `Settings → Plugins → Multi-root Workspace`; it defaults to `false` and requires an explicit opt-in. This feature can only be enabled on DSH `0.2.*` releases within the existing exact support matrix. On `0.1.*`, even a manually configured `enabled: true` stays inactive, and the legacy Settings UI is not supported ([version-scope decision](./docs/decisions/ADR-0029-ops-file-authorization-and-activity-adapter.md#ops-版本范围修订2026-11-06), Chinese). Enabling it from Settings opens the host’s risk dialog: acknowledge the limitations and confirm before the setting is saved. Cancel, close, or press Esc to keep it disabled.
+
+- **Enabled**: activates OPS execution protection, live activity, and Review enhancements. Full-access (`danger-full-access`) enforces explicit RO/cap deny boundaries through kernel confinement on the verified macOS and Linux lanes. On Windows, deny-bearing OPS execution calls, including reads, are conservatively refused before Worker preparation; protected preparation and legal writes in that combination are not yet supported. In WW/RO, any non-writable additional root or tool write cap causes the entire OPS execution call, including reads/page, to be refused before preparation and execution. All modes refuse OPS execution when Registry authority is unavailable; pure discovery/publication remains available. Subprocess launches also require a protected execution domain or a profile from the current admission, preventing background cleanup from bypassing boundaries. This can also reject third-party background processes; the panel’s user terminal is unaffected.
+- **Disabled**: restores OPS behavior from before this adaptation, without these safeguards — **OPS may write to an explicitly read-only additional root**. Normal multi-root features, native tool fences, and Auto Review's own toggle are unaffected. Delivered instructions are not retroactively erased; calls already inside a protected execution domain and running processes retain their original snapshot. Newly started calls no longer activate this adaptation.
+- **Experimental limitations**: only the Phase-A live activity index is available; there is no durable event bridge. While enabled, OPS history without live evidence after resume and dynamic pending actions (replace/batch/result/bash/unknown) cause Review to fail technically. Non-allowlisted diagnostics such as `ops_status` are also subject to this conservative rule.
+
+The MR-only P5 safeguards require no OPS changes. Legal additional-root writes can still be rejected, and result caches may remain when cleanup is refused. In legacy mode without a shared Registry, WW/RO PTC can also be refused before its code process starts. Durable activity stays disabled: DSH explicitly prohibits external plugins from calling `appendPluginRecord`; ordinary events and direct log writes are not substitutes. P6 technical acceptance is complete for this bounded scope. Remaining P5 capabilities and full OPS compatibility acceptance are **deferred indefinitely** and excluded from this acceptance; any future recovery will remain experimental. The canonical deferred list is in [ADR-0029](./docs/decisions/ADR-0029-ops-file-authorization-and-activity-adapter.md#无限期延后清单唯一真源), with scope recorded in the [completed plan](./docs/plans/completed/2026-11-01-ops-compatibility-adaptation.md) (Chinese).
+
+These experimental safeguards ship in `v0.1.15`; they do not claim complete OPS compatibility or expand the support matrix. The audit §16 historical re-verification predates this switch and describes the enabled path; reruns require an explicit `enabled: true`.
+
 ## Documentation
 
 Long-term project documentation lives in [`docs/`](./docs/README.md):

package/README.md

@@ -15,13 +15,13 @@
 并非所有项目都是 monorepo。一个开发项目往往由多个独立 Git 仓库组成，跨仓库干活原本得反复换会话。同类工具早已支持在一个工作区添加多个文件夹，本插件把同样的能力带给 DSH：把其他仓库登记为附加根，并按需授予只读、读写或不受限的访问级别，Agent 即可在授权范围内读写。
 
 - **不新增工具**：Agent 照旧使用原生 `read` / `write` / `edit` / `bash`，只是授权的目录变多了。
-- **沙箱约束**：附加根可继承会话（主目录）的权限设置，也可单独固定为只读或读写；在只读与读写下，约束不靠系统提示词，而由进程内文件围栏 + 内核级沙箱（macOS Seatbelt / Linux bwrap / Landlock / Windows ACL）执行，文件与 bash 共享同一份授权范围。
+- **沙箱约束**：附加根可继承会话（主目录）的权限设置，也可单独固定为只读或读写；在只读与读写下，约束不靠系统提示词，而由进程内文件围栏 + 内核级沙箱（macOS Seatbelt / Linux bwrap / Landlock / Windows ACL）执行，经本插件围栏的原生文件与 bash 共享同一份授权范围；自行启动 Worker 的第三方工具须单独验证，dsh-ops 的现存缺口见下方已知限制。
 - **Files 页签浏览附加根**：Files 页签头部可直接在主根与任一已登记附加根之间切换，附加根的目录树以与主根相同的原生 Files 视图呈现，打开文件、在外部应用打开、自动刷新等操作完全一致。
 - **可选 Auto review（默认关闭）**：fork 上游实验性「自动授权审查」，向 Reviewer 补充附加目录的审查上下文——当前工作区拓扑、各根访问级别与实时指令文件；出厂关闭，需在插件管理器的行列表中显式打开 `@dsh-electron/dsh-plugin-multi-root-workspace/auto-review` 行后生效，启用时接管官方同名 bundle。
 - **附属根 Skills**：发现附属目录的 `.dsh/skills` 与 `.agents/skills`，附属根经 `/alias-id:skill-name` 命名空间调用原生 `skill` 工具；每根独立开关、可编辑 `aliasId`，全局设置默认开启。
 - **不配等于没装**：未登记附加根时行为与未装插件逐项一致；配置错误一律明确报错，从不静默降级。
 
-当前发布版本 `v0.1.13`。各版本的用户可见变更见 [CHANGELOG](./CHANGELOG.md)；进度与发布状态见[路线图 §进度总账](./docs/plans/active/2026-09-12-multi-root-workspace.md#进度总账)。
+当前发布版本 `v0.1.15`。各版本的用户可见变更见 [CHANGELOG](./CHANGELOG.md)；进度与发布状态见[路线图 §进度总账](./docs/plans/active/2026-09-12-multi-root-workspace.md#进度总账)。
 
 ## 快速开始
 
@@ -53,11 +53,11 @@ tarball、GitHub、本地源码等其他安装方式见[安装](#安装)。
 | `0.1.7` | `0.1.7-alpha.1`、`0.1.7-alpha.2`、`0.1.7-rc.1`、`0.1.7-rc.2` |
 | `0.2.0` | `0.2.0-rc.1`、`0.2.0-rc.2` |
 | `0.2.1` | `0.2.1-alpha.1`、`0.2.1-alpha.2`、`0.2.1-alpha.3`、`0.2.1-alpha.4`、`0.2.1-alpha.5`、`0.2.1-rc.1`、`0.2.1-rc.2`、`0.2.1-rc.3`、`0.2.1-rc.4`、`0.2.1-rc.5` |
-| `0.2.2` | `0.2.2-alpha.2` |
+| `0.2.2` | `0.2.2-alpha.2`、`0.2.2-alpha.3`、`0.2.2-rc.1` |
 
 DSH 版本不在表内、或 `@deepseek-ai/dsh-*` 各包版本不一致时，插件不会启动，行为等同没装。
 
-**从源码构建 / 贡献**：Node.js `^22.19.0 || >=24`，pnpm `11.25.0`（建议经 corepack 启用）；开发 pin 的 DSH 为 `0.2.2-alpha.2`（Node ≥24.9）。
+**从源码构建 / 贡献**：Node.js `^22.19.0 || >=24`，pnpm `11.25.0`（建议经 corepack 启用）；开发 pin 的 DSH 为 `0.2.2-rc.1`（Node ≥24.9）。
 
 **运行平台**：macOS（Seatbelt）、Linux（bwrap / Landlock）、Windows（root-set ACL runner）。
 
@@ -96,8 +96,8 @@ dsh plugin --profile web add @dsh-electron/dsh-plugin-multi-root-workspace
 ```sh
 pnpm pack @dsh-electron/dsh-plugin-multi-root-workspace
 # 或从 GitHub Release 资产下载，例如：
-# https://github.com/cherrchen/dsh-plugin-multi-root-workspace/releases/download/v0.1.13/dsh-electron-dsh-plugin-multi-root-workspace-0.1.13.tgz
-dsh plugin --profile web add ./dsh-electron-dsh-plugin-multi-root-workspace-0.1.13.tgz
+# https://github.com/cherrchen/dsh-plugin-multi-root-workspace/releases/download/v0.1.15/dsh-electron-dsh-plugin-multi-root-workspace-0.1.15.tgz
+dsh plugin --profile web add ./dsh-electron-dsh-plugin-multi-root-workspace-0.1.15.tgz
 ```
 
 同样是预构建产物，适合内网或离线环境交付；首次安装同样需要添加 `allowBuilds`。
@@ -116,10 +116,10 @@ allowBuilds:
   koffi: true
 ```
 
-建议锁定版本（如 `#v0.1.13`），让后续推送无法悄悄改变实际运行的内容：
+建议锁定版本（如 `#v0.1.15`），让后续推送无法悄悄改变实际运行的内容：
 
 ```sh
-dsh plugin --profile web add github:cherrchen/dsh-plugin-multi-root-workspace#v0.1.13
+dsh plugin --profile web add github:cherrchen/dsh-plugin-multi-root-workspace#v0.1.15
 ```
 
 ### 从本地源码安装
@@ -210,6 +210,7 @@ dsh --profile web --dump-config | grep -A3 'multi-root'
 ```text
 /workspace-folders [list]                                                   # 列出主根与附加根（含每根访问级别与状态）
 /workspace-folders add <absolute path> [--inherit|--read-only|--read-write] # 不带路径时打开系统目录选择器；新登记默认 inherit
+/add-dirs [absolute path] [--inherit|--read-only|--read-write]              # /workspace-folders add 的快捷命令
 /workspace-folders access <order|path> inherit|read-only|read-write         # 切换访问级别（扩权要求该根此刻可用）
 /workspace-folders skills <order|path> on|off                               # 独立切换附属根 Skills，不改变写权限
 /workspace-folders alias-id <order|path> <kebab-case>                        # 编辑稳定 Skill 命名空间
@@ -256,7 +257,7 @@ Settings → Plugins → Multi-root Workspace 中的 **启用附属根 Skills**
 
 ## 可选 Auto Review 适配
 
-需要 Auto Review 多根上下文时，在插件管理器的主包行列表中启用默认关闭的 [Auto Review 入口](./src/auto-review/README.md)。该集成仅面向 DSH `0.2.1-rc.2`；普通安装保持原支持范围且不会启用或选择 Auto。
+需要 Auto Review 多根上下文时，在插件管理器的主包行列表中启用默认关闭的 [Auto Review 入口](./src/auto-review/README.md)；同一详情页设置卡中的「多根 Auto Review（实验性）」开关与该行开关等价，默认同样关闭。该集成仅面向 DSH `0.2.1-rc.2`；普通安装保持原支持范围且不会启用或选择 Auto。
 
 ## 项目结构
 
@@ -298,7 +299,11 @@ Settings → Plugins → Multi-root Workspace 中的 **启用附属根 Skills**
 
 ## 已知限制
 
-- 附加根的指令文件按需到达模型：根目录顶层的那一份在会话第一步之前注入，子目录里的那一份在本会话**成功**触碰过该目录之后注入；nested 文件只会在其目录被考察到时重新检查（根层每一步，子目录依赖已投递或有新触碰），投递状态是进程内的（resume 后可能再告知一次），也只识别 `read` / `write` / `edit` 三个工具名。主根与 user-global 的指令链仍由上游负责，本插件不重复注入（[ADR-0010](./docs/decisions/ADR-0010-additional-root-instruction-scope.md)）。
+- **dsh-ops 只读限制绕过（F01，历史基线）**：审计版本在 Full-access 下，OPS Native `ops_write_file` 实际写入了显式只读附属根，而原生 fs 同次对照被拒。启用 OPS 兼容模式时，本轮有限适配已在 Full-access 下复验 explicit RO/cap deny 对 OPS Native 与真实 PTC 生效（deny 执行复验见[审计§16](./docs/reviews/dsh-ops-compatibility-audit.md#16-适配后复验)），版本、测试范围与原始证据见[兼容性审计](./docs/reviews/dsh-ops-compatibility-audit.md)。
+- **dsh-ops 的合法写入与子目录指令缺口（F04/F05，历史基线）**：WW 下 inherit/固定读写附属根及 RO 下固定读写附属根被 OPS 预检拒写的问题未解决；OPS 读取不触发子目录指令发现（F05）已在启用模式的本轮 live 索引 + 真实 AgentLoop 下复验恢复（Native 与 PTC 成功触碰的子目录指令进入下一模型请求，见[审计§16](./docs/reviews/dsh-ops-compatibility-audit.md#16-适配后复验)）；不影响已验证的根级指令和 Skills 路径。
+- **Linux bwrap 的 WW batch/result 降级（F07）**：审计版本的共享 Registry 下，所有到达启动分支且取得有效 cache 的 `ops_batch` / `ops_result`（含 `page`）都会因 confine 后追加 bind 而失去 argv 归属证明，源码路径将拒绝 Worker 启动并报 `EXECUTOR_UNAVAILABLE`。函数级冲突已复现，Linux 端到端未测；普通 RO、Landlock 和无 cache 对照不在此结论内。需 OPS 提供 confine 前的 cache 声明接口，目前没有已验证的 MR 单侧缓解，见[审计 F07](./docs/reviews/dsh-ops-compatibility-audit.md#131-n1--f07confine-后的-cache-bind-与严格证明冲突)。
+- **其他 OPS 可用性边界**：共享 WW 下，调度外 purge 无有效 admission 时会被拒，结果缓存可能残留并告警；PTC 嵌套调用及后台 Bash 也有证明归属/过期导致的拒绝风险。本轮已完成保守拒绝边界的三平台验证；正常后台与清理能力仍未恢复，且已无限期延后，见 [ADR-0029 最终范围](./docs/decisions/ADR-0029-ops-file-authorization-and-activity-adapter.md#最终范围与无限期延后2026-11-05)。
+- 附加根的指令文件按需到达模型：根目录顶层的那一份在会话第一步之前注入，子目录里的那一份在本会话**成功**触碰过该目录之后注入；nested 文件只会在其目录被考察到时重新检查（根层每一步，子目录依赖已投递或有新触碰），投递状态是进程内的（resume 后可能再告知一次）；官方识别 `read` / `write` / `edit`，启用 OPS 兼容模式后，OPS 工具经 live 证据同样驱动投递（resume 后 OPS 历史缺 live 证据不参与投递）。主根与 user-global 的指令链仍由上游负责，本插件不重复注入（[ADR-0010](./docs/decisions/ADR-0010-additional-root-instruction-scope.md)）。
 - 多 Host 共享同一登记服务：只有一个 Host 管理存储，各实例逐操作取得授权；断线停止新附加授权，权威退出后按内核锁接管。限同机器、同用户及同锁命名空间；Linux 共享连接需要 SO_PEERPIDFD，Windows 限同登录会话。旧进程/PTY 保留启动快照（[共享架构](./docs/architecture/registry-authority-service.md)）。
 - 支持矩阵是精确版本 allowlist：宿主版本不在清单上、或核心包混装了不同版本时，`fs` / `sandbox` / `registry` / `instructions` / `lsp` / `workspace-files` 六行**不启动**，组合退化为"没装这个插件"（[ADR-0009](./docs/decisions/ADR-0009-dsh-compat-contract.md)）。
 - Windows 多根 runner 继承上游 partial enforcement、caller-owned 目录及 private temp 分离条件；已启动进程保留启动时根集合，后续进程使用更新后的集合（[ADR-0011](./docs/decisions/ADR-0011-multi-root-workspace-consumers.md)）。
@@ -310,6 +315,18 @@ Settings → Plugins → Multi-root Workspace 中的 **启用附属根 Skills**
 - 命令的输出文案为英文（host 侧没有活动语言信息），面板文案中英双语跟随界面语言。
 - Workspace Folders 面板是「侧栏底部动作 + 对话框」，不是独立全屏面板：`sidebar.footer.action` 是所有受支持版本都提供的插槽，而 `sidebar.panellist`/`main` 不是。
 
+## dsh-ops 适配现状（受限能力说明）
+
+当前实现作为 **OPS 兼容模式（实验性，可能存在限制）** 开放：在 `Settings → Plugins → Multi-root Workspace` 中设置 `multi-root-ops-compatibility.enabled`，默认 `false`，必须显式开启。该功能仅允许在现有精确支持矩阵内的 DSH `0.2.*` 上启用；`0.1.*` 即使手工配置 `enabled: true` 也保持关闭，不提供旧版 Settings UI（[版本范围决定](./docs/decisions/ADR-0029-ops-file-authorization-and-activity-adapter.md#ops-版本范围修订2026-11-06)）。 从设置界面开启时，须阅读官方风险弹窗、勾选已了解限制并再次确认；确认前保持关闭，取消、关闭弹窗或按 Esc 均不保存开启设置。
+
+- **开启**：激活 OPS 执行保护、实时活动与 Review 增强。Full-access（`danger-full-access`）在已验证的 macOS/Linux 车道用内核围栏保护 explicit RO/cap deny；Windows 有 deny 时在 Worker 准备前保守拒绝 OPS 执行（包括读取），尚不支持该组合下的受保护准备与合法写入。WW/RO 一旦存在不可写附加根或工具只读上限，整次 OPS 执行调用（包括读取/page）会在准备与正文前拒绝。所有模式在 Registry 失权时拒绝 OPS 执行调用，纯发现/发布除外。没有执行域或当次有效 profile 证明的 subprocess 启动也会拒绝，防止后台清理绕过边界；这可能连带拒绝第三方后台进程，但不拦截面板中用户自己的终端。
+- **关闭**：OPS 恢复本轮适配前的行为，不提供这些兜底——**显式只读附加根可能被 OPS 写入**。普通多根功能、原生工具围栏和 Auto Review 自身开关不受影响。已投递的指令不会回溯抹除，已进入保护域的调用与已启动进程保留原快照；关闭后开始的新调用不再激活本次适配。
+- **实验限制**：仅提供 Phase A live 活动索引，无持久事件桥。开启时，resume 后 OPS 历史缺 live 证据、动态 pending（replace/batch/result/bash/unknown）会使 Review 技术失败；非白名单诊断如 `ops_status` 也受此保守规则影响。
+
+P5 的本仓兜底不修改 OPS：合法附加根写入仍可能被误拒，后台结果缓存可能因拒绝清理而残留；legacy 非共享模式下，WW/RO 的 PTC 也可能在启动代码进程前被拒。持久活动仍关闭：DSH 的 `appendPluginRecord` 明确禁止外部插件调用，不能用普通事件或私写日志代替。P6 已按限定范围完成技术验收；P5 剩余功能及全功能兼容验收**无限期延后**，不构成本次完成条件，未来若恢复也仅以实验性能力开放。延期清单见 [ADR-0029](./docs/decisions/ADR-0029-ops-file-authorization-and-activity-adapter.md#无限期延后清单唯一真源)，验收范围见[已完成计划](./docs/plans/completed/2026-11-01-ops-compatibility-adaptation.md)。
+
+本次实验性保守兜底随 `v0.1.15` 发版，不声明完整 OPS 兼容，不提升支持版本。审计 §16 的历史复验发生在本开关加入之前，对应启用路径；后续复跑须显式 `enabled: true`。
+
 ## 文档
 
 项目长期文档位于 [`docs/`](./docs/README.md)：

package/cordis.patch.yml

@@ -12,7 +12,7 @@
 # provider below without any plugin-side executor.
 #
 # The last two rows are additive and self-softening: `multi-root-registry` waits
-# for the storage domain (absent only in compositions that mount no storage at
+# for the storage hub (absent only in compositions that mount no storage at
 # all) and takes a store-wide kernel lease beside the JSON document so two DSH
 # processes sharing $DSH_HOME cannot each grant a stale snapshot (ADR-0007);
 # `multi-root-command` registers the `/workspace-folders` command
@@ -76,6 +76,10 @@
         # or an unavailable registry authority), the scope appends this path
         # to the deny set, so fs writes and spawned processes refuse it.
         dshHome: !!js dshHomePath()
+    - id: multi-root-ops-compatibility
+      name: '@dsh-electron/dsh-plugin-multi-root-workspace/ops-compatibility'
+      config:
+        enabled: false
     - id: multi-root-registry
       name: '@dsh-electron/dsh-plugin-multi-root-workspace/registry'
       config:

package/detail/DETAIL.en.md

@@ -0,0 +1 @@
+![The "Multi-root workspace" title above a "Sync API types" session card, whose "Workspace folders" entry point opens the panel on the right: one primary and two secondary directories](preview.svg)

package/detail/DETAIL.md

@@ -0,0 +1 @@
+![「多根工作区」标题，下方「同步 API 类型」会话卡片经「工作区目录」入口指向右侧面板：一个主工作目录和两个附属目录](preview.zh.svg)