@dsh-electron/dsh-plugin-multi-root-workspace 0.1.15 → 0.1.16

package/lib/{command-y5tfcAeC.js → command-DaVJ-mK3.js}

@@ -28,6 +28,24 @@ function connectionRpcFor(ctx, connection) {
 	return connection.rpc;
 }
 //#endregion
+//#region src/compat/session-existence.ts
+/**
+* Whether `sessionId` exists in the mounted persistence backend.
+* @param ctx - the plugin fiber context; optional services read via `ctx.get`.
+* @param sessionId - the panel request's session id.
+* @param signal - the request's cancellation, forwarded when the backend takes options.
+* @returns `true` only when a snapshot proves the session exists.
+*/
+async function persistedSessionExists(ctx, sessionId, signal) {
+	try {
+		const persistence = ctx.get("sessionPersistence");
+		if (typeof persistence?.stat !== "function") return false;
+		return await persistence.stat(sessionId, signal === void 0 ? void 0 : { signal }) !== void 0;
+	} catch {
+		return false;
+	}
+}
+//#endregion
 //#region src/profile-isolation.ts
 /**
 * Profile pnpm import isolation — the host-side maintenance behind
@@ -1113,6 +1131,32 @@ function resolvePanelPrimaryRoot(ctx, sessionId) {
 	if (session === void 0 || cwd === void 0 || cwd === "" || !isAbsolute(cwd)) throw new RootValidationError("session-not-found", `session "${sessionId}" is not an active host session`, { reference: sessionId });
 	return cwd;
 }
+/**
+* Whether the panel's resolver would now name a primary root for the session —
+* the exact live-and-usable-cwd predicate, re-run so a resume that landed
+* between a rejection and its classification is recognized instead of
+* duplicating the cwd rule.
+*/
+function panelSessionResolvable(ctx, sessionId) {
+	try {
+		resolvePanelPrimaryRoot(ctx, sessionId);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Whether the sessions store names no live session for `sessionId` — or
+* cannot even answer, in which case "not live" stays unproven and the
+* caller keeps the code the flow already had.
+*/
+function liveSessionAbsent(ctx, sessionId) {
+	try {
+		return ctx.get("sessions")?.get(sessionId) === void 0;
+	} catch {
+		return false;
+	}
+}
 /** Project one status into the panel's view. */
 function toRootView(status, index) {
 	return {
@@ -1194,6 +1238,7 @@ async function rootsViewOf(ctx, registry, primaryRoot, request) {
 * through the channel.
 */
 async function dispatchPanelRequest(ctx, endpoint, payload, signal) {
+	let panelSessionId;
 	try {
 		if (SKILLS_ENDPOINTS.includes(endpoint)) {
 			const parsedSkills = skillsRequestSchema.safeParse(payload);
@@ -1231,6 +1276,7 @@ async function dispatchPanelRequest(ctx, endpoint, payload, signal) {
 			}
 		};
 		const request = parsed.value;
+		panelSessionId = request.sessionId;
 		const registry = ctx.multiRootRegistry;
 		const primaryRoot = resolvePanelPrimaryRoot(ctx, request.sessionId);
 		switch (request.endpoint) {
@@ -1302,7 +1348,15 @@ async function dispatchPanelRequest(ctx, endpoint, payload, signal) {
 			}
 		}
 	} catch (error) {
-		if (error instanceof RootValidationError || error instanceof AuthorityRpcError) return {
+		if (error instanceof RootValidationError) return {
+			ok: false,
+			error: {
+				code: error.code === "session-not-found" && panelSessionId !== void 0 && (panelSessionResolvable(ctx, panelSessionId) || liveSessionAbsent(ctx, panelSessionId) && await persistedSessionExists(ctx, panelSessionId, signal)) ? "session-not-live" : error.code,
+				message: error.message,
+				details: {}
+			}
+		};
+		if (error instanceof AuthorityRpcError) return {
 			ok: false,
 			error: {
 				code: error.code,

package/lib/command.js

@@ -1,2 +1,2 @@
-import { a as renderRootsReport, c as revealArgv, i as parseFoldersCommand, n as apply, o as resolvePanelPrimaryRoot, r as inject, s as revealAccepted, t as COMMAND_NAME } from "./command-y5tfcAeC.js";
+import { a as renderRootsReport, c as revealArgv, i as parseFoldersCommand, n as apply, o as resolvePanelPrimaryRoot, r as inject, s as revealAccepted, t as COMMAND_NAME } from "./command-DaVJ-mK3.js";
 export { COMMAND_NAME, apply, inject, parseFoldersCommand, renderRootsReport, resolvePanelPrimaryRoot, revealAccepted, revealArgv };

package/lib/index.js

@@ -1,17 +1,17 @@
 import { r as renderInstructions, t as instructionsApi } from "./agent-instructions-BXuKhOzr.js";
 import { t as createInstructionMessage } from "./llm-message-CepyzEBQ.js";
-import { a as composeInstructionMessage, r as PLUGIN_SOURCE, t as DEFAULT_MAX_BYTES } from "./instructions-Ck9wp4J4.js";
+import { a as composeInstructionMessage, r as PLUGIN_SOURCE, t as DEFAULT_MAX_BYTES } from "./instructions-Ca80SkZq.js";
 import { a as REQUIRED_CORE_PACKAGES, c as SUPPORTED_DSH_RELEASES, d as readInstalledVersion, i as OPTIONAL_CORE_PACKAGES, l as classifyInstallation, n as CORE_PACKAGES, o as RUNNER_ANCHORED_PACKAGES, r as HOST_SERVICE_PACKAGES, s as RUNTIME_OPTIONAL_PACKAGES, u as compatEnforcement } from "./dsh-version-DCwF7REk.js";
 import { a as classifyStoredRoots, c as indexedStatuses, g as resolveRootRef, i as canonicalRoot, l as isCanonicallyUnder, n as additionalRootId, p as removeStatusAt, r as availableRoots, s as expandRootInput, t as RootValidationError, y as validateRootCandidate } from "./roots-CmaWxRVy.js";
 import { c as agentPtyMarkerVerdict, i as assertSupportedInstallation, l as assertAgentPtyMarker, n as MultiRootCompatService, o as AGENT_PTY_MARKER, s as PtyMarkerContractError, t as DshCompatUnsupportedError } from "./compat-CTJbpCxu.js";
 import { l as widenConfined } from "./dialects-CdlG3RF9.js";
 import { MULTI_ROOT_PROVIDER_BRAND, MultiRootProviders, brandMultiRootProvider, isMultiRootProvider } from "./providers.js";
 import { t as MultiRootFileSystem } from "./fs-Uws0ZpmV.js";
-import { t as MultiRootSandboxProvider } from "./sandbox-CZElTNPz.js";
+import { t as MultiRootSandboxProvider } from "./sandbox-aobdyQGi.js";
 import { a as parseRevealedView, i as parsePanelCall, n as PANEL_ENDPOINTS, o as parseRootsView, t as PANEL_CHANNEL } from "./contract-CStSEOcK.js";
 import { MultiRootScopeService, renderWorkspaceRootsContext, sanitizeAdditionalRoots } from "./scope.js";
-import { a as MultiRootRegistry, c as multiRootDomainSpec, i as MAX_ALIAS_LENGTH, l as RegistryAuthorityLease, n as DOMAIN_NAME, o as REGISTRY_CONTENDED_MESSAGE, r as MAX_ADDITIONAL_ROOTS_CEILING, t as DEFAULT_MAX_ADDITIONAL_ROOTS, u as RegistryLeaseContendedError } from "./registry-DyDNDSJZ.js";
-import { a as renderRootsReport, c as revealArgv, i as parseFoldersCommand, o as resolvePanelPrimaryRoot, t as COMMAND_NAME } from "./command-y5tfcAeC.js";
+import { a as MultiRootRegistry, c as multiRootDomainSpec, i as MAX_ALIAS_LENGTH, l as RegistryAuthorityLease, n as DOMAIN_NAME, o as REGISTRY_CONTENDED_MESSAGE, r as MAX_ADDITIONAL_ROOTS_CEILING, t as DEFAULT_MAX_ADDITIONAL_ROOTS, u as RegistryLeaseContendedError } from "./registry-BibiukWk.js";
+import { a as renderRootsReport, c as revealArgv, i as parseFoldersCommand, o as resolvePanelPrimaryRoot, t as COMMAND_NAME } from "./command-DaVJ-mK3.js";
 //#region src/index.ts
 /**
 * Carrier plugin face for the bare-package-name loader row (see the module

package/lib/{instructions-Ck9wp4J4.js → instructions-Ca80SkZq.js}

@@ -1,5 +1,5 @@
 import { t as effectiveDirectory } from "./session-directory-BLOstut1.js";
-import { c as withRegistryRead, s as withRegistryAdmission } from "./registry-operation-C2ZV3Jhw.js";
+import { c as withRegistryAdmission, l as withRegistryRead } from "./registry-operation-CIlmt6_c.js";
 import { t as instructionsApi } from "./agent-instructions-BXuKhOzr.js";
 import { t as createInstructionMessage } from "./llm-message-CepyzEBQ.js";
 import { t as aroundTool } from "./tool-context-CCeY3mrK.js";

package/lib/instructions.js

@@ -1,2 +1,2 @@
-import { a as composeInstructionMessage, i as apply, l as touchedPathOfToolCall, n as DEFAULT_MAX_SOURCE_BYTES, o as inject, r as PLUGIN_SOURCE, t as DEFAULT_MAX_BYTES } from "./instructions-Ck9wp4J4.js";
+import { a as composeInstructionMessage, i as apply, l as touchedPathOfToolCall, n as DEFAULT_MAX_SOURCE_BYTES, o as inject, r as PLUGIN_SOURCE, t as DEFAULT_MAX_BYTES } from "./instructions-Ca80SkZq.js";
 export { DEFAULT_MAX_BYTES, DEFAULT_MAX_SOURCE_BYTES, PLUGIN_SOURCE, apply, composeInstructionMessage, inject, touchedPathOfToolCall };

package/lib/lsp.js

@@ -1,5 +1,5 @@
 import { t as wrapMethod } from "./method-wrapper-D4oUCsEF.js";
-import { c as withRegistryRead } from "./registry-operation-C2ZV3Jhw.js";
+import { l as withRegistryRead } from "./registry-operation-CIlmt6_c.js";
 import { t as aroundTool } from "./tool-context-CCeY3mrK.js";
 import { t as routeWorkspacePath } from "./workspace-routing-D_qwMUh-.js";
 import { AsyncLocalStorage } from "node:async_hooks";

package/lib/process-fence.js

@@ -1,5 +1,5 @@
 import { t as wrapMethod } from "./method-wrapper-D4oUCsEF.js";
-import { s as withRegistryAdmission } from "./registry-operation-C2ZV3Jhw.js";
+import { c as withRegistryAdmission } from "./registry-operation-CIlmt6_c.js";
 import { t as aroundTool } from "./tool-context-CCeY3mrK.js";
 import { r as opsCompatibilityToken } from "./ops-settings-UN2oOKEp.js";
 import { n as detectDialect, s as confineInstalled } from "./dialects-CdlG3RF9.js";
@@ -20,11 +20,11 @@ function originalProcessArgv(argv) {
 }
 //#endregion
 //#region src/compat/process-result.ts
-const object$1 = (value) => typeof value === "object" && value !== null;
+const object$2 = (value) => typeof value === "object" && value !== null;
 const thenable = (value) => typeof value?.then === "function";
-const textOf = (value) => typeof value === "string" ? value : object$1(value) && typeof value.text === "string" ? value.text : "";
-const stderrOf = (value) => textOf(value.stderr) + (object$1(value.error) ? textOf(value.error.message) : "") + (object$1(value.failure) ? textOf(value.failure.message) : "");
-const exitCodeOf = (value) => typeof value.exitCode === "number" || value.exitCode === null ? value.exitCode : value.ok === false || object$1(value.error) || object$1(value.failure) ? 1 : 0;
+const textOf = (value) => typeof value === "string" ? value : object$2(value) && typeof value.text === "string" ? value.text : "";
+const stderrOf = (value) => textOf(value.stderr) + (object$2(value.error) ? textOf(value.error.message) : "") + (object$2(value.failure) ? textOf(value.failure.message) : "");
+const exitCodeOf = (value) => typeof value.exitCode === "number" || value.exitCode === null ? value.exitCode : value.ok === false || object$2(value.error) || object$2(value.failure) ? 1 : 0;
 /** Denial and runner-failure verdicts for one settled process — the same
 * non-zero-exit + stderr-signature rules the sandbox executors apply: a fatal
 * runner line is an infrastructure failure, never a policy denial. */
@@ -42,7 +42,7 @@ const classifyOutcome = (exitCode, stderr, facts) => {
 const sandboxStamp = (value, facts, policy, stderr) => {
 	const { denied, runnerFailed } = classifyOutcome(exitCodeOf(value), stderr ?? stderrOf(value), facts);
 	return {
-		...object$1(value.sandbox) ? value.sandbox : {},
+		...object$2(value.sandbox) ? value.sandbox : {},
 		mode: policy.mode,
 		enforcement: facts.enforcement,
 		denied,
@@ -50,7 +50,7 @@ const sandboxStamp = (value, facts, policy, stderr) => {
 	};
 };
 function stampProcessResult(value, facts, policy) {
-	if (!object$1(value)) return value;
+	if (!object$2(value)) return value;
 	return {
 		...value,
 		sandbox: sandboxStamp(value, facts, policy)
@@ -65,8 +65,8 @@ function stampProcessResult(value, facts, policy) {
 */
 const liveHandle = (value) => thenable(value.done) || typeof value.done === "function" || Object.values(value).some((member) => typeof member === "function") || Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null;
 function decorateProcessOutcome(value, facts, policy, diagnostics) {
-	if (object$1(value) && typeof value.then === "function") return value.then((result) => decorateProcessOutcome(result, facts, policy, diagnostics));
-	if (object$1(value) && typeof value.result === "function") {
+	if (object$2(value) && typeof value.then === "function") return value.then((result) => decorateProcessOutcome(result, facts, policy, diagnostics));
+	if (object$2(value) && typeof value.result === "function") {
 		let cached;
 		let settled = false;
 		wrapMethod(value, "result", (original) => function(...args) {
@@ -78,7 +78,7 @@ function decorateProcessOutcome(value, facts, policy, diagnostics) {
 		});
 		return value;
 	}
-	if (object$1(value) && liveHandle(value)) {
+	if (object$2(value) && liveHandle(value)) {
 		const settle = () => {
 			try {
 				value.sandbox = sandboxStamp(value, facts, policy, diagnostics?.stderr?.());
@@ -142,6 +142,58 @@ function isAsyncProcessEntry(entry) {
 	return typeof entry === "function" && entry.constructor.name === "AsyncFunction";
 }
 //#endregion
+//#region src/compat/forge-entrypoints.ts
+/**
+* The forge-bundle service entries an admission can wrap, in this order.
+* `worktrees.create`/`restore` take an `Agent` (the session rides on
+* `agent.session`); every listed `forgePanel` entry takes the `Session` as
+* its first argument. Entries not listed — background inspections, the
+* isolated `forge-worktree` instance inside the panel's mount group — stay
+* ledger-covered.
+*/
+const FORGE_PROCESS_SERVICES = [{
+	service: "worktrees",
+	keys: ["create", "restore"]
+}, {
+	service: "forgePanel",
+	keys: [
+		"branches",
+		"track",
+		"dismiss",
+		"refresh",
+		"localDiff",
+		"localText",
+		"changeRequestChecks",
+		"changeRequestDiff",
+		"changeRequestText",
+		"submitReview",
+		"markReady",
+		"merge",
+		"requestWorktree",
+		"cancelWorktree",
+		"stopCreation",
+		"retryWorktree",
+		"restoreWorktree",
+		"continueInProject"
+	]
+}];
+const object$1 = (value) => typeof value === "object" && value !== null;
+/**
+* Read the session a foreign-service entry resolves its policy from — the
+* first argument alone: a `Session`, or an `Agent`-shaped value carrying one.
+* The probe is deliberately structural and narrow (`id` + `header`): it is a
+* trust boundary over the upstream type, not a full validation — anything
+* else runs unadmitted rather than let `sandboxPolicy.resolve` read fields a
+* foreign argument lacks.
+* @param first - the wrapped call's first argument.
+* @returns the session, or `undefined` for a call that does not carry one.
+*/
+function sessionOf(first) {
+	const candidate = object$1(first) && object$1(first.session) ? first.session : first;
+	const isSession = (value) => object$1(value) && typeof value.id === "string" && object$1(value.header);
+	return isSession(candidate) ? candidate : void 0;
+}
+//#endregion
 //#region src/process-fence.ts
 /**
 * `multi-root-process-fence`: the B9 seam for the one cell `ctx.sandbox.confine`
@@ -305,7 +357,7 @@ function apply(ctx) {
 					if (hasConfinedProfile(spec.argv)) {
 						if (!(spec.argv.length > prefix.length && prefix.every((segment, index) => spec.argv[index] === segment))) throw new Error("multi-root workspace: a confined spawn inside an OPS execution domain must carry this domain's own profile");
 					} else argv = [...prefix, ...spec.argv];
-					if (opsScope.admissionRequired && (hasConfinedProfile(spec.argv) || prefix.length > 0) && !opsScope.permitsProfile(argv)) throw new Error("multi-root workspace: a confined spawn requires a profile from this live admission");
+					if (opsScope.admissionRequired && (hasConfinedProfile(spec.argv) || prefix.length > 0) && !opsScope.permitsOperationProfile(argv)) throw new Error("multi-root workspace: a confined spawn requires a profile from this live admission");
 				} else {
 					argv = store === void 0 ? spec.argv : [...store.argvPrefix, ...spec.argv];
 					if (scope.multiRootScope.admissionRequired && (store !== void 0 || hasConfinedProfile(argv)) && !scope.multiRootScope.permitsProfile(argv)) throw new Error("multi-root workspace: a confined spawn requires a profile from this live admission");
@@ -314,7 +366,7 @@ function apply(ctx) {
 					...spec,
 					argv
 				});
-				const handle = store !== void 0 || admissionScope.admissionRequired && admissionScope.permitsProfile(argv) ? withOpsSpawnPermit(opsState, launch) : launch();
+				const handle = store !== void 0 || admissionScope.admissionRequired && admissionScope.permitsOperationProfile(argv) ? withOpsSpawnPermit(opsState, launch) : launch();
 				if (store === void 0) return handle;
 				const stderr = object(handle) && object(handle.collected) && object(handle.collected.stderr) && typeof handle.collected.stderr.readFrom === "function" ? handle.collected.stderr : void 0;
 				if (stderr !== void 0) store.stderr = () => {
@@ -401,6 +453,37 @@ function apply(ctx) {
 		if (runtime === void 0) return;
 		for (const key of ptcEntrypoints(runtime)) deniedEntry(scope, runtime, key);
 	});
+	const admitCalls = (service, keys) => {
+		ctx.inject([service], (scope) => {
+			const target = scope.get(service);
+			if (target === void 0) return;
+			for (const key of keys) try {
+				if (!isAsyncProcessEntry(target[key])) {
+					if (key in target) ctx.logger.warn(`multi-root workspace: foreign process entry ${service}.${key} exists but is not wrappable and stays outside the admission; any confined spawn it performs relies on the ledger`);
+					continue;
+				}
+				scope.effect(() => wrapMethod(target, key, (original) => async function(first, ...rest) {
+					const session = sessionOf(first);
+					if (session === void 0) return original.call(this, first, ...rest);
+					const policy = ctx.sandboxPolicy.resolve({ session });
+					let ran = false;
+					try {
+						return await withRegistryAdmission(ctx, policy, "process", () => {
+							ran = true;
+							return original.call(this, first, ...rest);
+						});
+					} catch (error) {
+						if (ran) throw error;
+						ctx.logger.warn(`multi-root workspace: admission for ${service}.${key} is unavailable; running unadmitted: ${error instanceof Error ? error.message : String(error)}`);
+						return original.call(this, first, ...rest);
+					}
+				}));
+			} catch (error) {
+				ctx.logger.warn(`multi-root workspace: foreign process entry ${service}.${key} is not wrappable: ${error instanceof Error ? error.message : String(error)}`);
+			}
+		});
+	};
+	for (const { service, keys } of FORGE_PROCESS_SERVICES) admitCalls(service, keys);
 }
 //#endregion
 export { apply, inject };

package/lib/{registry-DyDNDSJZ.js → registry-BibiukWk.js}

@@ -1,4 +1,4 @@
-import { a as runPrimaryOperation, n as freezeOperationScope, o as runRegistryOperation } from "./registry-operation-C2ZV3Jhw.js";
+import { n as freezeOperationScope, o as runPrimaryOperation, s as runRegistryOperation } from "./registry-operation-CIlmt6_c.js";
 import { i as isWindowsNetworkOrDevicePath } from "./windows-runner-contract-B5R2K3mM.js";
 import { _ as samePath, a as classifyStoredRoots, d as primaryKey, f as protectedOverlap, h as resolveRootIndex, i as canonicalRoot, m as reservedRootBoundary, n as additionalRootId, p as removeStatusAt, s as expandRootInput, t as RootValidationError, u as markProtectedPaths, v as singleGrantOf, y as validateRootCandidate } from "./roots-CmaWxRVy.js";
 import { r as validateAliasId, t as migrateRootSkills } from "./metadata-99jgViHQ.js";

package/lib/{registry-operation-C2ZV3Jhw.js → registry-operation-CIlmt6_c.js}

@@ -10,6 +10,10 @@ function currentRegistryOperation(proof) {
 	const frame = operations.getStore();
 	return frame?.active === true && frame.proof === proof ? frame.operation : void 0;
 }
+function operationFrameState(proof) {
+	const frame = operations.getStore();
+	return frame === void 0 || frame.proof !== proof ? "absent" : frame.active === true ? "active" : "expired";
+}
 /** Capture by value: neither later publication nor a caller can mutate admission. */
 function freezeOperationScope(scope) {
 	return Object.freeze({
@@ -113,4 +117,4 @@ function operationPermitsProfile(proof, argv, capped) {
 	return frame?.active === true && frame.proof === proof && frame.profiles.some((profile) => profile.capped === capped && profile.argv.length <= argv.length && profile.argv.every((arg, i) => argv[i] === arg));
 }
 //#endregion
-export { runPrimaryOperation as a, withRegistryRead as c, rememberOperationProfile as i, freezeOperationScope as n, runRegistryOperation as o, operationPermitsProfile as r, withRegistryAdmission as s, currentRegistryOperation as t };
+export { rememberOperationProfile as a, withRegistryAdmission as c, operationPermitsProfile as i, withRegistryRead as l, freezeOperationScope as n, runPrimaryOperation as o, operationFrameState as r, runRegistryOperation as s, currentRegistryOperation as t };

package/lib/registry.js

@@ -1,3 +1,3 @@
-import { a as MultiRootRegistry, c as multiRootDomainSpec, i as MAX_ALIAS_LENGTH, n as DOMAIN_NAME, o as REGISTRY_CONTENDED_MESSAGE, r as MAX_ADDITIONAL_ROOTS_CEILING, s as TABLE_NAME, t as DEFAULT_MAX_ADDITIONAL_ROOTS } from "./registry-DyDNDSJZ.js";
+import { a as MultiRootRegistry, c as multiRootDomainSpec, i as MAX_ALIAS_LENGTH, n as DOMAIN_NAME, o as REGISTRY_CONTENDED_MESSAGE, r as MAX_ADDITIONAL_ROOTS_CEILING, s as TABLE_NAME, t as DEFAULT_MAX_ADDITIONAL_ROOTS } from "./registry-BibiukWk.js";
 import { o as nativeHostAvailability } from "./protocol-CwDnFEyK.js";
 export { DEFAULT_MAX_ADDITIONAL_ROOTS, DOMAIN_NAME, MAX_ADDITIONAL_ROOTS_CEILING, MAX_ALIAS_LENGTH, MultiRootRegistry, MultiRootRegistry as default, REGISTRY_CONTENDED_MESSAGE, TABLE_NAME, multiRootDomainSpec, nativeHostAvailability };

package/lib/{review-context-B-oHkU6a.js → review-context-OxO-fMWR.js}

@@ -1,5 +1,5 @@
 import { t as effectiveDirectory } from "./session-directory-BLOstut1.js";
-import { c as stableOpsJson, l as touchedPathOfToolCall, s as pendingInstructionTargets } from "./instructions-Ck9wp4J4.js";
+import { c as stableOpsJson, l as touchedPathOfToolCall, s as pendingInstructionTargets } from "./instructions-Ca80SkZq.js";
 import { r as opsCompatibilityToken } from "./ops-settings-UN2oOKEp.js";
 import { l as isCanonicallyUnder } from "./roots-CmaWxRVy.js";
 import { createHash } from "node:crypto";

package/lib/review-context.js

@@ -1,2 +1,2 @@
-import { t as MultiRootReviewContext } from "./review-context-B-oHkU6a.js";
+import { t as MultiRootReviewContext } from "./review-context-OxO-fMWR.js";
 export { MultiRootReviewContext, MultiRootReviewContext as default };

package/lib/{sandbox-CZElTNPz.js → sandbox-aobdyQGi.js}

@@ -105,8 +105,9 @@ var MultiRootSandboxProvider = class extends LocalSandboxProvider {
 	*/
 	confine(argv, policy, signal) {
 		const scope = this.ctx.multiRootScope.resolve(policy);
+		const mint = this.ctx.multiRootScope.captureMint(scope.authority !== "unavailable" ? "ambient" : policy.mode === "read-only" ? "read-only" : policy.mode === "workspace-write" ? "clamped" : "ambient");
 		const remember = (facts) => {
-			this.ctx.multiRootScope.rememberProfile(facts.argv);
+			this.ctx.multiRootScope.rememberProfile(facts.argv, mint);
 			return facts;
 		};
 		if (policy.mode === "workspace-write" && scope.authority === "unavailable") {
@@ -211,6 +212,7 @@ var MultiRootSandboxProvider = class extends LocalSandboxProvider {
 			workspaceRoot: policy.workspaceRoot,
 			...policy.sessionId === void 0 ? {} : { sessionId: policy.sessionId }
 		};
+		const mint = this.ctx.multiRootScope.captureMint("ambient");
 		const probe = super.confine.call(this, ["true"], probePolicy, signal);
 		const restrict = (confined) => {
 			try {
@@ -232,7 +234,7 @@ var MultiRootSandboxProvider = class extends LocalSandboxProvider {
 		};
 		return widenConfined(() => probe, (facts) => {
 			const result = restrict(facts);
-			this.ctx.multiRootScope.rememberProfile(result.argv);
+			this.ctx.multiRootScope.rememberProfile(result.argv, mint);
 			return result;
 		}, ["true"], probePolicy, signal);
 	}
@@ -253,6 +255,7 @@ var MultiRootSandboxProvider = class extends LocalSandboxProvider {
 			workspaceRoot: policy.workspaceRoot,
 			...policy.sessionId === void 0 ? {} : { sessionId: policy.sessionId }
 		};
+		const mint = this.ctx.multiRootScope.captureMint("clamped");
 		const probe = super.confine.call(this, ["true"], probePolicy, signal);
 		const clamp = (confined) => {
 			try {
@@ -269,7 +272,7 @@ var MultiRootSandboxProvider = class extends LocalSandboxProvider {
 		};
 		return widenConfined(() => probe, (facts) => {
 			const result = clamp(facts);
-			this.ctx.multiRootScope.rememberProfile(result.argv);
+			this.ctx.multiRootScope.rememberProfile(result.argv, mint);
 			return result;
 		}, ["true"], probePolicy, signal);
 	}

package/lib/sandbox.js

@@ -1,3 +1,3 @@
 import "./providers.js";
-import { t as MultiRootSandboxProvider } from "./sandbox-CZElTNPz.js";
+import { t as MultiRootSandboxProvider } from "./sandbox-aobdyQGi.js";
 export { MultiRootSandboxProvider, MultiRootSandboxProvider as default };

package/lib/scope.js

@@ -1,5 +1,5 @@
 import { t as wrapMethod } from "./method-wrapper-D4oUCsEF.js";
-import { i as rememberOperationProfile, r as operationPermitsProfile, t as currentRegistryOperation } from "./registry-operation-C2ZV3Jhw.js";
+import { a as rememberOperationProfile, i as operationPermitsProfile, r as operationFrameState, t as currentRegistryOperation } from "./registry-operation-CIlmt6_c.js";
 import { t as aroundTool } from "./tool-context-CCeY3mrK.js";
 import { r as opsCompatibilityToken } from "./ops-settings-UN2oOKEp.js";
 import { d as primaryKey } from "./roots-CmaWxRVy.js";
@@ -149,6 +149,8 @@ function renderWorkspaceRootsContext(options) {
 }
 /** The tool-dispatch cap carried across async boundaries by the waterfall. */
 const toolCapStore = new AsyncLocalStorage();
+/** Bounded process-wide ledger of unadmitted mints; a burst cannot grow it without bound. */
+const MAX_MINTED_PROFILES = 256;
 /**
 * The `ctx.multiRootScope` service. Providers ask it — never the filesystem —
 * what the current scope is, which is what keeps the fs fence and every kernel
@@ -165,6 +167,14 @@ var MultiRootScopeService = class extends Service {
 	batchDirty = false;
 	admissionProof;
 	/**
+	* The publication generation the mint ledger is keyed on: bumped when a
+	* root-table write or an authority transition changes the authorization
+	* basis (a repeat publish of identical content is not a publication), so a
+	* minted profile dies with the state it was computed from.
+	*/
+	publicationVersion = 0;
+	mintedProfiles = [];
+	/**
 	* The registry-authority fact the registry row publishes. Defaults to
 	* `available`: a composition without a registry row can never have
 	* registered roots, so nothing is unknown there. The registry sets it false
@@ -228,6 +238,11 @@ var MultiRootScopeService = class extends Service {
 		}
 		for (const listener of this.listeners) listener();
 	}
+	/** A publication superseded the authorization basis: every outstanding minted profile dies. */
+	bumpPublication() {
+		this.publicationVersion += 1;
+		this.mintedProfiles.length = 0;
+	}
 	/**
 	* The sorted names of the tools `toolAccess` caps — read-only for the
 	* prompt contribution. An invalid config is not enumerated (it caps every
@@ -298,7 +313,7 @@ var MultiRootScopeService = class extends Service {
 				const restore = wrapMethod(scoped.get("subprocess"), "spawn", (original) => {
 					const scope = this;
 					return function(spec) {
-						if (active && opsCompatibilityToken(scoped) !== void 0 && scope.hasActiveDenyRoots() && !opsSpawnPermitted(scope.opsProtection) && !(scope.admissionRequired && scope.admissionPathsValid() && scope.permitsProfile(spec.argv))) throw new Error("multi-root workspace: an unattributed subprocess has no protected execution or live profile admission; refusing launch while OPS compatibility write boundaries apply");
+						if (active && opsCompatibilityToken(scoped) !== void 0 && scope.hasActiveDenyRoots() && !opsSpawnPermitted(scope.opsProtection) && !(scope.admissionRequired && scope.admissionPathsValid() && scope.permitsOperationProfile(spec.argv))) throw new Error("multi-root workspace: an unattributed subprocess has no protected execution or live profile admission; refusing launch while OPS compatibility write boundaries apply");
 						return original.call(this, spec);
 					};
 				});
@@ -340,12 +355,74 @@ var MultiRootScopeService = class extends Service {
 	requireAdmission(proof) {
 		this.admissionProof = proof;
 	}
-	rememberProfile(argv) {
-		if (this.admissionProof !== void 0) rememberOperationProfile(this.admissionProof, argv, this.capped());
+	/**
+	* The stamp an asynchronously completing mint must carry: the publication
+	* generation and tool-cap basis at the mint's synchronous entry, before any
+	* provider probe could run. An in-flight mint that crosses a real
+	* publication keeps its entry generation, so the ledger refuses it rather
+	* than re-stamping stale authorization under the current publication.
+	* @param form - the profile form the mint will produce (`clamped` and
+	*   `read-only` are the only ledger-eligible forms).
+	*/
+	captureMint(form) {
+		return {
+			version: this.publicationVersion,
+			capped: this.capped(),
+			form
+		};
+	}
+	/**
+	* Record a confined profile this host's provider just minted. Only
+	* meaningful under the shared Registry (`admissionProof` set; without it
+	* `permitsProfile` never refuses): a live admission binds the profile to
+	* the operation and it dies with it; an expired admission never bequeaths
+	* one — a mint that outlived its operation is dropped, not demoted into
+	* the ledger; only with NO admission frame at all does the profile join
+	* the publication-keyed ledger stamped with `mint`, and only when the
+	* mint's form is primary-bounded — an `ambient` mint that arrives without
+	* a frame is dropped the same way.
+	* @param argv - the confined argv just minted.
+	* @param mint - the {@link captureMint} stamp taken at the mint's
+	*   synchronous entry.
+	*/
+	rememberProfile(argv, mint) {
+		if (this.admissionProof === void 0) return;
+		const frame = operationFrameState(this.admissionProof);
+		if (frame === "expired") return;
+		if (frame === "active") {
+			rememberOperationProfile(this.admissionProof, argv, mint.capped);
+			return;
+		}
+		if (mint.form === "ambient") return;
+		this.mintedProfiles.push({
+			argv: [...argv],
+			capped: mint.capped,
+			version: mint.version
+		});
+		if (this.mintedProfiles.length > MAX_MINTED_PROFILES) this.mintedProfiles.shift();
 	}
+	/**
+	* Whether a confined argv may launch now: a profile minted inside this live
+	* admission, or — for a `confine`→`spawn` composition with no wrapped entry
+	* to admit it — a profile this host minted while its authorization
+	* publication is still current. Cached argv, argv minted under a superseded
+	* publication, and argv minted elsewhere stay refused.
+	*/
 	permitsProfile(argv) {
+		return this.admissionProof === void 0 || this.permitsOperationProfile(argv) || this.permitsMintedProfile(argv);
+	}
+	/**
+	* The strict form: only profiles minted inside this live admission. The OPS
+	* execution domain owns its profile exclusively and never honors the
+	* unadmitted mint ledger.
+	*/
+	permitsOperationProfile(argv) {
 		return this.admissionProof === void 0 || operationPermitsProfile(this.admissionProof, argv, this.capped());
 	}
+	permitsMintedProfile(argv) {
+		const capped = this.capped(), version = this.publicationVersion;
+		return this.mintedProfiles.some((entry) => entry.version === version && entry.capped === capped && entry.argv.length > 0 && entry.argv.length <= argv.length && entry.argv.every((arg, index) => argv[index] === arg));
+	}
 	get admissionRequired() {
 		return this.admissionProof !== void 0;
 	}
@@ -498,6 +575,7 @@ var MultiRootScopeService = class extends Service {
 	*/
 	setAdditionalRoots(primaryRoot, roots) {
 		const key = primaryKey(primaryRoot);
+		if (!sameAdditionalRoots(this.rootsByPrimary.get(key) ?? [], roots)) this.bumpPublication();
 		if (roots.length === 0) this.rootsByPrimary.delete(key);
 		else this.rootsByPrimary.set(key, [...roots]);
 		this.notifySubscribers();
@@ -517,8 +595,17 @@ var MultiRootScopeService = class extends Service {
 		const next = available ? "available" : "unavailable";
 		if (this.registryAuthority === next) return;
 		this.registryAuthority = next;
+		this.bumpPublication();
 		this.notifySubscribers();
 	}
 };
+/** Whether two persisted member lists carry the same authorization basis, in registry order. */
+function sameAdditionalRoots(a, b) {
+	if (a.length !== b.length) return false;
+	return a.every((root, index) => {
+		const next = b[index];
+		return next !== void 0 && root.id === next.id && root.path === next.path && root.recordedPath === next.recordedPath && root.access === next.access && root.withheld === next.withheld && root.alias === next.alias;
+	});
+}
 //#endregion
 export { MULTI_ROOT_CONTEXT_NAME, MultiRootScopeService, MultiRootScopeService as default, REGISTRY_UNAVAILABLE_NOTE, renderWorkspaceRootsContext, sanitizeAdditionalRoots };

package/lib/skills.js

@@ -1,5 +1,5 @@
 import { t as wrapMethod } from "./method-wrapper-D4oUCsEF.js";
-import { c as withRegistryRead } from "./registry-operation-C2ZV3Jhw.js";
+import { l as withRegistryRead } from "./registry-operation-CIlmt6_c.js";
 import { t as createInstructionMessage } from "./llm-message-CepyzEBQ.js";
 import { n as skillsMetadataValid } from "./metadata-99jgViHQ.js";
 import { a as skillOrigin, i as skillAgent, n as filesystemSkillsApi, o as volatileField, r as observedSkillOrigin, t as configValue } from "./skills-utyuvmwr.js";