@dsh-electron/dsh-plugin-multi-root-workspace 0.1.14 → 0.1.15

package/lib/{command-Dcz6nULo.js → command-y5tfcAeC.js}

@@ -1,12 +1,11 @@
 import { t as effectiveDirectory } from "./session-directory-BLOstut1.js";
-import { r as canonicalPath$1 } from "./windows-runner-contract-B5R2K3mM.js";
-import { i as canonicalRoot, o as entryRootRef, p as resolveRootRef, r as availableRoots, t as RootValidationError } from "./roots-Ca_W1S9n.js";
+import { r as canonicalPath } from "./windows-runner-contract-B5R2K3mM.js";
+import { g as resolveRootRef, i as canonicalRoot, o as entryRootRef, r as availableRoots, t as RootValidationError } from "./roots-CmaWxRVy.js";
 import { c as skillsRequestSchema, i as parsePanelCall, r as effectiveRootAccess, s as SKILLS_ENDPOINTS, t as PANEL_CHANNEL } from "./contract-CStSEOcK.js";
-import { n as AuthorityRpcError } from "./protocol-CnR1KTXy.js";
+import { n as AuthorityRpcError } from "./protocol-CwDnFEyK.js";
 import { closeSync, lstatSync, openSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { isAbsolute, join } from "node:path";
 import "@deepseek-ai/cordis";
-import { canonicalPath } from "@deepseek-ai/dsh-sandbox";
 //#region src/compat/connection-rpc.ts
 /**
 * Newer Cordis keeps a service getter's definition site when tracing it, so
@@ -397,7 +396,7 @@ function inspectHome(home) {
 		throw new Error(`the DSH home ${home} cannot be inspected: ${describeError(error)}`);
 	}
 	if (stat.isSymbolicLink()) throw new Error(`the DSH home ${home} is a reparse point — refusing to work through it`);
-	const canonical = canonicalPath$1(home);
+	const canonical = canonicalPath(home);
 	if (!stat.isDirectory()) throw new Error(`the DSH home ${canonical} is not a directory`);
 	const scan = {
 		directories: 0,
@@ -649,8 +648,8 @@ function remediationSteps(report) {
 //#endregion
 //#region src/command.ts
 /**
-* The user-facing surface: the `/workspace-folders` command and the panel's
-* RPC channel.
+* The user-facing surface: the `/workspace-folders` command, its `/add-dirs`
+* alias for adding a root, and the panel's RPC channel.
 *
 * They share one module because they are one thing — the operator-facing edge
 * over `ctx.multiRootRegistry`. The command serves the text surfaces (the
@@ -685,6 +684,8 @@ const inject = [
 ];
 /** The command name, without the leading slash. */
 const COMMAND_NAME = "workspace-folders";
+/** The shortcut for `/workspace-folders add`, without the leading slash. */
+const ADD_COMMAND_NAME = "add-dirs";
 /**
 * Parse the text that follows `/workspace-folders`.
 * @param rawInput - the verbatim `rawInput` of the command invocation.
@@ -772,6 +773,15 @@ function apply(ctx, config = {}) {
 		input: { hint: "[list|add [path] [--inherit|--read-only|--read-write]|remove <n|path>|alias <n|path> [name]|alias-id <n|path> <id>|skills <n|path> on|off|access <n|path> <level>|reveal <n|path>|isolate-profiles [--apply]|help]" },
 		handler: async (invocation) => await runCommand(ctx, invocation, config)
 	});
+	ctx.commands.register({
+		name: ADD_COMMAND_NAME,
+		description: `Add an additional workspace root (alias for /${COMMAND_NAME} add)`,
+		input: { hint: "[absolute path] [--inherit|--read-only|--read-write]" },
+		handler: async (invocation) => await runCommand(ctx, {
+			...invocation,
+			rawInput: `add ${invocation.rawInput}`
+		}, config)
+	});
 	ctx.inject(["connection", "webServer"], (connectionCtx) => {
 		const connection = connectionCtx.get("connection");
 		if (connection === void 0) {
@@ -957,6 +967,7 @@ function helpText() {
 		`/${COMMAND_NAME} — additional workspace roots of this session`,
 		`  /${COMMAND_NAME} list`,
 		`  /${COMMAND_NAME} add [absolute path] [--inherit|--read-only|--read-write]   (no path opens the directory picker when one is composed)`,
+		`  /${ADD_COMMAND_NAME} [absolute path] [--inherit|--read-only|--read-write]   (alias for /${COMMAND_NAME} add)`,
 		`  /${COMMAND_NAME} remove <n|path>`,
 		`  /${COMMAND_NAME} alias <n|path> [name]  (no name clears the alias)`,
 		`  /${COMMAND_NAME} access <n|path> inherit|read-only|read-write`,
@@ -1092,15 +1103,15 @@ async function targetOf(registry, primaryRoot, text) {
 *
 * @param ctx - the host context that may carry `sessions`.
 * @param sessionId - the id the panel sent; already required by the wire schema.
-* @returns the canonical cwd of that session.
+* @returns the session's cwd spelling, verbatim — the Registry key.
 * @throws {RootValidationError} `session-not-found` when the service is absent,
 *   the id does not name a live session, or that session has no cwd.
 */
 function resolvePanelPrimaryRoot(ctx, sessionId) {
 	const session = ctx.get("sessions")?.get(sessionId);
 	const cwd = session?.header.cwd;
-	if (session === void 0 || cwd === void 0 || cwd === "") throw new RootValidationError("session-not-found", `session "${sessionId}" is not an active host session`, { reference: sessionId });
-	return canonicalPath(cwd);
+	if (session === void 0 || cwd === void 0 || cwd === "" || !isAbsolute(cwd)) throw new RootValidationError("session-not-found", `session "${sessionId}" is not an active host session`, { reference: sessionId });
+	return cwd;
 }
 /** Project one status into the panel's view. */
 function toRootView(status, index) {

package/lib/command.js

@@ -1,2 +1,2 @@
-import { a as renderRootsReport, c as revealArgv, i as parseFoldersCommand, n as apply, o as resolvePanelPrimaryRoot, r as inject, s as revealAccepted, t as COMMAND_NAME } from "./command-Dcz6nULo.js";
+import { a as renderRootsReport, c as revealArgv, i as parseFoldersCommand, n as apply, o as resolvePanelPrimaryRoot, r as inject, s as revealAccepted, t as COMMAND_NAME } from "./command-y5tfcAeC.js";
 export { COMMAND_NAME, apply, inject, parseFoldersCommand, renderRootsReport, resolvePanelPrimaryRoot, revealAccepted, revealArgv };

package/lib/compat-CTJbpCxu.js

@@ -0,0 +1,267 @@
+import { c as SUPPORTED_DSH_RELEASES, l as classifyInstallation, t as COMPAT_ENFORCEMENT_ENV, u as compatEnforcement } from "./dsh-version-DCwF7REk.js";
+import { createRequire } from "node:module";
+import { readFileSync, readdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { Service } from "@deepseek-ai/cordis";
+//#region src/compat/pty-marker.ts
+/**
+* Boot-time probe for the agent-PTY marker contract.
+*
+* `multi-root-process-fence` tells an agent terminal from the user's own by
+* one env fact: every supported `dsh-terminal-bash` backend stamps
+* `DSH_PTY_SESSION_ID` (alongside `DSH_SESSION_ID`) into the PTY spawn spec,
+* while the panel's terminal controller stamps only `DSH_SESSION_ID`. That
+* marker is the ONLY discriminator — a backend that ever stops stamping it
+* would reclassify agent PTYs as user terminals and pass them through
+* unconfined under a restricted `danger-full-access`, which is a silent
+* fail-open on a security boundary.
+*
+* The marker is an env key inside upstream's emitted code, not an exported
+* symbol, so the honest structural probe is content: the installed backend
+* package must still write the marker. This module is called from the
+* `multi-root-compat` gate (`src/compat.ts`) BEFORE the service registers —
+* like the version verdict it is a precondition, not a diagnostic, and a
+* breach refuses the composition the same way `mixed`/`incomplete` do: it is
+* not relaxable by `DSH_MULTI_ROOT_COMPAT=warn`.
+*
+* Resolution follows the optional-peer precedent (`agent-instructions.ts`):
+* the backend is not a peer of this plugin, so the plugin anchor is tried
+* first (flat layouts) and the `@deepseek-ai/dsh` host anchor second — the
+* same host-anchor fallback pattern as `dsh-version.ts` — because the
+* backend rides inside the harness meta package's own dependency tree.
+*
+* @module @dsh-electron/dsh-plugin-multi-root-workspace/compat/pty-marker
+*/
+/** The env key that identifies an agent-launched PTY spawn spec. */
+const AGENT_PTY_MARKER = "DSH_PTY_SESSION_ID";
+/** The upstream package whose backend owns the marker stamp. */
+const TERMINAL_BACKEND = "@deepseek-ai/dsh-terminal-bash";
+/** The harness meta package the backend rides inside (its dependency). */
+const HOST_ANCHOR = "@deepseek-ai/dsh/package.json";
+/** Scan budget: enough for any plausible backend layout, bounded forever. */
+const MAX_SOURCE_FILES = 256;
+const MAX_TOTAL_BYTES = 8388608;
+/**
+* Raised when the installed terminal backend does not uphold the marker
+* contract. Thrown from `apply` like `DshCompatUnsupportedError`, so it
+* surfaces as a plugin load failure with the diagnosis attached.
+*/
+var PtyMarkerContractError = class extends Error {
+	/** The resolved backend path when one was found. */
+	backend;
+	constructor(message, backend) {
+		super(message);
+		this.name = "PtyMarkerContractError";
+		this.backend = backend;
+	}
+};
+/**
+* Resolve the backend package root through the two anchors the contract can
+* reach: this module first (flat layouts where the backend is a direct
+* install), then the `@deepseek-ai/dsh` host manifest (pnpm-style layouts
+* where it is the meta package's own dependency — the
+* host-anchor fallback pattern in `dsh-version.ts`). A resolution failure that is not a
+* genuine NOT_FOUND propagates: a resolvable-but-broken specifier is not
+* evidence of absence.
+*/
+function resolveBackendRoot() {
+	const self = createRequire(import.meta.url);
+	const anchors = [self];
+	try {
+		anchors.push(createRequire(self.resolve(HOST_ANCHOR)));
+	} catch (error) {
+		if (!isNotFound(error)) throw error;
+	}
+	for (const anchor of anchors) try {
+		return dirname(anchor.resolve(`${TERMINAL_BACKEND}/package.json`));
+	} catch (error) {
+		if (!isNotFound(error)) throw error;
+	}
+}
+function isNotFound(error) {
+	const code = error?.code;
+	return code === "MODULE_NOT_FOUND" || code === "ERR_MODULE_NOT_FOUND";
+}
+/** Recursively collect `.js` sources under the package root, within budget. */
+function listSources(root) {
+	const files = [];
+	const visit = (dir) => {
+		for (const entry of readdirSync(dir, { withFileTypes: true })) {
+			if (files.length >= MAX_SOURCE_FILES) return;
+			const path = join(dir, entry.name);
+			if (entry.isDirectory() && entry.name !== "node_modules") visit(path);
+			else if (entry.isFile() && entry.name.endsWith(".js")) files.push(path);
+		}
+	};
+	visit(root);
+	return files;
+}
+const defaultIo = {
+	resolveBackendRoot,
+	listSources,
+	read: (path) => readFileSync(path, "utf8")
+};
+/**
+* Judge the installed terminal backend against the marker contract.
+*
+* Never throws: every outcome — absent package, unreadable source, missing
+* marker — is folded into the verdict so the caller's reaction is a policy
+* decision in one place.
+* @param io - filesystem seams; tests inject them, production uses real fs.
+* @returns the verdict.
+*/
+function agentPtyMarkerVerdict(io = defaultIo) {
+	let root;
+	try {
+		root = io.resolveBackendRoot();
+	} catch {
+		return "unverifiable";
+	}
+	if (root === void 0) return "uninstalled";
+	let files;
+	try {
+		files = io.listSources(root);
+	} catch {
+		return "unverifiable";
+	}
+	let remaining = MAX_TOTAL_BYTES;
+	for (const file of files) {
+		let content;
+		try {
+			content = io.read(file);
+		} catch {
+			return "unverifiable";
+		}
+		if (content.length > remaining) return "unverifiable";
+		if (content.includes("DSH_PTY_SESSION_ID")) return "stamped";
+		remaining -= content.length;
+	}
+	return "unverifiable";
+}
+/**
+* Enforce the contract: refuse when the marker cannot be confirmed.
+*
+* @param io - filesystem seams; tests inject them.
+* @throws {PtyMarkerContractError} on `unverifiable`.
+*/
+function assertAgentPtyMarker(io = defaultIo) {
+	if (agentPtyMarkerVerdict(io) !== "unverifiable") return;
+	let backend;
+	try {
+		backend = io.resolveBackendRoot();
+	} catch {}
+	throw new PtyMarkerContractError(`multi-root workspace: the installed ${TERMINAL_BACKEND} does not stamp ${AGENT_PTY_MARKER} on agent PTY spawns, or its sources cannot be verified. That marker is the only fact that separates an agent terminal from the user's own — without it the process fence cannot confine a restricted danger-full-access agent PTY without confining the user's terminal too. The plugin refuses to run rather than let agent terminals pass unconfined. See docs/decisions/ADR-0017-three-state-root-access-and-sandbox-modes.md.`, backend);
+}
+//#endregion
+//#region src/compat.ts
+/**
+* `multi-root-compat`: the startup gate that turns the DSH compatibility
+* contract from documentation into a precondition.
+*
+* Every widened-authority row of this bundle — `multi-root-providers`,
+* `multi-root-registry`, `multi-root-instructions`, `multi-root-lsp`,
+* `multi-root-workspace-files`, `multi-root-process-fence` — injects
+* `multiRootCompat`. Cordis will not start a plugin whose injected service is
+* absent, so this row is what decides whether they run at all:
+*
+* ```text
+* compat check passes  →  ctx.multiRootCompat exists  →  the gated rows start
+* compat check fails   →  the row throws             →  they never start
+* ```
+*
+* The two PROVIDER rows (`multi-root-fs`, `multi-root-sandbox`) deliberately
+* do NOT inject the gate: their widening is scope-driven, and the gated
+* registry can never populate the scope on a refused installation — so they
+* degenerate to the upstream providers. That is what keeps a refused gate a
+* loud degradation (the plugin's features absent, the profile intact) instead
+* of a dead profile: upstream `fs-sandbox`/`sandbox` are already disabled by
+* the patch, so holding `ctx.fs`/`ctx.sandbox` back would take `ctx.shell`,
+* `permissionPresets` and every confining tool down with them.
+*
+* That is why the gate is a plain `apply` and not a `Service` subclass mounted
+* directly: the check has to be able to fail BEFORE the service exists. A
+* `Service` constructor has already run `super(ctx, name)` — and therefore
+* already claimed the service key — by the time it could inspect anything.
+*
+* The verdict itself, and the allowlist it is judged against, live in
+* `./compat/dsh-version.ts`. This module owns only the reaction to it.
+*
+* @module @dsh-electron/dsh-plugin-multi-root-workspace/compat
+*/
+/**
+* Raised when the installed DSH release is not one this plugin is verified
+* against. It is thrown from `apply`, so it surfaces as a plugin load failure
+* with the full diagnosis attached — never as a silently degraded sandbox.
+*/
+var DshCompatUnsupportedError = class extends Error {
+	/** The report that produced the refusal. */
+	report;
+	constructor(report) {
+		super(report.message);
+		this.name = "DshCompatUnsupportedError";
+		this.report = report;
+	}
+};
+/**
+* The `ctx.multiRootCompat` service: the resolved compatibility verdict, held
+* where the gated providers can read it.
+*
+* It intentionally exposes no per-version capability flags. The adapters under
+* `./compat/` detect the shape they need STRUCTURALLY — whether a return value
+* is a thenable, which export name a module carries — because a structural
+* probe also survives upstream reshaping something within one release, while a
+* version comparison does not. The release string here is for installation and
+* feature-availability gates (such as the OPS 0.2.* policy), and diagnostics.
+*/
+var MultiRootCompatService = class extends Service {
+	/** The verdict this composition started under. */
+	report;
+	constructor(ctx, report) {
+		super(ctx, "multiRootCompat");
+		this.report = report;
+	}
+	/** The single DSH release every inspected core package agreed on. */
+	get release() {
+		return this.report.release;
+	}
+	/** Whether the installation is on the allowlist. */
+	get supported() {
+		return this.report.verdict === "supported";
+	}
+};
+/** This row needs nothing: it is the thing everything else waits for. */
+const inject = [];
+/**
+* Apply the gate policy to one report.
+*
+* Under `DSH_MULTI_ROOT_COMPAT=warn` exactly one verdict is relaxed: an
+* `unsupported` release that every inspected package agrees on. That is the
+* only shape the upgrade smoke probes — a coherent tree on a release the
+* allowlist does not name yet, which is how a release earns its place there.
+* `mixed` and `incomplete` describe an installation the contract cannot judge
+* at all, so they are refused in either mode; production deployments leave the
+* variable unset and get the refusal for everything.
+* @param report - the verdict to act on.
+* @param enforcement - how to react to a non-`supported` verdict.
+* @returns the warning to log, or `undefined` when there is nothing to say.
+* @throws {DshCompatUnsupportedError} when refusing to run.
+*/
+function assertSupportedInstallation(report, enforcement) {
+	if (report.verdict === "supported") return void 0;
+	if (enforcement === "enforce" || report.verdict !== "unsupported") throw new DshCompatUnsupportedError(report);
+	return `${report.message}\n\nProceeding anyway because ${COMPAT_ENFORCEMENT_ENV}=warn. This is an upgrade-smoke mode: additional workspace roots are about to be granted through a sandbox profile shape that has not been verified on this release. Supported releases: ${SUPPORTED_DSH_RELEASES.join(", ")}.`;
+}
+/**
+* Judge the installation, then either refuse to provide the service or provide
+* it.
+* @param ctx - the row's context.
+*/
+function apply(ctx) {
+	const report = classifyInstallation();
+	const warning = assertSupportedInstallation(report, compatEnforcement());
+	if (warning !== void 0) ctx.logger.warn(warning);
+	assertAgentPtyMarker();
+	ctx.plugin(MultiRootCompatService, report);
+}
+//#endregion
+export { inject as a, agentPtyMarkerVerdict as c, assertSupportedInstallation as i, assertAgentPtyMarker as l, MultiRootCompatService as n, AGENT_PTY_MARKER as o, apply as r, PtyMarkerContractError as s, DshCompatUnsupportedError as t };

package/lib/compat.js

@@ -1,2 +1,2 @@
-import { a as inject, i as assertSupportedInstallation, n as MultiRootCompatService, r as apply, t as DshCompatUnsupportedError } from "./compat-veDqCOoa.js";
+import { a as inject, i as assertSupportedInstallation, n as MultiRootCompatService, r as apply, t as DshCompatUnsupportedError } from "./compat-CTJbpCxu.js";
 export { DshCompatUnsupportedError, MultiRootCompatService, apply, assertSupportedInstallation, inject };

package/lib/{dialects-Dr4rDR-H.js → dialects-CdlG3RF9.js}

@@ -1,5 +1,5 @@
 import { t as DialectUnrecognizedError } from "./windows-runner-contract-B5R2K3mM.js";
-import { l as isCanonicallyUnder } from "./roots-Ca_W1S9n.js";
+import { l as isCanonicallyUnder } from "./roots-CmaWxRVy.js";
 import { posix } from "node:path";
 //#region src/compat/sandbox-confine.ts
 /** Whether a value is a thenable, i.e. whether the installed `confine` is async. */

package/lib/{compat-veDqCOoa.js → dsh-version-DCwF7REk.js}

@@ -1,7 +1,6 @@
 import { createRequire } from "node:module";
-import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { dirname, join, sep } from "node:path";
-import { Service } from "@deepseek-ai/cordis";
 import { fileURLToPath } from "node:url";
 //#region src/compat/dsh-version.ts
 /**
@@ -354,265 +353,4 @@ function report(verdict, release, packages, lines) {
 	};
 }
 //#endregion
-//#region src/compat/pty-marker.ts
-/**
-* Boot-time probe for the agent-PTY marker contract.
-*
-* `multi-root-process-fence` tells an agent terminal from the user's own by
-* one env fact: every supported `dsh-terminal-bash` backend stamps
-* `DSH_PTY_SESSION_ID` (alongside `DSH_SESSION_ID`) into the PTY spawn spec,
-* while the panel's terminal controller stamps only `DSH_SESSION_ID`. That
-* marker is the ONLY discriminator — a backend that ever stops stamping it
-* would reclassify agent PTYs as user terminals and pass them through
-* unconfined under a restricted `danger-full-access`, which is a silent
-* fail-open on a security boundary.
-*
-* The marker is an env key inside upstream's emitted code, not an exported
-* symbol, so the honest structural probe is content: the installed backend
-* package must still write the marker. This module is called from the
-* `multi-root-compat` gate (`src/compat.ts`) BEFORE the service registers —
-* like the version verdict it is a precondition, not a diagnostic, and a
-* breach refuses the composition the same way `mixed`/`incomplete` do: it is
-* not relaxable by `DSH_MULTI_ROOT_COMPAT=warn`.
-*
-* Resolution follows the optional-peer precedent (`agent-instructions.ts`):
-* the backend is not a peer of this plugin, so the plugin anchor is tried
-* first (flat layouts) and the `@deepseek-ai/dsh` host anchor second — the
-* same host-anchor fallback pattern as `dsh-version.ts` — because the
-* backend rides inside the harness meta package's own dependency tree.
-*
-* @module @dsh-electron/dsh-plugin-multi-root-workspace/compat/pty-marker
-*/
-/** The env key that identifies an agent-launched PTY spawn spec. */
-const AGENT_PTY_MARKER = "DSH_PTY_SESSION_ID";
-/** The upstream package whose backend owns the marker stamp. */
-const TERMINAL_BACKEND = "@deepseek-ai/dsh-terminal-bash";
-/** The harness meta package the backend rides inside (its dependency). */
-const HOST_ANCHOR = "@deepseek-ai/dsh/package.json";
-/** Scan budget: enough for any plausible backend layout, bounded forever. */
-const MAX_SOURCE_FILES = 256;
-const MAX_TOTAL_BYTES = 8388608;
-/**
-* Raised when the installed terminal backend does not uphold the marker
-* contract. Thrown from `apply` like `DshCompatUnsupportedError`, so it
-* surfaces as a plugin load failure with the diagnosis attached.
-*/
-var PtyMarkerContractError = class extends Error {
-	/** The resolved backend path when one was found. */
-	backend;
-	constructor(message, backend) {
-		super(message);
-		this.name = "PtyMarkerContractError";
-		this.backend = backend;
-	}
-};
-/**
-* Resolve the backend package root through the two anchors the contract can
-* reach: this module first (flat layouts where the backend is a direct
-* install), then the `@deepseek-ai/dsh` host manifest (pnpm-style layouts
-* where it is the meta package's own dependency — the
-* host-anchor fallback pattern in `dsh-version.ts`). A resolution failure that is not a
-* genuine NOT_FOUND propagates: a resolvable-but-broken specifier is not
-* evidence of absence.
-*/
-function resolveBackendRoot() {
-	const self = createRequire(import.meta.url);
-	const anchors = [self];
-	try {
-		anchors.push(createRequire(self.resolve(HOST_ANCHOR)));
-	} catch (error) {
-		if (!isNotFound(error)) throw error;
-	}
-	for (const anchor of anchors) try {
-		return dirname(anchor.resolve(`${TERMINAL_BACKEND}/package.json`));
-	} catch (error) {
-		if (!isNotFound(error)) throw error;
-	}
-}
-function isNotFound(error) {
-	const code = error?.code;
-	return code === "MODULE_NOT_FOUND" || code === "ERR_MODULE_NOT_FOUND";
-}
-/** Recursively collect `.js` sources under the package root, within budget. */
-function listSources(root) {
-	const files = [];
-	const visit = (dir) => {
-		for (const entry of readdirSync(dir, { withFileTypes: true })) {
-			if (files.length >= MAX_SOURCE_FILES) return;
-			const path = join(dir, entry.name);
-			if (entry.isDirectory() && entry.name !== "node_modules") visit(path);
-			else if (entry.isFile() && entry.name.endsWith(".js")) files.push(path);
-		}
-	};
-	visit(root);
-	return files;
-}
-const defaultIo = {
-	resolveBackendRoot,
-	listSources,
-	read: (path) => readFileSync(path, "utf8")
-};
-/**
-* Judge the installed terminal backend against the marker contract.
-*
-* Never throws: every outcome — absent package, unreadable source, missing
-* marker — is folded into the verdict so the caller's reaction is a policy
-* decision in one place.
-* @param io - filesystem seams; tests inject them, production uses real fs.
-* @returns the verdict.
-*/
-function agentPtyMarkerVerdict(io = defaultIo) {
-	let root;
-	try {
-		root = io.resolveBackendRoot();
-	} catch {
-		return "unverifiable";
-	}
-	if (root === void 0) return "uninstalled";
-	let files;
-	try {
-		files = io.listSources(root);
-	} catch {
-		return "unverifiable";
-	}
-	let remaining = MAX_TOTAL_BYTES;
-	for (const file of files) {
-		let content;
-		try {
-			content = io.read(file);
-		} catch {
-			return "unverifiable";
-		}
-		if (content.length > remaining) return "unverifiable";
-		if (content.includes("DSH_PTY_SESSION_ID")) return "stamped";
-		remaining -= content.length;
-	}
-	return "unverifiable";
-}
-/**
-* Enforce the contract: refuse when the marker cannot be confirmed.
-*
-* @param io - filesystem seams; tests inject them.
-* @throws {PtyMarkerContractError} on `unverifiable`.
-*/
-function assertAgentPtyMarker(io = defaultIo) {
-	if (agentPtyMarkerVerdict(io) !== "unverifiable") return;
-	let backend;
-	try {
-		backend = io.resolveBackendRoot();
-	} catch {}
-	throw new PtyMarkerContractError(`multi-root workspace: the installed ${TERMINAL_BACKEND} does not stamp ${AGENT_PTY_MARKER} on agent PTY spawns, or its sources cannot be verified. That marker is the only fact that separates an agent terminal from the user's own — without it the process fence cannot confine a restricted danger-full-access agent PTY without confining the user's terminal too. The plugin refuses to run rather than let agent terminals pass unconfined. See docs/decisions/ADR-0017-three-state-root-access-and-sandbox-modes.md.`, backend);
-}
-//#endregion
-//#region src/compat.ts
-/**
-* `multi-root-compat`: the startup gate that turns the DSH compatibility
-* contract from documentation into a precondition.
-*
-* Every widened-authority row of this bundle — `multi-root-providers`,
-* `multi-root-registry`, `multi-root-instructions`, `multi-root-lsp`,
-* `multi-root-workspace-files`, `multi-root-process-fence` — injects
-* `multiRootCompat`. Cordis will not start a plugin whose injected service is
-* absent, so this row is what decides whether they run at all:
-*
-* ```text
-* compat check passes  →  ctx.multiRootCompat exists  →  the gated rows start
-* compat check fails   →  the row throws             →  they never start
-* ```
-*
-* The two PROVIDER rows (`multi-root-fs`, `multi-root-sandbox`) deliberately
-* do NOT inject the gate: their widening is scope-driven, and the gated
-* registry can never populate the scope on a refused installation — so they
-* degenerate to the upstream providers. That is what keeps a refused gate a
-* loud degradation (the plugin's features absent, the profile intact) instead
-* of a dead profile: upstream `fs-sandbox`/`sandbox` are already disabled by
-* the patch, so holding `ctx.fs`/`ctx.sandbox` back would take `ctx.shell`,
-* `permissionPresets` and every confining tool down with them.
-*
-* That is why the gate is a plain `apply` and not a `Service` subclass mounted
-* directly: the check has to be able to fail BEFORE the service exists. A
-* `Service` constructor has already run `super(ctx, name)` — and therefore
-* already claimed the service key — by the time it could inspect anything.
-*
-* The verdict itself, and the allowlist it is judged against, live in
-* `./compat/dsh-version.ts`. This module owns only the reaction to it.
-*
-* @module @dsh-electron/dsh-plugin-multi-root-workspace/compat
-*/
-/**
-* Raised when the installed DSH release is not one this plugin is verified
-* against. It is thrown from `apply`, so it surfaces as a plugin load failure
-* with the full diagnosis attached — never as a silently degraded sandbox.
-*/
-var DshCompatUnsupportedError = class extends Error {
-	/** The report that produced the refusal. */
-	report;
-	constructor(report) {
-		super(report.message);
-		this.name = "DshCompatUnsupportedError";
-		this.report = report;
-	}
-};
-/**
-* The `ctx.multiRootCompat` service: the resolved compatibility verdict, held
-* where the gated providers can read it.
-*
-* It intentionally exposes no per-version capability flags. The adapters under
-* `./compat/` detect the shape they need STRUCTURALLY — whether a return value
-* is a thenable, which export name a module carries — because a structural
-* probe also survives upstream reshaping something within one release, while a
-* version comparison does not. The release string here is for the gate and for
-* diagnostics.
-*/
-var MultiRootCompatService = class extends Service {
-	/** The verdict this composition started under. */
-	report;
-	constructor(ctx, report) {
-		super(ctx, "multiRootCompat");
-		this.report = report;
-	}
-	/** The single DSH release every inspected core package agreed on. */
-	get release() {
-		return this.report.release;
-	}
-	/** Whether the installation is on the allowlist. */
-	get supported() {
-		return this.report.verdict === "supported";
-	}
-};
-/** This row needs nothing: it is the thing everything else waits for. */
-const inject = [];
-/**
-* Apply the gate policy to one report.
-*
-* Under `DSH_MULTI_ROOT_COMPAT=warn` exactly one verdict is relaxed: an
-* `unsupported` release that every inspected package agrees on. That is the
-* only shape the upgrade smoke probes — a coherent tree on a release the
-* allowlist does not name yet, which is how a release earns its place there.
-* `mixed` and `incomplete` describe an installation the contract cannot judge
-* at all, so they are refused in either mode; production deployments leave the
-* variable unset and get the refusal for everything.
-* @param report - the verdict to act on.
-* @param enforcement - how to react to a non-`supported` verdict.
-* @returns the warning to log, or `undefined` when there is nothing to say.
-* @throws {DshCompatUnsupportedError} when refusing to run.
-*/
-function assertSupportedInstallation(report, enforcement) {
-	if (report.verdict === "supported") return void 0;
-	if (enforcement === "enforce" || report.verdict !== "unsupported") throw new DshCompatUnsupportedError(report);
-	return `${report.message}\n\nProceeding anyway because ${COMPAT_ENFORCEMENT_ENV}=warn. This is an upgrade-smoke mode: additional workspace roots are about to be granted through a sandbox profile shape that has not been verified on this release. Supported releases: ${SUPPORTED_DSH_RELEASES.join(", ")}.`;
-}
-/**
-* Judge the installation, then either refuse to provide the service or provide
-* it.
-* @param ctx - the row's context.
-*/
-function apply(ctx) {
-	const report = classifyInstallation();
-	const warning = assertSupportedInstallation(report, compatEnforcement());
-	if (warning !== void 0) ctx.logger.warn(warning);
-	assertAgentPtyMarker();
-	ctx.plugin(MultiRootCompatService, report);
-}
-//#endregion
-export { classifyInstallation as _, inject as a, agentPtyMarkerVerdict as c, HOST_SERVICE_PACKAGES as d, OPTIONAL_CORE_PACKAGES as f, SUPPORTED_DSH_RELEASES as g, RUNTIME_OPTIONAL_PACKAGES as h, assertSupportedInstallation as i, assertAgentPtyMarker as l, RUNNER_ANCHORED_PACKAGES as m, MultiRootCompatService as n, AGENT_PTY_MARKER as o, REQUIRED_CORE_PACKAGES as p, apply as r, PtyMarkerContractError as s, DshCompatUnsupportedError as t, CORE_PACKAGES as u, compatEnforcement as v, readInstalledVersion as y };
+export { REQUIRED_CORE_PACKAGES as a, SUPPORTED_DSH_RELEASES as c, readInstalledVersion as d, OPTIONAL_CORE_PACKAGES as i, classifyInstallation as l, CORE_PACKAGES as n, RUNNER_ANCHORED_PACKAGES as o, HOST_SERVICE_PACKAGES as r, RUNTIME_OPTIONAL_PACKAGES as s, COMPAT_ENFORCEMENT_ENV as t, compatEnforcement as u };