@dsh-electron/dsh-plugin-multi-root-workspace 0.1.13 → 0.1.15

package/lib/types/compat/instruction-activity.d.ts

@@ -9,9 +9,40 @@ export type FileActivity = {
     failed: boolean;
 };
 export declare function ptcFileActivity(event: unknown): FileActivity | undefined;
+export declare function stableOpsJson(value: unknown): string;
+export declare const opsActivityEvidenceKey: (kind: "native" | "ptc", id: string, name: string, args: unknown) => string;
+export interface OpsActivityEvidence {
+    readonly targets: readonly OpsFileTarget[];
+    readonly complete: boolean;
+}
 /** Rebuild read-only discovery candidates from successful durable activity after resume. */
-export declare function replayedInstructionTargets(events: readonly unknown[], origin: string | undefined): readonly string[];
+export declare function replayedInstructionTargets(events: readonly unknown[], origin: string | undefined, liveOpsEvidence?: ReadonlyMap<string, OpsActivityEvidence>, pendingExec?: {
+    readonly callId: string;
+    readonly name: string;
+    readonly arguments: unknown;
+    readonly parent?: unknown;
+}, options?: {
+    readonly opsCompatibility?: boolean;
+}): readonly string[];
 /** fs tools whose success touches the file at their `file_path` argument. */
 export declare const FILE_TOUCH_TOOL_NAMES: Record<string, true>;
 /** One explicit fs-tool target, shared with live touch capture. */
 export declare function touchedPathOfToolCall(name: string, argumentsJson: string): string | undefined;
+export interface OpsFileActivityInput {
+    name: string;
+    args: unknown;
+    cwd: string | undefined;
+    finalValue: unknown;
+    observedPaths: readonly string[];
+    isError?: boolean;
+}
+export interface OpsFileTarget {
+    path: string;
+    kind: 'read' | 'write' | 'remove';
+}
+export interface OpsFileActivity {
+    targets: readonly OpsFileTarget[];
+    complete: boolean;
+}
+export declare function normalizeOpsFileActivity(input: OpsFileActivityInput): OpsFileActivity;
+export declare function pendingInstructionTargets(name: string, args: unknown): readonly string[];

package/lib/types/compat/koffi.d.ts

@@ -0,0 +1,2 @@
+export type Koffi = (typeof import('koffi'))['default'];
+export declare function loadHostKoffi(): Promise<Koffi>;

package/lib/types/compat/ops-confirmation.d.ts

@@ -0,0 +1,17 @@
+/** Keep the optional host confirmation component behind a structural probe. */
+import type { ComponentType } from 'react';
+export interface OpsConfirmationProps {
+    open: boolean;
+    title: string;
+    description: string;
+    acknowledgeLabel: string;
+    cancelLabel: string;
+    closeLabel: string;
+    confirmLabel: string;
+    acknowledged: boolean;
+    disabled?: boolean;
+    onAcknowledgedChange(value: boolean): void;
+    onCancel(): void;
+    onConfirm(): void;
+}
+export declare function opsRiskConfirmation(): ComponentType<OpsConfirmationProps> | undefined;

package/lib/types/compat/ops-settings.d.ts

@@ -0,0 +1,11 @@
+import type { Context, Fiber } from '@deepseek-ai/cordis';
+export declare const OPS_SETTINGS_ID = "multi-root-ops-compatibility";
+/** Product availability policy, independent of structural Settings adaptation. */
+export declare function opsCompatibilityRelease(release: string | undefined): boolean;
+/** Unsupported hosts retain the config input but expose no editable live field. */
+export declare function opsCompatibilityField<S>(schema: S): S;
+export declare function installOpsCompatibilitySettings(ctx: Context, initial: () => unknown, changed: () => void): {
+    read(): unknown;
+    fiber: Fiber;
+};
+export declare function opsCompatibilityToken(ctx: Context): object | undefined;

package/lib/types/compat/ops-tools.d.ts

@@ -0,0 +1,25 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { MultiRootScopeService } from '../scope.ts';
+import type { ToolCaller } from './tool-context.ts';
+export declare const OPS_TOOL_PREFIX = "ops_";
+export declare const OPS_EXEC_NAMES: readonly string[];
+export type OpsToolKind = 'exec' | 'publish' | 'unknown' | 'other';
+export declare function classifyOpsTool(name: string): OpsToolKind;
+export interface OpsProtectionState {
+    owner: object | undefined;
+    entered: number;
+    readonly drainWaiters: Set<() => void>;
+}
+export declare function withOpsSpawnPermit<T>(state: OpsProtectionState, body: () => T): T;
+export declare function opsSpawnPermitted(state: OpsProtectionState): boolean;
+export declare function createOpsProtectionState(): OpsProtectionState;
+export declare function claimOpsProtection(state: OpsProtectionState): object;
+export declare function revokeOpsProtection(state: OpsProtectionState, token: object): void;
+export declare function opsProtectionReady(state: OpsProtectionState): boolean;
+export declare function assertOpsProtectionReady(state: OpsProtectionState): void;
+export declare function assertOpsProtectionOwner(state: OpsProtectionState, token: object): void;
+export declare function enterOpsProtection(state: OpsProtectionState): object;
+export declare function leaveOpsProtection(state: OpsProtectionState): void;
+export declare function drainOpsProtection(state: OpsProtectionState): Promise<void>;
+export declare function assertOpsPosixCacheAdmission(deniedRoots: readonly string[]): void;
+export declare function opsDispatchBarrier(ctx: Context, scope: MultiRootScopeService, exec: ToolCaller): string | undefined;

package/lib/types/compat/skills-client.d.ts

@@ -16,6 +16,7 @@ export interface SkillsForm {
         value: boolean;
     }[], revision?: number): Promise<boolean>;
 }
+export declare function bindSettingsForm(ctx: Context, entryId: string): SkillsForm | undefined;
 export declare function bindSkillsForm(ctx: Context): SkillsForm | undefined;
 export declare function clientInject(ctx: Context, services: string[], callback: (scope: Context) => void | (() => void)): void;
 export interface NamespaceRule {

package/lib/types/compat/tool-context.d.ts

@@ -5,5 +5,9 @@ export interface ToolCaller {
     readonly agent?: Agent;
     readonly callId: string;
     readonly name: string;
+    readonly arguments?: unknown;
+    readonly signal?: AbortSignal;
+    readonly parent?: unknown;
+    readonly token?: object;
 }
 export declare function aroundTool(ctx: Context, listener: (exec: ToolCaller, next: () => Promise<unknown>) => Promise<unknown>): void;

package/lib/types/compat.d.ts

@@ -57,8 +57,8 @@ export declare class DshCompatUnsupportedError extends Error {
  * `./compat/` detect the shape they need STRUCTURALLY — whether a return value
  * is a thenable, which export name a module carries — because a structural
  * probe also survives upstream reshaping something within one release, while a
- * version comparison does not. The release string here is for the gate and for
- * diagnostics.
+ * version comparison does not. The release string here is for installation and
+ * feature-availability gates (such as the OPS 0.2.* policy), and diagnostics.
  */
 export declare class MultiRootCompatService extends Service {
     /** The verdict this composition started under. */

package/lib/types/fs.d.ts

@@ -4,7 +4,7 @@
  * It extends the local backend so every text-storage mechanic — resolve, stat,
  * read/stream, listing, the atomic write and the read-match-write edit critical
  * section — stays the upstream implementation's, verbatim; this class adds only
- * the per-call POLICY fence on the two mutations, exactly as the upstream
+ * the per-call POLICY fence on mutations, exactly as the upstream
  * `SandboxedFileSystem` does, widened from one workspace root to the scope's
  * root set.
  *
@@ -64,6 +64,8 @@ export declare class MultiRootFileSystem extends LocalFileSystem {
     editText(target: FsTarget, edit: FsEditRequest, expected?: {
         version: FsVersion;
     }, signal?: AbortSignal, sandboxPolicy?: SandboxExecutionPolicy): Promise<FsEditOutcome>;
+    /** Fence every endpoint of a patch, delete, or move under one admission. */
+    private additionalMutation;
     /** The provider must also work without the gated registry (ADR-0009). */
     private withOperation;
     /**

package/lib/types/instructions.d.ts

@@ -4,7 +4,12 @@ declare module '@deepseek-ai/cordis' {
     interface Context {
         multiRootInstructions: {
             knownRoots(session: object): readonly string[];
-            snapshot(agent: Agent, roots: readonly string[], target: string | undefined, signal: AbortSignal): Promise<readonly CurrentRootInstruction[]>;
+            snapshot(agent: Agent, roots: readonly string[], target: string | readonly string[] | undefined, signal: AbortSignal, pending?: {
+                readonly callId: string;
+                readonly name: string;
+                readonly arguments: unknown;
+                readonly parent?: unknown;
+            }): Promise<readonly CurrentRootInstruction[]>;
         };
     }
 }

package/lib/types/ops-compatibility.d.ts

@@ -0,0 +1,34 @@
+import { Service, type Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+export interface Config {
+    readonly enabled?: boolean;
+}
+export declare const Config: z<Schemastery.ObjectS<NoInfer<{
+    enabled: z<boolean, boolean, "defined">;
+}>>, Schemastery.ObjectT<NoInfer<{
+    enabled: z<boolean, boolean, "defined">;
+}>>, "plain">;
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        multiRootOpsCompatibility: MultiRootOpsCompatibility;
+    }
+}
+export declare class MultiRootOpsCompatibility extends Service {
+    private readonly settingsConfig;
+    static Config: z<Schemastery.ObjectS<NoInfer<{
+        enabled: z<boolean, boolean, "defined">;
+    }>>, Schemastery.ObjectT<NoInfer<{
+        enabled: z<boolean, boolean, "defined">;
+    }>>, "plain">;
+    static provide: string;
+    static inject: string[];
+    constructor(ctx: Context, settingsConfig?: Config);
+    private settingsRead;
+    private currentToken;
+    private enabledNow;
+    private closing;
+    get token(): object | undefined;
+    get enabled(): boolean;
+    private sync;
+}
+export default MultiRootOpsCompatibility;

package/lib/types/registry.d.ts

@@ -121,7 +121,12 @@ export type RegistryAuthorityState = {
 export interface Config {
     /** Absolute path of the store-wide kernel lock file. */
     readonly leasePath?: string;
-    /** Explicit medium binding for the multi-Host authority service. */
+    /**
+     * Medium binding for the multi-Host authority service — REQUIRED since the
+     * single-process mode was removed (ADR-0028). Absent or empty puts the
+     * registry in the fail-closed `config-invalid` state: no lease, no domain,
+     * no grants.
+     */
     readonly sharedStorageRoot?: string;
     /**
      * Cap on STORED additional-root records per primary root (every state
@@ -281,8 +286,15 @@ export declare class MultiRootRegistry extends Service {
     /** Keys already warned about a historical over-limit store (one warning each). */
     private readonly warnedOverLimit;
     /**
-     * @param ctx - the host context; `storageDomain` and `multiRootScope` are injected.
-     * @param config - the patch row's `leasePath` and `maxAdditionalRoots`.
+     * The canonical value each protected boundary resolved to the FIRST time it
+     * could be computed, keyed by boundary kind. Never re-pinned: a later
+     * rename or symlink swap of the DSH home (or of the lease directory) must
+     * not drop the boundary the registration rules were enforced under.
+     */
+    private readonly pinnedProtectedPaths;
+    /**
+     * @param ctx - the host context; `storage` and `multiRootScope` are injected.
+     * @param config - the patch row's `sharedStorageRoot`, `leasePath`, and `maxAdditionalRoots`.
      */
     constructor(ctx: Context, config?: Config);
     /**
@@ -379,6 +391,44 @@ export declare class MultiRootRegistry extends Service {
      */
     withOperation<T>(policy: SandboxExecutionPolicy, kind: RegistryOperationKind, body: (operation: RegistryOperation) => T | Promise<T>): Promise<T>;
     withPrimaryOperation<T>(policy: SandboxExecutionPolicy, body: () => T): T;
+    /**
+     * The spellings one protected boundary contributes: the configured path,
+     * its current canonical resolution, and the canonical value pinned the
+     * first time it resolved — never re-pinned, so a later rename or symlink
+     * swap of the protected directory cannot drop the boundary the
+     * registration rules were enforced under. The list is deduplicated by
+     * {@link samePath}.
+     */
+    private boundarySpellings;
+    /**
+     * The best-known protected-boundary set, plus whether it is COMPLETE.
+     *
+     * The set comes from trusted host configuration, never from a panel or
+     * shell claim: the scope row's `dshHome`, the physical medium
+     * `storeIdentity` bound, and the lease directory beside it.
+     * `complete` is false — and only NEW grants may then be refused — when a
+     * boundary cannot be proven: an invalid `dshHome` config, a configured
+     * home that is not a directory right now, or a medium that was never bound. Stored classification always consumes whatever IS known
+     * (pinned values included), so an unknown boundary never weakens the
+     * revalidation of existing records.
+     */
+    private protectedBoundarySet;
+    /**
+     * The protected DSH directories this Host can prove right now, or
+     * `undefined` when the set cannot be proven. `undefined` blocks every NEW
+     * grant; it never weakens the classification of stored records.
+     */
+    private protectedPaths;
+    /**
+     * Every protected entry this Host can prove — used wherever a partial set
+     * must still protect stored records and received snapshots.
+     */
+    private knownProtectedPaths;
+    /**
+     * The one refusal shared by the owner mutation path and the follower
+     * pre-check: the protected set cannot be proven, so no new grant is safe.
+     */
+    private static protectedBoundaryUnknown;
     /**
      * Registers one additional root.
      * @param primaryRoot - the session workspace root the root belongs to.
@@ -463,7 +513,7 @@ export declare class MultiRootRegistry extends Service {
     recheck(primaryRoot: string): Promise<readonly RootStatus[]>;
     /**
      * Observe registry changes.
-     * @param listener - called with the canonical primary root after each durable change.
+     * @param listener - called with the Registry key (`primaryKey()`, case-folded on Windows) after each durable change.
      * @returns the disposer that stops observing.
      */
     onChange(listener: (primaryRoot: string) => void): () => void;
@@ -495,10 +545,17 @@ export declare class MultiRootRegistry extends Service {
      */
     private statusesOf;
     /**
-     * The stored record set of one key, or `undefined` when there is none (or
-     * when the store itself could not be read: an unusable store reads as
-     * "nothing registered" so reads stay answerable and the surfaces can explain
-     * the situation, while every write fails loudly in `requireTable()`).
+     * The stored record set of one key: `{ record, migrated: false }` when the
+     * spelling key holds it; `{ record, migrated: true }` when only the legacy
+     * CANONICAL key does — stores written before the upstream primary spelling
+     * became the key (v0.1.14 and earlier). The fallback follows the CURRENT
+     * resolution ONLY for such a not-yet-migrated store; the first serialized
+     * access copies the record forward under the spelling key (see
+     * {@link reclassify}), after which resolution can never re-key a grant.
+     * `undefined` when there is no record (or when the store itself could not
+     * be read: an unusable store reads as "nothing registered" so reads stay
+     * answerable and the surfaces can explain the situation, while every write
+     * fails loudly in `requireTable()`).
      */
     private lookupRecords;
     /**
@@ -562,6 +619,8 @@ export declare class MultiRootRegistry extends Service {
     private commit;
     /** Deliver one key's notifications now, or collect them inside a commit. */
     private deliverNotifications;
+    /** Narrow owner rows for this Host, identically for projection and admission. */
+    private localSnapshotRoots;
     private applySnapshot;
     private remoteUnavailable;
     /**

package/lib/types/review-context.d.ts

@@ -8,8 +8,10 @@ declare module '@deepseek-ai/cordis' {
 }
 export interface ReviewExecution {
     readonly agent?: Agent;
+    readonly callId?: string;
     readonly name: string;
     readonly arguments: unknown;
+    readonly parent?: unknown;
 }
 export interface ReviewContext {
     readonly schemaVersion: 1;

package/lib/types/roots.d.ts

@@ -14,15 +14,21 @@
  *    misconfiguration, not a path to guess at.
  * 2. `missing` — the directory does not exist.
  * 3. `not-a-directory` — it exists but is not a directory.
- * 4. `equals-primary` — the canonical candidate IS the session's workspace
+ * 4. `protected-path` — the canonical candidate equals, lies inside, or
+ *    contains a protected DSH directory (the DSH home, the registry's
+ *    physical storage medium, or the lease directory, supplied through
+ *    {@link RootCandidateContext.protectedPaths}): those hold the store,
+ *    the lease, profiles and user credentials, so no access level may
+ *    register them. Applies to every mode; no remote exemption exists.
+ * 5. `equals-primary` — the canonical candidate IS the session's workspace
  *    root, which is already granted by the upstream policy.
- * 5. `primary-overlap` — the candidate lies under the workspace root, or
+ * 6. `primary-overlap` — the candidate lies under the workspace root, or
  *    contains it. The union grants nothing new, and the displayed list would
  *    stop matching the enforced root set.
- * 6. `duplicate` — another registered root canonicalizes to the same path.
- * 7. `nested` — the candidate lies under a registered root, or contains one.
- *    Same reasoning as rule 5, applied to the additional roots.
- * 8. `unsupported-path` — on Windows, a network or device path (`\\server`,
+ * 7. `duplicate` — another registered root canonicalizes to the same path.
+ * 8. `nested` — the candidate lies under a registered root, or contains one.
+ *    Same reasoning as rule 6, applied to the additional roots.
+ * 9. `unsupported-path` — on Windows, a network or device path (`\\server`,
  *    `\\?\…`, `\\.\…`): the ACL confinement cannot be shown to cover it, so it
  *    is rejected lexically before any filesystem touch.
  *
@@ -67,6 +73,23 @@ export declare function additionalRootId(value: string): AdditionalRootId;
  *   `read-only` session; it does not widen anything beyond its own directory.
  */
 export type RootAccess = 'inherit' | 'read-write' | 'read-only';
+/**
+ * Which protected DSH directory one boundary belongs to: the harness home
+ * (`$DSH_HOME`), the registry's physical storage medium, or the directory the
+ * store-wide lease occupies.
+ */
+export type ProtectedPathKind = 'dsh-home' | 'registry-medium' | 'registry-lease';
+/**
+ * One directory no additional root may equal, lie inside, or contain. `path`
+ * is an absolute spelling — the configured one, the current canonical one, or
+ * a canonical value pinned the first time the boundary resolved — and is
+ * compared with {@link samePath}/{@link isCanonicallyUnder} exactly like
+ * every other boundary in this module.
+ */
+export interface ProtectedPath {
+    readonly kind: ProtectedPathKind;
+    readonly path: string;
+}
 /** One registered additional root exactly as it is persisted. */
 export interface RegisteredRoot {
     /** Stable registry identity. */
@@ -139,13 +162,20 @@ export interface RootStatus extends RegisteredRoot {
      *
      * `'membership-conflict'` means the record passed every structural rule —
      * including an intact, absolute recorded grant — but its recorded boundary
-     * overlaps another record's. Neither membership may be granted while the
-     * conflict stands, yet the boundary remains a trustworthy negative
-     * restriction, so {@link reservedRootBoundary} keeps it reserved and the
-     * registry publishes the root as a withheld, deny-only entry. Every other
-     * `invalid` verdict left the grant unverifiable, so it contributes nothing.
+     * overlaps another record's. `'protected-path'` means that same intact
+     * grant overlaps a protected DSH directory (the home, the storage medium,
+     * or the lease directory) — typically a store written before the boundary
+     * existed or on another layout. `'primary-overlap'` means the intact grant
+     * equals or overlaps the CURRENT canonical primary root — e.g. a primary
+     * spelling retargeted onto (or above) a read-only root — which withholds
+     * membership but must never drop the deny. All three reasons mean the same
+     * thing: the boundary is intact and trustworthy, so
+     * {@link reservedRootBoundary} keeps it reserved and the registry
+     * publishes the root as a withheld, deny-only entry — only the membership
+     * is withheld. Every other `invalid` verdict left the grant unverifiable,
+     * so it contributes nothing.
      */
-    readonly invalidReason?: 'membership-conflict';
+    readonly invalidReason?: 'membership-conflict' | 'protected-path' | 'primary-overlap';
 }
 /** One status together with the 1-based ordinal the surfaces accept for it. */
 export interface IndexedRootStatus {
@@ -172,7 +202,7 @@ export type RootRef = {
     readonly addedAt: string;
 };
 /** Every way root handling can fail, as a stable code the surfaces localize. */
-export type RootValidationCode = 'not-absolute' | 'missing' | 'not-a-directory' | 'equals-primary' | 'primary-overlap' | 'duplicate' | 'nested' | 'invalid-alias' | 'invalid-alias-id' | 'not-found' | 'invalid-ref' | 'storage-unavailable' | 'registry-contended' | 'root-limit-reached' | 'config-invalid' | 'reveal-unavailable' | 'session-not-found' | 'unsupported-path' | 'root-unavailable';
+export type RootValidationCode = 'not-absolute' | 'missing' | 'not-a-directory' | 'equals-primary' | 'primary-overlap' | 'duplicate' | 'nested' | 'invalid-alias' | 'invalid-alias-id' | 'not-found' | 'invalid-ref' | 'storage-unavailable' | 'registry-contended' | 'root-limit-reached' | 'config-invalid' | 'reveal-unavailable' | 'session-not-found' | 'unsupported-path' | 'root-unavailable' | 'protected-path' | 'protected-boundary-unknown' | 'revive-target-changed';
 /** A rejected root operation; `code` is the stable contract, `message` the fallback prose. */
 export declare class RootValidationError extends Error {
     readonly code: RootValidationCode;
@@ -200,6 +230,21 @@ export declare class RootValidationError extends Error {
  * @returns the expanded path (still unvalidated).
  */
 export declare function expandRootInput(raw: string, home?: string): string;
+/**
+ * The Registry/scope lookup key of one primary root: the UPSTREAM spelling,
+ * normalized lexically by `path.resolve` and case-folded on Windows — never
+ * re-resolved. Upstream `dsh-sandbox-policy` sets `policy.workspaceRoot` to
+ * `session.header.cwd` verbatim, so the spelling IS the identity: a symlinked
+ * workspace and its realpath target are different sessions and different key
+ * spaces. Re-resolving here would let a replaced workspace directory
+ * silently re-key the record set onto another identity — the exact failure
+ * the redirect rules exist to prevent. This is the ONLY function allowed to
+ * turn a primary root into a Registry key; path geometry keeps using
+ * {@link canonicalRoot}.
+ */
+export declare function primaryKey(path: string, platform?: NodeJS.Platform): string;
+/** Whether two canonical paths name the same directory on this platform. */
+export declare function samePath(left: string, right: string): boolean;
 /**
  * Whether `candidate` is `root` itself or lies beneath it. Both sides must
  * already be canonical: symlinks are resolved by then, so the lexical test is
@@ -242,6 +287,15 @@ export interface RootCandidateContext {
      * revived exempts only itself.
      */
     readonly existing: readonly string[];
+    /**
+     * The protected DSH directories — the home, the registry's storage medium,
+     * and the lease directory — that no candidate may equal, lie inside, or
+     * contain, at any access level and under any mode. Derived from the trusted
+     * host configuration by the registry; absent means "no protected set was
+     * provided" and is never a substitute for the boundary being unprovable
+     * (the caller refuses that case itself with `protected-boundary-unknown`).
+     */
+    readonly protectedPaths?: readonly ProtectedPath[];
 }
 /**
  * Judge one candidate root and return its canonical spelling.
@@ -251,6 +305,16 @@ export interface RootCandidateContext {
  * @throws {RootValidationError} with the first rule that failed.
  */
 export declare function validateRootCandidate(raw: string, context: RootCandidateContext): string;
+/**
+ * The first protected directory `candidate` overlaps — equals, lies inside,
+ * or contains. Both sides must already be canonical (or absolute boundary
+ * spellings): the comparison is the same lexical three-way test the other
+ * boundary rules use, so a symlink alias can never route around it.
+ * @param candidate - the canonical candidate or recorded grant to test.
+ * @param protectedPaths - the protected DSH directories.
+ * @returns the overlapping protected path, or `undefined`.
+ */
+export declare function protectedOverlap(candidate: string, protectedPaths: readonly ProtectedPath[]): ProtectedPath | undefined;
 /**
  * Re-judge every stored record of one primary root — the startup and refresh
  * path, which must never throw: a registration that stopped being usable is
@@ -262,26 +326,56 @@ export declare function validateRootCandidate(raw: string, context: RootCandidat
  * @param primaryRoot - the session workspace root the records belong to.
  * @param records - the stored records, in registry order.
  * @param platform - the platform the rules run for; defaults to `process.platform`.
+ * @param protectedPaths - the protected DSH directories a stored grant may not
+ *   overlap; a record that does is reported `invalid` with
+ *   `invalidReason: 'protected-path'` — withheld, never deleted, never re-granted.
  * @returns one status per record, in the same order.
  */
-export declare function classifyStoredRoots(primaryRoot: string, records: readonly RegisteredRoot[], platform?: NodeJS.Platform): RootStatus[];
+export declare function classifyStoredRoots(primaryRoot: string, records: readonly RegisteredRoot[], platform?: NodeJS.Platform, protectedPaths?: readonly ProtectedPath[]): RootStatus[];
+/**
+ * The single recorded grant a record or status carries — `undefined` unless
+ * EXACTLY one grant field holds a non-empty string. Shared by the conflict
+ * pass and {@link reservedRootBoundary}; the stored decoder is the source of
+ * the access level, so this never cross-checks the field against `access`.
+ */
+export declare function singleGrantOf(record: {
+    readonly recordedPath?: string;
+    readonly readOnlyRecordedPath?: string;
+    readonly readWriteRecordedPath?: string;
+}): string | undefined;
 /**
  * The canonical roots a status list grants, in registry order.
  * @param statuses - the statuses to project.
  * @returns the canonical paths of every `available` root.
  */
 export declare function availableRoots(statuses: readonly RootStatus[]): string[];
+/**
+ * Apply the protected-path verdict to an already-classified list: a status
+ * whose recorded grant overlaps a protected directory becomes `invalid` with
+ * `invalidReason: 'protected-path'` — the same verdict the pass-one stored
+ * check produces, here applied by a consumer that classified elsewhere (a
+ * shared-registry follower re-judging an owner snapshot against ITS OWN
+ * protected set, which may differ from the owner's). Statuses already
+ * `invalid` keep their own verdict — a structural failure is never healed
+ * into a trustworthy boundary.
+ * @param statuses - the classified statuses to re-mark.
+ * @param protectedPaths - the caller's own protected DSH directories.
+ * @returns a new list with the verdict applied.
+ */
+export declare function markProtectedPaths(statuses: readonly RootStatus[], protectedPaths: readonly ProtectedPath[]): RootStatus[];
 /**
  * The recorded boundary one status still RESERVES: the grant it was
  * registered for, which a new or revived registration may not overlap merely
  * because the root is currently unusable.
  *
- * `available`, `missing`, `redirected`, and membership-conflict statuses all
- * carry an intact, trustworthy recorded grant; every other `invalid` verdict
- * means the grant could not be parsed at all, so it reserves — and denies —
- * nothing. This is not an independent authorization table: it derives the
- * boundary from the status list {@link classifyStoredRoots} produced, with
- * the same grant-extraction semantics, so its answer can never disagree with
+ * `available`, `missing`, `redirected`, and the trustworthy-boundary
+ * `invalid` verdicts (`membership-conflict`, `protected-path`, and
+ * `primary-overlap`) all carry
+ * an intact recorded grant; every other `invalid` verdict means the grant
+ * could not be parsed at all, so it reserves — and denies — nothing. This is
+ * not an independent authorization table: it derives the boundary from the
+ * status list {@link classifyStoredRoots} produced, with the same
+ * grant-extraction semantics, so its answer can never disagree with
  * classification.
  * @param status - one classified registration.
  * @returns the absolute recorded boundary, or `undefined` when there is none.

package/lib/types/scope.d.ts

@@ -17,7 +17,8 @@
  */
 import { Context, Service } from '@deepseek-ai/cordis';
 import type { SandboxExecutionPolicy, SandboxMode } from '@deepseek-ai/dsh-sandbox';
-import type { RootAccess } from './roots.ts';
+import { type RootAccess } from './roots.ts';
+import type { OpsProtectionState } from './compat/ops-tools.ts';
 declare module '@deepseek-ai/cordis' {
     interface Context {
         multiRootScope: MultiRootScopeService;
@@ -210,6 +211,7 @@ export declare class MultiRootScopeService extends Service {
     private readonly listeners;
     /** Enclosing {@link MultiRootScopeService.batch} depth; inner calls nest. */
     private batchDepth;
+    readonly opsProtection: OpsProtectionState;
     /** True when a batched write coalesced its notification into the flush. */
     private batchDirty;
     private admissionProof;
@@ -233,6 +235,13 @@ export declare class MultiRootScopeService extends Service {
      * treated as evidence.
      */
     private readonly dshHome;
+    /**
+     * Whether the row carried a `dshHome` value at all — even an invalid one.
+     * The registry's protected-boundary set must tell "no home configured"
+     * (absent: nothing to protect) from "a home was supplied and rejected"
+     * (invalid: the boundary cannot be proven).
+     */
+    private readonly dshHomeSupplied;
     /** Observe registry publications; consumers still resolve authority from scopeOf(). */
     subscribe(listener: () => void): () => void;
     /**
@@ -257,6 +266,21 @@ export declare class MultiRootScopeService extends Service {
     toolCaps(): readonly string[];
     /** Whether malformed toolAccess caps every call, including unknown tools. */
     get toolAccessInvalid(): boolean;
+    /**
+     * The validated `dshHome` row config, classified for the registry's
+     * protected-boundary set: `absent` when the row carried no value (nothing
+     * to protect), `invalid` when it carried a value the constructor rejected
+     * (the boundary cannot be proven), `configured` with the accepted absolute
+     * path. Read-only — this changes no scope or `protectedHome` semantics.
+     */
+    get dshHomeConfig(): {
+        readonly kind: 'absent';
+    } | {
+        readonly kind: 'invalid';
+    } | {
+        readonly kind: 'configured';
+        readonly path: string;
+    };
     constructor(ctx: Context, config?: Config);
     /**
      * Resolve the scope of one confined call.
@@ -275,6 +299,7 @@ export declare class MultiRootScopeService extends Service {
     resolve(policy: SandboxExecutionPolicy): FilesystemScope;
     /** Read-only pending-dispatch projection. Does not mint an ALS execution grant. */
     previewForTool(policy: SandboxExecutionPolicy, toolName: string): FilesystemScope;
+    withToolCap<T>(name: string, fn: () => T): T;
     /** Execution and review use exactly the same parent-narrowing rule. */
     private capForTool;
     private project;
@@ -324,7 +349,8 @@ export declare class MultiRootScopeService extends Service {
      * M1 uses this from tests and smoke scripts only; M3 feeds it from plugin
      * storage. It is a plain setter so the transition swaps the data source
      * without touching any provider.
-     * @param primaryRoot - canonical primary root to register roots under.
+     * @param primaryRoot - primary root the roots belong to; the Registry key
+     *   is its upstream spelling via {@link primaryKey}, never re-resolved.
      * @param roots - the additional roots, in display order.
      */
     setAdditionalRoots(primaryRoot: string, roots: readonly AdditionalWorkspaceRoot[]): void;

package/lib/workspace-files.js

@@ -1,7 +1,7 @@
-import { t as wrapMethod } from "./method-wrapper-CFY3p3j2.js";
+import { t as wrapMethod } from "./method-wrapper-D4oUCsEF.js";
 import { c as withRegistryRead } from "./registry-operation-C2ZV3Jhw.js";
-import { l as isCanonicallyUnder } from "./roots-Ca_W1S9n.js";
-import { t as routeWorkspacePath } from "./workspace-routing-YPxaQ4V3.js";
+import { l as isCanonicallyUnder } from "./roots-CmaWxRVy.js";
+import { t as routeWorkspacePath } from "./workspace-routing-D_qwMUh-.js";
 import { posix, resolve, win32 } from "node:path";
 //#region src/compat/workspace-files.ts
 function adaptPathWatch(service, wrap) {