@dsh-electron/dsh-plugin-multi-root-workspace 0.1.14 → 0.1.16

package/lib/types/ops-compatibility.d.ts

@@ -0,0 +1,34 @@
+import { Service, type Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+export interface Config {
+    readonly enabled?: boolean;
+}
+export declare const Config: z<Schemastery.ObjectS<NoInfer<{
+    enabled: z<boolean, boolean, "defined">;
+}>>, Schemastery.ObjectT<NoInfer<{
+    enabled: z<boolean, boolean, "defined">;
+}>>, "plain">;
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        multiRootOpsCompatibility: MultiRootOpsCompatibility;
+    }
+}
+export declare class MultiRootOpsCompatibility extends Service {
+    private readonly settingsConfig;
+    static Config: z<Schemastery.ObjectS<NoInfer<{
+        enabled: z<boolean, boolean, "defined">;
+    }>>, Schemastery.ObjectT<NoInfer<{
+        enabled: z<boolean, boolean, "defined">;
+    }>>, "plain">;
+    static provide: string;
+    static inject: string[];
+    constructor(ctx: Context, settingsConfig?: Config);
+    private settingsRead;
+    private currentToken;
+    private enabledNow;
+    private closing;
+    get token(): object | undefined;
+    get enabled(): boolean;
+    private sync;
+}
+export default MultiRootOpsCompatibility;

package/lib/types/registry-operation.d.ts

@@ -2,6 +2,13 @@ import type { SandboxMode } from '@deepseek-ai/dsh-sandbox';
 import type { FilesystemScope } from './scope.ts';
 export type RegistryOperationKind = 'fs-write' | 'fs-edit' | 'process' | 'pty' | 'lsp' | 'files' | 'instructions' | 'skills';
 export declare function currentRegistryOperation(proof: object): RegistryOperation | undefined;
+/**
+ * The enclosing admission frame's mint disposition for this proof. `expired`
+ * frames still occupy the async context of their descendants; an expired
+ * admission must never bequeath a launchable profile.
+ */
+export type OperationFrameState = 'active' | 'expired' | 'absent';
+export declare function operationFrameState(proof: object): OperationFrameState;
 export interface RegistryOperationIdentity {
     readonly operationId: string;
     readonly kind: RegistryOperationKind;

package/lib/types/registry.d.ts

@@ -121,7 +121,12 @@ export type RegistryAuthorityState = {
 export interface Config {
     /** Absolute path of the store-wide kernel lock file. */
     readonly leasePath?: string;
-    /** Explicit medium binding for the multi-Host authority service. */
+    /**
+     * Medium binding for the multi-Host authority service — REQUIRED since the
+     * single-process mode was removed (ADR-0028). Absent or empty puts the
+     * registry in the fail-closed `config-invalid` state: no lease, no domain,
+     * no grants.
+     */
     readonly sharedStorageRoot?: string;
     /**
      * Cap on STORED additional-root records per primary root (every state
@@ -281,8 +286,15 @@ export declare class MultiRootRegistry extends Service {
     /** Keys already warned about a historical over-limit store (one warning each). */
     private readonly warnedOverLimit;
     /**
-     * @param ctx - the host context; `storageDomain` and `multiRootScope` are injected.
-     * @param config - the patch row's `leasePath` and `maxAdditionalRoots`.
+     * The canonical value each protected boundary resolved to the FIRST time it
+     * could be computed, keyed by boundary kind. Never re-pinned: a later
+     * rename or symlink swap of the DSH home (or of the lease directory) must
+     * not drop the boundary the registration rules were enforced under.
+     */
+    private readonly pinnedProtectedPaths;
+    /**
+     * @param ctx - the host context; `storage` and `multiRootScope` are injected.
+     * @param config - the patch row's `sharedStorageRoot`, `leasePath`, and `maxAdditionalRoots`.
      */
     constructor(ctx: Context, config?: Config);
     /**
@@ -379,6 +391,44 @@ export declare class MultiRootRegistry extends Service {
      */
     withOperation<T>(policy: SandboxExecutionPolicy, kind: RegistryOperationKind, body: (operation: RegistryOperation) => T | Promise<T>): Promise<T>;
     withPrimaryOperation<T>(policy: SandboxExecutionPolicy, body: () => T): T;
+    /**
+     * The spellings one protected boundary contributes: the configured path,
+     * its current canonical resolution, and the canonical value pinned the
+     * first time it resolved — never re-pinned, so a later rename or symlink
+     * swap of the protected directory cannot drop the boundary the
+     * registration rules were enforced under. The list is deduplicated by
+     * {@link samePath}.
+     */
+    private boundarySpellings;
+    /**
+     * The best-known protected-boundary set, plus whether it is COMPLETE.
+     *
+     * The set comes from trusted host configuration, never from a panel or
+     * shell claim: the scope row's `dshHome`, the physical medium
+     * `storeIdentity` bound, and the lease directory beside it.
+     * `complete` is false — and only NEW grants may then be refused — when a
+     * boundary cannot be proven: an invalid `dshHome` config, a configured
+     * home that is not a directory right now, or a medium that was never bound. Stored classification always consumes whatever IS known
+     * (pinned values included), so an unknown boundary never weakens the
+     * revalidation of existing records.
+     */
+    private protectedBoundarySet;
+    /**
+     * The protected DSH directories this Host can prove right now, or
+     * `undefined` when the set cannot be proven. `undefined` blocks every NEW
+     * grant; it never weakens the classification of stored records.
+     */
+    private protectedPaths;
+    /**
+     * Every protected entry this Host can prove — used wherever a partial set
+     * must still protect stored records and received snapshots.
+     */
+    private knownProtectedPaths;
+    /**
+     * The one refusal shared by the owner mutation path and the follower
+     * pre-check: the protected set cannot be proven, so no new grant is safe.
+     */
+    private static protectedBoundaryUnknown;
     /**
      * Registers one additional root.
      * @param primaryRoot - the session workspace root the root belongs to.
@@ -463,7 +513,7 @@ export declare class MultiRootRegistry extends Service {
     recheck(primaryRoot: string): Promise<readonly RootStatus[]>;
     /**
      * Observe registry changes.
-     * @param listener - called with the canonical primary root after each durable change.
+     * @param listener - called with the Registry key (`primaryKey()`, case-folded on Windows) after each durable change.
      * @returns the disposer that stops observing.
      */
     onChange(listener: (primaryRoot: string) => void): () => void;
@@ -495,10 +545,17 @@ export declare class MultiRootRegistry extends Service {
      */
     private statusesOf;
     /**
-     * The stored record set of one key, or `undefined` when there is none (or
-     * when the store itself could not be read: an unusable store reads as
-     * "nothing registered" so reads stay answerable and the surfaces can explain
-     * the situation, while every write fails loudly in `requireTable()`).
+     * The stored record set of one key: `{ record, migrated: false }` when the
+     * spelling key holds it; `{ record, migrated: true }` when only the legacy
+     * CANONICAL key does — stores written before the upstream primary spelling
+     * became the key (v0.1.14 and earlier). The fallback follows the CURRENT
+     * resolution ONLY for such a not-yet-migrated store; the first serialized
+     * access copies the record forward under the spelling key (see
+     * {@link reclassify}), after which resolution can never re-key a grant.
+     * `undefined` when there is no record (or when the store itself could not
+     * be read: an unusable store reads as "nothing registered" so reads stay
+     * answerable and the surfaces can explain the situation, while every write
+     * fails loudly in `requireTable()`).
      */
     private lookupRecords;
     /**
@@ -562,6 +619,8 @@ export declare class MultiRootRegistry extends Service {
     private commit;
     /** Deliver one key's notifications now, or collect them inside a commit. */
     private deliverNotifications;
+    /** Narrow owner rows for this Host, identically for projection and admission. */
+    private localSnapshotRoots;
     private applySnapshot;
     private remoteUnavailable;
     /**

package/lib/types/review-context.d.ts

@@ -8,8 +8,10 @@ declare module '@deepseek-ai/cordis' {
 }
 export interface ReviewExecution {
     readonly agent?: Agent;
+    readonly callId?: string;
     readonly name: string;
     readonly arguments: unknown;
+    readonly parent?: unknown;
 }
 export interface ReviewContext {
     readonly schemaVersion: 1;

package/lib/types/roots.d.ts

@@ -14,15 +14,21 @@
  *    misconfiguration, not a path to guess at.
  * 2. `missing` — the directory does not exist.
  * 3. `not-a-directory` — it exists but is not a directory.
- * 4. `equals-primary` — the canonical candidate IS the session's workspace
+ * 4. `protected-path` — the canonical candidate equals, lies inside, or
+ *    contains a protected DSH directory (the DSH home, the registry's
+ *    physical storage medium, or the lease directory, supplied through
+ *    {@link RootCandidateContext.protectedPaths}): those hold the store,
+ *    the lease, profiles and user credentials, so no access level may
+ *    register them. Applies to every mode; no remote exemption exists.
+ * 5. `equals-primary` — the canonical candidate IS the session's workspace
  *    root, which is already granted by the upstream policy.
- * 5. `primary-overlap` — the candidate lies under the workspace root, or
+ * 6. `primary-overlap` — the candidate lies under the workspace root, or
  *    contains it. The union grants nothing new, and the displayed list would
  *    stop matching the enforced root set.
- * 6. `duplicate` — another registered root canonicalizes to the same path.
- * 7. `nested` — the candidate lies under a registered root, or contains one.
- *    Same reasoning as rule 5, applied to the additional roots.
- * 8. `unsupported-path` — on Windows, a network or device path (`\\server`,
+ * 7. `duplicate` — another registered root canonicalizes to the same path.
+ * 8. `nested` — the candidate lies under a registered root, or contains one.
+ *    Same reasoning as rule 6, applied to the additional roots.
+ * 9. `unsupported-path` — on Windows, a network or device path (`\\server`,
  *    `\\?\…`, `\\.\…`): the ACL confinement cannot be shown to cover it, so it
  *    is rejected lexically before any filesystem touch.
  *
@@ -67,6 +73,23 @@ export declare function additionalRootId(value: string): AdditionalRootId;
  *   `read-only` session; it does not widen anything beyond its own directory.
  */
 export type RootAccess = 'inherit' | 'read-write' | 'read-only';
+/**
+ * Which protected DSH directory one boundary belongs to: the harness home
+ * (`$DSH_HOME`), the registry's physical storage medium, or the directory the
+ * store-wide lease occupies.
+ */
+export type ProtectedPathKind = 'dsh-home' | 'registry-medium' | 'registry-lease';
+/**
+ * One directory no additional root may equal, lie inside, or contain. `path`
+ * is an absolute spelling — the configured one, the current canonical one, or
+ * a canonical value pinned the first time the boundary resolved — and is
+ * compared with {@link samePath}/{@link isCanonicallyUnder} exactly like
+ * every other boundary in this module.
+ */
+export interface ProtectedPath {
+    readonly kind: ProtectedPathKind;
+    readonly path: string;
+}
 /** One registered additional root exactly as it is persisted. */
 export interface RegisteredRoot {
     /** Stable registry identity. */
@@ -139,13 +162,20 @@ export interface RootStatus extends RegisteredRoot {
      *
      * `'membership-conflict'` means the record passed every structural rule —
      * including an intact, absolute recorded grant — but its recorded boundary
-     * overlaps another record's. Neither membership may be granted while the
-     * conflict stands, yet the boundary remains a trustworthy negative
-     * restriction, so {@link reservedRootBoundary} keeps it reserved and the
-     * registry publishes the root as a withheld, deny-only entry. Every other
-     * `invalid` verdict left the grant unverifiable, so it contributes nothing.
+     * overlaps another record's. `'protected-path'` means that same intact
+     * grant overlaps a protected DSH directory (the home, the storage medium,
+     * or the lease directory) — typically a store written before the boundary
+     * existed or on another layout. `'primary-overlap'` means the intact grant
+     * equals or overlaps the CURRENT canonical primary root — e.g. a primary
+     * spelling retargeted onto (or above) a read-only root — which withholds
+     * membership but must never drop the deny. All three reasons mean the same
+     * thing: the boundary is intact and trustworthy, so
+     * {@link reservedRootBoundary} keeps it reserved and the registry
+     * publishes the root as a withheld, deny-only entry — only the membership
+     * is withheld. Every other `invalid` verdict left the grant unverifiable,
+     * so it contributes nothing.
      */
-    readonly invalidReason?: 'membership-conflict';
+    readonly invalidReason?: 'membership-conflict' | 'protected-path' | 'primary-overlap';
 }
 /** One status together with the 1-based ordinal the surfaces accept for it. */
 export interface IndexedRootStatus {
@@ -172,7 +202,9 @@ export type RootRef = {
     readonly addedAt: string;
 };
 /** Every way root handling can fail, as a stable code the surfaces localize. */
-export type RootValidationCode = 'not-absolute' | 'missing' | 'not-a-directory' | 'equals-primary' | 'primary-overlap' | 'duplicate' | 'nested' | 'invalid-alias' | 'invalid-alias-id' | 'not-found' | 'invalid-ref' | 'storage-unavailable' | 'registry-contended' | 'root-limit-reached' | 'config-invalid' | 'reveal-unavailable' | 'session-not-found' | 'unsupported-path' | 'root-unavailable';
+export type RootValidationCode = 'not-absolute' | 'missing' | 'not-a-directory' | 'equals-primary' | 'primary-overlap' | 'duplicate' | 'nested' | 'invalid-alias' | 'invalid-alias-id' | 'not-found' | 'invalid-ref' | 'storage-unavailable' | 'registry-contended' | 'root-limit-reached' | 'config-invalid' | 'reveal-unavailable' | 'session-not-found'
+/** Synthesized at the panel dispatch catch — the session existed but could not resolve a root during the request (writer-held, mid-resume, or a race resolved after the throw); no RootValidationError is constructed with it. */
+ | 'session-not-live' | 'unsupported-path' | 'root-unavailable' | 'protected-path' | 'protected-boundary-unknown' | 'revive-target-changed';
 /** A rejected root operation; `code` is the stable contract, `message` the fallback prose. */
 export declare class RootValidationError extends Error {
     readonly code: RootValidationCode;
@@ -200,6 +232,21 @@ export declare class RootValidationError extends Error {
  * @returns the expanded path (still unvalidated).
  */
 export declare function expandRootInput(raw: string, home?: string): string;
+/**
+ * The Registry/scope lookup key of one primary root: the UPSTREAM spelling,
+ * normalized lexically by `path.resolve` and case-folded on Windows — never
+ * re-resolved. Upstream `dsh-sandbox-policy` sets `policy.workspaceRoot` to
+ * `session.header.cwd` verbatim, so the spelling IS the identity: a symlinked
+ * workspace and its realpath target are different sessions and different key
+ * spaces. Re-resolving here would let a replaced workspace directory
+ * silently re-key the record set onto another identity — the exact failure
+ * the redirect rules exist to prevent. This is the ONLY function allowed to
+ * turn a primary root into a Registry key; path geometry keeps using
+ * {@link canonicalRoot}.
+ */
+export declare function primaryKey(path: string, platform?: NodeJS.Platform): string;
+/** Whether two canonical paths name the same directory on this platform. */
+export declare function samePath(left: string, right: string): boolean;
 /**
  * Whether `candidate` is `root` itself or lies beneath it. Both sides must
  * already be canonical: symlinks are resolved by then, so the lexical test is
@@ -242,6 +289,15 @@ export interface RootCandidateContext {
      * revived exempts only itself.
      */
     readonly existing: readonly string[];
+    /**
+     * The protected DSH directories — the home, the registry's storage medium,
+     * and the lease directory — that no candidate may equal, lie inside, or
+     * contain, at any access level and under any mode. Derived from the trusted
+     * host configuration by the registry; absent means "no protected set was
+     * provided" and is never a substitute for the boundary being unprovable
+     * (the caller refuses that case itself with `protected-boundary-unknown`).
+     */
+    readonly protectedPaths?: readonly ProtectedPath[];
 }
 /**
  * Judge one candidate root and return its canonical spelling.
@@ -251,6 +307,16 @@ export interface RootCandidateContext {
  * @throws {RootValidationError} with the first rule that failed.
  */
 export declare function validateRootCandidate(raw: string, context: RootCandidateContext): string;
+/**
+ * The first protected directory `candidate` overlaps — equals, lies inside,
+ * or contains. Both sides must already be canonical (or absolute boundary
+ * spellings): the comparison is the same lexical three-way test the other
+ * boundary rules use, so a symlink alias can never route around it.
+ * @param candidate - the canonical candidate or recorded grant to test.
+ * @param protectedPaths - the protected DSH directories.
+ * @returns the overlapping protected path, or `undefined`.
+ */
+export declare function protectedOverlap(candidate: string, protectedPaths: readonly ProtectedPath[]): ProtectedPath | undefined;
 /**
  * Re-judge every stored record of one primary root — the startup and refresh
  * path, which must never throw: a registration that stopped being usable is
@@ -262,26 +328,56 @@ export declare function validateRootCandidate(raw: string, context: RootCandidat
  * @param primaryRoot - the session workspace root the records belong to.
  * @param records - the stored records, in registry order.
  * @param platform - the platform the rules run for; defaults to `process.platform`.
+ * @param protectedPaths - the protected DSH directories a stored grant may not
+ *   overlap; a record that does is reported `invalid` with
+ *   `invalidReason: 'protected-path'` — withheld, never deleted, never re-granted.
  * @returns one status per record, in the same order.
  */
-export declare function classifyStoredRoots(primaryRoot: string, records: readonly RegisteredRoot[], platform?: NodeJS.Platform): RootStatus[];
+export declare function classifyStoredRoots(primaryRoot: string, records: readonly RegisteredRoot[], platform?: NodeJS.Platform, protectedPaths?: readonly ProtectedPath[]): RootStatus[];
+/**
+ * The single recorded grant a record or status carries — `undefined` unless
+ * EXACTLY one grant field holds a non-empty string. Shared by the conflict
+ * pass and {@link reservedRootBoundary}; the stored decoder is the source of
+ * the access level, so this never cross-checks the field against `access`.
+ */
+export declare function singleGrantOf(record: {
+    readonly recordedPath?: string;
+    readonly readOnlyRecordedPath?: string;
+    readonly readWriteRecordedPath?: string;
+}): string | undefined;
 /**
  * The canonical roots a status list grants, in registry order.
  * @param statuses - the statuses to project.
  * @returns the canonical paths of every `available` root.
  */
 export declare function availableRoots(statuses: readonly RootStatus[]): string[];
+/**
+ * Apply the protected-path verdict to an already-classified list: a status
+ * whose recorded grant overlaps a protected directory becomes `invalid` with
+ * `invalidReason: 'protected-path'` — the same verdict the pass-one stored
+ * check produces, here applied by a consumer that classified elsewhere (a
+ * shared-registry follower re-judging an owner snapshot against ITS OWN
+ * protected set, which may differ from the owner's). Statuses already
+ * `invalid` keep their own verdict — a structural failure is never healed
+ * into a trustworthy boundary.
+ * @param statuses - the classified statuses to re-mark.
+ * @param protectedPaths - the caller's own protected DSH directories.
+ * @returns a new list with the verdict applied.
+ */
+export declare function markProtectedPaths(statuses: readonly RootStatus[], protectedPaths: readonly ProtectedPath[]): RootStatus[];
 /**
  * The recorded boundary one status still RESERVES: the grant it was
  * registered for, which a new or revived registration may not overlap merely
  * because the root is currently unusable.
  *
- * `available`, `missing`, `redirected`, and membership-conflict statuses all
- * carry an intact, trustworthy recorded grant; every other `invalid` verdict
- * means the grant could not be parsed at all, so it reserves — and denies —
- * nothing. This is not an independent authorization table: it derives the
- * boundary from the status list {@link classifyStoredRoots} produced, with
- * the same grant-extraction semantics, so its answer can never disagree with
+ * `available`, `missing`, `redirected`, and the trustworthy-boundary
+ * `invalid` verdicts (`membership-conflict`, `protected-path`, and
+ * `primary-overlap`) all carry
+ * an intact recorded grant; every other `invalid` verdict means the grant
+ * could not be parsed at all, so it reserves — and denies — nothing. This is
+ * not an independent authorization table: it derives the boundary from the
+ * status list {@link classifyStoredRoots} produced, with the same
+ * grant-extraction semantics, so its answer can never disagree with
  * classification.
  * @param status - one classified registration.
  * @returns the absolute recorded boundary, or `undefined` when there is none.

package/lib/types/scope.d.ts

@@ -17,7 +17,8 @@
  */
 import { Context, Service } from '@deepseek-ai/cordis';
 import type { SandboxExecutionPolicy, SandboxMode } from '@deepseek-ai/dsh-sandbox';
-import type { RootAccess } from './roots.ts';
+import { type RootAccess } from './roots.ts';
+import type { OpsProtectionState } from './compat/ops-tools.ts';
 declare module '@deepseek-ai/cordis' {
     interface Context {
         multiRootScope: MultiRootScopeService;
@@ -199,6 +200,24 @@ export interface Config {
      */
     readonly dshHome?: string;
 }
+/**
+ * The baseline a mint resolved to. Only primary-bounded forms may join the
+ * unadmitted ledger: `clamped` (primary-root clamp) and `read-only` (the
+ * upstream read-only skeleton — never writable). `ambient` mints —
+ * `restrictedExecution`'s ambient-minus-denies profile, and any mint whose
+ * scope could not be proven unavailable — may only live bound to an
+ * admission frame, and otherwise die.
+ */
+export type MintForm = 'clamped' | 'read-only' | 'ambient';
+/** The authorization basis a mint carried at its synchronous entry, stamped onto its ledger entry. */
+export interface MintStamp {
+    /** Publication generation the mint's authorization snapshot was resolved under. */
+    readonly version: number;
+    /** Tool-cap basis at the same instant. */
+    readonly capped: boolean;
+    /** The profile form the mint produced; gates ledger admission. */
+    readonly form: MintForm;
+}
 /**
  * The `ctx.multiRootScope` service. Providers ask it — never the filesystem —
  * what the current scope is, which is what keeps the fs fence and every kernel
@@ -210,9 +229,18 @@ export declare class MultiRootScopeService extends Service {
     private readonly listeners;
     /** Enclosing {@link MultiRootScopeService.batch} depth; inner calls nest. */
     private batchDepth;
+    readonly opsProtection: OpsProtectionState;
     /** True when a batched write coalesced its notification into the flush. */
     private batchDirty;
     private admissionProof;
+    /**
+     * The publication generation the mint ledger is keyed on: bumped when a
+     * root-table write or an authority transition changes the authorization
+     * basis (a repeat publish of identical content is not a publication), so a
+     * minted profile dies with the state it was computed from.
+     */
+    private publicationVersion;
+    private mintedProfiles;
     /**
      * The registry-authority fact the registry row publishes. Defaults to
      * `available`: a composition without a registry row can never have
@@ -233,6 +261,13 @@ export declare class MultiRootScopeService extends Service {
      * treated as evidence.
      */
     private readonly dshHome;
+    /**
+     * Whether the row carried a `dshHome` value at all — even an invalid one.
+     * The registry's protected-boundary set must tell "no home configured"
+     * (absent: nothing to protect) from "a home was supplied and rejected"
+     * (invalid: the boundary cannot be proven).
+     */
+    private readonly dshHomeSupplied;
     /** Observe registry publications; consumers still resolve authority from scopeOf(). */
     subscribe(listener: () => void): () => void;
     /**
@@ -249,6 +284,8 @@ export declare class MultiRootScopeService extends Service {
     batch<T>(body: () => T): T;
     /** Notify subscribers now, or coalesce into the enclosing batch's flush. */
     private notifySubscribers;
+    /** A publication superseded the authorization basis: every outstanding minted profile dies. */
+    private bumpPublication;
     /**
      * The sorted names of the tools `toolAccess` caps — read-only for the
      * prompt contribution. An invalid config is not enumerated (it caps every
@@ -257,6 +294,21 @@ export declare class MultiRootScopeService extends Service {
     toolCaps(): readonly string[];
     /** Whether malformed toolAccess caps every call, including unknown tools. */
     get toolAccessInvalid(): boolean;
+    /**
+     * The validated `dshHome` row config, classified for the registry's
+     * protected-boundary set: `absent` when the row carried no value (nothing
+     * to protect), `invalid` when it carried a value the constructor rejected
+     * (the boundary cannot be proven), `configured` with the accepted absolute
+     * path. Read-only — this changes no scope or `protectedHome` semantics.
+     */
+    get dshHomeConfig(): {
+        readonly kind: 'absent';
+    } | {
+        readonly kind: 'invalid';
+    } | {
+        readonly kind: 'configured';
+        readonly path: string;
+    };
     constructor(ctx: Context, config?: Config);
     /**
      * Resolve the scope of one confined call.
@@ -264,8 +316,46 @@ export declare class MultiRootScopeService extends Service {
      * @returns the canonical scope; `additionalRoots` is empty when none are registered.
      */
     requireAdmission(proof: object): void;
-    rememberProfile(argv: readonly string[]): void;
+    /**
+     * The stamp an asynchronously completing mint must carry: the publication
+     * generation and tool-cap basis at the mint's synchronous entry, before any
+     * provider probe could run. An in-flight mint that crosses a real
+     * publication keeps its entry generation, so the ledger refuses it rather
+     * than re-stamping stale authorization under the current publication.
+     * @param form - the profile form the mint will produce (`clamped` and
+     *   `read-only` are the only ledger-eligible forms).
+     */
+    captureMint(form: MintForm): MintStamp;
+    /**
+     * Record a confined profile this host's provider just minted. Only
+     * meaningful under the shared Registry (`admissionProof` set; without it
+     * `permitsProfile` never refuses): a live admission binds the profile to
+     * the operation and it dies with it; an expired admission never bequeaths
+     * one — a mint that outlived its operation is dropped, not demoted into
+     * the ledger; only with NO admission frame at all does the profile join
+     * the publication-keyed ledger stamped with `mint`, and only when the
+     * mint's form is primary-bounded — an `ambient` mint that arrives without
+     * a frame is dropped the same way.
+     * @param argv - the confined argv just minted.
+     * @param mint - the {@link captureMint} stamp taken at the mint's
+     *   synchronous entry.
+     */
+    rememberProfile(argv: readonly string[], mint: MintStamp): void;
+    /**
+     * Whether a confined argv may launch now: a profile minted inside this live
+     * admission, or — for a `confine`→`spawn` composition with no wrapped entry
+     * to admit it — a profile this host minted while its authorization
+     * publication is still current. Cached argv, argv minted under a superseded
+     * publication, and argv minted elsewhere stay refused.
+     */
     permitsProfile(argv: readonly string[]): boolean;
+    /**
+     * The strict form: only profiles minted inside this live admission. The OPS
+     * execution domain owns its profile exclusively and never honors the
+     * unadmitted mint ledger.
+     */
+    permitsOperationProfile(argv: readonly string[]): boolean;
+    private permitsMintedProfile;
     get admissionRequired(): boolean;
     admissionPathsValid(): boolean;
     hasAdmission(): boolean;
@@ -275,6 +365,7 @@ export declare class MultiRootScopeService extends Service {
     resolve(policy: SandboxExecutionPolicy): FilesystemScope;
     /** Read-only pending-dispatch projection. Does not mint an ALS execution grant. */
     previewForTool(policy: SandboxExecutionPolicy, toolName: string): FilesystemScope;
+    withToolCap<T>(name: string, fn: () => T): T;
     /** Execution and review use exactly the same parent-narrowing rule. */
     private capForTool;
     private project;
@@ -324,7 +415,8 @@ export declare class MultiRootScopeService extends Service {
      * M1 uses this from tests and smoke scripts only; M3 feeds it from plugin
      * storage. It is a plain setter so the transition swaps the data source
      * without touching any provider.
-     * @param primaryRoot - canonical primary root to register roots under.
+     * @param primaryRoot - primary root the roots belong to; the Registry key
+     *   is its upstream spelling via {@link primaryKey}, never re-resolved.
      * @param roots - the additional roots, in display order.
      */
     setAdditionalRoots(primaryRoot: string, roots: readonly AdditionalWorkspaceRoot[]): void;

package/lib/workspace-files.js

@@ -1,7 +1,7 @@
-import { t as wrapMethod } from "./method-wrapper-CFY3p3j2.js";
-import { c as withRegistryRead } from "./registry-operation-C2ZV3Jhw.js";
-import { l as isCanonicallyUnder } from "./roots-Ca_W1S9n.js";
-import { t as routeWorkspacePath } from "./workspace-routing-YPxaQ4V3.js";
+import { t as wrapMethod } from "./method-wrapper-D4oUCsEF.js";
+import { l as withRegistryRead } from "./registry-operation-CIlmt6_c.js";
+import { l as isCanonicallyUnder } from "./roots-CmaWxRVy.js";
+import { t as routeWorkspacePath } from "./workspace-routing-D_qwMUh-.js";
 import { posix, resolve, win32 } from "node:path";
 //#region src/compat/workspace-files.ts
 function adaptPathWatch(service, wrap) {

package/lib/{workspace-routing-YPxaQ4V3.js → workspace-routing-D_qwMUh-.js}

@@ -4,7 +4,7 @@ import { canonicalPath } from "@deepseek-ai/dsh-sandbox";
 async function routeWorkspacePath(ctx, primaryRoot, path, signal, cwd = primaryRoot) {
 	signal?.throwIfAborted();
 	const primary = canonicalPath(primaryRoot);
-	const roots = [primary, ...ctx.multiRootScope.scopeOf(primary)];
+	const roots = [primary, ...ctx.multiRootScope.scopeOf(primaryRoot)];
 	const target = await ctx.fs.resolve(path, {
 		cwd,
 		...signal === void 0 ? {} : { signal }
@@ -12,11 +12,11 @@ async function routeWorkspacePath(ctx, primaryRoot, path, signal, cwd = primaryR
 	for (const root of roots) {
 		const rootTarget = await ctx.fs.resolve(root, signal === void 0 ? {} : { signal });
 		if (!ctx.fs.contains(rootTarget, target)) continue;
-		if (root !== primary && !ctx.multiRootScope.scopeOf(primary).includes(root)) return void 0;
+		if (root !== primary && !ctx.multiRootScope.scopeOf(primaryRoot).includes(root)) return void 0;
 		signal?.throwIfAborted();
 		return {
-			primaryRoot: primary,
-			workspaceRoot: root,
+			primaryRoot,
+			workspaceRoot: root === primary ? primaryRoot : root,
 			target,
 			absolutePath: ctx.fs.processPath(target)
 		};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dsh-electron/dsh-plugin-multi-root-workspace",
   "description": "Multi-root Workspace for DeepSeek Harness: adds N additional roots to the workspace sandbox scope as an out-of-tree bundle",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -75,6 +75,10 @@
     "./skills": {
       "types": "./lib/types/skills.d.ts",
       "default": "./lib/skills.js"
+    },
+    "./ops-compatibility": {
+      "types": "./lib/types/ops-compatibility.d.ts",
+      "default": "./lib/ops-compatibility.js"
     }
   },
   "files": [