@dsh-electron/dsh-plugin-multi-root-workspace 0.1.13 → 0.1.15

package/lib/{compat-Bg2HFVMX.js → dsh-version-DCwF7REk.js}

@@ -1,7 +1,6 @@
 import { createRequire } from "node:module";
-import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { dirname, join, sep } from "node:path";
-import { Service } from "@deepseek-ai/cordis";
 import { fileURLToPath } from "node:url";
 //#region src/compat/dsh-version.ts
 /**
@@ -54,7 +53,9 @@ const SUPPORTED_DSH_RELEASES = [
 	"0.2.1-rc.3",
 	"0.2.1-rc.4",
 	"0.2.1-rc.5",
-	"0.2.2-alpha.2"
+	"0.2.2-alpha.2",
+	"0.2.2-alpha.3",
+	"0.2.2-rc.1"
 ];
 /**
 * Packages whose absence means this plugin cannot function at all: every one of
@@ -352,265 +353,4 @@ function report(verdict, release, packages, lines) {
 	};
 }
 //#endregion
-//#region src/compat/pty-marker.ts
-/**
-* Boot-time probe for the agent-PTY marker contract.
-*
-* `multi-root-process-fence` tells an agent terminal from the user's own by
-* one env fact: every supported `dsh-terminal-bash` backend stamps
-* `DSH_PTY_SESSION_ID` (alongside `DSH_SESSION_ID`) into the PTY spawn spec,
-* while the panel's terminal controller stamps only `DSH_SESSION_ID`. That
-* marker is the ONLY discriminator — a backend that ever stops stamping it
-* would reclassify agent PTYs as user terminals and pass them through
-* unconfined under a restricted `danger-full-access`, which is a silent
-* fail-open on a security boundary.
-*
-* The marker is an env key inside upstream's emitted code, not an exported
-* symbol, so the honest structural probe is content: the installed backend
-* package must still write the marker. This module is called from the
-* `multi-root-compat` gate (`src/compat.ts`) BEFORE the service registers —
-* like the version verdict it is a precondition, not a diagnostic, and a
-* breach refuses the composition the same way `mixed`/`incomplete` do: it is
-* not relaxable by `DSH_MULTI_ROOT_COMPAT=warn`.
-*
-* Resolution follows the optional-peer precedent (`agent-instructions.ts`):
-* the backend is not a peer of this plugin, so the plugin anchor is tried
-* first (flat layouts) and the `@deepseek-ai/dsh` host anchor second — the
-* same host-anchor fallback pattern as `dsh-version.ts` — because the
-* backend rides inside the harness meta package's own dependency tree.
-*
-* @module @dsh-electron/dsh-plugin-multi-root-workspace/compat/pty-marker
-*/
-/** The env key that identifies an agent-launched PTY spawn spec. */
-const AGENT_PTY_MARKER = "DSH_PTY_SESSION_ID";
-/** The upstream package whose backend owns the marker stamp. */
-const TERMINAL_BACKEND = "@deepseek-ai/dsh-terminal-bash";
-/** The harness meta package the backend rides inside (its dependency). */
-const HOST_ANCHOR = "@deepseek-ai/dsh/package.json";
-/** Scan budget: enough for any plausible backend layout, bounded forever. */
-const MAX_SOURCE_FILES = 256;
-const MAX_TOTAL_BYTES = 8388608;
-/**
-* Raised when the installed terminal backend does not uphold the marker
-* contract. Thrown from `apply` like `DshCompatUnsupportedError`, so it
-* surfaces as a plugin load failure with the diagnosis attached.
-*/
-var PtyMarkerContractError = class extends Error {
-	/** The resolved backend path when one was found. */
-	backend;
-	constructor(message, backend) {
-		super(message);
-		this.name = "PtyMarkerContractError";
-		this.backend = backend;
-	}
-};
-/**
-* Resolve the backend package root through the two anchors the contract can
-* reach: this module first (flat layouts where the backend is a direct
-* install), then the `@deepseek-ai/dsh` host manifest (pnpm-style layouts
-* where it is the meta package's own dependency — the
-* host-anchor fallback pattern in `dsh-version.ts`). A resolution failure that is not a
-* genuine NOT_FOUND propagates: a resolvable-but-broken specifier is not
-* evidence of absence.
-*/
-function resolveBackendRoot() {
-	const self = createRequire(import.meta.url);
-	const anchors = [self];
-	try {
-		anchors.push(createRequire(self.resolve(HOST_ANCHOR)));
-	} catch (error) {
-		if (!isNotFound(error)) throw error;
-	}
-	for (const anchor of anchors) try {
-		return dirname(anchor.resolve(`${TERMINAL_BACKEND}/package.json`));
-	} catch (error) {
-		if (!isNotFound(error)) throw error;
-	}
-}
-function isNotFound(error) {
-	const code = error?.code;
-	return code === "MODULE_NOT_FOUND" || code === "ERR_MODULE_NOT_FOUND";
-}
-/** Recursively collect `.js` sources under the package root, within budget. */
-function listSources(root) {
-	const files = [];
-	const visit = (dir) => {
-		for (const entry of readdirSync(dir, { withFileTypes: true })) {
-			if (files.length >= MAX_SOURCE_FILES) return;
-			const path = join(dir, entry.name);
-			if (entry.isDirectory() && entry.name !== "node_modules") visit(path);
-			else if (entry.isFile() && entry.name.endsWith(".js")) files.push(path);
-		}
-	};
-	visit(root);
-	return files;
-}
-const defaultIo = {
-	resolveBackendRoot,
-	listSources,
-	read: (path) => readFileSync(path, "utf8")
-};
-/**
-* Judge the installed terminal backend against the marker contract.
-*
-* Never throws: every outcome — absent package, unreadable source, missing
-* marker — is folded into the verdict so the caller's reaction is a policy
-* decision in one place.
-* @param io - filesystem seams; tests inject them, production uses real fs.
-* @returns the verdict.
-*/
-function agentPtyMarkerVerdict(io = defaultIo) {
-	let root;
-	try {
-		root = io.resolveBackendRoot();
-	} catch {
-		return "unverifiable";
-	}
-	if (root === void 0) return "uninstalled";
-	let files;
-	try {
-		files = io.listSources(root);
-	} catch {
-		return "unverifiable";
-	}
-	let remaining = MAX_TOTAL_BYTES;
-	for (const file of files) {
-		let content;
-		try {
-			content = io.read(file);
-		} catch {
-			return "unverifiable";
-		}
-		if (content.length > remaining) return "unverifiable";
-		if (content.includes("DSH_PTY_SESSION_ID")) return "stamped";
-		remaining -= content.length;
-	}
-	return "unverifiable";
-}
-/**
-* Enforce the contract: refuse when the marker cannot be confirmed.
-*
-* @param io - filesystem seams; tests inject them.
-* @throws {PtyMarkerContractError} on `unverifiable`.
-*/
-function assertAgentPtyMarker(io = defaultIo) {
-	if (agentPtyMarkerVerdict(io) !== "unverifiable") return;
-	let backend;
-	try {
-		backend = io.resolveBackendRoot();
-	} catch {}
-	throw new PtyMarkerContractError(`multi-root workspace: the installed ${TERMINAL_BACKEND} does not stamp ${AGENT_PTY_MARKER} on agent PTY spawns, or its sources cannot be verified. That marker is the only fact that separates an agent terminal from the user's own — without it the process fence cannot confine a restricted danger-full-access agent PTY without confining the user's terminal too. The plugin refuses to run rather than let agent terminals pass unconfined. See docs/decisions/ADR-0017-three-state-root-access-and-sandbox-modes.md.`, backend);
-}
-//#endregion
-//#region src/compat.ts
-/**
-* `multi-root-compat`: the startup gate that turns the DSH compatibility
-* contract from documentation into a precondition.
-*
-* Every widened-authority row of this bundle — `multi-root-providers`,
-* `multi-root-registry`, `multi-root-instructions`, `multi-root-lsp`,
-* `multi-root-workspace-files`, `multi-root-process-fence` — injects
-* `multiRootCompat`. Cordis will not start a plugin whose injected service is
-* absent, so this row is what decides whether they run at all:
-*
-* ```text
-* compat check passes  →  ctx.multiRootCompat exists  →  the gated rows start
-* compat check fails   →  the row throws             →  they never start
-* ```
-*
-* The two PROVIDER rows (`multi-root-fs`, `multi-root-sandbox`) deliberately
-* do NOT inject the gate: their widening is scope-driven, and the gated
-* registry can never populate the scope on a refused installation — so they
-* degenerate to the upstream providers. That is what keeps a refused gate a
-* loud degradation (the plugin's features absent, the profile intact) instead
-* of a dead profile: upstream `fs-sandbox`/`sandbox` are already disabled by
-* the patch, so holding `ctx.fs`/`ctx.sandbox` back would take `ctx.shell`,
-* `permissionPresets` and every confining tool down with them.
-*
-* That is why the gate is a plain `apply` and not a `Service` subclass mounted
-* directly: the check has to be able to fail BEFORE the service exists. A
-* `Service` constructor has already run `super(ctx, name)` — and therefore
-* already claimed the service key — by the time it could inspect anything.
-*
-* The verdict itself, and the allowlist it is judged against, live in
-* `./compat/dsh-version.ts`. This module owns only the reaction to it.
-*
-* @module @dsh-electron/dsh-plugin-multi-root-workspace/compat
-*/
-/**
-* Raised when the installed DSH release is not one this plugin is verified
-* against. It is thrown from `apply`, so it surfaces as a plugin load failure
-* with the full diagnosis attached — never as a silently degraded sandbox.
-*/
-var DshCompatUnsupportedError = class extends Error {
-	/** The report that produced the refusal. */
-	report;
-	constructor(report) {
-		super(report.message);
-		this.name = "DshCompatUnsupportedError";
-		this.report = report;
-	}
-};
-/**
-* The `ctx.multiRootCompat` service: the resolved compatibility verdict, held
-* where the gated providers can read it.
-*
-* It intentionally exposes no per-version capability flags. The adapters under
-* `./compat/` detect the shape they need STRUCTURALLY — whether a return value
-* is a thenable, which export name a module carries — because a structural
-* probe also survives upstream reshaping something within one release, while a
-* version comparison does not. The release string here is for the gate and for
-* diagnostics.
-*/
-var MultiRootCompatService = class extends Service {
-	/** The verdict this composition started under. */
-	report;
-	constructor(ctx, report) {
-		super(ctx, "multiRootCompat");
-		this.report = report;
-	}
-	/** The single DSH release every inspected core package agreed on. */
-	get release() {
-		return this.report.release;
-	}
-	/** Whether the installation is on the allowlist. */
-	get supported() {
-		return this.report.verdict === "supported";
-	}
-};
-/** This row needs nothing: it is the thing everything else waits for. */
-const inject = [];
-/**
-* Apply the gate policy to one report.
-*
-* Under `DSH_MULTI_ROOT_COMPAT=warn` exactly one verdict is relaxed: an
-* `unsupported` release that every inspected package agrees on. That is the
-* only shape the upgrade smoke probes — a coherent tree on a release the
-* allowlist does not name yet, which is how a release earns its place there.
-* `mixed` and `incomplete` describe an installation the contract cannot judge
-* at all, so they are refused in either mode; production deployments leave the
-* variable unset and get the refusal for everything.
-* @param report - the verdict to act on.
-* @param enforcement - how to react to a non-`supported` verdict.
-* @returns the warning to log, or `undefined` when there is nothing to say.
-* @throws {DshCompatUnsupportedError} when refusing to run.
-*/
-function assertSupportedInstallation(report, enforcement) {
-	if (report.verdict === "supported") return void 0;
-	if (enforcement === "enforce" || report.verdict !== "unsupported") throw new DshCompatUnsupportedError(report);
-	return `${report.message}\n\nProceeding anyway because ${COMPAT_ENFORCEMENT_ENV}=warn. This is an upgrade-smoke mode: additional workspace roots are about to be granted through a sandbox profile shape that has not been verified on this release. Supported releases: ${SUPPORTED_DSH_RELEASES.join(", ")}.`;
-}
-/**
-* Judge the installation, then either refuse to provide the service or provide
-* it.
-* @param ctx - the row's context.
-*/
-function apply(ctx) {
-	const report = classifyInstallation();
-	const warning = assertSupportedInstallation(report, compatEnforcement());
-	if (warning !== void 0) ctx.logger.warn(warning);
-	assertAgentPtyMarker();
-	ctx.plugin(MultiRootCompatService, report);
-}
-//#endregion
-export { classifyInstallation as _, inject as a, agentPtyMarkerVerdict as c, HOST_SERVICE_PACKAGES as d, OPTIONAL_CORE_PACKAGES as f, SUPPORTED_DSH_RELEASES as g, RUNTIME_OPTIONAL_PACKAGES as h, assertSupportedInstallation as i, assertAgentPtyMarker as l, RUNNER_ANCHORED_PACKAGES as m, MultiRootCompatService as n, AGENT_PTY_MARKER as o, REQUIRED_CORE_PACKAGES as p, apply as r, PtyMarkerContractError as s, DshCompatUnsupportedError as t, CORE_PACKAGES as u, compatEnforcement as v, readInstalledVersion as y };
+export { REQUIRED_CORE_PACKAGES as a, SUPPORTED_DSH_RELEASES as c, readInstalledVersion as d, OPTIONAL_CORE_PACKAGES as i, classifyInstallation as l, CORE_PACKAGES as n, RUNNER_ANCHORED_PACKAGES as o, HOST_SERVICE_PACKAGES as r, RUNTIME_OPTIONAL_PACKAGES as s, COMPAT_ENFORCEMENT_ENV as t, compatEnforcement as u };

package/lib/{fs-CfzJq2wd.js → fs-Uws0ZpmV.js}

@@ -5,6 +5,30 @@ import { canonicalPath, writableRoots } from "@deepseek-ai/dsh-sandbox";
 import { stat } from "node:fs/promises";
 import { FsError } from "@deepseek-ai/dsh-fs";
 import { LocalFileSystem } from "@deepseek-ai/dsh-fs-local";
+//#region src/compat/fs-patch.ts
+/**
+* Adapt the mutation methods introduced by newer filesystem backends.
+* Older supported backends do not expose these methods at all.
+*/
+/** Install only methods present on the actual backend, preserving the caller as `this`. */
+function installAdditionalMutations(prototype, fence) {
+	for (const method of [
+		"patchText",
+		"deleteFile",
+		"moveFile"
+	]) {
+		const inherited = Reflect.get(LocalFileSystem.prototype, method);
+		if (typeof inherited !== "function") continue;
+		Object.defineProperty(prototype, method, {
+			configurable: true,
+			writable: true,
+			value: function(...args) {
+				return fence(this, method, args, (next) => Reflect.apply(inherited, this, next));
+			}
+		});
+	}
+}
+//#endregion
 //#region src/containment.ts
 const MISSING_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
 function isMissing(error) {
@@ -67,6 +91,9 @@ async function isPathUnder(path, root, caseSensitive = process.platform !== "win
 */
 var MultiRootFileSystem = class extends LocalFileSystem {
 	static inject = ["sandboxPolicy", "multiRootScope"];
+	static {
+		installAdditionalMutations(this.prototype, (receiver, method, args, invoke) => receiver.additionalMutation(method, args, invoke));
+	}
 	defaultMode;
 	constructor(ctx, config) {
 		super(ctx, config);
@@ -107,6 +134,17 @@ var MultiRootFileSystem = class extends LocalFileSystem {
 		const policy = structuredClone(sandboxPolicy ?? this.ctx.sandboxPolicy.resolve());
 		return this.withOperation(policy, "fs-edit", async (scope) => super.editText(await this.checkedTarget(target, policy, scope), edit, expected, signal));
 	}
+	/** Fence every endpoint of a patch, delete, or move under one admission. */
+	async additionalMutation(method, args, invoke) {
+		const policyIndex = method === "deleteFile" ? 3 : 4;
+		const policy = structuredClone(args[policyIndex] ?? this.ctx.sandboxPolicy.resolve());
+		return this.withOperation(policy, method === "patchText" ? "fs-edit" : "fs-write", async (scope) => {
+			const checked = [...args];
+			checked[0] = await this.checkedTarget(args[0], policy, scope);
+			if (method === "moveFile") checked[1] = await this.checkedTarget(args[1], policy, scope);
+			return await invoke(checked);
+		});
+	}
 	/** The provider must also work without the gated registry (ADR-0009). */
 	async withOperation(policy, kind, body) {
 		const registry = this.ctx.get("multiRootRegistry");

package/lib/fs.js

@@ -1,3 +1,3 @@
 import "./providers.js";
-import { t as MultiRootFileSystem } from "./fs-CfzJq2wd.js";
+import { t as MultiRootFileSystem } from "./fs-Uws0ZpmV.js";
 export { MultiRootFileSystem, MultiRootFileSystem as default };

package/lib/index.js

@@ -1,15 +1,17 @@
-import { i as renderInstructions, n as instructionsApi, t as createInstructionMessage } from "./llm-message-fYORacvh.js";
-import { a as composeInstructionMessage, r as PLUGIN_SOURCE, t as DEFAULT_MAX_BYTES } from "./instructions-KsUwUFE0.js";
-import { a as classifyStoredRoots, c as indexedStatuses, i as canonicalRoot, l as isCanonicallyUnder, m as validateRootCandidate, n as additionalRootId, p as resolveRootRef, r as availableRoots, s as expandRootInput, t as RootValidationError, u as removeStatusAt } from "./roots-Ca_W1S9n.js";
-import { _ as classifyInstallation, c as agentPtyMarkerVerdict, d as HOST_SERVICE_PACKAGES, f as OPTIONAL_CORE_PACKAGES, g as SUPPORTED_DSH_RELEASES, h as RUNTIME_OPTIONAL_PACKAGES, i as assertSupportedInstallation, l as assertAgentPtyMarker, m as RUNNER_ANCHORED_PACKAGES, n as MultiRootCompatService, o as AGENT_PTY_MARKER, p as REQUIRED_CORE_PACKAGES, s as PtyMarkerContractError, t as DshCompatUnsupportedError, u as CORE_PACKAGES, v as compatEnforcement, y as readInstalledVersion } from "./compat-Bg2HFVMX.js";
-import { l as widenConfined } from "./dialects-Dr4rDR-H.js";
+import { r as renderInstructions, t as instructionsApi } from "./agent-instructions-BXuKhOzr.js";
+import { t as createInstructionMessage } from "./llm-message-CepyzEBQ.js";
+import { a as composeInstructionMessage, r as PLUGIN_SOURCE, t as DEFAULT_MAX_BYTES } from "./instructions-Ck9wp4J4.js";
+import { a as REQUIRED_CORE_PACKAGES, c as SUPPORTED_DSH_RELEASES, d as readInstalledVersion, i as OPTIONAL_CORE_PACKAGES, l as classifyInstallation, n as CORE_PACKAGES, o as RUNNER_ANCHORED_PACKAGES, r as HOST_SERVICE_PACKAGES, s as RUNTIME_OPTIONAL_PACKAGES, u as compatEnforcement } from "./dsh-version-DCwF7REk.js";
+import { a as classifyStoredRoots, c as indexedStatuses, g as resolveRootRef, i as canonicalRoot, l as isCanonicallyUnder, n as additionalRootId, p as removeStatusAt, r as availableRoots, s as expandRootInput, t as RootValidationError, y as validateRootCandidate } from "./roots-CmaWxRVy.js";
+import { c as agentPtyMarkerVerdict, i as assertSupportedInstallation, l as assertAgentPtyMarker, n as MultiRootCompatService, o as AGENT_PTY_MARKER, s as PtyMarkerContractError, t as DshCompatUnsupportedError } from "./compat-CTJbpCxu.js";
+import { l as widenConfined } from "./dialects-CdlG3RF9.js";
 import { MULTI_ROOT_PROVIDER_BRAND, MultiRootProviders, brandMultiRootProvider, isMultiRootProvider } from "./providers.js";
-import { t as MultiRootFileSystem } from "./fs-CfzJq2wd.js";
-import { t as MultiRootSandboxProvider } from "./sandbox-C-vCJCp3.js";
+import { t as MultiRootFileSystem } from "./fs-Uws0ZpmV.js";
+import { t as MultiRootSandboxProvider } from "./sandbox-CZElTNPz.js";
 import { a as parseRevealedView, i as parsePanelCall, n as PANEL_ENDPOINTS, o as parseRootsView, t as PANEL_CHANNEL } from "./contract-CStSEOcK.js";
 import { MultiRootScopeService, renderWorkspaceRootsContext, sanitizeAdditionalRoots } from "./scope.js";
-import { a as MultiRootRegistry, c as multiRootDomainSpec, i as MAX_ALIAS_LENGTH, l as RegistryAuthorityLease, n as DOMAIN_NAME, o as REGISTRY_CONTENDED_MESSAGE, r as MAX_ADDITIONAL_ROOTS_CEILING, t as DEFAULT_MAX_ADDITIONAL_ROOTS, u as RegistryLeaseContendedError } from "./registry-Bv431TfO.js";
-import { a as renderRootsReport, c as revealArgv, i as parseFoldersCommand, o as resolvePanelPrimaryRoot, t as COMMAND_NAME } from "./command-B9855H7y.js";
+import { a as MultiRootRegistry, c as multiRootDomainSpec, i as MAX_ALIAS_LENGTH, l as RegistryAuthorityLease, n as DOMAIN_NAME, o as REGISTRY_CONTENDED_MESSAGE, r as MAX_ADDITIONAL_ROOTS_CEILING, t as DEFAULT_MAX_ADDITIONAL_ROOTS, u as RegistryLeaseContendedError } from "./registry-DyDNDSJZ.js";
+import { a as renderRootsReport, c as revealArgv, i as parseFoldersCommand, o as resolvePanelPrimaryRoot, t as COMMAND_NAME } from "./command-y5tfcAeC.js";
 //#region src/index.ts
 /**
 * Carrier plugin face for the bare-package-name loader row (see the module