@dsh-electron/dsh-plugin-multi-root-workspace 0.1.15 → 0.1.16

package/lib/types/compat/forge-entrypoints.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Compatibility adapter: which foreign-service entries the process fence can
+ * admit.
+ *
+ * The upstream experimental forge bundle composes `ctx.sandbox.confine` +
+ * `ctx.subprocess.spawn` on its own code paths — the panel's Git reads and the
+ * worktree service's creation/restore commands — bypassing every wrapped
+ * executor seam the admission already reaches. The fence therefore wraps each
+ * reachable async public entry with an ordered admission of its own. Which
+ * services and keys exist is a per-release shape: the verified baseline here
+ * is `@deepseek-ai/dsh-experimental-forge-bundle@0.2.2-rc.1` (which pins
+ * `dsh-experimental-worktree` and `dsh-experimental-client-ui-forge` at the
+ * same version), and the `follow`/`changeRequestStates` async generators are
+ * deliberately absent — a generator cannot hold a synchronous admission, so
+ * its detached work falls back to the minted-profile ledger.
+ *
+ * @module @dsh-electron/dsh-plugin-multi-root-workspace/compat/forge-entrypoints
+ */
+import type { Session } from '@deepseek-ai/dsh-session';
+/** One foreign service whose public entries spawn confined processes. */
+export interface ForeignProcessService {
+    readonly service: string;
+    readonly keys: readonly string[];
+}
+/**
+ * The forge-bundle service entries an admission can wrap, in this order.
+ * `worktrees.create`/`restore` take an `Agent` (the session rides on
+ * `agent.session`); every listed `forgePanel` entry takes the `Session` as
+ * its first argument. Entries not listed — background inspections, the
+ * isolated `forge-worktree` instance inside the panel's mount group — stay
+ * ledger-covered.
+ */
+export declare const FORGE_PROCESS_SERVICES: readonly ForeignProcessService[];
+/**
+ * Read the session a foreign-service entry resolves its policy from — the
+ * first argument alone: a `Session`, or an `Agent`-shaped value carrying one.
+ * The probe is deliberately structural and narrow (`id` + `header`): it is a
+ * trust boundary over the upstream type, not a full validation — anything
+ * else runs unadmitted rather than let `sandboxPolicy.resolve` read fields a
+ * foreign argument lacks.
+ * @param first - the wrapped call's first argument.
+ * @returns the session, or `undefined` for a call that does not carry one.
+ */
+export declare function sessionOf(first: unknown): Session | undefined;

package/lib/types/compat/session-existence.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Compatibility adapter for "does this session exist in durable storage".
+ *
+ * The panel session anchor (ADR-0008) is a live Session in this process's
+ * `SessionStore`. A persisted session owned by another Host — or one still
+ * mid-resume — never enters that store, so `resolvePanelPrimaryRoot` and the
+ * `rootsViewOf` re-check both answer `session-not-found`. That code is true
+ * but diagnostically wrong when the session exists: the panel copy asked the
+ * user to open a session already on screen.
+ *
+ * `sessionPersistence.stat(id)` is the cheapest probe of the durable fact:
+ * it reads only the session header — never the event log, never the
+ * cross-process write lease — and reports `undefined` for an absent id.
+ * This module isolates the probe because the fact's meaning differs by
+ * outcome:
+ *
+ * - snapshot returned → the session exists (writer-held elsewhere, still
+ *   resuming, or needing a format migration — `stat` reports the header in
+ *   every one of those states): reclassify as `session-not-live`;
+ * - `undefined` → the session does not exist in this backend: keep
+ *   `session-not-found`;
+ * - service or `stat` absent (a composition without persistence, or a
+ *   runtime whose backend does not name it) → `false`: the probe cannot
+ *   prove existence, so the caller keeps the code it already had;
+ * - `stat` throws → `false`, same conservatism. One imprecision survives:
+ *   a session that exists but whose header cannot be read (corrupt durable
+ *   state, a broken backend) is reported as not-found rather than not-live —
+ *   identical to the pre-probe behavior, and preferable to claiming
+ *   existence the probe failed to prove.
+ *
+ * @module @dsh-electron/dsh-plugin-multi-root-workspace/compat/session-existence
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/**
+ * Whether `sessionId` exists in the mounted persistence backend.
+ * @param ctx - the plugin fiber context; optional services read via `ctx.get`.
+ * @param sessionId - the panel request's session id.
+ * @param signal - the request's cancellation, forwarded when the backend takes options.
+ * @returns `true` only when a snapshot proves the session exists.
+ */
+export declare function persistedSessionExists(ctx: Context, sessionId: string, signal?: AbortSignal): Promise<boolean>;

package/lib/types/registry-operation.d.ts

@@ -2,6 +2,13 @@ import type { SandboxMode } from '@deepseek-ai/dsh-sandbox';
 import type { FilesystemScope } from './scope.ts';
 export type RegistryOperationKind = 'fs-write' | 'fs-edit' | 'process' | 'pty' | 'lsp' | 'files' | 'instructions' | 'skills';
 export declare function currentRegistryOperation(proof: object): RegistryOperation | undefined;
+/**
+ * The enclosing admission frame's mint disposition for this proof. `expired`
+ * frames still occupy the async context of their descendants; an expired
+ * admission must never bequeath a launchable profile.
+ */
+export type OperationFrameState = 'active' | 'expired' | 'absent';
+export declare function operationFrameState(proof: object): OperationFrameState;
 export interface RegistryOperationIdentity {
     readonly operationId: string;
     readonly kind: RegistryOperationKind;

package/lib/types/roots.d.ts

@@ -202,7 +202,9 @@ export type RootRef = {
     readonly addedAt: string;
 };
 /** Every way root handling can fail, as a stable code the surfaces localize. */
-export type RootValidationCode = 'not-absolute' | 'missing' | 'not-a-directory' | 'equals-primary' | 'primary-overlap' | 'duplicate' | 'nested' | 'invalid-alias' | 'invalid-alias-id' | 'not-found' | 'invalid-ref' | 'storage-unavailable' | 'registry-contended' | 'root-limit-reached' | 'config-invalid' | 'reveal-unavailable' | 'session-not-found' | 'unsupported-path' | 'root-unavailable' | 'protected-path' | 'protected-boundary-unknown' | 'revive-target-changed';
+export type RootValidationCode = 'not-absolute' | 'missing' | 'not-a-directory' | 'equals-primary' | 'primary-overlap' | 'duplicate' | 'nested' | 'invalid-alias' | 'invalid-alias-id' | 'not-found' | 'invalid-ref' | 'storage-unavailable' | 'registry-contended' | 'root-limit-reached' | 'config-invalid' | 'reveal-unavailable' | 'session-not-found'
+/** Synthesized at the panel dispatch catch — the session existed but could not resolve a root during the request (writer-held, mid-resume, or a race resolved after the throw); no RootValidationError is constructed with it. */
+ | 'session-not-live' | 'unsupported-path' | 'root-unavailable' | 'protected-path' | 'protected-boundary-unknown' | 'revive-target-changed';
 /** A rejected root operation; `code` is the stable contract, `message` the fallback prose. */
 export declare class RootValidationError extends Error {
     readonly code: RootValidationCode;

package/lib/types/scope.d.ts

@@ -200,6 +200,24 @@ export interface Config {
      */
     readonly dshHome?: string;
 }
+/**
+ * The baseline a mint resolved to. Only primary-bounded forms may join the
+ * unadmitted ledger: `clamped` (primary-root clamp) and `read-only` (the
+ * upstream read-only skeleton — never writable). `ambient` mints —
+ * `restrictedExecution`'s ambient-minus-denies profile, and any mint whose
+ * scope could not be proven unavailable — may only live bound to an
+ * admission frame, and otherwise die.
+ */
+export type MintForm = 'clamped' | 'read-only' | 'ambient';
+/** The authorization basis a mint carried at its synchronous entry, stamped onto its ledger entry. */
+export interface MintStamp {
+    /** Publication generation the mint's authorization snapshot was resolved under. */
+    readonly version: number;
+    /** Tool-cap basis at the same instant. */
+    readonly capped: boolean;
+    /** The profile form the mint produced; gates ledger admission. */
+    readonly form: MintForm;
+}
 /**
  * The `ctx.multiRootScope` service. Providers ask it — never the filesystem —
  * what the current scope is, which is what keeps the fs fence and every kernel
@@ -215,6 +233,14 @@ export declare class MultiRootScopeService extends Service {
     /** True when a batched write coalesced its notification into the flush. */
     private batchDirty;
     private admissionProof;
+    /**
+     * The publication generation the mint ledger is keyed on: bumped when a
+     * root-table write or an authority transition changes the authorization
+     * basis (a repeat publish of identical content is not a publication), so a
+     * minted profile dies with the state it was computed from.
+     */
+    private publicationVersion;
+    private mintedProfiles;
     /**
      * The registry-authority fact the registry row publishes. Defaults to
      * `available`: a composition without a registry row can never have
@@ -258,6 +284,8 @@ export declare class MultiRootScopeService extends Service {
     batch<T>(body: () => T): T;
     /** Notify subscribers now, or coalesce into the enclosing batch's flush. */
     private notifySubscribers;
+    /** A publication superseded the authorization basis: every outstanding minted profile dies. */
+    private bumpPublication;
     /**
      * The sorted names of the tools `toolAccess` caps — read-only for the
      * prompt contribution. An invalid config is not enumerated (it caps every
@@ -288,8 +316,46 @@ export declare class MultiRootScopeService extends Service {
      * @returns the canonical scope; `additionalRoots` is empty when none are registered.
      */
     requireAdmission(proof: object): void;
-    rememberProfile(argv: readonly string[]): void;
+    /**
+     * The stamp an asynchronously completing mint must carry: the publication
+     * generation and tool-cap basis at the mint's synchronous entry, before any
+     * provider probe could run. An in-flight mint that crosses a real
+     * publication keeps its entry generation, so the ledger refuses it rather
+     * than re-stamping stale authorization under the current publication.
+     * @param form - the profile form the mint will produce (`clamped` and
+     *   `read-only` are the only ledger-eligible forms).
+     */
+    captureMint(form: MintForm): MintStamp;
+    /**
+     * Record a confined profile this host's provider just minted. Only
+     * meaningful under the shared Registry (`admissionProof` set; without it
+     * `permitsProfile` never refuses): a live admission binds the profile to
+     * the operation and it dies with it; an expired admission never bequeaths
+     * one — a mint that outlived its operation is dropped, not demoted into
+     * the ledger; only with NO admission frame at all does the profile join
+     * the publication-keyed ledger stamped with `mint`, and only when the
+     * mint's form is primary-bounded — an `ambient` mint that arrives without
+     * a frame is dropped the same way.
+     * @param argv - the confined argv just minted.
+     * @param mint - the {@link captureMint} stamp taken at the mint's
+     *   synchronous entry.
+     */
+    rememberProfile(argv: readonly string[], mint: MintStamp): void;
+    /**
+     * Whether a confined argv may launch now: a profile minted inside this live
+     * admission, or — for a `confine`→`spawn` composition with no wrapped entry
+     * to admit it — a profile this host minted while its authorization
+     * publication is still current. Cached argv, argv minted under a superseded
+     * publication, and argv minted elsewhere stay refused.
+     */
     permitsProfile(argv: readonly string[]): boolean;
+    /**
+     * The strict form: only profiles minted inside this live admission. The OPS
+     * execution domain owns its profile exclusively and never honors the
+     * unadmitted mint ledger.
+     */
+    permitsOperationProfile(argv: readonly string[]): boolean;
+    private permitsMintedProfile;
     get admissionRequired(): boolean;
     admissionPathsValid(): boolean;
     hasAdmission(): boolean;

package/lib/workspace-files.js

@@ -1,5 +1,5 @@
 import { t as wrapMethod } from "./method-wrapper-D4oUCsEF.js";
-import { c as withRegistryRead } from "./registry-operation-C2ZV3Jhw.js";
+import { l as withRegistryRead } from "./registry-operation-CIlmt6_c.js";
 import { l as isCanonicallyUnder } from "./roots-CmaWxRVy.js";
 import { t as routeWorkspacePath } from "./workspace-routing-D_qwMUh-.js";
 import { posix, resolve, win32 } from "node:path";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dsh-electron/dsh-plugin-multi-root-workspace",
   "description": "Multi-root Workspace for DeepSeek Harness: adds N additional roots to the workspace sandbox scope as an out-of-tree bundle",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",