@dsh-electron/dsh-plugin-multi-root-workspace 0.1.14 → 0.1.15

package/lib/types/roots.d.ts

@@ -14,15 +14,21 @@
  *    misconfiguration, not a path to guess at.
  * 2. `missing` — the directory does not exist.
  * 3. `not-a-directory` — it exists but is not a directory.
- * 4. `equals-primary` — the canonical candidate IS the session's workspace
+ * 4. `protected-path` — the canonical candidate equals, lies inside, or
+ *    contains a protected DSH directory (the DSH home, the registry's
+ *    physical storage medium, or the lease directory, supplied through
+ *    {@link RootCandidateContext.protectedPaths}): those hold the store,
+ *    the lease, profiles and user credentials, so no access level may
+ *    register them. Applies to every mode; no remote exemption exists.
+ * 5. `equals-primary` — the canonical candidate IS the session's workspace
  *    root, which is already granted by the upstream policy.
- * 5. `primary-overlap` — the candidate lies under the workspace root, or
+ * 6. `primary-overlap` — the candidate lies under the workspace root, or
  *    contains it. The union grants nothing new, and the displayed list would
  *    stop matching the enforced root set.
- * 6. `duplicate` — another registered root canonicalizes to the same path.
- * 7. `nested` — the candidate lies under a registered root, or contains one.
- *    Same reasoning as rule 5, applied to the additional roots.
- * 8. `unsupported-path` — on Windows, a network or device path (`\\server`,
+ * 7. `duplicate` — another registered root canonicalizes to the same path.
+ * 8. `nested` — the candidate lies under a registered root, or contains one.
+ *    Same reasoning as rule 6, applied to the additional roots.
+ * 9. `unsupported-path` — on Windows, a network or device path (`\\server`,
  *    `\\?\…`, `\\.\…`): the ACL confinement cannot be shown to cover it, so it
  *    is rejected lexically before any filesystem touch.
  *
@@ -67,6 +73,23 @@ export declare function additionalRootId(value: string): AdditionalRootId;
  *   `read-only` session; it does not widen anything beyond its own directory.
  */
 export type RootAccess = 'inherit' | 'read-write' | 'read-only';
+/**
+ * Which protected DSH directory one boundary belongs to: the harness home
+ * (`$DSH_HOME`), the registry's physical storage medium, or the directory the
+ * store-wide lease occupies.
+ */
+export type ProtectedPathKind = 'dsh-home' | 'registry-medium' | 'registry-lease';
+/**
+ * One directory no additional root may equal, lie inside, or contain. `path`
+ * is an absolute spelling — the configured one, the current canonical one, or
+ * a canonical value pinned the first time the boundary resolved — and is
+ * compared with {@link samePath}/{@link isCanonicallyUnder} exactly like
+ * every other boundary in this module.
+ */
+export interface ProtectedPath {
+    readonly kind: ProtectedPathKind;
+    readonly path: string;
+}
 /** One registered additional root exactly as it is persisted. */
 export interface RegisteredRoot {
     /** Stable registry identity. */
@@ -139,13 +162,20 @@ export interface RootStatus extends RegisteredRoot {
      *
      * `'membership-conflict'` means the record passed every structural rule —
      * including an intact, absolute recorded grant — but its recorded boundary
-     * overlaps another record's. Neither membership may be granted while the
-     * conflict stands, yet the boundary remains a trustworthy negative
-     * restriction, so {@link reservedRootBoundary} keeps it reserved and the
-     * registry publishes the root as a withheld, deny-only entry. Every other
-     * `invalid` verdict left the grant unverifiable, so it contributes nothing.
+     * overlaps another record's. `'protected-path'` means that same intact
+     * grant overlaps a protected DSH directory (the home, the storage medium,
+     * or the lease directory) — typically a store written before the boundary
+     * existed or on another layout. `'primary-overlap'` means the intact grant
+     * equals or overlaps the CURRENT canonical primary root — e.g. a primary
+     * spelling retargeted onto (or above) a read-only root — which withholds
+     * membership but must never drop the deny. All three reasons mean the same
+     * thing: the boundary is intact and trustworthy, so
+     * {@link reservedRootBoundary} keeps it reserved and the registry
+     * publishes the root as a withheld, deny-only entry — only the membership
+     * is withheld. Every other `invalid` verdict left the grant unverifiable,
+     * so it contributes nothing.
      */
-    readonly invalidReason?: 'membership-conflict';
+    readonly invalidReason?: 'membership-conflict' | 'protected-path' | 'primary-overlap';
 }
 /** One status together with the 1-based ordinal the surfaces accept for it. */
 export interface IndexedRootStatus {
@@ -172,7 +202,7 @@ export type RootRef = {
     readonly addedAt: string;
 };
 /** Every way root handling can fail, as a stable code the surfaces localize. */
-export type RootValidationCode = 'not-absolute' | 'missing' | 'not-a-directory' | 'equals-primary' | 'primary-overlap' | 'duplicate' | 'nested' | 'invalid-alias' | 'invalid-alias-id' | 'not-found' | 'invalid-ref' | 'storage-unavailable' | 'registry-contended' | 'root-limit-reached' | 'config-invalid' | 'reveal-unavailable' | 'session-not-found' | 'unsupported-path' | 'root-unavailable';
+export type RootValidationCode = 'not-absolute' | 'missing' | 'not-a-directory' | 'equals-primary' | 'primary-overlap' | 'duplicate' | 'nested' | 'invalid-alias' | 'invalid-alias-id' | 'not-found' | 'invalid-ref' | 'storage-unavailable' | 'registry-contended' | 'root-limit-reached' | 'config-invalid' | 'reveal-unavailable' | 'session-not-found' | 'unsupported-path' | 'root-unavailable' | 'protected-path' | 'protected-boundary-unknown' | 'revive-target-changed';
 /** A rejected root operation; `code` is the stable contract, `message` the fallback prose. */
 export declare class RootValidationError extends Error {
     readonly code: RootValidationCode;
@@ -200,6 +230,21 @@ export declare class RootValidationError extends Error {
  * @returns the expanded path (still unvalidated).
  */
 export declare function expandRootInput(raw: string, home?: string): string;
+/**
+ * The Registry/scope lookup key of one primary root: the UPSTREAM spelling,
+ * normalized lexically by `path.resolve` and case-folded on Windows — never
+ * re-resolved. Upstream `dsh-sandbox-policy` sets `policy.workspaceRoot` to
+ * `session.header.cwd` verbatim, so the spelling IS the identity: a symlinked
+ * workspace and its realpath target are different sessions and different key
+ * spaces. Re-resolving here would let a replaced workspace directory
+ * silently re-key the record set onto another identity — the exact failure
+ * the redirect rules exist to prevent. This is the ONLY function allowed to
+ * turn a primary root into a Registry key; path geometry keeps using
+ * {@link canonicalRoot}.
+ */
+export declare function primaryKey(path: string, platform?: NodeJS.Platform): string;
+/** Whether two canonical paths name the same directory on this platform. */
+export declare function samePath(left: string, right: string): boolean;
 /**
  * Whether `candidate` is `root` itself or lies beneath it. Both sides must
  * already be canonical: symlinks are resolved by then, so the lexical test is
@@ -242,6 +287,15 @@ export interface RootCandidateContext {
      * revived exempts only itself.
      */
     readonly existing: readonly string[];
+    /**
+     * The protected DSH directories — the home, the registry's storage medium,
+     * and the lease directory — that no candidate may equal, lie inside, or
+     * contain, at any access level and under any mode. Derived from the trusted
+     * host configuration by the registry; absent means "no protected set was
+     * provided" and is never a substitute for the boundary being unprovable
+     * (the caller refuses that case itself with `protected-boundary-unknown`).
+     */
+    readonly protectedPaths?: readonly ProtectedPath[];
 }
 /**
  * Judge one candidate root and return its canonical spelling.
@@ -251,6 +305,16 @@ export interface RootCandidateContext {
  * @throws {RootValidationError} with the first rule that failed.
  */
 export declare function validateRootCandidate(raw: string, context: RootCandidateContext): string;
+/**
+ * The first protected directory `candidate` overlaps — equals, lies inside,
+ * or contains. Both sides must already be canonical (or absolute boundary
+ * spellings): the comparison is the same lexical three-way test the other
+ * boundary rules use, so a symlink alias can never route around it.
+ * @param candidate - the canonical candidate or recorded grant to test.
+ * @param protectedPaths - the protected DSH directories.
+ * @returns the overlapping protected path, or `undefined`.
+ */
+export declare function protectedOverlap(candidate: string, protectedPaths: readonly ProtectedPath[]): ProtectedPath | undefined;
 /**
  * Re-judge every stored record of one primary root — the startup and refresh
  * path, which must never throw: a registration that stopped being usable is
@@ -262,26 +326,56 @@ export declare function validateRootCandidate(raw: string, context: RootCandidat
  * @param primaryRoot - the session workspace root the records belong to.
  * @param records - the stored records, in registry order.
  * @param platform - the platform the rules run for; defaults to `process.platform`.
+ * @param protectedPaths - the protected DSH directories a stored grant may not
+ *   overlap; a record that does is reported `invalid` with
+ *   `invalidReason: 'protected-path'` — withheld, never deleted, never re-granted.
  * @returns one status per record, in the same order.
  */
-export declare function classifyStoredRoots(primaryRoot: string, records: readonly RegisteredRoot[], platform?: NodeJS.Platform): RootStatus[];
+export declare function classifyStoredRoots(primaryRoot: string, records: readonly RegisteredRoot[], platform?: NodeJS.Platform, protectedPaths?: readonly ProtectedPath[]): RootStatus[];
+/**
+ * The single recorded grant a record or status carries — `undefined` unless
+ * EXACTLY one grant field holds a non-empty string. Shared by the conflict
+ * pass and {@link reservedRootBoundary}; the stored decoder is the source of
+ * the access level, so this never cross-checks the field against `access`.
+ */
+export declare function singleGrantOf(record: {
+    readonly recordedPath?: string;
+    readonly readOnlyRecordedPath?: string;
+    readonly readWriteRecordedPath?: string;
+}): string | undefined;
 /**
  * The canonical roots a status list grants, in registry order.
  * @param statuses - the statuses to project.
  * @returns the canonical paths of every `available` root.
  */
 export declare function availableRoots(statuses: readonly RootStatus[]): string[];
+/**
+ * Apply the protected-path verdict to an already-classified list: a status
+ * whose recorded grant overlaps a protected directory becomes `invalid` with
+ * `invalidReason: 'protected-path'` — the same verdict the pass-one stored
+ * check produces, here applied by a consumer that classified elsewhere (a
+ * shared-registry follower re-judging an owner snapshot against ITS OWN
+ * protected set, which may differ from the owner's). Statuses already
+ * `invalid` keep their own verdict — a structural failure is never healed
+ * into a trustworthy boundary.
+ * @param statuses - the classified statuses to re-mark.
+ * @param protectedPaths - the caller's own protected DSH directories.
+ * @returns a new list with the verdict applied.
+ */
+export declare function markProtectedPaths(statuses: readonly RootStatus[], protectedPaths: readonly ProtectedPath[]): RootStatus[];
 /**
  * The recorded boundary one status still RESERVES: the grant it was
  * registered for, which a new or revived registration may not overlap merely
  * because the root is currently unusable.
  *
- * `available`, `missing`, `redirected`, and membership-conflict statuses all
- * carry an intact, trustworthy recorded grant; every other `invalid` verdict
- * means the grant could not be parsed at all, so it reserves — and denies —
- * nothing. This is not an independent authorization table: it derives the
- * boundary from the status list {@link classifyStoredRoots} produced, with
- * the same grant-extraction semantics, so its answer can never disagree with
+ * `available`, `missing`, `redirected`, and the trustworthy-boundary
+ * `invalid` verdicts (`membership-conflict`, `protected-path`, and
+ * `primary-overlap`) all carry
+ * an intact recorded grant; every other `invalid` verdict means the grant
+ * could not be parsed at all, so it reserves — and denies — nothing. This is
+ * not an independent authorization table: it derives the boundary from the
+ * status list {@link classifyStoredRoots} produced, with the same
+ * grant-extraction semantics, so its answer can never disagree with
  * classification.
  * @param status - one classified registration.
  * @returns the absolute recorded boundary, or `undefined` when there is none.

package/lib/types/scope.d.ts

@@ -17,7 +17,8 @@
  */
 import { Context, Service } from '@deepseek-ai/cordis';
 import type { SandboxExecutionPolicy, SandboxMode } from '@deepseek-ai/dsh-sandbox';
-import type { RootAccess } from './roots.ts';
+import { type RootAccess } from './roots.ts';
+import type { OpsProtectionState } from './compat/ops-tools.ts';
 declare module '@deepseek-ai/cordis' {
     interface Context {
         multiRootScope: MultiRootScopeService;
@@ -210,6 +211,7 @@ export declare class MultiRootScopeService extends Service {
     private readonly listeners;
     /** Enclosing {@link MultiRootScopeService.batch} depth; inner calls nest. */
     private batchDepth;
+    readonly opsProtection: OpsProtectionState;
     /** True when a batched write coalesced its notification into the flush. */
     private batchDirty;
     private admissionProof;
@@ -233,6 +235,13 @@ export declare class MultiRootScopeService extends Service {
      * treated as evidence.
      */
     private readonly dshHome;
+    /**
+     * Whether the row carried a `dshHome` value at all — even an invalid one.
+     * The registry's protected-boundary set must tell "no home configured"
+     * (absent: nothing to protect) from "a home was supplied and rejected"
+     * (invalid: the boundary cannot be proven).
+     */
+    private readonly dshHomeSupplied;
     /** Observe registry publications; consumers still resolve authority from scopeOf(). */
     subscribe(listener: () => void): () => void;
     /**
@@ -257,6 +266,21 @@ export declare class MultiRootScopeService extends Service {
     toolCaps(): readonly string[];
     /** Whether malformed toolAccess caps every call, including unknown tools. */
     get toolAccessInvalid(): boolean;
+    /**
+     * The validated `dshHome` row config, classified for the registry's
+     * protected-boundary set: `absent` when the row carried no value (nothing
+     * to protect), `invalid` when it carried a value the constructor rejected
+     * (the boundary cannot be proven), `configured` with the accepted absolute
+     * path. Read-only — this changes no scope or `protectedHome` semantics.
+     */
+    get dshHomeConfig(): {
+        readonly kind: 'absent';
+    } | {
+        readonly kind: 'invalid';
+    } | {
+        readonly kind: 'configured';
+        readonly path: string;
+    };
     constructor(ctx: Context, config?: Config);
     /**
      * Resolve the scope of one confined call.
@@ -275,6 +299,7 @@ export declare class MultiRootScopeService extends Service {
     resolve(policy: SandboxExecutionPolicy): FilesystemScope;
     /** Read-only pending-dispatch projection. Does not mint an ALS execution grant. */
     previewForTool(policy: SandboxExecutionPolicy, toolName: string): FilesystemScope;
+    withToolCap<T>(name: string, fn: () => T): T;
     /** Execution and review use exactly the same parent-narrowing rule. */
     private capForTool;
     private project;
@@ -324,7 +349,8 @@ export declare class MultiRootScopeService extends Service {
      * M1 uses this from tests and smoke scripts only; M3 feeds it from plugin
      * storage. It is a plain setter so the transition swaps the data source
      * without touching any provider.
-     * @param primaryRoot - canonical primary root to register roots under.
+     * @param primaryRoot - primary root the roots belong to; the Registry key
+     *   is its upstream spelling via {@link primaryKey}, never re-resolved.
      * @param roots - the additional roots, in display order.
      */
     setAdditionalRoots(primaryRoot: string, roots: readonly AdditionalWorkspaceRoot[]): void;

package/lib/workspace-files.js

@@ -1,7 +1,7 @@
-import { t as wrapMethod } from "./method-wrapper-CFY3p3j2.js";
+import { t as wrapMethod } from "./method-wrapper-D4oUCsEF.js";
 import { c as withRegistryRead } from "./registry-operation-C2ZV3Jhw.js";
-import { l as isCanonicallyUnder } from "./roots-Ca_W1S9n.js";
-import { t as routeWorkspacePath } from "./workspace-routing-YPxaQ4V3.js";
+import { l as isCanonicallyUnder } from "./roots-CmaWxRVy.js";
+import { t as routeWorkspacePath } from "./workspace-routing-D_qwMUh-.js";
 import { posix, resolve, win32 } from "node:path";
 //#region src/compat/workspace-files.ts
 function adaptPathWatch(service, wrap) {

package/lib/{workspace-routing-YPxaQ4V3.js → workspace-routing-D_qwMUh-.js}

@@ -4,7 +4,7 @@ import { canonicalPath } from "@deepseek-ai/dsh-sandbox";
 async function routeWorkspacePath(ctx, primaryRoot, path, signal, cwd = primaryRoot) {
 	signal?.throwIfAborted();
 	const primary = canonicalPath(primaryRoot);
-	const roots = [primary, ...ctx.multiRootScope.scopeOf(primary)];
+	const roots = [primary, ...ctx.multiRootScope.scopeOf(primaryRoot)];
 	const target = await ctx.fs.resolve(path, {
 		cwd,
 		...signal === void 0 ? {} : { signal }
@@ -12,11 +12,11 @@ async function routeWorkspacePath(ctx, primaryRoot, path, signal, cwd = primaryR
 	for (const root of roots) {
 		const rootTarget = await ctx.fs.resolve(root, signal === void 0 ? {} : { signal });
 		if (!ctx.fs.contains(rootTarget, target)) continue;
-		if (root !== primary && !ctx.multiRootScope.scopeOf(primary).includes(root)) return void 0;
+		if (root !== primary && !ctx.multiRootScope.scopeOf(primaryRoot).includes(root)) return void 0;
 		signal?.throwIfAborted();
 		return {
-			primaryRoot: primary,
-			workspaceRoot: root,
+			primaryRoot,
+			workspaceRoot: root === primary ? primaryRoot : root,
 			target,
 			absolutePath: ctx.fs.processPath(target)
 		};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dsh-electron/dsh-plugin-multi-root-workspace",
   "description": "Multi-root Workspace for DeepSeek Harness: adds N additional roots to the workspace sandbox scope as an out-of-tree bundle",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -75,6 +75,10 @@
     "./skills": {
       "types": "./lib/types/skills.d.ts",
       "default": "./lib/skills.js"
+    },
+    "./ops-compatibility": {
+      "types": "./lib/types/ops-compatibility.d.ts",
+      "default": "./lib/ops-compatibility.js"
     }
   },
   "files": [