@dsh-electron/dsh-plugin-multi-root-workspace 0.1.14 → 0.1.15

package/CHANGELOG.en.md

@@ -8,6 +8,24 @@ This file records the user-visible changes of every **released** version.
 - For installation sources, the supported upstream runtimes, and known limitations, see the [README](./README.en.md).
 - The evidence, numbering, and release state of each version live in the [roadmap progress ledger](./docs/plans/active/2026-09-12-multi-root-workspace.md#进度总账). The body of each GitHub Release is generated from the commit history by `scripts/release-notes.mjs` and is the complete raw list behind this file.
 
+## [0.1.15] - 2026-11-06
+
+### Changed
+
+- **Upgrade note for custom compositions: the Registry now requires shared mode**. `multi-root-registry` must configure `sharedStorageRoot`; without it, startup fails with `config-invalid` and neither single-process storage nor additional-root grants are opened. The default bundle has configured shared mode since `v0.1.12` and needs no change. Registry keys now follow the upstream Session's original primary-directory spelling, with migration from legacy canonical keys. Clearing a migrated root table persists an empty record so refreshes and restarts cannot revive old registrations ([ADR-0028](./docs/decisions/ADR-0028-upstream-primary-identity-and-shared-only-registry.md), Chinese).
+
+### Added
+
+- **The `/add-dirs` alias**: `/add-dirs [absolute path] [--inherit|--read-only|--read-write]` reuses `/workspace-folders add` path parsing, directory picker, access options, and validation. It does not replace dsh-TUI's built-in `/add-dir`.
+- **OPS compatibility mode (experimental, off by default)**: explicitly enable `multi-root-ops-compatibility.enabled` in the plugin settings card on DSH `0.2.*` releases within the existing exact support matrix. On `0.1.*` the setting is unavailable and a manually configured `true` stays inactive. Each UI activation requires acknowledging and confirming the host's risk dialog; disabling saves directly. OPS and Auto Review have independent switches.
+- **Conservative execution protection and context while OPS mode is enabled**: on macOS/Linux, Full-access Workers receive kernel confinement when read-only roots or tool caps create deny boundaries. Windows calls with deny boundaries, WW/RO calls with non-writable roots or caps, and calls in any mode without Registry authority are conservatively refused before preparation; reads may also be refused. Proven live successful file targets can trigger additional-directory instruction discovery. Auto Review still requires exactly DSH `0.2.1-rc.2` and fails technically when historical evidence is missing, pending targets are dynamic, or the snapshot changes. **This is not full OPS compatibility**: false refusals, blocked background cleanup, retained caches, and the lack of durable activity remain; full compatibility recovery is deferred indefinitely. With the mode disabled, OPS may still write to explicitly read-only additional roots ([capabilities and limitations](./README.en.md#dsh-ops-adaptation-status-capability-notes), [ADR-0029](./docs/decisions/ADR-0029-ops-file-authorization-and-activity-adapter.md), Chinese).
+
+### Fixed
+
+- **Re-registering a root no longer transfers its grant to a replacement target (BYP-02)**: revival requires the original grant target. Changed targets must be removed and explicitly added again. The panel offers re-registration only for missing records, not redirected or invalid ones.
+- **Additional-root registration refuses protected directories**: new and revived roots cannot equal, contain, or sit inside `$DSH_HOME`, the physical Registry store, or its lease directory. Existing overlapping records are withheld while retaining deny boundaries. Shared followers apply their own protected set to every filesystem/process admission too; Windows network/device paths are refused before local resolution or forwarding ([ADR-0027](./docs/decisions/ADR-0027-revive-target-and-protected-paths.md), Chinese).
+- **Replacing the primary directory no longer drops existing deny boundaries (MRW-01)**: Registry/scope identity uses the upstream primary spelling, canonical paths serve geometry only, and deny boundaries take precedence over primary-root overlap. Write authority for the primary root itself still follows upstream semantics. Trusted human confirmation for root management (BYP-01) remains a known residual risk outside this release's fixes ([scope and maintainer decisions](./docs/plans/completed/2026-11-05-root-authorization-security-fixes.md), Chinese).
+
 ## [0.1.14] - 2026-11-05
 
 ### Added
@@ -229,7 +247,8 @@ The first release: the three MVP milestones (M1–M3).
 
 - All eight findings of the pre-release external review (three of them release-blocking) are fixed, each with a regression test: a registered directory replaced by a symlink transplanting its authority (which introduced `recordedPath` — **re-resolving a path is not re-authorizing it**), concurrent registry mutations losing a write or reviving a revoked grant (per-primary-root mutations are serialized), a refresh not re-checking directories, a typed path being overwritten by the directory picker, the `reveal` response contract and failure code, duplicate ids not validated, the primary root missing from nesting validation, and CI testing before building.
 
-[Unreleased]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.14...HEAD
+[Unreleased]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.15...HEAD
+[0.1.15]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.14...v0.1.15
 [0.1.14]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.13...v0.1.14
 [0.1.13]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.12...v0.1.13
 [0.1.12]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.11...v0.1.12

package/CHANGELOG.md

@@ -8,6 +8,24 @@ English: [CHANGELOG.en.md](./CHANGELOG.en.md)
 - 安装方式、受支持的上游运行时与已知限制见 [README](./README.md)。
 - 每个版本的实施证据、编号口径与发布状态见[路线图 §进度总账](./docs/plans/active/2026-09-12-multi-root-workspace.md#进度总账)；GitHub Release 的正文由 `scripts/release-notes.mjs` 从 commit 历史生成，是本文件之外的完整原始清单。
 
+## [0.1.15] - 2026-11-06
+
+### Changed
+
+- **自定义组合升级注意：Registry 只保留共享模式**。`multi-root-registry` 必须配置 `sharedStorageRoot`；缺失时以 `config-invalid` 拒绝启动，不再打开单进程存储或授予附加根。默认 bundle 自 `v0.1.12` 起已配置共享模式，无需另行修改。主根登记表改为按上游 Session 原始目录拼写查找，升级时迁移旧 canonical key；清空后的空表会持久保留，防止刷新或重启复活旧登记（[ADR-0028](./docs/decisions/ADR-0028-upstream-primary-identity-and-shared-only-registry.md)）。
+
+### Added
+
+- **`/add-dirs` 命令别名**：`/add-dirs [absolute path] [--inherit|--read-only|--read-write]` 复用 `/workspace-folders add` 的路径解析、目录选择器、访问选项和校验，不接管 dsh-TUI 的内置 `/add-dir`。
+- **OPS 兼容模式（实验性，默认关闭）**：在插件设置卡中显式开启 `multi-root-ops-compatibility.enabled`，仅适用于现有精确支持矩阵内的 DSH `0.2.*`；`0.1.*` 不提供该设置入口，手工写入 `true` 也不启用。从 UI 开启须先在宿主风险弹窗中勾选并确认，每次重新开启都需确认；关闭直接保存，OPS 与 Auto Review 开关独立。
+- **启用 OPS 模式后的保守执行保护与上下文**：macOS/Linux 的 Full-access 有只读或 tool-cap 拒写边界时，以内核围栏保护 Worker；Windows 有拒写边界、WW/RO 有不可写根或 cap，以及所有模式 Registry 失权时，执行调用在准备前保守拒绝，读取也可能被拒。可证明的实时成功文件目标可触发附属目录指令发现；Auto Review 仍仅支持精确 DSH `0.2.1-rc.2`，缺少历史证据、动态待审目标或快照变化时技术失败。**不声明完整 OPS 兼容**：合法操作误拒、后台清理与缓存残留、无持久活动等限制保留，完整兼容恢复无限期延后；关闭模式后 OPS 仍可能写入显式只读附加根（[能力与限制](./README.md#dsh-ops-适配现状受限能力说明)、[ADR-0029](./docs/decisions/ADR-0029-ops-file-authorization-and-activity-adapter.md)）。
+
+### Fixed
+
+- **重新登记不再把旧授权转移到新目标（BYP-02）**：只有目录恢复到原 grant 目标时才能 revive；目标已改变的记录必须先移除再显式新增。面板只为 missing 记录提供重新登记，不为 redirected/invalid 记录提供该动作。
+- **附加根登记拒绝覆盖受保护目录**：新增与 revive 不得等于、包含或位于 `$DSH_HOME`、Registry 物理介质或 lease 目录；重叠存量记录 withheld 并保留拒写边界。共享 follower 在每次 fs/进程准入时同样按自己的保护集合收窄；Windows 网络/设备路径在本地解析和转发前拒绝（[ADR-0027](./docs/decisions/ADR-0027-revive-target-and-protected-paths.md)）。
+- **主根目录置换不再丢失已有拒写边界（MRW-01）**：Registry/scope 使用上游主根拼写作为身份，canonical 路径只用于几何判断，拒写边界优先于主根重叠。主根本身的写授权继续遵循上游语义；根管理的可信人工确认（BYP-01）仍是已知残余风险，不在本版修复范围（[范围与维护者决定](./docs/plans/completed/2026-11-05-root-authorization-security-fixes.md)）。
+
 ## [0.1.14] - 2026-11-05
 
 ### Added
@@ -229,7 +247,8 @@ English: [CHANGELOG.en.md](./CHANGELOG.en.md)
 
 - 发布前外部评审提出的 8 项发现（其中 3 项发布阻断）全部修复，每项各带一个回归测试：登记目录被替换为符号链接后授权转移（引入 `recordedPath`，**重新解析路径不等于重新授权**）、并发修改注册表丢写或复活已撤销的授权（每个主根的变更串行）、刷新不重新检查目录、手输路径被目录选择器覆盖、`reveal` 的应答契约与失败码、重复 id 未校验、主根未纳入嵌套校验、CI 先测后构建。
 
-[Unreleased]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.14...HEAD
+[Unreleased]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.15...HEAD
+[0.1.15]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.14...v0.1.15
 [0.1.14]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.13...v0.1.14
 [0.1.13]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.12...v0.1.13
 [0.1.12]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.11...v0.1.12

package/README.en.md

@@ -15,13 +15,13 @@ By default, [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)
 Not every project is a monorepo. A real development project is usually several independent Git repositories, and working across them meant juggling sessions. Peer harnesses already support adding multiple folders to a single workspace. This plugin brings the same capability to DSH — register the other repositories as additional roots, grant each read-only, read-write, or unrestricted access, and the agent can work in them within that grant.
 
 - **No new tools**: the agent keeps using the native `read` / `write` / `edit` / `bash`; only the granted directories grow.
-- **Sandbox confinement**: an additional root may inherit the session's (primary root's) permission setting, or be pinned to read-only or read-write; under read-only and read-write, confinement does not rest on system prompts — it is enforced by an in-process filesystem fence plus kernel-level sandboxes (macOS Seatbelt / Linux bwrap / Landlock / Windows ACL), with files and bash sharing one and the same scope.
+- **Sandbox confinement**: an additional root may inherit the session's (primary root's) permission setting, or be pinned to read-only or read-write; under read-only and read-write, confinement does not rest on system prompts — it is enforced by an in-process filesystem fence plus kernel-level sandboxes (macOS Seatbelt / Linux bwrap / Landlock / Windows ACL), with native filesystem and bash calls passing through these fences sharing the same scope. Third-party tools that launch their own Workers need separate validation; see the current dsh-ops limitations below.
 - **Browse additional roots in the Files tab**: the Files tab header switches between the primary root and any registered additional root; an additional root's directory renders in the same native Files view, with open-file, open-in-app, and auto-refresh behaving identically.
 - **Optional Auto review (off by default)**: a fork of upstream's experimental auto-review that gives the reviewer the additional directories' context — the current workspace topology, each root's access level, and live instruction files; it ships disabled and only takes effect once the `@dsh-electron/dsh-plugin-multi-root-workspace/auto-review` row is explicitly enabled in the Plugin Manager row list, taking over the official bundle while on.
 - **Additional-root Skills**: discovers `.dsh/skills` and `.agents/skills` inside additional folders, invoked through the namespaced `/alias-id:skill-name` reference and the native `skill` tool; each root has an independent toggle and editable `aliasId`, with a global setting that defaults to on.
 - **Absent when absent**: with no additional root configured, its behavior is item-for-item identical to an uninstalled harness; every misconfiguration fails loudly instead of silently degrading.
 
-Current released version: `v0.1.14`. The user-visible changes of each version live in the [CHANGELOG](./CHANGELOG.en.md); progress and release state live in the [roadmap progress ledger](./docs/plans/active/2026-09-12-multi-root-workspace.md#进度总账).
+Current released version: `v0.1.15`. The user-visible changes of each version live in the [CHANGELOG](./CHANGELOG.en.md); progress and release state live in the [roadmap progress ledger](./docs/plans/active/2026-09-12-multi-root-workspace.md#进度总账).
 
 ## Quick Start
 
@@ -94,8 +94,8 @@ This installs pre-built artifacts; the first install needs the `allowBuilds` add
 ```sh
 pnpm pack @dsh-electron/dsh-plugin-multi-root-workspace
 # or download the tgz from the GitHub Release assets, e.g.:
-# https://github.com/cherrchen/dsh-plugin-multi-root-workspace/releases/download/v0.1.14/dsh-electron-dsh-plugin-multi-root-workspace-0.1.14.tgz
-dsh plugin --profile web add ./dsh-electron-dsh-plugin-multi-root-workspace-0.1.14.tgz
+# https://github.com/cherrchen/dsh-plugin-multi-root-workspace/releases/download/v0.1.15/dsh-electron-dsh-plugin-multi-root-workspace-0.1.15.tgz
+dsh plugin --profile web add ./dsh-electron-dsh-plugin-multi-root-workspace-0.1.15.tgz
 ```
 
 Also pre-built, handy for air-gapped or offline delivery; the first install needs the same `allowBuilds` addition.
@@ -114,10 +114,10 @@ allowBuilds:
   koffi: true
 ```
 
-Pinning a version (e.g. `#v0.1.14`) is recommended so a later push cannot silently change what actually runs:
+Pinning a version (e.g. `#v0.1.15`) is recommended so a later push cannot silently change what actually runs:
 
 ```sh
-dsh plugin --profile web add github:cherrchen/dsh-plugin-multi-root-workspace#v0.1.14
+dsh plugin --profile web add github:cherrchen/dsh-plugin-multi-root-workspace#v0.1.15
 ```
 
 ### Install from a local clone
@@ -208,6 +208,7 @@ The upstream `fs-sandbox` and `sandbox` rows are disabled and taken over by the
 ```text
 /workspace-folders [list]                                                    # list the primary root and the additional roots (access and state included)
 /workspace-folders add <absolute path> [--inherit|--read-only|--read-write]  # no path opens the OS directory picker; new registrations default to inherit
+/add-dirs [absolute path] [--inherit|--read-only|--read-write]               # shortcut for /workspace-folders add
 /workspace-folders access <n|path> inherit|read-only|read-write              # switch access (widening requires the root to be available right now)
 /workspace-folders skills <n|path> on|off                                    # toggle additional-root Skills independently of write access
 /workspace-folders alias-id <n|path> <kebab-case>                             # edit the stable Skill namespace
@@ -296,7 +297,11 @@ Issues and PRs are welcome:
 
 ## Known Limitations
 
-- An additional root's instruction files arrive as they become relevant: the one at the root's top level is injected before the session's first step, and a subdirectory's is injected once the session has **successfully** worked in that directory. A nested file is re-examined only when its directory is examined (the root's own every step; a subdirectory's because it was delivered from, or because of a fresh touch), delivery state is in-process (so a resumed session may be told again), and only the `read` / `write` / `edit` tool names count. The primary root's chain and the user-global file remain upstream's job, and this plugin does not inject them a second time ([ADR-0010](./docs/decisions/ADR-0010-additional-root-instruction-scope.md)).
+- **dsh-ops bypassed an explicit read-only root restriction (F01, historical baseline)**: in the audited versions under Full access, the Native `ops_write_file` tool actually changed a file in an additional root pinned read-only, while the native filesystem control was denied. With OPS compatibility mode enabled, this round's limited adaptation makes the explicit RO/cap deny boundary effective for OPS Native and real PTC under Full access (deny-execution re-verification in [audit §16](./docs/reviews/dsh-ops-compatibility-audit.md#16-适配后复验)); see the [compatibility audit](./docs/reviews/dsh-ops-compatibility-audit.md) (Chinese) for versions, scope, and original evidence.
+- **Legal additional-root writes and nested instructions had gaps with dsh-ops (F04/F05, historical baseline)**: OPS preflight still rejects inherited or pinned read-write additional roots under workspace-write and pinned read-write roots under read-only (F04 unresolved). The nested-instruction gap (F05) is re-verified as recovered with the mode enabled this round: with the live index, real AgentLoop evidence shows successful Native and PTC touches delivering the subdirectory chain into the next model request (see [audit §16](./docs/reviews/dsh-ops-compatibility-audit.md#16-适配后复验)). The tested root-level instructions and Skills paths still work.
+- **Linux bwrap workspace-write batch/result is degraded (F07)**: with the audited shared Registry composition, every `ops_batch` / `ops_result` call (including `page`) that reaches the launch branch with a valid cache loses its argv ownership proof when OPS adds a bind after confinement. The source path rejects the Worker launch with `EXECUTOR_UNAVAILABLE`. The function-level conflict is reproduced; Linux end-to-end execution is untested. Ordinary read-only, Landlock, and no-cache controls are outside this conclusion. An OPS interface to declare cache requirements before confinement is needed; no MR-only workaround has been validated. See [F07](./docs/reviews/dsh-ops-compatibility-audit.md#131-n1--f07confine-后的-cache-bind-与严格证明冲突).
+- **Other OPS availability limits**: under shared workspace-write, purge outside dispatch is rejected without a live admission, so result caches may remain with a warning. Nested PTC calls and background Bash also risk rejection from mismatched or expired proofs. The conservative refusal boundaries have been validated on all three platforms. Normal background execution and cleanup remain unavailable and are deferred indefinitely; see the [final scope in ADR-0029](./docs/decisions/ADR-0029-ops-file-authorization-and-activity-adapter.md#最终范围与无限期延后2026-11-05) (Chinese).
+- An additional root's instruction files arrive as they become relevant: the one at the root's top level is injected before the session's first step, and a subdirectory's is injected once the session has **successfully** worked in that directory. A nested file is re-examined only when its directory is examined (the root's own every step; a subdirectory's because it was delivered from, or because of a fresh touch), delivery state is in-process (so a resumed session may be told again); officially the `read` / `write` / `edit` tool names count, and OPS tools also drive delivery through live evidence when OPS compatibility mode is enabled (OPS history without live evidence does not count after a resume). The primary root's chain and the user-global file remain upstream's job, and this plugin does not inject them a second time ([ADR-0010](./docs/decisions/ADR-0010-additional-root-instruction-scope.md)).
 - Hosts share one Registry service: one Host owns storage and each instance obtains admission for new operations. Disconnection stops new additional-root grants; a successor takes over through the kernel lease. Sharing is local to one user and lock namespace; Linux requires SO_PEERPIDFD, and Windows is limited to one login session. Existing processes and PTYs retain their launch snapshot ([architecture](./docs/architecture/registry-authority-service.md), Chinese).
 - The supported matrix is an exact-version allowlist: on a host whose release is not on the list, or whose core packages disagree about the release, the `fs` / `sandbox` / `registry` / `instructions` / `lsp` / `workspace-files` rows **do not start** and the composition degrades to "the plugin is not installed" ([ADR-0009](./docs/decisions/ADR-0009-dsh-compat-contract.md)).
 - The Windows multi-root runner inherits upstream partial enforcement, caller-owned directory requirements, and private-temp isolation. Running processes retain their initial roots; later processes use the updated set ([ADR-0011](./docs/decisions/ADR-0011-multi-root-workspace-consumers.md)).
@@ -308,6 +313,18 @@ Issues and PRs are welcome:
 - The command's own output text is English (a host-side handler has no active locale to consult); the panel is bilingual.
 - The Workspace Folders panel is a sidebar footer action plus a dialog rather than a full panel: `sidebar.footer.action` is offered by every supported release, whereas `sidebar.panellist` / `main` are not.
 
+## dsh-ops adaptation status (capability notes)
+
+The implementation is available through **OPS compatibility mode (experimental; limitations may apply)**. Set `multi-root-ops-compatibility.enabled` under `Settings → Plugins → Multi-root Workspace`; it defaults to `false` and requires an explicit opt-in. This feature can only be enabled on DSH `0.2.*` releases within the existing exact support matrix. On `0.1.*`, even a manually configured `enabled: true` stays inactive, and the legacy Settings UI is not supported ([version-scope decision](./docs/decisions/ADR-0029-ops-file-authorization-and-activity-adapter.md#ops-版本范围修订2026-11-06), Chinese). Enabling it from Settings opens the host’s risk dialog: acknowledge the limitations and confirm before the setting is saved. Cancel, close, or press Esc to keep it disabled.
+
+- **Enabled**: activates OPS execution protection, live activity, and Review enhancements. Full-access (`danger-full-access`) enforces explicit RO/cap deny boundaries through kernel confinement on the verified macOS and Linux lanes. On Windows, deny-bearing OPS execution calls, including reads, are conservatively refused before Worker preparation; protected preparation and legal writes in that combination are not yet supported. In WW/RO, any non-writable additional root or tool write cap causes the entire OPS execution call, including reads/page, to be refused before preparation and execution. All modes refuse OPS execution when Registry authority is unavailable; pure discovery/publication remains available. Subprocess launches also require a protected execution domain or a profile from the current admission, preventing background cleanup from bypassing boundaries. This can also reject third-party background processes; the panel’s user terminal is unaffected.
+- **Disabled**: restores OPS behavior from before this adaptation, without these safeguards — **OPS may write to an explicitly read-only additional root**. Normal multi-root features, native tool fences, and Auto Review's own toggle are unaffected. Delivered instructions are not retroactively erased; calls already inside a protected execution domain and running processes retain their original snapshot. Newly started calls no longer activate this adaptation.
+- **Experimental limitations**: only the Phase-A live activity index is available; there is no durable event bridge. While enabled, OPS history without live evidence after resume and dynamic pending actions (replace/batch/result/bash/unknown) cause Review to fail technically. Non-allowlisted diagnostics such as `ops_status` are also subject to this conservative rule.
+
+The MR-only P5 safeguards require no OPS changes. Legal additional-root writes can still be rejected, and result caches may remain when cleanup is refused. In legacy mode without a shared Registry, WW/RO PTC can also be refused before its code process starts. Durable activity stays disabled: DSH explicitly prohibits external plugins from calling `appendPluginRecord`; ordinary events and direct log writes are not substitutes. P6 technical acceptance is complete for this bounded scope. Remaining P5 capabilities and full OPS compatibility acceptance are **deferred indefinitely** and excluded from this acceptance; any future recovery will remain experimental. The canonical deferred list is in [ADR-0029](./docs/decisions/ADR-0029-ops-file-authorization-and-activity-adapter.md#无限期延后清单唯一真源), with scope recorded in the [completed plan](./docs/plans/completed/2026-11-01-ops-compatibility-adaptation.md) (Chinese).
+
+These experimental safeguards ship in `v0.1.15`; they do not claim complete OPS compatibility or expand the support matrix. The audit §16 historical re-verification predates this switch and describes the enabled path; reruns require an explicit `enabled: true`.
+
 ## Documentation
 
 Long-term project documentation lives in [`docs/`](./docs/README.md):

package/README.md

@@ -15,13 +15,13 @@
 并非所有项目都是 monorepo。一个开发项目往往由多个独立 Git 仓库组成，跨仓库干活原本得反复换会话。同类工具早已支持在一个工作区添加多个文件夹，本插件把同样的能力带给 DSH：把其他仓库登记为附加根，并按需授予只读、读写或不受限的访问级别，Agent 即可在授权范围内读写。
 
 - **不新增工具**：Agent 照旧使用原生 `read` / `write` / `edit` / `bash`，只是授权的目录变多了。
-- **沙箱约束**：附加根可继承会话（主目录）的权限设置，也可单独固定为只读或读写；在只读与读写下，约束不靠系统提示词，而由进程内文件围栏 + 内核级沙箱（macOS Seatbelt / Linux bwrap / Landlock / Windows ACL）执行，文件与 bash 共享同一份授权范围。
+- **沙箱约束**：附加根可继承会话（主目录）的权限设置，也可单独固定为只读或读写；在只读与读写下，约束不靠系统提示词，而由进程内文件围栏 + 内核级沙箱（macOS Seatbelt / Linux bwrap / Landlock / Windows ACL）执行，经本插件围栏的原生文件与 bash 共享同一份授权范围；自行启动 Worker 的第三方工具须单独验证，dsh-ops 的现存缺口见下方已知限制。
 - **Files 页签浏览附加根**：Files 页签头部可直接在主根与任一已登记附加根之间切换，附加根的目录树以与主根相同的原生 Files 视图呈现，打开文件、在外部应用打开、自动刷新等操作完全一致。
 - **可选 Auto review（默认关闭）**：fork 上游实验性「自动授权审查」，向 Reviewer 补充附加目录的审查上下文——当前工作区拓扑、各根访问级别与实时指令文件；出厂关闭，需在插件管理器的行列表中显式打开 `@dsh-electron/dsh-plugin-multi-root-workspace/auto-review` 行后生效，启用时接管官方同名 bundle。
 - **附属根 Skills**：发现附属目录的 `.dsh/skills` 与 `.agents/skills`，附属根经 `/alias-id:skill-name` 命名空间调用原生 `skill` 工具；每根独立开关、可编辑 `aliasId`，全局设置默认开启。
 - **不配等于没装**：未登记附加根时行为与未装插件逐项一致；配置错误一律明确报错，从不静默降级。
 
-当前发布版本 `v0.1.14`。各版本的用户可见变更见 [CHANGELOG](./CHANGELOG.md)；进度与发布状态见[路线图 §进度总账](./docs/plans/active/2026-09-12-multi-root-workspace.md#进度总账)。
+当前发布版本 `v0.1.15`。各版本的用户可见变更见 [CHANGELOG](./CHANGELOG.md)；进度与发布状态见[路线图 §进度总账](./docs/plans/active/2026-09-12-multi-root-workspace.md#进度总账)。
 
 ## 快速开始
 
@@ -96,8 +96,8 @@ dsh plugin --profile web add @dsh-electron/dsh-plugin-multi-root-workspace
 ```sh
 pnpm pack @dsh-electron/dsh-plugin-multi-root-workspace
 # 或从 GitHub Release 资产下载，例如：
-# https://github.com/cherrchen/dsh-plugin-multi-root-workspace/releases/download/v0.1.14/dsh-electron-dsh-plugin-multi-root-workspace-0.1.14.tgz
-dsh plugin --profile web add ./dsh-electron-dsh-plugin-multi-root-workspace-0.1.14.tgz
+# https://github.com/cherrchen/dsh-plugin-multi-root-workspace/releases/download/v0.1.15/dsh-electron-dsh-plugin-multi-root-workspace-0.1.15.tgz
+dsh plugin --profile web add ./dsh-electron-dsh-plugin-multi-root-workspace-0.1.15.tgz
 ```
 
 同样是预构建产物，适合内网或离线环境交付；首次安装同样需要添加 `allowBuilds`。
@@ -116,10 +116,10 @@ allowBuilds:
   koffi: true
 ```
 
-建议锁定版本（如 `#v0.1.14`），让后续推送无法悄悄改变实际运行的内容：
+建议锁定版本（如 `#v0.1.15`），让后续推送无法悄悄改变实际运行的内容：
 
 ```sh
-dsh plugin --profile web add github:cherrchen/dsh-plugin-multi-root-workspace#v0.1.14
+dsh plugin --profile web add github:cherrchen/dsh-plugin-multi-root-workspace#v0.1.15
 ```
 
 ### 从本地源码安装
@@ -210,6 +210,7 @@ dsh --profile web --dump-config | grep -A3 'multi-root'
 ```text
 /workspace-folders [list]                                                   # 列出主根与附加根（含每根访问级别与状态）
 /workspace-folders add <absolute path> [--inherit|--read-only|--read-write] # 不带路径时打开系统目录选择器；新登记默认 inherit
+/add-dirs [absolute path] [--inherit|--read-only|--read-write]              # /workspace-folders add 的快捷命令
 /workspace-folders access <order|path> inherit|read-only|read-write         # 切换访问级别（扩权要求该根此刻可用）
 /workspace-folders skills <order|path> on|off                               # 独立切换附属根 Skills，不改变写权限
 /workspace-folders alias-id <order|path> <kebab-case>                        # 编辑稳定 Skill 命名空间
@@ -298,7 +299,11 @@ Settings → Plugins → Multi-root Workspace 中的 **启用附属根 Skills**
 
 ## 已知限制
 
-- 附加根的指令文件按需到达模型：根目录顶层的那一份在会话第一步之前注入，子目录里的那一份在本会话**成功**触碰过该目录之后注入；nested 文件只会在其目录被考察到时重新检查（根层每一步，子目录依赖已投递或有新触碰），投递状态是进程内的（resume 后可能再告知一次），也只识别 `read` / `write` / `edit` 三个工具名。主根与 user-global 的指令链仍由上游负责，本插件不重复注入（[ADR-0010](./docs/decisions/ADR-0010-additional-root-instruction-scope.md)）。
+- **dsh-ops 只读限制绕过（F01，历史基线）**：审计版本在 Full-access 下，OPS Native `ops_write_file` 实际写入了显式只读附属根，而原生 fs 同次对照被拒。启用 OPS 兼容模式时，本轮有限适配已在 Full-access 下复验 explicit RO/cap deny 对 OPS Native 与真实 PTC 生效（deny 执行复验见[审计§16](./docs/reviews/dsh-ops-compatibility-audit.md#16-适配后复验)），版本、测试范围与原始证据见[兼容性审计](./docs/reviews/dsh-ops-compatibility-audit.md)。
+- **dsh-ops 的合法写入与子目录指令缺口（F04/F05，历史基线）**：WW 下 inherit/固定读写附属根及 RO 下固定读写附属根被 OPS 预检拒写的问题未解决；OPS 读取不触发子目录指令发现（F05）已在启用模式的本轮 live 索引 + 真实 AgentLoop 下复验恢复（Native 与 PTC 成功触碰的子目录指令进入下一模型请求，见[审计§16](./docs/reviews/dsh-ops-compatibility-audit.md#16-适配后复验)）；不影响已验证的根级指令和 Skills 路径。
+- **Linux bwrap 的 WW batch/result 降级（F07）**：审计版本的共享 Registry 下，所有到达启动分支且取得有效 cache 的 `ops_batch` / `ops_result`（含 `page`）都会因 confine 后追加 bind 而失去 argv 归属证明，源码路径将拒绝 Worker 启动并报 `EXECUTOR_UNAVAILABLE`。函数级冲突已复现，Linux 端到端未测；普通 RO、Landlock 和无 cache 对照不在此结论内。需 OPS 提供 confine 前的 cache 声明接口，目前没有已验证的 MR 单侧缓解，见[审计 F07](./docs/reviews/dsh-ops-compatibility-audit.md#131-n1--f07confine-后的-cache-bind-与严格证明冲突)。
+- **其他 OPS 可用性边界**：共享 WW 下，调度外 purge 无有效 admission 时会被拒，结果缓存可能残留并告警；PTC 嵌套调用及后台 Bash 也有证明归属/过期导致的拒绝风险。本轮已完成保守拒绝边界的三平台验证；正常后台与清理能力仍未恢复，且已无限期延后，见 [ADR-0029 最终范围](./docs/decisions/ADR-0029-ops-file-authorization-and-activity-adapter.md#最终范围与无限期延后2026-11-05)。
+- 附加根的指令文件按需到达模型：根目录顶层的那一份在会话第一步之前注入，子目录里的那一份在本会话**成功**触碰过该目录之后注入；nested 文件只会在其目录被考察到时重新检查（根层每一步，子目录依赖已投递或有新触碰），投递状态是进程内的（resume 后可能再告知一次）；官方识别 `read` / `write` / `edit`，启用 OPS 兼容模式后，OPS 工具经 live 证据同样驱动投递（resume 后 OPS 历史缺 live 证据不参与投递）。主根与 user-global 的指令链仍由上游负责，本插件不重复注入（[ADR-0010](./docs/decisions/ADR-0010-additional-root-instruction-scope.md)）。
 - 多 Host 共享同一登记服务：只有一个 Host 管理存储，各实例逐操作取得授权；断线停止新附加授权，权威退出后按内核锁接管。限同机器、同用户及同锁命名空间；Linux 共享连接需要 SO_PEERPIDFD，Windows 限同登录会话。旧进程/PTY 保留启动快照（[共享架构](./docs/architecture/registry-authority-service.md)）。
 - 支持矩阵是精确版本 allowlist：宿主版本不在清单上、或核心包混装了不同版本时，`fs` / `sandbox` / `registry` / `instructions` / `lsp` / `workspace-files` 六行**不启动**，组合退化为"没装这个插件"（[ADR-0009](./docs/decisions/ADR-0009-dsh-compat-contract.md)）。
 - Windows 多根 runner 继承上游 partial enforcement、caller-owned 目录及 private temp 分离条件；已启动进程保留启动时根集合，后续进程使用更新后的集合（[ADR-0011](./docs/decisions/ADR-0011-multi-root-workspace-consumers.md)）。
@@ -310,6 +315,18 @@ Settings → Plugins → Multi-root Workspace 中的 **启用附属根 Skills**
 - 命令的输出文案为英文（host 侧没有活动语言信息），面板文案中英双语跟随界面语言。
 - Workspace Folders 面板是「侧栏底部动作 + 对话框」，不是独立全屏面板：`sidebar.footer.action` 是所有受支持版本都提供的插槽，而 `sidebar.panellist`/`main` 不是。
 
+## dsh-ops 适配现状（受限能力说明）
+
+当前实现作为 **OPS 兼容模式（实验性，可能存在限制）** 开放：在 `Settings → Plugins → Multi-root Workspace` 中设置 `multi-root-ops-compatibility.enabled`，默认 `false`，必须显式开启。该功能仅允许在现有精确支持矩阵内的 DSH `0.2.*` 上启用；`0.1.*` 即使手工配置 `enabled: true` 也保持关闭，不提供旧版 Settings UI（[版本范围决定](./docs/decisions/ADR-0029-ops-file-authorization-and-activity-adapter.md#ops-版本范围修订2026-11-06)）。 从设置界面开启时，须阅读官方风险弹窗、勾选已了解限制并再次确认；确认前保持关闭，取消、关闭弹窗或按 Esc 均不保存开启设置。
+
+- **开启**：激活 OPS 执行保护、实时活动与 Review 增强。Full-access（`danger-full-access`）在已验证的 macOS/Linux 车道用内核围栏保护 explicit RO/cap deny；Windows 有 deny 时在 Worker 准备前保守拒绝 OPS 执行（包括读取），尚不支持该组合下的受保护准备与合法写入。WW/RO 一旦存在不可写附加根或工具只读上限，整次 OPS 执行调用（包括读取/page）会在准备与正文前拒绝。所有模式在 Registry 失权时拒绝 OPS 执行调用，纯发现/发布除外。没有执行域或当次有效 profile 证明的 subprocess 启动也会拒绝，防止后台清理绕过边界；这可能连带拒绝第三方后台进程，但不拦截面板中用户自己的终端。
+- **关闭**：OPS 恢复本轮适配前的行为，不提供这些兜底——**显式只读附加根可能被 OPS 写入**。普通多根功能、原生工具围栏和 Auto Review 自身开关不受影响。已投递的指令不会回溯抹除，已进入保护域的调用与已启动进程保留原快照；关闭后开始的新调用不再激活本次适配。
+- **实验限制**：仅提供 Phase A live 活动索引，无持久事件桥。开启时，resume 后 OPS 历史缺 live 证据、动态 pending（replace/batch/result/bash/unknown）会使 Review 技术失败；非白名单诊断如 `ops_status` 也受此保守规则影响。
+
+P5 的本仓兜底不修改 OPS：合法附加根写入仍可能被误拒，后台结果缓存可能因拒绝清理而残留；legacy 非共享模式下，WW/RO 的 PTC 也可能在启动代码进程前被拒。持久活动仍关闭：DSH 的 `appendPluginRecord` 明确禁止外部插件调用，不能用普通事件或私写日志代替。P6 已按限定范围完成技术验收；P5 剩余功能及全功能兼容验收**无限期延后**，不构成本次完成条件，未来若恢复也仅以实验性能力开放。延期清单见 [ADR-0029](./docs/decisions/ADR-0029-ops-file-authorization-and-activity-adapter.md#无限期延后清单唯一真源)，验收范围见[已完成计划](./docs/plans/completed/2026-11-01-ops-compatibility-adaptation.md)。
+
+本次实验性保守兜底随 `v0.1.15` 发版，不声明完整 OPS 兼容，不提升支持版本。审计 §16 的历史复验发生在本开关加入之前，对应启用路径；后续复跑须显式 `enabled: true`。
+
 ## 文档
 
 项目长期文档位于 [`docs/`](./docs/README.md)：

package/cordis.patch.yml

@@ -12,7 +12,7 @@
 # provider below without any plugin-side executor.
 #
 # The last two rows are additive and self-softening: `multi-root-registry` waits
-# for the storage domain (absent only in compositions that mount no storage at
+# for the storage hub (absent only in compositions that mount no storage at
 # all) and takes a store-wide kernel lease beside the JSON document so two DSH
 # processes sharing $DSH_HOME cannot each grant a stale snapshot (ADR-0007);
 # `multi-root-command` registers the `/workspace-folders` command
@@ -76,6 +76,10 @@
         # or an unavailable registry authority), the scope appends this path
         # to the deny set, so fs writes and spawned processes refuse it.
         dshHome: !!js dshHomePath()
+    - id: multi-root-ops-compatibility
+      name: '@dsh-electron/dsh-plugin-multi-root-workspace/ops-compatibility'
+      config:
+        enabled: false
     - id: multi-root-registry
       name: '@dsh-electron/dsh-plugin-multi-root-workspace/registry'
       config:

package/lib/{llm-message-fYORacvh.js → agent-instructions-BXuKhOzr.js}

@@ -120,87 +120,4 @@ async function renderInstructions(files, options) {
 	return api.render(files, options);
 }
 //#endregion
-//#region src/compat/llm-message.ts
-/**
-* This plugin's own producer kind.
-*
-* Session format 4 rejects the shared `kind: 'plugin'` (`format v4 message
-* requires a producer-owned source kind`). The kind is ours, not
-* `agent-instructions`: upstream treats that kind's `changes` array as its
-* own reconciliation authority.
-*/
-const PRODUCER_SOURCE_KIND = "multi-root-workspace";
-/**
-* The first session format whose encoder refuses `kind: 'plugin'`.
-* Earlier formats declare that kind on `MessageSourceMap` and require it.
-*/
-const PRODUCER_OWNED_FORMAT = 4;
-/**
-* Which source kind the installed session format will persist.
-* @param formatVersion - `SESSION_FORMAT_VERSION`, when the session package is installed.
-* @returns `plugin` through format 3, and this plugin's own kind from format 4 on.
-*/
-function instructionSourceKind(formatVersion) {
-	return formatVersion !== void 0 && formatVersion >= PRODUCER_OWNED_FORMAT ? PRODUCER_SOURCE_KIND : "plugin";
-}
-/**
-* The installed session format, when that package is present.
-*
-* A composition that never persists a session can omit the package; format 3
-* is then the spelling that still declares `kind: 'plugin'`. Any other failure
-* is a broken install and must surface.
-* @returns the format version, or `undefined` when the package is not installed.
-*/
-async function installedFormatVersion() {
-	try {
-		const session = await import("@deepseek-ai/dsh-session");
-		return typeof session.SESSION_FORMAT_VERSION === "number" ? session.SESSION_FORMAT_VERSION : void 0;
-	} catch (error) {
-		const code = error.code;
-		if (code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND") return void 0;
-		throw error;
-	}
-}
-/**
-* Build one user-role instruction message.
-*
-* Format 3 and earlier: `{ kind: 'plugin', plugin, form: 'instructions' }`.
-* Format 4 and later: `{ kind: 'multi-root-workspace', plugin, form: 'instructions' }`.
-* @param input - the body and the plugin attribution.
-* @returns the frozen message upstream's helper produced.
-* @throws {Error} when the optional peer is absent: a step that has instruction
-*   text to deliver cannot be served without it, and staying silent would drop
-*   user-visible context instead of reporting a misconfigured composition.
-*/
-async function createInstructionMessage(input) {
-	let module;
-	try {
-		module = await import("@deepseek-ai/dsh-llm");
-	} catch (error) {
-		throw new Error(`multi-root workspace: @deepseek-ai/dsh-llm is not installed, so additional roots' instruction files cannot be delivered as messages (${error instanceof Error ? error.message : String(error)}).`);
-	}
-	const create = module.createUserMessage;
-	return create({
-		content: [{
-			type: "text",
-			text: input.text
-		}],
-		source: instructionSource(input.plugin, await installedFormatVersion())
-	});
-}
-/** The source object the installed format will persist. */
-function instructionSource(plugin, formatVersion) {
-	const kind = instructionSourceKind(formatVersion);
-	if (kind === "plugin") return {
-		kind,
-		plugin,
-		form: "instructions"
-	};
-	return {
-		kind,
-		plugin,
-		form: "instructions"
-	};
-}
-//#endregion
-export { renderInstructions as i, instructionsApi as n, isPackageInstalled as r, createInstructionMessage as t };
+export { isPackageInstalled as n, renderInstructions as r, instructionsApi as t };

package/lib/auto-review.js

@@ -1,6 +1,6 @@
-import { n as assertAutoReviewRelease, t as MultiRootReviewContext } from "./review-context-NDpKeMCc.js";
+import { n as assertAutoReviewRelease, t as MultiRootReviewContext } from "./review-context-B-oHkU6a.js";
 import { t as assertForkPackages } from "./auto-review-packages-nRjnb4pU.js";
-import { t as wrapMethod } from "./method-wrapper-CFY3p3j2.js";
+import { t as wrapMethod } from "./method-wrapper-D4oUCsEF.js";
 //#region src/compat/auto-review-loader.ts
 const OFFICIAL_AUTO_REVIEW = "@deepseek-ai/dsh-experimental-auto-review";
 const takeovers = /* @__PURE__ */ new WeakMap();