@dsh-electron/dsh-plugin-multi-root-workspace 0.1.14 → 0.1.16

package/lib/{review-context-NDpKeMCc.js → review-context-OxO-fMWR.js}

@@ -1,6 +1,7 @@
 import { t as effectiveDirectory } from "./session-directory-BLOstut1.js";
-import { s as touchedPathOfToolCall } from "./instructions-KsUwUFE0.js";
-import { l as isCanonicallyUnder } from "./roots-Ca_W1S9n.js";
+import { c as stableOpsJson, l as touchedPathOfToolCall, s as pendingInstructionTargets } from "./instructions-Ca80SkZq.js";
+import { r as opsCompatibilityToken } from "./ops-settings-UN2oOKEp.js";
+import { l as isCanonicallyUnder } from "./roots-CmaWxRVy.js";
 import { createHash } from "node:crypto";
 import { resolve } from "node:path";
 import { Service } from "@deepseek-ai/cordis";
@@ -50,7 +51,7 @@ var MultiRootReviewContext = class extends Service {
 		const policy = this.ctx.sandboxPolicy.resolve({ session: agent.session });
 		const primary = canonicalPath(policy.workspaceRoot);
 		if (agent.session.header.cwd !== void 0 && canonicalPath(agent.session.header.cwd) !== primary) throw new Error("review-context: inconsistent session origin");
-		await this.ctx.multiRootRegistry.refresh(primary);
+		await this.ctx.multiRootRegistry.refresh(policy.workspaceRoot);
 		signal.throwIfAborted();
 		const cwd = effectiveDirectory(this.ctx, agent.session);
 		if (cwd === void 0) throw new Error("review-context: missing effective cwd");
@@ -73,10 +74,20 @@ var MultiRootReviewContext = class extends Service {
 			primaryRootWritable: policy.mode !== "read-only" && !scope.deniedRoots.some((deny) => isCanonicallyUnder(scope.primaryRoot, deny)),
 			writeBoundary: scope.authority === "unavailable" && policy.mode !== "read-only" ? "primary-root-only; no shared temp grants; explicit denies take precedence" : policy.mode === "danger-full-access" ? "ambient host writes minus explicit deny boundaries; membership is not an access allowlist" : policy.mode === "workspace-write" ? "primary root, effective writable additional roots and upstream host temp grants; explicit denies take precedence" : "only effective writable additional roots; explicit denies take precedence"
 		};
-		const path = touchedPathOfToolCall(exec.name, JSON.stringify(exec.arguments));
-		const target = path === void 0 ? void 0 : this.ctx.fs.processPath(await this.ctx.fs.resolve(resolve(cwd, path), { signal }));
-		const constraints = await this.ctx.multiRootInstructions.snapshot(agent, scope.authority === "available" ? scope.additionalRoots : [], target, signal);
+		const official = touchedPathOfToolCall(exec.name, JSON.stringify(exec.arguments));
+		const modeToken = opsCompatibilityToken(this.ctx);
+		const candidates = modeToken === void 0 ? [] : pendingInstructionTargets(exec.name, exec.arguments);
+		const targets = [];
+		for (const path of official === void 0 ? candidates : [official]) targets.push(this.ctx.fs.processPath(await this.ctx.fs.resolve(resolve(cwd, path), { signal })));
+		const pending = exec.callId === void 0 || modeToken === void 0 ? void 0 : {
+			callId: exec.callId,
+			name: exec.name,
+			arguments: exec.arguments,
+			parent: exec.parent
+		};
+		const constraints = await this.ctx.multiRootInstructions.snapshot(agent, scope.authority === "available" ? scope.additionalRoots : [], targets, signal, pending);
 		signal.throwIfAborted();
+		if (opsCompatibilityToken(this.ctx) !== modeToken) throw new Error("review-context: OPS compatibility changed during the build; retry");
 		const payload = {
 			schemaVersion: 1,
 			environment,
@@ -87,7 +98,13 @@ var MultiRootReviewContext = class extends Service {
 		if (Buffer.byteLength(JSON.stringify(payload), "utf8") > 65536) throw new Error("review-context: context budget exceeded");
 		return {
 			...payload,
-			fingerprint: createHash("sha256").update(JSON.stringify([payload, nativeInstructionFingerprint(agent.session)])).digest("hex")
+			fingerprint: createHash("sha256").update(JSON.stringify(modeToken === void 0 ? [payload, nativeInstructionFingerprint(agent.session)] : [
+				payload,
+				nativeInstructionFingerprint(agent.session),
+				exec.name,
+				stableOpsJson(exec.arguments),
+				modeToken.id
+			])).digest("hex")
 		};
 	}
 	async assertCurrent(exec, snapshot, signal) {

package/lib/review-context.js

@@ -1,2 +1,2 @@
-import { t as MultiRootReviewContext } from "./review-context-NDpKeMCc.js";
+import { t as MultiRootReviewContext } from "./review-context-OxO-fMWR.js";
 export { MultiRootReviewContext, MultiRootReviewContext as default };

package/lib/{roots-Ca_W1S9n.js → roots-CmaWxRVy.js}

@@ -1,6 +1,6 @@
 import { i as isWindowsNetworkOrDevicePath } from "./windows-runner-contract-B5R2K3mM.js";
 import { statSync } from "node:fs";
-import { isAbsolute, join, sep } from "node:path";
+import { isAbsolute, join, resolve, sep } from "node:path";
 import { canonicalPath } from "@deepseek-ai/dsh-sandbox";
 import { homedir } from "node:os";
 //#region src/roots.ts
@@ -20,15 +20,21 @@ import { homedir } from "node:os";
 *    misconfiguration, not a path to guess at.
 * 2. `missing` — the directory does not exist.
 * 3. `not-a-directory` — it exists but is not a directory.
-* 4. `equals-primary` — the canonical candidate IS the session's workspace
+* 4. `protected-path` — the canonical candidate equals, lies inside, or
+*    contains a protected DSH directory (the DSH home, the registry's
+*    physical storage medium, or the lease directory, supplied through
+*    {@link RootCandidateContext.protectedPaths}): those hold the store,
+*    the lease, profiles and user credentials, so no access level may
+*    register them. Applies to every mode; no remote exemption exists.
+* 5. `equals-primary` — the canonical candidate IS the session's workspace
 *    root, which is already granted by the upstream policy.
-* 5. `primary-overlap` — the candidate lies under the workspace root, or
+* 6. `primary-overlap` — the candidate lies under the workspace root, or
 *    contains it. The union grants nothing new, and the displayed list would
 *    stop matching the enforced root set.
-* 6. `duplicate` — another registered root canonicalizes to the same path.
-* 7. `nested` — the candidate lies under a registered root, or contains one.
-*    Same reasoning as rule 5, applied to the additional roots.
-* 8. `unsupported-path` — on Windows, a network or device path (`\\server`,
+* 7. `duplicate` — another registered root canonicalizes to the same path.
+* 8. `nested` — the candidate lies under a registered root, or contains one.
+*    Same reasoning as rule 6, applied to the additional roots.
+* 9. `unsupported-path` — on Windows, a network or device path (`\\server`,
 *    `\\?\…`, `\\.\…`): the ACL confinement cannot be shown to cover it, so it
 *    is rejected lexically before any filesystem touch.
 *
@@ -88,6 +94,22 @@ const CASE_SENSITIVE = process.platform !== "win32";
 function comparable(path) {
 	return CASE_SENSITIVE ? path : path.toLowerCase();
 }
+/**
+* The Registry/scope lookup key of one primary root: the UPSTREAM spelling,
+* normalized lexically by `path.resolve` and case-folded on Windows — never
+* re-resolved. Upstream `dsh-sandbox-policy` sets `policy.workspaceRoot` to
+* `session.header.cwd` verbatim, so the spelling IS the identity: a symlinked
+* workspace and its realpath target are different sessions and different key
+* spaces. Re-resolving here would let a replaced workspace directory
+* silently re-key the record set onto another identity — the exact failure
+* the redirect rules exist to prevent. This is the ONLY function allowed to
+* turn a primary root into a Registry key; path geometry keeps using
+* {@link canonicalRoot}.
+*/
+function primaryKey(path, platform = process.platform) {
+	const resolved = resolve(path);
+	return platform === "win32" ? resolved.toLowerCase() : resolved;
+}
 /** Whether two canonical paths name the same directory on this platform. */
 function samePath(left, right) {
 	return comparable(left) === comparable(right);
@@ -131,6 +153,11 @@ function validateRootCandidate(raw, context) {
 	const canonical = canonicalRoot(expanded);
 	if (platform === "win32" && isWindowsNetworkOrDevicePath(canonical)) throw unsupportedPath(expanded);
 	assertDirectory(canonical, expanded);
+	const protectedConflict = protectedOverlap(canonical, context.protectedPaths ?? []);
+	if (protectedConflict !== void 0) throw new RootValidationError("protected-path", `"${canonical}" overlaps the protected DSH directory "${protectedConflict.path}" (${protectedConflict.kind}) and cannot be registered`, {
+		conflict: protectedConflict.path,
+		reference: canonical
+	});
 	const primaryRoot = canonicalRoot(context.primaryRoot);
 	if (samePath(canonical, primaryRoot)) throw new RootValidationError("equals-primary", `"${canonical}" is this session's workspace root and is already writable`, {
 		conflict: primaryRoot,
@@ -160,6 +187,18 @@ function validateRootCandidate(raw, context) {
 function unsupportedPath(asTyped) {
 	return new RootValidationError("unsupported-path", `"${asTyped}" is a network or device path, which Windows ACL confinement cannot cover`, { reference: asTyped });
 }
+/**
+* The first protected directory `candidate` overlaps — equals, lies inside,
+* or contains. Both sides must already be canonical (or absolute boundary
+* spellings): the comparison is the same lexical three-way test the other
+* boundary rules use, so a symlink alias can never route around it.
+* @param candidate - the canonical candidate or recorded grant to test.
+* @param protectedPaths - the protected DSH directories.
+* @returns the overlapping protected path, or `undefined`.
+*/
+function protectedOverlap(candidate, protectedPaths) {
+	return protectedPaths.find((boundary) => samePath(candidate, boundary.path) || isCanonicallyUnder(candidate, boundary.path) || isCanonicallyUnder(boundary.path, candidate));
+}
 /** Assert that a canonical path is an existing directory. */
 function assertDirectory(canonical, asTyped) {
 	let stats;
@@ -181,12 +220,15 @@ function assertDirectory(canonical, asTyped) {
 * @param primaryRoot - the session workspace root the records belong to.
 * @param records - the stored records, in registry order.
 * @param platform - the platform the rules run for; defaults to `process.platform`.
+* @param protectedPaths - the protected DSH directories a stored grant may not
+*   overlap; a record that does is reported `invalid` with
+*   `invalidReason: 'protected-path'` — withheld, never deleted, never re-granted.
 * @returns one status per record, in the same order.
 */
-function classifyStoredRoots(primaryRoot, records, platform = process.platform) {
+function classifyStoredRoots(primaryRoot, records, platform = process.platform, protectedPaths = []) {
 	const primary = canonicalRoot(primaryRoot);
 	const duplicated = duplicatedIds(records);
-	return markMembershipConflicts(records.map((record, index) => classifyStoredRoot(record, primary, duplicated.has(record.id), index, platform)));
+	return markMembershipConflicts(records.map((record, index) => classifyStoredRoot(record, primary, duplicated.has(record.id), index, platform, protectedPaths)));
 }
 /**
 * Pass two of {@link classifyStoredRoots}: every pair of structurally sound
@@ -204,7 +246,7 @@ function classifyStoredRoots(primaryRoot, records, platform = process.platform)
 * when the pair found first was already doomed.
 */
 function markMembershipConflicts(statuses) {
-	const boundaries = statuses.map((status) => status.state === "invalid" ? void 0 : singleGrantOf(status));
+	const boundaries = statuses.map((status) => status.state !== "invalid" || status.invalidReason === "protected-path" || status.invalidReason === "primary-overlap" ? singleGrantOf(status) : void 0);
 	const conflicts = /* @__PURE__ */ new Map();
 	for (let index = 0; index < boundaries.length; index += 1) {
 		const boundary = boundaries[index];
@@ -221,7 +263,7 @@ function markMembershipConflicts(statuses) {
 	if (conflicts.size === 0) return [...statuses];
 	return statuses.map((status, index) => {
 		const others = conflicts.get(index);
-		if (others === void 0) return status;
+		if (others === void 0 || status.invalidReason === "protected-path" || status.invalidReason === "primary-overlap") return status;
 		const boundary = boundaries[index];
 		const partners = others.map((other) => `"${other}"`).join(", ");
 		return {
@@ -271,7 +313,7 @@ function duplicatedIds(records) {
 * boundary — the directory the operator was granted — not what `path`
 * resolves to today.
 */
-function classifyStoredRoot(record, primary, duplicatedId, position, platform) {
+function classifyStoredRoot(record, primary, duplicatedId, position, platform, protectedPaths) {
 	const invalid = (detail) => ({
 		...record,
 		state: "invalid",
@@ -291,8 +333,21 @@ function classifyStoredRoot(record, primary, duplicatedId, position, platform) {
 	if (typeof recorded !== "string" || recorded === "") return invalid("the record does not say which directory it was granted for");
 	if (!isAbsolute(recorded)) return invalid(`the recorded grant "${recorded}" is not an absolute path`);
 	if (platform === "win32" && (isWindowsNetworkOrDevicePath(record.path) || isWindowsNetworkOrDevicePath(recorded))) return invalid(`"${record.path}" is a network or device path, which Windows ACL confinement cannot cover`);
-	if (samePath(recorded, primary)) return invalid(`"${recorded}" is this session's workspace root`);
-	if (isCanonicallyUnder(recorded, primary) || isCanonicallyUnder(primary, recorded)) return invalid(`"${recorded}" overlaps this session's workspace root`);
+	const primaryOverlap = (detail) => ({
+		...record,
+		state: "invalid",
+		invalidReason: "primary-overlap",
+		detail: `${detail}; any recorded read-only restriction remains in force`
+	});
+	if (samePath(recorded, primary)) return primaryOverlap(`"${recorded}" is this session's workspace root`);
+	if (isCanonicallyUnder(recorded, primary) || isCanonicallyUnder(primary, recorded)) return primaryOverlap(`"${recorded}" overlaps this session's workspace root`);
+	const protectedConflict = protectedOverlap(recorded, protectedPaths);
+	if (protectedConflict !== void 0) return {
+		...record,
+		state: "invalid",
+		invalidReason: "protected-path",
+		detail: protectedGrantDetail(recorded, protectedConflict)
+	};
 	const canonical = canonicalRoot(record.path);
 	if (!samePath(canonical, recorded)) return {
 		...record,
@@ -325,23 +380,58 @@ function classifyStoredRoot(record, primary, duplicatedId, position, platform) {
 function availableRoots(statuses) {
 	return statuses.filter((status) => status.state === "available").map((status) => status.path);
 }
+/** The detail text the protected-path verdict carries, shared by both marking paths. */
+function protectedGrantDetail(grant, conflict) {
+	return `the recorded grant "${grant}" overlaps the protected DSH directory "${conflict.path}" (${conflict.kind}); it stays registered and withheld, and any recorded read-only restriction remains in force`;
+}
+/**
+* Apply the protected-path verdict to an already-classified list: a status
+* whose recorded grant overlaps a protected directory becomes `invalid` with
+* `invalidReason: 'protected-path'` — the same verdict the pass-one stored
+* check produces, here applied by a consumer that classified elsewhere (a
+* shared-registry follower re-judging an owner snapshot against ITS OWN
+* protected set, which may differ from the owner's). Statuses already
+* `invalid` keep their own verdict — a structural failure is never healed
+* into a trustworthy boundary.
+* @param statuses - the classified statuses to re-mark.
+* @param protectedPaths - the caller's own protected DSH directories.
+* @returns a new list with the verdict applied.
+*/
+function markProtectedPaths(statuses, protectedPaths) {
+	if (protectedPaths.length === 0) return [...statuses];
+	return statuses.map((status) => {
+		if (status.state === "invalid") return status;
+		const grant = singleGrantOf(status);
+		if (grant === void 0) return status;
+		const conflict = protectedOverlap(grant, protectedPaths);
+		if (conflict === void 0) return status;
+		return {
+			...status,
+			state: "invalid",
+			invalidReason: "protected-path",
+			detail: protectedGrantDetail(grant, conflict)
+		};
+	});
+}
 /**
 * The recorded boundary one status still RESERVES: the grant it was
 * registered for, which a new or revived registration may not overlap merely
 * because the root is currently unusable.
 *
-* `available`, `missing`, `redirected`, and membership-conflict statuses all
-* carry an intact, trustworthy recorded grant; every other `invalid` verdict
-* means the grant could not be parsed at all, so it reserves — and denies —
-* nothing. This is not an independent authorization table: it derives the
-* boundary from the status list {@link classifyStoredRoots} produced, with
-* the same grant-extraction semantics, so its answer can never disagree with
+* `available`, `missing`, `redirected`, and the trustworthy-boundary
+* `invalid` verdicts (`membership-conflict`, `protected-path`, and
+* `primary-overlap`) all carry
+* an intact recorded grant; every other `invalid` verdict means the grant
+* could not be parsed at all, so it reserves — and denies — nothing. This is
+* not an independent authorization table: it derives the boundary from the
+* status list {@link classifyStoredRoots} produced, with the same
+* grant-extraction semantics, so its answer can never disagree with
 * classification.
 * @param status - one classified registration.
 * @returns the absolute recorded boundary, or `undefined` when there is none.
 */
 function reservedRootBoundary(status) {
-	if (status.state === "invalid" && status.invalidReason !== "membership-conflict") return void 0;
+	if (status.state === "invalid" && status.invalidReason === void 0) return void 0;
 	const boundary = singleGrantOf(status);
 	return boundary !== void 0 && isAbsolute(boundary) ? boundary : void 0;
 }
@@ -439,4 +529,4 @@ function describeRef(ref) {
 	}
 }
 //#endregion
-export { classifyStoredRoots as a, indexedStatuses as c, reservedRootBoundary as d, resolveRootIndex as f, canonicalRoot as i, isCanonicallyUnder as l, validateRootCandidate as m, additionalRootId as n, entryRootRef as o, resolveRootRef as p, availableRoots as r, expandRootInput as s, RootValidationError as t, removeStatusAt as u };
+export { samePath as _, classifyStoredRoots as a, indexedStatuses as c, primaryKey as d, protectedOverlap as f, resolveRootRef as g, resolveRootIndex as h, canonicalRoot as i, isCanonicallyUnder as l, reservedRootBoundary as m, additionalRootId as n, entryRootRef as o, removeStatusAt as p, availableRoots as r, expandRootInput as s, RootValidationError as t, markProtectedPaths as u, singleGrantOf as v, validateRootCandidate as y };

package/lib/{sandbox-C-vCJCp3.js → sandbox-aobdyQGi.js}

@@ -1,5 +1,5 @@
 import { a as parseWindowsProfile, i as isWindowsNetworkOrDevicePath, n as assertWindowsDenyCapacity, t as DialectUnrecognizedError } from "./windows-runner-contract-B5R2K3mM.js";
-import { a as splitConfined, c as mapConfined, i as restrictProfileArgs, l as widenConfined, o as widenProfileArgs, r as graftProfileArgs, t as denyProfileArgs } from "./dialects-Dr4rDR-H.js";
+import { a as splitConfined, c as mapConfined, i as restrictProfileArgs, l as widenConfined, o as widenProfileArgs, r as graftProfileArgs, t as denyProfileArgs } from "./dialects-CdlG3RF9.js";
 import { brandMultiRootProvider } from "./providers.js";
 import { SandboxUnavailableError, canonicalPath } from "@deepseek-ai/dsh-sandbox";
 import { fileURLToPath } from "node:url";
@@ -105,8 +105,9 @@ var MultiRootSandboxProvider = class extends LocalSandboxProvider {
 	*/
 	confine(argv, policy, signal) {
 		const scope = this.ctx.multiRootScope.resolve(policy);
+		const mint = this.ctx.multiRootScope.captureMint(scope.authority !== "unavailable" ? "ambient" : policy.mode === "read-only" ? "read-only" : policy.mode === "workspace-write" ? "clamped" : "ambient");
 		const remember = (facts) => {
-			this.ctx.multiRootScope.rememberProfile(facts.argv);
+			this.ctx.multiRootScope.rememberProfile(facts.argv, mint);
 			return facts;
 		};
 		if (policy.mode === "workspace-write" && scope.authority === "unavailable") {
@@ -211,6 +212,7 @@ var MultiRootSandboxProvider = class extends LocalSandboxProvider {
 			workspaceRoot: policy.workspaceRoot,
 			...policy.sessionId === void 0 ? {} : { sessionId: policy.sessionId }
 		};
+		const mint = this.ctx.multiRootScope.captureMint("ambient");
 		const probe = super.confine.call(this, ["true"], probePolicy, signal);
 		const restrict = (confined) => {
 			try {
@@ -232,7 +234,7 @@ var MultiRootSandboxProvider = class extends LocalSandboxProvider {
 		};
 		return widenConfined(() => probe, (facts) => {
 			const result = restrict(facts);
-			this.ctx.multiRootScope.rememberProfile(result.argv);
+			this.ctx.multiRootScope.rememberProfile(result.argv, mint);
 			return result;
 		}, ["true"], probePolicy, signal);
 	}
@@ -253,6 +255,7 @@ var MultiRootSandboxProvider = class extends LocalSandboxProvider {
 			workspaceRoot: policy.workspaceRoot,
 			...policy.sessionId === void 0 ? {} : { sessionId: policy.sessionId }
 		};
+		const mint = this.ctx.multiRootScope.captureMint("clamped");
 		const probe = super.confine.call(this, ["true"], probePolicy, signal);
 		const clamp = (confined) => {
 			try {
@@ -269,7 +272,7 @@ var MultiRootSandboxProvider = class extends LocalSandboxProvider {
 		};
 		return widenConfined(() => probe, (facts) => {
 			const result = clamp(facts);
-			this.ctx.multiRootScope.rememberProfile(result.argv);
+			this.ctx.multiRootScope.rememberProfile(result.argv, mint);
 			return result;
 		}, ["true"], probePolicy, signal);
 	}

package/lib/sandbox.js

@@ -1,3 +1,3 @@
 import "./providers.js";
-import { t as MultiRootSandboxProvider } from "./sandbox-C-vCJCp3.js";
+import { t as MultiRootSandboxProvider } from "./sandbox-aobdyQGi.js";
 export { MultiRootSandboxProvider, MultiRootSandboxProvider as default };

package/lib/scope.js

@@ -1,5 +1,9 @@
-import { i as rememberOperationProfile, r as operationPermitsProfile, t as currentRegistryOperation } from "./registry-operation-C2ZV3Jhw.js";
-import { t as aroundTool } from "./tool-context-CpgIFcCB.js";
+import { t as wrapMethod } from "./method-wrapper-D4oUCsEF.js";
+import { a as rememberOperationProfile, i as operationPermitsProfile, r as operationFrameState, t as currentRegistryOperation } from "./registry-operation-CIlmt6_c.js";
+import { t as aroundTool } from "./tool-context-CCeY3mrK.js";
+import { r as opsCompatibilityToken } from "./ops-settings-UN2oOKEp.js";
+import { d as primaryKey } from "./roots-CmaWxRVy.js";
+import { a as createOpsProtectionState, l as opsDispatchBarrier, u as opsSpawnPermitted } from "./ops-tools-k4JYaOrM.js";
 import { r as effectiveRootAccess } from "./contract-CStSEOcK.js";
 import { statSync } from "node:fs";
 import { isAbsolute } from "node:path";
@@ -145,6 +149,8 @@ function renderWorkspaceRootsContext(options) {
 }
 /** The tool-dispatch cap carried across async boundaries by the waterfall. */
 const toolCapStore = new AsyncLocalStorage();
+/** Bounded process-wide ledger of unadmitted mints; a burst cannot grow it without bound. */
+const MAX_MINTED_PROFILES = 256;
 /**
 * The `ctx.multiRootScope` service. Providers ask it — never the filesystem —
 * what the current scope is, which is what keeps the fs fence and every kernel
@@ -156,10 +162,19 @@ var MultiRootScopeService = class extends Service {
 	listeners = /* @__PURE__ */ new Set();
 	/** Enclosing {@link MultiRootScopeService.batch} depth; inner calls nest. */
 	batchDepth = 0;
+	opsProtection = createOpsProtectionState();
 	/** True when a batched write coalesced its notification into the flush. */
 	batchDirty = false;
 	admissionProof;
 	/**
+	* The publication generation the mint ledger is keyed on: bumped when a
+	* root-table write or an authority transition changes the authorization
+	* basis (a repeat publish of identical content is not a publication), so a
+	* minted profile dies with the state it was computed from.
+	*/
+	publicationVersion = 0;
+	mintedProfiles = [];
+	/**
 	* The registry-authority fact the registry row publishes. Defaults to
 	* `available`: a composition without a registry row can never have
 	* registered roots, so nothing is unknown there. The registry sets it false
@@ -179,6 +194,13 @@ var MultiRootScopeService = class extends Service {
 	* treated as evidence.
 	*/
 	dshHome;
+	/**
+	* Whether the row carried a `dshHome` value at all — even an invalid one.
+	* The registry's protected-boundary set must tell "no home configured"
+	* (absent: nothing to protect) from "a home was supplied and rejected"
+	* (invalid: the boundary cannot be proven).
+	*/
+	dshHomeSupplied;
 	/** Observe registry publications; consumers still resolve authority from scopeOf(). */
 	subscribe(listener) {
 		this.listeners.add(listener);
@@ -216,6 +238,11 @@ var MultiRootScopeService = class extends Service {
 		}
 		for (const listener of this.listeners) listener();
 	}
+	/** A publication superseded the authorization basis: every outstanding minted profile dies. */
+	bumpPublication() {
+		this.publicationVersion += 1;
+		this.mintedProfiles.length = 0;
+	}
 	/**
 	* The sorted names of the tools `toolAccess` caps — read-only for the
 	* prompt contribution. An invalid config is not enumerated (it caps every
@@ -228,6 +255,20 @@ var MultiRootScopeService = class extends Service {
 	get toolAccessInvalid() {
 		return this.capsInvalid;
 	}
+	/**
+	* The validated `dshHome` row config, classified for the registry's
+	* protected-boundary set: `absent` when the row carried no value (nothing
+	* to protect), `invalid` when it carried a value the constructor rejected
+	* (the boundary cannot be proven), `configured` with the accepted absolute
+	* path. Read-only — this changes no scope or `protectedHome` semantics.
+	*/
+	get dshHomeConfig() {
+		if (this.dshHome !== void 0) return {
+			kind: "configured",
+			path: this.dshHome
+		};
+		return this.dshHomeSupplied ? { kind: "invalid" } : { kind: "absent" };
+	}
 	constructor(ctx, config = {}) {
 		super(ctx, "multiRootScope");
 		const toolAccess = config.toolAccess;
@@ -243,10 +284,44 @@ var MultiRootScopeService = class extends Service {
 			this.capsInvalid = false;
 		}
 		const dshHome = config.dshHome;
+		this.dshHomeSupplied = dshHome !== void 0;
 		if (dshHome !== void 0 && (typeof dshHome !== "string" || dshHome.trim() === "" || !isAbsolute(dshHome))) ctx.logger.error(`multi-root-workspace: invalid dshHome config (expected an absolute path, got ${JSON.stringify(dshHome)}); the DSH-home deny boundary is disabled`);
 		else this.dshHome = dshHome;
 		aroundTool(ctx, (exec, next) => {
-			return toolCapStore.run({ capped: this.capForTool(exec.name) }, next);
+			return this.withToolCap(exec.name, async () => {
+				const denial = opsDispatchBarrier(ctx, this, exec);
+				if (denial !== void 0) throw new Error(denial);
+				return await next();
+			});
+		});
+		ctx.inject([
+			"tools",
+			"sandboxPolicy",
+			"multiRootCompat",
+			"multiRootProviders"
+		], (scoped) => {
+			if (typeof scoped.tools.guard !== "function") return;
+			scoped.effect(() => scoped.tools.guard((exec) => opsDispatchBarrier(ctx, this, exec)));
+		});
+		ctx.inject([
+			"subprocess",
+			"multiRootCompat",
+			"multiRootProviders"
+		], (scoped) => {
+			scoped.effect(() => {
+				let active = true;
+				const restore = wrapMethod(scoped.get("subprocess"), "spawn", (original) => {
+					const scope = this;
+					return function(spec) {
+						if (active && opsCompatibilityToken(scoped) !== void 0 && scope.hasActiveDenyRoots() && !opsSpawnPermitted(scope.opsProtection) && !(scope.admissionRequired && scope.admissionPathsValid() && scope.permitsOperationProfile(spec.argv))) throw new Error("multi-root workspace: an unattributed subprocess has no protected execution or live profile admission; refusing launch while OPS compatibility write boundaries apply");
+						return original.call(this, spec);
+					};
+				});
+				return () => {
+					active = false;
+					restore();
+				};
+			});
 		});
 		ctx.inject(["systemPrompt", "sandboxPolicy"], (scope) => {
 			scope.systemPrompt.context({
@@ -280,12 +355,74 @@ var MultiRootScopeService = class extends Service {
 	requireAdmission(proof) {
 		this.admissionProof = proof;
 	}
-	rememberProfile(argv) {
-		if (this.admissionProof !== void 0) rememberOperationProfile(this.admissionProof, argv, this.capped());
+	/**
+	* The stamp an asynchronously completing mint must carry: the publication
+	* generation and tool-cap basis at the mint's synchronous entry, before any
+	* provider probe could run. An in-flight mint that crosses a real
+	* publication keeps its entry generation, so the ledger refuses it rather
+	* than re-stamping stale authorization under the current publication.
+	* @param form - the profile form the mint will produce (`clamped` and
+	*   `read-only` are the only ledger-eligible forms).
+	*/
+	captureMint(form) {
+		return {
+			version: this.publicationVersion,
+			capped: this.capped(),
+			form
+		};
+	}
+	/**
+	* Record a confined profile this host's provider just minted. Only
+	* meaningful under the shared Registry (`admissionProof` set; without it
+	* `permitsProfile` never refuses): a live admission binds the profile to
+	* the operation and it dies with it; an expired admission never bequeaths
+	* one — a mint that outlived its operation is dropped, not demoted into
+	* the ledger; only with NO admission frame at all does the profile join
+	* the publication-keyed ledger stamped with `mint`, and only when the
+	* mint's form is primary-bounded — an `ambient` mint that arrives without
+	* a frame is dropped the same way.
+	* @param argv - the confined argv just minted.
+	* @param mint - the {@link captureMint} stamp taken at the mint's
+	*   synchronous entry.
+	*/
+	rememberProfile(argv, mint) {
+		if (this.admissionProof === void 0) return;
+		const frame = operationFrameState(this.admissionProof);
+		if (frame === "expired") return;
+		if (frame === "active") {
+			rememberOperationProfile(this.admissionProof, argv, mint.capped);
+			return;
+		}
+		if (mint.form === "ambient") return;
+		this.mintedProfiles.push({
+			argv: [...argv],
+			capped: mint.capped,
+			version: mint.version
+		});
+		if (this.mintedProfiles.length > MAX_MINTED_PROFILES) this.mintedProfiles.shift();
 	}
+	/**
+	* Whether a confined argv may launch now: a profile minted inside this live
+	* admission, or — for a `confine`→`spawn` composition with no wrapped entry
+	* to admit it — a profile this host minted while its authorization
+	* publication is still current. Cached argv, argv minted under a superseded
+	* publication, and argv minted elsewhere stay refused.
+	*/
 	permitsProfile(argv) {
+		return this.admissionProof === void 0 || this.permitsOperationProfile(argv) || this.permitsMintedProfile(argv);
+	}
+	/**
+	* The strict form: only profiles minted inside this live admission. The OPS
+	* execution domain owns its profile exclusively and never honors the
+	* unadmitted mint ledger.
+	*/
+	permitsOperationProfile(argv) {
 		return this.admissionProof === void 0 || operationPermitsProfile(this.admissionProof, argv, this.capped());
 	}
+	permitsMintedProfile(argv) {
+		const capped = this.capped(), version = this.publicationVersion;
+		return this.mintedProfiles.some((entry) => entry.version === version && entry.capped === capped && entry.argv.length > 0 && entry.argv.length <= argv.length && entry.argv.every((arg, index) => argv[index] === arg));
+	}
 	get admissionRequired() {
 		return this.admissionProof !== void 0;
 	}
@@ -327,16 +464,19 @@ var MultiRootScopeService = class extends Service {
 	previewForTool(policy, toolName) {
 		return this.project(policy, this.capForTool(toolName));
 	}
+	withToolCap(name, fn) {
+		return toolCapStore.run({ capped: this.capForTool(name) }, fn);
+	}
 	/** Execution and review use exactly the same parent-narrowing rule. */
 	capForTool(toolName) {
 		return this.capsInvalid || toolCapStore.getStore()?.capped === true || this.caps[toolName] === "read-only";
 	}
 	project(policy, capped, recorded, authority = this.registryAuthority) {
 		const primaryRoot = canonicalPath(policy.workspaceRoot);
-		const registered = recorded ?? this.rootsByPrimary.get(primaryRoot) ?? [];
+		const registered = recorded ?? this.rootsByPrimary.get(primaryKey(policy.workspaceRoot)) ?? [];
 		const roots = authority === "unavailable" ? [] : sanitizeMembers(primaryRoot, registered);
 		const writable = capped || authority === "unavailable" ? [] : roots.filter((root) => effectivelyWritable(policy.mode, root.access)).map((root) => root.path);
-		const denied = registered.filter((root) => typeof root.recordedPath === "string" && root.recordedPath !== "" && root.recordedPath !== primaryRoot && (capped || !effectivelyWritable(policy.mode, root.access))).map((root) => root.recordedPath);
+		const denied = registered.filter((root) => typeof root.recordedPath === "string" && root.recordedPath !== "" && (capped || !effectivelyWritable(policy.mode, root.access))).map((root) => root.recordedPath);
 		const deniedRoots = [...new Set(denied)];
 		let protectedHome;
 		if (this.dshHome !== void 0 && policy.mode === "danger-full-access" && (deniedRoots.length > 0 || authority === "unavailable")) {
@@ -419,10 +559,9 @@ var MultiRootScopeService = class extends Service {
 	}
 	/** The sanitized members of one primary root, in registry order. */
 	membersOf(primaryRoot) {
-		const key = canonicalPath(primaryRoot);
-		const registered = this.rootsByPrimary.get(key);
+		const registered = this.rootsByPrimary.get(primaryKey(primaryRoot));
 		if (registered === void 0) return [];
-		return sanitizeMembers(key, registered);
+		return sanitizeMembers(canonicalPath(primaryRoot), registered);
 	}
 	/**
 	* Replace the roots registered for one primary root.
@@ -430,11 +569,13 @@ var MultiRootScopeService = class extends Service {
 	* M1 uses this from tests and smoke scripts only; M3 feeds it from plugin
 	* storage. It is a plain setter so the transition swaps the data source
 	* without touching any provider.
-	* @param primaryRoot - canonical primary root to register roots under.
+	* @param primaryRoot - primary root the roots belong to; the Registry key
+	*   is its upstream spelling via {@link primaryKey}, never re-resolved.
 	* @param roots - the additional roots, in display order.
 	*/
 	setAdditionalRoots(primaryRoot, roots) {
-		const key = canonicalPath(primaryRoot);
+		const key = primaryKey(primaryRoot);
+		if (!sameAdditionalRoots(this.rootsByPrimary.get(key) ?? [], roots)) this.bumpPublication();
 		if (roots.length === 0) this.rootsByPrimary.delete(key);
 		else this.rootsByPrimary.set(key, [...roots]);
 		this.notifySubscribers();
@@ -454,8 +595,17 @@ var MultiRootScopeService = class extends Service {
 		const next = available ? "available" : "unavailable";
 		if (this.registryAuthority === next) return;
 		this.registryAuthority = next;
+		this.bumpPublication();
 		this.notifySubscribers();
 	}
 };
+/** Whether two persisted member lists carry the same authorization basis, in registry order. */
+function sameAdditionalRoots(a, b) {
+	if (a.length !== b.length) return false;
+	return a.every((root, index) => {
+		const next = b[index];
+		return next !== void 0 && root.id === next.id && root.path === next.path && root.recordedPath === next.recordedPath && root.access === next.access && root.withheld === next.withheld && root.alias === next.alias;
+	});
+}
 //#endregion
 export { MULTI_ROOT_CONTEXT_NAME, MultiRootScopeService, MultiRootScopeService as default, REGISTRY_UNAVAILABLE_NOTE, renderWorkspaceRootsContext, sanitizeAdditionalRoots };