@dsh-electron/dsh-plugin-multi-root-workspace 0.1.13 → 0.1.15

package/lib/{review-context-NDpKeMCc.js → review-context-B-oHkU6a.js}

@@ -1,6 +1,7 @@
 import { t as effectiveDirectory } from "./session-directory-BLOstut1.js";
-import { s as touchedPathOfToolCall } from "./instructions-KsUwUFE0.js";
-import { l as isCanonicallyUnder } from "./roots-Ca_W1S9n.js";
+import { c as stableOpsJson, l as touchedPathOfToolCall, s as pendingInstructionTargets } from "./instructions-Ck9wp4J4.js";
+import { r as opsCompatibilityToken } from "./ops-settings-UN2oOKEp.js";
+import { l as isCanonicallyUnder } from "./roots-CmaWxRVy.js";
 import { createHash } from "node:crypto";
 import { resolve } from "node:path";
 import { Service } from "@deepseek-ai/cordis";
@@ -50,7 +51,7 @@ var MultiRootReviewContext = class extends Service {
 		const policy = this.ctx.sandboxPolicy.resolve({ session: agent.session });
 		const primary = canonicalPath(policy.workspaceRoot);
 		if (agent.session.header.cwd !== void 0 && canonicalPath(agent.session.header.cwd) !== primary) throw new Error("review-context: inconsistent session origin");
-		await this.ctx.multiRootRegistry.refresh(primary);
+		await this.ctx.multiRootRegistry.refresh(policy.workspaceRoot);
 		signal.throwIfAborted();
 		const cwd = effectiveDirectory(this.ctx, agent.session);
 		if (cwd === void 0) throw new Error("review-context: missing effective cwd");
@@ -73,10 +74,20 @@ var MultiRootReviewContext = class extends Service {
 			primaryRootWritable: policy.mode !== "read-only" && !scope.deniedRoots.some((deny) => isCanonicallyUnder(scope.primaryRoot, deny)),
 			writeBoundary: scope.authority === "unavailable" && policy.mode !== "read-only" ? "primary-root-only; no shared temp grants; explicit denies take precedence" : policy.mode === "danger-full-access" ? "ambient host writes minus explicit deny boundaries; membership is not an access allowlist" : policy.mode === "workspace-write" ? "primary root, effective writable additional roots and upstream host temp grants; explicit denies take precedence" : "only effective writable additional roots; explicit denies take precedence"
 		};
-		const path = touchedPathOfToolCall(exec.name, JSON.stringify(exec.arguments));
-		const target = path === void 0 ? void 0 : this.ctx.fs.processPath(await this.ctx.fs.resolve(resolve(cwd, path), { signal }));
-		const constraints = await this.ctx.multiRootInstructions.snapshot(agent, scope.authority === "available" ? scope.additionalRoots : [], target, signal);
+		const official = touchedPathOfToolCall(exec.name, JSON.stringify(exec.arguments));
+		const modeToken = opsCompatibilityToken(this.ctx);
+		const candidates = modeToken === void 0 ? [] : pendingInstructionTargets(exec.name, exec.arguments);
+		const targets = [];
+		for (const path of official === void 0 ? candidates : [official]) targets.push(this.ctx.fs.processPath(await this.ctx.fs.resolve(resolve(cwd, path), { signal })));
+		const pending = exec.callId === void 0 || modeToken === void 0 ? void 0 : {
+			callId: exec.callId,
+			name: exec.name,
+			arguments: exec.arguments,
+			parent: exec.parent
+		};
+		const constraints = await this.ctx.multiRootInstructions.snapshot(agent, scope.authority === "available" ? scope.additionalRoots : [], targets, signal, pending);
 		signal.throwIfAborted();
+		if (opsCompatibilityToken(this.ctx) !== modeToken) throw new Error("review-context: OPS compatibility changed during the build; retry");
 		const payload = {
 			schemaVersion: 1,
 			environment,
@@ -87,7 +98,13 @@ var MultiRootReviewContext = class extends Service {
 		if (Buffer.byteLength(JSON.stringify(payload), "utf8") > 65536) throw new Error("review-context: context budget exceeded");
 		return {
 			...payload,
-			fingerprint: createHash("sha256").update(JSON.stringify([payload, nativeInstructionFingerprint(agent.session)])).digest("hex")
+			fingerprint: createHash("sha256").update(JSON.stringify(modeToken === void 0 ? [payload, nativeInstructionFingerprint(agent.session)] : [
+				payload,
+				nativeInstructionFingerprint(agent.session),
+				exec.name,
+				stableOpsJson(exec.arguments),
+				modeToken.id
+			])).digest("hex")
 		};
 	}
 	async assertCurrent(exec, snapshot, signal) {

package/lib/review-context.js

@@ -1,2 +1,2 @@
-import { t as MultiRootReviewContext } from "./review-context-NDpKeMCc.js";
+import { t as MultiRootReviewContext } from "./review-context-B-oHkU6a.js";
 export { MultiRootReviewContext, MultiRootReviewContext as default };

package/lib/{roots-Ca_W1S9n.js → roots-CmaWxRVy.js}

@@ -1,6 +1,6 @@
 import { i as isWindowsNetworkOrDevicePath } from "./windows-runner-contract-B5R2K3mM.js";
 import { statSync } from "node:fs";
-import { isAbsolute, join, sep } from "node:path";
+import { isAbsolute, join, resolve, sep } from "node:path";
 import { canonicalPath } from "@deepseek-ai/dsh-sandbox";
 import { homedir } from "node:os";
 //#region src/roots.ts
@@ -20,15 +20,21 @@ import { homedir } from "node:os";
 *    misconfiguration, not a path to guess at.
 * 2. `missing` — the directory does not exist.
 * 3. `not-a-directory` — it exists but is not a directory.
-* 4. `equals-primary` — the canonical candidate IS the session's workspace
+* 4. `protected-path` — the canonical candidate equals, lies inside, or
+*    contains a protected DSH directory (the DSH home, the registry's
+*    physical storage medium, or the lease directory, supplied through
+*    {@link RootCandidateContext.protectedPaths}): those hold the store,
+*    the lease, profiles and user credentials, so no access level may
+*    register them. Applies to every mode; no remote exemption exists.
+* 5. `equals-primary` — the canonical candidate IS the session's workspace
 *    root, which is already granted by the upstream policy.
-* 5. `primary-overlap` — the candidate lies under the workspace root, or
+* 6. `primary-overlap` — the candidate lies under the workspace root, or
 *    contains it. The union grants nothing new, and the displayed list would
 *    stop matching the enforced root set.
-* 6. `duplicate` — another registered root canonicalizes to the same path.
-* 7. `nested` — the candidate lies under a registered root, or contains one.
-*    Same reasoning as rule 5, applied to the additional roots.
-* 8. `unsupported-path` — on Windows, a network or device path (`\\server`,
+* 7. `duplicate` — another registered root canonicalizes to the same path.
+* 8. `nested` — the candidate lies under a registered root, or contains one.
+*    Same reasoning as rule 6, applied to the additional roots.
+* 9. `unsupported-path` — on Windows, a network or device path (`\\server`,
 *    `\\?\…`, `\\.\…`): the ACL confinement cannot be shown to cover it, so it
 *    is rejected lexically before any filesystem touch.
 *
@@ -88,6 +94,22 @@ const CASE_SENSITIVE = process.platform !== "win32";
 function comparable(path) {
 	return CASE_SENSITIVE ? path : path.toLowerCase();
 }
+/**
+* The Registry/scope lookup key of one primary root: the UPSTREAM spelling,
+* normalized lexically by `path.resolve` and case-folded on Windows — never
+* re-resolved. Upstream `dsh-sandbox-policy` sets `policy.workspaceRoot` to
+* `session.header.cwd` verbatim, so the spelling IS the identity: a symlinked
+* workspace and its realpath target are different sessions and different key
+* spaces. Re-resolving here would let a replaced workspace directory
+* silently re-key the record set onto another identity — the exact failure
+* the redirect rules exist to prevent. This is the ONLY function allowed to
+* turn a primary root into a Registry key; path geometry keeps using
+* {@link canonicalRoot}.
+*/
+function primaryKey(path, platform = process.platform) {
+	const resolved = resolve(path);
+	return platform === "win32" ? resolved.toLowerCase() : resolved;
+}
 /** Whether two canonical paths name the same directory on this platform. */
 function samePath(left, right) {
 	return comparable(left) === comparable(right);
@@ -131,6 +153,11 @@ function validateRootCandidate(raw, context) {
 	const canonical = canonicalRoot(expanded);
 	if (platform === "win32" && isWindowsNetworkOrDevicePath(canonical)) throw unsupportedPath(expanded);
 	assertDirectory(canonical, expanded);
+	const protectedConflict = protectedOverlap(canonical, context.protectedPaths ?? []);
+	if (protectedConflict !== void 0) throw new RootValidationError("protected-path", `"${canonical}" overlaps the protected DSH directory "${protectedConflict.path}" (${protectedConflict.kind}) and cannot be registered`, {
+		conflict: protectedConflict.path,
+		reference: canonical
+	});
 	const primaryRoot = canonicalRoot(context.primaryRoot);
 	if (samePath(canonical, primaryRoot)) throw new RootValidationError("equals-primary", `"${canonical}" is this session's workspace root and is already writable`, {
 		conflict: primaryRoot,
@@ -160,6 +187,18 @@ function validateRootCandidate(raw, context) {
 function unsupportedPath(asTyped) {
 	return new RootValidationError("unsupported-path", `"${asTyped}" is a network or device path, which Windows ACL confinement cannot cover`, { reference: asTyped });
 }
+/**
+* The first protected directory `candidate` overlaps — equals, lies inside,
+* or contains. Both sides must already be canonical (or absolute boundary
+* spellings): the comparison is the same lexical three-way test the other
+* boundary rules use, so a symlink alias can never route around it.
+* @param candidate - the canonical candidate or recorded grant to test.
+* @param protectedPaths - the protected DSH directories.
+* @returns the overlapping protected path, or `undefined`.
+*/
+function protectedOverlap(candidate, protectedPaths) {
+	return protectedPaths.find((boundary) => samePath(candidate, boundary.path) || isCanonicallyUnder(candidate, boundary.path) || isCanonicallyUnder(boundary.path, candidate));
+}
 /** Assert that a canonical path is an existing directory. */
 function assertDirectory(canonical, asTyped) {
 	let stats;
@@ -181,12 +220,15 @@ function assertDirectory(canonical, asTyped) {
 * @param primaryRoot - the session workspace root the records belong to.
 * @param records - the stored records, in registry order.
 * @param platform - the platform the rules run for; defaults to `process.platform`.
+* @param protectedPaths - the protected DSH directories a stored grant may not
+*   overlap; a record that does is reported `invalid` with
+*   `invalidReason: 'protected-path'` — withheld, never deleted, never re-granted.
 * @returns one status per record, in the same order.
 */
-function classifyStoredRoots(primaryRoot, records, platform = process.platform) {
+function classifyStoredRoots(primaryRoot, records, platform = process.platform, protectedPaths = []) {
 	const primary = canonicalRoot(primaryRoot);
 	const duplicated = duplicatedIds(records);
-	return markMembershipConflicts(records.map((record, index) => classifyStoredRoot(record, primary, duplicated.has(record.id), index, platform)));
+	return markMembershipConflicts(records.map((record, index) => classifyStoredRoot(record, primary, duplicated.has(record.id), index, platform, protectedPaths)));
 }
 /**
 * Pass two of {@link classifyStoredRoots}: every pair of structurally sound
@@ -204,7 +246,7 @@ function classifyStoredRoots(primaryRoot, records, platform = process.platform)
 * when the pair found first was already doomed.
 */
 function markMembershipConflicts(statuses) {
-	const boundaries = statuses.map((status) => status.state === "invalid" ? void 0 : singleGrantOf(status));
+	const boundaries = statuses.map((status) => status.state !== "invalid" || status.invalidReason === "protected-path" || status.invalidReason === "primary-overlap" ? singleGrantOf(status) : void 0);
 	const conflicts = /* @__PURE__ */ new Map();
 	for (let index = 0; index < boundaries.length; index += 1) {
 		const boundary = boundaries[index];
@@ -221,7 +263,7 @@ function markMembershipConflicts(statuses) {
 	if (conflicts.size === 0) return [...statuses];
 	return statuses.map((status, index) => {
 		const others = conflicts.get(index);
-		if (others === void 0) return status;
+		if (others === void 0 || status.invalidReason === "protected-path" || status.invalidReason === "primary-overlap") return status;
 		const boundary = boundaries[index];
 		const partners = others.map((other) => `"${other}"`).join(", ");
 		return {
@@ -271,7 +313,7 @@ function duplicatedIds(records) {
 * boundary — the directory the operator was granted — not what `path`
 * resolves to today.
 */
-function classifyStoredRoot(record, primary, duplicatedId, position, platform) {
+function classifyStoredRoot(record, primary, duplicatedId, position, platform, protectedPaths) {
 	const invalid = (detail) => ({
 		...record,
 		state: "invalid",
@@ -291,8 +333,21 @@ function classifyStoredRoot(record, primary, duplicatedId, position, platform) {
 	if (typeof recorded !== "string" || recorded === "") return invalid("the record does not say which directory it was granted for");
 	if (!isAbsolute(recorded)) return invalid(`the recorded grant "${recorded}" is not an absolute path`);
 	if (platform === "win32" && (isWindowsNetworkOrDevicePath(record.path) || isWindowsNetworkOrDevicePath(recorded))) return invalid(`"${record.path}" is a network or device path, which Windows ACL confinement cannot cover`);
-	if (samePath(recorded, primary)) return invalid(`"${recorded}" is this session's workspace root`);
-	if (isCanonicallyUnder(recorded, primary) || isCanonicallyUnder(primary, recorded)) return invalid(`"${recorded}" overlaps this session's workspace root`);
+	const primaryOverlap = (detail) => ({
+		...record,
+		state: "invalid",
+		invalidReason: "primary-overlap",
+		detail: `${detail}; any recorded read-only restriction remains in force`
+	});
+	if (samePath(recorded, primary)) return primaryOverlap(`"${recorded}" is this session's workspace root`);
+	if (isCanonicallyUnder(recorded, primary) || isCanonicallyUnder(primary, recorded)) return primaryOverlap(`"${recorded}" overlaps this session's workspace root`);
+	const protectedConflict = protectedOverlap(recorded, protectedPaths);
+	if (protectedConflict !== void 0) return {
+		...record,
+		state: "invalid",
+		invalidReason: "protected-path",
+		detail: protectedGrantDetail(recorded, protectedConflict)
+	};
 	const canonical = canonicalRoot(record.path);
 	if (!samePath(canonical, recorded)) return {
 		...record,
@@ -325,23 +380,58 @@ function classifyStoredRoot(record, primary, duplicatedId, position, platform) {
 function availableRoots(statuses) {
 	return statuses.filter((status) => status.state === "available").map((status) => status.path);
 }
+/** The detail text the protected-path verdict carries, shared by both marking paths. */
+function protectedGrantDetail(grant, conflict) {
+	return `the recorded grant "${grant}" overlaps the protected DSH directory "${conflict.path}" (${conflict.kind}); it stays registered and withheld, and any recorded read-only restriction remains in force`;
+}
+/**
+* Apply the protected-path verdict to an already-classified list: a status
+* whose recorded grant overlaps a protected directory becomes `invalid` with
+* `invalidReason: 'protected-path'` — the same verdict the pass-one stored
+* check produces, here applied by a consumer that classified elsewhere (a
+* shared-registry follower re-judging an owner snapshot against ITS OWN
+* protected set, which may differ from the owner's). Statuses already
+* `invalid` keep their own verdict — a structural failure is never healed
+* into a trustworthy boundary.
+* @param statuses - the classified statuses to re-mark.
+* @param protectedPaths - the caller's own protected DSH directories.
+* @returns a new list with the verdict applied.
+*/
+function markProtectedPaths(statuses, protectedPaths) {
+	if (protectedPaths.length === 0) return [...statuses];
+	return statuses.map((status) => {
+		if (status.state === "invalid") return status;
+		const grant = singleGrantOf(status);
+		if (grant === void 0) return status;
+		const conflict = protectedOverlap(grant, protectedPaths);
+		if (conflict === void 0) return status;
+		return {
+			...status,
+			state: "invalid",
+			invalidReason: "protected-path",
+			detail: protectedGrantDetail(grant, conflict)
+		};
+	});
+}
 /**
 * The recorded boundary one status still RESERVES: the grant it was
 * registered for, which a new or revived registration may not overlap merely
 * because the root is currently unusable.
 *
-* `available`, `missing`, `redirected`, and membership-conflict statuses all
-* carry an intact, trustworthy recorded grant; every other `invalid` verdict
-* means the grant could not be parsed at all, so it reserves — and denies —
-* nothing. This is not an independent authorization table: it derives the
-* boundary from the status list {@link classifyStoredRoots} produced, with
-* the same grant-extraction semantics, so its answer can never disagree with
+* `available`, `missing`, `redirected`, and the trustworthy-boundary
+* `invalid` verdicts (`membership-conflict`, `protected-path`, and
+* `primary-overlap`) all carry
+* an intact recorded grant; every other `invalid` verdict means the grant
+* could not be parsed at all, so it reserves — and denies — nothing. This is
+* not an independent authorization table: it derives the boundary from the
+* status list {@link classifyStoredRoots} produced, with the same
+* grant-extraction semantics, so its answer can never disagree with
 * classification.
 * @param status - one classified registration.
 * @returns the absolute recorded boundary, or `undefined` when there is none.
 */
 function reservedRootBoundary(status) {
-	if (status.state === "invalid" && status.invalidReason !== "membership-conflict") return void 0;
+	if (status.state === "invalid" && status.invalidReason === void 0) return void 0;
 	const boundary = singleGrantOf(status);
 	return boundary !== void 0 && isAbsolute(boundary) ? boundary : void 0;
 }
@@ -439,4 +529,4 @@ function describeRef(ref) {
 	}
 }
 //#endregion
-export { classifyStoredRoots as a, indexedStatuses as c, reservedRootBoundary as d, resolveRootIndex as f, canonicalRoot as i, isCanonicallyUnder as l, validateRootCandidate as m, additionalRootId as n, entryRootRef as o, resolveRootRef as p, availableRoots as r, expandRootInput as s, RootValidationError as t, removeStatusAt as u };
+export { samePath as _, classifyStoredRoots as a, indexedStatuses as c, primaryKey as d, protectedOverlap as f, resolveRootRef as g, resolveRootIndex as h, canonicalRoot as i, isCanonicallyUnder as l, reservedRootBoundary as m, additionalRootId as n, entryRootRef as o, removeStatusAt as p, availableRoots as r, expandRootInput as s, RootValidationError as t, markProtectedPaths as u, singleGrantOf as v, validateRootCandidate as y };

package/lib/{sandbox-C-vCJCp3.js → sandbox-CZElTNPz.js}

@@ -1,5 +1,5 @@
 import { a as parseWindowsProfile, i as isWindowsNetworkOrDevicePath, n as assertWindowsDenyCapacity, t as DialectUnrecognizedError } from "./windows-runner-contract-B5R2K3mM.js";
-import { a as splitConfined, c as mapConfined, i as restrictProfileArgs, l as widenConfined, o as widenProfileArgs, r as graftProfileArgs, t as denyProfileArgs } from "./dialects-Dr4rDR-H.js";
+import { a as splitConfined, c as mapConfined, i as restrictProfileArgs, l as widenConfined, o as widenProfileArgs, r as graftProfileArgs, t as denyProfileArgs } from "./dialects-CdlG3RF9.js";
 import { brandMultiRootProvider } from "./providers.js";
 import { SandboxUnavailableError, canonicalPath } from "@deepseek-ai/dsh-sandbox";
 import { fileURLToPath } from "node:url";

package/lib/sandbox.js

@@ -1,3 +1,3 @@
 import "./providers.js";
-import { t as MultiRootSandboxProvider } from "./sandbox-C-vCJCp3.js";
+import { t as MultiRootSandboxProvider } from "./sandbox-CZElTNPz.js";
 export { MultiRootSandboxProvider, MultiRootSandboxProvider as default };

package/lib/scope.js

@@ -1,5 +1,9 @@
+import { t as wrapMethod } from "./method-wrapper-D4oUCsEF.js";
 import { i as rememberOperationProfile, r as operationPermitsProfile, t as currentRegistryOperation } from "./registry-operation-C2ZV3Jhw.js";
-import { t as aroundTool } from "./tool-context-CpgIFcCB.js";
+import { t as aroundTool } from "./tool-context-CCeY3mrK.js";
+import { r as opsCompatibilityToken } from "./ops-settings-UN2oOKEp.js";
+import { d as primaryKey } from "./roots-CmaWxRVy.js";
+import { a as createOpsProtectionState, l as opsDispatchBarrier, u as opsSpawnPermitted } from "./ops-tools-k4JYaOrM.js";
 import { r as effectiveRootAccess } from "./contract-CStSEOcK.js";
 import { statSync } from "node:fs";
 import { isAbsolute } from "node:path";
@@ -156,6 +160,7 @@ var MultiRootScopeService = class extends Service {
 	listeners = /* @__PURE__ */ new Set();
 	/** Enclosing {@link MultiRootScopeService.batch} depth; inner calls nest. */
 	batchDepth = 0;
+	opsProtection = createOpsProtectionState();
 	/** True when a batched write coalesced its notification into the flush. */
 	batchDirty = false;
 	admissionProof;
@@ -179,6 +184,13 @@ var MultiRootScopeService = class extends Service {
 	* treated as evidence.
 	*/
 	dshHome;
+	/**
+	* Whether the row carried a `dshHome` value at all — even an invalid one.
+	* The registry's protected-boundary set must tell "no home configured"
+	* (absent: nothing to protect) from "a home was supplied and rejected"
+	* (invalid: the boundary cannot be proven).
+	*/
+	dshHomeSupplied;
 	/** Observe registry publications; consumers still resolve authority from scopeOf(). */
 	subscribe(listener) {
 		this.listeners.add(listener);
@@ -228,6 +240,20 @@ var MultiRootScopeService = class extends Service {
 	get toolAccessInvalid() {
 		return this.capsInvalid;
 	}
+	/**
+	* The validated `dshHome` row config, classified for the registry's
+	* protected-boundary set: `absent` when the row carried no value (nothing
+	* to protect), `invalid` when it carried a value the constructor rejected
+	* (the boundary cannot be proven), `configured` with the accepted absolute
+	* path. Read-only — this changes no scope or `protectedHome` semantics.
+	*/
+	get dshHomeConfig() {
+		if (this.dshHome !== void 0) return {
+			kind: "configured",
+			path: this.dshHome
+		};
+		return this.dshHomeSupplied ? { kind: "invalid" } : { kind: "absent" };
+	}
 	constructor(ctx, config = {}) {
 		super(ctx, "multiRootScope");
 		const toolAccess = config.toolAccess;
@@ -243,10 +269,44 @@ var MultiRootScopeService = class extends Service {
 			this.capsInvalid = false;
 		}
 		const dshHome = config.dshHome;
+		this.dshHomeSupplied = dshHome !== void 0;
 		if (dshHome !== void 0 && (typeof dshHome !== "string" || dshHome.trim() === "" || !isAbsolute(dshHome))) ctx.logger.error(`multi-root-workspace: invalid dshHome config (expected an absolute path, got ${JSON.stringify(dshHome)}); the DSH-home deny boundary is disabled`);
 		else this.dshHome = dshHome;
 		aroundTool(ctx, (exec, next) => {
-			return toolCapStore.run({ capped: this.capForTool(exec.name) }, next);
+			return this.withToolCap(exec.name, async () => {
+				const denial = opsDispatchBarrier(ctx, this, exec);
+				if (denial !== void 0) throw new Error(denial);
+				return await next();
+			});
+		});
+		ctx.inject([
+			"tools",
+			"sandboxPolicy",
+			"multiRootCompat",
+			"multiRootProviders"
+		], (scoped) => {
+			if (typeof scoped.tools.guard !== "function") return;
+			scoped.effect(() => scoped.tools.guard((exec) => opsDispatchBarrier(ctx, this, exec)));
+		});
+		ctx.inject([
+			"subprocess",
+			"multiRootCompat",
+			"multiRootProviders"
+		], (scoped) => {
+			scoped.effect(() => {
+				let active = true;
+				const restore = wrapMethod(scoped.get("subprocess"), "spawn", (original) => {
+					const scope = this;
+					return function(spec) {
+						if (active && opsCompatibilityToken(scoped) !== void 0 && scope.hasActiveDenyRoots() && !opsSpawnPermitted(scope.opsProtection) && !(scope.admissionRequired && scope.admissionPathsValid() && scope.permitsProfile(spec.argv))) throw new Error("multi-root workspace: an unattributed subprocess has no protected execution or live profile admission; refusing launch while OPS compatibility write boundaries apply");
+						return original.call(this, spec);
+					};
+				});
+				return () => {
+					active = false;
+					restore();
+				};
+			});
 		});
 		ctx.inject(["systemPrompt", "sandboxPolicy"], (scope) => {
 			scope.systemPrompt.context({
@@ -327,16 +387,19 @@ var MultiRootScopeService = class extends Service {
 	previewForTool(policy, toolName) {
 		return this.project(policy, this.capForTool(toolName));
 	}
+	withToolCap(name, fn) {
+		return toolCapStore.run({ capped: this.capForTool(name) }, fn);
+	}
 	/** Execution and review use exactly the same parent-narrowing rule. */
 	capForTool(toolName) {
 		return this.capsInvalid || toolCapStore.getStore()?.capped === true || this.caps[toolName] === "read-only";
 	}
 	project(policy, capped, recorded, authority = this.registryAuthority) {
 		const primaryRoot = canonicalPath(policy.workspaceRoot);
-		const registered = recorded ?? this.rootsByPrimary.get(primaryRoot) ?? [];
+		const registered = recorded ?? this.rootsByPrimary.get(primaryKey(policy.workspaceRoot)) ?? [];
 		const roots = authority === "unavailable" ? [] : sanitizeMembers(primaryRoot, registered);
 		const writable = capped || authority === "unavailable" ? [] : roots.filter((root) => effectivelyWritable(policy.mode, root.access)).map((root) => root.path);
-		const denied = registered.filter((root) => typeof root.recordedPath === "string" && root.recordedPath !== "" && root.recordedPath !== primaryRoot && (capped || !effectivelyWritable(policy.mode, root.access))).map((root) => root.recordedPath);
+		const denied = registered.filter((root) => typeof root.recordedPath === "string" && root.recordedPath !== "" && (capped || !effectivelyWritable(policy.mode, root.access))).map((root) => root.recordedPath);
 		const deniedRoots = [...new Set(denied)];
 		let protectedHome;
 		if (this.dshHome !== void 0 && policy.mode === "danger-full-access" && (deniedRoots.length > 0 || authority === "unavailable")) {
@@ -419,10 +482,9 @@ var MultiRootScopeService = class extends Service {
 	}
 	/** The sanitized members of one primary root, in registry order. */
 	membersOf(primaryRoot) {
-		const key = canonicalPath(primaryRoot);
-		const registered = this.rootsByPrimary.get(key);
+		const registered = this.rootsByPrimary.get(primaryKey(primaryRoot));
 		if (registered === void 0) return [];
-		return sanitizeMembers(key, registered);
+		return sanitizeMembers(canonicalPath(primaryRoot), registered);
 	}
 	/**
 	* Replace the roots registered for one primary root.
@@ -430,11 +492,12 @@ var MultiRootScopeService = class extends Service {
 	* M1 uses this from tests and smoke scripts only; M3 feeds it from plugin
 	* storage. It is a plain setter so the transition swaps the data source
 	* without touching any provider.
-	* @param primaryRoot - canonical primary root to register roots under.
+	* @param primaryRoot - primary root the roots belong to; the Registry key
+	*   is its upstream spelling via {@link primaryKey}, never re-resolved.
 	* @param roots - the additional roots, in display order.
 	*/
 	setAdditionalRoots(primaryRoot, roots) {
-		const key = canonicalPath(primaryRoot);
+		const key = primaryKey(primaryRoot);
 		if (roots.length === 0) this.rootsByPrimary.delete(key);
 		else this.rootsByPrimary.set(key, [...roots]);
 		this.notifySubscribers();

package/lib/skills-utyuvmwr.js

@@ -0,0 +1,104 @@
+import { n as isPackageInstalled } from "./agent-instructions-BXuKhOzr.js";
+//#region \0@oxc-project+runtime@0.149.0/helpers/esm/usingCtx.js
+function _usingCtx() {
+	var r = "function" == typeof SuppressedError ? SuppressedError : function(r, e) {
+		var n = Error();
+		return n.name = "SuppressedError", n.error = r, n.suppressed = e, n;
+	}, e = {}, n = [];
+	function using(r, e) {
+		if (null != e) {
+			if (Object(e) !== e) throw new TypeError("using declarations can only be used with objects, functions, null, or undefined.");
+			if (r) var o = e[Symbol.asyncDispose || Symbol["for"]("Symbol.asyncDispose")];
+			if (void 0 === o && (o = e[Symbol.dispose || Symbol["for"]("Symbol.dispose")], r)) var t = o;
+			if ("function" != typeof o) throw new TypeError("Object is not disposable.");
+			t && (o = function o() {
+				try {
+					t.call(e);
+				} catch (r) {
+					return Promise.reject(r);
+				}
+			}), n.push({
+				v: e,
+				d: o,
+				a: r
+			});
+		} else r && n.push({
+			d: e,
+			a: r
+		});
+		return e;
+	}
+	return {
+		e,
+		u: using.bind(null, !1),
+		a: using.bind(null, !0),
+		d: function d() {
+			var o, t = this.e, s = 0;
+			function next() {
+				for (; o = n.pop();) try {
+					if (!o.a && 1 === s) return s = 0, n.push(o), Promise.resolve().then(next);
+					if (o.d) {
+						var r = o.d.call(o.v);
+						if (o.a) return s |= 2, Promise.resolve(r).then(next, err);
+					} else s |= 1;
+				} catch (r) {
+					return err(r);
+				}
+				if (1 === s) return t !== e ? Promise.reject(t) : Promise.resolve();
+				if (t !== e) throw t;
+			}
+			function err(n) {
+				return t = t !== e ? new r(n, t) : n, next();
+			}
+			return next();
+		}
+	};
+}
+//#endregion
+//#region src/compat/skills.ts
+/** Never infer authority from cwd, a preset key, or a lookalike Agent. */
+function skillAgent(ctx, options) {
+	const scope = options.scope;
+	if (typeof scope !== "object" || scope === null || !("id" in scope) || typeof scope.id !== "string") return void 0;
+	const agent = ctx.get("agents")?.get(scope.id);
+	return agent === scope ? agent : void 0;
+}
+function skillOrigin(ctx, options) {
+	const cwd = skillAgent(ctx, options)?.session.header.cwd;
+	return typeof cwd === "string" && cwd !== "" ? cwd : void 0;
+}
+/** Absence is optional; a present but broken module must fail visibly. */
+async function filesystemSkillsApi() {
+	if (!isPackageInstalled("@deepseek-ai/dsh-skill-filesystem")) return void 0;
+	const api = await import("@deepseek-ai/dsh-skill-filesystem");
+	if (typeof api.FileSystemSkillProvider !== "function") throw new Error("multi-root skills: FileSystemSkillProvider is unavailable");
+	return api;
+}
+function volatileField(schema) {
+	const method = schema.volatile;
+	return typeof method === "function" ? method.call(schema) : schema;
+}
+function configValue(value) {
+	if (typeof value === "object" && value !== null && Symbol.for("cosmokit.volatile.write") in value) {
+		const get = value.get;
+		if (typeof get === "function") return get.call(value);
+	}
+	return value;
+}
+/** Cold Browser Catalog supplies a Session header, never a fabricated Agent. */
+async function observedSkillOrigin(ctx, sessionId) {
+	try {
+		var _usingCtx$1 = _usingCtx();
+		const query = ctx.get("sessionQuery");
+		if (query === void 0) throw new Error("multi-root skills: SessionQuery is unavailable");
+		const cwd = _usingCtx$1.u(await query.observeSession(sessionId)).header.cwd;
+		if (typeof cwd !== "string" || cwd === "") throw new Error("multi-root skills: Session has no origin");
+		return cwd;
+	} catch (_) {
+		_usingCtx$1.e = _;
+	} finally {
+		_usingCtx$1.d();
+	}
+}
+//#endregion
+export { skillOrigin as a, skillAgent as i, filesystemSkillsApi as n, volatileField as o, observedSkillOrigin as r, configValue as t };