@dsh-electron/dsh-plugin-multi-root-workspace 0.1.14 → 0.1.15

package/lib/instructions.js

@@ -1,2 +1,2 @@
-import { a as composeInstructionMessage, i as apply, n as DEFAULT_MAX_SOURCE_BYTES, o as inject, r as PLUGIN_SOURCE, s as touchedPathOfToolCall, t as DEFAULT_MAX_BYTES } from "./instructions-KsUwUFE0.js";
+import { a as composeInstructionMessage, i as apply, l as touchedPathOfToolCall, n as DEFAULT_MAX_SOURCE_BYTES, o as inject, r as PLUGIN_SOURCE, t as DEFAULT_MAX_BYTES } from "./instructions-Ck9wp4J4.js";
 export { DEFAULT_MAX_BYTES, DEFAULT_MAX_SOURCE_BYTES, PLUGIN_SOURCE, apply, composeInstructionMessage, inject, touchedPathOfToolCall };

package/lib/llm-message-CepyzEBQ.js

@@ -0,0 +1,84 @@
+//#region src/compat/llm-message.ts
+/**
+* This plugin's own producer kind.
+*
+* Session format 4 rejects the shared `kind: 'plugin'` (`format v4 message
+* requires a producer-owned source kind`). The kind is ours, not
+* `agent-instructions`: upstream treats that kind's `changes` array as its
+* own reconciliation authority.
+*/
+const PRODUCER_SOURCE_KIND = "multi-root-workspace";
+/**
+* The first session format whose encoder refuses `kind: 'plugin'`.
+* Earlier formats declare that kind on `MessageSourceMap` and require it.
+*/
+const PRODUCER_OWNED_FORMAT = 4;
+/**
+* Which source kind the installed session format will persist.
+* @param formatVersion - `SESSION_FORMAT_VERSION`, when the session package is installed.
+* @returns `plugin` through format 3, and this plugin's own kind from format 4 on.
+*/
+function instructionSourceKind(formatVersion) {
+	return formatVersion !== void 0 && formatVersion >= PRODUCER_OWNED_FORMAT ? PRODUCER_SOURCE_KIND : "plugin";
+}
+/**
+* The installed session format, when that package is present.
+*
+* A composition that never persists a session can omit the package; format 3
+* is then the spelling that still declares `kind: 'plugin'`. Any other failure
+* is a broken install and must surface.
+* @returns the format version, or `undefined` when the package is not installed.
+*/
+async function installedFormatVersion() {
+	try {
+		const session = await import("@deepseek-ai/dsh-session");
+		return typeof session.SESSION_FORMAT_VERSION === "number" ? session.SESSION_FORMAT_VERSION : void 0;
+	} catch (error) {
+		const code = error.code;
+		if (code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND") return void 0;
+		throw error;
+	}
+}
+/**
+* Build one user-role instruction message.
+*
+* Format 3 and earlier: `{ kind: 'plugin', plugin, form: 'instructions' }`.
+* Format 4 and later: `{ kind: 'multi-root-workspace', plugin, form: 'instructions' }`.
+* @param input - the body and the plugin attribution.
+* @returns the frozen message upstream's helper produced.
+* @throws {Error} when the optional peer is absent: a step that has instruction
+*   text to deliver cannot be served without it, and staying silent would drop
+*   user-visible context instead of reporting a misconfigured composition.
+*/
+async function createInstructionMessage(input) {
+	let module;
+	try {
+		module = await import("@deepseek-ai/dsh-llm");
+	} catch (error) {
+		throw new Error(`multi-root workspace: @deepseek-ai/dsh-llm is not installed, so additional roots' instruction files cannot be delivered as messages (${error instanceof Error ? error.message : String(error)}).`);
+	}
+	const create = module.createUserMessage;
+	return create({
+		content: [{
+			type: "text",
+			text: input.text
+		}],
+		source: instructionSource(input.plugin, await installedFormatVersion())
+	});
+}
+/** The source object the installed format will persist. */
+function instructionSource(plugin, formatVersion) {
+	const kind = instructionSourceKind(formatVersion);
+	if (kind === "plugin") return {
+		kind,
+		plugin,
+		form: "instructions"
+	};
+	return {
+		kind,
+		plugin,
+		form: "instructions"
+	};
+}
+//#endregion
+export { createInstructionMessage as t };

package/lib/lsp.js

@@ -1,7 +1,7 @@
-import { t as wrapMethod } from "./method-wrapper-CFY3p3j2.js";
+import { t as wrapMethod } from "./method-wrapper-D4oUCsEF.js";
 import { c as withRegistryRead } from "./registry-operation-C2ZV3Jhw.js";
-import { t as aroundTool } from "./tool-context-CpgIFcCB.js";
-import { t as routeWorkspacePath } from "./workspace-routing-YPxaQ4V3.js";
+import { t as aroundTool } from "./tool-context-CCeY3mrK.js";
+import { t as routeWorkspacePath } from "./workspace-routing-D_qwMUh-.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/lsp.ts
 const inject = [

package/lib/{metadata-DgqSdVX_.js → metadata-99jgViHQ.js}

@@ -1,4 +1,4 @@
-import { t as RootValidationError } from "./roots-Ca_W1S9n.js";
+import { t as RootValidationError } from "./roots-CmaWxRVy.js";
 import { createHash } from "node:crypto";
 import { basename } from "node:path";
 //#region src/skills/metadata.ts

package/lib/{method-wrapper-CFY3p3j2.js → method-wrapper-D4oUCsEF.js}

@@ -1,4 +1,14 @@
 //#region src/method-wrapper.ts
+const layers = /* @__PURE__ */ new WeakMap();
+function liveDescriptor(target, key, descriptor) {
+	let current = descriptor;
+	while (typeof current?.value === "function") {
+		const layer = layers.get(current.value);
+		if (layer === void 0 || layer.active || layer.target !== target || layer.key !== key) break;
+		current = layer.own;
+	}
+	return current;
+}
 /** Wrap a public method on a Cordis service without capturing a caller-context proxy. */
 function wrapMethod(target, key, wrap) {
 	const own = Object.getOwnPropertyDescriptor(target, key);
@@ -10,6 +20,14 @@ function wrapMethod(target, key, wrap) {
 	}
 	if (typeof descriptor?.value !== "function") throw new Error(`multi-root: ${String(key)} is not a public method`);
 	const value = wrap(descriptor.value);
+	if (value === descriptor.value) return () => {};
+	const layer = {
+		target,
+		key,
+		own,
+		active: true
+	};
+	layers.set(value, layer);
 	Object.defineProperty(target, key, {
 		configurable: true,
 		writable: true,
@@ -17,9 +35,11 @@ function wrapMethod(target, key, wrap) {
 		value
 	});
 	return () => {
+		layer.active = false;
 		if (Object.getOwnPropertyDescriptor(target, key)?.value !== value) return;
-		if (own === void 0) Reflect.deleteProperty(target, key);
-		else Object.defineProperty(target, key, own);
+		const previous = liveDescriptor(target, key, own);
+		if (previous === void 0) Reflect.deleteProperty(target, key);
+		else Object.defineProperty(target, key, previous);
 	};
 }
 //#endregion

package/lib/{native-win32-CRNXr11U.js → native-win32-C5oMtt7f.js}

@@ -1,4 +1,4 @@
-import { c as loadHostKoffi } from "./protocol-CnR1KTXy.js";
+import { c as loadHostKoffi } from "./protocol-CwDnFEyK.js";
 import { EventEmitter } from "node:events";
 //#region src/authority/native-win32.ts
 /** Windows local pipes: tokens, never a caller-supplied PID or a bearer file. */

package/lib/ops-compatibility.js

@@ -0,0 +1,58 @@
+import { n as opsCompatibilityField, t as installOpsCompatibilitySettings } from "./ops-settings-UN2oOKEp.js";
+import { t as configValue } from "./skills-utyuvmwr.js";
+import { randomUUID } from "node:crypto";
+import { Service } from "@deepseek-ai/cordis";
+import z from "@deepseek-ai/schemastery";
+//#region src/ops-compatibility.ts
+const enabledField = opsCompatibilityField(z.boolean().default(false));
+const experimental = enabledField.experimental;
+const described = typeof experimental === "function" ? experimental.call(enabledField) : enabledField;
+const Config = z.object({ enabled: described.description("OPS 兼容模式（实验性，仅限 DSH 0.2.*）：可能存在功能、版本和平台限制。启用 OPS 写保护、实时活动与 Review 增强；受限模式可能拒绝附加根操作（包括读取），后台缓存可能残留；关闭时显式只读附加根可能被 OPS 写入。") });
+var MultiRootOpsCompatibility = class extends Service {
+	settingsConfig;
+	static Config = Config;
+	static provide = "multiRootOpsCompatibility";
+	static inject = [
+		"multiRootCompat",
+		"multiRootProviders",
+		"multiRootScope"
+	];
+	constructor(ctx, settingsConfig = {}) {
+		super(ctx, "multiRootOpsCompatibility");
+		this.settingsConfig = settingsConfig;
+		const settings = installOpsCompatibilitySettings(ctx, () => this.settingsConfig.enabled, () => this.sync());
+		this.settingsRead = settings.read;
+		ctx.effect(() => () => {
+			this.closing = true;
+			this.enabledNow = false;
+			this.currentToken = void 0;
+		});
+		this.sync();
+	}
+	settingsRead;
+	currentToken;
+	enabledNow = false;
+	closing = false;
+	get token() {
+		this.sync();
+		return this.currentToken;
+	}
+	get enabled() {
+		this.sync();
+		return this.enabledNow;
+	}
+	sync() {
+		if (this.closing) {
+			this.enabledNow = false;
+			this.currentToken = void 0;
+			return;
+		}
+		const raw = this.settingsRead?.();
+		const enabled = configValue(raw) === true;
+		if (enabled === this.enabledNow) return;
+		this.enabledNow = enabled;
+		this.currentToken = enabled ? Object.freeze({ id: randomUUID() }) : void 0;
+	}
+};
+//#endregion
+export { Config, MultiRootOpsCompatibility, MultiRootOpsCompatibility as default };

package/lib/ops-settings-UN2oOKEp.js

@@ -0,0 +1,40 @@
+import { d as readInstalledVersion } from "./dsh-version-DCwF7REk.js";
+/** Product availability policy, independent of structural Settings adaptation. */
+function opsCompatibilityRelease(release) {
+	return release !== void 0 && /^0\.2\.\d+(?:[-+].*)?$/.test(release);
+}
+/** Unsupported hosts retain the config input but expose no editable live field. */
+function opsCompatibilityField(schema) {
+	if (!opsCompatibilityRelease(readInstalledVersion("@deepseek-ai/dsh-sandbox"))) return schema;
+	const method = schema.volatile;
+	return typeof method === "function" ? method.call(schema) : schema;
+}
+function installOpsCompatibilitySettings(ctx, initial, changed) {
+	let active = false;
+	return {
+		fiber: ctx.inject(["settings"], (scope) => {
+			if (!opsCompatibilityRelease(scope.get("multiRootCompat")?.release)) return;
+			const settings = scope.get("settings");
+			if (typeof settings.configure !== "function") return;
+			const stop = settings.configure({ auto: false }, ctx.fiber);
+			active = true;
+			const stopEvent = scope.on("settings/document-updated", (id) => {
+				if (id === "multi-root-ops-compatibility") changed();
+			});
+			changed();
+			return () => {
+				active = false;
+				stopEvent();
+				stop();
+				changed();
+			};
+		}),
+		read: () => active && opsCompatibilityRelease(ctx.get("multiRootCompat")?.release) ? initial() : void 0
+	};
+}
+function opsCompatibilityToken(ctx) {
+	const service = ctx.get("multiRootOpsCompatibility");
+	return service === void 0 ? void 0 : service.token;
+}
+//#endregion
+export { opsCompatibilityField as n, opsCompatibilityToken as r, installOpsCompatibilitySettings as t };

package/lib/ops-tools-k4JYaOrM.js

@@ -0,0 +1,152 @@
+import { r as opsCompatibilityToken } from "./ops-settings-UN2oOKEp.js";
+import { realpathSync } from "node:fs";
+import { isAbsolute, relative } from "node:path";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { tmpdir } from "node:os";
+//#region src/compat/ops-tools.ts
+const OPS_TOOL_PREFIX = "ops_";
+const OPS_EXEC_RAW_NAMES = [
+	"inspect_local_file",
+	"grep",
+	"glob",
+	"replace",
+	"write_file",
+	"edit_file",
+	"diff",
+	"stat",
+	"copy",
+	"move",
+	"remove",
+	"read_files",
+	"read_table",
+	"read_docx",
+	"read_pdf",
+	"batch",
+	"result",
+	"bash"
+];
+const OPS_PUBLISH_RAW_NAMES = ["discover_tools", "load_sdk"];
+OPS_EXEC_RAW_NAMES.map((raw) => OPS_TOOL_PREFIX + raw);
+function classifyOpsTool(name) {
+	if (typeof name !== "string" || !name.startsWith("ops_")) return "other";
+	const raw = name.slice(4);
+	if (OPS_EXEC_RAW_NAMES.includes(raw)) return "exec";
+	if (OPS_PUBLISH_RAW_NAMES.includes(raw)) return "publish";
+	return "unknown";
+}
+const spawnPermit = new AsyncLocalStorage();
+function withOpsSpawnPermit(state, body) {
+	const permit = {
+		state,
+		active: true
+	};
+	try {
+		return spawnPermit.run(permit, body);
+	} finally {
+		permit.active = false;
+	}
+}
+function opsSpawnPermitted(state) {
+	const permit = spawnPermit.getStore();
+	return permit?.state === state && permit.active;
+}
+function createOpsProtectionState() {
+	return {
+		owner: void 0,
+		entered: 0,
+		drainWaiters: /* @__PURE__ */ new Set()
+	};
+}
+function claimOpsProtection(state) {
+	const owner = {};
+	state.owner = owner;
+	return owner;
+}
+function revokeOpsProtection(state, token) {
+	if (state.owner === token) state.owner = void 0;
+}
+function opsProtectionReady(state) {
+	return state.owner !== void 0;
+}
+function assertOpsProtectionOwner(state, token) {
+	if (state.owner !== token) throw new Error("multi-root workspace: the OPS execution protection generation was replaced during dispatch");
+}
+function enterOpsProtection(state) {
+	if (state.owner === void 0) throw new Error("multi-root workspace: the OPS execution protection is not installed on this scope");
+	state.entered += 1;
+	return state.owner;
+}
+function leaveOpsProtection(state) {
+	state.entered -= 1;
+	if (state.entered === 0) {
+		for (const resolve of state.drainWaiters) resolve();
+		state.drainWaiters.clear();
+	}
+}
+async function drainOpsProtection(state) {
+	if (state.entered === 0) return;
+	await new Promise((resolve) => state.drainWaiters.add(resolve));
+}
+const OPS_RESULT_CACHE_LEAF = /^dsh-ops-results-[0-9a-f]{64}$/u;
+function cacheRefusal(detail) {
+	return /* @__PURE__ */ new Error(`multi-root workspace: ${detail}; refusing to prepare the OPS execution`);
+}
+function containsPath(root, path) {
+	if (root === path) return true;
+	const rel = relative(root, path);
+	return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+}
+function assertOpsPosixCacheAdmission(deniedRoots) {
+	let canonicalTmp;
+	try {
+		canonicalTmp = realpathSync.native(tmpdir());
+	} catch (error) {
+		throw cacheRefusal(`the canonical temporary directory cannot be resolved (${error.message})`);
+	}
+	if (!isAbsolute(canonicalTmp)) throw cacheRefusal("the canonical temporary directory is not absolute");
+	const rawTmp = tmpdir();
+	const spellings = /* @__PURE__ */ new Set();
+	for (const root of deniedRoots) {
+		if (root === "") continue;
+		spellings.add(root);
+		try {
+			spellings.add(realpathSync.native(root));
+		} catch {}
+		if (containsPath(rawTmp, root) || root === rawTmp) {
+			const rel = relative(rawTmp, root);
+			spellings.add(rel === "" ? canonicalTmp : canonicalTmp + "/" + rel);
+		}
+	}
+	for (const deny of spellings) {
+		if (containsPath(deny, canonicalTmp)) throw cacheRefusal(`a deny boundary ${JSON.stringify(deny)} covers the temporary directory`);
+		const rel = relative(canonicalTmp, deny);
+		if (rel === "" || rel.startsWith("..") || isAbsolute(rel)) continue;
+		const first = rel.split("/")[0];
+		if (first !== void 0 && OPS_RESULT_CACHE_LEAF.test(first)) throw cacheRefusal(`a deny boundary ${JSON.stringify(deny)} overlaps the OPS result cache`);
+	}
+}
+const object = (value) => typeof value === "object" && value !== null;
+function opsDispatchBarrier(ctx, scope, exec) {
+	if (opsCompatibilityToken(ctx) === void 0) return void 0;
+	const kind = classifyOpsTool(exec.name);
+	if (kind === "other" || kind === "publish") return void 0;
+	if (ctx.get("multiRootCompat") === void 0 || ctx.get("multiRootProviders") === void 0) return void 0;
+	const session = exec.agent?.session;
+	const policyService = ctx.get("sandboxPolicy");
+	let policy;
+	if (session !== void 0 && policyService !== void 0) try {
+		policy = policyService.resolve({ session });
+	} catch {
+		policy = void 0;
+	}
+	if (policy === void 0) return `the OPS tool ${JSON.stringify(exec.name)} cannot be confirmed against a trusted session and policy`;
+	const preview = scope.previewForTool(policy, exec.name);
+	if (preview.authority === "unavailable") return `the multi-root registry authority is unavailable; the OPS call ${JSON.stringify(exec.name)} is refused before dispatch`;
+	if (preview.deniedRoots.length === 0) return void 0;
+	if (policy.mode !== "danger-full-access") return `the OPS call ${JSON.stringify(exec.name)} is refused in ${policy.mode}: private preparation and worker write boundaries cannot be proven without OPS integration`;
+	if (kind === "unknown") return `the unrecognized OPS capability ${JSON.stringify(exec.name)} is refused while write boundaries apply`;
+	if (!opsProtectionReady(scope.opsProtection)) return `the OPS execution protection is not installed; the call ${JSON.stringify(exec.name)} is refused`;
+	if (exec.name === `ops_bash` && object(exec.arguments) && exec.arguments.run_in_background === true) return "run_in_background is refused while danger-full-access write boundaries apply";
+}
+//#endregion
+export { createOpsProtectionState as a, leaveOpsProtection as c, revokeOpsProtection as d, withOpsSpawnPermit as f, classifyOpsTool as i, opsDispatchBarrier as l, assertOpsProtectionOwner as n, drainOpsProtection as o, claimOpsProtection as r, enterOpsProtection as s, assertOpsPosixCacheAdmission as t, opsSpawnPermitted as u };

package/lib/process-fence.js

@@ -1,7 +1,9 @@
-import { t as wrapMethod } from "./method-wrapper-CFY3p3j2.js";
+import { t as wrapMethod } from "./method-wrapper-D4oUCsEF.js";
 import { s as withRegistryAdmission } from "./registry-operation-C2ZV3Jhw.js";
-import { t as aroundTool } from "./tool-context-CpgIFcCB.js";
-import { n as detectDialect, s as confineInstalled } from "./dialects-Dr4rDR-H.js";
+import { t as aroundTool } from "./tool-context-CCeY3mrK.js";
+import { r as opsCompatibilityToken } from "./ops-settings-UN2oOKEp.js";
+import { n as detectDialect, s as confineInstalled } from "./dialects-CdlG3RF9.js";
+import { c as leaveOpsProtection, d as revokeOpsProtection, f as withOpsSpawnPermit, i as classifyOpsTool, n as assertOpsProtectionOwner, o as drainOpsProtection, r as claimOpsProtection, s as enterOpsProtection, t as assertOpsPosixCacheAdmission } from "./ops-tools-k4JYaOrM.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/compat/process-profile.ts
 /** Structural runner recognition shared by the synchronous process seams. */
@@ -206,9 +208,59 @@ function isThenable(value) {
 }
 const object = (value) => typeof value === "object" && value !== null;
 function apply(ctx) {
+	const opsScope = ctx.get("multiRootScope");
+	const opsSandbox = ctx.sandbox;
+	const runOpsDispatch = async (exec, policy, next) => {
+		const modeToken = opsCompatibilityToken(ctx);
+		const scope = opsScope;
+		const opsState = scope.opsProtection;
+		const token = enterOpsProtection(opsState);
+		try {
+			const dispatch = async () => {
+				const resolved = scope.resolve(policy);
+				if (resolved.authority === "unavailable") throw new Error("multi-root workspace: the registry authority is unavailable; refusing the OPS execution");
+				if (resolved.deniedRoots.length > 0) {
+					if (policy.mode !== "danger-full-access") throw new Error(`multi-root workspace: the OPS execution is refused in ${policy.mode}: private preparation and worker write boundaries cannot be proven without OPS integration`);
+					if (classifyOpsTool(exec.name) === "unknown") throw new Error(`multi-root workspace: the unrecognized OPS capability ${JSON.stringify(exec.name)} is refused while write boundaries apply`);
+					if (exec.name === "ops_bash" && typeof exec.arguments === "object" && exec.arguments !== null && exec.arguments.run_in_background === true) throw new Error("multi-root workspace: run_in_background is refused while danger-full-access write boundaries apply");
+				}
+				let facts;
+				if (resolved.deniedRoots.length > 0) {
+					if (process.platform === "win32") throw new Error("multi-root workspace: OPS worker preparation is not verified on this platform; refusing the call while write boundaries apply");
+					assertOpsPosixCacheAdmission(resolved.deniedRoots);
+					facts = await opsSandbox.restrictedExecution(policy, resolved.deniedRoots, exec.signal, resolved.protectedHome);
+					if (facts === void 0 || facts.argv.length === 0) throw new Error("multi-root workspace: the restricted runner could not be prepared; refusing the OPS execution");
+				}
+				assertOpsProtectionOwner(opsState, token);
+				if (opsCompatibilityToken(ctx) !== modeToken) throw new Error("multi-root workspace: the OPS compatibility mode changed during dispatch; refusing the execution");
+				const store = {
+					argvPrefix: facts?.argv ?? [],
+					ops: true,
+					opsState,
+					active: true
+				};
+				try {
+					return await processDenyStore.run(store, () => facts === void 0 ? next() : decorateProcessOutcome(next(), facts, policy, { stderr: () => store.stderr?.() }));
+				} finally {
+					store.active = false;
+				}
+			};
+			if (ctx.get("multiRootRegistry")?.shared) return await withRegistryAdmission(ctx, policy, "process", dispatch);
+			return await dispatch();
+		} finally {
+			leaveOpsProtection(opsState);
+		}
+	};
 	aroundTool(ctx, async (exec, next) => {
-		if (!ctx.get("multiRootRegistry")?.shared || exec.agent === void 0) return next();
-		return withRegistryAdmission(ctx, ctx.sandboxPolicy.resolve({ session: exec.agent.session }), "process", next);
+		const kind = classifyOpsTool(exec.name);
+		if (kind === "other" || kind === "publish" || opsCompatibilityToken(ctx) === void 0) {
+			if (!ctx.get("multiRootRegistry")?.shared || exec.agent === void 0) return next();
+			const policy = ctx.sandboxPolicy.resolve({ session: exec.agent.session });
+			return opsScope.withToolCap(exec.name, () => withRegistryAdmission(ctx, policy, "process", next));
+		}
+		if (exec.agent === void 0) throw new Error(`multi-root workspace: the OPS call ${JSON.stringify(exec.name)} cannot be confirmed against a trusted session`);
+		const policy = ctx.sandboxPolicy.resolve({ session: exec.agent.session });
+		return opsScope.withToolCap(exec.name, () => runOpsDispatch(exec, policy, next));
 	});
 	const policyOf = (spec) => spec?.sandboxPolicy ?? ctx.sandboxPolicy.resolve();
 	/**
@@ -240,27 +292,46 @@ function apply(ctx) {
 		return isThenable(prepared) ? prepared.then(run) : run(prepared);
 	};
 	ctx.inject(["subprocess"], (scope) => {
-		scope.effect(() => wrapMethod(scope.subprocess, "spawn", (original) => function(spec) {
-			const store = processDenyStore.getStore();
-			if (scope.multiRootScope.admissionRequired && scope.multiRootScope.hasAdmission() && !scope.multiRootScope.admissionPathsValid()) throw new Error("multi-root workspace: an admitted root was redirected before process launch");
-			const argv = store === void 0 ? spec.argv : [...store.argvPrefix, ...spec.argv];
-			if (scope.multiRootScope.admissionRequired && (store !== void 0 || hasConfinedProfile(argv)) && !scope.multiRootScope.permitsProfile(argv)) throw new Error("multi-root workspace: a confined spawn requires a profile from this live admission");
-			const handle = original.call(this, store === void 0 ? spec : {
-				...spec,
-				argv
-			});
-			if (store === void 0) return handle;
-			const stderr = object(handle) && object(handle.collected) && object(handle.collected.stderr) && typeof handle.collected.stderr.readFrom === "function" ? handle.collected.stderr : void 0;
-			if (stderr !== void 0) store.stderr = () => {
-				try {
-					return stderr.readFrom(0).text;
-				} catch {
-					return;
+		const opsState = opsScope.opsProtection;
+		scope.effect(() => {
+			const restore = wrapMethod(scope.get("subprocess"), "spawn", (original) => function(spec) {
+				const store = processDenyStore.getStore();
+				if (store?.ops === true && (store.active === false || store.opsState !== opsState)) throw new Error("multi-root workspace: the OPS execution domain has expired");
+				const admissionScope = store?.ops === true ? opsScope : scope.multiRootScope;
+				if (admissionScope.admissionRequired && admissionScope.hasAdmission() && !admissionScope.admissionPathsValid()) throw new Error("multi-root workspace: an admitted root was redirected before process launch");
+				let argv = spec.argv;
+				if (store?.ops === true) {
+					const prefix = store.argvPrefix;
+					if (hasConfinedProfile(spec.argv)) {
+						if (!(spec.argv.length > prefix.length && prefix.every((segment, index) => spec.argv[index] === segment))) throw new Error("multi-root workspace: a confined spawn inside an OPS execution domain must carry this domain's own profile");
+					} else argv = [...prefix, ...spec.argv];
+					if (opsScope.admissionRequired && (hasConfinedProfile(spec.argv) || prefix.length > 0) && !opsScope.permitsProfile(argv)) throw new Error("multi-root workspace: a confined spawn requires a profile from this live admission");
+				} else {
+					argv = store === void 0 ? spec.argv : [...store.argvPrefix, ...spec.argv];
+					if (scope.multiRootScope.admissionRequired && (store !== void 0 || hasConfinedProfile(argv)) && !scope.multiRootScope.permitsProfile(argv)) throw new Error("multi-root workspace: a confined spawn requires a profile from this live admission");
 				}
+				const launch = () => original.call(this, argv === spec.argv ? spec : {
+					...spec,
+					argv
+				});
+				const handle = store !== void 0 || admissionScope.admissionRequired && admissionScope.permitsProfile(argv) ? withOpsSpawnPermit(opsState, launch) : launch();
+				if (store === void 0) return handle;
+				const stderr = object(handle) && object(handle.collected) && object(handle.collected.stderr) && typeof handle.collected.stderr.readFrom === "function" ? handle.collected.stderr : void 0;
+				if (stderr !== void 0) store.stderr = () => {
+					try {
+						return stderr.readFrom(0).text;
+					} catch {
+						return;
+					}
+				};
+				return handle;
+			});
+			return async () => {
+				await drainOpsProtection(opsState);
+				restore();
 			};
-			return handle;
-		}));
-		scope.effect(() => wrapMethod(scope.subprocess, "spawnTerminal", (original) => async function(spec) {
+		});
+		scope.effect(() => wrapMethod(scope.get("subprocess"), "spawnTerminal", (original) => async function(spec) {
 			const ptySessionId = spec.env?.DSH_PTY_SESSION_ID;
 			if (ptySessionId === void 0 || ptySessionId === "") return await original.call(this, spec);
 			const sessionId = spec.env?.DSH_SESSION_ID;
@@ -293,6 +364,11 @@ function apply(ctx) {
 				});
 			});
 		}));
+		const token = claimOpsProtection(opsState);
+		scope.effect(() => async () => {
+			revokeOpsProtection(opsState, token);
+			await drainOpsProtection(opsState);
+		});
 	});
 	/**
 	* The wrapper every execute-style consumer entry shares: resolve the policy

package/lib/{protocol-CnR1KTXy.js → protocol-CwDnFEyK.js}

@@ -212,7 +212,7 @@ function posix$1() {
 	return posixPromise ??= loadPosix();
 }
 async function connectNative(endpoint) {
-	if (process.platform === "win32") return (await import("./native-win32-CRNXr11U.js")).connectWindows(endpoint);
+	if (process.platform === "win32") return (await import("./native-win32-C5oMtt7f.js")).connectWindows(endpoint);
 	const api = await posix$1(), address = api.address(endpoint), fd = api.open();
 	if (api.connect(fd, address, address.length) !== 0) {
 		closeSync(fd);
@@ -222,7 +222,7 @@ async function connectNative(endpoint) {
 }
 /** Called only by the kernel lease holder. Never removes another epoch's socket. */
 async function listenNative(endpoint, accepted) {
-	if (process.platform === "win32") return (await import("./native-win32-CRNXr11U.js")).listenWindows(endpoint, accepted);
+	if (process.platform === "win32") return (await import("./native-win32-C5oMtt7f.js")).listenWindows(endpoint, accepted);
 	const api = await posix$1(), address = api.address(endpoint), fd = api.open();
 	try {
 		unlinkSync(endpoint);
@@ -264,7 +264,7 @@ async function listenNative(endpoint, accepted) {
 }
 /** Capability probe for native tests and diagnostics; not an authorization bypass. */
 async function nativeHostAvailability() {
-	if (process.platform === "win32") return (await import("./native-win32-CRNXr11U.js")).windowsHostAvailability();
+	if (process.platform === "win32") return (await import("./native-win32-C5oMtt7f.js")).windowsHostAvailability();
 	if (process.platform === "linux") {
 		if (!/^NoNewPrivs:\s+0$/m.test(readFileSync("/proc/self/status", "utf8"))) return {
 			available: false,
@@ -345,7 +345,11 @@ const rootSchema = z.object({
 		"invalid"
 	]),
 	detail: z.string().optional(),
-	invalidReason: z.literal("membership-conflict").optional()
+	invalidReason: z.enum([
+		"membership-conflict",
+		"protected-path",
+		"primary-overlap"
+	]).optional()
 }).strict();
 const snapshotSchema = z.object({
 	protocol: z.literal(1),